@burdenoff/microfe-bigconsole 2026.1005.4 → 2026.1006.1

package/dist/bigconsole/renderers/index.d.ts

@@ -7,4 +7,3 @@ export type { RendererType, RendererProps, RendererCapabilities, RendererDefinit
 export { RENDERER_DEFINITIONS, getRendererDefinition, getAllRendererDefinitions, getRenderersForWidgetType, getDefaultRenderer, isValidRendererType, rendererSupportsWidgetType, validateTemplate, } from './registry/RendererRegistry';
 export { WidgetRendererFactory, resolveRenderer, getRendererForWidget, type WidgetRendererFactoryProps, type ResolvedRenderer, } from './factory/WidgetRendererFactory';
 export { BigConsoleRenderer, AdaptiveCardRenderer, BlockKitRenderer, CustomRenderer, registerCustomComponent, unregisterCustomComponent, hasCustomComponent, getCustomComponent, getRegisteredComponentNames, type CustomComponentProps, } from './adapters';
-//# sourceMappingURL=index.d.ts.map

package/dist/bigconsole/renderers/registry/RendererRegistry.d.ts

@@ -39,4 +39,3 @@ export declare function validateTemplate(rendererType: RendererType, template: R
  */
 export declare function getRendererComponent(type: RendererType): React.ComponentType<RendererProps>;
 export default RENDERER_DEFINITIONS;
-//# sourceMappingURL=RendererRegistry.d.ts.map

package/dist/bigconsole/renderers/registry/RendererRegistry.js

@@ -135,5 +135,3 @@ function p(e) {
 }
 //#endregion
 export { p as getDefaultRenderer, u as getRendererDefinition, d as isValidRendererType, f as rendererSupportsWidgetType };
-
-//# sourceMappingURL=RendererRegistry.js.map

package/dist/bigconsole/renderers/types/index.d.ts

@@ -4,4 +4,3 @@
  * Export all type definitions for the renderer system.
  */
 export type { RendererType, RendererProps, RendererCapabilities, RendererDefinition, RendererContext, AdaptiveCardElement, AdaptiveCardColumn, AdaptiveCardFact, AdaptiveCardAction, AdaptiveCardTemplate, BlockKitElement, BlockKitText, BlockKitAccessory, BlockKitConfirm, BlockKitTemplate, BlockKitAttachment, WidgetAction, ActionConfirmation, ActionContext, ActionResult, } from './renderer';
-//# sourceMappingURL=index.d.ts.map

package/dist/bigconsole/renderers/types/renderer.d.ts

@@ -225,4 +225,3 @@ export interface ActionResult {
         target?: '_self' | '_blank' | '_modal';
     };
 }
-//# sourceMappingURL=renderer.d.ts.map

package/dist/bigconsole/store/dashboardStore.d.ts

@@ -129,4 +129,3 @@ export declare const useHasActiveFilters: () => boolean;
  */
 export declare const useFiltersCollapsed: () => boolean;
 export {};
-//# sourceMappingURL=dashboardStore.d.ts.map

package/dist/bigconsole/store/dashboardStore.js

@@ -242,5 +242,3 @@ var i = 30, a = {
 }), { name: "DashboardStore" })), c = () => s((e) => e.viewMode === "edit"), l = () => s((e) => e.globalFilterValues);
 //#endregion
 export { s as useDashboardStore, l as useGlobalFilterValues, c as useIsEditMode };
-
-//# sourceMappingURL=dashboardStore.js.map

package/dist/bigconsole/store/dataSinkStore.d.ts

@@ -91,4 +91,3 @@ export declare const useDataSinkStore: import('zustand').UseBoundStore<Omit<Omit
     };
 }>;
 export {};
-//# sourceMappingURL=dataSinkStore.d.ts.map

package/dist/bigconsole/store/dataSinkStore.js

@@ -134,5 +134,3 @@ var i = {
 }), { name: "DataSinkStore" }));
 //#endregion
 export { a as useDataSinkStore };
-
-//# sourceMappingURL=dataSinkStore.js.map

package/dist/bigconsole/store/drilldownStore.d.ts

@@ -60,4 +60,3 @@ export declare const useDrilldownStore: import('zustand').UseBoundStore<Omit<Omi
     };
 }>;
 export default useDrilldownStore;
-//# sourceMappingURL=drilldownStore.d.ts.map

package/dist/bigconsole/store/drilldownStore.js

@@ -65,5 +65,3 @@ var i = {
 }));
 //#endregion
 export { a as default };
-
-//# sourceMappingURL=drilldownStore.js.map

package/dist/bigconsole/store/index.d.ts

@@ -10,4 +10,3 @@ export { useDataSinkStore } from './dataSinkStore';
 export { useParserStore } from './parserStore';
 export { useWorkflowStore } from './workflowStore';
 export { usePipelineStore } from './pipelineStore';
-//# sourceMappingURL=index.d.ts.map

package/dist/bigconsole/store/parserStore.d.ts

@@ -103,4 +103,3 @@ export declare const useParserStore: import('zustand').UseBoundStore<Omit<Omit<i
     };
 }>;
 export {};
-//# sourceMappingURL=parserStore.d.ts.map

package/dist/bigconsole/store/parserStore.js

@@ -171,5 +171,3 @@ var i = {
 }), { name: "ParserStore" }));
 //#endregion
 export { a as useParserStore };
-
-//# sourceMappingURL=parserStore.js.map

package/dist/bigconsole/store/pipelineStore.d.ts

@@ -110,4 +110,3 @@ export declare const usePipelineStore: import('zustand').UseBoundStore<Omit<Omit
     };
 }>;
 export {};
-//# sourceMappingURL=pipelineStore.d.ts.map

package/dist/bigconsole/store/pipelineStore.js

@@ -227,5 +227,3 @@ var i = {
 }), { name: "PipelineStore" }));
 //#endregion
 export { a as usePipelineStore };
-
-//# sourceMappingURL=pipelineStore.js.map

package/dist/bigconsole/store/widgetStore.d.ts

@@ -103,4 +103,3 @@ export declare const useHasClipboard: () => boolean;
 export declare const useHasDirtyWidgets: () => boolean;
 export declare const useDirtyWidgetIds: () => Set<string>;
 export {};
-//# sourceMappingURL=widgetStore.d.ts.map

package/dist/bigconsole/store/widgetStore.js

@@ -213,5 +213,3 @@ var i = {
 }, s = (e) => a((t) => t.widgetUIStates.get(e) || o), c = (e) => a((t) => t.selectedWidgetId === e);
 //#endregion
 export { c as useIsWidgetSelected, a as useWidgetStore, s as useWidgetUIState };
-
-//# sourceMappingURL=widgetStore.js.map

package/dist/bigconsole/store/workflowStore.d.ts

@@ -117,4 +117,3 @@ export declare const useWorkflowStore: import('zustand').UseBoundStore<Omit<Omit
     };
 }>;
 export {};
-//# sourceMappingURL=workflowStore.d.ts.map

package/dist/bigconsole/store/workflowStore.js

@@ -189,5 +189,3 @@ var i = {
 }), { name: "WorkflowStore" }));
 //#endregion
 export { a as useWorkflowStore };
-
-//# sourceMappingURL=workflowStore.js.map

package/dist/bigconsole/types/index.d.ts

@@ -45,6 +45,9 @@ export interface BigConsoleRootProps extends MicrofrontendRootProps {
     /** Exact host routes consume their pathname before nested Routes run.
      * Render the corresponding native feed page within the usual providers. */
     routePage?: 'workflow-feeds' | 'workflow-detail';
+    /** Mount only authenticated dashboard discovery, viewing and authoring routes.
+     * This mode does not initialize the global FluidGrids SDK client. */
+    dashboardOnly?: boolean;
     /**
      * API Gateway URL (used when connecting via gateway in workspaces-app)
      * Will append /workspaces/graphql to this URL
@@ -65,6 +68,13 @@ export interface BigConsoleRootProps extends MicrofrontendRootProps {
      * for workspace-scoped operations.
      */
     workspaceToken?: string;
+    /**
+     * Exact https origins that iframe widgets may embed, e.g.
+     * `['https://reports.example.com']`. When omitted or empty, any https origin
+     * other than the app's own can be embedded. Every embedded page runs with a
+     * fixed sandbox regardless of this list.
+     */
+    iframeAllowedOrigins?: readonly string[];
 }
 /**
  * BigConsole admin microfrontend root props.
@@ -894,7 +904,13 @@ export interface DataSinkQuota {
     alertThreshold: number;
     alertRecipients?: string[];
 }
-/** Complete DataSink entity */
+/**
+ * DataSink entity as held by the client.
+ *
+ * The payload is deliberately not part of this record: it is loaded on demand
+ * (GetDataSinkPayload) by the views that edit or compare it, and `sizeBytes` /
+ * `dataStats` describe it everywhere else.
+ */
 export interface DataSink {
     id: string;
     workspaceId: string;
@@ -906,7 +922,6 @@ export interface DataSink {
     fluidGridsWorkflowId: string | null;
     fluidGridsWorkflowExecutionId: string | null;
     config: Record<string, unknown> | null;
-    data: Record<string, unknown>;
     dataStats: DataSinkDataStats | null;
     lastRefreshedAt: string;
     lastRefreshedBy: string | null;
@@ -1374,4 +1389,3 @@ export interface BatchPositionUpdate {
     id: string;
     position: WidgetPositionInput;
 }
-//# sourceMappingURL=index.d.ts.map

package/dist/bigconsole/utils/alertRules.d.ts

@@ -37,4 +37,3 @@ export declare const ALERT_VALIDATION_MESSAGES: {
 export type AlertValidationCode = keyof typeof ALERT_VALIDATION_MESSAGES;
 export declare function validateAlertDraft(draft: AlertDraft, channels: AlertChannel[]): AlertValidationCode | null;
 export declare function alertDraftInput(draft: AlertDraft): DataSinkAlertInput;
-//# sourceMappingURL=alertRules.d.ts.map

package/dist/bigconsole/utils/alertRules.js

@@ -79,5 +79,3 @@ function o(e) {
 }
 //#endregion
 export { i as ALERT_VALIDATION_MESSAGES, r as alertDraft, o as alertDraftInput, a as validateAlertDraft };
-
-//# sourceMappingURL=alertRules.js.map

package/dist/bigconsole/utils/backendError.d.ts

@@ -1,4 +1,3 @@
 type TranslateFn = (key: string, fallback: string) => string;
 export declare function resolveBackendErrorMessage(t: TranslateFn, error: unknown): string;
 export {};
-//# sourceMappingURL=backendError.d.ts.map

package/dist/bigconsole/utils/createDialogParam.d.ts

@@ -23,4 +23,3 @@ export interface CreateParamState {
 export declare function resolveCreateParam(params: URLSearchParams, state: CreateParamState): CreateParamDecision;
 /** A copy of `params` without the create param (other params are preserved). */
 export declare function withoutCreateParam(params: URLSearchParams): URLSearchParams;
-//# sourceMappingURL=createDialogParam.d.ts.map

package/dist/bigconsole/utils/createDialogParam.js

@@ -10,5 +10,3 @@ function r(t) {
 }
 //#endregion
 export { n as resolveCreateParam, r as withoutCreateParam };
-
-//# sourceMappingURL=createDialogParam.js.map

package/dist/bigconsole/utils/csv.d.ts

@@ -25,4 +25,3 @@ export declare function inferCsvValue(raw: string): CsvValue;
  * @throws Error when the input is empty or has a header but no data rows.
  */
 export declare function parseCsv(text: string, options?: ParseCsvOptions): ParsedCsv;
-//# sourceMappingURL=csv.d.ts.map

package/dist/bigconsole/utils/csv.js

@@ -87,5 +87,3 @@ function a(e, a = {}) {
 }
 //#endregion
 export { a as parseCsv };
-
-//# sourceMappingURL=csv.js.map

package/dist/bigconsole/utils/dashboardTemplateContent.d.ts

@@ -7,4 +7,3 @@ export declare function withDashboardTemplateMetadata(content: DashboardTemplate
     description?: string;
     tags?: string[];
 }): DashboardTemplateContent;
-//# sourceMappingURL=dashboardTemplateContent.d.ts.map

package/dist/bigconsole/utils/dashboardTemplateContent.js

@@ -32,5 +32,3 @@ function n(t, n) {
 }
 //#endregion
 export { t as isInstallableDashboardTemplate, n as withDashboardTemplateMetadata };
-
-//# sourceMappingURL=dashboardTemplateContent.js.map

package/dist/bigconsole/utils/dataSinkPayload.d.ts

@@ -0,0 +1,48 @@
+/**
+ * DataSink payload helpers.
+ *
+ * DataSink records held by the client (store, list, detail and mutation
+ * responses) never carry the payload. Views that need it load it on demand
+ * through the dedicated payload query, and the edit form sends it back only
+ * when the user has actually changed it — an untouched editor must never
+ * rewrite the stored payload.
+ */
+/**
+ * Whether a sink holds a non-empty payload, judged from its size metadata so
+ * the payload itself never has to be fetched.
+ */
+export declare function hasDataSinkPayload(sink: {
+    sizeBytes?: number | null;
+}): boolean;
+/**
+ * Render a stored payload as the editor's JSON text.
+ *
+ * The result always parses as JSON: a string that is itself JSON text is
+ * pretty-printed as the value it encodes, and any other string is shown as a
+ * JSON string literal. A missing payload renders as an empty editor.
+ */
+export declare function formatPayloadForEditor(payload: unknown): string;
+export type PayloadEditorChange = {
+    status: 'unchanged';
+} | {
+    status: 'changed';
+    payload: unknown;
+} | {
+    status: 'invalid';
+};
+/**
+ * Decide what a save should do with the payload editor's contents.
+ *
+ * @param text     Current editor text.
+ * @param baseline The editor text the stored payload was loaded as, or `null`
+ *                 when the stored payload is unknown (not loaded, or could not
+ *                 be read).
+ *
+ * - Text equal to the baseline, or JSON with the same value, is unchanged —
+ *   reformatting alone never rewrites the payload.
+ * - Clearing the editor empties the payload (`{}`), but only when there was a
+ *   known payload to clear; an editor that was empty to begin with is left alone.
+ * - With an unknown baseline, any JSON the user enters replaces the payload.
+ * - Text that is not valid JSON is reported as invalid.
+ */
+export declare function diffPayloadEditor(text: string, baseline: string | null): PayloadEditorChange;

package/dist/bigconsole/utils/dataSinkPayload.js

@@ -0,0 +1,38 @@
+//#region src/bigconsole/utils/dataSinkPayload.ts
+var e = 2;
+function t(t) {
+	return typeof t.sizeBytes == "number" && t.sizeBytes > e;
+}
+function n(e) {
+	if (e == null) return "";
+	if (typeof e == "string") try {
+		return JSON.stringify(JSON.parse(e), null, 2);
+	} catch {
+		return JSON.stringify(e);
+	}
+	return JSON.stringify(e, null, 2) ?? "";
+}
+var r = { status: "unchanged" };
+function i(e, t) {
+	if (t !== null && e === t) return r;
+	let n = t !== null && t.trim() !== "";
+	if (e.trim() === "") return n ? {
+		status: "changed",
+		payload: {}
+	} : r;
+	let i;
+	try {
+		i = JSON.parse(e);
+	} catch {
+		return { status: "invalid" };
+	}
+	if (n) try {
+		if (JSON.stringify(JSON.parse(t)) === JSON.stringify(i)) return r;
+	} catch {}
+	return {
+		status: "changed",
+		payload: i
+	};
+}
+//#endregion
+export { i as diffPayloadEditor, n as formatPayloadForEditor, t as hasDataSinkPayload };

package/dist/bigconsole/utils/drilldownParams.d.ts

@@ -1,3 +1,2 @@
 /** Display only meaningful context; the original drilldown parameters remain unchanged. */
 export declare function getVisibleDrilldownParams(params: Record<string, unknown>): Array<[string, unknown]>;
-//# sourceMappingURL=drilldownParams.d.ts.map

package/dist/bigconsole/utils/drilldownParams.js

@@ -4,5 +4,3 @@ function e(e) {
 }
 //#endregion
 export { e as getVisibleDrilldownParams };
-
-//# sourceMappingURL=drilldownParams.js.map

package/dist/bigconsole/utils/format.d.ts

@@ -14,4 +14,3 @@
  * computed must not claim to be empty.
  */
 export declare function formatByteSize(bytes: number | null | undefined): string;
-//# sourceMappingURL=format.d.ts.map

package/dist/bigconsole/utils/format.js

@@ -14,5 +14,3 @@ function t(t) {
 }
 //#endregion
 export { t as formatByteSize };
-
-//# sourceMappingURL=format.js.map

package/dist/bigconsole/utils/index.d.ts

@@ -6,6 +6,7 @@
 export { SEMANTIC_COLORS, EVENT_STATUS_COLORS, COMPLEXITY_COLORS, ACTION_STYLE_COLORS, getCSSVariableValue, type SemanticColorKey, type EventStatusKey, type ComplexityKey, type ActionStyleKey, } from './semanticTokens';
 export { parseCsv, inferCsvValue, type CsvValue, type ParsedCsv, type ParseCsvOptions } from './csv';
 export { formatByteSize } from './format';
+export { toSafeHref, normalizeHttpsOrigin, resolveFrameSrc, appendPathSegment, currentAppOrigin, openExternalUrl, MAX_URL_LENGTH, type SafeHrefOptions, type FrameSrcContext, type FrameSrcRejection, type FrameSrcResult, } from './safeUrl';
+export { hasDataSinkPayload, formatPayloadForEditor, diffPayloadEditor, type PayloadEditorChange, } from './dataSinkPayload';
 export { mapToFederationWidgetType, mapFromFederationWidgetType, isFederationAccessible, normalizeWidgetTypeForApi, type FederationWidgetType, } from './widgetTypeMapping';
 export { findNextAvailablePosition, findPositionNextToWidget, calculatePositionFromDrop, getResponsiveCols, getResponsiveSpan, getResponsiveTier, adjustPositionsForCols, RESPONSIVE_BREAKPOINTS, RESPONSIVE_COLS, DEFAULT_GRID_CONFIG, type WidgetSize, type WidgetPosition, type GridConfig, type ResponsiveTier, } from './widgetPositioning';
-//# sourceMappingURL=index.d.ts.map

package/dist/bigconsole/utils/quota.d.ts

@@ -36,4 +36,3 @@ export declare function getBigConsoleQuotaDialogContent(kind: BigConsoleQuotaKin
     title: string;
     message: string;
 };
-//# sourceMappingURL=quota.d.ts.map

package/dist/bigconsole/utils/quota.js

@@ -110,5 +110,3 @@ function _(e) {
 }
 //#endregion
 export { r as BIGCONSOLE_BILLING_PATHS, t as BIGCONSOLE_QUOTA_EXHAUSTED_EVENT, p as createBigConsoleQuotaError, _ as getBigConsoleQuotaDialogContent, m as isBigConsoleQuotaError, g as reportBigConsoleQuotaError };
-
-//# sourceMappingURL=quota.js.map

package/dist/bigconsole/utils/safeUrl.d.ts

@@ -0,0 +1,79 @@
+/**
+ * URL policies for widget content.
+ *
+ * Widget configuration and parser output are data, so any URL taken from them
+ * is parsed with the WHATWG URL parser and checked against an explicit scheme
+ * allowlist before it reaches an `href`, `window.open` or an iframe `src`.
+ * Apart from {@link currentAppOrigin} and {@link openExternalUrl}, which read
+ * `window`, every helper here is pure so the rules can be unit-tested without a
+ * DOM.
+ */
+/** Upper bound on the length of a URL accepted from widget content. */
+export declare const MAX_URL_LENGTH = 2048;
+export interface SafeHrefOptions {
+    /** Also accept `mailto:` links. */
+    allowMailto?: boolean;
+    /** Also accept root-relative paths such as `/bigconsole/dashboards/1` (never `//host`). */
+    allowRootRelative?: boolean;
+    /** Also accept same-document fragment links such as `#summary`. */
+    allowFragment?: boolean;
+}
+/**
+ * Return a navigable href for `raw`, or `null` when it is not allowed.
+ *
+ * Absolute `http:` and `https:` URLs are always accepted (without embedded
+ * credentials) and returned in normalised form. `mailto:`, root-relative paths
+ * and fragments are accepted only when the matching option is set. Every other
+ * scheme, protocol-relative URLs and bare relative paths are rejected.
+ */
+export declare function toSafeHref(raw: unknown, options?: SafeHrefOptions): string | null;
+/**
+ * Validate an exact https origin such as `https://reports.example.com`.
+ *
+ * Returns the serialised origin, or `null` when the value is not an https URL
+ * or carries a path, query or fragment.
+ */
+export declare function normalizeHttpsOrigin(raw: unknown): string | null;
+export type FrameSrcRejection = 'missing' | 'invalid' | 'scheme' | 'credentials' | 'same-origin' | 'origin-not-allowed';
+export type FrameSrcResult = {
+    ok: true;
+    src: string;
+    origin: string;
+} | {
+    ok: false;
+    reason: FrameSrcRejection;
+};
+export interface FrameSrcContext {
+    /** Origin of the hosting app; frames on this origin are rejected. */
+    appOrigin?: string | null;
+    /**
+     * Exact https origins that may be framed. An empty or missing list allows
+     * any https origin other than the app's own. A non-empty list with no valid
+     * entry allows nothing.
+     */
+    allowedOrigins?: readonly string[] | null;
+}
+/**
+ * Decide whether `raw` may be used as an iframe `src`.
+ *
+ * Only absolute https URLs without credentials are accepted. The app's own
+ * origin is rejected, and when an allowlist is configured the URL's origin must
+ * match one of its entries exactly.
+ */
+export declare function resolveFrameSrc(raw: unknown, context?: FrameSrcContext): FrameSrcResult;
+/**
+ * Append one path segment (such as a dashboard id) to an in-app base path.
+ *
+ * The segment is percent-encoded, so it cannot add path separators, a query or
+ * a fragment. Empty, `.` and `..` segments are rejected with `null`.
+ */
+export declare function appendPathSegment(basePath: string, segment: unknown): string | null;
+/** The origin the app is served from, or `null` outside a browser. */
+export declare function currentAppOrigin(): string | null;
+/**
+ * Open `raw` in a new browsing context without an opener or referrer.
+ *
+ * Returns `false` (and opens nothing) when the URL is not allowed by
+ * {@link toSafeHref} with the given options.
+ */
+export declare function openExternalUrl(raw: unknown, options?: SafeHrefOptions): boolean;

package/dist/bigconsole/utils/safeUrl.js

@@ -0,0 +1,93 @@
+function e(e) {
+	for (let t = 0; t < e.length; t += 1) {
+		let n = e.charCodeAt(t);
+		if (n < 32 || n === 127) return !0;
+	}
+	return !1;
+}
+var t = "https://path-base.invalid";
+function n(t) {
+	if (typeof t != "string") return null;
+	let n = t.trim();
+	return !n || n.length > 2048 || e(n) ? null : n;
+}
+function r(e) {
+	try {
+		return new URL(e);
+	} catch {
+		return null;
+	}
+}
+function i(e, i = {}) {
+	let a = n(e);
+	if (!a) return null;
+	if (a.startsWith("#")) return i.allowFragment ? a : null;
+	if (a.startsWith("/")) {
+		if (!i.allowRootRelative) return null;
+		let e;
+		try {
+			e = new URL(a, t);
+		} catch {
+			return null;
+		}
+		return e.origin === t ? `${e.pathname}${e.search}${e.hash}` : null;
+	}
+	let o = r(a);
+	return o ? o.protocol === "http:" || o.protocol === "https:" ? o.username || o.password ? null : o.href : o.protocol === "mailto:" && i.allowMailto ? o.href : null : null;
+}
+function a(e) {
+	if (typeof e != "string") return null;
+	let t = e.trim();
+	if (!t) return null;
+	let n = r(t);
+	return !n || n.protocol !== "https:" || n.pathname !== "" && n.pathname !== "/" || n.search || n.hash ? null : n.origin;
+}
+function o(e, t = {}) {
+	if (typeof e != "string" || e.trim() === "") return {
+		ok: !1,
+		reason: "missing"
+	};
+	let i = n(e);
+	if (!i) return {
+		ok: !1,
+		reason: "invalid"
+	};
+	let o = r(i);
+	if (!o) return {
+		ok: !1,
+		reason: "invalid"
+	};
+	if (o.protocol !== "https:") return {
+		ok: !1,
+		reason: "scheme"
+	};
+	if (o.username || o.password) return {
+		ok: !1,
+		reason: "credentials"
+	};
+	if (t.appOrigin && o.origin === t.appOrigin) return {
+		ok: !1,
+		reason: "same-origin"
+	};
+	let s = t.allowedOrigins ?? [];
+	return s.length > 0 && !new Set(s.map((e) => a(e)).filter((e) => e !== null)).has(o.origin) ? {
+		ok: !1,
+		reason: "origin-not-allowed"
+	} : {
+		ok: !0,
+		src: o.href,
+		origin: o.origin
+	};
+}
+function s(e, t) {
+	return typeof t != "string" || t === "" || t === "." || t === ".." ? null : `${e.endsWith("/") ? e.slice(0, -1) : e}/${encodeURIComponent(t)}`;
+}
+function c() {
+	return typeof window > "u" || !window.location ? null : window.location.origin;
+}
+function l(e, t = {}) {
+	let n = i(e, t);
+	return !n || typeof window > "u" ? !1 : (window.open(n, "_blank", "noopener,noreferrer"), !0);
+}
+//#endregion
+export { s as appendPathSegment, c as currentAppOrigin, a as normalizeHttpsOrigin, l as openExternalUrl, o as resolveFrameSrc, i as toSafeHref };

package/dist/bigconsole/utils/sanitizeHtml.d.ts

@@ -0,0 +1,16 @@
+import { WindowLike } from 'dompurify';
+
+export type HtmlSanitizer = (dirty: string) => string;
+/** Escape text so it renders literally when assigned as HTML. */
+export declare function escapeHtml(input: string): string;
+/**
+ * Build a sanitiser bound to `win`. A private DOMPurify instance is created so
+ * the hooks and configuration never leak into other users of DOMPurify on the
+ * page. Without a usable window the returned sanitiser escapes its input.
+ */
+export declare function createWidgetHtmlSanitizer(win?: WindowLike): HtmlSanitizer;
+/**
+ * Sanitise widget HTML for assignment via `dangerouslySetInnerHTML` or
+ * `innerHTML`. Outside a browser the input is returned escaped.
+ */
+export declare function sanitizeWidgetHtml(dirty: string): string;

package/dist/bigconsole/utils/sanitizeHtml.js

@@ -0,0 +1,67 @@
+import { purify as e } from "../../node_modules/dompurify/dist/purify.es.js";
+//#region src/bigconsole/utils/sanitizeHtml.ts
+var t = "user-content-", n = [
+	"script",
+	"style",
+	"link",
+	"meta",
+	"base",
+	"noscript",
+	"template",
+	"iframe",
+	"frame",
+	"frameset",
+	"object",
+	"embed",
+	"form",
+	"input",
+	"button",
+	"select",
+	"textarea",
+	"option",
+	"dialog"
+], r = [
+	"style",
+	"srcset",
+	"action",
+	"formaction",
+	"ping",
+	"background"
+], i = /^(?:(?:https?|mailto):|#|\/(?![/\\]))/i, a = /^data:image\/(?:png|gif|jpe?g|webp|avif|bmp);base64,[a-z0-9+/]+=*$/i, o = {
+	USE_PROFILES: { html: !0 },
+	FORBID_TAGS: n,
+	FORBID_ATTR: r,
+	ALLOW_DATA_ATTR: !1,
+	ALLOW_UNKNOWN_PROTOCOLS: !1,
+	ALLOWED_URI_REGEXP: i,
+	SANITIZE_DOM: !0,
+	SANITIZE_NAMED_PROPS: !0,
+	WHOLE_DOCUMENT: !1
+};
+function s(e) {
+	return e.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\"", "&quot;").replaceAll("'", "&#39;");
+}
+function c(e) {
+	return /^(?:https?|mailto):/i.test(e);
+}
+function l(e) {
+	let n = e.getAttribute("src");
+	if (n !== null && /^\s*data:/i.test(n) && (e.nodeName !== "IMG" || !a.test(n.trim())) && e.removeAttribute("src"), e.nodeName !== "A") return;
+	let r = e.getAttribute("href");
+	if (r === null) {
+		e.removeAttribute("target");
+		return;
+	}
+	r.startsWith("#") && r.length > 1 && e.setAttribute("href", `#${t}${r.slice(1)}`), c(r) ? e.setAttribute("target", "_blank") : e.removeAttribute("target"), e.setAttribute("rel", "noopener noreferrer");
+}
+function u(t) {
+	if (!t) return s;
+	let n = e(t);
+	return n.isSupported ? (n.setConfig(o), n.addHook("afterSanitizeAttributes", l), (e) => n.sanitize(e)) : s;
+}
+var d = null;
+function f(e) {
+	return typeof window > "u" ? s(e) : (d ??= u(window), d(e));
+}
+//#endregion
+export { s as escapeHtml, f as sanitizeWidgetHtml };

package/dist/bigconsole/utils/semanticTokens.d.ts

@@ -85,4 +85,3 @@ export type SemanticColorKey = keyof typeof SEMANTIC_COLORS;
 export type EventStatusKey = keyof typeof EVENT_STATUS_COLORS;
 export type ComplexityKey = keyof typeof COMPLEXITY_COLORS;
 export type ActionStyleKey = keyof typeof ACTION_STYLE_COLORS;
-//# sourceMappingURL=semanticTokens.d.ts.map