sibujs 3.2.2 → 3.3.1

package/dist/{chunk-HMJFCBRR.js → chunk-L3GAGWCC.js}

@@ -41,7 +41,9 @@ function sanitizeSrcset(value) {
   }
   return out.join(", ");
 }
+var CSS_DANGER_GATE = /[(:@\\]/;
 function sanitizeCSSValue(value) {
+  if (!CSS_DANGER_GATE.test(value)) return value;
   const decoded = value.replace(/\\([0-9a-fA-F]{1,6})\s?/g, (_m, hex) => {
     const code = Number.parseInt(hex, 16);
     if (!Number.isFinite(code) || code < 0 || code > 1114111) return "";
@@ -90,6 +92,12 @@ var URL_ATTRIBUTES = /* @__PURE__ */ new Set([
 function isUrlAttribute(attr) {
   return URL_ATTRIBUTES.has(attr.toLowerCase());
 }
+function sanitizeAttributeString(attr, value) {
+  const lower = attr.toLowerCase();
+  if (lower === "srcset") return sanitizeSrcset(value);
+  if (URL_ATTRIBUTES.has(lower)) return sanitizeUrl(value);
+  return value;
+}
 
 export {
   stripControlChars,
@@ -98,5 +106,6 @@ export {
   sanitizeSrcset,
   sanitizeCSSValue,
   stripHtml,
-  isUrlAttribute
+  isUrlAttribute,
+  sanitizeAttributeString
 };

package/dist/{chunk-X67UYC74.js → chunk-LU2MQXQQ.js}

@@ -1,25 +1,23 @@
 import {
   bindAttribute
-} from "./chunk-RLUJL2MV.js";
+} from "./chunk-NHKQKKZU.js";
 import {
   dispose,
   registerDisposer
-} from "./chunk-2UPRY23K.js";
+} from "./chunk-5VGSK6D2.js";
 import {
   isEventHandlerAttr,
-  isUrlAttribute,
-  sanitizeCSSValue,
-  sanitizeSrcset,
-  sanitizeUrl
-} from "./chunk-HMJFCBRR.js";
+  sanitizeAttributeString,
+  sanitizeCSSValue
+} from "./chunk-L3GAGWCC.js";
 import {
   reactiveBinding,
   track
-} from "./chunk-Z2FWAE4B.js";
+} from "./chunk-TEFZT5PJ.js";
 import {
   devWarn,
   isDev
-} from "./chunk-LMLD24FC.js";
+} from "./chunk-COY6PUD2.js";
 
 // src/reactivity/bindChildNode.ts
 var _isDev = isDev();
@@ -98,11 +96,8 @@ function bindChildNode(placeholder, getter) {
 var SVG_NS = "http://www.w3.org/2000/svg";
 var _isDev2 = isDev();
 var BLOCKED_TAGS = /* @__PURE__ */ new Set(["script", "iframe", "object", "embed", "frame", "frameset"]);
-function validateTagName(tag) {
-  const lower = tag.toLowerCase();
-  if (BLOCKED_TAGS.has(lower)) {
-    throw new Error(`tagFactory: refusing to create <${tag}> \u2014 tag is blocked for security reasons.`);
-  }
+function isBlockedTag(tag) {
+  return BLOCKED_TAGS.has(tag.toLowerCase());
 }
 var CLOBBER_RISKY_IDS = /* @__PURE__ */ new Set([
   "config",
@@ -257,8 +252,11 @@ function appendChildren(el, nodes) {
   }
 }
 var tagFactory = (tag, ns) => {
+  const blocked = isBlockedTag(tag);
   return (first, second) => {
-    validateTagName(tag);
+    if (blocked) {
+      throw new Error(`tagFactory: refusing to create <${tag}> \u2014 tag is blocked for security reasons.`);
+    }
     const el = ns ? document.createElementNS(ns, tag) : document.createElement(tag);
     if (first === void 0) return el;
     if (typeof first === "string") {
@@ -328,7 +326,6 @@ var tagFactory = (tag, ns) => {
         default: {
           const value = props[key];
           if (value == null) continue;
-          const lkey = key.toLowerCase();
           if (isEventHandlerAttr(key)) continue;
           if (typeof value === "function") {
             registerDisposer(el, bindAttribute(el, key, value));
@@ -341,14 +338,7 @@ var tagFactory = (tag, ns) => {
               el.removeAttribute(key);
             }
           } else {
-            const str = String(value);
-            if (lkey === "srcset") {
-              el.setAttribute(key, sanitizeSrcset(str));
-            } else if (isUrlAttribute(lkey)) {
-              el.setAttribute(key, sanitizeUrl(str));
-            } else {
-              el.setAttribute(key, str);
-            }
+            el.setAttribute(key, sanitizeAttributeString(key, String(value)));
           }
         }
       }

package/dist/{chunk-4JCAUOLN.js → chunk-M5KBNOSJ.js}

@@ -1,16 +1,19 @@
 import {
   dispose
-} from "./chunk-2UPRY23K.js";
+} from "./chunk-5VGSK6D2.js";
+import {
+  sanitizeUrl
+} from "./chunk-L3GAGWCC.js";
 import {
   effect
-} from "./chunk-FDY42FIU.js";
+} from "./chunk-MHBCEJQO.js";
 import {
   signal
-} from "./chunk-C427DVQF.js";
+} from "./chunk-WZG2SZOT.js";
 import {
   devWarn,
   isDev
-} from "./chunk-LMLD24FC.js";
+} from "./chunk-COY6PUD2.js";
 
 // src/performance/scheduler.ts
 var Priority = {
@@ -284,11 +287,13 @@ function getDOMPool() {
 }
 var preloadedResources = /* @__PURE__ */ new Set();
 function preloadResource(url, type = "fetch") {
-  if (preloadedResources.has(url)) return;
-  preloadedResources.add(url);
+  const safe = sanitizeUrl(url);
+  if (!safe) return;
+  if (preloadedResources.has(safe)) return;
+  preloadedResources.add(safe);
   const link = document.createElement("link");
   link.rel = "preload";
-  link.href = url;
+  link.href = safe;
   switch (type) {
     case "script":
       link.setAttribute("as", "script");
@@ -306,11 +311,13 @@ function preloadResource(url, type = "fetch") {
   document.head.appendChild(link);
 }
 function prefetch(url) {
-  if (preloadedResources.has(url)) return;
-  preloadedResources.add(url);
+  const safe = sanitizeUrl(url);
+  if (!safe) return;
+  if (preloadedResources.has(safe)) return;
+  preloadedResources.add(safe);
   const link = document.createElement("link");
   link.rel = "prefetch";
-  link.href = url;
+  link.href = safe;
   document.head.appendChild(link);
 }
 function preloadImage(src) {
@@ -679,11 +686,14 @@ function lazyChunk(id, loader, registry, fallback) {
 }
 function preloadModule(url) {
   if (typeof document === "undefined") return;
-  const existing = document.querySelector(`link[href="${url}"][rel="modulepreload"]`);
+  const safe = sanitizeUrl(url);
+  if (!safe) return;
+  const safeHref = typeof CSS !== "undefined" && typeof CSS.escape === "function" ? CSS.escape(safe) : safe.replace(/["\\]/g, "\\$&");
+  const existing = document.querySelector(`link[rel="modulepreload"][href="${safeHref}"]`);
   if (existing) return;
   const link = document.createElement("link");
   link.rel = "modulepreload";
-  link.href = url;
+  link.href = safe;
   document.head.appendChild(link);
 }
 function preloadModules(urls) {

package/dist/{chunk-FDY42FIU.js → chunk-MHBCEJQO.js}

@@ -5,10 +5,10 @@ import {
   cleanup,
   retrack,
   untracked
-} from "./chunk-Z2FWAE4B.js";
+} from "./chunk-TEFZT5PJ.js";
 import {
   devAssert
-} from "./chunk-LMLD24FC.js";
+} from "./chunk-COY6PUD2.js";
 
 // src/core/signals/effect.ts
 var _g = globalThis;

package/dist/{chunk-RLUJL2MV.js → chunk-NHKQKKZU.js}

@@ -1,15 +1,14 @@
 import {
   isEventHandlerAttr,
-  isUrlAttribute,
-  sanitizeUrl
-} from "./chunk-HMJFCBRR.js";
+  sanitizeAttributeString
+} from "./chunk-L3GAGWCC.js";
 import {
   reactiveBinding
-} from "./chunk-Z2FWAE4B.js";
+} from "./chunk-TEFZT5PJ.js";
 import {
   devWarn,
   isDev
-} from "./chunk-LMLD24FC.js";
+} from "./chunk-COY6PUD2.js";
 
 // src/reactivity/bindAttribute.ts
 var _isDev = isDev();
@@ -48,7 +47,7 @@ function bindAttribute(el, attr, getter) {
     if ((attr === "value" || attr === "checked") && attr in el) {
       setProp(el, attr, attr === "checked" ? Boolean(value) : str);
     } else {
-      el.setAttribute(attr, isUrlAttribute(attr) ? sanitizeUrl(str) : str);
+      el.setAttribute(attr, sanitizeAttributeString(attr, str));
     }
   }
   return reactiveBinding(commit);
@@ -78,7 +77,7 @@ function bindDynamic(el, nameGetter, valueGetter) {
     if ((name === "value" || name === "checked") && name in el) {
       setProp(el, name, name === "checked" ? Boolean(value) : str);
     } else {
-      el.setAttribute(name, isUrlAttribute(name) ? sanitizeUrl(str) : str);
+      el.setAttribute(name, sanitizeAttributeString(name, str));
     }
     prevName = name;
   }

package/dist/{chunk-HXMS4SNP.js → chunk-R3QEDXFS.js}

@@ -3,13 +3,13 @@ import {
   sanitizeSrcset,
   sanitizeUrl,
   stripControlChars
-} from "./chunk-HMJFCBRR.js";
+} from "./chunk-L3GAGWCC.js";
 import {
   getSSRStore
 } from "./chunk-GOJMFRBL.js";
 import {
   isDev
-} from "./chunk-LMLD24FC.js";
+} from "./chunk-COY6PUD2.js";
 
 // src/platform/ssr.ts
 function sanitizeUrlAttr(name, value) {

package/dist/{chunk-NPIEEKPT.js → chunk-RYMOSG5B.js}

@@ -1,22 +1,22 @@
 import {
   bindAttribute
-} from "./chunk-RLUJL2MV.js";
+} from "./chunk-NHKQKKZU.js";
 import {
   derived
-} from "./chunk-JYXOEYI4.js";
+} from "./chunk-WW6DAGGR.js";
 import {
   dispose,
   registerDisposer
-} from "./chunk-2UPRY23K.js";
+} from "./chunk-5VGSK6D2.js";
 import {
   effect
-} from "./chunk-FDY42FIU.js";
+} from "./chunk-MHBCEJQO.js";
 import {
   signal
-} from "./chunk-C427DVQF.js";
+} from "./chunk-WZG2SZOT.js";
 import {
   track
-} from "./chunk-Z2FWAE4B.js";
+} from "./chunk-TEFZT5PJ.js";
 
 // src/ui/form.ts
 function required(message = "This field is required") {

package/dist/{chunk-H6PCHJZQ.js → chunk-SLMFA3ZZ.js}

@@ -2,11 +2,13 @@ import {
   isSSR
 } from "./chunk-GOJMFRBL.js";
 import {
+  resumeTracking,
+  suspendTracking,
   track
-} from "./chunk-Z2FWAE4B.js";
+} from "./chunk-TEFZT5PJ.js";
 import {
   devAssert
-} from "./chunk-LMLD24FC.js";
+} from "./chunk-COY6PUD2.js";
 
 // src/core/signals/watch.ts
 function watch(getter, callback) {
@@ -24,8 +26,14 @@ function watch(getter, callback) {
       return;
     }
     if (!Object.is(newValue, oldValue)) {
-      callback(newValue, oldValue);
+      const prev = oldValue;
       oldValue = newValue;
+      suspendTracking();
+      try {
+        callback(newValue, prev);
+      } finally {
+        resumeTracking();
+      }
     }
   };
   const teardown = track(subscriber);

package/dist/{chunk-Z2FWAE4B.js → chunk-TEFZT5PJ.js}

@@ -1,9 +1,9 @@
 import {
   devWarn,
   isDev
-} from "./chunk-LMLD24FC.js";
+} from "./chunk-COY6PUD2.js";
 
-// src/reactivity/track.ts
+// src/reactivity/track-core.ts
 var _isDev = isDev();
 var POOL_MAX = 4096;
 var nodePool = [];
@@ -117,6 +117,9 @@ function resumeTracking() {
     trackingSuspended = false;
   }
 }
+function isTrackingSuspended() {
+  return trackingSuspended;
+}
 function untracked(fn) {
   suspendTracking();
   try {
@@ -234,6 +237,11 @@ function cleanup(subscriber) {
 var maxSubscriberRepeats = 50;
 var maxDrainIterations = 1e6;
 var drainEpoch = 0;
+function setMaxSubscriberRepeats(n) {
+  const prev = maxSubscriberRepeats;
+  if (Number.isFinite(n) && n > 0) maxSubscriberRepeats = Math.floor(n);
+  return prev;
+}
 function setMaxDrainIterations(n) {
   const prev = maxDrainIterations;
   if (Number.isFinite(n) && n > 0) maxDrainIterations = Math.floor(n);
@@ -409,19 +417,79 @@ function forEachSubscriber(signal, visit) {
   }
 }
 
+// src/reactivity/track.ts
+var _isDev2 = isDev();
+var _runtimeVersion = typeof __SIBU_VERSION__ !== "undefined" ? __SIBU_VERSION__ : "dev";
+var REGISTRY_KEY = /* @__PURE__ */ Symbol.for("sibujs.reactive.v1");
+function resolveReactiveApi() {
+  const g = globalThis;
+  const existing = g[REGISTRY_KEY];
+  if (existing) {
+    if (_isDev2 && !existing.__dupWarned) {
+      existing.__dupWarned = true;
+      devWarn(
+        `Multiple instances of the reactive runtime detected on this page (active: ${existing.version}, duplicate: ${_runtimeVersion}). Reactivity still works \u2014 all copies share the first one \u2014 but de-duplicate sibujs in your bundler (e.g. Vite optimizeDeps.exclude: ['sibujs'] or resolve.dedupe: ['sibujs']).`
+      );
+    }
+    return existing;
+  }
+  const local = {
+    suspendTracking,
+    resumeTracking,
+    isTrackingSuspended,
+    untracked,
+    retrack,
+    track,
+    reactiveBinding,
+    recordDependency,
+    cleanup,
+    setMaxSubscriberRepeats,
+    setMaxDrainIterations,
+    drainNotificationQueue,
+    queueSignalNotification,
+    notifySubscribers,
+    getSubscriberCount,
+    getSubscriberDeps,
+    forEachSubscriber,
+    version: _runtimeVersion
+  };
+  g[REGISTRY_KEY] = local;
+  return local;
+}
+var API = resolveReactiveApi();
+var suspendTracking2 = API.suspendTracking;
+var resumeTracking2 = API.resumeTracking;
+var isTrackingSuspended2 = API.isTrackingSuspended;
+var untracked2 = API.untracked;
+var retrack2 = API.retrack;
+var track2 = API.track;
+var reactiveBinding2 = API.reactiveBinding;
+var recordDependency2 = API.recordDependency;
+var cleanup2 = API.cleanup;
+var setMaxSubscriberRepeats2 = API.setMaxSubscriberRepeats;
+var setMaxDrainIterations2 = API.setMaxDrainIterations;
+var drainNotificationQueue2 = API.drainNotificationQueue;
+var queueSignalNotification2 = API.queueSignalNotification;
+var notifySubscribers2 = API.notifySubscribers;
+var getSubscriberCount2 = API.getSubscriberCount;
+var getSubscriberDeps2 = API.getSubscriberDeps;
+var forEachSubscriber2 = API.forEachSubscriber;
+
 export {
-  trackingSuspended,
-  untracked,
-  retrack,
-  track,
-  reactiveBinding,
-  recordDependency,
-  cleanup,
-  setMaxDrainIterations,
-  drainNotificationQueue,
-  queueSignalNotification,
-  notifySubscribers,
-  getSubscriberCount,
-  getSubscriberDeps,
-  forEachSubscriber
+  suspendTracking2 as suspendTracking,
+  resumeTracking2 as resumeTracking,
+  isTrackingSuspended2 as isTrackingSuspended,
+  untracked2 as untracked,
+  retrack2 as retrack,
+  track2 as track,
+  reactiveBinding2 as reactiveBinding,
+  recordDependency2 as recordDependency,
+  cleanup2 as cleanup,
+  setMaxDrainIterations2 as setMaxDrainIterations,
+  drainNotificationQueue2 as drainNotificationQueue,
+  queueSignalNotification2 as queueSignalNotification,
+  notifySubscribers2 as notifySubscribers,
+  getSubscriberCount2 as getSubscriberCount,
+  getSubscriberDeps2 as getSubscriberDeps,
+  forEachSubscriber2 as forEachSubscriber
 };

package/dist/{chunk-7XDYVJLE.js → chunk-ULLTNDRA.js}

@@ -1,23 +1,23 @@
 import {
   dispose
-} from "./chunk-2UPRY23K.js";
+} from "./chunk-5VGSK6D2.js";
 import {
   stripHtml
-} from "./chunk-HMJFCBRR.js";
+} from "./chunk-L3GAGWCC.js";
 import {
   effect
-} from "./chunk-FDY42FIU.js";
+} from "./chunk-MHBCEJQO.js";
 import {
   signal
-} from "./chunk-C427DVQF.js";
+} from "./chunk-WZG2SZOT.js";
 import {
   forEachSubscriber,
   getSubscriberCount,
   getSubscriberDeps
-} from "./chunk-Z2FWAE4B.js";
+} from "./chunk-TEFZT5PJ.js";
 import {
   isDev
-} from "./chunk-LMLD24FC.js";
+} from "./chunk-COY6PUD2.js";
 
 // src/devtools/debug.ts
 var debugEnabled = false;

package/dist/{chunk-GOUM4JCT.js → chunk-VOVVTOEA.js}

@@ -3,11 +3,11 @@ import {
 } from "./chunk-H3SRKIYX.js";
 import {
   effect
-} from "./chunk-FDY42FIU.js";
+} from "./chunk-MHBCEJQO.js";
 import {
   batch,
   signal
-} from "./chunk-C427DVQF.js";
+} from "./chunk-WZG2SZOT.js";
 
 // src/browser/media.ts
 function media(query) {

package/dist/{chunk-FOI23UJL.js → chunk-WL7BIR6O.js}

@@ -1,6 +1,6 @@
 import {
   signal
-} from "./chunk-C427DVQF.js";
+} from "./chunk-WZG2SZOT.js";
 
 // src/ui/transition.ts
 function transition(element, options = {}) {

package/dist/{chunk-JYXOEYI4.js → chunk-WW6DAGGR.js}

@@ -1,12 +1,12 @@
 import {
+  isTrackingSuspended,
   recordDependency,
   retrack,
-  track,
-  trackingSuspended
-} from "./chunk-Z2FWAE4B.js";
+  track
+} from "./chunk-TEFZT5PJ.js";
 import {
   devAssert
-} from "./chunk-LMLD24FC.js";
+} from "./chunk-COY6PUD2.js";
 
 // src/core/signals/derived.ts
 function derived(getter, options) {
@@ -49,7 +49,7 @@ function derived(getter, options) {
         `[SibuJS] Circular dependency detected in derived${debugName ? ` "${debugName}"` : ""}. A derived signal cannot read itself (directly or through a chain).`
       );
     }
-    if (trackingSuspended) {
+    if (isTrackingSuspended()) {
       if (cs._d) {
         const prev = cs._v;
         evaluating = true;

package/dist/{chunk-C427DVQF.js → chunk-WZG2SZOT.js}

@@ -3,15 +3,15 @@ import {
   notifySubscribers,
   queueSignalNotification,
   recordDependency
-} from "./chunk-Z2FWAE4B.js";
+} from "./chunk-TEFZT5PJ.js";
 import {
   isDev
-} from "./chunk-LMLD24FC.js";
+} from "./chunk-COY6PUD2.js";
 
 // src/reactivity/batch.ts
 var batchDepth = 0;
 var pendingSignals = /* @__PURE__ */ new Set();
-function batch(fn) {
+function batchImpl(fn) {
   batchDepth++;
   try {
     return fn();
@@ -22,12 +22,12 @@ function batch(fn) {
     }
   }
 }
-function enqueueBatchedSignal(signal2) {
+function enqueueBatchedSignalImpl(signal2) {
   if (batchDepth === 0) return false;
   pendingSignals.add(signal2);
   return true;
 }
-function isBatching() {
+function isBatchingImpl() {
   return batchDepth > 0;
 }
 function flushBatch() {
@@ -40,6 +40,23 @@ function flushBatch() {
   }
   drainNotificationQueue();
 }
+var BATCH_REGISTRY_KEY = /* @__PURE__ */ Symbol.for("sibujs.reactive.batch.v1");
+function resolveBatchApi() {
+  const g = globalThis;
+  const existing = g[BATCH_REGISTRY_KEY];
+  if (existing) return existing;
+  const local = {
+    batch: batchImpl,
+    enqueueBatchedSignal: enqueueBatchedSignalImpl,
+    isBatching: isBatchingImpl
+  };
+  g[BATCH_REGISTRY_KEY] = local;
+  return local;
+}
+var API = resolveBatchApi();
+var batch = API.batch;
+var enqueueBatchedSignal = API.enqueueBatchedSignal;
+var isBatching = API.isBatching;
 
 // src/core/signals/signal.ts
 var _g = globalThis;

package/dist/{chunk-NFYWLRUO.js → chunk-XH2RTYEQ.js}

@@ -4,14 +4,14 @@ import {
 } from "./chunk-H3SRKIYX.js";
 import {
   derived
-} from "./chunk-JYXOEYI4.js";
+} from "./chunk-WW6DAGGR.js";
 import {
   effect
-} from "./chunk-FDY42FIU.js";
+} from "./chunk-MHBCEJQO.js";
 import {
   batch,
   signal
-} from "./chunk-C427DVQF.js";
+} from "./chunk-WZG2SZOT.js";
 
 // src/patterns/machine.ts
 function machine(config) {

package/dist/{chunk-2C4E3HBM.js → chunk-Z37APKBV.js}

@@ -1,19 +1,19 @@
 import {
   watch
-} from "./chunk-H6PCHJZQ.js";
+} from "./chunk-SLMFA3ZZ.js";
 import {
   derived
-} from "./chunk-JYXOEYI4.js";
+} from "./chunk-WW6DAGGR.js";
 import {
   stripHtml
-} from "./chunk-HMJFCBRR.js";
+} from "./chunk-L3GAGWCC.js";
 import {
   effect
-} from "./chunk-FDY42FIU.js";
+} from "./chunk-MHBCEJQO.js";
 import {
   batch,
   signal
-} from "./chunk-C427DVQF.js";
+} from "./chunk-WZG2SZOT.js";
 
 // src/widgets/Combobox.ts
 var comboboxIdCounter = 0;

package/dist/{chunk-RDRSWYNP.js → chunk-ZUVLC7TM.js}

@@ -1,6 +1,6 @@
 import {
   renderToString
-} from "./chunk-HXMS4SNP.js";
+} from "./chunk-R3QEDXFS.js";
 
 // src/plugins/modular.ts
 function createModuleRegistry() {