sibujs 3.4.0 → 4.0.0

package/dist/{chunk-EX77FXTT.js → chunk-HYCCIYNS.js}

@@ -1,39 +1,195 @@
 import {
+  canonicalAttrName,
   isEventHandlerAttr,
-  sanitizeSrcset,
+  isHtmlContentAttribute,
+  isPolicyAttribute,
+  sanitizeAttributeString,
   sanitizeUrl,
   stripControlChars
-} from "./chunk-L3GAGWCC.js";
+} from "./chunk-5INI7D2L.js";
 import {
   getSSRStore
-} from "./chunk-S3NFJO6L.js";
+} from "./chunk-TIRZCERI.js";
+import {
+  dispose,
+  replaceChildrenSafely
+} from "./chunk-DHDZ7IVN.js";
 import {
   isDev
-} from "./chunk-COY6PUD2.js";
+} from "./chunk-VPP2FONR.js";
+
+// src/utils/metaRefresh.ts
+function isAsciiWhitespace(ch) {
+  return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f";
+}
+function trimAsciiWhitespace(value) {
+  let start = 0;
+  let end = value.length;
+  while (start < end && isAsciiWhitespace(value[start])) start++;
+  while (end > start && isAsciiWhitespace(value[end - 1])) end--;
+  return value.slice(start, end);
+}
+var forbidden = (reason) => ({ kind: "forbidden", reason });
+function parseMetaRefreshContent(content) {
+  const raw = trimAsciiWhitespace(stripControlChars(content));
+  if (raw === "") return forbidden("empty content");
+  let i = 0;
+  while (i < raw.length && raw[i] >= "0" && raw[i] <= "9") i++;
+  if (i === 0) return forbidden("missing or non-numeric delay");
+  const delay = Number.parseInt(raw.slice(0, i), 10);
+  if (!Number.isFinite(delay)) return forbidden("unparseable delay");
+  while (i < raw.length && isAsciiWhitespace(raw[i])) i++;
+  if (i === raw.length) return { kind: "delay-only", delay };
+  if (raw[i] !== ";" && raw[i] !== ",") return forbidden("unexpected text after delay");
+  i++;
+  while (i < raw.length && isAsciiWhitespace(raw[i])) i++;
+  const keyStart = i;
+  while (i < raw.length && !isAsciiWhitespace(raw[i]) && raw[i] !== "=") i++;
+  const key = raw.slice(keyStart, i).toLowerCase();
+  if (key !== "url") return forbidden(`unsupported refresh key ${JSON.stringify(key)}`);
+  while (i < raw.length && isAsciiWhitespace(raw[i])) i++;
+  if (raw[i] !== "=") return forbidden("missing '=' after url");
+  i++;
+  while (i < raw.length && isAsciiWhitespace(raw[i])) i++;
+  let destination;
+  const quote = raw[i];
+  if (quote === '"' || quote === "'") {
+    const close = raw.indexOf(quote, i + 1);
+    if (close === -1) return forbidden("unterminated quoted destination");
+    destination = raw.slice(i + 1, close);
+    const rest = trimAsciiWhitespace(raw.slice(close + 1));
+    if (rest !== "") return forbidden("trailing text after quoted destination");
+  } else {
+    destination = trimAsciiWhitespace(raw.slice(i));
+    if (/[;,]/.test(destination)) return forbidden("multiple refresh assignments");
+  }
+  if (destination === "") return forbidden("empty destination");
+  const sanitizedDestination = sanitizeUrl(destination);
+  if (sanitizedDestination === "") return forbidden("destination uses a disallowed protocol");
+  return { kind: "allowed", delay, destination, sanitizedDestination };
+}
+function resolveMetaRefreshPolicy(attributes) {
+  let httpEquiv;
+  let content;
+  let duplicateName;
+  const seen = /* @__PURE__ */ new Set();
+  for (const [key, value] of attributes) {
+    const canonical = canonicalAttrName(key);
+    if (seen.has(canonical)) duplicateName = canonical;
+    seen.add(canonical);
+    if (canonical === "http-equiv") httpEquiv = value;
+    else if (canonical === "content") content = value;
+  }
+  if (duplicateName !== void 0) {
+    return forbidden(`duplicate case-insensitive attribute ${JSON.stringify(duplicateName)}`);
+  }
+  if (typeof httpEquiv !== "string") return { kind: "not-refresh" };
+  if (trimAsciiWhitespace(stripControlChars(httpEquiv)).toLowerCase() !== "refresh") {
+    return { kind: "not-refresh" };
+  }
+  if (typeof content !== "string") return { kind: "not-refresh" };
+  return parseMetaRefreshContent(content);
+}
+function normalizeMetaAttributes(props) {
+  const out = /* @__PURE__ */ new Map();
+  const seen = /* @__PURE__ */ new Set();
+  for (const key of Object.keys(props)) {
+    const canonical = canonicalAttrName(key);
+    if (seen.has(canonical)) return null;
+    seen.add(canonical);
+    out.set(key, props[key]);
+  }
+  return out;
+}
+function isForbiddenMetaEntry(props) {
+  const normalized = normalizeMetaAttributes(props);
+  if (normalized === null) return true;
+  return resolveMetaRefreshPolicy(normalized).kind === "forbidden";
+}
+
+// src/utils/headEntry.ts
+var SAFE_HEAD_ATTR_NAME = /^[A-Za-z_:][-A-Za-z0-9_.:]*$/;
+function isEmittableHeadAttrName(name) {
+  if (!SAFE_HEAD_ATTR_NAME.test(name)) return false;
+  const canonical = canonicalAttrName(name);
+  if (isEventHandlerAttr(canonical)) return false;
+  if (isHtmlContentAttribute(canonical)) return false;
+  return true;
+}
+function sanitizeHeadAttrValue(canonical, value) {
+  if (!isPolicyAttribute(canonical)) return value;
+  const safe = sanitizeAttributeString(canonical, value);
+  return safe === "" ? null : safe;
+}
+function findDuplicateAttributeName(names) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const name of names) {
+    const canonical = canonicalAttrName(name);
+    if (seen.has(canonical)) return canonical;
+    seen.add(canonical);
+  }
+  return null;
+}
+function planEntry(props, resolver, applyRefreshPolicy) {
+  const rawNames = Object.keys(props);
+  const duplicate = findDuplicateAttributeName(rawNames);
+  if (duplicate !== null) {
+    return { kind: "drop", reason: `duplicate case-insensitive attribute ${JSON.stringify(duplicate)}` };
+  }
+  const attributes = /* @__PURE__ */ new Map();
+  let reactive = false;
+  for (const name of rawNames) {
+    if (!Object.hasOwn(props, name)) continue;
+    if (!isEmittableHeadAttrName(name)) continue;
+    const authored = props[name];
+    if (resolver.isReactiveValue?.(authored)) reactive = true;
+    const canonical = canonicalAttrName(name);
+    const sanitized = sanitizeHeadAttrValue(canonical, resolver.resolveValue(name, authored));
+    if (sanitized === null) continue;
+    attributes.set(canonical, sanitized);
+  }
+  if (attributes.size === 0) return { kind: "drop", reason: "no effective attributes remain" };
+  const refresh = applyRefreshPolicy ? resolveMetaRefreshPolicy(attributes) : { kind: "not-refresh" };
+  if (refresh.kind === "forbidden") return { kind: "drop", reason: refresh.reason };
+  if (reactive && (refresh.kind === "allowed" || refresh.kind === "delay-only")) {
+    return { kind: "drop", reason: "a reactive meta entry may not publish a native refresh directive" };
+  }
+  return { kind: "publish", attributes, refresh };
+}
+function planMetaEntry(props, resolver) {
+  return planEntry(props, resolver, true);
+}
+function planHeadElementEntry(props, resolver) {
+  return planEntry(props, resolver, false);
+}
+var STATIC_VALUE_RESOLVER = {
+  resolveValue: (_name, value) => String(value)
+};
+function escapeHeadAttrValue(value) {
+  return value.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/'/g, "&#39;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function serializeHeadEntry(tag, attrs) {
+  const plan = tag === "meta" ? planMetaEntry(attrs, STATIC_VALUE_RESOLVER) : planHeadElementEntry(attrs, STATIC_VALUE_RESOLVER);
+  if (plan.kind === "drop") return "";
+  const pairs = Array.from(plan.attributes, ([name, value]) => `${name}="${escapeHeadAttrValue(value)}"`).join(" ");
+  return `<${tag} ${pairs} />`;
+}
 
 // src/platform/ssr.ts
-function sanitizeUrlAttr(name, value) {
-  return name === "srcset" ? sanitizeSrcset(value) : sanitizeUrl(value);
+function isPolicyAttr(lowerName) {
+  return isPolicyAttribute(lowerName);
+}
+function isForbiddenSsrAttr(lowerName) {
+  return isHtmlContentAttribute(lowerName);
+}
+function sanitizeSsrAttributeValue(lowerName, value) {
+  return sanitizeAttributeString(lowerName, value);
 }
 var _isDev = isDev();
 var SAFE_ATTR_NAME = /^[A-Za-z_:][-A-Za-z0-9_.:]*$/;
 function isSafeAttrName(name) {
   return SAFE_ATTR_NAME.test(name);
 }
-var URL_ATTRS = /* @__PURE__ */ new Set([
-  "href",
-  "src",
-  "action",
-  "formaction",
-  "cite",
-  "poster",
-  "background",
-  "srcset",
-  "ping",
-  "manifest",
-  "data",
-  "xlink:href"
-]);
 function ssrErrorComment(err) {
   if (_isDev) {
     const msg = escapeHtml(err instanceof Error ? err.message : String(err));
@@ -91,10 +247,11 @@ function renderToString(element) {
     const rawName = attr.name;
     if (!isSafeAttrName(rawName)) continue;
     if (isEventHandlerAttr(rawName)) continue;
+    if (isForbiddenSsrAttr(rawName)) continue;
     const lowerName = rawName.toLowerCase();
     let value = attr.value;
-    if (URL_ATTRS.has(lowerName)) {
-      value = sanitizeUrlAttr(lowerName, value);
+    if (isPolicyAttr(lowerName)) {
+      value = sanitizeSsrAttributeValue(lowerName, value);
       if (!value) continue;
     }
     html += ` ${rawName}="${escapeAttr(value)}"`;
@@ -135,9 +292,20 @@ function hydrate(component, container, options = {}) {
       }
     }
   }
-  container.replaceChildren(clientTree);
+  replaceChildrenSafely(container, clientTree);
   container.setAttribute("data-sibu-hydrated", "true");
 }
+function directTextOf(node) {
+  let out = "";
+  for (const child of Array.from(node.childNodes)) {
+    if (child.nodeType === 3) out += child.nodeValue ?? "";
+  }
+  return out.replace(/\s+/g, " ").trim();
+}
+function disposeAndReplace(outgoing, next) {
+  dispose(outgoing);
+  outgoing.replaceWith(next);
+}
 function collectMismatches(serverNode, clientNode, path, out, max = 5) {
   if (out.length >= max) return;
   const nodePath = path || clientNode?.tagName?.toLowerCase() || "(root)";
@@ -213,6 +381,18 @@ function collectMismatches(serverNode, clientNode, path, out, max = 5) {
       });
     }
   }
+  const serverText = directTextOf(serverNode);
+  const clientText = directTextOf(clientNode);
+  if (serverText !== clientText) {
+    out.push({
+      kind: "text",
+      path: nodePath,
+      serverValue: serverText,
+      clientValue: clientText,
+      message: "Text content differs between server and client."
+    });
+    if (out.length >= max) return;
+  }
   const serverChildren = Array.from(serverNode.children);
   const clientChildren = Array.from(clientNode.children);
   const max2 = Math.max(serverChildren.length, clientChildren.length);
@@ -232,10 +412,11 @@ function buildAttrString(attrs, { allowEventHandlers = false } = {}) {
     if (!Object.hasOwn(attrs, rawKey)) continue;
     if (!isSafeAttrName(rawKey)) continue;
     if (!allowEventHandlers && isEventHandlerAttr(rawKey)) continue;
+    if (isForbiddenSsrAttr(rawKey)) continue;
     const lowerKey = rawKey.toLowerCase();
     let value = String(attrs[rawKey]);
-    if (URL_ATTRS.has(lowerKey)) {
-      value = sanitizeUrlAttr(lowerKey, value);
+    if (isPolicyAttr(lowerKey)) {
+      value = sanitizeSsrAttributeValue(lowerKey, value);
       if (!value) continue;
     }
     out.push(`${rawKey}="${escapeAttr(value)}"`);
@@ -243,18 +424,7 @@ function buildAttrString(attrs, { allowEventHandlers = false } = {}) {
   return out.join(" ");
 }
 function isDangerousMetaRefresh(metaProps) {
-  let httpEquiv;
-  let content;
-  for (const k in metaProps) {
-    const lk = k.toLowerCase();
-    if (lk === "http-equiv") httpEquiv = metaProps[k];
-    else if (lk === "content") content = metaProps[k];
-  }
-  if (typeof httpEquiv !== "string") return false;
-  if (httpEquiv.toLowerCase() !== "refresh") return false;
-  if (typeof content !== "string") return false;
-  const normalized = stripControlChars(content).toLowerCase();
-  return normalized.includes("url=javascript:") || normalized.includes("url=data:") || normalized.includes("url=vbscript:") || normalized.includes("url=blob:");
+  return isForbiddenMetaEntry(metaProps);
 }
 function renderToDocument(component, options = {}) {
   let content;
@@ -263,15 +433,8 @@ function renderToDocument(component, options = {}) {
   } catch (err) {
     content = ssrErrorComment(err);
   }
-  const metaTags = (options.meta || []).map((attrs) => {
-    if (isDangerousMetaRefresh(attrs)) return "";
-    const pairs = buildAttrString(attrs);
-    return pairs ? `<meta ${pairs} />` : "";
-  }).filter(Boolean).join("\n    ");
-  const linkTags = (options.links || []).map((attrs) => {
-    const pairs = buildAttrString(attrs);
-    return pairs ? `<link ${pairs} />` : "";
-  }).filter(Boolean).join("\n    ");
+  const metaTags = (options.meta || []).map((attrs) => serializeHeadEntry("meta", attrs)).filter(Boolean).join("\n    ");
+  const linkTags = (options.links || []).map((attrs) => serializeHeadEntry("link", attrs)).filter(Boolean).join("\n    ");
   const scriptTags = (options.scripts || []).map((src) => {
     const safe = sanitizeUrl(String(src));
     if (!safe) return "";
@@ -332,14 +495,18 @@ async function* renderToStream(element) {
     const rawName = attr.name;
     if (!isSafeAttrName(rawName)) continue;
     if (isEventHandlerAttr(rawName)) continue;
+    if (isForbiddenSsrAttr(rawName)) continue;
     const lowerName = rawName.toLowerCase();
     let value = attr.value;
-    if (URL_ATTRS.has(lowerName)) {
-      value = sanitizeUrlAttr(lowerName, value);
+    if (isPolicyAttr(lowerName)) {
+      value = sanitizeSsrAttributeValue(lowerName, value);
       if (!value) continue;
     }
     openTag += ` ${rawName}="${escapeAttr(value)}"`;
   }
+  if (element.dataset && !element.dataset.sibuHydrate) {
+    openTag += ` data-sibu-ssr="true"`;
+  }
   if (VOID_ELEMENTS.has(tag)) {
     yield `${openTag} />`;
     return;
@@ -386,9 +553,13 @@ function island(id, component) {
   el.setAttribute("data-sibu-island", id);
   return el;
 }
+function isAlreadyHydrated(element) {
+  return element.hasAttribute("data-sibu-hydrated");
+}
 function hydrateIslands(container, islands) {
   const markers = container.querySelectorAll("[data-sibu-island]");
   for (const marker of Array.from(markers)) {
+    if (isAlreadyHydrated(marker)) continue;
     const id = marker.getAttribute("data-sibu-island") ?? "";
     if (!Object.hasOwn(islands, id)) continue;
     const factory = islands[id];
@@ -396,7 +567,7 @@ function hydrateIslands(container, islands) {
     const clientTree = factory();
     clientTree.setAttribute("data-sibu-island", id);
     clientTree.setAttribute("data-sibu-hydrated", "true");
-    marker.replaceWith(clientTree);
+    disposeAndReplace(marker, clientTree);
   }
   container.setAttribute("data-sibu-hydrated", "partial");
 }
@@ -404,6 +575,7 @@ function hydrateProgressively(container, islands, options) {
   const markers = container.querySelectorAll("[data-sibu-island]");
   const cleanups = [];
   for (const marker of Array.from(markers)) {
+    if (isAlreadyHydrated(marker)) continue;
     const id = marker.getAttribute("data-sibu-island") ?? "";
     if (!Object.hasOwn(islands, id)) continue;
     const factory = islands[id];
@@ -413,10 +585,11 @@ function hydrateProgressively(container, islands, options) {
         for (const entry of entries) {
           if (entry.isIntersecting) {
             observer.disconnect();
+            if (isAlreadyHydrated(marker) || marker.parentNode === null) break;
             const clientTree = factory();
             clientTree.setAttribute("data-sibu-island", id);
             clientTree.setAttribute("data-sibu-hydrated", "true");
-            marker.replaceWith(clientTree);
+            disposeAndReplace(marker, clientTree);
             break;
           }
         }
@@ -472,7 +645,7 @@ function suspenseSwapScript(id, nonce) {
     );
   }
   const nonceAttr = nonce ? ` nonce="${escapeAttr(nonce)}"` : "";
-  return `<script${nonceAttr}>(function(){var t=document.getElementById("sibu-resolved-${id}");var f=document.querySelector('[data-sibu-suspense-id="${id}"]');if(t&&f){while(t.firstChild)f.appendChild(t.firstChild);t.remove();f.removeAttribute("data-sibu-suspense-id");}})()</script>`;
+  return `<script${nonceAttr}>(function(){var t=document.getElementById("sibu-resolved-${id}");var f=document.querySelector('[data-sibu-suspense-id="${id}"]');if(t&&f){while(f.firstChild)f.removeChild(f.firstChild);while(t.firstChild)f.appendChild(t.firstChild);t.remove();f.removeAttribute("data-sibu-suspense-id");}})()</script>`;
 }
 async function* renderToSuspenseStream(element, pendingBoundaries = [], options) {
   yield* renderToStream(element);
@@ -522,6 +695,10 @@ function escapeAttr(str) {
 }
 
 export {
+  planMetaEntry,
+  planHeadElementEntry,
+  STATIC_VALUE_RESOLVER,
+  serializeHeadEntry,
   renderToString,
   hydrate,
   trustHTML,