@builder.io/sdk-svelte 5.2.16 → 5.3.0

package/lib/node/functions/evaluate/safe-state-expression.js

@@ -0,0 +1,236 @@
+import { createBoundedCache } from '../../helpers/bounded-cache';
+/**
+ * Recognizes binding expressions that only read `state` and combine the values
+ * with operators and literals, e.g. `!state.open`, `state.$index + 1` or
+ * `state.plan === "pro" ? "Upgrade" : "Manage"`. Such an expression cannot call
+ * functions, assign, loop or reach any global, so it can run as a plain function
+ * instead of in a sandbox. Anything else returns `null` and is sandboxed as usual.
+ */
+const IDENTIFIER = /^[A-Za-z_$][\w$]*/;
+const NUMBER = /^(?:\d+\.?\d*|\.\d+)(?:[eE][+-]?\d+)?/;
+/**
+ * The length of a single- or double-quoted string literal at the start of `code`
+ * (no escapes or line breaks), or 0 when there is none.
+ */
+const getStringLiteralLength = (code) => {
+    const quote = code[0];
+    if (quote !== '"' && quote !== "'")
+        return 0;
+    for (let i = 1; i < code.length; i++) {
+        const char = code[i];
+        if (char === quote)
+            return i + 1;
+        if (char === '\\' || char === '\n' || char === '\r')
+            return 0;
+    }
+    return 0;
+};
+const OPERATORS = ['===', '!==', '==', '!=', '<=', '>=', '&&', '||', '??', '<', '>', '!', '+', '-', '*', '/', '%', '?', ':'];
+const LITERAL_KEYWORDS = new Set(['true', 'false', 'null', 'undefined']);
+// Reading these is harmless on data, but they lead to functions and prototypes.
+const BLOCKED_PROPERTIES = new Set(['constructor', '__proto__', 'prototype', '__defineGetter__', '__defineSetter__', '__lookupGetter__', '__lookupSetter__']);
+const MAX_EXPRESSION_LENGTH = 500;
+/**
+ * Returns `expression` when it only uses the allowed grammar, otherwise `null`.
+ */
+export const getSafeStateExpression = (expression) => {
+    if (expression.length > MAX_EXPRESSION_LENGTH)
+        return null;
+    let rest = expression.trim();
+    if (!rest)
+        return null;
+    let depth = 0;
+    // A value (state path, literal or closing paren) was just read: `(` here would be a call.
+    let afterValue = false;
+    let readsState = false;
+    while (rest) {
+        const whitespace = /^\s+/.exec(rest);
+        if (whitespace) {
+            rest = rest.slice(whitespace[0].length);
+            continue;
+        }
+        const identifier = IDENTIFIER.exec(rest);
+        if (identifier) {
+            if (afterValue)
+                return null;
+            const word = identifier[0];
+            rest = rest.slice(word.length);
+            if (LITERAL_KEYWORDS.has(word)) {
+                afterValue = true;
+                continue;
+            }
+            if (word !== 'state')
+                return null;
+            let hasProperty = false;
+            let property = /^\s*\.\s*([A-Za-z_$][\w$]*)/.exec(rest);
+            while (property) {
+                if (BLOCKED_PROPERTIES.has(property[1]))
+                    return null;
+                hasProperty = true;
+                rest = rest.slice(property[0].length);
+                property = /^\s*\.\s*([A-Za-z_$][\w$]*)/.exec(rest);
+            }
+            if (!hasProperty)
+                return null;
+            readsState = true;
+            afterValue = true;
+            continue;
+        }
+        const literalLength = NUMBER.exec(rest)?.[0].length || getStringLiteralLength(rest);
+        if (literalLength) {
+            if (afterValue)
+                return null;
+            rest = rest.slice(literalLength);
+            afterValue = true;
+            continue;
+        }
+        if (rest[0] === '(') {
+            if (afterValue)
+                return null;
+            depth++;
+            rest = rest.slice(1);
+            continue;
+        }
+        if (rest[0] === ')') {
+            if (depth === 0)
+                return null;
+            depth--;
+            rest = rest.slice(1);
+            afterValue = true;
+            continue;
+        }
+        const operator = OPERATORS.find(op => rest.startsWith(op));
+        if (!operator)
+            return null;
+        // `?.` is optional chaining (a property access we do not handle)
+        if (operator === '?' && rest[1] === '.')
+            return null;
+        // `++` / `--` would write to state
+        if ((operator === '+' || operator === '-') && rest[1] === operator) {
+            return null;
+        }
+        rest = rest.slice(operator.length);
+        afterValue = false;
+    }
+    if (depth !== 0 || !readsState || !afterValue)
+        return null;
+    return expression.trim();
+};
+const RETURN_EXPRESSION = /^\s*return\s*\(([\s\S]*)\);\s*$/;
+const VIRTUAL_INDEX_EXPRESSION = /^\s*var\s+_virtual_index\s*=\s*([\s\S]*?);?\s*return\s+_virtual_index\s*;?\s*$/;
+/**
+ * Extracts the expression from code produced by `parseCode` (`return (expr);`) or
+ * from the editor's transpiled form (`var _virtual_index=expr;` followed by a return of it).
+ * (Mitosis treats any file containing a literal "return" + " _virtual_index" as a function body.)
+ */
+export const getSafeStateExpressionFromCode = (code) => {
+    const match = RETURN_EXPRESSION.exec(code) || VIRTUAL_INDEX_EXPRESSION.exec(code);
+    return match ? getSafeStateExpression(match[1]) : null;
+};
+const isPrimitiveValue = (value) => value === null || typeof value !== 'object' && typeof value !== 'function';
+const MAX_CACHED_EXPRESSIONS = 5000;
+const COMPILED_EXPRESSIONS = createBoundedCache(MAX_CACHED_EXPRESSIONS);
+/**
+ * The compiled expression for `code`, or `null` when `code` is not a safe state expression.
+ */
+export const getSafeStateExpressionFn = (code) => {
+    let fn = COMPILED_EXPRESSIONS.get(code);
+    if (fn === undefined) {
+        const expression = getSafeStateExpressionFromCode(code);
+        fn = null;
+        if (expression) {
+            try {
+                fn = new Function('state', `return (${expression});`);
+            }
+            catch (e) {
+                fn = null;
+            }
+        }
+        COMPILED_EXPRESSIONS.set(code, fn);
+    }
+    return fn;
+};
+const UNSAFE_STATE_READ = Symbol('unsafe state read');
+const isPlainContainer = (value) => {
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === Array.prototype || prototype === null;
+};
+const READ_ONLY_TRAPS = {
+    set: () => false,
+    deleteProperty: () => false
+};
+const findDescriptor = (target, prop) => {
+    for (let o = target; o; o = Object.getPrototypeOf(o)) {
+        const descriptor = Object.getOwnPropertyDescriptor(o, prop);
+        if (descriptor)
+            return descriptor;
+    }
+    return undefined;
+};
+/**
+ * A read-only view of local state over root state, without copying either.
+ *
+ * Plain objects and arrays are wrapped so every nested read is checked: accessors
+ * anywhere on the prototype chain, class instances and functions (which could run
+ * getters or custom `valueOf`/`toString`) abort the read. Each source object maps to
+ * one wrapper for the life of the view, so `===` still compares the underlying objects.
+ * Wrappers target a fresh empty container rather than the object itself, because proxy
+ * invariants forbid returning a wrapper for a frozen (non-configurable) property.
+ */
+export const getReadOnlyStateView = (rootState, localState, isProxy) => {
+    // Reflecting on a Proxy (even `Object.getPrototypeOf`) runs its traps.
+    const isInspectable = (value) => !isProxy(value) && isPlainContainer(value);
+    if (!isInspectable(rootState) || localState && isProxy(localState)) {
+        throw UNSAFE_STATE_READ;
+    }
+    const wrappers = new WeakMap();
+    const guardStateValue = (value) => {
+        if (value === null || typeof value !== 'object') {
+            if (typeof value === 'function')
+                throw UNSAFE_STATE_READ;
+            return value;
+        }
+        if (!isInspectable(value))
+            throw UNSAFE_STATE_READ;
+        let wrapper = wrappers.get(value);
+        if (!wrapper) {
+            wrapper = new Proxy(Array.isArray(value) ? [] : {}, {
+                get: (_, prop) => readDataProperty(value, prop),
+                ...READ_ONLY_TRAPS
+            });
+            wrappers.set(value, wrapper);
+        }
+        return wrapper;
+    };
+    const readDataProperty = (target, prop) => {
+        const descriptor = findDescriptor(target, prop);
+        if (descriptor && (descriptor.get || descriptor.set)) {
+            throw UNSAFE_STATE_READ;
+        }
+        return guardStateValue(descriptor?.value);
+    };
+    return new Proxy({}, {
+        get: (_, prop) => localState && Object.prototype.hasOwnProperty.call(localState, prop) ? readDataProperty(localState, prop) : readDataProperty(rootState, prop),
+        ...READ_ONLY_TRAPS
+    });
+};
+export const NOT_EVALUATED = Symbol('not evaluated');
+/**
+ * Evaluates `code` outside the sandbox when it is a safe state expression over plain
+ * data and produces a primitive. Returns `NOT_EVALUATED` when the sandbox must run it.
+ */
+export const evaluateSafeStateExpression = (code, rootState, localState, isProxy) => {
+    const fn = getSafeStateExpressionFn(code);
+    if (!fn)
+        return NOT_EVALUATED;
+    let value;
+    try {
+        value = fn(getReadOnlyStateView(rootState, localState, isProxy));
+    }
+    catch {
+        // Unsafe reads and ordinary errors (e.g. a null-prototype object in `+`) both
+        // go to the regular evaluator, so behavior matches evaluation without the fast path.
+        return NOT_EVALUATED;
+    }
+    return isPrimitiveValue(value) ? value : NOT_EVALUATED;
+};

package/lib/node/functions/evaluate/should-force-browser-runtime-in-node.js

@@ -1,5 +1,6 @@
 import { logger } from '../../helpers/logger';
 import { isNodeRuntime } from '../is-node-runtime';
+let hasLoggedWarning = false;
 export const shouldForceBrowserRuntimeInNode = ({ shouldLogWarning }) => {
     if (!isNodeRuntime())
         return false;
@@ -7,7 +8,8 @@ export const shouldForceBrowserRuntimeInNode = ({ shouldLogWarning }) => {
     const isNode20 = process.version.startsWith('v20');
     const hasNoNodeSnapshotNodeOption = process.env.NODE_OPTIONS?.includes('--no-node-snapshot');
     if (isArm64 && isNode20 && !hasNoNodeSnapshotNodeOption) {
-        if (shouldLogWarning) {
+        if (shouldLogWarning && !hasLoggedWarning) {
+            hasLoggedWarning = true;
             logger.log(`Skipping usage of \`isolated-vm\` to avoid crashes in Node v20 on an arm64 machine.
     If you would like to use the \`isolated-vm\` package on this machine, please provide the \`NODE_OPTIONS=--no-node-snapshot\` config to your Node process.
     See https://github.com/BuilderIO/builder/blob/main/packages/sdks/README.md#node-v20--m1-macs-apple-silicon-support for more information.

package/lib/node/functions/extract-localized-values.d.ts

@@ -1,2 +1,6 @@
 import type { BuilderBlock } from '../types/builder-block';
+/**
+ * Returns the block with localized values in `component.options` resolved.
+ * The block is returned unchanged (same object) when it has none.
+ */
 export declare function resolveLocalizedValues(block: BuilderBlock, locale: string | undefined): BuilderBlock;

package/lib/node/functions/extract-localized-values.js

@@ -1,37 +1,76 @@
-import { traverse } from './traverse';
 function isLocalizedField(value) {
     return value && typeof value === 'object' && value['@type'] === '@builder.io/core:LocalizedValue';
 }
-function containsLocalizedValues(data) {
-    if (!data || !Object.getOwnPropertyNames(data).length) {
-        return false;
+const isPlainObjectOrArray = (value) => {
+    if (Array.isArray(value))
+        return true;
+    const proto = Object.getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
+};
+/**
+ * Returns `value` with every localized value replaced by its `locale` entry.
+ * Only the objects and arrays on the way to a replaced value are copied: the
+ * input is never mutated, and a value with nothing localized is returned as-is.
+ */
+function resolveLocalized(value, locale, seen) {
+    if (value === null || typeof value !== 'object')
+        return value;
+    if (isLocalizedField(value)) {
+        return resolveLocalized(value[locale] ?? undefined, locale, seen);
     }
-    let hasLocalizedValues = false;
-    traverse(data, value => {
-        if (isLocalizedField(value)) {
-            hasLocalizedValues = true;
-            return;
+    if (!isPlainObjectOrArray(value))
+        return value;
+    if (seen.has(value))
+        return seen.get(value);
+    seen.set(value, value);
+    let copy = null;
+    if (Array.isArray(value)) {
+        for (let i = 0; i < value.length; i++) {
+            const next = resolveLocalized(value[i], locale, seen);
+            if (next !== value[i]) {
+                if (!copy)
+                    copy = value.slice();
+                copy[i] = next;
+            }
         }
-    });
-    return hasLocalizedValues;
-}
-function extractLocalizedValues(data, locale) {
-    if (!data || !Object.getOwnPropertyNames(data).length) {
-        return {};
     }
-    traverse(data, (value, update) => {
-        if (isLocalizedField(value)) {
-            update(value[locale] ?? undefined);
+    else {
+        for (const key of Object.keys(value)) {
+            const next = resolveLocalized(value[key], locale, seen);
+            if (next !== value[key]) {
+                if (!copy)
+                    copy = {
+                        ...value
+                    };
+                copy[key] = next;
+            }
         }
-    });
-    return data;
+    }
+    const result = copy ?? value;
+    seen.set(value, result);
+    return result;
 }
+/**
+ * Returns the block with localized values in `component.options` resolved.
+ * The block is returned unchanged (same object) when it has none.
+ */
 export function resolveLocalizedValues(block, locale) {
-    if (block.component?.options && containsLocalizedValues(block.component?.options)) {
-        if (!locale) {
-            console.warn('[Builder.io] In order to use localized fields in Builder, you must pass a locale prop to the BuilderComponent or to options object while fetching the content to resolve localized fields. Learn more: https://www.builder.io/c/docs/localization-inline#targeting-and-inline-localization');
-        }
-        block.component.options = extractLocalizedValues(block.component.options, locale ?? 'Default');
+    const options = block.component?.options;
+    if (!options || typeof options !== 'object' || isLocalizedField(options)) {
+        return block;
     }
-    return block;
+    const resolvedOptions = resolveLocalized(options, locale ?? 'Default', new WeakMap());
+    if (resolvedOptions === options) {
+        return block;
+    }
+    if (!locale) {
+        console.warn('[Builder.io] In order to use localized fields in Builder, you must pass a locale prop to the BuilderComponent or to options object while fetching the content to resolve localized fields. Learn more: https://www.builder.io/c/docs/localization-inline#targeting-and-inline-localization');
+    }
+    return {
+        ...block,
+        component: {
+            ...block.component,
+            options: resolvedOptions
+        }
+    };
 }

package/lib/node/functions/get-block-properties.js

@@ -34,9 +34,10 @@ const extractRelevantRootBlockProperties = (block) => {
     };
 };
 export function getBlockProperties({ block, context }) {
+    const { _newProperty, ...blockProperties } = block.properties || {};
     const properties = {
         ...extractRelevantRootBlockProperties(block),
-        ...block.properties,
+        ...blockProperties,
         'builder-id': block.id,
         style: getStyle({
             block,

package/lib/node/functions/get-processed-block.d.ts

@@ -1,6 +1,5 @@
 import type { BuilderContextInterface } from '../context/types';
 import type { BuilderBlock } from '../types/builder-block';
-export declare function deepCloneWithConditions<T = any>(obj: T): T;
 export declare function getProcessedBlock({ block, context, localState, rootState, rootSetState }: {
     block: BuilderBlock;
 } & Pick<BuilderContextInterface, 'localState' | 'context' | 'rootState' | 'rootSetState'>): BuilderBlock;

package/lib/node/functions/get-processed-block.js

@@ -1,64 +1,25 @@
-import { TARGET } from '../constants/target';
-import { omit } from '../helpers/omit';
 import { evaluate } from './evaluate/index';
 import { resolveLocalizedValues } from './extract-localized-values';
-import { fastClone } from './fast-clone';
-import { set } from './set';
+import { isEditingOrPreviewing } from './is-editing-or-previewing';
+import { setCopyOnWrite } from './set';
 import { transformBlock } from './transform-block';
-// Deep clone a block but without cloning any child blocks
-export function deepCloneWithConditions(obj) {
-    if (obj === null || typeof obj !== 'object') {
-        return obj;
-    }
-    if (Array.isArray(obj)) {
-        return obj.map((item) => deepCloneWithConditions(item));
-    }
-    if (obj['@type'] === '@builder.io/sdk:Element') {
-        return obj;
-    }
-    const clonedObj = {};
-    for (const key in obj) {
-        if (key !== 'meta' && Object.prototype.hasOwnProperty.call(obj, key)) {
-            clonedObj[key] = deepCloneWithConditions(obj[key]);
-        }
-    }
-    return clonedObj;
-}
-const IS_SDK_WITHOUT_CACHED_PROCESSED_BLOCK = ['svelte', 'vue', 'angular', 'qwik', 'solid'].includes(TARGET);
-const getCopy = (block) => {
-    if (IS_SDK_WITHOUT_CACHED_PROCESSED_BLOCK) {
-        const copy = fastClone(block);
-        const copied = {
-            ...copy,
-            properties: {
-                ...copy.properties
-            },
-            actions: {
-                ...copy.actions
-            }
-        };
-        return copied;
-    }
-    else {
-        const copy = deepCloneWithConditions(omit(block, 'children', 'meta'));
-        return {
-            ...copy,
-            properties: {
-                ...copy.properties
-            },
-            actions: {
-                ...copy.actions
-            },
-            children: block.children,
-            meta: block.meta
-        };
-    }
-};
 const evaluateBindings = ({ block, context, localState, rootState, rootSetState }) => {
     if (!block.bindings) {
         return block;
     }
-    const copied = getCopy(block);
+    // Only objects along a bound path are copied: the block (and content) passed in is never mutated.
+    const copied = new WeakSet();
+    const copy = {
+        ...block,
+        properties: {
+            ...block.properties
+        },
+        actions: {
+            ...block.actions
+        }
+    };
+    copied.add(copy.properties);
+    copied.add(copy.actions);
     for (const binding in block.bindings) {
         const expression = block.bindings[binding];
         const value = evaluate({
@@ -68,11 +29,32 @@ const evaluateBindings = ({ block, context, localState, rootState, rootSetState
             rootSetState,
             context
         });
-        set(copied, binding, value);
+        setCopyOnWrite(copy, binding, value, copied);
     }
-    return copied;
+    return copy;
+};
+/**
+ * A block without bindings processes to the same result for a given locale, so
+ * it is computed once per block object instead of on every render.
+ * Only the latest locale is kept, so a block holds at most one cached result.
+ */
+const PROCESSED_BLOCKS_WITHOUT_BINDINGS = new WeakMap();
+const hasBindings = (block) => {
+    if (!block.bindings)
+        return false;
+    for (const _ in block.bindings)
+        return true;
+    return false;
 };
 export function getProcessedBlock({ block, context, localState, rootState, rootSetState }) {
+    const locale = rootState.locale;
+    const canUseCache = !hasBindings(block) && typeof block === 'object' && block !== null && !isEditingOrPreviewing();
+    const cacheKey = locale ?? '';
+    if (canUseCache) {
+        const cached = PROCESSED_BLOCKS_WITHOUT_BINDINGS.get(block);
+        if (cached && cached.locale === cacheKey)
+            return cached.block;
+    }
     let transformedBlock = transformBlock(block);
     transformedBlock = evaluateBindings({
         block: transformedBlock,
@@ -81,6 +63,12 @@ export function getProcessedBlock({ block, context, localState, rootState, rootS
         rootSetState,
         context
     });
-    transformedBlock = resolveLocalizedValues(transformedBlock, rootState.locale);
+    transformedBlock = resolveLocalizedValues(transformedBlock, locale);
+    if (canUseCache) {
+        PROCESSED_BLOCKS_WITHOUT_BINDINGS.set(block, {
+            locale: cacheKey,
+            block: transformedBlock
+        });
+    }
     return transformedBlock;
 }

package/lib/node/functions/is-editing-or-previewing.d.ts

@@ -0,0 +1 @@
+export declare const isEditingOrPreviewing: () => boolean;

package/lib/node/functions/is-editing-or-previewing.js

@@ -0,0 +1,3 @@
+import { isEditing } from './is-editing';
+import { isPreviewing } from './is-previewing';
+export const isEditingOrPreviewing = () => isEditing() || isPreviewing();

package/lib/node/functions/set.d.ts

@@ -2,6 +2,34 @@
  * Minimal implementation of lodash's _.set
  * https://lodash.com/docs/4.17.15#set
  *
- * See ./set.test.ts for usage examples
+ * Mutates `obj` in place, creating missing objects/arrays along the path:
+ *
+ *   const obj = { a: { b: 1 } };
+ *   set(obj, 'a.c', 2);      // obj is { a: { b: 1, c: 2 } }
+ *   set(obj, 'list.0', 'x'); // obj.list is ['x']
+ *
+ * See ./set.test.ts for more usage examples
  */
 export declare const set: (obj: any, _path: string | string[], value: any) => any;
+/**
+ * Like `set`, but every object or array along `path` that is not in `copied`
+ * is shallow-copied before being written to, so objects shared with the
+ * original are never mutated. `obj` itself must already be a copy.
+ *
+ *   const block = { options: { text: 'a' }, style: { color: 'red' } };
+ *   const copy = { ...block };
+ *   setCopyOnWrite(copy, 'options.text', 'b', new WeakSet());
+ *   // copy.options is a new object: { text: 'b' }
+ *   // block.options.text is still 'a'
+ *   // copy.style === block.style (untouched branches stay shared)
+ */
+export declare const setCopyOnWrite: (obj: any, _path: string, value: any, copied: WeakSet<object>) => any;
+/**
+ * Deletes the property at `path`, the inverse of `set` for an array path.
+ * Mutates `obj` in place and does nothing when a parent is missing:
+ *
+ *   const obj = { a: { b: 1, c: 2 } };
+ *   unset(obj, ['a', 'b']); // obj is { a: { c: 2 } }
+ *   unset(obj, ['x', 'y']); // no-op
+ */
+export declare const unset: (obj: any, path: string[]) => any;

package/lib/node/functions/set.js

@@ -1,17 +1,98 @@
+const parsePath = (path) => path.toString().match(/[^.[\]]+/g);
+const isArrayIndex = (key) => Math.abs(Number(key)) >> 0 === +key;
+/**
+ * `__proto__` is never allowed. `constructor` and `prototype` are allowed only as
+ * the final key, where they are written as ordinary own properties.
+ */
+const hasUnsafeSegment = (path) => path.some((key, i) => key === '__proto__' || i < path.length - 1 && (key === 'constructor' || key === 'prototype'));
+/**
+ * Own properties only, so a path can never walk into a value shared through a
+ * prototype (e.g. `Object.prototype.toString`) and mutate it.
+ */
+const getOwn = (obj, key) => Object.prototype.hasOwnProperty.call(obj, key) ? obj[key] : undefined;
 /**
  * Minimal implementation of lodash's _.set
  * https://lodash.com/docs/4.17.15#set
  *
- * See ./set.test.ts for usage examples
+ * Mutates `obj` in place, creating missing objects/arrays along the path:
+ *
+ *   const obj = { a: { b: 1 } };
+ *   set(obj, 'a.c', 2);      // obj is { a: { b: 1, c: 2 } }
+ *   set(obj, 'list.0', 'x'); // obj.list is ['x']
+ *
+ * See ./set.test.ts for more usage examples
  */
 export const set = (obj, _path, value) => {
     if (Object(obj) !== obj) {
         return obj;
     }
-    const path = Array.isArray(_path) ? _path : _path.toString().match(/[^.[\]]+/g);
-    if (!path || path.some((key, i) => key === '__proto__' || i < path.length - 1 && (key === 'constructor' || key === 'prototype'))) {
+    const path = Array.isArray(_path) ? _path : parsePath(_path);
+    if (!path || hasUnsafeSegment(path)) {
         return obj;
     }
-    path.slice(0, -1).reduce((a, c, i) => Object(a[c]) === a[c] ? a[c] : a[c] = Math.abs(Number(path[i + 1])) >> 0 === +path[i + 1] ? [] : {}, obj)[path[path.length - 1]] = value;
+    path.slice(0, -1).reduce((a, c, i) => {
+        const next = getOwn(a, c);
+        return Object(next) === next ? next : a[c] = isArrayIndex(path[i + 1]) ? [] : {};
+    }, obj)[path[path.length - 1]] = value;
+    return obj;
+};
+/**
+ * Like `set`, but every object or array along `path` that is not in `copied`
+ * is shallow-copied before being written to, so objects shared with the
+ * original are never mutated. `obj` itself must already be a copy.
+ *
+ *   const block = { options: { text: 'a' }, style: { color: 'red' } };
+ *   const copy = { ...block };
+ *   setCopyOnWrite(copy, 'options.text', 'b', new WeakSet());
+ *   // copy.options is a new object: { text: 'b' }
+ *   // block.options.text is still 'a'
+ *   // copy.style === block.style (untouched branches stay shared)
+ */
+export const setCopyOnWrite = (obj, _path, value, copied) => {
+    if (Object(obj) !== obj) {
+        return obj;
+    }
+    const path = parsePath(_path);
+    if (!path || hasUnsafeSegment(path)) {
+        return obj;
+    }
+    copied.add(obj);
+    let current = obj;
+    for (let i = 0; i < path.length - 1; i++) {
+        const key = path[i];
+        let next = getOwn(current, key);
+        if (Object(next) !== next) {
+            next = isArrayIndex(path[i + 1]) ? [] : {};
+            copied.add(next);
+            current[key] = next;
+        }
+        else if (typeof next === 'object' && !copied.has(next)) {
+            next = Array.isArray(next) ? next.slice() : {
+                ...next
+            };
+            copied.add(next);
+            current[key] = next;
+        }
+        current = next;
+    }
+    current[path[path.length - 1]] = value;
+    return obj;
+};
+/**
+ * Deletes the property at `path`, the inverse of `set` for an array path.
+ * Mutates `obj` in place and does nothing when a parent is missing:
+ *
+ *   const obj = { a: { b: 1, c: 2 } };
+ *   unset(obj, ['a', 'b']); // obj is { a: { c: 2 } }
+ *   unset(obj, ['x', 'y']); // no-op
+ */
+export const unset = (obj, path) => {
+    if (Object(obj) !== obj || !path.length || hasUnsafeSegment(path)) {
+        return obj;
+    }
+    const parent = path.slice(0, -1).reduce((a, c) => Object(a) === a ? getOwn(a, c) : undefined, obj);
+    if (Object(parent) === parent) {
+        delete parent[path[path.length - 1]];
+    }
     return obj;
 };

package/lib/node/helpers/bounded-cache.d.ts

@@ -0,0 +1,4 @@
+export declare const createBoundedCache: <V>(max: number) => {
+    get: (key: string) => V | undefined;
+    set: (key: string, value: V) => void;
+};