sibujs 3.4.1 → 4.0.1

package/dist/chunk-52XFPGSN.js

@@ -0,0 +1,123 @@
+import {
+  globalSingleton
+} from "./chunk-7ZHH77QA.js";
+
+// src/utils/singletonResource.ts
+function singletonResource(io) {
+  let original = null;
+  let captured = false;
+  const stack = [];
+  function apply() {
+    if (stack.length > 0) {
+      io.write(stack[stack.length - 1].value);
+      return;
+    }
+    if (captured) {
+      io.write(original);
+      captured = false;
+      original = null;
+    }
+  }
+  return {
+    acquire(value) {
+      if (!captured) {
+        original = io.read();
+        captured = true;
+      }
+      const entry = { value, released: false };
+      stack.push(entry);
+      apply();
+      return {
+        set(next) {
+          if (entry.released) return;
+          entry.value = next;
+          apply();
+        },
+        release() {
+          if (entry.released) return;
+          entry.released = true;
+          const index = stack.indexOf(entry);
+          if (index !== -1) stack.splice(index, 1);
+          apply();
+        }
+      };
+    },
+    ownerCount() {
+      return stack.length;
+    }
+  };
+}
+
+// src/utils/documentResources.ts
+var INERT_LEASE = {
+  set() {
+  },
+  release() {
+  }
+};
+function inertLease() {
+  return INERT_LEASE;
+}
+var titleResource = globalSingleton(
+  /* @__PURE__ */ Symbol.for("sibujs.documentTitle.v1"),
+  () => singletonResource({
+    read: () => document.title,
+    write: (value) => {
+      document.title = value;
+    }
+  })
+);
+var baseResource = globalSingleton(
+  /* @__PURE__ */ Symbol.for("sibujs.documentBase.v1"),
+  () => singletonResource({
+    read: () => {
+      const el = document.head.querySelector("base");
+      if (!el) return null;
+      return {
+        href: el.getAttribute("href") ?? void 0,
+        target: el.getAttribute("target") ?? void 0
+      };
+    },
+    write: (spec) => {
+      const existing = document.head.querySelector("base");
+      if (spec === null) {
+        existing?.remove();
+        return;
+      }
+      const el = existing ?? document.head.appendChild(document.createElement("base"));
+      if (spec.href === void 0) el.removeAttribute("href");
+      else el.setAttribute("href", spec.href);
+      if (spec.target === void 0) el.removeAttribute("target");
+      else el.setAttribute("target", spec.target);
+    }
+  })
+);
+var scrollRestorationResource = globalSingleton(
+  /* @__PURE__ */ Symbol.for("sibujs.historyScrollRestoration.v1"),
+  () => singletonResource({
+    read: () => history.scrollRestoration,
+    write: (mode) => {
+      history.scrollRestoration = mode;
+    }
+  })
+);
+function acquireScrollRestorationMode(mode) {
+  if (typeof history === "undefined" || !("scrollRestoration" in history)) {
+    return inertLease();
+  }
+  return scrollRestorationResource.acquire(mode);
+}
+function acquireTitle(value) {
+  if (typeof document === "undefined") return inertLease();
+  return titleResource.acquire(value);
+}
+function acquireBase(spec) {
+  if (typeof document === "undefined") return inertLease();
+  return baseResource.acquire(spec);
+}
+
+export {
+  acquireScrollRestorationMode,
+  acquireTitle,
+  acquireBase
+};

package/dist/{chunk-Y22QAKJX.js → chunk-5BVKQX2F.js}

@@ -3,17 +3,17 @@ import {
 } from "./chunk-WWV3SJ3L.js";
 import {
   tagFactory
-} from "./chunk-NXR2YFZB.js";
+} from "./chunk-QD4I7ZGZ.js";
 import {
   derived
-} from "./chunk-4I3M326N.js";
+} from "./chunk-AD5YSZAN.js";
 import {
   effect
-} from "./chunk-X4JS367G.js";
+} from "./chunk-XDOMTQHM.js";
 import {
   batch,
   signal
-} from "./chunk-335KJEN2.js";
+} from "./chunk-TVURNWDK.js";
 
 // src/ecosystem/adapters/mobx.ts
 function mobXAdapter(options) {

package/dist/chunk-5INI7D2L.js

@@ -0,0 +1,194 @@
+// src/utils/sanitize.ts
+function stripControlChars(value) {
+  return value.replace(/[\x00-\x20\x7f-\x9f]+/g, "");
+}
+function canonicalAttrName(name) {
+  return name.replace(/[A-Z]/g, (ch) => String.fromCharCode(ch.charCodeAt(0) + 32));
+}
+function isEventHandlerAttr(name) {
+  if (name.length < 3) return false;
+  const lower = name.toLowerCase();
+  return lower[0] === "o" && lower[1] === "n" && lower.charCodeAt(2) >= 97 && lower.charCodeAt(2) <= 122;
+}
+var SAFE_URL_PROTOCOLS = ["http:", "https:", "mailto:", "tel:", "ftp:"];
+var OUTER_TRIM = /^[\x00-\x20\x7f-\x9f]+|[\x00-\x20\x7f-\x9f]+$/g;
+function sanitizeUrl(url) {
+  const probe = stripControlChars(url).trim();
+  if (!probe) return "";
+  const output = url.replace(OUTER_TRIM, "");
+  const lower = probe.toLowerCase();
+  let schemeEnd = -1;
+  for (let i = 0; i < lower.length; i++) {
+    const ch = lower.charCodeAt(i);
+    if (ch === 58) {
+      schemeEnd = i;
+      break;
+    }
+    if (ch === 47 || ch === 63 || ch === 35) break;
+  }
+  if (schemeEnd === -1) return output;
+  const scheme = lower.slice(0, schemeEnd + 1);
+  if (!/^[a-z][a-z0-9+.-]*:$/.test(scheme)) return output;
+  if (SAFE_URL_PROTOCOLS.indexOf(scheme) === -1) return "";
+  return output;
+}
+var SRCSET_DESCRIPTOR = /^\s+\d+(\.\d+)?[wx]$/;
+function sanitizeSrcset(value) {
+  const parts = value.split(",");
+  const out = [];
+  for (let i = 0; i < parts.length; i++) {
+    const part = parts[i].trim();
+    if (!part) continue;
+    const m = part.match(/^(\S+)(\s+.+)?$/);
+    if (!m) continue;
+    if (m[2] !== void 0 && !SRCSET_DESCRIPTOR.test(m[2])) continue;
+    const safe = sanitizeUrl(m[1]);
+    if (!safe) continue;
+    out.push(m[2] ? `${safe}${m[2]}` : safe);
+  }
+  return out.join(", ");
+}
+var CSS_DANGER_GATE = /[(:@\\]/;
+function isCssWhitespace(ch) {
+  return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f";
+}
+function isHexDigit(ch) {
+  return ch >= "0" && ch <= "9" || ch >= "a" && ch <= "f" || ch >= "A" && ch <= "F";
+}
+function decodeCssEscapes(value) {
+  let out = "";
+  for (let i = 0; i < value.length; i++) {
+    const ch = value[i];
+    if (ch !== "\\") {
+      out += ch;
+      continue;
+    }
+    if (i + 1 >= value.length) break;
+    const next = value[i + 1];
+    if (next === "\n" || next === "\f") {
+      i += 1;
+      continue;
+    }
+    if (next === "\r") {
+      i += value[i + 2] === "\n" ? 2 : 1;
+      continue;
+    }
+    if (isHexDigit(next)) {
+      let hex = "";
+      let j = i + 1;
+      while (j < value.length && hex.length < 6 && isHexDigit(value[j])) {
+        hex += value[j];
+        j++;
+      }
+      if (j < value.length && isCssWhitespace(value[j])) {
+        j += value[j] === "\r" && value[j + 1] === "\n" ? 2 : 1;
+      }
+      const code = Number.parseInt(hex, 16);
+      const invalid = code === 0 || code > 1114111 || code >= 55296 && code <= 57343;
+      out += invalid ? "\uFFFD" : String.fromCodePoint(code);
+      i = j - 1;
+      continue;
+    }
+    out += next;
+    i += 1;
+  }
+  return out;
+}
+function sanitizeCSSValue(value) {
+  if (!CSS_DANGER_GATE.test(value)) return value;
+  const normalized = value.includes("\\") ? decodeCssEscapes(value) : value;
+  const lower = normalized.toLowerCase().replace(/\s+/g, "");
+  if (lower.includes("url(") || lower.includes("expression(") || lower.includes("javascript:") || lower.includes("vbscript:") || lower.includes("-moz-binding") || lower.includes("behavior:") || lower.includes("@import") || lower.includes("image-set(") || lower.includes("filter:progid")) {
+    return "";
+  }
+  return value;
+}
+function sanitizeStyleAttribute(cssText) {
+  const input = String(cssText);
+  if (input.trim() === "") return "";
+  if (typeof document === "undefined") {
+    return sanitizeCSSValue(input) === "" ? "" : input;
+  }
+  const probe = document.createElement("div");
+  try {
+    probe.style.cssText = input;
+  } catch {
+    return "";
+  }
+  const declarations = [];
+  for (let i = 0; i < probe.style.length; i++) {
+    const property = probe.style[i];
+    const value = probe.style.getPropertyValue(property);
+    if (sanitizeCSSValue(value) === "") continue;
+    if (sanitizeCSSValue(`${property}:${value}`) === "") continue;
+    const priority = probe.style.getPropertyPriority(property);
+    declarations.push(`${property}: ${value}${priority ? ` !${priority}` : ""}`);
+  }
+  return declarations.join("; ");
+}
+function stripHtml(html) {
+  const input = String(html);
+  if (typeof DOMParser !== "undefined") {
+    try {
+      return new DOMParser().parseFromString(input, "text/html").body.textContent ?? "";
+    } catch {
+    }
+  }
+  let prev;
+  let out = input;
+  do {
+    prev = out;
+    out = out.replace(/<[^>]*>/g, "");
+  } while (out !== prev);
+  return out.replace(/<[^>]*$/, "");
+}
+var URL_ATTRIBUTES = /* @__PURE__ */ new Set([
+  "href",
+  "xlink:href",
+  "src",
+  "action",
+  "formaction",
+  "formtarget",
+  "cite",
+  "poster",
+  "background",
+  "srcset",
+  "ping",
+  "data",
+  // `<html manifest>` is a URL sink too. It was carried only by the SSR
+  // serializers' private copy of this set; folding that copy into this one would
+  // otherwise have silently dropped its coverage.
+  "manifest"
+]);
+var HTML_CONTENT_ATTRIBUTES = /* @__PURE__ */ new Set(["srcdoc"]);
+function isHtmlContentAttribute(name) {
+  return HTML_CONTENT_ATTRIBUTES.has(name.toLowerCase());
+}
+function isUrlAttribute(attr) {
+  return URL_ATTRIBUTES.has(attr.toLowerCase());
+}
+function isPolicyAttribute(name) {
+  const lower = name.toLowerCase();
+  return lower === "style" || URL_ATTRIBUTES.has(lower);
+}
+function sanitizeAttributeString(attr, value) {
+  const lower = attr.toLowerCase();
+  if (lower === "srcset") return sanitizeSrcset(value);
+  if (URL_ATTRIBUTES.has(lower)) return sanitizeUrl(value);
+  if (lower === "style") return sanitizeStyleAttribute(value);
+  return value;
+}
+
+export {
+  stripControlChars,
+  canonicalAttrName,
+  isEventHandlerAttr,
+  sanitizeUrl,
+  sanitizeCSSValue,
+  sanitizeStyleAttribute,
+  stripHtml,
+  isHtmlContentAttribute,
+  isUrlAttribute,
+  isPolicyAttribute,
+  sanitizeAttributeString
+};

package/dist/{chunk-4I3M326N.js → chunk-AD5YSZAN.js}

@@ -3,10 +3,10 @@ import {
   recordDependency,
   retrack,
   track
-} from "./chunk-BQLVTAUZ.js";
+} from "./chunk-JYXQCELN.js";
 import {
   devAssert
-} from "./chunk-COY6PUD2.js";
+} from "./chunk-VPP2FONR.js";
 
 // src/core/signals/derived.ts
 function derived(getter, options) {
@@ -43,6 +43,21 @@ function derived(getter, options) {
   }, markDirty);
   const hook = globalThis.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
   let evaluating = false;
+  const validate = () => {
+    if (!cs._d) return;
+    const oldValue = cs._v;
+    evaluating = true;
+    try {
+      retrack(recompute, markDirty);
+      if (!Object.is(oldValue, cs._v)) cs.__v++;
+    } finally {
+      evaluating = false;
+    }
+    if (hook && !Object.is(oldValue, cs._v)) {
+      hook.emit("computed:update", { signal: cs, oldValue, newValue: cs._v });
+    }
+  };
+  cs._validate = validate;
   function computedGetter() {
     if (evaluating) {
       throw new Error(
@@ -50,32 +65,11 @@ function derived(getter, options) {
       );
     }
     if (isTrackingSuspended()) {
-      if (cs._d) {
-        const prev = cs._v;
-        evaluating = true;
-        try {
-          retrack(recompute, markDirty);
-          if (!Object.is(prev, cs._v)) cs.__v++;
-        } finally {
-          evaluating = false;
-        }
-      }
+      if (cs._d) validate();
       return cs._v;
     }
+    if (cs._d) validate();
     recordDependency(cs);
-    if (cs._d) {
-      const oldValue = cs._v;
-      evaluating = true;
-      try {
-        retrack(recompute, markDirty);
-        if (!Object.is(oldValue, cs._v)) cs.__v++;
-      } finally {
-        evaluating = false;
-      }
-      if (hook && oldValue !== cs._v) {
-        hook.emit("computed:update", { signal: cs, oldValue, newValue: cs._v });
-      }
-    }
     return cs._v;
   }
   if (debugName) {

package/dist/{chunk-F7HW2NI5.js → chunk-AW6HPJ3L.js}

@@ -1,6 +1,6 @@
 import {
   renderToString
-} from "./chunk-EX77FXTT.js";
+} from "./chunk-HYCCIYNS.js";
 
 // src/plugins/modular.ts
 function createModuleRegistry() {

package/dist/chunk-DHDZ7IVN.js

@@ -0,0 +1,109 @@
+import {
+  devWarn,
+  isDev,
+  reportError
+} from "./chunk-VPP2FONR.js";
+
+// src/core/rendering/dispose.ts
+var elementDisposers = /* @__PURE__ */ new WeakMap();
+var MAX_DRAIN_TEARDOWNS = 1e4;
+function reportDrainRunaway(label, executed, remaining) {
+  if (typeof console === "undefined") return;
+  console.error(
+    `[SibuJS ${label}] runaway cleanup: stopped after running ${executed} teardowns with ${remaining} still queued. Cleanup production did not stabilize before the teardown safety ceiling was reached \u2014 the remaining work was NOT run.`,
+    { executed, remaining }
+  );
+}
+var _isDev = isDev();
+var activeBindingCount = 0;
+function registerDisposer(node, teardown) {
+  let disposers = elementDisposers.get(node);
+  if (!disposers) {
+    disposers = [];
+    elementDisposers.set(node, disposers);
+  }
+  disposers.push(teardown);
+  if (_isDev) activeBindingCount++;
+}
+function unregisterDisposer(node, teardown) {
+  const disposers = elementDisposers.get(node);
+  if (!disposers) return;
+  const index = disposers.indexOf(teardown);
+  if (index === -1) return;
+  disposers.splice(index, 1);
+  if (_isDev) activeBindingCount--;
+  if (disposers.length === 0) elementDisposers.delete(node);
+}
+function dispose(node) {
+  const stack = [node];
+  const order = [];
+  while (stack.length > 0) {
+    const current = stack.pop();
+    order.push(current);
+    const children = Array.from(current.childNodes);
+    for (let i = 0; i < children.length; i++) {
+      stack.push(children[i]);
+    }
+  }
+  for (let i = order.length - 1; i >= 0; i--) {
+    const current = order[i];
+    if (elementDisposers.has(current)) {
+      let executed = 0;
+      let runaway = false;
+      while (!runaway) {
+        const pending = elementDisposers.get(current);
+        if (!pending || pending.length === 0) break;
+        const snapshot = pending.slice();
+        elementDisposers.delete(current);
+        if (_isDev) activeBindingCount -= snapshot.length;
+        for (let i2 = 0; i2 < snapshot.length; i2++) {
+          if (executed >= MAX_DRAIN_TEARDOWNS) {
+            const rest = snapshot.slice(i2);
+            const added = elementDisposers.get(current);
+            elementDisposers.set(current, added ? rest.concat(added) : rest);
+            if (_isDev) activeBindingCount += rest.length;
+            reportDrainRunaway("dispose", executed, rest.length + (added?.length ?? 0));
+            runaway = true;
+            break;
+          }
+          executed++;
+          try {
+            snapshot[i2]();
+          } catch (err) {
+            reportError(err, { phase: "cleanup", name: "disposer" });
+          }
+        }
+      }
+    }
+  }
+}
+function replaceChildrenSafely(parent, ...next) {
+  for (let i = 0; i < next.length; i++) {
+    const node = next[i];
+    node.parentNode?.removeChild(node);
+  }
+  const current = Array.from(parent.childNodes);
+  for (let i = 0; i < current.length; i++) {
+    dispose(current[i]);
+  }
+  parent.replaceChildren(...next);
+}
+function checkLeaks(warnThreshold = 0) {
+  if (!_isDev) return 0;
+  if (warnThreshold > 0 && activeBindingCount > warnThreshold) {
+    devWarn(
+      `checkLeaks: ${activeBindingCount} active DOM bindings detected. Expected \u2264${warnThreshold}. This may indicate a component was removed from the DOM without calling dispose().`
+    );
+  }
+  return activeBindingCount;
+}
+
+export {
+  MAX_DRAIN_TEARDOWNS,
+  reportDrainRunaway,
+  registerDisposer,
+  unregisterDisposer,
+  dispose,
+  replaceChildrenSafely,
+  checkLeaks
+};

package/dist/{chunk-VQZDHAEK.js → chunk-E72G5JSK.js}

@@ -1,7 +1,7 @@
 import {
   SVG_NS,
   tagFactory
-} from "./chunk-NXR2YFZB.js";
+} from "./chunk-QD4I7ZGZ.js";
 
 // src/core/rendering/html.ts
 var html = tagFactory("html");