@anoki/fse-ui 2.3.0-8-SNAPSHOT → 2.3.0-9-SNAPSHOT

package/dist/index.es625.js

@@ -1,5 +1,699 @@
-var e = {};
+import { __require as ue } from "./index.es626.js";
+import { __require as ge } from "./index.es627.js";
+import { __require as pe } from "./index.es628.js";
+import { __require as he } from "./index.es629.js";
+import { __require as me } from "./index.es630.js";
+import { __require as we } from "./index.es631.js";
+var $, Y;
+function Me() {
+  if (Y) return $;
+  Y = 1;
+  const J = /* @__PURE__ */ ue(), I = ge(), { isPlainObject: K } = pe(), B = he(), Q = me(), { parse: j } = we(), ee = [
+    "img",
+    "audio",
+    "video",
+    "picture",
+    "svg",
+    "object",
+    "map",
+    "iframe",
+    "embed"
+  ], te = ["script", "style"];
+  function S(d, t) {
+    d && Object.keys(d).forEach(function(w) {
+      t(d[w], w);
+    });
+  }
+  function x(d, t) {
+    return {}.hasOwnProperty.call(d, t);
+  }
+  function L(d, t) {
+    const w = [];
+    return S(d, function(s) {
+      t(s) && w.push(s);
+    }), w;
+  }
+  function re(d) {
+    for (const t in d)
+      if (x(d, t))
+        return !1;
+    return !0;
+  }
+  function ne(d) {
+    return d.map(function(t) {
+      if (!t.url)
+        throw new Error("URL missing");
+      return t.url + (t.w ? ` ${t.w}w` : "") + (t.h ? ` ${t.h}h` : "") + (t.d ? ` ${t.d}x` : "");
+    }).join(", ");
+  }
+  $ = v;
+  const ie = /^[^\0\t\n\f\r /<=>]+$/;
+  function v(d, t, w) {
+    if (d == null)
+      return "";
+    typeof d == "number" && (d = d.toString());
+    let s = "", h = "";
+    function R(e, n) {
+      const r = this;
+      this.tag = e, this.attribs = n || {}, this.tagPosition = s.length, this.text = "", this.openingTagLength = 0, this.mediaChildren = [], this.updateParentNodeText = function() {
+        if (g.length) {
+          const i = g[g.length - 1];
+          i.text += r.text;
+        }
+      }, this.updateParentNodeMediaChildren = function() {
+        g.length && ee.includes(this.tag) && g[g.length - 1].mediaChildren.push(this.tag);
+      };
+    }
+    t = Object.assign({}, v.defaults, t), t.parser = Object.assign({}, se, t.parser);
+    const q = function(e) {
+      return t.allowedTags === !1 || (t.allowedTags || []).indexOf(e) > -1;
+    };
+    te.forEach(function(e) {
+      q(e) && !t.allowVulnerableTags && console.warn(`
+
+⚠️ Your \`allowedTags\` option includes, \`${e}\`, which is inherently
+vulnerable to XSS attacks. Please remove it from \`allowedTags\`.
+Or, to disable this warning, add the \`allowVulnerableTags\` option
+and ensure you are accounting for this risk.
+
+`);
+    });
+    const le = t.nonTextTags || [
+      "script",
+      "style",
+      "textarea",
+      "option"
+    ];
+    let f, E;
+    t.allowedAttributes && (f = {}, E = {}, S(t.allowedAttributes, function(e, n) {
+      f[n] = [];
+      const r = [];
+      e.forEach(function(i) {
+        typeof i == "string" && i.indexOf("*") >= 0 ? r.push(I(i).replace(/\\\*/g, ".*")) : f[n].push(i);
+      }), r.length && (E[n] = new RegExp("^(" + r.join("|") + ")$"));
+    }));
+    const C = {}, D = {}, _ = {};
+    S(t.allowedClasses, function(e, n) {
+      if (f && (x(f, n) || (f[n] = []), f[n].push("class")), C[n] = e, Array.isArray(e)) {
+        const r = [];
+        C[n] = [], _[n] = [], e.forEach(function(i) {
+          typeof i == "string" && i.indexOf("*") >= 0 ? r.push(I(i).replace(/\\\*/g, ".*")) : i instanceof RegExp ? _[n].push(i) : C[n].push(i);
+        }), r.length && (D[n] = new RegExp("^(" + r.join("|") + ")$"));
+      }
+    });
+    const z = {};
+    let F;
+    S(t.transformTags, function(e, n) {
+      let r;
+      typeof e == "function" ? r = e : typeof e == "string" && (r = v.simpleTransform(e)), n === "*" ? F = r : z[n] = r;
+    });
+    let m, g, P, M, T, O, H = !1;
+    W();
+    const U = new J.Parser({
+      onopentag: function(e, n) {
+        if (t.onOpenTag && t.onOpenTag(e, n), t.enforceHtmlBoundary && e === "html" && W(), T) {
+          O++;
+          return;
+        }
+        const r = new R(e, n);
+        g.push(r);
+        let i = !1;
+        const u = !!r.text;
+        let p;
+        if (x(z, e) && (p = z[e](e, n), r.attribs = n = p.attribs, p.text !== void 0 && (r.innerText = p.text), e !== p.tagName && (r.name = e = p.tagName, M[m] = p.tagName)), F && (p = F(e, n), r.attribs = n = p.attribs, e !== p.tagName && (r.name = e = p.tagName, M[m] = p.tagName)), (!q(e) || t.disallowedTagsMode === "recursiveEscape" && !re(P) || t.nestingLimit != null && m >= t.nestingLimit) && (i = !0, P[m] = !0, (t.disallowedTagsMode === "discard" || t.disallowedTagsMode === "completelyDiscard") && le.indexOf(e) !== -1 && (T = !0, O = 1)), m++, i) {
+          if (t.disallowedTagsMode === "discard" || t.disallowedTagsMode === "completelyDiscard") {
+            if (r.innerText && !u) {
+              const c = A(r.innerText);
+              t.textFilter ? s += t.textFilter(c, e) : s += c, H = !0;
+            }
+            return;
+          }
+          h = s, s = "";
+        }
+        s += "<" + e, e === "script" && (t.allowedScriptHostnames || t.allowedScriptDomains) && (r.innerText = ""), i && (t.disallowedTagsMode === "escape" || t.disallowedTagsMode === "recursiveEscape") && t.preserveEscapedAttributes ? S(n, function(c, l) {
+          s += " " + l + '="' + A(c || "", !0) + '"';
+        }) : (!f || x(f, e) || f["*"]) && S(n, function(c, l) {
+          if (!ie.test(l)) {
+            delete r.attribs[l];
+            return;
+          }
+          if (c === "" && !t.allowedEmptyAttributes.includes(l) && (t.nonBooleanAttributes.includes(l) || t.nonBooleanAttributes.includes("*"))) {
+            delete r.attribs[l];
+            return;
+          }
+          let N = !1;
+          if (!f || x(f, e) && f[e].indexOf(l) !== -1 || f["*"] && f["*"].indexOf(l) !== -1 || x(E, e) && E[e].test(l) || E["*"] && E["*"].test(l))
+            N = !0;
+          else if (f && f[e]) {
+            for (const o of f[e])
+              if (K(o) && o.name && o.name === l) {
+                N = !0;
+                let a = "";
+                if (o.multiple === !0) {
+                  const k = c.split(" ");
+                  for (const y of k)
+                    o.values.indexOf(y) !== -1 && (a === "" ? a = y : a += " " + y);
+                } else o.values.indexOf(c) >= 0 && (a = c);
+                c = a;
+              }
+          }
+          if (N) {
+            if (t.allowedSchemesAppliedToAttributes.indexOf(l) !== -1 && G(e, c)) {
+              delete r.attribs[l];
+              return;
+            }
+            if (e === "script" && l === "src") {
+              let o = !0;
+              try {
+                const a = V(c);
+                if (t.allowedScriptHostnames || t.allowedScriptDomains) {
+                  const k = (t.allowedScriptHostnames || []).find(function(b) {
+                    return b === a.url.hostname;
+                  }), y = (t.allowedScriptDomains || []).find(function(b) {
+                    return a.url.hostname === b || a.url.hostname.endsWith(`.${b}`);
+                  });
+                  o = k || y;
+                }
+              } catch {
+                o = !1;
+              }
+              if (!o) {
+                delete r.attribs[l];
+                return;
+              }
+            }
+            if (e === "iframe" && l === "src") {
+              let o = !0;
+              try {
+                const a = V(c);
+                if (a.isRelativeUrl)
+                  o = x(t, "allowIframeRelativeUrls") ? t.allowIframeRelativeUrls : !t.allowedIframeHostnames && !t.allowedIframeDomains;
+                else if (t.allowedIframeHostnames || t.allowedIframeDomains) {
+                  const k = (t.allowedIframeHostnames || []).find(function(b) {
+                    return b === a.url.hostname;
+                  }), y = (t.allowedIframeDomains || []).find(function(b) {
+                    return a.url.hostname === b || a.url.hostname.endsWith(`.${b}`);
+                  });
+                  o = k || y;
+                }
+              } catch {
+                o = !1;
+              }
+              if (!o) {
+                delete r.attribs[l];
+                return;
+              }
+            }
+            if (l === "srcset")
+              try {
+                let o = Q(c);
+                if (o.forEach(function(a) {
+                  G("srcset", a.url) && (a.evil = !0);
+                }), o = L(o, function(a) {
+                  return !a.evil;
+                }), o.length)
+                  c = ne(L(o, function(a) {
+                    return !a.evil;
+                  })), r.attribs[l] = c;
+                else {
+                  delete r.attribs[l];
+                  return;
+                }
+              } catch {
+                delete r.attribs[l];
+                return;
+              }
+            if (l === "class") {
+              const o = C[e], a = C["*"], k = D[e], y = _[e], b = _["*"], de = D["*"], X = [
+                k,
+                de
+              ].concat(y, b).filter(function(fe) {
+                return fe;
+              });
+              if (o && a ? c = Z(c, B(o, a), X) : c = Z(c, o || a, X), !c.length) {
+                delete r.attribs[l];
+                return;
+              }
+            }
+            if (l === "style") {
+              if (t.parseStyleAttributes)
+                try {
+                  const o = j(e + " {" + c + "}", { map: !1 }), a = oe(o, t.allowedStyles);
+                  if (c = ae(a), c.length === 0) {
+                    delete r.attribs[l];
+                    return;
+                  }
+                } catch {
+                  typeof window < "u" && console.warn('Failed to parse "' + e + " {" + c + `}", If you're running this in a browser, we recommend to disable style parsing: options.parseStyleAttributes: false, since this only works in a node environment due to a postcss dependency, More info: https://github.com/apostrophecms/sanitize-html/issues/547`), delete r.attribs[l];
+                  return;
+                }
+              else if (t.allowedStyles)
+                throw new Error("allowedStyles option cannot be used together with parseStyleAttributes: false.");
+            }
+            s += " " + l, c && c.length ? s += '="' + A(c, !0) + '"' : t.allowedEmptyAttributes.includes(l) && (s += '=""');
+          } else
+            delete r.attribs[l];
+        }), t.selfClosing.indexOf(e) !== -1 ? s += " />" : (s += ">", r.innerText && !u && !t.textFilter && (s += A(r.innerText), H = !0)), i && (s = h + A(s), h = ""), r.openingTagLength = s.length - r.tagPosition;
+      },
+      ontext: function(e) {
+        if (T)
+          return;
+        const n = g[g.length - 1];
+        let r;
+        if (n && (r = n.tag, e = n.innerText !== void 0 ? n.innerText : e), t.disallowedTagsMode === "completelyDiscard" && !q(r))
+          e = "";
+        else if ((t.disallowedTagsMode === "discard" || t.disallowedTagsMode === "completelyDiscard") && (r === "script" || r === "style"))
+          s += e;
+        else if (!H) {
+          const i = A(e, !1);
+          t.textFilter ? s += t.textFilter(i, r) : s += i;
+        }
+        if (g.length) {
+          const i = g[g.length - 1];
+          i.text += e;
+        }
+      },
+      onclosetag: function(e, n) {
+        if (t.onCloseTag && t.onCloseTag(e, n), T)
+          if (O--, !O)
+            T = !1;
+          else
+            return;
+        const r = g.pop();
+        if (!r)
+          return;
+        if (r.tag !== e) {
+          g.push(r);
+          return;
+        }
+        T = t.enforceHtmlBoundary ? e === "html" : !1, m--;
+        const i = P[m];
+        if (i) {
+          if (delete P[m], t.disallowedTagsMode === "discard" || t.disallowedTagsMode === "completelyDiscard") {
+            r.updateParentNodeText();
+            return;
+          }
+          h = s, s = "";
+        }
+        if (M[m] && (e = M[m], delete M[m]), t.exclusiveFilter) {
+          const u = t.exclusiveFilter(r);
+          if (u === "excludeTag") {
+            i && (s = h, h = ""), s = s.substring(0, r.tagPosition) + s.substring(r.tagPosition + r.openingTagLength);
+            return;
+          } else if (u) {
+            s = s.substring(0, r.tagPosition);
+            return;
+          }
+        }
+        if (r.updateParentNodeMediaChildren(), r.updateParentNodeText(), // Already output />
+        t.selfClosing.indexOf(e) !== -1 || // Escaped tag, closing tag is implied
+        n && !q(e) && ["escape", "recursiveEscape"].indexOf(t.disallowedTagsMode) >= 0) {
+          i && (s = h, h = "");
+          return;
+        }
+        s += "</" + e + ">", i && (s = h + A(s), h = ""), H = !1;
+      }
+    }, t.parser);
+    return U.write(d), U.end(), s;
+    function W() {
+      s = "", m = 0, g = [], P = {}, M = {}, T = !1, O = 0;
+    }
+    function A(e, n) {
+      return typeof e != "string" && (e = e + ""), t.parser.decodeEntities && (e = e.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;"), n && (e = e.replace(/"/g, "&quot;"))), e = e.replace(/&(?![a-zA-Z0-9#]{1,20};)/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;"), n && (e = e.replace(/"/g, "&quot;")), e;
+    }
+    function G(e, n) {
+      for (n = n.replace(/[\x00-\x20]+/g, ""); ; ) {
+        const u = n.indexOf("<!--");
+        if (u === -1)
+          break;
+        const p = n.indexOf("-->", u + 4);
+        if (p === -1)
+          break;
+        n = n.substring(0, u) + n.substring(p + 3);
+      }
+      const r = n.match(/^([a-zA-Z][a-zA-Z0-9.\-+]*):/);
+      if (!r)
+        return n.match(/^[/\\]{2}/) ? !t.allowProtocolRelative : !1;
+      const i = r[1].toLowerCase();
+      return x(t.allowedSchemesByTag, e) ? t.allowedSchemesByTag[e].indexOf(i) === -1 : !t.allowedSchemes || t.allowedSchemes.indexOf(i) === -1;
+    }
+    function V(e) {
+      if (e = e.replace(/^(\w+:)?\s*[\\/]\s*[\\/]/, "$1//"), e.startsWith("relative:"))
+        throw new Error("relative: exploit attempt");
+      let n = "relative://relative-site";
+      for (let u = 0; u < 100; u++)
+        n += `/${u}`;
+      const r = new URL(e, n);
+      return {
+        isRelativeUrl: r && r.hostname === "relative-site" && r.protocol === "relative:",
+        url: r
+      };
+    }
+    function oe(e, n) {
+      if (!n)
+        return e;
+      const r = e.nodes[0];
+      let i;
+      return n[r.selector] && n["*"] ? i = B(
+        n[r.selector],
+        n["*"]
+      ) : i = n[r.selector] || n["*"], i && (e.nodes[0].nodes = r.nodes.reduce(ce(i), [])), e;
+    }
+    function ae(e) {
+      return e.nodes[0].nodes.reduce(function(n, r) {
+        return n.push(
+          `${r.prop}:${r.value}${r.important ? " !important" : ""}`
+        ), n;
+      }, []).join(";");
+    }
+    function ce(e) {
+      return function(n, r) {
+        return x(e, r.prop) && e[r.prop].some(function(u) {
+          return u.test(r.value);
+        }) && n.push(r), n;
+      };
+    }
+    function Z(e, n, r) {
+      return n ? (e = e.split(/\s+/), e.filter(function(i) {
+        return n.indexOf(i) !== -1 || r.some(function(u) {
+          return u.test(i);
+        });
+      }).join(" ")) : e;
+    }
+  }
+  const se = {
+    decodeEntities: !0
+  };
+  return v.defaults = {
+    allowedTags: [
+      // Sections derived from MDN element categories and limited to the more
+      // benign categories.
+      // https://developer.mozilla.org/en-US/docs/Web/HTML/Element
+      // Content sectioning
+      "address",
+      "article",
+      "aside",
+      "footer",
+      "header",
+      "h1",
+      "h2",
+      "h3",
+      "h4",
+      "h5",
+      "h6",
+      "hgroup",
+      "main",
+      "nav",
+      "section",
+      // Text content
+      "blockquote",
+      "dd",
+      "div",
+      "dl",
+      "dt",
+      "figcaption",
+      "figure",
+      "hr",
+      "li",
+      "menu",
+      "ol",
+      "p",
+      "pre",
+      "ul",
+      // Inline text semantics
+      "a",
+      "abbr",
+      "b",
+      "bdi",
+      "bdo",
+      "br",
+      "cite",
+      "code",
+      "data",
+      "dfn",
+      "em",
+      "i",
+      "kbd",
+      "mark",
+      "q",
+      "rb",
+      "rp",
+      "rt",
+      "rtc",
+      "ruby",
+      "s",
+      "samp",
+      "small",
+      "span",
+      "strong",
+      "sub",
+      "sup",
+      "time",
+      "u",
+      "var",
+      "wbr",
+      // Table content
+      "caption",
+      "col",
+      "colgroup",
+      "table",
+      "tbody",
+      "td",
+      "tfoot",
+      "th",
+      "thead",
+      "tr"
+    ],
+    // Tags that cannot be boolean
+    nonBooleanAttributes: [
+      "abbr",
+      "accept",
+      "accept-charset",
+      "accesskey",
+      "action",
+      "allow",
+      "alt",
+      "as",
+      "autocapitalize",
+      "autocomplete",
+      "blocking",
+      "charset",
+      "cite",
+      "class",
+      "color",
+      "cols",
+      "colspan",
+      "content",
+      "contenteditable",
+      "coords",
+      "crossorigin",
+      "data",
+      "datetime",
+      "decoding",
+      "dir",
+      "dirname",
+      "download",
+      "draggable",
+      "enctype",
+      "enterkeyhint",
+      "fetchpriority",
+      "for",
+      "form",
+      "formaction",
+      "formenctype",
+      "formmethod",
+      "formtarget",
+      "headers",
+      "height",
+      "hidden",
+      "high",
+      "href",
+      "hreflang",
+      "http-equiv",
+      "id",
+      "imagesizes",
+      "imagesrcset",
+      "inputmode",
+      "integrity",
+      "is",
+      "itemid",
+      "itemprop",
+      "itemref",
+      "itemtype",
+      "kind",
+      "label",
+      "lang",
+      "list",
+      "loading",
+      "low",
+      "max",
+      "maxlength",
+      "media",
+      "method",
+      "min",
+      "minlength",
+      "name",
+      "nonce",
+      "optimum",
+      "pattern",
+      "ping",
+      "placeholder",
+      "popover",
+      "popovertarget",
+      "popovertargetaction",
+      "poster",
+      "preload",
+      "referrerpolicy",
+      "rel",
+      "rows",
+      "rowspan",
+      "sandbox",
+      "scope",
+      "shape",
+      "size",
+      "sizes",
+      "slot",
+      "span",
+      "spellcheck",
+      "src",
+      "srcdoc",
+      "srclang",
+      "srcset",
+      "start",
+      "step",
+      "style",
+      "tabindex",
+      "target",
+      "title",
+      "translate",
+      "type",
+      "usemap",
+      "value",
+      "width",
+      "wrap",
+      // Event handlers
+      "onauxclick",
+      "onafterprint",
+      "onbeforematch",
+      "onbeforeprint",
+      "onbeforeunload",
+      "onbeforetoggle",
+      "onblur",
+      "oncancel",
+      "oncanplay",
+      "oncanplaythrough",
+      "onchange",
+      "onclick",
+      "onclose",
+      "oncontextlost",
+      "oncontextmenu",
+      "oncontextrestored",
+      "oncopy",
+      "oncuechange",
+      "oncut",
+      "ondblclick",
+      "ondrag",
+      "ondragend",
+      "ondragenter",
+      "ondragleave",
+      "ondragover",
+      "ondragstart",
+      "ondrop",
+      "ondurationchange",
+      "onemptied",
+      "onended",
+      "onerror",
+      "onfocus",
+      "onformdata",
+      "onhashchange",
+      "oninput",
+      "oninvalid",
+      "onkeydown",
+      "onkeypress",
+      "onkeyup",
+      "onlanguagechange",
+      "onload",
+      "onloadeddata",
+      "onloadedmetadata",
+      "onloadstart",
+      "onmessage",
+      "onmessageerror",
+      "onmousedown",
+      "onmouseenter",
+      "onmouseleave",
+      "onmousemove",
+      "onmouseout",
+      "onmouseover",
+      "onmouseup",
+      "onoffline",
+      "ononline",
+      "onpagehide",
+      "onpageshow",
+      "onpaste",
+      "onpause",
+      "onplay",
+      "onplaying",
+      "onpopstate",
+      "onprogress",
+      "onratechange",
+      "onreset",
+      "onresize",
+      "onrejectionhandled",
+      "onscroll",
+      "onscrollend",
+      "onsecuritypolicyviolation",
+      "onseeked",
+      "onseeking",
+      "onselect",
+      "onslotchange",
+      "onstalled",
+      "onstorage",
+      "onsubmit",
+      "onsuspend",
+      "ontimeupdate",
+      "ontoggle",
+      "onunhandledrejection",
+      "onunload",
+      "onvolumechange",
+      "onwaiting",
+      "onwheel"
+    ],
+    disallowedTagsMode: "discard",
+    allowedAttributes: {
+      a: ["href", "name", "target"],
+      // We don't currently allow img itself by default, but
+      // these attributes would make sense if we did.
+      img: ["src", "srcset", "alt", "title", "width", "height", "loading"]
+    },
+    allowedEmptyAttributes: [
+      "alt"
+    ],
+    // Lots of these won't come up by default because we don't allow them
+    selfClosing: ["img", "br", "hr", "area", "base", "basefont", "input", "link", "meta"],
+    // URL schemes we permit
+    allowedSchemes: ["http", "https", "ftp", "mailto", "tel"],
+    allowedSchemesByTag: {},
+    allowedSchemesAppliedToAttributes: ["href", "src", "cite"],
+    allowProtocolRelative: !0,
+    enforceHtmlBoundary: !1,
+    parseStyleAttributes: !0,
+    preserveEscapedAttributes: !1
+  }, v.simpleTransform = function(d, t, w) {
+    return w = w === void 0 ? !0 : w, t = t || {}, function(s, h) {
+      let R;
+      if (w)
+        for (R in t)
+          h[R] = t[R];
+      else
+        h = t;
+      return {
+        tagName: d,
+        attribs: h
+      };
+    };
+  }, $;
+}
 export {
-  e as __exports
+  Me as __require
 };
 //# sourceMappingURL=index.es625.js.map