sibujs 4.6.0 → 4.8.0

package/dist/index.js

@@ -7,6 +7,7 @@ import {
   Loading,
   Portal,
   Suspense,
+  __renderParsedTemplate,
   action,
   array,
   asyncDerived,
@@ -53,7 +54,7 @@ import {
   unregisterIsland,
   when,
   writable
-} from "./chunk-7GQCWFOE.js";
+} from "./chunk-J3YQ457H.js";
 import {
   a,
   abbr,
@@ -191,33 +192,35 @@ import {
   use,
   var_,
   video
-} from "./chunk-JSXPZCET.js";
+} from "./chunk-Q5J2LVKH.js";
 import {
   trustHTML
-} from "./chunk-HURREPU2.js";
+} from "./chunk-FC6KCJSA.js";
 import {
   watch
-} from "./chunk-UZQ6ALFS.js";
+} from "./chunk-CZPRSWSS.js";
 import {
   __resetIdCounter,
   createId
-} from "./chunk-3ISI6ACU.js";
+} from "./chunk-C7AA2CZX.js";
+import "./chunk-62BDYGAG.js";
 import {
   SVG_NS,
   tagFactory
-} from "./chunk-VVWPJ543.js";
+} from "./chunk-VWT3VXPL.js";
 import {
   bindDynamic
-} from "./chunk-47M47FOM.js";
+} from "./chunk-O6TRVMJI.js";
+import "./chunk-3ACAAQIN.js";
 import {
   derived
-} from "./chunk-QE4TTDU3.js";
-import "./chunk-2INLLLMZ.js";
+} from "./chunk-KJ3UKABJ.js";
 import "./chunk-7ZHH77QA.js";
 import {
   effect,
   on
-} from "./chunk-XC4MEKGA.js";
+} from "./chunk-V3LHZSU5.js";
+import "./chunk-EXXSN3BW.js";
 import {
   disableSSR,
   enableSSR,
@@ -234,12 +237,12 @@ import {
   external,
   isBatching,
   signal
-} from "./chunk-D33YTSX5.js";
+} from "./chunk-DSID757X.js";
 import {
   retrack,
   setMaxDrainIterations,
   untracked
-} from "./chunk-5Q4R7HCL.js";
+} from "./chunk-TQQUN4WR.js";
 import {
   MAX_DRAIN_TEARDOWNS,
   checkLeaks,
@@ -263,6 +266,7 @@ export {
   Portal,
   SVG_NS,
   Suspense,
+  __renderParsedTemplate,
   __resetIdCounter,
   a,
   abbr,

package/dist/motion.cjs

@@ -761,7 +761,7 @@ function forEachSubscriber(signal2, visit) {
 }
 
 // src/reactivity/track.ts
-var _runtimeVersion = true ? "4.6.0" : "dev";
+var _runtimeVersion = true ? "4.8.0" : "dev";
 var REGISTRY_KEY = /* @__PURE__ */ Symbol.for("sibujs.reactive.v1");
 function resolveReactiveApi() {
   const g = globalThis;
@@ -867,6 +867,14 @@ var batch = API2.batch;
 var enqueueBatchedSignal = API2.enqueueBatchedSignal;
 var isBatching = API2.isBatching;
 
+// src/core/devtoolsHook.ts
+function emitDevtools(hook, event, payload) {
+  try {
+    hook.emit(event, payload);
+  } catch {
+  }
+}
+
 // src/core/signals/signal.ts
 var _g = globalThis;
 function signal(initial, options) {
@@ -900,7 +908,7 @@ function signal(initial, options) {
       state2.__v++;
       if (DEV) {
         const hook = _g.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
-        if (hook) hook.emit("signal:update", { signal: state2, name: debugName, oldValue: prev, newValue });
+        if (hook) emitDevtools(hook, "signal:update", { signal: state2, name: debugName, oldValue: prev, newValue });
       }
       if (!enqueueBatchedSignal(state2)) {
         notifySubscribers2(state2);
@@ -914,7 +922,7 @@ function signal(initial, options) {
       state2.value = newValue;
       state2.__v++;
       const hook = _g.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
-      if (hook) hook.emit("signal:update", { signal: state2, name: debugName, oldValue: prev, newValue });
+      if (hook) emitDevtools(hook, "signal:update", { signal: state2, name: debugName, oldValue: prev, newValue });
       if (!enqueueBatchedSignal(state2)) {
         notifySubscribers2(state2);
       }
@@ -933,7 +941,7 @@ function signal(initial, options) {
   }
   if (DEV) {
     const hook = _g.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
-    if (hook) hook.emit("signal:create", { signal: state2, name: debugName, getter: get, initial });
+    if (hook) emitDevtools(hook, "signal:create", { signal: state2, name: debugName, getter: get, initial });
   }
   return [get, set];
 }

package/dist/motion.js

@@ -20,10 +20,10 @@ import {
   stagger,
   transition,
   viewTransition
-} from "./chunk-XRRZKZYX.js";
+} from "./chunk-LI4W3U6C.js";
 import "./chunk-5HZXGZ6T.js";
-import "./chunk-D33YTSX5.js";
-import "./chunk-5Q4R7HCL.js";
+import "./chunk-DSID757X.js";
+import "./chunk-TQQUN4WR.js";
 import "./chunk-NYNYSPK7.js";
 export {
   TransitionGroup,

package/dist/patterns.cjs

@@ -657,7 +657,7 @@ function forEachSubscriber(signal2, visit) {
 }
 
 // src/reactivity/track.ts
-var _runtimeVersion = true ? "4.6.0" : "dev";
+var _runtimeVersion = true ? "4.8.0" : "dev";
 var REGISTRY_KEY = /* @__PURE__ */ Symbol.for("sibujs.reactive.v1");
 function resolveReactiveApi() {
   const g = globalThis;
@@ -763,6 +763,14 @@ var batch = API2.batch;
 var enqueueBatchedSignal = API2.enqueueBatchedSignal;
 var isBatching = API2.isBatching;
 
+// src/core/devtoolsHook.ts
+function emitDevtools(hook, event, payload) {
+  try {
+    hook.emit(event, payload);
+  } catch {
+  }
+}
+
 // src/core/signals/signal.ts
 var _g = globalThis;
 function signal(initial, options) {
@@ -796,7 +804,7 @@ function signal(initial, options) {
       state2.__v++;
       if (DEV) {
         const hook = _g.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
-        if (hook) hook.emit("signal:update", { signal: state2, name: debugName, oldValue: prev, newValue });
+        if (hook) emitDevtools(hook, "signal:update", { signal: state2, name: debugName, oldValue: prev, newValue });
       }
       if (!enqueueBatchedSignal(state2)) {
         notifySubscribers2(state2);
@@ -810,7 +818,7 @@ function signal(initial, options) {
       state2.value = newValue;
       state2.__v++;
       const hook = _g.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
-      if (hook) hook.emit("signal:update", { signal: state2, name: debugName, oldValue: prev, newValue });
+      if (hook) emitDevtools(hook, "signal:update", { signal: state2, name: debugName, oldValue: prev, newValue });
       if (!enqueueBatchedSignal(state2)) {
         notifySubscribers2(state2);
       }
@@ -829,7 +837,7 @@ function signal(initial, options) {
   }
   if (DEV) {
     const hook = _g.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
-    if (hook) hook.emit("signal:create", { signal: state2, name: debugName, getter: get, initial });
+    if (hook) emitDevtools(hook, "signal:create", { signal: state2, name: debugName, getter: get, initial });
   }
   return [get, set];
 }
@@ -848,6 +856,9 @@ function stripUnsafeKeys(obj) {
 }
 
 // src/patterns/machine.ts
+function ownEntry(table, key) {
+  return Object.hasOwn(table, key) ? table[key] : void 0;
+}
 function machine(config) {
   const [state2, setState] = signal(config.initial);
   const [context, setContext] = signal(config.context || {});
@@ -869,9 +880,9 @@ function machine(config) {
     }
   }
   function step(event) {
-    const stateDef = config.states[currentState];
+    const stateDef = ownEntry(config.states, currentState);
     if (!stateDef?.on) return;
-    const transition = stateDef.on[event];
+    const transition = ownEntry(stateDef.on, event);
     if (!transition) return;
     let target;
     let guard;
@@ -899,7 +910,7 @@ function machine(config) {
       if (action) setContext(nextContext);
       setState(target);
     });
-    const targetDef = config.states[target];
+    const targetDef = ownEntry(config.states, target);
     if (targetDef?.entry) {
       targetDef.entry(currentContext);
     }
@@ -909,7 +920,7 @@ function machine(config) {
     if (processing) return;
     drain();
   }
-  const initialDef = config.states[config.initial];
+  const initialDef = ownEntry(config.states, config.initial);
   if (initialDef?.entry) {
     processing = true;
     try {
@@ -927,9 +938,9 @@ function machine(config) {
   }
   function can(event) {
     const currentState2 = state2();
-    const stateDef = config.states[currentState2];
+    const stateDef = ownEntry(config.states, currentState2);
     if (!stateDef?.on) return false;
-    const transition = stateDef.on[event];
+    const transition = ownEntry(stateDef.on, event);
     if (!transition) return false;
     if (typeof transition === "string") return true;
     if (transition.guard) {
@@ -1094,12 +1105,17 @@ function effect(effectFn, options) {
   try {
     retrack2(ctx.bodyFn, ctx.subscriber);
     if (ctx.rerunPending) drainReruns(ctx);
+  } catch (err) {
+    ctx.disposed = true;
+    if (ctx.userCleanups.length > 0) flushUserCleanups(ctx);
+    cleanup2(ctx.subscriber);
+    throw err;
   } finally {
     ctx.running = false;
     ctx.rerunPending = false;
   }
   const hook = _g2.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
-  if (hook) hook.emit("effect:create", { effectFn });
+  if (hook) emitDevtools(hook, "effect:create", { effectFn });
   return () => disposeEffect(ctx);
 }
 
@@ -1497,17 +1513,17 @@ function derived(getter, options) {
     cs._d = false;
     cs._init = true;
   };
-  track2(() => {
-    let threw = true;
-    try {
+  try {
+    track2(() => {
       cs._v = getter();
       cs._d = false;
       cs._init = true;
-      threw = false;
-    } finally {
-      if (threw) cs._d = true;
-    }
-  }, markDirty);
+    }, markDirty);
+  } catch (err) {
+    disposed = true;
+    cleanup2(markDirty);
+    throw err;
+  }
   const hook = globalThis.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
   const validate = () => {
     if (!cs._d || disposed || pendingError !== void 0) return;
@@ -1526,7 +1542,7 @@ function derived(getter, options) {
       if (disposed) cleanup2(markDirty);
     }
     if (hook && !disposed && !Object.is(oldValue, cs._v)) {
-      hook.emit("computed:update", { signal: cs, oldValue, newValue: cs._v });
+      emitDevtools(hook, "computed:update", { signal: cs, oldValue, newValue: cs._v });
     }
   };
   cs._validate = validate;
@@ -1577,7 +1593,7 @@ function derived(getter, options) {
       }
     }
   };
-  if (hook) hook.emit("computed:create", { signal: cs, name: debugName, getter: computedGetter });
+  if (hook) emitDevtools(hook, "computed:create", { signal: cs, name: debugName, getter: computedGetter });
   return computedGetter;
 }
 

package/dist/patterns.d.cts

@@ -1,4 +1,5 @@
-export { C as ComponentProps, P as PropDef, a as PropSchema, R as RenderProp, V as Validator, W as WithDefaultsProps, b as assertType, c as compose, d as createGuard, e as createSlots, f as defineComponent, g as defineSlottedComponent, h as defineStrictComponent, v as validateProps, i as validators, w as withBoundary, j as withDefaults, k as withProps, l as withWrapper } from './contracts-DRIuclVT.cjs';
+export { C as ComponentProps, P as PropDef, a as PropSchema, R as RenderProp, V as Validator, W as WithDefaultsProps, b as assertType, c as compose, d as createGuard, e as createSlots, f as defineComponent, g as defineSlottedComponent, h as defineStrictComponent, v as validateProps, i as validators, w as withBoundary, j as withDefaults, k as withProps, l as withWrapper } from './contracts-CTOJXu-x.cjs';
+import './types-CJFViL6Q.cjs';
 
 interface MachineConfig<S extends string, E extends string, C extends object = Record<string, unknown>> {
     initial: S;

package/dist/patterns.d.ts

@@ -1,4 +1,5 @@
-export { C as ComponentProps, P as PropDef, a as PropSchema, R as RenderProp, V as Validator, W as WithDefaultsProps, b as assertType, c as compose, d as createGuard, e as createSlots, f as defineComponent, g as defineSlottedComponent, h as defineStrictComponent, v as validateProps, i as validators, w as withBoundary, j as withDefaults, k as withProps, l as withWrapper } from './contracts-DRIuclVT.js';
+export { C as ComponentProps, P as PropDef, a as PropSchema, R as RenderProp, V as Validator, W as WithDefaultsProps, b as assertType, c as compose, d as createGuard, e as createSlots, f as defineComponent, g as defineSlottedComponent, h as defineStrictComponent, v as validateProps, i as validators, w as withBoundary, j as withDefaults, k as withProps, l as withWrapper } from './contracts-CLqzJnOV.js';
+import './types-CJFViL6Q.js';
 
 interface MachineConfig<S extends string, E extends string, C extends object = Record<string, unknown>> {
     initial: S;

package/dist/patterns.js

@@ -5,7 +5,7 @@ import {
   optimisticList,
   persisted,
   timeline
-} from "./chunk-AIF3Z2T7.js";
+} from "./chunk-RGLPEBDE.js";
 import {
   RenderProp,
   assertType,
@@ -22,12 +22,12 @@ import {
   withProps,
   withWrapper
 } from "./chunk-TUCPL2HB.js";
-import "./chunk-H3SRKIYX.js";
-import "./chunk-QE4TTDU3.js";
-import "./chunk-XC4MEKGA.js";
+import "./chunk-62BDYGAG.js";
+import "./chunk-KJ3UKABJ.js";
+import "./chunk-V3LHZSU5.js";
 import "./chunk-7XHATCIH.js";
-import "./chunk-D33YTSX5.js";
-import "./chunk-5Q4R7HCL.js";
+import "./chunk-DSID757X.js";
+import "./chunk-TQQUN4WR.js";
 import "./chunk-NYNYSPK7.js";
 export {
   RenderProp,

package/dist/performance.cjs

@@ -923,7 +923,7 @@ function forEachSubscriber(signal2, visit) {
 }
 
 // src/reactivity/track.ts
-var _runtimeVersion = true ? "4.6.0" : "dev";
+var _runtimeVersion = true ? "4.8.0" : "dev";
 var REGISTRY_KEY = /* @__PURE__ */ Symbol.for("sibujs.reactive.v1");
 function resolveReactiveApi() {
   const g = globalThis;
@@ -979,6 +979,14 @@ var getSubscriberCount2 = API.getSubscriberCount;
 var getSubscriberDeps2 = API.getSubscriberDeps;
 var forEachSubscriber2 = API.forEachSubscriber;
 
+// src/core/devtoolsHook.ts
+function emitDevtools(hook, event, payload) {
+  try {
+    hook.emit(event, payload);
+  } catch {
+  }
+}
+
 // src/core/ssr-context.ts
 var SSR_KEY = /* @__PURE__ */ Symbol.for("sibujs.ssr.v1");
 function detectSSRShared() {
@@ -1133,12 +1141,17 @@ function effect(effectFn, options) {
   try {
     retrack2(ctx.bodyFn, ctx.subscriber);
     if (ctx.rerunPending) drainReruns(ctx);
+  } catch (err) {
+    ctx.disposed = true;
+    if (ctx.userCleanups.length > 0) flushUserCleanups(ctx);
+    cleanup2(ctx.subscriber);
+    throw err;
   } finally {
     ctx.running = false;
     ctx.rerunPending = false;
   }
   const hook = _g.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
-  if (hook) hook.emit("effect:create", { effectFn });
+  if (hook) emitDevtools(hook, "effect:create", { effectFn });
   return () => disposeEffect(ctx);
 }
 
@@ -1225,7 +1238,7 @@ function signal(initial, options) {
       state2.__v++;
       if (DEV) {
         const hook = _g2.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
-        if (hook) hook.emit("signal:update", { signal: state2, name: debugName, oldValue: prev, newValue });
+        if (hook) emitDevtools(hook, "signal:update", { signal: state2, name: debugName, oldValue: prev, newValue });
       }
       if (!enqueueBatchedSignal(state2)) {
         notifySubscribers2(state2);
@@ -1239,7 +1252,7 @@ function signal(initial, options) {
       state2.value = newValue;
       state2.__v++;
       const hook = _g2.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
-      if (hook) hook.emit("signal:update", { signal: state2, name: debugName, oldValue: prev, newValue });
+      if (hook) emitDevtools(hook, "signal:update", { signal: state2, name: debugName, oldValue: prev, newValue });
       if (!enqueueBatchedSignal(state2)) {
         notifySubscribers2(state2);
       }
@@ -1258,7 +1271,7 @@ function signal(initial, options) {
   }
   if (DEV) {
     const hook = _g2.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
-    if (hook) hook.emit("signal:create", { signal: state2, name: debugName, getter: get, initial });
+    if (hook) emitDevtools(hook, "signal:create", { signal: state2, name: debugName, getter: get, initial });
   }
   return [get, set];
 }
@@ -1308,12 +1321,20 @@ function uniqueId(suffix) {
 function stripControlChars(value) {
   return value.replace(/[\x00-\x20\x7f-\x9f]+/g, "");
 }
+var ASCII_UPPER = /[A-Z]/;
+var ASCII_UPPER_G = /[A-Z]/g;
+function canonicalAttrName(name) {
+  return ASCII_UPPER.test(name) ? name.replace(ASCII_UPPER_G, (ch) => String.fromCharCode(ch.charCodeAt(0) + 32)) : name;
+}
 var SAFE_URL_PROTOCOLS = ["http:", "https:", "mailto:", "tel:", "ftp:"];
 var OUTER_TRIM = /^[\x00-\x20\x7f-\x9f]+|[\x00-\x20\x7f-\x9f]+$/g;
 function sanitizeUrl(url) {
   const probe = stripControlChars(url).trim();
   if (!probe) return "";
   const output = url.replace(OUTER_TRIM, "");
+  if (probe.length >= 2 && (probe[0] === "\\" || probe[0] === "/") && (probe[1] === "\\" || probe[1] === "/") && (probe[0] === "\\" || probe[1] === "\\")) {
+    return "";
+  }
   const lower = probe.toLowerCase();
   let schemeEnd = -1;
   for (let i = 0; i < lower.length; i++) {
@@ -1331,6 +1352,15 @@ function sanitizeUrl(url) {
   return output;
 }
 
+// src/utils/elementPolicy.ts
+var BLOCKED_ELEMENTS = /* @__PURE__ */ new Set(["script", "iframe", "object", "embed", "frame", "frameset"]);
+function canonicalTagName(tag) {
+  return canonicalAttrName(tag);
+}
+function isBlockedElement(tag) {
+  return BLOCKED_ELEMENTS.has(canonicalTagName(tag));
+}
+
 // src/performance/domRecycler.ts
 var DOMPool = class {
   constructor(maxSize = 50) {
@@ -1341,6 +1371,9 @@ var DOMPool = class {
    * Get a recycled element or create a new one.
    */
   acquire(tag) {
+    if (isBlockedElement(tag)) {
+      throw new Error(`DOMPool: refusing to create <${tag}> \u2014 tag is blocked for security reasons.`);
+    }
     const pool = this.pools.get(tag);
     if (pool && pool.length > 0) {
       const el = pool.pop();
@@ -1446,10 +1479,19 @@ function prefetch(url) {
 }
 function preloadImage(src) {
   return new Promise((resolve, reject) => {
+    const safe = sanitizeUrl(String(src));
+    if (!safe) {
+      reject(
+        new Error(
+          String(src).trim() === "" ? "preloadImage: no image URL was given." : "preloadImage: refusing an image URL outside the URL policy."
+        )
+      );
+      return;
+    }
     const img = new Image();
     img.onload = () => resolve(img);
     img.onerror = reject;
-    img.src = src;
+    img.src = safe;
   });
 }
 

package/dist/performance.d.cts

@@ -1,5 +1,5 @@
-import { T as TrustedHTML } from './ssr-Bli9XRW5.cjs';
-export { t as trustHTML } from './ssr-Bli9XRW5.cjs';
+import { T as TrustedHTML } from './ssr-C8hgIAw7.cjs';
+export { t as trustHTML } from './ssr-C8hgIAw7.cjs';
 
 declare const Priority: {
     readonly IMMEDIATE: 0;
@@ -144,6 +144,16 @@ declare function preloadResource(url: string, type?: "script" | "style" | "fetch
 declare function prefetch(url: string): void;
 /**
  * Preloads an image and returns a promise that resolves when loaded.
+ *
+ * The URL goes through the same canonical policy (`sanitizeUrl`) as
+ * `preloadResource()`, `prefetch()` and every attribute writer, BEFORE an
+ * `Image` exists: a refused URL creates no element and starts no request. The
+ * promise then rejects with an `Error` — never stays pending — so an `await`
+ * cannot hang on it. The message does not repeat the URL.
+ *
+ * An empty (or whitespace-only) `src` names no image, which is not a policy
+ * refusal; it rejects with its own message, as the browser would have fired
+ * `error` for it anyway.
  */
 declare function preloadImage(src: string): Promise<HTMLImageElement>;
 

package/dist/performance.d.ts

@@ -1,5 +1,5 @@
-import { T as TrustedHTML } from './ssr-Bli9XRW5.js';
-export { t as trustHTML } from './ssr-Bli9XRW5.js';
+import { T as TrustedHTML } from './ssr-C8hgIAw7.js';
+export { t as trustHTML } from './ssr-C8hgIAw7.js';
 
 declare const Priority: {
     readonly IMMEDIATE: 0;
@@ -144,6 +144,16 @@ declare function preloadResource(url: string, type?: "script" | "style" | "fetch
 declare function prefetch(url: string): void;
 /**
  * Preloads an image and returns a promise that resolves when loaded.
+ *
+ * The URL goes through the same canonical policy (`sanitizeUrl`) as
+ * `preloadResource()`, `prefetch()` and every attribute writer, BEFORE an
+ * `Image` exists: a refused URL creates no element and starts no request. The
+ * promise then rejects with an `Error` — never stays pending — so an `await`
+ * cannot hang on it. The message does not repeat the URL.
+ *
+ * An empty (or whitespace-only) `src` names no image, which is not a policy
+ * refusal; it rejects with its own message, as the browser would have fired
+ * `error` for it anyway.
  */
 declare function preloadImage(src: string): Promise<HTMLImageElement>;
 

package/dist/performance.js

@@ -33,16 +33,18 @@ import {
   transitionState,
   uniqueId,
   yieldToMain
-} from "./chunk-DKGBBKOF.js";
+} from "./chunk-C5PEWEGH.js";
 import {
   trustHTML
-} from "./chunk-HURREPU2.js";
-import "./chunk-2INLLLMZ.js";
+} from "./chunk-FC6KCJSA.js";
+import "./chunk-62BDYGAG.js";
+import "./chunk-3ACAAQIN.js";
 import "./chunk-7ZHH77QA.js";
-import "./chunk-XC4MEKGA.js";
+import "./chunk-V3LHZSU5.js";
+import "./chunk-EXXSN3BW.js";
 import "./chunk-7XHATCIH.js";
-import "./chunk-D33YTSX5.js";
-import "./chunk-5Q4R7HCL.js";
+import "./chunk-DSID757X.js";
+import "./chunk-TQQUN4WR.js";
 import "./chunk-NYNYSPK7.js";
 export {
   DOMPool,