phlex-reactive 0.9.3 → 0.9.5

data/app/controllers/phlex/reactive/actions_controller.rb

@@ -35,13 +35,83 @@ module Phlex
         # #82/#87); we only ADD the outcome finalizer. `action` is safe to read
         # up front (it comes from the request, not the verified token).
         event = { component: nil, action: reactive_action_name.to_s, outcome: nil }
-        Phlex::Reactive.instrument("action", event) do
-          create_action(event)
+        # Mint any reply.defer directive tokens UNDER the actor's binding (issue
+        # #165 security), so the defer endpoint accepts them ONLY back from this
+        # same actor. The defer token is built in response_streams (inside this
+        # block via the Defer builder), so the binding must be established here.
+        Phlex::Reactive.with_defer_binding(Phlex::Reactive.defer_binding_for(request)) do
+          Phlex::Reactive.instrument("action", event) do
+            create_action(event)
+          end
+        end
+      end
+
+      # The defer endpoint (issue #165) — the pull lane's render leg. Verifies
+      # the purpose-scoped, short-TTL defer token (an ACTION token is rejected
+      # here by signature — purpose confusion fails closed), rebuilds the
+      # component from its signed identity, and returns its replace (or morph,
+      # per the SIGNED mode) stream. No action runs and no transaction opens —
+      # this is a read. Authorization: the base controller's auth applies as on
+      # every reactive request; a component that guards visibility can raise a
+      # registered authorization error from from_identity/render (→ 403) or
+      # return false from render? (→ 204: keep content, clear pending).
+      def deferred
+        event = { component: nil, outcome: nil }
+        # Verify UNDER the actor's binding (issue #165 security): a defer token
+        # minted for another actor's session fails the binding-scoped purpose,
+        # so a leaked token can't be exchanged here for this actor's render (and
+        # its embedded fresh identity token). Unbound requests (no session) are
+        # unchanged.
+        Phlex::Reactive.with_defer_binding(Phlex::Reactive.defer_binding_for(request)) do
+          Phlex::Reactive.instrument("defer", event) do
+            deferred_action(event)
+          end
         end
       end
 
       private
 
+      # The defer body, mirroring create_action's shape: fill the event payload
+      # on every exit path, reuse the shared rescue → reactive_error plumbing.
+      def deferred_action(event)
+        payload = verified_defer_payload
+        component_class = resolve_component(payload["c"])
+        event[:component] = component_class.name
+        component = component_class.from_identity(payload)
+
+        if component.respond_to?(:render?) && !component.render?
+          event[:outcome] = :no_content
+          return head :no_content
+        end
+
+        event[:outcome] = :ok
+        stream = payload["m"] == "morph" ? component.to_stream_morph : component.to_stream_replace
+        render turbo_stream: stream
+      rescue Phlex::Reactive::InvalidToken => e
+        event[:outcome] = :invalid_token
+        reactive_error(:bad_request, e.message, kind: e.diagnostic || :tampered)
+      rescue ActiveRecord::RecordNotFound
+        event[:outcome] = :not_found
+        reactive_error(:not_found, record_not_found_message(payload), kind: :not_found)
+      rescue *authorization_errors => e
+        event[:outcome] = :unauthorized
+        reactive_error(:forbidden, deferred_authorization_message(e, component_class), kind: :forbidden)
+      end
+
+      def verified_defer_payload
+        token = params.require(:token)
+        Phlex::Reactive.verify_defer(token) || raise(Phlex::Reactive::InvalidToken.new(
+          "defer token invalid — expired (defer_token_ttl is #{Phlex::Reactive.defer_token_ttl}s), " \
+          "tampered, or an ACTION token posted to the defer endpoint (the purposes are disjoint)",
+          diagnostic: :tampered
+        ))
+      end
+
+      def deferred_authorization_message(error, component_class)
+        "#{error.class.name} raised rebuilding/rendering #{component_class&.name} for a deferred " \
+          "segment — the signature proves identity, not permission"
+      end
+
       # The action body, run inside the instrument block so its payload (`event`)
       # can be finalized on every exit path. Kept separate so `create` stays a
       # thin instrument wrapper.
@@ -60,10 +130,21 @@ module Phlex
         component = component_class.from_identity(payload)
         coerced = coerce_params(action_def, component_class:, action_name: action_def.name)
 
+        # verify_authorized (issue #168): instrument the class ONCE (idempotent,
+        # per class object) so its authorization methods mark the tracking cell.
+        # Only when the feature is on — zero cost otherwise.
+        Phlex::Reactive::Authorization.instrument!(component_class) if Phlex::Reactive.verify_authorized
+
         result = run_action(component, action_def, coerced)
 
         event[:outcome] = :ok
         render turbo_stream: response_streams(result, component)
+      rescue Phlex::Reactive::AuthorizationNotVerified
+        # A developer error (a forgotten authorize!), NOT a client fault — it
+        # bubbles as a 500 so error trackers fire, but we tag the event first so
+        # the action.phlex_reactive outcome stays accurate, then re-raise.
+        event[:outcome] = :unverified
+        raise
       rescue Phlex::Reactive::InvalidToken => e
         # The component name here came from an UNVERIFIED token — do NOT report it
         # as trusted. Leave event[:component] nil.
@@ -153,10 +234,21 @@ module Phlex
         Phlex::Reactive.with_connection_id(request.headers["X-Pgbus-Connection"]) do
           with_around_actions(component, action_def, coerced) do
             transaction_wrapper do
-              if coerced.any?
-                component.public_send(action_def.name, **coerced)
-              else
-                component.public_send(action_def.name)
+              # verify_authorized (issue #168): open the tracking window, run the
+              # action, then verify INSIDE the transaction so an unverified action
+              # rolls its mutation back (fail-closed). with_tracking is a bare
+              # yield's-worth of overhead; verify! is a no-op when the feature is
+              # off / the action is skipped / something marked. The interceptor
+              # (create_action's instrument!) marks the window on a real
+              # authorization call.
+              Phlex::Reactive::Authorization.with_tracking do
+                result = if coerced.any?
+                           component.public_send(action_def.name, **coerced)
+                         else
+                           component.public_send(action_def.name)
+                         end
+                Phlex::Reactive::Authorization.verify!(component.class, action_def)
+                result
               end
             end
           end
@@ -214,9 +306,11 @@ module Phlex
         # the dedupe is scoped to the actor's own target, NOT a global substring,
         # so a partial reply that legitimately includes another reactive
         # component's stream (which carries its OWN token) still refreshes ours.
+        #
+        # (refresh_token? implies render_self? is false — .streams/collections set
+        # both — so folding this into the if/elsif below is behavior-preserving.)
         if result.refresh_token? && !carries_token_for?(streams, result.token_component)
-          return [*streams, result.token_component.to_stream_token]
-        end
+          streams = [*streams, result.token_component.to_stream_token]
 
         # Guarantee the component's signed identity token is refreshed unless the
         # Response opted out (remove/redirect navigate away — handled above). The
@@ -234,10 +328,26 @@ module Phlex
         # ground-truth flag (rx_carries_token?), a raw string from a substring
         # scan. Deliberately NOT rx_refreshes_token_for? (target-scoped): scoping
         # this guard would regress update/morph of self on an aliased id.
-        if result.render_self? && streams.none? { stream_carries_token?(it) }
+        elsif result.render_self? && streams.none? { stream_carries_token?(it) }
           streams = [component.to_stream_replace, *streams]
         end
-        streams
+
+        append_deferred_streams(streams, result)
+      end
+
+      # Deferred segments (issue #165) ride LAST — after every render stream and
+      # after the reactive:js op stream — so their placeholder/directive apply
+      # to the fully-updated DOM (Turbo applies in document order) and delivery
+      # kicks off only once the reply's own paints are in flight. This runs
+      # AFTER run_action returned, i.e. after the action's transaction
+      # COMMITTED — a rolled-back action takes the rescue paths and no directive
+      # (or push-lane enqueue) can ever leak. The common non-defer reply pays
+      # one empty? check.
+      def append_deferred_streams(streams, result)
+        return streams unless result.deferred?
+
+        via = Phlex::Reactive::Defer.resolve_via
+        [*streams, *result.deferred_segments.flat_map { Phlex::Reactive::Defer.streams_for(it, via:) }]
       end
 
       # GUARD 2 predicate. A Stream with intact metadata answers structurally

data/app/javascript/phlex/reactive/inspect.js

@@ -0,0 +1,225 @@
+// The on-demand client inspector (issue #168) — the browser half of the
+// debugging toolkit, the client twin of `phlex_reactive:actions` / the MCP tools.
+//
+// It is a STANDALONE module (the confirm.js / compute.js precedent): it does NOT
+// touch the hot-path reactive_controller.js and costs NOTHING until you import
+// it. Loaded on demand from the console (the engine pins it), it scans the live
+// DOM and maps every reactive root + bound trigger back to the server
+// Component#action names — so you can answer "what's reactive on this page, what
+// does each control POST, and which component owns it?" without reading source.
+//
+//   (await import("phlex/reactive/inspect")).report()   // console.table
+//   const roots = (await import("phlex/reactive/inspect")).scan()  // data
+//
+// The server↔client mapping is BY NAME: scan()'s `component` + each trigger's
+// `action` are exactly the Component#action identifiers `phlex_reactive:actions`
+// and the MCP tools list. The docs page shows the two side by side.
+//
+// It reads the SAME DOM contract reactive_controller.js writes (roots
+// [data-controller~="reactive"] with id + data-reactive-token-value; triggers
+// [data-reactive-action-param] with data-action/params/modifiers; client-only
+// [data-reactive-ops-param]; computes [data-reactive-compute-reducer-param]; the
+// show/filter/text binding families). It never mutates anything — pure read.
+
+// Scan `root` (default the whole document) and return one entry per reactive
+// root, deepest-scoped: each trigger is attributed to its NEAREST reactive root,
+// so a nested root doesn't double-count its parent's triggers.
+export function scan(root = document) {
+  const roots = Array.from(root.querySelectorAll('[data-controller~="reactive"]'))
+  return roots.map((el) => inspectRoot(el, roots))
+}
+
+// console.table the inventory (roots + a flattened trigger table), and return
+// the same data scan() does so `report()` is also usable programmatically. Safe
+// on an empty document (logs an empty table, throws nothing).
+export function report(root = document) {
+  const roots = scan(root)
+  const console = globalThis.console
+
+  // Guard each console method independently — a host page (or a test harness)
+  // may ship a partial console, and report() must never throw over logging.
+  if (console && typeof console.log === "function") {
+    console.log(`[phlex-reactive] ${roots.length} reactive root(s)`)
+  }
+  if (console && typeof console.table === "function") {
+    console.table(
+      roots.map((r) => ({
+        id: r.id,
+        component: r.component ?? (r.opaque ? "(opaque token)" : null),
+        actions: r.triggers.map((t) => t.action).join(", "),
+        fields: r.fields.join(", "),
+        computes: r.computes.join(", "),
+      })),
+    )
+  }
+  return roots
+}
+
+// --- one root --------------------------------------------------------------
+
+function inspectRoot(el, allRoots) {
+  const token = el.getAttribute("data-reactive-token-value")
+  const payload = decodeToken(token)
+
+  return {
+    id: el.id || null,
+    component: payload.opaque ? null : (payload.c ?? null),
+    gid: payload.gid ?? null,
+    stateKeys: payload.s ? Object.keys(payload.s) : [],
+    tokenVersion: payload.v ?? null,
+    opaque: !!payload.opaque,
+    status: readStatus(el),
+    triggers: ownedTriggers(el, allRoots),
+    clientOps: ownedClientOps(el, allRoots),
+    computes: ownedComputes(el, allRoots),
+    fields: ownedFields(el, allRoots),
+    show: ownedShow(el, allRoots),
+    text: ownedText(el, allRoots),
+    filter: readFilter(el),
+  }
+}
+
+// The signed identity is base64(JSON)--signature under the Rails 7.1+ JSON
+// message serializer. Decode the segment BEFORE the "--", JSON-parse it, and
+// unwrap the MessageVerifier envelope ({_rails:{data:…}}) to the {c,gid,s,v}
+// payload. Degrade to { opaque: true } on anything that isn't JSON-decodable —
+// a Marshal-serialized payload (older apps) simply isn't readable client-side,
+// and that's fine: the inspector shows "(opaque token)" rather than throwing.
+function decodeToken(token) {
+  if (!token) return { opaque: true }
+
+  try {
+    const segment = token.split("--")[0]
+    const json = atobUtf8(segment)
+    const parsed = JSON.parse(json)
+    const data = parsed && parsed._rails && parsed._rails.data ? parsed._rails.data : parsed
+    if (!data || typeof data !== "object") return { opaque: true }
+    return data
+  } catch {
+    return { opaque: true }
+  }
+}
+
+// base64 → string. Uses the platform atob; a malformed/urlsafe segment throws,
+// which decodeToken catches and reports as opaque.
+function atobUtf8(b64) {
+  const decode = globalThis.atob || ((s) => Buffer.from(s, "base64").toString("binary"))
+  return decode(b64)
+}
+
+// The at-a-glance runtime state the controller stamps on the root. Names/flags
+// only — never a value that could be sensitive.
+function readStatus(el) {
+  return {
+    error: el.getAttribute("data-reactive-error"),
+    busy: el.getAttribute("aria-busy") === "true" || el.hasAttribute("data-reactive-busy"),
+    dirty: el.hasAttribute("data-reactive-dirty"),
+  }
+}
+
+// --- ownership scoping -----------------------------------------------------
+//
+// An element belongs to a root when its NEAREST reactive-root ancestor is that
+// root (matching the controller's own ownership walk). closest() finds the
+// nearest ancestor matching the selector; the element itself can be the root
+// (for a root that also carries a binding), so we start the walk from the
+// element and accept `el` as its own owner.
+
+const ROOT_SELECTOR = '[data-controller~="reactive"]'
+
+function ownedBy(node, root) {
+  return node.closest(ROOT_SELECTOR) === root
+}
+
+// Query `root` for `selector`, keeping only elements whose nearest reactive
+// root IS `root` — so a nested root's matches are excluded here and attributed
+// to that inner root instead.
+function scopedQuery(root, selector, allRoots) {
+  return Array.from(root.querySelectorAll(selector)).filter((node) => ownedBy(node, root))
+}
+
+// --- the binding families --------------------------------------------------
+
+function ownedTriggers(root, allRoots) {
+  return scopedQuery(root, "[data-reactive-action-param]", allRoots).map((el) => ({
+    action: el.getAttribute("data-reactive-action-param"),
+    event: eventOf(el.getAttribute("data-action")),
+    params: el.getAttribute("data-reactive-params-param"),
+    debounce: el.getAttribute("data-reactive-debounce-param"),
+    throttle: el.getAttribute("data-reactive-throttle-param"),
+    confirm: el.getAttribute("data-reactive-confirm-param"),
+    optimistic: el.getAttribute("data-reactive-optimistic-param"),
+    loading: el.getAttribute("data-reactive-loading-param"),
+  }))
+}
+
+// The Stimulus data-action descriptor is "event->controller#method"; the event
+// is the part before "->" (a bare "controller#method" has an implicit default
+// event, which we report as null).
+function eventOf(dataAction) {
+  if (!dataAction) return null
+  const arrow = dataAction.indexOf("->")
+  return arrow === -1 ? null : dataAction.slice(0, arrow)
+}
+
+// Client-only op triggers ([data-reactive-ops-param]) — a menu toggle, a DOM op
+// chain that never round-trips. Report the parsed ops (names) when decodable.
+function ownedClientOps(root, allRoots) {
+  return scopedQuery(root, "[data-reactive-ops-param]", allRoots).map((el) => {
+    const raw = el.getAttribute("data-reactive-ops-param")
+    let ops = raw
+    try {
+      ops = JSON.parse(raw)
+    } catch {
+      // leave the raw string — a malformed ops attr shouldn't break the scan
+    }
+    return { event: eventOf(el.getAttribute("data-action")), ops }
+  })
+}
+
+// Compute reducers bound on this root ([data-reactive-compute-reducer-param]) —
+// the client-side data-binding twins of reactive_compute. Report reducer names.
+function ownedComputes(root, allRoots) {
+  return scopedQuery(root, "[data-reactive-compute-reducer-param]", allRoots).map((el) =>
+    el.getAttribute("data-reactive-compute-reducer-param"),
+  )
+}
+
+// The named form controls the dispatch would collect and send — the same
+// selector the controller's field walk uses. Names only, never values.
+function ownedFields(root, allRoots) {
+  return scopedQuery(root, "input[name], select[name], textarea[name]", allRoots).map((el) =>
+    el.getAttribute("name"),
+  )
+}
+
+// reactive_show bindings: which owned field controls each element's visibility.
+function ownedShow(root, allRoots) {
+  return scopedQuery(root, "[data-reactive-show-field]", allRoots).map((el) => ({
+    field: el.getAttribute("data-reactive-show-field"),
+    equals: el.getAttribute("data-reactive-show-equals"),
+    not: el.getAttribute("data-reactive-show-not"),
+    in: el.getAttribute("data-reactive-show-in"),
+  }))
+}
+
+// reactive_text spans (data-reactive-text=<name>) the client writes via
+// textContent — report the binding names.
+function ownedText(root, allRoots) {
+  return scopedQuery(root, "[data-reactive-text]", allRoots).map((el) =>
+    el.getAttribute("data-reactive-text"),
+  )
+}
+
+// reactive_filter lives on the ROOT itself (the input/option/group/empty
+// selectors it narrows client-side). Null when the root declares no filter.
+function readFilter(el) {
+  const input = el.getAttribute("data-reactive-filter-input")
+  if (!input) return null
+  return {
+    input,
+    option: el.getAttribute("data-reactive-filter-option"),
+    group: el.getAttribute("data-reactive-filter-group"),
+    empty: el.getAttribute("data-reactive-filter-empty"),
+  }
+}

data/app/javascript/phlex/reactive/inspect.min.js

@@ -0,0 +1,4 @@
+function K(q=document){let z=Array.from(q.querySelectorAll('[data-controller~="reactive"]'));return z.map((D)=>M(D,z))}function U(q=document){let z=K(q),D=globalThis.console;if(D&&typeof D.log==="function")D.log(`[phlex-reactive] ${z.length} reactive root(s)`);if(D&&typeof D.table==="function")D.table(z.map((G)=>({id:G.id,component:G.component??(G.opaque?"(opaque token)":null),actions:G.triggers.map((H)=>H.action).join(", "),fields:G.fields.join(", "),computes:G.computes.join(", ")})));return z}function M(q,z){let D=q.getAttribute("data-reactive-token-value"),G=P(D);return{id:q.id||null,component:G.opaque?null:G.c??null,gid:G.gid??null,stateKeys:G.s?Object.keys(G.s):[],tokenVersion:G.v??null,opaque:!!G.opaque,status:W(q),triggers:Z(q,z),clientOps:$(q,z),computes:j(q,z),fields:x(q,z),show:B(q,z),text:L(q,z),filter:N(q)}}function P(q){if(!q)return{opaque:!0};try{let z=q.split("--")[0],D=V(z),G=JSON.parse(D),H=G&&G._rails&&G._rails.data?G._rails.data:G;if(!H||typeof H!=="object")return{opaque:!0};return H}catch{return{opaque:!0}}}function V(q){return(globalThis.atob||((D)=>Buffer.from(D,"base64").toString("binary")))(q)}function W(q){return{error:q.getAttribute("data-reactive-error"),busy:q.getAttribute("aria-busy")==="true"||q.hasAttribute("data-reactive-busy"),dirty:q.hasAttribute("data-reactive-dirty")}}var X='[data-controller~="reactive"]';function Y(q,z){return q.closest(X)===z}function I(q,z,D){return Array.from(q.querySelectorAll(z)).filter((G)=>Y(G,q))}function Z(q,z){return I(q,"[data-reactive-action-param]",z).map((D)=>({action:D.getAttribute("data-reactive-action-param"),event:J(D.getAttribute("data-action")),params:D.getAttribute("data-reactive-params-param"),debounce:D.getAttribute("data-reactive-debounce-param"),throttle:D.getAttribute("data-reactive-throttle-param"),confirm:D.getAttribute("data-reactive-confirm-param"),optimistic:D.getAttribute("data-reactive-optimistic-param"),loading:D.getAttribute("data-reactive-loading-param")}))}function J(q){if(!q)return null;let z=q.indexOf("->");return z===-1?null:q.slice(0,z)}function $(q,z){return I(q,"[data-reactive-ops-param]",z).map((D)=>{let G=D.getAttribute("data-reactive-ops-param"),H=G;try{H=JSON.parse(G)}catch{}return{event:J(D.getAttribute("data-action")),ops:H}})}function j(q,z){return I(q,"[data-reactive-compute-reducer-param]",z).map((D)=>D.getAttribute("data-reactive-compute-reducer-param"))}function x(q,z){return I(q,"input[name], select[name], textarea[name]",z).map((D)=>D.getAttribute("name"))}function B(q,z){return I(q,"[data-reactive-show-field]",z).map((D)=>({field:D.getAttribute("data-reactive-show-field"),equals:D.getAttribute("data-reactive-show-equals"),not:D.getAttribute("data-reactive-show-not"),in:D.getAttribute("data-reactive-show-in")}))}function L(q,z){return I(q,"[data-reactive-text]",z).map((D)=>D.getAttribute("data-reactive-text"))}function N(q){let z=q.getAttribute("data-reactive-filter-input");if(!z)return null;return{input:z,option:q.getAttribute("data-reactive-filter-option"),group:q.getAttribute("data-reactive-filter-group"),empty:q.getAttribute("data-reactive-filter-empty")}}export{K as scan,U as report};
+
+//# debugId=DAD9B8F0F9C2105E64756E2164756E21
+//# sourceMappingURL=inspect.min.js.map

data/app/javascript/phlex/reactive/inspect.min.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["inspect.js"],
+  "sourcesContent": [
+    "// The on-demand client inspector (issue #168) — the browser half of the\n// debugging toolkit, the client twin of `phlex_reactive:actions` / the MCP tools.\n//\n// It is a STANDALONE module (the confirm.js / compute.js precedent): it does NOT\n// touch the hot-path reactive_controller.js and costs NOTHING until you import\n// it. Loaded on demand from the console (the engine pins it), it scans the live\n// DOM and maps every reactive root + bound trigger back to the server\n// Component#action names — so you can answer \"what's reactive on this page, what\n// does each control POST, and which component owns it?\" without reading source.\n//\n//   (await import(\"phlex/reactive/inspect\")).report()   // console.table\n//   const roots = (await import(\"phlex/reactive/inspect\")).scan()  // data\n//\n// The server↔client mapping is BY NAME: scan()'s `component` + each trigger's\n// `action` are exactly the Component#action identifiers `phlex_reactive:actions`\n// and the MCP tools list. The docs page shows the two side by side.\n//\n// It reads the SAME DOM contract reactive_controller.js writes (roots\n// [data-controller~=\"reactive\"] with id + data-reactive-token-value; triggers\n// [data-reactive-action-param] with data-action/params/modifiers; client-only\n// [data-reactive-ops-param]; computes [data-reactive-compute-reducer-param]; the\n// show/filter/text binding families). It never mutates anything — pure read.\n\n// Scan `root` (default the whole document) and return one entry per reactive\n// root, deepest-scoped: each trigger is attributed to its NEAREST reactive root,\n// so a nested root doesn't double-count its parent's triggers.\nexport function scan(root = document) {\n  const roots = Array.from(root.querySelectorAll('[data-controller~=\"reactive\"]'))\n  return roots.map((el) => inspectRoot(el, roots))\n}\n\n// console.table the inventory (roots + a flattened trigger table), and return\n// the same data scan() does so `report()` is also usable programmatically. Safe\n// on an empty document (logs an empty table, throws nothing).\nexport function report(root = document) {\n  const roots = scan(root)\n  const console = globalThis.console\n\n  // Guard each console method independently — a host page (or a test harness)\n  // may ship a partial console, and report() must never throw over logging.\n  if (console && typeof console.log === \"function\") {\n    console.log(`[phlex-reactive] ${roots.length} reactive root(s)`)\n  }\n  if (console && typeof console.table === \"function\") {\n    console.table(\n      roots.map((r) => ({\n        id: r.id,\n        component: r.component ?? (r.opaque ? \"(opaque token)\" : null),\n        actions: r.triggers.map((t) => t.action).join(\", \"),\n        fields: r.fields.join(\", \"),\n        computes: r.computes.join(\", \"),\n      })),\n    )\n  }\n  return roots\n}\n\n// --- one root --------------------------------------------------------------\n\nfunction inspectRoot(el, allRoots) {\n  const token = el.getAttribute(\"data-reactive-token-value\")\n  const payload = decodeToken(token)\n\n  return {\n    id: el.id || null,\n    component: payload.opaque ? null : (payload.c ?? null),\n    gid: payload.gid ?? null,\n    stateKeys: payload.s ? Object.keys(payload.s) : [],\n    tokenVersion: payload.v ?? null,\n    opaque: !!payload.opaque,\n    status: readStatus(el),\n    triggers: ownedTriggers(el, allRoots),\n    clientOps: ownedClientOps(el, allRoots),\n    computes: ownedComputes(el, allRoots),\n    fields: ownedFields(el, allRoots),\n    show: ownedShow(el, allRoots),\n    text: ownedText(el, allRoots),\n    filter: readFilter(el),\n  }\n}\n\n// The signed identity is base64(JSON)--signature under the Rails 7.1+ JSON\n// message serializer. Decode the segment BEFORE the \"--\", JSON-parse it, and\n// unwrap the MessageVerifier envelope ({_rails:{data:…}}) to the {c,gid,s,v}\n// payload. Degrade to { opaque: true } on anything that isn't JSON-decodable —\n// a Marshal-serialized payload (older apps) simply isn't readable client-side,\n// and that's fine: the inspector shows \"(opaque token)\" rather than throwing.\nfunction decodeToken(token) {\n  if (!token) return { opaque: true }\n\n  try {\n    const segment = token.split(\"--\")[0]\n    const json = atobUtf8(segment)\n    const parsed = JSON.parse(json)\n    const data = parsed && parsed._rails && parsed._rails.data ? parsed._rails.data : parsed\n    if (!data || typeof data !== \"object\") return { opaque: true }\n    return data\n  } catch {\n    return { opaque: true }\n  }\n}\n\n// base64 → string. Uses the platform atob; a malformed/urlsafe segment throws,\n// which decodeToken catches and reports as opaque.\nfunction atobUtf8(b64) {\n  const decode = globalThis.atob || ((s) => Buffer.from(s, \"base64\").toString(\"binary\"))\n  return decode(b64)\n}\n\n// The at-a-glance runtime state the controller stamps on the root. Names/flags\n// only — never a value that could be sensitive.\nfunction readStatus(el) {\n  return {\n    error: el.getAttribute(\"data-reactive-error\"),\n    busy: el.getAttribute(\"aria-busy\") === \"true\" || el.hasAttribute(\"data-reactive-busy\"),\n    dirty: el.hasAttribute(\"data-reactive-dirty\"),\n  }\n}\n\n// --- ownership scoping -----------------------------------------------------\n//\n// An element belongs to a root when its NEAREST reactive-root ancestor is that\n// root (matching the controller's own ownership walk). closest() finds the\n// nearest ancestor matching the selector; the element itself can be the root\n// (for a root that also carries a binding), so we start the walk from the\n// element and accept `el` as its own owner.\n\nconst ROOT_SELECTOR = '[data-controller~=\"reactive\"]'\n\nfunction ownedBy(node, root) {\n  return node.closest(ROOT_SELECTOR) === root\n}\n\n// Query `root` for `selector`, keeping only elements whose nearest reactive\n// root IS `root` — so a nested root's matches are excluded here and attributed\n// to that inner root instead.\nfunction scopedQuery(root, selector, allRoots) {\n  return Array.from(root.querySelectorAll(selector)).filter((node) => ownedBy(node, root))\n}\n\n// --- the binding families --------------------------------------------------\n\nfunction ownedTriggers(root, allRoots) {\n  return scopedQuery(root, \"[data-reactive-action-param]\", allRoots).map((el) => ({\n    action: el.getAttribute(\"data-reactive-action-param\"),\n    event: eventOf(el.getAttribute(\"data-action\")),\n    params: el.getAttribute(\"data-reactive-params-param\"),\n    debounce: el.getAttribute(\"data-reactive-debounce-param\"),\n    throttle: el.getAttribute(\"data-reactive-throttle-param\"),\n    confirm: el.getAttribute(\"data-reactive-confirm-param\"),\n    optimistic: el.getAttribute(\"data-reactive-optimistic-param\"),\n    loading: el.getAttribute(\"data-reactive-loading-param\"),\n  }))\n}\n\n// The Stimulus data-action descriptor is \"event->controller#method\"; the event\n// is the part before \"->\" (a bare \"controller#method\" has an implicit default\n// event, which we report as null).\nfunction eventOf(dataAction) {\n  if (!dataAction) return null\n  const arrow = dataAction.indexOf(\"->\")\n  return arrow === -1 ? null : dataAction.slice(0, arrow)\n}\n\n// Client-only op triggers ([data-reactive-ops-param]) — a menu toggle, a DOM op\n// chain that never round-trips. Report the parsed ops (names) when decodable.\nfunction ownedClientOps(root, allRoots) {\n  return scopedQuery(root, \"[data-reactive-ops-param]\", allRoots).map((el) => {\n    const raw = el.getAttribute(\"data-reactive-ops-param\")\n    let ops = raw\n    try {\n      ops = JSON.parse(raw)\n    } catch {\n      // leave the raw string — a malformed ops attr shouldn't break the scan\n    }\n    return { event: eventOf(el.getAttribute(\"data-action\")), ops }\n  })\n}\n\n// Compute reducers bound on this root ([data-reactive-compute-reducer-param]) —\n// the client-side data-binding twins of reactive_compute. Report reducer names.\nfunction ownedComputes(root, allRoots) {\n  return scopedQuery(root, \"[data-reactive-compute-reducer-param]\", allRoots).map((el) =>\n    el.getAttribute(\"data-reactive-compute-reducer-param\"),\n  )\n}\n\n// The named form controls the dispatch would collect and send — the same\n// selector the controller's field walk uses. Names only, never values.\nfunction ownedFields(root, allRoots) {\n  return scopedQuery(root, \"input[name], select[name], textarea[name]\", allRoots).map((el) =>\n    el.getAttribute(\"name\"),\n  )\n}\n\n// reactive_show bindings: which owned field controls each element's visibility.\nfunction ownedShow(root, allRoots) {\n  return scopedQuery(root, \"[data-reactive-show-field]\", allRoots).map((el) => ({\n    field: el.getAttribute(\"data-reactive-show-field\"),\n    equals: el.getAttribute(\"data-reactive-show-equals\"),\n    not: el.getAttribute(\"data-reactive-show-not\"),\n    in: el.getAttribute(\"data-reactive-show-in\"),\n  }))\n}\n\n// reactive_text spans (data-reactive-text=<name>) the client writes via\n// textContent — report the binding names.\nfunction ownedText(root, allRoots) {\n  return scopedQuery(root, \"[data-reactive-text]\", allRoots).map((el) =>\n    el.getAttribute(\"data-reactive-text\"),\n  )\n}\n\n// reactive_filter lives on the ROOT itself (the input/option/group/empty\n// selectors it narrows client-side). Null when the root declares no filter.\nfunction readFilter(el) {\n  const input = el.getAttribute(\"data-reactive-filter-input\")\n  if (!input) return null\n  return {\n    input,\n    option: el.getAttribute(\"data-reactive-filter-option\"),\n    group: el.getAttribute(\"data-reactive-filter-group\"),\n    empty: el.getAttribute(\"data-reactive-filter-empty\"),\n  }\n}\n"
+  ],
+  "mappings": "AA0BO,SAAS,CAAI,CAAC,EAAO,SAAU,CACpC,IAAM,EAAQ,MAAM,KAAK,EAAK,iBAAiB,+BAA+B,CAAC,EAC/E,OAAO,EAAM,IAAI,CAAC,IAAO,EAAY,EAAI,CAAK,CAAC,EAM1C,SAAS,CAAM,CAAC,EAAO,SAAU,CACtC,IAAM,EAAQ,EAAK,CAAI,EACjB,EAAU,WAAW,QAI3B,GAAI,GAAW,OAAO,EAAQ,MAAQ,WACpC,EAAQ,IAAI,oBAAoB,EAAM,yBAAyB,EAEjE,GAAI,GAAW,OAAO,EAAQ,QAAU,WACtC,EAAQ,MACN,EAAM,IAAI,CAAC,KAAO,CAChB,GAAI,EAAE,GACN,UAAW,EAAE,YAAc,EAAE,OAAS,iBAAmB,MACzD,QAAS,EAAE,SAAS,IAAI,CAAC,IAAM,EAAE,MAAM,EAAE,KAAK,IAAI,EAClD,OAAQ,EAAE,OAAO,KAAK,IAAI,EAC1B,SAAU,EAAE,SAAS,KAAK,IAAI,CAChC,EAAE,CACJ,EAEF,OAAO,EAKT,SAAS,CAAW,CAAC,EAAI,EAAU,CACjC,IAAM,EAAQ,EAAG,aAAa,2BAA2B,EACnD,EAAU,EAAY,CAAK,EAEjC,MAAO,CACL,GAAI,EAAG,IAAM,KACb,UAAW,EAAQ,OAAS,KAAQ,EAAQ,GAAK,KACjD,IAAK,EAAQ,KAAO,KACpB,UAAW,EAAQ,EAAI,OAAO,KAAK,EAAQ,CAAC,EAAI,CAAC,EACjD,aAAc,EAAQ,GAAK,KAC3B,OAAQ,CAAC,CAAC,EAAQ,OAClB,OAAQ,EAAW,CAAE,EACrB,SAAU,EAAc,EAAI,CAAQ,EACpC,UAAW,EAAe,EAAI,CAAQ,EACtC,SAAU,EAAc,EAAI,CAAQ,EACpC,OAAQ,EAAY,EAAI,CAAQ,EAChC,KAAM,EAAU,EAAI,CAAQ,EAC5B,KAAM,EAAU,EAAI,CAAQ,EAC5B,OAAQ,EAAW,CAAE,CACvB,EASF,SAAS,CAAW,CAAC,EAAO,CAC1B,GAAI,CAAC,EAAO,MAAO,CAAE,OAAQ,EAAK,EAElC,GAAI,CACF,IAAM,EAAU,EAAM,MAAM,IAAI,EAAE,GAC5B,EAAO,EAAS,CAAO,EACvB,EAAS,KAAK,MAAM,CAAI,EACxB,EAAO,GAAU,EAAO,QAAU,EAAO,OAAO,KAAO,EAAO,OAAO,KAAO,EAClF,GAAI,CAAC,GAAQ,OAAO,IAAS,SAAU,MAAO,CAAE,OAAQ,EAAK,EAC7D,OAAO,EACP,KAAM,CACN,MAAO,CAAE,OAAQ,EAAK,GAM1B,SAAS,CAAQ,CAAC,EAAK,CAErB,OADe,WAAW,OAAS,CAAC,IAAM,OAAO,KAAK,EAAG,QAAQ,EAAE,SAAS,QAAQ,IACtE,CAAG,EAKnB,SAAS,CAAU,CAAC,EAAI,CACtB,MAAO,CACL,MAAO,EAAG,aAAa,qBAAqB,EAC5C,KAAM,EAAG,aAAa,WAAW,IAAM,QAAU,EAAG,aAAa,oBAAoB,EACrF,MAAO,EAAG,aAAa,qBAAqB,CAC9C,EAWF,IAAM,EAAgB,gCAEtB,SAAS,CAAO,CAAC,EAAM,EAAM,CAC3B,OAAO,EAAK,QAAQ,CAAa,IAAM,EAMzC,SAAS,CAAW,CAAC,EAAM,EAAU,EAAU,CAC7C,OAAO,MAAM,KAAK,EAAK,iBAAiB,CAAQ,CAAC,EAAE,OAAO,CAAC,IAAS,EAAQ,EAAM,CAAI,CAAC,EAKzF,SAAS,CAAa,CAAC,EAAM,EAAU,CACrC,OAAO,EAAY,EAAM,+BAAgC,CAAQ,EAAE,IAAI,CAAC,KAAQ,CAC9E,OAAQ,EAAG,aAAa,4BAA4B,EACpD,MAAO,EAAQ,EAAG,aAAa,aAAa,CAAC,EAC7C,OAAQ,EAAG,aAAa,4BAA4B,EACpD,SAAU,EAAG,aAAa,8BAA8B,EACxD,SAAU,EAAG,aAAa,8BAA8B,EACxD,QAAS,EAAG,aAAa,6BAA6B,EACtD,WAAY,EAAG,aAAa,gCAAgC,EAC5D,QAAS,EAAG,aAAa,6BAA6B,CACxD,EAAE,EAMJ,SAAS,CAAO,CAAC,EAAY,CAC3B,GAAI,CAAC,EAAY,OAAO,KACxB,IAAM,EAAQ,EAAW,QAAQ,IAAI,EACrC,OAAO,IAAU,GAAK,KAAO,EAAW,MAAM,EAAG,CAAK,EAKxD,SAAS,CAAc,CAAC,EAAM,EAAU,CACtC,OAAO,EAAY,EAAM,4BAA6B,CAAQ,EAAE,IAAI,CAAC,IAAO,CAC1E,IAAM,EAAM,EAAG,aAAa,yBAAyB,EACjD,EAAM,EACV,GAAI,CACF,EAAM,KAAK,MAAM,CAAG,EACpB,KAAM,EAGR,MAAO,CAAE,MAAO,EAAQ,EAAG,aAAa,aAAa,CAAC,EAAG,KAAI,EAC9D,EAKH,SAAS,CAAa,CAAC,EAAM,EAAU,CACrC,OAAO,EAAY,EAAM,wCAAyC,CAAQ,EAAE,IAAI,CAAC,IAC/E,EAAG,aAAa,qCAAqC,CACvD,EAKF,SAAS,CAAW,CAAC,EAAM,EAAU,CACnC,OAAO,EAAY,EAAM,4CAA6C,CAAQ,EAAE,IAAI,CAAC,IACnF,EAAG,aAAa,MAAM,CACxB,EAIF,SAAS,CAAS,CAAC,EAAM,EAAU,CACjC,OAAO,EAAY,EAAM,6BAA8B,CAAQ,EAAE,IAAI,CAAC,KAAQ,CAC5E,MAAO,EAAG,aAAa,0BAA0B,EACjD,OAAQ,EAAG,aAAa,2BAA2B,EACnD,IAAK,EAAG,aAAa,wBAAwB,EAC7C,GAAI,EAAG,aAAa,uBAAuB,CAC7C,EAAE,EAKJ,SAAS,CAAS,CAAC,EAAM,EAAU,CACjC,OAAO,EAAY,EAAM,uBAAwB,CAAQ,EAAE,IAAI,CAAC,IAC9D,EAAG,aAAa,oBAAoB,CACtC,EAKF,SAAS,CAAU,CAAC,EAAI,CACtB,IAAM,EAAQ,EAAG,aAAa,4BAA4B,EAC1D,GAAI,CAAC,EAAO,OAAO,KACnB,MAAO,CACL,QACA,OAAQ,EAAG,aAAa,6BAA6B,EACrD,MAAO,EAAG,aAAa,4BAA4B,EACnD,MAAO,EAAG,aAAa,4BAA4B,CACrD",
+  "debugId": "DAD9B8F0F9C2105E64756E2164756E21",
+  "names": []
+}