sibujs 4.6.0 → 4.8.0

package/README.md

@@ -188,7 +188,7 @@ Accessible `Combobox`, `Tabs`, `Accordion`, `Popover`, `Select`, `Tooltip`, `Fil
 `machine` (finite state machines), `persist`, `optimistic`, `timeTravel`, `globalStore`; plus `hoc`, `composable`, `componentProps`, and `contracts`.
 
 ### `sibujs/plugins` — First-party plugins
-**Router** — `createRouter`, `Route`/`Outlet`/`RouterLink`, nested routes, guards (`beforeEach`, `beforeResolve`, `afterEach`), programmatic navigation, `preloadRoute`, memory router, and per-route transitions. **i18n** — `setLocale`, `t`, `Trans`, `registerTranslations`, reactive locale switching. Plus the plugin system (`modular`, `ecosystem`, `versioning`, `startup`).
+**Router** — `createRouter`, `Route`/`Outlet`/`RouterLink`, nested routes, guards (`beforeEach`, `beforeResolve`, `afterEach`), programmatic navigation, `preloadRoute`, memory router, and per-route transitions. **i18n** — `setLocale`, `t`, `translated`, `Trans`, `registerTranslations`, live locale switching for text and attributes. Plus the plugin system (`modular`, `ecosystem`, `versioning`, `startup`).
 
 ### `sibujs/ssr` — Server rendering
 `renderToString`, `renderToReadableStream`, `renderToDocument`, `hydrate`, streaming `Suspense`, `head` management, static site generation, incremental regeneration, route actions/middleware, scroll restoration, service worker & web/wasm workers, and microfrontend helpers.

package/dist/browser.cjs

@@ -674,7 +674,7 @@ function forEachSubscriber(signal2, visit) {
 }
 
 // src/reactivity/track.ts
-var _runtimeVersion = true ? "4.6.0" : "dev";
+var _runtimeVersion = true ? "4.8.0" : "dev";
 var REGISTRY_KEY = /* @__PURE__ */ Symbol.for("sibujs.reactive.v1");
 function resolveReactiveApi() {
   const g = globalThis;
@@ -780,6 +780,14 @@ var batch = API2.batch;
 var enqueueBatchedSignal = API2.enqueueBatchedSignal;
 var isBatching = API2.isBatching;
 
+// src/core/devtoolsHook.ts
+function emitDevtools(hook, event, payload) {
+  try {
+    hook.emit(event, payload);
+  } catch {
+  }
+}
+
 // src/core/signals/signal.ts
 var _g = globalThis;
 function signal(initial, options) {
@@ -813,7 +821,7 @@ function signal(initial, options) {
       state2.__v++;
       if (DEV) {
         const hook = _g.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
-        if (hook) hook.emit("signal:update", { signal: state2, name: debugName, oldValue: prev, newValue });
+        if (hook) emitDevtools(hook, "signal:update", { signal: state2, name: debugName, oldValue: prev, newValue });
       }
       if (!enqueueBatchedSignal(state2)) {
         notifySubscribers2(state2);
@@ -827,7 +835,7 @@ function signal(initial, options) {
       state2.value = newValue;
       state2.__v++;
       const hook = _g.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
-      if (hook) hook.emit("signal:update", { signal: state2, name: debugName, oldValue: prev, newValue });
+      if (hook) emitDevtools(hook, "signal:update", { signal: state2, name: debugName, oldValue: prev, newValue });
       if (!enqueueBatchedSignal(state2)) {
         notifySubscribers2(state2);
       }
@@ -846,7 +854,7 @@ function signal(initial, options) {
   }
   if (DEV) {
     const hook = _g.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
-    if (hook) hook.emit("signal:create", { signal: state2, name: debugName, getter: get, initial });
+    if (hook) emitDevtools(hook, "signal:create", { signal: state2, name: debugName, getter: get, initial });
   }
   return [get, set];
 }
@@ -1024,12 +1032,17 @@ function effect(effectFn, options) {
   try {
     retrack2(ctx.bodyFn, ctx.subscriber);
     if (ctx.rerunPending) drainReruns(ctx);
+  } catch (err) {
+    ctx.disposed = true;
+    if (ctx.userCleanups.length > 0) flushUserCleanups(ctx);
+    cleanup2(ctx.subscriber);
+    throw err;
   } finally {
     ctx.running = false;
     ctx.rerunPending = false;
   }
   const hook = _g2.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
-  if (hook) hook.emit("effect:create", { effectFn });
+  if (hook) emitDevtools(hook, "effect:create", { effectFn });
   return () => disposeEffect(ctx);
 }
 
@@ -1645,13 +1658,19 @@ function colorScheme() {
 }
 
 // src/browser/format.ts
+var I18N_STATE = /* @__PURE__ */ Symbol.for("sibujs.i18n.v1");
+function activeI18nLocale() {
+  const state2 = globalThis[I18N_STATE];
+  if (!state2) return void 0;
+  return state2.getLocale ? state2.getLocale() : state2.locale?.[0]();
+}
 function formatNumber(value, options) {
   const { locale, ...formatOptions } = options ?? {};
-  return new Intl.NumberFormat(locale, formatOptions).format(value);
+  return new Intl.NumberFormat(locale ?? activeI18nLocale(), formatOptions).format(value);
 }
 function formatCurrency(value, currency, options) {
   const { locale, ...formatOptions } = options ?? {};
-  return new Intl.NumberFormat(locale, {
+  return new Intl.NumberFormat(locale ?? activeI18nLocale(), {
     ...formatOptions,
     style: "currency",
     currency
@@ -2579,6 +2598,36 @@ function textSelection() {
   };
 }
 
+// src/utils/sanitize.ts
+function stripControlChars(value) {
+  return value.replace(/[\x00-\x20\x7f-\x9f]+/g, "");
+}
+var SAFE_URL_PROTOCOLS = ["http:", "https:", "mailto:", "tel:", "ftp:"];
+var OUTER_TRIM = /^[\x00-\x20\x7f-\x9f]+|[\x00-\x20\x7f-\x9f]+$/g;
+function sanitizeUrl(url) {
+  const probe = stripControlChars(url).trim();
+  if (!probe) return "";
+  const output = url.replace(OUTER_TRIM, "");
+  if (probe.length >= 2 && (probe[0] === "\\" || probe[0] === "/") && (probe[1] === "\\" || probe[1] === "/") && (probe[0] === "\\" || probe[1] === "\\")) {
+    return "";
+  }
+  const lower = probe.toLowerCase();
+  let schemeEnd = -1;
+  for (let i = 0; i < lower.length; i++) {
+    const ch = lower.charCodeAt(i);
+    if (ch === 58) {
+      schemeEnd = i;
+      break;
+    }
+    if (ch === 47 || ch === 63 || ch === 35) break;
+  }
+  if (schemeEnd === -1) return output;
+  const scheme = lower.slice(0, schemeEnd + 1);
+  if (!/^[a-z][a-z0-9+.-]*:$/.test(scheme)) return output;
+  if (SAFE_URL_PROTOCOLS.indexOf(scheme) === -1) return "";
+  return output;
+}
+
 // src/browser/imageLoader.ts
 function imageLoader(src) {
   const [status, setStatus] = signal("pending");
@@ -2620,6 +2669,11 @@ function imageLoader(src) {
     abandonCurrent();
     resetState();
     if (disposed || token !== startToken) return;
+    const safe = sanitizeUrl(String(url));
+    if (!safe) {
+      setStatus("error");
+      return;
+    }
     const img = new Image();
     current = img;
     currentSettled = false;
@@ -2638,7 +2692,7 @@ function imageLoader(src) {
       currentSettled = true;
       setStatus("error");
     };
-    img.src = url;
+    img.src = safe;
   }
   let srcEffectTeardown = null;
   if (typeof src === "function") {

package/dist/browser.d.cts

@@ -198,6 +198,18 @@ declare function colorScheme(): {
 /**
  * Locale-aware number and currency formatting using Intl.NumberFormat.
  *
+ * LOCALE. An explicit `locale` option always wins. Without one, the active i18n
+ * locale is used when the i18n plugin is loaded (`setLocale()` / `getLocale()`),
+ * and the runtime's default locale otherwise. The i18n read is reactive, so a
+ * formatter called inside a binding re-formats in place when the locale
+ * switches:
+ *
+ * ```ts
+ * span(() => formatCurrency(price(), "EUR"));   // follows setLocale("es")
+ * ```
+ *
+ * On the server the read is request-scoped, exactly as `getLocale()` is.
+ *
  * @example
  * ```ts
  * formatNumber(1234567.89);                         // "1,234,567.89" (locale-dependent)
@@ -792,6 +804,13 @@ declare function vibrate(pattern: number | number[]): boolean;
  * Ensures a `<link rel="icon">` exists — creates one if missing, updates
  * the `href` otherwise.
  *
+ * NOT routed through the canonical URL allowlist, deliberately: `data:` icons
+ * are this helper's purpose (see `svgFavicon`), and the allowlist refuses
+ * `data:`. That is safe here because an icon link only ever fetches an image —
+ * the browser never navigates to, executes or renders it as a document, so no
+ * scheme turns this sink into script. Do not copy this exception to any sink
+ * that navigates, executes or embeds.
+ *
  * @param url Favicon URL or `data:` URI
  *
  * @example
@@ -874,6 +893,10 @@ interface ImageLoaderState {
  * and its value changes, the previous load is abandoned and a new one
  * starts.
  *
+ * The URL passes the framework's canonical URL policy first (`http:`,
+ * `https:`, relative, …). A refused URL — `javascript:`, `data:`, `blob:`, … —
+ * requests nothing and reports `status() === "error"`.
+ *
  * @example
  * ```ts
  * const img = imageLoader("/hero.jpg");

package/dist/browser.d.ts

@@ -198,6 +198,18 @@ declare function colorScheme(): {
 /**
  * Locale-aware number and currency formatting using Intl.NumberFormat.
  *
+ * LOCALE. An explicit `locale` option always wins. Without one, the active i18n
+ * locale is used when the i18n plugin is loaded (`setLocale()` / `getLocale()`),
+ * and the runtime's default locale otherwise. The i18n read is reactive, so a
+ * formatter called inside a binding re-formats in place when the locale
+ * switches:
+ *
+ * ```ts
+ * span(() => formatCurrency(price(), "EUR"));   // follows setLocale("es")
+ * ```
+ *
+ * On the server the read is request-scoped, exactly as `getLocale()` is.
+ *
  * @example
  * ```ts
  * formatNumber(1234567.89);                         // "1,234,567.89" (locale-dependent)
@@ -792,6 +804,13 @@ declare function vibrate(pattern: number | number[]): boolean;
  * Ensures a `<link rel="icon">` exists — creates one if missing, updates
  * the `href` otherwise.
  *
+ * NOT routed through the canonical URL allowlist, deliberately: `data:` icons
+ * are this helper's purpose (see `svgFavicon`), and the allowlist refuses
+ * `data:`. That is safe here because an icon link only ever fetches an image —
+ * the browser never navigates to, executes or renders it as a document, so no
+ * scheme turns this sink into script. Do not copy this exception to any sink
+ * that navigates, executes or embeds.
+ *
  * @param url Favicon URL or `data:` URI
  *
  * @example
@@ -874,6 +893,10 @@ interface ImageLoaderState {
  * and its value changes, the previous load is abandoned and a new one
  * starts.
  *
+ * The URL passes the framework's canonical URL policy first (`http:`,
+ * `https:`, relative, …). A refused URL — `javascript:`, `data:`, `blob:`, … —
+ * requests nothing and reports `status() === "error"`.
+ *
  * @example
  * ```ts
  * const img = imageLoader("/hero.jpg");

package/dist/browser.js

@@ -36,14 +36,15 @@ import {
   visibility,
   wakeLock,
   windowSize
-} from "./chunk-OXUY2A6L.js";
-import "./chunk-H3SRKIYX.js";
+} from "./chunk-EGUQLBHE.js";
 import "./chunk-52XFPGSN.js";
+import "./chunk-62BDYGAG.js";
 import "./chunk-7ZHH77QA.js";
-import "./chunk-XC4MEKGA.js";
+import "./chunk-V3LHZSU5.js";
+import "./chunk-EXXSN3BW.js";
 import "./chunk-7XHATCIH.js";
-import "./chunk-D33YTSX5.js";
-import "./chunk-5Q4R7HCL.js";
+import "./chunk-DSID757X.js";
+import "./chunk-TQQUN4WR.js";
 import "./chunk-NYNYSPK7.js";
 export {
   __resetSpeechCoordinator,