sibujs 3.2.1 → 3.3.0

package/dist/{chunk-2UPRY23K.js → chunk-5VGSK6D2.js}

@@ -1,7 +1,7 @@
 import {
   devWarn,
   isDev
-} from "./chunk-LMLD24FC.js";
+} from "./chunk-COY6PUD2.js";
 
 // src/core/rendering/dispose.ts
 var elementDisposers = /* @__PURE__ */ new WeakMap();

package/dist/{chunk-NPIEEKPT.js → chunk-6G6UNHZI.js}

@@ -1,22 +1,22 @@
 import {
   bindAttribute
-} from "./chunk-RLUJL2MV.js";
+} from "./chunk-Q2ERM6NT.js";
 import {
   derived
-} from "./chunk-JYXOEYI4.js";
+} from "./chunk-CVMMULHO.js";
 import {
   dispose,
   registerDisposer
-} from "./chunk-2UPRY23K.js";
+} from "./chunk-5VGSK6D2.js";
 import {
   effect
-} from "./chunk-FDY42FIU.js";
+} from "./chunk-7JHWAGRQ.js";
 import {
   signal
-} from "./chunk-C427DVQF.js";
+} from "./chunk-5K72I3UQ.js";
 import {
   track
-} from "./chunk-Z2FWAE4B.js";
+} from "./chunk-X3NHE2DK.js";
 
 // src/ui/form.ts
 function required(message = "This field is required") {

package/dist/{chunk-FDY42FIU.js → chunk-7JHWAGRQ.js}

@@ -5,10 +5,10 @@ import {
   cleanup,
   retrack,
   untracked
-} from "./chunk-Z2FWAE4B.js";
+} from "./chunk-X3NHE2DK.js";
 import {
   devAssert
-} from "./chunk-LMLD24FC.js";
+} from "./chunk-COY6PUD2.js";
 
 // src/core/signals/effect.ts
 var _g = globalThis;

package/dist/{chunk-V2MTG5FT.js → chunk-BEIKESVL.js}

@@ -139,43 +139,43 @@ import {
   use,
   var_,
   video
-} from "./chunk-5N74TKLD.js";
+} from "./chunk-24DBWDTK.js";
 import {
   watch
-} from "./chunk-H6PCHJZQ.js";
+} from "./chunk-F4UM7QBJ.js";
 import {
   trustHTML
-} from "./chunk-HXMS4SNP.js";
+} from "./chunk-R3QEDXFS.js";
 import {
   context
-} from "./chunk-YFDGQWDA.js";
+} from "./chunk-JBXNCZSC.js";
 import {
   SVG_NS,
   bindChildNode,
   tagFactory
-} from "./chunk-X67UYC74.js";
+} from "./chunk-NUWKIEHE.js";
 import {
   bindAttribute,
   bindDynamic
-} from "./chunk-RLUJL2MV.js";
+} from "./chunk-Q2ERM6NT.js";
 import {
   derived
-} from "./chunk-JYXOEYI4.js";
+} from "./chunk-CVMMULHO.js";
 import {
   checkLeaks,
   dispose,
   registerDisposer
-} from "./chunk-2UPRY23K.js";
+} from "./chunk-5VGSK6D2.js";
 import {
   isEventHandlerAttr,
   isUrlAttribute,
   sanitizeSrcset,
   sanitizeUrl
-} from "./chunk-HMJFCBRR.js";
+} from "./chunk-L3GAGWCC.js";
 import {
   effect,
   on
-} from "./chunk-FDY42FIU.js";
+} from "./chunk-7JHWAGRQ.js";
 import {
   disableSSR,
   enableSSR,
@@ -190,21 +190,23 @@ import {
   enqueueBatchedSignal,
   isBatching,
   signal
-} from "./chunk-C427DVQF.js";
+} from "./chunk-5K72I3UQ.js";
 import {
   notifySubscribers,
   recordDependency,
+  resumeTracking,
   retrack,
   setMaxDrainIterations,
+  suspendTracking,
   track,
   untracked
-} from "./chunk-Z2FWAE4B.js";
+} from "./chunk-X3NHE2DK.js";
 import {
   __export,
   devAssert,
   devWarn,
   isDev
-} from "./chunk-LMLD24FC.js";
+} from "./chunk-COY6PUD2.js";
 
 // index.ts
 var index_exports = {};
@@ -1501,7 +1503,12 @@ function store(initialState) {
         first = false;
         return;
       }
-      callback(snapshot);
+      suspendTracking();
+      try {
+        callback(snapshot);
+      } finally {
+        resumeTracking();
+      }
     });
   };
   const subscribeKey = (key, callback) => {
@@ -1517,7 +1524,12 @@ function store(initialState) {
       if (!Object.is(current, prev)) {
         const oldPrev = prev;
         prev = current;
-        callback(current, oldPrev);
+        suspendTracking();
+        try {
+          callback(current, oldPrev);
+        } finally {
+          resumeTracking();
+        }
       }
     });
   };
@@ -3029,7 +3041,12 @@ function ErrorBoundary(optionsOrChildren, maybeChildren) {
     } else if (collected.length > 1) {
       const Agg = globalThis.AggregateError;
       handleError(
-        Agg ? new Agg(collected, `${collected.length} pre-mount errors caught by ErrorBoundary`) : new Error(collected.map((e) => e.message).join("; "))
+        Agg ? new Agg(collected, `${collected.length} pre-mount errors caught by ErrorBoundary`) : (
+          // AggregateError is ES2021 and present in every supported runtime
+          // (matches the browserslist targets), so this fallback is defensive.
+          /* v8 ignore next */
+          new Error(collected.map((e) => e.message).join("; "))
+        )
       );
     }
     return void 0;

package/dist/{chunk-LMLD24FC.js → chunk-COY6PUD2.js}

@@ -6,7 +6,13 @@ var __export = (target, all) => {
 
 // src/core/dev.ts
 function isDev() {
-  return typeof globalThis.__SIBU_DEV__ !== "undefined" ? !!globalThis.__SIBU_DEV__ : typeof __SIBU_DEV__ !== "undefined" ? __SIBU_DEV__ : typeof process !== "undefined" && process.env?.NODE_ENV !== "production";
+  return typeof globalThis.__SIBU_DEV__ !== "undefined" ? !!globalThis.__SIBU_DEV__ : (
+    // The bare `__SIBU_DEV__` is a bundler define that only exists in
+    // production builds; under the test runner it is always undefined, so
+    // this branch is unreachable here.
+    /* v8 ignore next 2 */
+    typeof __SIBU_DEV__ !== "undefined" ? __SIBU_DEV__ : typeof process !== "undefined" && process.env?.NODE_ENV !== "production"
+  );
 }
 var _isDev = isDev();
 function devAssert(condition, message) {

package/dist/{chunk-JYXOEYI4.js → chunk-CVMMULHO.js}

@@ -3,10 +3,10 @@ import {
   retrack,
   track,
   trackingSuspended
-} from "./chunk-Z2FWAE4B.js";
+} from "./chunk-X3NHE2DK.js";
 import {
   devAssert
-} from "./chunk-LMLD24FC.js";
+} from "./chunk-COY6PUD2.js";
 
 // src/core/signals/derived.ts
 function derived(getter, options) {

package/dist/{chunk-H6PCHJZQ.js → chunk-F4UM7QBJ.js}

@@ -2,11 +2,13 @@ import {
   isSSR
 } from "./chunk-GOJMFRBL.js";
 import {
+  resumeTracking,
+  suspendTracking,
   track
-} from "./chunk-Z2FWAE4B.js";
+} from "./chunk-X3NHE2DK.js";
 import {
   devAssert
-} from "./chunk-LMLD24FC.js";
+} from "./chunk-COY6PUD2.js";
 
 // src/core/signals/watch.ts
 function watch(getter, callback) {
@@ -24,8 +26,14 @@ function watch(getter, callback) {
       return;
     }
     if (!Object.is(newValue, oldValue)) {
-      callback(newValue, oldValue);
+      const prev = oldValue;
       oldValue = newValue;
+      suspendTracking();
+      try {
+        callback(newValue, prev);
+      } finally {
+        resumeTracking();
+      }
     }
   };
   const teardown = track(subscriber);

package/dist/{chunk-BGNLPNGV.js → chunk-IHBVTURX.js}

@@ -3,17 +3,17 @@ import {
 } from "./chunk-3JHCYHWN.js";
 import {
   tagFactory
-} from "./chunk-X67UYC74.js";
+} from "./chunk-NUWKIEHE.js";
 import {
   derived
-} from "./chunk-JYXOEYI4.js";
+} from "./chunk-CVMMULHO.js";
 import {
   effect
-} from "./chunk-FDY42FIU.js";
+} from "./chunk-7JHWAGRQ.js";
 import {
   batch,
   signal
-} from "./chunk-C427DVQF.js";
+} from "./chunk-5K72I3UQ.js";
 
 // src/ecosystem/adapters/mobx.ts
 function mobXAdapter(options) {

package/dist/{chunk-YFDGQWDA.js → chunk-JBXNCZSC.js}

@@ -1,6 +1,6 @@
 import {
   signal
-} from "./chunk-C427DVQF.js";
+} from "./chunk-5K72I3UQ.js";
 
 // src/core/rendering/context.ts
 function context(defaultValue) {

package/dist/{chunk-HMJFCBRR.js → chunk-L3GAGWCC.js}

@@ -41,7 +41,9 @@ function sanitizeSrcset(value) {
   }
   return out.join(", ");
 }
+var CSS_DANGER_GATE = /[(:@\\]/;
 function sanitizeCSSValue(value) {
+  if (!CSS_DANGER_GATE.test(value)) return value;
   const decoded = value.replace(/\\([0-9a-fA-F]{1,6})\s?/g, (_m, hex) => {
     const code = Number.parseInt(hex, 16);
     if (!Number.isFinite(code) || code < 0 || code > 1114111) return "";
@@ -90,6 +92,12 @@ var URL_ATTRIBUTES = /* @__PURE__ */ new Set([
 function isUrlAttribute(attr) {
   return URL_ATTRIBUTES.has(attr.toLowerCase());
 }
+function sanitizeAttributeString(attr, value) {
+  const lower = attr.toLowerCase();
+  if (lower === "srcset") return sanitizeSrcset(value);
+  if (URL_ATTRIBUTES.has(lower)) return sanitizeUrl(value);
+  return value;
+}
 
 export {
   stripControlChars,
@@ -98,5 +106,6 @@ export {
   sanitizeSrcset,
   sanitizeCSSValue,
   stripHtml,
-  isUrlAttribute
+  isUrlAttribute,
+  sanitizeAttributeString
 };

package/dist/{chunk-GOUM4JCT.js → chunk-M6WSIGYW.js}

@@ -3,11 +3,11 @@ import {
 } from "./chunk-H3SRKIYX.js";
 import {
   effect
-} from "./chunk-FDY42FIU.js";
+} from "./chunk-7JHWAGRQ.js";
 import {
   batch,
   signal
-} from "./chunk-C427DVQF.js";
+} from "./chunk-5K72I3UQ.js";
 
 // src/browser/media.ts
 function media(query) {

package/dist/{chunk-VOCE4NNK.js → chunk-MWZFOIBG.js}

@@ -1,22 +1,22 @@
 import {
   context
-} from "./chunk-YFDGQWDA.js";
+} from "./chunk-JBXNCZSC.js";
 import {
   derived
-} from "./chunk-JYXOEYI4.js";
+} from "./chunk-CVMMULHO.js";
 import {
   sanitizeUrl
-} from "./chunk-HMJFCBRR.js";
+} from "./chunk-L3GAGWCC.js";
 import {
   effect
-} from "./chunk-FDY42FIU.js";
+} from "./chunk-7JHWAGRQ.js";
 import {
   getRequestScopedCache
 } from "./chunk-GOJMFRBL.js";
 import {
   batch,
   signal
-} from "./chunk-C427DVQF.js";
+} from "./chunk-5K72I3UQ.js";
 
 // src/data/retry.ts
 function calculateDelay(attempt, strategy, baseDelay, maxDelay, jitter) {

package/dist/{chunk-X67UYC74.js → chunk-NUWKIEHE.js}

@@ -1,25 +1,23 @@
 import {
   bindAttribute
-} from "./chunk-RLUJL2MV.js";
+} from "./chunk-Q2ERM6NT.js";
 import {
   dispose,
   registerDisposer
-} from "./chunk-2UPRY23K.js";
+} from "./chunk-5VGSK6D2.js";
 import {
   isEventHandlerAttr,
-  isUrlAttribute,
-  sanitizeCSSValue,
-  sanitizeSrcset,
-  sanitizeUrl
-} from "./chunk-HMJFCBRR.js";
+  sanitizeAttributeString,
+  sanitizeCSSValue
+} from "./chunk-L3GAGWCC.js";
 import {
   reactiveBinding,
   track
-} from "./chunk-Z2FWAE4B.js";
+} from "./chunk-X3NHE2DK.js";
 import {
   devWarn,
   isDev
-} from "./chunk-LMLD24FC.js";
+} from "./chunk-COY6PUD2.js";
 
 // src/reactivity/bindChildNode.ts
 var _isDev = isDev();
@@ -98,11 +96,8 @@ function bindChildNode(placeholder, getter) {
 var SVG_NS = "http://www.w3.org/2000/svg";
 var _isDev2 = isDev();
 var BLOCKED_TAGS = /* @__PURE__ */ new Set(["script", "iframe", "object", "embed", "frame", "frameset"]);
-function validateTagName(tag) {
-  const lower = tag.toLowerCase();
-  if (BLOCKED_TAGS.has(lower)) {
-    throw new Error(`tagFactory: refusing to create <${tag}> \u2014 tag is blocked for security reasons.`);
-  }
+function isBlockedTag(tag) {
+  return BLOCKED_TAGS.has(tag.toLowerCase());
 }
 var CLOBBER_RISKY_IDS = /* @__PURE__ */ new Set([
   "config",
@@ -257,8 +252,11 @@ function appendChildren(el, nodes) {
   }
 }
 var tagFactory = (tag, ns) => {
+  const blocked = isBlockedTag(tag);
   return (first, second) => {
-    validateTagName(tag);
+    if (blocked) {
+      throw new Error(`tagFactory: refusing to create <${tag}> \u2014 tag is blocked for security reasons.`);
+    }
     const el = ns ? document.createElementNS(ns, tag) : document.createElement(tag);
     if (first === void 0) return el;
     if (typeof first === "string") {
@@ -328,7 +326,6 @@ var tagFactory = (tag, ns) => {
         default: {
           const value = props[key];
           if (value == null) continue;
-          const lkey = key.toLowerCase();
           if (isEventHandlerAttr(key)) continue;
           if (typeof value === "function") {
             registerDisposer(el, bindAttribute(el, key, value));
@@ -341,14 +338,7 @@ var tagFactory = (tag, ns) => {
               el.removeAttribute(key);
             }
           } else {
-            const str = String(value);
-            if (lkey === "srcset") {
-              el.setAttribute(key, sanitizeSrcset(str));
-            } else if (isUrlAttribute(lkey)) {
-              el.setAttribute(key, sanitizeUrl(str));
-            } else {
-              el.setAttribute(key, str);
-            }
+            el.setAttribute(key, sanitizeAttributeString(key, String(value)));
           }
         }
       }

package/dist/{chunk-RLUJL2MV.js → chunk-Q2ERM6NT.js}

@@ -1,15 +1,14 @@
 import {
   isEventHandlerAttr,
-  isUrlAttribute,
-  sanitizeUrl
-} from "./chunk-HMJFCBRR.js";
+  sanitizeAttributeString
+} from "./chunk-L3GAGWCC.js";
 import {
   reactiveBinding
-} from "./chunk-Z2FWAE4B.js";
+} from "./chunk-X3NHE2DK.js";
 import {
   devWarn,
   isDev
-} from "./chunk-LMLD24FC.js";
+} from "./chunk-COY6PUD2.js";
 
 // src/reactivity/bindAttribute.ts
 var _isDev = isDev();
@@ -48,7 +47,7 @@ function bindAttribute(el, attr, getter) {
     if ((attr === "value" || attr === "checked") && attr in el) {
       setProp(el, attr, attr === "checked" ? Boolean(value) : str);
     } else {
-      el.setAttribute(attr, isUrlAttribute(attr) ? sanitizeUrl(str) : str);
+      el.setAttribute(attr, sanitizeAttributeString(attr, str));
     }
   }
   return reactiveBinding(commit);
@@ -78,7 +77,7 @@ function bindDynamic(el, nameGetter, valueGetter) {
     if ((name === "value" || name === "checked") && name in el) {
       setProp(el, name, name === "checked" ? Boolean(value) : str);
     } else {
-      el.setAttribute(name, isUrlAttribute(name) ? sanitizeUrl(str) : str);
+      el.setAttribute(name, sanitizeAttributeString(name, str));
     }
     prevName = name;
   }

package/dist/{chunk-HXMS4SNP.js → chunk-R3QEDXFS.js}

@@ -3,13 +3,13 @@ import {
   sanitizeSrcset,
   sanitizeUrl,
   stripControlChars
-} from "./chunk-HMJFCBRR.js";
+} from "./chunk-L3GAGWCC.js";
 import {
   getSSRStore
 } from "./chunk-GOJMFRBL.js";
 import {
   isDev
-} from "./chunk-LMLD24FC.js";
+} from "./chunk-COY6PUD2.js";
 
 // src/platform/ssr.ts
 function sanitizeUrlAttr(name, value) {

package/dist/{chunk-NFYWLRUO.js → chunk-S4FHR5ZZ.js}

@@ -4,14 +4,14 @@ import {
 } from "./chunk-H3SRKIYX.js";
 import {
   derived
-} from "./chunk-JYXOEYI4.js";
+} from "./chunk-CVMMULHO.js";
 import {
   effect
-} from "./chunk-FDY42FIU.js";
+} from "./chunk-7JHWAGRQ.js";
 import {
   batch,
   signal
-} from "./chunk-C427DVQF.js";
+} from "./chunk-5K72I3UQ.js";
 
 // src/patterns/machine.ts
 function machine(config) {

package/dist/{chunk-7XDYVJLE.js → chunk-SLCUP2EK.js}

@@ -1,23 +1,23 @@
 import {
   dispose
-} from "./chunk-2UPRY23K.js";
+} from "./chunk-5VGSK6D2.js";
 import {
   stripHtml
-} from "./chunk-HMJFCBRR.js";
+} from "./chunk-L3GAGWCC.js";
 import {
   effect
-} from "./chunk-FDY42FIU.js";
+} from "./chunk-7JHWAGRQ.js";
 import {
   signal
-} from "./chunk-C427DVQF.js";
+} from "./chunk-5K72I3UQ.js";
 import {
   forEachSubscriber,
   getSubscriberCount,
   getSubscriberDeps
-} from "./chunk-Z2FWAE4B.js";
+} from "./chunk-X3NHE2DK.js";
 import {
   isDev
-} from "./chunk-LMLD24FC.js";
+} from "./chunk-COY6PUD2.js";
 
 // src/devtools/debug.ts
 var debugEnabled = false;

package/dist/{chunk-OYLPZO4N.js → chunk-USDR2GFV.js}

@@ -1,19 +1,19 @@
 import {
   div,
   span
-} from "./chunk-5N74TKLD.js";
+} from "./chunk-24DBWDTK.js";
 import {
   isEventHandlerAttr,
   sanitizeUrl,
   stripControlChars
-} from "./chunk-HMJFCBRR.js";
+} from "./chunk-L3GAGWCC.js";
 import {
   effect
-} from "./chunk-FDY42FIU.js";
+} from "./chunk-7JHWAGRQ.js";
 import {
   batch,
   signal
-} from "./chunk-C427DVQF.js";
+} from "./chunk-5K72I3UQ.js";
 
 // src/platform/head.ts
 var HEAD_URL_ATTRS = /* @__PURE__ */ new Set(["href", "src"]);

package/dist/{chunk-4JCAUOLN.js → chunk-WVJJUFPC.js}

@@ -1,16 +1,19 @@
 import {
   dispose
-} from "./chunk-2UPRY23K.js";
+} from "./chunk-5VGSK6D2.js";
+import {
+  sanitizeUrl
+} from "./chunk-L3GAGWCC.js";
 import {
   effect
-} from "./chunk-FDY42FIU.js";
+} from "./chunk-7JHWAGRQ.js";
 import {
   signal
-} from "./chunk-C427DVQF.js";
+} from "./chunk-5K72I3UQ.js";
 import {
   devWarn,
   isDev
-} from "./chunk-LMLD24FC.js";
+} from "./chunk-COY6PUD2.js";
 
 // src/performance/scheduler.ts
 var Priority = {
@@ -284,11 +287,13 @@ function getDOMPool() {
 }
 var preloadedResources = /* @__PURE__ */ new Set();
 function preloadResource(url, type = "fetch") {
-  if (preloadedResources.has(url)) return;
-  preloadedResources.add(url);
+  const safe = sanitizeUrl(url);
+  if (!safe) return;
+  if (preloadedResources.has(safe)) return;
+  preloadedResources.add(safe);
   const link = document.createElement("link");
   link.rel = "preload";
-  link.href = url;
+  link.href = safe;
   switch (type) {
     case "script":
       link.setAttribute("as", "script");
@@ -306,11 +311,13 @@ function preloadResource(url, type = "fetch") {
   document.head.appendChild(link);
 }
 function prefetch(url) {
-  if (preloadedResources.has(url)) return;
-  preloadedResources.add(url);
+  const safe = sanitizeUrl(url);
+  if (!safe) return;
+  if (preloadedResources.has(safe)) return;
+  preloadedResources.add(safe);
   const link = document.createElement("link");
   link.rel = "prefetch";
-  link.href = url;
+  link.href = safe;
   document.head.appendChild(link);
 }
 function preloadImage(src) {
@@ -679,11 +686,14 @@ function lazyChunk(id, loader, registry, fallback) {
 }
 function preloadModule(url) {
   if (typeof document === "undefined") return;
-  const existing = document.querySelector(`link[href="${url}"][rel="modulepreload"]`);
+  const safe = sanitizeUrl(url);
+  if (!safe) return;
+  const safeHref = typeof CSS !== "undefined" && typeof CSS.escape === "function" ? CSS.escape(safe) : safe.replace(/["\\]/g, "\\$&");
+  const existing = document.querySelector(`link[rel="modulepreload"][href="${safeHref}"]`);
   if (existing) return;
   const link = document.createElement("link");
   link.rel = "modulepreload";
-  link.href = url;
+  link.href = safe;
   document.head.appendChild(link);
 }
 function preloadModules(urls) {

package/dist/{chunk-Z2FWAE4B.js → chunk-X3NHE2DK.js}

@@ -1,7 +1,7 @@
 import {
   devWarn,
   isDev
-} from "./chunk-LMLD24FC.js";
+} from "./chunk-COY6PUD2.js";
 
 // src/reactivity/track.ts
 var _isDev = isDev();
@@ -411,6 +411,8 @@ function forEachSubscriber(signal, visit) {
 
 export {
   trackingSuspended,
+  suspendTracking,
+  resumeTracking,
   untracked,
   retrack,
   track,

package/dist/{chunk-FOI23UJL.js → chunk-XQ7XSGYP.js}

@@ -1,6 +1,6 @@
 import {
   signal
-} from "./chunk-C427DVQF.js";
+} from "./chunk-5K72I3UQ.js";
 
 // src/ui/transition.ts
 function transition(element, options = {}) {

package/dist/{chunk-RDRSWYNP.js → chunk-ZUVLC7TM.js}

@@ -1,6 +1,6 @@
 import {
   renderToString
-} from "./chunk-HXMS4SNP.js";
+} from "./chunk-R3QEDXFS.js";
 
 // src/plugins/modular.ts
 function createModuleRegistry() {