Release v1.3.0

Release Notes – v1.3.0

We are excited to announce Aided v1.3.0! This release introduces powerful performance tooling, stronger security, better async data handling, and an enhanced developer experience with an in‑browser documentation system in the Playground.

---

Security Strengthening

• URL Protocol Blocking – bindAttr and static attributes in h() now block dangerous executable protocols (javascript:, vbscript:, data:) on URL‑sensitive attributes (href, src, action, formaction, xlink:href, srcdoc, poster). A clear Security error is thrown when detected.
• h.dangerous Escape Hatch – The h proxy now includes a .dangerous namespace for creating tags that are blocked by default (script, iframe, base, meta, link, object, embed). This forces explicit opt‑in and logs a development warning, while still hard‑blocking prototype escapes (constructor, prototype, __proto__).
• Stricter Tag Validation – The standard h proxy now blocks a wider range of dangerous tags and provides actionable error messages guiding developers to the .dangerous namespace.

---

New Features

Performance Profiler (Zero‑Overhead)

import { enableProfiler, getProfilerReport } from 'aided-core';

enableProfiler(true);
// ... run your app ...
const report = getProfilerReport();
console.log(report.effectExecutions); // total number of effect runs
console.log(report.effects);          // per‑effect counts and total time

When disabled, profiling adds only a single boolean check – zero impact on production performance.

createResource with AbortSignal

The fetcher now receives a second argument { signal } (an AbortSignal). The signal is automatically aborted when the resource is re‑fetched or the owning scope is disposed, allowing clean cancellation of in‑flight requests.

const user = createResource(
  () => userId(),
  async (id, { signal }) => {
    const res = await fetch(`/api/users/${id}`, { signal });
    return res.json();
  }
);

Scheduler Error Isolation

Errors thrown inside effects are now caught and logged individually. One failing effect no longer blocks other dirty effects from executing in the same flush batch. The error log includes the effect name for easier debugging.

---

Improvements & Fixes

• Portal DocumentFragment Fix – Portal now correctly tracks individual child nodes when passed a DocumentFragment, preventing NotFoundError crashes during cleanup.
• Improved Bundle Size – Minified + gzipped size is now 5.92 kB (updated in documentation).
• Better Developer Warnings – devWarning is now used for h.dangerous usage, guiding developers to sanitise inputs.

---

Playground & Documentation Overhaul

The interactive playground now includes a full in‑browser documentation system:

• Sidebar Navigation – Tree‑based navigation of all API reference and guide files.
• Markdown Rendering – All documentation is rendered from Markdown with marked, sanitised with DOMPurify, and syntax‑highlighted with Prism.js.
• Copy‑to‑Clipboard – Every code snippet comes with a one‑click copy button.
• Client‑Side Routing – Seamless switching between the Playground and Documentation with History API support.

We have also added 40+ source‑file .md references and a comprehensive hyperscript helper guide (aided-hyperscript-helper.md) to help you get started.

---

Upgrading

yarn add aided-core@1.3.0
# or
npm install aided-core@1.3.0

Breaking Changes

None. This release is fully backward‑compatible. The new security features only block previously insecure patterns – existing safe code will continue to work.

Migration Tips

• If you were using h.script() or similar, replace with h.dangerous.script() and ensure all attributes/children are sanitised.
• Update createResource fetchers to optionally use the new signal parameter for cancellation support.

---

Acknowledgements

Thank you to all contributors and early adopters for your feedback and support. Aided continues to evolve with a focus on performance, security, and developer experience.

Happy building!

Changes since v1.2.0:

- feat(core): add performance profiler, AbortSignal in createResource, h.dangerous escape hatch, and multi-layer XSS prevention (d782a2d)
- ci: add semver validation guard to version extraction (444edbd)
- ci: improve NPM publish with OIDC, version sync, and auth verification (6f307e7)
- ci: switch NPM publish to OIDC trusted publisher auth (2690604)
- ci: rename default branch to master, update yarn, add release workflow (7a94c51)
- Updating coverage badges (961cd32)

Full changelog: https://github.com/ahmadmdabit/aided/commits/v1.3.0

v1.2.0

Full Changelog: v1.1.0...v1.2.0

v1.1.0

Full Changelog: v1.0.0...v1.1.0

v1.0.0

Release v1.0.0 - Initial Public Release

I am thrilled to announce the first public release of Aided Core (aided-core) v1.0.0!

Aided is a minimal, high-performance JavaScript library for building user interfaces with fine-grained reactivity. It is designed from the ground up for performance and simplicity, updating the DOM directly without using a Virtual DOM. This release marks the first stable, production-ready version available on NPM.

✨ Key Features

This initial release is packed with a powerful set of features for building modern, reactive web applications:

• Fine-Grained Reactivity: A robust system of reactive primitives (createSignal, createEffect, createMemo, createResource) ensures that your state updates are surgical, efficient, and predictable.
• High-Performance List Rendering: An advanced <For> component that uses a Longest Increasing Subsequence (LIS) based reconciliation algorithm for incredibly fast, keyed list updates.
• Built-in Virtualization: Includes a high-performance <VirtualFor> component and a headless createVirtualizer utility to render massive datasets (100,000+ items) with ease.
• Automatic Memory Management: A simple yet powerful ownership model (createRoot, onCleanup) guarantees that all reactive scopes are automatically cleaned up, preventing memory leaks.
• Excellent Developer Experience: The core library is dependency-free, provides clear development-mode warnings for common mistakes, and comes with first-class TypeScript support.
• Simple & Powerful API: A minimal API surface including a hyperscript h helper, control flow components (<Show>), and context (createContext) makes it easy to get started.

🚀 Getting Started

Installation

You can now install aided-core directly from the NPM registry:

# Using npm
npm install aided-core

# Using yarn
yarn add aided-core

Quick Example

Create your first reactive component in just a few lines of code:

import { render, createSignal, h } from 'aided-core';

function Counter() {
  const [count, setCount] = createSignal(0);

  return h.button(
    {
      onClick: () => setCount(count() + 1)
    },
    'Count: ', count // The text automatically updates when the signal changes!
  );
}

// Mount the component to the DOM
render(Counter, document.getElementById('app'));

📝 Changelog

This release focuses on preparing the library for its public debut. The changes are primarily centered around packaging, build process improvements, and project structure.

🚀 Features

• Publishable Package: The package.json has been significantly enhanced with rich metadata (keywords, repository, author), a modern exports field for full ESM/CJS compatibility, and an engines field to ensure a stable environment for users.

♻️ Refactoring

• Package Renaming: The package has been renamed from the scoped @aided/core to the unscoped aided-core to enable public publishing on NPM. All internal references, documentation, and path aliases across the monorepo have been updated accordingly.

🛠 Chores

• Build Process Overhaul: The build process has been made more robust to produce a clean, professional package.
  • A new package-specific tsconfig.json has been introduced to isolate the build, ensuring only intended source files are included in the output.
  • vite-plugin-dts is now configured to roll up all TypeScript declarations into a single, clean index.d.ts file, simplifying the public API for consumers.

Full Changelog: 413a994

---

This is the first step on an exciting journey. I welcome your feedback, bug reports, and contributions!

Check out the repository: https://github.com/ahmadmdabit/aided