fix(js): normalize request policies

Honor only documented request concurrency policies and fall back to default behavior for unknown data-slhx-policy values.

req: convention/006

slhx-js/runtime/slhx.js

@@ -45,8 +45,12 @@
     return raw && /^\d+$/.test(raw) ? raw : null;
   }
 
+  function normalizedPolicy(value) {
+    return value === "latest" || value === "queue" || value === "drop" || value === "parallel" ? value : null;
+  }
+
   function requestPolicy(el, eventName) {
-    const policy = el.getAttribute("data-slhx-policy");
+    const policy = normalizedPolicy(el.getAttribute("data-slhx-policy"));
     if (policy) return policy;
     if (el.hasAttribute("data-slhx-debounce") || eventName === "input") return "latest";
     if (el.tagName === "FORM") return "drop";

slhx-js/tests/runtime.rs

@@ -54,8 +54,12 @@ fn runtime_supports_drag_drop_params_without_user_js() {
 
 #[test]
 fn runtime_supports_queued_request_policy() {
+    // req: convention/006
     let source = slhx_js::RUNTIME_JS;
 
+    assert!(source.contains("function normalizedPolicy(value)"));
+    assert!(source.contains("value === \"latest\" || value === \"queue\" || value === \"drop\" || value === \"parallel\""));
+    assert!(source.contains("const policy = normalizedPolicy(el.getAttribute(\"data-slhx-policy\"))"));
     assert!(source.contains("const queues = new WeakMap()"));
     assert!(source.contains("policy === \"queue\""));
     assert!(source.contains("const base = queues.get(target) || active.done"));