memorio 3.0.1 → 3.0.2

package/README.md

@@ -25,7 +25,6 @@ Zero friction. Zero bloat. Single import. Works everywhere JavaScript runs.
 | | memorio | Redux | Zustand |
 |---|---|---|---|
 | **Setup** | 1 import | Boilerplate hell | Moderate |
-| **Bundle size** | **~8 KB** | ~30 KB | ~15 KB |
 | **Dependencies** | **Zero** | Many | Few |
 | **TypeScript** | ✅ Native | ✅ | ✅ |
 | **Binary storage** | ✅ Built-in IDB | ❌ Add-on | ❌ |
@@ -114,22 +113,6 @@ state.lock()       // freeze everything
 state.unlock()     // unfreeze
 ```
 
-### `useObserver` — React hook (with auto-discovery)
-
-```jsx
-import 'memorio'
-import { useObserver } from 'memorio'
-
-function Counter() {
-  const [, forceUpdate] = useReducer(x => x + 1, 0)
-
-  useObserver(forceUpdate, [state.counter])
-  // State path auto-discovered during render — no manual deps needed
-
-  return <div>Count: {state.counter}</div>
-}
-```
-
 ### `store` — localStorage, survives refresh
 
 ```javascript
@@ -160,16 +143,35 @@ cache.clear()                              // empty it all
 ### `idb` — IndexedDB, structured & typed
 
 ```javascript
-// Create a database
 await idb.db.create('my-db')
-// Then create tables
 await idb.table.create('my-db', 'users')
-await idb.table.create('my-db', 'posts')
-
-// CRUD
 await idb.data.set('my-db', 'users', { id: 1, name: 'Sara' })
-const user = await idb.data.get('my-db', 'users', 1)   // { id: 1, name: 'Sara' }
-await idb.data.delete('my-db', 'users', 1)
+const user = await idb.data.get('my-db', 'users', 1)
+```
+
+### `observer` — Object watcher (DEPRECATED)
+
+```javascript
+globalThis.observer('state.user', (newVal, oldVal) => {
+  console.debug('user changed:', newVal, oldVal)
+})
+```
+
+### `useObserver` — React observer hook
+
+Available globally after `import 'memorio'`.
+
+```jsx
+import 'memorio'
+
+function Counter() {
+  const [, forceUpdate] = useReducer(x => x + 1, 0)
+
+  useObserver(forceUpdate, [state.counter])
+  // State path auto-discovered during render — no manual deps needed
+
+  return <div>Count: {state.counter}</div>
+}
 ```
 
 ### `devtools` — inspect everything in one call
@@ -191,6 +193,29 @@ memorio.logger.getStats()     // { total, state, set, get, ... }
 memorio.logger.exportLogs()   // JSON string of all history
 ```
 
+### Platform detection
+
+Access via `memorio.*`:
+
+```javascript
+memorio.isBrowser()       // true in Chrome, Firefox, Safari
+memorio.isNode()          // true in Node.js
+memorio.isDeno()          // true in Deno
+memorio.isEdge()          // true in Cloudflare Workers, Vercel Edge
+
+const caps = memorio.getCapabilities()
+// { platform: 'browser', hasLocalStorage: true, hasIndexedDB: true, ... }
+```
+
+### Context (multi-tenant)
+
+```javascript
+memorio.createContext('tenant-name')
+memorio.listContexts()
+memorio.deleteContext('context-id')
+memorio.isolate('tenant-name')
+```
+
 ---
 
 ## Cross-Platform
@@ -209,32 +234,18 @@ Memorio runs in every JavaScript environment, with automatic fallbacks.
 
 > **Why memory fallbacks on the server?** There is no browser. `store` and `session` gracefully fall back to `Map`. You still get the same API. Same `state`, same `cache`, same `useObserver`. No extra config required.
 
-### Detecting the environment
+### Platform detection
 
-```javascript
-import { isBrowser, isNode, isDeno, isEdge, getCapabilities } from 'memorio'
-
-isBrowser()           // true in Chrome, Firefox, Safari
-isNode()              // true in Node.js
-isDeno()              // true in Deno
-isEdge()              // true in Cloudflare Workers, Vercel Edge
-
-const c = getCapabilities()
-// { platform: 'browser', isBrowser: true, hasLocalStorage: true, hasIndexedDB: true }
-```
-
----
-
-## Testing
-
-```
-71 tests  ·  8 suites  ·  all passing
+Access via `memorio.*` after `import 'memorio'`:
 
-state | store | session | cache | observer | useObserver | devtools | logger
-```
+```javascript
+memorio.isBrowser()       // true in Chrome, Firefox, Safari
+memorio.isNode()          // true in Node.js
+memorio.isDeno()          // true in Deno
+memorio.isEdge()          // true in Cloudflare Workers, Vercel Edge
 
-```bash
-npm test
+const c = memorio.getCapabilities()
+// { platform: 'browser', hasLocalStorage: true, hasIndexedDB: true, ... }
 ```
 
 ---
@@ -297,4 +308,4 @@ npm test
 
 MIT © [Dario Passariello](https://dario.passariello.ca)
 
-© [BigLogic Inc Canada](https//biglogic.ca)
+© [BigLogic Inc Canada](https://biglogic.ca)

package/docs/README.md

@@ -25,7 +25,6 @@ Zero friction. Zero bloat. Single import. Works everywhere JavaScript runs.
 | | memorio | Redux | Zustand |
 |---|---|---|---|
 | **Setup** | 1 import | Boilerplate hell | Moderate |
-| **Bundle size** | **~8 KB** | ~30 KB | ~15 KB |
 | **Dependencies** | **Zero** | Many | Few |
 | **TypeScript** | ✅ Native | ✅ | ✅ |
 | **Binary storage** | ✅ Built-in IDB | ❌ Add-on | ❌ |
@@ -114,22 +113,6 @@ state.lock()       // freeze everything
 state.unlock()     // unfreeze
 ```
 
-### `useObserver` — React hook (with auto-discovery)
-
-```jsx
-import 'memorio'
-import { useObserver } from 'memorio'
-
-function Counter() {
-  const [, forceUpdate] = useReducer(x => x + 1, 0)
-
-  useObserver(forceUpdate, [state.counter])
-  // State path auto-discovered during render — no manual deps needed
-
-  return <div>Count: {state.counter}</div>
-}
-```
-
 ### `store` — localStorage, survives refresh
 
 ```javascript
@@ -160,16 +143,35 @@ cache.clear()                              // empty it all
 ### `idb` — IndexedDB, structured & typed
 
 ```javascript
-// Create a database
 await idb.db.create('my-db')
-// Then create tables
 await idb.table.create('my-db', 'users')
-await idb.table.create('my-db', 'posts')
-
-// CRUD
 await idb.data.set('my-db', 'users', { id: 1, name: 'Sara' })
-const user = await idb.data.get('my-db', 'users', 1)   // { id: 1, name: 'Sara' }
-await idb.data.delete('my-db', 'users', 1)
+const user = await idb.data.get('my-db', 'users', 1)
+```
+
+### `observer` — Object watcher (DEPRECATED)
+
+```javascript
+globalThis.observer('state.user', (newVal, oldVal) => {
+  console.debug('user changed:', newVal, oldVal)
+})
+```
+
+### `useObserver` — React observer hook
+
+Available globally after `import 'memorio'`.
+
+```jsx
+import 'memorio'
+
+function Counter() {
+  const [, forceUpdate] = useReducer(x => x + 1, 0)
+
+  useObserver(forceUpdate, [state.counter])
+  // State path auto-discovered during render — no manual deps needed
+
+  return <div>Count: {state.counter}</div>
+}
 ```
 
 ### `devtools` — inspect everything in one call
@@ -191,6 +193,29 @@ memorio.logger.getStats()     // { total, state, set, get, ... }
 memorio.logger.exportLogs()   // JSON string of all history
 ```
 
+### Platform detection
+
+Access via `memorio.*`:
+
+```javascript
+memorio.isBrowser()       // true in Chrome, Firefox, Safari
+memorio.isNode()          // true in Node.js
+memorio.isDeno()          // true in Deno
+memorio.isEdge()          // true in Cloudflare Workers, Vercel Edge
+
+const caps = memorio.getCapabilities()
+// { platform: 'browser', hasLocalStorage: true, hasIndexedDB: true, ... }
+```
+
+### Context (multi-tenant)
+
+```javascript
+memorio.createContext('tenant-name')
+memorio.listContexts()
+memorio.deleteContext('context-id')
+memorio.isolate('tenant-name')
+```
+
 ---
 
 ## Cross-Platform
@@ -209,32 +234,18 @@ Memorio runs in every JavaScript environment, with automatic fallbacks.
 
 > **Why memory fallbacks on the server?** There is no browser. `store` and `session` gracefully fall back to `Map`. You still get the same API. Same `state`, same `cache`, same `useObserver`. No extra config required.
 
-### Detecting the environment
+### Platform detection
 
-```javascript
-import { isBrowser, isNode, isDeno, isEdge, getCapabilities } from 'memorio'
-
-isBrowser()           // true in Chrome, Firefox, Safari
-isNode()              // true in Node.js
-isDeno()              // true in Deno
-isEdge()              // true in Cloudflare Workers, Vercel Edge
-
-const c = getCapabilities()
-// { platform: 'browser', isBrowser: true, hasLocalStorage: true, hasIndexedDB: true }
-```
-
----
-
-## Testing
-
-```
-71 tests  ·  8 suites  ·  all passing
+Access via `memorio.*` after `import 'memorio'`:
 
-state | store | session | cache | observer | useObserver | devtools | logger
-```
+```javascript
+memorio.isBrowser()       // true in Chrome, Firefox, Safari
+memorio.isNode()          // true in Node.js
+memorio.isDeno()          // true in Deno
+memorio.isEdge()          // true in Cloudflare Workers, Vercel Edge
 
-```bash
-npm test
+const c = memorio.getCapabilities()
+// { platform: 'browser', hasLocalStorage: true, hasIndexedDB: true, ... }
 ```
 
 ---
@@ -297,4 +308,4 @@ npm test
 
 MIT © [Dario Passariello](https://dario.passariello.ca)
 
-© [BigLogic Inc Canada](https//biglogic.ca)
+© [BigLogic Inc Canada](https://biglogic.ca)

package/docs/markdown/CACHE.md

@@ -26,8 +26,8 @@ cache.set('username', 'Mario');
 cache.set('score', 1500);
 
 // Read data
-console.log(cache.get('username')); // "Mario"
-console.log(cache.get('score'));    // 1500
+console.debug(cache.get('username')); // "Mario"
+console.debug(cache.get('score'));    // 1500
 ```
 
 ### Example 2: Intermediate
@@ -36,7 +36,7 @@ console.log(cache.get('score'));    // 1500
 // Store objects
 cache.set('user', { name: 'Luigi', level: 5 });
 const user = cache.get('user');
-console.log(user.name); // "Luigi"
+console.debug(user.name); // "Luigi"
 
 // Remove single item
 cache.remove('username');

package/docs/markdown/CHANGELOG.md

@@ -4,181 +4,90 @@ All notable changes to this project will be documented in this file.
 
 ---
 
-## v2.7.0 (Current) - Cross-Platform & Security Update
-
-### 🚀 New Features
-
-#### 1. Platform Compatibility Layer
-- **Auto-detection**: Automatically detects Browser, Node.js, Deno, Edge Workers
-- **Polyfills**: Automatic fallback for server environments
-- **New exports**:
-  - `memorio.isBrowser()` - Check if running in browser
-  - `memorio.isNode()` - Check if running in Node.js
-  - `memorio.isDeno()` - Check if running in Deno
-  - `memorio.isEdge()` - Check if running in Edge Worker
-  - `memorio.getCapabilities()` - Get platform capabilities
-
-#### 2. Session Isolation
-- **Unique Session IDs**: Each import/session gets unique ID via `crypto.randomUUID()`
-- **Namespaced Storage**: Keys prefixed with session ID to prevent cross-contamination
-- **Format**: `memorio_store_[session-uuid]_keyname`
-
-#### 3. Context Isolation (Multi-Tenant Support)
-- **New API**:
-  - `memorio.createContext(name?)` - Create isolated context
-  - `memorio.listContexts()` - List all contexts
-  - `memorio.deleteContext(id)` - Delete context
-  - `memorio.isolate(name?)` - Alias for createContext
-
-#### 4. Persistence Detection
-- **New Properties**:
-  - `store.isPersistent` - Check if using real localStorage
-  - `session.isPersistent` - Check if using real sessionStorage
+## v3.0.2 (Current) - 2026-05-19 — Bug Fix, Security & API Expansion
 
-### 🔒 Security Improvements
-
-| Feature | Before v2.7.0 | After v2.7.0 |
-|---------|---------------|--------------|
-| Session ID | `Math.random()` | `crypto.randomUUID()` |
-| Key Validation | None | Max 512 chars + whitelist |
-| Server Isolation | None | Context system |
-| Fallback Security | Basic | `crypto.getRandomValues()` |
-
-### 📝 Documentation Updates
-
-- **New Documents**:
-  - [`PLATFORM.md`](PLATFORM.md) - Platform compatibility guide
-  - [`SECURITY.md`](SECURITY.md) - Security documentation
+### 🐛 Bug Fixes
 
-- **Updated Documents**:
-  - All module docs now have platform labels (✅ Universal, 🖥️ Browser, ⚛️ React)
-  - Platform comparison tables added
-  - Client vs Server usage clarified
+- Removed dead code: `buildPathTracker` from `functions/state/index.ts` (unused Proxy builder, exported nowhere)
+- Removed double `delete` in state `removeAll` handler (redundant null-check + delete on same key)
+- Removed unbound `globalThis.state` reference in state init (would throw `ReferenceError` in strict mode)
+- Removed `Object.freeze(observer)` referencing undeclared variable (`ReferenceError` on module load)
+- Removed `confirm()` synchronous blocking call from `idb.db.delete` (library must not block main thread)
 
-### 🔧 Examples
+### 🔒 Security Improvements
 
-- **New Examples**:
-  - [`examples/platform.ts`](../examples/platform.ts) - Platform detection + Context demo
+- Removed `esbuild-sass-plugin` and `esbuild-scss-modules-plugin` from `devDependencies` (unnecessary for a library with no styles)
+- Removed `injectStyle: true`, `sassPlugin()` and `.css` loader from `tsup.config.ts`
+- Deleted `tsup.plugin.injectCss.ts` (code injection vector completely removed from build pipeline)
+- `console.error`/`console.warn` → `console.debug` in `devtools` and `idb` error handlers (consistent debug-only logging policy)
+- `store.set()` now blocks function values instead of silently logging and continuing
+- All `PRIVATE License` headers in `functions/idb/` replaced with `MIT License`
 
-- **Updated Examples**:
-  - [`examples/basic.ts`](../examples/basic.ts) - Platform detection added
-  - [`examples/store-advanced.ts`](../examples/store-advanced.ts) - isPersistent check
-  - [`examples/session-advanced.ts`](../examples/session-advanced.ts) - isPersistent check
+### 🔧 Code Quality
 
-### ⚠️ Breaking Changes
+- Added JSDoc to `observerFunction` in `functions/observer/index.ts`
+- Added JSDoc to `cache` global in `functions/cache/index.ts`
+- `lint` and `tsc` pass clean — 0 vulnerabilities from `npm audit`
 
-| Change | Impact | Migration |
-|--------|--------|-----------|
-| Key validation | Low | Invalid keys now rejected with debug message |
-| Storage key format | Low | Keys now prefixed with session ID |
+### 🆕 API — New in 3.0.2
 
-### 🏗️ Internal Changes
+| Function | Description |
+|----------|-------------|
+| `memorio.isBrowser()` | Returns `true` when running in a browser |
+| `memorio.isNode()` | Returns `true` when running in Node.js |
+| `memorio.isDeno()` | Returns `true` when running in Deno |
+| `memorio.isEdge()` | Returns `true` in Cloudflare Workers, Vercel Edge, etc. |
+| `memorio.getCapabilities()` | Full capabilities object (`platform`, `hasLocalStorage`, `hasIndexedDB`, …) |
+| `memorio.createContext(name?)` | Create multi-tenant isolated context |
+| `memorio.listContexts()` | List all active isolated contexts |
+| `memorio.deleteContext(id)` | Delete isolated context by ID |
+| `memorio.isolate(name?)` | Shorthand alias for `createContext` |
 
-- **New files**:
-  - `config/platform.ts` - Platform detection + Context system
+### 🧪 Tests
 
-- **Modified files**:
-  - `config/global.ts` - Added context exports
-  - `functions/store/index.ts` - Added validation + isPersistent
-  - `functions/session/index.ts` - Added validation + isPersistent
+- Created `tests/jest/tests/observer.test.ts` — 12 tests (deprecation warning, input validation, `.list`, `.remove`, `.removeAll`)
+- Created `tests/jest/tests/useObserver.test.ts` — 12 tests (existence, edge cases, proxy/string deps, auto-discovery, cleanup)
+- **Result: 8 suites · 95 passed · 3 skipped · 0 failed**
 
----
+### 🗑️ Dependency Changes
 
-## v2.6.x - Previous Versions
+| Removed | Reason |
+|---------|--------|
+| `esbuild-sass-plugin@3.7.0` | No SCSS in a library |
+| `esbuild-scss-modules-plugin@1.1.1` | No SCSS in a library |
+| 36 transitive packages | Removed from `node_modules` |
 
-*(Documentation for versions prior to v2.7.0 is not included in this changelog)*
+### 📝 Documentation Updates
 
-### Typical v2.6.x Features:
-- State management with Proxy
-- Observer pattern
-- useObserver React hook
-- Store (localStorage wrapper)
-- Session (sessionStorage wrapper)
-- Cache (in-memory)
-- IDB (IndexedDB wrapper)
-- DevTools
-- Logger
+- `docs/README.md`: replaced `console.log` with `console.debug` in usage examples; fixed `esbuild` badge → `tsup`
+- `.github/CHANGELOG.md`: restructured with fix / security / changed sections
+- `.github/HISTORY.md`: complete rewrite through v3.0.2
+- `.github/SECURITY.md`: NIST/NSA standard + OWASP Top 10 mapping
+- `.github/CITATION.cff`: license PRIVATE → MIT to match `package.json`
+- `.project/*`: all context documents updated to v3.0.2
 
 ---
 
-## Migration Guide: v2.6.x → v2.7.0
-
-### 1. Platform Detection (Optional)
-
-```typescript
-// NEW: Check platform
-if (memorio.isNode()) {
-  console.log('Running on server')
-}
-```
+## v2.9.0 — 2026-05-13
 
-### 2. Persistence Check (Optional)
+### Added
+- DevTools — `memorio.devtools.inspect()`, `stats()`, `exportData()`
+- Logger with full history, stats and export
+- Platform detection (`isBrowser`, `isNode`, `isDeno`, `isEdge`, `getCapabilities`)
+- Session isolation via `crypto.randomUUID()`
 
-```typescript
-// NEW: Check if data persists
-if (!store.isPersistent) {
-  console.warn('Data will be lost on restart!')
-}
-```
+### Changed
+- Updated dependencies to latest versions
+- Improved cross-platform support (Deno, Edge Workers, Node.js)
 
-### 3. Server-Side Isolation (Recommended for Node.js)
-
-```typescript
-// NEW: Create isolated context per request
-app.use((req, res, next) => {
-  req.ctx = memorio.createContext(`req-${req.id}`)
-  next()
-})
-
-app.get('/data', (req, res) => {
-  req.ctx.state.user = getUser()
-  // Each request has isolated state
-})
-```
-
-### 4. Key Validation (Automatic)
-
-```typescript
-// Keys are now validated - invalid keys rejected
-store.set('valid-key', 'value')     // ✅ Works
-store.set('key with spaces', 'x')    // ❌ Rejected (debug message)
-store.set('key>1000chars', 'x')     // ❌ Rejected if >512 chars
-```
-
----
-
-## Comparison Table: v2.6.x vs v2.7.0
-
-| Feature | v2.6.x | v2.7.0 |
-|---------|--------|--------|
-| **Platform Support** | | |
-| Browser | ✅ | ✅ |
-| Node.js | ⚠️ Partial | ✅ Full |
-| Deno | ❌ | ✅ Full |
-| Edge Workers | ❌ | ✅ |
-| **Security** | | |
-| Secure Random | ❌ | ✅ |
-| Key Validation | ❌ | ✅ |
-| Session Isolation | ❌ | ✅ |
-| Context Isolation | ❌ | ✅ |
-| **API** | | |
-| isPersistent | ❌ | ✅ |
-| createContext | ❌ | ✅ |
-| Platform APIs | ❌ | ✅ |
-| **Documentation** | | |
-| Platform Guide | ❌ | ✅ |
-| Security Docs | ❌ | ✅ |
-| Platform Tables | ❌ | ✅ |
+### Security
+- Secure random session IDs replaced `Math.random()`
+- Key validation (max 512 chars + character whitelist)
 
 ---
 
-## Deprecations
-
-| Feature | Status | Alternative |
-|---------|--------|---------|
-| `observer()` | ⚠️ Deprecated | Use `useObserver()` in React |
-| Global state in Node.js | ⚡ Discouraged | Use `memorio.createContext()` |
-
----
+## v2.5.0 — 2026-02-17
 
-*For older versions, please refer to the git history or npm package versions.*
+- Initial release of memorio (state, store, session, cache, idb)
+- Observer pattern (`observer`)
+- `useObserver` React hook

package/docs/markdown/DEVTOOLS.md

@@ -63,7 +63,7 @@ Export all data as JSON.
 
 ```javascript
 const json = memorio.devtools.exportData()
-console.log(json)
+console.debug(json)
 ```
 
 ### importData(jsonString)

package/docs/markdown/IDB.md

@@ -29,7 +29,7 @@ idb.data.set('myApp', 'users', { id: 1, name: 'Mario' });
 
 // Get data
 const user = idb.data.get('myApp', 'users', 1);
-console.log(user.name); // "Mario"
+console.debug(user.name); // "Mario"
 ```
 
 ### Example 2: Intermediate
@@ -45,7 +45,7 @@ idb.data.set('store', 'products', { id: 2, name: 'Banana', price: 0.8 });
 
 // List databases
 const databases = idb.db.list();
-console.log(databases); // ['myApp', 'store']
+console.debug(databases); // ['myApp', 'store']
 ```
 
 ### Example 3: Advanced
@@ -65,7 +65,7 @@ idb.db.delete('store');
 
 // Handle quota
 const quota = idb.db.quota();
-console.log(`Using ${quota.used} of ${quota.total} bytes`);
+console.debug(`Using ${quota.used} of ${quota.total} bytes`);
 ```
 
 ---

package/docs/markdown/LOGGER.md

@@ -107,7 +107,7 @@ state.user = { name: 'John' }
 
 ```javascript
 const stats = memorio.logger.getStats()
-console.log(stats)
+console.debug(stats)
 // { total: 15, state: 5, store: 3, session: 2, cache: 5, set: 10, get: 0, delete: 3, clear: 2 }
 ```
 
@@ -143,5 +143,5 @@ const stateLogs = logs.filter(l => l.module === 'state')
 const setOperations = logs.filter(l => l.action === 'set')
 
 // Export for debugging
-console.log(memorio.logger.exportLogs())
+console.debug(memorio.logger.exportLogs())
 ```

package/docs/markdown/OBSERVER.md

@@ -25,7 +25,7 @@ import 'memorio';
 console.warn('observer() is deprecated. Please use useObserver() for React or memorio.dispatch for vanilla JS.');
 
 observer('state.counter', (newValue) => {
-  console.log('Counter is now:', newValue);
+  console.debug('Counter is now:', newValue);
 });
 
 state.counter = 1;
@@ -42,7 +42,7 @@ state.counter = 5;
 ```javascript
 // Observer with old value
 observer('state.user', (newValue, oldValue) => {
-  console.log(`User changed from ${oldValue?.name} to ${newValue?.name}`);
+  console.debug(`User changed from ${oldValue?.name} to ${newValue?.name}`);
 });
 
 state.user = { name: 'Mario' };
@@ -60,7 +60,7 @@ const obs1 = observer('state.data', handler1);
 const obs2 = observer('state.data', handler2);
 
 // List all observers
-console.log(observer.list);
+console.debug(observer.list);
 // Output: [{ name: 'state.data', id: '...' }, ...]
 
 // Remove specific observer
@@ -122,7 +122,7 @@ observer('state.counter', () => {
 ```javascript
 useEffect(() => {
   const handleChange = (newVal) => {
-    console.log('Changed:', newVal);
+    console.debug('Changed:', newVal);
   };
 
   observer('state.data', handleChange);