@flipdish/ui-library 0.17.0 → 0.19.0

package/dist/native/components/atoms/Button/index.js

@@ -1,9 +1,9 @@
 import { jsxs, jsx } from 'react/jsx-runtime';
 import { cx } from '../../../utilities/cx/index.js';
-import { isReactComponent } from '../../../utilities/isReactComponent/index.js';
 import { useResolvedTestId } from '../../../utilities/testIdUtils/index.js';
 import { useState, isValidElement } from 'react';
 import { Pressable, View, ActivityIndicator, Text, Linking } from 'react-native';
+import { isReactComponent } from '../../../utilities/__internal__/componentGuardUtils/componentGuard.utils.js';
 import { styles } from './Button.styles.js';
 
 const LINK_COLORS = ['link-gray', 'link-color', 'link-destructive'];

package/dist/{utilities/isReactComponent/index.d.ts → native/utilities/__internal__/componentGuardUtils/componentGuard.utils.d.ts}

@@ -9,8 +9,8 @@ type ReactComponent = React.FC<any> | React.ComponentClass<any, any> | React.For
  * form; these guards select the "render it yourself" branch.
  *
  * Pure JS with no DOM dependency — works on web (PostCSS) and React Native
- * (NativeWind). Imported by components as
- * `@flipdish/ui-library/utilities/isReactComponent`.
+ * (NativeWind). INTERNAL: imported by components as
+ * `#internal/utilities/componentGuardUtils/componentGuard.utils`.
  */
 /** Checks if a given value is a function component. */
 export declare const isFunctionComponent: (component: any) => component is React.FC<any>;
@@ -21,4 +21,4 @@ export declare const isForwardRefComponent: (component: any) => component is Rea
 /** Checks if a given value is a valid React component (FC, class, or forwardRef). */
 export declare const isReactComponent: (component: any) => component is ReactComponent;
 export {};
-//# sourceMappingURL=index.d.ts.map
+//# sourceMappingURL=componentGuard.utils.d.ts.map

package/dist/native/utilities/__internal__/componentGuardUtils/componentGuard.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"componentGuard.utils.d.ts","sourceRoot":"","sources":["../../../../../src/utilities/__internal__/componentGuardUtils/componentGuard.utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAG/B,KAAK,cAAc,GAAG,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC;AAE5G;;;;;;;;;;;GAWG;AAEH,uDAAuD;AAEvD,eAAO,MAAM,mBAAmB,GAAI,WAAW,GAAG,KAAG,SAAS,IAAI,KAAK,CAAC,EAAE,CAAC,GAAG,CAE7E,CAAC;AAEF,oDAAoD;AAEpD,eAAO,MAAM,gBAAgB,GAAI,WAAW,GAAG,KAAG,SAAS,IAAI,KAAK,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAE3F,CAAC;AAEF,0DAA0D;AAE1D,eAAO,MAAM,qBAAqB,GAAI,WAAW,GAAG,KAAG,SAAS,IAAI,KAAK,CAAC,yBAAyB,CAAC,GAAG,CAEtG,CAAC;AAEF,qFAAqF;AAErF,eAAO,MAAM,gBAAgB,GAAI,WAAW,GAAG,KAAG,SAAS,IAAI,cAE9D,CAAC"}

package/dist/{utilities/isReactComponent/index.js → native/utilities/__internal__/componentGuardUtils/componentGuard.utils.js}

@@ -7,8 +7,8 @@
  * form; these guards select the "render it yourself" branch.
  *
  * Pure JS with no DOM dependency — works on web (PostCSS) and React Native
- * (NativeWind). Imported by components as
- * `@flipdish/ui-library/utilities/isReactComponent`.
+ * (NativeWind). INTERNAL: imported by components as
+ * `#internal/utilities/componentGuardUtils/componentGuard.utils`.
  */
 /** Checks if a given value is a function component. */
 // biome-ignore lint/suspicious/noExplicitAny: required for React component type guard
@@ -32,4 +32,4 @@ const isReactComponent = (component) => {
 };
 
 export { isClassComponent, isForwardRefComponent, isFunctionComponent, isReactComponent };
-//# sourceMappingURL=index.js.map
+//# sourceMappingURL=componentGuard.utils.js.map

package/dist/native/utilities/__internal__/componentGuardUtils/componentGuard.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"componentGuard.utils.js","sources":["../../../../../../src/utilities/__internal__/componentGuardUtils/componentGuard.utils.ts"],"sourcesContent":[null],"names":[],"mappings":"AAMA;;;;;;;;;;;AAWG;AAEH;AACA;AACO,MAAM,mBAAmB,GAAG,CAAC,SAAc,KAAgC;AAChF,IAAA,OAAO,OAAO,SAAS,KAAK,UAAU;AACxC;AAEA;AACA;AACO,MAAM,gBAAgB,GAAG,CAAC,SAAc,KAAiD;IAC9F,OAAO,OAAO,SAAS,KAAK,UAAU,IAAI,SAAS,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,gBAAgB,IAAI,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC;AAC3I;AAEA;AACA;AACO,MAAM,qBAAqB,GAAG,CAAC,SAAc,KAAuD;AACzG,IAAA,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,2BAA2B;AAC9H;AAEA;AACA;AACO,MAAM,gBAAgB,GAAG,CAAC,SAAc,KAAiC;AAC9E,IAAA,OAAO,mBAAmB,CAAC,SAAS,CAAC,IAAI,qBAAqB,CAAC,SAAS,CAAC,IAAI,gBAAgB,CAAC,SAAS,CAAC;AAC1G;;;;"}

package/dist/native/{hooks/useAriaDisclosureAttrs → utilities/hrefUtils}/index.d.ts

@@ -1,12 +1,12 @@
 /**
- * `useAriaDisclosureAttrs` has no React Native implementation.
+ * `hrefUtils` has no React Native implementation.
  *
  * This is a generated types-only stub (scripts/emit-native-stubs.mjs). It exists so
- * that importing `@flipdish/ui-library/hooks/useAriaDisclosureAttrs` from React Native fails at
+ * that importing `@flipdish/ui-library/utilities/hrefUtils` from React Native fails at
  * compile time rather than resolving to the web build's types. There is no
  * matching `index.js`, so Metro cannot bundle this module either.
  *
- * To make `useAriaDisclosureAttrs` available on React Native, add an `index.native.tsx` beside
+ * To make `hrefUtils` available on React Native, add an `index.native.tsx` beside
  * its `index.tsx` — the build picks it up automatically and this stub disappears.
  */
 export declare const __NO_REACT_NATIVE_IMPLEMENTATION__: never;

package/dist/utilities/{isReactComponent/index.cjs → __internal__/componentGuardUtils/componentGuard.utils.cjs}

@@ -9,8 +9,8 @@
  * form; these guards select the "render it yourself" branch.
  *
  * Pure JS with no DOM dependency — works on web (PostCSS) and React Native
- * (NativeWind). Imported by components as
- * `@flipdish/ui-library/utilities/isReactComponent`.
+ * (NativeWind). INTERNAL: imported by components as
+ * `#internal/utilities/componentGuardUtils/componentGuard.utils`.
  */
 /** Checks if a given value is a function component. */
 // biome-ignore lint/suspicious/noExplicitAny: required for React component type guard
@@ -37,4 +37,4 @@ exports.isClassComponent = isClassComponent;
 exports.isForwardRefComponent = isForwardRefComponent;
 exports.isFunctionComponent = isFunctionComponent;
 exports.isReactComponent = isReactComponent;
-//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=componentGuard.utils.cjs.map

package/dist/utilities/__internal__/componentGuardUtils/componentGuard.utils.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"componentGuard.utils.cjs","sources":["../../../../src/utilities/__internal__/componentGuardUtils/componentGuard.utils.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAMA;;;;;;;;;;;AAWG;AAEH;AACA;AACO,MAAM,mBAAmB,GAAG,CAAC,SAAc,KAAgC;AAChF,IAAA,OAAO,OAAO,SAAS,KAAK,UAAU;AACxC;AAEA;AACA;AACO,MAAM,gBAAgB,GAAG,CAAC,SAAc,KAAiD;IAC9F,OAAO,OAAO,SAAS,KAAK,UAAU,IAAI,SAAS,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,gBAAgB,IAAI,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC;AAC3I;AAEA;AACA;AACO,MAAM,qBAAqB,GAAG,CAAC,SAAc,KAAuD;AACzG,IAAA,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,2BAA2B;AAC9H;AAEA;AACA;AACO,MAAM,gBAAgB,GAAG,CAAC,SAAc,KAAiC;AAC9E,IAAA,OAAO,mBAAmB,CAAC,SAAS,CAAC,IAAI,qBAAqB,CAAC,SAAS,CAAC,IAAI,gBAAgB,CAAC,SAAS,CAAC;AAC1G;;;;;;;"}

package/dist/{native/utilities/isReactComponent/index.d.ts → utilities/__internal__/componentGuardUtils/componentGuard.utils.d.ts}

@@ -9,8 +9,8 @@ type ReactComponent = React.FC<any> | React.ComponentClass<any, any> | React.For
  * form; these guards select the "render it yourself" branch.
  *
  * Pure JS with no DOM dependency — works on web (PostCSS) and React Native
- * (NativeWind). Imported by components as
- * `@flipdish/ui-library/utilities/isReactComponent`.
+ * (NativeWind). INTERNAL: imported by components as
+ * `#internal/utilities/componentGuardUtils/componentGuard.utils`.
  */
 /** Checks if a given value is a function component. */
 export declare const isFunctionComponent: (component: any) => component is React.FC<any>;
@@ -21,4 +21,4 @@ export declare const isForwardRefComponent: (component: any) => component is Rea
 /** Checks if a given value is a valid React component (FC, class, or forwardRef). */
 export declare const isReactComponent: (component: any) => component is ReactComponent;
 export {};
-//# sourceMappingURL=index.d.ts.map
+//# sourceMappingURL=componentGuard.utils.d.ts.map

package/dist/utilities/__internal__/componentGuardUtils/componentGuard.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"componentGuard.utils.d.ts","sourceRoot":"","sources":["../../../../src/utilities/__internal__/componentGuardUtils/componentGuard.utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAG/B,KAAK,cAAc,GAAG,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC;AAE5G;;;;;;;;;;;GAWG;AAEH,uDAAuD;AAEvD,eAAO,MAAM,mBAAmB,GAAI,WAAW,GAAG,KAAG,SAAS,IAAI,KAAK,CAAC,EAAE,CAAC,GAAG,CAE7E,CAAC;AAEF,oDAAoD;AAEpD,eAAO,MAAM,gBAAgB,GAAI,WAAW,GAAG,KAAG,SAAS,IAAI,KAAK,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAE3F,CAAC;AAEF,0DAA0D;AAE1D,eAAO,MAAM,qBAAqB,GAAI,WAAW,GAAG,KAAG,SAAS,IAAI,KAAK,CAAC,yBAAyB,CAAC,GAAG,CAEtG,CAAC;AAEF,qFAAqF;AAErF,eAAO,MAAM,gBAAgB,GAAI,WAAW,GAAG,KAAG,SAAS,IAAI,cAE9D,CAAC"}

package/dist/{native/utilities/isReactComponent/index.js → utilities/__internal__/componentGuardUtils/componentGuard.utils.js}

@@ -7,8 +7,8 @@
  * form; these guards select the "render it yourself" branch.
  *
  * Pure JS with no DOM dependency — works on web (PostCSS) and React Native
- * (NativeWind). Imported by components as
- * `@flipdish/ui-library/utilities/isReactComponent`.
+ * (NativeWind). INTERNAL: imported by components as
+ * `#internal/utilities/componentGuardUtils/componentGuard.utils`.
  */
 /** Checks if a given value is a function component. */
 // biome-ignore lint/suspicious/noExplicitAny: required for React component type guard
@@ -32,4 +32,4 @@ const isReactComponent = (component) => {
 };
 
 export { isClassComponent, isForwardRefComponent, isFunctionComponent, isReactComponent };
-//# sourceMappingURL=index.js.map
+//# sourceMappingURL=componentGuard.utils.js.map

package/dist/utilities/__internal__/componentGuardUtils/componentGuard.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"componentGuard.utils.js","sources":["../../../../src/utilities/__internal__/componentGuardUtils/componentGuard.utils.ts"],"sourcesContent":[null],"names":[],"mappings":"AAMA;;;;;;;;;;;AAWG;AAEH;AACA;AACO,MAAM,mBAAmB,GAAG,CAAC,SAAc,KAAgC;AAChF,IAAA,OAAO,OAAO,SAAS,KAAK,UAAU;AACxC;AAEA;AACA;AACO,MAAM,gBAAgB,GAAG,CAAC,SAAc,KAAiD;IAC9F,OAAO,OAAO,SAAS,KAAK,UAAU,IAAI,SAAS,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,gBAAgB,IAAI,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC;AAC3I;AAEA;AACA;AACO,MAAM,qBAAqB,GAAG,CAAC,SAAc,KAAuD;AACzG,IAAA,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,2BAA2B;AAC9H;AAEA;AACA;AACO,MAAM,gBAAgB,GAAG,CAAC,SAAc,KAAiC;AAC9E,IAAA,OAAO,mBAAmB,CAAC,SAAS,CAAC,IAAI,qBAAqB,CAAC,SAAS,CAAC,IAAI,gBAAgB,CAAC,SAAS,CAAC;AAC1G;;;;"}

package/dist/utilities/__internal__/logUtils/log.utils.cjs

@@ -0,0 +1,32 @@
+'use strict';
+
+/**
+ * INTERNAL — not part of the public API.
+ *
+ * `__internal__` modules deliberately have no `index.ts`, so they never match
+ * `PUBLIC_ENTRY_GLOBS` (scripts/entry-manifest.mjs) and the `./utilities/*` exports
+ * map cannot resolve them — consumers physically cannot import this. Library code
+ * imports them via the package-private `#internal/utilities/*` subpath (area-namespaced — add `#internal/hooks/*` etc. as new areas grow internal modules) (package.json `imports`
+ * field, resolved by tsc/Vite/Vitest at source level and rewritten to relative paths
+ * in dist by the rollup `internal-subpath-imports` plugin). Never import via
+ * `@flipdish/ui-library/...` — it resolves in TypeScript but breaks at runtime;
+ * `check-deep-imports.mjs` enforces this.
+ */
+const seenWarnings = new Set();
+/**
+ * Emits a `console.warn` prefixed with the library name, once per `key` for the
+ * lifetime of the module. Use for data-dependent runtime conditions (a blocked
+ * href scheme, a missing account id) that must stay visible in production —
+ * error-tracking tools pick console.warn up as breadcrumbs — without flooding
+ * the console on re-renders.
+ */
+const warnOnce = (key, message) => {
+    if (seenWarnings.has(key)) {
+        return;
+    }
+    seenWarnings.add(key);
+    console.warn(`[@flipdish/ui-library] ${message}`);
+};
+
+exports.warnOnce = warnOnce;
+//# sourceMappingURL=log.utils.cjs.map

package/dist/utilities/__internal__/logUtils/log.utils.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.utils.cjs","sources":["../../../../src/utilities/__internal__/logUtils/log.utils.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;;;;;;;;;AAWG;AAEH,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU;AAEtC;;;;;;AAMG;MACU,QAAQ,GAAG,CAAC,GAAW,EAAE,OAAe,KAAU;AAC7D,IAAA,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;QACzB;IACF;AACA,IAAA,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC;AACrB,IAAA,OAAO,CAAC,IAAI,CAAC,0BAA0B,OAAO,CAAA,CAAE,CAAC;AACnD;;;;"}

package/dist/utilities/__internal__/logUtils/log.utils.d.ts

@@ -0,0 +1,23 @@
+/**
+ * INTERNAL — not part of the public API.
+ *
+ * `__internal__` modules deliberately have no `index.ts`, so they never match
+ * `PUBLIC_ENTRY_GLOBS` (scripts/entry-manifest.mjs) and the `./utilities/*` exports
+ * map cannot resolve them — consumers physically cannot import this. Library code
+ * imports them via the package-private `#internal/utilities/*` subpath (area-namespaced — add `#internal/hooks/*` etc. as new areas grow internal modules) (package.json `imports`
+ * field, resolved by tsc/Vite/Vitest at source level and rewritten to relative paths
+ * in dist by the rollup `internal-subpath-imports` plugin). Never import via
+ * `@flipdish/ui-library/...` — it resolves in TypeScript but breaks at runtime;
+ * `check-deep-imports.mjs` enforces this.
+ */
+/**
+ * Emits a `console.warn` prefixed with the library name, once per `key` for the
+ * lifetime of the module. Use for data-dependent runtime conditions (a blocked
+ * href scheme, a missing account id) that must stay visible in production —
+ * error-tracking tools pick console.warn up as breadcrumbs — without flooding
+ * the console on re-renders.
+ */
+export declare const warnOnce: (key: string, message: string) => void;
+/** Test-only: clears the once-per-key warning memory. */
+export declare const resetWarnOnce: () => void;
+//# sourceMappingURL=log.utils.d.ts.map

package/dist/utilities/__internal__/logUtils/log.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.utils.d.ts","sourceRoot":"","sources":["../../../../src/utilities/__internal__/logUtils/log.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH;;;;;;GAMG;AACH,eAAO,MAAM,QAAQ,GAAI,KAAK,MAAM,EAAE,SAAS,MAAM,KAAG,IAMvD,CAAC;AAEF,yDAAyD;AACzD,eAAO,MAAM,aAAa,QAAO,IAEhC,CAAC"}

package/dist/utilities/__internal__/logUtils/log.utils.js

@@ -0,0 +1,30 @@
+/**
+ * INTERNAL — not part of the public API.
+ *
+ * `__internal__` modules deliberately have no `index.ts`, so they never match
+ * `PUBLIC_ENTRY_GLOBS` (scripts/entry-manifest.mjs) and the `./utilities/*` exports
+ * map cannot resolve them — consumers physically cannot import this. Library code
+ * imports them via the package-private `#internal/utilities/*` subpath (area-namespaced — add `#internal/hooks/*` etc. as new areas grow internal modules) (package.json `imports`
+ * field, resolved by tsc/Vite/Vitest at source level and rewritten to relative paths
+ * in dist by the rollup `internal-subpath-imports` plugin). Never import via
+ * `@flipdish/ui-library/...` — it resolves in TypeScript but breaks at runtime;
+ * `check-deep-imports.mjs` enforces this.
+ */
+const seenWarnings = new Set();
+/**
+ * Emits a `console.warn` prefixed with the library name, once per `key` for the
+ * lifetime of the module. Use for data-dependent runtime conditions (a blocked
+ * href scheme, a missing account id) that must stay visible in production —
+ * error-tracking tools pick console.warn up as breadcrumbs — without flooding
+ * the console on re-renders.
+ */
+const warnOnce = (key, message) => {
+    if (seenWarnings.has(key)) {
+        return;
+    }
+    seenWarnings.add(key);
+    console.warn(`[@flipdish/ui-library] ${message}`);
+};
+
+export { warnOnce };
+//# sourceMappingURL=log.utils.js.map

package/dist/utilities/__internal__/logUtils/log.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.utils.js","sources":["../../../../src/utilities/__internal__/logUtils/log.utils.ts"],"sourcesContent":[null],"names":[],"mappings":"AAAA;;;;;;;;;;;AAWG;AAEH,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU;AAEtC;;;;;;AAMG;MACU,QAAQ,GAAG,CAAC,GAAW,EAAE,OAAe,KAAU;AAC7D,IAAA,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;QACzB;IACF;AACA,IAAA,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC;AACrB,IAAA,OAAO,CAAC,IAAI,CAAC,0BAA0B,OAAO,CAAA,CAAE,CAAC;AACnD;;;;"}

package/dist/utilities/hrefUtils/index.cjs

@@ -0,0 +1,50 @@
+'use strict';
+
+var log_utils = require('../__internal__/logUtils/log.utils.cjs');
+
+const ALLOWED_PROTOCOLS = ['http:', 'https:', 'mailto:', 'tel:'];
+// The only scheme names that may appear in warnings — never consumer input.
+const KNOWN_BLOCKED_SCHEMES = ['javascript:', 'data:', 'vbscript:', 'file:', 'blob:', 'ftp:'];
+// Browsers strip tab/newline (and tolerate other C0 controls) when parsing URLs, so
+// `java\nscript:alert(1)` executes as javascript: — remove them before scheme-checking.
+// biome-ignore lint/suspicious/noControlCharactersInRegex: removing control characters is the point
+const CONTROL_CHARACTERS = /[\u0000-\u001F\u007F]/g;
+/**
+ * Validates a consumer-supplied `href` for safe use on an anchor.
+ *
+ * Strips ASCII control characters, then rejects any explicit scheme outside
+ * http/https/mailto/tel — blocking `javascript:`, `data:` and friends. Scheme-less
+ * values (relative paths, fragments, bare domains) are allowed.
+ *
+ * @returns the cleaned href, or `undefined` when the href is not allowed (rendering
+ * an anchor with no `href` rather than an executable one).
+ */
+const safeHref = (href) => {
+    if (href === undefined) {
+        return undefined;
+    }
+    const cleaned = href.replace(CONTROL_CHARACTERS, '');
+    const scheme = /^[a-z][a-z0-9+.-]*:/i.exec(cleaned.trim())?.[0].toLowerCase();
+    if (scheme && !ALLOWED_PROTOCOLS.includes(scheme)) {
+        // Kept in production builds on purpose: the dangerous input is data-dependent
+        // (CMS content, user profiles) and usually only exists in production. The warning
+        // text and dedupe key only ever use values from the fixed list below — a raw
+        // scheme is consumer input that can embed identifiers (`customer-123:`) and would
+        // grow the dedupe set without bound.
+        const known = KNOWN_BLOCKED_SCHEMES.includes(scheme);
+        log_utils.warnOnce(`safeHref:${known ? scheme : 'other-scheme'}`, `safeHref blocked an href with ${known ? `disallowed scheme "${scheme}"` : 'a non-allowlisted scheme'}. Allowed: http, https, mailto, tel, and relative URLs. The element renders without an href.`);
+        return undefined;
+    }
+    return cleaned;
+};
+/**
+ * Whether an href points at an external site (http/https), for `target="_blank"`
+ * decisions. Unlike a bare `startsWith('http')`, this requires a real scheme match on
+ * the control-character-stripped value, so `javascript:` never classifies as internal
+ * by falling through, and `httpfoo` never classifies as external.
+ */
+const isExternalHref = (href) => /^https?:/i.test((href ?? '').replace(CONTROL_CHARACTERS, '').trim());
+
+exports.isExternalHref = isExternalHref;
+exports.safeHref = safeHref;
+//# sourceMappingURL=index.cjs.map

package/dist/utilities/hrefUtils/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","sources":["../../../src/utilities/hrefUtils/index.ts"],"sourcesContent":[null],"names":["warnOnce"],"mappings":";;;;AAEA,MAAM,iBAAiB,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC;AAEhE;AACA,MAAM,qBAAqB,GAAG,CAAC,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC;AAE7F;AACA;AACA;AACA,MAAM,kBAAkB,GAAG,wBAAwB;AAEnD;;;;;;;;;AASG;AACI,MAAM,QAAQ,GAAG,CAAC,IAAwB,KAAwB;AACvE,IAAA,IAAI,IAAI,KAAK,SAAS,EAAE;AACtB,QAAA,OAAO,SAAS;IAClB;IACA,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC;AACpD,IAAA,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE;IAC7E,IAAI,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE;;;;;;QAMjD,MAAM,KAAK,GAAG,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC;QACpDA,kBAAQ,CACN,CAAA,SAAA,EAAY,KAAK,GAAG,MAAM,GAAG,cAAc,CAAA,CAAE,EAC7C,CAAA,8BAAA,EAAiC,KAAK,GAAG,CAAA,mBAAA,EAAsB,MAAM,CAAA,CAAA,CAAG,GAAG,0BAA0B,CAAA,4FAAA,CAA8F,CACpM;AACD,QAAA,OAAO,SAAS;IAClB;AACA,IAAA,OAAO,OAAO;AAChB;AAEA;;;;;AAKG;AACI,MAAM,cAAc,GAAG,CAAC,IAAwB,KAAc,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;;;;;"}

package/dist/utilities/hrefUtils/index.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Validates a consumer-supplied `href` for safe use on an anchor.
+ *
+ * Strips ASCII control characters, then rejects any explicit scheme outside
+ * http/https/mailto/tel — blocking `javascript:`, `data:` and friends. Scheme-less
+ * values (relative paths, fragments, bare domains) are allowed.
+ *
+ * @returns the cleaned href, or `undefined` when the href is not allowed (rendering
+ * an anchor with no `href` rather than an executable one).
+ */
+export declare const safeHref: (href: string | undefined) => string | undefined;
+/**
+ * Whether an href points at an external site (http/https), for `target="_blank"`
+ * decisions. Unlike a bare `startsWith('http')`, this requires a real scheme match on
+ * the control-character-stripped value, so `javascript:` never classifies as internal
+ * by falling through, and `httpfoo` never classifies as external.
+ */
+export declare const isExternalHref: (href: string | undefined) => boolean;
+//# sourceMappingURL=index.d.ts.map

package/dist/utilities/hrefUtils/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/utilities/hrefUtils/index.ts"],"names":[],"mappings":"AAYA;;;;;;;;;GASG;AACH,eAAO,MAAM,QAAQ,GAAI,MAAM,MAAM,GAAG,SAAS,KAAG,MAAM,GAAG,SAoB5D,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,MAAM,MAAM,GAAG,SAAS,KAAG,OAAgF,CAAC"}

package/dist/utilities/hrefUtils/index.js

@@ -0,0 +1,47 @@
+import { warnOnce } from '../__internal__/logUtils/log.utils.js';
+
+const ALLOWED_PROTOCOLS = ['http:', 'https:', 'mailto:', 'tel:'];
+// The only scheme names that may appear in warnings — never consumer input.
+const KNOWN_BLOCKED_SCHEMES = ['javascript:', 'data:', 'vbscript:', 'file:', 'blob:', 'ftp:'];
+// Browsers strip tab/newline (and tolerate other C0 controls) when parsing URLs, so
+// `java\nscript:alert(1)` executes as javascript: — remove them before scheme-checking.
+// biome-ignore lint/suspicious/noControlCharactersInRegex: removing control characters is the point
+const CONTROL_CHARACTERS = /[\u0000-\u001F\u007F]/g;
+/**
+ * Validates a consumer-supplied `href` for safe use on an anchor.
+ *
+ * Strips ASCII control characters, then rejects any explicit scheme outside
+ * http/https/mailto/tel — blocking `javascript:`, `data:` and friends. Scheme-less
+ * values (relative paths, fragments, bare domains) are allowed.
+ *
+ * @returns the cleaned href, or `undefined` when the href is not allowed (rendering
+ * an anchor with no `href` rather than an executable one).
+ */
+const safeHref = (href) => {
+    if (href === undefined) {
+        return undefined;
+    }
+    const cleaned = href.replace(CONTROL_CHARACTERS, '');
+    const scheme = /^[a-z][a-z0-9+.-]*:/i.exec(cleaned.trim())?.[0].toLowerCase();
+    if (scheme && !ALLOWED_PROTOCOLS.includes(scheme)) {
+        // Kept in production builds on purpose: the dangerous input is data-dependent
+        // (CMS content, user profiles) and usually only exists in production. The warning
+        // text and dedupe key only ever use values from the fixed list below — a raw
+        // scheme is consumer input that can embed identifiers (`customer-123:`) and would
+        // grow the dedupe set without bound.
+        const known = KNOWN_BLOCKED_SCHEMES.includes(scheme);
+        warnOnce(`safeHref:${known ? scheme : 'other-scheme'}`, `safeHref blocked an href with ${known ? `disallowed scheme "${scheme}"` : 'a non-allowlisted scheme'}. Allowed: http, https, mailto, tel, and relative URLs. The element renders without an href.`);
+        return undefined;
+    }
+    return cleaned;
+};
+/**
+ * Whether an href points at an external site (http/https), for `target="_blank"`
+ * decisions. Unlike a bare `startsWith('http')`, this requires a real scheme match on
+ * the control-character-stripped value, so `javascript:` never classifies as internal
+ * by falling through, and `httpfoo` never classifies as external.
+ */
+const isExternalHref = (href) => /^https?:/i.test((href ?? '').replace(CONTROL_CHARACTERS, '').trim());
+
+export { isExternalHref, safeHref };
+//# sourceMappingURL=index.js.map

package/dist/utilities/hrefUtils/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sources":["../../../src/utilities/hrefUtils/index.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAEA,MAAM,iBAAiB,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC;AAEhE;AACA,MAAM,qBAAqB,GAAG,CAAC,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC;AAE7F;AACA;AACA;AACA,MAAM,kBAAkB,GAAG,wBAAwB;AAEnD;;;;;;;;;AASG;AACI,MAAM,QAAQ,GAAG,CAAC,IAAwB,KAAwB;AACvE,IAAA,IAAI,IAAI,KAAK,SAAS,EAAE;AACtB,QAAA,OAAO,SAAS;IAClB;IACA,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC;AACpD,IAAA,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE;IAC7E,IAAI,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE;;;;;;QAMjD,MAAM,KAAK,GAAG,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC;QACpD,QAAQ,CACN,CAAA,SAAA,EAAY,KAAK,GAAG,MAAM,GAAG,cAAc,CAAA,CAAE,EAC7C,CAAA,8BAAA,EAAiC,KAAK,GAAG,CAAA,mBAAA,EAAsB,MAAM,CAAA,CAAA,CAAG,GAAG,0BAA0B,CAAA,4FAAA,CAA8F,CACpM;AACD,QAAA,OAAO,SAAS;IAClB;AACA,IAAA,OAAO,OAAO;AAChB;AAEA;;;;;AAKG;AACI,MAAM,cAAc,GAAG,CAAC,IAAwB,KAAc,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;;;;"}

package/dist/utilities/renderUtils/index.cjs

@@ -14,18 +14,13 @@ const getEnvironmentVariable = (key) => {
     if (typeof process !== 'undefined' && process.env && typeof process.env[key] === 'string') {
         return process.env[key];
     }
-    // Fallback to Vite env when available; use eval to avoid parse errors in non‑Vite/CJS.
-    // `eval('import.meta')` is intentional — `import.meta` is a parse-time syntax error in
-    // CommonJS / non-ESM contexts (e.g. some Node test runners). Using eval defers parsing
-    // until runtime so this util can live in shared library code consumed by both Vite and non-Vite environments.
-    try {
-        // biome-ignore lint/security/noGlobalEval: see comment above — required for cross-runtime import.meta access
-        const viteEnv = eval('import.meta')?.env;
-        return viteEnv?.[key] ?? '';
-    }
-    catch {
-        return '';
-    }
+    // Fallback to Vite env when available. Written as bare `import.meta.env` — legal in
+    // the ESM build and in Vite/Vitest — and rewritten to `undefined` in the CJS output
+    // by the `import-meta-env-cjs-safe` plugin in rollup.config.js, where `import.meta`
+    // would be a parse error. No eval: strict-CSP consumers (no `unsafe-eval`) previously
+    // lost this path silently.
+    const viteEnv = undefined;
+    return viteEnv?.[key] ?? '';
 };
 /**
  * Retrieves a micro-frontend attribute.

package/dist/utilities/renderUtils/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","sources":["../../../src/utilities/renderUtils/index.ts"],"sourcesContent":[null],"names":["lazy","importWithRetry"],"mappings":";;;;;AAIA;;;;;AAKG;AACI,MAAM,sBAAsB,GAAG,CAAC,GAAW,KAAY;;AAE5D,IAAA,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE;AACzF,QAAA,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAW;IACnC;;;;;AAKA,IAAA,IAAI;;QAEF,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,EAAE,GAAqD;AAC1F,QAAA,OAAO,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE;IAC7B;AAAE,IAAA,MAAM;AACN,QAAA,OAAO,EAAE;IACX;AACF;AAEA;;;;;AAKG;AACI,MAAM,yBAAyB,GAAG,CAAC,GAAW,KAAY;AAC/D,IAAA,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE;AACnC,QAAA,OAAO,EAAE;IACX;IACA,MAAM,gBAAgB,GAAG,QAAQ,CAAC,cAAc,CAAC,yBAAyB,CAAC;IAC3E,OAAO,gBAAgB,EAAE,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE;AAClD;AAEA;;;;;;;;AAQG;AACI,MAAM,QAAQ,GAAG,MAAa;AACnC,IAAA,OAAO,sBAAsB,CAAC,qBAAqB,CAAC,IAAI,yBAAyB,CAAC,aAAa,CAAC,IAAI,yBAAyB,CAAC,YAAY,CAAC;AAC7I;AAEA;;;;;;;;AAQG;AACI,MAAM,QAAQ,GAAG,MAAa;AACnC,IAAA,OAAO,sBAAsB,CAAC,qBAAqB,CAAC,IAAI,yBAAyB,CAAC,aAAa,CAAC,IAAI,yBAAyB,CAAC,YAAY,CAAC;AAC7I;AAEA;;;;;;;;AAQG;AACI,MAAM,UAAU,GAAG,MAAa;AACrC,IAAA,OAAO,sBAAsB,CAAC,uBAAuB,CAAC,IAAI,yBAAyB,CAAC,eAAe,CAAC,IAAI,yBAAyB,CAAC,cAAc,CAAC;AACnJ;AAEA;;;;;;;;AAQG;AACI,MAAM,kBAAkB,GAAG,MAAc;AAC9C,IAAA,MAAM,WAAW,GACf,sBAAsB,CAAC,8BAA8B,CAAC;QACtD,yBAAyB,CAAC,wBAAwB,CAAC;QACnD,yBAAyB,CAAC,sBAAsB,CAAC;AACnD,IAAA,OAAO,WAAW,EAAE,QAAQ,EAAE,KAAK,MAAM;AAC3C;AAEA;AACO,MAAM,aAAa,GAAG,CAAC,eAA0B,KAAKA,UAAI,CAAC,MAAMC,qCAAe,CAAC,eAAe,CAAC;;;;;;;;;;"}
+{"version":3,"file":"index.cjs","sources":["../../../src/utilities/renderUtils/index.ts"],"sourcesContent":[null],"names":["lazy","importWithRetry"],"mappings":";;;;;AAIA;;;;;AAKG;AACI,MAAM,sBAAsB,GAAG,CAAC,GAAW,KAAY;;AAE5D,IAAA,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE;AACzF,QAAA,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAW;IACnC;;;;;;AAMA,IAAA,MAAM,OAAO,GAAI,SAA6E;AAC9F,IAAA,OAAO,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE;AAC7B;AAEA;;;;;AAKG;AACI,MAAM,yBAAyB,GAAG,CAAC,GAAW,KAAY;AAC/D,IAAA,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE;AACnC,QAAA,OAAO,EAAE;IACX;IACA,MAAM,gBAAgB,GAAG,QAAQ,CAAC,cAAc,CAAC,yBAAyB,CAAC;IAC3E,OAAO,gBAAgB,EAAE,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE;AAClD;AAEA;;;;;;;;AAQG;AACI,MAAM,QAAQ,GAAG,MAAa;AACnC,IAAA,OAAO,sBAAsB,CAAC,qBAAqB,CAAC,IAAI,yBAAyB,CAAC,aAAa,CAAC,IAAI,yBAAyB,CAAC,YAAY,CAAC;AAC7I;AAEA;;;;;;;;AAQG;AACI,MAAM,QAAQ,GAAG,MAAa;AACnC,IAAA,OAAO,sBAAsB,CAAC,qBAAqB,CAAC,IAAI,yBAAyB,CAAC,aAAa,CAAC,IAAI,yBAAyB,CAAC,YAAY,CAAC;AAC7I;AAEA;;;;;;;;AAQG;AACI,MAAM,UAAU,GAAG,MAAa;AACrC,IAAA,OAAO,sBAAsB,CAAC,uBAAuB,CAAC,IAAI,yBAAyB,CAAC,eAAe,CAAC,IAAI,yBAAyB,CAAC,cAAc,CAAC;AACnJ;AAEA;;;;;;;;AAQG;AACI,MAAM,kBAAkB,GAAG,MAAc;AAC9C,IAAA,MAAM,WAAW,GACf,sBAAsB,CAAC,8BAA8B,CAAC;QACtD,yBAAyB,CAAC,wBAAwB,CAAC;QACnD,yBAAyB,CAAC,sBAAsB,CAAC;AACnD,IAAA,OAAO,WAAW,EAAE,QAAQ,EAAE,KAAK,MAAM;AAC3C;AAEA;AACO,MAAM,aAAa,GAAG,CAAC,eAA0B,KAAKA,UAAI,CAAC,MAAMC,qCAAe,CAAC,eAAe,CAAC;;;;;;;;;;"}

package/dist/utilities/renderUtils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/utilities/renderUtils/index.ts"],"names":[],"mappings":"AAIA;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,GAAI,KAAK,MAAM,KAAG,MAgBpD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,GAAI,KAAK,MAAM,KAAG,MAMvD,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,QAAQ,QAAO,MAE3B,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,QAAQ,QAAO,MAE3B,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,QAAO,MAE7B,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,QAAO,OAMrC,CAAC;AAGF,eAAO,MAAM,aAAa,GAAI,iBAAiB,MAAM,GAAG,4EAAiD,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/utilities/renderUtils/index.ts"],"names":[],"mappings":"AAIA;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,GAAI,KAAK,MAAM,KAAG,MAYpD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,GAAI,KAAK,MAAM,KAAG,MAMvD,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,QAAQ,QAAO,MAE3B,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,QAAQ,QAAO,MAE3B,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,QAAO,MAE7B,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,QAAO,OAMrC,CAAC;AAGF,eAAO,MAAM,aAAa,GAAI,iBAAiB,MAAM,GAAG,4EAAiD,CAAC"}

package/dist/utilities/renderUtils/index.js

@@ -12,18 +12,13 @@ const getEnvironmentVariable = (key) => {
     if (typeof process !== 'undefined' && process.env && typeof process.env[key] === 'string') {
         return process.env[key];
     }
-    // Fallback to Vite env when available; use eval to avoid parse errors in non‑Vite/CJS.
-    // `eval('import.meta')` is intentional — `import.meta` is a parse-time syntax error in
-    // CommonJS / non-ESM contexts (e.g. some Node test runners). Using eval defers parsing
-    // until runtime so this util can live in shared library code consumed by both Vite and non-Vite environments.
-    try {
-        // biome-ignore lint/security/noGlobalEval: see comment above — required for cross-runtime import.meta access
-        const viteEnv = eval('import.meta')?.env;
-        return viteEnv?.[key] ?? '';
-    }
-    catch {
-        return '';
-    }
+    // Fallback to Vite env when available. Written as bare `import.meta.env` — legal in
+    // the ESM build and in Vite/Vitest — and rewritten to `undefined` in the CJS output
+    // by the `import-meta-env-cjs-safe` plugin in rollup.config.js, where `import.meta`
+    // would be a parse error. No eval: strict-CSP consumers (no `unsafe-eval`) previously
+    // lost this path silently.
+    const viteEnv = import.meta.env;
+    return viteEnv?.[key] ?? '';
 };
 /**
  * Retrieves a micro-frontend attribute.

package/dist/utilities/renderUtils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":["../../../src/utilities/renderUtils/index.ts"],"sourcesContent":[null],"names":[],"mappings":";;;AAIA;;;;;AAKG;AACI,MAAM,sBAAsB,GAAG,CAAC,GAAW,KAAY;;AAE5D,IAAA,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE;AACzF,QAAA,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAW;IACnC;;;;;AAKA,IAAA,IAAI;;QAEF,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,EAAE,GAAqD;AAC1F,QAAA,OAAO,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE;IAC7B;AAAE,IAAA,MAAM;AACN,QAAA,OAAO,EAAE;IACX;AACF;AAEA;;;;;AAKG;AACI,MAAM,yBAAyB,GAAG,CAAC,GAAW,KAAY;AAC/D,IAAA,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE;AACnC,QAAA,OAAO,EAAE;IACX;IACA,MAAM,gBAAgB,GAAG,QAAQ,CAAC,cAAc,CAAC,yBAAyB,CAAC;IAC3E,OAAO,gBAAgB,EAAE,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE;AAClD;AAEA;;;;;;;;AAQG;AACI,MAAM,QAAQ,GAAG,MAAa;AACnC,IAAA,OAAO,sBAAsB,CAAC,qBAAqB,CAAC,IAAI,yBAAyB,CAAC,aAAa,CAAC,IAAI,yBAAyB,CAAC,YAAY,CAAC;AAC7I;AAEA;;;;;;;;AAQG;AACI,MAAM,QAAQ,GAAG,MAAa;AACnC,IAAA,OAAO,sBAAsB,CAAC,qBAAqB,CAAC,IAAI,yBAAyB,CAAC,aAAa,CAAC,IAAI,yBAAyB,CAAC,YAAY,CAAC;AAC7I;AAEA;;;;;;;;AAQG;AACI,MAAM,UAAU,GAAG,MAAa;AACrC,IAAA,OAAO,sBAAsB,CAAC,uBAAuB,CAAC,IAAI,yBAAyB,CAAC,eAAe,CAAC,IAAI,yBAAyB,CAAC,cAAc,CAAC;AACnJ;AAEA;;;;;;;;AAQG;AACI,MAAM,kBAAkB,GAAG,MAAc;AAC9C,IAAA,MAAM,WAAW,GACf,sBAAsB,CAAC,8BAA8B,CAAC;QACtD,yBAAyB,CAAC,wBAAwB,CAAC;QACnD,yBAAyB,CAAC,sBAAsB,CAAC;AACnD,IAAA,OAAO,WAAW,EAAE,QAAQ,EAAE,KAAK,MAAM;AAC3C;AAEA;AACO,MAAM,aAAa,GAAG,CAAC,eAA0B,KAAK,IAAI,CAAC,MAAM,eAAe,CAAC,eAAe,CAAC;;;;"}
+{"version":3,"file":"index.js","sources":["../../../src/utilities/renderUtils/index.ts"],"sourcesContent":[null],"names":[],"mappings":";;;AAIA;;;;;AAKG;AACI,MAAM,sBAAsB,GAAG,CAAC,GAAW,KAAY;;AAE5D,IAAA,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE;AACzF,QAAA,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAW;IACnC;;;;;;AAMA,IAAA,MAAM,OAAO,GAAI,MAAM,CAAC,IAAkE,CAAC,GAAG;AAC9F,IAAA,OAAO,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE;AAC7B;AAEA;;;;;AAKG;AACI,MAAM,yBAAyB,GAAG,CAAC,GAAW,KAAY;AAC/D,IAAA,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE;AACnC,QAAA,OAAO,EAAE;IACX;IACA,MAAM,gBAAgB,GAAG,QAAQ,CAAC,cAAc,CAAC,yBAAyB,CAAC;IAC3E,OAAO,gBAAgB,EAAE,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE;AAClD;AAEA;;;;;;;;AAQG;AACI,MAAM,QAAQ,GAAG,MAAa;AACnC,IAAA,OAAO,sBAAsB,CAAC,qBAAqB,CAAC,IAAI,yBAAyB,CAAC,aAAa,CAAC,IAAI,yBAAyB,CAAC,YAAY,CAAC;AAC7I;AAEA;;;;;;;;AAQG;AACI,MAAM,QAAQ,GAAG,MAAa;AACnC,IAAA,OAAO,sBAAsB,CAAC,qBAAqB,CAAC,IAAI,yBAAyB,CAAC,aAAa,CAAC,IAAI,yBAAyB,CAAC,YAAY,CAAC;AAC7I;AAEA;;;;;;;;AAQG;AACI,MAAM,UAAU,GAAG,MAAa;AACrC,IAAA,OAAO,sBAAsB,CAAC,uBAAuB,CAAC,IAAI,yBAAyB,CAAC,eAAe,CAAC,IAAI,yBAAyB,CAAC,cAAc,CAAC;AACnJ;AAEA;;;;;;;;AAQG;AACI,MAAM,kBAAkB,GAAG,MAAc;AAC9C,IAAA,MAAM,WAAW,GACf,sBAAsB,CAAC,8BAA8B,CAAC;QACtD,yBAAyB,CAAC,wBAAwB,CAAC;QACnD,yBAAyB,CAAC,sBAAsB,CAAC;AACnD,IAAA,OAAO,WAAW,EAAE,QAAQ,EAAE,KAAK,MAAM;AAC3C;AAEA;AACO,MAAM,aAAa,GAAG,CAAC,eAA0B,KAAK,IAAI,CAAC,MAAM,eAAe,CAAC,eAAe,CAAC;;;;"}

package/package.json

@@ -1,8 +1,12 @@
 {
   "name": "@flipdish/ui-library",
-  "version": "0.17.0",
+  "version": "0.19.0",
   "description": "Flipdish Design System — atomic-design component library (Tailwind v4 + UntitledUI + React Aria).",
   "type": "module",
+  "imports": {
+    "#internal/hooks/*": "./src/hooks/__internal__/*.ts",
+    "#internal/utilities/*": "./src/utilities/__internal__/*.ts"
+  },
   "sideEffects": [
     "*.css"
   ],

package/dist/hooks/useAriaDisclosureAttrs/index.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.cjs","sources":["../../../src/hooks/useAriaDisclosureAttrs/index.ts"],"sourcesContent":[null],"names":["useEffect"],"mappings":";;;;AAWA;;;;;;;;;;AAUG;AACI,MAAM,sBAAsB,GAAG,CACpC,GAAwB,EACxB,EAAE,YAAY,EAAE,YAAY,EAAiC,KAC3D;IACFA,eAAS,CAAC,MAAK;AACb,QAAA,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO;AACxB,QAAA,IAAI,CAAC,IAAI;YAAE;AAEX,QAAA,IAAI,YAAY,KAAK,SAAS,EAAE;AAC9B,YAAA,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC;QACvC;aAAO;YACL,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAC1D;AAEA,QAAA,IAAI,YAAY,KAAK,SAAS,EAAE;AAC9B,YAAA,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC;QACvC;aAAO;AACL,YAAA,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,YAAY,CAAC;QAClD;IACF,CAAC,EAAE,CAAC,GAAG,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;AACvC;;;;"}

package/dist/hooks/useAriaDisclosureAttrs/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/hooks/useAriaDisclosureAttrs/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,SAAS,EAAa,MAAM,OAAO,CAAC;AAElD,MAAM,WAAW,6BAA6B;IAC5C,iGAAiG;IACjG,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,kGAAkG;IAClG,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,GAAI,CAAC,SAAS,WAAW,EAC1D,KAAK,SAAS,CAAC,CAAC,GAAG,IAAI,CAAC,EACxB,gCAAgC,6BAA6B,SAkB9D,CAAC"}

package/dist/hooks/useAriaDisclosureAttrs/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sources":["../../../src/hooks/useAriaDisclosureAttrs/index.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAWA;;;;;;;;;;AAUG;AACI,MAAM,sBAAsB,GAAG,CACpC,GAAwB,EACxB,EAAE,YAAY,EAAE,YAAY,EAAiC,KAC3D;IACF,SAAS,CAAC,MAAK;AACb,QAAA,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO;AACxB,QAAA,IAAI,CAAC,IAAI;YAAE;AAEX,QAAA,IAAI,YAAY,KAAK,SAAS,EAAE;AAC9B,YAAA,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC;QACvC;aAAO;YACL,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAC1D;AAEA,QAAA,IAAI,YAAY,KAAK,SAAS,EAAE;AAC9B,YAAA,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC;QACvC;aAAO;AACL,YAAA,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,YAAY,CAAC;QAClD;IACF,CAAC,EAAE,CAAC,GAAG,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;AACvC;;;;"}

package/dist/native/utilities/isReactComponent/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/utilities/isReactComponent/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAG/B,KAAK,cAAc,GAAG,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC;AAE5G;;;;;;;;;;;GAWG;AAEH,uDAAuD;AAEvD,eAAO,MAAM,mBAAmB,GAAI,WAAW,GAAG,KAAG,SAAS,IAAI,KAAK,CAAC,EAAE,CAAC,GAAG,CAE7E,CAAC;AAEF,oDAAoD;AAEpD,eAAO,MAAM,gBAAgB,GAAI,WAAW,GAAG,KAAG,SAAS,IAAI,KAAK,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAE3F,CAAC;AAEF,0DAA0D;AAE1D,eAAO,MAAM,qBAAqB,GAAI,WAAW,GAAG,KAAG,SAAS,IAAI,KAAK,CAAC,yBAAyB,CAAC,GAAG,CAEtG,CAAC;AAEF,qFAAqF;AAErF,eAAO,MAAM,gBAAgB,GAAI,WAAW,GAAG,KAAG,SAAS,IAAI,cAE9D,CAAC"}

package/dist/native/utilities/isReactComponent/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sources":["../../../../../src/utilities/isReactComponent/index.ts"],"sourcesContent":[null],"names":[],"mappings":"AAMA;;;;;;;;;;;AAWG;AAEH;AACA;AACO,MAAM,mBAAmB,GAAG,CAAC,SAAc,KAAgC;AAChF,IAAA,OAAO,OAAO,SAAS,KAAK,UAAU;AACxC;AAEA;AACA;AACO,MAAM,gBAAgB,GAAG,CAAC,SAAc,KAAiD;IAC9F,OAAO,OAAO,SAAS,KAAK,UAAU,IAAI,SAAS,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,gBAAgB,IAAI,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC;AAC3I;AAEA;AACA;AACO,MAAM,qBAAqB,GAAG,CAAC,SAAc,KAAuD;AACzG,IAAA,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,2BAA2B;AAC9H;AAEA;AACA;AACO,MAAM,gBAAgB,GAAG,CAAC,SAAc,KAAiC;AAC9E,IAAA,OAAO,mBAAmB,CAAC,SAAS,CAAC,IAAI,qBAAqB,CAAC,SAAS,CAAC,IAAI,gBAAgB,CAAC,SAAS,CAAC;AAC1G;;;;"}

package/dist/utilities/isReactComponent/index.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.cjs","sources":["../../../src/utilities/isReactComponent/index.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAMA;;;;;;;;;;;AAWG;AAEH;AACA;AACO,MAAM,mBAAmB,GAAG,CAAC,SAAc,KAAgC;AAChF,IAAA,OAAO,OAAO,SAAS,KAAK,UAAU;AACxC;AAEA;AACA;AACO,MAAM,gBAAgB,GAAG,CAAC,SAAc,KAAiD;IAC9F,OAAO,OAAO,SAAS,KAAK,UAAU,IAAI,SAAS,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,gBAAgB,IAAI,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC;AAC3I;AAEA;AACA;AACO,MAAM,qBAAqB,GAAG,CAAC,SAAc,KAAuD;AACzG,IAAA,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,2BAA2B;AAC9H;AAEA;AACA;AACO,MAAM,gBAAgB,GAAG,CAAC,SAAc,KAAiC;AAC9E,IAAA,OAAO,mBAAmB,CAAC,SAAS,CAAC,IAAI,qBAAqB,CAAC,SAAS,CAAC,IAAI,gBAAgB,CAAC,SAAS,CAAC;AAC1G;;;;;;;"}

package/dist/utilities/isReactComponent/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/utilities/isReactComponent/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAG/B,KAAK,cAAc,GAAG,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC;AAE5G;;;;;;;;;;;GAWG;AAEH,uDAAuD;AAEvD,eAAO,MAAM,mBAAmB,GAAI,WAAW,GAAG,KAAG,SAAS,IAAI,KAAK,CAAC,EAAE,CAAC,GAAG,CAE7E,CAAC;AAEF,oDAAoD;AAEpD,eAAO,MAAM,gBAAgB,GAAI,WAAW,GAAG,KAAG,SAAS,IAAI,KAAK,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAE3F,CAAC;AAEF,0DAA0D;AAE1D,eAAO,MAAM,qBAAqB,GAAI,WAAW,GAAG,KAAG,SAAS,IAAI,KAAK,CAAC,yBAAyB,CAAC,GAAG,CAEtG,CAAC;AAEF,qFAAqF;AAErF,eAAO,MAAM,gBAAgB,GAAI,WAAW,GAAG,KAAG,SAAS,IAAI,cAE9D,CAAC"}

package/dist/utilities/isReactComponent/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sources":["../../../src/utilities/isReactComponent/index.ts"],"sourcesContent":[null],"names":[],"mappings":"AAMA;;;;;;;;;;;AAWG;AAEH;AACA;AACO,MAAM,mBAAmB,GAAG,CAAC,SAAc,KAAgC;AAChF,IAAA,OAAO,OAAO,SAAS,KAAK,UAAU;AACxC;AAEA;AACA;AACO,MAAM,gBAAgB,GAAG,CAAC,SAAc,KAAiD;IAC9F,OAAO,OAAO,SAAS,KAAK,UAAU,IAAI,SAAS,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,gBAAgB,IAAI,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC;AAC3I;AAEA;AACA;AACO,MAAM,qBAAqB,GAAG,CAAC,SAAc,KAAuD;AACzG,IAAA,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,2BAA2B;AAC9H;AAEA;AACA;AACO,MAAM,gBAAgB,GAAG,CAAC,SAAc,KAAiC;AAC9E,IAAA,OAAO,mBAAmB,CAAC,SAAS,CAAC,IAAI,qBAAqB,CAAC,SAAS,CAAC,IAAI,gBAAgB,CAAC,SAAS,CAAC;AAC1G;;;;"}