@bitstillery/mithril 3.7.0 → 3.8.0

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@bitstillery/mithril",
-    "version": "3.7.0",
+    "version": "3.8.0",
     "description": "Mithril + Signals, Store and SSR",
     "license": "MIT",
     "author": "Bitstillery",

package/querystring/build.ts

@@ -4,9 +4,14 @@ export default function buildQueryString(object: Record<string, any>): string {
     const args: string[] = []
     function destructure(key: string, value: any) {
         if (Array.isArray(value)) {
-            for (let i = 0; i < value.length; i++) {
-                destructure(key + '[' + i + ']', value[i])
-            }
+            // A comma list, not `key[0]=&key[1]=`: it is a third of the length, it survives a CDN
+            // cache-key allowlist as a single parameter name, and RFC 3986 permits a bare comma in
+            // a query. Each element is encoded on its own, so a comma *inside* a value stays `%2C`
+            // and the list still splits unambiguously.
+            if (value.length === 0) return
+            args.push(
+                encodeURIComponent(key) + '=' + value.map((item) => (item == null ? '' : encodeURIComponent(item))).join(','),
+            )
         } else if (Object.prototype.toString.call(value) === '[object Object]') {
             for (const i in value) {
                 destructure(key + '[' + i + ']', value[i])

package/render/render.ts

@@ -691,7 +691,11 @@ export default function renderFactory() {
                     const originalNextSibling = nextSibling
                     let pos = 2147483647,
                         matched = 0
-                    const oldIndices = Array.from({length: end - start + 1}, () => -1)
+                    // See the note in vnode.ts's normalizeChildren: `Array.from({length: n}, () => -1)`
+                    // is ~14x slower than this on V8 (~146ms vs ~10ms for 200k calls at 24 entries),
+                    // since it adds a per-element mapper call on top of the slower allocation path.
+                    // oxlint-disable-next-line no-new-array
+                    const oldIndices = new Array(end - start + 1).fill(-1)
                     const map: Record<string, number> = Object.create(null)
                     for (let i = start; i <= end; i++) {
                         if (vnodes[i] != null) map[vnodes[i]!.key!] = i

package/render/vnode.ts

@@ -102,7 +102,13 @@ const normalize = function (node: any): Vnode | null {
 const normalizeChildren = function (input: any[]): (Vnode | null)[] {
     // Preallocate the array length (initially holey) and fill every index immediately in order.
     // Benchmarking shows better performance on V8.
-    const children = Array.from({length: input.length}) as (Vnode | null)[]
+    //
+    // Do NOT let a linter rewrite this to `Array.from({length: n})`: that is not holey, it walks the
+    // array-like/iterator path, and on V8 it is ~15x slower here (measured on node 22: ~98ms vs ~6.4ms
+    // for 200k calls at 12 children). This is the hottest function in a portal render profile, so the
+    // difference is not academic — it was silently lost once already to an oxlint autofix.
+    // oxlint-disable-next-line no-new-array
+    const children = new Array(input.length) as (Vnode | null)[]
     // Count the number of keyed normalized vnodes for consistency check.
     // Note: this is a perf-sensitive check.
     // Fun fact: merging the loop like this is somehow faster than splitting

package/server.ts

@@ -14,7 +14,10 @@ import censor from './util/censor'
 import type {MithrilStatic, Hyperscript} from './index'
 import type {Redraw} from './api/mount-redraw'
 
-logger.debug(`mithril ssr v${version}`)
+// `process.env.MSI_BUILD_COMMIT` is inlined by the SSR bundle's `define` (see frontend/cli/tasks.ts).
+// It is undefined when running unbundled (e.g. mithril's own tests), hence the fallback.
+const buildCommit = process.env.MSI_BUILD_COMMIT || 'dev'
+logger.debug(`mithril ssr v${version} (commit ${buildCommit})`)
 
 // Create server-side renderer
 const {renderToString, renderToStringSync} = renderToStringFactory()

package/state.ts

@@ -619,12 +619,22 @@ export function state<T extends Record<string, any>>(initial: T, name?: string,
         }
 
         const ensurePropertySignal = (target: any, prop: string | symbol, key: string) => {
-            if (!nestedSignalMap.has(key)) {
-                const originalValue = Reflect.get(target, prop)
-                if (originalValue === undefined) return undefined
-                nestedSignalMap.set(key, createPropertySignal(originalValue))
+            // One Map lookup, not two. This runs on EVERY property read of every state object — the
+            // hottest path in the framework — and after the first access the signal always exists, so the
+            // old `has()` + `get()` pair doubled the cost of the common case.
+            //
+            // `get()` returning undefined is an exact substitute for `!has()`: createPropertySignal never
+            // returns undefined (it always yields a Signal, falling back to `signal(undefined)`), and the
+            // early return below stores nothing.
+            const existing = nestedSignalMap.get(key)
+            if (existing !== undefined) {
+                return existing
             }
-            return nestedSignalMap.get(key)
+            const originalValue = Reflect.get(target, prop)
+            if (originalValue === undefined) return undefined
+            const created = createPropertySignal(originalValue)
+            nestedSignalMap.set(key, created)
+            return created
         }
         wrapped = new Proxy(obj, {
             get(target, prop) {
@@ -647,7 +657,9 @@ export function state<T extends Record<string, any>>(initial: T, name?: string,
                     }
                 }
 
-                const propStr = String(prop)
+                // Property keys are already strings in virtually every access; `String()` on a symbol is
+                // the rare path, so don't make the common one pay for the conversion.
+                const propStr = typeof prop === 'string' ? prop : String(prop)
 
                 // Check for $ prefix convention (deepsignal-style: returns raw signal)
                 if (propStr.startsWith('$') && propStr.length > 1) {

package/store.ts

@@ -557,7 +557,9 @@ export class Store<T extends Record<string, any> = Record<string, any>> {
                 )
                 return
             }
-            document.cookie = `${key}=${value}; Path=/; SameSite=Lax; Max-Age=${this.cookieMaxAge}`
+            // Conditional so plain-http dev hosts can still write the cookie at all.
+            const secure = location.protocol === 'https:' ? '; Secure' : ''
+            document.cookie = `${key}=${value}; Path=/; SameSite=Lax${secure}; Max-Age=${this.cookieMaxAge}`
         } catch (err) {
             console.error('Cannot write cookie; continue without.', err)
         }