jssm 5.155.0 → 5.155.1

package/README.md

@@ -18,10 +18,10 @@ Please edit the file it's derived from, instead: `./src/md/readme_base.md`
 
 
 
-* Generated for version 5.155.0 at 6/28/2026, 7:41:44 PM
+* Generated for version 5.155.1 at 6/28/2026, 7:52:33 PM
 
 -->
-# jssm 5.155.0
+# jssm 5.155.1
 
 [**Try the live editor**](https://stonecypher.github.io/jssm-viz-demo/graph_explorer.html) ·
 [Documentation](https://stonecypher.github.io/jssm/docs/) ·
@@ -312,7 +312,7 @@ That decision shows up everywhere downstream:
   or run `npm run benny` against your own machine.
 
 - **More thoroughly tested than any other JavaScript state-machine
-  library.**  7,811 tests at 100.0% line coverage
+  library.**  7,815 tests at 100.0% line coverage
   ([report](https://coveralls.io/github/StoneCypher/jssm)), plus
   fuzz testing via `fast-check`, with parser test data across ten natural
   languages and Emoji.
@@ -445,11 +445,11 @@ If your contribution is missing here, please open an issue.
 
 <br/>
 
-***7,811 tests***, run 82,853 times.
+***7,815 tests***, run 82,857 times.
 
-- 7,053 specs with 100.0% coverage
-- 758 fuzz tests with 54.8% coverage
-- 9,666 TypeScript lines - 0.8 tests per line, 8.6 generated tests per line
+- 7,057 specs with 100.0% coverage
+- 758 fuzz tests with 54.7% coverage
+- 9,686 TypeScript lines - 0.8 tests per line, 8.6 generated tests per line
 
 [![Actions Status](https://github.com/StoneCypher/jssm/workflows/Node%20CI/badge.svg)](https://github.com/StoneCypher/jssm/actions)
 [![NPM version](https://img.shields.io/npm/v/jssm.svg)](https://www.npmjs.com/package/jssm)

package/custom-elements.json

@@ -3107,6 +3107,11 @@
           ],
           "description": "DEFLATE `bytes` (raw, headerless) via the platform `CompressionStream`."
         },
+        {
+          "kind": "variable",
+          "name": "MAX_PERMALINK_INFLATE_BYTES",
+          "description": "Hard ceiling on the inflated size of a permalink, in bytes. A permalink rides\r\nin a URL an attacker can hand a victim, and inflate_raw runs on it\r\nautomatically on page load, so an uncapped inflate is a decompression-bomb\r\nvector (a tiny `#m=…` could expand to hundreds of MB and OOM the tab). This is\r\ngenerous for real FSL (text — even a vast machine is well under a megabyte)."
+        },
         {
           "kind": "function",
           "name": "inflate_raw",
@@ -3123,7 +3128,7 @@
               }
             }
           ],
-          "description": "Inverse of deflate_raw."
+          "description": "Inverse of deflate_raw, reading the stream in chunks and aborting once\r\nthe inflated output would exceed MAX_PERMALINK_INFLATE_BYTES (a\r\ndecompression-bomb guard — see that constant)."
         },
         {
           "kind": "function",
@@ -3331,6 +3336,14 @@
             "module": "src/ts/wc/fsl_permalink.ts"
           }
         },
+        {
+          "kind": "js",
+          "name": "MAX_PERMALINK_INFLATE_BYTES",
+          "declaration": {
+            "name": "MAX_PERMALINK_INFLATE_BYTES",
+            "module": "src/ts/wc/fsl_permalink.ts"
+          }
+        },
         {
           "kind": "js",
           "name": "inflate_raw",

package/dist/cdn/instance.js

@@ -23563,7 +23563,7 @@ var constants = /*#__PURE__*/Object.freeze({
  *  Useful for runtime diagnostics and for embedding in serialized machine
  *  snapshots so that deserializers can detect version-skew.
  */
-const version = "5.155.0";
+const version = "5.155.1";
 
 // whargarbl lots of these return arrays could/should be sets
 const { state_name_chars, state_name_first_chars, action_label_chars } = constants;
@@ -29436,7 +29436,19 @@ async function deflate_raw(bytes) {
     return new Uint8Array(await new Response(stream.readable).arrayBuffer());
 }
 /**
- * Inverse of {@link deflate_raw}.
+ * Hard ceiling on the inflated size of a permalink, in bytes. A permalink rides
+ * in a URL an attacker can hand a victim, and {@link inflate_raw} runs on it
+ * automatically on page load, so an uncapped inflate is a decompression-bomb
+ * vector (a tiny `#m=…` could expand to hundreds of MB and OOM the tab). This is
+ * generous for real FSL (text — even a vast machine is well under a megabyte).
+ */
+const MAX_PERMALINK_INFLATE_BYTES = 5 * 1024 * 1024;
+/**
+ * Inverse of {@link deflate_raw}, reading the stream in chunks and aborting once
+ * the inflated output would exceed {@link MAX_PERMALINK_INFLATE_BYTES} (a
+ * decompression-bomb guard — see that constant).
+ *
+ * @throws RangeError when the inflated output exceeds the cap.
  *
  * @example
  * new TextDecoder().decode(await inflate_raw(await deflate_raw(new TextEncoder().encode("hi")))); // "hi"
@@ -29446,7 +29458,30 @@ async function inflate_raw(bytes) {
     const writer = stream.writable.getWriter();
     void writer.write(bytes);
     void writer.close();
-    return new Uint8Array(await new Response(stream.readable).arrayBuffer());
+    // Read incrementally; stopping past the cap leaves the stream half-drained, so
+    // backpressure halts further inflation and the abandoned stream is GC'd. We do
+    // not cancel (which would abort the writable and leak an unhandled rejection).
+    const reader = stream.readable.getReader();
+    const chunks = [];
+    let total = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done) {
+            break;
+        }
+        total += value.length;
+        if (total > MAX_PERMALINK_INFLATE_BYTES) {
+            throw new RangeError(`permalink inflate exceeded ${MAX_PERMALINK_INFLATE_BYTES} bytes`);
+        }
+        chunks.push(value);
+    }
+    const out = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        out.set(chunk, offset);
+        offset += chunk.length;
+    }
+    return out;
 }
 /**
  * Encode FSL to a `<scheme><payload>` segment value (the part after `key=`).
@@ -29475,14 +29510,28 @@ async function decode_machine(segment) {
     const plain = scheme === '1' ? await inflate_raw(bytes) : bytes;
     return new TextDecoder().decode(plain);
 }
-/** Split a fragment (leading `#` optional) into `[key, value]` pairs, dropping empties. */
+/** `decodeURIComponent` that returns its input untouched on a malformed escape,
+ *  so a hand-mangled fragment never throws out of {@link read_fragment_param}. */
+function safe_decode(text) {
+    try {
+        return decodeURIComponent(text);
+    }
+    catch (_a) {
+        return text;
+    }
+}
+/**
+ * Split a fragment (leading `#` optional) into `[key, value]` pairs, dropping
+ * empties. Keys are percent-decoded (they are percent-encoded on write by
+ * {@link set_fragment_param}); values are the URL-safe base64 payload as-is.
+ */
 function fragment_pairs(hash) {
     const body = hash.startsWith('#') ? hash.slice(1) : hash;
     return body.split('&').filter(Boolean).map(seg => {
         const eq = seg.indexOf('=');
         return eq === -1
-            ? [seg, '']
-            : [seg.slice(0, eq), seg.slice(eq + 1)];
+            ? [safe_decode(seg), '']
+            : [safe_decode(seg.slice(0, eq)), seg.slice(eq + 1)];
     });
 }
 /**
@@ -29513,7 +29562,9 @@ function set_fragment_param(hash, key, value) {
     else {
         pairs[at] = [key, value];
     }
-    return pairs.map(([k, v]) => `${k}=${v}`).join('&');
+    // Percent-encode the key so an `id`/`uhash` containing `=`, `&`, or `#` cannot
+    // break segmentation or collide with a sibling. Values are URL-safe base64.
+    return pairs.map(([k, v]) => `${encodeURIComponent(k)}=${v}`).join('&');
 }
 /**
  * The fragment key an element owns: its `uhash` attribute if set, else its
@@ -29581,6 +29632,13 @@ class FslPermalinkSync {
         }
         try {
             const fsl = await decode_machine(segment);
+            // The decode is async; if the host was disconnected while it ran, drop the
+            // result rather than mutating a detached element (and triggering a stray
+            // rebuild on a later reconnect). A reconnect runs hostConnected → _restore
+            // afresh.
+            if (!this.host.isConnected) {
+                return;
+            }
             this._last = segment;
             this.host.fsl = fsl;
         }

package/dist/cdn/viz.js

@@ -23588,7 +23588,7 @@ var constants = /*#__PURE__*/Object.freeze({
  *  Useful for runtime diagnostics and for embedding in serialized machine
  *  snapshots so that deserializers can detect version-skew.
  */
-const version = "5.155.0";
+const version = "5.155.1";
 
 // whargarbl lots of these return arrays could/should be sets
 const { state_name_chars, state_name_first_chars, action_label_chars } = constants;

package/dist/cli/fsl-export-system-prompt.cjs

@@ -108,7 +108,7 @@ function parseFslArgs(argv, spec) {
   return { positional, flags, helpText };
 }
 
-const getVersion = () => "5.155.0";
+const getVersion = () => "5.155.1";
 const SPEC = {
   flags: {
     help: { short: "h", boolean: true },