sibujs 1.5.0 → 2.1.0

package/dist/ssr.d.cts

@@ -1,4 +1,4 @@
-export { H as HydrateOptions, a as HydrationMismatch, T as TrustedHTML, c as collectStream, d as deserializeState, e as escapeScriptJson, h as hydrate, b as hydrateIslands, f as hydrateProgressively, i as island, r as renderToDocument, g as renderToReadableStream, j as renderToStream, k as renderToString, l as renderToSuspenseStream, m as resetSSRState, s as serializeState, n as ssrSuspense, o as suspenseSwapScript, t as trustHTML } from './ssr-Do_SiVoL.cjs';
+export { H as HydrateOptions, a as HydrationMismatch, T as TrustedHTML, c as collectStream, d as deserializeState, e as escapeScriptJson, h as hydrate, b as hydrateIslands, f as hydrateProgressively, i as island, r as renderToDocument, g as renderToReadableStream, j as renderToStream, k as renderToString, l as renderToSuspenseStream, m as resetSSRState, s as serializeState, n as ssrSuspense, o as suspenseSwapScript, t as trustHTML } from './ssr-CrVNy6Pa.cjs';
 
 interface HeadProps {
     title?: string | (() => string);
@@ -140,12 +140,24 @@ declare function wasm<T extends Record<string, unknown> = Record<string, unknown
  * Supports loading from URL, ArrayBuffer, or Uint8Array.
  * Caches compiled modules for reuse.
  */
-declare function loadWasmModule(source: string | ArrayBuffer | Uint8Array, imports?: WebAssembly.Imports, cacheKey?: string): Promise<WebAssembly.Instance>;
+interface LoadWasmOptions {
+    imports?: WebAssembly.Imports;
+    cacheKey?: string;
+    allowedOrigins?: string[];
+    /** Required when source is a URL and allowedOrigins is empty. WASM is
+     *  compiled code with imports into JS memory — fetching from any URL is
+     *  a supply-chain risk equivalent to remote module import (CWE-829). */
+    unsafelyAllowAnyOrigin?: boolean;
+}
+declare function loadWasmModule(source: string | ArrayBuffer | Uint8Array, imports?: WebAssembly.Imports | LoadWasmOptions, cacheKey?: string): Promise<WebAssembly.Instance>;
 /**
  * Preload and compile a WASM module without instantiating it.
  * The compiled module is cached for instant instantiation later.
  */
-declare function preloadWasm(url: string): Promise<void>;
+declare function preloadWasm(url: string, options?: {
+    allowedOrigins?: string[];
+    unsafelyAllowAnyOrigin?: boolean;
+}): Promise<void>;
 /**
  * Create a type-safe bridge to a WASM module with automatic memory management.
  * Provides helpers for passing strings and arrays between JS and WASM.
@@ -236,7 +248,13 @@ declare function createMicroApp(config: MicroAppConfig): MicroApp;
  * const el = charts.BarChart({ data: [1, 2, 3] });
  * ```
  */
-declare function loadRemoteModule(url: string): Promise<unknown>;
+interface LoadRemoteModuleOptions {
+    allowedOrigins?: string[];
+    /** Required when allowedOrigins is empty. Forces a deliberate decision
+     *  to import code from any URL — equivalent to remote eval (CWE-829). */
+    unsafelyAllowAnyOrigin?: boolean;
+}
+declare function loadRemoteModule(url: string, optionsOrAllowedOrigins?: string[] | LoadRemoteModuleOptions): Promise<unknown>;
 type Component = () => HTMLElement;
 type RemoteLoader = () => Promise<{
     default: Component;
@@ -322,7 +340,9 @@ declare function generateStaticSite(options: SSGOptions): Promise<SSGResult>;
 
 interface ISROptions<T> {
     revalidateAfter: number;
-    fetcher: () => Promise<T>;
+    fetcher: (ctx?: {
+        signal: AbortSignal;
+    }) => Promise<T>;
     initialData?: T;
 }
 /**
@@ -389,4 +409,4 @@ declare function createMiddlewareChain(): {
     }) => Promise<void>;
 };
 
-export { type ActionFn, type ActionResult, Head, type ISROptions, type MicroApp, type MicroAppConfig, type MiddlewareFn, type SSGOptions, type SSGResult, type ScrollRestorationOptions, type ServiceWorkerState, type SharedScope, type UseWorkerFnReturn, type UseWorkerReturn, type WasmConfig, type WasmModuleState, type WorkerPool, clearWasmCache, composeMiddleware, createAction, createISR, createMicroApp, createMiddlewareChain, createSharedScope, createWasmBridge, createWorkerPool, defineRemoteComponent, generateStaticSite, isWasmCached, loadRemoteModule, loadWasmModule, preloadWasm, scrollRestoration, serviceWorker, setCanonical, setStructuredData, wasm, worker, workerFn };
+export { type ActionFn, type ActionResult, Head, type ISROptions, type LoadRemoteModuleOptions, type LoadWasmOptions, type MicroApp, type MicroAppConfig, type MiddlewareFn, type SSGOptions, type SSGResult, type ScrollRestorationOptions, type ServiceWorkerState, type SharedScope, type UseWorkerFnReturn, type UseWorkerReturn, type WasmConfig, type WasmModuleState, type WorkerPool, clearWasmCache, composeMiddleware, createAction, createISR, createMicroApp, createMiddlewareChain, createSharedScope, createWasmBridge, createWorkerPool, defineRemoteComponent, generateStaticSite, isWasmCached, loadRemoteModule, loadWasmModule, preloadWasm, scrollRestoration, serviceWorker, setCanonical, setStructuredData, wasm, worker, workerFn };

package/dist/ssr.d.ts

@@ -1,4 +1,4 @@
-export { H as HydrateOptions, a as HydrationMismatch, T as TrustedHTML, c as collectStream, d as deserializeState, e as escapeScriptJson, h as hydrate, b as hydrateIslands, f as hydrateProgressively, i as island, r as renderToDocument, g as renderToReadableStream, j as renderToStream, k as renderToString, l as renderToSuspenseStream, m as resetSSRState, s as serializeState, n as ssrSuspense, o as suspenseSwapScript, t as trustHTML } from './ssr-Do_SiVoL.js';
+export { H as HydrateOptions, a as HydrationMismatch, T as TrustedHTML, c as collectStream, d as deserializeState, e as escapeScriptJson, h as hydrate, b as hydrateIslands, f as hydrateProgressively, i as island, r as renderToDocument, g as renderToReadableStream, j as renderToStream, k as renderToString, l as renderToSuspenseStream, m as resetSSRState, s as serializeState, n as ssrSuspense, o as suspenseSwapScript, t as trustHTML } from './ssr-CrVNy6Pa.js';
 
 interface HeadProps {
     title?: string | (() => string);
@@ -140,12 +140,24 @@ declare function wasm<T extends Record<string, unknown> = Record<string, unknown
  * Supports loading from URL, ArrayBuffer, or Uint8Array.
  * Caches compiled modules for reuse.
  */
-declare function loadWasmModule(source: string | ArrayBuffer | Uint8Array, imports?: WebAssembly.Imports, cacheKey?: string): Promise<WebAssembly.Instance>;
+interface LoadWasmOptions {
+    imports?: WebAssembly.Imports;
+    cacheKey?: string;
+    allowedOrigins?: string[];
+    /** Required when source is a URL and allowedOrigins is empty. WASM is
+     *  compiled code with imports into JS memory — fetching from any URL is
+     *  a supply-chain risk equivalent to remote module import (CWE-829). */
+    unsafelyAllowAnyOrigin?: boolean;
+}
+declare function loadWasmModule(source: string | ArrayBuffer | Uint8Array, imports?: WebAssembly.Imports | LoadWasmOptions, cacheKey?: string): Promise<WebAssembly.Instance>;
 /**
  * Preload and compile a WASM module without instantiating it.
  * The compiled module is cached for instant instantiation later.
  */
-declare function preloadWasm(url: string): Promise<void>;
+declare function preloadWasm(url: string, options?: {
+    allowedOrigins?: string[];
+    unsafelyAllowAnyOrigin?: boolean;
+}): Promise<void>;
 /**
  * Create a type-safe bridge to a WASM module with automatic memory management.
  * Provides helpers for passing strings and arrays between JS and WASM.
@@ -236,7 +248,13 @@ declare function createMicroApp(config: MicroAppConfig): MicroApp;
  * const el = charts.BarChart({ data: [1, 2, 3] });
  * ```
  */
-declare function loadRemoteModule(url: string): Promise<unknown>;
+interface LoadRemoteModuleOptions {
+    allowedOrigins?: string[];
+    /** Required when allowedOrigins is empty. Forces a deliberate decision
+     *  to import code from any URL — equivalent to remote eval (CWE-829). */
+    unsafelyAllowAnyOrigin?: boolean;
+}
+declare function loadRemoteModule(url: string, optionsOrAllowedOrigins?: string[] | LoadRemoteModuleOptions): Promise<unknown>;
 type Component = () => HTMLElement;
 type RemoteLoader = () => Promise<{
     default: Component;
@@ -322,7 +340,9 @@ declare function generateStaticSite(options: SSGOptions): Promise<SSGResult>;
 
 interface ISROptions<T> {
     revalidateAfter: number;
-    fetcher: () => Promise<T>;
+    fetcher: (ctx?: {
+        signal: AbortSignal;
+    }) => Promise<T>;
     initialData?: T;
 }
 /**
@@ -389,4 +409,4 @@ declare function createMiddlewareChain(): {
     }) => Promise<void>;
 };
 
-export { type ActionFn, type ActionResult, Head, type ISROptions, type MicroApp, type MicroAppConfig, type MiddlewareFn, type SSGOptions, type SSGResult, type ScrollRestorationOptions, type ServiceWorkerState, type SharedScope, type UseWorkerFnReturn, type UseWorkerReturn, type WasmConfig, type WasmModuleState, type WorkerPool, clearWasmCache, composeMiddleware, createAction, createISR, createMicroApp, createMiddlewareChain, createSharedScope, createWasmBridge, createWorkerPool, defineRemoteComponent, generateStaticSite, isWasmCached, loadRemoteModule, loadWasmModule, preloadWasm, scrollRestoration, serviceWorker, setCanonical, setStructuredData, wasm, worker, workerFn };
+export { type ActionFn, type ActionResult, Head, type ISROptions, type LoadRemoteModuleOptions, type LoadWasmOptions, type MicroApp, type MicroAppConfig, type MiddlewareFn, type SSGOptions, type SSGResult, type ScrollRestorationOptions, type ServiceWorkerState, type SharedScope, type UseWorkerFnReturn, type UseWorkerReturn, type WasmConfig, type WasmModuleState, type WorkerPool, clearWasmCache, composeMiddleware, createAction, createISR, createMicroApp, createMiddlewareChain, createSharedScope, createWasmBridge, createWorkerPool, defineRemoteComponent, generateStaticSite, isWasmCached, loadRemoteModule, loadWasmModule, preloadWasm, scrollRestoration, serviceWorker, setCanonical, setStructuredData, wasm, worker, workerFn };

package/dist/ssr.js

@@ -22,7 +22,8 @@ import {
   wasm,
   worker,
   workerFn
-} from "./chunk-MYRV7VDM.js";
+} from "./chunk-KGYT6UO6.js";
+import "./chunk-CWBVQML6.js";
 import {
   collectStream,
   deserializeState,
@@ -41,16 +42,16 @@ import {
   ssrSuspense,
   suspenseSwapScript,
   trustHTML
-} from "./chunk-3X2YG6YM.js";
-import "./chunk-P3XWXJZU.js";
-import "./chunk-SFKNRVCU.js";
-import "./chunk-5ZYQ6KDD.js";
-import "./chunk-CMBFNA7L.js";
-import "./chunk-VQNQZCWJ.js";
-import "./chunk-EUZND3CB.js";
-import "./chunk-NZIIMDWI.js";
-import "./chunk-K4G4ZQNR.js";
-import "./chunk-5X6PP2UK.js";
+} from "./chunk-JYD2PWXH.js";
+import "./chunk-P2HSJDDN.js";
+import "./chunk-WIPZPFBQ.js";
+import "./chunk-2UPRY23K.js";
+import "./chunk-UCS6AMJ7.js";
+import "./chunk-WZA53FXU.js";
+import "./chunk-2RA7SHDA.js";
+import "./chunk-RDTDJCAB.js";
+import "./chunk-QO3WC6FS.js";
+import "./chunk-LMLD24FC.js";
 export {
   Head,
   clearWasmCache,

package/dist/{tagFactory-DaJ0YWX6.d.cts → tagFactory-S17H2qxu.d.cts}

@@ -1,3 +1,11 @@
+/**
+ * Canonical disposer/teardown signature used across the framework.
+ *
+ * Returned by `effect()`, `track()`, widget `bind()` methods, and other
+ * subscription/lifecycle helpers. All disposers MUST be idempotent — calling
+ * twice should be a no-op rather than an error.
+ */
+type Dispose = () => void;
 type NodeChild = Node | Element | Text | Comment | string | number | boolean | (() => NodeChild) | null | undefined;
 type NodeChildren = NodeChild | NodeChild[] | NodeChild[][] | (() => NodeChild | NodeChild[]);
 
@@ -44,4 +52,4 @@ interface TagProps {
  */
 declare const tagFactory: (tag: string, ns?: string) => (first?: TagProps | NodeChildren, second?: NodeChildren) => Element;
 
-export { type NodeChildren as N, SVG_NS as S, type TagProps as T, type NodeChild as a, tagFactory as t };
+export { type Dispose as D, type NodeChildren as N, SVG_NS as S, type TagProps as T, type NodeChild as a, tagFactory as t };

package/dist/{tagFactory-DaJ0YWX6.d.ts → tagFactory-S17H2qxu.d.ts}

@@ -1,3 +1,11 @@
+/**
+ * Canonical disposer/teardown signature used across the framework.
+ *
+ * Returned by `effect()`, `track()`, widget `bind()` methods, and other
+ * subscription/lifecycle helpers. All disposers MUST be idempotent — calling
+ * twice should be a no-op rather than an error.
+ */
+type Dispose = () => void;
 type NodeChild = Node | Element | Text | Comment | string | number | boolean | (() => NodeChild) | null | undefined;
 type NodeChildren = NodeChild | NodeChild[] | NodeChild[][] | (() => NodeChild | NodeChild[]);
 
@@ -44,4 +52,4 @@ interface TagProps {
  */
 declare const tagFactory: (tag: string, ns?: string) => (first?: TagProps | NodeChildren, second?: NodeChildren) => Element;
 
-export { type NodeChildren as N, SVG_NS as S, type TagProps as T, type NodeChild as a, tagFactory as t };
+export { type Dispose as D, type NodeChildren as N, SVG_NS as S, type TagProps as T, type NodeChild as a, tagFactory as t };