@lmjs/core 1.0.6 → 2.0.0

package/build/bundle.js

@@ -0,0 +1,264 @@
+#!/usr/bin/env node
+// V2's own build pipeline — isolated from V1's index.php entirely, per the
+// working-session decision (2026-09-13) to keep V2 fully separate rather
+// than editing the live PHP CDN pipeline.
+//
+// Produces two bundles:
+//   - dist/lumenjs-core.js — dom-shim.js (a minimal jQuery-compatible
+//     layer) + the css/up workers + walk.js + _re.js + vendor/
+//     reconnecting-websocket.js + index-bootstrap.js + ws.js + lstnrs.js.
+//     No real jQuery, no plugins. This is the default every LumenJS V2
+//     page gets.
+//   - dist/lumenjs-core-with-plugins.js (+ dist/lumenjs-plugins.css) —
+//     2026-09-14: the same file list, but with dom-shim.js swapped for
+//     real jQuery, plus the plugins confirmed by testing real production
+//     content (console.roxyon.com) end-to-end: Select2, Flickity,
+//     bootstrap-colorpicker, bootstrap-datetimepicker. See PROVENANCE.md
+//     for exactly how each one was identified (bea.js is minified with no
+//     identifying strings left — matched by API/option shape instead:
+//     `format: 'rgba'` for bootstrap-colorpicker, the DPGlobal/startView/
+//     minView/maxView/todayBtn signature for bootstrap-datetimepicker) and
+//     why these four and not the wider list an earlier version of this
+//     comment speculated (jQuery UI, tag-editor, jquery.lazy, ...) — none
+//     of those are actually called anywhere in any real project checked
+//     (10 real sites), and drag/sort (§6.4 of the spec) turned out to be
+//     custom-implemented, not jQuery-UI-based, so no jQuery UI dependency
+//     is needed at all.
+
+const fs = require('fs');
+const path = require('path');
+const less = require('less');
+const esbuild = require('esbuild');
+const pluginsRegistry = require('./plugins-registry.js');
+
+const SRC = path.join(__dirname, '..', 'src');
+const VENDOR = path.join(__dirname, '..', 'vendor');
+const NODE_MODULES = path.join(__dirname, '..', 'node_modules');
+const OUT_DIR = path.join(__dirname, '..', 'dist');
+
+// 2026-09-16: this codebase's own source comments are deliberately
+// detailed — they're the record of every real bug found this session
+// (dated, narrative, sometimes referencing internal systems like
+// console.roxyon.com) — genuinely valuable for maintaining THIS repo, but
+// not appropriate to ship verbatim in a published npm package (this
+// project has no other build/minify step, so without this, dist/*.js
+// would carry every one of those comments as-is). esbuild's default
+// transform (no minification flags at all) does NOT reliably strip every
+// comment — confirmed empirically: a comment directly attached to a
+// class method survives regardless of the `legalComments` setting
+// (esbuild's printer treats it like retained method documentation).
+// minifyWhitespace does reliably remove it (comments are folded into the
+// same "removable formatting" pass as whitespace) — used here with
+// minifyIdentifiers/minifySyntax left off, so real names stay readable
+// for debugging; only formatting and comments are stripped. dist/*.js is
+// already a generated, do-not-edit-directly build artifact, not
+// something anyone reads directly, so the more compact output is a real
+// bonus (smaller browser-shipped bundle) rather than a readability loss.
+//
+// Deliberately NOT applied inside read()/readVendor() themselves: the
+// workers (workers/css.js, workers/up.js) are read as pre-escaped string
+// PAYLOADS meant for embedding inside a template literal
+// (`var _cssw = \`${read(...)}\`;`), not standalone parseable JS on their
+// own — running them through a real JS parser fails outright (confirmed
+// empirically: "Syntax error" on their own escaped backslash sequences).
+// astring.js is already a minified third-party build with nothing to
+// gain from re-stripping. Applied explicitly at each call site below
+// instead, only for files that really are directly-concatenated,
+// standalone top-level JS — and never to readModule() (real third-party
+// npm packages), whose license headers must be preserved as-is.
+function stripComments(src) {
+    return esbuild.transformSync(src, {
+        loader: 'js',
+        minifyWhitespace: true,
+        minifyIdentifiers: false,
+        minifySyntax: false,
+    }).code;
+}
+
+function read(relPath) {
+    return fs.readFileSync(path.join(SRC, relPath), 'utf8');
+}
+
+function readVendor(relPath) {
+    return fs.readFileSync(path.join(VENDOR, relPath), 'utf8');
+}
+
+function readModule(relPath) {
+    return fs.readFileSync(path.join(NODE_MODULES, relPath), 'utf8');
+}
+
+// The part of the bundle that's identical regardless of which jQuery layer
+// (shim vs. real+plugins) sits underneath it. Takes the already-built
+// jQuery layer as a string and appends everything else after it.
+function buildCommonTail() {
+    const parts = [];
+
+    // WebWorker helper — a genuine small dependency, not jQuery-replaceable
+    // weight: lstnrs.js unconditionally does `new WebWorker('_cssw')` /
+    // `new WebWorker('_upw')` at load time. Depends on jQuery/our shim
+    // being defined already (its own IIFE takes it as an argument).
+    // Already minified third-party code — nothing to strip.
+    parts.push(readVendor('webworker-helper.js'));
+    // _re.js's walk() uses md5() to generate unique keys for :if/:for
+    // sections — a small, unrelated-to-jQuery utility, genuinely needed.
+    // Already minified third-party code — nothing to strip.
+    parts.push(readVendor('md5.js'));
+
+    // Workers are string payloads, not standalone JS — wrap exactly like
+    // production's index.php does (see PROVENANCE.md's wrapper note). Not
+    // run through stripComments(): these are pre-escaped string content
+    // meant for template-literal embedding, not directly-parseable JS on
+    // their own.
+    parts.push('var _cssw = `' + read('workers/css.js') + '`;');
+    parts.push('var _upw = `' + read('workers/up.js') + '`;');
+
+    // astring (2026-09-14, real bug fix): walk.js's getWatcher() calls
+    // astring.generate() to turn a rewritten AST back into source — but
+    // nothing was ever putting `astring` in scope for the shipped bundle
+    // (it's a plain npm package, referenced as a bare global, not
+    // require()'d). Any real .view <script> block would have hit
+    // "ReferenceError: astring is not defined" the moment it rendered.
+    // Vendored build (UMD, attaches `globalThis.astring`) from
+    // node_modules/astring/dist/astring.min.js — see PROVENANCE.md.
+    // Already minified third-party code — nothing to strip.
+    parts.push(readVendor('astring.js'));
+
+    parts.push(stripComments(read('walk.js')));
+    parts.push(stripComments(read('_re.js')));
+
+    // ws.js's `_Live` class needs ReconnectingWebSocket — a genuine small
+    // vendor dependency (not jQuery-related, nothing to shim), vendored
+    // locally so this build has no dependency on the old V1 mirror at all.
+    // This file is itself part-third-party (the real ReconnectingWebSocket,
+    // already minified with no comments) and part our own framework code
+    // (Reactor(), the setAttribute/getAttribute/removeAttribute patch,
+    // ... — see PROVENANCE.md) — stripComments() is safe here since the
+    // third-party portion has no comments to lose in the first place.
+    parts.push(stripComments(readVendor('reconnecting-websocket.js')));
+
+    // index-bootstrap.js runs here — right after the WHOLE vendor file
+    // above, not spliced into the middle of it (tried that first,
+    // 2026-09-14 — see git history if curious). This file defines
+    // `Reactor` early in its own source but other framework globals real
+    // index.js scripts commonly reference (`cookies`, `session`, ...) much
+    // later in the same file — no single splice point could satisfy both
+    // "run after everything index.js might need" and "run before this
+    // file's own $(document).ready() handler, which can fire
+    // synchronously". Running after the whole file satisfies the first
+    // constraint completely; the second is now handled by making that
+    // ready() handler itself wait for `appSettings` (see its own comment,
+    // right above `function _lumenReadyHandler()` in this vendor file)
+    // instead of assuming an execution-order guarantee that doesn't
+    // actually hold.
+    parts.push(stripComments(read('index-bootstrap.js')));
+
+    parts.push(stripComments(read('ws.js')));
+    parts.push(stripComments(read('lstnrs.js')));
+
+    return parts.join('\n');
+}
+
+function buildCore() {
+    const parts = [];
+    parts.push('/* LumenJS V2 core — generated by packages/core/build/bundle.js, do not edit directly */');
+    parts.push(stripComments(read('dom-shim.js')));
+    parts.push(buildCommonTail());
+    return parts.join('\n');
+}
+
+// 2026-09-16: registry-ified. Every library's npm path(s), ordering
+// constraint, and build-time patch used to live inline here — now in
+// build/plugins-registry.js, the single source of truth both this
+// monolithic build AND a future per-project selective bundle (packages/cli)
+// consume. This refactor is a pure mechanical transcription with no
+// intended behavior change — see plugins-registry.js's own header for the
+// exact reasoning (why a plain ordered array, not a topological sort) and
+// PROVENANCE.md for the full per-library sourcing trail (why each library
+// was picked, exact version matches, etc. — that detail lives there, not
+// duplicated per-entry here anymore).
+function buildCoreWithPlugins() {
+    pluginsRegistry.validateOrder(pluginsRegistry);
+    const parts = [];
+    parts.push('/* LumenJS V2 core (with real jQuery + plugins) — generated by packages/core/build/bundle.js, do not edit directly */');
+    for (const entry of pluginsRegistry) {
+        for (const npmPath of [].concat(entry.npm || [])) {
+            let src = readModule(npmPath);
+            if (entry.patch) src = entry.patch(src);
+            parts.push(src);
+        }
+        if (entry.code) parts.push(entry.code);
+    }
+    parts.push(buildCommonTail());
+    // 2026-09-15, real bug: joining with a bare '\n' let a missing trailing
+    // semicolon in one vendored file merge into the next one via automatic
+    // semicolon insertion — bootstrap-datetimepicker's source ends with
+    // `})(window.jQuery)` (no `;`), and jQuery UI's starts with
+    // `( function( factory ) {`, so ASI read the two as ONE continuous
+    // call chain (`(...)(...)(...)...`) instead of two separate IIFEs —
+    // exactly matching the resulting error, "(intermediate value)(...) is
+    // not a function". This is a real risk for ANY two files in this list,
+    // not just this one pair, since none of the ~18 vendored sources here
+    // are guaranteed to end with a semicolon. `;\n` as the join separator
+    // closes the whole class of bug at once — an extra leading `;` is
+    // always a harmless no-op statement in JS.
+    return parts.join(';\n');
+}
+
+async function buildPluginsCss() {
+    const parts = [];
+    parts.push('/* LumenJS V2 plugins CSS — generated by packages/core/build/bundle.js, do not edit directly */');
+    for (const entry of pluginsRegistry) {
+        if (entry.css) {
+            for (const cssPath of [].concat(entry.css)) {
+                let src = readModule(cssPath);
+                if (entry.cssPatch) src = entry.cssPatch(src);
+                parts.push(src);
+            }
+        }
+        if (entry.lessCss) {
+            // bootstrap-datetimepicker ships only LESS, no compiled CSS at
+            // all — compile it here rather than hand-vendoring a pre-built copy.
+            const lessSrc = readModule(entry.lessCss);
+            const lessOut = await less.render(lessSrc, {
+                filename: path.join(NODE_MODULES, entry.lessCss),
+                paths: [path.join(VENDOR, 'bootstrap2-less-stubs')],
+            });
+            parts.push(lessOut.css);
+        }
+    }
+    return parts.join('\n');
+}
+
+async function main() {
+    if (!fs.existsSync(OUT_DIR)) fs.mkdirSync(OUT_DIR, { recursive: true });
+
+    const core = buildCore();
+    const outPath = path.join(OUT_DIR, 'lumenjs-core.js');
+    fs.writeFileSync(outPath, core);
+    console.log('Wrote ' + outPath + ' (' + core.length + ' bytes)');
+    checkSyntax(core, outPath);
+
+    const withPlugins = buildCoreWithPlugins();
+    const withPluginsPath = path.join(OUT_DIR, 'lumenjs-core-with-plugins.js');
+    fs.writeFileSync(withPluginsPath, withPlugins);
+    console.log('Wrote ' + withPluginsPath + ' (' + withPlugins.length + ' bytes)');
+    checkSyntax(withPlugins, withPluginsPath);
+
+    const pluginsCss = await buildPluginsCss();
+    const pluginsCssPath = path.join(OUT_DIR, 'lumenjs-plugins.css');
+    fs.writeFileSync(pluginsCssPath, pluginsCss);
+    console.log('Wrote ' + pluginsCssPath + ' (' + pluginsCss.length + ' bytes)');
+}
+
+function checkSyntax(code, outPath) {
+    // Fail loudly rather than ship something broken.
+    try {
+        new (require('vm').Script)(code, { filename: outPath });
+        console.log('Syntax check: OK');
+    } catch (e) {
+        console.error('Syntax check FAILED:', e.message);
+        process.exit(1);
+    }
+}
+
+main();

package/build/plugins-registry.js

@@ -0,0 +1,216 @@
+// plugins-registry.js — the 18-library (+jQuery) `--with-plugins` set,
+// factored out of build/bundle.js's buildCoreWithPlugins()/buildPluginsCss()
+// (2026-09-16) into one data structure both the existing prebuilt monolith
+// AND a future per-project selective bundle (packages/cli) can consume.
+//
+// Deliberately a plain ORDERED ARRAY, not something that computes an order
+// via topological sort: this array's declaration order IS today's real,
+// already-shipped, already-tested load order — transcribed mechanically
+// from build/bundle.js's buildCoreWithPlugins(), not reconstructed from
+// memory. A topo sort over `after` edges could legally reorder two
+// independent no-dependency entries (e.g. jquery.easing vs jquery.numeric —
+// no real dependency between them, but SOME specific order exists in the
+// real, shipped bundle), which would change dist/lumenjs-core-with-plugins.js's
+// bytes for no functional reason. `validateOrder()` below instead turns the
+// ordering knowledge that used to live only in code comments into an
+// enforced invariant: it throws if any entry's `after` key doesn't already
+// appear earlier in the array, catching a broken reorder immediately
+// instead of letting it silently ship.
+//
+// Each entry:
+//   key      — the real npm package name (also what a project's own
+//              package.json dependency list is matched against, for the
+//              future per-project selective bundle — see PROVENANCE.md).
+//   npm      — one path or an array of paths, relative to node_modules,
+//              exactly matching the readModule() calls this replaces.
+//   css      — one path or an array of paths (relative to node_modules)
+//              for buildPluginsCss(), if this library ships compiled CSS.
+//   lessCss  — a LESS source path to compile via the `less` package,
+//              for the one library (bootstrap-datetimepicker) that ships
+//              only LESS, no compiled CSS.
+//   after    — keys that must already have been emitted before this one.
+//   patch(src)    — transforms this entry's own JS source before it's
+//                   emitted (the datetimepicker null-guard, the slick→crsl
+//                   rename). Throws loudly if its patch anchor isn't found
+//                   (package updated out from under it), exactly like the
+//                   original inline checks did.
+//   cssPatch(src) — same, for this entry's CSS (crsl's rename, applied to
+//                   its CSS too).
+//   code     — a registration statement emitted verbatim after this
+//               entry's own source (the hasAttr polyfill, the jQueryBridget
+//               registration, GSAP's ScrollToPlugin registration).
+//   always   — true for the one entry (jQuery) that's implicitly required
+//              by every other entry; not itself gated by `after` since
+//              every real entry already declares `after: ["jquery"]`.
+
+function datetimepickerPatch(src) {
+    const patches = [
+        ["icon.addClass(this.timeIcon);", "if (icon) icon.addClass(this.timeIcon);"],
+        ["icon.removeClass(this.timeIcon);\n        icon.addClass(this.dateIcon);", "if (icon) {\n          icon.removeClass(this.timeIcon);\n          icon.addClass(this.dateIcon);\n        }"],
+    ];
+    for (const [from, to] of patches) {
+        if (src.indexOf(from) === -1) {
+            throw new Error('bootstrap-datetimepicker patch anchor not found: "' + from + '" — did the package update? Re-check the fix in plugins-registry.js against the new source.');
+        }
+        src = src.replace(from, to);
+    }
+    return src;
+}
+
+function crslRenamePatch(src) {
+    if (src.indexOf('slick') === -1) {
+        throw new Error('slick-carousel rename anchor "slick" not found in its own source — did the package change its own naming? Re-check this rename in plugins-registry.js.');
+    }
+    return src.split('Slick').join('Crsl').split('slick').join('crsl');
+}
+
+function crslCssPatch(src) {
+    return src.split('slick').join('crsl');
+}
+
+const registry = [
+    {
+        key: 'jquery',
+        npm: 'jquery/dist/jquery.js',
+        after: [],
+        always: true,
+        code: 'jQuery.fn.hasAttr = function (name) { return !!(this[0] && this[0].getAttribute(name) != null); };',
+    },
+    {
+        key: 'select2',
+        npm: 'select2/dist/js/select2.js',
+        css: 'select2/dist/css/select2.css',
+        after: ['jquery'],
+        // Only consumed by packages/cli's per-project selective esbuild
+        // bundle (plugins-esbuild-plugin.js), not by this file's own
+        // buildCoreWithPlugins() — that build is plain string
+        // concatenation, never triggers select2's UMD wrapper's CommonJS
+        // branch at all, so this quirk never applies to it. Select2's own
+        // UMD wrapper (dist/js/select2.js) is unusual among these 18
+        // libraries: its CommonJS branch exports a FACTORY FUNCTION
+        // (`module.exports = function (root, jQuery) {...}`) rather than
+        // self-attaching to jQuery.fn the moment it's required — real
+        // esbuild bundling (which wraps every dependency in a genuine
+        // module/exports closure) takes that branch, so a plain
+        // side-effect import alone never actually calls the factory;
+        // .select2 never gets attached. Confirmed by reading select2's
+        // real source directly, not guessed.
+        cjsFactory: true,
+    },
+    {
+        key: 'flickity',
+        npm: ['flickity/dist/flickity.pkgd.js', 'jquery-bridget/jquery-bridget.js'],
+        css: 'flickity/dist/flickity.css',
+        after: ['jquery'],
+        code: 'jQueryBridget("flickity", Flickity, jQuery);',
+    },
+    {
+        key: 'bootstrap-colorpicker',
+        npm: 'bootstrap-colorpicker/dist/js/bootstrap-colorpicker.js',
+        css: 'bootstrap-colorpicker/dist/css/bootstrap-colorpicker.css',
+        after: ['jquery'],
+    },
+    {
+        key: 'bootstrap-datetimepicker',
+        npm: 'bootstrap-datetimepicker/src/js/bootstrap-datetimepicker.js',
+        lessCss: 'bootstrap-datetimepicker/src/less/bootstrap-datetimepicker.less',
+        after: ['jquery'],
+        patch: datetimepickerPatch,
+    },
+    {
+        key: 'jquery-ui-dist',
+        npm: 'jquery-ui-dist/jquery-ui.js',
+        css: 'jquery-ui-dist/jquery-ui.css',
+        after: ['jquery'],
+    },
+    {
+        key: 'jquery.easing',
+        npm: 'jquery.easing/jquery.easing.js',
+        after: ['jquery'],
+    },
+    {
+        key: 'nestedSortable',
+        npm: 'nestedSortable/jquery.mjs.nestedSortable.js',
+        after: ['jquery-ui-dist'],
+    },
+    {
+        key: 'jquery.numeric',
+        npm: 'jquery.numeric/jquery.numeric.js',
+        after: ['jquery'],
+    },
+    {
+        key: 'timeago',
+        npm: 'timeago/jquery.timeago.js',
+        after: ['jquery'],
+    },
+    {
+        key: 'slick-carousel',
+        npm: 'slick-carousel/slick/slick.js',
+        css: ['slick-carousel/slick/slick.css', 'slick-carousel/slick/slick-theme.css'],
+        after: ['jquery'],
+        patch: crslRenamePatch,
+        cssPatch: crslCssPatch,
+    },
+    {
+        key: '@iconify/iconify',
+        npm: '@iconify/iconify/dist/iconify.js',
+        after: [],
+    },
+    {
+        key: 'rellax',
+        npm: 'rellax/rellax.js',
+        after: [],
+    },
+    {
+        key: 'headroom.js',
+        npm: ['headroom.js/dist/headroom.js', 'headroom.js/dist/jQuery.headroom.js'],
+        after: ['jquery'],
+    },
+    {
+        key: 'in-view',
+        npm: 'in-view/dist/in-view.min.js',
+        after: [],
+    },
+    {
+        key: 'gsap',
+        npm: ['gsap/dist/gsap.js', 'gsap/dist/ScrollToPlugin.js'],
+        after: [],
+        code: 'gsap.registerPlugin(ScrollToPlugin);',
+    },
+    {
+        key: 'jquery.caret',
+        npm: 'jquery.caret/dist/jquery.caret.js',
+        after: ['jquery'],
+    },
+    {
+        key: 'jquery-tageditor',
+        npm: 'jquery-tageditor/jquery.tag-editor.js',
+        css: 'jquery-tageditor/jquery.tag-editor.css',
+        after: ['jquery.caret'],
+    },
+    {
+        key: 'jquery-form',
+        npm: 'jquery-form/src/jquery.form.js',
+        after: ['jquery'],
+    },
+    {
+        key: 'jquery-lazy',
+        npm: 'jquery-lazy/jquery.lazy.js',
+        after: ['jquery'],
+    },
+];
+
+function validateOrder(entries) {
+    const seen = new Set();
+    for (const e of entries) {
+        for (const dep of e.after) {
+            if (!seen.has(dep)) {
+                throw new Error(`plugins-registry.js: "${e.key}" is declared before its "after" dependency "${dep}" — reorder the array.`);
+            }
+        }
+        seen.add(e.key);
+    }
+}
+
+module.exports = registry;
+module.exports.validateOrder = validateOrder;