sibujs 4.7.0 → 4.9.0

package/dist/browser.cjs

@@ -674,7 +674,7 @@ function forEachSubscriber(signal2, visit) {
 }
 
 // src/reactivity/track.ts
-var _runtimeVersion = true ? "4.7.0" : "dev";
+var _runtimeVersion = true ? "4.9.0" : "dev";
 var REGISTRY_KEY = /* @__PURE__ */ Symbol.for("sibujs.reactive.v1");
 function resolveReactiveApi() {
   const g = globalThis;
@@ -1658,13 +1658,19 @@ function colorScheme() {
 }
 
 // src/browser/format.ts
+var I18N_STATE = /* @__PURE__ */ Symbol.for("sibujs.i18n.v1");
+function activeI18nLocale() {
+  const state2 = globalThis[I18N_STATE];
+  if (!state2) return void 0;
+  return state2.getLocale ? state2.getLocale() : state2.locale?.[0]();
+}
 function formatNumber(value, options) {
   const { locale, ...formatOptions } = options ?? {};
-  return new Intl.NumberFormat(locale, formatOptions).format(value);
+  return new Intl.NumberFormat(locale ?? activeI18nLocale(), formatOptions).format(value);
 }
 function formatCurrency(value, currency, options) {
   const { locale, ...formatOptions } = options ?? {};
-  return new Intl.NumberFormat(locale, {
+  return new Intl.NumberFormat(locale ?? activeI18nLocale(), {
     ...formatOptions,
     style: "currency",
     currency
@@ -2258,6 +2264,7 @@ function keyboard(options = {}) {
     };
   }
   const target = options.target ?? window;
+  const view = options.target?.ownerDocument?.defaultView ?? window;
   const filter = options.keys ? new Set(options.keys) : null;
   const onDown = (e) => {
     if (filter && !filter.has(e.key)) return;
@@ -2280,14 +2287,14 @@ function keyboard(options = {}) {
   const onBlur = () => setPressed(/* @__PURE__ */ new Set());
   target.addEventListener("keydown", onDown);
   target.addEventListener("keyup", onUp);
-  window.addEventListener("blur", onBlur);
+  view.addEventListener("blur", onBlur);
   function isPressed(key) {
     return pressed().has(key);
   }
   function dispose() {
     target.removeEventListener("keydown", onDown);
     target.removeEventListener("keyup", onUp);
-    window.removeEventListener("blur", onBlur);
+    view.removeEventListener("blur", onBlur);
   }
   return { pressed, isPressed, dispose };
 }
@@ -2592,6 +2599,36 @@ function textSelection() {
   };
 }
 
+// src/utils/sanitize.ts
+function stripControlChars(value) {
+  return value.replace(/[\x00-\x20\x7f-\x9f]+/g, "");
+}
+var SAFE_URL_PROTOCOLS = ["http:", "https:", "mailto:", "tel:", "ftp:"];
+var OUTER_TRIM = /^[\x00-\x20\x7f-\x9f]+|[\x00-\x20\x7f-\x9f]+$/g;
+function sanitizeUrl(url) {
+  const probe = stripControlChars(url).trim();
+  if (!probe) return "";
+  const output = url.replace(OUTER_TRIM, "");
+  if (probe.length >= 2 && (probe[0] === "\\" || probe[0] === "/") && (probe[1] === "\\" || probe[1] === "/") && (probe[0] === "\\" || probe[1] === "\\")) {
+    return "";
+  }
+  const lower = probe.toLowerCase();
+  let schemeEnd = -1;
+  for (let i = 0; i < lower.length; i++) {
+    const ch = lower.charCodeAt(i);
+    if (ch === 58) {
+      schemeEnd = i;
+      break;
+    }
+    if (ch === 47 || ch === 63 || ch === 35) break;
+  }
+  if (schemeEnd === -1) return output;
+  const scheme = lower.slice(0, schemeEnd + 1);
+  if (!/^[a-z][a-z0-9+.-]*:$/.test(scheme)) return output;
+  if (SAFE_URL_PROTOCOLS.indexOf(scheme) === -1) return "";
+  return output;
+}
+
 // src/browser/imageLoader.ts
 function imageLoader(src) {
   const [status, setStatus] = signal("pending");
@@ -2633,6 +2670,11 @@ function imageLoader(src) {
     abandonCurrent();
     resetState();
     if (disposed || token !== startToken) return;
+    const safe = sanitizeUrl(String(url));
+    if (!safe) {
+      setStatus("error");
+      return;
+    }
     const img = new Image();
     current = img;
     currentSettled = false;
@@ -2651,7 +2693,7 @@ function imageLoader(src) {
       currentSettled = true;
       setStatus("error");
     };
-    img.src = url;
+    img.src = safe;
   }
   let srcEffectTeardown = null;
   if (typeof src === "function") {

package/dist/browser.d.cts

@@ -198,6 +198,18 @@ declare function colorScheme(): {
 /**
  * Locale-aware number and currency formatting using Intl.NumberFormat.
  *
+ * LOCALE. An explicit `locale` option always wins. Without one, the active i18n
+ * locale is used when the i18n plugin is loaded (`setLocale()` / `getLocale()`),
+ * and the runtime's default locale otherwise. The i18n read is reactive, so a
+ * formatter called inside a binding re-formats in place when the locale
+ * switches:
+ *
+ * ```ts
+ * span(() => formatCurrency(price(), "EUR"));   // follows setLocale("es")
+ * ```
+ *
+ * On the server the read is request-scoped, exactly as `getLocale()` is.
+ *
  * @example
  * ```ts
  * formatNumber(1234567.89);                         // "1,234,567.89" (locale-dependent)
@@ -630,8 +642,9 @@ interface KeyboardOptions {
  * `KeyboardEvent.key`). On every key event the signal is replaced with a
  * new Set instance so reactive subscribers see the change.
  *
- * Also listens to `window.blur` to clear stuck keys if the window loses
- * focus mid-press — otherwise held modifiers can "ghost" forever.
+ * Also listens to `blur` on the target's window (the global `window`, or the
+ * window of the document a `target` element belongs to) to clear stuck keys
+ * if it loses focus mid-press — otherwise held modifiers can "ghost" forever.
  *
  * @example
  * ```ts
@@ -792,6 +805,13 @@ declare function vibrate(pattern: number | number[]): boolean;
  * Ensures a `<link rel="icon">` exists — creates one if missing, updates
  * the `href` otherwise.
  *
+ * NOT routed through the canonical URL allowlist, deliberately: `data:` icons
+ * are this helper's purpose (see `svgFavicon`), and the allowlist refuses
+ * `data:`. That is safe here because an icon link only ever fetches an image —
+ * the browser never navigates to, executes or renders it as a document, so no
+ * scheme turns this sink into script. Do not copy this exception to any sink
+ * that navigates, executes or embeds.
+ *
  * @param url Favicon URL or `data:` URI
  *
  * @example
@@ -874,6 +894,10 @@ interface ImageLoaderState {
  * and its value changes, the previous load is abandoned and a new one
  * starts.
  *
+ * The URL passes the framework's canonical URL policy first (`http:`,
+ * `https:`, relative, …). A refused URL — `javascript:`, `data:`, `blob:`, … —
+ * requests nothing and reports `status() === "error"`.
+ *
  * @example
  * ```ts
  * const img = imageLoader("/hero.jpg");

package/dist/browser.d.ts

@@ -198,6 +198,18 @@ declare function colorScheme(): {
 /**
  * Locale-aware number and currency formatting using Intl.NumberFormat.
  *
+ * LOCALE. An explicit `locale` option always wins. Without one, the active i18n
+ * locale is used when the i18n plugin is loaded (`setLocale()` / `getLocale()`),
+ * and the runtime's default locale otherwise. The i18n read is reactive, so a
+ * formatter called inside a binding re-formats in place when the locale
+ * switches:
+ *
+ * ```ts
+ * span(() => formatCurrency(price(), "EUR"));   // follows setLocale("es")
+ * ```
+ *
+ * On the server the read is request-scoped, exactly as `getLocale()` is.
+ *
  * @example
  * ```ts
  * formatNumber(1234567.89);                         // "1,234,567.89" (locale-dependent)
@@ -630,8 +642,9 @@ interface KeyboardOptions {
  * `KeyboardEvent.key`). On every key event the signal is replaced with a
  * new Set instance so reactive subscribers see the change.
  *
- * Also listens to `window.blur` to clear stuck keys if the window loses
- * focus mid-press — otherwise held modifiers can "ghost" forever.
+ * Also listens to `blur` on the target's window (the global `window`, or the
+ * window of the document a `target` element belongs to) to clear stuck keys
+ * if it loses focus mid-press — otherwise held modifiers can "ghost" forever.
  *
  * @example
  * ```ts
@@ -792,6 +805,13 @@ declare function vibrate(pattern: number | number[]): boolean;
  * Ensures a `<link rel="icon">` exists — creates one if missing, updates
  * the `href` otherwise.
  *
+ * NOT routed through the canonical URL allowlist, deliberately: `data:` icons
+ * are this helper's purpose (see `svgFavicon`), and the allowlist refuses
+ * `data:`. That is safe here because an icon link only ever fetches an image —
+ * the browser never navigates to, executes or renders it as a document, so no
+ * scheme turns this sink into script. Do not copy this exception to any sink
+ * that navigates, executes or embeds.
+ *
  * @param url Favicon URL or `data:` URI
  *
  * @example
@@ -874,6 +894,10 @@ interface ImageLoaderState {
  * and its value changes, the previous load is abandoned and a new one
  * starts.
  *
+ * The URL passes the framework's canonical URL policy first (`http:`,
+ * `https:`, relative, …). A refused URL — `javascript:`, `data:`, `blob:`, … —
+ * requests nothing and reports `status() === "error"`.
+ *
  * @example
  * ```ts
  * const img = imageLoader("/hero.jpg");

package/dist/browser.js

@@ -36,14 +36,15 @@ import {
   visibility,
   wakeLock,
   windowSize
-} from "./chunk-ZVL7TY4K.js";
-import "./chunk-H3SRKIYX.js";
+} from "./chunk-YW6HQKGO.js";
 import "./chunk-52XFPGSN.js";
+import "./chunk-62BDYGAG.js";
 import "./chunk-7ZHH77QA.js";
-import "./chunk-WEQ3DMVL.js";
+import "./chunk-SBTZEYNI.js";
+import "./chunk-EXXSN3BW.js";
 import "./chunk-7XHATCIH.js";
-import "./chunk-FQRUXCEE.js";
-import "./chunk-JWKYU5GV.js";
+import "./chunk-SYHGGDNW.js";
+import "./chunk-G2WHYEL7.js";
 import "./chunk-NYNYSPK7.js";
 export {
   __resetSpeechCoordinator,