pulse-js-framework 1.5.1 → 1.5.2

package/cli/index.js

@@ -87,6 +87,7 @@ Release Options:
   --no-push        Create commit and tag but don't push
   --title <text>   Release title for changelog
   --skip-prompt    Use empty changelog (for automation)
+  --from-commits   Auto-extract changelog from git commits since last tag
 
 Examples:
   pulse create my-app
@@ -107,6 +108,7 @@ Examples:
   pulse release patch
   pulse release minor --title "New Features"
   pulse release major --dry-run
+  pulse release patch --from-commits
 
 Documentation: https://github.com/vincenthirtz/pulse-js-framework
   `);

package/cli/release.js

@@ -113,6 +113,85 @@ function getCurrentMonthYear() {
   return `${months[now.getMonth()]} ${now.getFullYear()}`;
 }
 
+/**
+ * Get the last git tag
+ */
+function getLastTag() {
+  try {
+    return execSync('git describe --tags --abbrev=0', { cwd: root, encoding: 'utf-8' }).trim();
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Get commits since the last tag (or all commits if no tag exists)
+ */
+function getCommitsSinceLastTag() {
+  const lastTag = getLastTag();
+  const range = lastTag ? `${lastTag}..HEAD` : 'HEAD';
+
+  try {
+    const output = execSync(`git log ${range} --pretty=format:"%s"`, {
+      cwd: root,
+      encoding: 'utf-8'
+    });
+    return output.split('\n').filter(line => line.trim());
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * Parse commit messages into changelog categories
+ * Supports conventional commits: feat:, fix:, docs:, chore:, refactor:, perf:, test:, style:
+ */
+function parseCommitMessages(commits) {
+  const changes = { added: [], changed: [], fixed: [], removed: [] };
+
+  for (const commit of commits) {
+    const lowerCommit = commit.toLowerCase();
+
+    // Skip version commits (e.g., "v1.5.0")
+    if (/^v?\d+\.\d+\.\d+/.test(commit)) continue;
+
+    // Skip merge commits
+    if (lowerCommit.startsWith('merge ')) continue;
+
+    // Parse conventional commits
+    if (lowerCommit.startsWith('feat:') || lowerCommit.startsWith('feat(')) {
+      changes.added.push(cleanCommitMessage(commit, 'feat'));
+    } else if (lowerCommit.startsWith('fix:') || lowerCommit.startsWith('fix(')) {
+      changes.fixed.push(cleanCommitMessage(commit, 'fix'));
+    } else if (lowerCommit.startsWith('remove') || lowerCommit.startsWith('deprecate')) {
+      changes.removed.push(commit);
+    } else if (
+      lowerCommit.startsWith('refactor:') ||
+      lowerCommit.startsWith('perf:') ||
+      lowerCommit.startsWith('chore:') ||
+      lowerCommit.startsWith('docs:') ||
+      lowerCommit.startsWith('style:') ||
+      lowerCommit.startsWith('test:')
+    ) {
+      changes.changed.push(cleanCommitMessage(commit, commit.split(':')[0]));
+    } else {
+      // Default: treat as a change
+      changes.changed.push(commit);
+    }
+  }
+
+  return changes;
+}
+
+/**
+ * Clean commit message by removing the conventional commit prefix
+ */
+function cleanCommitMessage(message, prefix) {
+  // Remove "prefix:" or "prefix(scope):"
+  const regex = new RegExp(`^${prefix}(\\([^)]+\\))?:\\s*`, 'i');
+  return message.replace(regex, '').trim();
+}
+
 /**
  * Update package.json version
  */
@@ -296,30 +375,76 @@ function updateReadme(newVersion) {
 }
 
 /**
- * Execute git commands
+ * Build commit message from version, title, and changes
  */
-function gitCommitTagPush(newVersion, dryRun = false) {
-  const commands = [
-    'git add -A',
-    `git commit -m "$(cat <<'EOF'\nv${newVersion}\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>\nEOF\n)"`,
-    `git tag -a v${newVersion} -m "Release v${newVersion}"`,
-    'git push',
-    'git push --tags'
+function buildCommitMessage(newVersion, title, changes) {
+  // Build header: "v1.5.2 - Title" or just "v1.5.2"
+  let message = `v${newVersion}`;
+  if (title) {
+    message += ` - ${title}`;
+  }
+  message += '\n\n';
+
+  // Add change items as bullet points
+  const allChanges = [
+    ...(changes.added || []),
+    ...(changes.changed || []),
+    ...(changes.fixed || []),
+    ...(changes.removed || [])
   ];
 
-  for (const cmd of commands) {
-    if (dryRun) {
-      log.info(`  [dry-run] ${cmd}`);
-    } else {
-      log.info(`  Running: ${cmd.split('\n')[0]}...`);
-      try {
-        execSync(cmd, { cwd: root, stdio: 'inherit', shell: '/bin/bash' });
-      } catch (error) {
-        log.error(`  Failed: ${error.message}`);
-        throw error;
-      }
+  if (allChanges.length > 0) {
+    for (const change of allChanges) {
+      message += `- ${change}\n`;
     }
+    message += '\n';
   }
+
+  // Add co-author
+  message += 'Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>';
+
+  return message;
+}
+
+/**
+ * Execute git commands
+ */
+function gitCommitTagPush(newVersion, title, changes, dryRun = false) {
+  const commitMessage = buildCommitMessage(newVersion, title, changes);
+
+  if (dryRun) {
+    log.info('  [dry-run] git add -A');
+    log.info('  [dry-run] git commit with message:');
+    log.info('  ' + commitMessage.split('\n').join('\n  '));
+    log.info(`  [dry-run] git tag -a v${newVersion} -m "Release v${newVersion}"`);
+    log.info('  [dry-run] git push');
+    log.info('  [dry-run] git push --tags');
+    return;
+  }
+
+  // git add
+  log.info('  Running: git add -A...');
+  execSync('git add -A', { cwd: root, stdio: 'inherit' });
+
+  // git commit with heredoc for proper message formatting
+  log.info('  Running: git commit...');
+  const escapedMessage = commitMessage.replace(/'/g, "'\\''");
+  execSync(`git commit -m $'${escapedMessage.replace(/\n/g, '\\n')}'`, {
+    cwd: root,
+    stdio: 'inherit',
+    shell: '/bin/bash'
+  });
+
+  // git tag
+  log.info(`  Running: git tag v${newVersion}...`);
+  execSync(`git tag -a v${newVersion} -m "Release v${newVersion}"`, { cwd: root, stdio: 'inherit' });
+
+  // git push
+  log.info('  Running: git push...');
+  execSync('git push', { cwd: root, stdio: 'inherit' });
+
+  log.info('  Running: git push --tags...');
+  execSync('git push --tags', { cwd: root, stdio: 'inherit' });
 }
 
 /**
@@ -339,11 +464,13 @@ Options:
   --no-push       Create commit and tag but don't push
   --title <text>  Release title (e.g., "Performance Improvements")
   --skip-prompt   Use empty changelog (for automated releases)
+  --from-commits  Auto-extract changelog from git commits since last tag
 
 Examples:
   pulse release patch
   pulse release minor --title "New Features"
   pulse release major --dry-run
+  pulse release patch --from-commits --title "Bug Fixes"
   `);
 }
 
@@ -362,6 +489,7 @@ export async function runRelease(args) {
   const dryRun = args.includes('--dry-run');
   const noPush = args.includes('--no-push');
   const skipPrompt = args.includes('--skip-prompt');
+  const fromCommits = args.includes('--from-commits');
 
   let title = '';
   const titleIndex = args.indexOf('--title');
@@ -403,7 +531,33 @@ export async function runRelease(args) {
   // Collect changelog entries
   let changes = { added: [], changed: [], fixed: [], removed: [] };
 
-  if (!skipPrompt) {
+  if (fromCommits) {
+    // Auto-extract from git commits since last tag
+    const lastTag = getLastTag();
+    const commits = getCommitsSinceLastTag();
+
+    if (commits.length === 0) {
+      log.warn('No commits found since last tag');
+    } else {
+      log.info(`Found ${commits.length} commits since ${lastTag || 'beginning'}`);
+      changes = parseCommitMessages(commits);
+
+      // Show extracted changes
+      const totalChanges = Object.values(changes).flat().length;
+      if (totalChanges > 0) {
+        log.info('');
+        log.info('Extracted changelog entries:');
+        if (changes.added.length) log.info(`  Added: ${changes.added.length} items`);
+        if (changes.changed.length) log.info(`  Changed: ${changes.changed.length} items`);
+        if (changes.fixed.length) log.info(`  Fixed: ${changes.fixed.length} items`);
+        if (changes.removed.length) log.info(`  Removed: ${changes.removed.length} items`);
+      }
+    }
+
+    if (!title) {
+      title = await prompt('Release title (e.g., "Performance Improvements"): ');
+    }
+  } else if (!skipPrompt) {
     if (!title) {
       title = await prompt('Release title (e.g., "Performance Improvements"): ');
     }
@@ -466,8 +620,10 @@ export async function runRelease(args) {
   if (!dryRun) {
     if (noPush) {
       // Only commit and tag, no push
+      const commitMessage = buildCommitMessage(newVersion, title, changes);
       execSync('git add -A', { cwd: root, stdio: 'inherit' });
-      execSync(`git commit -m "v${newVersion}\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>"`, {
+      const escapedMessage = commitMessage.replace(/'/g, "'\\''");
+      execSync(`git commit -m $'${escapedMessage.replace(/\n/g, '\\n')}'`, {
         cwd: root,
         stdio: 'inherit',
         shell: '/bin/bash'
@@ -475,10 +631,10 @@ export async function runRelease(args) {
       execSync(`git tag -a v${newVersion} -m "Release v${newVersion}"`, { cwd: root, stdio: 'inherit' });
       log.info('  Created commit and tag (--no-push specified)');
     } else {
-      gitCommitTagPush(newVersion, false);
+      gitCommitTagPush(newVersion, title, changes, false);
     }
   } else {
-    gitCommitTagPush(newVersion, true);
+    gitCommitTagPush(newVersion, title, changes, true);
   }
 
   log.info('');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pulse-js-framework",
-  "version": "1.5.1",
+  "version": "1.5.2",
   "description": "A declarative DOM framework with CSS selector-based structure and reactive pulsations",
   "type": "module",
   "main": "index.js",

package/runtime/pulse.js

@@ -102,6 +102,63 @@ export function resetContext() {
   context.effectRegistry.clear();
 }
 
+/**
+ * Counter for generating unique effect IDs
+ * @type {number}
+ */
+let effectIdCounter = 0;
+
+/**
+ * Global effect error handler
+ * @type {Function|null}
+ */
+let globalEffectErrorHandler = null;
+
+/**
+ * Custom error class for effect-related errors with context information.
+ * Provides details about which effect failed, in what phase, and its dependencies.
+ */
+export class EffectError extends Error {
+  /**
+   * Create an EffectError with context information
+   * @param {string} message - Error message
+   * @param {Object} options - Error context
+   * @param {string} [options.effectId] - Effect identifier
+   * @param {string} [options.phase] - Phase when error occurred ('cleanup' | 'execution')
+   * @param {number} [options.dependencyCount] - Number of dependencies
+   * @param {Error} [options.cause] - Original error that caused this
+   */
+  constructor(message, options = {}) {
+    super(message);
+    this.name = 'EffectError';
+    this.effectId = options.effectId || null;
+    this.phase = options.phase || 'unknown';
+    this.dependencyCount = options.dependencyCount ?? 0;
+    this.cause = options.cause || null;
+  }
+}
+
+/**
+ * Set a global error handler for effect errors.
+ * The handler receives an EffectError with full context about the failure.
+ * @param {Function|null} handler - Error handler (effectError) => void, or null to clear
+ * @returns {Function|null} Previous handler (for restoration)
+ * @example
+ * // Set up global error tracking
+ * const prevHandler = onEffectError((err) => {
+ *   console.error(`Effect ${err.effectId} failed during ${err.phase}:`, err.cause);
+ *   reportToErrorService(err);
+ * });
+ *
+ * // Later, restore previous handler
+ * onEffectError(prevHandler);
+ */
+export function onEffectError(handler) {
+  const prev = globalEffectErrorHandler;
+  globalEffectErrorHandler = handler;
+  return prev;
+}
+
 /**
  * Set the current module ID for HMR effect tracking.
  * Effects created while a module ID is set will be registered for cleanup.
@@ -386,6 +443,52 @@ export class Pulse {
   }
 }
 
+/**
+ * Handle an effect error with full context information.
+ * Tries effect-specific handler, then global handler, then logs.
+ * @private
+ * @param {Error} error - The original error
+ * @param {EffectFn} effectFn - The effect that errored
+ * @param {string} phase - Phase when error occurred ('cleanup' | 'execution')
+ */
+function handleEffectError(error, effectFn, phase) {
+  const effectError = new EffectError(
+    `Effect [${effectFn.id}] error during ${phase}: ${error.message}`,
+    {
+      effectId: effectFn.id,
+      phase,
+      dependencyCount: effectFn.dependencies?.size ?? 0,
+      cause: error
+    }
+  );
+
+  // Try effect-specific handler first
+  if (effectFn.onError) {
+    try {
+      effectFn.onError(effectError);
+      return;
+    } catch (handlerError) {
+      log.error('Effect onError handler threw:', handlerError);
+    }
+  }
+
+  // Try global handler
+  if (globalEffectErrorHandler) {
+    try {
+      globalEffectErrorHandler(effectError);
+      return;
+    } catch (handlerError) {
+      log.error('Global effect error handler threw:', handlerError);
+    }
+  }
+
+  // Default: log with context
+  log.error(`[${effectError.effectId}] ${effectError.message}`, {
+    phase: effectError.phase,
+    dependencies: effectError.dependencyCount
+  });
+}
+
 /**
  * Run a single effect safely
  * @private
@@ -398,7 +501,7 @@ function runEffect(effectFn) {
   try {
     effectFn.run();
   } catch (error) {
-    log.error('Effect error:', error);
+    handleEffectError(error, effectFn, 'execution');
   }
 }
 
@@ -568,9 +671,16 @@ export function computed(fn, options = {}) {
   return p;
 }
 
+/**
+ * @typedef {Object} EffectOptions
+ * @property {string} [id] - Custom effect identifier for debugging
+ * @property {function(EffectError): void} [onError] - Error handler for this effect
+ */
+
 /**
  * Create an effect that runs when its dependencies change
  * @param {function(): void|function(): void} fn - Effect function, may return a cleanup function
+ * @param {EffectOptions} [options={}] - Effect configuration options
  * @returns {function(): void} Dispose function to stop the effect
  * @example
  * const count = pulse(0);
@@ -588,19 +698,32 @@ export function computed(fn, options = {}) {
  *   const timer = setInterval(() => tick(), 1000);
  *   return () => clearInterval(timer); // Cleanup on re-run or dispose
  * });
+ *
+ * // With custom ID and error handler
+ * effect(() => {
+ *   // Effect logic that might fail
+ * }, {
+ *   id: 'data-sync',
+ *   onError: (err) => console.error('Data sync failed:', err.cause)
+ * });
  */
-export function effect(fn) {
+export function effect(fn, options = {}) {
+  const { id: customId, onError } = options;
+  const effectId = customId || `effect_${++effectIdCounter}`;
+
   // Capture module ID at creation time for HMR tracking
   const moduleId = context.currentModuleId;
 
   const effectFn = {
+    id: effectId,
+    onError,
     run: () => {
       // Run cleanup functions from previous run
       for (const cleanup of effectFn.cleanups) {
         try {
           cleanup();
         } catch (e) {
-          log.error('Cleanup error:', e);
+          handleEffectError(e, effectFn, 'cleanup');
         }
       }
       effectFn.cleanups = [];
@@ -618,7 +741,7 @@ export function effect(fn) {
       try {
         fn();
       } catch (error) {
-        log.error('Effect execution error:', error);
+        handleEffectError(error, effectFn, 'execution');
       } finally {
         context.currentEffect = prevEffect;
       }
@@ -645,7 +768,7 @@ export function effect(fn) {
       try {
         cleanup();
       } catch (e) {
-        log.error('Cleanup error:', e);
+        handleEffectError(e, effectFn, 'cleanup');
       }
     }
     effectFn.cleanups = [];
@@ -994,6 +1117,9 @@ export default {
   memoComputed,
   context,
   resetContext,
+  // Error handling
+  EffectError,
+  onEffectError,
   // HMR support
   setCurrentModule,
   clearCurrentModule,

package/runtime/store.js

@@ -20,6 +20,12 @@ import { loggers, createLogger } from './logger.js';
 
 const log = loggers.store;
 
+/**
+ * Maximum nesting depth for nested objects to prevent abuse
+ * @type {number}
+ */
+const MAX_NESTING_DEPTH = 10;
+
 /**
  * @typedef {Object} StoreOptions
  * @property {boolean} [persist=false] - Persist state to localStorage
@@ -46,6 +52,52 @@ const log = loggers.store;
  * @typedef {function(Store): Store} StorePlugin
  */
 
+/**
+ * Dangerous property names that could cause prototype pollution
+ * @type {Set<string>}
+ */
+const DANGEROUS_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+
+/**
+ * Safely deserialize persisted state, preventing prototype pollution
+ * and property injection attacks.
+ * @private
+ * @param {Object} savedState - The parsed JSON state
+ * @param {Object} schema - The initial state defining allowed keys
+ * @returns {Object} Sanitized state object
+ */
+function safeDeserialize(savedState, schema) {
+  if (typeof savedState !== 'object' || savedState === null || Array.isArray(savedState)) {
+    return {};
+  }
+
+  const result = {};
+  for (const [key, value] of Object.entries(savedState)) {
+    // Block dangerous keys that could pollute prototypes
+    if (DANGEROUS_KEYS.has(key)) {
+      log.warn(`Blocked potentially dangerous key in persisted state: "${key}"`);
+      continue;
+    }
+
+    // Only allow keys that exist in the schema (initial state)
+    if (!(key in schema)) {
+      continue;
+    }
+
+    // Recursively validate nested objects
+    if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
+      if (typeof schema[key] === 'object' && schema[key] !== null && !Array.isArray(schema[key])) {
+        result[key] = safeDeserialize(value, schema[key]);
+      }
+      // If schema expects primitive but got object, skip it
+    } else {
+      result[key] = value;
+    }
+  }
+
+  return result;
+}
+
 /**
  * Create a global store with reactive state properties.
  * @template T
@@ -76,7 +128,9 @@ export function createStore(initialState = {}, options = {}) {
     try {
       const saved = localStorage.getItem(storageKey);
       if (saved) {
-        state = { ...initialState, ...JSON.parse(saved) };
+        const parsed = JSON.parse(saved);
+        const sanitized = safeDeserialize(parsed, initialState);
+        state = { ...initialState, ...sanitized };
       }
     } catch (e) {
       log.warn('Failed to load persisted state:', e);
@@ -93,9 +147,18 @@ export function createStore(initialState = {}, options = {}) {
    * @private
    * @param {string} key - State key
    * @param {*} value - Initial value
+   * @param {number} [depth=0] - Current nesting depth
    * @returns {Pulse|Object} Pulse or nested object of pulses
    */
-  function createPulse(key, value) {
+  function createPulse(key, value, depth = 0) {
+    // Prevent excessive nesting depth
+    if (depth > MAX_NESTING_DEPTH) {
+      log.warn(`Max nesting depth (${MAX_NESTING_DEPTH}) exceeded for key: "${key}". Flattening to single pulse.`);
+      const p = pulse(value);
+      pulses[key] = p;
+      return p;
+    }
+
     if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
       // Create a pulse for the nested object itself (for $setState support)
       const objectPulse = pulse(value);
@@ -104,7 +167,7 @@ export function createStore(initialState = {}, options = {}) {
       // Also create nested pulses for individual properties
       const nested = {};
       for (const [k, v] of Object.entries(value)) {
-        nested[k] = createPulse(`${key}.${k}`, v);
+        nested[k] = createPulse(`${key}.${k}`, v, depth + 1);
       }
       return nested;
     }
@@ -119,6 +182,15 @@ export function createStore(initialState = {}, options = {}) {
     store[key] = createPulse(key, value);
   }
 
+  // Sync nested pulses for persisted state to ensure consistency
+  if (persist && typeof localStorage !== 'undefined') {
+    for (const [key, value] of Object.entries(state)) {
+      if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
+        updateNestedPulses(key, value);
+      }
+    }
+  }
+
   // Persist state changes
   if (persist) {
     effect(() => {