sibujs 3.1.0 → 3.2.1

package/dist/{chunk-SVVAUX7J.js → chunk-7XDYVJLE.js}

@@ -3,18 +3,18 @@ import {
 } from "./chunk-2UPRY23K.js";
 import {
   stripHtml
-} from "./chunk-UCS6AMJ7.js";
+} from "./chunk-HMJFCBRR.js";
 import {
   effect
-} from "./chunk-ZIBE2SAT.js";
+} from "./chunk-FDY42FIU.js";
 import {
   signal
-} from "./chunk-RK4BQG25.js";
+} from "./chunk-C427DVQF.js";
 import {
   forEachSubscriber,
   getSubscriberCount,
   getSubscriberDeps
-} from "./chunk-3U4ZVXVD.js";
+} from "./chunk-Z2FWAE4B.js";
 import {
   isDev
 } from "./chunk-LMLD24FC.js";
@@ -22,6 +22,7 @@ import {
 // src/devtools/debug.ts
 var debugEnabled = false;
 var perfMarks = /* @__PURE__ */ new Map();
+var MAX_PERF_SAMPLES = 1e3;
 function enableDebug() {
   debugEnabled = true;
   console.log("[SibuJS] Debug mode enabled");
@@ -46,7 +47,11 @@ function perfTracker(label) {
   }
   function endMeasure() {
     const elapsed = globalThis.performance.now() - startTime;
-    perfMarks.get(label)?.push(elapsed);
+    const marks = perfMarks.get(label);
+    if (marks) {
+      marks.push(elapsed);
+      if (marks.length > MAX_PERF_SAMPLES) marks.shift();
+    }
     if (debugEnabled) {
       debugLog("Perf", `${label}: ${elapsed.toFixed(2)}ms`);
     }
@@ -1000,7 +1005,7 @@ function withErrorTracking(name, component, reporter) {
     }
   };
 }
-function formatError(error, context) {
+function formatError(error, context, seen = /* @__PURE__ */ new Set([error])) {
   const lines = [];
   const componentLabel = context?.component ?? (error instanceof SibuError ? error.component : void 0);
   if (componentLabel) {
@@ -1025,10 +1030,11 @@ function formatError(error, context) {
     lines.push(stackBody);
   }
   const cause = error.cause;
-  if (cause instanceof Error) {
+  if (cause instanceof Error && !seen.has(cause)) {
+    seen.add(cause);
     lines.push("");
     lines.push("Caused by:");
-    lines.push(formatError(cause));
+    lines.push(formatError(cause, context, seen));
   }
   return lines.join("\n");
 }
@@ -1042,7 +1048,11 @@ function debugValue(value, formatter) {
   const dispose2 = effect(() => {
     const resolved = value();
     entry.value = resolved;
-    entry.label = format(resolved);
+    try {
+      entry.label = format(resolved);
+    } catch (err) {
+      entry.label = `<format error: ${err instanceof Error ? err.message : String(err)}>`;
+    }
   });
   return () => {
     dispose2();

package/dist/{chunk-2N2UL7O4.js → chunk-BGNLPNGV.js}

@@ -3,23 +3,35 @@ import {
 } from "./chunk-3JHCYHWN.js";
 import {
   tagFactory
-} from "./chunk-WKUXSE7V.js";
+} from "./chunk-X67UYC74.js";
 import {
   derived
-} from "./chunk-SC437AMI.js";
+} from "./chunk-JYXOEYI4.js";
 import {
   effect
-} from "./chunk-ZIBE2SAT.js";
+} from "./chunk-FDY42FIU.js";
 import {
   batch,
   signal
-} from "./chunk-RK4BQG25.js";
+} from "./chunk-C427DVQF.js";
 
 // src/ecosystem/adapters/mobx.ts
 function mobXAdapter(options) {
   return createPlugin("sibu-mobx", (ctx) => {
     const { autorun } = options;
     const disposers = [];
+    function trackDisposer(rawDispose) {
+      let done = false;
+      const wrapped = () => {
+        if (done) return;
+        done = true;
+        const i = disposers.indexOf(wrapped);
+        if (i >= 0) disposers.splice(i, 1);
+        rawDispose();
+      };
+      disposers.push(wrapped);
+      return wrapped;
+    }
     function fromMobX(expression) {
       const [getValue, setValue] = signal(void 0);
       const disposer = autorun(() => {
@@ -28,22 +40,18 @@ function mobXAdapter(options) {
           setValue(newValue);
         });
       });
-      disposers.push(disposer);
       const getter = (() => getValue());
-      getter.dispose = () => {
-        const i = disposers.indexOf(disposer);
-        if (i >= 0) disposers.splice(i, 1);
-        disposer();
-      };
+      getter.dispose = trackDisposer(disposer);
       return getter;
     }
     function toMobX(sibuGetter, callback) {
-      return effect(() => {
+      const stop = effect(() => {
         callback(sibuGetter());
       });
+      return trackDisposer(stop);
     }
     function destroy() {
-      for (const disposer of disposers) {
+      for (const disposer of [...disposers]) {
         disposer();
       }
       disposers.length = 0;

package/dist/{chunk-RK4BQG25.js → chunk-C427DVQF.js}

@@ -3,7 +3,7 @@ import {
   notifySubscribers,
   queueSignalNotification,
   recordDependency
-} from "./chunk-3U4ZVXVD.js";
+} from "./chunk-Z2FWAE4B.js";
 import {
   isDev
 } from "./chunk-LMLD24FC.js";

package/dist/{chunk-ZIBE2SAT.js → chunk-FDY42FIU.js}

@@ -1,11 +1,11 @@
 import {
   isSSR
-} from "./chunk-2RA7SHDA.js";
+} from "./chunk-GOJMFRBL.js";
 import {
   cleanup,
   retrack,
   untracked
-} from "./chunk-3U4ZVXVD.js";
+} from "./chunk-Z2FWAE4B.js";
 import {
   devAssert
 } from "./chunk-LMLD24FC.js";
@@ -111,6 +111,7 @@ function effect(effectFn, options) {
     ctx.fn(ctx.onCleanup);
   };
   const sub = (() => {
+    if (ctx.disposed) return;
     if (ctx.running) {
       ctx.rerunPending = true;
       return;

package/dist/{chunk-GQ7RRFPU.js → chunk-FOI23UJL.js}

@@ -1,6 +1,6 @@
 import {
   signal
-} from "./chunk-RK4BQG25.js";
+} from "./chunk-C427DVQF.js";
 
 // src/ui/transition.ts
 function transition(element, options = {}) {
@@ -17,11 +17,17 @@ function transition(element, options = {}) {
   } = options;
   const transitionValue = `${property} ${duration}ms ${easing} ${delay}ms`;
   let activeTimer = null;
+  let pendingResolve = null;
   function cancelPending() {
     if (activeTimer !== null) {
       clearTimeout(activeTimer);
       activeTimer = null;
     }
+    if (pendingResolve !== null) {
+      const resolvePrev = pendingResolve;
+      pendingResolve = null;
+      resolvePrev();
+    }
   }
   function enter() {
     return new Promise((resolve) => {
@@ -33,11 +39,13 @@ function transition(element, options = {}) {
       if (activeClass) element.classList.add(activeClass);
       const done = () => {
         activeTimer = null;
+        pendingResolve = null;
         if (enterClass) element.classList.remove(enterClass);
         onEnterDone?.();
         resolve();
       };
       if (duration > 0) {
+        pendingResolve = resolve;
         activeTimer = setTimeout(done, duration + delay);
       } else {
         done();
@@ -53,11 +61,13 @@ function transition(element, options = {}) {
       if (enterClass) element.classList.remove(enterClass);
       const done = () => {
         activeTimer = null;
+        pendingResolve = null;
         if (leaveClass) element.classList.remove(leaveClass);
         onLeaveDone?.();
         resolve();
       };
       if (duration > 0) {
+        pendingResolve = resolve;
         activeTimer = setTimeout(done, duration + delay);
       } else {
         done();

package/dist/{chunk-2RA7SHDA.js → chunk-GOJMFRBL.js}

@@ -2,11 +2,15 @@
 var als = null;
 try {
   if (typeof process !== "undefined" && process.versions && process.versions.node) {
-    const req = Function("return typeof require==='function'?require:null")();
-    if (req) {
-      const mod = req("node:async_hooks");
-      als = new mod.AsyncLocalStorage();
+    let mod = null;
+    const getBuiltin = process.getBuiltinModule;
+    if (typeof getBuiltin === "function") {
+      mod = getBuiltin("node:async_hooks");
+    } else {
+      const req = Function("return typeof require==='function'?require:null")();
+      if (req) mod = req("node:async_hooks");
     }
+    if (mod) als = new mod.AsyncLocalStorage();
   }
 } catch {
   als = null;
@@ -22,6 +26,17 @@ function getSSRStore() {
 function isSSR() {
   return getSSRStore().ssr;
 }
+function getRequestScopedCache(name) {
+  if (!isSSR()) return null;
+  const store = getSSRStore();
+  const caches = store.caches ?? (store.caches = /* @__PURE__ */ new Map());
+  let c = caches.get(name);
+  if (!c) {
+    c = /* @__PURE__ */ new Map();
+    caches.set(name, c);
+  }
+  return c;
+}
 function enableSSR() {
   getSSRStore().ssr = true;
 }
@@ -58,6 +73,7 @@ function withSSR(fn) {
 export {
   getSSRStore,
   isSSR,
+  getRequestScopedCache,
   enableSSR,
   disableSSR,
   runInSSRContext,

package/dist/{chunk-IVOUCSZL.js → chunk-GOUM4JCT.js}

@@ -1,10 +1,13 @@
+import {
+  isUnsafeKey
+} from "./chunk-H3SRKIYX.js";
 import {
   effect
-} from "./chunk-ZIBE2SAT.js";
+} from "./chunk-FDY42FIU.js";
 import {
   batch,
   signal
-} from "./chunk-RK4BQG25.js";
+} from "./chunk-C427DVQF.js";
 
 // src/browser/media.ts
 function media(query) {
@@ -399,10 +402,7 @@ function dropZone(element, options) {
         const raw = e.dataTransfer.getData("application/json");
         if (raw) {
           try {
-            transferData = JSON.parse(
-              raw,
-              (k, v) => k === "__proto__" || k === "constructor" || k === "prototype" ? void 0 : v
-            );
+            transferData = JSON.parse(raw, (k, v) => isUnsafeKey(k) ? void 0 : v);
           } catch {
             transferData = raw;
           }

package/dist/chunk-H3SRKIYX.js

@@ -0,0 +1,17 @@
+// src/utils/guards.ts
+var UNSAFE_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+function isUnsafeKey(key) {
+  return UNSAFE_KEYS.has(key);
+}
+function stripUnsafeKeys(obj) {
+  const out = {};
+  for (const k of Object.keys(obj)) {
+    if (!isUnsafeKey(k)) out[k] = obj[k];
+  }
+  return out;
+}
+
+export {
+  isUnsafeKey,
+  stripUnsafeKeys
+};

package/dist/{chunk-3DJH25UO.js → chunk-H6PCHJZQ.js}

@@ -1,9 +1,9 @@
 import {
   isSSR
-} from "./chunk-2RA7SHDA.js";
+} from "./chunk-GOJMFRBL.js";
 import {
   track
-} from "./chunk-3U4ZVXVD.js";
+} from "./chunk-Z2FWAE4B.js";
 import {
   devAssert
 } from "./chunk-LMLD24FC.js";

package/dist/{chunk-UCS6AMJ7.js → chunk-HMJFCBRR.js}

@@ -1,7 +1,15 @@
 // src/utils/sanitize.ts
+function stripControlChars(value) {
+  return value.replace(/[\x00-\x20\x7f-\x9f]+/g, "");
+}
+function isEventHandlerAttr(name) {
+  if (name.length < 3) return false;
+  const lower = name.toLowerCase();
+  return lower[0] === "o" && lower[1] === "n" && lower.charCodeAt(2) >= 97 && lower.charCodeAt(2) <= 122;
+}
 var SAFE_URL_PROTOCOLS = ["http:", "https:", "mailto:", "tel:", "ftp:"];
 function sanitizeUrl(url) {
-  const trimmed = url.replace(/[\x00-\x20\x7f-\x9f]+/g, "").trim();
+  const trimmed = stripControlChars(url).trim();
   if (!trimmed) return "";
   const lower = trimmed.toLowerCase();
   let schemeEnd = -1;
@@ -50,7 +58,20 @@ function sanitizeCSSValue(value) {
   return value;
 }
 function stripHtml(html) {
-  return String(html).replace(/<[^>]*>/g, "");
+  const input = String(html);
+  if (typeof DOMParser !== "undefined") {
+    try {
+      return new DOMParser().parseFromString(input, "text/html").body.textContent ?? "";
+    } catch {
+    }
+  }
+  let prev;
+  let out = input;
+  do {
+    prev = out;
+    out = out.replace(/<[^>]*>/g, "");
+  } while (out !== prev);
+  return out.replace(/<[^>]*$/, "");
 }
 var URL_ATTRIBUTES = /* @__PURE__ */ new Set([
   "href",
@@ -67,10 +88,12 @@ var URL_ATTRIBUTES = /* @__PURE__ */ new Set([
   "data"
 ]);
 function isUrlAttribute(attr) {
-  return URL_ATTRIBUTES.has(attr);
+  return URL_ATTRIBUTES.has(attr.toLowerCase());
 }
 
 export {
+  stripControlChars,
+  isEventHandlerAttr,
   sanitizeUrl,
   sanitizeSrcset,
   sanitizeCSSValue,

package/dist/{chunk-JYD2PWXH.js → chunk-HXMS4SNP.js}

@@ -1,24 +1,25 @@
 import {
-  sanitizeUrl
-} from "./chunk-UCS6AMJ7.js";
+  isEventHandlerAttr,
+  sanitizeSrcset,
+  sanitizeUrl,
+  stripControlChars
+} from "./chunk-HMJFCBRR.js";
 import {
   getSSRStore
-} from "./chunk-2RA7SHDA.js";
+} from "./chunk-GOJMFRBL.js";
 import {
   isDev
 } from "./chunk-LMLD24FC.js";
 
 // src/platform/ssr.ts
+function sanitizeUrlAttr(name, value) {
+  return name === "srcset" ? sanitizeSrcset(value) : sanitizeUrl(value);
+}
 var _isDev = isDev();
 var SAFE_ATTR_NAME = /^[A-Za-z_:][-A-Za-z0-9_.:]*$/;
 function isSafeAttrName(name) {
   return SAFE_ATTR_NAME.test(name);
 }
-function isEventHandlerAttr(name) {
-  if (name.length < 3) return false;
-  const lower = name.toLowerCase();
-  return lower[0] === "o" && lower[1] === "n" && lower.charCodeAt(2) >= 97 && lower.charCodeAt(2) <= 122;
-}
 var URL_ATTRS = /* @__PURE__ */ new Set([
   "href",
   "src",
@@ -93,7 +94,7 @@ function renderToString(element) {
     const lowerName = rawName.toLowerCase();
     let value = attr.value;
     if (URL_ATTRS.has(lowerName)) {
-      value = sanitizeUrl(value);
+      value = sanitizeUrlAttr(lowerName, value);
       if (!value) continue;
     }
     html += ` ${rawName}="${escapeAttr(value)}"`;
@@ -234,7 +235,7 @@ function buildAttrString(attrs, { allowEventHandlers = false } = {}) {
     const lowerKey = rawKey.toLowerCase();
     let value = String(attrs[rawKey]);
     if (URL_ATTRS.has(lowerKey)) {
-      value = sanitizeUrl(value);
+      value = sanitizeUrlAttr(lowerKey, value);
       if (!value) continue;
     }
     out.push(`${rawKey}="${escapeAttr(value)}"`);
@@ -242,12 +243,17 @@ function buildAttrString(attrs, { allowEventHandlers = false } = {}) {
   return out.join(" ");
 }
 function isDangerousMetaRefresh(metaProps) {
-  const httpEquiv = metaProps["http-equiv"];
+  let httpEquiv;
+  let content;
+  for (const k in metaProps) {
+    const lk = k.toLowerCase();
+    if (lk === "http-equiv") httpEquiv = metaProps[k];
+    else if (lk === "content") content = metaProps[k];
+  }
   if (typeof httpEquiv !== "string") return false;
   if (httpEquiv.toLowerCase() !== "refresh") return false;
-  const content = metaProps.content;
   if (typeof content !== "string") return false;
-  const normalized = content.replace(/[\x00-\x20\x7f-\x9f]+/g, "").toLowerCase();
+  const normalized = stripControlChars(content).toLowerCase();
   return normalized.includes("url=javascript:") || normalized.includes("url=data:") || normalized.includes("url=vbscript:") || normalized.includes("url=blob:");
 }
 function renderToDocument(component, options = {}) {
@@ -329,7 +335,7 @@ async function* renderToStream(element) {
     const lowerName = rawName.toLowerCase();
     let value = attr.value;
     if (URL_ATTRS.has(lowerName)) {
-      value = sanitizeUrl(value);
+      value = sanitizeUrlAttr(lowerName, value);
       if (!value) continue;
     }
     openTag += ` ${rawName}="${escapeAttr(value)}"`;
@@ -406,11 +412,11 @@ function hydrateProgressively(container, islands, options) {
       (entries) => {
         for (const entry of entries) {
           if (entry.isIntersecting) {
+            observer.disconnect();
             const clientTree = factory();
             clientTree.setAttribute("data-sibu-island", id);
             clientTree.setAttribute("data-sibu-hydrated", "true");
             marker.replaceWith(clientTree);
-            observer.disconnect();
             break;
           }
         }
@@ -519,6 +525,7 @@ export {
   renderToString,
   hydrate,
   trustHTML,
+  isDangerousMetaRefresh,
   renderToDocument,
   renderToStream,
   collectStream,

package/dist/{chunk-SC437AMI.js → chunk-JYXOEYI4.js}

@@ -3,7 +3,7 @@ import {
   retrack,
   track,
   trackingSuspended
-} from "./chunk-3U4ZVXVD.js";
+} from "./chunk-Z2FWAE4B.js";
 import {
   devAssert
 } from "./chunk-LMLD24FC.js";
@@ -15,6 +15,7 @@ function derived(getter, options) {
   const equals = options?.equals;
   const cs = {};
   cs._d = false;
+  cs._init = false;
   cs._g = getter;
   cs.__v = 0;
   const markDirty = () => {
@@ -23,11 +24,18 @@ function derived(getter, options) {
   };
   markDirty._c = 1;
   markDirty._sig = cs;
+  const recompute = () => {
+    const next = getter();
+    cs._v = equals && cs._init ? equals(cs._v, next) ? cs._v : next : next;
+    cs._d = false;
+    cs._init = true;
+  };
   track(() => {
     let threw = true;
     try {
       cs._v = getter();
       cs._d = false;
+      cs._init = true;
       threw = false;
     } finally {
       if (threw) cs._d = true;
@@ -43,20 +51,13 @@ function derived(getter, options) {
     }
     if (trackingSuspended) {
       if (cs._d) {
+        const prev = cs._v;
         evaluating = true;
-        let threw = true;
         try {
-          const prev = cs._v;
-          retrack(() => {
-            const next = getter();
-            cs._v = equals && cs._v !== void 0 ? equals(cs._v, next) ? cs._v : next : next;
-            cs._d = false;
-            threw = false;
-          }, markDirty);
+          retrack(recompute, markDirty);
           if (!Object.is(prev, cs._v)) cs.__v++;
         } finally {
           evaluating = false;
-          if (threw) cs._d = true;
         }
       }
       return cs._v;
@@ -65,18 +66,11 @@ function derived(getter, options) {
     if (cs._d) {
       const oldValue = cs._v;
       evaluating = true;
-      let threw = true;
       try {
-        retrack(() => {
-          const next = getter();
-          cs._v = equals && cs._v !== void 0 ? equals(cs._v, next) ? cs._v : next : next;
-          cs._d = false;
-          threw = false;
-        }, markDirty);
+        retrack(recompute, markDirty);
         if (!Object.is(oldValue, cs._v)) cs.__v++;
       } finally {
         evaluating = false;
-        if (threw) cs._d = true;
       }
       if (hook && oldValue !== cs._v) {
         hook.emit("computed:update", { signal: cs, oldValue, newValue: cs._v });

package/dist/{chunk-KB3BA2XK.js → chunk-NFYWLRUO.js}

@@ -1,13 +1,17 @@
+import {
+  isUnsafeKey,
+  stripUnsafeKeys
+} from "./chunk-H3SRKIYX.js";
 import {
   derived
-} from "./chunk-SC437AMI.js";
+} from "./chunk-JYXOEYI4.js";
 import {
   effect
-} from "./chunk-ZIBE2SAT.js";
+} from "./chunk-FDY42FIU.js";
 import {
   batch,
   signal
-} from "./chunk-RK4BQG25.js";
+} from "./chunk-C427DVQF.js";
 
 // src/patterns/machine.ts
 function machine(config) {
@@ -40,11 +44,7 @@ function machine(config) {
     }
     if (action) {
       const rawPatch = action(ctx);
-      const next = { ...ctx };
-      for (const key of Object.keys(rawPatch)) {
-        if (key === "__proto__" || key === "constructor" || key === "prototype") continue;
-        next[key] = rawPatch[key];
-      }
+      const next = { ...ctx, ...stripUnsafeKeys(rawPatch) };
       setContext(next);
     }
     setState(target);
@@ -75,10 +75,7 @@ function machine(config) {
 function persisted(key, initial, options = {}) {
   const storage = options.session ? sessionStorage : localStorage;
   const serialize = options.serialize || JSON.stringify;
-  const safeReviver = (k, v) => {
-    if (k === "__proto__" || k === "constructor" || k === "prototype") return void 0;
-    return v;
-  };
+  const safeReviver = (k, v) => isUnsafeKey(k) ? void 0 : v;
   const deserialize = options.deserialize || ((raw) => JSON.parse(raw, safeReviver));
   const encrypt = options.encrypt;
   const decrypt = options.decrypt;
@@ -368,6 +365,7 @@ function deepClone(value) {
     if (Array.isArray(v)) return v.map(clone);
     const out = {};
     for (const k of Object.keys(v)) {
+      if (k === "__proto__") continue;
       out[k] = clone(v[k]);
     }
     return out;
@@ -385,12 +383,7 @@ function globalStore(config) {
     const execute = () => {
       const current = getState();
       const rawPatch = actionFn(current, payload);
-      const patch = {};
-      for (const key of Object.keys(rawPatch)) {
-        if (key !== "__proto__" && key !== "constructor" && key !== "prototype") {
-          patch[key] = rawPatch[key];
-        }
-      }
+      const patch = stripUnsafeKeys(rawPatch);
       setState({ ...current, ...patch });
       const newState = getState();
       for (const listener of listeners) {