sibujs 4.1.0 → 4.3.0

package/dist/{chunk-XIHMS2Y6.js → chunk-GZYQNIPS.js}

@@ -1,33 +1,33 @@
 import {
   bindAttribute,
   setSafeAttribute
-} from "./chunk-SHDVWATN.js";
+} from "./chunk-7UBG6LDP.js";
 import {
   derived
-} from "./chunk-DCDS2PQ6.js";
+} from "./chunk-3E5YNK2F.js";
 import {
   isEventHandlerAttr
-} from "./chunk-5INI7D2L.js";
+} from "./chunk-IXKSNWV5.js";
 import {
   globalSingleton
 } from "./chunk-7ZHH77QA.js";
 import {
   effect
-} from "./chunk-PFTDGEPZ.js";
+} from "./chunk-7BJLKDBI.js";
 import {
   dispose,
   registerDisposer,
   replaceChildrenSafely
-} from "./chunk-DHDZ7IVN.js";
+} from "./chunk-QKRPLZ2V.js";
 import {
   signal
-} from "./chunk-UFSQEO7P.js";
+} from "./chunk-MYA5HEK5.js";
 import {
   track
-} from "./chunk-D3SZ4LVS.js";
+} from "./chunk-TSL64O5L.js";
 import {
   reportError
-} from "./chunk-VPP2FONR.js";
+} from "./chunk-2WLZ6757.js";
 
 // src/ui/form.ts
 function required(message = "This field is required") {

package/dist/{chunk-5INI7D2L.js → chunk-IXKSNWV5.js}

@@ -1,3 +1,7 @@
+import {
+  devWarnLazy
+} from "./chunk-2WLZ6757.js";
+
 // src/utils/sanitize.ts
 function stripControlChars(value) {
   return value.replace(/[\x00-\x20\x7f-\x9f]+/g, "");
@@ -94,20 +98,75 @@ function decodeCssEscapes(value) {
   }
   return out;
 }
-function sanitizeCSSValue(value) {
-  if (!CSS_DANGER_GATE.test(value)) return value;
+var BLOCKED_CSS_NEEDLES = [
+  "url(",
+  "expression(",
+  "javascript:",
+  "vbscript:",
+  "-moz-binding",
+  "behavior:",
+  "@import",
+  "image-set(",
+  "filter:progid"
+];
+function describeElement(el) {
+  if (!el) return "an element";
+  let out = el.tagName.toLowerCase();
+  const id = el.getAttribute("id");
+  if (id) out += `#${id}`;
+  const cls = el.getAttribute("class");
+  if (cls) out += `.${cls.trim().split(/\s+/).slice(0, 3).join(".")}`;
+  return `<${out}>`;
+}
+var warnedDeclarations = /* @__PURE__ */ new Set();
+var MAX_WARNED_DECLARATIONS = 100;
+var declarationCapAnnounced = false;
+function warnDroppedDeclaration(value, reason, ctx) {
+  devWarnLazy(() => {
+    const reasons = [
+      "url() in an inline style is an exfiltration channel: the browser fetches it immediately and the URL's path or query can carry page data off-origin",
+      "expression() executes arbitrary script in legacy engines",
+      "the javascript: scheme executes script",
+      "the vbscript: scheme executes script",
+      "-moz-binding loads and runs remote XBL",
+      "behavior: loads and runs a remote HTC script",
+      "@import pulls in a remote stylesheet",
+      "image-set() fetches remote images, the same exfiltration channel as url()",
+      "filter:progid activates legacy scriptable filters"
+    ];
+    const declaration = ctx?.property ? `${ctx.property}: ${value}` : value;
+    const where = describeElement(ctx?.element);
+    const key = `${where}|${declaration}`;
+    if (warnedDeclarations.has(key)) return "";
+    if (warnedDeclarations.size >= MAX_WARNED_DECLARATIONS) {
+      if (declarationCapAnnounced) return "";
+      declarationCapAnnounced = true;
+      return `${MAX_WARNED_DECLARATIONS} distinct dropped style declarations have been reported; suppressing further ones for the rest of this session so they cannot flood the console. The declarations are still dropped \u2014 only the reporting stops. Fix the reported ones and reload to see any that remain.`;
+    }
+    warnedDeclarations.add(key);
+    return `style declaration "${declaration}" was dropped by the style sanitizer on ${where} \u2014 ${reasons[reason]}. The element renders without it, which usually looks like a missing image rather than an error. Sanctioned alternatives: for a content image use an <img> element (or a <picture>); for decoration, put the rule in a stylesheet and set a class instead \u2014 stylesheet CSS is not sanitized, only inline style attributes are. If this declaration is not yours, it came from untrusted data and the drop just prevented an exfiltration.`;
+  });
+}
+function blockedCssReason(value) {
+  if (!CSS_DANGER_GATE.test(value)) return -1;
   const normalized = value.includes("\\") ? decodeCssEscapes(value) : value;
   const lower = normalized.toLowerCase().replace(/\s+/g, "");
-  if (lower.includes("url(") || lower.includes("expression(") || lower.includes("javascript:") || lower.includes("vbscript:") || lower.includes("-moz-binding") || lower.includes("behavior:") || lower.includes("@import") || lower.includes("image-set(") || lower.includes("filter:progid")) {
-    return "";
+  for (let i = 0; i < BLOCKED_CSS_NEEDLES.length; i++) {
+    if (lower.includes(BLOCKED_CSS_NEEDLES[i])) return i;
   }
-  return value;
+  return -1;
+}
+function sanitizeCSSValue(value, context) {
+  const reason = blockedCssReason(value);
+  if (reason === -1) return value;
+  warnDroppedDeclaration(value, reason, context);
+  return "";
 }
-function sanitizeStyleAttribute(cssText) {
+function sanitizeStyleAttribute(cssText, context) {
   const input = String(cssText);
   if (input.trim() === "") return "";
   if (typeof document === "undefined") {
-    return sanitizeCSSValue(input) === "" ? "" : input;
+    return sanitizeCSSValue(input, context) === "" ? "" : input;
   }
   const probe = document.createElement("div");
   try {
@@ -119,8 +178,12 @@ function sanitizeStyleAttribute(cssText) {
   for (let i = 0; i < probe.style.length; i++) {
     const property = probe.style[i];
     const value = probe.style.getPropertyValue(property);
-    if (sanitizeCSSValue(value) === "") continue;
-    if (sanitizeCSSValue(`${property}:${value}`) === "") continue;
+    let reason = blockedCssReason(value);
+    if (reason === -1) reason = blockedCssReason(`${property}:${value}`);
+    if (reason !== -1) {
+      warnDroppedDeclaration(value, reason, { property, element: context?.element });
+      continue;
+    }
     const priority = probe.style.getPropertyPriority(property);
     declarations.push(`${property}: ${value}${priority ? ` !${priority}` : ""}`);
   }
@@ -171,11 +234,11 @@ function isPolicyAttribute(name) {
   const lower = name.toLowerCase();
   return lower === "style" || URL_ATTRIBUTES.has(lower);
 }
-function sanitizeAttributeString(attr, value) {
+function sanitizeAttributeString(attr, value, context) {
   const lower = attr.toLowerCase();
   if (lower === "srcset") return sanitizeSrcset(value);
   if (URL_ATTRIBUTES.has(lower)) return sanitizeUrl(value);
-  if (lower === "style") return sanitizeStyleAttribute(value);
+  if (lower === "style") return sanitizeStyleAttribute(value, context);
   return value;
 }
 

package/dist/{chunk-KSOEJGFO.js → chunk-IYHM4FWD.js}

@@ -1,14 +1,14 @@
 import {
   isSSR
-} from "./chunk-TIRZCERI.js";
+} from "./chunk-5DXA2J44.js";
 import {
   resumeTracking,
   suspendTracking,
   track
-} from "./chunk-D3SZ4LVS.js";
+} from "./chunk-TSL64O5L.js";
 import {
   devAssert
-} from "./chunk-VPP2FONR.js";
+} from "./chunk-2WLZ6757.js";
 
 // src/core/signals/watch.ts
 function watch(getter, callback) {

package/dist/{chunk-AW6HPJ3L.js → chunk-KKLW7YWL.js}

@@ -1,6 +1,6 @@
 import {
   renderToString
-} from "./chunk-HYCCIYNS.js";
+} from "./chunk-NIOYEGBQ.js";
 
 // src/plugins/modular.ts
 function createModuleRegistry() {

package/dist/{chunk-5GJ5RTHA.js → chunk-L4B3Y3OM.js}

@@ -1,20 +1,19 @@
 import {
   isSSR
-} from "./chunk-TIRZCERI.js";
+} from "./chunk-5DXA2J44.js";
 import {
   signal
-} from "./chunk-UFSQEO7P.js";
+} from "./chunk-MYA5HEK5.js";
 import {
-  devWarn,
-  isDev
-} from "./chunk-VPP2FONR.js";
+  DEV,
+  devWarn
+} from "./chunk-2WLZ6757.js";
 
 // src/core/rendering/context.ts
-var _isDev = isDev();
 function context(defaultValue) {
   const [getValue, setValue] = signal(defaultValue);
   const warnIfSSR = (method) => {
-    if (!_isDev || !isSSR()) return;
+    if (!DEV || !isSSR()) return;
     devWarn(
       `context.${method}() called during SSR. SibuJS context() is application-global \u2014 it is NOT isolated per request, so a concurrent request can observe this value. Do not use context() for request-specific SSR data; pass it explicitly or use request-scoped storage instead.`
     );
@@ -42,7 +41,7 @@ function context(defaultValue) {
       setValue(value);
       try {
         const result = fn();
-        if (_isDev && result !== null && typeof result?.then === "function") {
+        if (DEV && result !== null && typeof result?.then === "function") {
           devWarn(
             "context.withContext() received an async callback. Scoping is synchronous only \u2014 the previous value is restored as soon as the callback returns its promise, so anything after an `await` runs outside the scope."
           );

package/dist/{chunk-UFSQEO7P.js → chunk-MYA5HEK5.js}

@@ -3,10 +3,10 @@ import {
   notifySubscribers,
   queueSignalNotification,
   recordDependency
-} from "./chunk-D3SZ4LVS.js";
+} from "./chunk-TSL64O5L.js";
 import {
-  isDev
-} from "./chunk-VPP2FONR.js";
+  DEV
+} from "./chunk-2WLZ6757.js";
 
 // src/reactivity/batch.ts
 var batchDepth = 0;
@@ -60,7 +60,6 @@ var isBatching = API.isBatching;
 
 // src/core/signals/signal.ts
 var _g = globalThis;
-var _isDev = isDev();
 function signal(initial, options) {
   const state = {
     value: initial,
@@ -73,7 +72,7 @@ function signal(initial, options) {
     _d: false,
     _validate: void 0
   };
-  const debugName = _isDev ? options?.name : void 0;
+  const debugName = DEV ? options?.name : void 0;
   const equalsFn = options?.equals;
   if (debugName) state.__name = debugName;
   function get() {
@@ -90,7 +89,7 @@ function signal(initial, options) {
       if (equalsFn(prev, newValue)) return;
       state.value = newValue;
       state.__v++;
-      if (_isDev) {
+      if (DEV) {
         const hook = _g.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
         if (hook) hook.emit("signal:update", { signal: state, name: debugName, oldValue: prev, newValue });
       }
@@ -98,7 +97,7 @@ function signal(initial, options) {
         notifySubscribers(state);
       }
     };
-  } else if (_isDev) {
+  } else if (DEV) {
     set = (next) => {
       const prev = state.value;
       const newValue = typeof next === "function" ? next(prev) : next;
@@ -123,7 +122,7 @@ function signal(initial, options) {
       }
     };
   }
-  if (_isDev) {
+  if (DEV) {
     const hook = _g.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
     if (hook) hook.emit("signal:create", { signal: state, name: debugName, getter: get, initial });
   }

package/dist/{chunk-HYCCIYNS.js → chunk-NIOYEGBQ.js}

@@ -6,17 +6,17 @@ import {
   sanitizeAttributeString,
   sanitizeUrl,
   stripControlChars
-} from "./chunk-5INI7D2L.js";
+} from "./chunk-IXKSNWV5.js";
 import {
   getSSRStore
-} from "./chunk-TIRZCERI.js";
+} from "./chunk-5DXA2J44.js";
 import {
   dispose,
   replaceChildrenSafely
-} from "./chunk-DHDZ7IVN.js";
+} from "./chunk-QKRPLZ2V.js";
 import {
-  isDev
-} from "./chunk-VPP2FONR.js";
+  DEV
+} from "./chunk-2WLZ6757.js";
 
 // src/utils/metaRefresh.ts
 function isAsciiWhitespace(ch) {
@@ -185,13 +185,12 @@ function isForbiddenSsrAttr(lowerName) {
 function sanitizeSsrAttributeValue(lowerName, value) {
   return sanitizeAttributeString(lowerName, value);
 }
-var _isDev = isDev();
 var SAFE_ATTR_NAME = /^[A-Za-z_:][-A-Za-z0-9_.:]*$/;
 function isSafeAttrName(name) {
   return SAFE_ATTR_NAME.test(name);
 }
 function ssrErrorComment(err) {
-  if (_isDev) {
+  if (DEV) {
     const msg = escapeHtml(err instanceof Error ? err.message : String(err));
     return `<!--SSR error: ${safeCommentText(msg)}-->`;
   }
@@ -237,10 +236,10 @@ function renderToString(element) {
   }
   const tag = element.tagName.toLowerCase();
   if (tag === "script" || tag === "style") {
-    return _isDev ? `<!--ssr:${tag}-stripped-->` : "";
+    return DEV ? `<!--ssr:${tag}-stripped-->` : "";
   }
   if (!/^[a-z][a-z0-9-]*$/i.test(tag)) {
-    return _isDev ? "<!--ssr:invalid-tag-->" : "";
+    return DEV ? "<!--ssr:invalid-tag-->" : "";
   }
   let html = `<${tag}`;
   for (const attr of Array.from(element.attributes)) {
@@ -282,7 +281,7 @@ function hydrate(component, container, options = {}) {
       const first = mismatches[0];
       if (options.onMismatch) {
         options.onMismatch(first);
-      } else if (_isDev) {
+      } else if (DEV) {
         console.warn(
           `[SibuJS hydration] ${first.message}
   at ${first.path}
@@ -483,11 +482,11 @@ async function* renderToStream(element) {
   }
   const tag = element.tagName.toLowerCase();
   if (tag === "script" || tag === "style") {
-    if (_isDev) yield `<!--ssr:${tag}-stripped-->`;
+    if (DEV) yield `<!--ssr:${tag}-stripped-->`;
     return;
   }
   if (!/^[a-z][a-z0-9-]*$/i.test(tag)) {
-    if (_isDev) yield "<!--ssr:invalid-tag-->";
+    if (DEV) yield "<!--ssr:invalid-tag-->";
     return;
   }
   let openTag = `<${tag}`;
@@ -630,7 +629,7 @@ function ssrSuspense(props) {
     },
     (err) => {
       if (timer) clearTimeout(timer);
-      if (_isDev) console.warn("[SibuJS SSR] ssrSuspense rejected:", err);
+      if (DEV) console.warn("[SibuJS SSR] ssrSuspense rejected:", err);
       return { id, html: fallbackHtml };
     }
   );
@@ -676,7 +675,7 @@ function serializeState(state, nonce, options) {
 }
 function deserializeState(validate) {
   if (typeof window === "undefined") return void 0;
-  if (_isDev && !validate) {
+  if (DEV && !validate) {
     console.warn(
       "[SibuJS SSR] deserializeState() called without a validate guard \u2014 tampered SSR payloads will not be detected."
     );

package/dist/{chunk-DHDZ7IVN.js → chunk-QKRPLZ2V.js}

@@ -1,8 +1,8 @@
 import {
+  DEV,
   devWarn,
-  isDev,
   reportError
-} from "./chunk-VPP2FONR.js";
+} from "./chunk-2WLZ6757.js";
 
 // src/core/rendering/dispose.ts
 var elementDisposers = /* @__PURE__ */ new WeakMap();
@@ -14,7 +14,6 @@ function reportDrainRunaway(label, executed, remaining) {
     { executed, remaining }
   );
 }
-var _isDev = isDev();
 var activeBindingCount = 0;
 function registerDisposer(node, teardown) {
   let disposers = elementDisposers.get(node);
@@ -23,7 +22,7 @@ function registerDisposer(node, teardown) {
     elementDisposers.set(node, disposers);
   }
   disposers.push(teardown);
-  if (_isDev) activeBindingCount++;
+  if (DEV) activeBindingCount++;
 }
 function unregisterDisposer(node, teardown) {
   const disposers = elementDisposers.get(node);
@@ -31,7 +30,7 @@ function unregisterDisposer(node, teardown) {
   const index = disposers.indexOf(teardown);
   if (index === -1) return;
   disposers.splice(index, 1);
-  if (_isDev) activeBindingCount--;
+  if (DEV) activeBindingCount--;
   if (disposers.length === 0) elementDisposers.delete(node);
 }
 function dispose(node) {
@@ -55,13 +54,13 @@ function dispose(node) {
         if (!pending || pending.length === 0) break;
         const snapshot = pending.slice();
         elementDisposers.delete(current);
-        if (_isDev) activeBindingCount -= snapshot.length;
+        if (DEV) activeBindingCount -= snapshot.length;
         for (let i2 = 0; i2 < snapshot.length; i2++) {
           if (executed >= MAX_DRAIN_TEARDOWNS) {
             const rest = snapshot.slice(i2);
             const added = elementDisposers.get(current);
             elementDisposers.set(current, added ? rest.concat(added) : rest);
-            if (_isDev) activeBindingCount += rest.length;
+            if (DEV) activeBindingCount += rest.length;
             reportDrainRunaway("dispose", executed, rest.length + (added?.length ?? 0));
             runaway = true;
             break;
@@ -89,7 +88,7 @@ function replaceChildrenSafely(parent, ...next) {
   parent.replaceChildren(...next);
 }
 function checkLeaks(warnThreshold = 0) {
-  if (!_isDev) return 0;
+  if (!DEV) return 0;
   if (warnThreshold > 0 && activeBindingCount > warnThreshold) {
     devWarn(
       `checkLeaks: ${activeBindingCount} active DOM bindings detected. Expected \u2264${warnThreshold}. This may indicate a component was removed from the DOM without calling dispose().`

package/dist/{chunk-FB7KQXZI.js → chunk-R4EF7V3K.js}

@@ -3,17 +3,17 @@ import {
 } from "./chunk-WWV3SJ3L.js";
 import {
   tagFactory
-} from "./chunk-I3VI34DP.js";
+} from "./chunk-XGCZ45NH.js";
 import {
   derived
-} from "./chunk-DCDS2PQ6.js";
+} from "./chunk-3E5YNK2F.js";
 import {
   effect
-} from "./chunk-PFTDGEPZ.js";
+} from "./chunk-7BJLKDBI.js";
 import {
   batch,
   signal
-} from "./chunk-UFSQEO7P.js";
+} from "./chunk-MYA5HEK5.js";
 
 // src/ecosystem/adapters/mobx.ts
 function mobXAdapter(options) {

package/dist/{chunk-IM7N5WR4.js → chunk-RE6KLGMV.js}

@@ -1,9 +1,9 @@
 import {
   registerDisposer
-} from "./chunk-DHDZ7IVN.js";
+} from "./chunk-QKRPLZ2V.js";
 import {
   signal
-} from "./chunk-UFSQEO7P.js";
+} from "./chunk-MYA5HEK5.js";
 
 // src/ui/transition.ts
 function transition(element, options = {}) {

package/dist/{chunk-D3SZ4LVS.js → chunk-TSL64O5L.js}

@@ -1,8 +1,8 @@
 import {
+  DEV,
   devWarn,
-  isDev,
   reportError
-} from "./chunk-VPP2FONR.js";
+} from "./chunk-2WLZ6757.js";
 
 // src/reactivity/track-core.ts
 var POOL_MAX = 4096;
@@ -460,17 +460,16 @@ function forEachSubscriber(signal, visit) {
 }
 
 // src/reactivity/track.ts
-var _isDev = isDev();
-var _runtimeVersion = true ? "4.1.0" : "dev";
+var _runtimeVersion = true ? "4.3.0" : "dev";
 var REGISTRY_KEY = /* @__PURE__ */ Symbol.for("sibujs.reactive.v1");
 function resolveReactiveApi() {
   const g = globalThis;
   const existing = g[REGISTRY_KEY];
   if (existing) {
-    if (_isDev && !existing.__dupWarned) {
+    if (DEV && !existing.__dupWarned) {
       existing.__dupWarned = true;
       devWarn(
-        `Multiple instances of the reactive runtime detected on this page (active: ${existing.version}, duplicate: ${_runtimeVersion}). Reactivity still works \u2014 all copies share the first one \u2014 but de-duplicate sibujs in your bundler (e.g. Vite optimizeDeps.exclude: ['sibujs'] or resolve.dedupe: ['sibujs']).`
+        `Multiple instances of the reactive runtime detected on this page (active: ${existing.version}, duplicate: ${_runtimeVersion}). Reactivity is NOT broken and no bundler configuration is required: every copy routes through the first one via a global registry, so signal writes still reach subscribers registered by any copy. This is only a SIZE issue \u2014 the duplicate copy's bytes are downloaded and parsed for nothing. If you want them back, de-duplicate sibujs in your bundler (Vite: resolve.dedupe: ['sibujs']). Mismatched VERSIONS above are worth fixing regardless, since only the first one loaded is used.`
       );
     }
     return existing;

package/dist/{chunk-DAKLOMKS.js → chunk-UD6YE2GW.js}

@@ -6,14 +6,14 @@ import {
 } from "./chunk-52XFPGSN.js";
 import {
   effect
-} from "./chunk-PFTDGEPZ.js";
+} from "./chunk-7BJLKDBI.js";
 import {
   batch,
   signal
-} from "./chunk-UFSQEO7P.js";
+} from "./chunk-MYA5HEK5.js";
 import {
   reportError
-} from "./chunk-VPP2FONR.js";
+} from "./chunk-2WLZ6757.js";
 
 // src/browser/media.ts
 function media(query) {

package/dist/{chunk-4U7KD3RY.js → chunk-USS5ENJ2.js}

@@ -4,14 +4,14 @@ import {
 } from "./chunk-H3SRKIYX.js";
 import {
   derived
-} from "./chunk-DCDS2PQ6.js";
+} from "./chunk-3E5YNK2F.js";
 import {
   effect
-} from "./chunk-PFTDGEPZ.js";
+} from "./chunk-7BJLKDBI.js";
 import {
   batch,
   signal
-} from "./chunk-UFSQEO7P.js";
+} from "./chunk-MYA5HEK5.js";
 
 // src/patterns/machine.ts
 function machine(config) {