sibujs 4.7.0 → 4.8.0

package/dist/{chunk-XYV3EDB7.js → chunk-J3YQ457H.js}

@@ -135,40 +135,44 @@ import {
   use,
   var_,
   video
-} from "./chunk-7LUJQAOJ.js";
+} from "./chunk-Q5J2LVKH.js";
 import {
   trustHTML
-} from "./chunk-HURREPU2.js";
+} from "./chunk-FC6KCJSA.js";
 import {
   watch
-} from "./chunk-SLM3IA34.js";
+} from "./chunk-CZPRSWSS.js";
 import {
   __resetIdCounter,
   createId,
   domBinding
-} from "./chunk-BC2SECJD.js";
+} from "./chunk-C7AA2CZX.js";
 import {
   SVG_NS,
   bindChildNode,
   captureFocusWithin,
   restoreFocusWithin,
   tagFactory
-} from "./chunk-UOL2ECCS.js";
+} from "./chunk-VWT3VXPL.js";
 import {
   bindAttribute,
   bindDynamic,
-  setSafeAttribute
-} from "./chunk-FNJXNGYZ.js";
+  setSafeAttribute,
+  setTrustedAttribute
+} from "./chunk-O6TRVMJI.js";
+import {
+  isCodeTextElement
+} from "./chunk-3ACAAQIN.js";
 import {
   derived
-} from "./chunk-RUSSKG6G.js";
+} from "./chunk-KJ3UKABJ.js";
 import {
   globalSingleton
 } from "./chunk-7ZHH77QA.js";
 import {
   effect,
   on
-} from "./chunk-WEQ3DMVL.js";
+} from "./chunk-V3LHZSU5.js";
 import {
   disableSSR,
   enableSSR,
@@ -187,7 +191,7 @@ import {
   external,
   isBatching,
   signal
-} from "./chunk-FQRUXCEE.js";
+} from "./chunk-DSID757X.js";
 import {
   emitDevtools,
   notifySubscribers,
@@ -199,7 +203,7 @@ import {
   suspendTracking,
   track,
   untracked
-} from "./chunk-JWKYU5GV.js";
+} from "./chunk-TQQUN4WR.js";
 import {
   DEV,
   MAX_DRAIN_TEARDOWNS,
@@ -234,6 +238,7 @@ __export(index_exports, {
   Portal: () => Portal,
   SVG_NS: () => SVG_NS,
   Suspense: () => Suspense,
+  __renderParsedTemplate: () => __renderParsedTemplate,
   __resetIdCounter: () => __resetIdCounter,
   a: () => a,
   abbr: () => abbr,
@@ -1831,6 +1836,10 @@ function attachBranch(parent, anchor, branch, attachedOnce, where) {
   parent.insertBefore(node, anchor.nextSibling);
   return { node, owned };
 }
+function releaseBranchNode(node, owned) {
+  if (owned) dispose(node);
+  node.parentNode?.removeChild(node);
+}
 function when(condition, thenBranch, elseBranch) {
   const anchor = document.createComment("when");
   let currentNode = null;
@@ -1848,8 +1857,7 @@ function when(condition, thenBranch, elseBranch) {
     lastCondition = show2;
     const focused = currentNode ? captureFocusWithin([currentNode]) : null;
     if (currentNode?.parentNode) {
-      if (currentNodeOwned) dispose(currentNode);
-      currentNode.parentNode.removeChild(currentNode);
+      releaseBranchNode(currentNode, currentNodeOwned);
       currentNode = null;
     }
     const branch = show2 ? thenBranch : elseBranch !== void 0 ? elseBranch : null;
@@ -1863,6 +1871,8 @@ function when(condition, thenBranch, elseBranch) {
   registerDisposer(anchor, () => {
     disposed = true;
     stopBinding();
+    if (currentNode) releaseBranchNode(currentNode, currentNodeOwned);
+    currentNode = null;
   });
   if (!initialized) {
     queueMicrotask(() => {
@@ -1888,8 +1898,7 @@ function match(value, cases, fallback) {
     lastKey = key;
     const focused = currentNode ? captureFocusWithin([currentNode]) : null;
     if (currentNode?.parentNode) {
-      if (currentNodeOwned) dispose(currentNode);
-      currentNode.parentNode.removeChild(currentNode);
+      releaseBranchNode(currentNode, currentNodeOwned);
       currentNode = null;
     }
     const branch = Object.hasOwn(cases, key) ? cases[key] : fallback;
@@ -1903,6 +1912,8 @@ function match(value, cases, fallback) {
   registerDisposer(anchor, () => {
     disposed = true;
     stopBinding();
+    if (currentNode) releaseBranchNode(currentNode, currentNodeOwned);
+    currentNode = null;
   });
   if (!initialized) {
     queueMicrotask(() => {
@@ -2239,7 +2250,6 @@ function appendChild(frag, child) {
 }
 
 // src/core/rendering/htm.ts
-var RAW_TEXT_TAGS = /* @__PURE__ */ new Set(["script", "style"]);
 var VOID_ELEMENTS = /* @__PURE__ */ new Set([
   "area",
   "base",
@@ -2462,7 +2472,7 @@ function parseTemplate(strings) {
           children.push({ t: 0, el: { tag, svg: SVG_TAGS.has(tag), attrs, children: [] } });
         } else {
           const inner = parseChildren();
-          if (RAW_TEXT_TAGS.has(tag.toLowerCase())) {
+          if (isCodeTextElement(tag)) {
             for (let i2 = 0; i2 < inner.length; i2++) {
               if (inner[i2].t === 2) {
                 throw new Error(
@@ -2493,7 +2503,7 @@ function executeElement(tmpl, values) {
     const attr = tmpl.attrs[i2];
     switch (attr.t) {
       case 0:
-        el.setAttribute(attr.name, attr.value);
+        setTrustedAttribute(el, attr.name, attr.value);
         break;
       case 1: {
         const name = attr.name;
@@ -2526,7 +2536,7 @@ function executeElement(tmpl, values) {
         break;
       }
       case 4:
-        el.setAttribute(attr.name, "");
+        setTrustedAttribute(el, attr.name, "");
         break;
     }
   }
@@ -2571,6 +2581,12 @@ function html(strings, ...values) {
     tmpl = parseTemplate(strings);
     cache.set(strings, tmpl);
   }
+  return renderTemplate(tmpl, values);
+}
+function __renderParsedTemplate(tree, values) {
+  return renderTemplate(tree, values);
+}
+function renderTemplate(tmpl, values) {
   if (tmpl.length === 1 && tmpl[0].t === 0) {
     return executeElement(tmpl[0].el, values);
   }
@@ -3512,7 +3528,7 @@ function enhance(target, setup) {
           bindNode(el, () => {
             const v = value();
             const next = v == null ? null : String(v);
-            setSafeAttribute(el, name, next, { syncValueProperty: false, label: "enhance attr()" });
+            setSafeAttribute(el, name, next, { syncValueProperty: false, label: "enhance attr()", reactive: true });
           })
         );
       });
@@ -3899,6 +3915,7 @@ export {
   each,
   Fragment,
   html,
+  __renderParsedTemplate,
   KeepAlive,
   mount,
   Portal,

package/dist/{chunk-VZSG24LS.js → chunk-JUTFX2RM.js}

@@ -6,25 +6,25 @@ import {
 import {
   div,
   span
-} from "./chunk-7LUJQAOJ.js";
+} from "./chunk-Q5J2LVKH.js";
 import {
   STATIC_VALUE_RESOLVER,
   planHeadElementEntry,
   planMetaEntry
-} from "./chunk-HURREPU2.js";
-import {
-  sanitizeUrl
-} from "./chunk-2INLLLMZ.js";
+} from "./chunk-FC6KCJSA.js";
 import {
   globalSingleton
 } from "./chunk-7ZHH77QA.js";
 import {
   effect
-} from "./chunk-WEQ3DMVL.js";
+} from "./chunk-V3LHZSU5.js";
+import {
+  sanitizeUrl
+} from "./chunk-EXXSN3BW.js";
 import {
   batch,
   signal
-} from "./chunk-FQRUXCEE.js";
+} from "./chunk-DSID757X.js";
 import {
   registerDisposer,
   replaceChildrenSafely,
@@ -179,7 +179,16 @@ function toError(err) {
   if (err !== null && typeof err === "object" && "name" in err && "message" in err) return err;
   return new Error(String(err));
 }
+function workerSource(fn, api) {
+  if (typeof fn !== "function") {
+    throw new TypeError(
+      `${api}: expected a function, got ${typeof fn}. Worker code must be a function defined in your source \u2014 a string would be evaluated as code.`
+    );
+  }
+  return Function.prototype.toString.call(fn);
+}
 function worker(workerFn2) {
+  const fnBody = workerSource(workerFn2, "worker");
   const [result, setResult] = signal(null);
   const [error, setError] = signal(null);
   const [loading, setLoading] = signal(false);
@@ -195,7 +204,6 @@ function worker(workerFn2) {
     if (typeof Worker === "undefined") {
       throw new Error("Web Workers are not supported in this environment");
     }
-    const fnBody = workerFn2.toString();
     const blob = new Blob([`self.onmessage = ${fnBody};`], { type: "application/javascript" });
     blobUrl = URL.createObjectURL(blob);
     worker2 = new Worker(blobUrl);
@@ -244,6 +252,7 @@ function worker(workerFn2) {
   return { post, result, error, loading, terminate };
 }
 function workerFn(fn) {
+  const fnStr = workerSource(fn, "workerFn");
   const [loading, setLoading] = signal(false);
   let worker2 = null;
   let blobUrl = null;
@@ -258,7 +267,6 @@ function workerFn(fn) {
     if (typeof Worker === "undefined") {
       throw new Error("Web Workers are not supported in this environment");
     }
-    const fnStr = fn.toString();
     const blob = new Blob(
       [
         `self.onmessage = function(e) {
@@ -318,6 +326,7 @@ function workerFn(fn) {
   return { run, loading, terminate };
 }
 function createWorkerPool(workerFn2, poolSize) {
+  const fnBody = workerSource(workerFn2, "createWorkerPool");
   const size = poolSize || typeof navigator !== "undefined" && navigator.hardwareConcurrency || 4;
   const workers = [];
   const queues = [];
@@ -376,7 +385,6 @@ function createWorkerPool(workerFn2, poolSize) {
     if (typeof Worker === "undefined") {
       throw new Error("Web Workers are not supported in this environment");
     }
-    const fnBody = workerFn2.toString();
     const blob = new Blob([`self.onmessage = ${fnBody};`], { type: "application/javascript" });
     blobUrl = URL.createObjectURL(blob);
     for (let i = 0; i < size; i++) {

package/dist/{chunk-RUSSKG6G.js → chunk-KJ3UKABJ.js}

@@ -5,7 +5,7 @@ import {
   recordDependency,
   retrack,
   track
-} from "./chunk-JWKYU5GV.js";
+} from "./chunk-TQQUN4WR.js";
 import {
   devAssert
 } from "./chunk-NYNYSPK7.js";

package/dist/{chunk-UNWRJRKC.js → chunk-LI4W3U6C.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-5HZXGZ6T.js";
 import {
   signal
-} from "./chunk-FQRUXCEE.js";
+} from "./chunk-DSID757X.js";
 import {
   registerDisposer,
   reportError

package/dist/{chunk-FNJXNGYZ.js → chunk-O6TRVMJI.js}

@@ -1,14 +1,20 @@
+import {
+  ContextualRefusal,
+  contextualAttributeRefusal,
+  settleAttributeProvenance
+} from "./chunk-3ACAAQIN.js";
 import {
   isEventHandlerAttr,
   isHtmlContentAttribute,
-  sanitizeAttributeString
-} from "./chunk-2INLLLMZ.js";
+  resolveAttributeValue
+} from "./chunk-EXXSN3BW.js";
 import {
   reactiveBinding
-} from "./chunk-JWKYU5GV.js";
+} from "./chunk-TQQUN4WR.js";
 import {
   DEV,
   devWarn,
+  devWarnLazy,
   reportError
 } from "./chunk-NYNYSPK7.js";
 
@@ -21,6 +27,19 @@ var BOOLEAN_IDL_ATTRS = /* @__PURE__ */ new Set(["checked", "disabled", "selecte
 function isHtmlElement(el) {
   return el.namespaceURI === null || el.namespaceURI === HTML_NS;
 }
+function warnContextualRefusal(label, name, refusal) {
+  devWarnLazy(() => {
+    const reasons = [
+      "",
+      'the element would become a <meta http-equiv="refresh"> directive the shared refresh policy forbids (a destination outside the URL allowlist, or a directive too malformed to read unambiguously)',
+      "a <meta> whose http-equiv or content is reactive may never carry a refresh directive: a browser schedules the navigation as soon as the directive is valid, and nothing can withdraw it when the state changes back",
+      "a runtime value may not choose the program a <script> runs; name the script in static template source, or load it through Head({ script }) as an explicit trust decision",
+      "an SVG animation may not target a URL, event-handler or nested-document attribute; its to / values would be written into that attribute without passing the URL policy",
+      'a runtime-chosen href may not become an applied <link rel="stylesheet">: a well-formed URL is not a trusted stylesheet. Name the stylesheet in static template source, or load a runtime-chosen one through Head({ link }) as an explicit trust decision'
+    ];
+    return `${label}: refusing "${name}" in this element's context \u2014 ${reasons[refusal]}. The write was not performed.`;
+  });
+}
 function setProp(el, key, val) {
   el[key] = val;
 }
@@ -32,6 +51,11 @@ function namespaceFor(el, name) {
   return null;
 }
 function setSafeAttribute(el, name, value, options = {}) {
+  const written = commitSafeAttribute(el, name, value, options);
+  if (el.localName === "link") settleAttributeProvenance(el, name, options.reactive ? "reactive" : "runtime");
+  return written;
+}
+function commitSafeAttribute(el, name, value, options) {
   const ns = namespaceFor(el, name);
   const localName = ns ? name.slice(name.indexOf(":") + 1) : name;
   if (isEventHandlerAttr(name)) {
@@ -44,6 +68,14 @@ function setSafeAttribute(el, name, value, options = {}) {
     else el.removeAttribute(name);
     return false;
   }
+  const pending = value == null || value === false ? null : value === true ? "" : String(value);
+  const refusal = contextualAttributeRefusal(el, name, pending, options.reactive ? "reactive" : "runtime");
+  if (refusal !== ContextualRefusal.None) {
+    warnContextualRefusal(options.label ?? "setSafeAttribute", name, refusal);
+    if (ns) el.removeAttributeNS(ns, localName);
+    else el.removeAttribute(name);
+    return false;
+  }
   if (value == null) {
     if (ns) el.removeAttributeNS(ns, localName);
     else el.removeAttribute(name);
@@ -87,13 +119,32 @@ function setSafeAttribute(el, name, value, options = {}) {
     setProp(el, idlName, idlName === "checked" ? Boolean(value) : str);
     return true;
   }
-  const safe = sanitizeAttributeString(name, str, { element: el });
+  const safe = str === "" ? "" : resolveAttributeValue(name, str, { element: el });
+  if (safe === null) {
+    if (ns) el.removeAttributeNS(ns, localName);
+    else el.removeAttribute(name);
+    return true;
+  }
   const current = ns ? el.getAttributeNS(ns, localName) : el.getAttribute(name);
   if (current === safe) return true;
   if (ns) el.setAttributeNS(ns, name, safe);
   else el.setAttribute(name, safe);
   return true;
 }
+function setTrustedAttribute(el, name, value) {
+  if (isHtmlContentAttribute(name)) {
+    if (DEV) devWarn(`html: refusing static attribute "${name}" \u2014 the browser parses it as a nested document.`);
+    return false;
+  }
+  const refusal = contextualAttributeRefusal(el, name, value, "static");
+  if (refusal !== ContextualRefusal.None) {
+    warnContextualRefusal("html (static attribute)", name, refusal);
+    return false;
+  }
+  el.setAttribute(name, value);
+  if (el.localName === "link") settleAttributeProvenance(el, name, "static");
+  return true;
+}
 
 // src/reactivity/bindAttribute.ts
 function bindAttribute(el, attr, getter) {
@@ -110,7 +161,7 @@ function bindAttribute(el, attr, getter) {
       reportError(err, { phase: "binding", name: `bindAttribute("${attr}")`, node: el });
       return;
     }
-    setSafeAttribute(el, attr, value, { label: `bindAttribute("${attr}")` });
+    setSafeAttribute(el, attr, value, { label: `bindAttribute("${attr}")`, reactive: true });
   }
   return reactiveBinding(commit, el);
 }
@@ -135,7 +186,7 @@ function bindDynamic(el, nameGetter, valueGetter) {
       el.removeAttribute(prevName);
       prevName = null;
     }
-    if (!setSafeAttribute(el, name, value, { label: "bindDynamic" })) return;
+    if (!setSafeAttribute(el, name, value, { label: "bindDynamic", reactive: true })) return;
     prevName = name;
   }
   const teardown = reactiveBinding(commit, el);
@@ -149,6 +200,7 @@ function bindDynamic(el, nameGetter, valueGetter) {
 
 export {
   setSafeAttribute,
+  setTrustedAttribute,
   bindAttribute,
   bindDynamic
 };

package/dist/{chunk-7LUJQAOJ.js → chunk-Q5J2LVKH.js}

@@ -1,7 +1,7 @@
 import {
   SVG_NS,
   tagFactory
-} from "./chunk-UOL2ECCS.js";
+} from "./chunk-VWT3VXPL.js";
 
 // src/core/rendering/html.ts
 var html = tagFactory("html");

package/dist/{chunk-4AWA2PVD.js → chunk-QGMSESDD.js}

@@ -1,9 +1,12 @@
 import {
   renderToString
-} from "./chunk-HURREPU2.js";
+} from "./chunk-FC6KCJSA.js";
 import {
   globalSingleton
 } from "./chunk-7ZHH77QA.js";
+import {
+  sanitizeUrl
+} from "./chunk-EXXSN3BW.js";
 import {
   reportError
 } from "./chunk-NYNYSPK7.js";
@@ -167,7 +170,7 @@ var CDN_ENTRY_POINTS = {
 };
 var packageInfo = {
   name: "sibujs",
-  version: true ? "4.7.0" : "dev",
+  version: true ? "4.8.0" : "dev",
   entryPoints: MODULE_ENTRY_POINTS,
   /**
    * Generate the package.json `exports` map. Module entries resolve to the
@@ -312,7 +315,7 @@ var env = {
 };
 
 // src/plugins/versioning.ts
-var VERSION = true ? "4.7.0" : "dev";
+var VERSION = true ? "4.8.0" : "dev";
 var NUM = "(?:0|[1-9]\\d*)";
 var PRE_ID = `(?:${NUM}|\\d*[a-zA-Z-][0-9a-zA-Z-]*)`;
 var BUILD_ID = "[0-9a-zA-Z-]+";
@@ -595,12 +598,14 @@ function extractRangeTarget(range) {
 function preloadCritical(resources) {
   if (typeof document === "undefined") return;
   for (const resource of resources) {
-    const safeHref = typeof CSS !== "undefined" && typeof CSS.escape === "function" ? CSS.escape(resource.href) : resource.href.replace(/["\\]/g, "\\$&");
+    const href = sanitizeUrl(resource.href);
+    if (!href) continue;
+    const safeHref = typeof CSS !== "undefined" && typeof CSS.escape === "function" ? CSS.escape(href) : href.replace(/["\\]/g, "\\$&");
     const existing = document.querySelector(`link[rel="preload"][href="${safeHref}"]`);
     if (existing) continue;
     const link = document.createElement("link");
     link.rel = "preload";
-    link.href = resource.href;
+    link.href = href;
     link.setAttribute("as", resource.as);
     if (resource.type) {
       link.type = resource.type;

package/dist/{chunk-XZR4PXRE.js → chunk-RGLPEBDE.js}

@@ -1,17 +1,17 @@
 import {
   isUnsafeKey,
   stripUnsafeKeys
-} from "./chunk-H3SRKIYX.js";
+} from "./chunk-62BDYGAG.js";
 import {
   derived
-} from "./chunk-RUSSKG6G.js";
+} from "./chunk-KJ3UKABJ.js";
 import {
   effect
-} from "./chunk-WEQ3DMVL.js";
+} from "./chunk-V3LHZSU5.js";
 import {
   batch,
   signal
-} from "./chunk-FQRUXCEE.js";
+} from "./chunk-DSID757X.js";
 import {
   DEV,
   devWarn,
@@ -19,6 +19,9 @@ import {
 } from "./chunk-NYNYSPK7.js";
 
 // src/patterns/machine.ts
+function ownEntry(table, key) {
+  return Object.hasOwn(table, key) ? table[key] : void 0;
+}
 function machine(config) {
   const [state, setState] = signal(config.initial);
   const [context, setContext] = signal(config.context || {});
@@ -40,9 +43,9 @@ function machine(config) {
     }
   }
   function step(event) {
-    const stateDef = config.states[currentState];
+    const stateDef = ownEntry(config.states, currentState);
     if (!stateDef?.on) return;
-    const transition = stateDef.on[event];
+    const transition = ownEntry(stateDef.on, event);
     if (!transition) return;
     let target;
     let guard;
@@ -70,7 +73,7 @@ function machine(config) {
       if (action) setContext(nextContext);
       setState(target);
     });
-    const targetDef = config.states[target];
+    const targetDef = ownEntry(config.states, target);
     if (targetDef?.entry) {
       targetDef.entry(currentContext);
     }
@@ -80,7 +83,7 @@ function machine(config) {
     if (processing) return;
     drain();
   }
-  const initialDef = config.states[config.initial];
+  const initialDef = ownEntry(config.states, config.initial);
   if (initialDef?.entry) {
     processing = true;
     try {
@@ -98,9 +101,9 @@ function machine(config) {
   }
   function can(event) {
     const currentState2 = state();
-    const stateDef = config.states[currentState2];
+    const stateDef = ownEntry(config.states, currentState2);
     if (!stateDef?.on) return false;
-    const transition = stateDef.on[event];
+    const transition = ownEntry(stateDef.on, event);
     if (!transition) return false;
     if (typeof transition === "string") return true;
     if (transition.guard) {

package/dist/{chunk-JWKYU5GV.js → chunk-TQQUN4WR.js}

@@ -498,7 +498,7 @@ function forEachSubscriber(signal, visit) {
 }
 
 // src/reactivity/track.ts
-var _runtimeVersion = true ? "4.7.0" : "dev";
+var _runtimeVersion = true ? "4.8.0" : "dev";
 var REGISTRY_KEY = /* @__PURE__ */ Symbol.for("sibujs.reactive.v1");
 function resolveReactiveApi() {
   const g = globalThis;

package/dist/{chunk-WOLJZUFQ.js → chunk-UCNP3HVM.js}

@@ -1,25 +1,25 @@
 import {
   derived
-} from "./chunk-RUSSKG6G.js";
-import {
-  sanitizeUrl
-} from "./chunk-2INLLLMZ.js";
+} from "./chunk-KJ3UKABJ.js";
 import {
   globalSingleton
 } from "./chunk-7ZHH77QA.js";
 import {
   effect
-} from "./chunk-WEQ3DMVL.js";
+} from "./chunk-V3LHZSU5.js";
+import {
+  sanitizeUrl
+} from "./chunk-EXXSN3BW.js";
 import {
   getRequestScopedCache
 } from "./chunk-7XHATCIH.js";
 import {
   batch,
   signal
-} from "./chunk-FQRUXCEE.js";
+} from "./chunk-DSID757X.js";
 import {
   untracked
-} from "./chunk-JWKYU5GV.js";
+} from "./chunk-TQQUN4WR.js";
 import {
   reportError
 } from "./chunk-NYNYSPK7.js";
@@ -173,7 +173,11 @@ function reconcile(prev, next, depth, walk, newRoot) {
     const nextChild = nextRecord[key];
     const hasPrev = Object.hasOwn(prevRecord, key);
     const shared = hasPrev ? reconcile(prevRecord[key], nextChild, depth + 1, walk, false) : nextChild;
-    copy[key] = shared;
+    if (key === "__proto__") {
+      Object.defineProperty(copy, key, { value: shared, writable: true, enumerable: true, configurable: true });
+    } else {
+      copy[key] = shared;
+    }
     if (!hasPrev || !Object.is(shared, prevRecord[key])) allFromPrev = false;
     if (!Object.is(shared, nextChild)) allFromNext = false;
   }

package/dist/{chunk-WEQ3DMVL.js → chunk-V3LHZSU5.js}

@@ -6,7 +6,7 @@ import {
   emitDevtools,
   retrack,
   untracked
-} from "./chunk-JWKYU5GV.js";
+} from "./chunk-TQQUN4WR.js";
 import {
   devAssert,
   reportError