Improved XXS

Readme.md

@@ -22,7 +22,7 @@ That extra development time and the cognitive load of "learning the framework" i
 * 🛠️ **Build-Tool Agnostic:** Total freedom. Use it with **Vite, Webpack, or Rollup** for enterprise projects, or simply import it via a **`<script>` tag** for rapid prototyping. No tooling required.
 * 🚀 **Vite-Powered DX:** First-class Vite support with **file-based routing** out of the box. The official `sigpro/vite` plugin automatically scans your `src/pages` directory and generates reactive routes—no manual route configuration needed.
 * 📈 **Zero-Scale Bloat:** Unlike other frameworks where the bundle grows exponentially, SigPro's footprint remains **flat and predictable**. You only pay for the code you write.
-* 💎 **Premium DX (Developer Experience):** Forget boilerplate imports. SigPro injects an elegant, functional syntax (`Div()`, `Button()`, `Span()`) directly into your scope for a **"Zero-Import"** workflow.
+* 💎 **Premium DX (Developer Experience):** Forget boilerplate imports. SigPro injects an elegant, functional syntax (`div()`, `button()`, `span()`) directly into your scope for a **"Zero-Import"** workflow.
 * 📦 **Fully Loaded:** Built-in Hash Routing, native **`localStorage` persistence**, and automatic lifecycle management (cleanups) included in less than 2KB.
 * 🌳 **Tree-Shakable:** Optimized for modern bundlers. Import only what you use, or load the full engine for rapid prototyping.
 

dist/sigpro.esm.js

@@ -244,7 +244,8 @@ var cleanupNode = (node) => {
     node.childNodes.forEach((n) => cleanupNode(n));
 };
 var DANGEROUS_PROTOCOL = /^\s*(javascript|data|vbscript):/i;
-var isDangerousAttr = (key) => key === "src" || key === "href" || key.startsWith("on");
+var DANGEROUS_URI_ATTRS = new Set(["src", "href", "formaction", "action", "background", "code", "archive"]);
+var isDangerousAttr = (key) => DANGEROUS_URI_ATTRS.has(key) || key.startsWith("on");
 var validateAttr = (key, val) => {
   if (val == null || val === false)
     return null;
@@ -298,8 +299,9 @@ var h = (tag, props = {}, children = []) => {
       continue;
     }
     if (isSVG && k.startsWith("xlink:")) {
-      const ns = "http://www.w3.org/1999/xlink";
-      v == null ? el.removeAttributeNS(ns, k.slice(6)) : el.setAttributeNS(ns, k.slice(6), v);
+      const cleanVal = validateAttr(k.slice(6), v);
+      let lnk = "http://www.w3.org/1999/xlink";
+      cleanVal == null ? el.removeAttributeNS(lnk, k.slice(6)) : el.setAttributeNS(lnk, k.slice(6), cleanVal);
       continue;
     }
     if (k.startsWith("on")) {

dist/sigpro.js

@@ -300,7 +300,8 @@
       node.childNodes.forEach((n) => cleanupNode(n));
   };
   var DANGEROUS_PROTOCOL = /^\s*(javascript|data|vbscript):/i;
-  var isDangerousAttr = (key) => key === "src" || key === "href" || key.startsWith("on");
+  var DANGEROUS_URI_ATTRS = new Set(["src", "href", "formaction", "action", "background", "code", "archive"]);
+  var isDangerousAttr = (key) => DANGEROUS_URI_ATTRS.has(key) || key.startsWith("on");
   var validateAttr = (key, val) => {
     if (val == null || val === false)
       return null;
@@ -354,8 +355,9 @@
         continue;
       }
       if (isSVG && k.startsWith("xlink:")) {
-        const ns = "http://www.w3.org/1999/xlink";
-        v == null ? el.removeAttributeNS(ns, k.slice(6)) : el.setAttributeNS(ns, k.slice(6), v);
+        const cleanVal = validateAttr(k.slice(6), v);
+        let lnk = "http://www.w3.org/1999/xlink";
+        cleanVal == null ? el.removeAttributeNS(lnk, k.slice(6)) : el.setAttributeNS(lnk, k.slice(6), cleanVal);
         continue;
       }
       if (k.startsWith("on")) {

docs/api/quick.md

@@ -184,7 +184,7 @@ Applies smooth enter animations (CSS transitions / keyframes). Returns the modif
 
 ```javascript
 fx({ name: 'fade', duration: 300 }, 
-  Div({}, 'Hello')
+  div({}, 'Hello')
 )
 ```
 

docs/api/tags.md

@@ -224,7 +224,7 @@ Or using the classic script (auto‑global):
 
 ## 8. Important Notes
 
-- **Naming:** All tag helpers are **lowercase** – no PascalCase helpers (`Div`, `Button`).  
+- **Naming:** All tag helpers are **lowercase**.  
 - **Global availability:**  
   - **IIFE script** → automatically on `window`.  
   - **ESM module** → not global by default; use `import { div } from 'sigpro'` or call `sigpro()` to inject all globals.  

docs/sigpro.js

@@ -300,7 +300,8 @@
       node.childNodes.forEach((n) => cleanupNode(n));
   };
   var DANGEROUS_PROTOCOL = /^\s*(javascript|data|vbscript):/i;
-  var isDangerousAttr = (key) => key === "src" || key === "href" || key.startsWith("on");
+  var DANGEROUS_URI_ATTRS = new Set(["src", "href", "formaction", "action", "background", "code", "archive"]);
+  var isDangerousAttr = (key) => DANGEROUS_URI_ATTRS.has(key) || key.startsWith("on");
   var validateAttr = (key, val) => {
     if (val == null || val === false)
       return null;
@@ -354,8 +355,9 @@
         continue;
       }
       if (isSVG && k.startsWith("xlink:")) {
-        const ns = "http://www.w3.org/1999/xlink";
-        v == null ? el.removeAttributeNS(ns, k.slice(6)) : el.setAttributeNS(ns, k.slice(6), v);
+        const cleanVal = validateAttr(k.slice(6), v);
+        let lnk = "http://www.w3.org/1999/xlink";
+        cleanVal == null ? el.removeAttributeNS(lnk, k.slice(6)) : el.setAttributeNS(lnk, k.slice(6), cleanVal);
         continue;
       }
       if (k.startsWith("on")) {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigpro",
-  "version": "1.2.20",
+  "version": "1.2.21",
   "type": "module",
   "license": "MIT",
   "main": "./dist/sigpro.esm.min.js",
@@ -28,10 +28,10 @@
   "homepage": "https://sigpro.natxocc.com/#/",
   "repository": {
     "type": "git",
-    "url": "https://git.natxocc.com/natxocc/sigpro"
+    "url": "https://github.com/natxocc/sigpro"
   },
   "bugs": {
-    "url": "https://git.natxocc.com/natxocc/sigpro/issues"
+    "url": "https://github.com/natxocc/sigpro/issues"
   },
   "scripts": {
     "clean": "rm -rf dist",

sigpro.js

@@ -230,8 +230,9 @@ const cleanupNode = (node) => {
   if (node.childNodes) node.childNodes.forEach(n => cleanupNode(n));
 };
 
-const DANGEROUS_PROTOCOL = /^\s*(javascript|data|vbscript):/i
-const isDangerousAttr = key => key === 'src' || key === 'href' || key.startsWith('on')
+var DANGEROUS_PROTOCOL = /^\s*(javascript|data|vbscript):/i;
+var DANGEROUS_URI_ATTRS = new Set(["src", "href", "formaction", "action", "background", "code", "archive"]);
+var isDangerousAttr = (key) => DANGEROUS_URI_ATTRS.has(key) || key.startsWith("on");
 
 const validateAttr = (key, val) => {
   if (val == null || val === false) return null
@@ -292,9 +293,12 @@ const h = (tag, props = {}, children = []) => {
       continue
     }
     if (isSVG && k.startsWith("xlink:")) {
-      const ns = "http://www.w3.org/1999/xlink"
-      v == null ? el.removeAttributeNS(ns, k.slice(6)) : el.setAttributeNS(ns, k.slice(6), v)
-      continue
+      const cleanVal = validateAttr(k.slice(6), v);
+      let lnk = "http://www.w3.org/1999/xlink"
+      cleanVal == null
+        ? el.removeAttributeNS(lnk, k.slice(6))
+        : el.setAttributeNS(lnk, k.slice(6), cleanVal);
+      continue;
     }
     if (k.startsWith("on")) {
       const ev = k.slice(2).toLowerCase()