@zenithbuild/runtime 0.7.9 → 0.7.11

package/dist/cleanup.js

@@ -11,6 +11,7 @@
 // Calling cleanup() twice is a no-op.
 // ---------------------------------------------------------------------------
 import { resetGlobalSideEffects } from './side-effect-scope.js';
+import { runCleanupCallback, throwCleanupErrors } from './effect-utils.js';
 /** @type {function[]} */
 const _disposers = [];
 /** @type {{ element: Element, event: string, handler: function }[]} */
@@ -45,28 +46,31 @@ export function _registerListener(element, event, handler) {
  * - Idempotent: calling twice is a no-op
  */
 export function cleanup() {
+    const errors = [];
     // Global zenMount/zenEffect registrations can be created outside hydrate's
     // disposer table (e.g. page-level component bootstraps). cleanup() is the
     // full runtime teardown boundary, so that scope must be reset on every pass,
     // including the first real cleanup.
     if (_cleaned) {
-        resetGlobalSideEffects();
+        resetGlobalSideEffects(errors);
+        throwCleanupErrors(errors, 'cleanup');
         return;
     }
     // 1. Dispose all effects
     for (let i = 0; i < _disposers.length; i++) {
-        _disposers[i]();
+        runCleanupCallback(_disposers[i], errors);
     }
     _disposers.length = 0;
     // 2. Remove all event listeners
     for (let i = 0; i < _listeners.length; i++) {
         const { element, event, handler } = _listeners[i];
-        element.removeEventListener(event, handler);
+        runCleanupCallback(() => element.removeEventListener(event, handler), errors);
     }
     _listeners.length = 0;
     // 3. Dispose any top-level reactive work registered outside hydrate.
-    resetGlobalSideEffects();
+    resetGlobalSideEffects(errors);
     _cleaned = true;
+    throwCleanupErrors(errors, 'cleanup');
 }
 /**
  * Get counts for testing/debugging.

package/dist/effect-runtime.d.ts

@@ -1,2 +1,2 @@
-export declare function createAutoTrackedEffect(effect: any, options: any, scope: any): () => void;
-export declare function createExplicitDependencyEffect(effect: any, dependencies: any, scope: any): () => void;
+export declare function createAutoTrackedEffect(effect: any, options: any, scope: any): (errors?: null) => void;
+export declare function createExplicitDependencyEffect(effect: any, dependencies: any, scope: any): (errors?: null) => void;

package/dist/effect-runtime.js

@@ -1,11 +1,12 @@
 // @ts-nocheck
 import { runWithDependencyCollector } from './reactivity-core.js';
 import { registerScopeDisposer, queueWhenScopeReady } from './side-effect-scope.js';
-import { drainCleanupStack, applyCleanupResult, createEffectContext } from './effect-utils.js';
+import { drainCleanupStack, applyCleanupResult, createEffectContext, runCleanupCallback } from './effect-utils.js';
 import { createScheduler } from './effect-scheduler.js';
 let _effectIdCounter = 0;
 export function createAutoTrackedEffect(effect, options, scope) {
     let disposed = false;
+    let completedSetup = false;
     const activeSubscriptions = new Map();
     const runCleanups = [];
     _effectIdCounter += 1;
@@ -22,47 +23,56 @@ export function createAutoTrackedEffect(effect, options, scope) {
         }
         drainCleanupStack(runCleanups);
         const nextDependenciesById = new Map();
-        runWithDependencyCollector((source) => {
-            if (!source || typeof source.subscribe !== 'function') {
-                return;
-            }
-            const reactiveId = Number.isInteger(source.__zenith_id) ? source.__zenith_id : 0;
-            if (!nextDependenciesById.has(reactiveId)) {
-                nextDependenciesById.set(reactiveId, source);
-            }
-        }, () => {
-            const result = effect(createEffectContext(registerCleanup));
-            applyCleanupResult(result, registerCleanup);
-        });
-        const nextDependencies = Array.from(nextDependenciesById.values()).sort((left, right) => {
-            const leftId = Number.isInteger(left.__zenith_id) ? left.__zenith_id : 0;
-            const rightId = Number.isInteger(right.__zenith_id) ? right.__zenith_id : 0;
-            return leftId - rightId;
-        });
-        const nextSet = new Set(nextDependencies);
-        for (const [dependency, unsubscribe] of activeSubscriptions.entries()) {
-            if (nextSet.has(dependency)) {
-                continue;
+        try {
+            runWithDependencyCollector((source) => {
+                if (!source || typeof source.subscribe !== 'function') {
+                    return;
+                }
+                const reactiveId = Number.isInteger(source.__zenith_id) ? source.__zenith_id : 0;
+                if (!nextDependenciesById.has(reactiveId)) {
+                    nextDependenciesById.set(reactiveId, source);
+                }
+            }, () => {
+                const result = effect(createEffectContext(registerCleanup));
+                applyCleanupResult(result, registerCleanup);
+            });
+            const nextDependencies = Array.from(nextDependenciesById.values()).sort((left, right) => {
+                const leftId = Number.isInteger(left.__zenith_id) ? left.__zenith_id : 0;
+                const rightId = Number.isInteger(right.__zenith_id) ? right.__zenith_id : 0;
+                return leftId - rightId;
+            });
+            const nextSet = new Set(nextDependencies);
+            for (const [dependency, unsubscribe] of activeSubscriptions.entries()) {
+                if (nextSet.has(dependency)) {
+                    continue;
+                }
+                if (typeof unsubscribe === 'function') {
+                    unsubscribe();
+                }
+                activeSubscriptions.delete(dependency);
             }
-            if (typeof unsubscribe === 'function') {
-                unsubscribe();
+            for (let i = 0; i < nextDependencies.length; i++) {
+                const dependency = nextDependencies[i];
+                if (activeSubscriptions.has(dependency)) {
+                    continue;
+                }
+                const unsubscribe = dependency.subscribe(() => {
+                    scheduler.schedule();
+                });
+                activeSubscriptions.set(dependency, typeof unsubscribe === 'function' ? unsubscribe : () => { });
             }
-            activeSubscriptions.delete(dependency);
+            completedSetup = true;
         }
-        for (let i = 0; i < nextDependencies.length; i++) {
-            const dependency = nextDependencies[i];
-            if (activeSubscriptions.has(dependency)) {
-                continue;
+        catch (error) {
+            if (!completedSetup) {
+                disposeEffect();
             }
-            const unsubscribe = dependency.subscribe(() => {
-                scheduler.schedule();
-            });
-            activeSubscriptions.set(dependency, typeof unsubscribe === 'function' ? unsubscribe : () => { });
+            throw error;
         }
         void effectId;
     }
     const scheduler = createScheduler(runEffectNow, options);
-    function disposeEffect() {
+    function disposeEffect(errors = null) {
         if (disposed) {
             return;
         }
@@ -70,11 +80,11 @@ export function createAutoTrackedEffect(effect, options, scope) {
         scheduler.cancel();
         for (const unsubscribe of activeSubscriptions.values()) {
             if (typeof unsubscribe === 'function') {
-                unsubscribe();
+                runCleanupCallback(unsubscribe, errors);
             }
         }
         activeSubscriptions.clear();
-        drainCleanupStack(runCleanups);
+        drainCleanupStack(runCleanups, errors);
     }
     registerScopeDisposer(scope, disposeEffect);
     queueWhenScopeReady(scope, () => scheduler.schedule());
@@ -91,7 +101,9 @@ export function createExplicitDependencyEffect(effect, dependencies, scope) {
         throw new Error('[Zenith Runtime] zeneffect(deps, fn) requires a function');
     }
     let disposed = false;
+    let completedSetup = false;
     const runCleanups = [];
+    const unsubscribers = [];
     function registerCleanup(cleanup) {
         if (typeof cleanup !== 'function') {
             throw new Error('[Zenith Runtime] cleanup(fn) requires a function');
@@ -103,37 +115,60 @@ export function createExplicitDependencyEffect(effect, dependencies, scope) {
             return;
         }
         drainCleanupStack(runCleanups);
-        const result = effect(createEffectContext(registerCleanup));
-        applyCleanupResult(result, registerCleanup);
-    }
-    const unsubscribers = dependencies.map((dep, index) => {
-        if (!dep || typeof dep.subscribe !== 'function') {
-            throw new Error(`[Zenith Runtime] zeneffect dependency at index ${index} must expose subscribe(fn)`);
-        }
-        return dep.subscribe(() => {
-            if (scope?.mountReady === true) {
-                runEffectNow();
-                return;
+        try {
+            const result = effect(createEffectContext(registerCleanup));
+            applyCleanupResult(result, registerCleanup);
+            completedSetup = true;
+        }
+        catch (error) {
+            if (!completedSetup) {
+                dispose();
             }
-            queueWhenScopeReady(scope, runEffectNow);
-        });
-    });
-    if (scope?.mountReady === true) {
-        runEffectNow();
-    }
-    else {
-        queueWhenScopeReady(scope, runEffectNow);
+            throw error;
+        }
     }
-    const dispose = () => {
+    function dispose(errors = null) {
         if (disposed) {
             return;
         }
         disposed = true;
-        for (let i = 0; i < unsubscribers.length; i++) {
-            unsubscribers[i]();
+        for (let i = unsubscribers.length - 1; i >= 0; i--) {
+            if (typeof unsubscribers[i] === 'function') {
+                runCleanupCallback(unsubscribers[i], errors);
+            }
         }
-        drainCleanupStack(runCleanups);
-    };
-    registerScopeDisposer(scope, dispose);
-    return dispose;
+        unsubscribers.length = 0;
+        drainCleanupStack(runCleanups, errors);
+    }
+    try {
+        for (let index = 0; index < dependencies.length; index++) {
+            const dep = dependencies[index];
+            if (!dep || typeof dep.subscribe !== 'function') {
+                throw new Error(`[Zenith Runtime] zeneffect dependency at index ${index} must expose subscribe(fn)`);
+            }
+        }
+        for (let index = 0; index < dependencies.length; index++) {
+            const dep = dependencies[index];
+            const unsubscribe = dep.subscribe(() => {
+                if (scope?.mountReady === true) {
+                    runEffectNow();
+                    return;
+                }
+                queueWhenScopeReady(scope, runEffectNow);
+            });
+            unsubscribers.push(typeof unsubscribe === 'function' ? unsubscribe : () => { });
+        }
+        if (scope?.mountReady === true) {
+            runEffectNow();
+        }
+        else {
+            queueWhenScopeReady(scope, runEffectNow);
+        }
+        registerScopeDisposer(scope, dispose);
+        return dispose;
+    }
+    catch (error) {
+        dispose();
+        throw error;
+    }
 }

package/dist/effect-utils.d.ts

@@ -5,7 +5,9 @@ export declare function normalizeEffectOptions(options: any): {
     raf: boolean;
     flush: string;
 };
-export declare function drainCleanupStack(cleanups: any): void;
+export declare function drainCleanupStack(cleanups: any, errors?: null): void;
+export declare function runCleanupCallback(callback: any, errors?: null): void;
+export declare function throwCleanupErrors(errors: any, label?: string): void;
 export declare function applyCleanupResult(result: any, registerCleanup: any): void;
 export declare function createMountContext(registerCleanup: any): {
     cleanup: any;

package/dist/effect-utils.js

@@ -38,7 +38,8 @@ export function normalizeEffectOptions(options) {
     }
     return normalized;
 }
-export function drainCleanupStack(cleanups) {
+export function drainCleanupStack(cleanups, errors = null) {
+    const errorSink = Array.isArray(errors) ? errors : null;
     for (let i = cleanups.length - 1; i >= 0; i--) {
         const cleanup = cleanups[i];
         if (typeof cleanup !== 'function') {
@@ -47,11 +48,35 @@ export function drainCleanupStack(cleanups) {
         try {
             cleanup();
         }
-        catch {
+        catch (error) {
+            if (errorSink) {
+                errorSink.push(error);
+            }
         }
     }
     cleanups.length = 0;
 }
+export function runCleanupCallback(callback, errors = null) {
+    try {
+        callback();
+    }
+    catch (error) {
+        if (Array.isArray(errors)) {
+            errors.push(error);
+        }
+    }
+}
+export function throwCleanupErrors(errors, label = 'cleanup') {
+    if (!Array.isArray(errors) || errors.length === 0) {
+        return;
+    }
+    const message = `[Zenith Runtime] ${label} failed with ${errors.length} error(s)`;
+    const error = typeof AggregateError === 'function'
+        ? new AggregateError(errors, message)
+        : new Error(message);
+    error.zenithCleanupErrors = errors;
+    throw error;
+}
 export function applyCleanupResult(result, registerCleanup) {
     if (typeof result === 'function') {
         registerCleanup(result);

package/dist/markup.js

@@ -10,6 +10,19 @@ const _FRAGMENT_EVENT_ATTR_RE = /\bon[a-z]+\s*=/i;
 const _FRAGMENT_JS_URL_RE = /javascript\s*:/i;
 const _FRAGMENT_PROTO_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
 const _FRAGMENT_SCRIPT_CLOSE_RE = /<\/script/gi;
+const _FRAGMENT_URL_ATTRS = new Set(['href', 'src', 'srcset', 'action', 'formaction', 'poster', 'xlink:href']);
+const _FRAGMENT_ALLOWED_PROTOCOLS = new Set(['http:', 'https:', 'mailto:', 'tel:']);
+const _FRAGMENT_URL_ATTR_RE = /\s([:@A-Za-z0-9_.-]+)\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'=<>`]+))/g;
+const _FRAGMENT_NAMED_ENTITIES = {
+    amp: '&',
+    apos: "'",
+    colon: ':',
+    gt: '>',
+    lt: '<',
+    newline: '\n',
+    quot: '"',
+    tab: '\t'
+};
 function _createHtmlFragment(html) {
     return {
         __zenith_fragment: true,
@@ -65,9 +78,119 @@ export function _fragment(strings, ...values) {
             hint: 'javascript: URLs are forbidden.'
         });
     }
+    _validateFragmentUrlAttributes(result);
     result = result.replace(_FRAGMENT_SCRIPT_CLOSE_RE, '<\\/script');
     return _createHtmlFragment(result);
 }
+function _validateFragmentUrlAttributes(html) {
+    if (_validateFragmentUrlAttributesWithTemplate(html)) {
+        return;
+    }
+    _FRAGMENT_URL_ATTR_RE.lastIndex = 0;
+    for (const match of html.matchAll(_FRAGMENT_URL_ATTR_RE)) {
+        const attrName = String(match[1] || '').toLowerCase();
+        if (!_FRAGMENT_URL_ATTRS.has(attrName)) {
+            continue;
+        }
+        _validateFragmentUrlAttribute(attrName, match[2] ?? match[3] ?? match[4] ?? '');
+    }
+}
+function _validateFragmentUrlAttributesWithTemplate(html) {
+    const doc = globalThis.document;
+    if (!doc || typeof doc.createElement !== 'function') {
+        return false;
+    }
+    const template = doc.createElement('template');
+    if (!template || !('innerHTML' in template)) {
+        return false;
+    }
+    template.innerHTML = html;
+    const stack = Array.from(template.content?.childNodes || []);
+    while (stack.length > 0) {
+        const node = stack.pop();
+        if (!node) {
+            continue;
+        }
+        if (node.nodeType === 1 && node.attributes) {
+            for (let i = 0; i < node.attributes.length; i++) {
+                const attr = node.attributes[i];
+                const attrName = String(attr.name || '').toLowerCase();
+                if (_FRAGMENT_URL_ATTRS.has(attrName)) {
+                    _validateFragmentUrlAttribute(attrName, attr.value || '');
+                }
+            }
+        }
+        const children = node.childNodes ? Array.from(node.childNodes) : [];
+        for (let i = children.length - 1; i >= 0; i--) {
+            stack.push(children[i]);
+        }
+    }
+    return true;
+}
+function _validateFragmentUrlAttribute(attrName, value) {
+    if (attrName === 'srcset') {
+        _validateFragmentSrcsetAttribute(value);
+        return;
+    }
+    _validateFragmentSingleUrlAttribute(attrName, value);
+}
+function _validateFragmentSingleUrlAttribute(attrName, value) {
+    const protocol = _normalizedFragmentUrlProtocol(value);
+    if (protocol && !_FRAGMENT_ALLOWED_PROTOCOLS.has(protocol)) {
+        throwZenithRuntimeError({
+            phase: 'render',
+            code: 'NON_RENDERABLE_VALUE',
+            message: `Embedded markup expression contains unsafe URL protocol in ${attrName}`,
+            hint: 'Use a relative URL or an allowed absolute URL.'
+        });
+    }
+}
+function _validateFragmentSrcsetAttribute(value) {
+    const candidates = String(value || '').split(',');
+    for (let i = 0; i < candidates.length; i++) {
+        const candidate = candidates[i].trim();
+        if (!candidate) {
+            continue;
+        }
+        const url = candidate.split(/[\u0000-\u001F\u007F\s]+/, 1)[0] || '';
+        _validateFragmentSingleUrlAttribute('srcset', url);
+    }
+}
+function _normalizedFragmentUrlProtocol(value) {
+    const normalized = _decodeFragmentAttributeValue(value)
+        .trim()
+        .replace(/[\u0000-\u001F\u007F\s]+/g, '');
+    const match = /^([A-Za-z][A-Za-z0-9+.-]*):/.exec(normalized);
+    return match ? `${match[1].toLowerCase()}:` : '';
+}
+function _decodeFragmentAttributeValue(value) {
+    let decoded = String(value || '');
+    for (let pass = 0; pass < 3; pass++) {
+        const next = decoded.replace(/&(#x[0-9a-fA-F]+|#[0-9]+|[A-Za-z][A-Za-z0-9]+);?/g, (_, body) => {
+            if (body[0] === '#') {
+                const radix = body[1] === 'x' || body[1] === 'X' ? 16 : 10;
+                const digits = radix === 16 ? body.slice(2) : body.slice(1);
+                const codePoint = Number.parseInt(digits, radix);
+                if (Number.isFinite(codePoint)) {
+                    try {
+                        return String.fromCodePoint(codePoint);
+                    }
+                    catch {
+                        return '';
+                    }
+                }
+                return '';
+            }
+            const named = _FRAGMENT_NAMED_ENTITIES[String(body).toLowerCase()];
+            return named === undefined ? `&${body};` : named;
+        });
+        if (next === decoded) {
+            break;
+        }
+        decoded = next;
+    }
+    return decoded;
+}
 function _fragmentInterpolate(val, interpolationIndex) {
     if (val === null || val === undefined || val === false) {
         return '';

package/dist/mount-runtime.js

@@ -23,8 +23,8 @@ export function createMountEffect(callback, scope) {
         catch (error) {
             console.error('[Zenith Runtime] Unhandled error during zenMount:', error);
         }
-        registeredDisposer = registerScopeDisposer(scope, () => {
-            drainCleanupStack(cleanups);
+        registeredDisposer = registerScopeDisposer(scope, (errors = null) => {
+            drainCleanupStack(cleanups, errors);
         });
     }
     queueWhenScopeReady(scope, runMount);

package/dist/render.js

@@ -21,13 +21,7 @@ export function _applyMarkerValue(nodes, marker, value) {
                     _mountStructuralFragment(node, value, textPath);
                     continue;
                 }
-                const html = _renderFragmentValue(value, textPath);
-                if (html !== null) {
-                    node.innerHTML = html;
-                }
-                else {
-                    node.textContent = _coerceText(value, textPath);
-                }
+                _replaceTextMarkerContent(node, value, textPath);
                 continue;
             }
             if (marker.kind === 'attr') {
@@ -136,10 +130,22 @@ function _mountStructuralFragment(container, value, rootPath = 'renderable') {
     if (_tryUpdateFragmentTarget(container, value, container, null, rootPath)) {
         return;
     }
-    _runUnmounts(container);
-    container.innerHTML = '';
+    _clearStructuralTarget(container);
+    while (container.firstChild) {
+        container.removeChild(container.firstChild);
+    }
     _mountFragmentRegion(container, value, container, null, rootPath);
 }
+function _replaceTextMarkerContent(node, value, rootPath) {
+    _clearStructuralTarget(node);
+    const html = _renderFragmentValue(value, rootPath);
+    if (html !== null) {
+        node.innerHTML = html;
+    }
+    else {
+        node.textContent = _coerceText(value, rootPath);
+    }
+}
 export function _coerceText(value, path = 'renderable') {
     if (value === null || value === undefined || value === false || value === true) {
         return '';
@@ -258,6 +264,11 @@ function _runUnmounts(target) {
     }
     target.__z_unmounts = [];
 }
+function _clearStructuralTarget(target) {
+    _runUnmounts(target);
+    target.__z_fragment_region = null;
+    target.__z_fragment_region_active = false;
+}
 function _updateFragmentRegion(region, value, parent, insertBefore, rootPath) {
     try {
         region.update(value, { parent, insertBefore, rootPath });

package/dist/side-effect-scope.d.ts

@@ -1,6 +1,6 @@
 export declare function isSideEffectScope(value: any): boolean;
 export declare function resolveSideEffectScope(scopeOverride: any): any;
-export declare function resetGlobalSideEffects(): void;
+export declare function resetGlobalSideEffects(errors?: null): void;
 export declare function createSideEffectScope(label?: string): {
     __zenith_scope: boolean;
     id: number;
@@ -12,5 +12,5 @@ export declare function createSideEffectScope(label?: string): {
 };
 export declare function activateSideEffectScope(scope: any): void;
 export declare function registerScopeDisposer(scope: any, disposer: any): () => void;
-export declare function disposeSideEffectScope(scope: any): void;
+export declare function disposeSideEffectScope(scope: any, errors?: null): void;
 export declare function queueWhenScopeReady(scope: any, callback: any): void;

package/dist/side-effect-scope.js

@@ -1,4 +1,5 @@
 // @ts-nocheck
+import { runCleanupCallback } from './effect-utils.js';
 let _scopeIdCounter = 0;
 function createInternalScope(label, mountReady) {
     _scopeIdCounter += 1;
@@ -22,8 +23,8 @@ export function resolveSideEffectScope(scopeOverride) {
     }
     return _globalScope;
 }
-export function resetGlobalSideEffects() {
-    disposeSideEffectScope(_globalScope);
+export function resetGlobalSideEffects(errors = null) {
+    disposeSideEffectScope(_globalScope, errors);
     _globalScope = createInternalScope('global', true);
 }
 export function createSideEffectScope(label = 'anonymous') {
@@ -67,7 +68,7 @@ export function registerScopeDisposer(scope, disposer) {
         }
     };
 }
-export function disposeSideEffectScope(scope) {
+export function disposeSideEffectScope(scope, errors = null) {
     if (!scope || scope.disposed) {
         return;
     }
@@ -80,11 +81,7 @@ export function disposeSideEffectScope(scope) {
         if (typeof disposer !== 'function') {
             continue;
         }
-        try {
-            disposer();
-        }
-        catch {
-        }
+        runCleanupCallback(() => disposer(errors), errors);
     }
 }
 export function queueWhenScopeReady(scope, callback) {

package/dist/zeneffect.d.ts

@@ -1,13 +1,13 @@
 export { _nextReactiveId, _trackDependency } from './reactivity-core.js';
 export { resetGlobalSideEffects, createSideEffectScope, activateSideEffectScope, disposeSideEffectScope } from './side-effect-scope.js';
-export declare function zenEffect(effect: any, options?: null, scopeOverride?: null): () => void;
-export declare function zeneffect(effectOrDependencies: any, optionsOrEffect: any, scopeOverride?: null): () => void;
+export declare function zenEffect(effect: any, options?: null, scopeOverride?: null): (errors?: null) => void;
+export declare function zeneffect(effectOrDependencies: any, optionsOrEffect: any, scopeOverride?: null): (errors?: null) => void;
 export declare function zenMount(callback: any, scopeOverride?: null): () => void;
 /**
  * @alias zeneffect
  * @description Optional secondary alias for the canonical zeneffect primitive.
  */
-export declare function effect(effectOrDependencies: any, optionsOrEffect: any, scopeOverride?: null): () => void;
+export declare function effect(effectOrDependencies: any, optionsOrEffect: any, scopeOverride?: null): (errors?: null) => void;
 /**
  * @alias zenMount
  * @description Optional secondary alias for the canonical zenMount primitive.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zenithbuild/runtime",
-  "version": "0.7.9",
+  "version": "0.7.11",
   "type": "module",
   "main": "./dist/index.js",
   "exports": {