sibujs 1.0.0 → 1.0.2

package/dist/ssr.d.cts

@@ -108,7 +108,7 @@ declare function ssrSuspense(props: {
  * Generate an inline script that swaps a suspense fallback with resolved content.
  * The id is escaped for both JS string and HTML attribute contexts to prevent injection.
  */
-declare function suspenseSwapScript(id: string): string;
+declare function suspenseSwapScript(id: string, nonce?: string): string;
 /**
  * Renders a component tree with suspense boundaries as a stream.
  * Yields the main tree HTML first (including fallback content for suspended
@@ -123,11 +123,17 @@ declare function renderToSuspenseStream(element: HTMLElement | DocumentFragment
  * The serialized data is embedded in the document and picked up
  * on the client with `deserializeState()`.
  */
-declare function serializeState(state: Record<string, unknown>): string;
+declare function serializeState(state: Record<string, unknown>, nonce?: string): string;
 /**
  * Retrieve state that was embedded by `serializeState()` during SSR.
+ *
+ * When a `validate` function is provided, it acts as a type guard —
+ * only data that passes validation is returned. This prevents
+ * tampered SSR payloads from being trusted by the client.
+ *
+ * @param validate Optional type guard to verify data integrity
  */
-declare function deserializeState<T = Record<string, unknown>>(): T | undefined;
+declare function deserializeState<T = Record<string, unknown>>(validate?: (data: unknown) => data is T): T | undefined;
 
 interface UseWorkerReturn<TInput, TOutput> {
     post(data: TInput): void;

package/dist/ssr.d.ts

@@ -108,7 +108,7 @@ declare function ssrSuspense(props: {
  * Generate an inline script that swaps a suspense fallback with resolved content.
  * The id is escaped for both JS string and HTML attribute contexts to prevent injection.
  */
-declare function suspenseSwapScript(id: string): string;
+declare function suspenseSwapScript(id: string, nonce?: string): string;
 /**
  * Renders a component tree with suspense boundaries as a stream.
  * Yields the main tree HTML first (including fallback content for suspended
@@ -123,11 +123,17 @@ declare function renderToSuspenseStream(element: HTMLElement | DocumentFragment
  * The serialized data is embedded in the document and picked up
  * on the client with `deserializeState()`.
  */
-declare function serializeState(state: Record<string, unknown>): string;
+declare function serializeState(state: Record<string, unknown>, nonce?: string): string;
 /**
  * Retrieve state that was embedded by `serializeState()` during SSR.
+ *
+ * When a `validate` function is provided, it acts as a type guard —
+ * only data that passes validation is returned. This prevents
+ * tampered SSR payloads from being trusted by the client.
+ *
+ * @param validate Optional type guard to verify data integrity
  */
-declare function deserializeState<T = Record<string, unknown>>(): T | undefined;
+declare function deserializeState<T = Record<string, unknown>>(validate?: (data: unknown) => data is T): T | undefined;
 
 interface UseWorkerReturn<TInput, TOutput> {
     post(data: TInput): void;

package/dist/ssr.js

@@ -22,7 +22,7 @@ import {
   wasm,
   worker,
   workerFn
-} from "./chunk-FYIGTFXO.js";
+} from "./chunk-MJ4LVHGX.js";
 import {
   collectStream,
   deserializeState,
@@ -39,13 +39,14 @@ import {
   serializeState,
   ssrSuspense,
   suspenseSwapScript
-} from "./chunk-UATXXETW.js";
-import "./chunk-MGYRVG2A.js";
-import "./chunk-LHNJSLC6.js";
-import "./chunk-NMTRH4Q3.js";
-import "./chunk-OZS4YOOP.js";
+} from "./chunk-7TQKR4PP.js";
+import "./chunk-OWLQ4HZI.js";
+import "./chunk-QVKGGB2S.js";
+import "./chunk-SDLZDHKP.js";
+import "./chunk-PZEGYCF5.js";
 import "./chunk-CHJ27IGK.js";
-import "./chunk-KKUV25KB.js";
+import "./chunk-YECR7UIA.js";
+import "./chunk-4MYMUBRS.js";
 import "./chunk-MLKGABMK.js";
 export {
   Head,

package/dist/ui.js

@@ -36,7 +36,7 @@ import {
   toast,
   withScopedStyle,
   zipMask
-} from "./chunk-DB243LB7.js";
+} from "./chunk-3CRQALYP.js";
 import {
   RenderProp,
   assertType,
@@ -54,13 +54,14 @@ import {
   withProps,
   withWrapper
 } from "./chunk-XYU6TZOW.js";
-import "./chunk-NMTRH4Q3.js";
-import "./chunk-SU63HSUU.js";
+import "./chunk-SDLZDHKP.js";
+import "./chunk-FGOEVHY3.js";
 import {
   effect
-} from "./chunk-OZS4YOOP.js";
+} from "./chunk-PZEGYCF5.js";
 import "./chunk-CHJ27IGK.js";
-import "./chunk-KKUV25KB.js";
+import "./chunk-YECR7UIA.js";
+import "./chunk-4MYMUBRS.js";
 import "./chunk-MLKGABMK.js";
 
 // src/ui/lazyEffect.ts

package/dist/widgets.js

@@ -8,11 +8,12 @@ import {
   select,
   tabs,
   tooltip
-} from "./chunk-2GLUWW3D.js";
-import "./chunk-MBINISSE.js";
-import "./chunk-SU63HSUU.js";
+} from "./chunk-N6IZB6KJ.js";
+import "./chunk-CZUGLNJS.js";
+import "./chunk-FGOEVHY3.js";
 import "./chunk-CHJ27IGK.js";
-import "./chunk-KKUV25KB.js";
+import "./chunk-YECR7UIA.js";
+import "./chunk-4MYMUBRS.js";
 import "./chunk-MLKGABMK.js";
 export {
   accordion,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sibujs",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "A lightweight, function-based frontend framework that combines the best of React, Svelte, and Vue — with zero VDOM and maximum simplicity. Designed for developers who want fine-grained reactivity and full control without compilation or magic.",
   "keywords": [
     "frontend",