sibujs 3.4.0 → 4.0.0

package/dist/{chunk-JCO7AHNU.js → chunk-3EKJK5FZ.js}

@@ -1,22 +1,24 @@
+import {
+  sanitizeUrl
+} from "./chunk-5INI7D2L.js";
 import {
   globalSingleton
 } from "./chunk-7ZHH77QA.js";
-import {
-  sanitizeUrl
-} from "./chunk-L3GAGWCC.js";
 import {
   effect
-} from "./chunk-BUKYCWHX.js";
+} from "./chunk-PBQEW5VW.js";
 import {
-  dispose
-} from "./chunk-5VGSK6D2.js";
+  dispose,
+  replaceChildrenSafely
+} from "./chunk-DHDZ7IVN.js";
 import {
   signal
-} from "./chunk-KZBEVFXZ.js";
+} from "./chunk-W55YHPEP.js";
 import {
   devWarn,
-  isDev
-} from "./chunk-COY6PUD2.js";
+  isDev,
+  reportError
+} from "./chunk-VPP2FONR.js";
 
 // src/performance/scheduler.ts
 var Priority = {
@@ -265,7 +267,7 @@ var DOMPool = class {
       this.pools.set(tag, pool);
     }
     if (pool.length >= this.maxSize) return;
-    element.innerHTML = "";
+    replaceChildrenSafely(element);
     element.className = "";
     element.removeAttribute("style");
     element.removeAttribute("id");
@@ -396,8 +398,9 @@ function normalizedStore(schema) {
     ids: [],
     entities: {}
   });
+  const idOf = (entity) => String(entity[idKey]);
   function add(entity) {
-    const id = String(entity[idKey]);
+    const id = idOf(entity);
     setState((prev) => {
       const ids = prev.ids.includes(id) ? prev.ids : [...prev.ids, id];
       return {
@@ -411,7 +414,7 @@ function normalizedStore(schema) {
       const nextIds = [...prev.ids];
       const nextEntities = { ...prev.entities };
       for (const entity of entities) {
-        const id = String(entity[idKey]);
+        const id = idOf(entity);
         if (!nextIds.includes(id)) {
           nextIds.push(id);
         }
@@ -533,7 +536,14 @@ function createChunkRegistry(config = {}) {
   } = config;
   const cache = /* @__PURE__ */ new Map();
   const pending = /* @__PURE__ */ new Map();
-  const preloaded = /* @__PURE__ */ new Set();
+  const preloaded = /* @__PURE__ */ new Map();
+  function notify(name, run) {
+    try {
+      run();
+    } catch (err) {
+      reportError(err, { phase: "async", name: `chunkRegistry(${name})` });
+    }
+  }
   function evict() {
     while (cache.size >= maxCacheSize) {
       let lru = null;
@@ -588,30 +598,47 @@ function createChunkRegistry(config = {}) {
       cached.lastAccess = Date.now();
       return cached.value;
     }
-    const pendingLoad = pending.get(id);
-    if (pendingLoad) return pendingLoad;
-    onLoadStart?.(id);
-    const loadPromise = loadWithRetry(id, loader).then((value) => {
-      evict();
-      const now = Date.now();
-      cache.set(id, { value, timestamp: now, lastAccess: now, accessCount: 1 });
-      pending.delete(id);
-      onLoadEnd?.(id);
-      return value;
-    }).catch((err) => {
-      pending.delete(id);
-      const error = err instanceof Error ? err : new Error(String(err));
-      onLoadError?.(id, error);
-      throw error;
+    const existing = pending.get(id);
+    if (existing) return existing.promise;
+    let resolveOuter;
+    let rejectOuter;
+    const outcome = new Promise((resolve, reject) => {
+      resolveOuter = resolve;
+      rejectOuter = reject;
+    });
+    const entry = { promise: outcome };
+    pending.set(id, entry);
+    const owns = () => pending.get(id) === entry;
+    notify("onLoadStart", () => onLoadStart?.(id));
+    void loadWithRetry(id, loader).then(
+      (value) => {
+        if (owns()) {
+          pending.delete(id);
+          evict();
+          const now = Date.now();
+          cache.set(id, { value, timestamp: now, lastAccess: now, accessCount: 1 });
+        }
+        notify("onLoadEnd", () => onLoadEnd?.(id));
+        resolveOuter(value);
+      },
+      (err) => {
+        if (owns()) pending.delete(id);
+        const error = err instanceof Error ? err : new Error(String(err));
+        notify("onLoadError", () => onLoadError?.(id, error));
+        rejectOuter(error);
+      }
+    ).catch((internal) => {
+      reportError(internal, { phase: "async", name: "chunkRegistry(settlement)" });
+      rejectOuter(internal);
     });
-    pending.set(id, loadPromise);
-    return loadPromise;
+    return outcome;
   }
   function preloadFn(id, loader) {
     if (cache.has(id) || pending.has(id) || preloaded.has(id)) return;
-    preloaded.add(id);
+    const marker = {};
+    preloaded.set(id, marker);
     loadFn(id, loader).catch(() => {
-      preloaded.delete(id);
+      if (preloaded.get(id) === marker) preloaded.delete(id);
     });
   }
   return {
@@ -645,21 +672,33 @@ function createChunkRegistry(config = {}) {
       return void 0;
     },
     /**
-     * Invalidate a cached chunk.
+     * Invalidate a cached chunk, and supersede any load still in flight for it.
+     *
+     * In-flight work is not cancelled — the loader API takes no abort signal, so
+     * claiming cancellation would be a lie. It is *superseded*: it still settles
+     * for whoever called `load()`, but it can no longer write to the cache, and
+     * a subsequent `load(id, …)` starts fresh work rather than adopting it.
      */
     invalidate(id) {
       cache.delete(id);
       preloaded.delete(id);
+      pending.delete(id);
     },
     /**
-     * Clear all cached chunks.
+     * Clear all cached chunks, and supersede every load still in flight.
+     *
+     * Same barrier as `invalidate`, applied to every key at once.
      */
     clear() {
       cache.clear();
       preloaded.clear();
+      pending.clear();
     },
     /**
      * Get cache statistics.
+     *
+     * Describes currently OWNED state: superseded loads are already absent from
+     * `pending`, so the counts never include work whose result will be discarded.
      */
     stats() {
       return {

package/dist/chunk-4MFZMLUU.js

@@ -0,0 +1,147 @@
+import {
+  isEventHandlerAttr,
+  isHtmlContentAttribute,
+  sanitizeAttributeString
+} from "./chunk-5INI7D2L.js";
+import {
+  reactiveBinding
+} from "./chunk-ACBT6UZS.js";
+import {
+  devWarn,
+  isDev,
+  reportError
+} from "./chunk-VPP2FONR.js";
+
+// src/utils/setSafeAttribute.ts
+var _isDev = isDev();
+var HTML_NS = "http://www.w3.org/1999/xhtml";
+var SVG_NS = "http://www.w3.org/2000/svg";
+var XLINK_NS = "http://www.w3.org/1999/xlink";
+var XML_NS = "http://www.w3.org/XML/1998/namespace";
+var BOOLEAN_IDL_ATTRS = /* @__PURE__ */ new Set(["checked", "disabled", "selected"]);
+function isHtmlElement(el) {
+  return el.namespaceURI === null || el.namespaceURI === HTML_NS;
+}
+function setProp(el, key, val) {
+  el[key] = val;
+}
+function namespaceFor(el, name) {
+  if (el.namespaceURI !== SVG_NS) return null;
+  const lower = name.toLowerCase();
+  if (lower.startsWith("xlink:")) return XLINK_NS;
+  if (lower.startsWith("xml:")) return XML_NS;
+  return null;
+}
+function setSafeAttribute(el, name, value, options = {}) {
+  const ns = namespaceFor(el, name);
+  const localName = ns ? name.slice(name.indexOf(":") + 1) : name;
+  if (isEventHandlerAttr(name)) {
+    if (_isDev) {
+      devWarn(
+        `${options.label ?? "setSafeAttribute"}: refusing to set event-handler attribute "${name}". Its value would be evaluated as JavaScript. Use on:{ ${name.slice(2)}: fn } instead.`
+      );
+    }
+    if (ns) el.removeAttributeNS(ns, localName);
+    else el.removeAttribute(name);
+    return false;
+  }
+  if (value == null) {
+    if (ns) el.removeAttributeNS(ns, localName);
+    else el.removeAttribute(name);
+    return true;
+  }
+  if (isHtmlContentAttribute(name)) {
+    if (_isDev) {
+      devWarn(
+        `${options.label ?? "setSafeAttribute"}: refusing to set "${name}". The browser parses this attribute as a nested HTML document, so a generic string value cannot be made safe \u2014 attribute escaping is undone before the parse. Build the frame's content another way.`
+      );
+    }
+    if (ns) el.removeAttributeNS(ns, localName);
+    else el.removeAttribute(name);
+    return false;
+  }
+  const html = isHtmlElement(el);
+  const idlName = html ? name.toLowerCase() : name;
+  if (typeof value === "boolean") {
+    if (html && BOOLEAN_IDL_ATTRS.has(idlName) && idlName in el) {
+      setProp(el, idlName, value);
+    } else if (value) {
+      if (ns) el.setAttributeNS(ns, name, "");
+      else el.setAttribute(name, "");
+    } else if (ns) {
+      el.removeAttributeNS(ns, localName);
+    } else {
+      el.removeAttribute(name);
+    }
+    return true;
+  }
+  const str = String(value);
+  if (options.syncValueProperty !== false && html && (idlName === "value" || idlName === "checked") && idlName in el) {
+    setProp(el, idlName, idlName === "checked" ? Boolean(value) : str);
+    return true;
+  }
+  const safe = sanitizeAttributeString(name, str);
+  const current = ns ? el.getAttributeNS(ns, localName) : el.getAttribute(name);
+  if (current === safe) return true;
+  if (ns) el.setAttributeNS(ns, name, safe);
+  else el.setAttribute(name, safe);
+  return true;
+}
+
+// src/reactivity/bindAttribute.ts
+function bindAttribute(el, attr, getter) {
+  if (isEventHandlerAttr(attr)) {
+    setSafeAttribute(el, attr, "", { label: `bindAttribute("${attr}")` });
+    return () => {
+    };
+  }
+  function commit() {
+    let value;
+    try {
+      value = getter();
+    } catch (err) {
+      reportError(err, { phase: "binding", name: `bindAttribute("${attr}")`, node: el });
+      return;
+    }
+    setSafeAttribute(el, attr, value, { label: `bindAttribute("${attr}")` });
+  }
+  return reactiveBinding(commit, el);
+}
+function bindDynamic(el, nameGetter, valueGetter) {
+  let prevName = null;
+  function commit() {
+    let name;
+    try {
+      name = typeof nameGetter === "function" ? nameGetter() : nameGetter;
+    } catch (err) {
+      reportError(err, { phase: "binding", name: "bindDynamic (name getter)", node: el });
+      return;
+    }
+    let value;
+    try {
+      value = typeof valueGetter === "function" ? valueGetter() : valueGetter;
+    } catch (err) {
+      reportError(err, { phase: "binding", name: "bindDynamic (value getter)", node: el });
+      return;
+    }
+    if (prevName !== null && prevName !== name) {
+      el.removeAttribute(prevName);
+      prevName = null;
+    }
+    if (!setSafeAttribute(el, name, value, { label: "bindDynamic" })) return;
+    prevName = name;
+  }
+  const teardown = reactiveBinding(commit, el);
+  return () => {
+    teardown();
+    if (prevName !== null) {
+      el.removeAttribute(prevName);
+    }
+  };
+}
+
+export {
+  setSafeAttribute,
+  bindAttribute,
+  bindDynamic
+};

package/dist/chunk-52XFPGSN.js

@@ -0,0 +1,123 @@
+import {
+  globalSingleton
+} from "./chunk-7ZHH77QA.js";
+
+// src/utils/singletonResource.ts
+function singletonResource(io) {
+  let original = null;
+  let captured = false;
+  const stack = [];
+  function apply() {
+    if (stack.length > 0) {
+      io.write(stack[stack.length - 1].value);
+      return;
+    }
+    if (captured) {
+      io.write(original);
+      captured = false;
+      original = null;
+    }
+  }
+  return {
+    acquire(value) {
+      if (!captured) {
+        original = io.read();
+        captured = true;
+      }
+      const entry = { value, released: false };
+      stack.push(entry);
+      apply();
+      return {
+        set(next) {
+          if (entry.released) return;
+          entry.value = next;
+          apply();
+        },
+        release() {
+          if (entry.released) return;
+          entry.released = true;
+          const index = stack.indexOf(entry);
+          if (index !== -1) stack.splice(index, 1);
+          apply();
+        }
+      };
+    },
+    ownerCount() {
+      return stack.length;
+    }
+  };
+}
+
+// src/utils/documentResources.ts
+var INERT_LEASE = {
+  set() {
+  },
+  release() {
+  }
+};
+function inertLease() {
+  return INERT_LEASE;
+}
+var titleResource = globalSingleton(
+  /* @__PURE__ */ Symbol.for("sibujs.documentTitle.v1"),
+  () => singletonResource({
+    read: () => document.title,
+    write: (value) => {
+      document.title = value;
+    }
+  })
+);
+var baseResource = globalSingleton(
+  /* @__PURE__ */ Symbol.for("sibujs.documentBase.v1"),
+  () => singletonResource({
+    read: () => {
+      const el = document.head.querySelector("base");
+      if (!el) return null;
+      return {
+        href: el.getAttribute("href") ?? void 0,
+        target: el.getAttribute("target") ?? void 0
+      };
+    },
+    write: (spec) => {
+      const existing = document.head.querySelector("base");
+      if (spec === null) {
+        existing?.remove();
+        return;
+      }
+      const el = existing ?? document.head.appendChild(document.createElement("base"));
+      if (spec.href === void 0) el.removeAttribute("href");
+      else el.setAttribute("href", spec.href);
+      if (spec.target === void 0) el.removeAttribute("target");
+      else el.setAttribute("target", spec.target);
+    }
+  })
+);
+var scrollRestorationResource = globalSingleton(
+  /* @__PURE__ */ Symbol.for("sibujs.historyScrollRestoration.v1"),
+  () => singletonResource({
+    read: () => history.scrollRestoration,
+    write: (mode) => {
+      history.scrollRestoration = mode;
+    }
+  })
+);
+function acquireScrollRestorationMode(mode) {
+  if (typeof history === "undefined" || !("scrollRestoration" in history)) {
+    return inertLease();
+  }
+  return scrollRestorationResource.acquire(mode);
+}
+function acquireTitle(value) {
+  if (typeof document === "undefined") return inertLease();
+  return titleResource.acquire(value);
+}
+function acquireBase(spec) {
+  if (typeof document === "undefined") return inertLease();
+  return baseResource.acquire(spec);
+}
+
+export {
+  acquireScrollRestorationMode,
+  acquireTitle,
+  acquireBase
+};

package/dist/chunk-5INI7D2L.js

@@ -0,0 +1,194 @@
+// src/utils/sanitize.ts
+function stripControlChars(value) {
+  return value.replace(/[\x00-\x20\x7f-\x9f]+/g, "");
+}
+function canonicalAttrName(name) {
+  return name.replace(/[A-Z]/g, (ch) => String.fromCharCode(ch.charCodeAt(0) + 32));
+}
+function isEventHandlerAttr(name) {
+  if (name.length < 3) return false;
+  const lower = name.toLowerCase();
+  return lower[0] === "o" && lower[1] === "n" && lower.charCodeAt(2) >= 97 && lower.charCodeAt(2) <= 122;
+}
+var SAFE_URL_PROTOCOLS = ["http:", "https:", "mailto:", "tel:", "ftp:"];
+var OUTER_TRIM = /^[\x00-\x20\x7f-\x9f]+|[\x00-\x20\x7f-\x9f]+$/g;
+function sanitizeUrl(url) {
+  const probe = stripControlChars(url).trim();
+  if (!probe) return "";
+  const output = url.replace(OUTER_TRIM, "");
+  const lower = probe.toLowerCase();
+  let schemeEnd = -1;
+  for (let i = 0; i < lower.length; i++) {
+    const ch = lower.charCodeAt(i);
+    if (ch === 58) {
+      schemeEnd = i;
+      break;
+    }
+    if (ch === 47 || ch === 63 || ch === 35) break;
+  }
+  if (schemeEnd === -1) return output;
+  const scheme = lower.slice(0, schemeEnd + 1);
+  if (!/^[a-z][a-z0-9+.-]*:$/.test(scheme)) return output;
+  if (SAFE_URL_PROTOCOLS.indexOf(scheme) === -1) return "";
+  return output;
+}
+var SRCSET_DESCRIPTOR = /^\s+\d+(\.\d+)?[wx]$/;
+function sanitizeSrcset(value) {
+  const parts = value.split(",");
+  const out = [];
+  for (let i = 0; i < parts.length; i++) {
+    const part = parts[i].trim();
+    if (!part) continue;
+    const m = part.match(/^(\S+)(\s+.+)?$/);
+    if (!m) continue;
+    if (m[2] !== void 0 && !SRCSET_DESCRIPTOR.test(m[2])) continue;
+    const safe = sanitizeUrl(m[1]);
+    if (!safe) continue;
+    out.push(m[2] ? `${safe}${m[2]}` : safe);
+  }
+  return out.join(", ");
+}
+var CSS_DANGER_GATE = /[(:@\\]/;
+function isCssWhitespace(ch) {
+  return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f";
+}
+function isHexDigit(ch) {
+  return ch >= "0" && ch <= "9" || ch >= "a" && ch <= "f" || ch >= "A" && ch <= "F";
+}
+function decodeCssEscapes(value) {
+  let out = "";
+  for (let i = 0; i < value.length; i++) {
+    const ch = value[i];
+    if (ch !== "\\") {
+      out += ch;
+      continue;
+    }
+    if (i + 1 >= value.length) break;
+    const next = value[i + 1];
+    if (next === "\n" || next === "\f") {
+      i += 1;
+      continue;
+    }
+    if (next === "\r") {
+      i += value[i + 2] === "\n" ? 2 : 1;
+      continue;
+    }
+    if (isHexDigit(next)) {
+      let hex = "";
+      let j = i + 1;
+      while (j < value.length && hex.length < 6 && isHexDigit(value[j])) {
+        hex += value[j];
+        j++;
+      }
+      if (j < value.length && isCssWhitespace(value[j])) {
+        j += value[j] === "\r" && value[j + 1] === "\n" ? 2 : 1;
+      }
+      const code = Number.parseInt(hex, 16);
+      const invalid = code === 0 || code > 1114111 || code >= 55296 && code <= 57343;
+      out += invalid ? "\uFFFD" : String.fromCodePoint(code);
+      i = j - 1;
+      continue;
+    }
+    out += next;
+    i += 1;
+  }
+  return out;
+}
+function sanitizeCSSValue(value) {
+  if (!CSS_DANGER_GATE.test(value)) return value;
+  const normalized = value.includes("\\") ? decodeCssEscapes(value) : value;
+  const lower = normalized.toLowerCase().replace(/\s+/g, "");
+  if (lower.includes("url(") || lower.includes("expression(") || lower.includes("javascript:") || lower.includes("vbscript:") || lower.includes("-moz-binding") || lower.includes("behavior:") || lower.includes("@import") || lower.includes("image-set(") || lower.includes("filter:progid")) {
+    return "";
+  }
+  return value;
+}
+function sanitizeStyleAttribute(cssText) {
+  const input = String(cssText);
+  if (input.trim() === "") return "";
+  if (typeof document === "undefined") {
+    return sanitizeCSSValue(input) === "" ? "" : input;
+  }
+  const probe = document.createElement("div");
+  try {
+    probe.style.cssText = input;
+  } catch {
+    return "";
+  }
+  const declarations = [];
+  for (let i = 0; i < probe.style.length; i++) {
+    const property = probe.style[i];
+    const value = probe.style.getPropertyValue(property);
+    if (sanitizeCSSValue(value) === "") continue;
+    if (sanitizeCSSValue(`${property}:${value}`) === "") continue;
+    const priority = probe.style.getPropertyPriority(property);
+    declarations.push(`${property}: ${value}${priority ? ` !${priority}` : ""}`);
+  }
+  return declarations.join("; ");
+}
+function stripHtml(html) {
+  const input = String(html);
+  if (typeof DOMParser !== "undefined") {
+    try {
+      return new DOMParser().parseFromString(input, "text/html").body.textContent ?? "";
+    } catch {
+    }
+  }
+  let prev;
+  let out = input;
+  do {
+    prev = out;
+    out = out.replace(/<[^>]*>/g, "");
+  } while (out !== prev);
+  return out.replace(/<[^>]*$/, "");
+}
+var URL_ATTRIBUTES = /* @__PURE__ */ new Set([
+  "href",
+  "xlink:href",
+  "src",
+  "action",
+  "formaction",
+  "formtarget",
+  "cite",
+  "poster",
+  "background",
+  "srcset",
+  "ping",
+  "data",
+  // `<html manifest>` is a URL sink too. It was carried only by the SSR
+  // serializers' private copy of this set; folding that copy into this one would
+  // otherwise have silently dropped its coverage.
+  "manifest"
+]);
+var HTML_CONTENT_ATTRIBUTES = /* @__PURE__ */ new Set(["srcdoc"]);
+function isHtmlContentAttribute(name) {
+  return HTML_CONTENT_ATTRIBUTES.has(name.toLowerCase());
+}
+function isUrlAttribute(attr) {
+  return URL_ATTRIBUTES.has(attr.toLowerCase());
+}
+function isPolicyAttribute(name) {
+  const lower = name.toLowerCase();
+  return lower === "style" || URL_ATTRIBUTES.has(lower);
+}
+function sanitizeAttributeString(attr, value) {
+  const lower = attr.toLowerCase();
+  if (lower === "srcset") return sanitizeSrcset(value);
+  if (URL_ATTRIBUTES.has(lower)) return sanitizeUrl(value);
+  if (lower === "style") return sanitizeStyleAttribute(value);
+  return value;
+}
+
+export {
+  stripControlChars,
+  canonicalAttrName,
+  isEventHandlerAttr,
+  sanitizeUrl,
+  sanitizeCSSValue,
+  sanitizeStyleAttribute,
+  stripHtml,
+  isHtmlContentAttribute,
+  isUrlAttribute,
+  isPolicyAttribute,
+  sanitizeAttributeString
+};

package/dist/{chunk-OAVXAFAY.js → chunk-6LG2T7LO.js}

@@ -1,22 +1,22 @@
 import {
   watch
-} from "./chunk-H5FI5WDP.js";
+} from "./chunk-RRIDJQ5C.js";
 import {
   createId
 } from "./chunk-CCSJMTRN.js";
 import {
   derived
-} from "./chunk-ITWCTZYH.js";
+} from "./chunk-Z2CE42DB.js";
 import {
   stripHtml
-} from "./chunk-L3GAGWCC.js";
+} from "./chunk-5INI7D2L.js";
 import {
   effect
-} from "./chunk-BUKYCWHX.js";
+} from "./chunk-PBQEW5VW.js";
 import {
   batch,
   signal
-} from "./chunk-KZBEVFXZ.js";
+} from "./chunk-W55YHPEP.js";
 
 // src/widgets/Combobox.ts
 var boundComboboxes = /* @__PURE__ */ new WeakMap();