sibujs 4.7.0 → 4.9.0

package/dist/{chunk-XYV3EDB7.js → chunk-FNOK662L.js}

@@ -135,40 +135,44 @@ import {
   use,
   var_,
   video
-} from "./chunk-7LUJQAOJ.js";
+} from "./chunk-QBKCK6MJ.js";
 import {
   trustHTML
-} from "./chunk-HURREPU2.js";
+} from "./chunk-FC6KCJSA.js";
 import {
   watch
-} from "./chunk-SLM3IA34.js";
+} from "./chunk-CDBKFGXN.js";
 import {
   __resetIdCounter,
   createId,
   domBinding
-} from "./chunk-BC2SECJD.js";
+} from "./chunk-FHCZMHHE.js";
 import {
   SVG_NS,
   bindChildNode,
   captureFocusWithin,
   restoreFocusWithin,
   tagFactory
-} from "./chunk-UOL2ECCS.js";
+} from "./chunk-5MLWTIQE.js";
 import {
   bindAttribute,
   bindDynamic,
-  setSafeAttribute
-} from "./chunk-FNJXNGYZ.js";
+  setSafeAttribute,
+  setTrustedAttribute
+} from "./chunk-MPWDSTYK.js";
+import {
+  isCodeTextElement
+} from "./chunk-3ACAAQIN.js";
 import {
   derived
-} from "./chunk-RUSSKG6G.js";
+} from "./chunk-X7NRHFZR.js";
 import {
   globalSingleton
 } from "./chunk-7ZHH77QA.js";
 import {
   effect,
   on
-} from "./chunk-WEQ3DMVL.js";
+} from "./chunk-SBTZEYNI.js";
 import {
   disableSSR,
   enableSSR,
@@ -187,7 +191,7 @@ import {
   external,
   isBatching,
   signal
-} from "./chunk-FQRUXCEE.js";
+} from "./chunk-SYHGGDNW.js";
 import {
   emitDevtools,
   notifySubscribers,
@@ -199,7 +203,7 @@ import {
   suspendTracking,
   track,
   untracked
-} from "./chunk-JWKYU5GV.js";
+} from "./chunk-G2WHYEL7.js";
 import {
   DEV,
   MAX_DRAIN_TEARDOWNS,
@@ -234,6 +238,7 @@ __export(index_exports, {
   Portal: () => Portal,
   SVG_NS: () => SVG_NS,
   Suspense: () => Suspense,
+  __renderParsedTemplate: () => __renderParsedTemplate,
   __resetIdCounter: () => __resetIdCounter,
   a: () => a,
   abbr: () => abbr,
@@ -1632,37 +1637,44 @@ function action(element, action2, param2) {
   }
 }
 var clickOutside = (element, callback) => {
+  const doc = element.ownerDocument;
   const handler = (e) => {
-    if (!element.contains(e.target)) {
-      callback();
-    }
+    const target = e.target;
+    if (!(typeof target?.nodeType === "number" && element.contains(target))) callback();
   };
-  document.addEventListener("pointerdown", handler, true);
-  return () => document.removeEventListener("pointerdown", handler, true);
+  doc.addEventListener("pointerdown", handler, true);
+  return () => doc.removeEventListener("pointerdown", handler, true);
 };
+var PRESS_END_EVENTS = ["pointerup", "pointerleave", "pointercancel"];
 var longPress = (element, options) => {
   const duration = options.duration ?? 500;
   let timer = null;
-  const start = () => {
-    timer = setTimeout(() => {
-      options.callback();
-      timer = null;
-    }, duration);
-  };
+  let owner;
   const cancel = () => {
     if (timer !== null) {
       clearTimeout(timer);
       timer = null;
     }
   };
+  const start = (e) => {
+    const id = e.pointerId;
+    if (timer !== null && id !== owner) return;
+    cancel();
+    owner = id;
+    timer = setTimeout(() => {
+      timer = null;
+      options.callback();
+    }, duration);
+  };
+  const end = (e) => {
+    if (timer !== null && e.pointerId === owner) cancel();
+  };
   element.addEventListener("pointerdown", start);
-  element.addEventListener("pointerup", cancel);
-  element.addEventListener("pointerleave", cancel);
+  for (const type of PRESS_END_EVENTS) element.addEventListener(type, end);
   return () => {
     cancel();
     element.removeEventListener("pointerdown", start);
-    element.removeEventListener("pointerup", cancel);
-    element.removeEventListener("pointerleave", cancel);
+    for (const type of PRESS_END_EVENTS) element.removeEventListener(type, end);
   };
 };
 var copyOnClick = (element, getText) => {
@@ -1696,10 +1708,11 @@ var trapFocus = (element) => {
     if (elements.length === 0) return;
     const first = elements[0];
     const last = elements[elements.length - 1];
-    if (e.shiftKey && document.activeElement === first) {
+    const active = element.ownerDocument.activeElement;
+    if (e.shiftKey && active === first) {
       e.preventDefault();
       last.focus();
-    } else if (!e.shiftKey && document.activeElement === last) {
+    } else if (!e.shiftKey && active === last) {
       e.preventDefault();
       first.focus();
     }
@@ -1831,6 +1844,10 @@ function attachBranch(parent, anchor, branch, attachedOnce, where) {
   parent.insertBefore(node, anchor.nextSibling);
   return { node, owned };
 }
+function releaseBranchNode(node, owned) {
+  if (owned) dispose(node);
+  node.parentNode?.removeChild(node);
+}
 function when(condition, thenBranch, elseBranch) {
   const anchor = document.createComment("when");
   let currentNode = null;
@@ -1848,8 +1865,7 @@ function when(condition, thenBranch, elseBranch) {
     lastCondition = show2;
     const focused = currentNode ? captureFocusWithin([currentNode]) : null;
     if (currentNode?.parentNode) {
-      if (currentNodeOwned) dispose(currentNode);
-      currentNode.parentNode.removeChild(currentNode);
+      releaseBranchNode(currentNode, currentNodeOwned);
       currentNode = null;
     }
     const branch = show2 ? thenBranch : elseBranch !== void 0 ? elseBranch : null;
@@ -1863,6 +1879,8 @@ function when(condition, thenBranch, elseBranch) {
   registerDisposer(anchor, () => {
     disposed = true;
     stopBinding();
+    if (currentNode) releaseBranchNode(currentNode, currentNodeOwned);
+    currentNode = null;
   });
   if (!initialized) {
     queueMicrotask(() => {
@@ -1888,8 +1906,7 @@ function match(value, cases, fallback) {
     lastKey = key;
     const focused = currentNode ? captureFocusWithin([currentNode]) : null;
     if (currentNode?.parentNode) {
-      if (currentNodeOwned) dispose(currentNode);
-      currentNode.parentNode.removeChild(currentNode);
+      releaseBranchNode(currentNode, currentNodeOwned);
       currentNode = null;
     }
     const branch = Object.hasOwn(cases, key) ? cases[key] : fallback;
@@ -1903,6 +1920,8 @@ function match(value, cases, fallback) {
   registerDisposer(anchor, () => {
     disposed = true;
     stopBinding();
+    if (currentNode) releaseBranchNode(currentNode, currentNodeOwned);
+    currentNode = null;
   });
   if (!initialized) {
     queueMicrotask(() => {
@@ -2239,7 +2258,6 @@ function appendChild(frag, child) {
 }
 
 // src/core/rendering/htm.ts
-var RAW_TEXT_TAGS = /* @__PURE__ */ new Set(["script", "style"]);
 var VOID_ELEMENTS = /* @__PURE__ */ new Set([
   "area",
   "base",
@@ -2462,7 +2480,7 @@ function parseTemplate(strings) {
           children.push({ t: 0, el: { tag, svg: SVG_TAGS.has(tag), attrs, children: [] } });
         } else {
           const inner = parseChildren();
-          if (RAW_TEXT_TAGS.has(tag.toLowerCase())) {
+          if (isCodeTextElement(tag)) {
             for (let i2 = 0; i2 < inner.length; i2++) {
               if (inner[i2].t === 2) {
                 throw new Error(
@@ -2493,7 +2511,7 @@ function executeElement(tmpl, values) {
     const attr = tmpl.attrs[i2];
     switch (attr.t) {
       case 0:
-        el.setAttribute(attr.name, attr.value);
+        setTrustedAttribute(el, attr.name, attr.value);
         break;
       case 1: {
         const name = attr.name;
@@ -2526,7 +2544,7 @@ function executeElement(tmpl, values) {
         break;
       }
       case 4:
-        el.setAttribute(attr.name, "");
+        setTrustedAttribute(el, attr.name, "");
         break;
     }
   }
@@ -2571,6 +2589,12 @@ function html(strings, ...values) {
     tmpl = parseTemplate(strings);
     cache.set(strings, tmpl);
   }
+  return renderTemplate(tmpl, values);
+}
+function __renderParsedTemplate(tree, values) {
+  return renderTemplate(tree, values);
+}
+function renderTemplate(tmpl, values) {
   if (tmpl.length === 1 && tmpl[0].t === 0) {
     return executeElement(tmpl[0].el, values);
   }
@@ -2646,7 +2670,7 @@ function KeepAlive(activeKey, cases, options) {
         return;
       }
       node = factory();
-      if (node instanceof DocumentFragment) {
+      if (node.nodeType === 11) {
         const wrapper = document.createElement("div");
         wrapper.style.display = "contents";
         wrapper.appendChild(node);
@@ -3512,7 +3536,7 @@ function enhance(target, setup) {
           bindNode(el, () => {
             const v = value();
             const next = v == null ? null : String(v);
-            setSafeAttribute(el, name, next, { syncValueProperty: false, label: "enhance attr()" });
+            setSafeAttribute(el, name, next, { syncValueProperty: false, label: "enhance attr()", reactive: true });
           })
         );
       });
@@ -3899,6 +3923,7 @@ export {
   each,
   Fragment,
   html,
+  __renderParsedTemplate,
   KeepAlive,
   mount,
   Portal,

package/dist/{chunk-JWKYU5GV.js → chunk-G2WHYEL7.js}

@@ -498,7 +498,7 @@ function forEachSubscriber(signal, visit) {
 }
 
 // src/reactivity/track.ts
-var _runtimeVersion = true ? "4.7.0" : "dev";
+var _runtimeVersion = true ? "4.9.0" : "dev";
 var REGISTRY_KEY = /* @__PURE__ */ Symbol.for("sibujs.reactive.v1");
 function resolveReactiveApi() {
   const g = globalThis;

package/dist/{chunk-DKXRACVN.js → chunk-K6K5ACO6.js}

@@ -1,20 +1,20 @@
-import {
-  stripHtml
-} from "./chunk-2INLLLMZ.js";
 import {
   globalSingleton
 } from "./chunk-7ZHH77QA.js";
 import {
   effect
-} from "./chunk-WEQ3DMVL.js";
+} from "./chunk-SBTZEYNI.js";
+import {
+  stripHtml
+} from "./chunk-EXXSN3BW.js";
 import {
   signal
-} from "./chunk-FQRUXCEE.js";
+} from "./chunk-SYHGGDNW.js";
 import {
   forEachSubscriber,
   getSubscriberCount,
   getSubscriberDeps
-} from "./chunk-JWKYU5GV.js";
+} from "./chunk-G2WHYEL7.js";
 import {
   dispose,
   isDev

package/dist/{chunk-VZSG24LS.js → chunk-KG25XMGP.js}

@@ -6,25 +6,25 @@ import {
 import {
   div,
   span
-} from "./chunk-7LUJQAOJ.js";
+} from "./chunk-QBKCK6MJ.js";
 import {
   STATIC_VALUE_RESOLVER,
   planHeadElementEntry,
   planMetaEntry
-} from "./chunk-HURREPU2.js";
-import {
-  sanitizeUrl
-} from "./chunk-2INLLLMZ.js";
+} from "./chunk-FC6KCJSA.js";
 import {
   globalSingleton
 } from "./chunk-7ZHH77QA.js";
 import {
   effect
-} from "./chunk-WEQ3DMVL.js";
+} from "./chunk-SBTZEYNI.js";
+import {
+  sanitizeUrl
+} from "./chunk-EXXSN3BW.js";
 import {
   batch,
   signal
-} from "./chunk-FQRUXCEE.js";
+} from "./chunk-SYHGGDNW.js";
 import {
   registerDisposer,
   replaceChildrenSafely,
@@ -179,7 +179,16 @@ function toError(err) {
   if (err !== null && typeof err === "object" && "name" in err && "message" in err) return err;
   return new Error(String(err));
 }
+function workerSource(fn, api) {
+  if (typeof fn !== "function") {
+    throw new TypeError(
+      `${api}: expected a function, got ${typeof fn}. Worker code must be a function defined in your source \u2014 a string would be evaluated as code.`
+    );
+  }
+  return Function.prototype.toString.call(fn);
+}
 function worker(workerFn2) {
+  const fnBody = workerSource(workerFn2, "worker");
   const [result, setResult] = signal(null);
   const [error, setError] = signal(null);
   const [loading, setLoading] = signal(false);
@@ -195,7 +204,6 @@ function worker(workerFn2) {
     if (typeof Worker === "undefined") {
       throw new Error("Web Workers are not supported in this environment");
     }
-    const fnBody = workerFn2.toString();
     const blob = new Blob([`self.onmessage = ${fnBody};`], { type: "application/javascript" });
     blobUrl = URL.createObjectURL(blob);
     worker2 = new Worker(blobUrl);
@@ -244,6 +252,7 @@ function worker(workerFn2) {
   return { post, result, error, loading, terminate };
 }
 function workerFn(fn) {
+  const fnStr = workerSource(fn, "workerFn");
   const [loading, setLoading] = signal(false);
   let worker2 = null;
   let blobUrl = null;
@@ -258,7 +267,6 @@ function workerFn(fn) {
     if (typeof Worker === "undefined") {
       throw new Error("Web Workers are not supported in this environment");
     }
-    const fnStr = fn.toString();
     const blob = new Blob(
       [
         `self.onmessage = function(e) {
@@ -318,6 +326,7 @@ function workerFn(fn) {
   return { run, loading, terminate };
 }
 function createWorkerPool(workerFn2, poolSize) {
+  const fnBody = workerSource(workerFn2, "createWorkerPool");
   const size = poolSize || typeof navigator !== "undefined" && navigator.hardwareConcurrency || 4;
   const workers = [];
   const queues = [];
@@ -376,7 +385,6 @@ function createWorkerPool(workerFn2, poolSize) {
     if (typeof Worker === "undefined") {
       throw new Error("Web Workers are not supported in this environment");
     }
-    const fnBody = workerFn2.toString();
     const blob = new Blob([`self.onmessage = ${fnBody};`], { type: "application/javascript" });
     blobUrl = URL.createObjectURL(blob);
     for (let i = 0; i < size; i++) {
@@ -902,7 +910,7 @@ function createISR(options) {
   const [data, setData] = signal(initialData);
   const [stale, setStale] = signal(initialData === void 0);
   const controller = new AbortController();
-  let inFlight = false;
+  let inFlight = null;
   let disposed = false;
   let deadline;
   const clearDeadline = () => {
@@ -922,10 +930,7 @@ function createISR(options) {
       });
     }, revalidateAfter);
   };
-  const revalidate = async () => {
-    if (disposed || inFlight) return;
-    if (controller.signal.aborted) return;
-    inFlight = true;
+  const run = async () => {
     try {
       const result = await fetcher({ signal: controller.signal });
       if (disposed || controller.signal.aborted) return;
@@ -937,10 +942,33 @@ function createISR(options) {
     } catch (err) {
       if (!disposed && !controller.signal.aborted) armDeadline();
       throw err;
-    } finally {
-      inFlight = false;
     }
   };
+  const revalidate = () => {
+    if (disposed || controller.signal.aborted) return Promise.resolve();
+    if (inFlight) return inFlight;
+    let resolve;
+    let reject;
+    const current = new Promise((res, rej) => {
+      resolve = res;
+      reject = rej;
+    });
+    inFlight = current;
+    const release = () => {
+      if (inFlight === current) inFlight = null;
+    };
+    run().then(
+      () => {
+        release();
+        resolve();
+      },
+      (err) => {
+        release();
+        reject(err);
+      }
+    );
+    return current;
+  };
   if (initialData === void 0) {
     revalidate().catch((err) => {
       if (typeof console !== "undefined") console.warn("[SibuJS ISR] initial fetch failed", err);

package/dist/{chunk-FNJXNGYZ.js → chunk-MPWDSTYK.js}

@@ -1,14 +1,20 @@
+import {
+  ContextualRefusal,
+  contextualAttributeRefusal,
+  settleAttributeProvenance
+} from "./chunk-3ACAAQIN.js";
 import {
   isEventHandlerAttr,
   isHtmlContentAttribute,
-  sanitizeAttributeString
-} from "./chunk-2INLLLMZ.js";
+  resolveAttributeValue
+} from "./chunk-EXXSN3BW.js";
 import {
   reactiveBinding
-} from "./chunk-JWKYU5GV.js";
+} from "./chunk-G2WHYEL7.js";
 import {
   DEV,
   devWarn,
+  devWarnLazy,
   reportError
 } from "./chunk-NYNYSPK7.js";
 
@@ -21,6 +27,19 @@ var BOOLEAN_IDL_ATTRS = /* @__PURE__ */ new Set(["checked", "disabled", "selecte
 function isHtmlElement(el) {
   return el.namespaceURI === null || el.namespaceURI === HTML_NS;
 }
+function warnContextualRefusal(label, name, refusal) {
+  devWarnLazy(() => {
+    const reasons = [
+      "",
+      'the element would become a <meta http-equiv="refresh"> directive the shared refresh policy forbids (a destination outside the URL allowlist, or a directive too malformed to read unambiguously)',
+      "a <meta> whose http-equiv or content is reactive may never carry a refresh directive: a browser schedules the navigation as soon as the directive is valid, and nothing can withdraw it when the state changes back",
+      "a runtime value may not choose the program a <script> runs; name the script in static template source, or load it through Head({ script }) as an explicit trust decision",
+      "an SVG animation may not target a URL, event-handler or nested-document attribute; its to / values would be written into that attribute without passing the URL policy",
+      'a runtime-chosen href may not become an applied <link rel="stylesheet">: a well-formed URL is not a trusted stylesheet. Name the stylesheet in static template source, or load a runtime-chosen one through Head({ link }) as an explicit trust decision'
+    ];
+    return `${label}: refusing "${name}" in this element's context \u2014 ${reasons[refusal]}. The write was not performed.`;
+  });
+}
 function setProp(el, key, val) {
   el[key] = val;
 }
@@ -32,6 +51,11 @@ function namespaceFor(el, name) {
   return null;
 }
 function setSafeAttribute(el, name, value, options = {}) {
+  const written = commitSafeAttribute(el, name, value, options);
+  if (el.localName === "link") settleAttributeProvenance(el, name, options.reactive ? "reactive" : "runtime");
+  return written;
+}
+function commitSafeAttribute(el, name, value, options) {
   const ns = namespaceFor(el, name);
   const localName = ns ? name.slice(name.indexOf(":") + 1) : name;
   if (isEventHandlerAttr(name)) {
@@ -44,6 +68,14 @@ function setSafeAttribute(el, name, value, options = {}) {
     else el.removeAttribute(name);
     return false;
   }
+  const pending = value == null || value === false ? null : value === true ? "" : String(value);
+  const refusal = contextualAttributeRefusal(el, name, pending, options.reactive ? "reactive" : "runtime");
+  if (refusal !== ContextualRefusal.None) {
+    warnContextualRefusal(options.label ?? "setSafeAttribute", name, refusal);
+    if (ns) el.removeAttributeNS(ns, localName);
+    else el.removeAttribute(name);
+    return false;
+  }
   if (value == null) {
     if (ns) el.removeAttributeNS(ns, localName);
     else el.removeAttribute(name);
@@ -87,13 +119,32 @@ function setSafeAttribute(el, name, value, options = {}) {
     setProp(el, idlName, idlName === "checked" ? Boolean(value) : str);
     return true;
   }
-  const safe = sanitizeAttributeString(name, str, { element: el });
+  const safe = str === "" ? "" : resolveAttributeValue(name, str, { element: el });
+  if (safe === null) {
+    if (ns) el.removeAttributeNS(ns, localName);
+    else el.removeAttribute(name);
+    return true;
+  }
   const current = ns ? el.getAttributeNS(ns, localName) : el.getAttribute(name);
   if (current === safe) return true;
   if (ns) el.setAttributeNS(ns, name, safe);
   else el.setAttribute(name, safe);
   return true;
 }
+function setTrustedAttribute(el, name, value) {
+  if (isHtmlContentAttribute(name)) {
+    if (DEV) devWarn(`html: refusing static attribute "${name}" \u2014 the browser parses it as a nested document.`);
+    return false;
+  }
+  const refusal = contextualAttributeRefusal(el, name, value, "static");
+  if (refusal !== ContextualRefusal.None) {
+    warnContextualRefusal("html (static attribute)", name, refusal);
+    return false;
+  }
+  el.setAttribute(name, value);
+  if (el.localName === "link") settleAttributeProvenance(el, name, "static");
+  return true;
+}
 
 // src/reactivity/bindAttribute.ts
 function bindAttribute(el, attr, getter) {
@@ -110,7 +161,7 @@ function bindAttribute(el, attr, getter) {
       reportError(err, { phase: "binding", name: `bindAttribute("${attr}")`, node: el });
       return;
     }
-    setSafeAttribute(el, attr, value, { label: `bindAttribute("${attr}")` });
+    setSafeAttribute(el, attr, value, { label: `bindAttribute("${attr}")`, reactive: true });
   }
   return reactiveBinding(commit, el);
 }
@@ -135,7 +186,7 @@ function bindDynamic(el, nameGetter, valueGetter) {
       el.removeAttribute(prevName);
       prevName = null;
     }
-    if (!setSafeAttribute(el, name, value, { label: "bindDynamic" })) return;
+    if (!setSafeAttribute(el, name, value, { label: "bindDynamic", reactive: true })) return;
     prevName = name;
   }
   const teardown = reactiveBinding(commit, el);
@@ -149,6 +200,7 @@ function bindDynamic(el, nameGetter, valueGetter) {
 
 export {
   setSafeAttribute,
+  setTrustedAttribute,
   bindAttribute,
   bindDynamic
 };

package/dist/{chunk-UNWRJRKC.js → chunk-NQMKWBKU.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-5HZXGZ6T.js";
 import {
   signal
-} from "./chunk-FQRUXCEE.js";
+} from "./chunk-SYHGGDNW.js";
 import {
   registerDisposer,
   reportError

package/dist/{chunk-7LUJQAOJ.js → chunk-QBKCK6MJ.js}

@@ -1,7 +1,7 @@
 import {
   SVG_NS,
   tagFactory
-} from "./chunk-UOL2ECCS.js";
+} from "./chunk-5MLWTIQE.js";
 
 // src/core/rendering/html.ts
 var html = tagFactory("html");

package/dist/{chunk-WEQ3DMVL.js → chunk-SBTZEYNI.js}

@@ -6,7 +6,7 @@ import {
   emitDevtools,
   retrack,
   untracked
-} from "./chunk-JWKYU5GV.js";
+} from "./chunk-G2WHYEL7.js";
 import {
   devAssert,
   reportError

package/dist/{chunk-FQRUXCEE.js → chunk-SYHGGDNW.js}

@@ -4,7 +4,7 @@ import {
   notifySubscribers,
   queueSignalNotification,
   recordDependency
-} from "./chunk-JWKYU5GV.js";
+} from "./chunk-G2WHYEL7.js";
 import {
   DEV
 } from "./chunk-NYNYSPK7.js";