@livenetworks/ashlar 1.5.1 → 1.6.1

package/js/ln-accordion/ln-accordion.js

@@ -1 +1 @@
-(function(){"use strict";function O(e,t,n){e.dispatchEvent(new CustomEvent(t,{bubbles:!0,detail:n||{}}))}function x(e,t){if(!document.body){document.addEventListener("DOMContentLoaded",function(){x(e,t)}),console.warn("["+t+'] Script loaded before <body> — add "defer" to your <script> tag');return}e()}function h(e,t,n,i){if(e.nodeType!==1)return;const u=t.indexOf("[")!==-1||t.indexOf(".")!==-1||t.indexOf("#")!==-1?t:"["+t+"]",d=Array.from(e.querySelectorAll(u));e.matches&&e.matches(u)&&d.push(e);for(const r of d)r[n]||(r[n]=new i(r))}function E(e,t,n,i,c={}){const u=c.extraAttributes||[],d=c.onAttributeChange||null,r=c.onInit||null;function g(m){const f=m||document.body;h(f,e,t,n),r&&r(f)}return x(function(){const m=new MutationObserver(function(p){for(let l=0;l<p.length;l++){const o=p[l];if(o.type==="childList"){for(let a=0;a<o.addedNodes.length;a++){const s=o.addedNodes[a];s.nodeType===1&&(h(s,e,t,n),r&&r(s))}for(let a=0;a<o.removedNodes.length;a++){const s=o.removedNodes[a];if(s.nodeType===1){const v=e.indexOf("[")!==-1||e.indexOf(".")!==-1||e.indexOf("#")!==-1?e:"["+e+"]",y=Array.from(s.querySelectorAll(v));s.matches&&s.matches(v)&&y.push(s);for(let b=0;b<y.length;b++){const C=y[b];if(!document.contains(C)){const w=C[t];w&&typeof w.destroy=="function"&&w.destroy()}}}}}else o.type==="attributes"&&(d&&o.target[t]?d(o.target,o.attributeName):(h(o.target,e,t,n),r&&r(o.target)))}});let f=[];if(e.indexOf("[")!==-1){const p=/\[([\w-]+)/g;let l;for(;(l=p.exec(e))!==null;)f.push(l[1])}else f.push(e);m.observe(document.body,{childList:!0,subtree:!0,attributes:!0,attributeFilter:f.concat(u)})},i),window[t]=g,document.readyState==="loading"?document.addEventListener("DOMContentLoaded",function(){g(document.body)}):g(document.body),g}const A={};function M(e,t){A[e]=t}function L(e){return A[e]||{ingress:t=>t,egress:t=>t}}typeof window<"u"&&(window.lnCore=window.lnCore||{},window.lnCore.registerDataMapper=M,window.lnCore.getDataMapper=L),(function(){const e="data-ln-accordion",t="lnAccordion";if(window[t]!==void 0)return;function n(i){return this.dom=i,this._onToggleOpen=function(c){if(c.detail.target.closest("[data-ln-accordion]")!==i)return;const u=i.querySelectorAll("[data-ln-toggle]");for(const d of u)d!==c.detail.target&&d.closest("[data-ln-accordion]")===i&&d.getAttribute("data-ln-toggle")==="open"&&d.setAttribute("data-ln-toggle","close");O(i,"ln-accordion:change",{target:c.detail.target})},i.addEventListener("ln-toggle:open",this._onToggleOpen),this}n.prototype.destroy=function(){this.dom[t]&&(this.dom.removeEventListener("ln-toggle:open",this._onToggleOpen),O(this.dom,"ln-accordion:destroyed",{target:this.dom}),delete this.dom[t])},E(e,t,n,"ln-accordion")})()})();
+(function(){"use strict";if(typeof window<"u"){const t=console.warn;console.warn=function(...e){typeof e[0]=="string"&&(e[0].startsWith("[ln-")||e[0].startsWith("[lnCore"))&&!(document.documentElement.hasAttribute("data-ln-debug")||document.body&&document.body.hasAttribute("data-ln-debug"))||t.apply(console,e)}}const w={};function D(t,e){w[t]||(w[t]=document.querySelector('[data-ln-template="'+t+'"]'));const o=w[t];return o?o.content.cloneNode(!0):(console.warn("["+(e||"ln-core")+'] Template "'+t+'" not found'),null)}function x(t,e,o){t.dispatchEvent(new CustomEvent(e,{bubbles:!0,detail:o||{}}))}function L(t,e){if(!t||!e)return t;const o=t.querySelectorAll("[data-ln-field]");for(let n=0;n<o.length;n++){const i=o[n],l=i.getAttribute("data-ln-field");e[l]!=null&&(i.textContent=e[l])}const s=t.querySelectorAll("[data-ln-attr]");for(let n=0;n<s.length;n++){const i=s[n],l=i.getAttribute("data-ln-attr").split(",");for(let c=0;c<l.length;c++){const a=l[c].trim().split(":");if(a.length!==2)continue;const u=a[0].trim(),f=a[1].trim();e[f]!=null&&i.setAttribute(u,e[f])}}const d=t.querySelectorAll("[data-ln-show]");for(let n=0;n<d.length;n++){const i=d[n],l=i.getAttribute("data-ln-show");l in e&&i.classList.toggle("hidden",!e[l])}const r=t.querySelectorAll("[data-ln-class]");for(let n=0;n<r.length;n++){const i=r[n],l=i.getAttribute("data-ln-class").split(",");for(let c=0;c<l.length;c++){const a=l[c].trim().split(":");if(a.length!==2)continue;const u=a[0].trim(),f=a[1].trim();f in e&&i.classList.toggle(u,!!e[f])}}return t}function M(t,e){t.matches&&t.matches("[data-ln-form], [data-ln-fillable]")&&t.dispatchEvent(new CustomEvent("ln-fill",{detail:e??null,bubbles:!0}));const o=t.querySelectorAll("[data-ln-form], [data-ln-fillable]");for(let s=0;s<o.length;s++)o[s].dispatchEvent(new CustomEvent("ln-fill",{detail:e??null,bubbles:!0}));return t}typeof window<"u"&&(window.lnCore=window.lnCore||{},window.lnCore._fillBound||(window.lnCore._fillBound=!0,document.addEventListener("ln-fill",function(t){if(!(!t.target.matches||!t.target.matches("[data-ln-fillable]")))if(t.detail)L(t.target,t.detail);else{const e=t.target.querySelectorAll("[data-ln-field]");for(let o=0;o<e.length;o++)e[o].textContent=""}})));function v(t,e){if(!t||!e)return t;const o=document.createTreeWalker(t,NodeFilter.SHOW_TEXT);for(;o.nextNode();){const r=o.currentNode;r.textContent.indexOf("{{")!==-1&&(r.textContent=r.textContent.replace(/\{\{\s*(\w+)\s*\}\}/g,function(n,i){return e[i]!==void 0?e[i]:""}))}const s=function(r,n){return e[n]!==void 0?e[n]:""},d=Array.from(t.querySelectorAll("*"));t.nodeType===1&&d.push(t);for(let r=0;r<d.length;r++){const n=d[r],i=n.attributes;for(let l=0;l<i.length;l++){const c=i[l];c.value.indexOf("{{")!==-1&&n.setAttribute(c.name,c.value.replace(/\{\{\s*(\w+)\s*\}\}/g,s))}}return t}function N(t,e,o,s,d,r){const n={};for(let l=0;l<t.children.length;l++){const c=t.children[l],a=c.getAttribute("data-ln-key");a&&(n[a]=c)}const i=document.createDocumentFragment();for(let l=0;l<e.length;l++){const c=e[l],a=String(s(c));let u=n[a];if(u)d(u,c,l);else{const f=D(o,r);if(!f||(v(f,c),u=f.firstElementChild,!u))continue;u.setAttribute("data-ln-key",a),d(u,c,l)}i.appendChild(u)}t.textContent="",t.appendChild(i)}function O(t,e){if(!document.body){document.addEventListener("DOMContentLoaded",function(){O(t,e)}),console.warn("["+e+'] Script loaded before <body> — add "defer" to your <script> tag');return}t()}function m(t,e,o,s){if(t.nodeType!==1)return;const r=e.indexOf("[")!==-1||e.indexOf(".")!==-1||e.indexOf("#")!==-1?e:"["+e+"]",n=Array.from(t.querySelectorAll(r));t.matches&&t.matches(r)&&n.push(t);for(const i of n)i[o]||(i[o]=new s(i))}function j(t,e,o,s,d={}){const r=d.extraAttributes||[],n=d.onAttributeChange||null,i=d.onInit||null;function l(c){const a=c||document.body;m(a,t,e,o),i&&i(a)}return O(function(){const c=new MutationObserver(function(u){for(let f=0;f<u.length;f++){const h=u[f];if(h.type==="childList"){for(let g=0;g<h.addedNodes.length;g++){const p=h.addedNodes[g];p.nodeType===1&&(m(p,t,e,o),i&&i(p))}for(let g=0;g<h.removedNodes.length;g++){const p=h.removedNodes[g];if(p.nodeType===1){const _=t.indexOf("[")!==-1||t.indexOf(".")!==-1||t.indexOf("#")!==-1?t:"["+t+"]",b=Array.from(p.querySelectorAll(_));p.matches&&p.matches(_)&&b.push(p);for(let C=0;C<b.length;C++){const q=b[C];if(!document.contains(q)){const A=q[e];A&&typeof A.destroy=="function"&&A.destroy()}}}}}else h.type==="attributes"&&(n&&h.target[e]?n(h.target,h.attributeName):(m(h.target,t,e,o),i&&i(h.target)))}});let a=[];if(t.indexOf("[")!==-1){const u=/\[([\w-]+)/g;let f;for(;(f=u.exec(t))!==null;)a.push(f[1])}else a.push(t);c.observe(document.body,{childList:!0,subtree:!0,attributes:!0,attributeFilter:a.concat(r)})},s),window[e]=l,document.readyState==="loading"?document.addEventListener("DOMContentLoaded",function(){l(document.body)}):l(document.body),l}const S={};function W(t,e){S[t]=e}function F(t){return S[t]||{ingress:e=>e,egress:e=>e}}const E={};function T(t,e){if(!t||typeof e!="object")return;const o=t.toLowerCase().split("-")[0];E[o]=e}function B(t){if(!t)return null;const e=t.toLowerCase().split("-")[0];return E[e]||null}T("mk",{monthsLong:["јануари","февруари","март","април","мај","јуни","јули","август","септември","октомври","ноември","декември"],monthsShort:["јан","фев","мар","апр","мај","јун","јул","авг","септ","окт","ноем","дек"],daysLong:["недела","понеделник","вторник","среда","четврток","петок","сабота"],daysShort:["нед","пон","вт","ср","чет","пет","саб"]}),typeof window<"u"&&(window.lnCore=window.lnCore||{},window.lnCore.registerDataMapper=W,window.lnCore.getDataMapper=F,window.lnCore.registerLocaleFallback=T,window.lnCore.getLocaleFallback=B,window.lnCore.fillTemplate=v,window.lnCore.fill=L,window.lnCore.lnFill=M,window.lnCore.renderList=N);function k(t){return(t||"").replace(/^#/,"")}function y(t){const e=t===void 0?location.hash:t,o={},s=k(e);if(!s)return o;const d=s.split("&");for(let r=0;r<d.length;r++){const n=d[r];if(!n)continue;const i=n.indexOf(":"),l=i>-1?n.slice(0,i):n,c=i>-1?n.slice(i+1):"";if(l)try{o[l]=decodeURIComponent(c)}catch{o[l]=c}}return o}function I(t){if(!t)return null;const e=y();return t in e?e[t]:null}function K(t,e){if(!t)return;const o=y();e==null?delete o[t]:o[t]=String(e);const d=Object.keys(o).map(function(r){const n=o[r];return n===""?r:r+":"+encodeURIComponent(n)}).join("&");k(location.hash)!==d&&(location.hash=d)}function R(t){return t.button===1||t.ctrlKey||t.metaKey||t.shiftKey?!1:(t.preventDefault(),!0)}typeof window<"u"&&(window.lnCore=window.lnCore||{},window.lnCore.hashParse=y,window.lnCore.hashGet=I,window.lnCore.hashSet=K,window.lnCore.hashLinkClick=R),(function(){const t="data-ln-accordion",e="lnAccordion";if(window[e]!==void 0)return;function o(s){return this.dom=s,this._onToggleOpen=function(d){if(d.detail.target.closest("[data-ln-accordion]")!==s)return;const r=s.querySelectorAll("[data-ln-toggle]");for(const n of r)n!==d.detail.target&&n.closest("[data-ln-accordion]")===s&&n.getAttribute("data-ln-toggle")==="open"&&n.setAttribute("data-ln-toggle","close");x(s,"ln-accordion:change",{target:d.detail.target})},s.addEventListener("ln-toggle:open",this._onToggleOpen),this}o.prototype.destroy=function(){this.dom[e]&&(this.dom.removeEventListener("ln-toggle:open",this._onToggleOpen),x(this.dom,"ln-accordion:destroyed",{target:this.dom}),delete this.dom[e])},j(t,e,o,"ln-accordion")})()})();

package/js/ln-ajax/README.md

@@ -40,10 +40,15 @@ Wrap interactive elements or entire layouts with the `data-ln-ajax` selector.
 
 ### HTML Attributes
 
-| Attribute | Elements | Description |
-| :--- | :--- | :--- |
-| `data-ln-ajax` | Container, `<a>`, `<form>` | Activates AJAX capture on the element and its descendants. |
-| `data-ln-ajax="false"` | `<a>`, `<form>` | Excludes the specific link or form from AJAX interception. |
+| Attribute | Elements | Values | Description |
+| :--- | :--- | :--- | :--- |
+| `data-ln-ajax` | Container, `<a>`, `<form>` | *none* (empty attribute) | Activates AJAX capture on the element and its descendants. Acts as a boolean flag. |
+| `data-ln-ajax="false"` | `<a>`, `<form>` | `"false"` | **The only supported value.** Excludes the specific link or form from AJAX interception. |
+
+> [!IMPORTANT]
+> **Attribute Value Restriction:** The `data-ln-ajax` attribute operates as a presence-based trigger (like a boolean flag). 
+> * **The only valid and supported value is `"false"`**, which is used to exclude/opt-out specific elements inside an AJAX-enabled container.
+> * **Do not use custom values** (e.g., `data-ln-ajax="loginform"` or `data-ln-ajax="my-widget"`). The component does **not** accept, process, or assign behavior based on other string values. Using custom values will simply activate normal AJAX routing (acting the same as an empty attribute) but is a major anti-pattern that confuses both developers and AI agents.
 
 ### Server Response Protocol
 
@@ -89,3 +94,67 @@ All events are dispatched on the initiating element (`<a>` or `<form>`) and bubb
 - **Missing DOM IDs on Swap Targets:** If the server returns a key in `content` that does not match a mounting ID in the active document (e.g. `id="main-content"`), that segment swap fails silently.
 - **Forgetting CSRF Meta:** `ln-ajax` automatically reads `<meta name="csrf-token" content="...">` to inject the `X-CSRF-TOKEN` header on non-GET calls. If this meta tag is missing, POST/PUT requests may fail authentication.
 - **Breaking External Links:** Links with different hostnames are ignored automatically, but absolute paths on the same host are captured. Ensure assets/downloads use `data-ln-ajax="false"`.
+- **Forms carrying `data-ln-form-scope` are skipped entirely** (one-time `console.warn`) — the `ln-data-coordinator` write pipeline takes precedence over ajax progressive enhancement.
+- **Respects `e.defaultPrevented`.** If a prior `submit` listener on the same form (e.g. a validation gate) already called `preventDefault()`, `ln-ajax` does nothing — no fetch, no loader class.
+
+---
+
+## 🔧 Internals
+
+Source: `js/ln-ajax/ln-ajax.js`.
+
+### Request lifecycle
+
+In order, per intercepted click/submit:
+
+1. **Intercept** — click on `<a>` or submit on `<form>`. Modifier-key clicks (Ctrl/Cmd/middle) and `#`-href links pass through untouched.
+2. **External-hostname skip** — if the link's hostname differs from `location.hostname`, ln-ajax aborts and the browser follows the link normally (no opt-out needed).
+3. **`ln-ajax:before-start`** — cancelable; `preventDefault()` stops here (no spinner, no fetch).
+4. **Spinner mount** — `.ln-ajax--loading` on the trigger, `<span class="ln-ajax-spinner">` appended, form buttons disabled.
+5. **`ln-ajax:start`** — non-cancelable; fetch is about to begin.
+6. **`fetch()`** — built from `href`/`action`, `method`, `FormData`. Headers always include `X-Requested-With`, `Accept: application/json`, and `X-CSRF-TOKEN` from the page meta. A `<input name="_method">` (auto-added by `ln-form`'s RESTful mode) rides in `FormData` transparently — the HTTP verb stays POST while `_method` travels in the body.
+7. **Response** — see the branches below.
+8. **`ln-ajax:success` / `ln-ajax:error`** — dispatched on the trigger, bubbling.
+9. **Cleanup** — loading class + spinner removed, buttons re-enabled.
+10. **`ln-ajax:complete`** — always fires last, success or error.
+
+Response branches:
+- **HTTP error** (`!response.ok`): parse JSON, dispatch `ln-ajax:error` `{ method, url, status, data }`, auto-toast if `data.message`.
+- **Fetch rejection** (network / JSON parse): dispatch `ln-ajax:error` `{ method, url, error }`.
+- **Success**: update `document.title`, swap `target.innerHTML` for each `data.content[id]`, auto-toast if `data.message`, `history.pushState` for `<a>` and GET `<form>`.
+
+### MutationObserver flow
+
+A single observer on `document.body` handles three cases:
+- **New `data-ln-ajax` root injected** → `new lnAjax(node)` attaches listeners (covers AJAX-swapped frames and `innerHTML` writes).
+- **Elements injected inside a live root** → `findElements` re-runs on the subtree and attaches to any new `<a>`/`<form>` — no full re-init of the root.
+- **`data-ln-ajax` set on an existing element** → the attributes branch runs `new lnAjax(node)`, so programmatic opt-in works.
+
+### DOM mutations performed
+
+| Phase | Mutation |
+|-------|----------|
+| Request start | `.ln-ajax--loading` on trigger |
+| Request start | `<span class="ln-ajax-spinner">` appended to trigger |
+| Request start | `disabled` on all `<button>` descendants of a `<form>` trigger |
+| Success | `target.innerHTML` replaced per `id` in `data.content` |
+| Success | `document.title` updated from `data.title` |
+| Success (`<a>` / GET `<form>`) | `history.pushState` |
+| Completion | loading class + spinner removed, form buttons re-enabled |
+
+### `findElements` local divergence
+
+ln-ajax uses a local `findElements` rather than the ln-core helper of the same name: it needs a `{ links, forms }` partition (to bind `click` on links and `submit` on forms in one pass), where ln-core returns a flat list. The two must not be merged without updating all call sites.
+
+### Trust boundary
+
+ln-ajax operates under a trusted, same-origin model: it expects every HTML fragment in the JSON response to be safe. It performs **no** client-side sanitization or regex script/attribute filtering — that would be fragile and would corrupt valid markup (e.g. stripping `data-ln-confirm` values that contain event-like substrings). Sanitizing user-submitted HTML is the server's job, done before the fragment is rendered. See [Security §5 — AJAX Fragment Trust Boundary](../../docs/architecture/security.md#5-ajax-fragment-trust-boundary).
+
+### Error detail shape
+
+`ln-ajax:error` carries one of two shapes depending on failure mode:
+
+- **HTTP-status error** (response received, `!ok`): `{ method, url, status, data }` — `data` is the parsed body (may contain `message`).
+- **Fetch rejection** (network / DNS / JSON parse): `{ method, url, error }` — the caught `Error`, no `status`/`data`.
+
+A single `ln-ajax:error` listener must guard with `'status' in e.detail` before reading `status`, and `'error' in e.detail` before reading `error`. (`ln-api-connector`, the data-layer transport tier, emits a single unified error shape — `{ action, error, status, data }` — and is the pattern to prefer for new data-flow code.)

package/js/ln-ajax/ln-ajax.js

@@ -1 +1 @@
-(function(){"use strict";function p(o,n,l){o.dispatchEvent(new CustomEvent(n,{bubbles:!0,detail:l||{}}))}function M(o,n,l){const b=new CustomEvent(n,{bubbles:!0,cancelable:!0,detail:l||{}});return o.dispatchEvent(b),b}function v(o,n){if(!document.body){document.addEventListener("DOMContentLoaded",function(){v(o,n)}),console.warn("["+n+'] Script loaded before <body> — add "defer" to your <script> tag');return}o()}const j={};function C(o,n){j[o]=n}function D(o){return j[o]||{ingress:n=>n,egress:n=>n}}typeof window<"u"&&(window.lnCore=window.lnCore||{},window.lnCore.registerDataMapper=C,window.lnCore.getDataMapper=D),(function(){const o="data-ln-ajax",n="lnAjax";if(window[n]!==void 0)return;function l(e){if(!e.hasAttribute(o)||e[n])return;e[n]=!0;const t=y(e);b(t.links),E(t.forms)}function b(e){for(const t of e){if(t[n+"Trigger"]||t.hostname&&t.hostname!==window.location.hostname)continue;const i=t.getAttribute("href");if(i&&i.includes("#"))continue;const r=function(a){if(a.ctrlKey||a.metaKey||a.button===1)return;a.preventDefault();const f=t.getAttribute("href");f&&x("GET",f,null,t)};t.addEventListener("click",r),t[n+"Trigger"]=r}}function E(e){for(const t of e){if(t[n+"Trigger"])continue;const i=function(r){r.preventDefault();const a=t.method.toUpperCase(),f=t.action,h=new FormData(t);for(const g of t.querySelectorAll('button, input[type="submit"]'))g.disabled=!0;x(a,f,h,t,function(){for(const g of t.querySelectorAll('button, input[type="submit"]'))g.disabled=!1})};t.addEventListener("submit",i),t[n+"Trigger"]=i}}function S(e){if(!e[n])return;const t=y(e);for(const i of t.links)i[n+"Trigger"]&&(i.removeEventListener("click",i[n+"Trigger"]),delete i[n+"Trigger"]);for(const i of t.forms)i[n+"Trigger"]&&(i.removeEventListener("submit",i[n+"Trigger"]),delete i[n+"Trigger"]);delete e[n]}function x(e,t,i,r,a){if(M(r,"ln-ajax:before-start",{method:e,url:t}).defaultPrevented)return;p(r,"ln-ajax:start",{method:e,url:t}),r.classList.add("ln-ajax--loading");const h=document.createElement("span");h.className="ln-ajax-spinner",r.appendChild(h);function g(){r.classList.remove("ln-ajax--loading");const s=r.querySelector(".ln-ajax-spinner");s&&s.remove(),a&&a()}let d=t;const k=document.querySelector('meta[name="csrf-token"]'),w=k?k.getAttribute("content"):null;i instanceof FormData&&w&&i.append("_token",w);const A={method:e,headers:{"X-Requested-With":"XMLHttpRequest",Accept:"application/json"}};if(w&&(A.headers["X-CSRF-TOKEN"]=w),e==="GET"&&i){const s=new URLSearchParams(i);d=t+(t.includes("?")?"&":"?")+s.toString()}else e!=="GET"&&i&&(A.body=i);fetch(d,A).then(function(s){const c=s.ok;return s.json().then(function(u){return{ok:c,status:s.status,data:u}})}).then(function(s){const c=s.data;if(s.ok){if(c.title&&(document.title=c.title),c.content)for(const u in c.content){const L=document.getElementById(u);if(L){let m=c.content[u];window.DOMPurify&&typeof window.DOMPurify.sanitize=="function"?m=window.DOMPurify.sanitize(m):m=m.replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi,"").replace(/on\w+\s*=\s*(['"][^'"]*['"]|[^\s>]+)/gi,""),L.innerHTML=m}}if(r.tagName==="A"){const u=r.getAttribute("href");u&&window.history.pushState({ajax:!0},"",u)}else r.tagName==="FORM"&&r.method.toUpperCase()==="GET"&&window.history.pushState({ajax:!0},"",d);p(r,"ln-ajax:success",{method:e,url:d,data:c})}else p(r,"ln-ajax:error",{method:e,url:d,status:s.status,data:c});if(c.message){const u=c.message;window.dispatchEvent(new CustomEvent("ln-toast:enqueue",{detail:{type:u.type||(s.ok?"success":"error"),title:u.title||"",message:u.body||""}}))}p(r,"ln-ajax:complete",{method:e,url:d}),g()}).catch(function(s){p(r,"ln-ajax:error",{method:e,url:d,error:s}),p(r,"ln-ajax:complete",{method:e,url:d}),g()})}function y(e){const t={links:[],forms:[]};return e.tagName==="A"&&e.getAttribute(o)!=="false"?t.links.push(e):e.tagName==="FORM"&&e.getAttribute(o)!=="false"?t.forms.push(e):(t.links=Array.from(e.querySelectorAll('a:not([data-ln-ajax="false"])')),t.forms=Array.from(e.querySelectorAll('form:not([data-ln-ajax="false"])'))),t}function O(){v(function(){new MutationObserver(function(t){for(const i of t)if(i.type==="childList"){for(const r of i.addedNodes)if(r.nodeType===1&&(l(r),!r.hasAttribute(o))){for(const f of r.querySelectorAll("["+o+"]"))l(f);const a=r.closest&&r.closest("["+o+"]");if(a&&a.getAttribute(o)!=="false"){const f=y(r);b(f.links),E(f.forms)}}}else i.type==="attributes"&&l(i.target)}).observe(document.body,{childList:!0,subtree:!0,attributes:!0,attributeFilter:[o]})},"ln-ajax")}function T(){for(const e of document.querySelectorAll("["+o+"]"))l(e)}window[n]=l,window[n].destroy=S,O(),document.readyState==="loading"?document.addEventListener("DOMContentLoaded",T):T()})()})();
+(function(){"use strict";if(typeof window<"u"){const t=console.warn;console.warn=function(...e){typeof e[0]=="string"&&(e[0].startsWith("[ln-")||e[0].startsWith("[lnCore"))&&!(document.documentElement.hasAttribute("data-ln-debug")||document.body&&document.body.hasAttribute("data-ln-debug"))||t.apply(console,e)}}const S={};function N(t,e){S[t]||(S[t]=document.querySelector('[data-ln-template="'+t+'"]'));const o=S[t];return o?o.content.cloneNode(!0):(console.warn("["+(e||"ln-core")+'] Template "'+t+'" not found'),null)}function A(t,e,o){t.dispatchEvent(new CustomEvent(e,{bubbles:!0,detail:o||{}}))}function K(t,e,o){const u=new CustomEvent(e,{bubbles:!0,cancelable:!0,detail:o||{}});return t.dispatchEvent(u),u}function T(t,e){if(!t||!e)return t;const o=t.querySelectorAll("[data-ln-field]");for(let i=0;i<o.length;i++){const a=o[i],s=a.getAttribute("data-ln-field");e[s]!=null&&(a.textContent=e[s])}const u=t.querySelectorAll("[data-ln-attr]");for(let i=0;i<u.length;i++){const a=u[i],s=a.getAttribute("data-ln-attr").split(",");for(let d=0;d<s.length;d++){const h=s[d].trim().split(":");if(h.length!==2)continue;const r=h[0].trim(),n=h[1].trim();e[n]!=null&&a.setAttribute(r,e[n])}}const p=t.querySelectorAll("[data-ln-show]");for(let i=0;i<p.length;i++){const a=p[i],s=a.getAttribute("data-ln-show");s in e&&a.classList.toggle("hidden",!e[s])}const f=t.querySelectorAll("[data-ln-class]");for(let i=0;i<f.length;i++){const a=f[i],s=a.getAttribute("data-ln-class").split(",");for(let d=0;d<s.length;d++){const h=s[d].trim().split(":");if(h.length!==2)continue;const r=h[0].trim(),n=h[1].trim();n in e&&a.classList.toggle(r,!!e[n])}}return t}function U(t,e){t.matches&&t.matches("[data-ln-form], [data-ln-fillable]")&&t.dispatchEvent(new CustomEvent("ln-fill",{detail:e??null,bubbles:!0}));const o=t.querySelectorAll("[data-ln-form], [data-ln-fillable]");for(let u=0;u<o.length;u++)o[u].dispatchEvent(new CustomEvent("ln-fill",{detail:e??null,bubbles:!0}));return t}typeof window<"u"&&(window.lnCore=window.lnCore||{},window.lnCore._fillBound||(window.lnCore._fillBound=!0,document.addEventListener("ln-fill",function(t){if(!(!t.target.matches||!t.target.matches("[data-ln-fillable]")))if(t.detail)T(t.target,t.detail);else{const e=t.target.querySelectorAll("[data-ln-field]");for(let o=0;o<e.length;o++)e[o].textContent=""}})));function v(t,e){if(!t||!e)return t;const o=document.createTreeWalker(t,NodeFilter.SHOW_TEXT);for(;o.nextNode();){const f=o.currentNode;f.textContent.indexOf("{{")!==-1&&(f.textContent=f.textContent.replace(/\{\{\s*(\w+)\s*\}\}/g,function(i,a){return e[a]!==void 0?e[a]:""}))}const u=function(f,i){return e[i]!==void 0?e[i]:""},p=Array.from(t.querySelectorAll("*"));t.nodeType===1&&p.push(t);for(let f=0;f<p.length;f++){const i=p[f],a=i.attributes;for(let s=0;s<a.length;s++){const d=a[s];d.value.indexOf("{{")!==-1&&i.setAttribute(d.name,d.value.replace(/\{\{\s*(\w+)\s*\}\}/g,u))}}return t}function B(t,e,o,u,p,f){const i={};for(let s=0;s<t.children.length;s++){const d=t.children[s],h=d.getAttribute("data-ln-key");h&&(i[h]=d)}const a=document.createDocumentFragment();for(let s=0;s<e.length;s++){const d=e[s],h=String(u(d));let r=i[h];if(r)p(r,d,s);else{const n=N(o,f);if(!n||(v(n,d),r=n.firstElementChild,!r))continue;r.setAttribute("data-ln-key",h),p(r,d,s)}a.appendChild(r)}t.textContent="",t.appendChild(a)}function _(t,e){if(!document.body){document.addEventListener("DOMContentLoaded",function(){_(t,e)}),console.warn("["+e+'] Script loaded before <body> — add "defer" to your <script> tag');return}t()}function G(t,e){if(t.ctrlKey||t.metaKey||t.shiftKey||t.altKey||t.button!==0||!e)return!1;const o=e.getAttribute("href");return!(!o||e.getAttribute("target")==="_blank"||e.hasAttribute("download")||o.startsWith("mailto:")||o.startsWith("tel:")||o==="#"||o.startsWith("#")||e.hostname&&e.hostname!==window.location.hostname)}const q={};function I(t,e){q[t]=e}function P(t){return q[t]||{ingress:e=>e,egress:e=>e}}const D={};function O(t,e){if(!t||typeof e!="object")return;const o=t.toLowerCase().split("-")[0];D[o]=e}function X(t){if(!t)return null;const e=t.toLowerCase().split("-")[0];return D[e]||null}O("mk",{monthsLong:["јануари","февруари","март","април","мај","јуни","јули","август","септември","октомври","ноември","декември"],monthsShort:["јан","фев","мар","апр","мај","јун","јул","авг","септ","окт","ноем","дек"],daysLong:["недела","понеделник","вторник","среда","четврток","петок","сабота"],daysShort:["нед","пон","вт","ср","чет","пет","саб"]}),typeof window<"u"&&(window.lnCore=window.lnCore||{},window.lnCore.registerDataMapper=I,window.lnCore.getDataMapper=P,window.lnCore.registerLocaleFallback=O,window.lnCore.getLocaleFallback=X,window.lnCore.fillTemplate=v,window.lnCore.fill=T,window.lnCore.lnFill=U,window.lnCore.renderList=B);function F(t){return(t||"").replace(/^#/,"")}function E(t){const e=t===void 0?location.hash:t,o={},u=F(e);if(!u)return o;const p=u.split("&");for(let f=0;f<p.length;f++){const i=p[f];if(!i)continue;const a=i.indexOf(":"),s=a>-1?i.slice(0,a):i,d=a>-1?i.slice(a+1):"";if(s)try{o[s]=decodeURIComponent(d)}catch{o[s]=d}}return o}function H(t){if(!t)return null;const e=E();return t in e?e[t]:null}function z(t,e){if(!t)return;const o=E();e==null?delete o[t]:o[t]=String(e);const p=Object.keys(o).map(function(f){const i=o[f];return i===""?f:f+":"+encodeURIComponent(i)}).join("&");F(location.hash)!==p&&(location.hash=p)}function R(t){return t.button===1||t.ctrlKey||t.metaKey||t.shiftKey?!1:(t.preventDefault(),!0)}typeof window<"u"&&(window.lnCore=window.lnCore||{},window.lnCore.hashParse=E,window.lnCore.hashGet=H,window.lnCore.hashSet=z,window.lnCore.hashLinkClick=R),(function(){const t="data-ln-ajax",e="lnAjax",o="data-ln-form-scope";if(window[e]!==void 0)return;function u(r){if(!r.hasAttribute(t)||r[e])return;r[e]=!0;const n=s(r);p(n.links),f(n.forms)}function p(r){for(const n of r){if(n[e+"Trigger"]||n.hostname&&n.hostname!==window.location.hostname)continue;const c=n.getAttribute("href");if(c&&c.includes("#"))continue;const l=function(b){if(!G(b,n))return;b.preventDefault();const y=n.getAttribute("href");y&&a("GET",y,null,n)};n.addEventListener("click",l),n[e+"Trigger"]=l}}function f(r){for(const n of r){if(n[e+"Trigger"])continue;if(n.hasAttribute(o)){n[e+"ScopeWarned"]||(n[e+"ScopeWarned"]=!0,console.warn("[ln-ajax] Form has data-ln-form-scope — the ln-data-coordinator write pipeline takes precedence; skipping ajax interception for this form."));continue}const c=function(l){if(l.defaultPrevented)return;l.preventDefault();const b=n.method.toUpperCase(),y=n.action,x=new FormData(n);for(const k of n.querySelectorAll('button, input[type="submit"]'))k.disabled=!0;a(b,y,x,n,function(){for(const k of n.querySelectorAll('button, input[type="submit"]'))k.disabled=!1})};n.addEventListener("submit",c),n[e+"Trigger"]=c}}function i(r){if(!r[e])return;const n=s(r);for(const c of n.links)c[e+"Trigger"]&&(c.removeEventListener("click",c[e+"Trigger"]),delete c[e+"Trigger"]);for(const c of n.forms)c[e+"Trigger"]&&(c.removeEventListener("submit",c[e+"Trigger"]),delete c[e+"Trigger"]);delete r[e]}function a(r,n,c,l,b){if(K(l,"ln-ajax:before-start",{method:r,url:n}).defaultPrevented)return;A(l,"ln-ajax:start",{method:r,url:n}),l.classList.add("ln-ajax--loading");const x=document.createElement("span");x.className="ln-ajax-spinner",l.appendChild(x);function k(){l.classList.remove("ln-ajax--loading");const g=l.querySelector(".ln-ajax-spinner");g&&g.remove(),b&&b()}let C=n;const M=document.querySelector('meta[name="csrf-token"]'),L=M?M.getAttribute("content"):null;c instanceof FormData&&L&&c.append("_token",L);const j={method:r,headers:{"X-Requested-With":"XMLHttpRequest",Accept:"application/json"}};if(L&&(j.headers["X-CSRF-TOKEN"]=L),r==="GET"&&c){const g=new URLSearchParams(c);C=n+(n.includes("?")?"&":"?")+g.toString()}else r!=="GET"&&c&&(j.body=c);fetch(C,j).then(function(g){const m=g.ok;return g.json().then(function(w){return{ok:m,status:g.status,data:w}})}).then(function(g){const m=g.data;if(g.ok){if(m.title&&(document.title=m.title),m.content)for(const w in m.content){const W=document.getElementById(w);W&&(W.innerHTML=m.content[w])}if(l.tagName==="A"){const w=l.getAttribute("href");w&&window.history.pushState({ajax:!0},"",w)}else l.tagName==="FORM"&&l.method.toUpperCase()==="GET"&&window.history.pushState({ajax:!0},"",C);A(l,"ln-ajax:success",{method:r,url:C,data:m})}else A(l,"ln-ajax:error",{method:r,url:C,status:g.status,data:m});if(m.message){const w=m.message;window.dispatchEvent(new CustomEvent("ln-toast:enqueue",{detail:{type:w.type||(g.ok?"success":"error"),title:w.title||"",message:w.body||""}}))}A(l,"ln-ajax:complete",{method:r,url:C}),k()}).catch(function(g){A(l,"ln-ajax:error",{method:r,url:C,error:g}),A(l,"ln-ajax:complete",{method:r,url:C}),k()})}function s(r){const n={links:[],forms:[]};return r.tagName==="A"&&r.getAttribute(t)!=="false"?n.links.push(r):r.tagName==="FORM"&&r.getAttribute(t)!=="false"?n.forms.push(r):(n.links=Array.from(r.querySelectorAll('a:not([data-ln-ajax="false"])')),n.forms=Array.from(r.querySelectorAll('form:not([data-ln-ajax="false"])'))),n}function d(){_(function(){new MutationObserver(function(n){for(const c of n)if(c.type==="childList"){for(const l of c.addedNodes)if(l.nodeType===1&&(u(l),!l.hasAttribute(t))){for(const y of l.querySelectorAll("["+t+"]"))u(y);const b=l.closest&&l.closest("["+t+"]");if(b&&b.getAttribute(t)!=="false"){const y=s(l);p(y.links),f(y.forms)}}}else c.type==="attributes"&&u(c.target)}).observe(document.body,{childList:!0,subtree:!0,attributes:!0,attributeFilter:[t]})},"ln-ajax")}function h(){for(const r of document.querySelectorAll("["+t+"]"))u(r)}window[e]=u,window[e].destroy=i,d(),document.readyState==="loading"?document.addEventListener("DOMContentLoaded",h):h()})()})();

package/js/ln-ajax/src/ln-ajax.js

@@ -1,8 +1,9 @@
-import { guardBody, dispatch, dispatchCancelable } from '../../ln-core';
+import { guardBody, dispatch, dispatchCancelable, shouldInterceptLink } from '../../ln-core';
 
 (function () {
 	const DOM_SELECTOR = 'data-ln-ajax';
 	const DOM_ATTRIBUTE = 'lnAjax';
+	const SCOPE_ATTR = 'data-ln-form-scope';
 
 	if (window[DOM_ATTRIBUTE] !== undefined) return;
 
@@ -27,7 +28,7 @@ import { guardBody, dispatch, dispatchCancelable } from '../../ln-core';
 			if (href && href.includes('#')) continue;
 
 			const handler = function (e) {
-				if (e.ctrlKey || e.metaKey || e.button === 1) return;
+				if (!shouldInterceptLink(e, link)) return;
 
 				e.preventDefault();
 				const url = link.getAttribute('href');
@@ -45,7 +46,16 @@ import { guardBody, dispatch, dispatchCancelable } from '../../ln-core';
 		for (const form of forms) {
 			if (form[DOM_ATTRIBUTE + 'Trigger']) continue;
 
+			if (form.hasAttribute(SCOPE_ATTR)) {
+				if (!form[DOM_ATTRIBUTE + 'ScopeWarned']) {
+					form[DOM_ATTRIBUTE + 'ScopeWarned'] = true;
+					console.warn('[ln-ajax] Form has data-ln-form-scope — the ln-data-coordinator write pipeline takes precedence; skipping ajax interception for this form.');
+				}
+				continue;
+			}
+
 			const handler = function (e) {
+				if (e.defaultPrevented) return; // a prior handler (e.g. a validation gate) already blocked this submit
 				e.preventDefault();
 				const method = form.method.toUpperCase();
 				const action = form.action;
@@ -152,17 +162,7 @@ import { guardBody, dispatch, dispatchCancelable } from '../../ln-core';
 						for (const targetId in data.content) {
 							const targetElement = document.getElementById(targetId);
 							if (targetElement) {
-								let htmlContent = data.content[targetId];
-								// Defense-in-depth: sanitize if DOMPurify is available globally, otherwise use native mitigation
-								if (window.DOMPurify && typeof window.DOMPurify.sanitize === 'function') {
-									htmlContent = window.DOMPurify.sanitize(htmlContent);
-								} else {
-									// Safe fallback: strip inline script tags and inline events (on*) to prevent basic XSS
-									htmlContent = htmlContent
-										.replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '')
-										.replace(/on\w+\s*=\s*(['"][^'"]*['"]|[^\s>]+)/gi, '');
-								}
-								targetElement.innerHTML = htmlContent;
+								targetElement.innerHTML = data.content[targetId];
 							}
 						}
 					}