stimeo-ui 0.5.0 → 0.7.0

package/dist/controllers/pagination_controller.js

@@ -13,16 +13,48 @@ function inheritsFieldsetDisabled(control) {
   return false;
 }
 function canTakeFocus(element) {
-  if (element.closest("[hidden]")) return false;
+  if (element.closest("[hidden], [inert]")) return false;
+  if (element instanceof HTMLInputElement && element.type === "hidden") return false;
   if (!("disabled" in element)) return true;
   if (element.disabled) return false;
   return !inheritsFieldsetDisabled(element);
 }
 
+// src/utils/before_cache_reset.ts
+var BeforeCacheReset = class _BeforeCacheReset {
+  /** Every subscribed instance, iterated by the one shared document listener. */
+  static #subscribers = /* @__PURE__ */ new Set();
+  /** The shared listener; installed while at least one instance is subscribed. */
+  static #onBeforeCache = () => {
+    for (const subscriber of _BeforeCacheReset.#subscribers) subscriber.#rewind();
+  };
+  #rewind;
+  /** @param rewind - the pass that returns this controller's state to its initial form. */
+  constructor(rewind) {
+    this.#rewind = rewind;
+  }
+  /** Subscribes to `turbo:before-cache`; call from `connect()`. Idempotent. */
+  activate() {
+    const first = _BeforeCacheReset.#subscribers.size === 0;
+    _BeforeCacheReset.#subscribers.add(this);
+    if (first) {
+      document.addEventListener("turbo:before-cache", _BeforeCacheReset.#onBeforeCache);
+    }
+  }
+  /** Unsubscribes; call from `disconnect()`. Safe when never subscribed. */
+  deactivate() {
+    _BeforeCacheReset.#subscribers.delete(this);
+    if (_BeforeCacheReset.#subscribers.size > 0) return;
+    document.removeEventListener("turbo:before-cache", _BeforeCacheReset.#onBeforeCache);
+  }
+};
+
 // src/utils/tabindex_loan.ts
 var TabindexLoan = class {
   #value;
   #lent = /* @__PURE__ */ new Set();
+  /** Returns live loans before Turbo can copy them into its page snapshot. */
+  #beforeCache = new BeforeCacheReset(() => this.returnAll());
   /**
    * @param value - the `tabindex` to lend. `"-1"` (the default) is
    *   programmatically focusable but not a Tab stop; `"0"` is a real Tab stop,
@@ -36,6 +68,7 @@ var TabindexLoan = class {
     if (element.hasAttribute("tabindex")) return;
     element.setAttribute("tabindex", this.#value);
     this.#lent.add(element);
+    this.#beforeCache.activate();
   }
   /** Takes back every loan whose value is still the one that was lent. */
   returnAll() {
@@ -43,6 +76,7 @@ var TabindexLoan = class {
       if (element.getAttribute("tabindex") === this.#value) element.removeAttribute("tabindex");
     }
     this.#lent.clear();
+    this.#beforeCache.deactivate();
   }
 };
 

package/dist/controllers/pagination_controller.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utils/focus_candidate.ts","../../src/utils/tabindex_loan.ts","../../src/controllers/pagination_controller.ts"],"names":[],"mappings":";;;;;AAWO,SAAS,yBAAyB,OAAA,EAA+B;AACtE,EAAA,IAAI,QAAA,GAA2B,OAAA,CAAQ,OAAA,CAAQ,oBAAoB,CAAA;AACnE,EAAA,OAAO,QAAA,EAAU;AACf,IAAA,MAAM,MAAA,GAAS,KAAA,CAAM,IAAA,CAAK,QAAA,CAAS,QAAQ,CAAA,CAAE,IAAA,CAAK,CAAC,KAAA,KAAU,KAAA,CAAM,OAAA,KAAY,QAAQ,CAAA;AACvF,IAAA,IAAI,CAAC,MAAA,EAAQ,QAAA,CAAS,OAAO,GAAG,OAAO,IAAA;AACvC,IAAA,QAAA,GAAW,QAAA,CAAS,aAAA,EAAe,OAAA,CAAQ,oBAAoB,CAAA,IAAK,IAAA;AAAA,EACtE;AACA,EAAA,OAAO,KAAA;AACT;AA+CO,SAAS,aAAa,OAAA,EAA+B;AAC1D,EAAA,IAAI,OAAA,CAAQ,OAAA,CAAQ,UAAU,CAAA,EAAG,OAAO,KAAA;AACxC,EAAA,IAAI,EAAE,UAAA,IAAc,OAAA,CAAA,EAAU,OAAO,IAAA;AACrC,EAAA,IAAK,OAAA,CAAgD,UAAU,OAAO,KAAA;AACtE,EAAA,OAAO,CAAC,yBAAyB,OAAO,CAAA;AAC1C;;;AC1BO,IAAM,eAAN,MAAwD;AAAA,EACpD,MAAA;AAAA,EACA,KAAA,uBAAY,GAAA,EAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO5B,WAAA,CAAY,QAAgB,IAAA,EAAM;AAChC,IAAA,IAAA,CAAK,MAAA,GAAS,KAAA;AAAA,EAChB;AAAA;AAAA,EAGA,KAAK,OAAA,EAAkB;AACrB,IAAA,IAAI,OAAA,CAAQ,YAAA,CAAa,UAAU,CAAA,EAAG;AACtC,IAAA,OAAA,CAAQ,YAAA,CAAa,UAAA,EAAY,IAAA,CAAK,MAAM,CAAA;AAC5C,IAAA,IAAA,CAAK,KAAA,CAAM,IAAI,OAAO,CAAA;AAAA,EACxB;AAAA;AAAA,EAGA,SAAA,GAAkB;AAChB,IAAA,KAAA,MAAW,OAAA,IAAW,KAAK,KAAA,EAAO;AAChC,MAAA,IAAI,OAAA,CAAQ,aAAa,UAAU,CAAA,KAAM,KAAK,MAAA,EAAQ,OAAA,CAAQ,gBAAgB,UAAU,CAAA;AAAA,IAC1F;AACA,IAAA,IAAA,CAAK,MAAM,KAAA,EAAM;AAAA,EACnB;AACF,CAAA;;;ACfO,IAAM,oBAAA,GAAN,MAAM,qBAAA,SAA6B,UAAA,CAAwB;AAAA,EAChE,OAAgB,OAAA,GAAU,CAAC,MAAA,EAAQ,QAAQ,MAAM,CAAA;AAAA,EACjD,OAAgB,MAAA,GAAS;AAAA,IACvB,IAAA,EAAM,EAAE,IAAA,EAAM,MAAA,EAAQ,SAAS,CAAA,EAAE;AAAA,IACjC,KAAA,EAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,SAAS,CAAA;AAAE,GACpC;AAAA,EACA,OAAO,OAAA,GAAU,CAAC,MAAA,EAAQ,QAAQ,QAAQ,CAAA;AAAA,EAC1C,OAAO,MAAA,GAAS,CAAC,QAAQ,CAAA;AAAA;AAAA,EAGzB,OAAgB,cAAA,GAAiB,2CAAA;AAAA,EAUjC,YAAA,GAAe,KAAA;AAAA;AAAA,EAEN,SAAA,GAAY,IAAI,YAAA,EAAa;AAAA;AAAA,EAG7B,OAAA,GAAgB;AACvB,IAAA,IAAA,CAAK,YAAA,GAAe,IAAA;AACpB,IAAA,IAAA,CAAK,mBAAA,EAAoB;AAAA,EAC3B;AAAA;AAAA,EAGS,UAAA,GAAmB;AAC1B,IAAA,IAAA,CAAK,YAAA,GAAe,KAAA;AACpB,IAAA,IAAA,CAAK,UAAU,SAAA,EAAU;AAAA,EAC3B;AAAA;AAAA,EAGA,gBAAA,GAAyB;AACvB,IAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACxB,IAAA,IAAA,CAAK,mBAAA,EAAoB;AAAA,EAC3B;AAAA;AAAA,EAGA,iBAAA,GAA0B;AACxB,IAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACxB,IAAA,IAAA,CAAK,mBAAA,EAAoB;AAAA,EAC3B;AAAA;AAAA,EAGA,mBAAA,GAA4B;AAC1B,IAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACxB,IAAA,IAAA,CAAK,OAAA,EAAQ;AAAA,EACf;AAAA;AAAA,EAGA,mBAAA,GAA4B;AAC1B,IAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACxB,IAAA,IAAA,CAAK,OAAA,EAAQ;AAAA,EACf;AAAA;AAAA,EAGA,mBAAA,GAA4B;AAC1B,IAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACxB,IAAA,IAAA,CAAK,OAAA,EAAQ;AAAA,EACf;AAAA;AAAA,EAGA,OAAO,KAAA,EAAoB;AACzB,IAAA,MAAM,SAAS,KAAA,CAAM,aAAA;AACrB,IAAA,MAAM,GAAA,GAAM,OAAO,OAAA,CAAQ,IAAA;AAC3B,IAAA,IAAI,GAAA,KAAQ,MAAA,IAAa,GAAA,CAAI,IAAA,OAAW,EAAA,EAAI;AAC5C,IAAA,MAAM,IAAA,GAAO,OAAO,GAAG,CAAA;AAGvB,IAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,IAAI,CAAA,EAAG;AAC7B,IAAA,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EACjB;AAAA;AAAA,EAGA,IAAA,GAAa;AACX,IAAA,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,KAAA,GAAQ,CAAC,CAAA;AAAA,EAC3B;AAAA;AAAA,EAGA,IAAA,GAAa;AACX,IAAA,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,KAAA,GAAQ,CAAC,CAAA;AAAA,EAC3B;AAAA;AAAA,EAGA,MAAM,IAAA,EAAoB;AACxB,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,IAAI,CAAA,EAAG;AAC5B,IAAA,MAAM,WAAW,IAAA,CAAK,KAAA;AACtB,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,MAAA,CAAO,IAAI,CAAA;AAC/B,IAAA,IAAI,WAAW,QAAA,EAAU;AACzB,IAAA,IAAA,CAAK,SAAA,GAAY,MAAA;AACjB,IAAA,IAAA,CAAK,OAAA,EAAQ;AACb,IAAA,IAAA,CAAK,SAAS,QAAA,EAAU;AAAA,MACtB,QAAQ,EAAE,IAAA,EAAM,QAAQ,KAAA,EAAO,IAAA,CAAK,QAAQ,QAAA;AAAS,KACtD,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,mBAAA,GAA4B;AAG1B,IAAA,MAAM,QAAQ,IAAA,CAAK,MAAA;AACnB,IAAA,IAAI,CAAC,OAAO,EAAA,CAAG,KAAA,EAAO,KAAK,UAAU,CAAA,OAAQ,UAAA,GAAa,KAAA;AAC1D,IAAA,MAAM,OAAO,IAAA,CAAK,KAAA;AAClB,IAAA,IAAI,CAAC,OAAO,EAAA,CAAG,IAAA,EAAM,KAAK,SAAS,CAAA,OAAQ,SAAA,GAAY,IAAA;AACvD,IAAA,IAAA,CAAK,OAAA,EAAQ;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAA,GAAgB;AACd,IAAA,MAAM,OAAO,IAAA,CAAK,KAAA;AAClB,IAAA,KAAA,MAAW,MAAA,IAAU,KAAK,WAAA,EAAa;AACrC,MAAA,IAAI,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,IAAI,MAAM,IAAA,EAAM;AACxC,QAAA,MAAA,CAAO,YAAA,CAAa,gBAAgB,MAAM,CAAA;AAAA,MAC5C,CAAA,MAAO;AACL,QAAA,MAAA,CAAO,gBAAgB,cAAc,CAAA;AAAA,MACvC;AAAA,IACF;AAEA,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,aAAA,GAAgB,IAAA,CAAK,UAAA,GAAa,IAAA;AACpD,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,aAAA,GAAgB,IAAA,CAAK,UAAA,GAAa,IAAA;AACpD,IAAA,MAAM,UAAU,IAAA,IAAQ,CAAA;AACxB,IAAA,MAAM,KAAA,GAAQ,QAAQ,IAAA,CAAK,MAAA;AAI3B,IAAA,MAAM,iBAAA,GAAoB,IAAA,CAAK,cAAA,CAAe,IAAA,EAAM,OAAO,CAAA;AAC3D,IAAA,MAAM,iBAAA,GAAoB,IAAA,CAAK,cAAA,CAAe,IAAA,EAAM,KAAK,CAAA;AAGzD,IAAA,IAAA,CAAK,QAAA,CAAS,MAAM,OAAO,CAAA;AAC3B,IAAA,IAAA,CAAK,QAAA,CAAS,MAAM,KAAK,CAAA;AACzB,IAAA,IAAA,CAAK,QAAA,CAAS,IAAA,EAAM,OAAA,EAAS,iBAAA,GAAoB,OAAO,IAAI,CAAA;AAC5D,IAAA,IAAA,CAAK,QAAA,CAAS,IAAA,EAAM,KAAA,EAAO,iBAAA,GAAoB,OAAO,IAAI,CAAA;AAAA,EAC5D;AAAA;AAAA,EAGA,cAAA,CAAe,QAAkC,UAAA,EAA8B;AAC7E,IAAA,IAAI,CAAC,QAAQ,OAAO,IAAA;AACpB,IAAA,IAAI,YAAY,OAAO,IAAA;AAEvB,IAAA,OAAO,MAAA,CAAO,QAAA,IAAY,CAAC,IAAA,CAAK,MAAM,MAAM,CAAA;AAAA,EAC9C;AAAA;AAAA,EAGA,QAAA,CAAS,QAAkC,UAAA,EAA2B;AACpE,IAAA,IAAI,CAAC,MAAA,IAAU,UAAA,IAAc,CAAC,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,EAAG;AAClD,IAAA,MAAA,CAAO,QAAA,GAAW,KAAA;AAClB,IAAA,MAAA,CAAO,eAAA,CAAgB,sBAAqB,cAAc,CAAA;AAAA,EAC5D;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,QAAA,CACE,MAAA,EACA,UAAA,EACA,QAAA,EACM;AACN,IAAA,IAAI,CAAC,MAAA,IAAU,CAAC,UAAA,EAAY;AAC5B,IAAA,IAAI,OAAO,QAAA,IAAY,CAAC,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,EAAG;AAC5C,IAAA,IAAI,MAAA,KAAW,QAAA,CAAS,aAAA,EAAe,IAAA,CAAK,mBAAmB,QAAQ,CAAA;AACvE,IAAA,MAAA,CAAO,QAAA,GAAW,IAAA;AAClB,IAAA,MAAA,CAAO,YAAA,CAAa,qBAAA,CAAqB,cAAA,EAAgB,EAAE,CAAA;AAAA,EAC7D;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,mBAAmB,QAAA,EAA0C;AAC3D,IAAA,MAAM,OAAO,IAAA,CAAK,KAAA;AAClB,IAAA,MAAM,WAAA,GAAc,KAAK,WAAA,CAAY,IAAA;AAAA,MACnC,CAAC,SAAA,KAAc,MAAA,CAAO,SAAA,CAAU,OAAA,CAAQ,IAAI,CAAA,KAAM;AAAA,KACpD;AAQA,IAAA,MAAM,WAAA,GAAc,CAAC,QAAA,EAAU,WAAW,CAAA,CAAE,IAAA;AAAA,MAC1C,CAAC,SAAA,KAAwC,SAAA,IAAa,IAAA,IAAQ,aAAa,SAAS;AAAA,KACtF;AACA,IAAA,IAAI,WAAA,EAAa;AACf,MAAA,WAAA,CAAY,KAAA,EAAM;AAClB,MAAA;AAAA,IACF;AAMA,IAAA,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,IAAA,CAAK,OAAO,CAAA;AAChC,IAAA,IAAA,CAAK,QAAQ,KAAA,EAAM;AAAA,EACrB;AAAA;AAAA,EAGA,IAAI,MAAA,GAAiB;AACnB,IAAA,MAAM,QAAQ,IAAA,CAAK,UAAA;AACnB,IAAA,OAAO,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA,GAAI,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,KAAA,CAAM,KAAK,CAAC,CAAA,GAAI,CAAA;AAAA,EACnE;AAAA;AAAA,EAGA,IAAI,KAAA,GAAgB;AAClB,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,SAAS,CAAA;AAAA,EACnC;AAAA;AAAA,EAGA,OAAO,IAAA,EAAsB;AAC3B,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,IAAI,GAAG,OAAO,CAAA;AACnC,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,MAAA,EAAQ,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,KAAA,CAAM,IAAI,CAAC,CAAC,CAAA;AAAA,EAC5D;AAAA;AAAA,EAGA,MAAM,MAAA,EAAoC;AACxC,IAAA,OAAO,MAAA,CAAO,YAAA,CAAa,qBAAA,CAAqB,cAAc,CAAA;AAAA,EAChE;AACF","file":"pagination_controller.js","sourcesContent":["/**\n * Whether a disabled `<fieldset>` ancestor actually reaches `control`.\n *\n * HTML exempts the contents of a fieldset's **first direct-child `<legend>`**, and\n * the exemption is per fieldset — a control legal in one legend can still be\n * disabled by a second, outer fieldset, so the walk continues upward.\n *\n * Exported for the consumer that needs this rule *without* the rest of\n * {@link canTakeFocus}: `toolbar` bounds its own `hidden` walk at the toolbar\n * root, which is a different rule, so it composes the two itself.\n */\nexport function inheritsFieldsetDisabled(control: HTMLElement): boolean {\n  let fieldset: Element | null = control.closest(\"fieldset[disabled]\");\n  while (fieldset) {\n    const legend = Array.from(fieldset.children).find((child) => child.tagName === \"LEGEND\");\n    if (!legend?.contains(control)) return true;\n    fieldset = fieldset.parentElement?.closest(\"fieldset[disabled]\") ?? null;\n  }\n  return false;\n}\n\n/**\n * Whether an element can actually take focus, checked **before** `focus()` runs.\n *\n * A controller that must move focus off a control it is about to disable or hide\n * picks a destination and calls `focus()` on it. If that destination cannot take\n * focus, the call **fails silently**: `hidden` and natively `disabled` elements\n * swallow it, so the caret stays in the subtree that is disappearing and lands on\n * `<body>` a frame later — the exact outcome the rescue exists to prevent, minus\n * any signal that it happened.\n *\n * Testing after the fact is the obvious alternative and is deliberately not the\n * rule. Reading `document.activeElement` back only works in a real browser, and\n * looping over candidates that way performs a real focus move per failure —\n * observable to assistive technology. Checking first costs nothing and catches\n * the cases that actually occur.\n *\n * **`aria-disabled` is not disqualifying.** It is the attribute an author uses\n * for a control that must stay *discoverable*, and the roving contract keeps\n * such items reachable. Only the three conditions that make the platform refuse\n * focus are checked: `hidden` (an ancestor's counts), the native `disabled`\n * property, and `disabled` inherited from an ancestor `fieldset`. CSS-only\n * invisibility is not detectable here and stays the consumer's problem.\n *\n * Reading `:disabled` instead of walking the fieldset chain would be shorter, but\n * that pseudo-class is not evaluated consistently outside real browsers and this\n * has to be right headlessly too. happy-dom in particular focuses a `<button>`\n * inside a disabled fieldset where a real engine refuses, so the inheritance is\n * spelled out rather than delegated.\n *\n * What a consumer does when nothing survives is its own call: some fall back to\n * their landmark, while a widget whose caret already sits somewhere legitimate\n * refuses the move outright rather than relocating it.\n *\n * @example\n * ```ts\n * const target = candidates.find(canTakeFocus);\n * if (target) target.focus();\n * else {\n *   this.#tabindex.lend(this.element); // nothing left: fall back to the landmark\n *   this.element.focus();\n * }\n * ```\n *\n * @param element - the candidate destination\n */\nexport function canTakeFocus(element: HTMLElement): boolean {\n  if (element.closest(\"[hidden]\")) return false;\n  if (!(\"disabled\" in element)) return true;\n  if ((element as HTMLElement & { disabled: boolean }).disabled) return false;\n  return !inheritsFieldsetDisabled(element);\n}\n","/**\n * Shared bookkeeping for a `tabindex` a controller lends an element temporarily.\n *\n * A controller that must move focus somewhere the author never made focusable\n * (a landmark root, a scroll destination) reaches for the same trick: add a\n * `tabindex` just-in-time and hand it back once it is no longer needed. The\n * borrow is the easy half; the return is what the two conditions below are for.\n *\n * **Returning needs two conditions, not one.** Owning the borrow is not enough:\n * the attribute must also still hold the value this instance wrote. A consumer\n * that changed it afterwards — `tabindex=\"0\"` to make the root its own Tab stop\n * — owns it now, and removing it there silently discards authored markup. The\n * bookkeeping is dropped either way, since the loan is over regardless of who\n * ends up owning the value.\n *\n * **Never borrow over an existing value.** An element that already carries a\n * `tabindex` is the author's to control, so there is nothing to lend and nothing\n * to return.\n *\n * The registry is keyed by element, so a controller borrowing on a single\n * element (`this.element`) and one borrowing across a changing set of targets\n * use the same API — the single-element case is a set of one. It holds no\n * opinion about *when* to borrow or where focus goes next; that stays in the\n * controller.\n *\n * **The API is deliberately two methods.** This file's own doc block is dropped\n * from `dist`, but every member comment is inlined into **each** consumer entry\n * (`tsup` builds with `splitting: false`), so rationale belongs here, only the\n * contract belongs on the members, and every method no consumer calls is still\n * paid for once per consumer entry.\n *\n * @example\n * ```ts\n * readonly #tabindex = new TabindexLoan();\n *\n * #rescueFocus() {\n *   this.#tabindex.lend(this.element);\n *   this.element.focus();\n * }\n *\n * disconnect() {\n *   this.#tabindex.returnAll();\n * }\n * ```\n */\nexport class TabindexLoan<T extends HTMLElement = HTMLElement> {\n  readonly #value: string;\n  readonly #lent = new Set<T>();\n\n  /**\n   * @param value - the `tabindex` to lend. `\"-1\"` (the default) is\n   *   programmatically focusable but not a Tab stop; `\"0\"` is a real Tab stop,\n   *   which a scroll region with no focusable content of its own needs.\n   */\n  constructor(value: string = \"-1\") {\n    this.#value = value;\n  }\n\n  /** Lends `element` the value; no-ops when it already carries a `tabindex`. */\n  lend(element: T): void {\n    if (element.hasAttribute(\"tabindex\")) return;\n    element.setAttribute(\"tabindex\", this.#value);\n    this.#lent.add(element);\n  }\n\n  /** Takes back every loan whose value is still the one that was lent. */\n  returnAll(): void {\n    for (const element of this.#lent) {\n      if (element.getAttribute(\"tabindex\") === this.#value) element.removeAttribute(\"tabindex\");\n    }\n    this.#lent.clear();\n  }\n}\n","import { Controller } from \"@hotwired/stimulus\";\nimport { canTakeFocus } from \"../utils/focus_candidate\";\nimport { TabindexLoan } from \"../utils/tabindex_loan\";\n\n/**\n * Headless, accessible pagination behavior.\n *\n * Markup contract (identifier: `stimeo--pagination`):\n *   <nav data-controller=\"stimeo--pagination\" aria-label=\"Pagination\"\n *        data-stimeo--pagination-page-value=\"1\"\n *        data-stimeo--pagination-total-value=\"5\">\n *     <button type=\"button\" data-stimeo--pagination-target=\"prev\"\n *             data-action=\"click->stimeo--pagination#prev\">Prev</button>\n *     <button type=\"button\" data-page=\"1\" aria-current=\"page\"\n *             data-stimeo--pagination-target=\"page\"\n *             data-action=\"click->stimeo--pagination#select\">1</button>\n *     <!-- more page buttons -->\n *     <button type=\"button\" data-stimeo--pagination-target=\"next\"\n *             data-action=\"click->stimeo--pagination#next\">Next</button>\n *   </nav>\n *\n * There is no dedicated APG pattern; this uses a navigation landmark plus\n * `aria-current=\"page\"`. The controller owns current-page state, the\n * `aria-current` sync, boundary disabling of prev/next, and the change event.\n * Generating/eliding the page buttons and fetching data stay with the consumer.\n *\n * `prev`/`next` must be real `<button>` elements: the boundary state is applied\n * through the native `disabled` property, which no other element honors.\n *\n * @remarks\n * Behavior only — each control is in the natural Tab order (no roving). When a\n * boundary disables the button that currently has focus, focus is moved first so\n * it is never lost to a `disabled` element.\n *\n * Behavior provided:\n * - `select` reads the clicked button's `data-page` and makes it current. The\n *   value must parse as an integer; blank/fractional/non-numeric ones are ignored.\n * - `prev`/`next` step by one, clamped to `[1, total]`.\n * - The current page button gets `aria-current=\"page\"` (removed from the rest);\n *   `prev` is `disabled` at page 1 and `next` at `total`.\n * - `page`/`total` are normalized (`total` to a finite integer >= 1, `page` into\n *   `[1, total]`) on connect **and** on every runtime Value change, so JS-driven\n *   updates re-render. Normalization never dispatches `change`: it is a display\n *   correction, not a user navigation, and the initial render is consumer-owned.\n * - Page/boundary buttons swapped in at runtime re-render through the Stimulus\n *   target callbacks, so a consumer-regenerated button list stays in sync.\n * - Every navigation dispatches `stimeo--pagination:change`, whose `detail.total`\n *   is the same normalized total the boundary state is derived from.\n *\n * The boundary `disabled` is **owned**: the controller marks what it disabled\n * with `data-stimeo--pagination-boundary-disabled` and releases only that. A\n * button already disabled by the consumer is never marked when it overlaps a\n * boundary, so loading / permission state survives both entering and leaving the\n * boundary. The marker lives in the DOM rather than in a field so ownership\n * survives a Turbo cache restore, where a fresh instance would otherwise either\n * strand or steal the flag.\n */\nexport class PaginationController extends Controller<HTMLElement> {\n  static override targets = [\"page\", \"prev\", \"next\"];\n  static override values = {\n    page: { type: Number, default: 1 },\n    total: { type: Number, default: 1 },\n  };\n  static actions = [\"next\", \"prev\", \"select\"] as const;\n  static events = [\"change\"] as const;\n\n  /** Marks a `disabled` this controller applied at a boundary (ownership flag). */\n  static readonly #BOUNDARY_ATTR = \"data-stimeo--pagination-boundary-disabled\";\n\n  declare readonly pageTargets: HTMLElement[];\n  declare readonly prevTarget: HTMLButtonElement;\n  declare readonly nextTarget: HTMLButtonElement;\n  declare readonly hasPrevTarget: boolean;\n  declare readonly hasNextTarget: boolean;\n  declare pageValue: number;\n  declare totalValue: number;\n\n  #isConnected = false;\n  /** The `tabindex` this instance lends the root for the focus fallback. */\n  readonly #tabindex = new TabindexLoan();\n\n  /** Normalizes out-of-range initial values and renders the initial state. */\n  override connect(): void {\n    this.#isConnected = true;\n    this.#normalizeAndRender();\n  }\n\n  /** Reverts the one attribute the controller adds outside its state hooks. */\n  override disconnect(): void {\n    this.#isConnected = false;\n    this.#tabindex.returnAll();\n  }\n\n  /** Re-renders when application code (or a Turbo morph) changes `page` at runtime. */\n  pageValueChanged(): void {\n    if (!this.#isConnected) return;\n    this.#normalizeAndRender();\n  }\n\n  /** Re-renders when application code (or a Turbo morph) changes `total` at runtime. */\n  totalValueChanged(): void {\n    if (!this.#isConnected) return;\n    this.#normalizeAndRender();\n  }\n\n  /** Syncs a page button appended/replaced at runtime (the consumer owns the list). */\n  pageTargetConnected(): void {\n    if (!this.#isConnected) return;\n    this.#render();\n  }\n\n  /** Syncs a `prev` button appended/replaced at runtime. */\n  prevTargetConnected(): void {\n    if (!this.#isConnected) return;\n    this.#render();\n  }\n\n  /** Syncs a `next` button appended/replaced at runtime. */\n  nextTargetConnected(): void {\n    if (!this.#isConnected) return;\n    this.#render();\n  }\n\n  /** Makes the clicked page button (its `data-page`) current. */\n  select(event: Event): void {\n    const button = event.currentTarget as HTMLElement;\n    const raw = button.dataset.page;\n    if (raw === undefined || raw.trim() === \"\") return;\n    const page = Number(raw);\n    // Integer-only, matching `stimeo--stepper`: `Number(\"\")` is 0 and `Number(\"2.7\")`\n    // truncates, so a bare finite check would accept meaningless page numbers.\n    if (!Number.isInteger(page)) return;\n    this.#goto(page);\n  }\n\n  /** Steps to the previous page. */\n  prev(): void {\n    this.#goto(this.#page - 1);\n  }\n\n  /** Steps to the next page. */\n  next(): void {\n    this.#goto(this.#page + 1);\n  }\n\n  /** Moves to `page` (clamped to `[1, total]`), re-renders, and dispatches `change`. */\n  #goto(page: number): void {\n    if (!Number.isFinite(page)) return;\n    const previous = this.#page;\n    const target = this.#clamp(page);\n    if (target === previous) return;\n    this.pageValue = target;\n    this.#render();\n    this.dispatch(\"change\", {\n      detail: { page: target, total: this.#total, previous },\n    });\n  }\n\n  /** Writes the normalized Values back (only when they differ) and renders. */\n  #normalizeAndRender(): void {\n    // Stimulus setters rewrite the data attribute unconditionally, so guard the\n    // no-op case to avoid waking consumer MutationObservers for nothing.\n    const total = this.#total;\n    if (!Object.is(total, this.totalValue)) this.totalValue = total;\n    const page = this.#page;\n    if (!Object.is(page, this.pageValue)) this.pageValue = page;\n    this.#render();\n  }\n\n  /**\n   * Syncs `aria-current` on the page buttons and the prev/next `disabled` state.\n   *\n   * @stimeoRenderRoot\n   */\n  #render(): void {\n    const page = this.#page;\n    for (const button of this.pageTargets) {\n      if (Number(button.dataset.page) === page) {\n        button.setAttribute(\"aria-current\", \"page\");\n      } else {\n        button.removeAttribute(\"aria-current\");\n      }\n    }\n\n    const prev = this.hasPrevTarget ? this.prevTarget : null;\n    const next = this.hasNextTarget ? this.nextTarget : null;\n    const atStart = page <= 1;\n    const atEnd = page >= this.#total;\n    // Resolve both post-render states up front: a focus hand-off must target the\n    // opposite button as it will be *after* this pass, not as it is now (moving\n    // between the two boundaries of a 2-page set re-enables it in the same pass).\n    const prevStaysDisabled = this.#disabledAfter(prev, atStart);\n    const nextStaysDisabled = this.#disabledAfter(next, atEnd);\n    // Release before disabling, so the hand-off can land on a button this same\n    // pass re-enables (focusing a still-`disabled` button is a no-op).\n    this.#release(prev, atStart);\n    this.#release(next, atEnd);\n    this.#disable(prev, atStart, nextStaysDisabled ? null : next);\n    this.#disable(next, atEnd, prevStaysDisabled ? null : prev);\n  }\n\n  /** Whether a boundary button will still be `disabled` once this render applies. */\n  #disabledAfter(button: HTMLButtonElement | null, atBoundary: boolean): boolean {\n    if (!button) return true;\n    if (atBoundary) return true;\n    // Away from a boundary, only the controller's own `disabled` is released.\n    return button.disabled && !this.#owns(button);\n  }\n\n  /** Releases the boundary `disabled` this controller owns, once away from it. */\n  #release(button: HTMLButtonElement | null, atBoundary: boolean): void {\n    if (!button || atBoundary || !this.#owns(button)) return;\n    button.disabled = false;\n    button.removeAttribute(PaginationController.#BOUNDARY_ATTR);\n  }\n\n  /**\n   * Disables a boundary button, first moving focus off it when it is the active\n   * element so disabling never strands focus.\n   */\n  #disable(\n    button: HTMLButtonElement | null,\n    atBoundary: boolean,\n    opposite: HTMLButtonElement | null,\n  ): void {\n    if (!button || !atBoundary) return;\n    if (button.disabled && !this.#owns(button)) return;\n    if (button === document.activeElement) this.#moveFocusAwayFrom(opposite);\n    button.disabled = true;\n    button.setAttribute(PaginationController.#BOUNDARY_ATTR, \"\");\n  }\n\n  /**\n   * Moves focus to `opposite` (already resolved to `null` when it will stay\n   * disabled), else to the current page button, else to the landmark itself.\n   */\n  #moveFocusAwayFrom(opposite: HTMLButtonElement | null): void {\n    const page = this.#page;\n    const currentPage = this.pageTargets.find(\n      (candidate) => Number(candidate.dataset.page) === page,\n    );\n    // Checked before the call, never after: `hidden` and natively disabled\n    // elements swallow `focus()` silently, so an unchecked destination leaves the\n    // caret in the subtree that is about to disable and drops it to <body> a frame\n    // later — the outcome this rescue exists to prevent.\n    // Narrowed to `HTMLElement`, not `HTMLButtonElement`: `pageTargets` is typed\n    // `HTMLElement[]`, so a page control can legitimately be an `<a>`. The\n    // destination is only ever focused, so the wider type is the honest one.\n    const destination = [opposite, currentPage].find(\n      (candidate): candidate is HTMLElement => candidate != null && canTakeFocus(candidate),\n    );\n    if (destination) {\n      destination.focus();\n      return;\n    }\n    // Nothing left to hand focus to (a lone boundary button, or every page button\n    // disabled): keep it inside the pagination landmark instead of letting the\n    // browser drop it to <body> when the button disables. The root is made\n    // programmatically focusable just-in-time with `tabindex=\"-1\"`, which is not a\n    // Tab stop; `disconnect()` removes it again when this controller added it.\n    this.#tabindex.lend(this.element);\n    this.element.focus();\n  }\n\n  /** Total pages, normalized to a finite integer >= 1. */\n  get #total(): number {\n    const total = this.totalValue;\n    return Number.isFinite(total) ? Math.max(1, Math.trunc(total)) : 1;\n  }\n\n  /** The current page, normalized into `[1, total]`. */\n  get #page(): number {\n    return this.#clamp(this.pageValue);\n  }\n\n  /** Constrains `page` to `[1, total]`; a non-finite page falls back to page 1. */\n  #clamp(page: number): number {\n    if (!Number.isFinite(page)) return 1;\n    return Math.min(this.#total, Math.max(1, Math.trunc(page)));\n  }\n\n  /** Whether the button's current `disabled` was applied by boundary control. */\n  #owns(button: HTMLButtonElement): boolean {\n    return button.hasAttribute(PaginationController.#BOUNDARY_ATTR);\n  }\n}\n"]}
+{"version":3,"sources":["../../src/utils/focus_candidate.ts","../../src/utils/before_cache_reset.ts","../../src/utils/tabindex_loan.ts","../../src/controllers/pagination_controller.ts"],"names":[],"mappings":";;;;;AAWO,SAAS,yBAAyB,OAAA,EAA+B;AACtE,EAAA,IAAI,QAAA,GAA2B,OAAA,CAAQ,OAAA,CAAQ,oBAAoB,CAAA;AACnE,EAAA,OAAO,QAAA,EAAU;AACf,IAAA,MAAM,MAAA,GAAS,KAAA,CAAM,IAAA,CAAK,QAAA,CAAS,QAAQ,CAAA,CAAE,IAAA,CAAK,CAAC,KAAA,KAAU,KAAA,CAAM,OAAA,KAAY,QAAQ,CAAA;AACvF,IAAA,IAAI,CAAC,MAAA,EAAQ,QAAA,CAAS,OAAO,GAAG,OAAO,IAAA;AACvC,IAAA,QAAA,GAAW,QAAA,CAAS,aAAA,EAAe,OAAA,CAAQ,oBAAoB,CAAA,IAAK,IAAA;AAAA,EACtE;AACA,EAAA,OAAO,KAAA;AACT;AAgDO,SAAS,aAAa,OAAA,EAA+B;AAC1D,EAAA,IAAI,OAAA,CAAQ,OAAA,CAAQ,mBAAmB,CAAA,EAAG,OAAO,KAAA;AACjD,EAAA,IAAI,OAAA,YAAmB,gBAAA,IAAoB,OAAA,CAAQ,IAAA,KAAS,UAAU,OAAO,KAAA;AAC7E,EAAA,IAAI,EAAE,UAAA,IAAc,OAAA,CAAA,EAAU,OAAO,IAAA;AACrC,EAAA,IAAK,OAAA,CAAgD,UAAU,OAAO,KAAA;AACtE,EAAA,OAAO,CAAC,yBAAyB,OAAO,CAAA;AAC1C;;;AC9BO,IAAM,gBAAA,GAAN,MAAM,iBAAA,CAAiB;AAAA;AAAA,EAE5B,OAAgB,YAAA,mBAAe,IAAI,GAAA,EAAsB;AAAA;AAAA,EAGzD,OAAgB,iBAAiB,MAAY;AAC3C,IAAA,KAAA,MAAW,UAAA,IAAc,iBAAA,CAAiB,YAAA,EAAc,UAAA,CAAW,OAAA,EAAQ;AAAA,EAC7E,CAAA;AAAA,EAES,OAAA;AAAA;AAAA,EAGT,YAAY,MAAA,EAAoB;AAC9B,IAAA,IAAA,CAAK,OAAA,GAAU,MAAA;AAAA,EACjB;AAAA;AAAA,EAGA,QAAA,GAAiB;AACf,IAAA,MAAM,KAAA,GAAQ,iBAAA,CAAiB,YAAA,CAAa,IAAA,KAAS,CAAA;AACrD,IAAA,iBAAA,CAAiB,YAAA,CAAa,IAAI,IAAI,CAAA;AACtC,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,QAAA,CAAS,gBAAA,CAAiB,oBAAA,EAAsB,iBAAA,CAAiB,cAAc,CAAA;AAAA,IACjF;AAAA,EACF;AAAA;AAAA,EAGA,UAAA,GAAmB;AACjB,IAAA,iBAAA,CAAiB,YAAA,CAAa,OAAO,IAAI,CAAA;AACzC,IAAA,IAAI,iBAAA,CAAiB,YAAA,CAAa,IAAA,GAAO,CAAA,EAAG;AAC5C,IAAA,QAAA,CAAS,mBAAA,CAAoB,oBAAA,EAAsB,iBAAA,CAAiB,cAAc,CAAA;AAAA,EACpF;AACF,CAAA;;;ACtBO,IAAM,eAAN,MAAwD;AAAA,EACpD,MAAA;AAAA,EACA,KAAA,uBAAY,GAAA,EAAO;AAAA;AAAA,EAEnB,eAAe,IAAI,gBAAA,CAAiB,MAAM,IAAA,CAAK,WAAW,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOnE,WAAA,CAAY,QAAgB,IAAA,EAAM;AAChC,IAAA,IAAA,CAAK,MAAA,GAAS,KAAA;AAAA,EAChB;AAAA;AAAA,EAGA,KAAK,OAAA,EAAkB;AACrB,IAAA,IAAI,OAAA,CAAQ,YAAA,CAAa,UAAU,CAAA,EAAG;AACtC,IAAA,OAAA,CAAQ,YAAA,CAAa,UAAA,EAAY,IAAA,CAAK,MAAM,CAAA;AAC5C,IAAA,IAAA,CAAK,KAAA,CAAM,IAAI,OAAO,CAAA;AAGtB,IAAA,IAAA,CAAK,aAAa,QAAA,EAAS;AAAA,EAC7B;AAAA;AAAA,EAGA,SAAA,GAAkB;AAChB,IAAA,KAAA,MAAW,OAAA,IAAW,KAAK,KAAA,EAAO;AAChC,MAAA,IAAI,OAAA,CAAQ,aAAa,UAAU,CAAA,KAAM,KAAK,MAAA,EAAQ,OAAA,CAAQ,gBAAgB,UAAU,CAAA;AAAA,IAC1F;AACA,IAAA,IAAA,CAAK,MAAM,KAAA,EAAM;AACjB,IAAA,IAAA,CAAK,aAAa,UAAA,EAAW;AAAA,EAC/B;AACF,CAAA;;;AC1BO,IAAM,oBAAA,GAAN,MAAM,qBAAA,SAA6B,UAAA,CAAwB;AAAA,EAChE,OAAgB,OAAA,GAAU,CAAC,MAAA,EAAQ,QAAQ,MAAM,CAAA;AAAA,EACjD,OAAgB,MAAA,GAAS;AAAA,IACvB,IAAA,EAAM,EAAE,IAAA,EAAM,MAAA,EAAQ,SAAS,CAAA,EAAE;AAAA,IACjC,KAAA,EAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,SAAS,CAAA;AAAE,GACpC;AAAA,EACA,OAAO,OAAA,GAAU,CAAC,MAAA,EAAQ,QAAQ,QAAQ,CAAA;AAAA,EAC1C,OAAO,MAAA,GAAS,CAAC,QAAQ,CAAA;AAAA;AAAA,EAGzB,OAAgB,cAAA,GAAiB,2CAAA;AAAA,EAUjC,YAAA,GAAe,KAAA;AAAA;AAAA,EAEN,SAAA,GAAY,IAAI,YAAA,EAAa;AAAA;AAAA,EAG7B,OAAA,GAAgB;AACvB,IAAA,IAAA,CAAK,YAAA,GAAe,IAAA;AACpB,IAAA,IAAA,CAAK,mBAAA,EAAoB;AAAA,EAC3B;AAAA;AAAA,EAGS,UAAA,GAAmB;AAC1B,IAAA,IAAA,CAAK,YAAA,GAAe,KAAA;AACpB,IAAA,IAAA,CAAK,UAAU,SAAA,EAAU;AAAA,EAC3B;AAAA;AAAA,EAGA,gBAAA,GAAyB;AACvB,IAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACxB,IAAA,IAAA,CAAK,mBAAA,EAAoB;AAAA,EAC3B;AAAA;AAAA,EAGA,iBAAA,GAA0B;AACxB,IAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACxB,IAAA,IAAA,CAAK,mBAAA,EAAoB;AAAA,EAC3B;AAAA;AAAA,EAGA,mBAAA,GAA4B;AAC1B,IAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACxB,IAAA,IAAA,CAAK,OAAA,EAAQ;AAAA,EACf;AAAA;AAAA,EAGA,mBAAA,GAA4B;AAC1B,IAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACxB,IAAA,IAAA,CAAK,OAAA,EAAQ;AAAA,EACf;AAAA;AAAA,EAGA,mBAAA,GAA4B;AAC1B,IAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACxB,IAAA,IAAA,CAAK,OAAA,EAAQ;AAAA,EACf;AAAA;AAAA,EAGA,OAAO,KAAA,EAAoB;AACzB,IAAA,MAAM,SAAS,KAAA,CAAM,aAAA;AACrB,IAAA,MAAM,GAAA,GAAM,OAAO,OAAA,CAAQ,IAAA;AAC3B,IAAA,IAAI,GAAA,KAAQ,MAAA,IAAa,GAAA,CAAI,IAAA,OAAW,EAAA,EAAI;AAC5C,IAAA,MAAM,IAAA,GAAO,OAAO,GAAG,CAAA;AAGvB,IAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,IAAI,CAAA,EAAG;AAC7B,IAAA,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EACjB;AAAA;AAAA,EAGA,IAAA,GAAa;AACX,IAAA,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,KAAA,GAAQ,CAAC,CAAA;AAAA,EAC3B;AAAA;AAAA,EAGA,IAAA,GAAa;AACX,IAAA,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,KAAA,GAAQ,CAAC,CAAA;AAAA,EAC3B;AAAA;AAAA,EAGA,MAAM,IAAA,EAAoB;AACxB,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,IAAI,CAAA,EAAG;AAC5B,IAAA,MAAM,WAAW,IAAA,CAAK,KAAA;AACtB,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,MAAA,CAAO,IAAI,CAAA;AAC/B,IAAA,IAAI,WAAW,QAAA,EAAU;AACzB,IAAA,IAAA,CAAK,SAAA,GAAY,MAAA;AACjB,IAAA,IAAA,CAAK,OAAA,EAAQ;AACb,IAAA,IAAA,CAAK,SAAS,QAAA,EAAU;AAAA,MACtB,QAAQ,EAAE,IAAA,EAAM,QAAQ,KAAA,EAAO,IAAA,CAAK,QAAQ,QAAA;AAAS,KACtD,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,mBAAA,GAA4B;AAG1B,IAAA,MAAM,QAAQ,IAAA,CAAK,MAAA;AACnB,IAAA,IAAI,CAAC,OAAO,EAAA,CAAG,KAAA,EAAO,KAAK,UAAU,CAAA,OAAQ,UAAA,GAAa,KAAA;AAC1D,IAAA,MAAM,OAAO,IAAA,CAAK,KAAA;AAClB,IAAA,IAAI,CAAC,OAAO,EAAA,CAAG,IAAA,EAAM,KAAK,SAAS,CAAA,OAAQ,SAAA,GAAY,IAAA;AACvD,IAAA,IAAA,CAAK,OAAA,EAAQ;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAA,GAAgB;AACd,IAAA,MAAM,OAAO,IAAA,CAAK,KAAA;AAClB,IAAA,KAAA,MAAW,MAAA,IAAU,KAAK,WAAA,EAAa;AACrC,MAAA,IAAI,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,IAAI,MAAM,IAAA,EAAM;AACxC,QAAA,MAAA,CAAO,YAAA,CAAa,gBAAgB,MAAM,CAAA;AAAA,MAC5C,CAAA,MAAO;AACL,QAAA,MAAA,CAAO,gBAAgB,cAAc,CAAA;AAAA,MACvC;AAAA,IACF;AAEA,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,aAAA,GAAgB,IAAA,CAAK,UAAA,GAAa,IAAA;AACpD,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,aAAA,GAAgB,IAAA,CAAK,UAAA,GAAa,IAAA;AACpD,IAAA,MAAM,UAAU,IAAA,IAAQ,CAAA;AACxB,IAAA,MAAM,KAAA,GAAQ,QAAQ,IAAA,CAAK,MAAA;AAI3B,IAAA,MAAM,iBAAA,GAAoB,IAAA,CAAK,cAAA,CAAe,IAAA,EAAM,OAAO,CAAA;AAC3D,IAAA,MAAM,iBAAA,GAAoB,IAAA,CAAK,cAAA,CAAe,IAAA,EAAM,KAAK,CAAA;AAGzD,IAAA,IAAA,CAAK,QAAA,CAAS,MAAM,OAAO,CAAA;AAC3B,IAAA,IAAA,CAAK,QAAA,CAAS,MAAM,KAAK,CAAA;AACzB,IAAA,IAAA,CAAK,QAAA,CAAS,IAAA,EAAM,OAAA,EAAS,iBAAA,GAAoB,OAAO,IAAI,CAAA;AAC5D,IAAA,IAAA,CAAK,QAAA,CAAS,IAAA,EAAM,KAAA,EAAO,iBAAA,GAAoB,OAAO,IAAI,CAAA;AAAA,EAC5D;AAAA;AAAA,EAGA,cAAA,CAAe,QAAkC,UAAA,EAA8B;AAC7E,IAAA,IAAI,CAAC,QAAQ,OAAO,IAAA;AACpB,IAAA,IAAI,YAAY,OAAO,IAAA;AAEvB,IAAA,OAAO,MAAA,CAAO,QAAA,IAAY,CAAC,IAAA,CAAK,MAAM,MAAM,CAAA;AAAA,EAC9C;AAAA;AAAA,EAGA,QAAA,CAAS,QAAkC,UAAA,EAA2B;AACpE,IAAA,IAAI,CAAC,MAAA,IAAU,UAAA,IAAc,CAAC,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,EAAG;AAClD,IAAA,MAAA,CAAO,QAAA,GAAW,KAAA;AAClB,IAAA,MAAA,CAAO,eAAA,CAAgB,sBAAqB,cAAc,CAAA;AAAA,EAC5D;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,QAAA,CACE,MAAA,EACA,UAAA,EACA,QAAA,EACM;AACN,IAAA,IAAI,CAAC,MAAA,IAAU,CAAC,UAAA,EAAY;AAC5B,IAAA,IAAI,OAAO,QAAA,IAAY,CAAC,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,EAAG;AAC5C,IAAA,IAAI,MAAA,KAAW,QAAA,CAAS,aAAA,EAAe,IAAA,CAAK,mBAAmB,QAAQ,CAAA;AACvE,IAAA,MAAA,CAAO,QAAA,GAAW,IAAA;AAClB,IAAA,MAAA,CAAO,YAAA,CAAa,qBAAA,CAAqB,cAAA,EAAgB,EAAE,CAAA;AAAA,EAC7D;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,mBAAmB,QAAA,EAA0C;AAC3D,IAAA,MAAM,OAAO,IAAA,CAAK,KAAA;AAClB,IAAA,MAAM,WAAA,GAAc,KAAK,WAAA,CAAY,IAAA;AAAA,MACnC,CAAC,SAAA,KAAc,MAAA,CAAO,SAAA,CAAU,OAAA,CAAQ,IAAI,CAAA,KAAM;AAAA,KACpD;AAQA,IAAA,MAAM,WAAA,GAAc,CAAC,QAAA,EAAU,WAAW,CAAA,CAAE,IAAA;AAAA,MAC1C,CAAC,SAAA,KAAwC,SAAA,IAAa,IAAA,IAAQ,aAAa,SAAS;AAAA,KACtF;AACA,IAAA,IAAI,WAAA,EAAa;AACf,MAAA,WAAA,CAAY,KAAA,EAAM;AAClB,MAAA;AAAA,IACF;AAMA,IAAA,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,IAAA,CAAK,OAAO,CAAA;AAChC,IAAA,IAAA,CAAK,QAAQ,KAAA,EAAM;AAAA,EACrB;AAAA;AAAA,EAGA,IAAI,MAAA,GAAiB;AACnB,IAAA,MAAM,QAAQ,IAAA,CAAK,UAAA;AACnB,IAAA,OAAO,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA,GAAI,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,KAAA,CAAM,KAAK,CAAC,CAAA,GAAI,CAAA;AAAA,EACnE;AAAA;AAAA,EAGA,IAAI,KAAA,GAAgB;AAClB,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,SAAS,CAAA;AAAA,EACnC;AAAA;AAAA,EAGA,OAAO,IAAA,EAAsB;AAC3B,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,IAAI,GAAG,OAAO,CAAA;AACnC,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,MAAA,EAAQ,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,KAAA,CAAM,IAAI,CAAC,CAAC,CAAA;AAAA,EAC5D;AAAA;AAAA,EAGA,MAAM,MAAA,EAAoC;AACxC,IAAA,OAAO,MAAA,CAAO,YAAA,CAAa,qBAAA,CAAqB,cAAc,CAAA;AAAA,EAChE;AACF","file":"pagination_controller.js","sourcesContent":["/**\n * Whether a disabled `<fieldset>` ancestor actually reaches `control`.\n *\n * HTML exempts the contents of a fieldset's **first direct-child `<legend>`**, and\n * the exemption is per fieldset — a control legal in one legend can still be\n * disabled by a second, outer fieldset, so the walk continues upward.\n *\n * Exported for the consumer that needs this rule *without* the rest of\n * {@link canTakeFocus}: `toolbar` bounds its own `hidden` walk at the toolbar\n * root, which is a different rule, so it composes the two itself.\n */\nexport function inheritsFieldsetDisabled(control: HTMLElement): boolean {\n  let fieldset: Element | null = control.closest(\"fieldset[disabled]\");\n  while (fieldset) {\n    const legend = Array.from(fieldset.children).find((child) => child.tagName === \"LEGEND\");\n    if (!legend?.contains(control)) return true;\n    fieldset = fieldset.parentElement?.closest(\"fieldset[disabled]\") ?? null;\n  }\n  return false;\n}\n\n/**\n * Whether an element can actually take focus, checked **before** `focus()` runs.\n *\n * A controller that must move focus off a control it is about to disable or hide\n * picks a destination and calls `focus()` on it. If that destination cannot take\n * focus, the call **fails silently**: `hidden` and natively `disabled` elements\n * swallow it, so the caret stays in the subtree that is disappearing and lands on\n * `<body>` a frame later — the exact outcome the rescue exists to prevent, minus\n * any signal that it happened.\n *\n * Testing after the fact is the obvious alternative and is deliberately not the\n * rule. Reading `document.activeElement` back only works in a real browser, and\n * looping over candidates that way performs a real focus move per failure —\n * observable to assistive technology. Checking first costs nothing and catches\n * the cases that actually occur.\n *\n * **`aria-disabled` is not disqualifying.** It is the attribute an author uses\n * for a control that must stay *discoverable*, and the roving contract keeps\n * such items reachable. Only the three conditions that make the platform refuse\n * focus are checked: `hidden` / `inert` (an ancestor's counts),\n * `input[type=\"hidden\"]`, the native `disabled` property, and `disabled`\n * inherited from an ancestor `fieldset`. CSS-only invisibility is handled by\n * {@link isRenderedForFocus} when a consumer needs sequential-focus semantics.\n *\n * Reading `:disabled` instead of walking the fieldset chain would be shorter, but\n * that pseudo-class is not evaluated consistently outside real browsers and this\n * has to be right headlessly too. happy-dom in particular focuses a `<button>`\n * inside a disabled fieldset where a real engine refuses, so the inheritance is\n * spelled out rather than delegated.\n *\n * What a consumer does when nothing survives is its own call: some fall back to\n * their landmark, while a widget whose caret already sits somewhere legitimate\n * refuses the move outright rather than relocating it.\n *\n * @example\n * ```ts\n * const target = candidates.find(canTakeFocus);\n * if (target) target.focus();\n * else {\n *   this.#tabindex.lend(this.element); // nothing left: fall back to the landmark\n *   this.element.focus();\n * }\n * ```\n *\n * @param element - the candidate destination\n */\nexport function canTakeFocus(element: HTMLElement): boolean {\n  if (element.closest(\"[hidden], [inert]\")) return false;\n  if (element instanceof HTMLInputElement && element.type === \"hidden\") return false;\n  if (!(\"disabled\" in element)) return true;\n  if ((element as HTMLElement & { disabled: boolean }).disabled) return false;\n  return !inheritsFieldsetDisabled(element);\n}\n\n/** Elements whose semantics or authored attributes can place them in sequential focus order. */\nexport const TAB_STOP_CANDIDATE_SELECTOR = [\n  \"a[href]\",\n  \"area[href]\",\n  \"button\",\n  \"input\",\n  \"select\",\n  \"textarea\",\n  \"summary\",\n  \"iframe\",\n  \"audio[controls]\",\n  \"video[controls]\",\n  \"[tabindex]\",\n  \"[contenteditable]\",\n].join(\",\");\n\n/** Optional browser visibility API used to exclude CSS-hidden candidates. */\ninterface VisibilityCheckable {\n  checkVisibility?: (options?: { visibilityProperty?: boolean }) => boolean;\n}\n\n/** Whether CSS visibility allows an otherwise eligible element to participate in focus order. */\nexport function isRenderedForFocus(element: HTMLElement): boolean {\n  const check = (element as HTMLElement & VisibilityCheckable).checkVisibility;\n  return typeof check === \"function\" ? check.call(element, { visibilityProperty: true }) : true;\n}\n\n/** Parses an authored `tabindex`; invalid syntax has no explicit focus-order meaning. */\nfunction authoredTabindex(element: HTMLElement): number | null {\n  const value = element.getAttribute(\"tabindex\");\n  if (value === null || !/^[+-]?\\d+$/.test(value.trim())) return null;\n  return Number(value);\n}\n\n/** Whether the element's native semantics place it in sequential focus order. */\nfunction hasNativeTabStop(element: HTMLElement): boolean {\n  if (element instanceof HTMLAnchorElement || element instanceof HTMLAreaElement) {\n    return element.hasAttribute(\"href\");\n  }\n  if (\n    element instanceof HTMLButtonElement ||\n    element instanceof HTMLSelectElement ||\n    element instanceof HTMLTextAreaElement\n  ) {\n    return true;\n  }\n  if (element instanceof HTMLInputElement) return element.type !== \"hidden\";\n  if (element instanceof HTMLIFrameElement) return true;\n  if (element.tagName === \"AUDIO\" || element.tagName === \"VIDEO\") {\n    return element.hasAttribute(\"controls\");\n  }\n  if (element instanceof HTMLElement && element.tagName === \"SUMMARY\") {\n    const details = element.parentElement;\n    return (\n      details instanceof HTMLDetailsElement &&\n      Array.from(details.children).find((child) => child.tagName === \"SUMMARY\") === element\n    );\n  }\n  return false;\n}\n\n/** Whether an explicit `contenteditable` value creates an editable tab stop. */\nfunction hasEditableTabStop(element: HTMLElement): boolean {\n  const value = element.getAttribute(\"contenteditable\")?.toLowerCase();\n  return value === \"\" || value === \"true\" || value === \"plaintext-only\";\n}\n\n/**\n * Whether an element is a usable sequential Tab stop right now.\n *\n * Native semantics, authored `tabindex`, editable hosts, inherited disabled state,\n * HTML `hidden`/`inert`, and CSS visibility are evaluated together. `aria-disabled`\n * remains focusable because it communicates unavailability without removing the\n * control from discovery order.\n */\nexport function isTabStop(element: HTMLElement): boolean {\n  if (!canTakeFocus(element) || !isRenderedForFocus(element)) return false;\n\n  const tabindex = authoredTabindex(element);\n  if (tabindex !== null) return tabindex >= 0;\n  return hasNativeTabStop(element) || hasEditableTabStop(element);\n}\n\n/** Returns every usable sequential Tab stop below `root` in document order. */\nexport function tabStopsWithin(root: ParentNode): HTMLElement[] {\n  return Array.from(root.querySelectorAll<HTMLElement>(TAB_STOP_CANDIDATE_SELECTOR)).filter(\n    isTabStop,\n  );\n}\n\n/** Returns the first usable sequential Tab stop below `root`, if one exists. */\nexport function firstTabStop(root: ParentNode): HTMLElement | null {\n  for (const candidate of root.querySelectorAll<HTMLElement>(TAB_STOP_CANDIDATE_SELECTOR)) {\n    if (isTabStop(candidate)) return candidate;\n  }\n  return null;\n}\n\n/** Whether `root` contains at least one usable sequential Tab stop. */\nexport function hasTabStop(root: ParentNode): boolean {\n  return firstTabStop(root) !== null;\n}\n","/**\n * Runs a controller's \"return to the initial state\" pass just before Turbo\n * caches the page.\n *\n * **`disconnect()` cannot do this job, for two independent reasons.** Turbo\n * queues the clone from this event rather than taking it here, and the body swap\n * that runs the controller's `disconnect()` is queued separately — so which of\n * the two lands first is not something a controller can rely on, and a rewind\n * written in `disconnect()` may reach only the DOM being thrown away. In the\n * other direction, `disconnect()` also fires on an in-page move (Stimulus tears\n * down and reconnects the same element), where rewinding would wipe a\n * legitimately in-progress interaction — a spinner mid-load would vanish. One\n * timing is unreliable, the other is too eager; `turbo:before-cache` is the only\n * point that is exactly \"the page is about to be frozen\".\n *\n * Scope is the subscription only: registering on `activate()`, unregistering on\n * `deactivate()`, and one shared document listener no matter how many instances\n * are live. *What* to return to its initial state — which `data-state`, which\n * `hidden`, which `aria-busy` — stays in the controller, because no two\n * consumers answer it the same way (the `MicrotaskCoalescer` split).\n *\n * **Rewind state, not appearance.** The pass writes attributes the controller\n * itself owns; the visual result of those attributes is the consumer's CSS, and\n * a library that reached for style or class names would be guessing at markup\n * it does not own.\n *\n * Both entry points are idempotent, so the lifecycle hooks can call them\n * unconditionally: a second `activate()` does not double-subscribe and does not\n * make the callback run twice, and `deactivate()` on an instance that never\n * subscribed is a no-op.\n *\n * This file's own doc block is dropped from `dist`, but every member comment is\n * inlined into each consumer entry (`tsup` builds with `splitting: false`), so\n * rationale belongs here and only the contract belongs on the members.\n *\n * @example\n * ```ts\n * readonly #beforeCache = new BeforeCacheReset(() => this.#rewind());\n *\n * connect()    { this.#beforeCache.activate(); }\n * disconnect() { this.#beforeCache.deactivate(); }\n * ```\n */\nexport class BeforeCacheReset {\n  /** Every subscribed instance, iterated by the one shared document listener. */\n  static readonly #subscribers = new Set<BeforeCacheReset>();\n\n  /** The shared listener; installed while at least one instance is subscribed. */\n  static readonly #onBeforeCache = (): void => {\n    for (const subscriber of BeforeCacheReset.#subscribers) subscriber.#rewind();\n  };\n\n  readonly #rewind: () => void;\n\n  /** @param rewind - the pass that returns this controller's state to its initial form. */\n  constructor(rewind: () => void) {\n    this.#rewind = rewind;\n  }\n\n  /** Subscribes to `turbo:before-cache`; call from `connect()`. Idempotent. */\n  activate(): void {\n    const first = BeforeCacheReset.#subscribers.size === 0;\n    BeforeCacheReset.#subscribers.add(this);\n    if (first) {\n      document.addEventListener(\"turbo:before-cache\", BeforeCacheReset.#onBeforeCache);\n    }\n  }\n\n  /** Unsubscribes; call from `disconnect()`. Safe when never subscribed. */\n  deactivate(): void {\n    BeforeCacheReset.#subscribers.delete(this);\n    if (BeforeCacheReset.#subscribers.size > 0) return;\n    document.removeEventListener(\"turbo:before-cache\", BeforeCacheReset.#onBeforeCache);\n  }\n}\n","import { BeforeCacheReset } from \"./before_cache_reset\";\n\n/**\n * Shared bookkeeping for a `tabindex` a controller lends an element temporarily.\n *\n * A controller that must move focus somewhere the author never made focusable\n * (a landmark root, a scroll destination) reaches for the same trick: add a\n * `tabindex` just-in-time and hand it back once it is no longer needed. The\n * borrow is the easy half; the return is what the two conditions below are for.\n *\n * **Returning needs two conditions, not one.** Owning the borrow is not enough:\n * the attribute must also still hold the value this instance wrote. A consumer\n * that changed it afterwards — `tabindex=\"0\"` to make the root its own Tab stop\n * — owns it now, and removing it there silently discards authored markup. The\n * bookkeeping is dropped either way, since the loan is over regardless of who\n * ends up owning the value.\n *\n * **Never borrow over an existing value.** An element that already carries a\n * `tabindex` is the author's to control, so there is nothing to lend and nothing\n * to return.\n *\n * Every live loan also owns a shared `turbo:before-cache` subscription. The loan\n * is returned before Turbo can copy it into a snapshot, so consumers get cache\n * safety without duplicating a lifecycle hook; `returnAll()` removes the\n * subscription again as soon as no loan remains.\n *\n * The registry is keyed by element, so a controller borrowing on a single\n * element (`this.element`) and one borrowing across a changing set of targets\n * use the same API — the single-element case is a set of one. It holds no\n * opinion about *when* to borrow or where focus goes next; that stays in the\n * controller.\n *\n * **The API is deliberately two methods.** This file's own doc block is dropped\n * from `dist`, but every member comment is inlined into **each** consumer entry\n * (`tsup` builds with `splitting: false`), so rationale belongs here, only the\n * contract belongs on the members, and every method no consumer calls is still\n * paid for once per consumer entry.\n *\n * @example\n * ```ts\n * readonly #tabindex = new TabindexLoan();\n *\n * #rescueFocus() {\n *   this.#tabindex.lend(this.element);\n *   this.element.focus();\n * }\n *\n * disconnect() {\n *   this.#tabindex.returnAll();\n * }\n * ```\n */\nexport class TabindexLoan<T extends HTMLElement = HTMLElement> {\n  readonly #value: string;\n  readonly #lent = new Set<T>();\n  /** Returns live loans before Turbo can copy them into its page snapshot. */\n  readonly #beforeCache = new BeforeCacheReset(() => this.returnAll());\n\n  /**\n   * @param value - the `tabindex` to lend. `\"-1\"` (the default) is\n   *   programmatically focusable but not a Tab stop; `\"0\"` is a real Tab stop,\n   *   which a scroll region with no focusable content of its own needs.\n   */\n  constructor(value: string = \"-1\") {\n    this.#value = value;\n  }\n\n  /** Lends `element` the value; no-ops when it already carries a `tabindex`. */\n  lend(element: T): void {\n    if (element.hasAttribute(\"tabindex\")) return;\n    element.setAttribute(\"tabindex\", this.#value);\n    this.#lent.add(element);\n    // Subscribe only while a real loan exists. Keeping this guarantee here means\n    // every consumer is Turbo-safe without another lifecycle hook to remember.\n    this.#beforeCache.activate();\n  }\n\n  /** Takes back every loan whose value is still the one that was lent. */\n  returnAll(): void {\n    for (const element of this.#lent) {\n      if (element.getAttribute(\"tabindex\") === this.#value) element.removeAttribute(\"tabindex\");\n    }\n    this.#lent.clear();\n    this.#beforeCache.deactivate();\n  }\n}\n","import { Controller } from \"@hotwired/stimulus\";\nimport { canTakeFocus } from \"../utils/focus_candidate\";\nimport { TabindexLoan } from \"../utils/tabindex_loan\";\n\n/**\n * Headless, accessible pagination behavior.\n *\n * Markup contract (identifier: `stimeo--pagination`):\n *   <nav data-controller=\"stimeo--pagination\" aria-label=\"Pagination\"\n *        data-stimeo--pagination-page-value=\"1\"\n *        data-stimeo--pagination-total-value=\"5\">\n *     <button type=\"button\" data-stimeo--pagination-target=\"prev\"\n *             data-action=\"click->stimeo--pagination#prev\">Prev</button>\n *     <button type=\"button\" data-page=\"1\" aria-current=\"page\"\n *             data-stimeo--pagination-target=\"page\"\n *             data-action=\"click->stimeo--pagination#select\">1</button>\n *     <!-- more page buttons -->\n *     <button type=\"button\" data-stimeo--pagination-target=\"next\"\n *             data-action=\"click->stimeo--pagination#next\">Next</button>\n *   </nav>\n *\n * There is no dedicated APG pattern; this uses a navigation landmark plus\n * `aria-current=\"page\"`. The controller owns current-page state, the\n * `aria-current` sync, boundary disabling of prev/next, and the change event.\n * Generating/eliding the page buttons and fetching data stay with the consumer.\n *\n * `prev`/`next` must be real `<button>` elements: the boundary state is applied\n * through the native `disabled` property, which no other element honors.\n *\n * `change` dispatches `{ page: number, total: number, previous: number }`.\n *\n * @remarks\n * Behavior only — each control is in the natural Tab order (no roving). When a\n * boundary disables the button that currently has focus, focus is moved first so\n * it is never lost to a `disabled` element.\n *\n * Behavior provided:\n * - `select` reads the clicked button's `data-page` and makes it current. The\n *   value must parse as an integer; blank/fractional/non-numeric ones are ignored.\n * - `prev`/`next` step by one, clamped to `[1, total]`.\n * - The current page button gets `aria-current=\"page\"` (removed from the rest);\n *   `prev` is `disabled` at page 1 and `next` at `total`.\n * - `page`/`total` are normalized (`total` to a finite integer >= 1, `page` into\n *   `[1, total]`) on connect **and** on every runtime Value change, so JS-driven\n *   updates re-render. Normalization never dispatches `change`: it is a display\n *   correction, not a user navigation, and the initial render is consumer-owned.\n * - Page/boundary buttons swapped in at runtime re-render through the Stimulus\n *   target callbacks, so a consumer-regenerated button list stays in sync.\n * - Every navigation dispatches `stimeo--pagination:change`, whose `detail.total`\n *   is the same normalized total the boundary state is derived from.\n *\n * The boundary `disabled` is **owned**: the controller marks what it disabled\n * with `data-stimeo--pagination-boundary-disabled` and releases only that. A\n * button already disabled by the consumer is never marked when it overlaps a\n * boundary, so loading / permission state survives both entering and leaving the\n * boundary. The marker lives in the DOM rather than in a field so ownership\n * survives a Turbo cache restore, where a fresh instance would otherwise either\n * strand or steal the flag.\n */\nexport class PaginationController extends Controller<HTMLElement> {\n  static override targets = [\"page\", \"prev\", \"next\"];\n  static override values = {\n    page: { type: Number, default: 1 },\n    total: { type: Number, default: 1 },\n  };\n  static actions = [\"next\", \"prev\", \"select\"] as const;\n  static events = [\"change\"] as const;\n\n  /** Marks a `disabled` this controller applied at a boundary (ownership flag). */\n  static readonly #BOUNDARY_ATTR = \"data-stimeo--pagination-boundary-disabled\";\n\n  declare readonly pageTargets: HTMLElement[];\n  declare readonly prevTarget: HTMLButtonElement;\n  declare readonly nextTarget: HTMLButtonElement;\n  declare readonly hasPrevTarget: boolean;\n  declare readonly hasNextTarget: boolean;\n  declare pageValue: number;\n  declare totalValue: number;\n\n  #isConnected = false;\n  /** The `tabindex` this instance lends the root for the focus fallback. */\n  readonly #tabindex = new TabindexLoan();\n\n  /** Normalizes out-of-range initial values and renders the initial state. */\n  override connect(): void {\n    this.#isConnected = true;\n    this.#normalizeAndRender();\n  }\n\n  /** Reverts the one attribute the controller adds outside its state hooks. */\n  override disconnect(): void {\n    this.#isConnected = false;\n    this.#tabindex.returnAll();\n  }\n\n  /** Re-renders when application code (or a Turbo morph) changes `page` at runtime. */\n  pageValueChanged(): void {\n    if (!this.#isConnected) return;\n    this.#normalizeAndRender();\n  }\n\n  /** Re-renders when application code (or a Turbo morph) changes `total` at runtime. */\n  totalValueChanged(): void {\n    if (!this.#isConnected) return;\n    this.#normalizeAndRender();\n  }\n\n  /** Syncs a page button appended/replaced at runtime (the consumer owns the list). */\n  pageTargetConnected(): void {\n    if (!this.#isConnected) return;\n    this.#render();\n  }\n\n  /** Syncs a `prev` button appended/replaced at runtime. */\n  prevTargetConnected(): void {\n    if (!this.#isConnected) return;\n    this.#render();\n  }\n\n  /** Syncs a `next` button appended/replaced at runtime. */\n  nextTargetConnected(): void {\n    if (!this.#isConnected) return;\n    this.#render();\n  }\n\n  /** Makes the clicked page button (its `data-page`) current. */\n  select(event: Event): void {\n    const button = event.currentTarget as HTMLElement;\n    const raw = button.dataset.page;\n    if (raw === undefined || raw.trim() === \"\") return;\n    const page = Number(raw);\n    // Integer-only, matching `stimeo--stepper`: `Number(\"\")` is 0 and `Number(\"2.7\")`\n    // truncates, so a bare finite check would accept meaningless page numbers.\n    if (!Number.isInteger(page)) return;\n    this.#goto(page);\n  }\n\n  /** Steps to the previous page. */\n  prev(): void {\n    this.#goto(this.#page - 1);\n  }\n\n  /** Steps to the next page. */\n  next(): void {\n    this.#goto(this.#page + 1);\n  }\n\n  /** Moves to `page` (clamped to `[1, total]`), re-renders, and dispatches `change`. */\n  #goto(page: number): void {\n    if (!Number.isFinite(page)) return;\n    const previous = this.#page;\n    const target = this.#clamp(page);\n    if (target === previous) return;\n    this.pageValue = target;\n    this.#render();\n    this.dispatch(\"change\", {\n      detail: { page: target, total: this.#total, previous },\n    });\n  }\n\n  /** Writes the normalized Values back (only when they differ) and renders. */\n  #normalizeAndRender(): void {\n    // Stimulus setters rewrite the data attribute unconditionally, so guard the\n    // no-op case to avoid waking consumer MutationObservers for nothing.\n    const total = this.#total;\n    if (!Object.is(total, this.totalValue)) this.totalValue = total;\n    const page = this.#page;\n    if (!Object.is(page, this.pageValue)) this.pageValue = page;\n    this.#render();\n  }\n\n  /**\n   * Syncs `aria-current` on the page buttons and the prev/next `disabled` state.\n   *\n   * @stimeoRenderRoot\n   */\n  #render(): void {\n    const page = this.#page;\n    for (const button of this.pageTargets) {\n      if (Number(button.dataset.page) === page) {\n        button.setAttribute(\"aria-current\", \"page\");\n      } else {\n        button.removeAttribute(\"aria-current\");\n      }\n    }\n\n    const prev = this.hasPrevTarget ? this.prevTarget : null;\n    const next = this.hasNextTarget ? this.nextTarget : null;\n    const atStart = page <= 1;\n    const atEnd = page >= this.#total;\n    // Resolve both post-render states up front: a focus hand-off must target the\n    // opposite button as it will be *after* this pass, not as it is now (moving\n    // between the two boundaries of a 2-page set re-enables it in the same pass).\n    const prevStaysDisabled = this.#disabledAfter(prev, atStart);\n    const nextStaysDisabled = this.#disabledAfter(next, atEnd);\n    // Release before disabling, so the hand-off can land on a button this same\n    // pass re-enables (focusing a still-`disabled` button is a no-op).\n    this.#release(prev, atStart);\n    this.#release(next, atEnd);\n    this.#disable(prev, atStart, nextStaysDisabled ? null : next);\n    this.#disable(next, atEnd, prevStaysDisabled ? null : prev);\n  }\n\n  /** Whether a boundary button will still be `disabled` once this render applies. */\n  #disabledAfter(button: HTMLButtonElement | null, atBoundary: boolean): boolean {\n    if (!button) return true;\n    if (atBoundary) return true;\n    // Away from a boundary, only the controller's own `disabled` is released.\n    return button.disabled && !this.#owns(button);\n  }\n\n  /** Releases the boundary `disabled` this controller owns, once away from it. */\n  #release(button: HTMLButtonElement | null, atBoundary: boolean): void {\n    if (!button || atBoundary || !this.#owns(button)) return;\n    button.disabled = false;\n    button.removeAttribute(PaginationController.#BOUNDARY_ATTR);\n  }\n\n  /**\n   * Disables a boundary button, first moving focus off it when it is the active\n   * element so disabling never strands focus.\n   */\n  #disable(\n    button: HTMLButtonElement | null,\n    atBoundary: boolean,\n    opposite: HTMLButtonElement | null,\n  ): void {\n    if (!button || !atBoundary) return;\n    if (button.disabled && !this.#owns(button)) return;\n    if (button === document.activeElement) this.#moveFocusAwayFrom(opposite);\n    button.disabled = true;\n    button.setAttribute(PaginationController.#BOUNDARY_ATTR, \"\");\n  }\n\n  /**\n   * Moves focus to `opposite` (already resolved to `null` when it will stay\n   * disabled), else to the current page button, else to the landmark itself.\n   */\n  #moveFocusAwayFrom(opposite: HTMLButtonElement | null): void {\n    const page = this.#page;\n    const currentPage = this.pageTargets.find(\n      (candidate) => Number(candidate.dataset.page) === page,\n    );\n    // Checked before the call, never after: `hidden` and natively disabled\n    // elements swallow `focus()` silently, so an unchecked destination leaves the\n    // caret in the subtree that is about to disable and drops it to <body> a frame\n    // later — the outcome this rescue exists to prevent.\n    // Narrowed to `HTMLElement`, not `HTMLButtonElement`: `pageTargets` is typed\n    // `HTMLElement[]`, so a page control can legitimately be an `<a>`. The\n    // destination is only ever focused, so the wider type is the honest one.\n    const destination = [opposite, currentPage].find(\n      (candidate): candidate is HTMLElement => candidate != null && canTakeFocus(candidate),\n    );\n    if (destination) {\n      destination.focus();\n      return;\n    }\n    // Nothing left to hand focus to (a lone boundary button, or every page button\n    // disabled): keep it inside the pagination landmark instead of letting the\n    // browser drop it to <body> when the button disables. The root is made\n    // programmatically focusable just-in-time with `tabindex=\"-1\"`, which is not a\n    // Tab stop; `disconnect()` removes it again when this controller added it.\n    this.#tabindex.lend(this.element);\n    this.element.focus();\n  }\n\n  /** Total pages, normalized to a finite integer >= 1. */\n  get #total(): number {\n    const total = this.totalValue;\n    return Number.isFinite(total) ? Math.max(1, Math.trunc(total)) : 1;\n  }\n\n  /** The current page, normalized into `[1, total]`. */\n  get #page(): number {\n    return this.#clamp(this.pageValue);\n  }\n\n  /** Constrains `page` to `[1, total]`; a non-finite page falls back to page 1. */\n  #clamp(page: number): number {\n    if (!Number.isFinite(page)) return 1;\n    return Math.min(this.#total, Math.max(1, Math.trunc(page)));\n  }\n\n  /** Whether the button's current `disabled` was applied by boundary control. */\n  #owns(button: HTMLButtonElement): boolean {\n    return button.hasAttribute(PaginationController.#BOUNDARY_ATTR);\n  }\n}\n"]}

package/dist/controllers/password_reveal_controller.d.ts

@@ -16,6 +16,8 @@ import { Controller } from '@hotwired/stimulus';
  * accessible name stays state-independent ("Show password") while the pressed
  * state is conveyed by `aria-pressed`.
  *
+ * `toggle` dispatches `{ visible: boolean }`.
+ *
  * @remarks
  * Behavior only — icon rendering is the consumer's, keyed off `aria-pressed` /
  * `data-state` (`hidden` / `visible`). Flipping `input.type` can drop focus and

package/dist/controllers/password_reveal_controller.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utils/safe_timeout.ts","../../src/controllers/password_reveal_controller.ts"],"names":[],"mappings":";;;;;AAwBA,IAAe,gBAAf,MAA6B;AAAA;AAAA,EAER,GAAA,uBAAU,GAAA,EAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAczC,MAAM,EAAA,EAAkB;AACtB,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,MAAA,CAAO,EAAE,CAAA,EAAG;AACvB,MAAA,IAAA,CAAK,OAAO,EAAE,CAAA;AAAA,IAChB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,QAAA,GAAiB;AACf,IAAA,KAAA,MAAW,EAAA,IAAM,KAAK,GAAA,EAAK;AACzB,MAAA,IAAA,CAAK,OAAO,EAAE,CAAA;AAAA,IAChB;AACA,IAAA,IAAA,CAAK,IAAI,KAAA,EAAM;AAAA,EACjB;AAAA;AAAA,EAGA,IAAI,IAAA,GAAe;AACjB,IAAA,OAAO,KAAK,GAAA,CAAI,IAAA;AAAA,EAClB;AACF,CAAA;AAmBO,IAAM,WAAA,GAAN,cAA0B,aAAA,CAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO7C,GAAA,CAAI,UAAsB,KAAA,EAAuB;AAC/C,IAAA,MAAM,EAAA,GAAK,IAAA,CAAK,QAAA,CAAS,MAAM;AAC7B,MAAA,IAAA,CAAK,GAAA,CAAI,OAAO,EAAE,CAAA;AAClB,MAAA,QAAA,EAAS;AAAA,IACX,GAAG,KAAK,CAAA;AACR,IAAA,IAAA,CAAK,GAAA,CAAI,IAAI,EAAE,CAAA;AACf,IAAA,OAAO,EAAA;AAAA,EACT;AAAA,EAEU,QAAA,CAAS,UAAsB,KAAA,EAAuB;AAC9D,IAAA,OAAO,MAAA,CAAO,UAAA,CAAW,QAAA,EAAU,KAAK,CAAA;AAAA,EAC1C;AAAA,EAEU,OAAO,EAAA,EAAkB;AACjC,IAAA,MAAA,CAAO,aAAa,EAAE,CAAA;AAAA,EACxB;AACF,CAAA;;;AC5EO,IAAM,wBAAA,GAAN,cAAuC,UAAA,CAAwB;AAAA,EACpE,OAAgB,OAAA,GAAU,CAAC,OAAA,EAAS,QAAQ,CAAA;AAAA,EAC5C,OAAgB,MAAA,GAAS;AAAA,IACvB,QAAA,EAAU,EAAE,IAAA,EAAM,MAAA,EAAQ,SAAS,CAAA;AAAE,GACvC;AAAA,EACA,OAAO,OAAA,GAAU,CAAC,QAAQ,CAAA;AAAA,EAC1B,OAAO,MAAA,GAAS,CAAC,QAAQ,CAAA;AAAA;AAAA,EAUzB,OAAA,GAAU,IAAI,WAAA,EAAY;AAAA,EAEjB,OAAA,GAAgB;AACvB,IAAA,IAAA,CAAK,QAAA,CAAS,KAAK,UAAU,CAAA;AAAA,EAC/B;AAAA,EAES,UAAA,GAAmB;AAC1B,IAAA,IAAA,CAAK,QAAQ,QAAA,EAAS;AAAA,EACxB;AAAA;AAAA,EAGA,MAAA,GAAe;AACb,IAAA,IAAA,CAAK,WAAA,CAAY,CAAC,IAAA,CAAK,UAAU,CAAA;AAAA,EACnC;AAAA;AAAA,EAGA,IAAI,UAAA,GAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,cAAA,IAAkB,IAAA,CAAK,WAAA,CAAY,IAAA,KAAS,MAAA;AAAA,EAC1D;AAAA;AAAA,EAGA,YAAY,OAAA,EAAwB;AAClC,IAAA,IAAI,CAAC,KAAK,cAAA,EAAgB;AAC1B,IAAA,MAAM,QAAQ,IAAA,CAAK,WAAA;AAInB,IAAA,MAAM,iBAAA,GAAoB,SAAS,aAAA,KAAkB,KAAA;AACrD,IAAA,MAAM,iBAAiB,KAAA,CAAM,cAAA;AAC7B,IAAA,MAAM,eAAe,KAAA,CAAM,YAAA;AAE3B,IAAA,KAAA,CAAM,IAAA,GAAO,UAAU,MAAA,GAAS,UAAA;AAEhC,IAAA,IAAI,iBAAA,EAAmB;AACrB,MAAA,KAAA,CAAM,KAAA,EAAM;AAGZ,MAAA,IAAI,cAAA,KAAmB,IAAA,IAAQ,YAAA,KAAiB,IAAA,EAAM;AACpD,QAAA,IAAI;AACF,UAAA,KAAA,CAAM,iBAAA,CAAkB,gBAAgB,YAAY,CAAA;AAAA,QACtD,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,SAAS,OAAO,CAAA;AACrB,IAAA,IAAA,CAAK,SAAS,QAAA,EAAU,EAAE,QAAQ,EAAE,OAAA,IAAW,CAAA;AAE/C,IAAA,IAAA,CAAK,QAAQ,QAAA,EAAS;AACtB,IAAA,IAAI,OAAA,IAAW,IAAA,CAAK,aAAA,GAAgB,CAAA,EAAG;AACrC,MAAA,IAAA,CAAK,OAAA,CAAQ,IAAI,MAAM,IAAA,CAAK,YAAY,KAAK,CAAA,EAAG,KAAK,aAAa,CAAA;AAAA,IACpE;AAAA,EACF;AAAA;AAAA,EAGA,SAAS,OAAA,EAAwB;AAC/B,IAAA,IAAI,KAAK,eAAA,EAAiB;AACxB,MAAA,IAAA,CAAK,YAAA,CAAa,YAAA,CAAa,cAAA,EAAgB,OAAA,GAAU,SAAS,OAAO,CAAA;AAAA,IAC3E;AACA,IAAA,IAAA,CAAK,OAAA,CAAQ,YAAA,CAAa,YAAA,EAAc,OAAA,GAAU,YAAY,QAAQ,CAAA;AAAA,EACxE;AACF","file":"password_reveal_controller.js","sourcesContent":["/**\n * Self-cleaning timer registries shared by Stimeo controllers.\n *\n * Stimulus controllers frequently schedule `setTimeout` / `setInterval` work\n * (auto-dismiss, debouncing, polling). When the element leaves the DOM — a\n * Turbo Drive navigation, a Turbo Stream replacement, or any `disconnect()` —\n * orphaned timers keep firing against a detached controller, leaking memory and\n * mutating stale state. {@link SafeTimeout} and {@link SafeInterval} track every\n * timer they create so a single {@link TimerRegistry.clearAll | clearAll()} call\n * in `disconnect()` tears them all down.\n *\n * These are intentionally low-level primitives: they own *registration and\n * cleanup only*. Higher-level policy (pause/resume, remaining-time accounting)\n * stays in the individual controllers so per-widget semantics are not flattened\n * into a lowest-common-denominator helper.\n */\n\n/**\n * Shared registry bookkeeping for the timeout/interval variants.\n *\n * Subclasses provide the scheduling primitive ({@link schedule}) and its matching\n * canceller ({@link cancel}); this base owns the set of live ids plus the\n * per-id and bulk teardown shared by both.\n */\nabstract class TimerRegistry {\n  /** Live timer ids that have not yet been cleared (or, for timeouts, fired). */\n  protected readonly ids = new Set<number>();\n\n  /** Schedules the underlying platform timer and returns its id. */\n  protected abstract schedule(callback: () => void, delay: number): number;\n\n  /** Cancels the underlying platform timer for `id`. */\n  protected abstract cancel(id: number): void;\n\n  /**\n   * Cancels a single tracked timer.\n   *\n   * No-ops if the id is unknown (already cleared, fired, or never owned by this\n   * registry), so callers can clear defensively without guarding.\n   */\n  clear(id: number): void {\n    if (this.ids.delete(id)) {\n      this.cancel(id);\n    }\n  }\n\n  /**\n   * Cancels every tracked timer. Call this from a controller's `disconnect()`\n   * to guarantee no timer outlives the element.\n   */\n  clearAll(): void {\n    for (const id of this.ids) {\n      this.cancel(id);\n    }\n    this.ids.clear();\n  }\n\n  /** Number of timers currently tracked (pending). */\n  get size(): number {\n    return this.ids.size;\n  }\n}\n\n/**\n * `setTimeout` wrapper that auto-forgets each timer once it fires and supports\n * bulk teardown on disconnect.\n *\n * @example\n * ```ts\n * #timers = new SafeTimeout();\n *\n * connect() {\n *   this.#timers.set(() => this.dismiss(), 5000);\n * }\n *\n * disconnect() {\n *   this.#timers.clearAll();\n * }\n * ```\n */\nexport class SafeTimeout extends TimerRegistry {\n  /**\n   * Schedules `callback` after `delay` ms and returns the timer id.\n   *\n   * The id is removed from the registry automatically when the timeout fires,\n   * so {@link TimerRegistry.size | size} reflects only still-pending timers.\n   */\n  set(callback: () => void, delay: number): number {\n    const id = this.schedule(() => {\n      this.ids.delete(id);\n      callback();\n    }, delay);\n    this.ids.add(id);\n    return id;\n  }\n\n  protected schedule(callback: () => void, delay: number): number {\n    return window.setTimeout(callback, delay);\n  }\n\n  protected cancel(id: number): void {\n    window.clearTimeout(id);\n  }\n}\n\n/**\n * `setInterval` wrapper that tracks every interval for bulk teardown on\n * disconnect. Unlike {@link SafeTimeout}, intervals are retained until they are\n * explicitly cleared because they fire repeatedly.\n *\n * @example\n * ```ts\n * #intervals = new SafeInterval();\n *\n * connect() {\n *   this.#intervals.set(() => this.tick(), 1000);\n * }\n *\n * disconnect() {\n *   this.#intervals.clearAll();\n * }\n * ```\n */\nexport class SafeInterval extends TimerRegistry {\n  /** Schedules a repeating `callback` every `delay` ms and returns the timer id. */\n  set(callback: () => void, delay: number): number {\n    const id = this.schedule(callback, delay);\n    this.ids.add(id);\n    return id;\n  }\n\n  protected schedule(callback: () => void, delay: number): number {\n    return window.setInterval(callback, delay);\n  }\n\n  protected cancel(id: number): void {\n    window.clearInterval(id);\n  }\n}\n","import { Controller } from \"@hotwired/stimulus\";\nimport { SafeTimeout } from \"../utils/safe_timeout\";\n\n/**\n * Headless password show/hide (unmask) toggle behavior.\n *\n * Markup contract (identifier: `stimeo--password-reveal`):\n *   <div data-controller=\"stimeo--password-reveal\">\n *     <input type=\"password\" aria-label=\"Password\"\n *            data-stimeo--password-reveal-target=\"input\">\n *     <button type=\"button\" aria-pressed=\"false\" aria-label=\"Show password\"\n *             data-stimeo--password-reveal-target=\"toggle\"\n *             data-action=\"stimeo--password-reveal#toggle\"></button>\n *   </div>\n *\n * No dedicated APG pattern; this follows the toggle **Button** practice. The\n * accessible name stays state-independent (\"Show password\") while the pressed\n * state is conveyed by `aria-pressed`.\n *\n * @remarks\n * Behavior only — icon rendering is the consumer's, keyed off `aria-pressed` /\n * `data-state` (`hidden` / `visible`). Flipping `input.type` can drop focus and\n * the caret, so when (and only when) the input was the focused element its focus\n * and selection are restored afterward; when the toggle button holds focus\n * (keyboard use) focus is left on the button. An optional `autoHide` re-masks\n * after a delay, and that timer is torn down on disconnect (Turbo).\n */\nexport class PasswordRevealController extends Controller<HTMLElement> {\n  static override targets = [\"input\", \"toggle\"];\n  static override values = {\n    autoHide: { type: Number, default: 0 },\n  };\n  static actions = [\"toggle\"] as const;\n  static events = [\"toggle\"] as const;\n\n  declare readonly inputTarget: HTMLInputElement;\n  declare readonly toggleTarget: HTMLElement;\n  declare readonly hasInputTarget: boolean;\n  declare readonly hasToggleTarget: boolean;\n\n  declare autoHideValue: number;\n\n  /** Auto re-mask timer; torn down on disconnect. */\n  #timers = new SafeTimeout();\n\n  override connect(): void {\n    this.#reflect(this.#isVisible);\n  }\n\n  override disconnect(): void {\n    this.#timers.clearAll();\n  }\n\n  /** Toggles the input between masked and revealed. Bound via `data-action`. */\n  toggle(): void {\n    this.#setVisible(!this.#isVisible);\n  }\n\n  /** Whether the input is currently revealed (`type=\"text\"`). */\n  get #isVisible(): boolean {\n    return this.hasInputTarget && this.inputTarget.type === \"text\";\n  }\n\n  /** Switches the masked/revealed state, preserving focus and caret. */\n  #setVisible(visible: boolean): void {\n    if (!this.hasInputTarget) return;\n    const input = this.inputTarget;\n\n    // Only the input's *own* focus is restored across the type change; if the\n    // toggle button (keyboard) holds focus, it is left untouched.\n    const restoreInputFocus = document.activeElement === input;\n    const selectionStart = input.selectionStart;\n    const selectionEnd = input.selectionEnd;\n\n    input.type = visible ? \"text\" : \"password\";\n\n    if (restoreInputFocus) {\n      input.focus();\n      // `selectionStart` / `selectionEnd` are `number | null` (null for input\n      // types that don't expose a selection); only restore when both are present.\n      if (selectionStart !== null && selectionEnd !== null) {\n        try {\n          input.setSelectionRange(selectionStart, selectionEnd);\n        } catch {\n          // Some input types reject selection access; focus alone is enough.\n        }\n      }\n    }\n\n    this.#reflect(visible);\n    this.dispatch(\"toggle\", { detail: { visible } });\n\n    this.#timers.clearAll();\n    if (visible && this.autoHideValue > 0) {\n      this.#timers.set(() => this.#setVisible(false), this.autoHideValue);\n    }\n  }\n\n  /** Reflects the visible state onto `aria-pressed` and `data-state`. */\n  #reflect(visible: boolean): void {\n    if (this.hasToggleTarget) {\n      this.toggleTarget.setAttribute(\"aria-pressed\", visible ? \"true\" : \"false\");\n    }\n    this.element.setAttribute(\"data-state\", visible ? \"visible\" : \"hidden\");\n  }\n}\n"]}
+{"version":3,"sources":["../../src/utils/safe_timeout.ts","../../src/controllers/password_reveal_controller.ts"],"names":[],"mappings":";;;;;AAwBA,IAAe,gBAAf,MAA6B;AAAA;AAAA,EAER,GAAA,uBAAU,GAAA,EAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAczC,MAAM,EAAA,EAAkB;AACtB,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,MAAA,CAAO,EAAE,CAAA,EAAG;AACvB,MAAA,IAAA,CAAK,OAAO,EAAE,CAAA;AAAA,IAChB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,QAAA,GAAiB;AACf,IAAA,KAAA,MAAW,EAAA,IAAM,KAAK,GAAA,EAAK;AACzB,MAAA,IAAA,CAAK,OAAO,EAAE,CAAA;AAAA,IAChB;AACA,IAAA,IAAA,CAAK,IAAI,KAAA,EAAM;AAAA,EACjB;AAAA;AAAA,EAGA,IAAI,IAAA,GAAe;AACjB,IAAA,OAAO,KAAK,GAAA,CAAI,IAAA;AAAA,EAClB;AACF,CAAA;AAmBO,IAAM,WAAA,GAAN,cAA0B,aAAA,CAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO7C,GAAA,CAAI,UAAsB,KAAA,EAAuB;AAC/C,IAAA,MAAM,EAAA,GAAK,IAAA,CAAK,QAAA,CAAS,MAAM;AAC7B,MAAA,IAAA,CAAK,GAAA,CAAI,OAAO,EAAE,CAAA;AAClB,MAAA,QAAA,EAAS;AAAA,IACX,GAAG,KAAK,CAAA;AACR,IAAA,IAAA,CAAK,GAAA,CAAI,IAAI,EAAE,CAAA;AACf,IAAA,OAAO,EAAA;AAAA,EACT;AAAA,EAEU,QAAA,CAAS,UAAsB,KAAA,EAAuB;AAC9D,IAAA,OAAO,MAAA,CAAO,UAAA,CAAW,QAAA,EAAU,KAAK,CAAA;AAAA,EAC1C;AAAA,EAEU,OAAO,EAAA,EAAkB;AACjC,IAAA,MAAA,CAAO,aAAa,EAAE,CAAA;AAAA,EACxB;AACF,CAAA;;;AC1EO,IAAM,wBAAA,GAAN,cAAuC,UAAA,CAAwB;AAAA,EACpE,OAAgB,OAAA,GAAU,CAAC,OAAA,EAAS,QAAQ,CAAA;AAAA,EAC5C,OAAgB,MAAA,GAAS;AAAA,IACvB,QAAA,EAAU,EAAE,IAAA,EAAM,MAAA,EAAQ,SAAS,CAAA;AAAE,GACvC;AAAA,EACA,OAAO,OAAA,GAAU,CAAC,QAAQ,CAAA;AAAA,EAC1B,OAAO,MAAA,GAAS,CAAC,QAAQ,CAAA;AAAA;AAAA,EAUzB,OAAA,GAAU,IAAI,WAAA,EAAY;AAAA,EAEjB,OAAA,GAAgB;AACvB,IAAA,IAAA,CAAK,QAAA,CAAS,KAAK,UAAU,CAAA;AAAA,EAC/B;AAAA,EAES,UAAA,GAAmB;AAC1B,IAAA,IAAA,CAAK,QAAQ,QAAA,EAAS;AAAA,EACxB;AAAA;AAAA,EAGA,MAAA,GAAe;AACb,IAAA,IAAA,CAAK,WAAA,CAAY,CAAC,IAAA,CAAK,UAAU,CAAA;AAAA,EACnC;AAAA;AAAA,EAGA,IAAI,UAAA,GAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,cAAA,IAAkB,IAAA,CAAK,WAAA,CAAY,IAAA,KAAS,MAAA;AAAA,EAC1D;AAAA;AAAA,EAGA,YAAY,OAAA,EAAwB;AAClC,IAAA,IAAI,CAAC,KAAK,cAAA,EAAgB;AAC1B,IAAA,MAAM,QAAQ,IAAA,CAAK,WAAA;AAInB,IAAA,MAAM,iBAAA,GAAoB,SAAS,aAAA,KAAkB,KAAA;AACrD,IAAA,MAAM,iBAAiB,KAAA,CAAM,cAAA;AAC7B,IAAA,MAAM,eAAe,KAAA,CAAM,YAAA;AAE3B,IAAA,KAAA,CAAM,IAAA,GAAO,UAAU,MAAA,GAAS,UAAA;AAEhC,IAAA,IAAI,iBAAA,EAAmB;AACrB,MAAA,KAAA,CAAM,KAAA,EAAM;AAGZ,MAAA,IAAI,cAAA,KAAmB,IAAA,IAAQ,YAAA,KAAiB,IAAA,EAAM;AACpD,QAAA,IAAI;AACF,UAAA,KAAA,CAAM,iBAAA,CAAkB,gBAAgB,YAAY,CAAA;AAAA,QACtD,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,SAAS,OAAO,CAAA;AACrB,IAAA,IAAA,CAAK,SAAS,QAAA,EAAU,EAAE,QAAQ,EAAE,OAAA,IAAW,CAAA;AAE/C,IAAA,IAAA,CAAK,QAAQ,QAAA,EAAS;AACtB,IAAA,IAAI,OAAA,IAAW,IAAA,CAAK,aAAA,GAAgB,CAAA,EAAG;AACrC,MAAA,IAAA,CAAK,OAAA,CAAQ,IAAI,MAAM,IAAA,CAAK,YAAY,KAAK,CAAA,EAAG,KAAK,aAAa,CAAA;AAAA,IACpE;AAAA,EACF;AAAA;AAAA,EAGA,SAAS,OAAA,EAAwB;AAC/B,IAAA,IAAI,KAAK,eAAA,EAAiB;AACxB,MAAA,IAAA,CAAK,YAAA,CAAa,YAAA,CAAa,cAAA,EAAgB,OAAA,GAAU,SAAS,OAAO,CAAA;AAAA,IAC3E;AACA,IAAA,IAAA,CAAK,OAAA,CAAQ,YAAA,CAAa,YAAA,EAAc,OAAA,GAAU,YAAY,QAAQ,CAAA;AAAA,EACxE;AACF","file":"password_reveal_controller.js","sourcesContent":["/**\n * Self-cleaning timer registries shared by Stimeo controllers.\n *\n * Stimulus controllers frequently schedule `setTimeout` / `setInterval` work\n * (auto-dismiss, debouncing, polling). When the element leaves the DOM — a\n * Turbo Drive navigation, a Turbo Stream replacement, or any `disconnect()` —\n * orphaned timers keep firing against a detached controller, leaking memory and\n * mutating stale state. {@link SafeTimeout} and {@link SafeInterval} track every\n * timer they create so a single {@link TimerRegistry.clearAll | clearAll()} call\n * in `disconnect()` tears them all down.\n *\n * These are intentionally low-level primitives: they own *registration and\n * cleanup only*. Higher-level policy (pause/resume, remaining-time accounting)\n * stays in the individual controllers so per-widget semantics are not flattened\n * into a lowest-common-denominator helper.\n */\n\n/**\n * Shared registry bookkeeping for the timeout/interval variants.\n *\n * Subclasses provide the scheduling primitive ({@link schedule}) and its matching\n * canceller ({@link cancel}); this base owns the set of live ids plus the\n * per-id and bulk teardown shared by both.\n */\nabstract class TimerRegistry {\n  /** Live timer ids that have not yet been cleared (or, for timeouts, fired). */\n  protected readonly ids = new Set<number>();\n\n  /** Schedules the underlying platform timer and returns its id. */\n  protected abstract schedule(callback: () => void, delay: number): number;\n\n  /** Cancels the underlying platform timer for `id`. */\n  protected abstract cancel(id: number): void;\n\n  /**\n   * Cancels a single tracked timer.\n   *\n   * No-ops if the id is unknown (already cleared, fired, or never owned by this\n   * registry), so callers can clear defensively without guarding.\n   */\n  clear(id: number): void {\n    if (this.ids.delete(id)) {\n      this.cancel(id);\n    }\n  }\n\n  /**\n   * Cancels every tracked timer. Call this from a controller's `disconnect()`\n   * to guarantee no timer outlives the element.\n   */\n  clearAll(): void {\n    for (const id of this.ids) {\n      this.cancel(id);\n    }\n    this.ids.clear();\n  }\n\n  /** Number of timers currently tracked (pending). */\n  get size(): number {\n    return this.ids.size;\n  }\n}\n\n/**\n * `setTimeout` wrapper that auto-forgets each timer once it fires and supports\n * bulk teardown on disconnect.\n *\n * @example\n * ```ts\n * #timers = new SafeTimeout();\n *\n * connect() {\n *   this.#timers.set(() => this.dismiss(), 5000);\n * }\n *\n * disconnect() {\n *   this.#timers.clearAll();\n * }\n * ```\n */\nexport class SafeTimeout extends TimerRegistry {\n  /**\n   * Schedules `callback` after `delay` ms and returns the timer id.\n   *\n   * The id is removed from the registry automatically when the timeout fires,\n   * so {@link TimerRegistry.size | size} reflects only still-pending timers.\n   */\n  set(callback: () => void, delay: number): number {\n    const id = this.schedule(() => {\n      this.ids.delete(id);\n      callback();\n    }, delay);\n    this.ids.add(id);\n    return id;\n  }\n\n  protected schedule(callback: () => void, delay: number): number {\n    return window.setTimeout(callback, delay);\n  }\n\n  protected cancel(id: number): void {\n    window.clearTimeout(id);\n  }\n}\n\n/**\n * `setInterval` wrapper that tracks every interval for bulk teardown on\n * disconnect. Unlike {@link SafeTimeout}, intervals are retained until they are\n * explicitly cleared because they fire repeatedly.\n *\n * @example\n * ```ts\n * #intervals = new SafeInterval();\n *\n * connect() {\n *   this.#intervals.set(() => this.tick(), 1000);\n * }\n *\n * disconnect() {\n *   this.#intervals.clearAll();\n * }\n * ```\n */\nexport class SafeInterval extends TimerRegistry {\n  /** Schedules a repeating `callback` every `delay` ms and returns the timer id. */\n  set(callback: () => void, delay: number): number {\n    const id = this.schedule(callback, delay);\n    this.ids.add(id);\n    return id;\n  }\n\n  protected schedule(callback: () => void, delay: number): number {\n    return window.setInterval(callback, delay);\n  }\n\n  protected cancel(id: number): void {\n    window.clearInterval(id);\n  }\n}\n","import { Controller } from \"@hotwired/stimulus\";\nimport { SafeTimeout } from \"../utils/safe_timeout\";\n\n/**\n * Headless password show/hide (unmask) toggle behavior.\n *\n * Markup contract (identifier: `stimeo--password-reveal`):\n *   <div data-controller=\"stimeo--password-reveal\">\n *     <input type=\"password\" aria-label=\"Password\"\n *            data-stimeo--password-reveal-target=\"input\">\n *     <button type=\"button\" aria-pressed=\"false\" aria-label=\"Show password\"\n *             data-stimeo--password-reveal-target=\"toggle\"\n *             data-action=\"stimeo--password-reveal#toggle\"></button>\n *   </div>\n *\n * No dedicated APG pattern; this follows the toggle **Button** practice. The\n * accessible name stays state-independent (\"Show password\") while the pressed\n * state is conveyed by `aria-pressed`.\n *\n * `toggle` dispatches `{ visible: boolean }`.\n *\n * @remarks\n * Behavior only — icon rendering is the consumer's, keyed off `aria-pressed` /\n * `data-state` (`hidden` / `visible`). Flipping `input.type` can drop focus and\n * the caret, so when (and only when) the input was the focused element its focus\n * and selection are restored afterward; when the toggle button holds focus\n * (keyboard use) focus is left on the button. An optional `autoHide` re-masks\n * after a delay, and that timer is torn down on disconnect (Turbo).\n */\nexport class PasswordRevealController extends Controller<HTMLElement> {\n  static override targets = [\"input\", \"toggle\"];\n  static override values = {\n    autoHide: { type: Number, default: 0 },\n  };\n  static actions = [\"toggle\"] as const;\n  static events = [\"toggle\"] as const;\n\n  declare readonly inputTarget: HTMLInputElement;\n  declare readonly toggleTarget: HTMLElement;\n  declare readonly hasInputTarget: boolean;\n  declare readonly hasToggleTarget: boolean;\n\n  declare autoHideValue: number;\n\n  /** Auto re-mask timer; torn down on disconnect. */\n  #timers = new SafeTimeout();\n\n  override connect(): void {\n    this.#reflect(this.#isVisible);\n  }\n\n  override disconnect(): void {\n    this.#timers.clearAll();\n  }\n\n  /** Toggles the input between masked and revealed. Bound via `data-action`. */\n  toggle(): void {\n    this.#setVisible(!this.#isVisible);\n  }\n\n  /** Whether the input is currently revealed (`type=\"text\"`). */\n  get #isVisible(): boolean {\n    return this.hasInputTarget && this.inputTarget.type === \"text\";\n  }\n\n  /** Switches the masked/revealed state, preserving focus and caret. */\n  #setVisible(visible: boolean): void {\n    if (!this.hasInputTarget) return;\n    const input = this.inputTarget;\n\n    // Only the input's *own* focus is restored across the type change; if the\n    // toggle button (keyboard) holds focus, it is left untouched.\n    const restoreInputFocus = document.activeElement === input;\n    const selectionStart = input.selectionStart;\n    const selectionEnd = input.selectionEnd;\n\n    input.type = visible ? \"text\" : \"password\";\n\n    if (restoreInputFocus) {\n      input.focus();\n      // `selectionStart` / `selectionEnd` are `number | null` (null for input\n      // types that don't expose a selection); only restore when both are present.\n      if (selectionStart !== null && selectionEnd !== null) {\n        try {\n          input.setSelectionRange(selectionStart, selectionEnd);\n        } catch {\n          // Some input types reject selection access; focus alone is enough.\n        }\n      }\n    }\n\n    this.#reflect(visible);\n    this.dispatch(\"toggle\", { detail: { visible } });\n\n    this.#timers.clearAll();\n    if (visible && this.autoHideValue > 0) {\n      this.#timers.set(() => this.#setVisible(false), this.autoHideValue);\n    }\n  }\n\n  /** Reflects the visible state onto `aria-pressed` and `data-state`. */\n  #reflect(visible: boolean): void {\n    if (this.hasToggleTarget) {\n      this.toggleTarget.setAttribute(\"aria-pressed\", visible ? \"true\" : \"false\");\n    }\n    this.element.setAttribute(\"data-state\", visible ? \"visible\" : \"hidden\");\n  }\n}\n"]}

package/dist/controllers/password_strength_controller.d.ts

@@ -20,6 +20,8 @@ import { Controller } from '@hotwired/stimulus';
  * `--stimeo--password-strength`, and (when `minScore` is set) `data-below-min`,
  * and writes the level label into the label target.
  *
+ * `change` dispatches `{ score, level, max, meetsMin }`.
+ *
  * @remarks
  * Behavior only — the meter/bar look is the consumer's, keyed off the data hooks.
  * `data-strength` is one of the fixed {@link STRENGTH_BANDS} (not the localizable
@@ -44,8 +46,8 @@ declare class PasswordStrengthController extends Controller<HTMLElement> {
             default: number;
         };
         levels: {
-            type: ArrayConstructor;
-            default: string[];
+            type: StringConstructor;
+            default: string;
         };
     };
     static actions: readonly ["evaluate"];
@@ -57,7 +59,7 @@ declare class PasswordStrengthController extends Controller<HTMLElement> {
     readonly hasMeterTarget: boolean;
     readonly hasLabelTarget: boolean;
     minScoreValue: number;
-    levelsValue: string[];
+    levelsValue: string;
     connect(): void;
     disconnect(): void;
     /** Re-evaluates strength from the input. Bound via `data-action` (`input`). */

package/dist/controllers/password_strength_controller.js

@@ -55,8 +55,23 @@ var SafeTimeout = class extends TimerRegistry {
   }
 };
 
+// src/utils/string_list.ts
+function parseStringList(raw, fallback = []) {
+  const text = raw.trim();
+  if (text.length === 0) return [...fallback];
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return [...fallback];
+  }
+  if (!Array.isArray(parsed)) return [...fallback];
+  return parsed.filter((entry) => typeof entry === "string");
+}
+
 // src/controllers/password_strength_controller.ts
 var CLASS_PATTERNS = [/[a-z]/, /[A-Z]/, /[0-9]/, /[^A-Za-z0-9]/];
+var DEFAULT_LEVELS = ["weak", "fair", "good", "strong"];
 var LENGTH_MILESTONES = [8, 12, 16];
 var MAX_POINTS = LENGTH_MILESTONES.length + (CLASS_PATTERNS.length - 1);
 var STRENGTH_BANDS = ["weak", "fair", "good", "strong"];
@@ -64,7 +79,10 @@ var PasswordStrengthController = class _PasswordStrengthController extends Contr
   static targets = ["input", "meter", "label"];
   static values = {
     minScore: { type: Number, default: 0 },
-    levels: { type: Array, default: ["weak", "fair", "good", "strong"] }
+    // A JSON list read through `parseStringList` rather than Stimulus's `Array`
+    // type: that reader throws out of the value observer before any callback
+    // runs, so one malformed attribute would stop the meter connecting.
+    levels: { type: String, default: "" }
   };
   static actions = ["evaluate"];
   static events = ["change"];
@@ -90,7 +108,7 @@ var PasswordStrengthController = class _PasswordStrengthController extends Contr
    */
   #update(options = {}) {
     const password = this.hasInputTarget ? this.inputTarget.value : "";
-    const labels = this.levelsValue;
+    const labels = parseStringList(this.levelsValue, DEFAULT_LEVELS);
     const max = labels.length;
     const score = this.#score(password, max);
     const label = score > 0 ? labels[score - 1] ?? "" : "";

package/dist/controllers/password_strength_controller.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utils/safe_timeout.ts","../../src/controllers/password_strength_controller.ts"],"names":[],"mappings":";;;;;AAwBA,IAAe,gBAAf,MAA6B;AAAA;AAAA,EAER,GAAA,uBAAU,GAAA,EAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAczC,MAAM,EAAA,EAAkB;AACtB,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,MAAA,CAAO,EAAE,CAAA,EAAG;AACvB,MAAA,IAAA,CAAK,OAAO,EAAE,CAAA;AAAA,IAChB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,QAAA,GAAiB;AACf,IAAA,KAAA,MAAW,EAAA,IAAM,KAAK,GAAA,EAAK;AACzB,MAAA,IAAA,CAAK,OAAO,EAAE,CAAA;AAAA,IAChB;AACA,IAAA,IAAA,CAAK,IAAI,KAAA,EAAM;AAAA,EACjB;AAAA;AAAA,EAGA,IAAI,IAAA,GAAe;AACjB,IAAA,OAAO,KAAK,GAAA,CAAI,IAAA;AAAA,EAClB;AACF,CAAA;AAmBO,IAAM,WAAA,GAAN,cAA0B,aAAA,CAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO7C,GAAA,CAAI,UAAsB,KAAA,EAAuB;AAC/C,IAAA,MAAM,EAAA,GAAK,IAAA,CAAK,QAAA,CAAS,MAAM;AAC7B,MAAA,IAAA,CAAK,GAAA,CAAI,OAAO,EAAE,CAAA;AAClB,MAAA,QAAA,EAAS;AAAA,IACX,GAAG,KAAK,CAAA;AACR,IAAA,IAAA,CAAK,GAAA,CAAI,IAAI,EAAE,CAAA;AACf,IAAA,OAAO,EAAA;AAAA,EACT;AAAA,EAEU,QAAA,CAAS,UAAsB,KAAA,EAAuB;AAC9D,IAAA,OAAO,MAAA,CAAO,UAAA,CAAW,QAAA,EAAU,KAAK,CAAA;AAAA,EAC1C;AAAA,EAEU,OAAO,EAAA,EAAkB;AACjC,IAAA,MAAA,CAAO,aAAa,EAAE,CAAA;AAAA,EACxB;AACF,CAAA;;;ACnGA,IAAM,cAAA,GAAoC,CAAC,OAAA,EAAS,OAAA,EAAS,SAAS,cAAc,CAAA;AAGpF,IAAM,iBAAA,GAAuC,CAAC,CAAA,EAAG,EAAA,EAAI,EAAE,CAAA;AAGvD,IAAM,UAAA,GAAa,iBAAA,CAAkB,MAAA,IAAU,cAAA,CAAe,MAAA,GAAS,CAAA,CAAA;AAQvE,IAAM,cAAA,GAAiB,CAAC,MAAA,EAAQ,MAAA,EAAQ,QAAQ,QAAQ,CAAA;AAqCjD,IAAM,0BAAA,GAAN,MAAM,2BAAA,SAAmC,UAAA,CAAwB;AAAA,EACtE,OAAgB,OAAA,GAAU,CAAC,OAAA,EAAS,SAAS,OAAO,CAAA;AAAA,EACpD,OAAgB,MAAA,GAAS;AAAA,IACvB,QAAA,EAAU,EAAE,IAAA,EAAM,MAAA,EAAQ,SAAS,CAAA,EAAE;AAAA,IACrC,MAAA,EAAQ,EAAE,IAAA,EAAM,KAAA,EAAO,OAAA,EAAS,CAAC,MAAA,EAAQ,MAAA,EAAQ,MAAA,EAAQ,QAAQ,CAAA;AAAE,GACrE;AAAA,EACA,OAAO,OAAA,GAAU,CAAC,UAAU,CAAA;AAAA,EAC5B,OAAO,MAAA,GAAS,CAAC,QAAQ,CAAA;AAAA;AAAA,EAazB,OAAgB,cAAA,GAAiB,GAAA;AAAA,EAExB,OAAA,GAAU,IAAI,WAAA,EAAY;AAAA,EACnC,WAAA,GAA6B,IAAA;AAAA,EAEpB,OAAA,GAAgB;AAGvB,IAAA,IAAA,CAAK,OAAA,CAAQ,EAAE,QAAA,EAAU,KAAA,EAAO,CAAA;AAAA,EAClC;AAAA,EAES,UAAA,GAAmB;AAC1B,IAAA,IAAA,CAAK,QAAQ,QAAA,EAAS;AACtB,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AAAA,EACrB;AAAA;AAAA,EAGA,QAAA,GAAiB;AACf,IAAA,IAAA,CAAK,OAAA,EAAQ;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAA,CAAQ,OAAA,GAAkC,EAAC,EAAS;AAClD,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,cAAA,GAAiB,IAAA,CAAK,YAAY,KAAA,GAAQ,EAAA;AAChE,IAAA,MAAM,SAAS,IAAA,CAAK,WAAA;AACpB,IAAA,MAAM,MAAM,MAAA,CAAO,MAAA;AACnB,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,MAAA,CAAO,QAAA,EAAU,GAAG,CAAA;AACvC,IAAA,MAAM,QAAQ,KAAA,GAAQ,CAAA,GAAK,OAAO,KAAA,GAAQ,CAAC,KAAK,EAAA,GAAM,EAAA;AAEtD,IAAA,IAAA,CAAK,aAAA,CAAc,OAAO,GAAG,CAAA;AAC7B,IAAA,IAAA,CAAK,YAAA,CAAa,OAAO,GAAG,CAAA;AAE5B,IAAA,IAAI,OAAA,CAAQ,aAAa,KAAA,EAAO;AAG9B,MAAA,IAAA,CAAK,YAAY,KAAK,CAAA;AACtB,MAAA;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,SAAS,QAAA,EAAU;AAAA,MACtB,MAAA,EAAQ,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,GAAA,EAAK,QAAA,EAAU,KAAA,GAAQ,CAAA,IAAK,KAAA,IAAS,IAAA,CAAK,aAAA;AAAc,KACxF,CAAA;AAED,IAAA,IAAI,KAAK,WAAA,KAAgB,IAAA,OAAW,OAAA,CAAQ,KAAA,CAAM,KAAK,WAAW,CAAA;AAClE,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,MAAM;AACxC,MAAA,IAAA,CAAK,YAAY,KAAK,CAAA;AACtB,MAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AAAA,IACrB,CAAA,EAAG,4BAA2B,cAAc,CAAA;AAAA,EAC9C;AAAA;AAAA,EAGA,aAAA,CAAc,OAAe,GAAA,EAAmB;AAC9C,IAAA,IAAI,CAAC,KAAK,cAAA,EAAgB;AAC1B,IAAA,IAAA,CAAK,WAAA,CAAY,YAAA,CAAa,eAAA,EAAiB,GAAG,CAAA;AAClD,IAAA,IAAA,CAAK,WAAA,CAAY,YAAA,CAAa,eAAA,EAAiB,MAAA,CAAO,GAAG,CAAC,CAAA;AAC1D,IAAA,IAAA,CAAK,WAAA,CAAY,YAAA,CAAa,eAAA,EAAiB,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,EAC9D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,YAAA,CAAa,OAAe,GAAA,EAAmB;AAC7C,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,KAAA,EAAO,GAAG,CAAA;AAClC,IAAA,IAAA,CAAK,OAAA,CAAQ,eAAA,EAAiB,IAAA,EAAM,IAAA,CAAK,SAAS,CAAC,CAAA;AAKnD,IAAA,IAAA,CAAK,QAAQ,gBAAA,EAAkB,MAAA,EAAQ,QAAQ,CAAA,IAAK,KAAA,GAAQ,KAAK,aAAa,CAAA;AAC9E,IAAA,MAAM,KAAA,GAAQ,GAAA,GAAM,CAAA,GAAI,KAAA,GAAQ,GAAA,GAAM,CAAA;AACtC,IAAA,IAAA,CAAK,QAAQ,KAAA,CAAM,WAAA,CAAY,6BAAA,EAA+B,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,EAC7E;AAAA,EAEA,YAAY,KAAA,EAAqB;AAC/B,IAAA,IAAI,IAAA,CAAK,cAAA,EAAgB,IAAA,CAAK,WAAA,CAAY,WAAA,GAAc,KAAA;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,KAAA,CAAM,OAAe,GAAA,EAAqB;AACxC,IAAA,IAAI,KAAA,IAAS,CAAA,IAAK,GAAA,IAAO,CAAA,EAAG,OAAO,EAAA;AACnC,IAAA,MAAM,QAAQ,IAAA,CAAK,IAAA,CAAM,QAAQ,GAAA,GAAO,cAAA,CAAe,MAAM,CAAA,GAAI,CAAA;AACjE,IAAA,OAAO,cAAA,CAAe,IAAA,CAAK,GAAA,CAAI,cAAA,CAAe,MAAA,GAAS,CAAA,EAAG,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,KAAK,CAAC,CAAC,CAAA,IAAK,EAAA;AAAA,EACpF;AAAA;AAAA,EAGA,OAAA,CAAQ,IAAA,EAAc,KAAA,EAAe,EAAA,EAAmB;AACtD,IAAA,IAAI,EAAA,EAAI;AACN,MAAA,IAAA,CAAK,OAAA,CAAQ,YAAA,CAAa,IAAA,EAAM,KAAK,CAAA;AAAA,IACvC,CAAA,MAAO;AACL,MAAA,IAAA,CAAK,OAAA,CAAQ,gBAAgB,IAAI,CAAA;AAAA,IACnC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAA,CAAO,UAAkB,GAAA,EAAqB;AAC5C,IAAA,IAAI,QAAA,CAAS,MAAA,KAAW,CAAA,IAAK,GAAA,KAAQ,GAAG,OAAO,CAAA;AAE/C,IAAA,IAAI,MAAA,GAAS,CAAA;AACb,IAAA,KAAA,MAAW,aAAa,iBAAA,EAAmB;AACzC,MAAA,IAAI,QAAA,CAAS,MAAA,IAAU,SAAA,EAAW,MAAA,IAAU,CAAA;AAAA,IAC9C;AAEA,IAAA,MAAA,IAAU,cAAA,CAAe,OAAO,CAAC,EAAA,KAAO,GAAG,IAAA,CAAK,QAAQ,CAAC,CAAA,CAAE,MAAA,GAAS,CAAA;AAEpE,IAAA,IAAI,IAAI,GAAA,CAAI,QAAQ,CAAA,CAAE,IAAA,IAAQ,GAAG,MAAA,GAAS,CAAA;AAE1C,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAO,MAAA,GAAS,aAAc,GAAG,CAAA;AACvD,IAAA,OAAO,KAAK,GAAA,CAAI,GAAA,EAAK,KAAK,GAAA,CAAI,CAAA,EAAG,QAAQ,CAAC,CAAA;AAAA,EAC5C;AACF","file":"password_strength_controller.js","sourcesContent":["/**\n * Self-cleaning timer registries shared by Stimeo controllers.\n *\n * Stimulus controllers frequently schedule `setTimeout` / `setInterval` work\n * (auto-dismiss, debouncing, polling). When the element leaves the DOM — a\n * Turbo Drive navigation, a Turbo Stream replacement, or any `disconnect()` —\n * orphaned timers keep firing against a detached controller, leaking memory and\n * mutating stale state. {@link SafeTimeout} and {@link SafeInterval} track every\n * timer they create so a single {@link TimerRegistry.clearAll | clearAll()} call\n * in `disconnect()` tears them all down.\n *\n * These are intentionally low-level primitives: they own *registration and\n * cleanup only*. Higher-level policy (pause/resume, remaining-time accounting)\n * stays in the individual controllers so per-widget semantics are not flattened\n * into a lowest-common-denominator helper.\n */\n\n/**\n * Shared registry bookkeeping for the timeout/interval variants.\n *\n * Subclasses provide the scheduling primitive ({@link schedule}) and its matching\n * canceller ({@link cancel}); this base owns the set of live ids plus the\n * per-id and bulk teardown shared by both.\n */\nabstract class TimerRegistry {\n  /** Live timer ids that have not yet been cleared (or, for timeouts, fired). */\n  protected readonly ids = new Set<number>();\n\n  /** Schedules the underlying platform timer and returns its id. */\n  protected abstract schedule(callback: () => void, delay: number): number;\n\n  /** Cancels the underlying platform timer for `id`. */\n  protected abstract cancel(id: number): void;\n\n  /**\n   * Cancels a single tracked timer.\n   *\n   * No-ops if the id is unknown (already cleared, fired, or never owned by this\n   * registry), so callers can clear defensively without guarding.\n   */\n  clear(id: number): void {\n    if (this.ids.delete(id)) {\n      this.cancel(id);\n    }\n  }\n\n  /**\n   * Cancels every tracked timer. Call this from a controller's `disconnect()`\n   * to guarantee no timer outlives the element.\n   */\n  clearAll(): void {\n    for (const id of this.ids) {\n      this.cancel(id);\n    }\n    this.ids.clear();\n  }\n\n  /** Number of timers currently tracked (pending). */\n  get size(): number {\n    return this.ids.size;\n  }\n}\n\n/**\n * `setTimeout` wrapper that auto-forgets each timer once it fires and supports\n * bulk teardown on disconnect.\n *\n * @example\n * ```ts\n * #timers = new SafeTimeout();\n *\n * connect() {\n *   this.#timers.set(() => this.dismiss(), 5000);\n * }\n *\n * disconnect() {\n *   this.#timers.clearAll();\n * }\n * ```\n */\nexport class SafeTimeout extends TimerRegistry {\n  /**\n   * Schedules `callback` after `delay` ms and returns the timer id.\n   *\n   * The id is removed from the registry automatically when the timeout fires,\n   * so {@link TimerRegistry.size | size} reflects only still-pending timers.\n   */\n  set(callback: () => void, delay: number): number {\n    const id = this.schedule(() => {\n      this.ids.delete(id);\n      callback();\n    }, delay);\n    this.ids.add(id);\n    return id;\n  }\n\n  protected schedule(callback: () => void, delay: number): number {\n    return window.setTimeout(callback, delay);\n  }\n\n  protected cancel(id: number): void {\n    window.clearTimeout(id);\n  }\n}\n\n/**\n * `setInterval` wrapper that tracks every interval for bulk teardown on\n * disconnect. Unlike {@link SafeTimeout}, intervals are retained until they are\n * explicitly cleared because they fire repeatedly.\n *\n * @example\n * ```ts\n * #intervals = new SafeInterval();\n *\n * connect() {\n *   this.#intervals.set(() => this.tick(), 1000);\n * }\n *\n * disconnect() {\n *   this.#intervals.clearAll();\n * }\n * ```\n */\nexport class SafeInterval extends TimerRegistry {\n  /** Schedules a repeating `callback` every `delay` ms and returns the timer id. */\n  set(callback: () => void, delay: number): number {\n    const id = this.schedule(callback, delay);\n    this.ids.add(id);\n    return id;\n  }\n\n  protected schedule(callback: () => void, delay: number): number {\n    return window.setInterval(callback, delay);\n  }\n\n  protected cancel(id: number): void {\n    window.clearInterval(id);\n  }\n}\n","import { Controller } from \"@hotwired/stimulus\";\nimport { SafeTimeout } from \"../utils/safe_timeout\";\n\n/** Character classes that contribute to password variety (one point each beyond the first). */\nconst CLASS_PATTERNS: readonly RegExp[] = [/[a-z]/, /[A-Z]/, /[0-9]/, /[^A-Za-z0-9]/];\n\n/** Length milestones that each add a strength point. */\nconst LENGTH_MILESTONES: readonly number[] = [8, 12, 16];\n\n/** Upper bound of the raw heuristic points, used to bucket into the level scale. */\nconst MAX_POINTS = LENGTH_MILESTONES.length + (CLASS_PATTERNS.length - 1);\n\n/**\n * Fixed, locale-independent styling bands `data-strength` is drawn from. Kept\n * separate from the (localizable) `levels` labels so `data-strength` stays a\n * stable CSS hook (e.g. `[data-strength=\"weak\"]`) even when `levels` is\n * translated. Ascending: weakest → strongest.\n */\nconst STRENGTH_BANDS = [\"weak\", \"fair\", \"good\", \"strong\"] as const;\n\n/**\n * Headless password-strength behavior: scores the field with a lightweight\n * zero-dependency heuristic and drives a meter plus an `aria-live` label. No\n * dedicated APG pattern; the meter display follows {@link MeterController}.\n *\n * Markup contract (identifier: `stimeo--password-strength`):\n *   <div data-controller=\"stimeo--password-strength\">\n *     <input type=\"password\" data-stimeo--password-strength-target=\"input\"\n *            data-action=\"input->stimeo--password-strength#evaluate\" aria-describedby=\"pw\">\n *     <div data-stimeo--password-strength-target=\"meter\" role=\"meter\"\n *          aria-valuemin=\"0\" aria-valuemax=\"4\"></div>\n *     <span id=\"pw\" data-stimeo--password-strength-target=\"label\" aria-live=\"polite\"></span>\n *   </div>\n *\n * On each input the controller scores the password (length milestones + character\n * variety, capped for trivial repetition), syncs the meter's `aria-valuenow`,\n * reflects a stable band on `data-strength`, the `0–1` fill on\n * `--stimeo--password-strength`, and (when `minScore` is set) `data-below-min`,\n * and writes the level label into the label target.\n *\n * @remarks\n * Behavior only — the meter/bar look is the consumer's, keyed off the data hooks.\n * `data-strength` is one of the fixed {@link STRENGTH_BANDS} (not the localizable\n * `levels` text), so consumers can style by it regardless of locale; the visible\n * label receives the matching `levels` entry. Non-text state (meter ARIA,\n * `data-strength`/`data-below-min`, the custom property, and the `change` event)\n * updates **immediately** on every keystroke so styling and consumers stay\n * responsive, while the label — in an `aria-live=\"polite\"` region — is written on\n * a short debounce so a screen reader is not flooded mid-typing. The score is a\n * pure function of the input value (no module-scope state), so `connect()`\n * re-evaluates idempotently after a Turbo cache restore; the debounce timer is\n * owned by {@link SafeTimeout} and torn down on `disconnect()` (Turbo included).\n * The estimator is intentionally not a dictionary/zxcvbn-grade one (kept\n * zero-dep); swap a stronger one in on the consumer side if needed.\n */\nexport class PasswordStrengthController extends Controller<HTMLElement> {\n  static override targets = [\"input\", \"meter\", \"label\"];\n  static override values = {\n    minScore: { type: Number, default: 0 },\n    levels: { type: Array, default: [\"weak\", \"fair\", \"good\", \"strong\"] },\n  };\n  static actions = [\"evaluate\"] as const;\n  static events = [\"change\"] as const;\n\n  declare readonly inputTarget: HTMLInputElement;\n  declare readonly meterTarget: HTMLElement;\n  declare readonly labelTarget: HTMLElement;\n  declare readonly hasInputTarget: boolean;\n  declare readonly hasMeterTarget: boolean;\n  declare readonly hasLabelTarget: boolean;\n\n  declare minScoreValue: number;\n  declare levelsValue: string[];\n\n  /** Delay (ms) before the polite live-region label is written, to throttle SR flooding. */\n  static readonly #announceDelay = 200;\n\n  readonly #timers = new SafeTimeout();\n  #announceId: number | null = null;\n\n  override connect(): void {\n    // Reflect the current value synchronously (no announce): an autofilled or\n    // cache-restored field shows the right strength without queuing an SR message.\n    this.#update({ announce: false });\n  }\n\n  override disconnect(): void {\n    this.#timers.clearAll();\n    this.#announceId = null;\n  }\n\n  /** Re-evaluates strength from the input. Bound via `data-action` (`input`). */\n  evaluate(): void {\n    this.#update();\n  }\n\n  /**\n   * Recomputes the strength. The meter ARIA, data hooks, the custom property and\n   * the `change` event apply immediately; the live-region label text is debounced\n   * unless `announce` is `false` (the initial render).\n   */\n  #update(options: { announce?: boolean } = {}): void {\n    const password = this.hasInputTarget ? this.inputTarget.value : \"\";\n    const labels = this.levelsValue;\n    const max = labels.length;\n    const score = this.#score(password, max);\n    const label = score > 0 ? (labels[score - 1] ?? \"\") : \"\";\n\n    this.#reflectMeter(score, max);\n    this.#reflectRoot(score, max);\n\n    if (options.announce === false) {\n      // Initial render (connect / cache-restore): reflect without a change event\n      // or a queued screen-reader announcement.\n      this.#writeLabel(label);\n      return;\n    }\n\n    this.dispatch(\"change\", {\n      detail: { score, level: label, max, meetsMin: score > 0 && score >= this.minScoreValue },\n    });\n\n    if (this.#announceId !== null) this.#timers.clear(this.#announceId);\n    this.#announceId = this.#timers.set(() => {\n      this.#writeLabel(label);\n      this.#announceId = null;\n    }, PasswordStrengthController.#announceDelay);\n  }\n\n  /** Syncs the meter target's ARIA value attributes (`0..levels.length`). */\n  #reflectMeter(score: number, max: number): void {\n    if (!this.hasMeterTarget) return;\n    this.meterTarget.setAttribute(\"aria-valuemin\", \"0\");\n    this.meterTarget.setAttribute(\"aria-valuemax\", String(max));\n    this.meterTarget.setAttribute(\"aria-valuenow\", String(score));\n  }\n\n  /**\n   * Reflects the level onto the root: the stable `data-strength` band (absent when\n   * empty), the `data-below-min` hook when the score is under `minScore`, and the\n   * `0–1` fill the consumer's CSS turns into the bar width.\n   */\n  #reflectRoot(score: number, max: number): void {\n    const band = this.#band(score, max);\n    this.#toggle(\"data-strength\", band, band.length > 0);\n    // Empty/pristine input (`score === 0`) is never \"below min\": that would let CSS\n    // flag an untouched field as failing. Mirror the `change` event's `meetsMin`\n    // (`score > 0 && …`) so the hook only marks a *non-empty* password under the\n    // threshold. `minScore` defaults to 0, leaving the hook inert until set positive.\n    this.#toggle(\"data-below-min\", \"true\", score > 0 && score < this.minScoreValue);\n    const ratio = max > 0 ? score / max : 0;\n    this.element.style.setProperty(\"--stimeo--password-strength\", String(ratio));\n  }\n\n  #writeLabel(label: string): void {\n    if (this.hasLabelTarget) this.labelTarget.textContent = label;\n  }\n\n  /**\n   * Locale-independent styling band (one of {@link STRENGTH_BANDS}) for `score`\n   * out of `max`. Empty input → `\"\"`. Quantizes the `score/max` ratio into the\n   * four fixed bands, so a non-default level count still maps onto a stable hook.\n   */\n  #band(score: number, max: number): string {\n    if (score <= 0 || max <= 0) return \"\";\n    const index = Math.ceil((score / max) * STRENGTH_BANDS.length) - 1;\n    return STRENGTH_BANDS[Math.min(STRENGTH_BANDS.length - 1, Math.max(0, index))] ?? \"\";\n  }\n\n  /** Sets `name` to `value` when `on`, else removes it (value/presence data hook). */\n  #toggle(name: string, value: string, on: boolean): void {\n    if (on) {\n      this.element.setAttribute(name, value);\n    } else {\n      this.element.removeAttribute(name);\n    }\n  }\n\n  /**\n   * Lightweight zero-dependency strength heuristic returning an integer in\n   * `[0, max]` (`max` = number of levels). Empty input is `0` (no level); any\n   * non-empty password is at least `1`. Points accrue from length milestones and\n   * character-class variety, then bucket into the level scale. A tiny alphabet\n   * (≤ 2 distinct characters, e.g. \"aaaa\") is capped as the weakest, so length\n   * alone cannot mask trivial repetition.\n   */\n  #score(password: string, max: number): number {\n    if (password.length === 0 || max === 0) return 0;\n\n    let points = 0;\n    for (const milestone of LENGTH_MILESTONES) {\n      if (password.length >= milestone) points += 1;\n    }\n    // The first present character class is free; each additional one adds a point.\n    points += CLASS_PATTERNS.filter((re) => re.test(password)).length - 1;\n\n    if (new Set(password).size <= 2) points = 0; // trivial repetition → weakest\n\n    const bucketed = Math.round((points / MAX_POINTS) * max);\n    return Math.min(max, Math.max(1, bucketed));\n  }\n}\n"]}
+{"version":3,"sources":["../../src/utils/safe_timeout.ts","../../src/utils/string_list.ts","../../src/controllers/password_strength_controller.ts"],"names":[],"mappings":";;;;;AAwBA,IAAe,gBAAf,MAA6B;AAAA;AAAA,EAER,GAAA,uBAAU,GAAA,EAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAczC,MAAM,EAAA,EAAkB;AACtB,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,MAAA,CAAO,EAAE,CAAA,EAAG;AACvB,MAAA,IAAA,CAAK,OAAO,EAAE,CAAA;AAAA,IAChB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,QAAA,GAAiB;AACf,IAAA,KAAA,MAAW,EAAA,IAAM,KAAK,GAAA,EAAK;AACzB,MAAA,IAAA,CAAK,OAAO,EAAE,CAAA;AAAA,IAChB;AACA,IAAA,IAAA,CAAK,IAAI,KAAA,EAAM;AAAA,EACjB;AAAA;AAAA,EAGA,IAAI,IAAA,GAAe;AACjB,IAAA,OAAO,KAAK,GAAA,CAAI,IAAA;AAAA,EAClB;AACF,CAAA;AAmBO,IAAM,WAAA,GAAN,cAA0B,aAAA,CAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO7C,GAAA,CAAI,UAAsB,KAAA,EAAuB;AAC/C,IAAA,MAAM,EAAA,GAAK,IAAA,CAAK,QAAA,CAAS,MAAM;AAC7B,MAAA,IAAA,CAAK,GAAA,CAAI,OAAO,EAAE,CAAA;AAClB,MAAA,QAAA,EAAS;AAAA,IACX,GAAG,KAAK,CAAA;AACR,IAAA,IAAA,CAAK,GAAA,CAAI,IAAI,EAAE,CAAA;AACf,IAAA,OAAO,EAAA;AAAA,EACT;AAAA,EAEU,QAAA,CAAS,UAAsB,KAAA,EAAuB;AAC9D,IAAA,OAAO,MAAA,CAAO,UAAA,CAAW,QAAA,EAAU,KAAK,CAAA;AAAA,EAC1C;AAAA,EAEU,OAAO,EAAA,EAAkB;AACjC,IAAA,MAAA,CAAO,aAAa,EAAE,CAAA;AAAA,EACxB;AACF,CAAA;;;ACxEO,SAAS,eAAA,CAAgB,GAAA,EAAa,QAAA,GAA8B,EAAC,EAAa;AAIvF,EAAA,MAAM,IAAA,GAAO,IAAI,IAAA,EAAK;AACtB,EAAA,IAAI,KAAK,MAAA,KAAW,CAAA,EAAG,OAAO,CAAC,GAAG,QAAQ,CAAA;AAE1C,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EAC1B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,CAAC,GAAG,QAAQ,CAAA;AAAA,EACrB;AAEA,EAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,MAAM,GAAG,OAAO,CAAC,GAAG,QAAQ,CAAA;AAC/C,EAAA,OAAO,OAAO,MAAA,CAAO,CAAC,KAAA,KAA2B,OAAO,UAAU,QAAQ,CAAA;AAC5E;;;AC1CA,IAAM,cAAA,GAAoC,CAAC,OAAA,EAAS,OAAA,EAAS,SAAS,cAAc,CAAA;AAGpF,IAAM,cAAA,GAAiB,CAAC,MAAA,EAAQ,MAAA,EAAQ,QAAQ,QAAQ,CAAA;AAGxD,IAAM,iBAAA,GAAuC,CAAC,CAAA,EAAG,EAAA,EAAI,EAAE,CAAA;AAGvD,IAAM,UAAA,GAAa,iBAAA,CAAkB,MAAA,IAAU,cAAA,CAAe,MAAA,GAAS,CAAA,CAAA;AAQvE,IAAM,cAAA,GAAiB,CAAC,MAAA,EAAQ,MAAA,EAAQ,QAAQ,QAAQ,CAAA;AAuCjD,IAAM,0BAAA,GAAN,MAAM,2BAAA,SAAmC,UAAA,CAAwB;AAAA,EACtE,OAAgB,OAAA,GAAU,CAAC,OAAA,EAAS,SAAS,OAAO,CAAA;AAAA,EACpD,OAAgB,MAAA,GAAS;AAAA,IACvB,QAAA,EAAU,EAAE,IAAA,EAAM,MAAA,EAAQ,SAAS,CAAA,EAAE;AAAA;AAAA;AAAA;AAAA,IAIrC,MAAA,EAAQ,EAAE,IAAA,EAAM,MAAA,EAAQ,SAAS,EAAA;AAAG,GACtC;AAAA,EACA,OAAO,OAAA,GAAU,CAAC,UAAU,CAAA;AAAA,EAC5B,OAAO,MAAA,GAAS,CAAC,QAAQ,CAAA;AAAA;AAAA,EAazB,OAAgB,cAAA,GAAiB,GAAA;AAAA,EAExB,OAAA,GAAU,IAAI,WAAA,EAAY;AAAA,EACnC,WAAA,GAA6B,IAAA;AAAA,EAEpB,OAAA,GAAgB;AAGvB,IAAA,IAAA,CAAK,OAAA,CAAQ,EAAE,QAAA,EAAU,KAAA,EAAO,CAAA;AAAA,EAClC;AAAA,EAES,UAAA,GAAmB;AAC1B,IAAA,IAAA,CAAK,QAAQ,QAAA,EAAS;AACtB,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AAAA,EACrB;AAAA;AAAA,EAGA,QAAA,GAAiB;AACf,IAAA,IAAA,CAAK,OAAA,EAAQ;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAA,CAAQ,OAAA,GAAkC,EAAC,EAAS;AAClD,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,cAAA,GAAiB,IAAA,CAAK,YAAY,KAAA,GAAQ,EAAA;AAChE,IAAA,MAAM,MAAA,GAAS,eAAA,CAAgB,IAAA,CAAK,WAAA,EAAa,cAAc,CAAA;AAC/D,IAAA,MAAM,MAAM,MAAA,CAAO,MAAA;AACnB,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,MAAA,CAAO,QAAA,EAAU,GAAG,CAAA;AACvC,IAAA,MAAM,QAAQ,KAAA,GAAQ,CAAA,GAAK,OAAO,KAAA,GAAQ,CAAC,KAAK,EAAA,GAAM,EAAA;AAEtD,IAAA,IAAA,CAAK,aAAA,CAAc,OAAO,GAAG,CAAA;AAC7B,IAAA,IAAA,CAAK,YAAA,CAAa,OAAO,GAAG,CAAA;AAE5B,IAAA,IAAI,OAAA,CAAQ,aAAa,KAAA,EAAO;AAG9B,MAAA,IAAA,CAAK,YAAY,KAAK,CAAA;AACtB,MAAA;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,SAAS,QAAA,EAAU;AAAA,MACtB,MAAA,EAAQ,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,GAAA,EAAK,QAAA,EAAU,KAAA,GAAQ,CAAA,IAAK,KAAA,IAAS,IAAA,CAAK,aAAA;AAAc,KACxF,CAAA;AAED,IAAA,IAAI,KAAK,WAAA,KAAgB,IAAA,OAAW,OAAA,CAAQ,KAAA,CAAM,KAAK,WAAW,CAAA;AAClE,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,MAAM;AACxC,MAAA,IAAA,CAAK,YAAY,KAAK,CAAA;AACtB,MAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AAAA,IACrB,CAAA,EAAG,4BAA2B,cAAc,CAAA;AAAA,EAC9C;AAAA;AAAA,EAGA,aAAA,CAAc,OAAe,GAAA,EAAmB;AAC9C,IAAA,IAAI,CAAC,KAAK,cAAA,EAAgB;AAC1B,IAAA,IAAA,CAAK,WAAA,CAAY,YAAA,CAAa,eAAA,EAAiB,GAAG,CAAA;AAClD,IAAA,IAAA,CAAK,WAAA,CAAY,YAAA,CAAa,eAAA,EAAiB,MAAA,CAAO,GAAG,CAAC,CAAA;AAC1D,IAAA,IAAA,CAAK,WAAA,CAAY,YAAA,CAAa,eAAA,EAAiB,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,EAC9D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,YAAA,CAAa,OAAe,GAAA,EAAmB;AAC7C,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,KAAA,EAAO,GAAG,CAAA;AAClC,IAAA,IAAA,CAAK,OAAA,CAAQ,eAAA,EAAiB,IAAA,EAAM,IAAA,CAAK,SAAS,CAAC,CAAA;AAKnD,IAAA,IAAA,CAAK,QAAQ,gBAAA,EAAkB,MAAA,EAAQ,QAAQ,CAAA,IAAK,KAAA,GAAQ,KAAK,aAAa,CAAA;AAC9E,IAAA,MAAM,KAAA,GAAQ,GAAA,GAAM,CAAA,GAAI,KAAA,GAAQ,GAAA,GAAM,CAAA;AACtC,IAAA,IAAA,CAAK,QAAQ,KAAA,CAAM,WAAA,CAAY,6BAAA,EAA+B,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,EAC7E;AAAA,EAEA,YAAY,KAAA,EAAqB;AAC/B,IAAA,IAAI,IAAA,CAAK,cAAA,EAAgB,IAAA,CAAK,WAAA,CAAY,WAAA,GAAc,KAAA;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,KAAA,CAAM,OAAe,GAAA,EAAqB;AACxC,IAAA,IAAI,KAAA,IAAS,CAAA,IAAK,GAAA,IAAO,CAAA,EAAG,OAAO,EAAA;AACnC,IAAA,MAAM,QAAQ,IAAA,CAAK,IAAA,CAAM,QAAQ,GAAA,GAAO,cAAA,CAAe,MAAM,CAAA,GAAI,CAAA;AACjE,IAAA,OAAO,cAAA,CAAe,IAAA,CAAK,GAAA,CAAI,cAAA,CAAe,MAAA,GAAS,CAAA,EAAG,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,KAAK,CAAC,CAAC,CAAA,IAAK,EAAA;AAAA,EACpF;AAAA;AAAA,EAGA,OAAA,CAAQ,IAAA,EAAc,KAAA,EAAe,EAAA,EAAmB;AACtD,IAAA,IAAI,EAAA,EAAI;AACN,MAAA,IAAA,CAAK,OAAA,CAAQ,YAAA,CAAa,IAAA,EAAM,KAAK,CAAA;AAAA,IACvC,CAAA,MAAO;AACL,MAAA,IAAA,CAAK,OAAA,CAAQ,gBAAgB,IAAI,CAAA;AAAA,IACnC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAA,CAAO,UAAkB,GAAA,EAAqB;AAC5C,IAAA,IAAI,QAAA,CAAS,MAAA,KAAW,CAAA,IAAK,GAAA,KAAQ,GAAG,OAAO,CAAA;AAE/C,IAAA,IAAI,MAAA,GAAS,CAAA;AACb,IAAA,KAAA,MAAW,aAAa,iBAAA,EAAmB;AACzC,MAAA,IAAI,QAAA,CAAS,MAAA,IAAU,SAAA,EAAW,MAAA,IAAU,CAAA;AAAA,IAC9C;AAEA,IAAA,MAAA,IAAU,cAAA,CAAe,OAAO,CAAC,EAAA,KAAO,GAAG,IAAA,CAAK,QAAQ,CAAC,CAAA,CAAE,MAAA,GAAS,CAAA;AAEpE,IAAA,IAAI,IAAI,GAAA,CAAI,QAAQ,CAAA,CAAE,IAAA,IAAQ,GAAG,MAAA,GAAS,CAAA;AAE1C,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAO,MAAA,GAAS,aAAc,GAAG,CAAA;AACvD,IAAA,OAAO,KAAK,GAAA,CAAI,GAAA,EAAK,KAAK,GAAA,CAAI,CAAA,EAAG,QAAQ,CAAC,CAAA;AAAA,EAC5C;AACF","file":"password_strength_controller.js","sourcesContent":["/**\n * Self-cleaning timer registries shared by Stimeo controllers.\n *\n * Stimulus controllers frequently schedule `setTimeout` / `setInterval` work\n * (auto-dismiss, debouncing, polling). When the element leaves the DOM — a\n * Turbo Drive navigation, a Turbo Stream replacement, or any `disconnect()` —\n * orphaned timers keep firing against a detached controller, leaking memory and\n * mutating stale state. {@link SafeTimeout} and {@link SafeInterval} track every\n * timer they create so a single {@link TimerRegistry.clearAll | clearAll()} call\n * in `disconnect()` tears them all down.\n *\n * These are intentionally low-level primitives: they own *registration and\n * cleanup only*. Higher-level policy (pause/resume, remaining-time accounting)\n * stays in the individual controllers so per-widget semantics are not flattened\n * into a lowest-common-denominator helper.\n */\n\n/**\n * Shared registry bookkeeping for the timeout/interval variants.\n *\n * Subclasses provide the scheduling primitive ({@link schedule}) and its matching\n * canceller ({@link cancel}); this base owns the set of live ids plus the\n * per-id and bulk teardown shared by both.\n */\nabstract class TimerRegistry {\n  /** Live timer ids that have not yet been cleared (or, for timeouts, fired). */\n  protected readonly ids = new Set<number>();\n\n  /** Schedules the underlying platform timer and returns its id. */\n  protected abstract schedule(callback: () => void, delay: number): number;\n\n  /** Cancels the underlying platform timer for `id`. */\n  protected abstract cancel(id: number): void;\n\n  /**\n   * Cancels a single tracked timer.\n   *\n   * No-ops if the id is unknown (already cleared, fired, or never owned by this\n   * registry), so callers can clear defensively without guarding.\n   */\n  clear(id: number): void {\n    if (this.ids.delete(id)) {\n      this.cancel(id);\n    }\n  }\n\n  /**\n   * Cancels every tracked timer. Call this from a controller's `disconnect()`\n   * to guarantee no timer outlives the element.\n   */\n  clearAll(): void {\n    for (const id of this.ids) {\n      this.cancel(id);\n    }\n    this.ids.clear();\n  }\n\n  /** Number of timers currently tracked (pending). */\n  get size(): number {\n    return this.ids.size;\n  }\n}\n\n/**\n * `setTimeout` wrapper that auto-forgets each timer once it fires and supports\n * bulk teardown on disconnect.\n *\n * @example\n * ```ts\n * #timers = new SafeTimeout();\n *\n * connect() {\n *   this.#timers.set(() => this.dismiss(), 5000);\n * }\n *\n * disconnect() {\n *   this.#timers.clearAll();\n * }\n * ```\n */\nexport class SafeTimeout extends TimerRegistry {\n  /**\n   * Schedules `callback` after `delay` ms and returns the timer id.\n   *\n   * The id is removed from the registry automatically when the timeout fires,\n   * so {@link TimerRegistry.size | size} reflects only still-pending timers.\n   */\n  set(callback: () => void, delay: number): number {\n    const id = this.schedule(() => {\n      this.ids.delete(id);\n      callback();\n    }, delay);\n    this.ids.add(id);\n    return id;\n  }\n\n  protected schedule(callback: () => void, delay: number): number {\n    return window.setTimeout(callback, delay);\n  }\n\n  protected cancel(id: number): void {\n    window.clearTimeout(id);\n  }\n}\n\n/**\n * `setInterval` wrapper that tracks every interval for bulk teardown on\n * disconnect. Unlike {@link SafeTimeout}, intervals are retained until they are\n * explicitly cleared because they fire repeatedly.\n *\n * @example\n * ```ts\n * #intervals = new SafeInterval();\n *\n * connect() {\n *   this.#intervals.set(() => this.tick(), 1000);\n * }\n *\n * disconnect() {\n *   this.#intervals.clearAll();\n * }\n * ```\n */\nexport class SafeInterval extends TimerRegistry {\n  /** Schedules a repeating `callback` every `delay` ms and returns the timer id. */\n  set(callback: () => void, delay: number): number {\n    const id = this.schedule(callback, delay);\n    this.ids.add(id);\n    return id;\n  }\n\n  protected schedule(callback: () => void, delay: number): number {\n    return window.setInterval(callback, delay);\n  }\n\n  protected cancel(id: number): void {\n    window.clearInterval(id);\n  }\n}\n","/**\n * JSON string-list parsing for the controllers that take a list as a Value.\n *\n * Stimulus offers an `Array` Value type, but its reader runs `JSON.parse` inside\n * the value observer — **before** the `<name>ValueChanged` callback — and\n * rethrows on malformed text. The throw propagates out of the observer that runs\n * during connection, so a single unparseable attribute stops the controller from\n * connecting at all: no lifecycle callback runs and the element is left inert\n * rather than degraded. A consumer cannot guard against it either, because the\n * callback that would hold the `try` never runs.\n *\n * Declaring the attribute as a `String` Value and parsing it here keeps a\n * malformed declaration local to the value it declares. The attribute text is\n * identical either way (`'[\"a\", \"b\"]'`), so markup does not change with the\n * declaration.\n */\n\n/**\n * Parses `raw` as a JSON array of strings.\n *\n * Returns `fallback` when the text is absent, unparseable, or not an array, so a\n * malformed declaration behaves like an omitted one. A parsed array keeps only\n * its string entries: every caller indexes or compares strings, and a stray\n * number would otherwise sit in the list without ever matching.\n *\n * An explicit `\"[]\"` is honoured as an empty list rather than falling back — it\n * is the only way to declare \"none\" against a non-empty default.\n *\n * @param raw - the attribute text, e.g. `'[\"password\"]'`.\n * @param fallback - the list to use when `raw` declares nothing usable.\n */\nexport function parseStringList(raw: string, fallback: readonly string[] = []): string[] {\n  // The common case is an undeclared attribute, and `JSON.parse(\"\")` answers it\n  // by throwing. Reaching the same fallback without building an exception keeps\n  // the callers that ask per element off that path.\n  const text = raw.trim();\n  if (text.length === 0) return [...fallback];\n\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(text);\n  } catch {\n    return [...fallback];\n  }\n\n  if (!Array.isArray(parsed)) return [...fallback];\n  return parsed.filter((entry): entry is string => typeof entry === \"string\");\n}\n","import { Controller } from \"@hotwired/stimulus\";\nimport { SafeTimeout } from \"../utils/safe_timeout\";\nimport { parseStringList } from \"../utils/string_list\";\n\n/** Character classes that contribute to password variety (one point each beyond the first). */\nconst CLASS_PATTERNS: readonly RegExp[] = [/[a-z]/, /[A-Z]/, /[0-9]/, /[^A-Za-z0-9]/];\n\n/** Strength labels used unless the consumer declares its own scale. */\nconst DEFAULT_LEVELS = [\"weak\", \"fair\", \"good\", \"strong\"];\n\n/** Length milestones that each add a strength point. */\nconst LENGTH_MILESTONES: readonly number[] = [8, 12, 16];\n\n/** Upper bound of the raw heuristic points, used to bucket into the level scale. */\nconst MAX_POINTS = LENGTH_MILESTONES.length + (CLASS_PATTERNS.length - 1);\n\n/**\n * Fixed, locale-independent styling bands `data-strength` is drawn from. Kept\n * separate from the (localizable) `levels` labels so `data-strength` stays a\n * stable CSS hook (e.g. `[data-strength=\"weak\"]`) even when `levels` is\n * translated. Ascending: weakest → strongest.\n */\nconst STRENGTH_BANDS = [\"weak\", \"fair\", \"good\", \"strong\"] as const;\n\n/**\n * Headless password-strength behavior: scores the field with a lightweight\n * zero-dependency heuristic and drives a meter plus an `aria-live` label. No\n * dedicated APG pattern; the meter display follows {@link MeterController}.\n *\n * Markup contract (identifier: `stimeo--password-strength`):\n *   <div data-controller=\"stimeo--password-strength\">\n *     <input type=\"password\" data-stimeo--password-strength-target=\"input\"\n *            data-action=\"input->stimeo--password-strength#evaluate\" aria-describedby=\"pw\">\n *     <div data-stimeo--password-strength-target=\"meter\" role=\"meter\"\n *          aria-valuemin=\"0\" aria-valuemax=\"4\"></div>\n *     <span id=\"pw\" data-stimeo--password-strength-target=\"label\" aria-live=\"polite\"></span>\n *   </div>\n *\n * On each input the controller scores the password (length milestones + character\n * variety, capped for trivial repetition), syncs the meter's `aria-valuenow`,\n * reflects a stable band on `data-strength`, the `0–1` fill on\n * `--stimeo--password-strength`, and (when `minScore` is set) `data-below-min`,\n * and writes the level label into the label target.\n *\n * `change` dispatches `{ score, level, max, meetsMin }`.\n *\n * @remarks\n * Behavior only — the meter/bar look is the consumer's, keyed off the data hooks.\n * `data-strength` is one of the fixed {@link STRENGTH_BANDS} (not the localizable\n * `levels` text), so consumers can style by it regardless of locale; the visible\n * label receives the matching `levels` entry. Non-text state (meter ARIA,\n * `data-strength`/`data-below-min`, the custom property, and the `change` event)\n * updates **immediately** on every keystroke so styling and consumers stay\n * responsive, while the label — in an `aria-live=\"polite\"` region — is written on\n * a short debounce so a screen reader is not flooded mid-typing. The score is a\n * pure function of the input value (no module-scope state), so `connect()`\n * re-evaluates idempotently after a Turbo cache restore; the debounce timer is\n * owned by {@link SafeTimeout} and torn down on `disconnect()` (Turbo included).\n * The estimator is intentionally not a dictionary/zxcvbn-grade one (kept\n * zero-dep); swap a stronger one in on the consumer side if needed.\n */\nexport class PasswordStrengthController extends Controller<HTMLElement> {\n  static override targets = [\"input\", \"meter\", \"label\"];\n  static override values = {\n    minScore: { type: Number, default: 0 },\n    // A JSON list read through `parseStringList` rather than Stimulus's `Array`\n    // type: that reader throws out of the value observer before any callback\n    // runs, so one malformed attribute would stop the meter connecting.\n    levels: { type: String, default: \"\" },\n  };\n  static actions = [\"evaluate\"] as const;\n  static events = [\"change\"] as const;\n\n  declare readonly inputTarget: HTMLInputElement;\n  declare readonly meterTarget: HTMLElement;\n  declare readonly labelTarget: HTMLElement;\n  declare readonly hasInputTarget: boolean;\n  declare readonly hasMeterTarget: boolean;\n  declare readonly hasLabelTarget: boolean;\n\n  declare minScoreValue: number;\n  declare levelsValue: string;\n\n  /** Delay (ms) before the polite live-region label is written, to throttle SR flooding. */\n  static readonly #announceDelay = 200;\n\n  readonly #timers = new SafeTimeout();\n  #announceId: number | null = null;\n\n  override connect(): void {\n    // Reflect the current value synchronously (no announce): an autofilled or\n    // cache-restored field shows the right strength without queuing an SR message.\n    this.#update({ announce: false });\n  }\n\n  override disconnect(): void {\n    this.#timers.clearAll();\n    this.#announceId = null;\n  }\n\n  /** Re-evaluates strength from the input. Bound via `data-action` (`input`). */\n  evaluate(): void {\n    this.#update();\n  }\n\n  /**\n   * Recomputes the strength. The meter ARIA, data hooks, the custom property and\n   * the `change` event apply immediately; the live-region label text is debounced\n   * unless `announce` is `false` (the initial render).\n   */\n  #update(options: { announce?: boolean } = {}): void {\n    const password = this.hasInputTarget ? this.inputTarget.value : \"\";\n    const labels = parseStringList(this.levelsValue, DEFAULT_LEVELS);\n    const max = labels.length;\n    const score = this.#score(password, max);\n    const label = score > 0 ? (labels[score - 1] ?? \"\") : \"\";\n\n    this.#reflectMeter(score, max);\n    this.#reflectRoot(score, max);\n\n    if (options.announce === false) {\n      // Initial render (connect / cache-restore): reflect without a change event\n      // or a queued screen-reader announcement.\n      this.#writeLabel(label);\n      return;\n    }\n\n    this.dispatch(\"change\", {\n      detail: { score, level: label, max, meetsMin: score > 0 && score >= this.minScoreValue },\n    });\n\n    if (this.#announceId !== null) this.#timers.clear(this.#announceId);\n    this.#announceId = this.#timers.set(() => {\n      this.#writeLabel(label);\n      this.#announceId = null;\n    }, PasswordStrengthController.#announceDelay);\n  }\n\n  /** Syncs the meter target's ARIA value attributes (`0..levels.length`). */\n  #reflectMeter(score: number, max: number): void {\n    if (!this.hasMeterTarget) return;\n    this.meterTarget.setAttribute(\"aria-valuemin\", \"0\");\n    this.meterTarget.setAttribute(\"aria-valuemax\", String(max));\n    this.meterTarget.setAttribute(\"aria-valuenow\", String(score));\n  }\n\n  /**\n   * Reflects the level onto the root: the stable `data-strength` band (absent when\n   * empty), the `data-below-min` hook when the score is under `minScore`, and the\n   * `0–1` fill the consumer's CSS turns into the bar width.\n   */\n  #reflectRoot(score: number, max: number): void {\n    const band = this.#band(score, max);\n    this.#toggle(\"data-strength\", band, band.length > 0);\n    // Empty/pristine input (`score === 0`) is never \"below min\": that would let CSS\n    // flag an untouched field as failing. Mirror the `change` event's `meetsMin`\n    // (`score > 0 && …`) so the hook only marks a *non-empty* password under the\n    // threshold. `minScore` defaults to 0, leaving the hook inert until set positive.\n    this.#toggle(\"data-below-min\", \"true\", score > 0 && score < this.minScoreValue);\n    const ratio = max > 0 ? score / max : 0;\n    this.element.style.setProperty(\"--stimeo--password-strength\", String(ratio));\n  }\n\n  #writeLabel(label: string): void {\n    if (this.hasLabelTarget) this.labelTarget.textContent = label;\n  }\n\n  /**\n   * Locale-independent styling band (one of {@link STRENGTH_BANDS}) for `score`\n   * out of `max`. Empty input → `\"\"`. Quantizes the `score/max` ratio into the\n   * four fixed bands, so a non-default level count still maps onto a stable hook.\n   */\n  #band(score: number, max: number): string {\n    if (score <= 0 || max <= 0) return \"\";\n    const index = Math.ceil((score / max) * STRENGTH_BANDS.length) - 1;\n    return STRENGTH_BANDS[Math.min(STRENGTH_BANDS.length - 1, Math.max(0, index))] ?? \"\";\n  }\n\n  /** Sets `name` to `value` when `on`, else removes it (value/presence data hook). */\n  #toggle(name: string, value: string, on: boolean): void {\n    if (on) {\n      this.element.setAttribute(name, value);\n    } else {\n      this.element.removeAttribute(name);\n    }\n  }\n\n  /**\n   * Lightweight zero-dependency strength heuristic returning an integer in\n   * `[0, max]` (`max` = number of levels). Empty input is `0` (no level); any\n   * non-empty password is at least `1`. Points accrue from length milestones and\n   * character-class variety, then bucket into the level scale. A tiny alphabet\n   * (≤ 2 distinct characters, e.g. \"aaaa\") is capped as the weakest, so length\n   * alone cannot mask trivial repetition.\n   */\n  #score(password: string, max: number): number {\n    if (password.length === 0 || max === 0) return 0;\n\n    let points = 0;\n    for (const milestone of LENGTH_MILESTONES) {\n      if (password.length >= milestone) points += 1;\n    }\n    // The first present character class is free; each additional one adds a point.\n    points += CLASS_PATTERNS.filter((re) => re.test(password)).length - 1;\n\n    if (new Set(password).size <= 2) points = 0; // trivial repetition → weakest\n\n    const bucketed = Math.round((points / MAX_POINTS) * max);\n    return Math.min(max, Math.max(1, bucketed));\n  }\n}\n"]}

package/dist/controllers/persist_controller.d.ts

@@ -1,11 +1,8 @@
 import { Controller } from '@hotwired/stimulus';
 
-/** Field controls this controller can persist. */
-type PersistField = HTMLInputElement | HTMLTextAreaElement | HTMLSelectElement;
 /**
- * Headless draft-autosave behavior: persists a form's field values to
- * `localStorage` and restores them across Turbo navigations and reloads (no APG
- * pattern; a state-holding utility). The Alpine `persist` equivalent.
+ * Headless draft-autosave behavior: persists form controls to `localStorage`
+ * and restores them across Turbo navigation and reloads.
  *
  * Markup contract (identifier: `stimeo--persist`):
  *   <form data-controller="stimeo--persist"
@@ -14,16 +11,25 @@ type PersistField = HTMLInputElement | HTMLTextAreaElement | HTMLSelectElement;
  *     <textarea name="message"></textarea>
  *   </form>
  *
- * On connect it restores any saved values under `key` (falling back to the
- * element's `id`), then debounce-saves on every input/change. Password fields (and
- * anything in `exclude`) are never written. A `clear()` action — or the `clearOn`
- * event (e.g. `submit`) — drops the draft. Restoring never moves focus.
+ * The optional `field` targets restrict persistence to explicitly targeted
+ * controls. The public `clear` action removes the active draft. `key`,
+ * `debounce`, `exclude`, and `clearOn` Values can change while connected;
+ * `clearOn` is an event name whose occurrence invokes `clear`.
+ *
+ * `restore`, `save`, and `clear` dispatch `{ key: string }`. `error` dispatches
+ * `{ key: string, operation: "read" | "write" | "remove", reason:
+ * "unavailable" | "invalid-payload" }`. Restore writes are intentionally
+ * silent native-control mutations; consumers synchronize from the bubbling
+ * `restore` event without treating a restored draft as user input.
  *
  * @remarks
- * Behavior only. State lives entirely in `localStorage` (no module-scope state), so
- * instances never interfere. The input listener and debounce timer are removed on
- * `disconnect()` (Turbo navigation included), where a pending save is flushed first
- * so an in-flight edit is not lost.
+ * Behavior only — restoration never moves focus. Passwords are never stored;
+ * the default exclusion also omits Rails request metadata while preserving
+ * application-owned hidden fields. Distinct logical keys isolate instances;
+ * instances using the same key intentionally share one last-writer-wins draft.
+ * Every listener, timer, observer, and queued reconciliation is released on
+ * `disconnect()`, after any pending edit is flushed through the normal save
+ * path. A reconnect removes stale restored state before reading storage.
  */
 declare class PersistController extends Controller<HTMLElement> {
     #private;
@@ -38,8 +44,8 @@ declare class PersistController extends Controller<HTMLElement> {
             default: number;
         };
         exclude: {
-            type: ArrayConstructor;
-            default: string[];
+            type: StringConstructor;
+            default: string;
         };
         clearOn: {
             type: StringConstructor;
@@ -47,17 +53,25 @@ declare class PersistController extends Controller<HTMLElement> {
         };
     };
     static actions: readonly ["clear"];
-    static events: readonly ["restore", "save", "clear"];
-    readonly fieldTargets: PersistField[];
+    static events: readonly ["restore", "save", "clear", "error"];
+    readonly fieldTargets: Element[];
     readonly hasFieldTarget: boolean;
     keyValue: string;
     debounceValue: number;
-    excludeValue: string[];
+    excludeValue: string;
     clearOnValue: string;
     connect(): void;
     disconnect(): void;
-    /** Drops the saved draft and clears the restored marker. */
+    /** Drops the active draft after storage confirms the removal. */
     clear(): void;
+    /** Rebinds the external clear event when its Value changes. */
+    clearOnValueChanged(): void;
+    /** Switches storage namespaces without writing old edits under the new key. */
+    keyValueChanged(): void;
+    /** Reschedules a pending write against the current debounce delay. */
+    debounceValueChanged(): void;
+    /** Restores every field the new exclusion list makes eligible. */
+    excludeValueChanged(): void;
 }
 
 export { PersistController };