sibujs 4.7.0 → 4.9.0

package/dist/chunk-3ACAAQIN.js

@@ -0,0 +1,224 @@
+import {
+  canonicalAttrName,
+  isEventHandlerAttr,
+  isHtmlContentAttribute,
+  isUrlAttribute,
+  sanitizeUrl,
+  stripControlChars
+} from "./chunk-EXXSN3BW.js";
+import {
+  DEV
+} from "./chunk-NYNYSPK7.js";
+
+// src/utils/metaRefresh.ts
+function isAsciiWhitespace(ch) {
+  return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f";
+}
+function trimAsciiWhitespace(value) {
+  let start = 0;
+  let end = value.length;
+  while (start < end && isAsciiWhitespace(value[start])) start++;
+  while (end > start && isAsciiWhitespace(value[end - 1])) end--;
+  return value.slice(start, end);
+}
+var forbidden = (reason) => ({ kind: "forbidden", reason });
+function parseMetaRefreshContent(content) {
+  const raw = trimAsciiWhitespace(stripControlChars(content));
+  if (raw === "") return forbidden(DEV ? "empty content" : "");
+  let i = 0;
+  while (i < raw.length && raw[i] >= "0" && raw[i] <= "9") i++;
+  if (i === 0) return forbidden(DEV ? "missing or non-numeric delay" : "");
+  const delay = Number.parseInt(raw.slice(0, i), 10);
+  if (!Number.isFinite(delay)) return forbidden(DEV ? "unparseable delay" : "");
+  while (i < raw.length && isAsciiWhitespace(raw[i])) i++;
+  if (i === raw.length) return { kind: "delay-only", delay };
+  if (raw[i] !== ";" && raw[i] !== ",") return forbidden(DEV ? "unexpected text after delay" : "");
+  i++;
+  while (i < raw.length && isAsciiWhitespace(raw[i])) i++;
+  const keyStart = i;
+  while (i < raw.length && !isAsciiWhitespace(raw[i]) && raw[i] !== "=") i++;
+  const key = raw.slice(keyStart, i).toLowerCase();
+  if (key !== "url") return forbidden(DEV ? `unsupported refresh key ${JSON.stringify(key)}` : "");
+  while (i < raw.length && isAsciiWhitespace(raw[i])) i++;
+  if (raw[i] !== "=") return forbidden(DEV ? "missing '=' after url" : "");
+  i++;
+  while (i < raw.length && isAsciiWhitespace(raw[i])) i++;
+  let destination;
+  const quote = raw[i];
+  if (quote === '"' || quote === "'") {
+    const close = raw.indexOf(quote, i + 1);
+    if (close === -1) return forbidden(DEV ? "unterminated quoted destination" : "");
+    destination = raw.slice(i + 1, close);
+    const rest = trimAsciiWhitespace(raw.slice(close + 1));
+    if (rest !== "") return forbidden(DEV ? "trailing text after quoted destination" : "");
+  } else {
+    destination = trimAsciiWhitespace(raw.slice(i));
+    if (/[;,]/.test(destination)) return forbidden(DEV ? "multiple refresh assignments" : "");
+  }
+  if (destination === "") return forbidden(DEV ? "empty destination" : "");
+  const sanitizedDestination = sanitizeUrl(destination);
+  if (sanitizedDestination === "") return forbidden(DEV ? "destination uses a disallowed protocol" : "");
+  return { kind: "allowed", delay, destination, sanitizedDestination };
+}
+function resolveMetaRefreshPolicy(attributes) {
+  let httpEquiv;
+  let content;
+  let duplicateName;
+  const seen = /* @__PURE__ */ new Set();
+  for (const [key, value] of attributes) {
+    const canonical = canonicalAttrName(key);
+    if (seen.has(canonical)) duplicateName = canonical;
+    seen.add(canonical);
+    if (canonical === "http-equiv") httpEquiv = value;
+    else if (canonical === "content") content = value;
+  }
+  if (duplicateName !== void 0) {
+    return forbidden(DEV ? `duplicate case-insensitive attribute ${JSON.stringify(duplicateName)}` : "");
+  }
+  if (typeof httpEquiv !== "string") return { kind: "not-refresh" };
+  if (trimAsciiWhitespace(stripControlChars(httpEquiv)).toLowerCase() !== "refresh") {
+    return { kind: "not-refresh" };
+  }
+  if (typeof content !== "string") return { kind: "not-refresh" };
+  return parseMetaRefreshContent(content);
+}
+function normalizeMetaAttributes(props) {
+  const out = /* @__PURE__ */ new Map();
+  const seen = /* @__PURE__ */ new Set();
+  for (const key of Object.keys(props)) {
+    const canonical = canonicalAttrName(key);
+    if (seen.has(canonical)) return null;
+    seen.add(canonical);
+    out.set(key, props[key]);
+  }
+  return out;
+}
+function isForbiddenMetaEntry(props) {
+  const normalized = normalizeMetaAttributes(props);
+  if (normalized === null) return true;
+  return resolveMetaRefreshPolicy(normalized).kind === "forbidden";
+}
+
+// src/utils/elementPolicy.ts
+var HTML_NS = "http://www.w3.org/1999/xhtml";
+var SVG_NS = "http://www.w3.org/2000/svg";
+var BLOCKED_ELEMENTS = /* @__PURE__ */ new Set(["script", "iframe", "object", "embed", "frame", "frameset"]);
+function canonicalTagName(tag) {
+  return canonicalAttrName(tag);
+}
+function isBlockedElement(tag) {
+  return BLOCKED_ELEMENTS.has(canonicalTagName(tag));
+}
+var CODE_TEXT_ELEMENTS = /* @__PURE__ */ new Set(["script", "style"]);
+function isCodeTextElement(tag) {
+  return CODE_TEXT_ELEMENTS.has(canonicalTagName(tag));
+}
+var ContextualRefusal = {
+  None: 0,
+  /** The element would carry a refresh directive the shared policy forbids. */
+  MetaRefreshForbidden: 1,
+  /** A `<meta>` with a reactive binding may not carry any refresh directive. */
+  MetaRefreshReactive: 2,
+  /** A runtime value may not choose which program a `<script>` runs. */
+  ScriptSource: 3,
+  /** An SVG animation may not target a URL, handler or document attribute. */
+  AnimationTarget: 4,
+  /** A runtime-written `href` may not become an applied stylesheet. */
+  StylesheetSource: 5
+};
+var SCRIPT_SOURCE_ATTRIBUTES = /* @__PURE__ */ new Set(["src", "href", "xlink:href", "type", "language"]);
+var SVG_ANIMATION_ELEMENTS = /* @__PURE__ */ new Set(["animate", "set", "animateMotion", "animateTransform", "animateColor"]);
+var reactiveMetaElements = /* @__PURE__ */ new WeakSet();
+function isHtmlNamespace(el) {
+  return el.namespaceURI === HTML_NS || el.namespaceURI === null;
+}
+function metaSnapshot(el, canonical, value) {
+  const snapshot = /* @__PURE__ */ new Map();
+  const attrs = el.attributes;
+  for (let i = 0; i < attrs.length; i++) {
+    const attr = attrs[i];
+    if (attr.name === canonical) continue;
+    snapshot.set(attr.name, attr.value);
+  }
+  if (canonical !== null && value !== null) snapshot.set(canonical, value);
+  return snapshot;
+}
+function claimReactiveMeta(el) {
+  if (reactiveMetaElements.has(el)) return;
+  reactiveMetaElements.add(el);
+  if (el.getAttribute("content") === null) return;
+  if (resolveMetaRefreshPolicy(metaSnapshot(el, null, null)).kind !== "not-refresh") {
+    el.removeAttribute("content");
+  }
+}
+function metaRefusal(el, name, value, origin) {
+  if (!isHtmlNamespace(el)) return ContextualRefusal.None;
+  const canonical = canonicalAttrName(name);
+  if (canonical !== "http-equiv" && canonical !== "content") return ContextualRefusal.None;
+  if (origin === "reactive") claimReactiveMeta(el);
+  if (value === null) return ContextualRefusal.None;
+  if (canonical === "content" && !el.hasAttribute("http-equiv")) return ContextualRefusal.None;
+  const decision = resolveMetaRefreshPolicy(metaSnapshot(el, canonical, value));
+  if (decision.kind === "forbidden") return ContextualRefusal.MetaRefreshForbidden;
+  if (decision.kind !== "not-refresh" && reactiveMetaElements.has(el)) return ContextualRefusal.MetaRefreshReactive;
+  return ContextualRefusal.None;
+}
+function animationRefusal(name, value) {
+  if (value === null || canonicalAttrName(name) !== "attributename") return ContextualRefusal.None;
+  const target = stripControlChars(value);
+  return isUrlAttribute(target) || isEventHandlerAttr(target) || isHtmlContentAttribute(target) ? ContextualRefusal.AnimationTarget : ContextualRefusal.None;
+}
+var runtimeHrefLinks = /* @__PURE__ */ new WeakSet();
+function relHasStylesheet(rel) {
+  if (rel === null) return false;
+  const lower = canonicalAttrName(rel);
+  if (!lower.includes("stylesheet")) return false;
+  const tokens = lower.split(/[\t\n\f\r ]+/);
+  for (let i = 0; i < tokens.length; i++) if (tokens[i] === "stylesheet") return true;
+  return false;
+}
+function stylesheetRefusal(el, name, value, origin) {
+  if (!isHtmlNamespace(el)) return ContextualRefusal.None;
+  const canonical = canonicalAttrName(name);
+  if (canonical === "href") {
+    if (origin === "static" || value === null) return ContextualRefusal.None;
+    if (relHasStylesheet(el.getAttribute("rel"))) return ContextualRefusal.StylesheetSource;
+    runtimeHrefLinks.add(el);
+    return ContextualRefusal.None;
+  }
+  if (canonical === "rel") {
+    if (!relHasStylesheet(value)) return ContextualRefusal.None;
+    return runtimeHrefLinks.has(el) && el.hasAttribute("href") ? ContextualRefusal.StylesheetSource : ContextualRefusal.None;
+  }
+  return ContextualRefusal.None;
+}
+function contextualAttributeRefusal(el, name, value, origin) {
+  const local = el.localName;
+  if (local === "meta") return metaRefusal(el, name, value, origin);
+  if (local === "link") return stylesheetRefusal(el, name, value, origin);
+  if (local === "script") {
+    if (origin === "static" || value === null) return ContextualRefusal.None;
+    return SCRIPT_SOURCE_ATTRIBUTES.has(canonicalAttrName(name)) ? ContextualRefusal.ScriptSource : ContextualRefusal.None;
+  }
+  if (SVG_ANIMATION_ELEMENTS.has(local) && el.namespaceURI === SVG_NS) return animationRefusal(name, value);
+  return ContextualRefusal.None;
+}
+function settleAttributeProvenance(el, name, origin) {
+  if (el.localName !== "link" || canonicalAttrName(name) !== "href") return;
+  if (origin !== "static" && el.hasAttribute("href")) runtimeHrefLinks.add(el);
+  else runtimeHrefLinks.delete(el);
+}
+function isForbiddenMetaSnapshot(attributes) {
+  return resolveMetaRefreshPolicy(attributes).kind === "forbidden";
+}
+
+export {
+  resolveMetaRefreshPolicy,
+  isForbiddenMetaEntry,
+  isBlockedElement,
+  isCodeTextElement,
+  ContextualRefusal,
+  contextualAttributeRefusal,
+  settleAttributeProvenance,
+  isForbiddenMetaSnapshot
+};

package/dist/{chunk-WOLJZUFQ.js → chunk-562UVHMM.js}

@@ -1,25 +1,25 @@
 import {
   derived
-} from "./chunk-RUSSKG6G.js";
-import {
-  sanitizeUrl
-} from "./chunk-2INLLLMZ.js";
+} from "./chunk-X7NRHFZR.js";
 import {
   globalSingleton
 } from "./chunk-7ZHH77QA.js";
 import {
   effect
-} from "./chunk-WEQ3DMVL.js";
+} from "./chunk-SBTZEYNI.js";
+import {
+  sanitizeUrl
+} from "./chunk-EXXSN3BW.js";
 import {
   getRequestScopedCache
 } from "./chunk-7XHATCIH.js";
 import {
   batch,
   signal
-} from "./chunk-FQRUXCEE.js";
+} from "./chunk-SYHGGDNW.js";
 import {
   untracked
-} from "./chunk-JWKYU5GV.js";
+} from "./chunk-G2WHYEL7.js";
 import {
   reportError
 } from "./chunk-NYNYSPK7.js";
@@ -173,7 +173,11 @@ function reconcile(prev, next, depth, walk, newRoot) {
     const nextChild = nextRecord[key];
     const hasPrev = Object.hasOwn(prevRecord, key);
     const shared = hasPrev ? reconcile(prevRecord[key], nextChild, depth + 1, walk, false) : nextChild;
-    copy[key] = shared;
+    if (key === "__proto__") {
+      Object.defineProperty(copy, key, { value: shared, writable: true, enumerable: true, configurable: true });
+    } else {
+      copy[key] = shared;
+    }
     if (!hasPrev || !Object.is(shared, prevRecord[key])) allFromPrev = false;
     if (!Object.is(shared, nextChild)) allFromNext = false;
   }
@@ -264,6 +268,8 @@ function query(key, fetcher, options = {}) {
     structuralSharing = true
   } = options;
   const resolveKey = typeof key === "function" ? key : () => key;
+  const enabledGate = typeof enabled === "function" ? derived(() => Boolean(enabled())) : null;
+  const isEnabled = enabledGate ?? (() => enabled);
   const cache = getActiveQueryCache();
   const [data, setData] = signal(initialData);
   const [isFetching, setIsFetching] = signal(false);
@@ -378,7 +384,7 @@ function query(key, fetcher, options = {}) {
     }
   }
   async function doFetch() {
-    if (disposed || !currentKey || !enabled) return;
+    if (disposed || !currentKey || !untracked(isEnabled)) return;
     const key2 = currentKey;
     const entry = getOrCreateEntry(cache, key2);
     attachToEntry(entry, key2);
@@ -480,10 +486,17 @@ function query(key, fetcher, options = {}) {
   }
   const effectCleanup = effect(() => {
     const key2 = resolveKey();
+    const on = isEnabled();
     const keyChanged = currentKey !== key2;
     currentKey = key2;
+    if (key2 === "") {
+      detachFromEntry();
+      setIsFetching(false);
+      return;
+    }
     const entry = getOrCreateEntry(cache, key2, initialData);
     attachToEntry(entry, key2);
+    if (keyChanged) setIsFetching(entry.promise !== null);
     if (entry.data !== void 0) {
       const view = viewOf(entry);
       batch(() => {
@@ -494,17 +507,17 @@ function query(key, fetcher, options = {}) {
     }
     if (!keyChanged && currentKey === key2 && entry.data !== void 0) {
       const isDataStale2 = entry.dataUpdatedAt === 0 || Date.now() - entry.dataUpdatedAt >= staleTime;
-      if (enabled && isDataStale2 && !entry.promise) doFetch();
+      if (on && isDataStale2 && !entry.promise) doFetch();
       return;
     }
     const isDataStale = entry.dataUpdatedAt === 0 || Date.now() - entry.dataUpdatedAt >= staleTime;
-    if (enabled && (entry.data === void 0 || isDataStale)) {
+    if (on && (entry.data === void 0 || isDataStale)) {
       doFetch();
     }
   });
   if (refetchInterval && refetchInterval > 0) {
     intervalTimer = setInterval(() => {
-      if (!disposed && currentKey && enabled) doFetch();
+      if (!disposed && currentKey) doFetch();
     }, refetchInterval);
   }
   let focusHandler = null;
@@ -512,13 +525,13 @@ function query(key, fetcher, options = {}) {
   if (typeof globalThis !== "undefined" && typeof globalThis.addEventListener === "function") {
     if (refetchOnWindowFocus) {
       focusHandler = () => {
-        if (!disposed && currentKey && enabled) doFetch();
+        if (!disposed && currentKey) doFetch();
       };
       globalThis.addEventListener("focus", focusHandler);
     }
     if (refetchOnReconnect) {
       onlineHandler = () => {
-        if (!disposed && currentKey && enabled) doFetch();
+        if (!disposed && currentKey) doFetch();
       };
       globalThis.addEventListener("online", onlineHandler);
     }
@@ -530,6 +543,7 @@ function query(key, fetcher, options = {}) {
     stopSelect?.();
     loading.dispose();
     isStale.dispose();
+    enabledGate?.dispose();
     if (intervalTimer) clearInterval(intervalTimer);
     detachFromEntry();
     if (focusHandler && typeof globalThis.removeEventListener === "function") {
@@ -709,6 +723,8 @@ function infiniteQuery(key, fetcher, options) {
     onError
   } = options;
   const resolveKey = typeof key === "function" ? key : () => key;
+  const enabledGate = typeof enabled === "function" ? derived(() => Boolean(enabled())) : null;
+  const isEnabled = enabledGate ?? (() => enabled);
   const [pages, setPages] = signal([]);
   const [isFetching, setIsFetching] = signal(false);
   const [isFetchingNext, setIsFetchingNext] = signal(false);
@@ -787,7 +803,7 @@ function infiniteQuery(key, fetcher, options) {
   }
   const effectCleanup = effect(() => {
     resolveKey();
-    if (enabled) {
+    if (isEnabled()) {
       abortController?.abort();
       batch(() => {
         setPages([]);
@@ -828,6 +844,7 @@ function infiniteQuery(key, fetcher, options) {
     loading.dispose();
     hasNextPage.dispose();
     hasPreviousPage.dispose();
+    enabledGate?.dispose();
   }
   return {
     data,

package/dist/{chunk-UOL2ECCS.js → chunk-5MLWTIQE.js}

@@ -1,15 +1,18 @@
 import {
   bindAttribute,
   setSafeAttribute
-} from "./chunk-FNJXNGYZ.js";
+} from "./chunk-MPWDSTYK.js";
+import {
+  isBlockedElement
+} from "./chunk-3ACAAQIN.js";
 import {
   isEventHandlerAttr,
-  sanitizeCSSValue,
+  sanitizeCSSDeclaration,
   sanitizeStyleAttribute
-} from "./chunk-2INLLLMZ.js";
+} from "./chunk-EXXSN3BW.js";
 import {
   reactiveBinding
-} from "./chunk-JWKYU5GV.js";
+} from "./chunk-G2WHYEL7.js";
 import {
   DEV,
   devWarn,
@@ -189,10 +192,6 @@ function bindChildNode(placeholder, getter) {
 
 // src/core/rendering/tagFactory.ts
 var SVG_NS = "http://www.w3.org/2000/svg";
-var BLOCKED_TAGS = /* @__PURE__ */ new Set(["script", "iframe", "object", "embed", "frame", "frameset"]);
-function isBlockedTag(tag) {
-  return BLOCKED_TAGS.has(tag.toLowerCase());
-}
 var CLOBBER_RISKY_IDS = /* @__PURE__ */ new Set([
   "config",
   "location",
@@ -237,11 +236,12 @@ function applyStyle(el, style) {
       }
       const next = [];
       for (const prop in value) {
+        if (!Object.hasOwn(value, prop)) continue;
         const val = value[prop];
         if (val == null) continue;
         const name = toKebab(prop);
         next.push(name);
-        decl.setProperty(name, sanitizeCSSValue(String(val), { property: name, element: el }));
+        decl.setProperty(name, sanitizeCSSDeclaration(name, String(val), { element: el }));
       }
       for (let i = 0; i < written.length; i++) {
         if (next.indexOf(written[i]) === -1) decl.removeProperty(written[i]);
@@ -257,16 +257,17 @@ function applyStyle(el, style) {
   }
   const htmlEl = el;
   for (const prop in style) {
+    if (!Object.hasOwn(style, prop)) continue;
     const val = style[prop];
     const name = toKebab(prop);
     if (typeof val === "function") {
       const getter = val;
       const teardown = reactiveBinding(() => {
-        htmlEl.style.setProperty(name, sanitizeCSSValue(String(getter()), { property: name, element: el }));
+        htmlEl.style.setProperty(name, sanitizeCSSDeclaration(name, String(getter()), { element: el }));
       }, el);
       registerDisposer(el, teardown);
     } else {
-      htmlEl.style.setProperty(name, sanitizeCSSValue(String(val), { property: name, element: el }));
+      htmlEl.style.setProperty(name, sanitizeCSSDeclaration(name, String(val), { element: el }));
     }
   }
 }
@@ -276,6 +277,7 @@ function resolveClassValue(cls) {
   if (!cls) return "";
   let out = "";
   for (const name in cls) {
+    if (!Object.hasOwn(cls, name)) continue;
     const val = cls[name];
     const active = typeof val === "function" ? val() : val;
     if (active) out = out ? `${out} ${name}` : name;
@@ -300,6 +302,7 @@ function applyClass(el, cls) {
   let hasReactive = false;
   let result = "";
   for (const name in obj) {
+    if (!Object.hasOwn(obj, name)) continue;
     const val = obj[name];
     if (typeof val === "function") {
       hasReactive = true;
@@ -311,6 +314,7 @@ function applyClass(el, cls) {
     const update = () => {
       let r = "";
       for (const name in obj) {
+        if (!Object.hasOwn(obj, name)) continue;
         const val = obj[name];
         const active = typeof val === "function" ? val() : val;
         if (active) r = r ? `${r} ${name}` : name;
@@ -374,7 +378,7 @@ function appendChildren(el, nodes) {
   }
 }
 function tagFactory(tag, ns) {
-  const blocked = isBlockedTag(tag);
+  const blocked = isBlockedElement(tag);
   return (first, second) => {
     if (blocked) {
       throw new Error(`tagFactory: refusing to create <${tag}> \u2014 tag is blocked for security reasons.`);
@@ -437,6 +441,7 @@ function tagFactory(tag, ns) {
     const pOn = props.on;
     if (pOn) {
       for (const ev in pOn) {
+        if (!Object.hasOwn(pOn, ev)) continue;
         const handler = pOn[ev];
         if (typeof handler === "function") {
           el.addEventListener(ev, handler);
@@ -463,6 +468,7 @@ function tagFactory(tag, ns) {
           continue;
         // already handled above / below
         default: {
+          if (!Object.hasOwn(props, key)) continue;
           const value = props[key];
           if (value == null) continue;
           if (isEventHandlerAttr(key)) continue;

package/dist/{chunk-H3SRKIYX.js → chunk-62BDYGAG.js}

@@ -3,6 +3,13 @@ var UNSAFE_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototyp
 function isUnsafeKey(key) {
   return UNSAFE_KEYS.has(key);
 }
+function readOwnGlobal(key) {
+  if (typeof window === "undefined") return void 0;
+  if (!Object.hasOwn(window, key)) return void 0;
+  const value = window[key];
+  if (typeof Node !== "undefined" && value instanceof Node) return void 0;
+  return value;
+}
 function stripUnsafeKeys(obj) {
   const out = {};
   for (const k of Object.keys(obj)) {
@@ -13,5 +20,6 @@ function stripUnsafeKeys(obj) {
 
 export {
   isUnsafeKey,
+  readOwnGlobal,
   stripUnsafeKeys
 };

package/dist/{chunk-3QWBSL5R.js → chunk-7OV5Q2UU.js}

@@ -3,20 +3,23 @@ import {
 } from "./chunk-J6FW5TV6.js";
 import {
   tagFactory
-} from "./chunk-UOL2ECCS.js";
+} from "./chunk-5MLWTIQE.js";
 import {
   derived
-} from "./chunk-RUSSKG6G.js";
+} from "./chunk-X7NRHFZR.js";
 import {
   globalSingleton
 } from "./chunk-7ZHH77QA.js";
 import {
   effect
-} from "./chunk-WEQ3DMVL.js";
+} from "./chunk-SBTZEYNI.js";
+import {
+  sanitizeCSSDeclaration
+} from "./chunk-EXXSN3BW.js";
 import {
   batch,
   signal
-} from "./chunk-FQRUXCEE.js";
+} from "./chunk-SYHGGDNW.js";
 
 // src/ecosystem/adapters/mobx.ts
 function mobXAdapter(options) {
@@ -121,7 +124,7 @@ var _themeLayers = globalSingleton(
 function commitThemeProperty(root, name, record) {
   const top = record.layers[record.layers.length - 1];
   if (top) {
-    root.style.setProperty(name, top.value);
+    root.style.setProperty(name, sanitizeCSSDeclaration(name, String(top.value), { element: root }));
     return;
   }
   _themeLayers.get(root)?.delete(name);

package/dist/{chunk-SLM3IA34.js → chunk-CDBKFGXN.js}

@@ -5,7 +5,7 @@ import {
   resumeTracking,
   suspendTracking,
   track
-} from "./chunk-JWKYU5GV.js";
+} from "./chunk-G2WHYEL7.js";
 import {
   devAssert
 } from "./chunk-NYNYSPK7.js";

package/dist/{chunk-4AWA2PVD.js → chunk-CF2KCWRE.js}

@@ -1,9 +1,12 @@
 import {
   renderToString
-} from "./chunk-HURREPU2.js";
+} from "./chunk-FC6KCJSA.js";
 import {
   globalSingleton
 } from "./chunk-7ZHH77QA.js";
+import {
+  sanitizeUrl
+} from "./chunk-EXXSN3BW.js";
 import {
   reportError
 } from "./chunk-NYNYSPK7.js";
@@ -167,7 +170,7 @@ var CDN_ENTRY_POINTS = {
 };
 var packageInfo = {
   name: "sibujs",
-  version: true ? "4.7.0" : "dev",
+  version: true ? "4.9.0" : "dev",
   entryPoints: MODULE_ENTRY_POINTS,
   /**
    * Generate the package.json `exports` map. Module entries resolve to the
@@ -312,7 +315,7 @@ var env = {
 };
 
 // src/plugins/versioning.ts
-var VERSION = true ? "4.7.0" : "dev";
+var VERSION = true ? "4.9.0" : "dev";
 var NUM = "(?:0|[1-9]\\d*)";
 var PRE_ID = `(?:${NUM}|\\d*[a-zA-Z-][0-9a-zA-Z-]*)`;
 var BUILD_ID = "[0-9a-zA-Z-]+";
@@ -595,12 +598,14 @@ function extractRangeTarget(range) {
 function preloadCritical(resources) {
   if (typeof document === "undefined") return;
   for (const resource of resources) {
-    const safeHref = typeof CSS !== "undefined" && typeof CSS.escape === "function" ? CSS.escape(resource.href) : resource.href.replace(/["\\]/g, "\\$&");
+    const href = sanitizeUrl(resource.href);
+    if (!href) continue;
+    const safeHref = typeof CSS !== "undefined" && typeof CSS.escape === "function" ? CSS.escape(href) : href.replace(/["\\]/g, "\\$&");
     const existing = document.querySelector(`link[rel="preload"][href="${safeHref}"]`);
     if (existing) continue;
     const link = document.createElement("link");
     link.rel = "preload";
-    link.href = resource.href;
+    link.href = href;
     link.setAttribute("as", resource.as);
     if (resource.type) {
       link.type = resource.type;

package/dist/{chunk-BSY63EM6.js → chunk-DRMLIF6M.js}

@@ -1,15 +1,18 @@
 import {
-  sanitizeUrl
-} from "./chunk-2INLLLMZ.js";
+  isBlockedElement
+} from "./chunk-3ACAAQIN.js";
 import {
   globalSingleton
 } from "./chunk-7ZHH77QA.js";
 import {
   effect
-} from "./chunk-WEQ3DMVL.js";
+} from "./chunk-SBTZEYNI.js";
+import {
+  sanitizeUrl
+} from "./chunk-EXXSN3BW.js";
 import {
   signal
-} from "./chunk-FQRUXCEE.js";
+} from "./chunk-SYHGGDNW.js";
 import {
   DEV,
   devWarn,
@@ -239,6 +242,9 @@ var DOMPool = class {
    * Get a recycled element or create a new one.
    */
   acquire(tag) {
+    if (isBlockedElement(tag)) {
+      throw new Error(`DOMPool: refusing to create <${tag}> \u2014 tag is blocked for security reasons.`);
+    }
     const pool = this.pools.get(tag);
     if (pool && pool.length > 0) {
       const el = pool.pop();
@@ -344,10 +350,19 @@ function prefetch(url) {
 }
 function preloadImage(src) {
   return new Promise((resolve, reject) => {
+    const safe = sanitizeUrl(String(src));
+    if (!safe) {
+      reject(
+        new Error(
+          String(src).trim() === "" ? "preloadImage: no image URL was given." : "preloadImage: refusing an image URL outside the URL policy."
+        )
+      );
+      return;
+    }
     const img = new Image();
     img.onload = () => resolve(img);
     img.onerror = reject;
-    img.src = src;
+    img.src = safe;
   });
 }