sibujs 1.5.0 → 2.1.0

package/dist/{chunk-2BYQDGN3.js → chunk-KGYT6UO6.js}

@@ -1,17 +1,17 @@
 import {
   div,
   span
-} from "./chunk-32DY64NT.js";
+} from "./chunk-CWBVQML6.js";
 import {
   sanitizeUrl
-} from "./chunk-CMBFNA7L.js";
+} from "./chunk-UCS6AMJ7.js";
 import {
   effect
-} from "./chunk-CHF5OHIA.js";
+} from "./chunk-WZA53FXU.js";
 import {
   batch,
   signal
-} from "./chunk-WZSPOOER.js";
+} from "./chunk-RDTDJCAB.js";
 
 // src/platform/head.ts
 var HEAD_URL_ATTRS = /* @__PURE__ */ new Set(["href", "src"]);
@@ -148,24 +148,37 @@ function worker(workerFn2) {
   const [error, setError] = signal(null);
   const [loading, setLoading] = signal(false);
   let worker2 = null;
+  let blobUrl = null;
+  const revokeBlobUrl = () => {
+    if (blobUrl) {
+      URL.revokeObjectURL(blobUrl);
+      blobUrl = null;
+    }
+  };
   try {
     if (typeof Worker === "undefined") {
       throw new Error("Web Workers are not supported in this environment");
     }
     const fnBody = workerFn2.toString();
     const blob = new Blob([`self.onmessage = ${fnBody};`], { type: "application/javascript" });
-    const url = URL.createObjectURL(blob);
-    worker2 = new Worker(url);
-    URL.revokeObjectURL(url);
-    worker2.onmessage = (e) => {
+    blobUrl = URL.createObjectURL(blob);
+    worker2 = new Worker(blobUrl);
+    worker2.addEventListener("message", (e) => {
+      revokeBlobUrl();
       setResult(e.data);
       setLoading(false);
-    };
-    worker2.onerror = (e) => {
+    });
+    worker2.addEventListener("error", (e) => {
+      revokeBlobUrl();
       setError(new Error(e.message || "Worker error"));
       setLoading(false);
-    };
+      if (worker2) {
+        worker2.terminate();
+        worker2 = null;
+      }
+    });
   } catch (err) {
+    revokeBlobUrl();
     setError(err instanceof Error ? err : new Error(String(err)));
   }
   function post(data) {
@@ -179,6 +192,7 @@ function worker(workerFn2) {
     if (!worker2) return;
     worker2.terminate();
     worker2 = null;
+    revokeBlobUrl();
     setLoading(false);
   }
   return { post, result, error, loading, terminate };
@@ -186,6 +200,14 @@ function worker(workerFn2) {
 function workerFn(fn) {
   const [loading, setLoading] = signal(false);
   let worker2 = null;
+  let blobUrl = null;
+  const revokeBlobUrl = () => {
+    if (blobUrl) {
+      URL.revokeObjectURL(blobUrl);
+      blobUrl = null;
+    }
+  };
+  const queue = [];
   try {
     if (typeof Worker === "undefined") {
       throw new Error("Web Workers are not supported in this environment");
@@ -201,10 +223,26 @@ function workerFn(fn) {
       ],
       { type: "application/javascript" }
     );
-    const url = URL.createObjectURL(blob);
-    worker2 = new Worker(url);
-    URL.revokeObjectURL(url);
+    blobUrl = URL.createObjectURL(blob);
+    worker2 = new Worker(blobUrl);
+    worker2.addEventListener("message", (e) => {
+      revokeBlobUrl();
+      const head = queue.shift();
+      if (queue.length === 0) setLoading(false);
+      if (head) head.resolve(e.data);
+    });
+    worker2.addEventListener("error", (e) => {
+      revokeBlobUrl();
+      const err = new Error(e.message || "Worker error");
+      while (queue.length > 0) queue.shift().reject(err);
+      setLoading(false);
+      if (worker2) {
+        worker2.terminate();
+        worker2 = null;
+      }
+    });
   } catch {
+    revokeBlobUrl();
   }
   function run(...args) {
     return new Promise((resolve, reject) => {
@@ -213,14 +251,7 @@ function workerFn(fn) {
         return;
       }
       setLoading(true);
-      worker2.onmessage = (e) => {
-        setLoading(false);
-        resolve(e.data);
-      };
-      worker2.onerror = (e) => {
-        setLoading(false);
-        reject(new Error(e.message || "Worker error"));
-      };
+      queue.push({ resolve, reject });
       worker2.postMessage(args);
     });
   }
@@ -228,6 +259,9 @@ function workerFn(fn) {
     if (!worker2) return;
     worker2.terminate();
     worker2 = null;
+    const err = new Error("Worker terminated");
+    while (queue.length > 0) queue.shift().reject(err);
+    revokeBlobUrl();
     setLoading(false);
   }
   return { run, loading, terminate };
@@ -235,20 +269,63 @@ function workerFn(fn) {
 function createWorkerPool(workerFn2, poolSize) {
   const size = poolSize || typeof navigator !== "undefined" && navigator.hardwareConcurrency || 4;
   const workers = [];
+  const queues = [];
+  const inflight = [];
   let currentIndex = 0;
   let alive = true;
+  let blobUrl = null;
+  let firedOnce = false;
+  const revokeBlobUrl = () => {
+    if (blobUrl) {
+      URL.revokeObjectURL(blobUrl);
+      blobUrl = null;
+    }
+  };
+  function dispatchNext(idx) {
+    if (!alive || inflight[idx] || queues[idx].length === 0) return;
+    const w = workers[idx];
+    const slot = queues[idx].shift();
+    const onMsg = (e) => {
+      if (!firedOnce) {
+        firedOnce = true;
+        revokeBlobUrl();
+      }
+      w.removeEventListener("message", onMsg);
+      w.removeEventListener("error", onErr);
+      inflight[idx] = null;
+      slot.resolve(e.data);
+      dispatchNext(idx);
+    };
+    const onErr = (e) => {
+      if (!firedOnce) {
+        firedOnce = true;
+        revokeBlobUrl();
+      }
+      w.removeEventListener("message", onMsg);
+      w.removeEventListener("error", onErr);
+      inflight[idx] = null;
+      slot.reject(new Error(e.message || "Worker error"));
+      dispatchNext(idx);
+    };
+    inflight[idx] = { ...slot, onMsg, onErr };
+    w.addEventListener("message", onMsg);
+    w.addEventListener("error", onErr);
+    w.postMessage(slot.data);
+  }
   try {
     if (typeof Worker === "undefined") {
       throw new Error("Web Workers are not supported in this environment");
     }
     const fnBody = workerFn2.toString();
     const blob = new Blob([`self.onmessage = ${fnBody};`], { type: "application/javascript" });
-    const url = URL.createObjectURL(blob);
+    blobUrl = URL.createObjectURL(blob);
     for (let i = 0; i < size; i++) {
-      workers.push(new Worker(url));
+      workers.push(new Worker(blobUrl));
+      queues.push([]);
+      inflight.push(null);
     }
-    URL.revokeObjectURL(url);
   } catch {
+    revokeBlobUrl();
   }
   function execute(data) {
     return new Promise((resolve, reject) => {
@@ -256,23 +333,25 @@ function createWorkerPool(workerFn2, poolSize) {
         reject(new Error("Worker pool is not available"));
         return;
       }
-      const worker2 = workers[currentIndex % workers.length];
+      const idx = currentIndex % workers.length;
       currentIndex++;
-      worker2.onmessage = (e) => {
-        resolve(e.data);
-      };
-      worker2.onerror = (e) => {
-        reject(new Error(e.message || "Worker error"));
-      };
-      worker2.postMessage(data);
+      queues[idx].push({ data, resolve, reject });
+      dispatchNext(idx);
     });
   }
   function terminate() {
     alive = false;
-    for (const w of workers) {
-      w.terminate();
+    for (const w of workers) w.terminate();
+    const err = new Error("Worker pool terminated");
+    for (let i = 0; i < queues.length; i++) {
+      const inf = inflight[i];
+      if (inf) inf.reject(err);
+      for (const s of queues[i]) s.reject(err);
+      queues[i] = [];
+      inflight[i] = null;
     }
     workers.length = 0;
+    revokeBlobUrl();
   }
   return { execute, terminate };
 }
@@ -308,7 +387,28 @@ function wasm(source, config = {}) {
   };
 }
 async function loadWasmModule(source, imports, cacheKey) {
-  const key = cacheKey || (typeof source === "string" ? source : void 0);
+  const isOptionsBag = !!(imports && ("allowedOrigins" in imports || "unsafelyAllowAnyOrigin" in imports));
+  const opts = isOptionsBag ? imports : { imports, cacheKey };
+  const wasmImports = opts.imports;
+  const key = opts.cacheKey || (typeof source === "string" ? source : void 0);
+  if (typeof source === "string") {
+    const allowed = opts.allowedOrigins ?? [];
+    if (allowed.length > 0) {
+      let parsed;
+      try {
+        parsed = new URL(source, typeof location !== "undefined" ? location.href : void 0);
+      } catch {
+        throw new Error(`loadWasmModule: invalid URL "${source}"`);
+      }
+      if (!allowed.includes(parsed.origin)) {
+        throw new Error(`loadWasmModule: origin "${parsed.origin}" is not in the allowlist`);
+      }
+    } else if (!opts.unsafelyAllowAnyOrigin) {
+      throw new Error(
+        `loadWasmModule: refused to fetch "${source}" with no allowedOrigins. Pass { allowedOrigins: [...] } to restrict the origin, or { unsafelyAllowAnyOrigin: true } to opt in (CWE-829).`
+      );
+    }
+  }
   if (key) {
     const cachedInstance = instanceCache.get(key);
     if (cachedInstance) {
@@ -324,7 +424,7 @@ async function loadWasmModule(source, imports, cacheKey) {
     if (typeof source === "string") {
       if (typeof WebAssembly.instantiateStreaming === "function") {
         const response2 = fetch(source);
-        const result = await WebAssembly.instantiateStreaming(response2, imports || {});
+        const result = await WebAssembly.instantiateStreaming(response2, wasmImports || {});
         if (key) {
           moduleCache.set(key, result.module);
           instanceCache.set(key, result.instance);
@@ -341,12 +441,28 @@ async function loadWasmModule(source, imports, cacheKey) {
     module = await WebAssembly.compile(bytes);
     if (key) moduleCache.set(key, module);
   }
-  const instance = await WebAssembly.instantiate(module, imports || {});
+  const instance = await WebAssembly.instantiate(module, wasmImports || {});
   if (key) instanceCache.set(key, instance);
   return instance;
 }
-async function preloadWasm(url) {
+async function preloadWasm(url, options = {}) {
   if (moduleCache.has(url)) return;
+  const allowed = options.allowedOrigins ?? [];
+  if (allowed.length > 0) {
+    let parsed;
+    try {
+      parsed = new URL(url, typeof location !== "undefined" ? location.href : void 0);
+    } catch {
+      throw new Error(`preloadWasm: invalid URL "${url}"`);
+    }
+    if (!allowed.includes(parsed.origin)) {
+      throw new Error(`preloadWasm: origin "${parsed.origin}" is not in the allowlist`);
+    }
+  } else if (!options.unsafelyAllowAnyOrigin) {
+    throw new Error(
+      `preloadWasm: refused to fetch "${url}" with no allowedOrigins. Pass { allowedOrigins: [...] } or { unsafelyAllowAnyOrigin: true } (CWE-829).`
+    );
+  }
   let module;
   if (typeof WebAssembly.compileStreaming === "function") {
     module = await WebAssembly.compileStreaming(fetch(url));
@@ -415,31 +531,38 @@ function createMicroApp(config) {
   }
   let mounted = false;
   function mount(component) {
-    if (root instanceof ShadowRoot) {
-      root.innerHTML = "";
-    } else {
-      while (root.firstChild) {
-        root.removeChild(root.firstChild);
-      }
-    }
+    root.replaceChildren();
     const el = component();
     root.appendChild(el);
     mounted = true;
   }
   function unmount() {
     if (!mounted) return;
-    if (root instanceof ShadowRoot) {
-      root.innerHTML = "";
-    } else {
-      while (root.firstChild) {
-        root.removeChild(root.firstChild);
-      }
-    }
+    root.replaceChildren();
     mounted = false;
   }
   return { mount, unmount, element: host };
 }
-function loadRemoteModule(url) {
+function loadRemoteModule(url, optionsOrAllowedOrigins = []) {
+  const opts = Array.isArray(optionsOrAllowedOrigins) ? { allowedOrigins: optionsOrAllowedOrigins } : optionsOrAllowedOrigins;
+  const allowedOrigins = opts.allowedOrigins ?? [];
+  if (allowedOrigins.length > 0) {
+    let parsed;
+    try {
+      parsed = new URL(url, typeof location !== "undefined" ? location.href : void 0);
+    } catch {
+      return Promise.reject(new Error(`loadRemoteModule: invalid URL "${url}"`));
+    }
+    if (!allowedOrigins.includes(parsed.origin)) {
+      return Promise.reject(new Error(`loadRemoteModule: origin "${parsed.origin}" is not in the allowlist`));
+    }
+  } else if (!opts.unsafelyAllowAnyOrigin) {
+    return Promise.reject(
+      new Error(
+        `loadRemoteModule: refused to import "${url}" with no allowedOrigins. Pass { allowedOrigins: [...] } to restrict the origin, or { unsafelyAllowAnyOrigin: true } to opt in to unrestricted imports (CWE-829).`
+      )
+    );
+  }
   const cached = moduleCache2.get(url);
   if (cached) return cached;
   const promise = import(
@@ -529,21 +652,49 @@ function serviceWorker(scriptUrl, options) {
   const [isReady, setIsReady] = signal(false);
   const [isUpdateAvailable, setIsUpdateAvailable] = signal(false);
   const [error, setError] = signal(null);
+  let disposed = false;
+  let updateFoundHandler = null;
+  let stateChangeHandler = null;
+  let trackedWorker = null;
+  let trackedReg = null;
+  function detachListeners() {
+    if (trackedReg && updateFoundHandler) {
+      trackedReg.removeEventListener("updatefound", updateFoundHandler);
+    }
+    if (trackedWorker && stateChangeHandler) {
+      trackedWorker.removeEventListener("statechange", stateChangeHandler);
+    }
+    updateFoundHandler = null;
+    stateChangeHandler = null;
+    trackedWorker = null;
+    trackedReg = null;
+  }
   if ("serviceWorker" in navigator) {
     navigator.serviceWorker.register(scriptUrl, options).then((reg) => {
+      if (disposed) return;
       setRegistration(reg);
       setIsReady(true);
-      reg.addEventListener("updatefound", () => {
+      trackedReg = reg;
+      updateFoundHandler = () => {
+        if (disposed) return;
         const newWorker = reg.installing;
         if (newWorker) {
-          newWorker.addEventListener("statechange", () => {
+          if (trackedWorker && stateChangeHandler) {
+            trackedWorker.removeEventListener("statechange", stateChangeHandler);
+          }
+          trackedWorker = newWorker;
+          stateChangeHandler = () => {
+            if (disposed) return;
             if (newWorker.state === "installed" && navigator.serviceWorker.controller) {
               setIsUpdateAvailable(true);
             }
-          });
+          };
+          newWorker.addEventListener("statechange", stateChangeHandler);
         }
-      });
+      };
+      reg.addEventListener("updatefound", updateFoundHandler);
     }).catch((err) => {
+      if (disposed) return;
       setError(err instanceof Error ? err : new Error(String(err)));
     });
   }
@@ -554,6 +705,8 @@ function serviceWorker(scriptUrl, options) {
     }
   }
   async function unregister() {
+    disposed = true;
+    detachListeners();
     const reg = registration();
     if (reg) {
       const result = await reg.unregister();
@@ -592,24 +745,42 @@ function createISR(options) {
   const { revalidateAfter, fetcher, initialData } = options;
   const [data, setData] = signal(initialData);
   const [timestamp, setTimestamp] = signal(initialData !== void 0 ? Date.now() : 0);
+  const controller = new AbortController();
+  let inFlight = false;
+  let disposed = false;
   const isStale = () => {
     const ts = timestamp();
     if (ts === 0) return true;
     return Date.now() - ts >= revalidateAfter;
   };
   const revalidate = async () => {
-    const result = await fetcher();
-    setData(result);
-    setTimestamp(Date.now());
+    if (disposed || inFlight) return;
+    if (controller.signal.aborted) return;
+    inFlight = true;
+    try {
+      const result = await fetcher({ signal: controller.signal });
+      if (disposed || controller.signal.aborted) return;
+      setData(result);
+      setTimestamp(Date.now());
+    } finally {
+      inFlight = false;
+    }
   };
   if (initialData === void 0) {
-    revalidate();
+    revalidate().catch((err) => {
+      if (typeof console !== "undefined") console.warn("[SibuJS ISR] initial fetch failed", err);
+    });
   }
   const intervalId = setInterval(() => {
-    revalidate();
+    revalidate().catch((err) => {
+      if (typeof console !== "undefined") console.warn("[SibuJS ISR] revalidate failed", err);
+    });
   }, revalidateAfter);
   const dispose = () => {
+    if (disposed) return;
+    disposed = true;
     clearInterval(intervalId);
+    controller.abort();
   };
   return { data, isStale, revalidate, dispose };
 }

package/dist/{chunk-5X6PP2UK.js → chunk-LMLD24FC.js}

@@ -11,12 +11,12 @@ function isDev() {
 var _isDev = isDev();
 function devAssert(condition, message) {
   if (_isDev && !condition) {
-    throw new Error(`[Sibu] ${message}`);
+    throw new Error(`[SibuJS] ${message}`);
   }
 }
 function devWarn(message) {
   if (_isDev) {
-    console.warn(`[Sibu] ${message}`);
+    console.warn(`[SibuJS] ${message}`);
   }
 }
 

package/dist/{chunk-M4NLBH4I.js → chunk-LYTCUZ7H.js}

@@ -1,6 +1,6 @@
 import {
   renderToString
-} from "./chunk-3X2YG6YM.js";
+} from "./chunk-JYD2PWXH.js";
 
 // src/plugins/modular.ts
 function createModuleRegistry() {
@@ -476,7 +476,8 @@ function extractRangeTarget(range) {
 function preloadCritical(resources) {
   if (typeof document === "undefined") return;
   for (const resource of resources) {
-    const existing = document.querySelector(`link[rel="preload"][href="${resource.href}"]`);
+    const safeHref = typeof CSS !== "undefined" && typeof CSS.escape === "function" ? CSS.escape(resource.href) : resource.href.replace(/["\\]/g, "\\$&");
+    const existing = document.querySelector(`link[rel="preload"][href="${safeHref}"]`);
     if (existing) continue;
     const link = document.createElement("link");
     link.rel = "preload";

package/dist/{chunk-XUEEGU5O.js → chunk-NASX6ST2.js}

@@ -1,6 +1,6 @@
 import {
   signal
-} from "./chunk-NZIIMDWI.js";
+} from "./chunk-RDTDJCAB.js";
 
 // src/ui/transition.ts
 function transition(element, options = {}) {
@@ -345,15 +345,24 @@ function springSignal(initial, options) {
   let velocity = 0;
   let target = initial;
   let rafId = null;
-  function tick() {
+  let lastTime = 0;
+  const REF_DT_MS = 1e3 / 60;
+  const MAX_STEP_RATIO = 4;
+  function tick(now) {
+    if (lastTime === 0) lastTime = now;
+    const rawDt = now - lastTime;
+    lastTime = now;
+    const dt = Number.isFinite(rawDt) && rawDt > 0 ? rawDt : REF_DT_MS;
+    const ratio = Math.min(MAX_STEP_RATIO, Math.max(0.1, dt / REF_DT_MS));
     const force = -stiffness * (current - target);
     const dampingForce = -damping * velocity;
-    velocity += force + dampingForce;
-    current += velocity;
+    velocity += (force + dampingForce) * ratio;
+    current += velocity * ratio;
     if (Math.abs(current - target) < precision && Math.abs(velocity) < precision) {
       current = target;
       velocity = 0;
       rafId = null;
+      lastTime = 0;
       setValue(current);
       return;
     }
@@ -369,10 +378,12 @@ function springSignal(initial, options) {
         cancelAnimationFrame(rafId);
         rafId = null;
       }
+      lastTime = 0;
       setValue(current);
       return;
     }
     if (rafId === null) {
+      lastTime = 0;
       rafId = requestAnimationFrame(tick);
     }
   }
@@ -381,6 +392,7 @@ function springSignal(initial, options) {
       cancelAnimationFrame(rafId);
       rafId = null;
     }
+    lastTime = 0;
   }
   return [value, set, dispose];
 }