sibujs 4.7.0 → 4.8.0

package/dist/ssr.d.cts

@@ -1,10 +1,40 @@
-export { H as HydrateOptions, a as HydrationMismatch, T as TrustedHTML, c as collectStream, d as deserializeState, e as escapeScriptJson, h as hydrate, b as hydrateIslands, f as hydrateProgressively, i as isDangerousMetaRefresh, g as island, r as renderToDocument, j as renderToReadableStream, k as renderToStream, l as renderToString, m as renderToSuspenseStream, n as resetSSRState, s as serializeState, o as ssrSuspense, p as suspenseSwapScript, t as trustHTML } from './ssr-Bli9XRW5.cjs';
+export { H as HydrateOptions, a as HydrationMismatch, T as TrustedHTML, c as collectStream, d as deserializeState, e as escapeScriptJson, h as hydrate, b as hydrateIslands, f as hydrateProgressively, i as isDangerousMetaRefresh, g as island, r as renderToDocument, j as renderToReadableStream, k as renderToStream, l as renderToString, m as renderToSuspenseStream, n as resetSSRState, s as serializeState, o as ssrSuspense, p as suspenseSwapScript, t as trustHTML } from './ssr-C8hgIAw7.cjs';
+import { C as Component } from './types-CJFViL6Q.cjs';
 
 interface HeadProps {
     title?: string | (() => string);
     meta?: Record<string, string | (() => string)>[];
+    /**
+     * `<link>` elements to add to `<head>`.
+     *
+     * TRUST BOUNDARY for stylesheets: `{ rel: "stylesheet", href }` is the
+     * framework's explicit API for a stylesheet whose URL is a runtime value.
+     * The generic writers refuse to let a runtime `href` become an applied
+     * stylesheet at all (see `utils/elementPolicy.ts`), because a well-formed
+     * URL is not trusted CSS. Naming it here is the trust decision: first-party
+     * or pinned URLs only, and a CSP `style-src` as the second layer.
+     */
     link?: Record<string, string>[];
+    /**
+     * External scripts to add to `<head>`.
+     *
+     * TRUST BOUNDARY: this is the framework's explicit API for loading a script
+     * whose URL is a runtime value, and naming it here IS the trust decision —
+     * the URL passes the scheme allowlist, but an allowed `https:` URL is still a
+     * program that runs with the page's full authority. Pass only URLs you
+     * control or pin (a first-party path, a CDN URL with `integrity`). The
+     * generic writers refuse to let a runtime value choose a `<script>` source
+     * at all; see `docs/architecture/attribute-security.md` § Trust model.
+     */
     script?: Record<string, string>[];
+    /**
+     * The document `<base>`.
+     *
+     * TRUST BOUNDARY: `href` passes the scheme allowlist, but an allowed `https:`
+     * base still re-homes every relative URL on the page — relative `<script
+     * src>`, stylesheets, form actions and `fetch("/api")` alike. Treat it like a
+     * script URL: first-party values only.
+     */
     base?: {
         href?: string;
         target?: string;
@@ -94,6 +124,10 @@ interface UseWorkerFnReturn<TArgs extends unknown[], TResult> {
  * The function must be self-contained -- it cannot reference variables
  * from the outer scope. Arguments are serialized via postMessage.
  *
+ * **Trust boundary:** the function's source is evaluated in a `blob:` worker,
+ * which is equivalent to `eval()`. Only a function object is accepted — never
+ * a string, and never a function built from untrusted input.
+ *
  * @param fn A pure function to execute in a worker thread.
  * @returns An object with run, loading, and terminate.
  */
@@ -108,6 +142,9 @@ interface WorkerPool<TInput, TOutput> {
  * Tasks are distributed across workers using round-robin scheduling.
  * Each worker is created from the same inline function.
  *
+ * **Trust boundary:** as with `worker()`, the function's source is evaluated in
+ * a `blob:` worker. Only a function object is accepted, never a string.
+ *
  * @param workerFn The function body to run inside each worker.
  * @param poolSize Number of workers in the pool (defaults to navigator.hardwareConcurrency or 4).
  * @returns An object with execute and terminate.
@@ -362,9 +399,13 @@ interface LoadRemoteModuleOptions {
     unsafelyAllowAnyOrigin?: boolean;
 }
 declare function loadRemoteModule(url: string, optionsOrAllowedOrigins?: string[] | LoadRemoteModuleOptions): Promise<unknown>;
-type Component = () => HTMLElement;
-type RemoteLoader = () => Promise<{
-    default: Component;
+/**
+ * Loads the remote module whose `default` export is the component. Its root may
+ * be any `Element` — an SVG root included — using the public `Component` type
+ * rather than a private `() => HTMLElement` that forced a cast.
+ */
+type RemoteLoader<R extends Element = HTMLElement> = () => Promise<{
+    default: Component<void, R>;
 }>;
 /**
  * Register a remote component that loads on demand.
@@ -392,7 +433,7 @@ type RemoteLoader = () => Promise<{
  * document.body.appendChild(RemoteHeader());
  * ```
  */
-declare function defineRemoteComponent(name: string, loader: RemoteLoader): Component;
+declare function defineRemoteComponent<R extends Element = HTMLElement>(name: string, loader: RemoteLoader<R>): Component<void, R | HTMLElement>;
 /**
  * Create a shared state scope that enables communication between independent
  * micro-frontend instances.
@@ -430,6 +471,15 @@ interface ServiceWorkerState {
 /**
  * serviceWorker registers and manages a service worker.
  *
+ * TRUST BOUNDARY: `scriptUrl` is CODE. A service worker runs with authority
+ * over every page in its scope and persists across reloads, so this is the
+ * strongest code-loading primitive in the framework. The browser enforces
+ * same-origin, a secure context and a JavaScript MIME type — it does NOT
+ * protect against a same-origin URL that serves attacker-influenced content
+ * (a JSONP endpoint, an upload directory). Pass only a literal path to a worker
+ * script you ship; never a value derived from the URL, storage or an API
+ * response.
+ *
  * LIFECYCLE CONTRACT
  * ------------------
  * Registration is asynchronous and `unregister()` can be called at any point

package/dist/ssr.d.ts

@@ -1,10 +1,40 @@
-export { H as HydrateOptions, a as HydrationMismatch, T as TrustedHTML, c as collectStream, d as deserializeState, e as escapeScriptJson, h as hydrate, b as hydrateIslands, f as hydrateProgressively, i as isDangerousMetaRefresh, g as island, r as renderToDocument, j as renderToReadableStream, k as renderToStream, l as renderToString, m as renderToSuspenseStream, n as resetSSRState, s as serializeState, o as ssrSuspense, p as suspenseSwapScript, t as trustHTML } from './ssr-Bli9XRW5.js';
+export { H as HydrateOptions, a as HydrationMismatch, T as TrustedHTML, c as collectStream, d as deserializeState, e as escapeScriptJson, h as hydrate, b as hydrateIslands, f as hydrateProgressively, i as isDangerousMetaRefresh, g as island, r as renderToDocument, j as renderToReadableStream, k as renderToStream, l as renderToString, m as renderToSuspenseStream, n as resetSSRState, s as serializeState, o as ssrSuspense, p as suspenseSwapScript, t as trustHTML } from './ssr-C8hgIAw7.js';
+import { C as Component } from './types-CJFViL6Q.js';
 
 interface HeadProps {
     title?: string | (() => string);
     meta?: Record<string, string | (() => string)>[];
+    /**
+     * `<link>` elements to add to `<head>`.
+     *
+     * TRUST BOUNDARY for stylesheets: `{ rel: "stylesheet", href }` is the
+     * framework's explicit API for a stylesheet whose URL is a runtime value.
+     * The generic writers refuse to let a runtime `href` become an applied
+     * stylesheet at all (see `utils/elementPolicy.ts`), because a well-formed
+     * URL is not trusted CSS. Naming it here is the trust decision: first-party
+     * or pinned URLs only, and a CSP `style-src` as the second layer.
+     */
     link?: Record<string, string>[];
+    /**
+     * External scripts to add to `<head>`.
+     *
+     * TRUST BOUNDARY: this is the framework's explicit API for loading a script
+     * whose URL is a runtime value, and naming it here IS the trust decision —
+     * the URL passes the scheme allowlist, but an allowed `https:` URL is still a
+     * program that runs with the page's full authority. Pass only URLs you
+     * control or pin (a first-party path, a CDN URL with `integrity`). The
+     * generic writers refuse to let a runtime value choose a `<script>` source
+     * at all; see `docs/architecture/attribute-security.md` § Trust model.
+     */
     script?: Record<string, string>[];
+    /**
+     * The document `<base>`.
+     *
+     * TRUST BOUNDARY: `href` passes the scheme allowlist, but an allowed `https:`
+     * base still re-homes every relative URL on the page — relative `<script
+     * src>`, stylesheets, form actions and `fetch("/api")` alike. Treat it like a
+     * script URL: first-party values only.
+     */
     base?: {
         href?: string;
         target?: string;
@@ -94,6 +124,10 @@ interface UseWorkerFnReturn<TArgs extends unknown[], TResult> {
  * The function must be self-contained -- it cannot reference variables
  * from the outer scope. Arguments are serialized via postMessage.
  *
+ * **Trust boundary:** the function's source is evaluated in a `blob:` worker,
+ * which is equivalent to `eval()`. Only a function object is accepted — never
+ * a string, and never a function built from untrusted input.
+ *
  * @param fn A pure function to execute in a worker thread.
  * @returns An object with run, loading, and terminate.
  */
@@ -108,6 +142,9 @@ interface WorkerPool<TInput, TOutput> {
  * Tasks are distributed across workers using round-robin scheduling.
  * Each worker is created from the same inline function.
  *
+ * **Trust boundary:** as with `worker()`, the function's source is evaluated in
+ * a `blob:` worker. Only a function object is accepted, never a string.
+ *
  * @param workerFn The function body to run inside each worker.
  * @param poolSize Number of workers in the pool (defaults to navigator.hardwareConcurrency or 4).
  * @returns An object with execute and terminate.
@@ -362,9 +399,13 @@ interface LoadRemoteModuleOptions {
     unsafelyAllowAnyOrigin?: boolean;
 }
 declare function loadRemoteModule(url: string, optionsOrAllowedOrigins?: string[] | LoadRemoteModuleOptions): Promise<unknown>;
-type Component = () => HTMLElement;
-type RemoteLoader = () => Promise<{
-    default: Component;
+/**
+ * Loads the remote module whose `default` export is the component. Its root may
+ * be any `Element` — an SVG root included — using the public `Component` type
+ * rather than a private `() => HTMLElement` that forced a cast.
+ */
+type RemoteLoader<R extends Element = HTMLElement> = () => Promise<{
+    default: Component<void, R>;
 }>;
 /**
  * Register a remote component that loads on demand.
@@ -392,7 +433,7 @@ type RemoteLoader = () => Promise<{
  * document.body.appendChild(RemoteHeader());
  * ```
  */
-declare function defineRemoteComponent(name: string, loader: RemoteLoader): Component;
+declare function defineRemoteComponent<R extends Element = HTMLElement>(name: string, loader: RemoteLoader<R>): Component<void, R | HTMLElement>;
 /**
  * Create a shared state scope that enables communication between independent
  * micro-frontend instances.
@@ -430,6 +471,15 @@ interface ServiceWorkerState {
 /**
  * serviceWorker registers and manages a service worker.
  *
+ * TRUST BOUNDARY: `scriptUrl` is CODE. A service worker runs with authority
+ * over every page in its scope and persists across reloads, so this is the
+ * strongest code-loading primitive in the framework. The browser enforces
+ * same-origin, a secure context and a JavaScript MIME type — it does NOT
+ * protect against a same-origin URL that serves attacker-influenced content
+ * (a JSONP endpoint, an upload directory). Pass only a literal path to a worker
+ * script you ship; never a value derived from the URL, storage or an API
+ * response.
+ *
  * LIFECYCLE CONTRACT
  * ------------------
  * Registration is asynchronous and `unregister()` can be called at any point

package/dist/ssr.js

@@ -23,9 +23,9 @@ import {
   wasm,
   worker,
   workerFn
-} from "./chunk-VZSG24LS.js";
+} from "./chunk-JUTFX2RM.js";
 import "./chunk-52XFPGSN.js";
-import "./chunk-7LUJQAOJ.js";
+import "./chunk-Q5J2LVKH.js";
 import {
   collectStream,
   deserializeState,
@@ -45,15 +45,17 @@ import {
   ssrSuspense,
   suspenseSwapScript,
   trustHTML
-} from "./chunk-HURREPU2.js";
-import "./chunk-UOL2ECCS.js";
-import "./chunk-FNJXNGYZ.js";
-import "./chunk-2INLLLMZ.js";
+} from "./chunk-FC6KCJSA.js";
+import "./chunk-62BDYGAG.js";
+import "./chunk-VWT3VXPL.js";
+import "./chunk-O6TRVMJI.js";
+import "./chunk-3ACAAQIN.js";
 import "./chunk-7ZHH77QA.js";
-import "./chunk-WEQ3DMVL.js";
+import "./chunk-V3LHZSU5.js";
+import "./chunk-EXXSN3BW.js";
 import "./chunk-7XHATCIH.js";
-import "./chunk-FQRUXCEE.js";
-import "./chunk-JWKYU5GV.js";
+import "./chunk-DSID757X.js";
+import "./chunk-TQQUN4WR.js";
 import "./chunk-NYNYSPK7.js";
 export {
   Head,

package/dist/testing.cjs

@@ -754,7 +754,7 @@ function forEachSubscriber(signal, visit) {
 }
 
 // src/reactivity/track.ts
-var _runtimeVersion = true ? "4.7.0" : "dev";
+var _runtimeVersion = true ? "4.8.0" : "dev";
 var REGISTRY_KEY = /* @__PURE__ */ Symbol.for("sibujs.reactive.v1");
 function resolveReactiveApi() {
   const g = globalThis;
@@ -1163,8 +1163,8 @@ function enableListenerTracking() {
     if (opts?.signal) {
       const signal = opts.signal;
       const onAbort = () => drop(this, type2, entry);
-      add.call(signal, "abort", onAbort, { once: true });
-      releases.push(() => remove.call(signal, "abort", onAbort));
+      signal.addEventListener("abort", onAbort, { once: true });
+      releases.push(() => signal.removeEventListener("abort", onAbort));
     }
     if (releases.length > 0) {
       entry.release = () => {

package/dist/testing.js

@@ -3,9 +3,9 @@ import {
 } from "./chunk-7ZHH77QA.js";
 import {
   effect
-} from "./chunk-WEQ3DMVL.js";
+} from "./chunk-V3LHZSU5.js";
 import "./chunk-7XHATCIH.js";
-import "./chunk-JWKYU5GV.js";
+import "./chunk-TQQUN4WR.js";
 import {
   dispose,
   replaceChildrenSafely,
@@ -189,8 +189,8 @@ function enableListenerTracking() {
     if (opts?.signal) {
       const signal = opts.signal;
       const onAbort = () => drop(this, type2, entry);
-      add.call(signal, "abort", onAbort, { once: true });
-      releases.push(() => remove.call(signal, "abort", onAbort));
+      signal.addEventListener("abort", onAbort, { once: true });
+      releases.push(() => signal.removeEventListener("abort", onAbort));
     }
     if (releases.length > 0) {
       entry.release = () => {