@thelacanians/vue-native-runtime 0.3.0 → 0.4.0

package/dist/index.cjs

@@ -384,6 +384,17 @@ var _NativeBridgeImpl = class _NativeBridgeImpl {
           ));
         }
       }, timeoutMs);
+      if (this.pendingCallbacks.size >= _NativeBridgeImpl.MAX_PENDING_CALLBACKS) {
+        const oldestKey = this.pendingCallbacks.keys().next().value;
+        if (oldestKey !== void 0) {
+          const oldest = this.pendingCallbacks.get(oldestKey);
+          if (oldest) {
+            clearTimeout(oldest.timeoutId);
+            oldest.reject(new Error("Callback queue full, evicting oldest pending callback"));
+            this.pendingCallbacks.delete(oldestKey);
+          }
+        }
+      }
       this.pendingCallbacks.set(callbackId, { resolve, reject, timeoutId });
       this.enqueue("invokeNativeModule", [moduleName, methodName, args, callbackId]);
     });
@@ -403,11 +414,9 @@ var _NativeBridgeImpl = class _NativeBridgeImpl {
   resolveCallback(callbackId, result, error) {
     const pending = this.pendingCallbacks.get(callbackId);
     if (!pending) {
-      if (__DEV__) {
-        console.warn(
-          `[VueNative] Received callback for unknown callbackId: ${callbackId}`
-        );
-      }
+      console.warn(
+        `[VueNative] Received callback for unknown callbackId: ${callbackId}. This likely means the callback already timed out or was evicted. The late response has been discarded.`
+      );
       return;
     }
     clearTimeout(pending.timeoutId);
@@ -472,6 +481,8 @@ var _NativeBridgeImpl = class _NativeBridgeImpl {
 };
 /** Maximum callback ID before wraparound (safe for 32-bit signed int) */
 _NativeBridgeImpl.MAX_CALLBACK_ID = 2147483647;
+/** Maximum number of pending callbacks before evicting the oldest */
+_NativeBridgeImpl.MAX_PENDING_CALLBACKS = 1e3;
 var NativeBridgeImpl = _NativeBridgeImpl;
 if (typeof globalThis.__DEV__ === "undefined") {
   ;
@@ -786,7 +797,17 @@ var VInput = (0, import_runtime_core5.defineComponent)({
   },
   emits: ["update:modelValue", "focus", "blur", "submit"],
   setup(props, { emit }) {
+    const isComposing = (0, import_runtime_core5.ref)(false);
+    const onCompositionstart = () => {
+      isComposing.value = true;
+    };
+    const onCompositionend = (payload) => {
+      isComposing.value = false;
+      const text = typeof payload === "string" ? payload : payload?.text ?? "";
+      emit("update:modelValue", text);
+    };
     const onChangetext = (payload) => {
+      if (isComposing.value) return;
       const text = typeof payload === "string" ? payload : payload?.text ?? "";
       emit("update:modelValue", text);
     };
@@ -815,6 +836,8 @@ var VInput = (0, import_runtime_core5.defineComponent)({
       accessibilityHint: props.accessibilityHint,
       accessibilityState: props.accessibilityState,
       onChangetext,
+      onCompositionstart,
+      onCompositionend,
       onFocus,
       onBlur,
       onSubmit
@@ -927,6 +950,11 @@ var VScrollView = (0, import_runtime_core8.defineComponent)({
       default: false
     },
     contentContainerStyle: Object,
+    /** Minimum interval in ms between scroll event emissions. Default: 16 (~60fps) */
+    scrollEventThrottle: {
+      type: Number,
+      default: 16
+    },
     /** Whether the pull-to-refresh indicator is active */
     refreshing: {
       type: Boolean,
@@ -940,8 +968,13 @@ var VScrollView = (0, import_runtime_core8.defineComponent)({
   },
   emits: ["scroll", "refresh"],
   setup(props, { slots, emit }) {
+    let lastScrollEmit = 0;
     const onScroll = (payload) => {
-      emit("scroll", payload);
+      const now = Date.now();
+      if (now - lastScrollEmit >= props.scrollEventThrottle) {
+        lastScrollEmit = now;
+        emit("scroll", payload);
+      }
     };
     const onRefresh = () => {
       emit("refresh");
@@ -988,13 +1021,29 @@ var VImage = (0, import_runtime_core9.defineComponent)({
     accessibilityState: Object
   },
   emits: ["load", "error"],
-  setup(props, { emit }) {
+  setup(props, { emit, expose }) {
+    const loading = (0, import_runtime_core9.ref)(true);
+    (0, import_runtime_core9.watch)(
+      () => props.source?.uri,
+      () => {
+        loading.value = true;
+      }
+    );
+    const onLoad = () => {
+      loading.value = false;
+      emit("load");
+    };
+    const onError = (e) => {
+      loading.value = false;
+      emit("error", e);
+    };
+    expose({ loading });
     return () => (0, import_runtime_core9.h)(
       "VImage",
       {
         ...props,
-        onLoad: () => emit("load"),
-        onError: (e) => emit("error", e)
+        onLoad,
+        onError
       }
     );
   }
@@ -1100,8 +1149,29 @@ var VList = (0, import_runtime_core13.defineComponent)({
   },
   emits: ["scroll", "endReached"],
   setup(props, { slots, emit }) {
+    let lastScrollEmit = 0;
+    const onScroll = (e) => {
+      const now = Date.now();
+      if (now - lastScrollEmit >= 16) {
+        lastScrollEmit = now;
+        emit("scroll", e);
+      }
+    };
     return () => {
       const items = props.data ?? [];
+      if (typeof __DEV__ !== "undefined" && __DEV__ && items.length > 0) {
+        const keys = /* @__PURE__ */ new Set();
+        for (let index = 0; index < items.length; index++) {
+          const key = props.keyExtractor(items[index], index);
+          if (keys.has(key)) {
+            console.warn(
+              `[VueNative] VList: Duplicate key "${key}" at index ${index}. Each item must have a unique key for correct reconciliation.`
+            );
+            break;
+          }
+          keys.add(key);
+        }
+      }
       const children = [];
       if (slots.header) {
         children.push(
@@ -1139,7 +1209,7 @@ var VList = (0, import_runtime_core13.defineComponent)({
           showsScrollIndicator: props.showsScrollIndicator,
           bounces: props.bounces,
           horizontal: props.horizontal,
-          onScroll: (e) => emit("scroll", e),
+          onScroll,
           onEndReached: () => emit("endReached")
         },
         children
@@ -1164,10 +1234,24 @@ var VModal = (0, import_runtime_core14.defineComponent)({
   },
   emits: ["dismiss"],
   setup(props, { slots, emit }) {
+    const debouncedVisible = (0, import_runtime_core14.ref)(props.visible);
+    let visibleTimer;
+    (0, import_runtime_core14.watch)(
+      () => props.visible,
+      (val) => {
+        if (visibleTimer) clearTimeout(visibleTimer);
+        visibleTimer = setTimeout(() => {
+          debouncedVisible.value = val;
+        }, 50);
+      }
+    );
+    (0, import_runtime_core14.onUnmounted)(() => {
+      if (visibleTimer) clearTimeout(visibleTimer);
+    });
     return () => (0, import_runtime_core14.h)(
       "VModal",
       {
-        visible: props.visible,
+        visible: debouncedVisible.value,
         style: props.style,
         onDismiss: () => emit("dismiss")
       },
@@ -1188,8 +1272,22 @@ var VAlertDialog = (0, import_runtime_core15.defineComponent)({
   },
   emits: ["confirm", "cancel", "action"],
   setup(props, { emit }) {
+    const debouncedVisible = (0, import_runtime_core15.ref)(props.visible);
+    let visibleTimer;
+    (0, import_runtime_core15.watch)(
+      () => props.visible,
+      (val) => {
+        if (visibleTimer) clearTimeout(visibleTimer);
+        visibleTimer = setTimeout(() => {
+          debouncedVisible.value = val;
+        }, 50);
+      }
+    );
+    (0, import_runtime_core15.onUnmounted)(() => {
+      if (visibleTimer) clearTimeout(visibleTimer);
+    });
     return () => (0, import_runtime_core15.h)("VAlertDialog", {
-      visible: props.visible,
+      visible: debouncedVisible.value,
       title: props.title,
       message: props.message,
       buttons: props.buttons,
@@ -1229,8 +1327,18 @@ var VWebView = (0, import_runtime_core17.defineComponent)({
   },
   emits: ["load", "error", "message"],
   setup(props, { emit }) {
+    const sanitizedSource = (0, import_runtime_core17.computed)(() => {
+      const source = props.source;
+      if (!source?.uri) return source;
+      const lower = source.uri.toLowerCase().trim();
+      if (lower.startsWith("javascript:") || lower.startsWith("data:text/html")) {
+        console.warn("[VueNative] VWebView: Blocked potentially unsafe URI scheme");
+        return { ...source, uri: void 0 };
+      }
+      return source;
+    });
     return () => (0, import_runtime_core17.h)("VWebView", {
-      source: props.source,
+      source: sanitizedSource.value,
       style: props.style,
       javaScriptEnabled: props.javaScriptEnabled,
       onLoad: (e) => emit("load", e),
@@ -1876,15 +1984,33 @@ function useHaptics() {
 }
 
 // src/composables/useAsyncStorage.ts
+var writeQueues = /* @__PURE__ */ new Map();
+function queueWrite(key, fn) {
+  const prev = writeQueues.get(key) ?? Promise.resolve();
+  const next = prev.then(fn, fn);
+  writeQueues.set(key, next);
+  next.then(() => {
+    if (writeQueues.get(key) === next) {
+      writeQueues.delete(key);
+    }
+  });
+  return next;
+}
 function useAsyncStorage() {
   function getItem(key) {
     return NativeBridge.invokeNativeModule("AsyncStorage", "getItem", [key]);
   }
   function setItem(key, value) {
-    return NativeBridge.invokeNativeModule("AsyncStorage", "setItem", [key, value]).then(() => void 0);
+    return queueWrite(
+      key,
+      () => NativeBridge.invokeNativeModule("AsyncStorage", "setItem", [key, value]).then(() => void 0)
+    );
   }
   function removeItem(key) {
-    return NativeBridge.invokeNativeModule("AsyncStorage", "removeItem", [key]).then(() => void 0);
+    return queueWrite(
+      key,
+      () => NativeBridge.invokeNativeModule("AsyncStorage", "removeItem", [key]).then(() => void 0)
+    );
   }
   function getAllKeys() {
     return NativeBridge.invokeNativeModule("AsyncStorage", "getAllKeys", []);
@@ -2021,15 +2147,20 @@ var import_runtime_core33 = require("@vue/runtime-core");
 function useNetwork() {
   const isConnected = (0, import_runtime_core33.ref)(true);
   const connectionType = (0, import_runtime_core33.ref)("unknown");
-  NativeBridge.invokeNativeModule("Network", "getStatus").then((status) => {
-    isConnected.value = status.isConnected;
-    connectionType.value = status.connectionType;
-  }).catch(() => {
-  });
+  let lastEventTime = 0;
   const unsubscribe = NativeBridge.onGlobalEvent("network:change", (payload) => {
+    lastEventTime = Date.now();
     isConnected.value = payload.isConnected;
     connectionType.value = payload.connectionType;
   });
+  const initTime = Date.now();
+  NativeBridge.invokeNativeModule("Network", "getStatus").then((status) => {
+    if (lastEventTime <= initTime) {
+      isConnected.value = status.isConnected;
+      connectionType.value = status.connectionType;
+    }
+  }).catch(() => {
+  });
   (0, import_runtime_core33.onUnmounted)(unsubscribe);
   return { isConnected, connectionType };
 }
@@ -2086,21 +2217,39 @@ function useGeolocation() {
   const error = (0, import_runtime_core35.ref)(null);
   let watchId = null;
   async function getCurrentPosition() {
-    const result = await NativeBridge.invokeNativeModule("Geolocation", "getCurrentPosition");
-    coords.value = result;
-    return result;
+    try {
+      error.value = null;
+      const result = await NativeBridge.invokeNativeModule("Geolocation", "getCurrentPosition");
+      coords.value = result;
+      return result;
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : String(e);
+      error.value = msg;
+      throw e;
+    }
   }
   async function watchPosition() {
-    const id = await NativeBridge.invokeNativeModule("Geolocation", "watchPosition");
-    watchId = id;
-    const unsubscribe = NativeBridge.onGlobalEvent("location:update", (payload) => {
-      coords.value = payload;
-    });
-    (0, import_runtime_core35.onUnmounted)(() => {
-      unsubscribe();
-      if (watchId !== null) clearWatch(watchId);
-    });
-    return id;
+    try {
+      error.value = null;
+      const id = await NativeBridge.invokeNativeModule("Geolocation", "watchPosition");
+      watchId = id;
+      const unsubscribe = NativeBridge.onGlobalEvent("location:update", (payload) => {
+        coords.value = payload;
+      });
+      const unsubscribeError = NativeBridge.onGlobalEvent("location:error", (payload) => {
+        error.value = payload.message;
+      });
+      (0, import_runtime_core35.onUnmounted)(() => {
+        unsubscribe();
+        unsubscribeError();
+        if (watchId !== null) clearWatch(watchId);
+      });
+      return id;
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : String(e);
+      error.value = msg;
+      throw e;
+    }
   }
   async function clearWatch(id) {
     await NativeBridge.invokeNativeModule("Geolocation", "clearWatch", [id]);
@@ -2233,6 +2382,10 @@ function useHttp(config = {}) {
   }
   const loading = (0, import_runtime_core38.ref)(false);
   const error = (0, import_runtime_core38.ref)(null);
+  let isMounted = true;
+  (0, import_runtime_core38.onUnmounted)(() => {
+    isMounted = false;
+  });
   async function request(method, url, options = {}) {
     const fullUrl = config.baseURL ? `${config.baseURL}${url}` : url;
     loading.value = true;
@@ -2252,6 +2405,9 @@ function useHttp(config = {}) {
       }
       const response = await fetch(fullUrl, fetchOptions);
       const data = await response.json();
+      if (!isMounted) {
+        return { data, status: response.status, ok: response.ok, headers: {} };
+      }
       return {
         data,
         status: response.status,
@@ -2260,10 +2416,14 @@ function useHttp(config = {}) {
       };
     } catch (e) {
       const msg = e instanceof Error ? e.message : String(e);
-      error.value = msg;
+      if (isMounted) {
+        error.value = msg;
+      }
       throw e;
     } finally {
-      loading.value = false;
+      if (isMounted) {
+        loading.value = false;
+      }
     }
   }
   return {
@@ -2299,7 +2459,11 @@ function useBackHandler(handler) {
   let unsubscribe = null;
   (0, import_runtime_core40.onMounted)(() => {
     unsubscribe = NativeBridge.onGlobalEvent("hardware:backPress", () => {
-      handler();
+      const handled = handler();
+      if (!handled) {
+        NativeBridge.invokeNativeModule("BackHandler", "exitApp", []).catch(() => {
+        });
+      }
     });
   });
   (0, import_runtime_core40.onUnmounted)(() => {
@@ -2389,6 +2553,8 @@ function useWebSocket(url, options = {}) {
   const error = (0, import_runtime_core43.ref)(null);
   let reconnectAttempts = 0;
   let reconnectTimer = null;
+  const MAX_PENDING_MESSAGES = 100;
+  const pendingMessages = [];
   const unsubscribers = [];
   unsubscribers.push(
     NativeBridge.onGlobalEvent("websocket:open", (payload) => {
@@ -2396,6 +2562,12 @@ function useWebSocket(url, options = {}) {
       status.value = "OPEN";
       error.value = null;
       reconnectAttempts = 0;
+      while (pendingMessages.length > 0) {
+        const msg = pendingMessages.shift();
+        NativeBridge.invokeNativeModule("WebSocket", "send", [connectionId, msg]).catch((err) => {
+          error.value = err.message;
+        });
+      }
     })
   );
   unsubscribers.push(
@@ -2410,9 +2582,10 @@ function useWebSocket(url, options = {}) {
       status.value = "CLOSED";
       if (autoReconnect && reconnectAttempts < maxReconnectAttempts && payload.code !== 1e3) {
         reconnectAttempts++;
+        const backoffMs = reconnectInterval * Math.pow(2, reconnectAttempts - 1);
         reconnectTimer = setTimeout(() => {
           open();
-        }, reconnectInterval);
+        }, backoffMs);
       }
     })
   );
@@ -2432,8 +2605,17 @@ function useWebSocket(url, options = {}) {
     });
   }
   function send(data) {
-    if (status.value !== "OPEN") return;
     const message = typeof data === "string" ? data : JSON.stringify(data);
+    if (status.value !== "OPEN") {
+      if (pendingMessages.length >= MAX_PENDING_MESSAGES) {
+        pendingMessages.shift();
+        if (__DEV__) {
+          console.warn("[VueNative] WebSocket pending message queue full, dropping oldest message");
+        }
+      }
+      pendingMessages.push(message);
+      return;
+    }
     NativeBridge.invokeNativeModule("WebSocket", "send", [connectionId, message]).catch((err) => {
       error.value = err.message;
     });
@@ -2717,22 +2899,22 @@ function useDatabase(name = "default") {
   }
   async function transaction(callback) {
     await ensureOpen();
-    const statements = [];
-    const ctx = {
-      execute: async (sql, params) => {
-        statements.push({ sql, params: params ?? [] });
-        return { rowsAffected: 0 };
-      },
-      query: async (sql, params) => {
-        if (statements.length > 0) {
-          await NativeBridge.invokeNativeModule("Database", "executeTransaction", [name, statements.splice(0)]);
+    await NativeBridge.invokeNativeModule("Database", "execute", [name, "BEGIN TRANSACTION", []]);
+    try {
+      const ctx = {
+        execute: async (sql, params) => {
+          return NativeBridge.invokeNativeModule("Database", "execute", [name, sql, params ?? []]);
+        },
+        query: async (sql, params) => {
+          return NativeBridge.invokeNativeModule("Database", "query", [name, sql, params ?? []]);
         }
-        return NativeBridge.invokeNativeModule("Database", "query", [name, sql, params ?? []]);
-      }
-    };
-    await callback(ctx);
-    if (statements.length > 0) {
-      await NativeBridge.invokeNativeModule("Database", "executeTransaction", [name, statements]);
+      };
+      await callback(ctx);
+      await NativeBridge.invokeNativeModule("Database", "execute", [name, "COMMIT", []]);
+    } catch (err) {
+      await NativeBridge.invokeNativeModule("Database", "execute", [name, "ROLLBACK", []]).catch(() => {
+      });
+      throw err;
     }
   }
   async function close() {
@@ -3121,6 +3303,8 @@ function useOTAUpdate(serverUrl) {
       await NativeBridge.invokeNativeModule("OTA", "downloadUpdate", [downloadUrl, expectedHash || ""]);
       status.value = "ready";
     } catch (err) {
+      await NativeBridge.invokeNativeModule("OTA", "cleanupPartialDownload", []).catch(() => {
+      });
       error.value = err?.message || String(err);
       status.value = "error";
       throw err;
@@ -3129,7 +3313,17 @@ function useOTAUpdate(serverUrl) {
     }
   }
   async function applyUpdate() {
+    if (status.value !== "ready") {
+      throw new Error("No update ready to apply. Call downloadUpdate() first.");
+    }
     error.value = null;
+    try {
+      await NativeBridge.invokeNativeModule("OTA", "verifyBundle", []);
+    } catch (err) {
+      status.value = "error";
+      error.value = "Bundle verification failed: " + (err?.message || String(err));
+      throw err;
+    }
     try {
       await NativeBridge.invokeNativeModule("OTA", "applyUpdate", []);
       const info = await NativeBridge.invokeNativeModule("OTA", "getCurrentVersion", []);

package/dist/index.d.cts

@@ -602,6 +602,10 @@ declare const VButton: _vue_runtime_core.DefineComponent<_vue_runtime_core.Extra
  * The component maps `modelValue` to the native `text` prop and listens
  * for `changetext` events from the native side to update the model.
  *
+ * Handles CJK IME composition correctly: during composition, model updates
+ * are deferred until the user commits the composed character to avoid
+ * v-model desync.
+ *
  * @example
  * ```vue
  * <VInput
@@ -845,6 +849,11 @@ declare const VScrollView: _vue_runtime_core.DefineComponent<_vue_runtime_core.E
         default: boolean;
     };
     contentContainerStyle: PropType<ViewStyle>;
+    /** Minimum interval in ms between scroll event emissions. Default: 16 (~60fps) */
+    scrollEventThrottle: {
+        type: NumberConstructor;
+        default: number;
+    };
     /** Whether the pull-to-refresh indicator is active */
     refreshing: {
         type: BooleanConstructor;
@@ -883,6 +892,11 @@ declare const VScrollView: _vue_runtime_core.DefineComponent<_vue_runtime_core.E
         default: boolean;
     };
     contentContainerStyle: PropType<ViewStyle>;
+    /** Minimum interval in ms between scroll event emissions. Default: 16 (~60fps) */
+    scrollEventThrottle: {
+        type: NumberConstructor;
+        default: number;
+    };
     /** Whether the pull-to-refresh indicator is active */
     refreshing: {
         type: BooleanConstructor;
@@ -903,6 +917,7 @@ declare const VScrollView: _vue_runtime_core.DefineComponent<_vue_runtime_core.E
     scrollEnabled: boolean;
     bounces: boolean;
     pagingEnabled: boolean;
+    scrollEventThrottle: number;
     refreshing: boolean;
 }, {}, {}, {}, string, _vue_runtime_core.ComponentProvideOptions, true, {}, any>;
 
@@ -912,6 +927,9 @@ declare const VScrollView: _vue_runtime_core.DefineComponent<_vue_runtime_core.E
  * Maps to UIImageView on iOS. Loads images from URIs asynchronously
  * with built-in caching. Supports various resize modes.
  *
+ * Exposes a reactive `loading` ref (via template ref) that is `true`
+ * while the image is being fetched and `false` once it loads or errors.
+ *
  * @example
  * ```vue
  * <VImage
@@ -1306,6 +1324,9 @@ interface WebViewSource {
 /**
  * Embedded web view component backed by WKWebView.
  *
+ * URI sources are validated to block dangerous schemes such as `javascript:`
+ * and `data:text/html` which could lead to XSS.
+ *
  * @example
  * <VWebView :source="{ uri: 'https://example.com' }" style="flex: 1" @load="onLoad" />
  */
@@ -2179,6 +2200,8 @@ declare function useHaptics(): {
  * Async key-value storage composable backed by UserDefaults.
  *
  * All operations are Promise-based and run on a background thread.
+ * Write operations (setItem, removeItem) are serialized per key to
+ * prevent race conditions from concurrent access.
  *
  * @example
  * ```ts
@@ -3479,6 +3502,8 @@ declare class NativeBridgeImpl {
     private nextCallbackId;
     /** Maximum callback ID before wraparound (safe for 32-bit signed int) */
     private static readonly MAX_CALLBACK_ID;
+    /** Maximum number of pending callbacks before evicting the oldest */
+    private static readonly MAX_PENDING_CALLBACKS;
     /** Global event listeners: eventName -> Set of callbacks */
     private globalEventHandlers;
     /**

package/dist/index.d.ts

@@ -602,6 +602,10 @@ declare const VButton: _vue_runtime_core.DefineComponent<_vue_runtime_core.Extra
  * The component maps `modelValue` to the native `text` prop and listens
  * for `changetext` events from the native side to update the model.
  *
+ * Handles CJK IME composition correctly: during composition, model updates
+ * are deferred until the user commits the composed character to avoid
+ * v-model desync.
+ *
  * @example
  * ```vue
  * <VInput
@@ -845,6 +849,11 @@ declare const VScrollView: _vue_runtime_core.DefineComponent<_vue_runtime_core.E
         default: boolean;
     };
     contentContainerStyle: PropType<ViewStyle>;
+    /** Minimum interval in ms between scroll event emissions. Default: 16 (~60fps) */
+    scrollEventThrottle: {
+        type: NumberConstructor;
+        default: number;
+    };
     /** Whether the pull-to-refresh indicator is active */
     refreshing: {
         type: BooleanConstructor;
@@ -883,6 +892,11 @@ declare const VScrollView: _vue_runtime_core.DefineComponent<_vue_runtime_core.E
         default: boolean;
     };
     contentContainerStyle: PropType<ViewStyle>;
+    /** Minimum interval in ms between scroll event emissions. Default: 16 (~60fps) */
+    scrollEventThrottle: {
+        type: NumberConstructor;
+        default: number;
+    };
     /** Whether the pull-to-refresh indicator is active */
     refreshing: {
         type: BooleanConstructor;
@@ -903,6 +917,7 @@ declare const VScrollView: _vue_runtime_core.DefineComponent<_vue_runtime_core.E
     scrollEnabled: boolean;
     bounces: boolean;
     pagingEnabled: boolean;
+    scrollEventThrottle: number;
     refreshing: boolean;
 }, {}, {}, {}, string, _vue_runtime_core.ComponentProvideOptions, true, {}, any>;
 
@@ -912,6 +927,9 @@ declare const VScrollView: _vue_runtime_core.DefineComponent<_vue_runtime_core.E
  * Maps to UIImageView on iOS. Loads images from URIs asynchronously
  * with built-in caching. Supports various resize modes.
  *
+ * Exposes a reactive `loading` ref (via template ref) that is `true`
+ * while the image is being fetched and `false` once it loads or errors.
+ *
  * @example
  * ```vue
  * <VImage
@@ -1306,6 +1324,9 @@ interface WebViewSource {
 /**
  * Embedded web view component backed by WKWebView.
  *
+ * URI sources are validated to block dangerous schemes such as `javascript:`
+ * and `data:text/html` which could lead to XSS.
+ *
  * @example
  * <VWebView :source="{ uri: 'https://example.com' }" style="flex: 1" @load="onLoad" />
  */
@@ -2179,6 +2200,8 @@ declare function useHaptics(): {
  * Async key-value storage composable backed by UserDefaults.
  *
  * All operations are Promise-based and run on a background thread.
+ * Write operations (setItem, removeItem) are serialized per key to
+ * prevent race conditions from concurrent access.
  *
  * @example
  * ```ts
@@ -3479,6 +3502,8 @@ declare class NativeBridgeImpl {
     private nextCallbackId;
     /** Maximum callback ID before wraparound (safe for 32-bit signed int) */
     private static readonly MAX_CALLBACK_ID;
+    /** Maximum number of pending callbacks before evicting the oldest */
+    private static readonly MAX_PENDING_CALLBACKS;
     /** Global event listeners: eventName -> Set of callbacks */
     private globalEventHandlers;
     /**