sibujs 3.2.2 → 3.3.1

package/dist/performance.cjs

@@ -218,7 +218,13 @@ async function processInChunks(items, processor, chunkSize = 50) {
 
 // src/core/dev.ts
 function isDev() {
-  return typeof globalThis.__SIBU_DEV__ !== "undefined" ? !!globalThis.__SIBU_DEV__ : typeof __SIBU_DEV__ !== "undefined" ? __SIBU_DEV__ : typeof process !== "undefined" && process.env?.NODE_ENV !== "production";
+  return typeof globalThis.__SIBU_DEV__ !== "undefined" ? !!globalThis.__SIBU_DEV__ : (
+    // The bare `__SIBU_DEV__` is a bundler define that only exists in
+    // production builds; under the test runner it is always undefined, so
+    // this branch is unreachable here.
+    /* v8 ignore next 2 */
+    typeof __SIBU_DEV__ !== "undefined" ? __SIBU_DEV__ : typeof process !== "undefined" && process.env?.NODE_ENV !== "production"
+  );
 }
 var _isDev = isDev();
 function devAssert(condition, message) {
@@ -232,7 +238,7 @@ function devWarn(message) {
   }
 }
 
-// src/reactivity/track.ts
+// src/reactivity/track-core.ts
 var _isDev2 = isDev();
 var POOL_MAX = 4096;
 var nodePool = [];
@@ -316,6 +322,7 @@ function unlinkSub(node) {
   else sub.depsTail = prev;
 }
 var currentSubscriber = null;
+var suspendSavedSub = null;
 var notifyDepth = 0;
 var pendingQueue = [];
 var pendingSet = /* @__PURE__ */ new Set();
@@ -327,6 +334,35 @@ function safeInvoke(sub) {
     if (_isDev2) devWarn(`Subscriber threw during notification: ${err instanceof Error ? err.message : String(err)}`);
   }
 }
+var suspendDepth = 0;
+var trackingSuspended = false;
+function suspendTracking() {
+  if (suspendDepth === 0) {
+    suspendSavedSub = currentSubscriber;
+    currentSubscriber = null;
+    trackingSuspended = true;
+  }
+  suspendDepth++;
+}
+function resumeTracking() {
+  suspendDepth--;
+  if (suspendDepth === 0) {
+    currentSubscriber = suspendSavedSub;
+    suspendSavedSub = null;
+    trackingSuspended = false;
+  }
+}
+function isTrackingSuspended() {
+  return trackingSuspended;
+}
+function untracked(fn) {
+  suspendTracking();
+  try {
+    return fn();
+  } finally {
+    resumeTracking();
+  }
+}
 var subscriberEpochCounter = 0;
 function retrack(effectFn, subscriber) {
   const prev = currentSubscriber;
@@ -359,6 +395,51 @@ function retrack(effectFn, subscriber) {
     }
   }
 }
+function track(effectFn, subscriber) {
+  if (!subscriber) return reactiveBinding(effectFn);
+  cleanup(subscriber);
+  const prev = currentSubscriber;
+  currentSubscriber = subscriber;
+  try {
+    effectFn();
+  } finally {
+    currentSubscriber = prev;
+    const sub2 = subscriber;
+    for (let n = sub2.depsHead ?? null; n !== null; n = n.subNext) {
+      const sig = n.sig;
+      sig.__activeNode = n.prevActive;
+      n.prevActive = null;
+    }
+  }
+  const sub = subscriber;
+  return sub._dispose ?? (sub._dispose = () => cleanup(subscriber));
+}
+function reactiveBinding(commit) {
+  const run = () => {
+    const s = subscriber;
+    if (s._disposed || s._reentrant) return;
+    s._reentrant = true;
+    try {
+      retrack(commit, subscriber);
+    } finally {
+      s._reentrant = false;
+    }
+  };
+  const subscriber = run;
+  subscriber.depsHead = null;
+  subscriber.depsTail = null;
+  subscriber._epoch = 0;
+  subscriber._structDirty = false;
+  subscriber._runEpoch = 0;
+  subscriber._runs = 0;
+  subscriber._reentrant = false;
+  subscriber._disposed = false;
+  run();
+  return subscriber._dispose ?? (subscriber._dispose = () => {
+    subscriber._disposed = true;
+    cleanup(subscriber);
+  });
+}
 function recordDependency(signal2) {
   if (!currentSubscriber) return;
   const sub = currentSubscriber;
@@ -391,6 +472,16 @@ function cleanup(subscriber) {
 var maxSubscriberRepeats = 50;
 var maxDrainIterations = 1e6;
 var drainEpoch = 0;
+function setMaxSubscriberRepeats(n) {
+  const prev = maxSubscriberRepeats;
+  if (Number.isFinite(n) && n > 0) maxSubscriberRepeats = Math.floor(n);
+  return prev;
+}
+function setMaxDrainIterations(n) {
+  const prev = maxDrainIterations;
+  if (Number.isFinite(n) && n > 0) maxDrainIterations = Math.floor(n);
+  return prev;
+}
 function tickRepeat(sub) {
   const s = sub;
   if (s._runEpoch !== drainEpoch) {
@@ -432,6 +523,20 @@ function drainQueue() {
     safeInvoke(sub);
   }
 }
+function drainNotificationQueue() {
+  if (notifyDepth > 0) return;
+  notifyDepth++;
+  drainEpoch++;
+  try {
+    drainQueue();
+  } finally {
+    notifyDepth--;
+    if (notifyDepth === 0) {
+      pendingQueue.length = 0;
+      pendingSet.clear();
+    }
+  }
+}
 function propagateDirty(sub) {
   sub();
   const rootSig = sub._sig;
@@ -464,6 +569,22 @@ function propagateDirty(sub) {
     }
   }
 }
+function queueSignalNotification(signal2) {
+  const sig = signal2;
+  let node = sig.subsHead ?? null;
+  while (node) {
+    const s = node.sub;
+    if (s) {
+      if (s._c) {
+        propagateDirty(s);
+      } else if (!pendingSet.has(s)) {
+        pendingSet.add(s);
+        pendingQueue.push(s);
+      }
+    }
+    node = node.sigNext;
+  }
+}
 function notifySubscribers(signal2) {
   const sig = signal2;
   const head = sig.subsHead;
@@ -509,6 +630,85 @@ function notifySubscribers(signal2) {
     }
   }
 }
+function getSubscriberCount(signal2) {
+  return signal2.__sc ?? 0;
+}
+function getSubscriberDeps(subscriber) {
+  const sub = subscriber;
+  const out = [];
+  let node = sub.depsHead ?? null;
+  while (node) {
+    if (node.sig) out.push(node.sig);
+    node = node.subNext;
+  }
+  return out;
+}
+function forEachSubscriber(signal2, visit) {
+  let node = signal2.subsHead ?? null;
+  while (node) {
+    const s = node.sub;
+    if (s) visit(s);
+    node = node.sigNext;
+  }
+}
+
+// src/reactivity/track.ts
+var _isDev3 = isDev();
+var _runtimeVersion = typeof __SIBU_VERSION__ !== "undefined" ? __SIBU_VERSION__ : "dev";
+var REGISTRY_KEY = /* @__PURE__ */ Symbol.for("sibujs.reactive.v1");
+function resolveReactiveApi() {
+  const g = globalThis;
+  const existing = g[REGISTRY_KEY];
+  if (existing) {
+    if (_isDev3 && !existing.__dupWarned) {
+      existing.__dupWarned = true;
+      devWarn(
+        `Multiple instances of the reactive runtime detected on this page (active: ${existing.version}, duplicate: ${_runtimeVersion}). Reactivity still works \u2014 all copies share the first one \u2014 but de-duplicate sibujs in your bundler (e.g. Vite optimizeDeps.exclude: ['sibujs'] or resolve.dedupe: ['sibujs']).`
+      );
+    }
+    return existing;
+  }
+  const local = {
+    suspendTracking,
+    resumeTracking,
+    isTrackingSuspended,
+    untracked,
+    retrack,
+    track,
+    reactiveBinding,
+    recordDependency,
+    cleanup,
+    setMaxSubscriberRepeats,
+    setMaxDrainIterations,
+    drainNotificationQueue,
+    queueSignalNotification,
+    notifySubscribers,
+    getSubscriberCount,
+    getSubscriberDeps,
+    forEachSubscriber,
+    version: _runtimeVersion
+  };
+  g[REGISTRY_KEY] = local;
+  return local;
+}
+var API = resolveReactiveApi();
+var suspendTracking2 = API.suspendTracking;
+var resumeTracking2 = API.resumeTracking;
+var isTrackingSuspended2 = API.isTrackingSuspended;
+var untracked2 = API.untracked;
+var retrack2 = API.retrack;
+var track2 = API.track;
+var reactiveBinding2 = API.reactiveBinding;
+var recordDependency2 = API.recordDependency;
+var cleanup2 = API.cleanup;
+var setMaxSubscriberRepeats2 = API.setMaxSubscriberRepeats;
+var setMaxDrainIterations2 = API.setMaxDrainIterations;
+var drainNotificationQueue2 = API.drainNotificationQueue;
+var queueSignalNotification2 = API.queueSignalNotification;
+var notifySubscribers2 = API.notifySubscribers;
+var getSubscriberCount2 = API.getSubscriberCount;
+var getSubscriberDeps2 = API.getSubscriberDeps;
+var forEachSubscriber2 = API.forEachSubscriber;
 
 // src/core/ssr-context.ts
 var als = null;
@@ -559,7 +759,7 @@ function drainReruns(ctx) {
   do {
     ctx.rerunPending = false;
     if (ctx.userCleanups.length > 0) flushUserCleanups(ctx);
-    retrack(ctx.bodyFn, ctx.subscriber);
+    retrack2(ctx.bodyFn, ctx.subscriber);
   } while (ctx.rerunPending && ++reruns <= MAX_RERUNS);
   if (ctx.rerunPending) {
     ctx.rerunPending = false;
@@ -588,7 +788,7 @@ function disposeEffect(ctx) {
     }
   }
   try {
-    cleanup(ctx.subscriber);
+    cleanup2(ctx.subscriber);
   } catch (err) {
     if (typeof console !== "undefined") {
       console.warn("[SibuJS effect] dispose threw:", err);
@@ -633,7 +833,7 @@ function effect(effectFn, options) {
     try {
       ctx.rerunPending = false;
       if (ctx.userCleanups.length > 0) flushUserCleanups(ctx);
-      retrack(ctx.bodyFn, sub);
+      retrack2(ctx.bodyFn, sub);
       if (ctx.rerunPending) drainReruns(ctx);
     } finally {
       ctx.running = false;
@@ -649,7 +849,7 @@ function effect(effectFn, options) {
   ctx.subscriber = sub;
   ctx.running = true;
   try {
-    retrack(ctx.bodyFn, ctx.subscriber);
+    retrack2(ctx.bodyFn, ctx.subscriber);
     if (ctx.rerunPending) drainReruns(ctx);
   } finally {
     ctx.running = false;
@@ -663,15 +863,56 @@ function effect(effectFn, options) {
 // src/reactivity/batch.ts
 var batchDepth = 0;
 var pendingSignals = /* @__PURE__ */ new Set();
-function enqueueBatchedSignal(signal2) {
+function batchImpl(fn) {
+  batchDepth++;
+  try {
+    return fn();
+  } finally {
+    batchDepth--;
+    if (batchDepth === 0) {
+      flushBatch();
+    }
+  }
+}
+function enqueueBatchedSignalImpl(signal2) {
   if (batchDepth === 0) return false;
   pendingSignals.add(signal2);
   return true;
 }
+function isBatchingImpl() {
+  return batchDepth > 0;
+}
+function flushBatch() {
+  try {
+    for (const signal2 of pendingSignals) {
+      queueSignalNotification2(signal2);
+    }
+  } finally {
+    pendingSignals.clear();
+  }
+  drainNotificationQueue2();
+}
+var BATCH_REGISTRY_KEY = /* @__PURE__ */ Symbol.for("sibujs.reactive.batch.v1");
+function resolveBatchApi() {
+  const g = globalThis;
+  const existing = g[BATCH_REGISTRY_KEY];
+  if (existing) return existing;
+  const local = {
+    batch: batchImpl,
+    enqueueBatchedSignal: enqueueBatchedSignalImpl,
+    isBatching: isBatchingImpl
+  };
+  g[BATCH_REGISTRY_KEY] = local;
+  return local;
+}
+var API2 = resolveBatchApi();
+var batch = API2.batch;
+var enqueueBatchedSignal = API2.enqueueBatchedSignal;
+var isBatching = API2.isBatching;
 
 // src/core/signals/signal.ts
 var _g2 = globalThis;
-var _isDev3 = isDev();
+var _isDev4 = isDev();
 function signal(initial, options) {
   const state = {
     value: initial,
@@ -682,11 +923,11 @@ function signal(initial, options) {
     __activeNode: null,
     __name: void 0
   };
-  const debugName = _isDev3 ? options?.name : void 0;
+  const debugName = _isDev4 ? options?.name : void 0;
   const equalsFn = options?.equals;
   if (debugName) state.__name = debugName;
   function get() {
-    recordDependency(state);
+    recordDependency2(state);
     return state.value;
   }
   get.__signal = state;
@@ -699,15 +940,15 @@ function signal(initial, options) {
       if (equalsFn(prev, newValue)) return;
       state.value = newValue;
       state.__v++;
-      if (_isDev3) {
+      if (_isDev4) {
         const hook = _g2.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
         if (hook) hook.emit("signal:update", { signal: state, name: debugName, oldValue: prev, newValue });
       }
       if (!enqueueBatchedSignal(state)) {
-        notifySubscribers(state);
+        notifySubscribers2(state);
       }
     };
-  } else if (_isDev3) {
+  } else if (_isDev4) {
     set = (next) => {
       const prev = state.value;
       const newValue = typeof next === "function" ? next(prev) : next;
@@ -717,7 +958,7 @@ function signal(initial, options) {
       const hook = _g2.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
       if (hook) hook.emit("signal:update", { signal: state, name: debugName, oldValue: prev, newValue });
       if (!enqueueBatchedSignal(state)) {
-        notifySubscribers(state);
+        notifySubscribers2(state);
       }
     };
   } else {
@@ -728,11 +969,11 @@ function signal(initial, options) {
       state.value = newValue;
       state.__v++;
       if (!enqueueBatchedSignal(state)) {
-        notifySubscribers(state);
+        notifySubscribers2(state);
       }
     };
   }
-  if (_isDev3) {
+  if (_isDev4) {
     const hook = _g2.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
     if (hook) hook.emit("signal:create", { signal: state, name: debugName, getter: get, initial });
   }
@@ -778,8 +1019,33 @@ function uniqueId(suffix) {
   return suffix ? `${id}-${suffix}` : id;
 }
 
+// src/utils/sanitize.ts
+function stripControlChars(value) {
+  return value.replace(/[\x00-\x20\x7f-\x9f]+/g, "");
+}
+var SAFE_URL_PROTOCOLS = ["http:", "https:", "mailto:", "tel:", "ftp:"];
+function sanitizeUrl(url) {
+  const trimmed = stripControlChars(url).trim();
+  if (!trimmed) return "";
+  const lower = trimmed.toLowerCase();
+  let schemeEnd = -1;
+  for (let i = 0; i < lower.length; i++) {
+    const ch = lower.charCodeAt(i);
+    if (ch === 58) {
+      schemeEnd = i;
+      break;
+    }
+    if (ch === 47 || ch === 63 || ch === 35) break;
+  }
+  if (schemeEnd === -1) return trimmed;
+  const scheme = lower.slice(0, schemeEnd + 1);
+  if (!/^[a-z][a-z0-9+.-]*:$/.test(scheme)) return trimmed;
+  if (SAFE_URL_PROTOCOLS.indexOf(scheme) === -1) return "";
+  return trimmed;
+}
+
 // src/performance/domRecycler.ts
-var _isDev4 = isDev();
+var _isDev5 = isDev();
 var DOMPool = class {
   constructor(maxSize = 50) {
     this.pools = /* @__PURE__ */ new Map();
@@ -806,7 +1072,7 @@ var DOMPool = class {
    * is almost certainly a bug.
    */
   release(element) {
-    if (_isDev4 && element.isConnected) {
+    if (_isDev5 && element.isConnected) {
       devWarn(
         "DOMPool.release() called on a still-connected element. Detach it from the DOM first (remove() / dispose())."
       );
@@ -853,11 +1119,13 @@ function getDOMPool() {
 }
 var preloadedResources = /* @__PURE__ */ new Set();
 function preloadResource(url, type = "fetch") {
-  if (preloadedResources.has(url)) return;
-  preloadedResources.add(url);
+  const safe = sanitizeUrl(url);
+  if (!safe) return;
+  if (preloadedResources.has(safe)) return;
+  preloadedResources.add(safe);
   const link = document.createElement("link");
   link.rel = "preload";
-  link.href = url;
+  link.href = safe;
   switch (type) {
     case "script":
       link.setAttribute("as", "script");
@@ -875,11 +1143,13 @@ function preloadResource(url, type = "fetch") {
   document.head.appendChild(link);
 }
 function prefetch(url) {
-  if (preloadedResources.has(url)) return;
-  preloadedResources.add(url);
+  const safe = sanitizeUrl(url);
+  if (!safe) return;
+  if (preloadedResources.has(safe)) return;
+  preloadedResources.add(safe);
   const link = document.createElement("link");
   link.rel = "prefetch";
-  link.href = url;
+  link.href = safe;
   document.head.appendChild(link);
 }
 function preloadImage(src) {
@@ -914,7 +1184,7 @@ function noSideEffect(fn) {
 }
 
 // src/platform/ssr.ts
-var _isDev5 = isDev();
+var _isDev6 = isDev();
 function trustHTML(html) {
   return html;
 }
@@ -1073,7 +1343,7 @@ function denormalize(id, entities, schema) {
 
 // src/core/rendering/dispose.ts
 var elementDisposers = /* @__PURE__ */ new WeakMap();
-var _isDev6 = isDev();
+var _isDev7 = isDev();
 var activeBindingCount = 0;
 function dispose(node) {
   const stack = [node];
@@ -1092,12 +1362,12 @@ function dispose(node) {
     if (disposers) {
       const snapshot = disposers.slice();
       elementDisposers.delete(current);
-      if (_isDev6) activeBindingCount -= snapshot.length;
+      if (_isDev7) activeBindingCount -= snapshot.length;
       for (const d of snapshot) {
         try {
           d();
         } catch (err) {
-          if (_isDev6 && typeof console !== "undefined") {
+          if (_isDev7 && typeof console !== "undefined") {
             console.warn("[SibuJS] Disposer threw during cleanup:", err);
           }
         }
@@ -1108,12 +1378,12 @@ function dispose(node) {
         if (!added || added.length === 0) break;
         const moreSnapshot = added.slice();
         elementDisposers.delete(current);
-        if (_isDev6) activeBindingCount -= moreSnapshot.length;
+        if (_isDev7) activeBindingCount -= moreSnapshot.length;
         for (const d of moreSnapshot) {
           try {
             d();
           } catch (err) {
-            if (_isDev6 && typeof console !== "undefined") {
+            if (_isDev7 && typeof console !== "undefined") {
               console.warn("[SibuJS] Disposer threw during cleanup:", err);
             }
           }
@@ -1307,11 +1577,14 @@ function lazyChunk(id, loader, registry, fallback) {
 }
 function preloadModule(url) {
   if (typeof document === "undefined") return;
-  const existing = document.querySelector(`link[href="${url}"][rel="modulepreload"]`);
+  const safe = sanitizeUrl(url);
+  if (!safe) return;
+  const safeHref = typeof CSS !== "undefined" && typeof CSS.escape === "function" ? CSS.escape(safe) : safe.replace(/["\\]/g, "\\$&");
+  const existing = document.querySelector(`link[rel="modulepreload"][href="${safeHref}"]`);
   if (existing) return;
   const link = document.createElement("link");
   link.rel = "modulepreload";
-  link.href = url;
+  link.href = safe;
   document.head.appendChild(link);
 }
 function preloadModules(urls) {

package/dist/performance.js

@@ -33,17 +33,17 @@ import {
   transitionState,
   uniqueId,
   yieldToMain
-} from "./chunk-4JCAUOLN.js";
+} from "./chunk-M5KBNOSJ.js";
 import {
   trustHTML
-} from "./chunk-HXMS4SNP.js";
-import "./chunk-2UPRY23K.js";
-import "./chunk-HMJFCBRR.js";
-import "./chunk-FDY42FIU.js";
+} from "./chunk-R3QEDXFS.js";
+import "./chunk-5VGSK6D2.js";
+import "./chunk-L3GAGWCC.js";
+import "./chunk-MHBCEJQO.js";
 import "./chunk-GOJMFRBL.js";
-import "./chunk-C427DVQF.js";
-import "./chunk-Z2FWAE4B.js";
-import "./chunk-LMLD24FC.js";
+import "./chunk-WZG2SZOT.js";
+import "./chunk-TEFZT5PJ.js";
+import "./chunk-COY6PUD2.js";
 export {
   DOMPool,
   Features,