Skip to content

Chore/sibujs hardening followups#38

Merged
hexplus merged 41 commits into
mainfrom
chore/sibujs-hardening-followups
Jun 26, 2026
Merged

Chore/sibujs hardening followups#38
hexplus merged 41 commits into
mainfrom
chore/sibujs-hardening-followups

Conversation

@hexplus

@hexplus hexplus commented Jun 26, 2026

Copy link
Copy Markdown
Owner

Description

Completes the duplicate-runtime hardening started in 3.3.1. When a bundler loads the framework's modules more than once on a page (e.g. Vite/esbuild dependency pre-bundling, which can serve the same chunk twice), module-scoped singletons split into independent copies and silently misbehave. 3.3.1 fixed the reactive core; this PR (3.3.2) sweeps the remaining coordination singletons via the same first-copy-wins globalThis registry, plus two supporting tooling fixes.

Singletons hardened

  • createId() — the unique-id counter is now shared, so two copies can't both hand out sibu-1 (was breaking a11y pairing aria-labelledby / for+id and SSR hydration).
  • ssr-context — the AsyncLocalStorage instance + fallback store are shared, so enableSSR() in one copy is observed by isSSR() in another (prevents client-only effects running during a server render, and per-request state bleed across copies).
  • router globalRouter — the global router instance is shared, so navigation / Outlet / Link helpers in a duplicated plugins chunk see the router created by createRouter() in the first copy (no spurious "Router not initialized").

Audited and already safe: context() (instance-owned signal) and the devtools hook (globalThis).

Tooling

  • __SIBU_VERSION__ build define (tsup.config.ts) — the duplicate-runtime dev warning now prints real versions (active: 3.3.2, …) instead of dev.
  • Benchmark harness — rewrote the Create 10,000 effects bench (was a single un-warmed iterations: 1 shot swinging ~10→20 ms) to measure create-only cost, warmed and averaged over 12 rounds with disposal outside the timed region (~14% spread, under the gate), and regenerated the stale bench-baseline.json so bench:check is trustworthy again.

Regression tests for createId and ssr-context cross-instance sharing added to tests/duplicate-instance.test.ts (fail before, pass after). The router shares the identical mechanism but is verified via the full router suite (247 tests) for single-instance safety — a cross-instance test is omitted because createRouter needs DOM, which conflicts with the node-env esbuild double-eval harness. Version bumped 3.3.1 → 3.3.2 with CHANGELOG and docs-site badges.

Related Issue

Closes #

Type of Change

  • Bug fix
  • New feature
  • Breaking change
  • Documentation update

Checklist

  • I have read CONTRIBUTING.md
  • My code builds without errors
  • I have tested my changes
  • I have updated documentation if needed

hexplus added 30 commits March 28, 2026 15:11
@hexplus hexplus merged commit ac217df into main Jun 26, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant