@faqir-ui/core 1.0.0 → 1.1.1

package/README.md

@@ -12,10 +12,10 @@ any HTML file and you have a styled, interactive Faqir page. No build step, no i
 
 ```html
 <!-- 1. A theme's full CSS bundle (tokens + theme + base + every component) -->
-<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@faqir-ui/core@0.2/dist/faqir.default.css">
+<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@faqir-ui/core@1.1/dist/faqir.default.css">
 
 <!-- 2. The reactive engine — sets window.Faqir and auto-boots on DOMContentLoaded -->
-<script src="https://cdn.jsdelivr.net/npm/@faqir-ui/core@0.2/dist/faqir-core.min.js" defer></script>
+<script src="https://cdn.jsdelivr.net/npm/@faqir-ui/core@1.1/dist/faqir-core.min.js" defer></script>
 ```
 
 That's it. Now write Faqir markup:
@@ -38,10 +38,10 @@ for tamper-proof loads:
 
 ```html
 <link rel="stylesheet"
-      href="https://cdn.jsdelivr.net/npm/@faqir-ui/core@0.2/dist/faqir.default.css"
+      href="https://cdn.jsdelivr.net/npm/@faqir-ui/core@1.1/dist/faqir.default.css"
       integrity="sha384-…paste from sri.json…"
       crossorigin="anonymous">
-<script src="https://cdn.jsdelivr.net/npm/@faqir-ui/core@0.2/dist/faqir-core.min.js"
+<script src="https://cdn.jsdelivr.net/npm/@faqir-ui/core@1.1/dist/faqir-core.min.js"
         integrity="sha384-…paste from sri.json…"
         crossorigin="anonymous" defer></script>
 ```
@@ -54,9 +54,49 @@ for tamper-proof loads:
 | `faqir-core.js` | Canonical UMD engine — what `<script src>` and the CDN load. Reachable explicitly at `@faqir-ui/core/faqir-core.js`. |
 | `faqir-core.min.js` (+ `.map`) | Minified classic-script build; a plain `<script src>` sets `window.Faqir`. |
 | `faqir.{theme}.css` | Full CSS bundle per theme: all tokens + theme + base + every component. Self-contained (no `@import`). |
-| `plugins/` | Official self-registering drops: `faqir-persist`, `faqir-intersect`, `faqir-collapse`, and `faqir-validate`. |
+| `plugins/` | Official self-registering drops — see [Plugins](#plugins) below. |
 | `sri.json` | SHA-384 integrity hashes for every file above. |
 
+## Plugins
+
+Each file in `dist/plugins/` is a self-registering classic script: load it
+**after** the engine and it installs itself. Every one is dependency-free.
+
+| Plugin | Provides | What it does |
+|---|---|---|
+| `faqir-collapse.js` | `l-collapse` | height auto-animation for a boolean expression |
+| `faqir-intersect.js` | `l-intersect` | declarative IntersectionObserver hooks |
+| `faqir-mask.js` | `l-mask` | caret-safe input masking |
+| `faqir-persist.js` | `l-persist`, `$persist()` | localStorage-backed reactive state |
+| `faqir-rules.js` | `l-rules`, `$rules` | a form's conditional logic, from one JSON definition |
+| `faqir-validate.js` | `l-validate` | declarative + programmatic form validation |
+
+```html
+<script src="https://cdn.jsdelivr.net/npm/@faqir-ui/core@1.1/dist/faqir-core.min.js" defer></script>
+<script src="https://cdn.jsdelivr.net/npm/@faqir-ui/core@1.1/dist/plugins/faqir-validate.js" defer></script>
+<script src="https://cdn.jsdelivr.net/npm/@faqir-ui/core@1.1/dist/plugins/faqir-rules.js" defer></script>
+```
+
+One pairing to know: `faqir-rules` registers its cross-field and remote checks
+through `Faqir.validate.register`, so a definition carrying `validate` rules
+needs `faqir-validate` on the page too. That is a presence requirement, not a
+script order — every plugin installs before the engine boots — and a page
+missing one is told so rather than quietly skipping the checks.
+
+Pin the plugin drops the same way as the engine — their hashes are in
+`dist/sri.json` beside the rest:
+
+```html
+<script src="https://cdn.jsdelivr.net/npm/@faqir-ui/core@1.1/dist/plugins/faqir-rules.js"
+        integrity="sha384-…paste from sri.json…"
+        crossorigin="anonymous" defer></script>
+```
+
+`faqir-rules` is the browser half of
+[`@faqir-ui/rules`](https://www.npmjs.com/package/@faqir-ui/rules) — the same
+evaluator, bundled in, so the verdict in the page is the verdict on your server
+by construction. Install that package to re-check a submission server-side.
+
 ## Module usage
 
 The package is **ESM-only**. The default export is the engine; every member is

package/cdn.json

@@ -1,28 +1,44 @@
 {
   "package": "@faqir-ui/core",
-  "version": "1.0.0",
-  "base": "https://cdn.jsdelivr.net/npm/@faqir-ui/core@1.0.0/dist/",
+  "version": "1.1.1",
+  "base": "https://cdn.jsdelivr.net/npm/@faqir-ui/core@1.1.1/dist/",
   "integrity": {
-    "faqir-core.js": "sha384-vH2gsWr7R/OAJLvYeBC4txN6mleQzdRiuLsc5AH2xbdge5+zQipF5AqSJS7Yc4Vz",
-    "faqir-core.min.js": "sha384-BHt1gSursbCylX/U3FT6iW5dWukyZcjDXKWOanw4baYgwn8qj1LIpI1It8ct7CyK",
-    "faqir-core.min.js.map": "sha384-io5FkzZ1meZXs3UY/kEJkmvB8YXwO/JfezQe4yZop6KZZjjwn6UCjeDUSh0FG1sz",
-    "faqir-core.mjs": "sha384-jqsZ/HqqXSuUjt6SikvDjynm7EdDVAfVLXYSoJHjzvOF+3V5CDmEZgzXDJPWvQ4I",
-    "faqir.aurora.css": "sha384-M7yDwTC7MuWfGfiIFLv9MFibCkYDDSHx6RFszEQ7iyd4Lp/bEG/SIyRcvSsfn2Vv",
-    "faqir.brutalist.css": "sha384-aRtTqpJetmoMa6uL2krMPEHsjTwF11oNlTzS9zZrdtqXSvzkSUCKKoHyr1WbCBnb",
-    "faqir.contrast.css": "sha384-Fy3tZU7cwb7LGNm9B/5nFNK1yRgwAZqv+FF69pY/w6AEGykZA4jSoDeFKU4hXdBf",
-    "faqir.default.css": "sha384-w2sH1K7AwYMeLQIhxBnAU1LuRrexg/xJx/eLLMgAjG7avxLYhYeuvM2pTu1yJJVi",
-    "faqir.document-serif.css": "sha384-2xWhB1DahXndhbbk7D+RV6w1NI7lPoO3tPgVtDvgWp8G+qE4jjI5nCWZa0IC1XiV",
-    "faqir.document.css": "sha384-loA3uWvclgLBd8OntpB4YrQP/jBsLScb06KI61EMauFjYxOadmCszUBkYYNoo4Wc",
-    "faqir.glass.css": "sha384-OQOzZy8BxLxPl1pFNkCwizX0oqOsmPf49FKhFa4d9HUM6bcJrJnzw3XU8IZGqSkG",
-    "faqir.midnight.css": "sha384-J0SQyAklYwD+yJ7jubtIJ+0t9DWBymcJikhI242PpTvzAL9SU4iWTYCwJBqSUbj0",
-    "faqir.paper.css": "sha384-OCmkztWvVBgacdb9HlGiRl+RRQ1QaFU8MCrQIYLeL17EMsT2tG8lZeU0mfQKLo6N",
-    "faqir.slate.css": "sha384-BxHSyxsLdi690Q1LBWIyAXodugjLNT764ZjqBRAaCtAaQeei81qzV46C5rMYonb4",
-    "faqir.soft.css": "sha384-a77S0Tcfd1I2V+r6Prt4gTtIzSZahltCuQ0jEzOKXUd+taDRjM0EsIy3n5VycLJT",
-    "faqir.terminal.css": "sha384-YvP4CkNUhcsFYJjBgnhcSMthsEheRg2RlZ0837GBzDVfmeJx9IYpMSrG7BkAb697",
-    "plugins/faqir-collapse.js": "sha384-y16PnFkcJiJLQIxuQMtdS+QalrC6lJ0EsPT/oceZWpLMGdqASXq3HhVHebfUWktm",
-    "plugins/faqir-intersect.js": "sha384-AfbB6icyS1ngl1JdiAMZ9//m5lHTMdgXXHWCdi5INfE9FmLbYRUeiyKTv4E4g6ri",
-    "plugins/faqir-mask.js": "sha384-cSq2DpUnoJCxEDAQjsbzAa+jSuHf4WsOaKT8t7b9p8pA7MaaRhA1DLzjMNChSa/I",
+    "faqir-core.js": "sha384-ypj/JvdM2DNbSf7TIOUBlbV3kKw3JE0YuKDPkDuroqFt8H/jB2O80j0rUa/s8N9l",
+    "faqir-core.min.js": "sha384-+0VjcV+UV4XDD6Y5YZ+yJG9qiwlcZRr+LgT6uVspQgw4ynLLzyNKrDc6HDvo6uiM",
+    "faqir-core.min.js.map": "sha384-3NMITzrdJEWU6VH6d64NSzEhMGdilUMAqm7tG37R9mq1oQcbiifI7azkysTVSK/a",
+    "faqir-core.mjs": "sha384-bFYiYI3mnO3fluPZh14FGac4ZgBXPEfENyv+/ewSMHNyataamJyDJYENbGaXnV8t",
+    "faqir.aurora.css": "sha384-TrPBHGXGxwY6sLypt3kbjbhEHz87wsYgqQhzPqi5zghmsiqewgykQx6aS+WP2O0h",
+    "faqir.brutalist.css": "sha384-N/VfEAEdOZ2PGFX4xsPzlHEmDkXtjzmkXXW1Ta3PCtBV/RZm1rF4EYsfwLEvwqPZ",
+    "faqir.candy.css": "sha384-/lk9HAr46O2pYwsM8vE8MBVkPLB1t2otA3Edfux98b564DvNkWqpsD4DSVdcmHAX",
+    "faqir.clinical.css": "sha384-quTFS0lcUB0sz5ysan8vVX75oBDNzY+of7CmKDEoX5fM5OCIbYEttiZ8eLL/vQ4u",
+    "faqir.contrast.css": "sha384-Kkc5S9mDWhATTvHHfZhNd+rN06hSCvbKLuqa5y+cwtvlF7jSunMH1bLkfrZsVw5f",
+    "faqir.default.css": "sha384-bbc2p6aV7UYxrmv8M6x0buppf4uT7yh8DZ9d///ykZjXQokcZNtOk6xK1UUl6Mnj",
+    "faqir.document-serif.css": "sha384-gruBhX1KhlPRKzCVMODRBoOB+IpJM3lgYB+xQgCbu35onXyy+OFvh0MBDThrRFSq",
+    "faqir.document.css": "sha384-oC4VnHJi2ez8nAPSBwN4GWOz+BraAWcXXcGjNrQmdKujuA3fVmawKwolH1zIEzT0",
+    "faqir.editorial-document.css": "sha384-sKWLbBQ4IvgSvhLYo0nE95l6pqku+T0VTmkkoTwg/YOx5vM9gBAPA7f6CLE8gLNa",
+    "faqir.editorial.css": "sha384-N5sYSpAAOB81nDI+eShZ+gTZ5zbTMwaUt9fIPxwiNWBkKdaEJnsvyP3na/2SyNbv",
+    "faqir.fintech.css": "sha384-xY6baIhCB0boozwIAPzhPg2FFZ8RhqSf/13CWeda9Bd+9D5bvZbNuiFcO67GGLOL",
+    "faqir.glass.css": "sha384-MW9qUMfNSCgUyQjY/UqCpRxsXxuDEoVFvvpLy2htmV1Vc2mtn/z7uCXscj6Yn5zq",
+    "faqir.ink-document.css": "sha384-uWhbYEZwSDk3QHPMWe7lzYM0HELolHkW8xyqoowVvXrToqTXnSYVw7zTVET3kTVC",
+    "faqir.ink.css": "sha384-57zpUenZ+vVG/PViYuf1yxB0VxdV/5hxhZbKy9vi8XawKTMpbbU7AtnvgZ81ZIvs",
+    "faqir.luxe.css": "sha384-AP+OFzUaZ0RNEOGS95dsf09tD8ltts0VslqgCyaJ3CBHHkesKJ+/MT3SA4gZPxbe",
+    "faqir.midnight.css": "sha384-xsSMTT7Pf9i0CDFfx5hlzCBkHx5gsfORYS3rZuKnasgMkHumNUsy0fTBFcHBxSo3",
+    "faqir.neo.css": "sha384-rNHNMTeReWOmjhAayIam2CSmH3cUpHI3VbCOxg1hhk0GE3pAB2GX6tqzXH8OU9kX",
+    "faqir.neumorph.css": "sha384-7N6RHoYWSlnTHeTwVWrCn4ey1KR62fsAS0p1QVyb0gcljIYhcMWADZrmH/hOjhx+",
+    "faqir.nordic.css": "sha384-A/O40XHz2mMUs3tKWT7usnwgAxSsdFpb8uXKNMtoIa3OBaR2Ibpqg5mGNov90PaT",
+    "faqir.organic.css": "sha384-acTW5ka4Zy5SXHHn1My078WAnPkj6/KbLHKuWzToArB8rWlwZGRqlFxfq8VNAaqY",
+    "faqir.paper.css": "sha384-O26GS1gp6lFBZmollq/g21aUGVoWixAfBEsFxhWzPif1X2ZrjeXyIOEmCn25R1Dz",
+    "faqir.slate.css": "sha384-lSeSUhJCMUsQxM1oS2AbeqbfdLzquz4zYDYSF1N2bpA4JC0g/7fcJA/lWvkZugyq",
+    "faqir.soft.css": "sha384-G7xaO/Rr9RdMdBch66kUiS+atQOluVXhwIb039G7WJg6KvAxDBSbA/7v8y9ouhZH",
+    "faqir.sunset.css": "sha384-7FyjK1RJrkGTvOSFLH15WiRI1i8V3bbfpUuv4Gq3stG1NwC56/JkXOH4uPscY95b",
+    "faqir.swiss-document.css": "sha384-hQKtiQvaCu9ot5TJnCIlPjZhUJif5cacuE27IvJi1j99iF9HuNOvfGp+epSzJlMT",
+    "faqir.swiss.css": "sha384-Ki39mfAWeHD1KRjAB07b4MygOk5swzXSp5sUKcTWldXuiNhpNTWo+vOeponF4yfB",
+    "faqir.terminal.css": "sha384-EE2EAqi6sG4GTe8l+7w0p8gqCjZu8A+dkfNFCx90Ue/loSNUSnLIYDqdAsApyOOR",
+    "plugins/faqir-collapse.js": "sha384-3l5Z+isXlDkidRevDGkuNOiDp6eJ2ML11RkXA0j4ixQBaepuu8pAhyY4YRnR1qB7",
+    "plugins/faqir-intersect.js": "sha384-Q/akZjAcnTnGYPKBP7b8c3iyYbHTIW1IPjBivzOH9dE7Nflr9Cu6adjeDXU2bhk6",
+    "plugins/faqir-mask.js": "sha384-7yA/VdjGdg/6vwX+zUbughO6ERyV2rEsVyNYBO5ghqJbAhj9912F9qMPTkLc55B6",
     "plugins/faqir-persist.js": "sha384-o0jfddebC8QZ3S26VXUlOme723BNMlb/N7vqpn+fWpSeEFXzpq+3MoeXhVL/0PSv",
-    "plugins/faqir-validate.js": "sha384-DSzQ7I94Qm+VKjpgBo3qgALyuU3zgQZ+jXOIqgRHkJ6utr8nqF7tQMKWnOv1/YH2"
+    "plugins/faqir-rules.js": "sha384-xE90r5W3AlWKu+idcwx6NAkVUcRWMgM9ZJ1VgJLOguj/0GYP0jfflCojiCWt4FVq",
+    "plugins/faqir-validate.js": "sha384-TIyGNL8dHBnFdV56LAhdklvhQLsClQqGuQ7DT0Zgxva8DIzfONXZSJYTXhQxJcN0"
   }
 }

package/dist/faqir-core.js

@@ -10,11 +10,11 @@
 // PRODUCTION BUILD — dev-only diagnostics stripped at assembly time.
 // Load faqir-core.dev.js instead while developing for full warnings.
 // Regenerate with: bun run build:core
-// Package version: 1.0.0
+// Package version: 1.1.1
 // ============================================================================
 
 /**
- * Faqir Core v0.1.0
+ * Faqir Core — the running version is `Faqir.version` (stamped at build time).
  * Alpine-style reactivity for the Faqir UI component system.
  * Zero dependencies. CDN-ready. Agent-native.
  *
@@ -176,7 +176,11 @@
     flushScheduled = false;
     var iterations = 0;
     while (pendingEffects.size > 0) {
+      // Effects that keep re-triggering each other (a writes b, b writes a)
+      // would loop forever. The cap stops that, but dropping work silently
+      // hides the bug, so it is reported in every build.
       if (++iterations > 100) {
+        console.warn('[Faqir] Effect loop: dropped ' + pendingEffects.size + ' effect(s) after 100 flushes; effects keep re-triggering each other');
         pendingEffects.clear();
         break;
       }
@@ -917,6 +921,16 @@
     function signalOf(ac) {
       return ac ? ac.signal : undefined;
     }
+    // Where a row is NOW — `row` by identity, else the row whose idKey is `id`.
+    // Never an index saved before the request: an interleaved load()/remove()
+    // shifts or replaces the list, and a stale index writes over a real row.
+    function locate(id, row) {
+      var items = scope[name];
+      for (var i = 0; i < items.length; i++) {
+        if (row ? items[i] === row : items[i] && items[i][idKey] === id) return i;
+      }
+      return -1;
+    }
 
     // Inject reactive data properties into scope
     scope[name] = [];
@@ -959,12 +973,12 @@
       create: function(payload) {
         if (destroyed) return Promise.resolve(null);
         scope[name + 'Error'] = null;
-        var tempIndex = -1;
+        var temp = null;
 
         if (isOptimistic) {
-          var temp = Object.assign({}, payload, { _pending: true });
-          scope[name].push(temp);
-          tempIndex = scope[name].length - 1;
+          scope[name].push(Object.assign({}, payload, { _pending: true }));
+          // Read back through the list: that is the handle `locate` compares.
+          temp = scope[name][scope[name].length - 1];
         }
 
         var ac = beginRequest();
@@ -981,9 +995,12 @@
         .then(function(created) {
           endRequest(ac);
           if (destroyed) return null;
-          if (isOptimistic && tempIndex >= 0) {
-            scope[name][tempIndex] = created;
-          } else {
+          var at = temp ? locate(null, temp) : -1;
+          if (at >= 0) {
+            scope[name][at] = created;
+          } else if (!temp || !created || created[idKey] == null || locate(created[idKey]) < 0) {
+            // The temp row is gone when a load() replaced the list meanwhile;
+            // that list may already hold the created row.
             scope[name].push(created);
           }
           return created;
@@ -992,9 +1009,8 @@
           endRequest(ac);
           if (destroyed) return null;
           scope[name + 'Error'] = e.message;
-          if (isOptimistic && tempIndex >= 0) {
-            scope[name].splice(tempIndex, 1);
-          }
+          var at = temp ? locate(null, temp) : -1;
+          if (at >= 0) scope[name].splice(at, 1);
           return null;
         });
       },
@@ -1003,10 +1019,7 @@
         if (destroyed) return Promise.resolve(null);
         scope[name + 'Error'] = null;
         var items = scope[name];
-        var idx = -1;
-        for (var i = 0; i < items.length; i++) {
-          if (items[i][idKey] === id) { idx = i; break; }
-        }
+        var idx = locate(id);
         var snapshot = null;
 
         if (isOptimistic && idx >= 0) {
@@ -1015,7 +1028,7 @@
         }
 
         var ac = beginRequest();
-        return fetch(endpoint + '/' + id, {
+        return fetch(endpoint + '/' + encodeURIComponent(id), {
           method: 'PATCH',
           headers: { 'Content-Type': 'application/json' },
           body: JSON.stringify(payload),
@@ -1028,16 +1041,16 @@
         .then(function(updated) {
           endRequest(ac);
           if (destroyed) return null;
-          if (idx >= 0) scope[name][idx] = updated;
+          var at = locate(id);
+          if (at >= 0) scope[name][at] = updated;
           return updated;
         })
         .catch(function(e) {
           endRequest(ac);
           if (destroyed) return null;
           scope[name + 'Error'] = e.message;
-          if (isOptimistic && snapshot && idx >= 0) {
-            scope[name][idx] = snapshot;
-          }
+          var at = snapshot ? locate(id) : -1;
+          if (at >= 0) scope[name][at] = snapshot;
           return null;
         });
       },
@@ -1046,10 +1059,7 @@
         if (destroyed) return Promise.resolve();
         scope[name + 'Error'] = null;
         var items = scope[name];
-        var idx = -1;
-        for (var i = 0; i < items.length; i++) {
-          if (items[i][idKey] === id) { idx = i; break; }
-        }
+        var idx = locate(id);
         var snapshot = null;
 
         if (isOptimistic && idx >= 0) {
@@ -1058,20 +1068,20 @@
         }
 
         var ac = beginRequest();
-        return fetch(endpoint + '/' + id, { method: 'DELETE', signal: signalOf(ac) })
+        return fetch(endpoint + '/' + encodeURIComponent(id), { method: 'DELETE', signal: signalOf(ac) })
         .then(function(res) {
           if (!res.ok) throw new Error(res.status + ' ' + res.statusText);
           endRequest(ac);
           if (destroyed) return;
-          if (!isOptimistic && idx >= 0) {
-            scope[name].splice(idx, 1);
-          }
+          var at = isOptimistic ? -1 : locate(id);
+          if (at >= 0) scope[name].splice(at, 1);
         })
         .catch(function(e) {
           endRequest(ac);
           if (destroyed) return;
           scope[name + 'Error'] = e.message;
-          if (isOptimistic && snapshot) {
+          // `idx` is only a position hint here; skip if a reload restored it.
+          if (snapshot && locate(id) < 0) {
             scope[name].splice(idx, 0, snapshot);
           }
         });
@@ -1600,14 +1610,11 @@
       });
 
       var inputHandler = function() {
+        // Trim first: `.number.trim` must not call trim() on the parsed number.
         var value = el.value;
-        if (modifiers.has('number')) value = parseFloat(value) || 0;
         if (modifiers.has('trim')) value = value.trim();
-        if (typeof value === 'number') {
-          writeModel(prop, value, scope, el);
-        } else {
-          writeModel(prop, value, scope, el);
-        }
+        if (modifiers.has('number')) value = parseFloat(value) || 0;
+        writeModel(prop, value, scope, el);
       };
 
       if (modifiers.has('debounce')) {
@@ -1904,12 +1911,17 @@
       // rebinds per-row DOM state to the wrong items. Once per list; keyed lists
       // never reach here. Production neither warns nor snapshots the list.
 
-      // old key -> entry, consumed as matched so duplicate keys fall through to
-      // fresh nodes and leftovers are stale. source[i] = reused entry's old
-      // position + 1, or 0 for a fresh entry (the getSequence sentinel).
+      // old key -> entries holding it, in order, consumed as matched; the
+      // leftovers are stale. A list rather than one entry because keys can
+      // repeat: a Map of single entries overwrote the first row of a duplicate
+      // pair, which then was neither reused nor removed and leaked a row per
+      // render. source[i] = reused entry's old position + 1, or 0 for a fresh
+      // entry (the getSequence sentinel).
       var oldMap = new Map();
       for (var i = 0; i < currentEntries.length; i++) {
-        oldMap.set(currentEntries[i].key, currentEntries[i]);
+        var k = currentEntries[i].key;
+        if (oldMap.has(k)) oldMap.get(k).push(currentEntries[i]);
+        else oldMap.set(k, [currentEntries[i]]);
       }
 
       var n = items.length;
@@ -1917,9 +1929,9 @@
       var source = new Array(n);
       for (var i = 0; i < n; i++) {
         var key = keyFor(items[i], i);
-        var entry = oldMap.get(key);
+        var olds = oldMap.get(key);
+        var entry = olds && olds.shift();
         if (entry !== undefined) {
-          oldMap.delete(key);
           // Reuse in place: one write per slot, re-renders only on change.
           entry.scope[itemName] = items[i];
           entry.scope[indexName] = i;
@@ -1932,10 +1944,12 @@
       }
 
       // Remove stale entries first so the DOM holds only reused nodes.
-      oldMap.forEach(function(stale) {
-        for (var j = 0; j < stale.nodes.length; j++) {
-          destroyScope(stale.nodes[j]);
-          stale.nodes[j].remove();
+      oldMap.forEach(function(olds) {
+        for (var e = 0; e < olds.length; e++) {
+          for (var j = 0; j < olds[e].nodes.length; j++) {
+            destroyScope(olds[e].nodes[j]);
+            olds[e].nodes[j].remove();
+          }
         }
       });
 
@@ -4400,13 +4414,17 @@ function createDialog(root) {
   let cancelExitWait = null;
 
   function open() {
+    // A second open() (trigger plus an external trigger, say) must not stack
+    // another focus trap or overwrite the focus to restore on close.
+    if (root.dataset.state === "open" && focusCleanup) return;
     cancelExitWait?.();
     cancelExitWait = null;
-    previouslyFocused = document.activeElement;
+    // Re-opened mid-exit: the trap and the focus to restore are still live.
+    if (!focusCleanup) previouslyFocused = document.activeElement;
     root.dataset.state = "open";
     overlay.hidden = false;
     panel.hidden = false;
-    focusCleanup = trapFocus(panel);
+    if (!focusCleanup) focusCleanup = trapFocus(panel);
     focusInitial();
   }
 
@@ -10455,7 +10473,8 @@ function createToastContainer(root) {
    */
   function dismiss(id) {
     const entry = toasts.get(id);
-    if (!entry) return;
+    // Already exiting (close clicked while the timer fires, say): one exit wait.
+    if (!entry || entry.cancelExitWait) return;
 
     const { el, timer, closeBtn, onCloseClick, actionBtn, onActionClick } = entry;
 
@@ -11541,7 +11560,18 @@ function createTreeView(root) {
      * Diagnostics recorded so far, oldest first. Always an array: the
      * production engine records nothing, so it is always empty there.
      */
-    warnings: function() { return devHooks ? devHooks.warnings() : []; }
+    warnings: function() { return devHooks ? devHooks.warnings() : []; },
+    /**
+     * Record one diagnostic on a plugin's behalf. The dev build prints it and
+     * keeps it in `warnings()` (deduped like every other); production does
+     * nothing and answers `false`. A plugin is a separate file with no reach
+     * into this seam's other side, so without it a plugin can only be silent
+     * or noisy in a shipped page — and "silent" is what the contract forbids.
+     * [1.1B-03]
+     */
+    report: function(message, el) {
+      return false;
+    }
   };
 
 
@@ -11602,7 +11632,7 @@ function createTreeView(root) {
       // to call `start()` again. [W3-1]
       if (rootEl.__faqirScope) {
         processed.add(rootEl);
-        var seen = rootEl.querySelectorAll('[l-data]');
+        var seen = rootEl.querySelectorAll('[l-data], [data-ui]');
         for (var sd = 0; sd < seen.length; sd++) processed.add(seen[sd]);
         continue;
       }
@@ -11634,7 +11664,13 @@ function createTreeView(root) {
 
       if (!skipThis) {
         initTree(rootEl, null);
-        var descendants = rootEl.querySelectorAll('[l-data]');
+        // `initTree` walked the whole subtree, so every root candidate inside it
+        // — nested `[l-data]` scopes AND nested `[data-ui]` components — is
+        // bound already. Claiming only the `[l-data]` ones left a `[data-ui]`
+        // inside a standalone `[data-ui]` looking standalone too: it became a
+        // root of its own and re-bound its subtree, so a button four components
+        // deep fired its `@click` four times.
+        var descendants = rootEl.querySelectorAll('[l-data], [data-ui]');
         for (var d = 0; d < descendants.length; d++) processed.add(descendants[d]);
         processed.add(rootEl);
       }
@@ -11688,7 +11724,14 @@ function createTreeView(root) {
             initController(uiName, node);
           }
 
-          if (node.hasAttribute && node.hasAttribute('l-data')) {
+          // Already initialized — by `Faqir.start()` / `Faqir.initTree()` in the
+          // same task that inserted it (the record is only delivered on the
+          // next microtask), or by the l-for / l-if render that stamped it.
+          // Re-running `initTree` would build a second scope and bind every
+          // directive twice — the same guard `bootstrap` applies. [1.1A-23]
+          if (node.__faqirScope) {
+            // fall through to the descendant sweep below
+          } else if (node.hasAttribute && node.hasAttribute('l-data')) {
             initTree(node, findParentScope(node));
           } else if (node.hasAttribute && node.hasAttribute('data-ui') && !findParentScope(node)) {
             // Standalone data-ui (no parent scope) — create its own scope
@@ -11729,14 +11772,35 @@ function createTreeView(root) {
   }
 
   // Auto-start logic
+  //
+  // `data-manual` opts out. A classic script is its own `currentScript`; a
+  // module (or anything a bundler emitted) has none, so there the attribute is
+  // honoured on the page's module `<script>` instead.
   var currentScript = typeof document !== 'undefined' ? document.currentScript : null;
-  var isManual = currentScript && currentScript.hasAttribute('data-manual');
+  var isManual = currentScript
+    ? currentScript.hasAttribute('data-manual')
+    : typeof document !== 'undefined' && !!document.querySelector('script[type="module"][data-manual]');
+
+  // Once the document is parsed — always true for a module, a `defer` script
+  // or a bundler import — booting right here ran before the importing code
+  // got past its `import`, so every `Faqir.data()` / `Faqir.directive()` it
+  // registered next was never seen. The boot waits one task instead: long
+  // enough for the rest of the module graph and any `import().then(...)`, and
+  // `DOMContentLoaded` still wins if it has not fired yet. `bootstrap` is
+  // re-entry safe, so an explicit `Faqir.start()` before then costs nothing.
+  var autoStarted = false;
+  function autoStart() {
+    if (autoStarted) return;
+    autoStarted = true;
+    bootstrap();
+  }
 
   if (!isManual && typeof document !== 'undefined') {
     if (document.readyState === 'loading') {
-      document.addEventListener('DOMContentLoaded', bootstrap);
+      document.addEventListener('DOMContentLoaded', autoStart);
     } else {
-      bootstrap();
+      if (document.readyState === 'interactive') document.addEventListener('DOMContentLoaded', autoStart);
+      setTimeout(autoStart, 0);
     }
   }
 
@@ -11750,7 +11814,7 @@ function createTreeView(root) {
     // one time it was hand-maintained (0.1.0 in a package versioned 0.2.4), so
     // the built artifact is now the only place the number is authoritative and
     // the build fails if this marker goes missing.
-    version: '1.0.0', // @faqir:version
+    version: '1.1.1', // @faqir:version
     reactive: reactive,
     effect: effect,
     batch: batch,