@burdenoff/microfe-bigconsole 2026.1010.12 → 2026.1012.1

package/dist/bigconsole/renderers/adapters/CustomRenderer.js

@@ -1,6 +1,6 @@
 import { memo as e, useMemo as t } from "react";
-import { useI18n as n } from "@burdenoff/fe-libs/shared/providers/shell/I18nProvider";
-import { jsx as r, jsxs as i } from "react/jsx-runtime";
+import { jsx as n, jsxs as r } from "react/jsx-runtime";
+import { useI18n as i } from "@burdenoff/fe-libs/shared/providers/shell/I18nProvider";
 //#region src/bigconsole/renderers/adapters/CustomRenderer.tsx
 var a = /* @__PURE__ */ new Map();
 function o(e, t) {
@@ -13,77 +13,77 @@ function c() {
 	return Array.from(a.keys());
 }
 o("SimpleText", ({ data: e, props: t }) => {
-	let { t: i } = n(), a = e.text || t?.text, o = t?.align || "left";
-	return a ? /* @__PURE__ */ r("div", {
+	let { t: r } = i(), a = e.text || t?.text, o = t?.align || "left";
+	return a ? /* @__PURE__ */ n("div", {
 		className: `p-4 text-${o}`,
-		children: /* @__PURE__ */ r("p", {
+		children: /* @__PURE__ */ n("p", {
 			className: "text-primary",
 			children: a
 		})
-	}) : /* @__PURE__ */ r("div", {
+	}) : /* @__PURE__ */ n("div", {
 		className: "flex items-center justify-center h-full p-4 text-secondary",
-		children: /* @__PURE__ */ r("p", {
+		children: /* @__PURE__ */ n("p", {
 			className: "text-sm",
-			children: i("bigconsole.widget.renderer.custom.noData", "No data available")
+			children: r("bigconsole.widget.renderer.custom.noData", "No data available")
 		})
 	});
 }), o("Counter", ({ data: e, props: t }) => {
-	let { t: a } = n(), o = e.value ?? t?.value, s = e.label || t?.label, c = t?.format || "number";
-	if (o == null) return /* @__PURE__ */ r("div", {
+	let { t: a } = i(), o = e.value ?? t?.value, s = e.label || t?.label, c = t?.format || "number";
+	if (o == null) return /* @__PURE__ */ n("div", {
 		className: "flex flex-col items-center justify-center h-full p-4 text-secondary",
-		children: /* @__PURE__ */ r("p", {
+		children: /* @__PURE__ */ n("p", {
 			className: "text-sm",
 			children: a("bigconsole.widget.renderer.custom.noData", "No data available")
 		})
 	});
 	let l = o;
-	return /* @__PURE__ */ i("div", {
+	return /* @__PURE__ */ r("div", {
 		className: "flex flex-col items-center justify-center h-full p-4 animate-in fade-in duration-200",
-		children: [/* @__PURE__ */ r("span", {
+		children: [/* @__PURE__ */ n("span", {
 			className: "text-3xl font-bold text-primary",
 			children: c === "currency" ? new Intl.NumberFormat("en-US", {
 				style: "currency",
 				currency: "USD"
 			}).format(l) : c === "percent" ? `${(l * 100).toFixed(1)}%` : new Intl.NumberFormat().format(l)
-		}), s && /* @__PURE__ */ r("span", {
+		}), s && /* @__PURE__ */ n("span", {
 			className: "text-sm text-secondary mt-1",
 			children: s
 		})]
 	});
 }), o("Card", ({ data: e, props: t, onAction: a }) => {
-	let { t: o } = n(), s = e.title || t?.title, c = e.description || t?.description || "";
-	if (!s && !c) return /* @__PURE__ */ r("div", {
+	let { t: o } = i(), s = e.title || t?.title, c = e.description || t?.description || "";
+	if (!s && !c) return /* @__PURE__ */ n("div", {
 		className: "flex items-center justify-center h-full p-4 text-secondary",
-		children: /* @__PURE__ */ r("p", {
+		children: /* @__PURE__ */ n("p", {
 			className: "text-sm",
 			children: o("bigconsole.widget.renderer.custom.noData", "No data available")
 		})
 	});
 	let l = e.image || t?.image, u = t?.actionLabel || o("bigconsole.widget.renderer.custom.viewDetails", "View Details"), d = t?.showAction !== !1;
-	return /* @__PURE__ */ i("div", {
+	return /* @__PURE__ */ r("div", {
 		className: "flex flex-col h-full bg-surface rounded-lg overflow-hidden animate-in fade-in duration-200",
 		children: [
-			l && /* @__PURE__ */ r("div", {
+			l && /* @__PURE__ */ n("div", {
 				className: "aspect-video bg-bg-sunken",
-				children: /* @__PURE__ */ r("img", {
+				children: /* @__PURE__ */ n("img", {
 					src: l,
 					alt: "",
 					className: "w-full h-full object-cover"
 				})
 			}),
-			/* @__PURE__ */ i("div", {
+			/* @__PURE__ */ r("div", {
 				className: "flex-1 p-4",
-				children: [s && /* @__PURE__ */ r("h3", {
+				children: [s && /* @__PURE__ */ n("h3", {
 					className: "text-lg font-semibold text-primary",
 					children: s
-				}), c && /* @__PURE__ */ r("p", {
+				}), c && /* @__PURE__ */ n("p", {
 					className: "text-sm text-secondary mt-1",
 					children: c
 				})]
 			}),
-			d && /* @__PURE__ */ r("div", {
+			d && /* @__PURE__ */ n("div", {
 				className: "p-4 pt-0",
-				children: /* @__PURE__ */ r("button", {
+				children: /* @__PURE__ */ n("button", {
 					type: "button",
 					onClick: () => a?.("click", { title: s }),
 					className: "w-full px-4 py-2 text-sm font-medium text-white bg-action-primary hover:bg-action-primary/90 rounded-md transition-colors",
@@ -94,25 +94,25 @@ o("SimpleText", ({ data: e, props: t }) => {
 	});
 });
 var l = ({ componentName: e }) => {
-	let { t } = n();
-	return /* @__PURE__ */ r("div", {
+	let { t } = i();
+	return /* @__PURE__ */ n("div", {
 		className: "flex flex-col items-center justify-center h-full p-4 text-secondary animate-in fade-in duration-200",
-		children: /* @__PURE__ */ i("div", {
+		children: /* @__PURE__ */ r("div", {
 			className: "text-center",
 			children: [
-				/* @__PURE__ */ r("p", {
+				/* @__PURE__ */ n("p", {
 					className: "font-medium",
 					children: t("bigconsole.widget.renderer.custom.componentNotFound", "Component Not Found")
 				}),
-				/* @__PURE__ */ r("p", {
+				/* @__PURE__ */ n("p", {
 					className: "text-sm mt-1",
 					children: t("bigconsole.widget.renderer.custom.componentNotRegistered", "Component \"{{name}}\" is not registered", { name: e ?? "" })
 				}),
-				/* @__PURE__ */ i("div", {
+				/* @__PURE__ */ r("div", {
 					className: "mt-4 text-xs",
-					children: [/* @__PURE__ */ r("p", { children: t("bigconsole.widget.renderer.custom.availableComponents", "Available components:") }), /* @__PURE__ */ r("ul", {
+					children: [/* @__PURE__ */ n("p", { children: t("bigconsole.widget.renderer.custom.availableComponents", "Available components:") }), /* @__PURE__ */ n("ul", {
 						className: "mt-1",
-						children: c().map((e) => /* @__PURE__ */ r("li", {
+						children: c().map((e) => /* @__PURE__ */ n("li", {
 							className: "text-link",
 							children: e
 						}, e))
@@ -122,44 +122,44 @@ var l = ({ componentName: e }) => {
 		})
 	});
 }, u = e(function({ widget: e, data: a, template: o, isLoading: c, error: u, onDrilldown: d, onAction: f }) {
-	let { t: p } = n(), m = t(() => {
+	let { t: p } = i(), m = t(() => {
 		if (o && typeof o == "object" && "componentName" in o) return o.componentName;
 		let t = e.config;
 		return t?.componentName || t?.componentId || "";
 	}, [o, e.config]), h = t(() => o && typeof o == "object" && "props" in o ? o.props : {}, [o]), g = t(() => m ? s(m) : null, [m]);
-	return c ? /* @__PURE__ */ r("div", {
+	return c ? /* @__PURE__ */ n("div", {
 		className: "flex items-center justify-center h-full p-4 animate-in fade-in duration-200",
-		children: /* @__PURE__ */ i("div", {
+		children: /* @__PURE__ */ r("div", {
 			className: "animate-pulse space-y-2 w-full",
-			children: [/* @__PURE__ */ r("div", { className: "h-4 bg-bg-sunken rounded w-3/4" }), /* @__PURE__ */ r("div", { className: "h-4 bg-bg-sunken rounded w-1/2" })]
+			children: [/* @__PURE__ */ n("div", { className: "h-4 bg-bg-sunken rounded w-3/4" }), /* @__PURE__ */ n("div", { className: "h-4 bg-bg-sunken rounded w-1/2" })]
 		})
-	}) : u ? /* @__PURE__ */ r("div", {
+	}) : u ? /* @__PURE__ */ n("div", {
 		className: "flex items-center justify-center h-full p-4 text-red-600 dark:text-red-400",
-		children: /* @__PURE__ */ i("div", {
+		children: /* @__PURE__ */ r("div", {
 			className: "text-center",
-			children: [/* @__PURE__ */ r("p", {
+			children: [/* @__PURE__ */ n("p", {
 				className: "font-medium",
 				children: p("bigconsole.widget.renderer.custom.errorRendering", "Error rendering component")
-			}), /* @__PURE__ */ r("p", {
+			}), /* @__PURE__ */ n("p", {
 				className: "text-sm mt-1",
 				children: u
 			})]
 		})
-	}) : m ? g ? /* @__PURE__ */ r(g, {
+	}) : m ? g ? /* @__PURE__ */ n(g, {
 		widget: e,
 		data: a,
 		template: o,
 		props: h,
 		onAction: f,
 		onDrilldown: d
-	}) : /* @__PURE__ */ r(l, { componentName: m }) : /* @__PURE__ */ r("div", {
+	}) : /* @__PURE__ */ n(l, { componentName: m }) : /* @__PURE__ */ n("div", {
 		className: "flex items-center justify-center h-full p-4 text-secondary animate-in fade-in duration-200",
-		children: /* @__PURE__ */ i("div", {
+		children: /* @__PURE__ */ r("div", {
 			className: "text-center",
-			children: [/* @__PURE__ */ r("p", {
+			children: [/* @__PURE__ */ n("p", {
 				className: "font-medium",
 				children: p("bigconsole.widget.renderer.custom.noComponentSpecified", "No Component Specified")
-			}), /* @__PURE__ */ r("p", {
+			}), /* @__PURE__ */ n("p", {
 				className: "text-sm mt-1",
 				children: p("bigconsole.widget.renderer.custom.setComponentName", "Set componentName in template or widget config")
 			})]

package/dist/bigconsole/renderers/adapters/adaptiveCardContent.d.ts

@@ -0,0 +1,29 @@
+import { SafeHrefOptions } from '../../utils/safeUrl';
+import { HtmlSanitizer } from '../../utils/sanitizeHtml';
+
+/** Links and URL actions in cards: https/http and mailto. */
+export declare const CARD_LINK_POLICY: SafeHrefOptions;
+/** CSS classes for markdown output; styled by the renderer's stylesheet. */
+export declare const CARD_MARKDOWN_CODE_CLASS = "ac-md-code";
+export declare const CARD_MARKDOWN_LINK_CLASS = "ac-md-link";
+/**
+ * Convert the markdown subset supported in card text (`**bold**`, `*italic*`,
+ * `` `code` ``, `[label](url)` and line breaks) to sanitised HTML.
+ *
+ * Code spans and links are swapped for placeholders before emphasis is applied
+ * so their contents are never reformatted. Links whose destination fails
+ * {@link CARD_LINK_POLICY} are rendered as their label only.
+ */
+export declare function processCardMarkdown(text: string, sanitize?: HtmlSanitizer): string;
+/**
+ * Return a copy of a card payload without `Action.OpenUrl` actions whose `url`
+ * fails {@link CARD_LINK_POLICY}. Such actions are dropped from action lists
+ * and removed where they are used as a `selectAction`; the surrounding content
+ * stays. Other values are copied unchanged.
+ */
+export declare function removeUnsafeOpenUrlActions(payload: unknown): unknown;
+/**
+ * Remove link targets outside {@link CARD_LINK_POLICY} from a rendered card
+ * and make every remaining link open without an opener or referrer.
+ */
+export declare function scrubRenderedLinks(root: ParentNode): void;

package/dist/bigconsole/renderers/adapters/adaptiveCardContent.js

@@ -0,0 +1,51 @@
+import { toSafeHref as e } from "../../utils/safeUrl.js";
+import { escapeHtml as t, sanitizeWidgetHtml as n } from "../../utils/sanitizeHtml.js";
+//#region src/bigconsole/renderers/adapters/adaptiveCardContent.ts
+var r = { allowMailto: !0 }, i = "ac-md-code", a = "ac-md-link", o = "", s = "", c = RegExp(`[${o}${s}]`, "g");
+function l(e) {
+	return e.replaceAll("&#39;", "'").replaceAll("&quot;", "\"").replaceAll("&gt;", ">").replaceAll("&lt;", "<").replaceAll("&amp;", "&");
+}
+function u(e) {
+	return e.replace(/\*\*(.+?)\*\*/g, "<strong>$1</strong>").replace(/__(.+?)__/g, "<strong>$1</strong>").replace(/\*(.+?)\*/g, "<em>$1</em>").replace(/_(.+?)_/g, "<em>$1</em>");
+}
+function d(d, f = n) {
+	if (!d) return "";
+	let p = [], m = (e) => (p.push(e), `${o}${p.length - 1}${s}`), h = t(d.replace(c, ""));
+	h = h.replace(/`(.+?)`/g, (e, t) => m(`<code class="${i}">${t}</code>`)), h = h.replace(/\[(.+?)\]\((.+?)\)/g, (n, i, o) => {
+		let s = e(l(o), r), c = u(i);
+		return m(s ? `<a href="${t(s)}" class="${a}">${c}</a>` : c);
+	}), h = u(h).replace(/\n/g, "<br/>");
+	let g = (e) => e.replace(RegExp(`${o}(\\d+)${s}`, "g"), (e, t) => g(p[Number(t)] ?? ""));
+	return f(g(h));
+}
+function f(e) {
+	return typeof e == "object" && !!e && !Array.isArray(e);
+}
+function p(t) {
+	return !f(t) || typeof t.type != "string" || t.type.toLowerCase() !== "action.openurl" ? !1 : e(t.url, r) === null;
+}
+function m(e) {
+	let t = (e) => {
+		if (Array.isArray(e)) return e.filter((e) => !p(e)).map(t);
+		if (f(e)) {
+			let n = {};
+			for (let [r, i] of Object.entries(e)) p(i) || Object.defineProperty(n, r, {
+				value: t(i),
+				enumerable: !0,
+				writable: !0,
+				configurable: !0
+			});
+			return n;
+		}
+		return e;
+	};
+	return t(e);
+}
+function h(t) {
+	for (let n of Array.from(t.querySelectorAll("a, area"))) {
+		let t = n.getAttribute("href");
+		t !== null && e(t, r) === null && n.removeAttribute("href"), n.setAttribute("rel", "noopener noreferrer");
+	}
+}
+//#endregion
+export { r as CARD_LINK_POLICY, i as CARD_MARKDOWN_CODE_CLASS, a as CARD_MARKDOWN_LINK_CLASS, d as processCardMarkdown, m as removeUnsafeOpenUrlActions, h as scrubRenderedLinks };

package/dist/bigconsole/store/widgetStore.d.ts

@@ -20,18 +20,6 @@ interface WidgetState {
     clipboardWidgetId: string | null;
     clipboardAction: 'copy' | 'cut' | null;
     gridLayout: GridLayoutItem[];
-    /**
-     * Counts the placements a PERSON made: bumped by `updateWidgetPosition` and by
-     * nothing else. The canvas calls that action only when a drag or a resize ENDS
-     * (`DashboardCanvas.handleLayoutChange`), and the inspector's "Position & size"
-     * fields call it only on a typed change that actually moves the widget
-     * (`LayoutSection.commit`). Loading (`setWidgets`), creating (`addWidget`),
-     * saving (`updateWidget`) and deleting (`removeWidget`) leave it alone, so a
-     * reader can tell "the person moved something" from "the list was refreshed"
-     * without comparing positions (BOFF-8060, the dashboard leave guard).
-     * Never reset: a reader keeps the last value it saw across `reset()`.
-     */
-    layoutEditRevision: number;
     typeFilter: WidgetType | null;
     setWidgets: (widgets: Widget[]) => void;
     addWidget: (widget: Widget) => void;

package/dist/bigconsole/store/widgetStore.js

@@ -20,7 +20,6 @@ var i = {
 	typeFilter: null
 }, a = e()(t(n((e, t) => ({
 	...i,
-	layoutEditRevision: 0,
 	setWidgets: (t) => e({
 		widgets: new Map(t.map((e) => [e.id, e])),
 		gridLayout: t.map((e) => ({
@@ -156,8 +155,7 @@ var i = {
 				y: n.y,
 				w: n.width,
 				h: n.height
-			} : e),
-			layoutEditRevision: e.layoutEditRevision + 1
+			} : e)
 		};
 	}),
 	setGridLayout: (t) => e({ gridLayout: t }),

package/dist/bigconsole/types/index.d.ts

@@ -45,6 +45,9 @@ export interface BigConsoleRootProps extends MicrofrontendRootProps {
     /** Exact host routes consume their pathname before nested Routes run.
      * Render the corresponding native feed page within the usual providers. */
     routePage?: 'workflow-feeds' | 'workflow-detail';
+    /** Mount only authenticated dashboard discovery, viewing and authoring routes.
+     * This mode does not initialize the global FluidGrids SDK client. */
+    dashboardOnly?: boolean;
     /**
      * API Gateway URL (used when connecting via gateway in workspaces-app)
      * Will append /workspaces/graphql to this URL
@@ -65,6 +68,13 @@ export interface BigConsoleRootProps extends MicrofrontendRootProps {
      * for workspace-scoped operations.
      */
     workspaceToken?: string;
+    /**
+     * Exact https origins that iframe widgets may embed, e.g.
+     * `['https://reports.example.com']`. When omitted or empty, any https origin
+     * other than the app's own can be embedded. Every embedded page runs with a
+     * fixed sandbox regardless of this list.
+     */
+    iframeAllowedOrigins?: readonly string[];
 }
 /**
  * BigConsole admin microfrontend root props.
@@ -894,7 +904,13 @@ export interface DataSinkQuota {
     alertThreshold: number;
     alertRecipients?: string[];
 }
-/** Complete DataSink entity */
+/**
+ * DataSink entity as held by the client.
+ *
+ * The payload is deliberately not part of this record: it is loaded on demand
+ * (GetDataSinkPayload) by the views that edit or compare it, and `sizeBytes` /
+ * `dataStats` describe it everywhere else.
+ */
 export interface DataSink {
     id: string;
     workspaceId: string;
@@ -906,7 +922,6 @@ export interface DataSink {
     fluidGridsWorkflowId: string | null;
     fluidGridsWorkflowExecutionId: string | null;
     config: Record<string, unknown> | null;
-    data: Record<string, unknown>;
     dataStats: DataSinkDataStats | null;
     lastRefreshedAt: string;
     lastRefreshedBy: string | null;

package/dist/bigconsole/utils/backendError.d.ts

@@ -1,21 +1,3 @@
 type TranslateFn = (key: string, fallback: string) => string;
 export declare function resolveBackendErrorMessage(t: TranslateFn, error: unknown): string;
-/**
- * Every GraphQL `extensions.code` reachable from an error, in the shapes the
- * fe-libs Apollo 4 client hands back:
- *
- *  - `CombinedGraphQLErrors` (a `query()` resolved with `{ error }` under
- *    errorPolicy "all", or thrown under "none"): `error.errors[]`;
- *  - legacy Apollo 3 errors: `error.graphQLErrors[]`;
- *  - `ServerError` for a non-2xx answer sent as `application/json` — a subgraph
- *    that maps NOT_FOUND to HTTP 404 lands here, with the GraphQL body only in
- *    `error.bodyText` (Apollo 3 kept it parsed on `error.result`);
- *  - a bare GraphQL error: `error.extensions.code`;
- *  - any of those wrapped in `cause` / `error`.
- *
- * Returns `[]` when none is found. Never throws.
- */
-export declare function graphQLErrorCodes(error: unknown): string[];
-/** True when any GraphQL error reachable from `error` carries one of `codes`. */
-export declare function hasGraphQLErrorCode(error: unknown, codes: ReadonlySet<string>): boolean;
 export {};

package/dist/bigconsole/utils/dataSinkPayload.d.ts

@@ -0,0 +1,48 @@
+/**
+ * DataSink payload helpers.
+ *
+ * DataSink records held by the client (store, list, detail and mutation
+ * responses) never carry the payload. Views that need it load it on demand
+ * through the dedicated payload query, and the edit form sends it back only
+ * when the user has actually changed it — an untouched editor must never
+ * rewrite the stored payload.
+ */
+/**
+ * Whether a sink holds a non-empty payload, judged from its size metadata so
+ * the payload itself never has to be fetched.
+ */
+export declare function hasDataSinkPayload(sink: {
+    sizeBytes?: number | null;
+}): boolean;
+/**
+ * Render a stored payload as the editor's JSON text.
+ *
+ * The result always parses as JSON: a string that is itself JSON text is
+ * pretty-printed as the value it encodes, and any other string is shown as a
+ * JSON string literal. A missing payload renders as an empty editor.
+ */
+export declare function formatPayloadForEditor(payload: unknown): string;
+export type PayloadEditorChange = {
+    status: 'unchanged';
+} | {
+    status: 'changed';
+    payload: unknown;
+} | {
+    status: 'invalid';
+};
+/**
+ * Decide what a save should do with the payload editor's contents.
+ *
+ * @param text     Current editor text.
+ * @param baseline The editor text the stored payload was loaded as, or `null`
+ *                 when the stored payload is unknown (not loaded, or could not
+ *                 be read).
+ *
+ * - Text equal to the baseline, or JSON with the same value, is unchanged —
+ *   reformatting alone never rewrites the payload.
+ * - Clearing the editor empties the payload (`{}`), but only when there was a
+ *   known payload to clear; an editor that was empty to begin with is left alone.
+ * - With an unknown baseline, any JSON the user enters replaces the payload.
+ * - Text that is not valid JSON is reported as invalid.
+ */
+export declare function diffPayloadEditor(text: string, baseline: string | null): PayloadEditorChange;

package/dist/bigconsole/utils/dataSinkPayload.js

@@ -0,0 +1,38 @@
+//#region src/bigconsole/utils/dataSinkPayload.ts
+var e = 2;
+function t(t) {
+	return typeof t.sizeBytes == "number" && t.sizeBytes > e;
+}
+function n(e) {
+	if (e == null) return "";
+	if (typeof e == "string") try {
+		return JSON.stringify(JSON.parse(e), null, 2);
+	} catch {
+		return JSON.stringify(e);
+	}
+	return JSON.stringify(e, null, 2) ?? "";
+}
+var r = { status: "unchanged" };
+function i(e, t) {
+	if (t !== null && e === t) return r;
+	let n = t !== null && t.trim() !== "";
+	if (e.trim() === "") return n ? {
+		status: "changed",
+		payload: {}
+	} : r;
+	let i;
+	try {
+		i = JSON.parse(e);
+	} catch {
+		return { status: "invalid" };
+	}
+	if (n) try {
+		if (JSON.stringify(JSON.parse(t)) === JSON.stringify(i)) return r;
+	} catch {}
+	return {
+		status: "changed",
+		payload: i
+	};
+}
+//#endregion
+export { i as diffPayloadEditor, n as formatPayloadForEditor, t as hasDataSinkPayload };

package/dist/bigconsole/utils/index.d.ts

@@ -6,5 +6,7 @@
 export { SEMANTIC_COLORS, EVENT_STATUS_COLORS, COMPLEXITY_COLORS, ACTION_STYLE_COLORS, getCSSVariableValue, type SemanticColorKey, type EventStatusKey, type ComplexityKey, type ActionStyleKey, } from './semanticTokens';
 export { parseCsv, inferCsvValue, type CsvValue, type ParsedCsv, type ParseCsvOptions } from './csv';
 export { formatByteSize } from './format';
+export { toSafeHref, normalizeHttpsOrigin, resolveFrameSrc, appendPathSegment, currentAppOrigin, openExternalUrl, MAX_URL_LENGTH, type SafeHrefOptions, type FrameSrcContext, type FrameSrcRejection, type FrameSrcResult, } from './safeUrl';
+export { hasDataSinkPayload, formatPayloadForEditor, diffPayloadEditor, type PayloadEditorChange, } from './dataSinkPayload';
 export { mapToFederationWidgetType, mapFromFederationWidgetType, isFederationAccessible, normalizeWidgetTypeForApi, type FederationWidgetType, } from './widgetTypeMapping';
 export { findNextAvailablePosition, findPositionNextToWidget, calculatePositionFromDrop, getResponsiveCols, getResponsiveSpan, getResponsiveTier, adjustPositionsForCols, RESPONSIVE_BREAKPOINTS, RESPONSIVE_COLS, DEFAULT_GRID_CONFIG, type WidgetSize, type WidgetPosition, type GridConfig, type ResponsiveTier, } from './widgetPositioning';

package/dist/bigconsole/utils/safeUrl.d.ts

@@ -0,0 +1,79 @@
+/**
+ * URL policies for widget content.
+ *
+ * Widget configuration and parser output are data, so any URL taken from them
+ * is parsed with the WHATWG URL parser and checked against an explicit scheme
+ * allowlist before it reaches an `href`, `window.open` or an iframe `src`.
+ * Apart from {@link currentAppOrigin} and {@link openExternalUrl}, which read
+ * `window`, every helper here is pure so the rules can be unit-tested without a
+ * DOM.
+ */
+/** Upper bound on the length of a URL accepted from widget content. */
+export declare const MAX_URL_LENGTH = 2048;
+export interface SafeHrefOptions {
+    /** Also accept `mailto:` links. */
+    allowMailto?: boolean;
+    /** Also accept root-relative paths such as `/bigconsole/dashboards/1` (never `//host`). */
+    allowRootRelative?: boolean;
+    /** Also accept same-document fragment links such as `#summary`. */
+    allowFragment?: boolean;
+}
+/**
+ * Return a navigable href for `raw`, or `null` when it is not allowed.
+ *
+ * Absolute `http:` and `https:` URLs are always accepted (without embedded
+ * credentials) and returned in normalised form. `mailto:`, root-relative paths
+ * and fragments are accepted only when the matching option is set. Every other
+ * scheme, protocol-relative URLs and bare relative paths are rejected.
+ */
+export declare function toSafeHref(raw: unknown, options?: SafeHrefOptions): string | null;
+/**
+ * Validate an exact https origin such as `https://reports.example.com`.
+ *
+ * Returns the serialised origin, or `null` when the value is not an https URL
+ * or carries a path, query or fragment.
+ */
+export declare function normalizeHttpsOrigin(raw: unknown): string | null;
+export type FrameSrcRejection = 'missing' | 'invalid' | 'scheme' | 'credentials' | 'same-origin' | 'origin-not-allowed';
+export type FrameSrcResult = {
+    ok: true;
+    src: string;
+    origin: string;
+} | {
+    ok: false;
+    reason: FrameSrcRejection;
+};
+export interface FrameSrcContext {
+    /** Origin of the hosting app; frames on this origin are rejected. */
+    appOrigin?: string | null;
+    /**
+     * Exact https origins that may be framed. An empty or missing list allows
+     * any https origin other than the app's own. A non-empty list with no valid
+     * entry allows nothing.
+     */
+    allowedOrigins?: readonly string[] | null;
+}
+/**
+ * Decide whether `raw` may be used as an iframe `src`.
+ *
+ * Only absolute https URLs without credentials are accepted. The app's own
+ * origin is rejected, and when an allowlist is configured the URL's origin must
+ * match one of its entries exactly.
+ */
+export declare function resolveFrameSrc(raw: unknown, context?: FrameSrcContext): FrameSrcResult;
+/**
+ * Append one path segment (such as a dashboard id) to an in-app base path.
+ *
+ * The segment is percent-encoded, so it cannot add path separators, a query or
+ * a fragment. Empty, `.` and `..` segments are rejected with `null`.
+ */
+export declare function appendPathSegment(basePath: string, segment: unknown): string | null;
+/** The origin the app is served from, or `null` outside a browser. */
+export declare function currentAppOrigin(): string | null;
+/**
+ * Open `raw` in a new browsing context without an opener or referrer.
+ *
+ * Returns `false` (and opens nothing) when the URL is not allowed by
+ * {@link toSafeHref} with the given options.
+ */
+export declare function openExternalUrl(raw: unknown, options?: SafeHrefOptions): boolean;

package/dist/bigconsole/utils/safeUrl.js

@@ -0,0 +1,93 @@
+function e(e) {
+	for (let t = 0; t < e.length; t += 1) {
+		let n = e.charCodeAt(t);
+		if (n < 32 || n === 127) return !0;
+	}
+	return !1;
+}
+var t = "https://path-base.invalid";
+function n(t) {
+	if (typeof t != "string") return null;
+	let n = t.trim();
+	return !n || n.length > 2048 || e(n) ? null : n;
+}
+function r(e) {
+	try {
+		return new URL(e);
+	} catch {
+		return null;
+	}
+}
+function i(e, i = {}) {
+	let a = n(e);
+	if (!a) return null;
+	if (a.startsWith("#")) return i.allowFragment ? a : null;
+	if (a.startsWith("/")) {
+		if (!i.allowRootRelative) return null;
+		let e;
+		try {
+			e = new URL(a, t);
+		} catch {
+			return null;
+		}
+		return e.origin === t ? `${e.pathname}${e.search}${e.hash}` : null;
+	}
+	let o = r(a);
+	return o ? o.protocol === "http:" || o.protocol === "https:" ? o.username || o.password ? null : o.href : o.protocol === "mailto:" && i.allowMailto ? o.href : null : null;
+}
+function a(e) {
+	if (typeof e != "string") return null;
+	let t = e.trim();
+	if (!t) return null;
+	let n = r(t);
+	return !n || n.protocol !== "https:" || n.pathname !== "" && n.pathname !== "/" || n.search || n.hash ? null : n.origin;
+}
+function o(e, t = {}) {
+	if (typeof e != "string" || e.trim() === "") return {
+		ok: !1,
+		reason: "missing"
+	};
+	let i = n(e);
+	if (!i) return {
+		ok: !1,
+		reason: "invalid"
+	};
+	let o = r(i);
+	if (!o) return {
+		ok: !1,
+		reason: "invalid"
+	};
+	if (o.protocol !== "https:") return {
+		ok: !1,
+		reason: "scheme"
+	};
+	if (o.username || o.password) return {
+		ok: !1,
+		reason: "credentials"
+	};
+	if (t.appOrigin && o.origin === t.appOrigin) return {
+		ok: !1,
+		reason: "same-origin"
+	};
+	let s = t.allowedOrigins ?? [];
+	return s.length > 0 && !new Set(s.map((e) => a(e)).filter((e) => e !== null)).has(o.origin) ? {
+		ok: !1,
+		reason: "origin-not-allowed"
+	} : {
+		ok: !0,
+		src: o.href,
+		origin: o.origin
+	};
+}
+function s(e, t) {
+	return typeof t != "string" || t === "" || t === "." || t === ".." ? null : `${e.endsWith("/") ? e.slice(0, -1) : e}/${encodeURIComponent(t)}`;
+}
+function c() {
+	return typeof window > "u" || !window.location ? null : window.location.origin;
+}
+function l(e, t = {}) {
+	let n = i(e, t);
+	return !n || typeof window > "u" ? !1 : (window.open(n, "_blank", "noopener,noreferrer"), !0);
+}
+//#endregion
+export { s as appendPathSegment, c as currentAppOrigin, a as normalizeHttpsOrigin, l as openExternalUrl, o as resolveFrameSrc, i as toSafeHref };