@burdenoff/microfe-bigconsole 2026.1006.1 → 2026.1007.11

package/dist/bigconsole/utils/dataSinkPayload.d.ts

@@ -1,48 +0,0 @@
-/**
- * DataSink payload helpers.
- *
- * DataSink records held by the client (store, list, detail and mutation
- * responses) never carry the payload. Views that need it load it on demand
- * through the dedicated payload query, and the edit form sends it back only
- * when the user has actually changed it — an untouched editor must never
- * rewrite the stored payload.
- */
-/**
- * Whether a sink holds a non-empty payload, judged from its size metadata so
- * the payload itself never has to be fetched.
- */
-export declare function hasDataSinkPayload(sink: {
-    sizeBytes?: number | null;
-}): boolean;
-/**
- * Render a stored payload as the editor's JSON text.
- *
- * The result always parses as JSON: a string that is itself JSON text is
- * pretty-printed as the value it encodes, and any other string is shown as a
- * JSON string literal. A missing payload renders as an empty editor.
- */
-export declare function formatPayloadForEditor(payload: unknown): string;
-export type PayloadEditorChange = {
-    status: 'unchanged';
-} | {
-    status: 'changed';
-    payload: unknown;
-} | {
-    status: 'invalid';
-};
-/**
- * Decide what a save should do with the payload editor's contents.
- *
- * @param text     Current editor text.
- * @param baseline The editor text the stored payload was loaded as, or `null`
- *                 when the stored payload is unknown (not loaded, or could not
- *                 be read).
- *
- * - Text equal to the baseline, or JSON with the same value, is unchanged —
- *   reformatting alone never rewrites the payload.
- * - Clearing the editor empties the payload (`{}`), but only when there was a
- *   known payload to clear; an editor that was empty to begin with is left alone.
- * - With an unknown baseline, any JSON the user enters replaces the payload.
- * - Text that is not valid JSON is reported as invalid.
- */
-export declare function diffPayloadEditor(text: string, baseline: string | null): PayloadEditorChange;

package/dist/bigconsole/utils/dataSinkPayload.js

@@ -1,38 +0,0 @@
-//#region src/bigconsole/utils/dataSinkPayload.ts
-var e = 2;
-function t(t) {
-	return typeof t.sizeBytes == "number" && t.sizeBytes > e;
-}
-function n(e) {
-	if (e == null) return "";
-	if (typeof e == "string") try {
-		return JSON.stringify(JSON.parse(e), null, 2);
-	} catch {
-		return JSON.stringify(e);
-	}
-	return JSON.stringify(e, null, 2) ?? "";
-}
-var r = { status: "unchanged" };
-function i(e, t) {
-	if (t !== null && e === t) return r;
-	let n = t !== null && t.trim() !== "";
-	if (e.trim() === "") return n ? {
-		status: "changed",
-		payload: {}
-	} : r;
-	let i;
-	try {
-		i = JSON.parse(e);
-	} catch {
-		return { status: "invalid" };
-	}
-	if (n) try {
-		if (JSON.stringify(JSON.parse(t)) === JSON.stringify(i)) return r;
-	} catch {}
-	return {
-		status: "changed",
-		payload: i
-	};
-}
-//#endregion
-export { i as diffPayloadEditor, n as formatPayloadForEditor, t as hasDataSinkPayload };

package/dist/bigconsole/utils/safeUrl.d.ts

@@ -1,79 +0,0 @@
-/**
- * URL policies for widget content.
- *
- * Widget configuration and parser output are data, so any URL taken from them
- * is parsed with the WHATWG URL parser and checked against an explicit scheme
- * allowlist before it reaches an `href`, `window.open` or an iframe `src`.
- * Apart from {@link currentAppOrigin} and {@link openExternalUrl}, which read
- * `window`, every helper here is pure so the rules can be unit-tested without a
- * DOM.
- */
-/** Upper bound on the length of a URL accepted from widget content. */
-export declare const MAX_URL_LENGTH = 2048;
-export interface SafeHrefOptions {
-    /** Also accept `mailto:` links. */
-    allowMailto?: boolean;
-    /** Also accept root-relative paths such as `/bigconsole/dashboards/1` (never `//host`). */
-    allowRootRelative?: boolean;
-    /** Also accept same-document fragment links such as `#summary`. */
-    allowFragment?: boolean;
-}
-/**
- * Return a navigable href for `raw`, or `null` when it is not allowed.
- *
- * Absolute `http:` and `https:` URLs are always accepted (without embedded
- * credentials) and returned in normalised form. `mailto:`, root-relative paths
- * and fragments are accepted only when the matching option is set. Every other
- * scheme, protocol-relative URLs and bare relative paths are rejected.
- */
-export declare function toSafeHref(raw: unknown, options?: SafeHrefOptions): string | null;
-/**
- * Validate an exact https origin such as `https://reports.example.com`.
- *
- * Returns the serialised origin, or `null` when the value is not an https URL
- * or carries a path, query or fragment.
- */
-export declare function normalizeHttpsOrigin(raw: unknown): string | null;
-export type FrameSrcRejection = 'missing' | 'invalid' | 'scheme' | 'credentials' | 'same-origin' | 'origin-not-allowed';
-export type FrameSrcResult = {
-    ok: true;
-    src: string;
-    origin: string;
-} | {
-    ok: false;
-    reason: FrameSrcRejection;
-};
-export interface FrameSrcContext {
-    /** Origin of the hosting app; frames on this origin are rejected. */
-    appOrigin?: string | null;
-    /**
-     * Exact https origins that may be framed. An empty or missing list allows
-     * any https origin other than the app's own. A non-empty list with no valid
-     * entry allows nothing.
-     */
-    allowedOrigins?: readonly string[] | null;
-}
-/**
- * Decide whether `raw` may be used as an iframe `src`.
- *
- * Only absolute https URLs without credentials are accepted. The app's own
- * origin is rejected, and when an allowlist is configured the URL's origin must
- * match one of its entries exactly.
- */
-export declare function resolveFrameSrc(raw: unknown, context?: FrameSrcContext): FrameSrcResult;
-/**
- * Append one path segment (such as a dashboard id) to an in-app base path.
- *
- * The segment is percent-encoded, so it cannot add path separators, a query or
- * a fragment. Empty, `.` and `..` segments are rejected with `null`.
- */
-export declare function appendPathSegment(basePath: string, segment: unknown): string | null;
-/** The origin the app is served from, or `null` outside a browser. */
-export declare function currentAppOrigin(): string | null;
-/**
- * Open `raw` in a new browsing context without an opener or referrer.
- *
- * Returns `false` (and opens nothing) when the URL is not allowed by
- * {@link toSafeHref} with the given options.
- */
-export declare function openExternalUrl(raw: unknown, options?: SafeHrefOptions): boolean;

package/dist/bigconsole/utils/safeUrl.js

@@ -1,93 +0,0 @@
-function e(e) {
-	for (let t = 0; t < e.length; t += 1) {
-		let n = e.charCodeAt(t);
-		if (n < 32 || n === 127) return !0;
-	}
-	return !1;
-}
-var t = "https://path-base.invalid";
-function n(t) {
-	if (typeof t != "string") return null;
-	let n = t.trim();
-	return !n || n.length > 2048 || e(n) ? null : n;
-}
-function r(e) {
-	try {
-		return new URL(e);
-	} catch {
-		return null;
-	}
-}
-function i(e, i = {}) {
-	let a = n(e);
-	if (!a) return null;
-	if (a.startsWith("#")) return i.allowFragment ? a : null;
-	if (a.startsWith("/")) {
-		if (!i.allowRootRelative) return null;
-		let e;
-		try {
-			e = new URL(a, t);
-		} catch {
-			return null;
-		}
-		return e.origin === t ? `${e.pathname}${e.search}${e.hash}` : null;
-	}
-	let o = r(a);
-	return o ? o.protocol === "http:" || o.protocol === "https:" ? o.username || o.password ? null : o.href : o.protocol === "mailto:" && i.allowMailto ? o.href : null : null;
-}
-function a(e) {
-	if (typeof e != "string") return null;
-	let t = e.trim();
-	if (!t) return null;
-	let n = r(t);
-	return !n || n.protocol !== "https:" || n.pathname !== "" && n.pathname !== "/" || n.search || n.hash ? null : n.origin;
-}
-function o(e, t = {}) {
-	if (typeof e != "string" || e.trim() === "") return {
-		ok: !1,
-		reason: "missing"
-	};
-	let i = n(e);
-	if (!i) return {
-		ok: !1,
-		reason: "invalid"
-	};
-	let o = r(i);
-	if (!o) return {
-		ok: !1,
-		reason: "invalid"
-	};
-	if (o.protocol !== "https:") return {
-		ok: !1,
-		reason: "scheme"
-	};
-	if (o.username || o.password) return {
-		ok: !1,
-		reason: "credentials"
-	};
-	if (t.appOrigin && o.origin === t.appOrigin) return {
-		ok: !1,
-		reason: "same-origin"
-	};
-	let s = t.allowedOrigins ?? [];
-	return s.length > 0 && !new Set(s.map((e) => a(e)).filter((e) => e !== null)).has(o.origin) ? {
-		ok: !1,
-		reason: "origin-not-allowed"
-	} : {
-		ok: !0,
-		src: o.href,
-		origin: o.origin
-	};
-}
-function s(e, t) {
-	return typeof t != "string" || t === "" || t === "." || t === ".." ? null : `${e.endsWith("/") ? e.slice(0, -1) : e}/${encodeURIComponent(t)}`;
-}
-function c() {
-	return typeof window > "u" || !window.location ? null : window.location.origin;
-}
-function l(e, t = {}) {
-	let n = i(e, t);
-	return !n || typeof window > "u" ? !1 : (window.open(n, "_blank", "noopener,noreferrer"), !0);
-}
-//#endregion
-export { s as appendPathSegment, c as currentAppOrigin, a as normalizeHttpsOrigin, l as openExternalUrl, o as resolveFrameSrc, i as toSafeHref };

package/dist/bigconsole/utils/sanitizeHtml.d.ts

@@ -1,16 +0,0 @@
-import { WindowLike } from 'dompurify';
-
-export type HtmlSanitizer = (dirty: string) => string;
-/** Escape text so it renders literally when assigned as HTML. */
-export declare function escapeHtml(input: string): string;
-/**
- * Build a sanitiser bound to `win`. A private DOMPurify instance is created so
- * the hooks and configuration never leak into other users of DOMPurify on the
- * page. Without a usable window the returned sanitiser escapes its input.
- */
-export declare function createWidgetHtmlSanitizer(win?: WindowLike): HtmlSanitizer;
-/**
- * Sanitise widget HTML for assignment via `dangerouslySetInnerHTML` or
- * `innerHTML`. Outside a browser the input is returned escaped.
- */
-export declare function sanitizeWidgetHtml(dirty: string): string;

package/dist/bigconsole/utils/sanitizeHtml.js

@@ -1,67 +0,0 @@
-import { purify as e } from "../../node_modules/dompurify/dist/purify.es.js";
-//#region src/bigconsole/utils/sanitizeHtml.ts
-var t = "user-content-", n = [
-	"script",
-	"style",
-	"link",
-	"meta",
-	"base",
-	"noscript",
-	"template",
-	"iframe",
-	"frame",
-	"frameset",
-	"object",
-	"embed",
-	"form",
-	"input",
-	"button",
-	"select",
-	"textarea",
-	"option",
-	"dialog"
-], r = [
-	"style",
-	"srcset",
-	"action",
-	"formaction",
-	"ping",
-	"background"
-], i = /^(?:(?:https?|mailto):|#|\/(?![/\\]))/i, a = /^data:image\/(?:png|gif|jpe?g|webp|avif|bmp);base64,[a-z0-9+/]+=*$/i, o = {
-	USE_PROFILES: { html: !0 },
-	FORBID_TAGS: n,
-	FORBID_ATTR: r,
-	ALLOW_DATA_ATTR: !1,
-	ALLOW_UNKNOWN_PROTOCOLS: !1,
-	ALLOWED_URI_REGEXP: i,
-	SANITIZE_DOM: !0,
-	SANITIZE_NAMED_PROPS: !0,
-	WHOLE_DOCUMENT: !1
-};
-function s(e) {
-	return e.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\"", "&quot;").replaceAll("'", "&#39;");
-}
-function c(e) {
-	return /^(?:https?|mailto):/i.test(e);
-}
-function l(e) {
-	let n = e.getAttribute("src");
-	if (n !== null && /^\s*data:/i.test(n) && (e.nodeName !== "IMG" || !a.test(n.trim())) && e.removeAttribute("src"), e.nodeName !== "A") return;
-	let r = e.getAttribute("href");
-	if (r === null) {
-		e.removeAttribute("target");
-		return;
-	}
-	r.startsWith("#") && r.length > 1 && e.setAttribute("href", `#${t}${r.slice(1)}`), c(r) ? e.setAttribute("target", "_blank") : e.removeAttribute("target"), e.setAttribute("rel", "noopener noreferrer");
-}
-function u(t) {
-	if (!t) return s;
-	let n = e(t);
-	return n.isSupported ? (n.setConfig(o), n.addHook("afterSanitizeAttributes", l), (e) => n.sanitize(e)) : s;
-}
-var d = null;
-function f(e) {
-	return typeof window > "u" ? s(e) : (d ??= u(window), d(e));
-}
-//#endregion
-export { s as escapeHtml, f as sanitizeWidgetHtml };