@schukai/monster 4.148.1 → 4.148.2

package/package.json

@@ -1 +1 @@
-{"author":"Volker Schukai","dependencies":{"@floating-ui/dom":"^1.7.6"},"description":"Monster is a simple library for creating fast, robust and lightweight websites.","homepage":"https://monsterjs.org/","keywords":["framework","web","dom","css","sass","mobile-first","app","front-end","templates","schukai","core","shopcloud","alvine","monster","buildmap","stack","observer","observable","uuid","node","nodelist","css-in-js","logger","log","theme"],"license":"AGPL 3.0","main":"source/monster.mjs","module":"source/monster.mjs","name":"@schukai/monster","repository":{"type":"git","url":"https://gitlab.schukai.com/oss/libraries/javascript/monster.git"},"type":"module","version":"4.148.1"}
+{"author":"Volker Schukai","dependencies":{"@floating-ui/dom":"^1.7.6"},"description":"Monster is a simple library for creating fast, robust and lightweight websites.","homepage":"https://monsterjs.org/","keywords":["framework","web","dom","css","sass","mobile-first","app","front-end","templates","schukai","core","shopcloud","alvine","monster","buildmap","stack","observer","observable","uuid","node","nodelist","css-in-js","logger","log","theme"],"license":"AGPL 3.0","main":"source/monster.mjs","module":"source/monster.mjs","name":"@schukai/monster","repository":{"type":"git","url":"https://gitlab.schukai.com/oss/libraries/javascript/monster.git"},"type":"module","version":"4.148.2"}

package/source/data/pathfinder.mjs

@@ -43,6 +43,17 @@ const DELIMITER = ".";
  */
 const WILDCARD = "*";
 
+/**
+ * Path segments that must never be traversed by mutation operations.
+ * @private
+ * @type {Set<string>}
+ */
+const UNSAFE_MUTATION_PATH_SEGMENTS = new Set([
+	"__proto__",
+	"constructor",
+	"prototype",
+]);
+
 /**
  * Pathfinder is a class to find a path to an object.
  *
@@ -245,7 +256,12 @@ function getValueViaPath(subject, path, check) {
 	}
 
 	let parts;
-	if (isString(path)) {
+	if (isArray(path)) {
+		if (path.length === 0) {
+			return subject;
+		}
+		parts = [...path];
+	} else {
 		if (path === "") {
 			return subject;
 		}
@@ -263,10 +279,12 @@ function getValueViaPath(subject, path, check) {
 		let anchor;
 		if (subject instanceof Map || subject instanceof WeakMap) {
 			anchor = subject.get(current);
-		} else if (subject instanceof Set || subject instanceof WeakSet) {
+		} else if (subject instanceof Set) {
 			current = parseInt(current);
 			validateInteger(current);
 			anchor = [...subject]?.[current];
+		} else if (subject instanceof WeakSet) {
+			throw Error("unsupported action for this data type (WeakSet)");
 		} else if (typeof WeakRef === "function" && subject instanceof WeakRef) {
 			throw Error("unsupported action for this data type (WeakRef)");
 		} else if (isArray(subject)) {
@@ -318,6 +336,7 @@ function setValueViaPath(subject, path, value) {
 	if (!(isArray(path) || isString(path))) {
 		throw new Error("type error: a path must be a string or an array");
 	}
+	validateMutationPath(path);
 
 	let parts;
 	if (isArray(path)) {
@@ -325,7 +344,7 @@ function setValueViaPath(subject, path, value) {
 			return;
 		}
 
-		parts = path;
+		parts = [...path];
 	} else {
 		parts = path.split(DELIMITER);
 	}
@@ -370,8 +389,10 @@ function setValueViaPath(subject, path, value) {
 
 	if (anchor instanceof Map || anchor instanceof WeakMap) {
 		anchor.set(last, value);
-	} else if (anchor instanceof Set || anchor instanceof WeakSet) {
-		anchor.append(value);
+	} else if (anchor instanceof Set) {
+		anchor.add(value);
+	} else if (anchor instanceof WeakSet) {
+		throw Error("unsupported action for this data type in setValueViaPath");
 	} else if (typeof WeakRef === "function" && anchor instanceof WeakRef) {
 		throw Error("unsupported action for this data type in setValueViaPath");
 	} else if (isArray(anchor)) {
@@ -421,6 +442,7 @@ function deleteValueViaPath(subject, path) {
 			"type error: a path must be a string or an array in deleteValueViaPath",
 		);
 	}
+	validateMutationPath(path);
 
 	let parts;
 	if (isArray(path)) {
@@ -428,7 +450,7 @@ function deleteValueViaPath(subject, path) {
 			return;
 		}
 
-		parts = path;
+		parts = [...path];
 	} else {
 		parts = path.split(DELIMITER);
 	}
@@ -455,3 +477,19 @@ function deleteValueViaPath(subject, path) {
 		delete anchor[last];
 	}
 }
+
+/**
+ * Reject paths that could mutate an object's prototype chain.
+ * @param {string|array} path
+ * @return {void}
+ * @throws {Error} unsafe mutation path segment
+ * @private
+ */
+function validateMutationPath(path) {
+	const parts = isArray(path) ? path : path.split(DELIMITER);
+	for (const part of parts) {
+		if (UNSAFE_MUTATION_PATH_SEGMENTS.has(`${part}`)) {
+			throw new Error(`unsafe mutation path segment: ${part}`);
+		}
+	}
+}

package/source/dom/updater.mjs

@@ -69,7 +69,8 @@ export { Updater, addObjectWithUpdaterToElement };
  * @private
  * @type {symbol}
  */
-const timerElementEventHandlerSymbol = Symbol("timerElementEventHandler");
+const controlEventTimersSymbol = Symbol("controlEventTimers");
+const registeredEventTypesSymbol = Symbol("registeredEventTypes");
 
 /**
  * @private
@@ -87,9 +88,29 @@ const applyChangeSymbol = Symbol("applyChange");
 const updaterRootSymbol = Symbol.for("@schukai/monster/dom/@@updater-root");
 const disposedSymbol = Symbol("disposed");
 const subjectObserverSymbol = Symbol("subjectObserver");
+const subjectRevisionSymbol = Symbol("subjectRevision");
 const patchNodeKeySymbol = Symbol("patchNodeKey");
 const queuedSnapshotSymbol = Symbol("queuedSnapshot");
 
+/**
+ * Tracks every notification request, including requests that Observer deduplicates
+ * while its asynchronous callback is already running.
+ * @private
+ */
+class UpdaterSubjectObserver extends Observer {
+	#onNotification;
+
+	constructor(callback, onNotification) {
+		super(callback);
+		this.#onNotification = onNotification;
+	}
+
+	update(subject) {
+		this.#onNotification();
+		return super.update(subject);
+	}
+}
+
 /**
  * The updater class connects an object with the DOM. In this way, structures and contents in the DOM can be
  * programmatically adapted via attributes.
@@ -165,23 +186,34 @@ class Updater extends Base {
 		this[pendingDiffsSymbol] = [];
 		this[processingSymbol] = false;
 		this[disposedSymbol] = false;
+		this[subjectRevisionSymbol] = 0;
 		this[queuedSnapshotSymbol] = clone(this[internalSymbol].last);
+		this[controlEventTimersSymbol] = new Map();
+		this[registeredEventTypesSymbol] = new Set();
+
+		this[subjectObserverSymbol] = new UpdaterSubjectObserver(
+			async () => {
+				let processedRevision;
+				do {
+					processedRevision = this[subjectRevisionSymbol];
+					if (this[disposedSymbol] === true) {
+						return;
+					}
 
-		this[subjectObserverSymbol] = new Observer(() => {
-			if (this[disposedSymbol] === true) {
-				return Promise.resolve();
-			}
-
-			const real = this[internalSymbol].subject.getRealSubject();
-			const diffResult = diff(this[queuedSnapshotSymbol], real);
-			if (diffResult.length === 0) {
-				return Promise.resolve();
-			}
-			const snapshot = clone(real);
-			this[queuedSnapshotSymbol] = snapshot;
-			this[pendingDiffsSymbol].push({ diffResult, snapshot });
-			return this[processQueueSymbol]();
-		});
+					const real = this[internalSymbol].subject.getRealSubject();
+					const diffResult = diff(this[queuedSnapshotSymbol], real);
+					if (diffResult.length > 0) {
+						const snapshot = clone(real);
+						this[queuedSnapshotSymbol] = snapshot;
+						this[pendingDiffsSymbol].push({ diffResult, snapshot });
+						await this[processQueueSymbol]();
+					}
+				} while (processedRevision !== this[subjectRevisionSymbol]);
+			},
+			() => {
+				this[subjectRevisionSymbol]++;
+			},
+		);
 		this[internalSymbol].subject.attachObserver(this[subjectObserverSymbol]);
 	}
 
@@ -317,6 +349,7 @@ class Updater extends Base {
 					passive: true,
 				},
 			);
+			this[registeredEventTypesSymbol].add(type);
 		}
 
 		return this;
@@ -329,12 +362,23 @@ class Updater extends Base {
 	 * @return {Updater}
 	 */
 	disableEventProcessing() {
-		for (const type of this[internalSymbol].eventTypes) {
+		for (const type of this[registeredEventTypesSymbol]) {
 			this[internalSymbol].element.removeEventListener(
 				type,
 				getControlEventHandler.call(this),
+				{ capture: true },
 			);
 		}
+		this[registeredEventTypesSymbol].clear();
+
+		for (const timer of this[controlEventTimersSymbol].values()) {
+			try {
+				timer.defuse();
+			} catch (e) {
+				// A timer that already ran no longer has pending work to cancel.
+			}
+		}
+		this[controlEventTimersSymbol].clear();
 
 		delete this[internalSymbol].element[updaterRootSymbol];
 
@@ -354,8 +398,6 @@ class Updater extends Base {
 			this[internalSymbol].subject.detachObserver(this[subjectObserverSymbol]);
 		}
 
-		delete this[timerElementEventHandlerSymbol];
-
 		return this;
 	}
 
@@ -495,21 +537,24 @@ function getControlEventHandler() {
 			return;
 		}
 
-		if (this[timerElementEventHandlerSymbol] instanceof DeadMansSwitch) {
+		const timers = this[controlEventTimersSymbol];
+		let timer = timers.get(element);
+		if (timer instanceof DeadMansSwitch) {
 			try {
-				this[timerElementEventHandlerSymbol].touch();
+				timer.touch();
 				return;
 			} catch (e) {
-				delete this[timerElementEventHandlerSymbol];
+				timers.delete(element);
 			}
 		}
 
-		this[timerElementEventHandlerSymbol] = new DeadMansSwitch(50, () => {
+		timer = new DeadMansSwitch(50, () => {
 			if (
 				this[disposedSymbol] === true ||
 				!this[internalSymbol].element?.isConnected ||
 				!element?.isConnected
 			) {
+				timers.delete(element);
 				return;
 			}
 
@@ -517,8 +562,11 @@ function getControlEventHandler() {
 				retrieveAndSetValue.call(this, element);
 			} catch (e) {
 				addErrorAttribute(element, e);
+			} finally {
+				timers.delete(element);
 			}
 		});
+		timers.set(element, timer);
 	};
 
 	return this[symbol];
@@ -1091,6 +1139,7 @@ function runUpdateContent(container, parts, subject) {
 				value = pipe.run(subject);
 			} catch (e) {
 				element.setAttribute(ATTRIBUTE_ERRORMESSAGE, e.message);
+				continue;
 			}
 
 			if (value instanceof HTMLElement) {
@@ -1529,6 +1578,7 @@ function runUpdateAttributes(container, parts, subject) {
 			}
 
 			const attributes = element.getAttribute(ATTRIBUTE_UPDATER_ATTRIBUTES);
+			element.removeAttribute(ATTRIBUTE_ERRORMESSAGE);
 
 			for (let [, def] of Object.entries(attributes.split(","))) {
 				def = trimSpaces(def);
@@ -1544,10 +1594,10 @@ function runUpdateAttributes(container, parts, subject) {
 
 				let value;
 				try {
-					element.removeAttribute(ATTRIBUTE_ERRORMESSAGE);
 					value = pipe.run(subject);
 				} catch (e) {
 					addErrorAttribute(element, e);
+					continue;
 				}
 
 				if (value === undefined) {
@@ -1604,6 +1654,7 @@ function runUpdateProperties(container, parts, subject) {
 			}
 
 			const properties = element.getAttribute(ATTRIBUTE_UPDATER_PROPERTIES);
+			element.removeAttribute(ATTRIBUTE_ERRORMESSAGE);
 
 			for (let [, def] of Object.entries(properties.split(","))) {
 				def = trimSpaces(def);
@@ -1619,10 +1670,10 @@ function runUpdateProperties(container, parts, subject) {
 
 				let value;
 				try {
-					element.removeAttribute(ATTRIBUTE_ERRORMESSAGE);
 					value = pipe.run(subject);
 				} catch (e) {
 					addErrorAttribute(element, e);
+					continue;
 				}
 
 				handleInputControlPropertyUpdate.call(this, element, name, value);

package/source/types/proxyobserver.mjs

@@ -173,6 +173,10 @@ function getHandler() {
 				return value;
 			}
 
+			if (isNativeObjectWithInternalSlots(value)) {
+				return value;
+			}
+
 			// set value as proxy if object or array
 			if (isArray(value) || isObject(value)) {
 				if (proxy.objectMap.has(value)) {
@@ -264,3 +268,14 @@ function getHandler() {
 
 	return handler;
 }
+
+/**
+ * Native objects with internal slots cannot be used through a transparent Proxy
+ * because their prototype methods require the original receiver.
+ * @param {*} value
+ * @return {boolean}
+ * @private
+ */
+function isNativeObjectWithInternalSlots(value) {
+	return value instanceof Date || value instanceof Map || value instanceof Set;
+}

package/source/util/clone.mjs

@@ -135,13 +135,14 @@ function cloneObject(obj) {
 	validateObject(obj);
 
 	const fkt = obj?.["constructor"];
+	const sourcePrototype = Object.getPrototypeOf(obj);
 
 	/** Object has clone method */
 	if (typeOf(fkt) === "function") {
 		const prototype = fkt?.prototype;
 		if (typeof prototype === "object") {
 			if (
-				prototype.hasOwnProperty("getClone") &&
+				Object.prototype.hasOwnProperty.call(prototype, "getClone") &&
 				typeOf(obj.getClone) === "function"
 			) {
 				return obj.getClone();
@@ -149,16 +150,17 @@ function cloneObject(obj) {
 		}
 	}
 
-	let copy = {};
+	let copy = sourcePrototype === null ? Object.create(null) : {};
 	if (
-		typeof obj.constructor === "function" &&
-		typeof obj.constructor.call === "function"
+		sourcePrototype !== null &&
+		typeof fkt === "function" &&
+		typeof fkt.call === "function"
 	) {
-		copy = new obj.constructor();
+		copy = new fkt();
 	}
 
 	for (const key in obj) {
-		if (!obj.hasOwnProperty(key)) {
+		if (!Object.prototype.hasOwnProperty.call(obj, key)) {
 			continue;
 		}
 

package/test/cases/data/pathfinder.mjs

@@ -5,6 +5,111 @@ import {Pathfinder} from "../../../source/data/pathfinder.mjs";
 
 describe('Pathfinder', function () {
 
+    describe('mutation path security issue #492', function () {
+        const probe = 'monsterPathfinderSecurityProbe';
+
+        afterEach(function () {
+            delete Object.prototype[probe];
+        });
+
+        [
+            `__proto__.${probe}`,
+            `constructor.prototype.${probe}`,
+            ['__proto__', probe],
+            ['constructor', 'prototype', probe],
+        ].forEach(function (path) {
+            it(`setVia(${JSON.stringify(path)}) should reject unsafe mutation paths`, function () {
+                try {
+                    expect(() => new Pathfinder({}).setVia(path, 'polluted')).to.throw(Error);
+                    expect(Object.prototype).to.not.have.own.property(probe);
+                } finally {
+                    delete Object.prototype[probe];
+                }
+            });
+        });
+
+        it('deleteVia() should not cross a prototype boundary', function () {
+            Object.defineProperty(Object.prototype, probe, {
+                configurable: true,
+                value: 'preserved',
+                writable: true,
+            });
+
+            try {
+                expect(() => new Pathfinder({}).deleteVia(`__proto__.${probe}`)).to.throw(Error);
+                expect(Object.prototype[probe]).to.equal('preserved');
+            } finally {
+                delete Object.prototype[probe];
+            }
+        });
+
+        it('setVia() should keep safe paths working', function () {
+            const subject = {};
+            new Pathfinder(subject).setVia('safe.nested.value', true);
+            expect(subject).to.deep.equal({safe: {nested: {value: true}}});
+        });
+    });
+
+    describe('array and collection path contracts issue #493', function () {
+        it('getVia() should accept an array path without mutating it', function () {
+            const path = ['a', 'b'];
+            const subject = {a: {b: 4}};
+
+            expect(new Pathfinder(subject).getVia(path)).to.equal(4);
+            expect(path).to.deep.equal(['a', 'b']);
+        });
+
+        it('getVia([]) should return the root subject', function () {
+            const subject = {a: true};
+            expect(new Pathfinder(subject).getVia([])).to.equal(subject);
+        });
+
+        it('setVia() should not mutate an array path', function () {
+            const path = ['a', 'b'];
+            const subject = {};
+
+            new Pathfinder(subject).setVia(path, 4);
+
+            expect(subject).to.deep.equal({a: {b: 4}});
+            expect(path).to.deep.equal(['a', 'b']);
+        });
+
+        it('deleteVia() should not mutate an array path', function () {
+            const path = ['a', 'b'];
+            const subject = {a: {b: 4, c: 5}};
+
+            new Pathfinder(subject).deleteVia(path);
+
+            expect(subject).to.deep.equal({a: {c: 5}});
+            expect(path).to.deep.equal(['a', 'b']);
+        });
+
+        it('empty mutation paths should be no-ops', function () {
+            const setPath = [];
+            const deletePath = [];
+            const subject = {a: true};
+            const pathfinder = new Pathfinder(subject);
+
+            pathfinder.setVia(setPath, false).deleteVia(deletePath);
+
+            expect(subject).to.deep.equal({a: true});
+            expect(setPath).to.deep.equal([]);
+            expect(deletePath).to.deep.equal([]);
+        });
+
+        it('setVia() should add values to a Set', function () {
+            const values = new Set(['first']);
+            new Pathfinder({values}).setVia('values.next', 'second');
+            expect([...values]).to.deep.equal(['first', 'second']);
+        });
+
+        it('setVia() should reject WeakSet writes explicitly', function () {
+            const values = new WeakSet();
+            expect(() => new Pathfinder({values}).setVia('values.next', {}))
+                .to.throw(Error, 'unsupported action for this data type in setValueViaPath');
+        });
+    });
+
     let convertMapResult = function (r) {
         if (r instanceof Map) {
             r = Object.fromEntries(r);
@@ -419,4 +524,3 @@ describe('Pathfinder', function () {
 
     });
 });
-

package/test/cases/dom/updater.mjs

@@ -383,6 +383,21 @@ describe("DOM", function () {
         expect(u.getSubject().a).to.be.equal(1);
       });
 
+      it("run() should accept dictionary payload keys issue #494", async function () {
+        element.innerHTML = `<span data-monster-replace="path:nested.value"></span>`;
+        const u = new Updater(element, {
+          hasOwnProperty: "payload",
+          nested: { value: "rendered" },
+        });
+
+        try {
+          await u.run();
+          expect(element.textContent).to.equal("rendered");
+        } finally {
+          u.dispose();
+        }
+      });
+
       it("enableEventProcessing() should be chainable", function () {
         const u = new Updater(element);
         expect(u.enableEventProcessing()).to.be.instanceof(Updater);
@@ -1892,6 +1907,37 @@ describe("DOM", function () {
   });
 
   describe("Updater reactive updates", function () {
+    [false, true].forEach((batchUpdates) => {
+      it(`should preserve microtask changes with batchUpdates=${batchUpdates} issue #496`, async function () {
+        let mocks = document.getElementById("mocks");
+        mocks.innerHTML = `
+          <span id="microtask-a" data-monster-replace="path:a"></span>
+          <span id="microtask-b" data-monster-replace="path:b"></span>
+        `;
+
+        const updater = new Updater(mocks, { a: "A1", b: "B1" });
+        updater.setBatchUpdates(batchUpdates);
+
+        try {
+          await updater.run();
+          const subject = updater.getSubject();
+          subject.a = "A2";
+          queueMicrotask(() => {
+            subject.b = "B2";
+          });
+
+          await new Promise((resolve) => setTimeout(resolve, 20));
+
+          expect(subject.a).to.equal("A2");
+          expect(subject.b).to.equal("B2");
+          expect(document.getElementById("microtask-a").textContent).to.equal("A2");
+          expect(document.getElementById("microtask-b").textContent).to.equal("B2");
+        } finally {
+          updater.dispose();
+        }
+      });
+    });
+
     it("should update the DOM when the subject changes", function (done) {
       let mocks = document.getElementById("mocks");
       mocks.innerHTML = html1;
@@ -2017,4 +2063,251 @@ describe("DOM", function () {
         .catch((e) => done(e));
     });
   });
+
+  describe("Updater event lifecycle issue #497", function () {
+    const waitForBinding = () => new Promise((resolve) => setTimeout(resolve, 80));
+
+    it("should debounce different bound controls independently", async function () {
+      const mocks = document.getElementById("mocks");
+      mocks.innerHTML = `
+        <div id="event-root">
+          <input id="event-first" data-monster-bind="path:first">
+          <input id="event-second" data-monster-bind="path:second">
+        </div>
+      `;
+      const updater = new Updater(document.getElementById("event-root"), {});
+      updater.enableEventProcessing();
+
+      try {
+        const first = document.getElementById("event-first");
+        const second = document.getElementById("event-second");
+        first.value = "A";
+        first.dispatchEvent(new Event("input", { bubbles: true, composed: true }));
+        second.value = "B";
+        second.dispatchEvent(new Event("input", { bubbles: true, composed: true }));
+
+        await waitForBinding();
+
+        expect(updater.getSubject().first).to.equal("A");
+        expect(updater.getSubject().second).to.equal("B");
+      } finally {
+        updater.dispose();
+      }
+    });
+
+    it("should coalesce a soft keyboard event burst to the latest value", async function () {
+      const mocks = document.getElementById("mocks");
+      mocks.innerHTML = `
+        <div id="keyboard-root">
+          <input id="keyboard-input" data-monster-bind="path:value">
+        </div>
+      `;
+      const updater = new Updater(document.getElementById("keyboard-root"), {});
+      updater.enableEventProcessing();
+
+      try {
+        const input = document.getElementById("keyboard-input");
+        input.value = "intermediate";
+        input.dispatchEvent(new InputEvent("input", {
+          bubbles: true,
+          composed: true,
+          data: "i",
+          isComposing: true,
+        }));
+        input.value = "final";
+        input.dispatchEvent(new KeyboardEvent("keyup", { bubbles: true, composed: true }));
+        input.dispatchEvent(new Event("change", { bubbles: true, composed: true }));
+
+        await waitForBinding();
+
+        expect(updater.getSubject().value).to.equal("final");
+      } finally {
+        updater.dispose();
+      }
+    });
+
+    it("disableEventProcessing() should cancel pending binding work", async function () {
+      const mocks = document.getElementById("mocks");
+      mocks.innerHTML = `
+        <div id="disable-root">
+          <input id="disable-input" data-monster-bind="path:value">
+        </div>
+      `;
+      const updater = new Updater(document.getElementById("disable-root"), {});
+      updater.enableEventProcessing();
+
+      try {
+        const input = document.getElementById("disable-input");
+        input.value = "ignored";
+        input.dispatchEvent(new Event("input", { bubbles: true, composed: true }));
+        updater.disableEventProcessing();
+
+        await waitForBinding();
+
+        expect(updater.getSubject()).to.not.have.property("value");
+      } finally {
+        updater.dispose();
+      }
+    });
+
+    it("dispose() should cancel pending binding work", async function () {
+      const mocks = document.getElementById("mocks");
+      mocks.innerHTML = `
+        <div id="dispose-root">
+          <input id="dispose-input" data-monster-bind="path:value">
+        </div>
+      `;
+      const updater = new Updater(document.getElementById("dispose-root"), {});
+      const subject = updater.getSubject();
+      updater.enableEventProcessing();
+
+      const input = document.getElementById("dispose-input");
+      input.value = "ignored";
+      input.dispatchEvent(new Event("input", { bubbles: true, composed: true }));
+      updater.dispose();
+
+      await waitForBinding();
+
+      expect(subject).to.not.have.property("value");
+    });
+
+    it("should remove previously registered event types before re-enabling", async function () {
+      const mocks = document.getElementById("mocks");
+      mocks.innerHTML = `
+        <div id="types-root">
+          <input id="types-input" data-monster-bind="path:value">
+        </div>
+      `;
+      const updater = new Updater(document.getElementById("types-root"), {});
+      updater.enableEventProcessing();
+      updater.setEventTypes(["blur"]);
+      updater.enableEventProcessing();
+
+      try {
+        const input = document.getElementById("types-input");
+        input.value = "stale-input-listener";
+        input.dispatchEvent(new Event("input", { bubbles: true, composed: true }));
+        await waitForBinding();
+        expect(updater.getSubject()).to.not.have.property("value");
+
+        input.value = "blur-value";
+        input.dispatchEvent(new Event("blur", { bubbles: false, composed: true }));
+        await waitForBinding();
+        expect(updater.getSubject().value).to.equal("blur-value");
+      } finally {
+        updater.dispose();
+      }
+    });
+  });
+
+  describe("Updater pipe failure recovery issue #498", function () {
+    const waitForUpdate = () => new Promise((resolve) => setTimeout(resolve, 20));
+
+    it("should preserve and recover replace content", async function () {
+      const mocks = document.getElementById("mocks");
+      mocks.innerHTML = `<span id="failure-replace" data-monster-replace="path:value | call:unstable"></span>`;
+      const updater = new Updater(mocks, { value: "first" });
+      let failing = false;
+      updater.setCallback("unstable", (value) => {
+        if (failing) throw new Error("probe failure");
+        return value;
+      });
+
+      try {
+        await updater.run();
+        const target = document.getElementById("failure-replace");
+        expect(target.textContent).to.equal("first");
+
+        failing = true;
+        updater.getSubject().value = "second";
+        await waitForUpdate();
+        expect(target.textContent).to.equal("first");
+        expect(target.getAttribute("data-monster-error")).to.equal("probe failure");
+
+        failing = false;
+        updater.getSubject().value = "third";
+        await waitForUpdate();
+        expect(target.textContent).to.equal("third");
+        expect(target.hasAttribute("data-monster-error")).to.be.false;
+      } finally {
+        updater.dispose();
+      }
+    });
+
+    it("should preserve attributes while valid sibling bindings continue", async function () {
+      const mocks = document.getElementById("mocks");
+      mocks.innerHTML = `
+        <span
+          id="failure-attribute"
+          data-monster-attributes="title path:value | call:unstable, data-valid path:sibling"
+        ></span>
+      `;
+      const updater = new Updater(mocks, { value: "first", sibling: "one" });
+      let failing = false;
+      updater.setCallback("unstable", (value) => {
+        if (failing) throw new Error("probe failure");
+        return value;
+      });
+
+      try {
+        await updater.run();
+        const target = document.getElementById("failure-attribute");
+        expect(target.getAttribute("title")).to.equal("first");
+
+        failing = true;
+        updater.getSubject().value = "second";
+        updater.getSubject().sibling = "two";
+        await waitForUpdate();
+        expect(target.getAttribute("title")).to.equal("first");
+        expect(target.getAttribute("data-valid")).to.equal("two");
+        expect(target.getAttribute("data-monster-error")).to.equal("probe failure");
+
+        failing = false;
+        updater.getSubject().value = "third";
+        await waitForUpdate();
+        expect(target.getAttribute("title")).to.equal("third");
+        expect(target.hasAttribute("data-monster-error")).to.be.false;
+      } finally {
+        updater.dispose();
+      }
+    });
+
+    it("should preserve properties while valid sibling bindings continue", async function () {
+      const mocks = document.getElementById("mocks");
+      mocks.innerHTML = `
+        <input
+          id="failure-property"
+          data-monster-properties="value path:value | call:unstable, disabled path:disabled"
+        >
+      `;
+      const updater = new Updater(mocks, { value: "first", disabled: false });
+      let failing = false;
+      updater.setCallback("unstable", (value) => {
+        if (failing) throw new Error("probe failure");
+        return value;
+      });
+
+      try {
+        await updater.run();
+        const target = document.getElementById("failure-property");
+        expect(target.value).to.equal("first");
+
+        failing = true;
+        updater.getSubject().value = "second";
+        updater.getSubject().disabled = true;
+        await waitForUpdate();
+        expect(target.value).to.equal("first");
+        expect(target.disabled).to.be.true;
+        expect(target.getAttribute("data-monster-error")).to.equal("probe failure");
+
+        failing = false;
+        updater.getSubject().value = "third";
+        await waitForUpdate();
+        expect(target.value).to.equal("third");
+        expect(target.hasAttribute("data-monster-error")).to.be.false;
+      } finally {
+        updater.dispose();
+      }
+    });
+  });
 });

package/test/cases/types/proxyobserver.mjs

@@ -292,4 +292,56 @@ describe('ProxyObserver', function () {
         });
     });
 
+    describe('native object compatibility issue #495', function () {
+        it('should preserve Date, Map, and Set identity and native methods', function () {
+            const date = new Date('2026-01-01T00:00:00Z');
+            const map = new Map([['key', 'value']]);
+            const set = new Set(['value']);
+            const proxy = new ProxyObserver({date, map, set});
+            const subject = proxy.getSubject();
+
+            expect(subject.date).to.equal(date);
+            expect(subject.date.getTime()).to.equal(date.getTime());
+            expect(subject.map).to.equal(map);
+            expect(subject.map.get('key')).to.equal('value');
+            expect(subject.set).to.equal(set);
+            expect(subject.set.has('value')).to.be.true;
+        });
+
+        it('should not notify for internal Map and Set mutations', async function () {
+            const proxy = new ProxyObserver({map: new Map(), set: new Set()});
+            let notifications = 0;
+            proxy.attachObserver(new Observer(function () {
+                notifications++;
+            }));
+
+            proxy.getSubject().map.set('key', 'value');
+            proxy.getSubject().set.add('value');
+            await new Promise((resolve) => setTimeout(resolve, 0));
+
+            expect(notifications).to.equal(0);
+        });
+
+        it('should notify when a complete native object property is replaced', async function () {
+            const proxy = new ProxyObserver({map: new Map()});
+            const replacement = new Map([['key', 'value']]);
+            let notifications = 0;
+            let resolveNotification;
+            const notified = new Promise((resolve) => {
+                resolveNotification = resolve;
+            });
+            proxy.attachObserver(new Observer(function () {
+                notifications++;
+                resolveNotification();
+            }));
+
+            proxy.getSubject().map = replacement;
+            await notified;
+
+            expect(proxy.getRealSubject().map).to.equal(replacement);
+            expect(proxy.getSubject().map).to.equal(replacement);
+            expect(notifications).to.equal(1);
+        });
+    });
+
 })

package/test/cases/util/clone.mjs

@@ -107,6 +107,30 @@ describe('Clone', function () {
             let b = clone(a);
             expect(a.x).is.equal(b.x)
         });
+
+        it('should clone objects with an own hasOwnProperty key issue #494', function () {
+            const source = {
+                hasOwnProperty: 'payload',
+                nested: {value: 1},
+            };
+
+            const result = clone(source);
+
+            expect(result).to.deep.equal(source);
+            expect(result).not.to.equal(source);
+            expect(result.nested).not.to.equal(source.nested);
+        });
+
+        it('should deeply clone null-prototype dictionaries issue #494', function () {
+            const source = Object.create(null);
+            source.nested = {value: 1};
+
+            const result = clone(source);
+
+            expect(Object.getPrototypeOf(result)).to.equal(null);
+            expect(result.nested).to.deep.equal({value: 1});
+            expect(result.nested).not.to.equal(source.nested);
+        });
     })
     describe('.clone(function)', function () {