@cldmv/slothlet 3.12.0 → 3.12.1

package/README.md

@@ -43,19 +43,18 @@ Every feature has been hardened with a comprehensive test suite - over **5,300 t
 
 ## ✨ What's New
 
-### Latest: v3.12.0 (July 2026)
+### Latest: v3.12.1 (July 2026)
 
-- **Permission hardening (#183)** — enforcement now **fails closed** on an absent or forged caller identity (opt-out: `permissions.failOpenOnAbsentCaller`); inter-module `new self.x.Foo()` construction and class-instance methods are permission-checked like ordinary calls; the engine-internal `handlers/` and `factories/` subpaths are removed from `exports` (they were the only userland path to a live instance); and the control surface gains an opt-in one-way `seal()`. Per-request context keys can also be owner-locked or write-protected via `scope({ protect, owners })`.
-- **Implementation diagnostics as events (#148)** — non-throwing conditions (a reserved-name shadow, multiple root defaults, a rejected hot-reload merge) now emit `impl:warning` / `impl:error` lifecycle events that fire **regardless of `silent`**; a construction-time `lifecycle` config option subscribes handlers _before_ the api builds, so even init-time diagnostics are observable.
-- **Nested lifecycle hooks (#176)** — nested `shutdown` / `destroy` leaves are no longer silently dropped, with opt-in `collectLifecycleHooks` to invoke them deepest-first on `api.shutdown()` / `destroy()`.
-- [View full v3.12.0 Changelog](./docs/changelog/v3/v3.12.0.md)
+- **Nested context protection (#207)** — `scope({ protect, owners })` now guards **nested** values, not just the top layer. A write to a nested field of a protected/owned key (`context.auth.userId = …`) previously slipped through the lock; it now throws `CONTEXT_KEY_PROTECTED` with the full path (e.g. `auth.userId`), across assignment, `delete`, `defineProperty`, and array mutators such as `push`. Guarding stays scoped to protected/owned keys — plain objects and arrays are wrapped, non-plain values (`Date` / `Map` / `Set`) returned raw — and a named owner can still write nested fields it owns.
+- **`./devcheck` export now actually ships (#209)** — the export pointed at a file the npm `files` whitelist never included, so it threw `ERR_MODULE_NOT_FOUND` in installed copies and `generateBrowserAssets` mirrored a dead entry into every importmap. The file now ships (inert outside the source repo by its own guards), and the importmap generator skips any entry whose resolved target doesn't exist on disk.
+- [View full v3.12.1 Changelog](./docs/changelog/v3/v3.12.1.md)
 
 ### Recent Releases
 
+- **v3.12.0** (July 2026) — Security-and-observability: permission enforcement fails closed on an absent/forged caller (opt-out `permissions.failOpenOnAbsentCaller`), inter-module construction + class-instance methods are permission-checked, the engine-internal `handlers/`/`factories/` subpaths leave `exports`, an opt-in control-surface `seal()`, owner-locked/write-protected context keys via `scope({ protect, owners })`, `impl:warning`/`impl:error` diagnostic lifecycle events, and nested `shutdown`/`destroy` leaves no longer dropped ([Changelog](./docs/changelog/v3/v3.12.0.md))
 - **v3.11.1** (June 2026) — OpenSSF Scorecard publishing fixed: the workflow calls the org reusable `reusable-scorecard.yml@v4` instead of an inline job whose composite checkout step failed Scorecard's publish-verification allowlist (CI-only, #173) ([Changelog](./docs/changelog/v3/v3.11.1.md))
 - **v3.11.0** (June 2026) — Satellite split: non-base locales and TypeScript declarations move to the optional `@cldmv/slothlet-i18n` and `@cldmv/slothlet-types` packages (en-us-only lean core); loader `hidden` option (`.`/`__` hidden by default); browser-mode v8 coverage with an unbalanced-`v8 ignore` analyze gate ([Changelog](./docs/changelog/v3/v3.11.0.md))
 - **v3.10.0** (June 2026) — Synthetic / in-memory leaves for `api.slothlet.api.add()` (inline function or export map, no temp file); hooks integrated with the permission system (gated registration/firing, owner-pinned, `pattern:type` selectors); browser importmap built from the full public export surface ([Changelog](./docs/changelog/v3/v3.10.0.md))
-- **v3.9.2** (May 2026) — Browser mode actually loadable: `generateBrowserAssets()` returns the API manifest **and** slothlet's own importmap; fixes an async double-wrap blow-up on chainable instances (#124), the dead global hook pattern filter (#125), and `npm run docs:build` (#121) ([Changelog](./docs/changelog/v3/v3.9.2.md))
 
 📚 **For complete version history and detailed release notes, see [docs/changelog/](./docs/changelog/) folder.**
 

package/devcheck.mjs

@@ -0,0 +1,99 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /devcheck.mjs
+ *	@Date: 2025-09-09T08:06:19-07:00 (1757430379)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-03-01 20:21:36 -08:00 (1772425296)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+import { existsSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import path from "node:path";
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+const srcPath = path.join(__dirname, "src");
+const distPath = path.join(__dirname, "dist");
+
+// Detect if we're running in a CI environment
+const isCI = !!(
+	process.env.CI || // Generic CI flag
+	process.env.GITHUB_ACTIONS || // GitHub Actions
+	process.env.TRAVIS || // Travis CI
+	process.env.CIRCLECI || // CircleCI
+	process.env.GITLAB_CI || // GitLab CI
+	process.env.BUILDKITE || // Buildkite
+	process.env.JENKINS_URL || // Jenkins
+	process.env.TF_BUILD // Azure DevOps
+);
+
+if (existsSync(srcPath) && !existsSync(distPath) && !isCI) {
+	const nodeEnv = process.env.NODE_ENV?.toLowerCase();
+	const nodeOptions = process.env.NODE_OPTIONS || "";
+
+	// Check if running from node_modules (parent folder is node_modules)
+	const parentFolder = path.basename(path.dirname(__dirname));
+	const isInstalledPackage = parentFolder === "node_modules";
+
+	// Parse conditions from NODE_OPTIONS
+	const hasSlothletDev = nodeOptions.indexOf("--conditions=slothlet-dev") !== -1;
+	const hasGenericDev = nodeOptions.indexOf("--conditions=development") !== -1;
+	const hasDevEnv = nodeEnv === "dev" || nodeEnv === "development";
+
+	// Only check if we're in the slothlet repo (not installed in node_modules)
+	if (!isInstalledPackage && !hasSlothletDev) {
+		let errorMessage;
+
+		// Determine which error message to show based on current state
+		if (hasDevEnv && hasGenericDev) {
+			// They have generic dev settings - tell them to switch to slothlet-dev
+			errorMessage =
+				"❌ Incorrect development environment detected!\n" +
+				"📁 You have generic development settings (NODE_ENV=development, --conditions=development).\n" +
+				"\n" +
+				"⚠️  This causes slothlet to load from src/ which breaks tests and builds!\n" +
+				"\n" +
+				"🔧 Switch to slothlet-specific development settings:\n" +
+				"   Windows (cmd):\n" +
+				"     set NODE_OPTIONS=--conditions=slothlet-dev\n" +
+				"\n" +
+				"   Windows (PowerShell):\n" +
+				"     $env:NODE_OPTIONS='--conditions=slothlet-dev'\n" +
+				"\n" +
+				"   Unix/Linux/macOS:\n" +
+				"     export NODE_OPTIONS=--conditions=slothlet-dev\n" +
+				"\n" +
+				"💡 Using 'slothlet-dev' prevents conflicts with apps that use slothlet.";
+		} else {
+			// They don't have proper settings at all
+			errorMessage =
+				"❌ Development environment not properly configured!\n" +
+				"📁 Source folder detected but NODE_ENV/NODE_OPTIONS not set for slothlet development.\n" +
+				"\n" +
+				"🔧 To fix this, run one of these commands:\n" +
+				"   Windows (cmd):\n" +
+				"     set NODE_ENV=development\n" +
+				"     set NODE_OPTIONS=--conditions=slothlet-dev\n" +
+				"\n" +
+				"   Windows (PowerShell):\n" +
+				"     $env:NODE_ENV='development'\n" +
+				"     $env:NODE_OPTIONS='--conditions=slothlet-dev'\n" +
+				"\n" +
+				"   Unix/Linux/macOS:\n" +
+				"     export NODE_ENV=development\n" +
+				"     export NODE_OPTIONS=--conditions=slothlet-dev\n" +
+				"\n" +
+				"💡 This ensures slothlet loads from src/ instead of dist/ for development.\n" +
+				"🔧 Using 'slothlet-dev' prevents conflicts with consumer development settings.\n" +
+				"🚀 CI environments automatically skip this check.";
+		}
+
+		console.error(errorMessage);
+		process.exit(1);
+	}
+}

package/dist/lib/handlers/trusted-root.mjs

@@ -14,4 +14,4 @@
 	limitations under the License.
 */
 
-import{SlothletError}from"@cldmv/slothlet/errors";const TRUSTED_ROOT=Symbol("slothlet.trustedRoot");const genuineWrappers=new WeakSet;const PROTECT_SENTINEL=Symbol("slothlet.protect");function enforceContextKeyWrite(ctx,prop){const owners=ctx?.__contextOwners;if(!owners||!Object.prototype.hasOwnProperty.call(owners,prop))return;const owner=owners[prop];const writer=ctx.currentWrapper?.____slothletInternal?.apiPath??null;if(owner===PROTECT_SENTINEL){throw new SlothletError("CONTEXT_KEY_PROTECTED",{key:String(prop),owner:"protected",writer:writer??"host"},null,{validationError:true})}const owned=writer!==null&&(writer===owner||writer.startsWith(owner+"."));if(!owned){throw new SlothletError("CONTEXT_KEY_PROTECTED",{key:String(prop),owner:String(owner),writer:writer??"host"},null,{validationError:true})}}export{PROTECT_SENTINEL,TRUSTED_ROOT,enforceContextKeyWrite,genuineWrappers};
+import{SlothletError}from"@cldmv/slothlet/errors";const TRUSTED_ROOT=Symbol("slothlet.trustedRoot");const genuineWrappers=new WeakSet;const PROTECT_SENTINEL=Symbol("slothlet.protect");function enforceContextKeyWrite(ctx,prop){enforceOwnedContextWrite(ctx,prop,String(prop))}function enforceOwnedContextWrite(ctx,ownerKey,pathKey,writerCtx=ctx){const owners=ctx?.__contextOwners;if(!owners||!Object.prototype.hasOwnProperty.call(owners,ownerKey))return;const owner=owners[ownerKey];const writer=writerCtx.currentWrapper?.____slothletInternal?.apiPath??null;if(owner===PROTECT_SENTINEL){throw new SlothletError("CONTEXT_KEY_PROTECTED",{key:pathKey,owner:"protected",writer:writer??"host"},null,{validationError:true})}const owned=writer!==null&&(writer===owner||writer.startsWith(owner+"."));if(!owned){throw new SlothletError("CONTEXT_KEY_PROTECTED",{key:pathKey,owner:String(owner),writer:writer??"host"},null,{validationError:true})}}const PROTECTED_VIEW_CACHE=Symbol("slothlet.protectedViewCache");function isWrappableContextValue(value){if(value===null||typeof value!=="object")return false;if(Array.isArray(value))return true;const proto=Object.getPrototypeOf(value);return proto===Object.prototype||proto===null}function makeProtectedContextView(ctx,getContext,ownerKey,value,path){if(!isWrappableContextValue(value))return value;let caches=ctx[PROTECTED_VIEW_CACHE];if(!caches)caches=ctx[PROTECTED_VIEW_CACHE]=new Map;let cache=caches.get(ownerKey);if(!cache)caches.set(ownerKey,cache=new WeakMap);const cached=cache.get(value);if(cached)return cached;const view=new Proxy(value,{get(target,prop,receiver){return makeProtectedContextView(ctx,getContext,ownerKey,Reflect.get(target,prop,receiver),`${path}.${String(prop)}`)},set(target,prop,newValue,receiver){enforceOwnedContextWrite(ctx,ownerKey,`${path}.${String(prop)}`,getContext()??ctx);return Reflect.set(target,prop,newValue,receiver)},defineProperty(target,prop,descriptor){enforceOwnedContextWrite(ctx,ownerKey,`${path}.${String(prop)}`,getContext()??ctx);return Reflect.defineProperty(target,prop,descriptor)},deleteProperty(target,prop){enforceOwnedContextWrite(ctx,ownerKey,`${path}.${String(prop)}`,getContext()??ctx);return Reflect.deleteProperty(target,prop)}});cache.set(value,view);return view}function readProtectedContextValue(ctx,prop,getContext){const owners=ctx.__contextOwners;if(owners&&Object.prototype.hasOwnProperty.call(owners,prop)){return makeProtectedContextView(ctx,getContext,prop,ctx.context[prop],String(prop))}return ctx.context[prop]}export{PROTECT_SENTINEL,TRUSTED_ROOT,enforceContextKeyWrite,genuineWrappers,readProtectedContextValue};

package/dist/lib/helpers/generate-manifest.mjs

@@ -14,4 +14,4 @@
 	limitations under the License.
 */
 
-import fs from"node:fs/promises";import path from"node:path";import{fileURLToPath}from"node:url";import{SlothletError}from"@cldmv/slothlet/errors";const SLOTHLET_SPEC_RE=/["'](@cldmv\/slothlet(?:\/[^"']+)?)["']/g;const DEFAULT_SLOTHLET_BASE="/node_modules/@cldmv/slothlet/";const LOADABLE_EXTENSIONS=new Set([".mjs",".cjs",".js",".ts",".mts",".cts"]);const SKIP_PREFIXES=["__","."];function isApiFile(filename){const ext=path.extname(filename);return LOADABLE_EXTENSIONS.has(ext)}function makeFileEntry(relativePath){const fullName=path.basename(relativePath);const name=path.basename(relativePath,path.extname(relativePath));return{path:relativePath,name,fullName}}async function scanDir(absDir,rootDir){let entries;try{entries=await fs.readdir(absDir,{withFileTypes:true})}catch{return{files:[],directories:[]}}const files=[];const directories=[];for(const entry of entries){if(SKIP_PREFIXES.some(p=>entry.name.startsWith(p)))continue;if(entry.isFile()){if(isApiFile(entry.name)){const absPath=path.join(absDir,entry.name);const rel=path.relative(rootDir,absPath).replace(/\\/g,"/");files.push(makeFileEntry(rel))}}else if(entry.isDirectory()){const absSubDir=path.join(absDir,entry.name);const relDir=path.relative(rootDir,absSubDir).replace(/\\/g,"/");const children=await scanDir(absSubDir,rootDir);if(children.files.length>0||children.directories.length>0){directories.push({name:entry.name,path:relDir,children})}}}return{files,directories}}async function generateManifest(dir){if(!dir||typeof dir!=="string"){const received=typeof dir==="string"?"<empty>":dir===null?"null":Array.isArray(dir)?"array":typeof dir;throw new SlothletError("GENERATE_MANIFEST_DIR_INVALID",{received},null,{validationError:true})}const absDir=path.resolve(dir);let stat;try{stat=await fs.stat(absDir)}catch(err){throw new SlothletError("GENERATE_MANIFEST_DIR_UNREADABLE",{dir:absDir,reason:err.message},null,{validationError:true})}if(!stat.isDirectory()){throw new SlothletError("GENERATE_MANIFEST_NOT_DIRECTORY",{dir:absDir},null,{validationError:true})}return scanDir(absDir,absDir)}function slothletPackageRoot(){return path.resolve(path.dirname(fileURLToPath(import.meta.url)),"../../..")}async function collectSlothletSpecifiers(root){const specifiers=new Set(["@cldmv/slothlet"]);const pkg=JSON.parse(await fs.readFile(path.join(root,"package.json"),"utf8"));for(const key of Object.keys(pkg.exports)){if(key.includes("*")||key.endsWith(".json"))continue;specifiers.add(key==="."?"@cldmv/slothlet":`@cldmv/slothlet${key.slice(1)}`)}for(const[key,value]of Object.entries(pkg.exports)){if(!key.includes("*")||key.startsWith("./i18n/language/"))continue;const specPrefix=`@cldmv/slothlet${key.slice(1)}`.split("*")[0];const targets=[];(function collectTargets(v){if(typeof v==="string"){if(v.includes("*")&&v.endsWith(".mjs"))targets.push(v)}else if(v&&typeof v==="object"){for(const child of Object.values(v))collectTargets(child)}})(value);for(const tmpl of targets){const star=tmpl.indexOf("*");const dirRel=tmpl.slice(0,star);const suffix=tmpl.slice(star+1);let files;try{files=await fs.readdir(path.join(root,dirRel),{recursive:true})}catch{continue}for(const f of files){const norm=String(f).replace(/\\/g,"/");if(norm.endsWith(suffix))specifiers.add(specPrefix+norm.slice(0,-suffix.length))}}}for(const[key,value]of Object.entries(pkg.imports??{})){if(!key.includes("*"))continue;const specPrefix=key.split("*")[0];const targets=[];(function collectTargets(v){if(typeof v==="string"){if(v.includes("*")&&v.endsWith(".mjs"))targets.push(v)}else if(v&&typeof v==="object"){for(const child of Object.values(v))collectTargets(child)}})(value);for(const tmpl of targets){const star=tmpl.indexOf("*");const dirRel=tmpl.slice(0,star);const suffix=tmpl.slice(star+1);let files;try{files=await fs.readdir(path.join(root,dirRel),{recursive:true})}catch{continue}for(const f of files){const norm=String(f).replace(/\\/g,"/");if(norm.endsWith(suffix))specifiers.add(specPrefix+norm.slice(0,-suffix.length))}}}const SKIP_DIRS=new Set(["node_modules","types","coverage","tmp","tests","api_tests",".git","docs"]);async function scan(dir){const entries=await fs.readdir(dir,{withFileTypes:true});for(const e of entries){if(e.isDirectory()){if(!SKIP_DIRS.has(e.name)&&!e.name.startsWith("."))await scan(path.join(dir,e.name))}else if(/\.(mjs|cjs|js)$/.test(e.name)){const src=await fs.readFile(path.join(dir,e.name),"utf8");let m;SLOTHLET_SPEC_RE.lastIndex=0;while(m=SLOTHLET_SPEC_RE.exec(src)){const spec=m[1];if(spec.startsWith("@cldmv/slothlet/i18n/language/"))continue;if(/[*<>]|\.\.\.|\/$/.test(spec)||spec.split("/").some(s=>s===""))continue;specifiers.add(spec)}}}}await scan(root);return specifiers}async function generateImportMap(slothletBase=DEFAULT_SLOTHLET_BASE){const base=String(slothletBase).endsWith("/")?String(slothletBase):`${slothletBase}/`;const root=slothletPackageRoot();const imports={};for(const spec of await collectSlothletSpecifiers(root)){let resolved;try{resolved=import.meta.resolve(spec)}catch{continue}const rel=path.relative(root,fileURLToPath(resolved)).replace(/\\/g,"/");imports[spec]=base+rel}try{const sampleDir=path.dirname(fileURLToPath(import.meta.resolve("@cldmv/slothlet/i18n/language/en-us.json")));for(const f of(await fs.readdir(sampleDir)).filter(n=>n.endsWith(".json"))){const rel=path.relative(root,path.join(sampleDir,f)).replace(/\\/g,"/");imports[`@cldmv/slothlet/i18n/language/${f}`]=base+rel}}catch{}try{const packRoot=path.dirname(fileURLToPath(import.meta.resolve("@cldmv/slothlet-i18n/package.json")));const packBase=base.replace(/@cldmv\/slothlet(@[^/]+)?\/$/,"@cldmv/slothlet-i18n$1/");if(packBase!==base){for(const f of(await fs.readdir(path.join(packRoot,"languages"))).filter(n=>n.endsWith(".json"))){imports[`@cldmv/slothlet-i18n/language/${f}`]=`${packBase}languages/${f}`}}}catch{}return{imports}}async function generateBrowserAssets(apiDir,options={}){const{slothletBase=DEFAULT_SLOTHLET_BASE}=options;if(typeof slothletBase!=="string"){throw new SlothletError("GENERATE_BROWSER_ASSETS_SLOTHLET_BASE_INVALID",{received:typeof slothletBase},null,{validationError:true})}const[manifest,importmap]=await Promise.all([generateManifest(apiDir),generateImportMap(slothletBase)]);return{manifest,importmap}}export{collectSlothletSpecifiers,generateBrowserAssets,generateImportMap,generateManifest};
+import fs from"node:fs/promises";import path from"node:path";import{fileURLToPath}from"node:url";import{SlothletError}from"@cldmv/slothlet/errors";const SLOTHLET_SPEC_RE=/["'](@cldmv\/slothlet(?:\/[^"']+)?)["']/g;const DEFAULT_SLOTHLET_BASE="/node_modules/@cldmv/slothlet/";const LOADABLE_EXTENSIONS=new Set([".mjs",".cjs",".js",".ts",".mts",".cts"]);const SKIP_PREFIXES=["__","."];function isApiFile(filename){const ext=path.extname(filename);return LOADABLE_EXTENSIONS.has(ext)}function makeFileEntry(relativePath){const fullName=path.basename(relativePath);const name=path.basename(relativePath,path.extname(relativePath));return{path:relativePath,name,fullName}}async function scanDir(absDir,rootDir){let entries;try{entries=await fs.readdir(absDir,{withFileTypes:true})}catch{return{files:[],directories:[]}}const files=[];const directories=[];for(const entry of entries){if(SKIP_PREFIXES.some(p=>entry.name.startsWith(p)))continue;if(entry.isFile()){if(isApiFile(entry.name)){const absPath=path.join(absDir,entry.name);const rel=path.relative(rootDir,absPath).replace(/\\/g,"/");files.push(makeFileEntry(rel))}}else if(entry.isDirectory()){const absSubDir=path.join(absDir,entry.name);const relDir=path.relative(rootDir,absSubDir).replace(/\\/g,"/");const children=await scanDir(absSubDir,rootDir);if(children.files.length>0||children.directories.length>0){directories.push({name:entry.name,path:relDir,children})}}}return{files,directories}}async function generateManifest(dir){if(!dir||typeof dir!=="string"){const received=typeof dir==="string"?"<empty>":dir===null?"null":Array.isArray(dir)?"array":typeof dir;throw new SlothletError("GENERATE_MANIFEST_DIR_INVALID",{received},null,{validationError:true})}const absDir=path.resolve(dir);let stat;try{stat=await fs.stat(absDir)}catch(err){throw new SlothletError("GENERATE_MANIFEST_DIR_UNREADABLE",{dir:absDir,reason:err.message},null,{validationError:true})}if(!stat.isDirectory()){throw new SlothletError("GENERATE_MANIFEST_NOT_DIRECTORY",{dir:absDir},null,{validationError:true})}return scanDir(absDir,absDir)}function slothletPackageRoot(){return path.resolve(path.dirname(fileURLToPath(import.meta.url)),"../../..")}async function collectSlothletSpecifiers(root){const specifiers=new Set(["@cldmv/slothlet"]);const pkg=JSON.parse(await fs.readFile(path.join(root,"package.json"),"utf8"));for(const key of Object.keys(pkg.exports)){if(key.includes("*")||key.endsWith(".json"))continue;specifiers.add(key==="."?"@cldmv/slothlet":`@cldmv/slothlet${key.slice(1)}`)}for(const[key,value]of Object.entries(pkg.exports)){if(!key.includes("*")||key.startsWith("./i18n/language/"))continue;const specPrefix=`@cldmv/slothlet${key.slice(1)}`.split("*")[0];const targets=[];(function collectTargets(v){if(typeof v==="string"){if(v.includes("*")&&v.endsWith(".mjs"))targets.push(v)}else if(v&&typeof v==="object"){for(const child of Object.values(v))collectTargets(child)}})(value);for(const tmpl of targets){const star=tmpl.indexOf("*");const dirRel=tmpl.slice(0,star);const suffix=tmpl.slice(star+1);let files;try{files=await fs.readdir(path.join(root,dirRel),{recursive:true})}catch{continue}for(const f of files){const norm=String(f).replace(/\\/g,"/");if(norm.endsWith(suffix))specifiers.add(specPrefix+norm.slice(0,-suffix.length))}}}for(const[key,value]of Object.entries(pkg.imports??{})){if(!key.includes("*"))continue;const specPrefix=key.split("*")[0];const targets=[];(function collectTargets(v){if(typeof v==="string"){if(v.includes("*")&&v.endsWith(".mjs"))targets.push(v)}else if(v&&typeof v==="object"){for(const child of Object.values(v))collectTargets(child)}})(value);for(const tmpl of targets){const star=tmpl.indexOf("*");const dirRel=tmpl.slice(0,star);const suffix=tmpl.slice(star+1);let files;try{files=await fs.readdir(path.join(root,dirRel),{recursive:true})}catch{continue}for(const f of files){const norm=String(f).replace(/\\/g,"/");if(norm.endsWith(suffix))specifiers.add(specPrefix+norm.slice(0,-suffix.length))}}}const SKIP_DIRS=new Set(["node_modules","types","coverage","tmp","tests","api_tests",".git","docs"]);async function scan(dir){const entries=await fs.readdir(dir,{withFileTypes:true});for(const e of entries){if(e.isDirectory()){if(!SKIP_DIRS.has(e.name)&&!e.name.startsWith("."))await scan(path.join(dir,e.name))}else if(/\.(mjs|cjs|js)$/.test(e.name)){const src=await fs.readFile(path.join(dir,e.name),"utf8");let m;SLOTHLET_SPEC_RE.lastIndex=0;while(m=SLOTHLET_SPEC_RE.exec(src)){const spec=m[1];if(spec.startsWith("@cldmv/slothlet/i18n/language/"))continue;if(/[*<>]|\.\.\.|\/$/.test(spec)||spec.split("/").some(s=>s===""))continue;specifiers.add(spec)}}}}await scan(root);return specifiers}async function generateImportMap(slothletBase=DEFAULT_SLOTHLET_BASE){const base=String(slothletBase).endsWith("/")?String(slothletBase):`${slothletBase}/`;const root=slothletPackageRoot();const imports={};for(const spec of await collectSlothletSpecifiers(root)){let resolved;try{resolved=import.meta.resolve(spec);await fs.access(fileURLToPath(resolved))}catch{continue}const rel=path.relative(root,fileURLToPath(resolved)).replace(/\\/g,"/");imports[spec]=base+rel}try{const sampleDir=path.dirname(fileURLToPath(import.meta.resolve("@cldmv/slothlet/i18n/language/en-us.json")));for(const f of(await fs.readdir(sampleDir)).filter(n=>n.endsWith(".json"))){const rel=path.relative(root,path.join(sampleDir,f)).replace(/\\/g,"/");imports[`@cldmv/slothlet/i18n/language/${f}`]=base+rel}}catch{}try{const packRoot=path.dirname(fileURLToPath(import.meta.resolve("@cldmv/slothlet-i18n/package.json")));const packBase=base.replace(/@cldmv\/slothlet(@[^/]+)?\/$/,"@cldmv/slothlet-i18n$1/");if(packBase!==base){for(const f of(await fs.readdir(path.join(packRoot,"languages"))).filter(n=>n.endsWith(".json"))){imports[`@cldmv/slothlet-i18n/language/${f}`]=`${packBase}languages/${f}`}}}catch{}return{imports}}async function generateBrowserAssets(apiDir,options={}){const{slothletBase=DEFAULT_SLOTHLET_BASE}=options;if(typeof slothletBase!=="string"){throw new SlothletError("GENERATE_BROWSER_ASSETS_SLOTHLET_BASE_INVALID",{received:typeof slothletBase},null,{validationError:true})}const[manifest,importmap]=await Promise.all([generateManifest(apiDir),generateImportMap(slothletBase)]);return{manifest,importmap}}export{collectSlothletSpecifiers,generateBrowserAssets,generateImportMap,generateManifest};

package/dist/lib/runtime/runtime-asynclocalstorage.mjs

@@ -14,4 +14,4 @@
 	limitations under the License.
 */
 
-import{asyncRuntime}from"#factories/context";import{SlothletError}from"@cldmv/slothlet/errors";import{enforceContextKeyWrite}from"#handlers/trusted-root";function safeGetContext(){try{return asyncRuntime.getContext()}catch{return null}}const self=new Proxy({},{get(_,prop){const ctx=safeGetContext();if(!ctx||!ctx.self){throw new SlothletError("RUNTIME_NO_ACTIVE_CONTEXT_SELF",{},null,{validationError:true})}return ctx.self[prop]},ownKeys(){const ctx=safeGetContext();if(!ctx||!ctx.self)return[];return Reflect.ownKeys(ctx.self)},has(_,prop){const ctx=safeGetContext();if(!ctx||!ctx.self)return false;return prop in ctx.self},getOwnPropertyDescriptor(_,prop){const ctx=safeGetContext();if(!ctx||!ctx.self)return void 0;const desc=Reflect.getOwnPropertyDescriptor(ctx.self,prop);if(desc){return{...desc,configurable:true}}return void 0},set(_,prop,value){const ctx=safeGetContext();if(!ctx||!ctx.self){throw new SlothletError("RUNTIME_NO_ACTIVE_CONTEXT_SELF",{},null,{validationError:true})}if(typeof prop==="symbol"){ctx.self[prop]=value;return true}if(ctx.slothlet?.boundApi&&ctx.self!==ctx.slothlet.boundApi){ctx.self[prop]=value;return true}const apiManager=ctx.slothlet?.handlers?.apiManager;if(apiManager&&typeof apiManager.setOwnedProperty==="function"){apiManager.setOwnedProperty(String(prop),value,ctx.currentWrapper??null)}else{ctx.self[prop]=value}return true}});const context=new Proxy({},{get(_,prop){const ctx=safeGetContext();if(!ctx||!ctx.context){return void 0}return ctx.context[prop]},set(_,prop,value){const ctx=safeGetContext();if(!ctx||!ctx.context){throw new SlothletError("RUNTIME_NO_ACTIVE_CONTEXT_CONTEXT",{},null,{validationError:true})}enforceContextKeyWrite(ctx,prop);ctx.context[prop]=value;return true},ownKeys(){const ctx=safeGetContext();if(!ctx||!ctx.context)return[];return Reflect.ownKeys(ctx.context)},has(_,prop){const ctx=safeGetContext();if(!ctx||!ctx.context)return false;return prop in ctx.context},getOwnPropertyDescriptor(_,prop){const ctx=safeGetContext();if(!ctx||!ctx.context)return void 0;return Reflect.getOwnPropertyDescriptor(ctx.context,prop)}});const instanceID=new Proxy({},{get(_,prop){const ctx=safeGetContext();if(!ctx||!ctx.instanceID){return void 0}if(prop===Symbol.toPrimitive||prop==="toString"||prop==="valueOf"){return()=>ctx.instanceID}return ctx.instanceID[prop]},has(_,prop){const ctx=safeGetContext();if(!ctx||!ctx.instanceID)return false;return prop in Object(ctx.instanceID)}});export{context,instanceID,self};
+import{asyncRuntime}from"#factories/context";import{SlothletError}from"@cldmv/slothlet/errors";import{enforceContextKeyWrite,readProtectedContextValue}from"#handlers/trusted-root";function safeGetContext(){try{return asyncRuntime.getContext()}catch{return null}}const self=new Proxy({},{get(_,prop){const ctx=safeGetContext();if(!ctx||!ctx.self){throw new SlothletError("RUNTIME_NO_ACTIVE_CONTEXT_SELF",{},null,{validationError:true})}return ctx.self[prop]},ownKeys(){const ctx=safeGetContext();if(!ctx||!ctx.self)return[];return Reflect.ownKeys(ctx.self)},has(_,prop){const ctx=safeGetContext();if(!ctx||!ctx.self)return false;return prop in ctx.self},getOwnPropertyDescriptor(_,prop){const ctx=safeGetContext();if(!ctx||!ctx.self)return void 0;const desc=Reflect.getOwnPropertyDescriptor(ctx.self,prop);if(desc){return{...desc,configurable:true}}return void 0},set(_,prop,value){const ctx=safeGetContext();if(!ctx||!ctx.self){throw new SlothletError("RUNTIME_NO_ACTIVE_CONTEXT_SELF",{},null,{validationError:true})}if(typeof prop==="symbol"){ctx.self[prop]=value;return true}if(ctx.slothlet?.boundApi&&ctx.self!==ctx.slothlet.boundApi){ctx.self[prop]=value;return true}const apiManager=ctx.slothlet?.handlers?.apiManager;if(apiManager&&typeof apiManager.setOwnedProperty==="function"){apiManager.setOwnedProperty(String(prop),value,ctx.currentWrapper??null)}else{ctx.self[prop]=value}return true}});const context=new Proxy({},{get(_,prop){const ctx=safeGetContext();if(!ctx||!ctx.context){return void 0}return readProtectedContextValue(ctx,prop,safeGetContext)},set(_,prop,value){const ctx=safeGetContext();if(!ctx||!ctx.context){throw new SlothletError("RUNTIME_NO_ACTIVE_CONTEXT_CONTEXT",{},null,{validationError:true})}enforceContextKeyWrite(ctx,prop);ctx.context[prop]=value;return true},ownKeys(){const ctx=safeGetContext();if(!ctx||!ctx.context)return[];return Reflect.ownKeys(ctx.context)},has(_,prop){const ctx=safeGetContext();if(!ctx||!ctx.context)return false;return prop in ctx.context},getOwnPropertyDescriptor(_,prop){const ctx=safeGetContext();if(!ctx||!ctx.context)return void 0;return Reflect.getOwnPropertyDescriptor(ctx.context,prop)}});const instanceID=new Proxy({},{get(_,prop){const ctx=safeGetContext();if(!ctx||!ctx.instanceID){return void 0}if(prop===Symbol.toPrimitive||prop==="toString"||prop==="valueOf"){return()=>ctx.instanceID}return ctx.instanceID[prop]},has(_,prop){const ctx=safeGetContext();if(!ctx||!ctx.instanceID)return false;return prop in Object(ctx.instanceID)}});export{context,instanceID,self};

package/dist/lib/runtime/runtime-livebindings.mjs

@@ -14,4 +14,4 @@
 	limitations under the License.
 */
 
-import{liveRuntime}from"#factories/context";import{SlothletError}from"@cldmv/slothlet/errors";import{enforceContextKeyWrite}from"#handlers/trusted-root";const self=new Proxy({},{get(_,prop){const ctx=liveRuntime.getContext();if(!ctx||!ctx.self){throw new SlothletError("RUNTIME_NO_ACTIVE_CONTEXT_SELF",{},null,{validationError:true})}return ctx.self[prop]},ownKeys(){const ctx=liveRuntime.getContext();if(!ctx||!ctx.self)return[];return Reflect.ownKeys(ctx.self)},has(_,prop){const ctx=liveRuntime.getContext();if(!ctx||!ctx.self)return false;return prop in ctx.self},getOwnPropertyDescriptor(_,prop){const ctx=liveRuntime.getContext();if(!ctx||!ctx.self)return void 0;const desc=Reflect.getOwnPropertyDescriptor(ctx.self,prop);if(desc){return{...desc,configurable:true}}return void 0},set(_,prop,value){const ctx=liveRuntime.getContext();if(!ctx||!ctx.self){throw new SlothletError("RUNTIME_NO_ACTIVE_CONTEXT_SELF",{},null,{validationError:true})}if(typeof prop==="symbol"){ctx.self[prop]=value;return true}if(ctx.slothlet?.boundApi&&ctx.self!==ctx.slothlet.boundApi){ctx.self[prop]=value;return true}const apiManager=ctx.slothlet?.handlers?.apiManager;if(apiManager&&typeof apiManager.setOwnedProperty==="function"){apiManager.setOwnedProperty(String(prop),value,ctx.currentWrapper??null)}else{ctx.self[prop]=value}return true}});const context=new Proxy({},{get(_,prop){const ctx=liveRuntime.getContext();if(!ctx||!ctx.context){return void 0}return ctx.context[prop]},set(_,prop,value){const ctx=liveRuntime.getContext();if(!ctx||!ctx.context){throw new SlothletError("RUNTIME_NO_ACTIVE_CONTEXT_CONTEXT",{},null,{validationError:true})}enforceContextKeyWrite(ctx,prop);ctx.context[prop]=value;return true},ownKeys(){const ctx=liveRuntime.getContext();if(!ctx||!ctx.context)return[];return Reflect.ownKeys(ctx.context)},has(_,prop){const ctx=liveRuntime.getContext();if(!ctx||!ctx.context)return false;return prop in ctx.context},getOwnPropertyDescriptor(_,prop){const ctx=liveRuntime.getContext();if(!ctx||!ctx.context)return void 0;return Reflect.getOwnPropertyDescriptor(ctx.context,prop)}});export{context,self};
+import{liveRuntime}from"#factories/context";import{SlothletError}from"@cldmv/slothlet/errors";import{enforceContextKeyWrite,readProtectedContextValue}from"#handlers/trusted-root";const resolveActiveContext=()=>liveRuntime.getContext();const self=new Proxy({},{get(_,prop){const ctx=liveRuntime.getContext();if(!ctx||!ctx.self){throw new SlothletError("RUNTIME_NO_ACTIVE_CONTEXT_SELF",{},null,{validationError:true})}return ctx.self[prop]},ownKeys(){const ctx=liveRuntime.getContext();if(!ctx||!ctx.self)return[];return Reflect.ownKeys(ctx.self)},has(_,prop){const ctx=liveRuntime.getContext();if(!ctx||!ctx.self)return false;return prop in ctx.self},getOwnPropertyDescriptor(_,prop){const ctx=liveRuntime.getContext();if(!ctx||!ctx.self)return void 0;const desc=Reflect.getOwnPropertyDescriptor(ctx.self,prop);if(desc){return{...desc,configurable:true}}return void 0},set(_,prop,value){const ctx=liveRuntime.getContext();if(!ctx||!ctx.self){throw new SlothletError("RUNTIME_NO_ACTIVE_CONTEXT_SELF",{},null,{validationError:true})}if(typeof prop==="symbol"){ctx.self[prop]=value;return true}if(ctx.slothlet?.boundApi&&ctx.self!==ctx.slothlet.boundApi){ctx.self[prop]=value;return true}const apiManager=ctx.slothlet?.handlers?.apiManager;if(apiManager&&typeof apiManager.setOwnedProperty==="function"){apiManager.setOwnedProperty(String(prop),value,ctx.currentWrapper??null)}else{ctx.self[prop]=value}return true}});const context=new Proxy({},{get(_,prop){const ctx=liveRuntime.getContext();if(!ctx||!ctx.context){return void 0}return readProtectedContextValue(ctx,prop,resolveActiveContext)},set(_,prop,value){const ctx=liveRuntime.getContext();if(!ctx||!ctx.context){throw new SlothletError("RUNTIME_NO_ACTIVE_CONTEXT_CONTEXT",{},null,{validationError:true})}enforceContextKeyWrite(ctx,prop);ctx.context[prop]=value;return true},ownKeys(){const ctx=liveRuntime.getContext();if(!ctx||!ctx.context)return[];return Reflect.ownKeys(ctx.context)},has(_,prop){const ctx=liveRuntime.getContext();if(!ctx||!ctx.context)return false;return prop in ctx.context},getOwnPropertyDescriptor(_,prop){const ctx=liveRuntime.getContext();if(!ctx||!ctx.context)return void 0;return Reflect.getOwnPropertyDescriptor(ctx.context,prop)}});export{context,self};

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@cldmv/slothlet",
-	"version": "3.12.0",
+	"version": "3.12.1",
 	"moduleVersions": {
 		"lazy": "3.0.0",
 		"eager": "3.0.0",
@@ -314,11 +314,11 @@
 	"devDependencies": {
 		"@cldmv/fix-headers": "^1.3.0",
 		"@cldmv/vitest-runner": "^1.2.0",
-		"@eslint/css": "^1.3.0",
+		"@eslint/css": "^1.4.0",
 		"@eslint/js": "^10.0.1",
 		"@eslint/json": "^2.0.1",
 		"@eslint/markdown": "^8.0.3",
-		"@types/node": "^26.1.0",
+		"@types/node": "^26.1.1",
 		"@vitest/browser": "^4.1.10",
 		"@vitest/browser-playwright": "^4.1.10",
 		"@vitest/coverage-v8": "^4.1.10",
@@ -326,8 +326,8 @@
 		"chalk": "^5.6.2",
 		"chokidar": "^5.0.0",
 		"dmd": "^7.1.1",
-		"esbuild": "^0.28.0",
-		"eslint": "^10.6.0",
+		"esbuild": "^0.28.1",
+		"eslint": "^10.7.0",
 		"estree-walker": "^3.0.3",
 		"globals": "^17.7.0",
 		"jsdoc": "^4.0.5",
@@ -335,7 +335,7 @@
 		"jsdoc2md": "^1.0.0",
 		"jsonc-parser": "^3.3.1",
 		"playwright": "^1.61.1",
-		"prettier": "^3.9.4",
+		"prettier": "^3.9.5",
 		"shx": "^0.4.0",
 		"typescript": "^6.0.3",
 		"vitest": "^4.1.10"
@@ -357,6 +357,7 @@
 	"files": [
 		"index.mjs",
 		"index.cjs",
+		"devcheck.mjs",
 		"README.md",
 		"REFERENCE.md",
 		"LICENSE",