sibujs 4.7.0 → 4.8.0

package/dist/browser.cjs

@@ -674,7 +674,7 @@ function forEachSubscriber(signal2, visit) {
 }
 
 // src/reactivity/track.ts
-var _runtimeVersion = true ? "4.7.0" : "dev";
+var _runtimeVersion = true ? "4.8.0" : "dev";
 var REGISTRY_KEY = /* @__PURE__ */ Symbol.for("sibujs.reactive.v1");
 function resolveReactiveApi() {
   const g = globalThis;
@@ -1658,13 +1658,19 @@ function colorScheme() {
 }
 
 // src/browser/format.ts
+var I18N_STATE = /* @__PURE__ */ Symbol.for("sibujs.i18n.v1");
+function activeI18nLocale() {
+  const state2 = globalThis[I18N_STATE];
+  if (!state2) return void 0;
+  return state2.getLocale ? state2.getLocale() : state2.locale?.[0]();
+}
 function formatNumber(value, options) {
   const { locale, ...formatOptions } = options ?? {};
-  return new Intl.NumberFormat(locale, formatOptions).format(value);
+  return new Intl.NumberFormat(locale ?? activeI18nLocale(), formatOptions).format(value);
 }
 function formatCurrency(value, currency, options) {
   const { locale, ...formatOptions } = options ?? {};
-  return new Intl.NumberFormat(locale, {
+  return new Intl.NumberFormat(locale ?? activeI18nLocale(), {
     ...formatOptions,
     style: "currency",
     currency
@@ -2592,6 +2598,36 @@ function textSelection() {
   };
 }
 
+// src/utils/sanitize.ts
+function stripControlChars(value) {
+  return value.replace(/[\x00-\x20\x7f-\x9f]+/g, "");
+}
+var SAFE_URL_PROTOCOLS = ["http:", "https:", "mailto:", "tel:", "ftp:"];
+var OUTER_TRIM = /^[\x00-\x20\x7f-\x9f]+|[\x00-\x20\x7f-\x9f]+$/g;
+function sanitizeUrl(url) {
+  const probe = stripControlChars(url).trim();
+  if (!probe) return "";
+  const output = url.replace(OUTER_TRIM, "");
+  if (probe.length >= 2 && (probe[0] === "\\" || probe[0] === "/") && (probe[1] === "\\" || probe[1] === "/") && (probe[0] === "\\" || probe[1] === "\\")) {
+    return "";
+  }
+  const lower = probe.toLowerCase();
+  let schemeEnd = -1;
+  for (let i = 0; i < lower.length; i++) {
+    const ch = lower.charCodeAt(i);
+    if (ch === 58) {
+      schemeEnd = i;
+      break;
+    }
+    if (ch === 47 || ch === 63 || ch === 35) break;
+  }
+  if (schemeEnd === -1) return output;
+  const scheme = lower.slice(0, schemeEnd + 1);
+  if (!/^[a-z][a-z0-9+.-]*:$/.test(scheme)) return output;
+  if (SAFE_URL_PROTOCOLS.indexOf(scheme) === -1) return "";
+  return output;
+}
+
 // src/browser/imageLoader.ts
 function imageLoader(src) {
   const [status, setStatus] = signal("pending");
@@ -2633,6 +2669,11 @@ function imageLoader(src) {
     abandonCurrent();
     resetState();
     if (disposed || token !== startToken) return;
+    const safe = sanitizeUrl(String(url));
+    if (!safe) {
+      setStatus("error");
+      return;
+    }
     const img = new Image();
     current = img;
     currentSettled = false;
@@ -2651,7 +2692,7 @@ function imageLoader(src) {
       currentSettled = true;
       setStatus("error");
     };
-    img.src = url;
+    img.src = safe;
   }
   let srcEffectTeardown = null;
   if (typeof src === "function") {

package/dist/browser.d.cts

@@ -198,6 +198,18 @@ declare function colorScheme(): {
 /**
  * Locale-aware number and currency formatting using Intl.NumberFormat.
  *
+ * LOCALE. An explicit `locale` option always wins. Without one, the active i18n
+ * locale is used when the i18n plugin is loaded (`setLocale()` / `getLocale()`),
+ * and the runtime's default locale otherwise. The i18n read is reactive, so a
+ * formatter called inside a binding re-formats in place when the locale
+ * switches:
+ *
+ * ```ts
+ * span(() => formatCurrency(price(), "EUR"));   // follows setLocale("es")
+ * ```
+ *
+ * On the server the read is request-scoped, exactly as `getLocale()` is.
+ *
  * @example
  * ```ts
  * formatNumber(1234567.89);                         // "1,234,567.89" (locale-dependent)
@@ -792,6 +804,13 @@ declare function vibrate(pattern: number | number[]): boolean;
  * Ensures a `<link rel="icon">` exists — creates one if missing, updates
  * the `href` otherwise.
  *
+ * NOT routed through the canonical URL allowlist, deliberately: `data:` icons
+ * are this helper's purpose (see `svgFavicon`), and the allowlist refuses
+ * `data:`. That is safe here because an icon link only ever fetches an image —
+ * the browser never navigates to, executes or renders it as a document, so no
+ * scheme turns this sink into script. Do not copy this exception to any sink
+ * that navigates, executes or embeds.
+ *
  * @param url Favicon URL or `data:` URI
  *
  * @example
@@ -874,6 +893,10 @@ interface ImageLoaderState {
  * and its value changes, the previous load is abandoned and a new one
  * starts.
  *
+ * The URL passes the framework's canonical URL policy first (`http:`,
+ * `https:`, relative, …). A refused URL — `javascript:`, `data:`, `blob:`, … —
+ * requests nothing and reports `status() === "error"`.
+ *
  * @example
  * ```ts
  * const img = imageLoader("/hero.jpg");

package/dist/browser.d.ts

@@ -198,6 +198,18 @@ declare function colorScheme(): {
 /**
  * Locale-aware number and currency formatting using Intl.NumberFormat.
  *
+ * LOCALE. An explicit `locale` option always wins. Without one, the active i18n
+ * locale is used when the i18n plugin is loaded (`setLocale()` / `getLocale()`),
+ * and the runtime's default locale otherwise. The i18n read is reactive, so a
+ * formatter called inside a binding re-formats in place when the locale
+ * switches:
+ *
+ * ```ts
+ * span(() => formatCurrency(price(), "EUR"));   // follows setLocale("es")
+ * ```
+ *
+ * On the server the read is request-scoped, exactly as `getLocale()` is.
+ *
  * @example
  * ```ts
  * formatNumber(1234567.89);                         // "1,234,567.89" (locale-dependent)
@@ -792,6 +804,13 @@ declare function vibrate(pattern: number | number[]): boolean;
  * Ensures a `<link rel="icon">` exists — creates one if missing, updates
  * the `href` otherwise.
  *
+ * NOT routed through the canonical URL allowlist, deliberately: `data:` icons
+ * are this helper's purpose (see `svgFavicon`), and the allowlist refuses
+ * `data:`. That is safe here because an icon link only ever fetches an image —
+ * the browser never navigates to, executes or renders it as a document, so no
+ * scheme turns this sink into script. Do not copy this exception to any sink
+ * that navigates, executes or embeds.
+ *
  * @param url Favicon URL or `data:` URI
  *
  * @example
@@ -874,6 +893,10 @@ interface ImageLoaderState {
  * and its value changes, the previous load is abandoned and a new one
  * starts.
  *
+ * The URL passes the framework's canonical URL policy first (`http:`,
+ * `https:`, relative, …). A refused URL — `javascript:`, `data:`, `blob:`, … —
+ * requests nothing and reports `status() === "error"`.
+ *
  * @example
  * ```ts
  * const img = imageLoader("/hero.jpg");

package/dist/browser.js

@@ -36,14 +36,15 @@ import {
   visibility,
   wakeLock,
   windowSize
-} from "./chunk-ZVL7TY4K.js";
-import "./chunk-H3SRKIYX.js";
+} from "./chunk-EGUQLBHE.js";
 import "./chunk-52XFPGSN.js";
+import "./chunk-62BDYGAG.js";
 import "./chunk-7ZHH77QA.js";
-import "./chunk-WEQ3DMVL.js";
+import "./chunk-V3LHZSU5.js";
+import "./chunk-EXXSN3BW.js";
 import "./chunk-7XHATCIH.js";
-import "./chunk-FQRUXCEE.js";
-import "./chunk-JWKYU5GV.js";
+import "./chunk-DSID757X.js";
+import "./chunk-TQQUN4WR.js";
 import "./chunk-NYNYSPK7.js";
 export {
   __resetSpeechCoordinator,