sibujs 1.4.0 → 2.0.0

package/dist/{chunk-2BYQDGN3.js → chunk-SAHNHTFC.js}

@@ -1,17 +1,17 @@
 import {
   div,
   span
-} from "./chunk-32DY64NT.js";
+} from "./chunk-R73P76YZ.js";
 import {
   sanitizeUrl
-} from "./chunk-CMBFNA7L.js";
+} from "./chunk-UCS6AMJ7.js";
 import {
   effect
-} from "./chunk-CHF5OHIA.js";
+} from "./chunk-HB24TBAF.js";
 import {
   batch,
   signal
-} from "./chunk-WZSPOOER.js";
+} from "./chunk-CC65Y57T.js";
 
 // src/platform/head.ts
 var HEAD_URL_ATTRS = /* @__PURE__ */ new Set(["href", "src"]);
@@ -148,24 +148,37 @@ function worker(workerFn2) {
   const [error, setError] = signal(null);
   const [loading, setLoading] = signal(false);
   let worker2 = null;
+  let blobUrl = null;
+  const revokeBlobUrl = () => {
+    if (blobUrl) {
+      URL.revokeObjectURL(blobUrl);
+      blobUrl = null;
+    }
+  };
   try {
     if (typeof Worker === "undefined") {
       throw new Error("Web Workers are not supported in this environment");
     }
     const fnBody = workerFn2.toString();
     const blob = new Blob([`self.onmessage = ${fnBody};`], { type: "application/javascript" });
-    const url = URL.createObjectURL(blob);
-    worker2 = new Worker(url);
-    URL.revokeObjectURL(url);
-    worker2.onmessage = (e) => {
+    blobUrl = URL.createObjectURL(blob);
+    worker2 = new Worker(blobUrl);
+    worker2.addEventListener("message", (e) => {
+      revokeBlobUrl();
       setResult(e.data);
       setLoading(false);
-    };
-    worker2.onerror = (e) => {
+    });
+    worker2.addEventListener("error", (e) => {
+      revokeBlobUrl();
       setError(new Error(e.message || "Worker error"));
       setLoading(false);
-    };
+      if (worker2) {
+        worker2.terminate();
+        worker2 = null;
+      }
+    });
   } catch (err) {
+    revokeBlobUrl();
     setError(err instanceof Error ? err : new Error(String(err)));
   }
   function post(data) {
@@ -179,6 +192,7 @@ function worker(workerFn2) {
     if (!worker2) return;
     worker2.terminate();
     worker2 = null;
+    revokeBlobUrl();
     setLoading(false);
   }
   return { post, result, error, loading, terminate };
@@ -186,6 +200,14 @@ function worker(workerFn2) {
 function workerFn(fn) {
   const [loading, setLoading] = signal(false);
   let worker2 = null;
+  let blobUrl = null;
+  const revokeBlobUrl = () => {
+    if (blobUrl) {
+      URL.revokeObjectURL(blobUrl);
+      blobUrl = null;
+    }
+  };
+  const queue = [];
   try {
     if (typeof Worker === "undefined") {
       throw new Error("Web Workers are not supported in this environment");
@@ -201,10 +223,26 @@ function workerFn(fn) {
       ],
       { type: "application/javascript" }
     );
-    const url = URL.createObjectURL(blob);
-    worker2 = new Worker(url);
-    URL.revokeObjectURL(url);
+    blobUrl = URL.createObjectURL(blob);
+    worker2 = new Worker(blobUrl);
+    worker2.addEventListener("message", (e) => {
+      revokeBlobUrl();
+      const head = queue.shift();
+      if (queue.length === 0) setLoading(false);
+      if (head) head.resolve(e.data);
+    });
+    worker2.addEventListener("error", (e) => {
+      revokeBlobUrl();
+      const err = new Error(e.message || "Worker error");
+      while (queue.length > 0) queue.shift().reject(err);
+      setLoading(false);
+      if (worker2) {
+        worker2.terminate();
+        worker2 = null;
+      }
+    });
   } catch {
+    revokeBlobUrl();
   }
   function run(...args) {
     return new Promise((resolve, reject) => {
@@ -213,14 +251,7 @@ function workerFn(fn) {
         return;
       }
       setLoading(true);
-      worker2.onmessage = (e) => {
-        setLoading(false);
-        resolve(e.data);
-      };
-      worker2.onerror = (e) => {
-        setLoading(false);
-        reject(new Error(e.message || "Worker error"));
-      };
+      queue.push({ resolve, reject });
       worker2.postMessage(args);
     });
   }
@@ -228,6 +259,9 @@ function workerFn(fn) {
     if (!worker2) return;
     worker2.terminate();
     worker2 = null;
+    const err = new Error("Worker terminated");
+    while (queue.length > 0) queue.shift().reject(err);
+    revokeBlobUrl();
     setLoading(false);
   }
   return { run, loading, terminate };
@@ -235,20 +269,63 @@ function workerFn(fn) {
 function createWorkerPool(workerFn2, poolSize) {
   const size = poolSize || typeof navigator !== "undefined" && navigator.hardwareConcurrency || 4;
   const workers = [];
+  const queues = [];
+  const inflight = [];
   let currentIndex = 0;
   let alive = true;
+  let blobUrl = null;
+  let firedOnce = false;
+  const revokeBlobUrl = () => {
+    if (blobUrl) {
+      URL.revokeObjectURL(blobUrl);
+      blobUrl = null;
+    }
+  };
+  function dispatchNext(idx) {
+    if (!alive || inflight[idx] || queues[idx].length === 0) return;
+    const w = workers[idx];
+    const slot = queues[idx].shift();
+    const onMsg = (e) => {
+      if (!firedOnce) {
+        firedOnce = true;
+        revokeBlobUrl();
+      }
+      w.removeEventListener("message", onMsg);
+      w.removeEventListener("error", onErr);
+      inflight[idx] = null;
+      slot.resolve(e.data);
+      dispatchNext(idx);
+    };
+    const onErr = (e) => {
+      if (!firedOnce) {
+        firedOnce = true;
+        revokeBlobUrl();
+      }
+      w.removeEventListener("message", onMsg);
+      w.removeEventListener("error", onErr);
+      inflight[idx] = null;
+      slot.reject(new Error(e.message || "Worker error"));
+      dispatchNext(idx);
+    };
+    inflight[idx] = { ...slot, onMsg, onErr };
+    w.addEventListener("message", onMsg);
+    w.addEventListener("error", onErr);
+    w.postMessage(slot.data);
+  }
   try {
     if (typeof Worker === "undefined") {
       throw new Error("Web Workers are not supported in this environment");
     }
     const fnBody = workerFn2.toString();
     const blob = new Blob([`self.onmessage = ${fnBody};`], { type: "application/javascript" });
-    const url = URL.createObjectURL(blob);
+    blobUrl = URL.createObjectURL(blob);
     for (let i = 0; i < size; i++) {
-      workers.push(new Worker(url));
+      workers.push(new Worker(blobUrl));
+      queues.push([]);
+      inflight.push(null);
     }
-    URL.revokeObjectURL(url);
   } catch {
+    revokeBlobUrl();
   }
   function execute(data) {
     return new Promise((resolve, reject) => {
@@ -256,23 +333,25 @@ function createWorkerPool(workerFn2, poolSize) {
         reject(new Error("Worker pool is not available"));
         return;
       }
-      const worker2 = workers[currentIndex % workers.length];
+      const idx = currentIndex % workers.length;
       currentIndex++;
-      worker2.onmessage = (e) => {
-        resolve(e.data);
-      };
-      worker2.onerror = (e) => {
-        reject(new Error(e.message || "Worker error"));
-      };
-      worker2.postMessage(data);
+      queues[idx].push({ data, resolve, reject });
+      dispatchNext(idx);
     });
   }
   function terminate() {
     alive = false;
-    for (const w of workers) {
-      w.terminate();
+    for (const w of workers) w.terminate();
+    const err = new Error("Worker pool terminated");
+    for (let i = 0; i < queues.length; i++) {
+      const inf = inflight[i];
+      if (inf) inf.reject(err);
+      for (const s of queues[i]) s.reject(err);
+      queues[i] = [];
+      inflight[i] = null;
     }
     workers.length = 0;
+    revokeBlobUrl();
   }
   return { execute, terminate };
 }
@@ -308,7 +387,28 @@ function wasm(source, config = {}) {
   };
 }
 async function loadWasmModule(source, imports, cacheKey) {
-  const key = cacheKey || (typeof source === "string" ? source : void 0);
+  const isOptionsBag = !!(imports && ("allowedOrigins" in imports || "unsafelyAllowAnyOrigin" in imports));
+  const opts = isOptionsBag ? imports : { imports, cacheKey };
+  const wasmImports = opts.imports;
+  const key = opts.cacheKey || (typeof source === "string" ? source : void 0);
+  if (typeof source === "string") {
+    const allowed = opts.allowedOrigins ?? [];
+    if (allowed.length > 0) {
+      let parsed;
+      try {
+        parsed = new URL(source, typeof location !== "undefined" ? location.href : void 0);
+      } catch {
+        throw new Error(`loadWasmModule: invalid URL "${source}"`);
+      }
+      if (!allowed.includes(parsed.origin)) {
+        throw new Error(`loadWasmModule: origin "${parsed.origin}" is not in the allowlist`);
+      }
+    } else if (!opts.unsafelyAllowAnyOrigin) {
+      throw new Error(
+        `loadWasmModule: refused to fetch "${source}" with no allowedOrigins. Pass { allowedOrigins: [...] } to restrict the origin, or { unsafelyAllowAnyOrigin: true } to opt in (CWE-829).`
+      );
+    }
+  }
   if (key) {
     const cachedInstance = instanceCache.get(key);
     if (cachedInstance) {
@@ -324,7 +424,7 @@ async function loadWasmModule(source, imports, cacheKey) {
     if (typeof source === "string") {
       if (typeof WebAssembly.instantiateStreaming === "function") {
         const response2 = fetch(source);
-        const result = await WebAssembly.instantiateStreaming(response2, imports || {});
+        const result = await WebAssembly.instantiateStreaming(response2, wasmImports || {});
         if (key) {
           moduleCache.set(key, result.module);
           instanceCache.set(key, result.instance);
@@ -341,12 +441,28 @@ async function loadWasmModule(source, imports, cacheKey) {
     module = await WebAssembly.compile(bytes);
     if (key) moduleCache.set(key, module);
   }
-  const instance = await WebAssembly.instantiate(module, imports || {});
+  const instance = await WebAssembly.instantiate(module, wasmImports || {});
   if (key) instanceCache.set(key, instance);
   return instance;
 }
-async function preloadWasm(url) {
+async function preloadWasm(url, options = {}) {
   if (moduleCache.has(url)) return;
+  const allowed = options.allowedOrigins ?? [];
+  if (allowed.length > 0) {
+    let parsed;
+    try {
+      parsed = new URL(url, typeof location !== "undefined" ? location.href : void 0);
+    } catch {
+      throw new Error(`preloadWasm: invalid URL "${url}"`);
+    }
+    if (!allowed.includes(parsed.origin)) {
+      throw new Error(`preloadWasm: origin "${parsed.origin}" is not in the allowlist`);
+    }
+  } else if (!options.unsafelyAllowAnyOrigin) {
+    throw new Error(
+      `preloadWasm: refused to fetch "${url}" with no allowedOrigins. Pass { allowedOrigins: [...] } or { unsafelyAllowAnyOrigin: true } (CWE-829).`
+    );
+  }
   let module;
   if (typeof WebAssembly.compileStreaming === "function") {
     module = await WebAssembly.compileStreaming(fetch(url));
@@ -415,31 +531,38 @@ function createMicroApp(config) {
   }
   let mounted = false;
   function mount(component) {
-    if (root instanceof ShadowRoot) {
-      root.innerHTML = "";
-    } else {
-      while (root.firstChild) {
-        root.removeChild(root.firstChild);
-      }
-    }
+    root.replaceChildren();
     const el = component();
     root.appendChild(el);
     mounted = true;
   }
   function unmount() {
     if (!mounted) return;
-    if (root instanceof ShadowRoot) {
-      root.innerHTML = "";
-    } else {
-      while (root.firstChild) {
-        root.removeChild(root.firstChild);
-      }
-    }
+    root.replaceChildren();
     mounted = false;
   }
   return { mount, unmount, element: host };
 }
-function loadRemoteModule(url) {
+function loadRemoteModule(url, optionsOrAllowedOrigins = []) {
+  const opts = Array.isArray(optionsOrAllowedOrigins) ? { allowedOrigins: optionsOrAllowedOrigins } : optionsOrAllowedOrigins;
+  const allowedOrigins = opts.allowedOrigins ?? [];
+  if (allowedOrigins.length > 0) {
+    let parsed;
+    try {
+      parsed = new URL(url, typeof location !== "undefined" ? location.href : void 0);
+    } catch {
+      return Promise.reject(new Error(`loadRemoteModule: invalid URL "${url}"`));
+    }
+    if (!allowedOrigins.includes(parsed.origin)) {
+      return Promise.reject(new Error(`loadRemoteModule: origin "${parsed.origin}" is not in the allowlist`));
+    }
+  } else if (!opts.unsafelyAllowAnyOrigin) {
+    return Promise.reject(
+      new Error(
+        `loadRemoteModule: refused to import "${url}" with no allowedOrigins. Pass { allowedOrigins: [...] } to restrict the origin, or { unsafelyAllowAnyOrigin: true } to opt in to unrestricted imports (CWE-829).`
+      )
+    );
+  }
   const cached = moduleCache2.get(url);
   if (cached) return cached;
   const promise = import(
@@ -529,21 +652,49 @@ function serviceWorker(scriptUrl, options) {
   const [isReady, setIsReady] = signal(false);
   const [isUpdateAvailable, setIsUpdateAvailable] = signal(false);
   const [error, setError] = signal(null);
+  let disposed = false;
+  let updateFoundHandler = null;
+  let stateChangeHandler = null;
+  let trackedWorker = null;
+  let trackedReg = null;
+  function detachListeners() {
+    if (trackedReg && updateFoundHandler) {
+      trackedReg.removeEventListener("updatefound", updateFoundHandler);
+    }
+    if (trackedWorker && stateChangeHandler) {
+      trackedWorker.removeEventListener("statechange", stateChangeHandler);
+    }
+    updateFoundHandler = null;
+    stateChangeHandler = null;
+    trackedWorker = null;
+    trackedReg = null;
+  }
   if ("serviceWorker" in navigator) {
     navigator.serviceWorker.register(scriptUrl, options).then((reg) => {
+      if (disposed) return;
       setRegistration(reg);
       setIsReady(true);
-      reg.addEventListener("updatefound", () => {
+      trackedReg = reg;
+      updateFoundHandler = () => {
+        if (disposed) return;
         const newWorker = reg.installing;
         if (newWorker) {
-          newWorker.addEventListener("statechange", () => {
+          if (trackedWorker && stateChangeHandler) {
+            trackedWorker.removeEventListener("statechange", stateChangeHandler);
+          }
+          trackedWorker = newWorker;
+          stateChangeHandler = () => {
+            if (disposed) return;
             if (newWorker.state === "installed" && navigator.serviceWorker.controller) {
               setIsUpdateAvailable(true);
             }
-          });
+          };
+          newWorker.addEventListener("statechange", stateChangeHandler);
         }
-      });
+      };
+      reg.addEventListener("updatefound", updateFoundHandler);
     }).catch((err) => {
+      if (disposed) return;
       setError(err instanceof Error ? err : new Error(String(err)));
     });
   }
@@ -554,6 +705,8 @@ function serviceWorker(scriptUrl, options) {
     }
   }
   async function unregister() {
+    disposed = true;
+    detachListeners();
     const reg = registration();
     if (reg) {
       const result = await reg.unregister();
@@ -592,24 +745,42 @@ function createISR(options) {
   const { revalidateAfter, fetcher, initialData } = options;
   const [data, setData] = signal(initialData);
   const [timestamp, setTimestamp] = signal(initialData !== void 0 ? Date.now() : 0);
+  const controller = new AbortController();
+  let inFlight = false;
+  let disposed = false;
   const isStale = () => {
     const ts = timestamp();
     if (ts === 0) return true;
     return Date.now() - ts >= revalidateAfter;
   };
   const revalidate = async () => {
-    const result = await fetcher();
-    setData(result);
-    setTimestamp(Date.now());
+    if (disposed || inFlight) return;
+    if (controller.signal.aborted) return;
+    inFlight = true;
+    try {
+      const result = await fetcher({ signal: controller.signal });
+      if (disposed || controller.signal.aborted) return;
+      setData(result);
+      setTimestamp(Date.now());
+    } finally {
+      inFlight = false;
+    }
   };
   if (initialData === void 0) {
-    revalidate();
+    revalidate().catch((err) => {
+      if (typeof console !== "undefined") console.warn("[SibuJS ISR] initial fetch failed", err);
+    });
   }
   const intervalId = setInterval(() => {
-    revalidate();
+    revalidate().catch((err) => {
+      if (typeof console !== "undefined") console.warn("[SibuJS ISR] revalidate failed", err);
+    });
   }, revalidateAfter);
   const dispose = () => {
+    if (disposed) return;
+    disposed = true;
     clearInterval(intervalId);
+    controller.abort();
   };
   return { data, isStale, revalidate, dispose };
 }

package/dist/chunk-UCS6AMJ7.js

@@ -0,0 +1,79 @@
+// src/utils/sanitize.ts
+var SAFE_URL_PROTOCOLS = ["http:", "https:", "mailto:", "tel:", "ftp:"];
+function sanitizeUrl(url) {
+  const trimmed = url.replace(/[\x00-\x20\x7f-\x9f]+/g, "").trim();
+  if (!trimmed) return "";
+  const lower = trimmed.toLowerCase();
+  let schemeEnd = -1;
+  for (let i = 0; i < lower.length; i++) {
+    const ch = lower.charCodeAt(i);
+    if (ch === 58) {
+      schemeEnd = i;
+      break;
+    }
+    if (ch === 47 || ch === 63 || ch === 35) break;
+  }
+  if (schemeEnd === -1) return trimmed;
+  const scheme = lower.slice(0, schemeEnd + 1);
+  if (!/^[a-z][a-z0-9+.-]*:$/.test(scheme)) return trimmed;
+  if (SAFE_URL_PROTOCOLS.indexOf(scheme) === -1) return "";
+  return trimmed;
+}
+function sanitizeSrcset(value) {
+  const parts = value.split(",");
+  const out = [];
+  for (let i = 0; i < parts.length; i++) {
+    const part = parts[i].trim();
+    if (!part) continue;
+    const m = part.match(/^(\S+)(\s+.+)?$/);
+    if (!m) continue;
+    const safe = sanitizeUrl(m[1]);
+    if (!safe) continue;
+    out.push(m[2] ? `${safe}${m[2]}` : safe);
+  }
+  return out.join(", ");
+}
+function sanitizeCSSValue(value) {
+  const decoded = value.replace(/\\([0-9a-fA-F]{1,6})\s?/g, (_m, hex) => {
+    const code = Number.parseInt(hex, 16);
+    if (!Number.isFinite(code) || code < 0 || code > 1114111) return "";
+    try {
+      return String.fromCodePoint(code);
+    } catch {
+      return "";
+    }
+  });
+  const lower = decoded.toLowerCase().replace(/\s+/g, "");
+  if (lower.includes("url(") || lower.includes("expression(") || lower.includes("javascript:") || lower.includes("vbscript:") || lower.includes("-moz-binding") || lower.includes("behavior:") || lower.includes("@import") || lower.includes("image-set(") || lower.includes("filter:progid")) {
+    return "";
+  }
+  return value;
+}
+function stripHtml(html) {
+  return String(html).replace(/<[^>]*>/g, "");
+}
+var URL_ATTRIBUTES = /* @__PURE__ */ new Set([
+  "href",
+  "xlink:href",
+  "src",
+  "action",
+  "formaction",
+  "formtarget",
+  "cite",
+  "poster",
+  "background",
+  "srcset",
+  "ping",
+  "data"
+]);
+function isUrlAttribute(attr) {
+  return URL_ATTRIBUTES.has(attr);
+}
+
+export {
+  sanitizeUrl,
+  sanitizeSrcset,
+  sanitizeCSSValue,
+  stripHtml,
+  isUrlAttribute
+};