lume-js 2.3.0 → 2.3.1

package/llms.txt

@@ -0,0 +1,89 @@
+# Lume.js
+
+> Minimal reactive state management using only standard JavaScript and HTML —
+> no custom syntax, no build step, no framework lock-in. 1.46 KB universal
+> core (state/batch), 2.66 KB with DOM binding (bindDom/effect). Reactivity
+> that follows web standards: stores are Proxies over plain objects, DOM
+> binding is declarative via valid data-* attributes, updates are
+> microtask-batched per store with an explicit batch() escape hatch for
+> cross-store writes.
+
+Version: 2.3.1. Install: `npm install lume-js` or import from
+`https://cdn.jsdelivr.net/npm/lume-js/dist/index.min.mjs`.
+
+Key facts agents get wrong without reading the docs: arrays and nested
+objects must be REPLACED, never mutated in place (reference equality);
+nested objects need explicit state() wrapping; updates flush on the next
+microtask, not synchronously; effects only track keys read synchronously;
+data-* attribute values are state keys, never expressions.
+
+## Start here
+
+- [AGENT_GUIDE.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/AGENT_GUIDE.md): Distilled rules, pitfalls, and patterns for coding agents
+- [README.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/README.md): Pitch, installation, quick start, API overview
+
+## Guides
+
+- [docs/guides/installation.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/docs/guides/installation.md): CDN, npm, and import options
+- [docs/guides/quick-start.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/docs/guides/quick-start.md): First app in five minutes
+- [docs/guides/core-concepts.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/docs/guides/core-concepts.md): Stores, effects, bindings
+- [docs/guides/reactivity.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/docs/guides/reactivity.md): How the Proxy, tracking, and microtask flush work
+- [docs/guides/choosing-reactive-primitives.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/docs/guides/choosing-reactive-primitives.md): effect vs computed vs watch
+- [docs/guides/two-way-binding.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/docs/guides/two-way-binding.md): Inputs and data-bind
+- [docs/guides/lists.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/docs/guides/lists.md): Rendering arrays
+- [docs/guides/forms.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/docs/guides/forms.md): Form patterns
+- [docs/guides/handlers.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/docs/guides/handlers.md): Extending bindDom with new data-* attributes
+- [docs/guides/cleanup-and-dispose.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/docs/guides/cleanup-and-dispose.md): Tearing down effects and bindings
+- [docs/guides/performance.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/docs/guides/performance.md): Batching and update costs
+- [docs/guides/animations.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/docs/guides/animations.md): Animating on state change
+- [docs/guides/routing.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/docs/guides/routing.md): Client-side routing patterns
+- [docs/guides/ssr-hydration.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/docs/guides/ssr-hydration.md): Server-rendered HTML with reactive hydration
+- [docs/guides/universal-core.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/docs/guides/universal-core.md): Using lume-js/state without a DOM
+- [docs/guides/testing.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/docs/guides/testing.md): Testing stores and bindings
+- [docs/guides/migration.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/docs/guides/migration.md): Migrating between versions
+- [docs/guides/faq.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/docs/guides/faq.md): Frequently asked questions
+
+## Tutorials
+
+- [docs/tutorials/build-todo-app.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/docs/tutorials/build-todo-app.md): Todo app walkthrough
+- [docs/tutorials/working-with-arrays.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/docs/tutorials/working-with-arrays.md): Immutable array updates — the golden rule
+- [docs/tutorials/build-tic-tac-toe.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/docs/tutorials/build-tic-tac-toe.md): Game with history and computed winner
+
+## API reference — core
+
+- [docs/api/core/state.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/docs/api/core/state.md): state() reactive stores
+- [docs/api/core/effect.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/docs/api/core/effect.md): effect() auto-tracking and explicit deps
+- [docs/api/core/bindDom.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/docs/api/core/bindDom.md): bindDom() DOM binding
+- [docs/api/core/batch.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/docs/api/core/batch.md): batch() cross-store write grouping
+- [docs/api/core/handlers.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/docs/api/core/handlers.md): Handler system — the { attr, apply } extension contract
+
+## API reference — handlers
+
+- [docs/api/handlers/show.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/docs/api/handlers/show.md): Conditional visibility
+- [docs/api/handlers/className.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/docs/api/handlers/className.md): Full class attribute from state
+- [docs/api/handlers/boolAttr.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/docs/api/handlers/boolAttr.md): Boolean attributes (disabled, hidden, …)
+- [docs/api/handlers/ariaAttr.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/docs/api/handlers/ariaAttr.md): ARIA attributes from state
+- [docs/api/handlers/classToggle.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/docs/api/handlers/classToggle.md): Toggle a single class
+- [docs/api/handlers/stringAttr.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/docs/api/handlers/stringAttr.md): String attributes (href, src, title, …)
+- [docs/api/handlers/on.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/docs/api/handlers/on.md): Declarative event wiring via data-on*
+- [docs/api/handlers/htmlAttrs.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/docs/api/handlers/htmlAttrs.md): Preset bundle of common attributes
+
+## API reference — addons
+
+- [docs/api/addons/computed.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/docs/api/addons/computed.md): Derived read-only values
+- [docs/api/addons/watch.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/docs/api/addons/watch.md): Single-key observation
+- [docs/api/addons/repeat.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/docs/api/addons/repeat.md): Keyed list rendering
+- [docs/api/addons/persist.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/docs/api/addons/persist.md): localStorage/sessionStorage sync
+- [docs/api/addons/hydrateState.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/docs/api/addons/hydrateState.md): SSR hydration
+- [docs/api/addons/createCleanupGroup.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/docs/api/addons/createCleanupGroup.md): Grouped disposal
+- [docs/api/addons/debug.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/docs/api/addons/debug.md): Write/flush logging
+- [docs/api/addons/withPlugins.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/docs/api/addons/withPlugins.md): State extension system
+- [docs/api/addons/isReactive.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/docs/api/addons/isReactive.md): Reactive brand detection
+
+## Design
+
+- [docs/design/design-decisions.md](https://raw.githubusercontent.com/sathvikc/lume-js/main/docs/design/design-decisions.md): Ratified decisions and their reasoning
+
+## Optional
+
+- [llms-full.txt](https://raw.githubusercontent.com/sathvikc/lume-js/main/llms-full.txt): every file above concatenated into one document

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lume-js",
-  "version": "2.3.0",
+  "version": "2.3.1",
   "description": "Minimal reactive state management using only standard JavaScript and HTML - no custom syntax, no build step required",
   "main": "dist/index.mjs",
   "module": "dist/index.mjs",
@@ -43,13 +43,18 @@
     "test:watch": "vitest",
     "coverage": "vitest run --coverage",
     "typecheck": "tsc --noEmit",
-    "validate": "npm run build && node scripts/check-size.js && node scripts/complexity.js && npm run lint && npm run typecheck && npm run coverage",
+    "llms": "node scripts/build-llms.js",
+    "llms:check": "node scripts/build-llms.js --check",
+    "validate": "npm run build && node scripts/check-size.js && node scripts/complexity.js && npm run lint && npm run typecheck && npm run coverage && node scripts/build-llms.js --check",
     "prepublishOnly": "npm run validate"
   },
   "files": [
     "dist",
     "src",
     "README.md",
+    "AGENT_GUIDE.md",
+    "llms.txt",
+    "llms-full.txt",
     "LICENSE"
   ],
   "keywords": [

package/src/addons/index.d.ts

@@ -153,9 +153,11 @@ export interface RepeatOptions<T> {
 
   /**
    * Function called ONCE when element is created (for DOM structure setup)
-   * Recommended for event listeners and innerHTML setup
+   * Recommended for event listeners and innerHTML setup.
+   * May return a cleanup function — it is called automatically when the
+   * element is removed (by list update or full cleanup).
    */
-  create?: (item: T, element: HTMLElement, index: number) => void;
+  create?: (item: T, element: HTMLElement, index: number) => void | (() => void);
 
   /**
    * Function called on every update for data binding
@@ -163,6 +165,13 @@ export interface RepeatOptions<T> {
    */
   update?: (item: T, element: HTMLElement, index: number, context: UpdateContext) => void;
 
+  /**
+   * Additional cleanup when an element is removed. Called after any cleanup
+   * function returned by create(). Prefer returning a cleanup from create()
+   * for automatic lifecycle management.
+   */
+  remove?: (item: T, element: HTMLElement) => void;
+
   /**
    * Declarative item structure from a standard <template> element.
    * - true: use the first <template> inside the container
@@ -458,6 +467,9 @@ export interface Plugin {
  * Wrap a reactive state proxy with plugin hooks.
  * Plugins can intercept get/set/notify/subscribe operations.
  *
+ * The returned proxy additionally exposes $dispose(), which removes the
+ * plugin layer's flush hook and clears its pending notifications.
+ *
  * @param store - A reactive proxy from state()
  * @param plugins - Array of plugin objects
  * @returns A new proxy wrapping the store with plugin behavior
@@ -468,9 +480,13 @@ export interface Plugin {
  * import { withPlugins, createDebugPlugin } from 'lume-js/addons';
  *
  * const store = withPlugins(state({ count: 0 }), [createDebugPlugin({ label: 'counter' })]);
+ * store.$dispose(); // detach the plugin layer when done
  * ```
  */
-export function withPlugins<T extends object>(store: ReactiveState<T>, plugins: Plugin[]): ReactiveState<T>;
+export function withPlugins<T extends object>(
+  store: ReactiveState<T>,
+  plugins: Plugin[]
+): ReactiveState<T> & { $dispose(): void };
 
 /**
  * A group that collects cleanup/unsubscribe functions and can dispose them all at once.
@@ -508,7 +524,9 @@ export function createCleanupGroup(): CleanupGroup;
  * embedded in the server-rendered HTML.
  *
  * @param selector - CSS selector for the script element (default: '#__LUME_DATA__')
- * @returns Parsed JSON object, or empty object if not found or invalid
+ * @param validate - Optional validator: (data) => boolean. If it returns
+ *   false, hydrateState returns {} instead of the parsed data.
+ * @returns Parsed JSON object, or empty object if not found, invalid, or rejected
  *
  * @example
  * ```typescript
@@ -516,9 +534,14 @@ export function createCleanupGroup(): CleanupGroup;
  * import { hydrateState } from 'lume-js/addons';
  *
  * const store = state(hydrateState());
+ *
+ * // With schema validation
+ * const data = hydrateState('#__LUME_DATA__', d =>
+ *   typeof (d as any).title === 'string'
+ * );
  * ```
  */
-export function hydrateState(selector?: string): object;
+export function hydrateState(selector?: string, validate?: (data: unknown) => boolean): object;
 
 /**
  * Options for persist()
@@ -526,6 +549,7 @@ export function hydrateState(selector?: string): object;
 export interface PersistOptions {
   /**
    * Keys to persist. Default: all own non-$ keys of the store at call time.
+   * An explicit empty array is respected: persists and hydrates nothing.
    */
   keys?: string[];
   /**

package/src/addons/persist.js

@@ -53,6 +53,25 @@ function serializeKeys(store, watched) {
   return JSON.stringify(out);
 }
 
+// storage object → Set of storage keys currently managed by a persist()
+// instance. Two instances on one entry silently overwrite each other's
+// subsets (each serializes only its own watched keys over the whole blob),
+// so the second registration gets a loud warning.
+const activeEntries = new WeakMap();
+
+/**
+ * Default storage resolution. Wrapped because accessing localStorage can
+ * THROW (SecurityError) in cookie-blocked iframes and some privacy modes —
+ * persist() must degrade to a warning, never crash the app at setup.
+ */
+function defaultStorage() {
+  try {
+    return typeof localStorage !== 'undefined' ? localStorage : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 /**
  * Sync store keys with a Storage object.
  *
@@ -75,17 +94,35 @@ export function persist(store, storageKey, options = {}) {
 
   const storage = options.storage !== undefined
     ? options.storage
-    : globalThis.localStorage;
+    : defaultStorage();
 
   if (!storage || typeof storage.getItem !== 'function') {
     logWarn('[Lume.js] persist(): no storage available — persistence disabled');
     return () => {};
   }
 
-  const watched = Array.isArray(options.keys) && options.keys.length > 0
+  // An explicit array is respected as-is — including [] (persist nothing).
+  // Only an absent/non-array option falls back to all own non-$ keys.
+  const watched = Array.isArray(options.keys)
     ? options.keys.slice()
     : Object.keys(store).filter(k => !k.startsWith('$'));
 
+  // Warn when another live persist() already manages this storage entry
+  let entrySet = activeEntries.get(storage);
+  if (!entrySet) {
+    entrySet = new Set();
+    activeEntries.set(storage, entrySet);
+  }
+  const ownsEntry = !entrySet.has(storageKey);
+  if (ownsEntry) {
+    entrySet.add(storageKey);
+  } else {
+    logWarn(
+      `[Lume.js] persist(): "${storageKey}" is already managed by another persist() on this storage — ` +
+      'instances will overwrite each other\'s data. Use a distinct key per store.'
+    );
+  }
+
   // ── Hydrate ────────────────────────────────────────────────────────────
   // Only watched keys are assigned — stale storage can't inject others.
   const stored = readStored(storage, storageKey);
@@ -147,6 +184,7 @@ export function persist(store, storageKey, options = {}) {
 
   return () => {
     disposed = true;
+    if (ownsEntry) entrySet.delete(storageKey);
     while (unsubs.length) unsubs.pop()();
   };
 }

package/src/addons/repeat.js

@@ -114,11 +114,11 @@ import { logWarn, logError } from '../utils/log.js';
 import { applyBindValue } from '../core/bindDom.js';
 
 /**
- * Resolve the template option to its single root element.
+ * Resolve the template option to the <template> element.
  * Accepts true (first <template> inside the container), a CSS selector,
  * or an HTMLTemplateElement directly.
  */
-function resolveTemplateRoot(template, containerEl) {
+function resolveTemplateEl(template, containerEl) {
   let templateEl = template;
   if (template === true) {
     templateEl = containerEl.querySelector('template');
@@ -131,7 +131,22 @@ function resolveTemplateRoot(template, containerEl) {
   if (templateEl.content.children.length !== 1) {
     throw new Error('[Lume.js] repeat(): template must contain exactly one root element');
   }
-  return templateEl.content.firstElementChild;
+  return templateEl;
+}
+
+/**
+ * Resolve the template option to its clone root, plus the container child
+ * that is (or contains) the source <template>. Reconciliation and cleanup
+ * must leave that child alone — it's the user's markup, and removing it
+ * would break re-binding with `template: true` after cleanup. keepEl is
+ * null when there is no template or it lives outside the container.
+ */
+function resolveTemplate(template, containerEl) {
+  if (!template) return { templateRoot: null, keepEl: null };
+  const templateEl = resolveTemplateEl(template, containerEl);
+  let keepEl = templateEl;
+  while (keepEl && keepEl.parentNode !== containerEl) keepEl = keepEl.parentNode;
+  return { templateRoot: templateEl.content.firstElementChild, keepEl };
 }
 
 /**
@@ -300,7 +315,7 @@ export function repeat(container, store, arrayKey, options) {
 
   // Template mode: structure and data binding come from the <template>;
   // render/create/update are all optional on top of it.
-  const templateRoot = template ? resolveTemplateRoot(template, containerEl) : null;
+  const { templateRoot, keepEl } = resolveTemplate(template, containerEl);
 
   if (templateRoot && typeof render === 'function') {
     logWarn('[Lume.js] repeat(): options.render is ignored when options.template is set — use create/update instead');
@@ -329,10 +344,29 @@ export function repeat(container, store, arrayKey, options) {
       : document.createElement(element);
   }
 
+  /**
+   * Empty the container, preserving the in-container source template.
+   * Manual removal (not replaceChildren) for two reasons: replaceChildren
+   * is Chrome 86+/Safari 14+ — above the documented ES2020-era browser
+   * floor — and re-inserting keepEl would re-parent a template the user
+   * has since moved (or resurrect one they deleted).
+   */
+  function clearContainer() {
+    let node = containerEl.firstChild;
+    while (node) {
+      const next = node.nextSibling;
+      if (node !== keepEl) containerEl.removeChild(node);
+      node = next;
+    }
+  }
+
   function reconcileDOM(container, nextEls) {
     let ptr = container.firstChild;
 
     for (let i = 0; i < nextEls.length; i++) {
+      // Never treat the source template (or its wrapper) as a list row
+      if (keepEl && ptr === keepEl) ptr = ptr.nextSibling;
+
       const desired = nextEls[i];
 
       if (ptr === desired) {
@@ -343,10 +377,10 @@ export function repeat(container, store, arrayKey, options) {
       container.insertBefore(desired, ptr);
     }
 
-    // Remove leftover children not in nextEls
+    // Remove leftover children not in nextEls (preserving the template)
     while (ptr) {
       const next = ptr.nextSibling;
-      container.removeChild(ptr);
+      if (ptr !== keepEl) container.removeChild(ptr);
       ptr = next;
     }
   }
@@ -510,7 +544,7 @@ export function repeat(container, store, arrayKey, options) {
           remove(prevItem, el);
         }
       }
-      containerEl.replaceChildren();
+      clearContainer();
       elementsByKey.clear();
       prevItemsByKey.clear();
       prevIndexByKey.clear();
@@ -539,8 +573,8 @@ export function repeat(container, store, arrayKey, options) {
         remove(prevItem, el);
       }
     }
-    // Clear DOM elements (replaceChildren is faster than loop)
-    containerEl.replaceChildren();
+    // Clear DOM elements (preserving the source template, if any)
+    clearContainer();
     elementsByKey.clear();
     prevItemsByKey.clear();
     prevIndexByKey.clear();

package/src/core/state.js

@@ -121,7 +121,16 @@ export function state(obj) {
   }
 
   function notifySubscribers() {
-    for (const [key, value] of pendingNotifications) {
+    // Drain BEFORE delivering. Iterating the live Map is wrong twice over:
+    // a subscriber writing back to an already-delivered key would update
+    // the in-flight entry (never revisited) and the trailing clear() would
+    // destroy it — a silently lost update; and a subscriber opening a
+    // batch() would re-deliver every in-flight entry through the wave's
+    // re-entrant call. Draining first means write-backs land in the now-
+    // empty live Map and are delivered by the next flush iteration/wave.
+    const entries = Array.from(pendingNotifications);
+    pendingNotifications.clear();
+    for (const [key, value] of entries) {
       if (listeners[key]) {
         const subs = listeners[key];
         let i = 0;
@@ -137,7 +146,6 @@ export function state(obj) {
         }
       }
     }
-    pendingNotifications.clear();
   }
 
   /** Drain queued effects (Set deduplicates) into an array. */

package/src/handlers/stringAttr.js

@@ -6,7 +6,13 @@
  * @returns {{ attr: string, apply: function }}
  */
 
-const DANGEROUS_SCHEME = /^(javascript|vbscript|data\s*:\s*text\/html)/i;
+// Matched against a normalized copy of the value (C0 controls, space, and
+// DEL stripped; lowercased) because the browser URL parser ignores those
+// characters when determining the scheme — "java\tscript:alert(1)" and
+// " javascript:alert(1)" both execute. The colon is required so legitimate
+// relative URLs like "javascript-tutorial.html" are not blocked.
+const DANGEROUS_SCHEME = /^(?:javascript:|vbscript:|data:text\/html)/;
+const IGNORED_URL_CHARS = /[\u0000-\u0020\u007F]/g;
 const URI_ATTRS = new Set(['href', 'src', 'action', 'srcset', 'poster', 'formaction']);
 
 export function stringAttr(name) {
@@ -18,7 +24,8 @@ export function stringAttr(name) {
         return;
       }
       const strVal = String(val);
-      if (URI_ATTRS.has(name) && DANGEROUS_SCHEME.test(strVal)) {
+      if (URI_ATTRS.has(name) &&
+          DANGEROUS_SCHEME.test(strVal.replace(IGNORED_URL_CHARS, '').toLowerCase())) {
         el.removeAttribute(name);
         return;
       }