@flipdish/ui-library 0.18.0 → 0.20.0

package/dist/utilities/hrefUtils/index.cjs

@@ -0,0 +1,50 @@
+'use strict';
+
+var log_utils = require('../__internal__/logUtils/log.utils.cjs');
+
+const ALLOWED_PROTOCOLS = ['http:', 'https:', 'mailto:', 'tel:'];
+// The only scheme names that may appear in warnings — never consumer input.
+const KNOWN_BLOCKED_SCHEMES = ['javascript:', 'data:', 'vbscript:', 'file:', 'blob:', 'ftp:'];
+// Browsers strip tab/newline (and tolerate other C0 controls) when parsing URLs, so
+// `java\nscript:alert(1)` executes as javascript: — remove them before scheme-checking.
+// biome-ignore lint/suspicious/noControlCharactersInRegex: removing control characters is the point
+const CONTROL_CHARACTERS = /[\u0000-\u001F\u007F]/g;
+/**
+ * Validates a consumer-supplied `href` for safe use on an anchor.
+ *
+ * Strips ASCII control characters, then rejects any explicit scheme outside
+ * http/https/mailto/tel — blocking `javascript:`, `data:` and friends. Scheme-less
+ * values (relative paths, fragments, bare domains) are allowed.
+ *
+ * @returns the cleaned href, or `undefined` when the href is not allowed (rendering
+ * an anchor with no `href` rather than an executable one).
+ */
+const safeHref = (href) => {
+    if (href === undefined) {
+        return undefined;
+    }
+    const cleaned = href.replace(CONTROL_CHARACTERS, '');
+    const scheme = /^[a-z][a-z0-9+.-]*:/i.exec(cleaned.trim())?.[0].toLowerCase();
+    if (scheme && !ALLOWED_PROTOCOLS.includes(scheme)) {
+        // Kept in production builds on purpose: the dangerous input is data-dependent
+        // (CMS content, user profiles) and usually only exists in production. The warning
+        // text and dedupe key only ever use values from the fixed list below — a raw
+        // scheme is consumer input that can embed identifiers (`customer-123:`) and would
+        // grow the dedupe set without bound.
+        const known = KNOWN_BLOCKED_SCHEMES.includes(scheme);
+        log_utils.warnOnce(`safeHref:${known ? scheme : 'other-scheme'}`, `safeHref blocked an href with ${known ? `disallowed scheme "${scheme}"` : 'a non-allowlisted scheme'}. Allowed: http, https, mailto, tel, and relative URLs. The element renders without an href.`);
+        return undefined;
+    }
+    return cleaned;
+};
+/**
+ * Whether an href points at an external site (http/https), for `target="_blank"`
+ * decisions. Unlike a bare `startsWith('http')`, this requires a real scheme match on
+ * the control-character-stripped value, so `javascript:` never classifies as internal
+ * by falling through, and `httpfoo` never classifies as external.
+ */
+const isExternalHref = (href) => /^https?:/i.test((href ?? '').replace(CONTROL_CHARACTERS, '').trim());
+
+exports.isExternalHref = isExternalHref;
+exports.safeHref = safeHref;
+//# sourceMappingURL=index.cjs.map

package/dist/utilities/hrefUtils/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","sources":["../../../src/utilities/hrefUtils/index.ts"],"sourcesContent":[null],"names":["warnOnce"],"mappings":";;;;AAEA,MAAM,iBAAiB,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC;AAEhE;AACA,MAAM,qBAAqB,GAAG,CAAC,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC;AAE7F;AACA;AACA;AACA,MAAM,kBAAkB,GAAG,wBAAwB;AAEnD;;;;;;;;;AASG;AACI,MAAM,QAAQ,GAAG,CAAC,IAAwB,KAAwB;AACvE,IAAA,IAAI,IAAI,KAAK,SAAS,EAAE;AACtB,QAAA,OAAO,SAAS;IAClB;IACA,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC;AACpD,IAAA,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE;IAC7E,IAAI,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE;;;;;;QAMjD,MAAM,KAAK,GAAG,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC;QACpDA,kBAAQ,CACN,CAAA,SAAA,EAAY,KAAK,GAAG,MAAM,GAAG,cAAc,CAAA,CAAE,EAC7C,CAAA,8BAAA,EAAiC,KAAK,GAAG,CAAA,mBAAA,EAAsB,MAAM,CAAA,CAAA,CAAG,GAAG,0BAA0B,CAAA,4FAAA,CAA8F,CACpM;AACD,QAAA,OAAO,SAAS;IAClB;AACA,IAAA,OAAO,OAAO;AAChB;AAEA;;;;;AAKG;AACI,MAAM,cAAc,GAAG,CAAC,IAAwB,KAAc,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;;;;;"}

package/dist/utilities/hrefUtils/index.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Validates a consumer-supplied `href` for safe use on an anchor.
+ *
+ * Strips ASCII control characters, then rejects any explicit scheme outside
+ * http/https/mailto/tel — blocking `javascript:`, `data:` and friends. Scheme-less
+ * values (relative paths, fragments, bare domains) are allowed.
+ *
+ * @returns the cleaned href, or `undefined` when the href is not allowed (rendering
+ * an anchor with no `href` rather than an executable one).
+ */
+export declare const safeHref: (href: string | undefined) => string | undefined;
+/**
+ * Whether an href points at an external site (http/https), for `target="_blank"`
+ * decisions. Unlike a bare `startsWith('http')`, this requires a real scheme match on
+ * the control-character-stripped value, so `javascript:` never classifies as internal
+ * by falling through, and `httpfoo` never classifies as external.
+ */
+export declare const isExternalHref: (href: string | undefined) => boolean;
+//# sourceMappingURL=index.d.ts.map

package/dist/utilities/hrefUtils/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/utilities/hrefUtils/index.ts"],"names":[],"mappings":"AAYA;;;;;;;;;GASG;AACH,eAAO,MAAM,QAAQ,GAAI,MAAM,MAAM,GAAG,SAAS,KAAG,MAAM,GAAG,SAoB5D,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,MAAM,MAAM,GAAG,SAAS,KAAG,OAAgF,CAAC"}

package/dist/utilities/hrefUtils/index.js

@@ -0,0 +1,47 @@
+import { warnOnce } from '../__internal__/logUtils/log.utils.js';
+
+const ALLOWED_PROTOCOLS = ['http:', 'https:', 'mailto:', 'tel:'];
+// The only scheme names that may appear in warnings — never consumer input.
+const KNOWN_BLOCKED_SCHEMES = ['javascript:', 'data:', 'vbscript:', 'file:', 'blob:', 'ftp:'];
+// Browsers strip tab/newline (and tolerate other C0 controls) when parsing URLs, so
+// `java\nscript:alert(1)` executes as javascript: — remove them before scheme-checking.
+// biome-ignore lint/suspicious/noControlCharactersInRegex: removing control characters is the point
+const CONTROL_CHARACTERS = /[\u0000-\u001F\u007F]/g;
+/**
+ * Validates a consumer-supplied `href` for safe use on an anchor.
+ *
+ * Strips ASCII control characters, then rejects any explicit scheme outside
+ * http/https/mailto/tel — blocking `javascript:`, `data:` and friends. Scheme-less
+ * values (relative paths, fragments, bare domains) are allowed.
+ *
+ * @returns the cleaned href, or `undefined` when the href is not allowed (rendering
+ * an anchor with no `href` rather than an executable one).
+ */
+const safeHref = (href) => {
+    if (href === undefined) {
+        return undefined;
+    }
+    const cleaned = href.replace(CONTROL_CHARACTERS, '');
+    const scheme = /^[a-z][a-z0-9+.-]*:/i.exec(cleaned.trim())?.[0].toLowerCase();
+    if (scheme && !ALLOWED_PROTOCOLS.includes(scheme)) {
+        // Kept in production builds on purpose: the dangerous input is data-dependent
+        // (CMS content, user profiles) and usually only exists in production. The warning
+        // text and dedupe key only ever use values from the fixed list below — a raw
+        // scheme is consumer input that can embed identifiers (`customer-123:`) and would
+        // grow the dedupe set without bound.
+        const known = KNOWN_BLOCKED_SCHEMES.includes(scheme);
+        warnOnce(`safeHref:${known ? scheme : 'other-scheme'}`, `safeHref blocked an href with ${known ? `disallowed scheme "${scheme}"` : 'a non-allowlisted scheme'}. Allowed: http, https, mailto, tel, and relative URLs. The element renders without an href.`);
+        return undefined;
+    }
+    return cleaned;
+};
+/**
+ * Whether an href points at an external site (http/https), for `target="_blank"`
+ * decisions. Unlike a bare `startsWith('http')`, this requires a real scheme match on
+ * the control-character-stripped value, so `javascript:` never classifies as internal
+ * by falling through, and `httpfoo` never classifies as external.
+ */
+const isExternalHref = (href) => /^https?:/i.test((href ?? '').replace(CONTROL_CHARACTERS, '').trim());
+
+export { isExternalHref, safeHref };
+//# sourceMappingURL=index.js.map

package/dist/utilities/hrefUtils/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sources":["../../../src/utilities/hrefUtils/index.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAEA,MAAM,iBAAiB,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC;AAEhE;AACA,MAAM,qBAAqB,GAAG,CAAC,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC;AAE7F;AACA;AACA;AACA,MAAM,kBAAkB,GAAG,wBAAwB;AAEnD;;;;;;;;;AASG;AACI,MAAM,QAAQ,GAAG,CAAC,IAAwB,KAAwB;AACvE,IAAA,IAAI,IAAI,KAAK,SAAS,EAAE;AACtB,QAAA,OAAO,SAAS;IAClB;IACA,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC;AACpD,IAAA,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE;IAC7E,IAAI,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE;;;;;;QAMjD,MAAM,KAAK,GAAG,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC;QACpD,QAAQ,CACN,CAAA,SAAA,EAAY,KAAK,GAAG,MAAM,GAAG,cAAc,CAAA,CAAE,EAC7C,CAAA,8BAAA,EAAiC,KAAK,GAAG,CAAA,mBAAA,EAAsB,MAAM,CAAA,CAAA,CAAG,GAAG,0BAA0B,CAAA,4FAAA,CAA8F,CACpM;AACD,QAAA,OAAO,SAAS;IAClB;AACA,IAAA,OAAO,OAAO;AAChB;AAEA;;;;;AAKG;AACI,MAAM,cAAc,GAAG,CAAC,IAAwB,KAAc,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;;;;"}

package/dist/utilities/localStorageUtils/index.cjs

@@ -1,75 +1,18 @@
 'use strict';
 
+var webStorage_utils = require('../__internal__/webStorageUtils/webStorage.utils.cjs');
 var localStorageUtils_constants = require('./localStorageUtils.constants.cjs');
 
 /**
- * Web-only, typed `localStorage` persistence. DOM access (`window.localStorage`)
- * lives here rather than in components, so component code stays free of `window.*`
- * and keeps React Native parity — see `useBreakpoint` for the same isolation
- * pattern. Every helper no-ops / returns `null` when `localStorage` is
- * unavailable (SSR, React Native, private mode, quota errors).
+ * Web-only, typed `localStorage` persistence. Thin wrapper over the shared
+ * `#internal/utilities/webStorageUtils` factory (which `sessionStorageUtils`
+ * also uses — the two modules were byte-identical twins before the factory).
+ * Every helper no-ops / returns `null` when `localStorage` is unavailable
+ * (SSR, React Native, private mode, quota errors).
  *
  * Every key this package persists is registered in `localStorageUtils.constants.ts`
  * — check there for the full list before adding a new one.
  */
-const isBrowser = typeof window !== 'undefined';
-/**
- * Internal `localStorage` primitives backing `createLocalStorageItem`. Not
- * exported — everything a consumer needs goes through `createLocalStorageItem`,
- * which adds typed serialization/validation on top. Add a raw string export
- * here only once a real caller needs plain-string storage without JSON typing.
- */
-/** Read a raw string value, or `null` when unset/unavailable. */
-const safeLocalGet = (key) => {
-    if (!isBrowser)
-        return null;
-    try {
-        return window.localStorage.getItem(key);
-    }
-    catch {
-        return null;
-    }
-};
-/** Persist a raw string value; returns whether the write succeeded. */
-const safeLocalSet = (key, value) => {
-    if (!isBrowser)
-        return false;
-    try {
-        window.localStorage.setItem(key, value);
-        return true;
-    }
-    catch {
-        return false;
-    }
-};
-/** Remove a value; returns whether the removal succeeded. */
-const safeLocalRemove = (key) => {
-    if (!isBrowser)
-        return false;
-    try {
-        window.localStorage.removeItem(key);
-        return true;
-    }
-    catch {
-        return false;
-    }
-};
-/**
- * Reusable `validate` guard for a `createLocalStorageItem<boolean>` item.
- */
-const isBoolean = (value) => typeof value === 'boolean';
-/**
- * Parse a plain `'true'`/`'false'` string (not JSON) into a boolean; throws
- * `errorMessage` for anything else so `createLocalStorageItem.get()` treats it
- * as invalid data and returns `null`.
- */
-const parseBooleanString = (raw, errorMessage) => {
-    if (raw === 'true')
-        return true;
-    if (raw === 'false')
-        return false;
-    throw new Error(errorMessage);
-};
 /**
  * Build a typed, failure-safe accessor for a single `localStorage` key.
  *
@@ -78,51 +21,15 @@ const parseBooleanString = (raw, errorMessage) => {
  * draft.set({ title: 'Hi' });
  * const value = draft.get(); // Draft | null
  */
-const createLocalStorageItem = (key, options = {}) => {
-    const { serialize = JSON.stringify, deserialize = JSON.parse, validate } = options;
-    return {
-        get() {
-            const raw = safeLocalGet(key);
-            if (raw == null)
-                return null;
-            try {
-                const value = deserialize(raw);
-                if (validate && !validate(value))
-                    return null;
-                return value;
-            }
-            catch {
-                return null;
-            }
-        },
-        set(value) {
-            try {
-                const serialized = serialize(value);
-                // JSON.stringify (and a custom serializer) can return `undefined` for a
-                // top-level `undefined`, function, or symbol — treat that as a failed
-                // serialization rather than writing the literal string "undefined".
-                if (typeof serialized !== 'string')
-                    return;
-                safeLocalSet(key, serialized);
-            }
-            catch {
-                // serialize() can throw (e.g. circular refs); matches the documented
-                // failure-safe contract — silently ignore, same as a write failure.
-            }
-        },
-        clear() {
-            safeLocalRemove(key);
-        },
-    };
-};
+const createLocalStorageItem = (key, options = {}) => webStorage_utils.createWebStorageItem(() => window.localStorage, key, options);
 /**
  * Persistence for the `SidebarNavigation` collapsed preference. Stored as the
  * plain strings `'true'` / `'false'` to preserve the original on-disk format.
  */
 const sidebarCollapsedStorage = createLocalStorageItem(localStorageUtils_constants.LOCAL_STORAGE_KEYS.sidebarCollapsed, {
     serialize: String,
-    deserialize: (raw) => parseBooleanString(raw, 'Invalid sidebar collapsed value'),
-    validate: isBoolean,
+    deserialize: (raw) => webStorage_utils.parseBooleanString(raw, 'Invalid sidebar collapsed value'),
+    validate: webStorage_utils.isBoolean,
 });
 
 exports.LOCAL_STORAGE_KEYS = localStorageUtils_constants.LOCAL_STORAGE_KEYS;

package/dist/utilities/localStorageUtils/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","sources":["../../../src/utilities/localStorageUtils/index.ts"],"sourcesContent":[null],"names":["LOCAL_STORAGE_KEYS"],"mappings":";;;;AAAA;;;;;;;;;AASG;AAMH,MAAM,SAAS,GAAG,OAAO,MAAM,KAAK,WAAW;AAE/C;;;;;AAKG;AAEH;AACA,MAAM,YAAY,GAAG,CAAC,GAAW,KAAmB;AAClD,IAAA,IAAI,CAAC,SAAS;AAAE,QAAA,OAAO,IAAI;AAC3B,IAAA,IAAI;QACF,OAAO,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC;IACzC;AAAE,IAAA,MAAM;AACN,QAAA,OAAO,IAAI;IACb;AACF,CAAC;AAED;AACA,MAAM,YAAY,GAAG,CAAC,GAAW,EAAE,KAAa,KAAa;AAC3D,IAAA,IAAI,CAAC,SAAS;AAAE,QAAA,OAAO,KAAK;AAC5B,IAAA,IAAI;QACF,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC;AACvC,QAAA,OAAO,IAAI;IACb;AAAE,IAAA,MAAM;AACN,QAAA,OAAO,KAAK;IACd;AACF,CAAC;AAED;AACA,MAAM,eAAe,GAAG,CAAC,GAAW,KAAa;AAC/C,IAAA,IAAI,CAAC,SAAS;AAAE,QAAA,OAAO,KAAK;AAC5B,IAAA,IAAI;AACF,QAAA,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC;AACnC,QAAA,OAAO,IAAI;IACb;AAAE,IAAA,MAAM;AACN,QAAA,OAAO,KAAK;IACd;AACF,CAAC;AAoBD;;AAEG;AACH,MAAM,SAAS,GAAG,CAAC,KAAc,KAAuB,OAAO,KAAK,KAAK,SAAS;AAElF;;;;AAIG;AACH,MAAM,kBAAkB,GAAG,CAAC,GAAW,EAAE,YAAoB,KAAa;IACxE,IAAI,GAAG,KAAK,MAAM;AAAE,QAAA,OAAO,IAAI;IAC/B,IAAI,GAAG,KAAK,OAAO;AAAE,QAAA,OAAO,KAAK;AACjC,IAAA,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC;AAC/B,CAAC;AAED;;;;;;;AAOG;AACI,MAAM,sBAAsB,GAAG,CAAI,GAAW,EAAE,OAAA,GAAsC,EAAE,KAAyB;AACtH,IAAA,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,WAAW,GAAG,IAAI,CAAC,KAA2B,EAAE,QAAQ,EAAE,GAAG,OAAO;IAExG,OAAO;QACL,GAAG,GAAA;AACD,YAAA,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC;YAC7B,IAAI,GAAG,IAAI,IAAI;AAAE,gBAAA,OAAO,IAAI;AAC5B,YAAA,IAAI;AACF,gBAAA,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC;AAC9B,gBAAA,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;AAAE,oBAAA,OAAO,IAAI;AAC7C,gBAAA,OAAO,KAAK;YACd;AAAE,YAAA,MAAM;AACN,gBAAA,OAAO,IAAI;YACb;QACF,CAAC;AACD,QAAA,GAAG,CAAC,KAAK,EAAA;AACP,YAAA,IAAI;AACF,gBAAA,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC;;;;gBAInC,IAAI,OAAO,UAAU,KAAK,QAAQ;oBAAE;AACpC,gBAAA,YAAY,CAAC,GAAG,EAAE,UAAU,CAAC;YAC/B;AAAE,YAAA,MAAM;;;YAGR;QACF,CAAC;QACD,KAAK,GAAA;YACH,eAAe,CAAC,GAAG,CAAC;QACtB,CAAC;KACF;AACH;AAEA;;;AAGG;MACU,uBAAuB,GAAG,sBAAsB,CAAUA,8CAAkB,CAAC,gBAAgB,EAAE;AAC1G,IAAA,SAAS,EAAE,MAAM;IACjB,WAAW,EAAE,CAAC,GAAG,KAAK,kBAAkB,CAAC,GAAG,EAAE,iCAAiC,CAAC;AAChF,IAAA,QAAQ,EAAE,SAAS;AACpB,CAAA;;;;;;"}
+{"version":3,"file":"index.cjs","sources":["../../../src/utilities/localStorageUtils/index.ts"],"sourcesContent":[null],"names":["createWebStorageItem","LOCAL_STORAGE_KEYS","parseBooleanString","isBoolean"],"mappings":";;;;;AAAA;;;;;;;;;AASG;AA2BH;;;;;;;AAOG;AACI,MAAM,sBAAsB,GAAG,CAAI,GAAW,EAAE,OAAA,GAAsC,EAAE,KAC7FA,qCAAoB,CAAC,MAAM,MAAM,CAAC,YAAY,EAAE,GAAG,EAAE,OAAO;AAE9D;;;AAGG;MACU,uBAAuB,GAAG,sBAAsB,CAAUC,8CAAkB,CAAC,gBAAgB,EAAE;AAC1G,IAAA,SAAS,EAAE,MAAM;IACjB,WAAW,EAAE,CAAC,GAAG,KAAKC,mCAAkB,CAAC,GAAG,EAAE,iCAAiC,CAAC;AAChF,IAAA,QAAQ,EAAEC,0BAAS;AACpB,CAAA;;;;;;"}

package/dist/utilities/localStorageUtils/index.d.ts

@@ -1,9 +1,9 @@
 /**
- * Web-only, typed `localStorage` persistence. DOM access (`window.localStorage`)
- * lives here rather than in components, so component code stays free of `window.*`
- * and keeps React Native parity — see `useBreakpoint` for the same isolation
- * pattern. Every helper no-ops / returns `null` when `localStorage` is
- * unavailable (SSR, React Native, private mode, quota errors).
+ * Web-only, typed `localStorage` persistence. Thin wrapper over the shared
+ * `#internal/utilities/webStorageUtils` factory (which `sessionStorageUtils`
+ * also uses — the two modules were byte-identical twins before the factory).
+ * Every helper no-ops / returns `null` when `localStorage` is unavailable
+ * (SSR, React Native, private mode, quota errors).
  *
  * Every key this package persists is registered in `localStorageUtils.constants.ts`
  * — check there for the full list before adding a new one.

package/dist/utilities/localStorageUtils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/utilities/localStorageUtils/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAEnE,OAAO,EAAE,kBAAkB,EAAE,CAAC;AA2C9B,MAAM,WAAW,gBAAgB,CAAC,CAAC;IACjC,gFAAgF;IAChF,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAChB,wEAAwE;IACxE,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;IACpB,mDAAmD;IACnD,KAAK,IAAI,IAAI,CAAC;CACf;AAED,MAAM,WAAW,uBAAuB,CAAC,CAAC;IACxC,8DAA8D;IAC9D,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,MAAM,CAAC;IACjC,2DAA2D;IAC3D,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,CAAC,CAAC;IACjC,oEAAoE;IACpE,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC;CAC3C;AAkBD;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,GAAI,CAAC,EAAE,KAAK,MAAM,EAAE,UAAS,uBAAuB,CAAC,CAAC,CAAM,KAAG,gBAAgB,CAAC,CAAC,CAgCnH,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,uBAAuB,2BAIlC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/utilities/localStorageUtils/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAEnE,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAI9B,MAAM,WAAW,gBAAgB,CAAC,CAAC;IACjC,gFAAgF;IAChF,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAChB,wEAAwE;IACxE,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;IACpB,mDAAmD;IACnD,KAAK,IAAI,IAAI,CAAC;CACf;AAED,MAAM,WAAW,uBAAuB,CAAC,CAAC;IACxC,8DAA8D;IAC9D,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,MAAM,CAAC;IACjC,2DAA2D;IAC3D,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,CAAC,CAAC;IACjC,oEAAoE;IACpE,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC;CAC3C;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,GAAI,CAAC,EAAE,KAAK,MAAM,EAAE,UAAS,uBAAuB,CAAC,CAAC,CAAM,KAAG,gBAAgB,CAAC,CAAC,CACrD,CAAC;AAEhE;;;GAGG;AACH,eAAO,MAAM,uBAAuB,2BAIlC,CAAC"}

package/dist/utilities/localStorageUtils/index.js

@@ -1,73 +1,16 @@
+import { createWebStorageItem, isBoolean, parseBooleanString } from '../__internal__/webStorageUtils/webStorage.utils.js';
 import { LOCAL_STORAGE_KEYS } from './localStorageUtils.constants.js';
 
 /**
- * Web-only, typed `localStorage` persistence. DOM access (`window.localStorage`)
- * lives here rather than in components, so component code stays free of `window.*`
- * and keeps React Native parity — see `useBreakpoint` for the same isolation
- * pattern. Every helper no-ops / returns `null` when `localStorage` is
- * unavailable (SSR, React Native, private mode, quota errors).
+ * Web-only, typed `localStorage` persistence. Thin wrapper over the shared
+ * `#internal/utilities/webStorageUtils` factory (which `sessionStorageUtils`
+ * also uses — the two modules were byte-identical twins before the factory).
+ * Every helper no-ops / returns `null` when `localStorage` is unavailable
+ * (SSR, React Native, private mode, quota errors).
  *
  * Every key this package persists is registered in `localStorageUtils.constants.ts`
  * — check there for the full list before adding a new one.
  */
-const isBrowser = typeof window !== 'undefined';
-/**
- * Internal `localStorage` primitives backing `createLocalStorageItem`. Not
- * exported — everything a consumer needs goes through `createLocalStorageItem`,
- * which adds typed serialization/validation on top. Add a raw string export
- * here only once a real caller needs plain-string storage without JSON typing.
- */
-/** Read a raw string value, or `null` when unset/unavailable. */
-const safeLocalGet = (key) => {
-    if (!isBrowser)
-        return null;
-    try {
-        return window.localStorage.getItem(key);
-    }
-    catch {
-        return null;
-    }
-};
-/** Persist a raw string value; returns whether the write succeeded. */
-const safeLocalSet = (key, value) => {
-    if (!isBrowser)
-        return false;
-    try {
-        window.localStorage.setItem(key, value);
-        return true;
-    }
-    catch {
-        return false;
-    }
-};
-/** Remove a value; returns whether the removal succeeded. */
-const safeLocalRemove = (key) => {
-    if (!isBrowser)
-        return false;
-    try {
-        window.localStorage.removeItem(key);
-        return true;
-    }
-    catch {
-        return false;
-    }
-};
-/**
- * Reusable `validate` guard for a `createLocalStorageItem<boolean>` item.
- */
-const isBoolean = (value) => typeof value === 'boolean';
-/**
- * Parse a plain `'true'`/`'false'` string (not JSON) into a boolean; throws
- * `errorMessage` for anything else so `createLocalStorageItem.get()` treats it
- * as invalid data and returns `null`.
- */
-const parseBooleanString = (raw, errorMessage) => {
-    if (raw === 'true')
-        return true;
-    if (raw === 'false')
-        return false;
-    throw new Error(errorMessage);
-};
 /**
  * Build a typed, failure-safe accessor for a single `localStorage` key.
  *
@@ -76,43 +19,7 @@ const parseBooleanString = (raw, errorMessage) => {
  * draft.set({ title: 'Hi' });
  * const value = draft.get(); // Draft | null
  */
-const createLocalStorageItem = (key, options = {}) => {
-    const { serialize = JSON.stringify, deserialize = JSON.parse, validate } = options;
-    return {
-        get() {
-            const raw = safeLocalGet(key);
-            if (raw == null)
-                return null;
-            try {
-                const value = deserialize(raw);
-                if (validate && !validate(value))
-                    return null;
-                return value;
-            }
-            catch {
-                return null;
-            }
-        },
-        set(value) {
-            try {
-                const serialized = serialize(value);
-                // JSON.stringify (and a custom serializer) can return `undefined` for a
-                // top-level `undefined`, function, or symbol — treat that as a failed
-                // serialization rather than writing the literal string "undefined".
-                if (typeof serialized !== 'string')
-                    return;
-                safeLocalSet(key, serialized);
-            }
-            catch {
-                // serialize() can throw (e.g. circular refs); matches the documented
-                // failure-safe contract — silently ignore, same as a write failure.
-            }
-        },
-        clear() {
-            safeLocalRemove(key);
-        },
-    };
-};
+const createLocalStorageItem = (key, options = {}) => createWebStorageItem(() => window.localStorage, key, options);
 /**
  * Persistence for the `SidebarNavigation` collapsed preference. Stored as the
  * plain strings `'true'` / `'false'` to preserve the original on-disk format.

package/dist/utilities/localStorageUtils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":["../../../src/utilities/localStorageUtils/index.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;;;;;;;AASG;AAMH,MAAM,SAAS,GAAG,OAAO,MAAM,KAAK,WAAW;AAE/C;;;;;AAKG;AAEH;AACA,MAAM,YAAY,GAAG,CAAC,GAAW,KAAmB;AAClD,IAAA,IAAI,CAAC,SAAS;AAAE,QAAA,OAAO,IAAI;AAC3B,IAAA,IAAI;QACF,OAAO,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC;IACzC;AAAE,IAAA,MAAM;AACN,QAAA,OAAO,IAAI;IACb;AACF,CAAC;AAED;AACA,MAAM,YAAY,GAAG,CAAC,GAAW,EAAE,KAAa,KAAa;AAC3D,IAAA,IAAI,CAAC,SAAS;AAAE,QAAA,OAAO,KAAK;AAC5B,IAAA,IAAI;QACF,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC;AACvC,QAAA,OAAO,IAAI;IACb;AAAE,IAAA,MAAM;AACN,QAAA,OAAO,KAAK;IACd;AACF,CAAC;AAED;AACA,MAAM,eAAe,GAAG,CAAC,GAAW,KAAa;AAC/C,IAAA,IAAI,CAAC,SAAS;AAAE,QAAA,OAAO,KAAK;AAC5B,IAAA,IAAI;AACF,QAAA,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC;AACnC,QAAA,OAAO,IAAI;IACb;AAAE,IAAA,MAAM;AACN,QAAA,OAAO,KAAK;IACd;AACF,CAAC;AAoBD;;AAEG;AACH,MAAM,SAAS,GAAG,CAAC,KAAc,KAAuB,OAAO,KAAK,KAAK,SAAS;AAElF;;;;AAIG;AACH,MAAM,kBAAkB,GAAG,CAAC,GAAW,EAAE,YAAoB,KAAa;IACxE,IAAI,GAAG,KAAK,MAAM;AAAE,QAAA,OAAO,IAAI;IAC/B,IAAI,GAAG,KAAK,OAAO;AAAE,QAAA,OAAO,KAAK;AACjC,IAAA,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC;AAC/B,CAAC;AAED;;;;;;;AAOG;AACI,MAAM,sBAAsB,GAAG,CAAI,GAAW,EAAE,OAAA,GAAsC,EAAE,KAAyB;AACtH,IAAA,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,WAAW,GAAG,IAAI,CAAC,KAA2B,EAAE,QAAQ,EAAE,GAAG,OAAO;IAExG,OAAO;QACL,GAAG,GAAA;AACD,YAAA,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC;YAC7B,IAAI,GAAG,IAAI,IAAI;AAAE,gBAAA,OAAO,IAAI;AAC5B,YAAA,IAAI;AACF,gBAAA,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC;AAC9B,gBAAA,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;AAAE,oBAAA,OAAO,IAAI;AAC7C,gBAAA,OAAO,KAAK;YACd;AAAE,YAAA,MAAM;AACN,gBAAA,OAAO,IAAI;YACb;QACF,CAAC;AACD,QAAA,GAAG,CAAC,KAAK,EAAA;AACP,YAAA,IAAI;AACF,gBAAA,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC;;;;gBAInC,IAAI,OAAO,UAAU,KAAK,QAAQ;oBAAE;AACpC,gBAAA,YAAY,CAAC,GAAG,EAAE,UAAU,CAAC;YAC/B;AAAE,YAAA,MAAM;;;YAGR;QACF,CAAC;QACD,KAAK,GAAA;YACH,eAAe,CAAC,GAAG,CAAC;QACtB,CAAC;KACF;AACH;AAEA;;;AAGG;MACU,uBAAuB,GAAG,sBAAsB,CAAU,kBAAkB,CAAC,gBAAgB,EAAE;AAC1G,IAAA,SAAS,EAAE,MAAM;IACjB,WAAW,EAAE,CAAC,GAAG,KAAK,kBAAkB,CAAC,GAAG,EAAE,iCAAiC,CAAC;AAChF,IAAA,QAAQ,EAAE,SAAS;AACpB,CAAA;;;;"}
+{"version":3,"file":"index.js","sources":["../../../src/utilities/localStorageUtils/index.ts"],"sourcesContent":[null],"names":[],"mappings":";;;AAAA;;;;;;;;;AASG;AA2BH;;;;;;;AAOG;AACI,MAAM,sBAAsB,GAAG,CAAI,GAAW,EAAE,OAAA,GAAsC,EAAE,KAC7F,oBAAoB,CAAC,MAAM,MAAM,CAAC,YAAY,EAAE,GAAG,EAAE,OAAO;AAE9D;;;AAGG;MACU,uBAAuB,GAAG,sBAAsB,CAAU,kBAAkB,CAAC,gBAAgB,EAAE;AAC1G,IAAA,SAAS,EAAE,MAAM;IACjB,WAAW,EAAE,CAAC,GAAG,KAAK,kBAAkB,CAAC,GAAG,EAAE,iCAAiC,CAAC;AAChF,IAAA,QAAQ,EAAE,SAAS;AACpB,CAAA;;;;"}

package/dist/utilities/renderUtils/index.cjs

@@ -14,18 +14,13 @@ const getEnvironmentVariable = (key) => {
     if (typeof process !== 'undefined' && process.env && typeof process.env[key] === 'string') {
         return process.env[key];
     }
-    // Fallback to Vite env when available; use eval to avoid parse errors in non‑Vite/CJS.
-    // `eval('import.meta')` is intentional — `import.meta` is a parse-time syntax error in
-    // CommonJS / non-ESM contexts (e.g. some Node test runners). Using eval defers parsing
-    // until runtime so this util can live in shared library code consumed by both Vite and non-Vite environments.
-    try {
-        // biome-ignore lint/security/noGlobalEval: see comment above — required for cross-runtime import.meta access
-        const viteEnv = eval('import.meta')?.env;
-        return viteEnv?.[key] ?? '';
-    }
-    catch {
-        return '';
-    }
+    // Fallback to Vite env when available. Written as bare `import.meta.env` — legal in
+    // the ESM build and in Vite/Vitest — and rewritten to `undefined` in the CJS output
+    // by the `import-meta-env-cjs-safe` plugin in rollup.config.js, where `import.meta`
+    // would be a parse error. No eval: strict-CSP consumers (no `unsafe-eval`) previously
+    // lost this path silently.
+    const viteEnv = undefined;
+    return viteEnv?.[key] ?? '';
 };
 /**
  * Retrieves a micro-frontend attribute.

package/dist/utilities/renderUtils/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","sources":["../../../src/utilities/renderUtils/index.ts"],"sourcesContent":[null],"names":["lazy","importWithRetry"],"mappings":";;;;;AAIA;;;;;AAKG;AACI,MAAM,sBAAsB,GAAG,CAAC,GAAW,KAAY;;AAE5D,IAAA,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE;AACzF,QAAA,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAW;IACnC;;;;;AAKA,IAAA,IAAI;;QAEF,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,EAAE,GAAqD;AAC1F,QAAA,OAAO,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE;IAC7B;AAAE,IAAA,MAAM;AACN,QAAA,OAAO,EAAE;IACX;AACF;AAEA;;;;;AAKG;AACI,MAAM,yBAAyB,GAAG,CAAC,GAAW,KAAY;AAC/D,IAAA,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE;AACnC,QAAA,OAAO,EAAE;IACX;IACA,MAAM,gBAAgB,GAAG,QAAQ,CAAC,cAAc,CAAC,yBAAyB,CAAC;IAC3E,OAAO,gBAAgB,EAAE,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE;AAClD;AAEA;;;;;;;;AAQG;AACI,MAAM,QAAQ,GAAG,MAAa;AACnC,IAAA,OAAO,sBAAsB,CAAC,qBAAqB,CAAC,IAAI,yBAAyB,CAAC,aAAa,CAAC,IAAI,yBAAyB,CAAC,YAAY,CAAC;AAC7I;AAEA;;;;;;;;AAQG;AACI,MAAM,QAAQ,GAAG,MAAa;AACnC,IAAA,OAAO,sBAAsB,CAAC,qBAAqB,CAAC,IAAI,yBAAyB,CAAC,aAAa,CAAC,IAAI,yBAAyB,CAAC,YAAY,CAAC;AAC7I;AAEA;;;;;;;;AAQG;AACI,MAAM,UAAU,GAAG,MAAa;AACrC,IAAA,OAAO,sBAAsB,CAAC,uBAAuB,CAAC,IAAI,yBAAyB,CAAC,eAAe,CAAC,IAAI,yBAAyB,CAAC,cAAc,CAAC;AACnJ;AAEA;;;;;;;;AAQG;AACI,MAAM,kBAAkB,GAAG,MAAc;AAC9C,IAAA,MAAM,WAAW,GACf,sBAAsB,CAAC,8BAA8B,CAAC;QACtD,yBAAyB,CAAC,wBAAwB,CAAC;QACnD,yBAAyB,CAAC,sBAAsB,CAAC;AACnD,IAAA,OAAO,WAAW,EAAE,QAAQ,EAAE,KAAK,MAAM;AAC3C;AAEA;AACO,MAAM,aAAa,GAAG,CAAC,eAA0B,KAAKA,UAAI,CAAC,MAAMC,qCAAe,CAAC,eAAe,CAAC;;;;;;;;;;"}
+{"version":3,"file":"index.cjs","sources":["../../../src/utilities/renderUtils/index.ts"],"sourcesContent":[null],"names":["lazy","importWithRetry"],"mappings":";;;;;AAIA;;;;;AAKG;AACI,MAAM,sBAAsB,GAAG,CAAC,GAAW,KAAY;;AAE5D,IAAA,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE;AACzF,QAAA,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAW;IACnC;;;;;;AAMA,IAAA,MAAM,OAAO,GAAI,SAA6E;AAC9F,IAAA,OAAO,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE;AAC7B;AAEA;;;;;AAKG;AACI,MAAM,yBAAyB,GAAG,CAAC,GAAW,KAAY;AAC/D,IAAA,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE;AACnC,QAAA,OAAO,EAAE;IACX;IACA,MAAM,gBAAgB,GAAG,QAAQ,CAAC,cAAc,CAAC,yBAAyB,CAAC;IAC3E,OAAO,gBAAgB,EAAE,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE;AAClD;AAEA;;;;;;;;AAQG;AACI,MAAM,QAAQ,GAAG,MAAa;AACnC,IAAA,OAAO,sBAAsB,CAAC,qBAAqB,CAAC,IAAI,yBAAyB,CAAC,aAAa,CAAC,IAAI,yBAAyB,CAAC,YAAY,CAAC;AAC7I;AAEA;;;;;;;;AAQG;AACI,MAAM,QAAQ,GAAG,MAAa;AACnC,IAAA,OAAO,sBAAsB,CAAC,qBAAqB,CAAC,IAAI,yBAAyB,CAAC,aAAa,CAAC,IAAI,yBAAyB,CAAC,YAAY,CAAC;AAC7I;AAEA;;;;;;;;AAQG;AACI,MAAM,UAAU,GAAG,MAAa;AACrC,IAAA,OAAO,sBAAsB,CAAC,uBAAuB,CAAC,IAAI,yBAAyB,CAAC,eAAe,CAAC,IAAI,yBAAyB,CAAC,cAAc,CAAC;AACnJ;AAEA;;;;;;;;AAQG;AACI,MAAM,kBAAkB,GAAG,MAAc;AAC9C,IAAA,MAAM,WAAW,GACf,sBAAsB,CAAC,8BAA8B,CAAC;QACtD,yBAAyB,CAAC,wBAAwB,CAAC;QACnD,yBAAyB,CAAC,sBAAsB,CAAC;AACnD,IAAA,OAAO,WAAW,EAAE,QAAQ,EAAE,KAAK,MAAM;AAC3C;AAEA;AACO,MAAM,aAAa,GAAG,CAAC,eAA0B,KAAKA,UAAI,CAAC,MAAMC,qCAAe,CAAC,eAAe,CAAC;;;;;;;;;;"}

package/dist/utilities/renderUtils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/utilities/renderUtils/index.ts"],"names":[],"mappings":"AAIA;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,GAAI,KAAK,MAAM,KAAG,MAgBpD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,GAAI,KAAK,MAAM,KAAG,MAMvD,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,QAAQ,QAAO,MAE3B,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,QAAQ,QAAO,MAE3B,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,QAAO,MAE7B,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,QAAO,OAMrC,CAAC;AAGF,eAAO,MAAM,aAAa,GAAI,iBAAiB,MAAM,GAAG,4EAAiD,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/utilities/renderUtils/index.ts"],"names":[],"mappings":"AAIA;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,GAAI,KAAK,MAAM,KAAG,MAYpD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,GAAI,KAAK,MAAM,KAAG,MAMvD,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,QAAQ,QAAO,MAE3B,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,QAAQ,QAAO,MAE3B,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,QAAO,MAE7B,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,QAAO,OAMrC,CAAC;AAGF,eAAO,MAAM,aAAa,GAAI,iBAAiB,MAAM,GAAG,4EAAiD,CAAC"}

package/dist/utilities/renderUtils/index.js

@@ -12,18 +12,13 @@ const getEnvironmentVariable = (key) => {
     if (typeof process !== 'undefined' && process.env && typeof process.env[key] === 'string') {
         return process.env[key];
     }
-    // Fallback to Vite env when available; use eval to avoid parse errors in non‑Vite/CJS.
-    // `eval('import.meta')` is intentional — `import.meta` is a parse-time syntax error in
-    // CommonJS / non-ESM contexts (e.g. some Node test runners). Using eval defers parsing
-    // until runtime so this util can live in shared library code consumed by both Vite and non-Vite environments.
-    try {
-        // biome-ignore lint/security/noGlobalEval: see comment above — required for cross-runtime import.meta access
-        const viteEnv = eval('import.meta')?.env;
-        return viteEnv?.[key] ?? '';
-    }
-    catch {
-        return '';
-    }
+    // Fallback to Vite env when available. Written as bare `import.meta.env` — legal in
+    // the ESM build and in Vite/Vitest — and rewritten to `undefined` in the CJS output
+    // by the `import-meta-env-cjs-safe` plugin in rollup.config.js, where `import.meta`
+    // would be a parse error. No eval: strict-CSP consumers (no `unsafe-eval`) previously
+    // lost this path silently.
+    const viteEnv = import.meta.env;
+    return viteEnv?.[key] ?? '';
 };
 /**
  * Retrieves a micro-frontend attribute.

package/dist/utilities/renderUtils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":["../../../src/utilities/renderUtils/index.ts"],"sourcesContent":[null],"names":[],"mappings":";;;AAIA;;;;;AAKG;AACI,MAAM,sBAAsB,GAAG,CAAC,GAAW,KAAY;;AAE5D,IAAA,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE;AACzF,QAAA,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAW;IACnC;;;;;AAKA,IAAA,IAAI;;QAEF,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,EAAE,GAAqD;AAC1F,QAAA,OAAO,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE;IAC7B;AAAE,IAAA,MAAM;AACN,QAAA,OAAO,EAAE;IACX;AACF;AAEA;;;;;AAKG;AACI,MAAM,yBAAyB,GAAG,CAAC,GAAW,KAAY;AAC/D,IAAA,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE;AACnC,QAAA,OAAO,EAAE;IACX;IACA,MAAM,gBAAgB,GAAG,QAAQ,CAAC,cAAc,CAAC,yBAAyB,CAAC;IAC3E,OAAO,gBAAgB,EAAE,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE;AAClD;AAEA;;;;;;;;AAQG;AACI,MAAM,QAAQ,GAAG,MAAa;AACnC,IAAA,OAAO,sBAAsB,CAAC,qBAAqB,CAAC,IAAI,yBAAyB,CAAC,aAAa,CAAC,IAAI,yBAAyB,CAAC,YAAY,CAAC;AAC7I;AAEA;;;;;;;;AAQG;AACI,MAAM,QAAQ,GAAG,MAAa;AACnC,IAAA,OAAO,sBAAsB,CAAC,qBAAqB,CAAC,IAAI,yBAAyB,CAAC,aAAa,CAAC,IAAI,yBAAyB,CAAC,YAAY,CAAC;AAC7I;AAEA;;;;;;;;AAQG;AACI,MAAM,UAAU,GAAG,MAAa;AACrC,IAAA,OAAO,sBAAsB,CAAC,uBAAuB,CAAC,IAAI,yBAAyB,CAAC,eAAe,CAAC,IAAI,yBAAyB,CAAC,cAAc,CAAC;AACnJ;AAEA;;;;;;;;AAQG;AACI,MAAM,kBAAkB,GAAG,MAAc;AAC9C,IAAA,MAAM,WAAW,GACf,sBAAsB,CAAC,8BAA8B,CAAC;QACtD,yBAAyB,CAAC,wBAAwB,CAAC;QACnD,yBAAyB,CAAC,sBAAsB,CAAC;AACnD,IAAA,OAAO,WAAW,EAAE,QAAQ,EAAE,KAAK,MAAM;AAC3C;AAEA;AACO,MAAM,aAAa,GAAG,CAAC,eAA0B,KAAK,IAAI,CAAC,MAAM,eAAe,CAAC,eAAe,CAAC;;;;"}
+{"version":3,"file":"index.js","sources":["../../../src/utilities/renderUtils/index.ts"],"sourcesContent":[null],"names":[],"mappings":";;;AAIA;;;;;AAKG;AACI,MAAM,sBAAsB,GAAG,CAAC,GAAW,KAAY;;AAE5D,IAAA,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE;AACzF,QAAA,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAW;IACnC;;;;;;AAMA,IAAA,MAAM,OAAO,GAAI,MAAM,CAAC,IAAkE,CAAC,GAAG;AAC9F,IAAA,OAAO,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE;AAC7B;AAEA;;;;;AAKG;AACI,MAAM,yBAAyB,GAAG,CAAC,GAAW,KAAY;AAC/D,IAAA,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE;AACnC,QAAA,OAAO,EAAE;IACX;IACA,MAAM,gBAAgB,GAAG,QAAQ,CAAC,cAAc,CAAC,yBAAyB,CAAC;IAC3E,OAAO,gBAAgB,EAAE,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE;AAClD;AAEA;;;;;;;;AAQG;AACI,MAAM,QAAQ,GAAG,MAAa;AACnC,IAAA,OAAO,sBAAsB,CAAC,qBAAqB,CAAC,IAAI,yBAAyB,CAAC,aAAa,CAAC,IAAI,yBAAyB,CAAC,YAAY,CAAC;AAC7I;AAEA;;;;;;;;AAQG;AACI,MAAM,QAAQ,GAAG,MAAa;AACnC,IAAA,OAAO,sBAAsB,CAAC,qBAAqB,CAAC,IAAI,yBAAyB,CAAC,aAAa,CAAC,IAAI,yBAAyB,CAAC,YAAY,CAAC;AAC7I;AAEA;;;;;;;;AAQG;AACI,MAAM,UAAU,GAAG,MAAa;AACrC,IAAA,OAAO,sBAAsB,CAAC,uBAAuB,CAAC,IAAI,yBAAyB,CAAC,eAAe,CAAC,IAAI,yBAAyB,CAAC,cAAc,CAAC;AACnJ;AAEA;;;;;;;;AAQG;AACI,MAAM,kBAAkB,GAAG,MAAc;AAC9C,IAAA,MAAM,WAAW,GACf,sBAAsB,CAAC,8BAA8B,CAAC;QACtD,yBAAyB,CAAC,wBAAwB,CAAC;QACnD,yBAAyB,CAAC,sBAAsB,CAAC;AACnD,IAAA,OAAO,WAAW,EAAE,QAAQ,EAAE,KAAK,MAAM;AAC3C;AAEA;AACO,MAAM,aAAa,GAAG,CAAC,eAA0B,KAAK,IAAI,CAAC,MAAM,eAAe,CAAC,eAAe,CAAC;;;;"}