sibujs 3.2.1 → 3.3.0

package/dist/ssr.cjs

@@ -66,7 +66,13 @@ module.exports = __toCommonJS(ssr_exports);
 
 // src/core/dev.ts
 function isDev() {
-  return typeof globalThis.__SIBU_DEV__ !== "undefined" ? !!globalThis.__SIBU_DEV__ : typeof __SIBU_DEV__ !== "undefined" ? __SIBU_DEV__ : typeof process !== "undefined" && process.env?.NODE_ENV !== "production";
+  return typeof globalThis.__SIBU_DEV__ !== "undefined" ? !!globalThis.__SIBU_DEV__ : (
+    // The bare `__SIBU_DEV__` is a bundler define that only exists in
+    // production builds; under the test runner it is always undefined, so
+    // this branch is unreachable here.
+    /* v8 ignore next 2 */
+    typeof __SIBU_DEV__ !== "undefined" ? __SIBU_DEV__ : typeof process !== "undefined" && process.env?.NODE_ENV !== "production"
+  );
 }
 var _isDev = isDev();
 function devAssert(condition, message) {
@@ -152,7 +158,9 @@ function sanitizeSrcset(value) {
   }
   return out.join(", ");
 }
+var CSS_DANGER_GATE = /[(:@\\]/;
 function sanitizeCSSValue(value) {
+  if (!CSS_DANGER_GATE.test(value)) return value;
   const decoded = value.replace(/\\([0-9a-fA-F]{1,6})\s?/g, (_m, hex) => {
     const code2 = Number.parseInt(hex, 16);
     if (!Number.isFinite(code2) || code2 < 0 || code2 > 1114111) return "";
@@ -182,8 +190,11 @@ var URL_ATTRIBUTES = /* @__PURE__ */ new Set([
   "ping",
   "data"
 ]);
-function isUrlAttribute(attr) {
-  return URL_ATTRIBUTES.has(attr.toLowerCase());
+function sanitizeAttributeString(attr, value) {
+  const lower = attr.toLowerCase();
+  if (lower === "srcset") return sanitizeSrcset(value);
+  if (URL_ATTRIBUTES.has(lower)) return sanitizeUrl(value);
+  return value;
 }
 
 // src/platform/ssr.ts
@@ -1617,7 +1628,7 @@ function bindAttribute(el, attr, getter) {
     if ((attr === "value" || attr === "checked") && attr in el) {
       setProp(el, attr, attr === "checked" ? Boolean(value) : str);
     } else {
-      el.setAttribute(attr, isUrlAttribute(attr) ? sanitizeUrl(str) : str);
+      el.setAttribute(attr, sanitizeAttributeString(attr, str));
     }
   }
   return reactiveBinding(commit);
@@ -1761,11 +1772,8 @@ function bindChildNode(placeholder, getter) {
 var SVG_NS = "http://www.w3.org/2000/svg";
 var _isDev8 = isDev();
 var BLOCKED_TAGS = /* @__PURE__ */ new Set(["script", "iframe", "object", "embed", "frame", "frameset"]);
-function validateTagName(tag) {
-  const lower = tag.toLowerCase();
-  if (BLOCKED_TAGS.has(lower)) {
-    throw new Error(`tagFactory: refusing to create <${tag}> \u2014 tag is blocked for security reasons.`);
-  }
+function isBlockedTag(tag) {
+  return BLOCKED_TAGS.has(tag.toLowerCase());
 }
 var CLOBBER_RISKY_IDS = /* @__PURE__ */ new Set([
   "config",
@@ -1920,8 +1928,11 @@ function appendChildren(el, nodes) {
   }
 }
 var tagFactory = (tag, ns) => {
+  const blocked = isBlockedTag(tag);
   return (first, second) => {
-    validateTagName(tag);
+    if (blocked) {
+      throw new Error(`tagFactory: refusing to create <${tag}> \u2014 tag is blocked for security reasons.`);
+    }
     const el = ns ? document.createElementNS(ns, tag) : document.createElement(tag);
     if (first === void 0) return el;
     if (typeof first === "string") {
@@ -1991,7 +2002,6 @@ var tagFactory = (tag, ns) => {
         default: {
           const value = props[key];
           if (value == null) continue;
-          const lkey = key.toLowerCase();
           if (isEventHandlerAttr(key)) continue;
           if (typeof value === "function") {
             registerDisposer(el, bindAttribute(el, key, value));
@@ -2004,14 +2014,7 @@ var tagFactory = (tag, ns) => {
               el.removeAttribute(key);
             }
           } else {
-            const str = String(value);
-            if (lkey === "srcset") {
-              el.setAttribute(key, sanitizeSrcset(str));
-            } else if (isUrlAttribute(lkey)) {
-              el.setAttribute(key, sanitizeUrl(str));
-            } else {
-              el.setAttribute(key, str);
-            }
+            el.setAttribute(key, sanitizeAttributeString(key, String(value)));
           }
         }
       }

package/dist/ssr.js

@@ -22,8 +22,8 @@ import {
   wasm,
   worker,
   workerFn
-} from "./chunk-OYLPZO4N.js";
-import "./chunk-5N74TKLD.js";
+} from "./chunk-USDR2GFV.js";
+import "./chunk-24DBWDTK.js";
 import {
   collectStream,
   deserializeState,
@@ -43,16 +43,16 @@ import {
   ssrSuspense,
   suspenseSwapScript,
   trustHTML
-} from "./chunk-HXMS4SNP.js";
-import "./chunk-X67UYC74.js";
-import "./chunk-RLUJL2MV.js";
-import "./chunk-2UPRY23K.js";
-import "./chunk-HMJFCBRR.js";
-import "./chunk-FDY42FIU.js";
+} from "./chunk-R3QEDXFS.js";
+import "./chunk-NUWKIEHE.js";
+import "./chunk-Q2ERM6NT.js";
+import "./chunk-5VGSK6D2.js";
+import "./chunk-L3GAGWCC.js";
+import "./chunk-7JHWAGRQ.js";
 import "./chunk-GOJMFRBL.js";
-import "./chunk-C427DVQF.js";
-import "./chunk-Z2FWAE4B.js";
-import "./chunk-LMLD24FC.js";
+import "./chunk-5K72I3UQ.js";
+import "./chunk-X3NHE2DK.js";
+import "./chunk-COY6PUD2.js";
 export {
   Head,
   clearWasmCache,

package/dist/testing.cjs

@@ -68,7 +68,13 @@ module.exports = __toCommonJS(testing_exports);
 
 // src/core/dev.ts
 function isDev() {
-  return typeof globalThis.__SIBU_DEV__ !== "undefined" ? !!globalThis.__SIBU_DEV__ : typeof __SIBU_DEV__ !== "undefined" ? __SIBU_DEV__ : typeof process !== "undefined" && process.env?.NODE_ENV !== "production";
+  return typeof globalThis.__SIBU_DEV__ !== "undefined" ? !!globalThis.__SIBU_DEV__ : (
+    // The bare `__SIBU_DEV__` is a bundler define that only exists in
+    // production builds; under the test runner it is always undefined, so
+    // this branch is unreachable here.
+    /* v8 ignore next 2 */
+    typeof __SIBU_DEV__ !== "undefined" ? __SIBU_DEV__ : typeof process !== "undefined" && process.env?.NODE_ENV !== "production"
+  );
 }
 var _isDev = isDev();
 function devAssert(condition, message) {
@@ -130,6 +136,9 @@ function dispose(node) {
 }
 
 // src/testing/a11y.ts
+function escSel(value) {
+  return value.replace(/["\\]/g, "\\$&");
+}
 var VALID_ARIA_ROLES = /* @__PURE__ */ new Set([
   "alert",
   "alertdialog",
@@ -386,7 +395,7 @@ function checkInputHasLabel(input, root) {
   if (input.getAttribute("title")?.trim()) return true;
   const id = input.getAttribute("id");
   if (id) {
-    const label = root.querySelector(`label[for="${id}"]`);
+    const label = root.querySelector(`label[for="${escSel(id)}"]`);
     if (label?.textContent?.trim()) return true;
   }
   let parent = input.parentElement;
@@ -972,6 +981,9 @@ function assertA11y(root, options) {
 }
 
 // src/testing/adapters.ts
+function escSel2(value) {
+  return value.replace(/["\\]/g, "\\$&");
+}
 function createJestAdapter() {
   let container = null;
   return {
@@ -1187,10 +1199,10 @@ function createUniversalAdapter() {
     /** Query helpers */
     queries: {
       byTestId(container2, id) {
-        return container2.querySelector(`[data-testid="${id}"]`);
+        return container2.querySelector(`[data-testid="${escSel2(id)}"]`);
       },
       byRole(container2, role) {
-        return container2.querySelector(`[role="${role}"]`);
+        return container2.querySelector(`[role="${escSel2(role)}"]`);
       },
       byText(container2, text) {
         const walker = document.createTreeWalker(container2, NodeFilter.SHOW_TEXT);
@@ -1207,16 +1219,16 @@ function createUniversalAdapter() {
           if (labelEl.textContent?.includes(label)) {
             const forAttr = labelEl.getAttribute("for");
             if (forAttr) {
-              return container2.querySelector(`#${forAttr}`);
+              return container2.querySelector(`[id="${escSel2(forAttr)}"]`);
             }
             const nested = labelEl.querySelector("input, select, textarea");
             if (nested) return nested;
           }
         }
-        return container2.querySelector(`[aria-label="${label}"]`);
+        return container2.querySelector(`[aria-label="${escSel2(label)}"]`);
       },
       allByRole(container2, role) {
-        return Array.from(container2.querySelectorAll(`[role="${role}"]`));
+        return Array.from(container2.querySelectorAll(`[role="${escSel2(role)}"]`));
       }
     },
     /** Assertion helpers */

package/dist/testing.js

@@ -1,14 +1,17 @@
 import {
   dispose
-} from "./chunk-2UPRY23K.js";
+} from "./chunk-5VGSK6D2.js";
 import {
   effect
-} from "./chunk-FDY42FIU.js";
+} from "./chunk-7JHWAGRQ.js";
 import "./chunk-GOJMFRBL.js";
-import "./chunk-Z2FWAE4B.js";
-import "./chunk-LMLD24FC.js";
+import "./chunk-X3NHE2DK.js";
+import "./chunk-COY6PUD2.js";
 
 // src/testing/a11y.ts
+function escSel(value) {
+  return value.replace(/["\\]/g, "\\$&");
+}
 var VALID_ARIA_ROLES = /* @__PURE__ */ new Set([
   "alert",
   "alertdialog",
@@ -265,7 +268,7 @@ function checkInputHasLabel(input, root) {
   if (input.getAttribute("title")?.trim()) return true;
   const id = input.getAttribute("id");
   if (id) {
-    const label = root.querySelector(`label[for="${id}"]`);
+    const label = root.querySelector(`label[for="${escSel(id)}"]`);
     if (label?.textContent?.trim()) return true;
   }
   let parent = input.parentElement;
@@ -851,6 +854,9 @@ function assertA11y(root, options) {
 }
 
 // src/testing/adapters.ts
+function escSel2(value) {
+  return value.replace(/["\\]/g, "\\$&");
+}
 function createJestAdapter() {
   let container = null;
   return {
@@ -1066,10 +1072,10 @@ function createUniversalAdapter() {
     /** Query helpers */
     queries: {
       byTestId(container2, id) {
-        return container2.querySelector(`[data-testid="${id}"]`);
+        return container2.querySelector(`[data-testid="${escSel2(id)}"]`);
       },
       byRole(container2, role) {
-        return container2.querySelector(`[role="${role}"]`);
+        return container2.querySelector(`[role="${escSel2(role)}"]`);
       },
       byText(container2, text) {
         const walker = document.createTreeWalker(container2, NodeFilter.SHOW_TEXT);
@@ -1086,16 +1092,16 @@ function createUniversalAdapter() {
           if (labelEl.textContent?.includes(label)) {
             const forAttr = labelEl.getAttribute("for");
             if (forAttr) {
-              return container2.querySelector(`#${forAttr}`);
+              return container2.querySelector(`[id="${escSel2(forAttr)}"]`);
             }
             const nested = labelEl.querySelector("input, select, textarea");
             if (nested) return nested;
           }
         }
-        return container2.querySelector(`[aria-label="${label}"]`);
+        return container2.querySelector(`[aria-label="${escSel2(label)}"]`);
       },
       allByRole(container2, role) {
-        return Array.from(container2.querySelectorAll(`[role="${role}"]`));
+        return Array.from(container2.querySelectorAll(`[role="${escSel2(role)}"]`));
       }
     },
     /** Assertion helpers */

package/dist/ui.cjs

@@ -87,7 +87,13 @@ module.exports = __toCommonJS(ui_exports);
 
 // src/core/dev.ts
 function isDev() {
-  return typeof globalThis.__SIBU_DEV__ !== "undefined" ? !!globalThis.__SIBU_DEV__ : typeof __SIBU_DEV__ !== "undefined" ? __SIBU_DEV__ : typeof process !== "undefined" && process.env?.NODE_ENV !== "production";
+  return typeof globalThis.__SIBU_DEV__ !== "undefined" ? !!globalThis.__SIBU_DEV__ : (
+    // The bare `__SIBU_DEV__` is a bundler define that only exists in
+    // production builds; under the test runner it is always undefined, so
+    // this branch is unreachable here.
+    /* v8 ignore next 2 */
+    typeof __SIBU_DEV__ !== "undefined" ? __SIBU_DEV__ : typeof process !== "undefined" && process.env?.NODE_ENV !== "production"
+  );
 }
 var _isDev = isDev();
 function devAssert(condition, message) {
@@ -1740,6 +1746,20 @@ function sanitizeUrl(url) {
   if (SAFE_URL_PROTOCOLS.indexOf(scheme) === -1) return "";
   return trimmed;
 }
+function sanitizeSrcset(value) {
+  const parts = value.split(",");
+  const out = [];
+  for (let i = 0; i < parts.length; i++) {
+    const part = parts[i].trim();
+    if (!part) continue;
+    const m = part.match(/^(\S+)(\s+.+)?$/);
+    if (!m) continue;
+    const safe = sanitizeUrl(m[1]);
+    if (!safe) continue;
+    out.push(m[2] ? `${safe}${m[2]}` : safe);
+  }
+  return out.join(", ");
+}
 var URL_ATTRIBUTES = /* @__PURE__ */ new Set([
   "href",
   "xlink:href",
@@ -1754,8 +1774,11 @@ var URL_ATTRIBUTES = /* @__PURE__ */ new Set([
   "ping",
   "data"
 ]);
-function isUrlAttribute(attr) {
-  return URL_ATTRIBUTES.has(attr.toLowerCase());
+function sanitizeAttributeString(attr, value) {
+  const lower = attr.toLowerCase();
+  if (lower === "srcset") return sanitizeSrcset(value);
+  if (URL_ATTRIBUTES.has(lower)) return sanitizeUrl(value);
+  return value;
 }
 
 // src/reactivity/bindAttribute.ts
@@ -1795,7 +1818,7 @@ function bindAttribute(el, attr, getter) {
     if ((attr === "value" || attr === "checked") && attr in el) {
       setProp(el, attr, attr === "checked" ? Boolean(value) : str);
     } else {
-      el.setAttribute(attr, isUrlAttribute(attr) ? sanitizeUrl(str) : str);
+      el.setAttribute(attr, sanitizeAttributeString(attr, str));
     }
   }
   return reactiveBinding(commit);

package/dist/ui.js

@@ -38,7 +38,7 @@ import {
   toast,
   withScopedStyle,
   zipMask
-} from "./chunk-NPIEEKPT.js";
+} from "./chunk-6G6UNHZI.js";
 import {
   RenderProp,
   assertType,
@@ -58,21 +58,21 @@ import {
 import {
   createId
 } from "./chunk-YT6HQ6AM.js";
-import "./chunk-RLUJL2MV.js";
-import "./chunk-JYXOEYI4.js";
+import "./chunk-Q2ERM6NT.js";
+import "./chunk-CVMMULHO.js";
 import {
   registerDisposer
-} from "./chunk-2UPRY23K.js";
-import "./chunk-HMJFCBRR.js";
+} from "./chunk-5VGSK6D2.js";
+import "./chunk-L3GAGWCC.js";
 import {
   effect
-} from "./chunk-FDY42FIU.js";
+} from "./chunk-7JHWAGRQ.js";
 import "./chunk-GOJMFRBL.js";
 import {
   signal
-} from "./chunk-C427DVQF.js";
-import "./chunk-Z2FWAE4B.js";
-import "./chunk-LMLD24FC.js";
+} from "./chunk-5K72I3UQ.js";
+import "./chunk-X3NHE2DK.js";
+import "./chunk-COY6PUD2.js";
 
 // src/ui/formAction.ts
 function formAction(fn) {

package/dist/widgets.cjs

@@ -34,7 +34,13 @@ module.exports = __toCommonJS(widgets_exports);
 
 // src/core/dev.ts
 function isDev() {
-  return typeof globalThis.__SIBU_DEV__ !== "undefined" ? !!globalThis.__SIBU_DEV__ : typeof __SIBU_DEV__ !== "undefined" ? __SIBU_DEV__ : typeof process !== "undefined" && process.env?.NODE_ENV !== "production";
+  return typeof globalThis.__SIBU_DEV__ !== "undefined" ? !!globalThis.__SIBU_DEV__ : (
+    // The bare `__SIBU_DEV__` is a bundler define that only exists in
+    // production builds; under the test runner it is always undefined, so
+    // this branch is unreachable here.
+    /* v8 ignore next 2 */
+    typeof __SIBU_DEV__ !== "undefined" ? __SIBU_DEV__ : typeof process !== "undefined" && process.env?.NODE_ENV !== "production"
+  );
 }
 var _isDev = isDev();
 function devAssert(condition, message) {
@@ -132,6 +138,7 @@ function unlinkSub(node) {
   else sub.depsTail = prev;
 }
 var currentSubscriber = null;
+var suspendSavedSub = null;
 var notifyDepth = 0;
 var pendingQueue = [];
 var pendingSet = /* @__PURE__ */ new Set();
@@ -143,7 +150,24 @@ function safeInvoke(sub) {
     if (_isDev2) devWarn(`Subscriber threw during notification: ${err instanceof Error ? err.message : String(err)}`);
   }
 }
+var suspendDepth = 0;
 var trackingSuspended = false;
+function suspendTracking() {
+  if (suspendDepth === 0) {
+    suspendSavedSub = currentSubscriber;
+    currentSubscriber = null;
+    trackingSuspended = true;
+  }
+  suspendDepth++;
+}
+function resumeTracking() {
+  suspendDepth--;
+  if (suspendDepth === 0) {
+    currentSubscriber = suspendSavedSub;
+    suspendSavedSub = null;
+    trackingSuspended = false;
+  }
+}
 var subscriberEpochCounter = 0;
 function retrack(effectFn, subscriber) {
   const prev = currentSubscriber;
@@ -747,8 +771,14 @@ function watch(getter, callback) {
       return;
     }
     if (!Object.is(newValue, oldValue)) {
-      callback(newValue, oldValue);
+      const prev = oldValue;
       oldValue = newValue;
+      suspendTracking();
+      try {
+        callback(newValue, prev);
+      } finally {
+        resumeTracking();
+      }
     }
   };
   const teardown = track(subscriber);

package/dist/widgets.js

@@ -8,15 +8,15 @@ import {
   select,
   tabs,
   tooltip
-} from "./chunk-2C4E3HBM.js";
-import "./chunk-H6PCHJZQ.js";
-import "./chunk-JYXOEYI4.js";
-import "./chunk-HMJFCBRR.js";
-import "./chunk-FDY42FIU.js";
+} from "./chunk-4WXWJ4SW.js";
+import "./chunk-F4UM7QBJ.js";
+import "./chunk-CVMMULHO.js";
+import "./chunk-L3GAGWCC.js";
+import "./chunk-7JHWAGRQ.js";
 import "./chunk-GOJMFRBL.js";
-import "./chunk-C427DVQF.js";
-import "./chunk-Z2FWAE4B.js";
-import "./chunk-LMLD24FC.js";
+import "./chunk-5K72I3UQ.js";
+import "./chunk-X3NHE2DK.js";
+import "./chunk-COY6PUD2.js";
 export {
   accordion,
   combobox,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sibujs",
-  "version": "3.2.1",
+  "version": "3.3.0",
   "description": "A lightweight, function-based frontend framework that combines the best of React, Svelte, and Vue — with zero VDOM and maximum simplicity. Designed for developers who want fine-grained reactivity and full control without compilation or magic.",
   "keywords": [
     "frontend",