pulse-js-framework 1.5.0 → 1.5.2

package/cli/index.js

@@ -87,6 +87,7 @@ Release Options:
   --no-push        Create commit and tag but don't push
   --title <text>   Release title for changelog
   --skip-prompt    Use empty changelog (for automation)
+  --from-commits   Auto-extract changelog from git commits since last tag
 
 Examples:
   pulse create my-app
@@ -107,6 +108,7 @@ Examples:
   pulse release patch
   pulse release minor --title "New Features"
   pulse release major --dry-run
+  pulse release patch --from-commits
 
 Documentation: https://github.com/vincenthirtz/pulse-js-framework
   `);

package/cli/release.js

@@ -113,6 +113,85 @@ function getCurrentMonthYear() {
   return `${months[now.getMonth()]} ${now.getFullYear()}`;
 }
 
+/**
+ * Get the last git tag
+ */
+function getLastTag() {
+  try {
+    return execSync('git describe --tags --abbrev=0', { cwd: root, encoding: 'utf-8' }).trim();
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Get commits since the last tag (or all commits if no tag exists)
+ */
+function getCommitsSinceLastTag() {
+  const lastTag = getLastTag();
+  const range = lastTag ? `${lastTag}..HEAD` : 'HEAD';
+
+  try {
+    const output = execSync(`git log ${range} --pretty=format:"%s"`, {
+      cwd: root,
+      encoding: 'utf-8'
+    });
+    return output.split('\n').filter(line => line.trim());
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * Parse commit messages into changelog categories
+ * Supports conventional commits: feat:, fix:, docs:, chore:, refactor:, perf:, test:, style:
+ */
+function parseCommitMessages(commits) {
+  const changes = { added: [], changed: [], fixed: [], removed: [] };
+
+  for (const commit of commits) {
+    const lowerCommit = commit.toLowerCase();
+
+    // Skip version commits (e.g., "v1.5.0")
+    if (/^v?\d+\.\d+\.\d+/.test(commit)) continue;
+
+    // Skip merge commits
+    if (lowerCommit.startsWith('merge ')) continue;
+
+    // Parse conventional commits
+    if (lowerCommit.startsWith('feat:') || lowerCommit.startsWith('feat(')) {
+      changes.added.push(cleanCommitMessage(commit, 'feat'));
+    } else if (lowerCommit.startsWith('fix:') || lowerCommit.startsWith('fix(')) {
+      changes.fixed.push(cleanCommitMessage(commit, 'fix'));
+    } else if (lowerCommit.startsWith('remove') || lowerCommit.startsWith('deprecate')) {
+      changes.removed.push(commit);
+    } else if (
+      lowerCommit.startsWith('refactor:') ||
+      lowerCommit.startsWith('perf:') ||
+      lowerCommit.startsWith('chore:') ||
+      lowerCommit.startsWith('docs:') ||
+      lowerCommit.startsWith('style:') ||
+      lowerCommit.startsWith('test:')
+    ) {
+      changes.changed.push(cleanCommitMessage(commit, commit.split(':')[0]));
+    } else {
+      // Default: treat as a change
+      changes.changed.push(commit);
+    }
+  }
+
+  return changes;
+}
+
+/**
+ * Clean commit message by removing the conventional commit prefix
+ */
+function cleanCommitMessage(message, prefix) {
+  // Remove "prefix:" or "prefix(scope):"
+  const regex = new RegExp(`^${prefix}(\\([^)]+\\))?:\\s*`, 'i');
+  return message.replace(regex, '').trim();
+}
+
 /**
  * Update package.json version
  */
@@ -296,30 +375,76 @@ function updateReadme(newVersion) {
 }
 
 /**
- * Execute git commands
+ * Build commit message from version, title, and changes
  */
-function gitCommitTagPush(newVersion, dryRun = false) {
-  const commands = [
-    'git add -A',
-    `git commit -m "$(cat <<'EOF'\nv${newVersion}\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>\nEOF\n)"`,
-    `git tag -a v${newVersion} -m "Release v${newVersion}"`,
-    'git push',
-    'git push --tags'
+function buildCommitMessage(newVersion, title, changes) {
+  // Build header: "v1.5.2 - Title" or just "v1.5.2"
+  let message = `v${newVersion}`;
+  if (title) {
+    message += ` - ${title}`;
+  }
+  message += '\n\n';
+
+  // Add change items as bullet points
+  const allChanges = [
+    ...(changes.added || []),
+    ...(changes.changed || []),
+    ...(changes.fixed || []),
+    ...(changes.removed || [])
   ];
 
-  for (const cmd of commands) {
-    if (dryRun) {
-      log.info(`  [dry-run] ${cmd}`);
-    } else {
-      log.info(`  Running: ${cmd.split('\n')[0]}...`);
-      try {
-        execSync(cmd, { cwd: root, stdio: 'inherit', shell: '/bin/bash' });
-      } catch (error) {
-        log.error(`  Failed: ${error.message}`);
-        throw error;
-      }
+  if (allChanges.length > 0) {
+    for (const change of allChanges) {
+      message += `- ${change}\n`;
     }
+    message += '\n';
   }
+
+  // Add co-author
+  message += 'Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>';
+
+  return message;
+}
+
+/**
+ * Execute git commands
+ */
+function gitCommitTagPush(newVersion, title, changes, dryRun = false) {
+  const commitMessage = buildCommitMessage(newVersion, title, changes);
+
+  if (dryRun) {
+    log.info('  [dry-run] git add -A');
+    log.info('  [dry-run] git commit with message:');
+    log.info('  ' + commitMessage.split('\n').join('\n  '));
+    log.info(`  [dry-run] git tag -a v${newVersion} -m "Release v${newVersion}"`);
+    log.info('  [dry-run] git push');
+    log.info('  [dry-run] git push --tags');
+    return;
+  }
+
+  // git add
+  log.info('  Running: git add -A...');
+  execSync('git add -A', { cwd: root, stdio: 'inherit' });
+
+  // git commit with heredoc for proper message formatting
+  log.info('  Running: git commit...');
+  const escapedMessage = commitMessage.replace(/'/g, "'\\''");
+  execSync(`git commit -m $'${escapedMessage.replace(/\n/g, '\\n')}'`, {
+    cwd: root,
+    stdio: 'inherit',
+    shell: '/bin/bash'
+  });
+
+  // git tag
+  log.info(`  Running: git tag v${newVersion}...`);
+  execSync(`git tag -a v${newVersion} -m "Release v${newVersion}"`, { cwd: root, stdio: 'inherit' });
+
+  // git push
+  log.info('  Running: git push...');
+  execSync('git push', { cwd: root, stdio: 'inherit' });
+
+  log.info('  Running: git push --tags...');
+  execSync('git push --tags', { cwd: root, stdio: 'inherit' });
 }
 
 /**
@@ -339,11 +464,13 @@ Options:
   --no-push       Create commit and tag but don't push
   --title <text>  Release title (e.g., "Performance Improvements")
   --skip-prompt   Use empty changelog (for automated releases)
+  --from-commits  Auto-extract changelog from git commits since last tag
 
 Examples:
   pulse release patch
   pulse release minor --title "New Features"
   pulse release major --dry-run
+  pulse release patch --from-commits --title "Bug Fixes"
   `);
 }
 
@@ -362,6 +489,7 @@ export async function runRelease(args) {
   const dryRun = args.includes('--dry-run');
   const noPush = args.includes('--no-push');
   const skipPrompt = args.includes('--skip-prompt');
+  const fromCommits = args.includes('--from-commits');
 
   let title = '';
   const titleIndex = args.indexOf('--title');
@@ -403,7 +531,33 @@ export async function runRelease(args) {
   // Collect changelog entries
   let changes = { added: [], changed: [], fixed: [], removed: [] };
 
-  if (!skipPrompt) {
+  if (fromCommits) {
+    // Auto-extract from git commits since last tag
+    const lastTag = getLastTag();
+    const commits = getCommitsSinceLastTag();
+
+    if (commits.length === 0) {
+      log.warn('No commits found since last tag');
+    } else {
+      log.info(`Found ${commits.length} commits since ${lastTag || 'beginning'}`);
+      changes = parseCommitMessages(commits);
+
+      // Show extracted changes
+      const totalChanges = Object.values(changes).flat().length;
+      if (totalChanges > 0) {
+        log.info('');
+        log.info('Extracted changelog entries:');
+        if (changes.added.length) log.info(`  Added: ${changes.added.length} items`);
+        if (changes.changed.length) log.info(`  Changed: ${changes.changed.length} items`);
+        if (changes.fixed.length) log.info(`  Fixed: ${changes.fixed.length} items`);
+        if (changes.removed.length) log.info(`  Removed: ${changes.removed.length} items`);
+      }
+    }
+
+    if (!title) {
+      title = await prompt('Release title (e.g., "Performance Improvements"): ');
+    }
+  } else if (!skipPrompt) {
     if (!title) {
       title = await prompt('Release title (e.g., "Performance Improvements"): ');
     }
@@ -466,8 +620,10 @@ export async function runRelease(args) {
   if (!dryRun) {
     if (noPush) {
       // Only commit and tag, no push
+      const commitMessage = buildCommitMessage(newVersion, title, changes);
       execSync('git add -A', { cwd: root, stdio: 'inherit' });
-      execSync(`git commit -m "v${newVersion}\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>"`, {
+      const escapedMessage = commitMessage.replace(/'/g, "'\\''");
+      execSync(`git commit -m $'${escapedMessage.replace(/\n/g, '\\n')}'`, {
         cwd: root,
         stdio: 'inherit',
         shell: '/bin/bash'
@@ -475,10 +631,10 @@ export async function runRelease(args) {
       execSync(`git tag -a v${newVersion} -m "Release v${newVersion}"`, { cwd: root, stdio: 'inherit' });
       log.info('  Created commit and tag (--no-push specified)');
     } else {
-      gitCommitTagPush(newVersion, false);
+      gitCommitTagPush(newVersion, title, changes, false);
     }
   } else {
-    gitCommitTagPush(newVersion, true);
+    gitCommitTagPush(newVersion, title, changes, true);
   }
 
   log.info('');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pulse-js-framework",
-  "version": "1.5.0",
+  "version": "1.5.2",
   "description": "A declarative DOM framework with CSS selector-based structure and reactive pulsations",
   "type": "module",
   "main": "index.js",
@@ -75,7 +75,7 @@
     "LICENSE"
   ],
   "scripts": {
-    "test": "npm run test:compiler && npm run test:sourcemap && npm run test:pulse && npm run test:dom && npm run test:router && npm run test:store && npm run test:hmr && npm run test:lint && npm run test:format && npm run test:analyze",
+    "test": "npm run test:compiler && npm run test:sourcemap && npm run test:pulse && npm run test:dom && npm run test:router && npm run test:store && npm run test:hmr && npm run test:lint && npm run test:format && npm run test:analyze && npm run test:lru-cache && npm run test:utils && npm run test:docs",
     "test:compiler": "node test/compiler.test.js",
     "test:sourcemap": "node test/sourcemap.test.js",
     "test:pulse": "node test/pulse.test.js",
@@ -86,6 +86,9 @@
     "test:lint": "node test/lint.test.js",
     "test:format": "node test/format.test.js",
     "test:analyze": "node test/analyze.test.js",
+    "test:lru-cache": "node test/lru-cache.test.js",
+    "test:utils": "node test/utils.test.js",
+    "test:docs": "node test/docs.test.js",
     "build:netlify": "node scripts/build-netlify.js",
     "version": "node scripts/sync-version.js",
     "docs": "node cli/index.js dev docs"

package/runtime/lru-cache.js

@@ -8,15 +8,10 @@
 
 /**
  * LRU Cache implementation
+ * Uses Map's insertion order for O(1) operations.
  * @template K, V
  */
 export class LRUCache {
-  /** @type {number} */
-  #capacity;
-
-  /** @type {Map<K, V>} */
-  #cache = new Map();
-
   /**
    * Create an LRU cache
    * @param {number} capacity - Maximum number of items to store
@@ -25,7 +20,8 @@ export class LRUCache {
     if (capacity <= 0) {
       throw new Error('LRU cache capacity must be greater than 0');
     }
-    this.#capacity = capacity;
+    this._capacity = capacity;
+    this._cache = new Map();
   }
 
   /**
@@ -35,14 +31,14 @@ export class LRUCache {
    * @returns {V|undefined} The cached value or undefined if not found
    */
   get(key) {
-    if (!this.#cache.has(key)) {
+    if (!this._cache.has(key)) {
       return undefined;
     }
 
     // Move to end (most recently used) by re-inserting
-    const value = this.#cache.get(key);
-    this.#cache.delete(key);
-    this.#cache.set(key, value);
+    const value = this._cache.get(key);
+    this._cache.delete(key);
+    this._cache.set(key, value);
     return value;
   }
 
@@ -55,15 +51,15 @@ export class LRUCache {
    */
   set(key, value) {
     // If key exists, delete first to update position
-    if (this.#cache.has(key)) {
-      this.#cache.delete(key);
-    } else if (this.#cache.size >= this.#capacity) {
+    if (this._cache.has(key)) {
+      this._cache.delete(key);
+    } else if (this._cache.size >= this._capacity) {
       // Remove oldest (first item in Map)
-      const oldest = this.#cache.keys().next().value;
-      this.#cache.delete(oldest);
+      const oldest = this._cache.keys().next().value;
+      this._cache.delete(oldest);
     }
 
-    this.#cache.set(key, value);
+    this._cache.set(key, value);
     return this;
   }
 
@@ -74,7 +70,7 @@ export class LRUCache {
    * @returns {boolean} True if key exists
    */
   has(key) {
-    return this.#cache.has(key);
+    return this._cache.has(key);
   }
 
   /**
@@ -83,14 +79,14 @@ export class LRUCache {
    * @returns {boolean} True if item was deleted
    */
   delete(key) {
-    return this.#cache.delete(key);
+    return this._cache.delete(key);
   }
 
   /**
    * Clear all items from the cache
    */
   clear() {
-    this.#cache.clear();
+    this._cache.clear();
   }
 
   /**
@@ -98,7 +94,7 @@ export class LRUCache {
    * @returns {number} Current size
    */
   get size() {
-    return this.#cache.size;
+    return this._cache.size;
   }
 
   /**
@@ -106,7 +102,7 @@ export class LRUCache {
    * @returns {number} Maximum capacity
    */
   get capacity() {
-    return this.#capacity;
+    return this._capacity;
   }
 
   /**
@@ -114,7 +110,7 @@ export class LRUCache {
    * @returns {IterableIterator<K>} Iterator of keys
    */
   keys() {
-    return this.#cache.keys();
+    return this._cache.keys();
   }
 
   /**
@@ -122,7 +118,7 @@ export class LRUCache {
    * @returns {IterableIterator<V>} Iterator of values
    */
   values() {
-    return this.#cache.values();
+    return this._cache.values();
   }
 
   /**
@@ -130,7 +126,7 @@ export class LRUCache {
    * @returns {IterableIterator<[K, V]>} Iterator of [key, value] pairs
    */
   entries() {
-    return this.#cache.entries();
+    return this._cache.entries();
   }
 
   /**
@@ -138,7 +134,7 @@ export class LRUCache {
    * @param {function(V, K, LRUCache): void} callback - Called for each entry
    */
   forEach(callback) {
-    this.#cache.forEach((value, key) => callback(value, key, this));
+    this._cache.forEach((value, key) => callback(value, key, this));
   }
 }
 

package/runtime/pulse.js

@@ -102,6 +102,63 @@ export function resetContext() {
   context.effectRegistry.clear();
 }
 
+/**
+ * Counter for generating unique effect IDs
+ * @type {number}
+ */
+let effectIdCounter = 0;
+
+/**
+ * Global effect error handler
+ * @type {Function|null}
+ */
+let globalEffectErrorHandler = null;
+
+/**
+ * Custom error class for effect-related errors with context information.
+ * Provides details about which effect failed, in what phase, and its dependencies.
+ */
+export class EffectError extends Error {
+  /**
+   * Create an EffectError with context information
+   * @param {string} message - Error message
+   * @param {Object} options - Error context
+   * @param {string} [options.effectId] - Effect identifier
+   * @param {string} [options.phase] - Phase when error occurred ('cleanup' | 'execution')
+   * @param {number} [options.dependencyCount] - Number of dependencies
+   * @param {Error} [options.cause] - Original error that caused this
+   */
+  constructor(message, options = {}) {
+    super(message);
+    this.name = 'EffectError';
+    this.effectId = options.effectId || null;
+    this.phase = options.phase || 'unknown';
+    this.dependencyCount = options.dependencyCount ?? 0;
+    this.cause = options.cause || null;
+  }
+}
+
+/**
+ * Set a global error handler for effect errors.
+ * The handler receives an EffectError with full context about the failure.
+ * @param {Function|null} handler - Error handler (effectError) => void, or null to clear
+ * @returns {Function|null} Previous handler (for restoration)
+ * @example
+ * // Set up global error tracking
+ * const prevHandler = onEffectError((err) => {
+ *   console.error(`Effect ${err.effectId} failed during ${err.phase}:`, err.cause);
+ *   reportToErrorService(err);
+ * });
+ *
+ * // Later, restore previous handler
+ * onEffectError(prevHandler);
+ */
+export function onEffectError(handler) {
+  const prev = globalEffectErrorHandler;
+  globalEffectErrorHandler = handler;
+  return prev;
+}
+
 /**
  * Set the current module ID for HMR effect tracking.
  * Effects created while a module ID is set will be registered for cleanup.
@@ -386,6 +443,52 @@ export class Pulse {
   }
 }
 
+/**
+ * Handle an effect error with full context information.
+ * Tries effect-specific handler, then global handler, then logs.
+ * @private
+ * @param {Error} error - The original error
+ * @param {EffectFn} effectFn - The effect that errored
+ * @param {string} phase - Phase when error occurred ('cleanup' | 'execution')
+ */
+function handleEffectError(error, effectFn, phase) {
+  const effectError = new EffectError(
+    `Effect [${effectFn.id}] error during ${phase}: ${error.message}`,
+    {
+      effectId: effectFn.id,
+      phase,
+      dependencyCount: effectFn.dependencies?.size ?? 0,
+      cause: error
+    }
+  );
+
+  // Try effect-specific handler first
+  if (effectFn.onError) {
+    try {
+      effectFn.onError(effectError);
+      return;
+    } catch (handlerError) {
+      log.error('Effect onError handler threw:', handlerError);
+    }
+  }
+
+  // Try global handler
+  if (globalEffectErrorHandler) {
+    try {
+      globalEffectErrorHandler(effectError);
+      return;
+    } catch (handlerError) {
+      log.error('Global effect error handler threw:', handlerError);
+    }
+  }
+
+  // Default: log with context
+  log.error(`[${effectError.effectId}] ${effectError.message}`, {
+    phase: effectError.phase,
+    dependencies: effectError.dependencyCount
+  });
+}
+
 /**
  * Run a single effect safely
  * @private
@@ -398,7 +501,7 @@ function runEffect(effectFn) {
   try {
     effectFn.run();
   } catch (error) {
-    log.error('Effect error:', error);
+    handleEffectError(error, effectFn, 'execution');
   }
 }
 
@@ -568,9 +671,16 @@ export function computed(fn, options = {}) {
   return p;
 }
 
+/**
+ * @typedef {Object} EffectOptions
+ * @property {string} [id] - Custom effect identifier for debugging
+ * @property {function(EffectError): void} [onError] - Error handler for this effect
+ */
+
 /**
  * Create an effect that runs when its dependencies change
  * @param {function(): void|function(): void} fn - Effect function, may return a cleanup function
+ * @param {EffectOptions} [options={}] - Effect configuration options
  * @returns {function(): void} Dispose function to stop the effect
  * @example
  * const count = pulse(0);
@@ -588,19 +698,32 @@ export function computed(fn, options = {}) {
  *   const timer = setInterval(() => tick(), 1000);
  *   return () => clearInterval(timer); // Cleanup on re-run or dispose
  * });
+ *
+ * // With custom ID and error handler
+ * effect(() => {
+ *   // Effect logic that might fail
+ * }, {
+ *   id: 'data-sync',
+ *   onError: (err) => console.error('Data sync failed:', err.cause)
+ * });
  */
-export function effect(fn) {
+export function effect(fn, options = {}) {
+  const { id: customId, onError } = options;
+  const effectId = customId || `effect_${++effectIdCounter}`;
+
   // Capture module ID at creation time for HMR tracking
   const moduleId = context.currentModuleId;
 
   const effectFn = {
+    id: effectId,
+    onError,
     run: () => {
       // Run cleanup functions from previous run
       for (const cleanup of effectFn.cleanups) {
         try {
           cleanup();
         } catch (e) {
-          log.error('Cleanup error:', e);
+          handleEffectError(e, effectFn, 'cleanup');
         }
       }
       effectFn.cleanups = [];
@@ -618,7 +741,7 @@ export function effect(fn) {
       try {
         fn();
       } catch (error) {
-        log.error('Effect execution error:', error);
+        handleEffectError(error, effectFn, 'execution');
       } finally {
         context.currentEffect = prevEffect;
       }
@@ -645,7 +768,7 @@ export function effect(fn) {
       try {
         cleanup();
       } catch (e) {
-        log.error('Cleanup error:', e);
+        handleEffectError(e, effectFn, 'cleanup');
       }
     }
     effectFn.cleanups = [];
@@ -994,6 +1117,9 @@ export default {
   memoComputed,
   context,
   resetContext,
+  // Error handling
+  EffectError,
+  onEffectError,
   // HMR support
   setCurrentModule,
   clearCurrentModule,

package/runtime/store.js

@@ -20,6 +20,12 @@ import { loggers, createLogger } from './logger.js';
 
 const log = loggers.store;
 
+/**
+ * Maximum nesting depth for nested objects to prevent abuse
+ * @type {number}
+ */
+const MAX_NESTING_DEPTH = 10;
+
 /**
  * @typedef {Object} StoreOptions
  * @property {boolean} [persist=false] - Persist state to localStorage
@@ -46,6 +52,52 @@ const log = loggers.store;
  * @typedef {function(Store): Store} StorePlugin
  */
 
+/**
+ * Dangerous property names that could cause prototype pollution
+ * @type {Set<string>}
+ */
+const DANGEROUS_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+
+/**
+ * Safely deserialize persisted state, preventing prototype pollution
+ * and property injection attacks.
+ * @private
+ * @param {Object} savedState - The parsed JSON state
+ * @param {Object} schema - The initial state defining allowed keys
+ * @returns {Object} Sanitized state object
+ */
+function safeDeserialize(savedState, schema) {
+  if (typeof savedState !== 'object' || savedState === null || Array.isArray(savedState)) {
+    return {};
+  }
+
+  const result = {};
+  for (const [key, value] of Object.entries(savedState)) {
+    // Block dangerous keys that could pollute prototypes
+    if (DANGEROUS_KEYS.has(key)) {
+      log.warn(`Blocked potentially dangerous key in persisted state: "${key}"`);
+      continue;
+    }
+
+    // Only allow keys that exist in the schema (initial state)
+    if (!(key in schema)) {
+      continue;
+    }
+
+    // Recursively validate nested objects
+    if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
+      if (typeof schema[key] === 'object' && schema[key] !== null && !Array.isArray(schema[key])) {
+        result[key] = safeDeserialize(value, schema[key]);
+      }
+      // If schema expects primitive but got object, skip it
+    } else {
+      result[key] = value;
+    }
+  }
+
+  return result;
+}
+
 /**
  * Create a global store with reactive state properties.
  * @template T
@@ -76,7 +128,9 @@ export function createStore(initialState = {}, options = {}) {
     try {
       const saved = localStorage.getItem(storageKey);
       if (saved) {
-        state = { ...initialState, ...JSON.parse(saved) };
+        const parsed = JSON.parse(saved);
+        const sanitized = safeDeserialize(parsed, initialState);
+        state = { ...initialState, ...sanitized };
       }
     } catch (e) {
       log.warn('Failed to load persisted state:', e);
@@ -93,9 +147,18 @@ export function createStore(initialState = {}, options = {}) {
    * @private
    * @param {string} key - State key
    * @param {*} value - Initial value
+   * @param {number} [depth=0] - Current nesting depth
    * @returns {Pulse|Object} Pulse or nested object of pulses
    */
-  function createPulse(key, value) {
+  function createPulse(key, value, depth = 0) {
+    // Prevent excessive nesting depth
+    if (depth > MAX_NESTING_DEPTH) {
+      log.warn(`Max nesting depth (${MAX_NESTING_DEPTH}) exceeded for key: "${key}". Flattening to single pulse.`);
+      const p = pulse(value);
+      pulses[key] = p;
+      return p;
+    }
+
     if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
       // Create a pulse for the nested object itself (for $setState support)
       const objectPulse = pulse(value);
@@ -104,7 +167,7 @@ export function createStore(initialState = {}, options = {}) {
       // Also create nested pulses for individual properties
       const nested = {};
       for (const [k, v] of Object.entries(value)) {
-        nested[k] = createPulse(`${key}.${k}`, v);
+        nested[k] = createPulse(`${key}.${k}`, v, depth + 1);
       }
       return nested;
     }
@@ -119,6 +182,15 @@ export function createStore(initialState = {}, options = {}) {
     store[key] = createPulse(key, value);
   }
 
+  // Sync nested pulses for persisted state to ensure consistency
+  if (persist && typeof localStorage !== 'undefined') {
+    for (const [key, value] of Object.entries(state)) {
+      if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
+        updateNestedPulses(key, value);
+      }
+    }
+  }
+
   // Persist state changes
   if (persist) {
     effect(() => {

package/runtime/utils.js

@@ -191,9 +191,9 @@ export function sanitizeUrl(url, options = {}) {
     return null;
   }
 
-  // Check for data: protocol unless explicitly allowed
-  if (!allowData && lowerUrl.startsWith('data:')) {
-    return null;
+  // Check for data: protocol
+  if (lowerUrl.startsWith('data:')) {
+    return allowData ? trimmed : null;
   }
 
   // Allow relative URLs