[noah-meierlabs]

Fixes points 2, 12, 13, 16–21 of #6. One commit per package.

No API surface changes: no new or removed exports, parameters or types. The only behaviour that changes is the buggy behaviour.

chuchi

• 2, // paths: pushState/replaceState get location.origin + uri instead of the bare uri. A same-host link like https://site.ch//evil.com/x used to throw a SecurityError (the uri //evil.com/x is read as another host). The URL that ends up in the address bar is the same as before.
  • crelte has the same bug: ClientRouter passes url.pathname + url.search + url.hash to pushState.

core

• 12:
  • request returns null for an empty body (e.g. 204) instead of throwing a JSON parse error.
  • A non-JSON error response (e.g. a 502 HTML page) becomes OTHER: response code 502.
  • ApiError.fromJson no longer crashes on null, numbers or {}.
• 13:
  • requestWithFile and requestTimeout accept every 2xx status, like request (before: only 200).
  • When the error body isn't JSON, they report the status code.
  • requestTimeout sends GET data as query params, like request (before: silently dropped).

utils

• 16: range had an operator-precedence bug in its length. It now collects the values in a plain array: range(0, 10, 2) → [0,2,4,6,8], and range(-5, 5, 2) / range(5, 2) no longer throw.
• 17: searchScore uses the previously unused searchSpaceRight for the right distance. Exact matches now rank better: foo/foo = 1, foo/foobarbaz = 7 (before: both 4).
• 18: removing a SlotArray slot twice no longer hands out the same index twice.

legacy

• 19: Date parses YYYY-MM-DD as a local date. Before, it was read as UTC midnight, so west of UTC it shifted a day on every round trip.
• 20: ISO week uses the Thursday's year, with rounding for DST, in both Date and DateTime.
• 21:
  • Duration picks the unit after rounding: 59.6s → "in one minute", 6.6 days → "in one week".
  • inViewY is true for an element taller than the viewport that covers it.

Testing

• build, check-fmt, check, lint and check-jsr pass.
• Router in headless Chromium: clicking a //evil.example/x same-host link works. On main it throws SecurityError: Failed to execute 'pushState'….
• Api with mocked fetch/XMLHttpRequest: 204, 502 HTML, a JSON error, GET query params (also for requestTimeout), 201 and 204 over XHR.
• week compared against the ISO week of every day from 2015 to 2030, for Date and DateTime (at 00:30 and 12:00), in America/New_York, Europe/Zurich, Australia/Sydney and UTC: 0 mismatches. A Date JSON round trip in New York keeps 2023-05-10.
• Node scripts for range, searchScore, SlotArray and Duration.

🤖 Generated with Claude Code