gina 0.4.5 → 0.4.6

package/framework/{v0.4.5 → v0.4.6}/core/asset/plugin/dist/vendor/gina/js/gina.js

@@ -5164,7 +5164,7 @@ function Routing() {
                 method              : method,
                 requirements        : routeObject.requirements,
                 namespace           : routeObject.namespace || undefined,
-                url                 : decodeURI(req.url), /// avoid %20
+                url                 : safeDecodeURI(req.url), /// avoid %20 — #B30 malformed-%-safe
                 rule                : routeObject.originalRule || cachedRoute.name,
 
                 param               : routeObject.param,
@@ -6437,7 +6437,7 @@ function Routing() {
 
         pathname    = url.replace( new RegExp('^('+ hostname +'|'+hostname.replace(/\:\d+/, '') +')' ), '');
         if ( typeof(request.routing.path) == 'undefined' )
-            request.routing.path = decodeURI(pathname);
+            request.routing.path = safeDecodeURI(pathname); // #B30 malformed-%-safe
         method      = ( typeof(method) != 'undefined' ) ? method.toLowerCase() : 'get';
 
         if (isMethodProvidedByDefault) {
@@ -6445,7 +6445,7 @@ function Routing() {
             request.originalMethod = request.method;
 
             request.method = method;
-            request.routing.path = decodeURI(pathname)
+            request.routing.path = safeDecodeURI(pathname) // #B30 malformed-%-safe
         }
         // last method check
         if ( !request.method)
@@ -6480,7 +6480,7 @@ function Routing() {
                     method              : localMethod,
                     requirements        : routing[name].requirements,
                     namespace           : routing[name].namespace || undefined,
-                    url                 : decodeURI(pathname), /// avoid %20
+                    url                 : safeDecodeURI(pathname), /// avoid %20 — #B30 malformed-%-safe
                     rule                : routing[name].originalRule || name,
                     param               : routing[name].param,
                     //middleware: routing[name].middleware,
@@ -8840,11 +8840,16 @@ define('gina/link', [ 'require', 'lib/domain', 'lib/merge', 'lib/uuid', 'utils/e
                     console.debug('Is request from same domain ? ', isSameDomain);
                 }
                 if (!isSameDomain) {
-                    // proxy external urls
-                    // TODO - instead of using `cors.io`, try to intégrate a local CORS proxy similar to : http://oskarhane.com/avoid-cors-with-nginx-proxy_pass/
-                    //url = url.match(/^(https|http)\:/)[0] + '//cors.io/?' + url;
-                    url = url.match(/^(https|http)\:/)[0] + '//corsacme.herokuapp.com/?'+ url;
-                    //delete options.headers['X-Requested-With']
+                    // Cross-origin request: drop credentials by default — the target
+                    // server must opt in via `Access-Control-Allow-Origin` (+ `Vary: Origin`).
+                    // If forced by user options, it is restored by the `$link.options` merge.
+                    //
+                    // SECURITY: the previous code rewrote the URL through an external CORS
+                    // proxy (`corsacme.herokuapp.com`) — an unmaintained third party that
+                    // would have routed user traffic (and any credentials) through it, and
+                    // which no longer resolves. Removed; cross-origin requests now go direct
+                    // and rely on the server's own CORS headers.
+                    options.withCredentials = false;
                 }
             }
             options.url     = url;
@@ -9321,6 +9326,56 @@ function DataHelper(){
             replace(/%(?:7C|60|5E)/g, unescape);
     };
 
+    /**
+     * Percent-decodes a string, returning the input UNCHANGED when it is not a
+     * valid URI component. `decodeURIComponent` throws `URIError` on a malformed
+     * escape (a bare `%`, `%zz`, or a truncated `%E0%A`). On the server request
+     * path an attacker-controlled malformed `%` in a URL / query string would
+     * otherwise reach an unguarded `decodeURIComponent`, throw, and — since the
+     * framework runs no `uncaughtException` handler — take the whole bundle down
+     * (#B30). Use this at every server-side decode of attacker-controllable
+     * input where the decode is the genuine (first) decode and cannot simply be
+     * dropped; it mirrors the try/decode/fallback-to-raw idiom already used in
+     * the POST/PUT/PATCH body branches of `processRequestData`.
+     *
+     * @param {string} str - the value to decode
+     * @returns {string} the decoded value, or the original string on URIError
+     * @example
+     *   safeDecodeURIComponent('a%20b'); // 'a b'
+     *   safeDecodeURIComponent('100%');  // '100%'  (decodeURIComponent would throw URIError)
+     */
+    safeDecodeURIComponent = function(str) {
+        try {
+            return decodeURIComponent(str);
+        } catch (err) {
+            return str;
+        }
+    };
+
+    /**
+     * Like {@link safeDecodeURIComponent} but for whole-URI decoding: wraps
+     * `decodeURI` (which leaves URI-reserved characters such as `/ ? #` intact —
+     * used across the routing and error-handler paths to turn `%20` back into a
+     * space without touching path separators). `decodeURI` throws the SAME
+     * `URIError` as `decodeURIComponent` on a malformed escape, so an unguarded
+     * call on the request URL / pathname crashes the bundle the same way (#B30) —
+     * including from inside `throwError`, which would turn a graceful error into a
+     * crash. Returns the input unchanged on a malformed escape.
+     *
+     * @param {string} str - the value to decode
+     * @returns {string} the decoded value, or the original string on URIError
+     * @example
+     *   safeDecodeURI('/a%20b');  // '/a b'
+     *   safeDecodeURI('/a%E0%A'); // '/a%E0%A'  (decodeURI would throw URIError)
+     */
+    safeDecodeURI = function(str) {
+        try {
+            return decodeURI(str);
+        } catch (err) {
+            return str;
+        }
+    };
+
     /**
      * Convert JSON string with structured keys to object
      *
@@ -9425,7 +9480,11 @@ function DataHelper(){
             for (var i = 0, len = arr.length; i < len; ++i) {
                 if (!arr[i]) continue;
 
-                arr[i] = decodeURIComponent(arr[i]);
+                // #B30: tolerate a malformed `%` escape (fall back to the raw
+                // segment) instead of letting decodeURIComponent throw URIError —
+                // an unguarded throw here propagates to processRequestData with no
+                // uncaughtException handler and crashes the bundle.
+                arr[i] = safeDecodeURIComponent(arr[i]);
 
                 if ( /^\{/.test(arr[i]) || /\=\{/.test(arr[i]) || /\=\[/.test(arr[i]) ) {
                     try {
@@ -9454,8 +9513,9 @@ function DataHelper(){
 
                     if ( typeof(el[1]) == 'string' && !/\[object /.test(el[1])) {
                         key     = null;
-                        el[0]   = decodeURIComponent(el[0]);
-                        el[1]   = decodeURIComponent(el[1]);
+                        // #B30: malformed-%-safe decode (see the arr[] loop above).
+                        el[0]   = safeDecodeURIComponent(el[0]);
+                        el[1]   = safeDecodeURIComponent(el[1]);
 
                         if ( /^(.*)\[(.*)\]/.test(el[0]) ) { // some[field] ?
                             key = el[0].replace(/\]/g, '').split(/\[/g);
@@ -11536,8 +11596,18 @@ function ValidatorPlugin(rules, data, formId) {
                 }
                 //console.debug('sending -> ', data);
                 if (!hasBinaries) {
-                    if (typeof (enctype) != 'undefined' && enctype != null && enctype != '') {
-                        xhr.setRequestHeader('Content-Type', enctype);
+                    // #FORMCT — the non-binary body is JSON (JSON.stringify'd above). Honor an
+                    // EXPLICIT form `enctype` if set; otherwise send application/json — NOT the
+                    // urlencoded default — or the server url-decodes the JSON body ('+' -> space,
+                    // decodeURIComponent) and corrupts values such as email "+aliases".
+                    var explicitEnctype = $target.getAttribute('enctype');
+                    var sendContentType = (explicitEnctype && explicitEnctype != '')
+                        ? explicitEnctype
+                        : ( (typeof(data) == 'string' && /^[\[{]/.test(data.trim()))
+                            ? 'application/json; charset=UTF-8'
+                            : enctype );
+                    if (typeof (sendContentType) != 'undefined' && sendContentType != null && sendContentType != '') {
+                        xhr.setRequestHeader('Content-Type', sendContentType);
                     }
                     xhr.send(data)
                 }
@@ -11913,8 +11983,11 @@ function ValidatorPlugin(rules, data, formId) {
                             method: method,
                             isSynchrone: isSynchrone,
                             headers : {
-                                // to upload, use `multipart/form-data` for `enctype`
-                                'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8',
+                                // #FORMCT — the body sent below is JSON (JSON.stringify({ files })).
+                                // Send application/json — NOT the urlencoded default — or the server
+                                // url-decodes the JSON body ('+' -> space, decodeURIComponent) and
+                                // corrupts '+'/'%' in removed-file keys.
+                                'Content-Type': 'application/json; charset=UTF-8',
                                 // cross domain is enabled by default, but you need to setup `Access-Control-Allow-Origin`
                                 'X-Requested-With': 'XMLHttpRequest' // in case of cross domain origin
                             }
@@ -17358,10 +17431,65 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
      */
     function _nextId(prefix) { return (prefix || 'gp') + '-' + (++_uid); }
 
+    /**
+     * Module-level preload cache, keyed by URL. Warmed by the delegated
+     * mouseover/focusin listeners (installPreload) and consumed once at open time
+     * (consumePreload). Shared across popin instances so a hover-preload survives the
+     * subsequent click. A reserved-but-not-yet-loaded entry is `null` (in-flight).
+     *
+     * @inner
+     * @type {object}
+     */
+    var preloadCache = {};
+
+    /** @inner @type {object} warn-once registry, keyed by deprecated attribute name */
+    var _deprecationWarned = {};
+
+    /**
+     * warnDeprecatedOnce
+     *
+     * Emits a one-time `console.warn` for a deprecated, *developer-authored* legacy
+     * trigger attribute — only `data-gina-popin-name` and `data-gina-popin-url` reach
+     * here (at most two distinct warnings for the life of the page). The
+     * engine-managed `data-gina-popin-is-link` / `data-gina-popin-loading` attributes
+     * are written by gina itself and are NOT deprecated, so they never warn.
+     *
+     * @inner
+     * @param {string} kind - the legacy attribute name
+     * @returns {void}
+     */
+    function warnDeprecatedOnce(kind) {
+        if ( _deprecationWarned[kind] ) {
+            return;
+        }
+        _deprecationWarned[kind] = true;
+        if ( typeof(console) != 'undefined' && typeof(console.warn) == 'function' ) {
+            var replacement = ( kind === 'data-gina-popin-name' ) ? 'data-gina-dialog' : 'data-gina-dialog-src';
+            console.warn(
+                '[gina/popin] `' + kind + '` is deprecated; use `' + replacement + '` instead. '
+                + 'The legacy attribute still works (mapped onto the new dialog path).'
+            );
+        }
+    }
+
+    /** @inner @type {boolean} module guard — the delegated open listener is installed once */
+    var _ginaDialogDelegated = false;
+    /** @inner @type {boolean} module guard — the preload listeners are installed once */
+    var _ginaPreloadInstalled = false;
+
     /**
      * Gina Popin Handler
      *
      * @param {object} options
+     * @param {string} options.name - unique popin name (the `data-gina-popin-name` trigger value)
+     * @param {string} [options.class='gina-popin-default'] - extra CSS class on the popin container
+     * @param {boolean} [options.useDialogMode=true] - use a native `<dialog>` (modal) instead of a `<div>` + overlay
+     * @param {boolean} [options.cancelOnOverlayClick=false] - close the popin when the backdrop/overlay is clicked
+     * @param {boolean} [options.preOpen=false] - opt-in: open the popin with a loading skeleton BEFORE the XHR
+     *        returns (no blank-screen gap), replaced by the real content on completion. See showLoadingShell().
+     * @param {string} [options.loadingShell] - custom skeleton HTML for `preOpen` (consumer markup wins);
+     *        when omitted a generic gina-namespaced default skeleton is used.
+     * @param {object} [options.validator] - a FormValidator instance to bind forms inside the popin
      * */
     function Popin(options) {
 
@@ -17376,12 +17504,34 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
                 'class': 'gina-popin-default',
                 // Support of `<dialog>` tag, set `true`
                 'useDialogMode': true,
-                'cancelOnOverlayClick': false
+                'cancelOnOverlayClick': false,
+                // Opt-in skeleton-loading pre-open: when `true`, the popin is filled with a
+                // loading skeleton and opened BEFORE the XHR returns, then the real content
+                // replaces the skeleton on completion. Off by default — pre-opening during
+                // the load is a behavior change vs the default "open on content-complete"
+                // path. See showLoadingShell().
+                'preOpen': false,
+                // Optional skeleton markup for `preOpen`: a string of HTML injected into the
+                // popin while it loads. When omitted, a generic gina-namespaced default
+                // skeleton is used (styled by `.gina-popin-skeleton*` in popin.css).
+                'loadingShell': null,
+                // Per-popin modal opt-in (precedence #2 in resolveModal). `null` => fall
+                // through to the trigger `data-gina-dialog-modal` attribute, then the
+                // `gina.config.popin.modal` project default, then the framework
+                // non-modal default. Set `true`/`false` via `new Popin({ modal })`.
+                'modal': null
             },
             authorizedEvents : ['ready', 'error'],
             events: {}
         };
 
+        // Snapshot the per-popin `modal` option (precedence #2) from the constructor
+        // arg, so resolveModal() can read it. `gina.config.popin.modal` (precedence #4)
+        // is read lazily at open time — it is populated post-load via setOptions.
+        if ( options && typeof(options.modal) != 'undefined' ) {
+            self.options.modal = options.modal;
+        }
+
         var instance        = {
             plugin          : this.plugin,
             id              : 'gina-popins-' + _nextId(),
@@ -17446,7 +17596,11 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
             $container.setAttribute('id', instance.id);
             $container.setAttribute('class', 'gina-popins');
 
-            if ( !self.options.useDialogMode || gina.config.envIsDev) {
+            // Non-dialog mode only: the manual .gina-popins-overlay provides the dimming/
+            // click-catcher backdrop for non-dialog popins. Dialog-mode popins open as
+            // native modals in every env (see the showModal() branch in this file) and use
+            // the native ::backdrop, so they no longer need this overlay.
+            if ( !self.options.useDialogMode ) {
                 var $overlay = document.createElement('div');
                 $overlay.setAttribute('id', 'gina-popins-overlay');
                 $overlay.setAttribute('class', 'gina-popins-overlay');
@@ -17512,6 +17666,577 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
         }
 
 
+        // ─────────────────────────────────────────────────────────────────────────
+        // New `data-gina-dialog-*` entry layer (strangler — funnels into the existing
+        // popinLoad / popinBind / popinOpen engine). Additive: the legacy bindOpen scan
+        // and per-element binding below are kept intact for full parity.
+        // ─────────────────────────────────────────────────────────────────────────
+
+        /**
+         * resolveModal
+         *
+         * Resolves whether a trigger opens a modal dialog. Precedence (highest wins):
+         *  1. legacy trigger (`data-gina-popin-name`) -> modal (today's showModal()-only parity)
+         *  2. `data-gina-dialog-modal` on the trigger -> `"false"` => non-modal, else modal
+         *  3. `new Popin({ modal })` per-popin option (`self.options.modal`)
+         *  4. `gina.config.popin.modal` project default (read lazily — populated post-load)
+         *  5. framework default -> non-modal
+         *
+         * @inner
+         * @param {HTMLElement} $trigger
+         * @param {boolean} [isLegacy] - precomputed legacy flag (resolveTrigger passes it)
+         * @returns {boolean}
+         */
+        function resolveModal($trigger, isLegacy) {
+            // 1. Legacy popins are always modal (showModal()-only, full parity).
+            if ( isLegacy || $trigger.getAttribute('data-gina-popin-name') != null ) {
+                return true;
+            }
+            // 2. Explicit attribute on the trigger. Value-parsed, no separate default:
+            //    `="false"` => non-modal; present with any other value => modal.
+            var attr = $trigger.getAttribute('data-gina-dialog-modal');
+            if ( attr != null ) {
+                return ( attr === 'false' ) ? false : true;
+            }
+            // 3. Per-popin constructor option.
+            if ( self.options.modal === true || self.options.modal === false ) {
+                return self.options.modal;
+            }
+            // 4. Project config — read lazily at open time (gina.config is populated
+            //    post-load via setOptions, so it may be unset when the constructor ran).
+            if (
+                typeof(gina) != 'undefined' && gina.config && gina.config.popin
+                && ( gina.config.popin.modal === true || gina.config.popin.modal === false )
+            ) {
+                return gina.config.popin.modal;
+            }
+            // 5. Framework default.
+            return false;
+        }
+
+        /**
+         * resolveTrigger
+         *
+         * Normalizes a trigger element (new `data-gina-dialog-*` or legacy
+         * `data-gina-popin-*`) into a single descriptor consumed by openFromTrigger().
+         * Only the two developer-authored legacy attributes are aliased + warned:
+         * `data-gina-popin-name` -> `id`, `data-gina-popin-url` -> `src`. The
+         * engine-managed `-is-link` / `-loading` attributes are read by the engine where
+         * it already reads them and are never deprecated here.
+         *
+         * @inner
+         * @param {HTMLElement} $trigger
+         * @returns {object} { id, src, isLegacy, modal, partialTarget, isLink, formSubmit }
+         */
+        function resolveTrigger($trigger) {
+            var isLegacy = false;
+            var id  = $trigger.getAttribute('data-gina-dialog');
+            var src = $trigger.getAttribute('data-gina-dialog-src');
+
+            // Legacy aliasing — only the two developer-authored attributes (warn once each).
+            if ( id == null && $trigger.getAttribute('data-gina-popin-name') != null ) {
+                isLegacy = true;
+                id = $trigger.getAttribute('data-gina-popin-name');
+                warnDeprecatedOnce('data-gina-popin-name');
+            }
+            if ( src == null && $trigger.getAttribute('data-gina-popin-url') != null ) {
+                isLegacy = true;
+                src = $trigger.getAttribute('data-gina-popin-url');
+                warnDeprecatedOnce('data-gina-popin-url');
+            }
+            // An <a href> doubles as the source for both APIs (ignore empty / "#" anchors).
+            if ( src == null && /^A$/i.test($trigger.tagName) ) {
+                var href = $trigger.getAttribute('href');
+                if ( href && href != '' && href != '#' && !/^#/.test(href) ) {
+                    src = href;
+                }
+            }
+
+            return {
+                'id'            : id
+                , 'src'         : src
+                , 'isLegacy'    : isLegacy
+                , 'modal'       : resolveModal($trigger, isLegacy)
+                , 'partialTarget' : $trigger.getAttribute('data-gina-dialog-target')
+                // engine-managed (read, not deprecated) — surfaced for openFromTrigger
+                , 'isLink'      : /^true$/i.test($trigger.getAttribute('data-gina-popin-is-link'))
+                , 'formSubmit'  : /^true$/i.test($trigger.getAttribute('data-gina-form-submit'))
+            };
+        }
+
+        /**
+         * wireTriggerAria — adds `aria-haspopup="dialog"` + `aria-controls="ID"` to a
+         * trigger so assistive tech announces the relationship.
+         *
+         * @inner
+         */
+        function wireTriggerAria($trigger, id) {
+            if ( !$trigger || !id ) {
+                return;
+            }
+            $trigger.setAttribute('aria-haspopup', 'dialog');
+            $trigger.setAttribute('aria-controls', id);
+        }
+
+        /**
+         * associateLabel — points the dialog's `aria-labelledby` at a REAL title element
+         * (an `[id$="-title"]`, else the first heading), assigning an id if missing.
+         * Fixes the legacy behavior of pointing `aria-labelledby` at the popin *name*.
+         *
+         * @inner
+         */
+        function associateLabel($el) {
+            if ( !$el || typeof($el.querySelector) != 'function' ) {
+                return;
+            }
+            var $title = $el.querySelector('[id$="-title"]') || $el.querySelector('h1, h2, h3, h4, h5, h6');
+            if ( !$title ) {
+                return;
+            }
+            if ( !$title.id ) {
+                $title.id = ( $el.id || 'gina-popin' ) + '-title';
+                $title.setAttribute('id', $title.id);
+            }
+            $el.setAttribute('aria-labelledby', $title.id);
+        }
+
+        /**
+         * focusInitial — moves focus into the dialog after content is applied, honoring
+         * an explicit `[autofocus]`, else the first focusable, else the dialog itself.
+         * (Native showModal() already does this; the non-modal `.show()` path does not.)
+         *
+         * @inner
+         */
+        function focusInitial($el) {
+            if ( !$el || typeof($el.querySelector) != 'function' ) {
+                return;
+            }
+            var $target = $el.querySelector('[autofocus]')
+                || $el.querySelector('a[href], button:not([disabled]), input:not([disabled]), select:not([disabled]), textarea:not([disabled]), [tabindex]:not([tabindex="-1"])');
+            if ( $target && typeof($target.focus) == 'function' ) {
+                $target.focus();
+            } else if ( typeof($el.focus) == 'function' ) {
+                if ( $el.getAttribute('tabindex') == null ) {
+                    $el.setAttribute('tabindex', '-1');
+                }
+                $el.focus();
+            }
+        }
+
+        /**
+         * applyNonModalShims
+         *
+         * Native `<dialog>.showModal()` gives `Escape`->close, background inert, body
+         * scroll-block and a focus trap for free; `.show()` (non-modal, the new-API
+         * default) gives none of them. This restores them: an `Escape` keydown handler,
+         * a body scroll-lock attribute (CSS), and best-effort `inert` on background
+         * siblings. Torn down by removeNonModalShims() on close.
+         *
+         * @inner
+         */
+        function applyNonModalShims($popin, $el) {
+            if ( !$el ) {
+                return;
+            }
+            // body scroll-lock (styled by `body[data-gina-popin-scroll-lock]` in popin.css)
+            document.body.setAttribute('data-gina-popin-scroll-lock', 'true');
+
+            // Escape-to-close — native modal does this for free; .show() does not.
+            var onKeydown = function (e) {
+                if ( e.key === 'Escape' || e.keyCode === 27 ) {
+                    e.preventDefault();
+                    popinClose($popin.name);
+                }
+            };
+            $el.__ginaOnKeydown = onKeydown;
+            $el.addEventListener('keydown', onKeydown);
+
+            // Best-effort background inert (skip the dialog, its container and ancestors).
+            var siblings = document.body.children;
+            var b = 0, len = siblings.length;
+            for (; b < len; ++b) {
+                if ( siblings[b] === $el || siblings[b] === instance.target || siblings[b].contains($el) ) {
+                    continue;
+                }
+                if ( siblings[b].getAttribute('inert') == null ) {
+                    siblings[b].setAttribute('inert', '');
+                    siblings[b].setAttribute('data-gina-popin-inert', 'true');
+                }
+            }
+        }
+
+        /**
+         * removeNonModalShims — teardown counterpart to applyNonModalShims (called from
+         * popinClose). Idempotent — safe to call for popins that were opened modal.
+         *
+         * @inner
+         */
+        function removeNonModalShims($el) {
+            document.body.removeAttribute('data-gina-popin-scroll-lock');
+            if ( $el && $el.__ginaOnKeydown ) {
+                $el.removeEventListener('keydown', $el.__ginaOnKeydown);
+                $el.__ginaOnKeydown = null;
+            }
+            var $inert = document.querySelectorAll('[data-gina-popin-inert]');
+            var b = 0, len = $inert.length;
+            for (; b < len; ++b) {
+                $inert[b].removeAttribute('inert');
+                $inert[b].removeAttribute('data-gina-popin-inert');
+            }
+        }
+
+        /**
+         * applyContent
+         *
+         * Full (default): replace the whole element — byte-identical to the legacy
+         * `$el.innerHTML = html.trim()`, so legacy popins are unaffected.
+         * Partial (`partialTarget` set): parse the fetched HTML with DOMParser and swap
+         * only the `partialTarget` region, so chrome (close button, header/footer) and
+         * its bindings survive. Falls back to full-replace if the slot is absent.
+         *
+         * @inner
+         */
+        function applyContent($el, html, $popin, partialTarget) {
+            if ( !partialTarget ) {
+                $el.innerHTML = ( typeof(html) == 'string' ) ? html.trim() : '';
+                return;
+            }
+            var $slot = $el.querySelector(partialTarget);
+            if ( !$slot ) {
+                $el.innerHTML = ( typeof(html) == 'string' ) ? html.trim() : '';
+                return;
+            }
+            var parsed = new DOMParser().parseFromString(html, 'text/html');
+            var $incoming = parsed.querySelector(partialTarget) || parsed.body;
+            $slot.innerHTML = $incoming.innerHTML;
+        }
+
+        /**
+         * handleLoadedBody
+         *
+         * Applies a loaded HTML body (full or partial per `$popin.partialTarget`),
+         * (re)binds the dialog through the guarded popinBind path, and opens it. Used by
+         * the preload-consume path; the click-time XHR keeps its own battle-tested
+         * completion tail (redirect / JSON / CORS / toolbar) for parity.
+         *
+         * @inner
+         */
+        function handleLoadedBody(body, $popin, $el) {
+            // $el may be absent on the cold-click path before popinLoad created it; ensure
+            // it so applyContent injects into — and popinOpen later scans — a real element.
+            $el = $el || ensurePopinDialog($popin);
+            applyContent($el, body, $popin, $popin.partialTarget);
+            popinUnbind($popin.name, true);
+            popinBind({ target: $el, type: 'loaded.' + $popin.id }, $popin);
+            if ( !$popin.isOpen ) {
+                popinOpen($popin.name);
+            }
+            associateLabel($el);
+            focusInitial($el);
+        }
+
+        /**
+         * preloadFetch — small same-origin GET that mirrors popinLoad's `X-Requested-With`
+         * + credentials so a preloaded response is interchangeable with a click-time load.
+         * Cross-origin URLs are left for the click-time XHR/CORS path.
+         *
+         * @inner
+         */
+        function preloadFetch(url) {
+            if (
+                /^(http|https):/.test(url)
+                && !new RegExp('^' + window.location.protocol + '//' + window.location.host).test(url)
+            ) {
+                delete preloadCache[url];
+                return;
+            }
+            var xhrPreload = new XMLHttpRequest();
+            xhrPreload.open('GET', url);
+            xhrPreload.withCredentials = false;
+            xhrPreload.setRequestHeader('X-Requested-With', 'XMLHttpRequest');
+            xhrPreload.onreadystatechange = function () {
+                if ( xhrPreload.readyState == 4 ) {
+                    if ( /^2/.test(xhrPreload.status) ) {
+                        preloadCache[url] = xhrPreload.responseText;
+                    } else {
+                        delete preloadCache[url];
+                    }
+                }
+            };
+            xhrPreload.send();
+        }
+
+        /**
+         * ensurePopinDialog — returns the popin's DOM element (a native `<dialog>` in
+         * dialog mode, a `<div>` otherwise), creating + appending it under the container on
+         * first use and returning the existing one thereafter (idempotent).
+         *
+         * The hover/focus preload path (consumePreload) short-circuits popinLoad() — which
+         * is what otherwise creates the element — so without this the AJAX popin had no
+         * element with `id === $popin.id` and popinOpen() threw
+         * (`document.getElementById(id).getElementsByTagName(...)` on `null`). Mirrors the
+         * create block popinLoad() runs at click time so both paths produce the same shape.
+         *
+         * @inner
+         * @param {object} $popin
+         * @returns {HTMLElement}
+         */
+        function ensurePopinDialog($popin) {
+            var $el = document.getElementById($popin.id);
+            if ( $el != null ) {
+                return $el;
+            }
+            var className = $popin.options.class + ' ' + $popin.id;
+            if ( !self.options.useDialogMode ) {
+                // DIV + manual overlay (non-dialog mode)
+                $el = document.createElement('div');
+                $el.setAttribute('id', $popin.id);
+                $el.setAttribute('class', className);
+                instance.target.firstChild.appendChild($el);
+            } else {
+                // native <dialog> (top layer + ::backdrop)
+                $el = document.createElement('dialog');
+                $el.setAttribute('id', $popin.id);
+                $el.setAttribute('class', className);
+                $el.setAttribute('data-type', 'modal');
+                $el.setAttribute('aria-labelledby', $popin.name);
+                var $ov = document.getElementById('gina-popins-overlay');
+                if ( $ov ) {
+                    $ov.appendChild($el);
+                } else {
+                    instance.target.appendChild($el);
+                }
+            }
+            return $el;
+        }
+
+        /**
+         * consumePreload — if a warmed preload for `url` is cached, apply it to the popin
+         * (deleting the cache entry) and return `true`; else `false` so the caller falls
+         * back to a click-time XHR. A `null` entry is in-flight (reserved, not ready).
+         *
+         * @inner
+         */
+        function consumePreload(url, $popin) {
+            if ( preloadCache[url] == null ) {
+                return false;
+            }
+            var body = preloadCache[url];
+            delete preloadCache[url];
+            var $el = ensurePopinDialog($popin);
+            handleLoadedBody(body, $popin, $el);
+            return true;
+        }
+
+        /**
+         * installPreload — one-time delegated `mouseover` + `focusin` listeners that warm
+         * preloadCache for AJAX triggers (`data-gina-dialog-src` / legacy
+         * `data-gina-popin-url`). GET + same-origin only; disabled triggers skipped;
+         * repeated hover over descendants is a no-op (URL-cache dedup).
+         *
+         * @inner
+         */
+        function installPreload() {
+            if ( _ginaPreloadInstalled ) {
+                return;
+            }
+            _ginaPreloadInstalled = true;
+
+            var onIntent = function (e) {
+                var $trigger = ( e.target && typeof(e.target.closest) == 'function' )
+                    ? e.target.closest('[data-gina-dialog-src],[data-gina-popin-url]')
+                    : null;
+                if ( !$trigger ) {
+                    return;
+                }
+                if (
+                    $trigger.getAttribute('disabled') != null && $trigger.getAttribute('disabled') != 'false'
+                    || $trigger.getAttribute('aria-disabled') == 'true'
+                ) {
+                    return;
+                }
+                var url = $trigger.getAttribute('data-gina-dialog-src') || $trigger.getAttribute('data-gina-popin-url');
+                if ( !url || typeof(preloadCache[url]) != 'undefined' ) {
+                    return; // already cached or in-flight — dedup
+                }
+                preloadCache[url] = null; // reserve in-flight slot (dedup concurrent intents)
+                preloadFetch(url);
+            };
+            document.addEventListener('mouseover', onIntent);
+            document.addEventListener('focusin', onIntent);
+        }
+
+        /**
+         * openInPageDialog
+         *
+         * Static (non-AJAX) path of the new API: opens an existing in-page
+         * `<dialog id="ID">` directly. Registers a lightweight $popin keyed by the
+         * element id (so close/getActivePopin work), wires a11y, then opens modal or
+         * non-modal per the resolved descriptor.
+         *
+         * @inner
+         */
+        function openInPageDialog(descriptor, $trigger) {
+            var id  = descriptor.id;
+            var $el = document.getElementById(id);
+            if ( !$el ) {
+                throw new Error('Popin dialog `' + id + '` not found in the DOM !');
+            }
+
+            var $dialogPopin = getPopinById(id);
+            if ( !$dialogPopin ) {
+                $dialogPopin = merge({}, $popin);
+                $dialogPopin.id            = id;
+                $dialogPopin.name          = id;
+                $dialogPopin.target        = $el;
+                $dialogPopin.options       = merge({}, self.options);
+                $dialogPopin.load          = popinLoad;
+                $dialogPopin.loadContent   = popinLoadContent;
+                $dialogPopin.open          = popinOpen;
+                $dialogPopin.close         = popinClose;
+                // Marks a static in-page dialog (vs an AJAX-loaded popin): its content is
+                // authored in the page, so popinUnbind must NOT wipe innerHTML on close —
+                // it has to survive close + reopen.
+                $dialogPopin.isInPageDialog = true;
+                instance.$popins[id]       = $dialogPopin;
+            }
+            $dialogPopin.modal       = descriptor.modal;
+            $dialogPopin.openTrigger = $trigger ? ( $trigger.id || $trigger.getAttribute('id') ) : null;
+
+            wireTriggerAria($trigger, id);
+            associateLabel($el);
+
+            // Bind close buttons / forms inside the dialog (guarded — no double-bind).
+            if ( !gina.popinIsBinded ) {
+                popinBind({ target: $el, type: 'open.' + id }, $dialogPopin);
+            }
+
+            $el.classList.add('gina-popin-is-active');
+            if ( !$el.getAttribute('open') ) {
+                if ( descriptor.modal && typeof($el.showModal) === 'function' ) {
+                    $el.showModal();
+                } else if ( typeof($el.show) === 'function' ) {
+                    $el.show();
+                    applyNonModalShims($dialogPopin, $el);
+                } else {
+                    $el.setAttribute('open', true);
+                }
+            }
+            $dialogPopin.isOpen     = true;
+            instance.activePopinId  = $dialogPopin.id;
+            focusInitial($el);
+            triggerEvent(gina, instance.target, 'open.' + id, $dialogPopin);
+        }
+
+        /**
+         * openFromTrigger
+         *
+         * Single entry point for both APIs. Resolves the descriptor, records the trigger
+         * (for focus-return), then either AJAX-loads (`src`) through the existing
+         * popinLoad engine — consuming a hover/focus preload when available — or opens an
+         * in-page dialog directly.
+         *
+         * @inner
+         */
+        function openFromTrigger($trigger) {
+            if (
+                $trigger.getAttribute('disabled') != null && $trigger.getAttribute('disabled') != 'false'
+                || $trigger.getAttribute('aria-disabled') == 'true'
+            ) {
+                return;
+            }
+            var descriptor = resolveTrigger($trigger);
+            if ( !descriptor.id && !descriptor.src ) {
+                return;
+            }
+
+            var triggerId = $trigger.id || $trigger.getAttribute('id');
+            if ( !triggerId ) {
+                triggerId = 'gina-dialog-trigger-' + _nextId();
+                $trigger.setAttribute('id', triggerId);
+            }
+            wireTriggerAria($trigger, descriptor.id || descriptor.src);
+
+            if ( descriptor.src ) {
+                // AJAX path — register (or reuse) a $popin, then load through the
+                // existing battle-tested popinLoad engine.
+                var name = descriptor.id || ( 'gina-dialog-' + _nextId() );
+                var existing = getPopinByName(name);
+                if ( !existing ) {
+                    var clone = merge({}, $popin);
+                    registerPopin(clone, merge({ 'name': name }, self.options));
+                    existing = getPopinByName(name);
+                }
+                existing.openTrigger   = triggerId;
+                existing.modal         = descriptor.modal;
+                existing.partialTarget = descriptor.partialTarget || null;
+
+                // Wire the `loaded.<id>` listener that consumes the response: popinLoad()
+                // only FIRES `loaded.<id>` with the body — it does not inject/open itself
+                // (legacy bindOpen registers an equivalent listener at its own load site).
+                // Without this the click-time XHR resolved into the void and nothing
+                // opened. handleLoadedBody applies the body (partial-aware), binds + opens.
+                // Guarded so repeated opens of the same popin register the listener once.
+                var loadedEvt = 'loaded.' + existing.id;
+                if ( typeof(gina.events[loadedEvt]) == 'undefined' ) {
+                    addListener(gina, existing.target, loadedEvt, function (loadedEvent) {
+                        loadedEvent.preventDefault();
+                        handleLoadedBody(loadedEvent.detail, existing, ensurePopinDialog(existing));
+                    });
+                }
+
+                // Consume a warmed preload if present; else fall through to a click-time XHR.
+                if ( consumePreload(descriptor.src, existing) ) {
+                    return;
+                }
+                var loadOptions = merge({ isSynchrone: false, withCredentials: false }, existing.options);
+                popinLoad(name, descriptor.src, loadOptions);
+            } else {
+                openInPageDialog(descriptor, $trigger);
+            }
+        }
+
+        /**
+         * bindDelegatedOpen
+         *
+         * One delegated `document` click listener handling new `data-gina-dialog`
+         * triggers (including dynamically-injected ones — SPA-safe). Idempotent via a
+         * module guard. Legacy `data-gina-popin-name` triggers are already wired by
+         * bindOpen's per-element listeners (kept for parity / test 02), so this handler
+         * defers to those to avoid a double-open.
+         *
+         * @inner
+         */
+        function bindDelegatedOpen() {
+            if ( _ginaDialogDelegated ) {
+                return;
+            }
+            _ginaDialogDelegated = true;
+
+            addListener(gina, document, 'click', function (event) {
+                var $trigger = ( event.target && typeof(event.target.closest) == 'function' )
+                    ? event.target.closest('[data-gina-dialog],[data-gina-dialog-src],[data-gina-popin-name]')
+                    : null;
+                if ( !$trigger ) {
+                    return;
+                }
+                // Own the new data-gina-dialog API: the `data-gina-dialog` marker (in-page
+                // or marker+src) OR a standalone `data-gina-dialog-src` AJAX trigger
+                // (documented as a peer trigger, and already warmed by installPreload). Pure
+                // legacy `data-gina-popin-*` triggers carrying neither new attribute stay
+                // with bindOpen's per-element listeners, to avoid a double-open.
+                if (
+                    $trigger.getAttribute('data-gina-dialog') == null
+                    && $trigger.getAttribute('data-gina-dialog-src') == null
+                ) {
+                    return;
+                }
+                cancelEvent(event);
+                openFromTrigger($trigger);
+            });
+        }
+
+
         var bindOpen = function($popin, isRouting) {
 
             isRouting = ( typeof(isRouting) != 'undefined' ) ? isRouting : false;
@@ -17776,7 +18501,10 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
             // bind overlay on click
             if (!$popin.isOpen && self.options.cancelOnOverlayClick) {
                 var $overlay = $popin.target;
-                if ( !self.options.useDialogMode || gina.config.envIsDev) {
+                // Non-dialog mode only: bind cancelOnOverlayClick to the manual overlay
+                // div — the non-dialog path has no native backdrop to click. Dialog-mode
+                // popins are native modals (see the showModal() branch) and use ::backdrop.
+                if ( !self.options.useDialogMode ) {
                     $overlay = instance.target.childNodes[0];
                 }
                 addListener(gina, $overlay, 'mousedown', function(event) {
@@ -18159,6 +18887,88 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
             }
         };
 
+        /**
+         * Default loading skeleton injected by showLoadingShell() when `preOpen` is set but
+         * no `loadingShell` markup was provided. Generic + gina-namespaced so it never
+         * collides with a consumer's own markup; styled by the `.gina-popin-skeleton*` rules
+         * in popin.css. Static HTML (no scripts) — CSP-safe.
+         *
+         * @constant {string}
+         * @inner
+         */
+        var GINA_DEFAULT_LOADING_SHELL =
+              '<div class="gina-popin-skeleton" aria-hidden="true">'
+            +     '<div class="gina-popin-skeleton-line gina-popin-skeleton-title"></div>'
+            +     '<div class="gina-popin-skeleton-line"></div>'
+            +     '<div class="gina-popin-skeleton-line gina-popin-skeleton-line--short"></div>'
+            + '</div>';
+
+        /**
+         * showLoadingShell
+         *
+         * Opt-in skeleton-loading pre-open. When a popin is registered with `preOpen: true`,
+         * this fills the (already DOM-attached) popin element with a loading skeleton and
+         * opens it BEFORE the XHR returns, so there is no blank-screen gap while the server
+         * responds. On completion popinBind injects the real HTML over `$el.innerHTML`
+         * (replacing the skeleton) and popinOpen's `!$el.getAttribute('open')` guard then
+         * skips its own open (re-showModal() on an already-open dialog throws).
+         *
+         * Born modal in every env (dev/prod parity), matching popinOpen's showModal()-only
+         * behavior. Idempotent — the open/active guard lets the two loading-attr write sites
+         * (the synchronous readyState-1 set and the onreadystatechange set) call it at most
+         * once per load. The skeleton is the consumer's `loadingShell` option when provided
+         * (so a consumer can delete its own pre-open observer and keep its exact markup),
+         * otherwise GINA_DEFAULT_LOADING_SHELL. Injected via innerHTML — no scripts, CSP-safe.
+         *
+         * @inner
+         * @param {object} $popin - the registered popin (carries `.options.preOpen` / `.options.loadingShell`)
+         * @param {HTMLElement} $el - the popin container (`<dialog>` in dialog mode, `<div>` otherwise)
+         * @returns {void}
+         *
+         * @example
+         * // gina default skeleton:
+         * new PopinHandler({ name: 'form', preOpen: true });
+         * // consumer markup (delete your own pre-open observer, keep your look):
+         * new PopinHandler({ name: 'form', preOpen: true, loadingShell: '<div class="my-skel">…</div>' });
+         */
+        function showLoadingShell($popin, $el) {
+            // Opt-in only — off unless the popin was registered with `preOpen: true`.
+            if ( !$popin || !$el || !$popin.options || !$popin.options.preOpen ) {
+                return;
+            }
+            // Idempotent: both loading-attr write sites call this; once the element is
+            // open/active, the repeat call no-ops. hasAttribute() (not getAttribute()) —
+            // showModal() sets `open` to the empty string, which is falsy, so a
+            // getAttribute() truthiness check would not trip on the second call.
+            if ( $el.hasAttribute('open') || $el.classList.contains('gina-popin-is-active') ) {
+                return;
+            }
+
+            var shell = ( typeof($popin.options.loadingShell) == 'string' && $popin.options.loadingShell )
+                ? $popin.options.loadingShell
+                : GINA_DEFAULT_LOADING_SHELL;
+            $el.innerHTML = shell;
+
+            if ( $el.tagName === 'DIALOG' ) {
+                // Born modal (dev/prod parity). showModal() promotes the dialog to the top
+                // layer with a native ::backdrop; popinOpen's !getAttribute('open') guard
+                // then skips its own showModal() (re-showModal on an open dialog throws).
+                if ( typeof($el.showModal) === 'function' ) {
+                    try { $el.showModal(); } catch (e) {}
+                } else {
+                    $el.setAttribute('open', true);
+                }
+            } else {
+                // Non-dialog mode: no native ::backdrop — activate the container and its
+                // manual .gina-popins-overlay (mirrors popinOpen's non-dialog branch).
+                $el.classList.add('gina-popin-is-active');
+                var $overlay = $el.parentElement;
+                if ( $overlay && !$overlay.classList.contains('gina-popin-is-active') ) {
+                    $overlay.classList.add('gina-popin-is-active');
+                }
+            }
+        }
+
         /**
          * popinLoad
          *
@@ -18247,20 +19057,15 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
                     console.debug('Is request from same domain ? ', isSameDomain);
                 }
                 if (!isSameDomain) {
-                    // proxy external urls
-                    // TODO - instead of using `cors.io` or similar services, try to intégrate a local CORS proxy similar to : http://oskarhane.com/avoid-cors-with-nginx-proxy_pass/
-                    //url = url.match(/^(https|http)\:/)[0] + '//cors.io/?' + url;
-
-
-                    url = url.match(/^(https|http)\:/)[0] + '//corsacme.herokuapp.com/?'+ url;
-                    // url = url.match(/^(https|http)\:/)[0] + '//localhost:4100/proxy/?'+ url;
-
-
-
-                    //delete options.headers['X-Requested-With']
-
-                    // remove credentials on untrusted env
-                    // if forced by user options, it will be restored with $popin.options merge
+                    // Cross-origin request: drop credentials by default — the target
+                    // server must opt in via `Access-Control-Allow-Origin` (+ `Vary: Origin`).
+                    // If forced by user options, it is restored by the `$popin.options` merge.
+                    //
+                    // SECURITY: the previous code rewrote the URL through an external CORS
+                    // proxy (`corsacme.herokuapp.com`) — an unmaintained third party that
+                    // would have routed user traffic (and any credentials) through it, and
+                    // which no longer resolves. Removed; cross-origin requests now go direct
+                    // and rely on the server's own CORS headers.
                     options.withCredentials = false;
                 }
             }
@@ -18334,6 +19139,7 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
                 // Data loading ...
                 if ( /^(1|3)$/.test(xhr.readyState) ) {
                     $popin.target.setAttribute('data-gina-popin-loading', true);
+                    showLoadingShell($popin, $el);
                     if ($popinTrigger) {
                         // For A tag: aria-disabled=true
                         if ( /^A$/i.test($popinTrigger.tagName) ) {
@@ -18349,6 +19155,7 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
                     // Data loading ...
                     if ( /^(1|3)$/.test(xhr.readyState) ) {
                         $popin.target.setAttribute('data-gina-popin-loading', true);
+                        showLoadingShell($popin, $el);
                         if ($popinTrigger) {
                             // For A tag: aria-disabled=true
                             if ( /^A$/i.test($popinTrigger.tagName) ) {
@@ -18390,9 +19197,16 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
                                 instance.eventData.success = result;
 
                                 if (
-                                    !isJsonContent && $popin.isOpen && !$popin.hasForm
+                                    // A partial re-load (data-gina-dialog-target) must reach
+                                    // applyContent's slot-swap, which lives on the loaded.<id>
+                                    // path (the `else` below). popinLoadContent full-replaces
+                                    // $el.innerHTML and ignores partialTarget, so an open re-load
+                                    // with a slot target is diverted to the else branch here;
+                                    // redirect / form / JSON re-loads (no partialTarget) keep the
+                                    // popinLoadContent path unchanged.
+                                    !isJsonContent && $popin.isOpen && !$popin.hasForm && !$popin.partialTarget
                                     ||
-                                    !isJsonContent && $popin.isOpen && isRedirecting
+                                    !isJsonContent && $popin.isOpen && isRedirecting && !$popin.partialTarget
                                 ) {
                                     // console.debug('Popin now redirecting [1]');
                                     popinLoadContent(result, isRedirecting);
@@ -18798,7 +19612,9 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
 
             $el.classList.add('gina-popin-is-active');
 
-            if ( !self.options.useDialogMode || gina.config.envIsDev ) {
+            // Non-dialog mode only: activate the manual overlay — the non-dialog path has
+            // no native ::backdrop (see the showModal() branch).
+            if ( !self.options.useDialogMode ) {
                 // overlay
                 instance.target.firstChild.classList.add('gina-popin-is-active');
                 // overlay
@@ -18808,12 +19624,29 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
             }
 
 
+            // Fix today's name-based aria-labelledby: associate a REAL title element.
+            associateLabel($el);
+
             if ( self.options.useDialogMode && !$el.getAttribute('open') ) {
+                // Modal vs non-modal. The new `data-gina-dialog` API defaults to
+                // non-modal — openFromTrigger sets `$popin.modal`. Any path that did NOT
+                // set it (legacy `data-gina-popin-*` triggers, direct popinOpen() calls)
+                // falls back to modal, preserving today's showModal()-only parity.
+                var useModal = ( typeof($popin.modal) == 'boolean' ) ? $popin.modal : true;
                 if ( typeof($el.showModal) === "function" ) {
-                    if (gina.config.envIsDev) {
-                        $el.show();
-                    } else {
+                    if ( useModal ) {
+                        // showModal() promotes the dialog to the top layer with a native
+                        // ::backdrop and inerts the rest of the page. Consumers that
+                        // preemptively open the dialog (skeleton-loading) MUST also use
+                        // showModal() so it is born modal; the !getAttribute('open') guard
+                        // above then skips this call (re-showModal on an open dialog throws).
                         $el.showModal();
+                    } else {
+                        // Non-modal: .show() loses the native ::backdrop / Escape /
+                        // scroll-block / focus-trap — applyNonModalShims() restores them.
+                        $el.show();
+                        applyNonModalShims($popin, $el);
+                        focusInitial($el);
                     }
                 } else {
                     $el.setAttribute('open', true)
@@ -18862,9 +19695,21 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
 
                 if ( $el != null && $el.classList.contains('gina-popin-is-active') ) {
                     if (!isRouting) {
-                        instance.target.firstChild.classList.remove('gina-popin-is-active');
+                        // Non-dialog mode only: clear the manual overlay's active state.
+                        // In dialog mode the `gina-popins` container has no overlay
+                        // first-child (popinCreateContainer skips it — native ::backdrop is
+                        // used instead), so guard the firstChild access to avoid a null
+                        // deref on close. Mirrors the open-path guard above.
+                        if ( !self.options.useDialogMode ) {
+                            instance.target.firstChild.classList.remove('gina-popin-is-active');
+                        }
                         $el.classList.remove('gina-popin-is-active');
-                        $el.innerHTML                           = '';
+                        // In-page (static) dialogs own their authored content — it must
+                        // persist across close + reopen. Only clear for AJAX-loaded popins
+                        // (the legacy default), whose body was injected at load time.
+                        if ( !$popin.isInPageDialog ) {
+                            $el.innerHTML                       = '';
+                        }
                     }
                     // Fixed: clear loading state on reset — defensive cleanup for navigation
                     // within a popin that was in loading state when reset was called.
@@ -18970,6 +19815,10 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
                         $popin.$headers = [];
                     }
 
+                    // Tear down the non-modal a11y shims (Escape handler, scroll-lock,
+                    // background inert). Idempotent — a no-op for popins opened modal.
+                    removeNonModalShims($el);
+
                     if ($popinTrigger) {
                         // For A tag: aria-disabled=true
                         if ( /^A$/i.test($popinTrigger.tagName) ) {
@@ -18977,6 +19826,10 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
                         } else {
                             $popinTrigger.removeAttribute('disabled', true);
                         }
+                        // a11y: return focus to the trigger that opened the popin.
+                        if ( typeof($popinTrigger.focus) == 'function' ) {
+                            $popinTrigger.focus();
+                        }
                     }
                     // Fixed: clear loading state on explicit close — defensive cleanup in case
                     // the popin is closed before the XHR completes or after a non-XHR flow.
@@ -19119,6 +19972,12 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
         var init = function(options) {
 
             setupInstanceProto();
+
+            // New `data-gina-dialog-*` entry layer — install the delegated open + preload
+            // listeners once per page (module-guarded). Additive to the legacy bindOpen
+            // scan (which registerPopin still runs per popin).
+            bindDelegatedOpen();
+            installPreload();
             //instance.on('init', function(event) {
             addListener(gina, instance.target, 'init.'+instance.id, function(e) {
 
@@ -21654,7 +22513,40 @@ require([
     "lib/collection",
     "lib/domain",
     "lib/routing"
-]);
+], function () {
+    // Boot the popin handler at page load so the declarative `data-gina-dialog` API is
+    // active WITHOUT bundle code calling `new gina.popin()`. Constructing the handler
+    // installs the delegated open listener + the `gina-popins` container; the
+    // `.on('ready')` registration triggers the popin `init` self-fire so `gina.popin` /
+    // `gina.hasPopinHandler` are set (a later explicit `new gina.popin()` then merges
+    // into this instance instead of creating a second container). Idempotent — guarded
+    // on `hasPopinHandler`; a no-op on pages with no dialog/popin elements. The popin
+    // module mutates the framework instance (`window.gina`), so defer until the
+    // `ginaloaded` lifecycle has wired it (bounded poll on `isFrameworkLoaded`).
+    var _popinBootTries = 0;
+    var bootPopinHandler = function () {
+        try {
+            if ( !window['gina'] || !window['gina']['isFrameworkLoaded'] ) {
+                if ( _popinBootTries++ < 100 ) {
+                    (window['setTimeout'] || function (fn) { fn(); })(bootPopinHandler, 50);
+                }
+                return;
+            }
+            if ( window['gina']['hasPopinHandler'] ) {
+                return;
+            }
+            var Popin = require('gina/popin');
+            if ( typeof(Popin) == 'function' ) {
+                new Popin({ 'name': 'gina-dialog-boot' }).on('ready', function () {});
+            }
+        } catch (popinBootErr) {
+            if ( typeof(console) != 'undefined' && console.error ) {
+                console.error('[gina] popin boot failed', popinBootErr.stack || popinBootErr);
+            }
+        }
+    };
+    bootPopinHandler();
+});
 
 function getDependencies(gina, cb) {
     // Loading frontend assets required by plugins