From 445b29d05198a5f444552ebdc57a00f4c126de54 Mon Sep 17 00:00:00 2001
From: "Alex A. Naanou" <alex.nanou@gmail.com>
Date: Thu, 15 Jan 2026 15:24:05 +0300
Subject: [PATCH] minor tweaks + docs...

Signed-off-by: Alex A. Naanou <alex.nanou@gmail.com>
---
 README.md    | 23 ++++++++++++++++++++++-
 package.json |  2 +-
 serialize.js | 29 ++++++++++++++++++++++-------
 3 files changed, 45 insertions(+), 9 deletions(-)

diff --git a/README.md b/README.md
index 2aa5172..4c4394d 100644
--- a/README.md
+++ b/README.md
@@ -53,7 +53,7 @@ Thus, care must be taken when serializing structures containing function.
 
 ### `serialize(..)` / `eJSON.stringify(..)`
 
-Serialize a JavaScript value into a JSON or JSON-like string.
+Serialize a JavaScript value into a JSON/eJSON string.
 ```
 serialize(<value>)
 eJSON.stringify(<value>)
@@ -89,12 +89,33 @@ Supported options:
 
 ### `deserialize(..)` / 'eJSON.parse(..)'
 
+Deserialize a JSON/eJSON into a value.
 ```
 deserialize(<string>)
 eJSON.parse(<string>)
 	-> <value>
 ```
 
+Deserializing function is disabled by default as it can be a security 
+risk if the eJSON came from an untrusted source.
+
+Enable function deserialization:
+```
+deserialize(<string>, true)
+eJSON.parse(<string>, true)
+deserialize(<string>, {functions: true})
+eJSON.parse(<string>, {functions: true})
+	-> <value>
+```
+
+Passing a function list (generated by `serialize(<value>, {functions: <functions>})`) 
+for deserialization:
+```
+deserialize(<string>, {functions: <functions>})
+eJSON.parse(<string>, {functions: <functions>})
+	-> <value>
+```
+
 
 ### `deepCopy(..)`
 
diff --git a/package.json b/package.json
index d32410f..b389b55 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "ig-serialize",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "experimental extended json serializaion...",
   "main": "serialize.js",
   "scripts": {
diff --git a/serialize.js b/serialize.js
index 596c5f3..5befb8a 100644
--- a/serialize.js
+++ b/serialize.js
@@ -93,12 +93,26 @@ module.MIN_LENGTH_REF = REFERENCE.length * 16
 // 	_serialize(obj, base_path, seen, indent, depth, options)
 // 		-> str
 //
-// Options format:
+//
+// options format:
 // 	{
-// 		// Indent to use 
+// 		// Indent to use for formatting output.
+// 		// Can be:
+// 		//	<number>	- number of spaces to use for indent
+// 		//	<string>	- string to use for indent
+// 		// 					NOTE: only whitespace characters are supported 
+// 		//						currently.
 // 		indent: undefined,
+//
+// 		// Top level indent.
 // 		depth: 0,
+//
+// 		// Minimum length of string/bigint to reference.
 // 		min_length_ref: MIN_LENGTH_REF,
+//
+// 		// Stored functions.
+// 		// If set to an array functions will be pushed to it and stored 
+// 		// by index.
 // 		functions: undefined,
 // 	}
 //
@@ -711,7 +725,12 @@ module.eJSON = {
 		return this[handler](state, path, match, str, i, line) },
 
 
-	parse: function(str, options={}){
+	parse: function(str, options){
+		options = 
+			options === true ?
+				{functions: true}
+				: (options 
+					?? {})
 
 		// stage 1: build the object...
 		var state = {functions: options.functions}
@@ -731,10 +750,6 @@ module.eJSON = {
 var deserialize =
 module.deserialize =
 function(str, options){
-	options = 
-		options === true ?
-			{functions: true}
-			: options
 	return eJSON.parse(str, options) }