@cplieger/reactive 2.1.1 → 2.1.2

package/NOTICE

@@ -0,0 +1,3 @@
+reactive
+Copyright 2026 cplieger
+https://github.com/cplieger/reactive

package/README.md

@@ -1,11 +1,6 @@
 # reactive
 
-[![npm](https://img.shields.io/npm/v/@cplieger/reactive)](https://www.npmjs.com/package/@cplieger/reactive)
-[![JSR](https://jsr.io/badges/@cplieger/reactive)](https://jsr.io/@cplieger/reactive)
-[![Test coverage](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/cplieger/reactive/badges/coverage.json)](https://github.com/cplieger/reactive/actions/workflows/coverage.yml)
-[![Mutation (TS)](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/cplieger/reactive/badges/mutation-ts.json)](https://github.com/cplieger/reactive/issues?q=label%3Astryker-tracker)
-[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/13218/badge)](https://www.bestpractices.dev/projects/13218)
-[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/cplieger/reactive/badge)](https://scorecard.dev/viewer/?uri=github.com/cplieger/reactive)
+[![npm](https://img.shields.io/npm/v/@cplieger/reactive)](https://www.npmjs.com/package/@cplieger/reactive) [![JSR](https://jsr.io/badges/@cplieger/reactive)](https://jsr.io/@cplieger/reactive) [![Mutation (TS)](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/cplieger/reactive/badges/mutation-ts.json)](https://github.com/cplieger/reactive/issues?q=label%3Astryker-tracker)
 
 > Signals + collections + DOM-reconciliation micro-framework for TypeScript
 
@@ -23,6 +18,8 @@ A standalone reactive app-skeleton:
 
 The store, `SignalMap`, and `Collection` are thin facades over a single signal engine: one reactive core, not several. Zero dependencies beyond the DOM API.
 
+> **What needs a DOM:** the render half, `el`, `bindList`, `reconcile`, `patch` and `trackHandler`. The engine and the state tiers do not: `signal`, `effect`, `computed`, `batch`, `untracked`, `createStore`, `SignalMap`, `createCollection` and `createBus`. Nothing touches the DOM at import time, so importing the package under Node, Deno, Bun or Workers succeeds and only the DOM functions throw when called.
+
 Mirrors semantics from @preact/signals-core and solid-js reactivity.
 
 ## Flush model
@@ -202,3 +199,5 @@ This project was built with AI-assisted tooling using [Claude](https://claude.co
 ## License
 
 Apache-2.0. See [LICENSE](LICENSE).
+
+Third-party attributions are in [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md).

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,8 @@
+# Third-party notices
+
+No third-party code is included in this repository. The signal engine is a re-derivation of an upstream design, not a copy of its source, so no license text is reproduced here.
+
+Two designs are followed, each named at the line of ours that follows it:
+
+- The dependency graph and the scheduler in `src/signal.ts` follow [@preact/signals-core](https://github.com/preactjs/signals) (MIT): the doubly-linked source/target edge nodes (`DepNode`, `SourceNode`, `TargetNode` at `src/signal.ts:75-100`), the pull-based glitch-free `refreshComputed` (`src/signal.ts:327`), the eager drain in `endBatch` (`src/signal.ts:397`), and the untracked `subscribe` callback (`src/signal.ts:711`, upstream `preactjs/signals#188`). The pinned baseline is `@preact/signals-core@1.14.4`; the header of `src/signal.ts` records every deliberate delta from it and the upstream machinery this engine does not carry, and `CONTRIBUTING.md` records the drift-audit procedure.
+- The explicit dependency helper `on()` (`src/signal.ts:734`) follows [solid-js](https://github.com/solidjs/solid) (MIT), whose `on()` has the same deps-plus-body shape; `untracked()` (`src/signal.ts:666`) is Solid's `untrack()` under the name Preact gives it.

package/jsr.json

@@ -1,6 +1,6 @@
 {
   "name": "@cplieger/reactive",
-  "version": "2.1.1",
+  "version": "2.1.2",
   "license": "Apache-2.0",
   "exports": {
     ".": "./src/index.ts"
@@ -8,7 +8,9 @@
   "publish": {
     "include": [
       "LICENSE",
+      "NOTICE",
       "README.md",
+      "THIRD_PARTY_NOTICES.md",
       "src/**/*.ts"
     ],
     "exclude": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cplieger/reactive",
-  "version": "2.1.1",
+  "version": "2.1.2",
   "type": "module",
   "sideEffects": false,
   "exports": {
@@ -9,7 +9,11 @@
   "scripts": {
     "typecheck": "tsc -p tsconfig.json",
     "typecheck:tests": "tsc -p tsconfig.tests.json",
-    "test": "vitest --run"
+    "test": "vitest --run",
+    "lint:eslint": "eslint .",
+    "lint:prettier": "prettier --check .",
+    "lint:knip": "knip",
+    "lint:fix": "eslint . --fix && prettier --write ."
   },
   "devDependencies": {
     "@eslint/js": "10.0.1",
@@ -17,16 +21,17 @@
     "@stryker-mutator/typescript-checker": "10.0.0",
     "@stryker-mutator/vitest-runner": "10.0.0",
     "@typescript/native": "npm:typescript@7.0.2",
-    "@vitest/browser": "5.0.0",
-    "@vitest/browser-playwright": "5.0.0",
-    "@vitest/coverage-v8": "5.0.0",
+    "@vitest/browser": "5.0.1",
+    "@vitest/browser-playwright": "5.0.1",
+    "@vitest/coverage-v8": "5.0.1",
     "eslint": "10.10.0",
-    "fast-check": "4.10.0",
+    "fast-check": "4.10.1",
+    "knip": "6.36.0",
     "playwright": "1.63.0",
-    "prettier": "3.9.6",
+    "prettier": "3.9.7",
     "typescript": "npm:@typescript/typescript6@6.0.2",
     "typescript-eslint": "8.70.0",
-    "vitest": "5.0.0"
+    "vitest": "5.0.1"
   },
   "overrides": {
     "qs": "^6.15.2"
@@ -61,6 +66,9 @@
   "files": [
     "src/",
     "jsr.json",
-    "!src/**/*.test.ts"
+    "!src/**/*.test.ts",
+    "LICENSE",
+    "NOTICE",
+    "THIRD_PARTY_NOTICES.md"
   ]
 }

package/src/signal.ts

@@ -746,19 +746,27 @@ export function on<T, U>(
   fn: (value: T, prev: T | undefined, prevResult: U | undefined) => U,
   options?: { defer?: false },
 ): () => U;
-// Single accessor, deferred: first call returns undefined.
+/** Single accessor, deferred: the first call returns undefined. A `defer`
+ *  typed as `boolean` selects this overload even when the value is `false`,
+ *  because the type cannot rule the deferred call out; pass a literal
+ *  `false` (or omit `options`) to keep the non-undefined return. */
 export function on<T, U>(
   deps: () => T,
   fn: (value: T, prev: T | undefined, prevResult: U | undefined) => U,
   options: { defer: boolean },
 ): () => U | undefined;
-// Array of accessors, non-deferred (or explicit `{ defer: false }`): never undefined.
+/** Array of accessors, non-deferred (or explicit `{ defer: false }`): never
+ *  undefined. `value` and `prev` are the accessors' results in declaration
+ *  order, typed `unknown[]` — a heterogeneous list is not correlated
+ *  positionally, so narrow each element before use. */
 export function on<U>(
   deps: (() => unknown)[],
   fn: (value: unknown[], prev: unknown[] | undefined, prevResult: U | undefined) => U,
   options?: { defer?: false },
 ): () => U;
-// Array of accessors, deferred: first call returns undefined.
+/** Array of accessors, deferred: the first call returns undefined, having read
+ *  every accessor to seed `prev`. Same `boolean`-widening caveat as the single
+ *  deferred overload. */
 export function on<U>(
   deps: (() => unknown)[],
   fn: (value: unknown[], prev: unknown[] | undefined, prevResult: U | undefined) => U,