sibujs 3.4.0 → 4.0.0

package/dist/{chunk-ODXVQ3CS.js → chunk-VFHIVEPF.js}

@@ -1,59 +1,87 @@
+import {
+  acquireBase,
+  acquireScrollRestorationMode,
+  acquireTitle
+} from "./chunk-52XFPGSN.js";
 import {
   div,
   span
-} from "./chunk-3Z2NGWQI.js";
+} from "./chunk-ES2GERY2.js";
+import {
+  STATIC_VALUE_RESOLVER,
+  planHeadElementEntry,
+  planMetaEntry
+} from "./chunk-HYCCIYNS.js";
+import {
+  sanitizeUrl
+} from "./chunk-5INI7D2L.js";
 import {
   globalSingleton
 } from "./chunk-7ZHH77QA.js";
-import {
-  isEventHandlerAttr,
-  sanitizeUrl,
-  stripControlChars
-} from "./chunk-L3GAGWCC.js";
 import {
   effect
-} from "./chunk-BUKYCWHX.js";
+} from "./chunk-PBQEW5VW.js";
 import {
-  registerDisposer
-} from "./chunk-5VGSK6D2.js";
+  registerDisposer,
+  replaceChildrenSafely
+} from "./chunk-DHDZ7IVN.js";
 import {
   batch,
   signal
-} from "./chunk-KZBEVFXZ.js";
+} from "./chunk-W55YHPEP.js";
 
 // src/platform/head.ts
-var HEAD_URL_ATTRS = /* @__PURE__ */ new Set(["href", "src"]);
-function sanitizeHeadAttr(key, value) {
-  if (HEAD_URL_ATTRS.has(key)) return sanitizeUrl(value);
-  return value;
-}
-function isDangerousRefreshContent(content) {
-  const normalized = stripControlChars(content).toLowerCase();
-  return normalized.includes("url=javascript:") || normalized.includes("url=data:") || normalized.includes("url=vbscript:") || normalized.includes("url=blob:");
-}
-function getMetaAttr(metaProps, name) {
-  for (const k in metaProps) {
-    if (k.toLowerCase() === name) return metaProps[k];
-  }
-  return void 0;
-}
-function isDangerousMetaRefresh(metaProps) {
-  const httpEquiv = getMetaAttr(metaProps, "http-equiv");
-  if (typeof httpEquiv !== "string") return false;
-  if (httpEquiv.toLowerCase() !== "refresh") return false;
-  const content = getMetaAttr(metaProps, "content");
-  if (typeof content !== "string") return false;
-  return isDangerousRefreshContent(content);
-}
-var SAFE_HEAD_ATTR_NAME = /^[A-Za-z_:][-A-Za-z0-9_.:]*$/;
-function isSafeHeadAttr(name) {
-  if (!SAFE_HEAD_ATTR_NAME.test(name)) return false;
-  if (isEventHandlerAttr(name)) return false;
-  return true;
-}
 function escapeScriptJsonLocal(json) {
   return json.replace(/</g, "\\u003c").replace(/>/g, "\\u003e").replace(/&/g, "\\u0026").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
 }
+var CLIENT_RESOLVER = {
+  resolveValue: (_name, value) => typeof value === "function" ? String(value()) : String(value),
+  isReactiveValue: (value) => typeof value === "function"
+};
+function applyMetaEntry(metaProps, managedElements) {
+  let current = null;
+  const retract = () => {
+    if (!current) return;
+    const index = managedElements.indexOf(current);
+    if (index !== -1) managedElements.splice(index, 1);
+    current.remove();
+    current = null;
+  };
+  const alreadyPublished = (attributes) => {
+    if (!current || current.attributes.length !== attributes.size) return false;
+    for (const [name, value] of attributes) {
+      if (current.getAttribute(name) !== value) return false;
+    }
+    return true;
+  };
+  const publish = (attributes) => {
+    if (alreadyPublished(attributes)) return;
+    const next = document.createElement("meta");
+    for (const [name, value] of attributes) next.setAttribute(name, value);
+    const index = current ? managedElements.indexOf(current) : -1;
+    if (current?.parentNode) {
+      current.replaceWith(next);
+    } else {
+      current?.remove();
+      document.head.appendChild(next);
+    }
+    if (index !== -1) managedElements[index] = next;
+    else managedElements.push(next);
+    current = next;
+  };
+  const stopEffect = effect(() => {
+    const plan = planMetaEntry(metaProps, CLIENT_RESOLVER);
+    if (plan.kind === "drop") {
+      retract();
+      return;
+    }
+    publish(plan.attributes);
+  });
+  return () => {
+    stopEffect();
+    retract();
+  };
+}
 function Head(props) {
   const anchor = document.createComment("sibu-head");
   const managedElements = [];
@@ -70,78 +98,52 @@ function Head(props) {
     cleanup();
     if (props.title) {
       if (typeof props.title === "function") {
-        const cleanupFn = effect(() => {
-          document.title = props.title();
+        const getter = props.title;
+        let lease = null;
+        const stopEffect = effect(() => {
+          const next = getter();
+          if (lease) lease.set(next);
+          else lease = acquireTitle(next);
+        });
+        effectCleanups.push(() => {
+          stopEffect();
+          lease?.release();
+          lease = null;
         });
-        effectCleanups.push(cleanupFn);
       } else {
-        document.title = props.title;
+        const lease = acquireTitle(props.title);
+        effectCleanups.push(() => lease.release());
       }
     }
     if (props.meta) {
       for (const metaProps of props.meta) {
-        if (isDangerousMetaRefresh(metaProps)) continue;
-        const httpEquiv = getMetaAttr(metaProps, "http-equiv");
-        const isRefreshNow = () => {
-          const eq = typeof httpEquiv === "function" ? httpEquiv() : httpEquiv;
-          return typeof eq === "string" && eq.toLowerCase() === "refresh";
-        };
-        const el = document.createElement("meta");
-        for (const [key, value] of Object.entries(metaProps)) {
-          if (!isSafeHeadAttr(key)) continue;
-          const isContent = key.toLowerCase() === "content";
-          if (typeof value === "function") {
-            const cleanupFn = effect(() => {
-              const resolved = value();
-              if (isContent && isRefreshNow() && isDangerousRefreshContent(resolved)) {
-                el.removeAttribute(key);
-                return;
-              }
-              el.setAttribute(key, sanitizeHeadAttr(key, resolved));
-            });
-            effectCleanups.push(cleanupFn);
-          } else {
-            if (isContent && isRefreshNow() && isDangerousRefreshContent(value)) continue;
-            el.setAttribute(key, sanitizeHeadAttr(key, value));
-          }
-        }
-        document.head.appendChild(el);
-        managedElements.push(el);
+        const stop = applyMetaEntry(metaProps, managedElements);
+        effectCleanups.push(stop);
       }
     }
-    if (props.link) {
-      for (const linkProps of props.link) {
-        const el = document.createElement("link");
-        for (const [key, value] of Object.entries(linkProps)) {
-          if (!isSafeHeadAttr(key)) continue;
-          el.setAttribute(key, sanitizeHeadAttr(key, value));
-        }
-        document.head.appendChild(el);
-        managedElements.push(el);
-      }
-    }
-    if (props.script) {
-      for (const scriptProps of props.script) {
-        const el = document.createElement("script");
-        for (const [key, value] of Object.entries(scriptProps)) {
-          if (!isSafeHeadAttr(key)) continue;
-          el.setAttribute(key, sanitizeHeadAttr(key, value));
-        }
+    for (const [tag, entries] of [
+      ["link", props.link],
+      ["script", props.script]
+    ]) {
+      if (!entries) continue;
+      for (const entryProps of entries) {
+        const plan = planHeadElementEntry(entryProps, STATIC_VALUE_RESOLVER);
+        if (plan.kind === "drop") continue;
+        const el = document.createElement(tag);
+        for (const [name, value] of plan.attributes) el.setAttribute(name, value);
         document.head.appendChild(el);
         managedElements.push(el);
       }
     }
     if (props.base) {
-      const existing = document.head.querySelector("base");
-      if (existing) existing.remove();
-      const el = document.createElement("base");
+      const spec = {};
       if (props.base.href) {
         const safeHref = sanitizeUrl(props.base.href);
-        if (safeHref) el.href = safeHref;
+        if (safeHref) spec.href = safeHref;
       }
-      if (props.base.target) el.target = props.base.target;
-      document.head.appendChild(el);
-      managedElements.push(el);
+      if (props.base.target) spec.target = props.base.target;
+      const lease = acquireBase(spec);
+      effectCleanups.push(() => lease.release());
     }
   };
   apply();
@@ -164,7 +166,9 @@ function setCanonical(url) {
     link.rel = "canonical";
     document.head.appendChild(link);
   }
-  link.href = sanitizeUrl(url);
+  const safe = sanitizeUrl(url);
+  if (safe) link.setAttribute("href", safe);
+  else link.removeAttribute("href");
 }
 
 // src/platform/worker.ts
@@ -390,22 +394,34 @@ var instanceCache = globalSingleton(
   /* @__PURE__ */ Symbol.for("sibujs.wasm.instanceCache.v1"),
   () => /* @__PURE__ */ new Map()
 );
+var inFlightCache = globalSingleton(
+  /* @__PURE__ */ Symbol.for("sibujs.wasm.inFlightCache.v1"),
+  () => /* @__PURE__ */ new Map()
+);
+var cacheState = globalSingleton(/* @__PURE__ */ Symbol.for("sibujs.wasm.cacheState.v1"), () => ({ generation: 0 }));
+function isCurrentGeneration(generation) {
+  return generation === cacheState.generation;
+}
 function wasm(source, config = {}) {
   const [instance, setInstance] = signal(null);
   const [loading, setLoading] = signal(true);
   const [error, setError] = signal(null);
   const cacheKey = config.cacheKey || (typeof source === "string" ? source : void 0);
+  let runId = 0;
   async function load() {
+    const myRun = ++runId;
     setLoading(true);
     setError(null);
     setInstance(null);
     try {
-      const wasmInstance = await loadWasmModule(source, config.imports, cacheKey);
+      const wasmInstance = await loadWasmModuleWithOptions(source, { ...config, cacheKey });
+      if (myRun !== runId) return;
       setInstance(wasmInstance.exports);
     } catch (err) {
+      if (myRun !== runId) return;
       setError(err instanceof Error ? err : new Error(String(err)));
     } finally {
-      setLoading(false);
+      if (myRun === runId) setLoading(false);
     }
   }
   load();
@@ -418,9 +434,9 @@ function wasm(source, config = {}) {
   };
 }
 async function loadWasmModule(source, imports, cacheKey) {
-  const isOptionsBag = !!(imports && ("allowedOrigins" in imports || "unsafelyAllowAnyOrigin" in imports));
-  const opts = isOptionsBag ? imports : { imports, cacheKey };
-  const wasmImports = opts.imports;
+  return loadWasmModuleWithOptions(source, { imports, cacheKey });
+}
+async function loadWasmModuleWithOptions(source, opts = {}) {
   const key = opts.cacheKey || (typeof source === "string" ? source : void 0);
   if (typeof source === "string") {
     const allowed = opts.allowedOrigins ?? [];
@@ -440,44 +456,50 @@ async function loadWasmModule(source, imports, cacheKey) {
       );
     }
   }
-  if (key) {
-    const cachedInstance = instanceCache.get(key);
-    if (cachedInstance) {
-      return cachedInstance;
-    }
-  }
-  let module;
+  const generation = cacheState.generation;
+  if (!key) return instantiateWasm(source, opts.imports, void 0, generation);
+  const cachedInstance = instanceCache.get(key);
+  if (cachedInstance) return cachedInstance;
+  const inFlight = inFlightCache.get(key);
+  if (inFlight) return inFlight;
+  const pending = instantiateWasm(source, opts.imports, key, generation).then((instance) => {
+    if (isCurrentGeneration(generation)) instanceCache.set(key, instance);
+    return instance;
+  });
+  inFlightCache.set(key, pending);
+  void pending.catch(() => {
+  }).then(() => {
+    if (inFlightCache.get(key) === pending) inFlightCache.delete(key);
+  });
+  return pending;
+}
+async function instantiateWasm(source, wasmImports, key, generation) {
   const cachedModule = key ? moduleCache.get(key) : void 0;
   if (cachedModule) {
-    module = cachedModule;
-  } else {
-    let bytes;
-    if (typeof source === "string") {
-      if (typeof WebAssembly.instantiateStreaming === "function") {
-        const response2 = fetch(source);
-        const result = await WebAssembly.instantiateStreaming(response2, wasmImports || {});
-        if (key) {
-          moduleCache.set(key, result.module);
-          instanceCache.set(key, result.instance);
-        }
-        return result.instance;
-      }
-      const response = await fetch(source);
-      bytes = await response.arrayBuffer();
-    } else if (source instanceof Uint8Array) {
-      bytes = source.buffer.slice(source.byteOffset, source.byteOffset + source.byteLength);
-    } else {
-      bytes = source;
+    return WebAssembly.instantiate(cachedModule, wasmImports || {});
+  }
+  let bytes;
+  if (typeof source === "string") {
+    if (typeof WebAssembly.instantiateStreaming === "function") {
+      const response2 = fetch(source);
+      const result = await WebAssembly.instantiateStreaming(response2, wasmImports || {});
+      if (key && isCurrentGeneration(generation)) moduleCache.set(key, result.module);
+      return result.instance;
     }
-    module = await WebAssembly.compile(bytes);
-    if (key) moduleCache.set(key, module);
+    const response = await fetch(source);
+    bytes = await response.arrayBuffer();
+  } else if (source instanceof Uint8Array) {
+    bytes = source.buffer.slice(source.byteOffset, source.byteOffset + source.byteLength);
+  } else {
+    bytes = source;
   }
-  const instance = await WebAssembly.instantiate(module, wasmImports || {});
-  if (key) instanceCache.set(key, instance);
-  return instance;
+  const module = await WebAssembly.compile(bytes);
+  if (key && isCurrentGeneration(generation)) moduleCache.set(key, module);
+  return WebAssembly.instantiate(module, wasmImports || {});
 }
 async function preloadWasm(url, options = {}) {
   if (moduleCache.has(url)) return;
+  const generation = cacheState.generation;
   const allowed = options.allowedOrigins ?? [];
   if (allowed.length > 0) {
     let parsed;
@@ -502,7 +524,7 @@ async function preloadWasm(url, options = {}) {
     const bytes = await response.arrayBuffer();
     module = await WebAssembly.compile(bytes);
   }
-  moduleCache.set(url, module);
+  if (isCurrentGeneration(generation)) moduleCache.set(url, module);
 }
 function createWasmBridge(instance) {
   const exports = instance.exports;
@@ -542,8 +564,10 @@ function createWasmBridge(instance) {
   };
 }
 function clearWasmCache() {
+  cacheState.generation++;
   moduleCache.clear();
   instanceCache.clear();
+  inFlightCache.clear();
 }
 function isWasmCached(key) {
   return moduleCache.has(key);
@@ -565,14 +589,13 @@ function createMicroApp(config) {
   }
   let mounted = false;
   function mount(component) {
-    root.replaceChildren();
     const el = component();
-    root.appendChild(el);
+    replaceChildrenSafely(root, el);
     mounted = true;
   }
   function unmount() {
     if (!mounted) return;
-    root.replaceChildren();
+    replaceChildrenSafely(root);
     mounted = false;
   }
   return { mount, unmount, element: host };
@@ -619,18 +642,21 @@ function defineRemoteComponent(name, loader) {
       class: "sibu-remote",
       "data-remote-component": name
     });
-    container.appendChild(span({ class: "sibu-remote-loading", nodes: "Loading..." }));
+    container.appendChild(span({ class: "sibu-remote-loading" }, "Loading..."));
+    let disposed = false;
+    registerDisposer(container, () => {
+      disposed = true;
+    });
     loader().then((mod) => {
       cached = mod.default;
-      const rendered = cached();
-      container.replaceChildren(rendered);
+      if (disposed) return;
+      replaceChildrenSafely(container, cached());
     }).catch((err) => {
+      if (disposed) return;
       const message = err instanceof Error ? err.message : String(err);
-      container.replaceChildren(
-        div({
-          class: "sibu-remote-error",
-          nodes: `Failed to load remote component "${name}": ${message}`
-        })
+      replaceChildrenSafely(
+        container,
+        div({ class: "sibu-remote-error" }, `Failed to load remote component "${name}": ${message}`)
       );
     });
     return container;
@@ -686,11 +712,16 @@ function serviceWorker(scriptUrl, options) {
   const [isReady, setIsReady] = signal(false);
   const [isUpdateAvailable, setIsUpdateAvailable] = signal(false);
   const [error, setError] = signal(null);
-  let disposed = false;
+  let unregistered = false;
+  let unregisterRequested = false;
+  let registrationPromise = null;
+  let arrivedRegistration = null;
+  let pendingUnregister = null;
   let updateFoundHandler = null;
   let stateChangeHandler = null;
   let trackedWorker = null;
   let trackedReg = null;
+  const supported = typeof navigator !== "undefined" && !!navigator.serviceWorker;
   function detachListeners() {
     if (trackedReg && updateFoundHandler) {
       trackedReg.removeEventListener("updatefound", updateFoundHandler);
@@ -703,33 +734,53 @@ function serviceWorker(scriptUrl, options) {
     trackedWorker = null;
     trackedReg = null;
   }
-  if ("serviceWorker" in navigator) {
-    navigator.serviceWorker.register(scriptUrl, options).then((reg) => {
-      if (disposed) return;
-      setRegistration(reg);
-      setIsReady(true);
-      trackedReg = reg;
-      updateFoundHandler = () => {
-        if (disposed) return;
-        const newWorker = reg.installing;
-        if (newWorker) {
-          if (trackedWorker && stateChangeHandler) {
-            trackedWorker.removeEventListener("statechange", stateChangeHandler);
-          }
-          trackedWorker = newWorker;
-          stateChangeHandler = () => {
-            if (disposed) return;
-            if (newWorker.state === "installed" && navigator.serviceWorker.controller) {
-              setIsUpdateAvailable(true);
-            }
-          };
-          newWorker.addEventListener("statechange", stateChangeHandler);
+  function attachListeners(reg) {
+    trackedReg = reg;
+    updateFoundHandler = () => {
+      if (unregistered) return;
+      const newWorker = reg.installing;
+      if (newWorker) {
+        if (trackedWorker && stateChangeHandler) {
+          trackedWorker.removeEventListener("statechange", stateChangeHandler);
         }
-      };
-      reg.addEventListener("updatefound", updateFoundHandler);
-    }).catch((err) => {
-      if (disposed) return;
-      setError(err instanceof Error ? err : new Error(String(err)));
+        trackedWorker = newWorker;
+        stateChangeHandler = () => {
+          if (unregistered) return;
+          if (newWorker.state === "installed" && navigator.serviceWorker.controller) {
+            setIsUpdateAvailable(true);
+          }
+        };
+        newWorker.addEventListener("statechange", stateChangeHandler);
+      }
+    };
+    reg.addEventListener("updatefound", updateFoundHandler);
+  }
+  function activate(reg) {
+    setRegistration(reg);
+    setIsReady(true);
+    attachListeners(reg);
+  }
+  function recoverFailedUnregister() {
+    unregisterRequested = false;
+    if (!registration() && arrivedRegistration) {
+      activate(arrivedRegistration);
+      arrivedRegistration = null;
+    }
+  }
+  function adopt(reg) {
+    if (unregisterRequested) {
+      arrivedRegistration = reg;
+      return null;
+    }
+    activate(reg);
+    return reg;
+  }
+  if (supported) {
+    registrationPromise = navigator.serviceWorker.register(scriptUrl, options).then(adopt).catch((err) => {
+      if (!unregistered) {
+        setError(err instanceof Error ? err : new Error(String(err)));
+      }
+      return null;
     });
   }
   async function update() {
@@ -738,19 +789,43 @@ function serviceWorker(scriptUrl, options) {
       await reg.update();
     }
   }
-  async function unregister() {
-    disposed = true;
-    detachListeners();
-    const reg = registration();
-    if (reg) {
-      const result = await reg.unregister();
-      if (result) {
-        setRegistration(null);
-        setIsReady(false);
-      }
-      return result;
+  async function performUnregister() {
+    unregisterRequested = true;
+    if (registrationPromise) await registrationPromise.catch(() => null);
+    const reg = registration() ?? arrivedRegistration;
+    if (!reg) {
+      unregisterRequested = false;
+      return false;
+    }
+    let result;
+    try {
+      result = await reg.unregister();
+    } catch (err) {
+      recoverFailedUnregister();
+      throw err;
+    }
+    if (result) {
+      detachListeners();
+      setRegistration(null);
+      setIsReady(false);
+      setIsUpdateAvailable(false);
+      arrivedRegistration = null;
+      unregistered = true;
+    } else {
+      recoverFailedUnregister();
     }
-    return false;
+    return result;
+  }
+  async function unregister() {
+    if (!supported || unregistered) return false;
+    if (pendingUnregister) return pendingUnregister;
+    const request = performUnregister();
+    pendingUnregister = request;
+    void request.catch(() => {
+    }).then(() => {
+      if (pendingUnregister === request) pendingUnregister = null;
+    });
+    return request;
   }
   return { registration, isReady, isUpdateAvailable, error, update, unregister };
 }
@@ -855,17 +930,39 @@ function createAction(actionFn) {
 }
 
 // src/platform/scrollRestoration.ts
+var DEFAULT_STATE_KEY = "__sibuScrollKey";
 function scrollRestoration(options) {
   const mode = options?.mode ?? "auto";
+  const stateKey = options?.stateKey ?? DEFAULT_STATE_KEY;
   const positions = /* @__PURE__ */ new Map();
   let popstateHandler = null;
   let currentKey = null;
-  const save = (key) => {
+  if (options?.getKey) {
+    try {
+      currentKey = options.getKey();
+    } catch {
+      currentKey = null;
+    }
+  }
+  const record = (key) => {
     if (typeof window !== "undefined") {
       positions.set(key, { x: window.scrollX, y: window.scrollY });
     }
     currentKey = key;
   };
+  const tagCurrentEntry = (key) => {
+    if (typeof window === "undefined" || typeof history === "undefined") return;
+    try {
+      const existing = history.state ?? {};
+      if (existing[stateKey] === key) return;
+      history.replaceState({ ...existing, [stateKey]: key }, "");
+    } catch {
+    }
+  };
+  const save = (key) => {
+    record(key);
+    if (mode === "auto") tagCurrentEntry(key);
+  };
   const restore = (key) => {
     const pos = positions.get(key);
     if (pos && typeof window !== "undefined") {
@@ -876,11 +973,32 @@ function scrollRestoration(options) {
   const getPosition = (key) => {
     return positions.get(key);
   };
+  const onNavigation = (key) => {
+    if (mode !== "auto") return;
+    if (currentKey !== null && currentKey !== key) record(currentKey);
+    currentKey = key;
+    tagCurrentEntry(key);
+  };
+  let nativeModeLease = null;
   if (mode === "auto" && typeof window !== "undefined") {
-    popstateHandler = () => {
-      if (currentKey) {
-        save(currentKey);
+    nativeModeLease = acquireScrollRestorationMode("manual");
+    if (currentKey !== null) tagCurrentEntry(currentKey);
+    popstateHandler = (event) => {
+      const state = event.state ?? null;
+      const rawDestination = state ? state[stateKey] : void 0;
+      const destination = typeof rawDestination === "string" ? rawDestination : null;
+      let outgoing = currentKey;
+      if (outgoing === null && options?.getKey) {
+        try {
+          outgoing = options.getKey();
+        } catch {
+          outgoing = null;
+        }
+      }
+      if (outgoing !== null && outgoing !== destination) {
+        record(outgoing);
       }
+      if (destination !== null) restore(destination);
     };
     window.addEventListener("popstate", popstateHandler);
   }
@@ -889,9 +1007,11 @@ function scrollRestoration(options) {
       window.removeEventListener("popstate", popstateHandler);
       popstateHandler = null;
     }
+    nativeModeLease?.release();
+    nativeModeLease = null;
     positions.clear();
   };
-  return { save, restore, getPosition, dispose };
+  return { save, restore, onNavigation, getPosition, dispose };
 }
 
 // src/platform/routeMiddleware.ts
@@ -934,6 +1054,7 @@ export {
   createWorkerPool,
   wasm,
   loadWasmModule,
+  loadWasmModuleWithOptions,
   preloadWasm,
   createWasmBridge,
   clearWasmCache,