npm - @conduction/nextcloud-vue - Versions diffs - 2.58.0 → 2.60.0 - Mend

@conduction/nextcloud-vue 2.58.0 → 2.60.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (507) hide show

package/dist/esm/utils/fetchFilterCounts.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"fetchFilterCounts.js","sources":["../../../src/utils/fetchFilterCounts.js"],"sourcesContent":["/**\n * SPDX-FileCopyrightText: 2026 Conduction B.V.\n * SPDX-License-Identifier: EUPL-1.2\n *\n * fetchFilterCounts: how many records each of a set of filters matches, in as\n * few requests as the API allows.\n *\n * Quick filters and saved views usually differ in ONE field (`status: open`,\n * `status: closed`, ...). Those are answered by one `/grouped` request on that\n * field. A filter that narrows on something else (two fields, an operator, a\n * list of values) cannot be read off a grouped result, so each of those costs\n * one `/value` count. A filter that holds a LIST of values is counted through\n * the list endpoint, because the aggregation endpoints cannot express it.\n * Nothing is requested for an entry that did not ask.\n *\n * @module utils/fetchFilterCounts\n */\n\nimport { fetchAggregateValue, fetchGroupedCounts } from './fetchAggregate.js'\nimport { buildHeaders, buildQueryString, prefixUrl } from './headers.js'\nimport { resolveFilterTokens } from './resolveFilterTokens.js'\n\n/**\n * Whether a filter holds a list of values (`{ status: ['open', 'hold'] }`).\n *\n * The aggregation endpoints have no spelling for \"one of these values\", so a\n * filter like this is never sent to them. It is counted through the list\n * endpoint instead, which is where the page's own request sends it.\n *\n * @param {object} filter A filter map.\n * @return {boolean} True when any value is an array.\n * @spec openspec/changes/workplace-dashboard-primitives/specs/workplace-dashboard-primitives/spec.md#requirement-counts-on-filters-and-views\n */\nexport function hasListValue(filter) {\n\tif (!filter || typeof filter !== 'object') {\n\t\treturn false\n\t}\n\treturn Object.values(filter).some((value) => Array.isArray(value))\n}\n\n/**\n * Count the records a filter matches by asking the LIST endpoint for one\n * record and reading its `total`. The filter is sent the way the list request\n * sends it: a list of values as repeated `field[]=`, an operator as\n * `field[op]=`.\n *\n * @param {string} register The register slug.\n * @param {string} schema The schema slug.\n * @param {object} filter The filter map.\n * @param {object} [ctx] Token-resolution context for the filter.\n * @return {Promise<number|null>} The total, or null when the response carries none.\n * @spec openspec/changes/workplace-dashboard-primitives/specs/workplace-dashboard-primitives/spec.md#requirement-counts-on-filters-and-views\n */\nexport async function fetchListTotal(register, schema, filter, ctx) {\n\tconst resolved = resolveFilterTokens(filter || {}, ctx || {})\n\tconst params = {}\n\tfor (const [key, value] of Object.entries(resolved || {})) {\n\t\tif (value && typeof value === 'object' && !Array.isArray(value)) {\n\t\t\tfor (const [op, operand] of Object.entries(value)) {\n\t\t\t\tparams[`${key}[${op}]`] = operand\n\t\t\t}\n\t\t} else {\n\t\t\tparams[key] = value\n\t\t}\n\t}\n\tconst qs = buildQueryString({ ...params, _limit: 1 })\n\tconst url = prefixUrl(`/apps/openregister/api/objects/${encodeURIComponent(register)}/${encodeURIComponent(schema)}${qs}`)\n\tconst response = await fetch(url, { headers: buildHeaders() })\n\tif (!response.ok) {\n\t\tthrow new Error(`list returned ${response.status}`)\n\t}\n\tconst data = await response.json()\n\treturn typeof data.total === 'number' ? data.total : null\n}\n\n/**\n * The single field a filter narrows on with a plain equality, or null when the\n * filter is anything else.\n *\n * @param {object} filter A filter map.\n * @return {{field: string, value: string}|null} The field and the value it must equal.\n * @spec openspec/changes/workplace-dashboard-primitives/specs/workplace-dashboard-primitives/spec.md#requirement-counts-on-filters-and-views\n */\nexport function singleEqualityOf(filter) {\n\tif (!filter || typeof filter !== 'object' || Array.isArray(filter)) {\n\t\treturn null\n\t}\n\tconst keys = Object.keys(filter)\n\tif (keys.length !== 1) {\n\t\treturn null\n\t}\n\tconst value = filter[keys[0]]\n\tif (value === null || value === undefined || value === '' || typeof value === 'object') {\n\t\treturn null\n\t}\n\t// A token (`@me`, `@today`) resolves to a value the grouped keys are\n\t// compared against only after resolution, which the count request does.\n\tif (typeof value === 'string' && value.charAt(0) === '@') {\n\t\treturn null\n\t}\n\treturn { field: keys[0], value: String(value) }\n}\n\n/**\n * Count the records each entry's filter matches.\n *\n * @param {object} options The request.\n * @param {string} options.register The register slug.\n * @param {string} options.schema The schema slug.\n * @param {Array<{key: (string|number), filter: object}>} options.entries The filters to count, each under its own key.\n * @param {object} [options.baseFilter] A filter every count is narrowed by (the page's fixed filter).\n * @param {object} [options.ctx] Token-resolution context for the filters.\n * @return {Promise<{[key: string]: number}>} The count per entry key. An entry whose count failed is left out.\n * @spec openspec/changes/workplace-dashboard-primitives/specs/workplace-dashboard-primitives/spec.md#requirement-counts-on-filters-and-views\n */\nexport async function fetchFilterCounts({ register, schema, entries, baseFilter, ctx } = {}) {\n\tconst counts = {}\n\tif (!register || !schema || !Array.isArray(entries) || entries.length === 0) {\n\t\treturn counts\n\t}\n\tconst base = (baseFilter && typeof baseFilter === 'object') ? baseFilter : {}\n\n\t// Entries that share one equality field go into one grouped request, but\n\t// only when at least two do: a lone entry costs one request either way,\n\t// and `/value` returns exactly its number.\n\t// A list of values anywhere in a request rules the aggregation endpoints\n\t// out for it. A base filter with one rules them out for every entry.\n\tconst baseHasList = hasListValue(base)\n\tconst byField = {}\n\tconst single = []\n\tconst viaList = []\n\tfor (const entry of entries) {\n\t\tif (baseHasList || hasListValue(entry.filter)) {\n\t\t\tviaList.push(entry)\n\t\t\tcontinue\n\t\t}\n\t\tconst eq = singleEqualityOf(entry.filter)\n\t\tif (eq !== null && !(eq.field in base)) {\n\t\t\t(byField[eq.field] = byField[eq.field] || []).push({ entry, value: eq.value })\n\t\t} else {\n\t\t\tsingle.push(entry)\n\t\t}\n\t}\n\tconst jobs = []\n\tfor (const [field, members] of Object.entries(byField)) {\n\t\tif (members.length < 2) {\n\t\t\tsingle.push(members[0].entry)\n\t\t\tcontinue\n\t\t}\n\t\tjobs.push(fetchGroupedCounts({ register, schema, groupBy: field, filter: base }, ctx)\n\t\t\t.then((groups) => {\n\t\t\t\tconst map = {}\n\t\t\t\tfor (const group of groups) {\n\t\t\t\t\tmap[group.key] = group.count\n\t\t\t\t}\n\t\t\t\tfor (const member of members) {\n\t\t\t\t\tcounts[member.entry.key] = map[member.value] || 0\n\t\t\t\t}\n\t\t\t})\n\t\t\t.catch(() => {}))\n\t}\n\tfor (const entry of single) {\n\t\tjobs.push(fetchAggregateValue({ register, schema, metric: 'count', filter: { ...base, ...(entry.filter || {}) } }, ctx)\n\t\t\t.then((value) => {\n\t\t\t\tif (value !== null && Number.isFinite(Number(value))) {\n\t\t\t\t\tcounts[entry.key] = Number(value)\n\t\t\t\t}\n\t\t\t})\n\t\t\t.catch(() => {}))\n\t}\n\tfor (const entry of viaList) {\n\t\tjobs.push(fetchListTotal(register, schema, { ...base, ...(entry.filter || {}) }, ctx)\n\t\t\t.then((total) => {\n\t\t\t\tif (total !== null) {\n\t\t\t\t\tcounts[entry.key] = total\n\t\t\t\t}\n\t\t\t})\n\t\t\t.catch(() => {}))\n\t}\n\tawait Promise.all(jobs)\n\treturn counts\n}\n"],"names":[],"mappings":";;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,YAAY,CAAC,MAAM,EAAE;AACrC,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE;AAC5C,EAAE,OAAO,KAAK;AACd,EAAE;AACF,CAAC,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAe,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE;AACpE,CAAC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,EAAC;AAC9D,CAAC,MAAM,MAAM,GAAG,GAAE;AAClB,CAAC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE;AAC5D,EAAE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;AACnE,GAAG,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;AACtD,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,QAAO;AACrC,IAAI;AACJ,GAAG,MAAM;AACT,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,MAAK;AACtB,GAAG;AACH,EAAE;AACF,CAAC,MAAM,EAAE,GAAG,gBAAgB,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,EAAC;AACtD,CAAC,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,+BAA+B,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAC;AAC3H,CAAC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,EAAC;AAC/D,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;AACnB,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AACrD,EAAE;AACF,CAAC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,GAAE;AACnC,CAAC,OAAO,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI;AAC1D,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,gBAAgB,CAAC,MAAM,EAAE;AACzC,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;AACrE,EAAE,OAAO,IAAI;AACb,EAAE;AACF,CAAC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAC;AACjC,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE;AACxB,EAAE,OAAO,IAAI;AACb,EAAE;AACF,CAAC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAC;AAC9B,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE;AACzF,EAAE,OAAO,IAAI;AACb,EAAE;AACF;AACA;AACA,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE;AAC3D,EAAE,OAAO,IAAI;AACb,EAAE;AACF,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE;AAChD,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAe,iBAAiB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;AAC7F,CAAC,MAAM,MAAM,GAAG,GAAE;AAClB,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE;AAC9E,EAAE,OAAO,MAAM;AACf,EAAE;AACF,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,GAAG,GAAE;AAC9E;AACA;AACA;AACA;AACA;AACA;AACA,CAAC,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,EAAC;AACvC,CAAC,MAAM,OAAO,GAAG,GAAE;AACnB,CAAC,MAAM,MAAM,GAAG,GAAE;AAClB,CAAC,MAAM,OAAO,GAAG,GAAE;AACnB,CAAC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE;AAC9B,EAAE,IAAI,WAAW,IAAI,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE;AACjD,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,EAAC;AACtB,GAAG,QAAQ;AACX,GAAG;AACH,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,EAAC;AAC3C,EAAE,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,EAAE;AAC1C,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,EAAC;AACjF,GAAG,MAAM;AACT,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAC;AACrB,GAAG;AACH,EAAE;AACF,CAAC,MAAM,IAAI,GAAG,GAAE;AAChB,CAAC,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;AACzD,EAAE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE;AAC1B,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,EAAC;AAChC,GAAG,QAAQ;AACX,GAAG;AACH,EAAE,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC;AACvF,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK;AACrB,IAAI,MAAM,GAAG,GAAG,GAAE;AAClB,IAAI,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE;AAChC,KAAK,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAK;AACjC,KAAK;AACL,IAAI,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE;AAClC,KAAK,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAC;AACtD,KAAK;AACL,IAAI,CAAC;AACL,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,EAAC;AACpB,EAAE;AACF,CAAC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE;AAC7B,EAAE,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC;AACzH,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK;AACpB,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE;AAC1D,KAAK,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,EAAC;AACtC,KAAK;AACL,IAAI,CAAC;AACL,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,EAAC;AACpB,EAAE;AACF,CAAC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE;AAC9B,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,EAAE,GAAG,CAAC;AACvF,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK;AACpB,IAAI,IAAI,KAAK,KAAK,IAAI,EAAE;AACxB,KAAK,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,MAAK;AAC9B,KAAK;AACL,IAAI,CAAC;AACL,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,EAAC;AACpB,EAAE;AACF,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,EAAC;AACxB,CAAC,OAAO,MAAM;AACd;;;;"}

package/dist/esm/utils/libraryWidgetKeys.js CHANGED Viewed

@@ -94,10 +94,12 @@ const DASHBOARD_CATALOG_WIDGET_KEYS = Object.freeze([
 	'calendar',
 	'chart',
 	'container',
+	'conversation',
 	'countdown',
 	'data',
 	'delta',
 	'divider',
+	'document-review',
 	'files',
 	'flow-runs',
 	'gauge',
@@ -111,6 +113,7 @@ const DASHBOARD_CATALOG_WIDGET_KEYS = Object.freeze([
 	'map',
 	'menu',
 	'nc-widget',
+	'next-step',
 	// `news` was here until the widget moved to LaunchPad, which owns the feed
 	// fetching. An app that renders one now gets it from LaunchPad's registry.
 	'object-geo',
@@ -120,6 +123,7 @@ const DASHBOARD_CATALOG_WIDGET_KEYS = Object.freeze([
 	'quicklinks',
 	'related',
 	'spend-analytics',
+	'stacked-bar',
 	'stages',
 	'stat',
 	'stats-block',
@@ -129,6 +133,7 @@ const DASHBOARD_CATALOG_WIDGET_KEYS = Object.freeze([
 	'text',
 	'tile',
 	'video',
+	'week-strip',
 	'workspace-filter',
 ]);

package/dist/esm/utils/libraryWidgetKeys.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"libraryWidgetKeys.js","sources":["../../../src/utils/libraryWidgetKeys.js"],"sourcesContent":["/*\n SPDX-FileCopyrightText: 2026 Conduction B.V.\n * SPDX-License-Identifier: EUPL-1.2\n \n libraryWidgetKeys — the one vocabulary of widget keys the LIBRARY itself\n * renders, and the only list `validateManifestV2` is allowed to consult.\n \n WHY THIS MODULE EXISTS\n * ----------------------\n * The validator used to carry its own hand-written array of \"library built-in\n * widget keys\", with a comment instructing whoever added a built-in to append\n * it \"in the same PR\". That instruction was followed for five keys and missed\n * for six, so the validator knew 11 keys while the library actually rendered\n * 45. Nothing failed when the two disagreed, because the only consumer is an\n * exemption: a key the validator does not recognise is treated as a CUSTOM\n * registry component, which makes a legitimate single-widget library dashboard\n * fail the ADR-036 Decision 1 anti-pattern rule with advice (\"declare it as\n * type:'custom'\") that is wrong for a library widget.\n \n A comment cannot enforce anything, so the array moved here and\n * `tests/utils/libraryWidgetKeys.spec.js` now binds it to the two registries\n * that actually resolve a key at runtime:\n \n 1. `BUILT_IN_WIDGETS` (components/CnWidgetGrid/builtInWidgets.js) — the v2\n * manifest widget set `CnWidgetGrid` resolves a `widgetKey` against.\n * 2. The dashboard widget catalog (`dashboardWidgetRegistry`), populated by\n * `registerDashboardWidgets.js`. `CnWidgetGrid` falls back to it (third in\n * the chain, after the consumer registry and `BUILT_IN_WIDGETS`), so a\n * catalog key renders on a v2 page exactly like a `BUILT_IN_WIDGETS` one.\n \n The test asserts SET EQUALITY in both directions against the live registries,\n * so adding a widget to either registry without touching this file fails CI,\n * and deleting one without removing it here fails too. The lists below are the\n * validator's view; the registries are the truth the test holds them to.\n \n THE CATALOG IS NOT LEGACY. It is a live half of the same vocabulary, and the\n * old array already conceded the point by exempting `chart` and `stats-block`,\n * which are catalog-only keys that `BUILT_IN_WIDGETS` has never held. What it\n * got wrong was doing that for two keys and not the other thirty-seven.\n * `widgetDispatch.js` unified the two resolution paths for the same reason: a\n * widget authored against one vocabulary was invisible to the other and said\n * nothing about why (101 of 236 detail widgets on hrmq).\n \n @module utils/libraryWidgetKeys\n /\n\nimport { WIDGET_TYPE_ALIASES } from './widgetTypeAliases.js'\n\n/\n Keys of `BUILT_IN_WIDGETS` — the v2 manifest widget set.\n \n Kept in the registry's own declaration order so a diff against\n * `builtInWidgets.js` reads straight down.\n \n @type {string[]} Frozen.\n /\nexport const BUILT_IN_WIDGET_KEYS = Object.freeze([\n\t'object-table',\n\t'form-renderer',\n\t'map-viewer',\n\t'object-geo',\n\t'card-grid',\n\t'nav-card-grid',\n\t'data',\n\t'metadata',\n\t'related',\n\t'integration',\n\t'banner',\n\t'audit-trail',\n\t'header',\n\t'text',\n\t'divider',\n])\n\n/\n Widget types the LIBRARY registers into the dashboard catalog at import time\n * (`registerDashboardWidgets.js` and the widget `index.js` modules it pulls in).\n \n Deliberately a static list rather than a read of `dashboardWidgetRegistry`:\n * that object is mutable and consumer-extensible, so deriving the exemption\n * from it at call time would let an app register its own full-page component in\n * the catalog and walk straight through the ADR-036 Decision 1 rule the\n * exemption exists to enforce. Only keys the library itself ships are exempt.\n \n Sorted, because unlike `BUILT_IN_WIDGETS` these registrations are spread over\n * ~30 files and have no meaningful declaration order.\n \n @type {string[]} Frozen.\n /\nexport const DASHBOARD_CATALOG_WIDGET_KEYS = Object.freeze([\n\t'audit-trail',\n\t'banner',\n\t'calendar',\n\t'chart',\n\t'container',\n\t'countdown',\n\t'data',\n\t'delta',\n\t'divider',\n\t'files',\n\t'flow-runs',\n\t'gauge',\n\t'header',\n\t'image',\n\t'interaction-form',\n\t'kb-search',\n\t'label',\n\t'link',\n\t'links',\n\t'map',\n\t'menu',\n\t'nc-widget',\n\t// `news` was here until the widget moved to LaunchPad, which owns the feed\n\t// fetching. An app that renders one now gets it from LaunchPad's registry.\n\t'object-geo',\n\t'object-list',\n\t'object-table',\n\t'people',\n\t'quicklinks',\n\t'related',\n\t'spend-analytics',\n\t'stages',\n\t'stat',\n\t'stats-block',\n\t'table',\n\t'tabs',\n\t'tasks',\n\t'text',\n\t'tile',\n\t'video',\n\t'workspace-filter',\n])\n\n/\n Expand a key set over `WIDGET_TYPE_ALIASES` so both spellings of an aliased\n * widget are present whenever either one is.\n \n `CnWidgetGrid` resolves a key and its canonical form (`object-table` ⇄\n * `table`, `map-viewer` ⇄ `map`), so both spellings render and both must be\n * exempt. Today each registry happens to hold one side of each pair, which is\n * exactly the accident that would silently stop being true when the next alias\n * lands.\n \n @param {Set<string>} keys The key set to expand, mutated in place.\n * @return {Set<string>} The same set.\n /\nfunction expandAliases(keys) {\n\tfor (const [alias, canonical] of Object.entries(WIDGET_TYPE_ALIASES)) {\n\t\tif (keys.has(alias) \|\| keys.has(canonical)) {\n\t\t\tkeys.add(alias)\n\t\t\tkeys.add(canonical)\n\t\t}\n\t}\n\treturn keys\n}\n\n/\n Every widget key the library renders itself: both registries, plus both\n * spellings of every alias.\n \n A `widgetKey` in this list is served by a library `Cn` SFC and does NOT\n count as a custom registry component for the single-12×12-widget dashboard\n * rule (ADR-036 Decision 1).\n \n @type {string[]} Frozen.\n */\nexport const LIBRARY_WIDGET_KEYS = Object.freeze([\n\t...expandAliases(new Set([\n\t\t...BUILT_IN_WIDGET_KEYS,\n\t\t...DASHBOARD_CATALOG_WIDGET_KEYS,\n\t])),\n])\n"],"names":[],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACY,MAAC,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC;AAClD,CAAC,cAAc;AACf,CAAC,eAAe;AAChB,CAAC,YAAY;AACb,CAAC,YAAY;AACb,CAAC,WAAW;AACZ,CAAC,eAAe;AAChB,CAAC,MAAM;AACP,CAAC,UAAU;AACX,CAAC,SAAS;AACV,CAAC,aAAa;AACd,CAAC,QAAQ;AACT,CAAC,aAAa;AACd,CAAC,QAAQ;AACT,CAAC,MAAM;AACP,CAAC,SAAS;AACV,CAAC,EAAC;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACY,MAAC,6BAA6B,GAAG,MAAM,CAAC,MAAM,CAAC;AAC3D,CAAC,aAAa;AACd,CAAC,QAAQ;AACT,CAAC,UAAU;AACX,CAAC,OAAO;AACR,CAAC,WAAW;AACZ,CAAC,WAAW;AACZ,CAAC,MAAM;AACP,CAAC,OAAO;AACR,CAAC,SAAS;AACV,CAAC,OAAO;AACR,CAAC,WAAW;AACZ,CAAC,OAAO;AACR,CAAC,QAAQ;AACT,CAAC,OAAO;AACR,CAAC,kBAAkB;AACnB,CAAC,WAAW;AACZ,CAAC,OAAO;AACR,CAAC,MAAM;AACP,CAAC,OAAO;AACR,CAAC,KAAK;AACN,CAAC,MAAM;AACP,CAAC,WAAW;AACZ;AACA;AACA,CAAC,YAAY;AACb,CAAC,aAAa;AACd,CAAC,cAAc;AACf,CAAC,QAAQ;AACT,CAAC,YAAY;AACb,CAAC,SAAS;AACV,CAAC,iBAAiB;AAClB,CAAC,QAAQ;AACT,CAAC,MAAM;AACP,CAAC,aAAa;AACd,CAAC,OAAO;AACR,CAAC,MAAM;AACP,CAAC,OAAO;AACR,CAAC,MAAM;AACP,CAAC,MAAM;AACP,CAAC,OAAO;AACR,CAAC,kBAAkB;AACnB,CAAC,EAAC;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,IAAI,EAAE;AAC7B,CAAC,KAAK,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE;AACvE,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE;AAC9C,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAC;AAClB,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAC;AACtB,GAAG;AACH,EAAE;AACF,CAAC,OAAO,IAAI;AACZ,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACY,MAAC,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC;AACjD,CAAC,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC;AAC1B,EAAE,GAAG,oBAAoB;AACzB,EAAE,GAAG,6BAA6B;AAClC,EAAE,CAAC,CAAC;AACJ,CAAC;;;;"}
1	+ {"version":3,"file":"libraryWidgetKeys.js","sources":["../../../src/utils/libraryWidgetKeys.js"],"sourcesContent":["/*\n SPDX-FileCopyrightText: 2026 Conduction B.V.\n * SPDX-License-Identifier: EUPL-1.2\n \n libraryWidgetKeys — the one vocabulary of widget keys the LIBRARY itself\n * renders, and the only list `validateManifestV2` is allowed to consult.\n \n WHY THIS MODULE EXISTS\n * ----------------------\n * The validator used to carry its own hand-written array of \"library built-in\n * widget keys\", with a comment instructing whoever added a built-in to append\n * it \"in the same PR\". That instruction was followed for five keys and missed\n * for six, so the validator knew 11 keys while the library actually rendered\n * 45. Nothing failed when the two disagreed, because the only consumer is an\n * exemption: a key the validator does not recognise is treated as a CUSTOM\n * registry component, which makes a legitimate single-widget library dashboard\n * fail the ADR-036 Decision 1 anti-pattern rule with advice (\"declare it as\n * type:'custom'\") that is wrong for a library widget.\n \n A comment cannot enforce anything, so the array moved here and\n * `tests/utils/libraryWidgetKeys.spec.js` now binds it to the two registries\n * that actually resolve a key at runtime:\n \n 1. `BUILT_IN_WIDGETS` (components/CnWidgetGrid/builtInWidgets.js) — the v2\n * manifest widget set `CnWidgetGrid` resolves a `widgetKey` against.\n * 2. The dashboard widget catalog (`dashboardWidgetRegistry`), populated by\n * `registerDashboardWidgets.js`. `CnWidgetGrid` falls back to it (third in\n * the chain, after the consumer registry and `BUILT_IN_WIDGETS`), so a\n * catalog key renders on a v2 page exactly like a `BUILT_IN_WIDGETS` one.\n \n The test asserts SET EQUALITY in both directions against the live registries,\n * so adding a widget to either registry without touching this file fails CI,\n * and deleting one without removing it here fails too. The lists below are the\n * validator's view; the registries are the truth the test holds them to.\n \n THE CATALOG IS NOT LEGACY. It is a live half of the same vocabulary, and the\n * old array already conceded the point by exempting `chart` and `stats-block`,\n * which are catalog-only keys that `BUILT_IN_WIDGETS` has never held. What it\n * got wrong was doing that for two keys and not the other thirty-seven.\n * `widgetDispatch.js` unified the two resolution paths for the same reason: a\n * widget authored against one vocabulary was invisible to the other and said\n * nothing about why (101 of 236 detail widgets on hrmq).\n \n @module utils/libraryWidgetKeys\n /\n\nimport { WIDGET_TYPE_ALIASES } from './widgetTypeAliases.js'\n\n/\n Keys of `BUILT_IN_WIDGETS` — the v2 manifest widget set.\n \n Kept in the registry's own declaration order so a diff against\n * `builtInWidgets.js` reads straight down.\n \n @type {string[]} Frozen.\n /\nexport const BUILT_IN_WIDGET_KEYS = Object.freeze([\n\t'object-table',\n\t'form-renderer',\n\t'map-viewer',\n\t'object-geo',\n\t'card-grid',\n\t'nav-card-grid',\n\t'data',\n\t'metadata',\n\t'related',\n\t'integration',\n\t'banner',\n\t'audit-trail',\n\t'header',\n\t'text',\n\t'divider',\n])\n\n/\n Widget types the LIBRARY registers into the dashboard catalog at import time\n * (`registerDashboardWidgets.js` and the widget `index.js` modules it pulls in).\n \n Deliberately a static list rather than a read of `dashboardWidgetRegistry`:\n * that object is mutable and consumer-extensible, so deriving the exemption\n * from it at call time would let an app register its own full-page component in\n * the catalog and walk straight through the ADR-036 Decision 1 rule the\n * exemption exists to enforce. Only keys the library itself ships are exempt.\n \n Sorted, because unlike `BUILT_IN_WIDGETS` these registrations are spread over\n * ~30 files and have no meaningful declaration order.\n \n @type {string[]} Frozen.\n /\nexport const DASHBOARD_CATALOG_WIDGET_KEYS = Object.freeze([\n\t'audit-trail',\n\t'banner',\n\t'calendar',\n\t'chart',\n\t'container',\n\t'conversation',\n\t'countdown',\n\t'data',\n\t'delta',\n\t'divider',\n\t'document-review',\n\t'files',\n\t'flow-runs',\n\t'gauge',\n\t'header',\n\t'image',\n\t'interaction-form',\n\t'kb-search',\n\t'label',\n\t'link',\n\t'links',\n\t'map',\n\t'menu',\n\t'nc-widget',\n\t'next-step',\n\t// `news` was here until the widget moved to LaunchPad, which owns the feed\n\t// fetching. An app that renders one now gets it from LaunchPad's registry.\n\t'object-geo',\n\t'object-list',\n\t'object-table',\n\t'people',\n\t'quicklinks',\n\t'related',\n\t'spend-analytics',\n\t'stacked-bar',\n\t'stages',\n\t'stat',\n\t'stats-block',\n\t'table',\n\t'tabs',\n\t'tasks',\n\t'text',\n\t'tile',\n\t'video',\n\t'week-strip',\n\t'workspace-filter',\n])\n\n/\n Expand a key set over `WIDGET_TYPE_ALIASES` so both spellings of an aliased\n * widget are present whenever either one is.\n \n `CnWidgetGrid` resolves a key and its canonical form (`object-table` ⇄\n * `table`, `map-viewer` ⇄ `map`), so both spellings render and both must be\n * exempt. Today each registry happens to hold one side of each pair, which is\n * exactly the accident that would silently stop being true when the next alias\n * lands.\n \n @param {Set<string>} keys The key set to expand, mutated in place.\n * @return {Set<string>} The same set.\n /\nfunction expandAliases(keys) {\n\tfor (const [alias, canonical] of Object.entries(WIDGET_TYPE_ALIASES)) {\n\t\tif (keys.has(alias) \|\| keys.has(canonical)) {\n\t\t\tkeys.add(alias)\n\t\t\tkeys.add(canonical)\n\t\t}\n\t}\n\treturn keys\n}\n\n/\n Every widget key the library renders itself: both registries, plus both\n * spellings of every alias.\n \n A `widgetKey` in this list is served by a library `Cn` SFC and does NOT\n count as a custom registry component for the single-12×12-widget dashboard\n * rule (ADR-036 Decision 1).\n \n @type {string[]} Frozen.\n */\nexport const LIBRARY_WIDGET_KEYS = Object.freeze([\n\t...expandAliases(new Set([\n\t\t...BUILT_IN_WIDGET_KEYS,\n\t\t...DASHBOARD_CATALOG_WIDGET_KEYS,\n\t])),\n])\n"],"names":[],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACY,MAAC,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC;AAClD,CAAC,cAAc;AACf,CAAC,eAAe;AAChB,CAAC,YAAY;AACb,CAAC,YAAY;AACb,CAAC,WAAW;AACZ,CAAC,eAAe;AAChB,CAAC,MAAM;AACP,CAAC,UAAU;AACX,CAAC,SAAS;AACV,CAAC,aAAa;AACd,CAAC,QAAQ;AACT,CAAC,aAAa;AACd,CAAC,QAAQ;AACT,CAAC,MAAM;AACP,CAAC,SAAS;AACV,CAAC,EAAC;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACY,MAAC,6BAA6B,GAAG,MAAM,CAAC,MAAM,CAAC;AAC3D,CAAC,aAAa;AACd,CAAC,QAAQ;AACT,CAAC,UAAU;AACX,CAAC,OAAO;AACR,CAAC,WAAW;AACZ,CAAC,cAAc;AACf,CAAC,WAAW;AACZ,CAAC,MAAM;AACP,CAAC,OAAO;AACR,CAAC,SAAS;AACV,CAAC,iBAAiB;AAClB,CAAC,OAAO;AACR,CAAC,WAAW;AACZ,CAAC,OAAO;AACR,CAAC,QAAQ;AACT,CAAC,OAAO;AACR,CAAC,kBAAkB;AACnB,CAAC,WAAW;AACZ,CAAC,OAAO;AACR,CAAC,MAAM;AACP,CAAC,OAAO;AACR,CAAC,KAAK;AACN,CAAC,MAAM;AACP,CAAC,WAAW;AACZ,CAAC,WAAW;AACZ;AACA;AACA,CAAC,YAAY;AACb,CAAC,aAAa;AACd,CAAC,cAAc;AACf,CAAC,QAAQ;AACT,CAAC,YAAY;AACb,CAAC,SAAS;AACV,CAAC,iBAAiB;AAClB,CAAC,aAAa;AACd,CAAC,QAAQ;AACT,CAAC,MAAM;AACP,CAAC,aAAa;AACd,CAAC,OAAO;AACR,CAAC,MAAM;AACP,CAAC,OAAO;AACR,CAAC,MAAM;AACP,CAAC,MAAM;AACP,CAAC,OAAO;AACR,CAAC,YAAY;AACb,CAAC,kBAAkB;AACnB,CAAC,EAAC;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,IAAI,EAAE;AAC7B,CAAC,KAAK,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE;AACvE,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE;AAC9C,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAC;AAClB,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAC;AACtB,GAAG;AACH,EAAE;AACF,CAAC,OAAO,IAAI;AACZ,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACY,MAAC,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC;AACjD,CAAC,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC;AAC1B,EAAE,GAAG,oBAAoB;AACzB,EAAE,GAAG,6BAA6B;AAClC,EAAE,CAAC,CAAC;AACJ,CAAC;;;;"}

package/dist/esm/utils/linkNavigation.js CHANGED Viewed

@@ -70,8 +70,11 @@ function resolveHref(target, router) {
  * click is routed through the router; a modified click, or one a handler
  * already prevented, is left to the browser.
  *
+ * Unlike `resolveHref`, a string target is a router path, so pair the two
+ * with a location object (or `{ path }`) for the href and click to agree.
+ *
  * @param {MouseEvent} event The click event.
- * @param {string|object} target The router location the link points at.
+ * @param {string|object} target The router location the link points at; a string is a router path.
  * @param {object} [router] The app's router.
  * @return {boolean} True when the app navigated.
  */
@@ -97,8 +100,8 @@ function followLinkClick(event, target, router) {
  *
  * A click that came from a control inside the surface (a button, a link, a
  * checkbox) is left to that control. Opening a new tab marks the event with
- * `preventDefault()`, and an event already marked that way is skipped, so
- * two listeners on the same click never open two tabs.
+ * `markNewTabHandled`, and an event already marked is skipped, so two
+ * listeners on the same click never open two tabs.
  *
  * @param {MouseEvent|KeyboardEvent|null|undefined} event The click event.
  * @param {string|object} target A URL, or a vue-router location.

package/dist/esm/utils/linkNavigation.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"linkNavigation.js","sources":["../../../src/utils/linkNavigation.js"],"sourcesContent":["/*\n SPDX-License-Identifier: EUPL-1.2\n * SPDX-FileCopyrightText: 2026 Conduction B.V.\n \n linkNavigation — make navigation behave like a link.\n \n A control whose only job is to go somewhere should be a real `<a href>`, so\n * it can be middle-clicked, opened in a new tab and copied. Two helpers cover\n * the two shapes that needs:\n \n - `followLinkClick` for a real `<a href>` that routes inside the app: a\n * plain click goes through the router, any other click is left to the\n * browser.\n * - `openRowTarget` for a surface that cannot be an `<a>` (a table row, a\n * draggable card): a plain click navigates in place, a ctrl/cmd/shift or\n * middle click opens the target in a new tab. Bind it to both `@click` and\n * `@auxclick`, since a middle click fires only the latter.\n \n A string target is a finished URL. Pass a router path as `{ path }` so the\n * router adds the app's base (`/index.php/apps/<app>`) to its href.\n \n @module utils/linkNavigation\n /\n\nimport { isFromNestedControl, isNewTabClick, isNewTabHandled, markNewTabHandled } from './rowAuxClick.js'\n\n/\n Whether the browser should handle this click itself (new tab, new window,\n * download) instead of the app navigating in place.\n \n @param {MouseEvent\|KeyboardEvent\|null\|undefined} event The click event.\n * @return {boolean} True for a modifier key or a non-primary button.\n /\nexport function isModifiedClick(event) {\n\tif (!event) {\n\t\treturn false\n\t}\n\treturn Boolean(event.metaKey \|\| event.ctrlKey \|\| event.shiftKey \|\| event.altKey\n\t\t\|\| (event.button !== undefined && event.button !== 0))\n}\n\n/\n The href for a navigation target. A string is returned as is, so a router\n * path must be passed as `{ path }` to get the app's base.\n \n @param {string\|object\|null\|undefined} target A URL, or a vue-router location.\n * @param {object} [router] The app's router, needed for a location.\n * @return {string} The href, or '' when it cannot be resolved.\n /\nexport function resolveHref(target, router) {\n\tif (!target) {\n\t\treturn ''\n\t}\n\tif (typeof target === 'string') {\n\t\treturn target\n\t}\n\tif (!router \|\| typeof router.resolve !== 'function') {\n\t\treturn ''\n\t}\n\ttry {\n\t\treturn router.resolve(target).href \|\| ''\n\t} catch {\n\t\treturn ''\n\t}\n}\n\n/\n Click handler for a real `<a href>` that routes inside the app. A plain\n * click is routed through the router; a modified click, or one a handler\n * already prevented, is left to the browser.\n \n @param {MouseEvent} event The click event.\n * @param {string\|object} target The router location the link points at.\n * @param {object} [router] The app's router.\n * @return {boolean} True when the app navigated.\n /\nexport function followLinkClick(event, target, router) {\n\tif (!target \|\| !router \|\| typeof router.push !== 'function') {\n\t\treturn false\n\t}\n\tif (event && (event.defaultPrevented \|\| isModifiedClick(event))) {\n\t\treturn false\n\t}\n\tif (event) {\n\t\tevent.preventDefault()\n\t}\n\t// vue-router rejects the promise on a blocked or duplicate navigation.\n\trouter.push(target).catch(() => {})\n\treturn true\n}\n\n/\n Navigate from a surface that cannot be an `<a>` (a table row, a card),\n * the way a link would: a ctrl/cmd/shift or middle click opens the target\n * in a new tab, a plain click navigates in place.\n \n A click that came from a control inside the surface (a button, a link, a\n * checkbox) is left to that control. Opening a new tab marks the event with\n * `~~preventDefault()~~`, and an event already marked ~~that way~~ is skipped, so\n * ~~two~~ listeners on the same click never open two tabs.\n \n @param {MouseEvent\|KeyboardEvent\|null\|undefined} event The click event.\n * @param {string\|object} target A URL, or a vue-router location.\n * @param {object} [router] The app's router, needed for a location.\n * @return {boolean} True when it navigated.\n */\nexport function openRowTarget(event, target, router) {\n\tif (!target \|\| isNewTabHandled(event) \|\| isFromNestedControl(event)) {\n\t\treturn false\n\t}\n\tif (isNewTabClick(event)) {\n\t\tconst href = resolveHref(target, router)\n\t\tif (!href) {\n\t\t\treturn false\n\t\t}\n\t\twindow.open(href, '_blank', 'noopener,noreferrer')\n\t\tmarkNewTabHandled(event, true)\n\t\treturn true\n\t}\n\t// Only the primary button navigates in place; a right click opens the menu.\n\tif (event && event.button !== undefined && event.button !== 0) {\n\t\treturn false\n\t}\n\tif (typeof target === 'string') {\n\t\twindow.location.assign(target)\n\t\treturn true\n\t}\n\tif (!router \|\| typeof router.push !== 'function') {\n\t\treturn false\n\t}\n\trouter.push(target).catch(() => {})\n\treturn true\n}\n"],"names":[],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,eAAe,CAAC,KAAK,EAAE;AACvC,CAAC,IAAI,CAAC,KAAK,EAAE;AACb,EAAE,OAAO,KAAK;AACd,EAAE;AACF,CAAC,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM;AAChF,MAAM,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;AACxD,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE;AAC5C,CAAC,IAAI,CAAC,MAAM,EAAE;AACd,EAAE,OAAO,EAAE;AACX,EAAE;AACF,CAAC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE;AACjC,EAAE,OAAO,MAAM;AACf,EAAE;AACF,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,UAAU,EAAE;AACtD,EAAE,OAAO,EAAE;AACX,EAAE;AACF,CAAC,IAAI;AACL,EAAE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,EAAE;AAC1C,EAAE,CAAC,MAAM;AACT,EAAE,OAAO,EAAE;AACX,EAAE;AACF,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE;AACvD,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE;AAC9D,EAAE,OAAO,KAAK;AACd,EAAE;AACF,CAAC,IAAI,KAAK,KAAK,KAAK,CAAC,gBAAgB,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE;AAClE,EAAE,OAAO,KAAK;AACd,EAAE;AACF,CAAC,IAAI,KAAK,EAAE;AACZ,EAAE,KAAK,CAAC,cAAc,GAAE;AACxB,EAAE;AACF;AACA,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,EAAC;AACpC,CAAC,OAAO,IAAI;AACZ,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE;AACrD,CAAC,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC,KAAK,CAAC,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE;AACtE,EAAE,OAAO,KAAK;AACd,EAAE;AACF,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE;AAC3B,EAAE,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,EAAC;AAC1C,EAAE,IAAI,CAAC,IAAI,EAAE;AACb,GAAG,OAAO,KAAK;AACf,GAAG;AACH,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,qBAAqB,EAAC;AACpD,EAAE,iBAAiB,CAAC,KAAK,EAAE,IAAI,EAAC;AAChC,EAAE,OAAO,IAAI;AACb,EAAE;AACF;AACA,CAAC,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE;AAChE,EAAE,OAAO,KAAK;AACd,EAAE;AACF,CAAC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE;AACjC,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAC;AAChC,EAAE,OAAO,IAAI;AACb,EAAE;AACF,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE;AACnD,EAAE,OAAO,KAAK;AACd,EAAE;AACF,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,EAAC;AACpC,CAAC,OAAO,IAAI;AACZ;;;;"}
1	+ {"version":3,"file":"linkNavigation.js","sources":["../../../src/utils/linkNavigation.js"],"sourcesContent":["/*\n SPDX-License-Identifier: EUPL-1.2\n * SPDX-FileCopyrightText: 2026 Conduction B.V.\n \n linkNavigation — make navigation behave like a link.\n \n A control whose only job is to go somewhere should be a real `<a href>`, so\n * it can be middle-clicked, opened in a new tab and copied. Two helpers cover\n * the two shapes that needs:\n \n - `followLinkClick` for a real `<a href>` that routes inside the app: a\n * plain click goes through the router, any other click is left to the\n * browser.\n * - `openRowTarget` for a surface that cannot be an `<a>` (a table row, a\n * draggable card): a plain click navigates in place, a ctrl/cmd/shift or\n * middle click opens the target in a new tab. Bind it to both `@click` and\n * `@auxclick`, since a middle click fires only the latter.\n \n A string target is a finished URL. Pass a router path as `{ path }` so the\n * router adds the app's base (`/index.php/apps/<app>`) to its href.\n \n @module utils/linkNavigation\n /\n\nimport { isFromNestedControl, isNewTabClick, isNewTabHandled, markNewTabHandled } from './rowAuxClick.js'\n\n/\n Whether the browser should handle this click itself (new tab, new window,\n * download) instead of the app navigating in place.\n \n @param {MouseEvent\|KeyboardEvent\|null\|undefined} event The click event.\n * @return {boolean} True for a modifier key or a non-primary button.\n /\nexport function isModifiedClick(event) {\n\tif (!event) {\n\t\treturn false\n\t}\n\treturn Boolean(event.metaKey \|\| event.ctrlKey \|\| event.shiftKey \|\| event.altKey\n\t\t\|\| (event.button !== undefined && event.button !== 0))\n}\n\n/\n The href for a navigation target. A string is returned as is, so a router\n * path must be passed as `{ path }` to get the app's base.\n \n @param {string\|object\|null\|undefined} target A URL, or a vue-router location.\n * @param {object} [router] The app's router, needed for a location.\n * @return {string} The href, or '' when it cannot be resolved.\n /\nexport function resolveHref(target, router) {\n\tif (!target) {\n\t\treturn ''\n\t}\n\tif (typeof target === 'string') {\n\t\treturn target\n\t}\n\tif (!router \|\| typeof router.resolve !== 'function') {\n\t\treturn ''\n\t}\n\ttry {\n\t\treturn router.resolve(target).href \|\| ''\n\t} catch {\n\t\treturn ''\n\t}\n}\n\n/\n Click handler for a real `<a href>` that routes inside the app. A plain\n * click is routed through the router; a modified click, or one a handler\n * already prevented, is left to the browser.\n \n Unlike `resolveHref`, a string target is a router path, so pair the two\n * with a location object (or `{ path }`) for the href and click to agree.\n \n @param {MouseEvent} event The click event.\n * @param {string\|object} target The router location the link points at; a string is a router path.\n * @param {object} [router] The app's router.\n * @return {boolean} True when the app navigated.\n /\nexport function followLinkClick(event, target, router) {\n\tif (!target \|\| !router \|\| typeof router.push !== 'function') {\n\t\treturn false\n\t}\n\tif (event && (event.defaultPrevented \|\| isModifiedClick(event))) {\n\t\treturn false\n\t}\n\tif (event) {\n\t\tevent.preventDefault()\n\t}\n\t// vue-router rejects the promise on a blocked or duplicate navigation.\n\trouter.push(target).catch(() => {})\n\treturn true\n}\n\n/\n Navigate from a surface that cannot be an `<a>` (a table row, a card),\n * the way a link would: a ctrl/cmd/shift or middle click opens the target\n * in a new tab, a plain click navigates in place.\n \n A click that came from a control inside the surface (a button, a link, a\n * checkbox) is left to that control. Opening a new tab marks the event with\n * `markNewTabHandled`, and an event already marked is skipped, so two\n * listeners on the same click never open two tabs.\n \n @param {MouseEvent\|KeyboardEvent\|null\|undefined} event The click event.\n * @param {string\|object} target A URL, or a vue-router location.\n * @param {object} [router] The app's router, needed for a location.\n * @return {boolean} True when it navigated.\n */\nexport function openRowTarget(event, target, router) {\n\tif (!target \|\| isNewTabHandled(event) \|\| isFromNestedControl(event)) {\n\t\treturn false\n\t}\n\tif (isNewTabClick(event)) {\n\t\tconst href = resolveHref(target, router)\n\t\tif (!href) {\n\t\t\treturn false\n\t\t}\n\t\twindow.open(href, '_blank', 'noopener,noreferrer')\n\t\tmarkNewTabHandled(event, true)\n\t\treturn true\n\t}\n\t// Only the primary button navigates in place; a right click opens the menu.\n\tif (event && event.button !== undefined && event.button !== 0) {\n\t\treturn false\n\t}\n\tif (typeof target === 'string') {\n\t\twindow.location.assign(target)\n\t\treturn true\n\t}\n\tif (!router \|\| typeof router.push !== 'function') {\n\t\treturn false\n\t}\n\trouter.push(target).catch(() => {})\n\treturn true\n}\n"],"names":[],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,eAAe,CAAC,KAAK,EAAE;AACvC,CAAC,IAAI,CAAC,KAAK,EAAE;AACb,EAAE,OAAO,KAAK;AACd,EAAE;AACF,CAAC,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM;AAChF,MAAM,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;AACxD,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE;AAC5C,CAAC,IAAI,CAAC,MAAM,EAAE;AACd,EAAE,OAAO,EAAE;AACX,EAAE;AACF,CAAC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE;AACjC,EAAE,OAAO,MAAM;AACf,EAAE;AACF,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,UAAU,EAAE;AACtD,EAAE,OAAO,EAAE;AACX,EAAE;AACF,CAAC,IAAI;AACL,EAAE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,EAAE;AAC1C,EAAE,CAAC,MAAM;AACT,EAAE,OAAO,EAAE;AACX,EAAE;AACF,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE;AACvD,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE;AAC9D,EAAE,OAAO,KAAK;AACd,EAAE;AACF,CAAC,IAAI,KAAK,KAAK,KAAK,CAAC,gBAAgB,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE;AAClE,EAAE,OAAO,KAAK;AACd,EAAE;AACF,CAAC,IAAI,KAAK,EAAE;AACZ,EAAE,KAAK,CAAC,cAAc,GAAE;AACxB,EAAE;AACF;AACA,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,EAAC;AACpC,CAAC,OAAO,IAAI;AACZ,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE;AACrD,CAAC,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC,KAAK,CAAC,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE;AACtE,EAAE,OAAO,KAAK;AACd,EAAE;AACF,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE;AAC3B,EAAE,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,EAAC;AAC1C,EAAE,IAAI,CAAC,IAAI,EAAE;AACb,GAAG,OAAO,KAAK;AACf,GAAG;AACH,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,qBAAqB,EAAC;AACpD,EAAE,iBAAiB,CAAC,KAAK,EAAE,IAAI,EAAC;AAChC,EAAE,OAAO,IAAI;AACb,EAAE;AACF;AACA,CAAC,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE;AAChE,EAAE,OAAO,KAAK;AACd,EAAE;AACF,CAAC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE;AACjC,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAC;AAChC,EAAE,OAAO,IAAI;AACb,EAAE;AACF,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE;AACnD,EAAE,OAAO,KAAK;AACd,EAAE;AACF,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,EAAC;AACpC,CAAC,OAAO,IAAI;AACZ;;;;"}

package/dist/esm/utils/readPath.js ADDED Viewed

@@ -0,0 +1,30 @@
+/**
+ * SPDX-FileCopyrightText: 2026 Conduction B.V.
+ * SPDX-License-Identifier: EUPL-1.2
+ *
+ * readPath: read a dot-path off an object.
+ *
+ * Its own module, with no imports, so the rules that read a record's fields
+ * (stage, checklist, due date) do not hang on a module a host or a test may
+ * replace.
+ *
+ * @module utils/readPath
+ */
+/**
+ * Read a dot-path (`'a.b.c'`) off an object.
+ *
+ * @param {object|null} data The source object.
+ * @param {string} [path] Dot-path into the object. Empty returns the object itself.
+ * @return {unknown} The value at the path, or undefined when a segment is missing.
+ * @spec openspec/changes/detail-action-model-and-case-surfaces/specs/detail-action-model/spec.md#requirement-primary-action-follows-the-stage
+ */
+function readPath(data, path) {
+	if (!path) {
+		return data
+	}
+	return String(path).split('.').reduce((value, key) => (value === null || value === undefined ? value : value[key]), data)
+}
+export { readPath };
+//# sourceMappingURL=readPath.js.map

package/dist/esm/utils/readPath.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"readPath.js","sources":["../../../src/utils/readPath.js"],"sourcesContent":["/**\n * SPDX-FileCopyrightText: 2026 Conduction B.V.\n * SPDX-License-Identifier: EUPL-1.2\n *\n * readPath: read a dot-path off an object.\n *\n * Its own module, with no imports, so the rules that read a record's fields\n * (stage, checklist, due date) do not hang on a module a host or a test may\n * replace.\n *\n * @module utils/readPath\n */\n\n/**\n * Read a dot-path (`'a.b.c'`) off an object.\n *\n * @param {object|null} data The source object.\n * @param {string} [path] Dot-path into the object. Empty returns the object itself.\n * @return {unknown} The value at the path, or undefined when a segment is missing.\n * @spec openspec/changes/detail-action-model-and-case-surfaces/specs/detail-action-model/spec.md#requirement-primary-action-follows-the-stage\n */\nexport function readPath(data, path) {\n\tif (!path) {\n\t\treturn data\n\t}\n\treturn String(path).split('.').reduce((value, key) => (value === null || value === undefined ? value : value[key]), data)\n}\n"],"names":[],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE;AACrC,CAAC,IAAI,CAAC,IAAI,EAAE;AACZ,EAAE,OAAO,IAAI;AACb,EAAE;AACF,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,GAAG,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,GAAG,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC;AAC1H;;;;"}

package/dist/esm/utils/rowAuxClick.js CHANGED Viewed

@@ -9,13 +9,17 @@
  * also fire `auxclick` for the right button, so a row that listens to it must
  * filter both out itself.
  *
- * Whoever opens a row in a new tab calls `preventDefault()` on the event, so a
- * second listener for the same click (a host behind a library default) can
+ * Whoever opens a row in a new tab marks the event with `markNewTabHandled`, so
+ * a second listener for the same click (a host behind a library default) can
  * check `isNewTabHandled` and not open a second tab.
  *
  * @module utils/rowAuxClick
  */
+// Events that opened a new tab. Not `defaultPrevented`, which any unrelated
+// handler can set on a modified or middle click.
+const newTabHandled = new WeakSet();
 const NESTED_CONTROL = 'a, button, input, select, textarea, label, summary, [role="button"], [role="checkbox"], [role="link"], [contenteditable="true"]';
 /**
@@ -49,6 +53,21 @@ function isRowMiddleClick(event) {
 	return Boolean(event && event.button === 1 && !isFromNestedControl(event))
 }
+/**
+ * Cancel a middle-button press on a clickable row or card body, so the
+ * browser does not start autoscroll (Chrome/Edge on Windows) instead of the
+ * middle click opening the row. A press on a nested control, a link
+ * included, keeps its default.
+ *
+ * @param {MouseEvent} event The mousedown event.
+ * @return {void}
+ */
+function preventMiddleClickAutoscroll(event) {
+	if (event && event.button === 1 && !isFromNestedControl(event) && typeof event.preventDefault === 'function') {
+		event.preventDefault();
+	}
+}
 /**
  * Whether `openRowTarget` would open this click in a new tab.
  *
@@ -66,21 +85,27 @@ function isNewTabClick(event) {
  * @return {boolean}
  */
 function isNewTabHandled(event) {
-	return Boolean(isNewTabClick(event) && event.defaultPrevented)
+	return Boolean(isNewTabClick(event) && newTabHandled.has(event))
 }
 /**
  * Mark a new-tab click as handled after opening it, see `isNewTabHandled`.
+ * Also prevents the event's default, so the browser does not act on the
+ * click as well.
  *
  * @param {MouseEvent|KeyboardEvent|null|undefined} event The click event.
  * @param {boolean} opened Whether the target was opened.
  * @return {void}
  */
 function markNewTabHandled(event, opened) {
-	if (opened && isNewTabClick(event) && typeof event.preventDefault === 'function') {
+	if (!opened || !isNewTabClick(event)) {
+		return
+	}
+	newTabHandled.add(event);
+	if (typeof event.preventDefault === 'function') {
 		event.preventDefault();
 	}
 }
-export { isFromNestedControl, isNewTabClick, isNewTabHandled, isRowMiddleClick, markNewTabHandled };
+export { isFromNestedControl, isNewTabClick, isNewTabHandled, isRowMiddleClick, markNewTabHandled, preventMiddleClickAutoscroll };
 //# sourceMappingURL=rowAuxClick.js.map

package/dist/esm/utils/rowAuxClick.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"rowAuxClick.js","sources":["../../../src/utils/rowAuxClick.js"],"sourcesContent":["/*\n SPDX-License-Identifier: EUPL-1.2\n * SPDX-FileCopyrightText: 2026 Conduction B.V.\n \n rowAuxClick — decide whether an `auxclick` on a clickable row or card is a\n * middle click meant for the row itself.\n \n `@click.stop` on a nested control does not stop `auxclick`, and browsers\n * also fire `auxclick` for the right button, so a row that listens to it must\n * filter both out itself.\n \n Whoever opens a row in a new tab ~~calls~~ ~~`preventDefault()` on~~ the event, so a\n * second listener for the same click (a host behind a library default) can\n * check `isNewTabHandled` and not open a second tab.\n \n @module utils/rowAuxClick\n /\n\nconst NESTED_CONTROL = 'a, button, input, select, textarea, label, summary, [role=\"button\"], [role=\"checkbox\"], [role=\"link\"], [contenteditable=\"true\"]'\n\n/\n Whether the event started on a control nested inside the element that\n * listens for it (not the listening element itself).\n \n @param {Event} event The click or auxclick event.\n * @return {boolean}\n /\nexport function isFromNestedControl(event) {\n\tconst target = event && event.target\n\tconst root = event && event.currentTarget\n\tif (!target \|\| typeof target.closest !== 'function') {\n\t\treturn false\n\t}\n\tconst control = target.closest(NESTED_CONTROL)\n\tif (!control \|\| control === root) {\n\t\treturn false\n\t}\n\treturn !root \|\| typeof root.contains !== 'function' \|\| root.contains(control)\n}\n\n/\n Whether an `auxclick` is a middle click on the row body, which should open\n * the row's target in a new tab.\n \n @param {MouseEvent} event The auxclick event.\n * @return {boolean}\n /\nexport function isRowMiddleClick(event) {\n\treturn Boolean(event && event.button === 1 && !isFromNestedControl(event))\n}\n\n/\n Whether `openRowTarget` would open this click in a new tab.\n \n @param {MouseEvent\|KeyboardEvent\|null\|undefined} event The click event.\n * @return {boolean}\n /\nexport function isNewTabClick(event) {\n\treturn Boolean(event && (event.metaKey \|\| event.ctrlKey \|\| event.shiftKey \|\| event.button === 1))\n}\n\n/\n Whether an earlier listener already opened this click in a new tab.\n \n @param {MouseEvent\|KeyboardEvent\|null\|undefined} event The click event.\n * @return {boolean}\n /\nexport function isNewTabHandled(event) {\n\treturn Boolean(isNewTabClick(event) && event~~.defaultPrevented~~)\n}\n\n/\n Mark a new-tab click as handled after opening it, see `isNewTabHandled`.\n \n @param {MouseEvent\|KeyboardEvent\|null\|undefined} event The click event.\n * @param {boolean} opened Whether the target was opened.\n * @return {void}\n */\nexport function markNewTabHandled(event, opened) {\n\tif (opened && isNewTabClick(event) && typeof event.preventDefault === 'function') {\n\t\tevent.preventDefault()\n\t}\n}\n"],"names":[],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAM,cAAc,GAAG,kIAAiI;AACxJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,mBAAmB,CAAC,KAAK,EAAE;AAC3C,CAAC,MAAM,MAAM,GAAG,KAAK,IAAI,KAAK,CAAC,OAAM;AACrC,CAAC,MAAM,IAAI,GAAG,KAAK,IAAI,KAAK,CAAC,cAAa;AAC1C,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,UAAU,EAAE;AACtD,EAAE,OAAO,KAAK;AACd,EAAE;AACF,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,EAAC;AAC/C,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,IAAI,EAAE;AACnC,EAAE,OAAO,KAAK;AACd,EAAE;AACF,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;AAC9E,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,gBAAgB,CAAC,KAAK,EAAE;AACxC,CAAC,OAAO,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;AAC3E,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,aAAa,CAAC,KAAK,EAAE;AACrC,CAAC,OAAO,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;AAClG,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,eAAe,CAAC,KAAK,EAAE;AACvC,CAAC,OAAO,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,~~KAAK~~,CAAC,~~gBAAgB~~,CAAC;~~AAC/D~~,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE;AACjD,CAAC,IAAI,MAAM,IAAI,aAAa,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,cAAc,KAAK,UAAU,EAAE;~~AACnF~~,EAAE,KAAK,CAAC,cAAc,GAAE;AACxB,EAAE;AACF;;;;"}
1	+ {"version":3,"file":"rowAuxClick.js","sources":["../../../src/utils/rowAuxClick.js"],"sourcesContent":["/*\n SPDX-License-Identifier: EUPL-1.2\n * SPDX-FileCopyrightText: 2026 Conduction B.V.\n \n rowAuxClick — decide whether an `auxclick` on a clickable row or card is a\n * middle click meant for the row itself.\n \n `@click.stop` on a nested control does not stop `auxclick`, and browsers\n * also fire `auxclick` for the right button, so a row that listens to it must\n * filter both out itself.\n \n Whoever opens a row in a new tab marks the event with `markNewTabHandled`, so\n * a second listener for the same click (a host behind a library default) can\n * check `isNewTabHandled` and not open a second tab.\n \n @module utils/rowAuxClick\n /\n\n// Events that opened a new tab. Not `defaultPrevented`, which any unrelated\n// handler can set on a modified or middle click.\nconst newTabHandled = new WeakSet()\n\nconst NESTED_CONTROL = 'a, button, input, select, textarea, label, summary, [role=\"button\"], [role=\"checkbox\"], [role=\"link\"], [contenteditable=\"true\"]'\n\n/\n Whether the event started on a control nested inside the element that\n * listens for it (not the listening element itself).\n \n @param {Event} event The click or auxclick event.\n * @return {boolean}\n /\nexport function isFromNestedControl(event) {\n\tconst target = event && event.target\n\tconst root = event && event.currentTarget\n\tif (!target \|\| typeof target.closest !== 'function') {\n\t\treturn false\n\t}\n\tconst control = target.closest(NESTED_CONTROL)\n\tif (!control \|\| control === root) {\n\t\treturn false\n\t}\n\treturn !root \|\| typeof root.contains !== 'function' \|\| root.contains(control)\n}\n\n/\n Whether an `auxclick` is a middle click on the row body, which should open\n * the row's target in a new tab.\n \n @param {MouseEvent} event The auxclick event.\n * @return {boolean}\n /\nexport function isRowMiddleClick(event) {\n\treturn Boolean(event && event.button === 1 && !isFromNestedControl(event))\n}\n\n/\n Cancel a middle-button press on a clickable row or card body, so the\n * browser does not start autoscroll (Chrome/Edge on Windows) instead of the\n * middle click opening the row. A press on a nested control, a link\n * included, keeps its default.\n \n @param {MouseEvent} event The mousedown event.\n * @return {void}\n /\nexport function preventMiddleClickAutoscroll(event) {\n\tif (event && event.button === 1 && !isFromNestedControl(event) && typeof event.preventDefault === 'function') {\n\t\tevent.preventDefault()\n\t}\n}\n\n/\n Whether `openRowTarget` would open this click in a new tab.\n \n @param {MouseEvent\|KeyboardEvent\|null\|undefined} event The click event.\n * @return {boolean}\n /\nexport function isNewTabClick(event) {\n\treturn Boolean(event && (event.metaKey \|\| event.ctrlKey \|\| event.shiftKey \|\| event.button === 1))\n}\n\n/\n Whether an earlier listener already opened this click in a new tab.\n \n @param {MouseEvent\|KeyboardEvent\|null\|undefined} event The click event.\n * @return {boolean}\n /\nexport function isNewTabHandled(event) {\n\treturn Boolean(isNewTabClick(event) && newTabHandled.has(event))\n}\n\n/\n Mark a new-tab click as handled after opening it, see `isNewTabHandled`.\n * Also prevents the event's default, so the browser does not act on the\n * click as well.\n \n @param {MouseEvent\|KeyboardEvent\|null\|undefined} event The click event.\n * @param {boolean} opened Whether the target was opened.\n * @return {void}\n */\nexport function markNewTabHandled(event, opened) {\n\tif (!opened \|\| !isNewTabClick(event)) {\n\t\treturn\n\t}\n\tnewTabHandled.add(event)\n\tif (typeof event.preventDefault === 'function') {\n\t\tevent.preventDefault()\n\t}\n}\n"],"names":[],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAM,aAAa,GAAG,IAAI,OAAO,GAAE;AACnC;AACA,MAAM,cAAc,GAAG,kIAAiI;AACxJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,mBAAmB,CAAC,KAAK,EAAE;AAC3C,CAAC,MAAM,MAAM,GAAG,KAAK,IAAI,KAAK,CAAC,OAAM;AACrC,CAAC,MAAM,IAAI,GAAG,KAAK,IAAI,KAAK,CAAC,cAAa;AAC1C,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,UAAU,EAAE;AACtD,EAAE,OAAO,KAAK;AACd,EAAE;AACF,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,EAAC;AAC/C,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,IAAI,EAAE;AACnC,EAAE,OAAO,KAAK;AACd,EAAE;AACF,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;AAC9E,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,gBAAgB,CAAC,KAAK,EAAE;AACxC,CAAC,OAAO,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;AAC3E,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,4BAA4B,CAAC,KAAK,EAAE;AACpD,CAAC,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,cAAc,KAAK,UAAU,EAAE;AAC/G,EAAE,KAAK,CAAC,cAAc,GAAE;AACxB,EAAE;AACF,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,aAAa,CAAC,KAAK,EAAE;AACrC,CAAC,OAAO,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;AAClG,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,eAAe,CAAC,KAAK,EAAE;AACvC,CAAC,OAAO,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE;AACjD,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE;AACvC,EAAE,MAAM;AACR,EAAE;AACF,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,EAAC;AACzB,CAAC,IAAI,OAAO,KAAK,CAAC,cAAc,KAAK,UAAU,EAAE;AACjD,EAAE,KAAK,CAAC,cAAc,GAAE;AACxB,EAAE;AACF;;;;"}

package/dist/esm/utils/safeHref.js CHANGED Viewed

@@ -18,6 +18,20 @@
  * @module utils/safeHref
  */
+/**
+ * Whether a URL is protocol-relative the way a browser reads it: leading
+ * control characters and spaces are dropped, tabs and newlines are ignored
+ * anywhere, and a backslash counts as `/`.
+ *
+ * @param {string} url The URL.
+ * @return {boolean}
+ */
+function isProtocolRelative(url) {
+	// eslint-disable-next-line no-control-regex
+	const normalized = url.replace(/[\t\n\r]/g, '').replace(/^[\u0000-\u0020]+/, '');
+	return /^[/\\]{2}/.test(normalized)
+}
 /**
  * Validate a URL and return it only if the scheme is safe for `:href`.
  *
@@ -30,7 +44,8 @@
  *   - `javascript:...`
  *   - `data:...`
  *   - `vbscript:...`
- *   - Protocol-relative `//attacker.com/...` (ambiguous origin)
+ *   - Protocol-relative `//attacker.com/...` (ambiguous origin), also as
+ *     `/\attacker.com` or with leading whitespace
  *   - Any other unrecognised scheme
  *   - `null`, `undefined`, empty string
  *
@@ -52,7 +67,7 @@ function safeHref(url) {
 	}
 	// Reject protocol-relative URLs — `//attacker.com/x` looks like a relative
 	// path but resolves to an arbitrary origin, bypassing same-origin intent.
-	if (url.startsWith('//')) {
+	if (isProtocolRelative(url)) {
 		return '#'
 	}
 	// Allow root-relative paths (same-origin navigation)
@@ -97,7 +112,7 @@ function safeImageSrc(url) {
 		return url
 	}
 	// Reject protocol-relative
-	if (url.startsWith('//')) {
+	if (isProtocolRelative(url)) {
 		return ''
 	}
 	try {

package/dist/esm/utils/safeHref.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"safeHref.js","sources":["../../../src/utils/safeHref.js"],"sourcesContent":["/*\n SPDX-License-Identifier: EUPL-1.2\n * SPDX-FileCopyrightText: 2026 Conduction B.V.\n \n safeHref — URL scheme validation for `:href` bindings.\n \n Components that bind user-controlled URLs to `:href` attributes must\n * validate the scheme before rendering. Without this, a malicious data\n * source returning `javascript:alert(1)` or `data:text/html,...` as a\n * URL would execute code when the user clicks the link.\n \n This utility returns the original URL when the scheme is safe\n * (`https:`, `http:`, `mailto:`) or when the URL is a relative path\n * starting with `/`. It returns `'#'` for all other inputs including\n * `javascript:`, `data:`, `vbscript:`, protocol-relative (`//`), and any\n * other unrecognised scheme.\n \n @module utils/safeHref\n /\n\n/\n Validate a URL and return it only if the scheme is safe for `:href`.\n \n Safe inputs:\n * - `https://...` and `http://...` absolute URLs\n * - `mailto:...` links\n * - Relative paths starting with `/` but NOT `//` (same-origin)\n \n Unsafe inputs (returns `'#'`):\n * - `javascript:...`\n * - `data:...`\n * - `vbscript:...`\n * - Protocol-relative `//attacker.com/...` (ambiguous origin)\n * - Any other unrecognised scheme\n * - `null`, `undefined`, empty string\n \n @param {string\|null\|undefined} url The URL to validate.\n * @return {string} The original URL if safe, or `'#'` otherwise.\n \n @example\n * safeHref('https://example.com') // -> 'https://example.com'\n * safeHref('/apps/files') // -> '/apps/files'\n * safeHref('mailto:info@example.com') // -> 'mailto:info@example.com'\n * safeHref('javascript:alert(1)') // -> '#'\n * safeHref('data:text/html,<h1>x</h1>') // -> '#'\n * safeHref('//attacker.com/x') // -> '#'\n * safeHref(null) // -> '#'\n /\nexport function safeHref(url) {\n\tif (!url \|\| typeof url !== 'string') {\n\t\treturn '#'\n\t}\n\t// Reject protocol-relative URLs — `//attacker.com/x` looks like a relative\n\t// path but resolves to an arbitrary origin, bypassing same-origin intent.\n\tif (url~~.startsWith('//'~~)) {\n\t\treturn '#'\n\t}\n\t// Allow root-relative paths (same-origin navigation)\n\tif (url.startsWith('/')) {\n\t\treturn url\n\t}\n\ttry {\n\t\tconst parsed = new URL(url, window.location.origin)\n\t\tif (['https:', 'http:', 'mailto:'].includes(parsed.protocol)) {\n\t\t\treturn url\n\t\t}\n\t} catch {\n\t\t// URL constructor threw — not a valid absolute URL and not a\n\t\t// relative path either; treat as unsafe.\n\t}\n\treturn '#'\n}\n\n/\n Validate a URL for use in `src` attributes of `<img>` elements.\n \n Allows `https:`, `http:`, and safe `data:image/...` URIs for inline\n * images (PNG, JPEG, GIF, WebP). Rejects all other schemes including\n * `javascript:`, `data:text/html,...`, and protocol-relative URLs.\n \n @param {string\|null\|undefined} url The image URL to validate.\n * @return {string} The original URL if safe, or `''` otherwise.\n \n @example\n * safeImageSrc('https://example.com/logo.png') // -> 'https://...'\n * safeImageSrc('data:image/png;base64,iVBOR...') // -> 'data:image/...'\n * safeImageSrc('data:text/html,<script>alert(1)</script>') // -> ''\n * safeImageSrc('javascript:alert(1)') // -> ''\n * safeImageSrc(null) // -> ''\n /\nexport function safeImageSrc(url) {\n\tif (!url \|\| typeof url !== 'string') {\n\t\treturn ''\n\t}\n\t// Allow safe inline image data URIs (png/jpeg/gif/webp only)\n\tif (/^data:image\\/(png\|jpe?g\|gif\|webp);base64,/i.test(url)) {\n\t\treturn url\n\t}\n\t// Reject protocol-relative\n\tif (url~~.startsWith('//'~~)) {\n\t\treturn ''\n\t}\n\ttry {\n\t\tconst parsed = new URL(url, window.location.origin)\n\t\tif (['https:', 'http:'].includes(parsed.protocol)) {\n\t\t\treturn url\n\t\t}\n\t} catch {\n\t\t// Not a valid URL — unsafe\n\t}\n\treturn ''\n}\n\n/\n SVG path `d` attribute allowlist validator.\n \n Restricts a path string to the characters used by SVG path commands:\n * letters (commands), digits, decimal points, commas, whitespace, and\n * the minus sign. Rejects any string containing other characters (e.g.\n * embedded script, unicode trickery).\n \n Returns the empty string for invalid inputs so a `:d` binding receives\n * an inert value rather than an attacker-controlled string.\n \n @param {string\|null\|undefined} pathData The SVG path `d` value.\n * @return {string} The original string if valid, or `''` otherwise.\n \n @example\n * safeSvgPath('M12 2 L20 20 Z') // -> 'M12 2 L20 20 Z'\n * safeSvgPath('M0,0<script>') // -> ''\n */\nexport function safeSvgPath(pathData) {\n\tif (!pathData \|\| typeof pathData !== 'string') {\n\t\treturn ''\n\t}\n\t// Allowlist: SVG path command letters, digits, decimal points,\n\t// commas, whitespace, minus (for negative coordinates), and `e`/`E`\n\t// for scientific notation in arc radii.\n\tif (/^[MmLlHhVvCcSsQqTtAaZz0-9.,\\s\\-eE]+$/.test(pathData)) {\n\t\treturn pathData\n\t}\n\treturn ''\n}\n"],"names":[],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,QAAQ,CAAC,GAAG,EAAE;AAC9B,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE;AACtC,EAAE,OAAO,GAAG;AACZ,EAAE;AACF;AACA;AACA,CAAC,IAAI,~~GAAG~~,CAAC,~~UAAU~~,CAAC,~~IAAI,CAAC,~~EAAE;~~AAC3B~~,EAAE,OAAO,GAAG;AACZ,EAAE;AACF;AACA,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE;AAC1B,EAAE,OAAO,GAAG;AACZ,EAAE;AACF,CAAC,IAAI;AACL,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAC;AACrD,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE;AAChE,GAAG,OAAO,GAAG;AACb,GAAG;AACH,EAAE,CAAC,MAAM;AACT;AACA;AACA,EAAE;AACF,CAAC,OAAO,GAAG;AACX,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,YAAY,CAAC,GAAG,EAAE;AAClC,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE;AACtC,EAAE,OAAO,EAAE;AACX,EAAE;AACF;AACA,CAAC,IAAI,4CAA4C,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;AAC7D,EAAE,OAAO,GAAG;AACZ,EAAE;AACF;AACA,CAAC,IAAI,~~GAAG~~,CAAC,~~UAAU~~,CAAC,~~IAAI,CAAC,~~EAAE;~~AAC3B~~,EAAE,OAAO,EAAE;AACX,EAAE;AACF,CAAC,IAAI;AACL,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAC;AACrD,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE;AACrD,GAAG,OAAO,GAAG;AACb,GAAG;AACH,EAAE,CAAC,MAAM;AACT;AACA,EAAE;AACF,CAAC,OAAO,EAAE;AACV,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,WAAW,CAAC,QAAQ,EAAE;AACtC,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE;AAChD,EAAE,OAAO,EAAE;AACX,EAAE;AACF;AACA;AACA;AACA,CAAC,IAAI,sCAAsC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;AAC5D,EAAE,OAAO,QAAQ;AACjB,EAAE;AACF,CAAC,OAAO,EAAE;AACV;;;;"}
1	+ {"version":3,"file":"safeHref.js","sources":["../../../src/utils/safeHref.js"],"sourcesContent":["/*\n SPDX-License-Identifier: EUPL-1.2\n * SPDX-FileCopyrightText: 2026 Conduction B.V.\n \n safeHref — URL scheme validation for `:href` bindings.\n \n Components that bind user-controlled URLs to `:href` attributes must\n * validate the scheme before rendering. Without this, a malicious data\n * source returning `javascript:alert(1)` or `data:text/html,...` as a\n * URL would execute code when the user clicks the link.\n \n This utility returns the original URL when the scheme is safe\n * (`https:`, `http:`, `mailto:`) or when the URL is a relative path\n * starting with `/`. It returns `'#'` for all other inputs including\n * `javascript:`, `data:`, `vbscript:`, protocol-relative (`//`), and any\n * other unrecognised scheme.\n \n @module utils/safeHref\n /\n\n/\n Whether a URL is protocol-relative the way a browser reads it: leading\n * control characters and spaces are dropped, tabs and newlines are ignored\n * anywhere, and a backslash counts as `/`.\n \n @param {string} url The URL.\n * @return {boolean}\n /\nfunction isProtocolRelative(url) {\n\t// eslint-disable-next-line no-control-regex\n\tconst normalized = url.replace(/[\\t\\n\\r]/g, '').replace(/^[\\u0000-\\u0020]+/, '')\n\treturn /^[/\\\\]{2}/.test(normalized)\n}\n\n/\n Validate a URL and return it only if the scheme is safe for `:href`.\n \n Safe inputs:\n * - `https://...` and `http://...` absolute URLs\n * - `mailto:...` links\n * - Relative paths starting with `/` but NOT `//` (same-origin)\n \n Unsafe inputs (returns `'#'`):\n * - `javascript:...`\n * - `data:...`\n * - `vbscript:...`\n * - Protocol-relative `//attacker.com/...` (ambiguous origin), also as\n * `/\\attacker.com` or with leading whitespace\n * - Any other unrecognised scheme\n * - `null`, `undefined`, empty string\n \n @param {string\|null\|undefined} url The URL to validate.\n * @return {string} The original URL if safe, or `'#'` otherwise.\n \n @example\n * safeHref('https://example.com') // -> 'https://example.com'\n * safeHref('/apps/files') // -> '/apps/files'\n * safeHref('mailto:info@example.com') // -> 'mailto:info@example.com'\n * safeHref('javascript:alert(1)') // -> '#'\n * safeHref('data:text/html,<h1>x</h1>') // -> '#'\n * safeHref('//attacker.com/x') // -> '#'\n * safeHref(null) // -> '#'\n /\nexport function safeHref(url) {\n\tif (!url \|\| typeof url !== 'string') {\n\t\treturn '#'\n\t}\n\t// Reject protocol-relative URLs — `//attacker.com/x` looks like a relative\n\t// path but resolves to an arbitrary origin, bypassing same-origin intent.\n\tif (isProtocolRelative(url)) {\n\t\treturn '#'\n\t}\n\t// Allow root-relative paths (same-origin navigation)\n\tif (url.startsWith('/')) {\n\t\treturn url\n\t}\n\ttry {\n\t\tconst parsed = new URL(url, window.location.origin)\n\t\tif (['https:', 'http:', 'mailto:'].includes(parsed.protocol)) {\n\t\t\treturn url\n\t\t}\n\t} catch {\n\t\t// URL constructor threw — not a valid absolute URL and not a\n\t\t// relative path either; treat as unsafe.\n\t}\n\treturn '#'\n}\n\n/\n Validate a URL for use in `src` attributes of `<img>` elements.\n \n Allows `https:`, `http:`, and safe `data:image/...` URIs for inline\n * images (PNG, JPEG, GIF, WebP). Rejects all other schemes including\n * `javascript:`, `data:text/html,...`, and protocol-relative URLs.\n \n @param {string\|null\|undefined} url The image URL to validate.\n * @return {string} The original URL if safe, or `''` otherwise.\n \n @example\n * safeImageSrc('https://example.com/logo.png') // -> 'https://...'\n * safeImageSrc('data:image/png;base64,iVBOR...') // -> 'data:image/...'\n * safeImageSrc('data:text/html,<script>alert(1)</script>') // -> ''\n * safeImageSrc('javascript:alert(1)') // -> ''\n * safeImageSrc(null) // -> ''\n /\nexport function safeImageSrc(url) {\n\tif (!url \|\| typeof url !== 'string') {\n\t\treturn ''\n\t}\n\t// Allow safe inline image data URIs (png/jpeg/gif/webp only)\n\tif (/^data:image\\/(png\|jpe?g\|gif\|webp);base64,/i.test(url)) {\n\t\treturn url\n\t}\n\t// Reject protocol-relative\n\tif (isProtocolRelative(url)) {\n\t\treturn ''\n\t}\n\ttry {\n\t\tconst parsed = new URL(url, window.location.origin)\n\t\tif (['https:', 'http:'].includes(parsed.protocol)) {\n\t\t\treturn url\n\t\t}\n\t} catch {\n\t\t// Not a valid URL — unsafe\n\t}\n\treturn ''\n}\n\n/\n SVG path `d` attribute allowlist validator.\n \n Restricts a path string to the characters used by SVG path commands:\n * letters (commands), digits, decimal points, commas, whitespace, and\n * the minus sign. Rejects any string containing other characters (e.g.\n * embedded script, unicode trickery).\n \n Returns the empty string for invalid inputs so a `:d` binding receives\n * an inert value rather than an attacker-controlled string.\n \n @param {string\|null\|undefined} pathData The SVG path `d` value.\n * @return {string} The original string if valid, or `''` otherwise.\n \n @example\n * safeSvgPath('M12 2 L20 20 Z') // -> 'M12 2 L20 20 Z'\n * safeSvgPath('M0,0<script>') // -> ''\n */\nexport function safeSvgPath(pathData) {\n\tif (!pathData \|\| typeof pathData !== 'string') {\n\t\treturn ''\n\t}\n\t// Allowlist: SVG path command letters, digits, decimal points,\n\t// commas, whitespace, minus (for negative coordinates), and `e`/`E`\n\t// for scientific notation in arc radii.\n\tif (/^[MmLlHhVvCcSsQqTtAaZz0-9.,\\s\\-eE]+$/.test(pathData)) {\n\t\treturn pathData\n\t}\n\treturn ''\n}\n"],"names":[],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,kBAAkB,CAAC,GAAG,EAAE;AACjC;AACA,CAAC,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,EAAC;AACjF,CAAC,OAAO,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC;AACpC,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,QAAQ,CAAC,GAAG,EAAE;AAC9B,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE;AACtC,EAAE,OAAO,GAAG;AACZ,EAAE;AACF;AACA;AACA,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE;AAC9B,EAAE,OAAO,GAAG;AACZ,EAAE;AACF;AACA,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE;AAC1B,EAAE,OAAO,GAAG;AACZ,EAAE;AACF,CAAC,IAAI;AACL,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAC;AACrD,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE;AAChE,GAAG,OAAO,GAAG;AACb,GAAG;AACH,EAAE,CAAC,MAAM;AACT;AACA;AACA,EAAE;AACF,CAAC,OAAO,GAAG;AACX,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,YAAY,CAAC,GAAG,EAAE;AAClC,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE;AACtC,EAAE,OAAO,EAAE;AACX,EAAE;AACF;AACA,CAAC,IAAI,4CAA4C,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;AAC7D,EAAE,OAAO,GAAG;AACZ,EAAE;AACF;AACA,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE;AAC9B,EAAE,OAAO,EAAE;AACX,EAAE;AACF,CAAC,IAAI;AACL,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAC;AACrD,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE;AACrD,GAAG,OAAO,GAAG;AACb,GAAG;AACH,EAAE,CAAC,MAAM;AACT;AACA,EAAE;AACF,CAAC,OAAO,EAAE;AACV,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,WAAW,CAAC,QAAQ,EAAE;AACtC,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE;AAChD,EAAE,OAAO,EAAE;AACX,EAAE;AACF;AACA;AACA;AACA,CAAC,IAAI,sCAAsC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;AAC5D,EAAE,OAAO,QAAQ;AACjB,EAAE;AACF,CAAC,OAAO,EAAE;AACV;;;;"}