@cplieger/reactive 2.1.0 → 2.1.2

package/NOTICE

@@ -0,0 +1,3 @@
+reactive
+Copyright 2026 cplieger
+https://github.com/cplieger/reactive

package/README.md

@@ -1,11 +1,6 @@
 # reactive
 
-[![npm](https://img.shields.io/npm/v/@cplieger/reactive)](https://www.npmjs.com/package/@cplieger/reactive)
-[![JSR](https://jsr.io/badges/@cplieger/reactive)](https://jsr.io/@cplieger/reactive)
-[![Test coverage](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/cplieger/reactive/badges/coverage.json)](https://github.com/cplieger/reactive/actions/workflows/coverage.yml)
-[![Mutation (TS)](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/cplieger/reactive/badges/mutation-ts.json)](https://github.com/cplieger/reactive/issues?q=label%3Astryker-tracker)
-[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/13218/badge)](https://www.bestpractices.dev/projects/13218)
-[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/cplieger/reactive/badge)](https://scorecard.dev/viewer/?uri=github.com/cplieger/reactive)
+[![npm](https://img.shields.io/npm/v/@cplieger/reactive)](https://www.npmjs.com/package/@cplieger/reactive) [![JSR](https://jsr.io/badges/@cplieger/reactive)](https://jsr.io/@cplieger/reactive) [![Mutation (TS)](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/cplieger/reactive/badges/mutation-ts.json)](https://github.com/cplieger/reactive/issues?q=label%3Astryker-tracker)
 
 > Signals + collections + DOM-reconciliation micro-framework for TypeScript
 
@@ -23,6 +18,8 @@ A standalone reactive app-skeleton:
 
 The store, `SignalMap`, and `Collection` are thin facades over a single signal engine: one reactive core, not several. Zero dependencies beyond the DOM API.
 
+> **What needs a DOM:** the render half, `el`, `bindList`, `reconcile`, `patch` and `trackHandler`. The engine and the state tiers do not: `signal`, `effect`, `computed`, `batch`, `untracked`, `createStore`, `SignalMap`, `createCollection` and `createBus`. Nothing touches the DOM at import time, so importing the package under Node, Deno, Bun or Workers succeeds and only the DOM functions throw when called.
+
 Mirrors semantics from @preact/signals-core and solid-js reactivity.
 
 ## Flush model
@@ -202,3 +199,5 @@ This project was built with AI-assisted tooling using [Claude](https://claude.co
 ## License
 
 Apache-2.0. See [LICENSE](LICENSE).
+
+Third-party attributions are in [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md).

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,8 @@
+# Third-party notices
+
+No third-party code is included in this repository. The signal engine is a re-derivation of an upstream design, not a copy of its source, so no license text is reproduced here.
+
+Two designs are followed, each named at the line of ours that follows it:
+
+- The dependency graph and the scheduler in `src/signal.ts` follow [@preact/signals-core](https://github.com/preactjs/signals) (MIT): the doubly-linked source/target edge nodes (`DepNode`, `SourceNode`, `TargetNode` at `src/signal.ts:75-100`), the pull-based glitch-free `refreshComputed` (`src/signal.ts:327`), the eager drain in `endBatch` (`src/signal.ts:397`), and the untracked `subscribe` callback (`src/signal.ts:711`, upstream `preactjs/signals#188`). The pinned baseline is `@preact/signals-core@1.14.4`; the header of `src/signal.ts` records every deliberate delta from it and the upstream machinery this engine does not carry, and `CONTRIBUTING.md` records the drift-audit procedure.
+- The explicit dependency helper `on()` (`src/signal.ts:734`) follows [solid-js](https://github.com/solidjs/solid) (MIT), whose `on()` has the same deps-plus-body shape; `untracked()` (`src/signal.ts:666`) is Solid's `untrack()` under the name Preact gives it.

package/jsr.json

@@ -1,6 +1,6 @@
 {
   "name": "@cplieger/reactive",
-  "version": "2.1.0",
+  "version": "2.1.2",
   "license": "Apache-2.0",
   "exports": {
     ".": "./src/index.ts"
@@ -8,7 +8,9 @@
   "publish": {
     "include": [
       "LICENSE",
+      "NOTICE",
       "README.md",
+      "THIRD_PARTY_NOTICES.md",
       "src/**/*.ts"
     ],
     "exclude": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cplieger/reactive",
-  "version": "2.1.0",
+  "version": "2.1.2",
   "type": "module",
   "sideEffects": false,
   "exports": {
@@ -9,7 +9,11 @@
   "scripts": {
     "typecheck": "tsc -p tsconfig.json",
     "typecheck:tests": "tsc -p tsconfig.tests.json",
-    "test": "vitest --run"
+    "test": "vitest --run",
+    "lint:eslint": "eslint .",
+    "lint:prettier": "prettier --check .",
+    "lint:knip": "knip",
+    "lint:fix": "eslint . --fix && prettier --write ."
   },
   "devDependencies": {
     "@eslint/js": "10.0.1",
@@ -17,16 +21,17 @@
     "@stryker-mutator/typescript-checker": "10.0.0",
     "@stryker-mutator/vitest-runner": "10.0.0",
     "@typescript/native": "npm:typescript@7.0.2",
-    "@vitest/browser": "4.1.11",
-    "@vitest/browser-playwright": "4.1.11",
-    "@vitest/coverage-v8": "4.1.11",
-    "eslint": "10.9.1",
-    "fast-check": "4.9.0",
-    "playwright": "1.62.1",
-    "prettier": "3.9.6",
+    "@vitest/browser": "5.0.1",
+    "@vitest/browser-playwright": "5.0.1",
+    "@vitest/coverage-v8": "5.0.1",
+    "eslint": "10.10.0",
+    "fast-check": "4.10.1",
+    "knip": "6.36.0",
+    "playwright": "1.63.0",
+    "prettier": "3.9.7",
     "typescript": "npm:@typescript/typescript6@6.0.2",
-    "typescript-eslint": "8.69.0",
-    "vitest": "4.1.11"
+    "typescript-eslint": "8.70.0",
+    "vitest": "5.0.1"
   },
   "overrides": {
     "qs": "^6.15.2"
@@ -61,6 +66,9 @@
   "files": [
     "src/",
     "jsr.json",
-    "!src/**/*.test.ts"
+    "!src/**/*.test.ts",
+    "LICENSE",
+    "NOTICE",
+    "THIRD_PARTY_NOTICES.md"
   ]
 }

package/src/reconcile.ts

@@ -30,10 +30,31 @@ export function reconcile<T>(
     }
   }
 
-  let target: Node | null = null;
-  for (let i = items.length - 1; i >= 0; i--) {
-    const item = items[i] as T;
+  // DEPARTING ELEMENTS GO FIRST, before anything is placed. The walk below runs
+  // backwards and skips an element already sitting before the last one it placed; a
+  // departing element still in the tree makes every PREDECESSOR's `nextSibling` point at
+  // a node about to vanish, so the guard sees a mismatch and re-seats a row nothing
+  // changed — which restarts its animations and drops `:hover` and focus. So `onRemove`
+  // fires before the survivors are placed, holding its own intact element; only the
+  // siblings' positions are not yet final. `key` is still called exactly once per item,
+  // and the pairs carry it into the walk so neither loop indexes an array.
+  const pairs: [T, string][] = [];
+  const wanted = new Set<string>();
+  for (const item of items) {
     const k = spec.key(item);
+    pairs.push([item, k]);
+    wanted.add(k);
+  }
+  for (const [k, el] of existing) {
+    if (!wanted.has(k)) {
+      spec.onRemove?.(el, k);
+      el.remove();
+      existing.delete(k);
+    }
+  }
+
+  let target: Node | null = null;
+  for (const [item, k] of pairs.reverse()) {
     let el = existing.get(k);
     if (el === undefined) {
       el = spec.mount(item);
@@ -52,9 +73,4 @@ export function reconcile<T>(
     }
     target = el;
   }
-
-  for (const [k, el] of existing) {
-    spec.onRemove?.(el, k);
-    el.remove();
-  }
 }

package/src/signal.ts

@@ -746,19 +746,27 @@ export function on<T, U>(
   fn: (value: T, prev: T | undefined, prevResult: U | undefined) => U,
   options?: { defer?: false },
 ): () => U;
-// Single accessor, deferred: first call returns undefined.
+/** Single accessor, deferred: the first call returns undefined. A `defer`
+ *  typed as `boolean` selects this overload even when the value is `false`,
+ *  because the type cannot rule the deferred call out; pass a literal
+ *  `false` (or omit `options`) to keep the non-undefined return. */
 export function on<T, U>(
   deps: () => T,
   fn: (value: T, prev: T | undefined, prevResult: U | undefined) => U,
   options: { defer: boolean },
 ): () => U | undefined;
-// Array of accessors, non-deferred (or explicit `{ defer: false }`): never undefined.
+/** Array of accessors, non-deferred (or explicit `{ defer: false }`): never
+ *  undefined. `value` and `prev` are the accessors' results in declaration
+ *  order, typed `unknown[]` — a heterogeneous list is not correlated
+ *  positionally, so narrow each element before use. */
 export function on<U>(
   deps: (() => unknown)[],
   fn: (value: unknown[], prev: unknown[] | undefined, prevResult: U | undefined) => U,
   options?: { defer?: false },
 ): () => U;
-// Array of accessors, deferred: first call returns undefined.
+/** Array of accessors, deferred: the first call returns undefined, having read
+ *  every accessor to seed `prev`. Same `boolean`-widening caveat as the single
+ *  deferred overload. */
 export function on<U>(
   deps: (() => unknown)[],
   fn: (value: unknown[], prev: unknown[] | undefined, prevResult: U | undefined) => U,