sibujs 3.2.1 → 3.3.0

package/dist/data.cjs

@@ -46,7 +46,13 @@ module.exports = __toCommonJS(data_exports);
 
 // src/core/dev.ts
 function isDev() {
-  return typeof globalThis.__SIBU_DEV__ !== "undefined" ? !!globalThis.__SIBU_DEV__ : typeof __SIBU_DEV__ !== "undefined" ? __SIBU_DEV__ : typeof process !== "undefined" && process.env?.NODE_ENV !== "production";
+  return typeof globalThis.__SIBU_DEV__ !== "undefined" ? !!globalThis.__SIBU_DEV__ : (
+    // The bare `__SIBU_DEV__` is a bundler define that only exists in
+    // production builds; under the test runner it is always undefined, so
+    // this branch is unreachable here.
+    /* v8 ignore next 2 */
+    typeof __SIBU_DEV__ !== "undefined" ? __SIBU_DEV__ : typeof process !== "undefined" && process.env?.NODE_ENV !== "production"
+  );
 }
 var _isDev = isDev();
 function devAssert(condition, message) {

package/dist/data.js

@@ -20,15 +20,15 @@ import {
   syncAdapter,
   throttle,
   withRetry
-} from "./chunk-VOCE4NNK.js";
-import "./chunk-YFDGQWDA.js";
-import "./chunk-JYXOEYI4.js";
-import "./chunk-HMJFCBRR.js";
-import "./chunk-FDY42FIU.js";
+} from "./chunk-MWZFOIBG.js";
+import "./chunk-JBXNCZSC.js";
+import "./chunk-CVMMULHO.js";
+import "./chunk-L3GAGWCC.js";
+import "./chunk-7JHWAGRQ.js";
 import "./chunk-GOJMFRBL.js";
-import "./chunk-C427DVQF.js";
-import "./chunk-Z2FWAE4B.js";
-import "./chunk-LMLD24FC.js";
+import "./chunk-5K72I3UQ.js";
+import "./chunk-X3NHE2DK.js";
+import "./chunk-COY6PUD2.js";
 export {
   __resetQueryCache,
   calculateDelay,

package/dist/devtools.cjs

@@ -173,7 +173,13 @@ function checkLeaks() {
 
 // src/core/dev.ts
 function isDev() {
-  return typeof globalThis.__SIBU_DEV__ !== "undefined" ? !!globalThis.__SIBU_DEV__ : typeof __SIBU_DEV__ !== "undefined" ? __SIBU_DEV__ : typeof process !== "undefined" && process.env?.NODE_ENV !== "production";
+  return typeof globalThis.__SIBU_DEV__ !== "undefined" ? !!globalThis.__SIBU_DEV__ : (
+    // The bare `__SIBU_DEV__` is a bundler define that only exists in
+    // production builds; under the test runner it is always undefined, so
+    // this branch is unreachable here.
+    /* v8 ignore next 2 */
+    typeof __SIBU_DEV__ !== "undefined" ? __SIBU_DEV__ : typeof process !== "undefined" && process.env?.NODE_ENV !== "production"
+  );
 }
 var _isDev = isDev();
 function devAssert(condition, message) {

package/dist/devtools.js

@@ -35,16 +35,16 @@ import {
   trackCleanup,
   walkDependencyGraph,
   withErrorTracking
-} from "./chunk-7XDYVJLE.js";
-import "./chunk-2UPRY23K.js";
-import "./chunk-HMJFCBRR.js";
-import "./chunk-FDY42FIU.js";
+} from "./chunk-SLCUP2EK.js";
+import "./chunk-5VGSK6D2.js";
+import "./chunk-L3GAGWCC.js";
+import "./chunk-7JHWAGRQ.js";
 import "./chunk-GOJMFRBL.js";
-import "./chunk-C427DVQF.js";
-import "./chunk-Z2FWAE4B.js";
+import "./chunk-5K72I3UQ.js";
+import "./chunk-X3NHE2DK.js";
 import {
   isDev
-} from "./chunk-LMLD24FC.js";
+} from "./chunk-COY6PUD2.js";
 
 // src/devtools/signalGraph.ts
 function getHook() {

package/dist/ecosystem.cjs

@@ -33,7 +33,13 @@ module.exports = __toCommonJS(ecosystem_exports);
 
 // src/core/dev.ts
 function isDev() {
-  return typeof globalThis.__SIBU_DEV__ !== "undefined" ? !!globalThis.__SIBU_DEV__ : typeof __SIBU_DEV__ !== "undefined" ? __SIBU_DEV__ : typeof process !== "undefined" && process.env?.NODE_ENV !== "production";
+  return typeof globalThis.__SIBU_DEV__ !== "undefined" ? !!globalThis.__SIBU_DEV__ : (
+    // The bare `__SIBU_DEV__` is a bundler define that only exists in
+    // production builds; under the test runner it is always undefined, so
+    // this branch is unreachable here.
+    /* v8 ignore next 2 */
+    typeof __SIBU_DEV__ !== "undefined" ? __SIBU_DEV__ : typeof process !== "undefined" && process.env?.NODE_ENV !== "production"
+  );
 }
 var _isDev = isDev();
 function devAssert(condition, message) {
@@ -952,7 +958,9 @@ function sanitizeSrcset(value) {
   }
   return out.join(", ");
 }
+var CSS_DANGER_GATE = /[(:@\\]/;
 function sanitizeCSSValue(value) {
+  if (!CSS_DANGER_GATE.test(value)) return value;
   const decoded = value.replace(/\\([0-9a-fA-F]{1,6})\s?/g, (_m, hex) => {
     const code = Number.parseInt(hex, 16);
     if (!Number.isFinite(code) || code < 0 || code > 1114111) return "";
@@ -982,8 +990,11 @@ var URL_ATTRIBUTES = /* @__PURE__ */ new Set([
   "ping",
   "data"
 ]);
-function isUrlAttribute(attr) {
-  return URL_ATTRIBUTES.has(attr.toLowerCase());
+function sanitizeAttributeString(attr, value) {
+  const lower = attr.toLowerCase();
+  if (lower === "srcset") return sanitizeSrcset(value);
+  if (URL_ATTRIBUTES.has(lower)) return sanitizeUrl(value);
+  return value;
 }
 
 // src/reactivity/bindAttribute.ts
@@ -1023,7 +1034,7 @@ function bindAttribute(el, attr, getter) {
     if ((attr === "value" || attr === "checked") && attr in el) {
       setProp(el, attr, attr === "checked" ? Boolean(value) : str);
     } else {
-      el.setAttribute(attr, isUrlAttribute(attr) ? sanitizeUrl(str) : str);
+      el.setAttribute(attr, sanitizeAttributeString(attr, str));
     }
   }
   return reactiveBinding(commit);
@@ -1166,11 +1177,8 @@ function bindChildNode(placeholder, getter) {
 // src/core/rendering/tagFactory.ts
 var _isDev7 = isDev();
 var BLOCKED_TAGS = /* @__PURE__ */ new Set(["script", "iframe", "object", "embed", "frame", "frameset"]);
-function validateTagName(tag) {
-  const lower = tag.toLowerCase();
-  if (BLOCKED_TAGS.has(lower)) {
-    throw new Error(`tagFactory: refusing to create <${tag}> \u2014 tag is blocked for security reasons.`);
-  }
+function isBlockedTag(tag) {
+  return BLOCKED_TAGS.has(tag.toLowerCase());
 }
 var CLOBBER_RISKY_IDS = /* @__PURE__ */ new Set([
   "config",
@@ -1325,8 +1333,11 @@ function appendChildren(el, nodes) {
   }
 }
 var tagFactory = (tag, ns) => {
+  const blocked = isBlockedTag(tag);
   return (first, second) => {
-    validateTagName(tag);
+    if (blocked) {
+      throw new Error(`tagFactory: refusing to create <${tag}> \u2014 tag is blocked for security reasons.`);
+    }
     const el = ns ? document.createElementNS(ns, tag) : document.createElement(tag);
     if (first === void 0) return el;
     if (typeof first === "string") {
@@ -1396,7 +1407,6 @@ var tagFactory = (tag, ns) => {
         default: {
           const value = props[key];
           if (value == null) continue;
-          const lkey = key.toLowerCase();
           if (isEventHandlerAttr(key)) continue;
           if (typeof value === "function") {
             registerDisposer(el, bindAttribute(el, key, value));
@@ -1409,14 +1419,7 @@ var tagFactory = (tag, ns) => {
               el.removeAttribute(key);
             }
           } else {
-            const str = String(value);
-            if (lkey === "srcset") {
-              el.setAttribute(key, sanitizeSrcset(str));
-            } else if (isUrlAttribute(lkey)) {
-              el.setAttribute(key, sanitizeUrl(str));
-            } else {
-              el.setAttribute(key, str);
-            }
+            el.setAttribute(key, sanitizeAttributeString(key, String(value)));
           }
         }
       }

package/dist/ecosystem.js

@@ -7,18 +7,18 @@ import {
   mobXAdapter,
   reduxAdapter,
   zustandAdapter
-} from "./chunk-BGNLPNGV.js";
+} from "./chunk-IHBVTURX.js";
 import "./chunk-3JHCYHWN.js";
-import "./chunk-X67UYC74.js";
-import "./chunk-RLUJL2MV.js";
-import "./chunk-JYXOEYI4.js";
-import "./chunk-2UPRY23K.js";
-import "./chunk-HMJFCBRR.js";
-import "./chunk-FDY42FIU.js";
+import "./chunk-NUWKIEHE.js";
+import "./chunk-Q2ERM6NT.js";
+import "./chunk-CVMMULHO.js";
+import "./chunk-5VGSK6D2.js";
+import "./chunk-L3GAGWCC.js";
+import "./chunk-7JHWAGRQ.js";
 import "./chunk-GOJMFRBL.js";
-import "./chunk-C427DVQF.js";
-import "./chunk-Z2FWAE4B.js";
-import "./chunk-LMLD24FC.js";
+import "./chunk-5K72I3UQ.js";
+import "./chunk-X3NHE2DK.js";
+import "./chunk-COY6PUD2.js";
 export {
   antdAdapter,
   chakraAdapter,

package/dist/extras.cjs

@@ -317,7 +317,13 @@ module.exports = __toCommonJS(extras_exports);
 
 // src/core/dev.ts
 function isDev() {
-  return typeof globalThis.__SIBU_DEV__ !== "undefined" ? !!globalThis.__SIBU_DEV__ : typeof __SIBU_DEV__ !== "undefined" ? __SIBU_DEV__ : typeof process !== "undefined" && process.env?.NODE_ENV !== "production";
+  return typeof globalThis.__SIBU_DEV__ !== "undefined" ? !!globalThis.__SIBU_DEV__ : (
+    // The bare `__SIBU_DEV__` is a bundler define that only exists in
+    // production builds; under the test runner it is always undefined, so
+    // this branch is unreachable here.
+    /* v8 ignore next 2 */
+    typeof __SIBU_DEV__ !== "undefined" ? __SIBU_DEV__ : typeof process !== "undefined" && process.env?.NODE_ENV !== "production"
+  );
 }
 var _isDev = isDev();
 function devAssert(condition, message) {
@@ -415,6 +421,7 @@ function unlinkSub(node) {
   else sub2.depsTail = prev;
 }
 var currentSubscriber = null;
+var suspendSavedSub = null;
 var notifyDepth = 0;
 var pendingQueue = [];
 var pendingSet = /* @__PURE__ */ new Set();
@@ -426,7 +433,24 @@ function safeInvoke(sub2) {
     if (_isDev2) devWarn(`Subscriber threw during notification: ${err instanceof Error ? err.message : String(err)}`);
   }
 }
+var suspendDepth = 0;
 var trackingSuspended = false;
+function suspendTracking() {
+  if (suspendDepth === 0) {
+    suspendSavedSub = currentSubscriber;
+    currentSubscriber = null;
+    trackingSuspended = true;
+  }
+  suspendDepth++;
+}
+function resumeTracking() {
+  suspendDepth--;
+  if (suspendDepth === 0) {
+    currentSubscriber = suspendSavedSub;
+    suspendSavedSub = null;
+    trackingSuspended = false;
+  }
+}
 var subscriberEpochCounter = 0;
 function retrack(effectFn, subscriber) {
   const prev = currentSubscriber;
@@ -2247,7 +2271,9 @@ function sanitizeSrcset(value) {
   }
   return out.join(", ");
 }
+var CSS_DANGER_GATE = /[(:@\\]/;
 function sanitizeCSSValue(value) {
+  if (!CSS_DANGER_GATE.test(value)) return value;
   const decoded = value.replace(/\\([0-9a-fA-F]{1,6})\s?/g, (_m, hex) => {
     const code2 = Number.parseInt(hex, 16);
     if (!Number.isFinite(code2) || code2 < 0 || code2 > 1114111) return "";
@@ -2293,8 +2319,11 @@ var URL_ATTRIBUTES = /* @__PURE__ */ new Set([
   "ping",
   "data"
 ]);
-function isUrlAttribute(attr) {
-  return URL_ATTRIBUTES.has(attr.toLowerCase());
+function sanitizeAttributeString(attr, value) {
+  const lower = attr.toLowerCase();
+  if (lower === "srcset") return sanitizeSrcset(value);
+  if (URL_ATTRIBUTES.has(lower)) return sanitizeUrl(value);
+  return value;
 }
 
 // src/ui/stream.ts
@@ -5448,7 +5477,7 @@ function bindAttribute(el, attr, getter) {
     if ((attr === "value" || attr === "checked") && attr in el) {
       setProp(el, attr, attr === "checked" ? Boolean(value) : str);
     } else {
-      el.setAttribute(attr, isUrlAttribute(attr) ? sanitizeUrl(str) : str);
+      el.setAttribute(attr, sanitizeAttributeString(attr, str));
     }
   }
   return reactiveBinding(commit);
@@ -6036,11 +6065,13 @@ function getDOMPool() {
 }
 var preloadedResources = /* @__PURE__ */ new Set();
 function preloadResource(url, type = "fetch") {
-  if (preloadedResources.has(url)) return;
-  preloadedResources.add(url);
+  const safe = sanitizeUrl(url);
+  if (!safe) return;
+  if (preloadedResources.has(safe)) return;
+  preloadedResources.add(safe);
   const link2 = document.createElement("link");
   link2.rel = "preload";
-  link2.href = url;
+  link2.href = safe;
   switch (type) {
     case "script":
       link2.setAttribute("as", "script");
@@ -6058,11 +6089,13 @@ function preloadResource(url, type = "fetch") {
   document.head.appendChild(link2);
 }
 function prefetch(url) {
-  if (preloadedResources.has(url)) return;
-  preloadedResources.add(url);
+  const safe = sanitizeUrl(url);
+  if (!safe) return;
+  if (preloadedResources.has(safe)) return;
+  preloadedResources.add(safe);
   const link2 = document.createElement("link");
   link2.rel = "prefetch";
-  link2.href = url;
+  link2.href = safe;
   document.head.appendChild(link2);
 }
 function preloadImage(src) {
@@ -6941,11 +6974,14 @@ function lazyChunk(id, loader, registry, fallback) {
 }
 function preloadModule(url) {
   if (typeof document === "undefined") return;
-  const existing = document.querySelector(`link[href="${url}"][rel="modulepreload"]`);
+  const safe = sanitizeUrl(url);
+  if (!safe) return;
+  const safeHref = typeof CSS !== "undefined" && typeof CSS.escape === "function" ? CSS.escape(safe) : safe.replace(/["\\]/g, "\\$&");
+  const existing = document.querySelector(`link[rel="modulepreload"][href="${safeHref}"]`);
   if (existing) return;
   const link2 = document.createElement("link");
   link2.rel = "modulepreload";
-  link2.href = url;
+  link2.href = safe;
   document.head.appendChild(link2);
 }
 function preloadModules(urls) {
@@ -7628,11 +7664,8 @@ function bindChildNode(placeholder, getter) {
 var SVG_NS = "http://www.w3.org/2000/svg";
 var _isDev9 = isDev();
 var BLOCKED_TAGS = /* @__PURE__ */ new Set(["script", "iframe", "object", "embed", "frame", "frameset"]);
-function validateTagName(tag) {
-  const lower = tag.toLowerCase();
-  if (BLOCKED_TAGS.has(lower)) {
-    throw new Error(`tagFactory: refusing to create <${tag}> \u2014 tag is blocked for security reasons.`);
-  }
+function isBlockedTag(tag) {
+  return BLOCKED_TAGS.has(tag.toLowerCase());
 }
 var CLOBBER_RISKY_IDS = /* @__PURE__ */ new Set([
   "config",
@@ -7787,8 +7820,11 @@ function appendChildren(el, nodes) {
   }
 }
 var tagFactory = (tag, ns) => {
+  const blocked = isBlockedTag(tag);
   return (first, second) => {
-    validateTagName(tag);
+    if (blocked) {
+      throw new Error(`tagFactory: refusing to create <${tag}> \u2014 tag is blocked for security reasons.`);
+    }
     const el = ns ? document.createElementNS(ns, tag) : document.createElement(tag);
     if (first === void 0) return el;
     if (typeof first === "string") {
@@ -7858,7 +7894,6 @@ var tagFactory = (tag, ns) => {
         default: {
           const value = props[key];
           if (value == null) continue;
-          const lkey = key.toLowerCase();
           if (isEventHandlerAttr(key)) continue;
           if (typeof value === "function") {
             registerDisposer(el, bindAttribute(el, key, value));
@@ -7871,14 +7906,7 @@ var tagFactory = (tag, ns) => {
               el.removeAttribute(key);
             }
           } else {
-            const str = String(value);
-            if (lkey === "srcset") {
-              el.setAttribute(key, sanitizeSrcset(str));
-            } else if (isUrlAttribute(lkey)) {
-              el.setAttribute(key, sanitizeUrl(str));
-            } else {
-              el.setAttribute(key, str);
-            }
+            el.setAttribute(key, sanitizeAttributeString(key, String(value)));
           }
         }
       }
@@ -10396,8 +10424,14 @@ function watch(getter, callback) {
       return;
     }
     if (!Object.is(newValue, oldValue)) {
-      callback(newValue, oldValue);
+      const prev = oldValue;
       oldValue = newValue;
+      suspendTracking();
+      try {
+        callback(newValue, prev);
+      } finally {
+        resumeTracking();
+      }
     }
   };
   const teardown = track(subscriber);

package/dist/extras.js

@@ -5,7 +5,7 @@ import {
   optimisticList,
   persisted,
   timeline
-} from "./chunk-NFYWLRUO.js";
+} from "./chunk-S4FHR5ZZ.js";
 import {
   DOMPool,
   Features,
@@ -41,7 +41,7 @@ import {
   transitionState,
   uniqueId,
   yieldToMain
-} from "./chunk-4JCAUOLN.js";
+} from "./chunk-WVJJUFPC.js";
 import {
   VERSION,
   bundlerMetadata,
@@ -62,7 +62,7 @@ import {
   preloadCritical,
   prerenderRoutes,
   satisfies
-} from "./chunk-RDRSWYNP.js";
+} from "./chunk-ZUVLC7TM.js";
 import {
   Head,
   clearWasmCache,
@@ -87,7 +87,7 @@ import {
   wasm,
   worker,
   workerFn
-} from "./chunk-OYLPZO4N.js";
+} from "./chunk-USDR2GFV.js";
 import {
   FocusTrap,
   VirtualList,
@@ -128,7 +128,7 @@ import {
   toast,
   withScopedStyle,
   zipMask
-} from "./chunk-NPIEEKPT.js";
+} from "./chunk-6G6UNHZI.js";
 import {
   RenderProp,
   assertType,
@@ -155,7 +155,7 @@ import {
   select,
   tabs,
   tooltip
-} from "./chunk-2C4E3HBM.js";
+} from "./chunk-4WXWJ4SW.js";
 import {
   animationFrame,
   battery,
@@ -193,7 +193,7 @@ import {
   visibility,
   wakeLock,
   windowSize
-} from "./chunk-GOUM4JCT.js";
+} from "./chunk-M6WSIGYW.js";
 import "./chunk-H3SRKIYX.js";
 import {
   __resetQueryCache,
@@ -217,7 +217,7 @@ import {
   syncAdapter,
   throttle,
   withRetry
-} from "./chunk-VOCE4NNK.js";
+} from "./chunk-MWZFOIBG.js";
 import {
   SibuError,
   checkLeaks,
@@ -255,7 +255,7 @@ import {
   trackCleanup,
   walkDependencyGraph,
   withErrorTracking
-} from "./chunk-7XDYVJLE.js";
+} from "./chunk-SLCUP2EK.js";
 import {
   antdAdapter,
   chakraAdapter,
@@ -265,7 +265,7 @@ import {
   mobXAdapter,
   reduxAdapter,
   zustandAdapter
-} from "./chunk-BGNLPNGV.js";
+} from "./chunk-IHBVTURX.js";
 import {
   createPlugin,
   createPluginRegistry,
@@ -277,8 +277,8 @@ import {
   triggerPluginMount,
   triggerPluginUnmount
 } from "./chunk-3JHCYHWN.js";
-import "./chunk-5N74TKLD.js";
-import "./chunk-H6PCHJZQ.js";
+import "./chunk-24DBWDTK.js";
+import "./chunk-F4UM7QBJ.js";
 import {
   collectStream,
   deserializeState,
@@ -298,14 +298,14 @@ import {
   ssrSuspense,
   suspenseSwapScript,
   trustHTML
-} from "./chunk-HXMS4SNP.js";
-import "./chunk-YFDGQWDA.js";
-import "./chunk-X67UYC74.js";
-import "./chunk-RLUJL2MV.js";
-import "./chunk-JYXOEYI4.js";
-import "./chunk-2UPRY23K.js";
-import "./chunk-HMJFCBRR.js";
-import "./chunk-FDY42FIU.js";
+} from "./chunk-R3QEDXFS.js";
+import "./chunk-JBXNCZSC.js";
+import "./chunk-NUWKIEHE.js";
+import "./chunk-Q2ERM6NT.js";
+import "./chunk-CVMMULHO.js";
+import "./chunk-5VGSK6D2.js";
+import "./chunk-L3GAGWCC.js";
+import "./chunk-7JHWAGRQ.js";
 import "./chunk-GOJMFRBL.js";
 import {
   TransitionGroup,
@@ -328,10 +328,10 @@ import {
   stagger,
   transition,
   viewTransition
-} from "./chunk-FOI23UJL.js";
-import "./chunk-C427DVQF.js";
-import "./chunk-Z2FWAE4B.js";
-import "./chunk-LMLD24FC.js";
+} from "./chunk-XQ7XSGYP.js";
+import "./chunk-5K72I3UQ.js";
+import "./chunk-X3NHE2DK.js";
+import "./chunk-COY6PUD2.js";
 export {
   DOMPool,
   Features,