@panphora/clayjs 0.2.0 → 0.4.0

package/src/dom/all.js

@@ -156,36 +156,9 @@ const createMethodHandler = (elements, plugins, methods) => ({
     // - When a method returns an Element (like cloneNode), it wraps it in a proxy
     // - When a method returns undefined (like removeAttribute), it chains on the original elements
     // - For other return values, like strings, it returns the results in an array
-    // We also handle passing in an all-wrapped proxy object as an argument and loop over all elements in it
-    // In the method handler's get function, replace the function call handling with:
     if (typeof value === 'function') {
       return (...args) => {
-        // Unwrap any proxy arguments
-        const unwrappedArgs = args.map(arg => {
-          if (arg && arg.constructor === Proxy) {
-            return Array.from(arg);
-          }
-          return arg;
-        });
-
-        const results = elements.map(el => {
-          // Check if any of the unwrapped arguments are arrays (from proxies)
-          const hasProxyArgs = unwrappedArgs.some(Array.isArray);
-
-          if (hasProxyArgs) {
-            // Handle proxy arguments case
-            const elementResults = unwrappedArgs.map(arg => {
-              if (Array.isArray(arg)) {
-                return arg.map(proxyEl => el[prop](proxyEl));
-              }
-              return [el[prop](...args)];
-            }).flat();
-            return elementResults[elementResults.length - 1];
-          } else {
-            // Simple case - just call the method once with original arguments
-            return el[prop](...args);
-          }
-        });
+        const results = elements.map(el => el[prop](...args));
 
         if (results[0] instanceof Element) {
           return createElementProxy(results.filter(Boolean), plugins, methods);
@@ -390,7 +363,9 @@ const All = new Proxy(function (selectorOrElements, contextSelector) {
     if (typeof selectorOrElements === 'string') {
       const elements = contextElements.flatMap(context => {
         // Include context itself if it matches the selector
-        const matches = context.matches(selectorOrElements) ? [context] : [];
+        // Document has no matches(): it can never be its own match, only a root
+        // to search under.
+        const matches = context.matches?.(selectorOrElements) ? [context] : [];
         // Plus all descendants that match
         const descendants = Array.from(context.querySelectorAll(selectorOrElements));
         return [...matches, ...descendants];

package/src/dom/form-data.js

@@ -5,7 +5,7 @@ function getDataFromForm(container) {
   // Helper function to process a single element
   const processElement = (elem) => {
     const name = elem.getAttribute('name');
-    const value = elem.value || elem.getAttribute('value');
+    const value = elem.value ?? elem.getAttribute('value');
 
     // Skip elements without a name or with a disabled attribute
     if (!name || elem.disabled) return;

package/src/dom/nearest.js

@@ -31,7 +31,9 @@
 export default function nearest (startElem, selector, elementFoundReturnValue = x => x) {
   const visited = new Set();
 
-  // Check node and its descendants using BFS
+  // Returns the matched ELEMENT, not the transformed value: a transform yielding
+  // "" or false used to read as not-found here, so the search walked past a real
+  // match (an empty input, an unchecked box) and could report a farther element.
   function checkDeep(root) {
     if (!root || visited.has(root)) return null;
 
@@ -46,7 +48,7 @@ export default function nearest (startElem, selector, elementFoundReturnValue =
       localVisited.add(node);
 
       if (node.matches(selector)) {
-        return elementFoundReturnValue(node);
+        return node;
       }
 
       queue.push(...node.children);
@@ -58,8 +60,8 @@ export default function nearest (startElem, selector, elementFoundReturnValue =
   function checkSiblings(start, direction) {
     let sibling = start[direction];
     while (sibling) {
-      const result = checkDeep(sibling);
-      if (result) return result;
+      const found = checkDeep(sibling);
+      if (found) return found;
       sibling = sibling[direction];
     }
     return null;
@@ -80,14 +82,14 @@ export default function nearest (startElem, selector, elementFoundReturnValue =
 
     // Check children deeply
     for (const child of current.children) {
-      const result = checkDeep(child);
-      if (result) return result;
+      const found = checkDeep(child);
+      if (found) return elementFoundReturnValue(found);
     }
 
     // Check siblings deeply
-    let result = checkSiblings(current, 'previousElementSibling') ||
-                 checkSiblings(current, 'nextElementSibling');
-    if (result) return result;
+    const found = checkSiblings(current, 'previousElementSibling') ||
+                  checkSiblings(current, 'nextElementSibling');
+    if (found) return elementFoundReturnValue(found);
 
     // Move up to parent
     current = current.parentElement;

package/src/internals/index.js

@@ -0,0 +1,64 @@
+/**
+ * internals/index.js — the supported low-level surface.
+ *
+ * Everything here is reachable by direct module import whether we export it or
+ * not, because src/ ships to npm and the CDN. What this file adds is the promise:
+ * these names keep working, and anything not named here may change in a patch.
+ *
+ * Lower level than clay.* deliberately. These are the pieces the library builds
+ * itself out of, so they assume you know the save lifecycle. The ergonomics are
+ * your problem; the stability is ours.
+ */
+
+import { captureSnapshot, captureForSave } from "../core/snapshot.js";
+import { saveHtml, replacePageWith, isSaveInProgress } from "../core/save-core.js";
+import {
+  addRegionToken,
+  resolveRegionPolicy,
+  isInert,
+  isSnapshotRemoved,
+  PERSIST,
+  REGION_ATTRS,
+  STRIP_FROM_SAVE,
+  STRIP_FROM_COMPARISON,
+  SNAPSHOT_REMOVE_SELECTOR,
+  FREEZE_SELECTOR,
+} from "../lib/region-policy.js";
+
+const clay = (window.clay = window.clay || {});
+
+clay.internals = {
+  // The snapshot pipeline, read side. captureSnapshot gives you the clone before
+  // any stripping; captureForSave gives you the bytes a save would send.
+  captureSnapshot,
+  captureForSave,
+
+  // Write your own attribute without hardcoding our selectors. Doing it by hand is
+  // how a custom attribute quietly stops respecting [no-save] two releases later.
+  region: {
+    addRegionToken,
+    resolveRegionPolicy,
+    isInert,
+    isSnapshotRemoved,
+    PERSIST,
+    REGION_ATTRS,
+    selectors: {
+      stripFromSave: STRIP_FROM_SAVE,
+      stripFromComparison: STRIP_FROM_COMPARISON,
+      snapshotRemove: SNAPSHOT_REMOVE_SELECTOR,
+      freeze: FREEZE_SELECTOR,
+    },
+  },
+
+  // The save lane under clay.save. saveHtml sends bytes you supply, so it bypasses
+  // the snapshot pipeline entirely: whatever you hand it is what lands in the
+  // person's file. Check isSaveInProgress first — firing into an in-flight save is
+  // how you lose an edit.
+  save: {
+    saveHtml,
+    replacePageWith,
+    isSaveInProgress,
+  },
+};
+
+export default clay.internals;

package/src/lib/cache-bust.js

@@ -1,12 +1,22 @@
 // cacheBust.js
 // Cache-bust an element's href or src attribute by adding/updating a version query param
 
+import { addRegionToken } from './region-policy.js';
+
 function cacheBust(el) {
   const attr = el.hasAttribute('href') ? 'href' : 'src';
   const currentValue = el.getAttribute(attr);
   const url = new URL(currentValue, location.href);
   url.searchParams.set('v', Date.now());
   el.setAttribute(attr, url.href);
+
+  // This runs from [onaftersave], i.e. after the save baseline was taken, so the
+  // rewrite would otherwise read as a user edit and leave the page dirty forever.
+  // Marking the element instead of re-reading the whole live DOM afterwards is what
+  // lets the baseline stay equal to the bytes actually sent: a post-save re-read
+  // cannot tell this rewrite apart from something the user typed mid-save, and used
+  // to record the latter as saved without sending it.
+  addRegionToken(el, 'no-trigger-autosave');
 }
 
 export default cacheBust;

package/src/lib/cookie.js

@@ -1,31 +1,66 @@
+// A sandboxed document (an iframe without allow-same-origin) throws a
+// SecurityError on document.cookie. is-edit-mode.js reads a cookie at module
+// scope, so an unguarded throw does not merely lose the cookie: it escapes the
+// dynamic import the loader is awaiting and the document loses its client
+// entirely. No cookies readable means no cookie, which is the honest answer.
+function readCookies() {
+  try {
+    return document.cookie;
+  } catch (err) {
+    return '';
+  }
+}
+
+// A cookie value that is not valid percent-encoding (a stray '%') makes
+// decodeURIComponent throw URIError. Decode ONCE, outside the JSON try: the catch
+// used to call it a second time on the value that had just thrown, so the second
+// throw escaped — out through is-edit-mode's module-scope read, out through the
+// loader's awaited import, and the document lost its client over a malformed cookie
+// it never even needed.
+function decode(value) {
+  try {
+    return decodeURIComponent(value);
+  } catch (err) {
+    return value;
+  }
+}
+
 // e.g. Cookie.get("isAdminOfCurrentResource")
 function get (cookieName) {
-  const cookies = document.cookie.split('; ');
+  const cookies = readCookies().split('; ');
   const cookie = cookies.find(row => row.startsWith(`${cookieName}=`));
   if (!cookie) return null;
-  const cookieValue = cookie.slice(cookieName.length + 1);
+  const cookieValue = decode(cookie.slice(cookieName.length + 1));
+  try {
+    return JSON.parse(cookieValue);
+  } catch (err) {
+    return cookieValue;
+  }
+}
+
+// Writing document.cookie throws in a sandbox for the same reason reading it
+// does, and there is nothing to clear there anyway.
+function writeCookie(value) {
   try {
-    return JSON.parse(decodeURIComponent(cookieValue));
+    document.cookie = value;
   } catch (err) {
-    return decodeURIComponent(cookieValue);
+    // Sandboxed: no cookie jar to clear.
   }
 }
 
 // e.g. Cookie.remove("isAdminOfCurrentResource")
 function remove(name) {
   // Clear from current path
-  document.cookie = `${name}=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/;`
-
-  // Clear from current domain
-  document.cookie = `${name}=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/; domain=${window.location.hostname};`
+  writeCookie(`${name}=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/;`)
 
-  // Clear from apex domain (e.g., .hyperclay.com or .localhyperclay.com)
-  const hostname = window.location.hostname;
-  if (hostname.includes('.')) {
-    // Get the last two parts for the apex domain (handles .com, .co.uk, etc)
-    const parts = hostname.split('.');
-    const apexDomain = '.' + parts.slice(-2).join('.');
-    document.cookie = `${name}=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/; domain=${apexDomain};`
+  // Clear from every parent domain rather than a guessed apex. Joining the last
+  // two labels produces `.co.uk` on editor.example.co.uk, which is a public
+  // suffix: the browser rejects it and the real cookie survives. Walking every
+  // suffix needs no public-suffix list, because the browser rejects exactly the
+  // ones that are public suffixes, harmlessly.
+  const labels = window.location.hostname.split('.');
+  for (let i = 0; i < labels.length; i++) {
+    writeCookie(`${name}=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/; domain=.${labels.slice(i).join('.')};`);
   }
 }
 

package/src/lib/extension-noise.js

@@ -52,7 +52,11 @@ export function stripExtensionNoise(root) {
   if (!root || !root.querySelectorAll) return
   try {
     for (const el of root.querySelectorAll(EXTENSION_NODE_SELECTOR)) el.remove()
-    for (const el of root.querySelectorAll('*')) {
+    // querySelectorAll('*') never returns the root itself, so an extension stamp on
+    // <html> used to ride into every saved file. The root is the one element an
+    // extension can mark on a page with no other match.
+    for (const el of [root, ...root.querySelectorAll('*')]) {
+      if (!el.attributes) continue
       for (const attr of [...el.attributes]) {
         if (EXTENSION_ATTR_PATTERN.test(attr.name.toLowerCase())) el.removeAttribute(attr.name)
       }

package/src/lib/mutation.js

@@ -68,10 +68,34 @@
 
 import { EXTENSION_ATTR_PATTERN } from './extension-noise.js';
 import { resolveRegionPolicy, isInert, strictestPolicy, skipForPolicy } from './region-policy.js';
+import { ROOT_LIBRARY_ATTRS } from './root-attrs.js';
+
 import { isUserDrivenNow, markUserDriven } from './user-gesture.js';
 
 const dummyElem = document.createElement("div");
 
+// Attributes clayjs itself writes on <html>: savestatus flips on every save,
+// editmode/pageowner on every mode change. They are library state, not page
+// content, and snapshots already normalize them so they never reach a file.
+//
+// This became load-bearing the moment the hub started observing documentElement
+// instead of body. The raw lane is deliberately unfiltered ("raw means raw"), so
+// without this every save would push a savestatus flip into undo's record stream
+// and Cmd+Z after a save would undo that instead of the user's edit.
+const ROOT_LIBRARY_ATTR_SET = new Set(ROOT_LIBRARY_ATTRS);
+
+function isLibraryRootAttr(record) {
+  return record.type === 'attributes'
+    && record.target === document.documentElement
+    && ROOT_LIBRARY_ATTR_SET.has(record.attributeName);
+}
+
+function withoutLibraryNoise(records) {
+  return records.some(isLibraryRootAttr)
+    ? records.filter(r => !isLibraryRootAttr(r))
+    : records;
+}
+
 const localMutation = {
   _callbacks: {
     anyChange: [],
@@ -108,8 +132,8 @@ const localMutation = {
     // Bridge: pause undo recorder too. Live-sync calls Mutation.pause()
     // before morphing remote HTML in, and we want those mutations excluded
     // from the local undo stack as well. undo.pause() is itself reference-counted.
-    if (typeof window !== 'undefined' && window.hyperclay && window.hyperclay.undo && window.hyperclay.undo.pause) {
-      window.hyperclay.undo.pause();
+    if (typeof window !== 'undefined' && window.clay?.undo?.pause) {
+      window.clay.undo.pause();
     }
     this._log('Paused', this._pauseDepth);
   },
@@ -130,8 +154,8 @@ const localMutation = {
     if (this._pauseDepth === 0 && this._observer) {
       this._drainBrowserQueue(this);
     }
-    if (typeof window !== 'undefined' && window.hyperclay && window.hyperclay.undo && window.hyperclay.undo.resume) {
-      window.hyperclay.undo.resume();
+    if (typeof window !== 'undefined' && window.clay?.undo?.resume) {
+      window.clay.undo.resume();
     }
     this._log('Resumed', this._pauseDepth);
   },
@@ -156,7 +180,7 @@ const localMutation = {
       // While paused, only non-pausable callbacks (pure enhancers) run.
       if (onlyNonPausable && callback.pausable !== false) continue;
 
-      const { fn, debounce = 0, selectorFilter, omitChangeDetails, require, skip } = callback;
+      const { fn, debounce = 0, maxWait = 0, selectorFilter, omitChangeDetails, require, skip } = callback;
 
       // Per-consumer region policy: drop changes whose region this consumer
       // doesn't participate in (no-save / no-trigger-autosave / no-undo / freeze
@@ -214,10 +238,21 @@ const localMutation = {
           callback.timeout = null;
         }
 
+        // A plain debounce resets on every mutation, so anything on the page that
+        // changes faster than the delay (a clock, a countdown, a polling counter)
+        // keeps pushing the callback into the future and it never fires at all.
+        // maxWait puts a ceiling on that: however long the churn lasts, the
+        // callback runs within maxWait of the FIRST change it was waiting on.
+        if (!callback.firstPendingAt) callback.firstPendingAt = Date.now();
+        const delay = maxWait > 0
+          ? Math.max(0, Math.min(debounce, maxWait - (Date.now() - callback.firstPendingAt)))
+          : debounce;
+
         if (omitChangeDetails) {
           // For omitChangeDetails, just reset the timer
           callback.timeout = setTimeout(() => {
             callback.timeout = null;
+            callback.firstPendingAt = null;
             try {
               this._log('Executing debounced callback (no details)');
               fn();
@@ -225,7 +260,7 @@ const localMutation = {
               this._log('Error in callback execution:', e, 'error');
               console.error('Error in Mutation callback:', e);
             }
-          }, debounce);
+          }, delay);
         } else {
           // For callbacks with change details, accumulate changes
           if (!callback.pendingChanges) {
@@ -238,6 +273,7 @@ const localMutation = {
             const changes = callback.pendingChanges;
             callback.pendingChanges = null; // Reset to null, not empty array
             callback.timeout = null; // Clear the timeout reference
+            callback.firstPendingAt = null;
             try {
               this._log('Executing debounced callback with changes:', { changes });
               if (changes && changes.length > 0) {
@@ -247,7 +283,7 @@ const localMutation = {
               this._log('Error in callback execution:', e, 'error');
               console.error('Error in Mutation callback:', e);
             }
-          }, debounce);
+          }, delay);
         }
       }
     }
@@ -272,7 +308,9 @@ const localMutation = {
   //      path) so the raw lane's push timing matches a real MutationObserver and
   //      undo's own paused-drop keeps working.
   //   2. the change lane (pause-gated, as before).
-  _onRecords(records) {
+  _onRecords(rawRecords) {
+    const records = withoutLibraryNoise(rawRecords);
+    if (!records.length) return;
     this._fanOutRaw(records);
     this._handleMutations(records);
   },
@@ -304,7 +342,9 @@ const localMutation = {
   //   (c) the requester: returns the pulled records merged with its own buffer,
   //       then clears the buffer.
   _drainBrowserQueue(requester) {
-    const pulled = this._observer ? this._observer.takeRecords() : [];
+    // Same filter as _onRecords: takeRecords() bypasses the observer callback, so
+    // library-owned root attributes would otherwise reach subscribers this way.
+    const pulled = withoutLibraryNoise(this._observer ? this._observer.takeRecords() : []);
     const requesterIsRaw = !!requester && this._rawSubscribers.indexOf(requester) !== -1;
 
     if (pulled.length) {
@@ -614,6 +654,8 @@ const localMutation = {
     const cb = {
       fn: callback,
       debounce: options.debounce || 0,
+      // Ceiling on the debounce: without it, continuous churn defers forever.
+      maxWait: options.maxWait || 0,
       selectorFilter: options.selectorFilter,
       omitChangeDetails: options.omitChangeDetails,
       // Region policy: axis this consumer needs ('observed' | 'autosave' | 'undo')
@@ -624,7 +666,8 @@ const localMutation = {
       // enhancers that never save/record/rebroadcast). Default true.
       pausable: options.pausable !== false,
       timeout: null,
-      pendingChanges: null
+      pendingChanges: null,
+      firstPendingAt: null
     };
 
     this._callbacks[type].push(cb);
@@ -664,7 +707,11 @@ const localMutation = {
 
     this._log('Starting observation');
     this._initializeObserver();
-    this._observer.observe(document.body, {
+    // The root, not body: every capture serializes documentElement, so watching
+    // only body meant a <head> edit (document.title, a new <style>) could never
+    // trigger an autosave while still counting as a change in the dirty check —
+    // the page stayed permanently unsaved and only a manual save cleared it.
+    this._observer.observe(document.documentElement, {
       childList: true,
       attributes: true,
       subtree: true,
@@ -718,18 +765,18 @@ const Mutation = existingHub || localMutation;
 
 if (typeof window !== 'undefined' && !existingHub) {
   window.__clayMutation = Mutation;
-  // Publish the vendor-compat mirror BEFORE the readiness dispatch: sap's mutation
-  // bridge reads window.hyperclay.Mutation when hyperclay:mutation-ready fires, so
-  // the hub must already be in place or sap keeps its own native observer.
-  window.hyperclay = window.hyperclay || {};
-  window.hyperclay.Mutation = Mutation;
+  // Publish the hub BEFORE the readiness dispatch. Consumers (sap's mutation
+  // bridge, hypercms's fast path) read clay.Mutation from inside their
+  // mutation-ready listener, and the loader's assembleCore does not run until
+  // after this module finishes evaluating, so without this the hub is invisible
+  // at the exact moment it announces itself.
+  window.clay = window.clay || {};
+  window.clay.Mutation = Mutation;
   // Signal consumers (e.g. hypercms ?cms=true auto-open, sap's late-hub listener)
   // that Mutation is ready, so they can react instead of polling. Wrapped so a
   // dispatch failure can never break the install.
   try {
     document.dispatchEvent(new CustomEvent('clay:mutation-ready', { detail: { Mutation } }));
-    // vendor-compat: hypercms's readiness fast path listens for the legacy name
-    document.dispatchEvent(new CustomEvent('hyperclay:mutation-ready', { detail: { Mutation } }));
   } catch {}
 }
 

package/src/lib/region-policy.js

@@ -52,6 +52,21 @@ function hasRegionToken(el, token) {
   return !!el.hasAttribute?.(token);                            // legacy bare attribute
 }
 
+/**
+ * Add a canonical region token to an element's `clay` attribute, preserving any
+ * tokens already there. The one place that knows how the attribute is spelled, so
+ * a caller that needs to mark a region cannot invent a second merge.
+ *
+ * @param {Element} el
+ * @param {string} token - a canonical token, e.g. 'no-trigger-autosave'
+ */
+export function addRegionToken(el, token) {
+  const tokens = new Set((el.getAttribute("clay") || "").trim().split(/\s+/).filter(Boolean));
+  if (tokens.has(token)) return;
+  tokens.add(token);
+  el.setAttribute("clay", Array.from(tokens).join(" "));
+}
+
 // Serializer selectors (recognize the clay-token spelling FIRST, then new + legacy bare).
 export const STRIP_FROM_SAVE = '[clay~="no-save"], [no-save], [save-remove]';
 export const FREEZE_SELECTOR = '[clay~="freeze"], [freeze], [save-freeze]';
@@ -205,8 +220,8 @@ export function skipForPolicy(policy, require, skip) {
 }
 
 // The canonical region API the vendored hyper-undo (a separate bundle that can't
-// import this module) delegates "is this undoable?" to via window.hyperclay.region,
-// so the two can no longer drift. The loader assembles this onto the compat shim.
+// import this module) delegates "is this undoable?" to via clay.region, so the two
+// can no longer drift. The loader assembles this onto clay in assembleCore.
 export const windowRegionShape = {
   resolveRegionPolicy,
   isInert,

package/src/lib/root-attrs.js

@@ -0,0 +1,45 @@
+/**
+ * root-attrs.js — the attributes that live on <html>, and who owns them.
+ *
+ * Three parties write to the root: the host at serve time, this library, and the
+ * author. Only the author's belong to the document. The other two belong to one
+ * response and one tab, which is why they are named here rather than inside the
+ * modules that happen to read them — the observer has to ignore them, and a
+ * peer's copy of them must never be applied.
+ */
+
+// Injected by the host at serve time. Spec §9 bounds a save token to per-file and
+// per-tab and makes the host strip it before writing, so it never reaches disk.
+// But §9 bounds only the save path, and §10 fans a snapshot out to other editors'
+// browsers, which is the hole this module closes.
+export const HOST_TOKEN_ATTRS = ["savetoken", "htmlclaytoken"];
+
+// Which save envelope this host's lane takes: a fact about the response, not
+// about the document.
+export const SAVE_TRANSPORT_ATTR = "clay-save-transport";
+
+// This library's own root state, and this tab's UI truth.
+export const ROOT_LIBRARY_ATTRS = ["savestatus", "editmode", "pageowner"];
+
+// Never copied between tabs: not written onto this root by an incoming morph, not
+// sent out on a sync broadcast.
+//
+// Both directions matter, and each was found separately. Accepting a peer's token
+// makes every later save go out as that peer, and keeps working after this tab's
+// own access is revoked, because revocation cannot reach a token minted for
+// somebody else. Accepting a peer's ABSENCE of one is the mirror failure logged in
+// documentid.md §5: a token-stripped broadcast removes this tab's own token and it
+// can no longer save at all.
+export const TAB_LOCAL_ROOT_ATTRS = new Set([
+  ...HOST_TOKEN_ATTRS,
+  SAVE_TRANSPORT_ATTR,
+  ...ROOT_LIBRARY_ATTRS,
+]);
+
+/**
+ * True when an incoming morph must be kept away from this attribute.
+ * Scoped to the root: the same names anywhere else are the author's business.
+ */
+export function isTabLocalRootAttr(name, element) {
+  return element === document.documentElement && TAB_LOCAL_ROOT_ATTRS.has(name);
+}

package/src/lib/throttle.js

@@ -1,36 +1,48 @@
 function throttle(callback, delay, executeFirst = true) {
   let lastCall = executeFirst ? 0 : Date.now();
   let timeoutId = null;
-  let pendingResolvers = [];
+  let pending = [];
+
+  // See debounce.js: settle both branches, or a throwing callback strands every
+  // caller sharing the window. throttle's caller is the save lane.
+  function settle(ctx, args, waiting) {
+    let result;
+    try {
+      result = callback.apply(ctx, args);
+    } catch (error) {
+      for (const p of waiting) p.reject(error);
+      return;
+    }
+    Promise.resolve(result).then(
+      value => { for (const p of waiting) p.resolve(value); },
+      error => { for (const p of waiting) p.reject(error); },
+    );
+  }
 
   return function (...args) {
     const ctx = this;
     const now = Date.now();
     const remaining = delay - (now - lastCall);
 
-    return new Promise((resolve) => {
+    return new Promise((resolve, reject) => {
       if (remaining <= 0) {
         clearTimeout(timeoutId);
         timeoutId = null;
         lastCall = now;
 
-        const resolvers = pendingResolvers.concat(resolve);
-        pendingResolvers = [];
-
-        Promise.resolve(callback.apply(ctx, args))
-          .then(value => { for (const r of resolvers) r(value); });
+        const waiting = pending.concat({ resolve, reject });
+        pending = [];
+        settle(ctx, args, waiting);
       } else {
-        pendingResolvers.push(resolve);
+        pending.push({ resolve, reject });
 
         if (!timeoutId) {
           timeoutId = setTimeout(() => {
             lastCall = Date.now();
             timeoutId = null;
-            const resolvers = pendingResolvers;
-            pendingResolvers = [];
-
-            Promise.resolve(callback.apply(ctx, args))
-              .then(value => { for (const r of resolvers) r(value); });
+            const waiting = pending;
+            pending = [];
+            settle(ctx, args, waiting);
           }, remaining);
         }
       }