@heartlandone/vega 2.75.0 → 2.76.0

package/dist/collection/utils/e2e-utils.js

@@ -240,10 +240,17 @@ export const getScreenshotDiffResults = async (page, desc, selector) => {
  * @param {string} config.date --sets the date want to mock
  * @param {number} config.timeout --sets the content timeout
  * @param {InjectFeatureFlagsConfig} config.featureFlags -inject feature flags.
+ * @param {string} config.timezone -sets the browser timezone (defaults to 'Asia/Shanghai' for consistent behavior across environments).
  */
 export const initVegaE2EPage = async (content, config) => {
-  var _a, _b;
+  var _a, _b, _c;
   const page = await newE2EPage();
+  // Set timezone to ensure consistent behavior across different environments
+  const timezone = (_a = config === null || config === void 0 ? void 0 : config.timezone) !== null && _a !== void 0 ? _a : 'Asia/Shanghai';
+  const pageWithTimezone = page;
+  if (typeof pageWithTimezone.emulateTimezone === 'function') {
+    await pageWithTimezone.emulateTimezone(timezone);
+  }
   await mockDate(page, config === null || config === void 0 ? void 0 : config.date);
   const script = (config === null || config === void 0 ? void 0 : config.eventSemanticsConfig)
     ? `<script type='module'>window.VegaEventManager.setSemantics(${JSON.stringify(config.eventSemanticsConfig)})</script>`
@@ -252,8 +259,8 @@ export const initVegaE2EPage = async (content, config) => {
     window.VegaIconManager.register(${JSON.stringify(TestIcons)});
   </script>`;
   const injectFeatureFlags = `<script>
-		window.VegaEnabledFeatureKeys = ${JSON.stringify(((_a = config === null || config === void 0 ? void 0 : config.featureFlags) === null || _a === void 0 ? void 0 : _a.enabled) || [])};
-		window.VegaDisabledFeatureKeys = ${JSON.stringify(((_b = config === null || config === void 0 ? void 0 : config.featureFlags) === null || _b === void 0 ? void 0 : _b.disabled) || [])};
+		window.VegaEnabledFeatureKeys = ${JSON.stringify(((_b = config === null || config === void 0 ? void 0 : config.featureFlags) === null || _b === void 0 ? void 0 : _b.enabled) || [])};
+		window.VegaDisabledFeatureKeys = ${JSON.stringify(((_c = config === null || config === void 0 ? void 0 : config.featureFlags) === null || _c === void 0 ? void 0 : _c.disabled) || [])};
 	</script>`;
   const contentHtml = (config === null || config === void 0 ? void 0 : config.wrapped)
     ? `${injectTestIcons}${script}${injectFeatureFlags}<div style="padding: 10px" id="visual-container">${content}</div>`

package/dist/collection/utils/sanitize/constants/tag-sets.js

@@ -0,0 +1,5 @@
+/**
+ * Set of allowed HTML tags for label rendering.
+ * Tags must be uppercase to match DOMParser element.tagName output.
+ */
+export const LABEL_ALLOWED_TAGS = new Set(['B', 'I', 'STRONG', 'EM']);

package/dist/collection/utils/sanitize/core/html-sanitizer.js

@@ -0,0 +1,39 @@
+import { tryGetDocument } from '../../try-get-document';
+import { serializeFragment } from '../utils/serialize-fragment';
+/**
+ * Main sanitization engine.
+ *
+ * Responsible for:
+ * - Parsing HTML
+ * - Delegating sanitization to strategy
+ * - Serializing safe output
+ */
+export class HtmlSanitizer {
+  /**
+   * Sanitizes the given string using the provided sanitization strategy.
+   *
+   * This is the single entry point for HTML sanitization.
+   * Always returns a safe string for DOM insertion.
+   *
+   * @param {string} input - Raw string input to be sanitized.
+   * @param {SanitizeStrategy} strategy - Sanitization strategy to apply.
+   * @returns { string } Sanitized string safe for rendering.
+   */
+  sanitize(input, strategy) {
+    if (!input || input.trim() === '') {
+      return '';
+    }
+    const doc = tryGetDocument();
+    if (!doc)
+      return '';
+    const parser = new DOMParser();
+    const parsed = parser.parseFromString(input, 'text/html');
+    const fragment = doc.createDocumentFragment();
+    parsed.body.childNodes.forEach((node) => {
+      const clean = strategy.execute(node, doc);
+      if (clean)
+        fragment.appendChild(clean);
+    });
+    return serializeFragment(fragment, doc);
+  }
+}

package/dist/collection/utils/sanitize/core/sanitize-strategy.js

@@ -0,0 +1,62 @@
+/**
+ * Base class for all sanitization strategies.
+ *
+ * Strategy defines:
+ * - Allowed tags
+ * - Allowed attributes per tag
+ * - Text preservation behavior
+ */
+export class SanitizeStrategy {
+  constructor() {
+    this.preserveTextContent = true;
+  }
+  /**
+   * @param {Node} node - Node to sanitize.
+   * @param {Document} doc - document reference.
+   * @returns {Nullable<Node>} - Sanitized node
+   */
+  execute(node, doc) {
+    var _a;
+    switch (node.nodeType) {
+      case Node.TEXT_NODE:
+        return this.preserveTextContent ? doc.createTextNode((_a = node.textContent) !== null && _a !== void 0 ? _a : '') : null;
+      case Node.ELEMENT_NODE:
+        return this.sanitizeElement(node, doc);
+      default:
+        return null;
+    }
+  }
+  /**
+   * @param {HTMLElement} element - HTMLElement to sanitize.
+   * @param {Document} doc - document reference.
+   * @returns {Nullable<Node>} - Sanitized node
+   */
+  sanitizeElement(element, doc) {
+    var _a;
+    const tagName = element.tagName;
+    if (!this.allowedTags.has(tagName)) {
+      const fragment = doc.createDocumentFragment();
+      element.childNodes.forEach((child) => {
+        const clean = this.execute(child, doc);
+        if (clean)
+          fragment.appendChild(clean);
+      });
+      return fragment;
+    }
+    const cleanElement = doc.createElement(tagName.toLowerCase());
+    const allowedAttrs = (_a = this.allowedAttributes) === null || _a === void 0 ? void 0 : _a.get(tagName);
+    if (allowedAttrs) {
+      Array.from(element.attributes).forEach((attr) => {
+        if (allowedAttrs.has(attr.name)) {
+          cleanElement.setAttribute(attr.name, attr.value);
+        }
+      });
+    }
+    element.childNodes.forEach((child) => {
+      const clean = this.execute(child, doc);
+      if (clean)
+        cleanElement.appendChild(clean);
+    });
+    return cleanElement;
+  }
+}

package/dist/collection/utils/sanitize/core/types.js

@@ -0,0 +1,4 @@
+/**
+ * Shared sanitization types.
+ */
+export {};

package/dist/collection/utils/sanitize/index.js

@@ -0,0 +1,12 @@
+/**
+ * Public Sanitization API
+ */
+export { HtmlSanitizer } from './core/html-sanitizer';
+export { SanitizeStrategy } from './core/sanitize-strategy';
+export { LabelSanitizeStrategy, StyleSanitizeStrategy, EmptySanitizeStrategy } from './strategies';
+import { HtmlSanitizer } from './core/html-sanitizer';
+import { LabelSanitizeStrategy, StyleSanitizeStrategy, EmptySanitizeStrategy } from './strategies';
+export const htmlSanitizer = new HtmlSanitizer();
+export const labelSanitizeStrategy = new LabelSanitizeStrategy();
+export const styleSanitizeStrategy = new StyleSanitizeStrategy();
+export const emptySanitizeStrategy = new EmptySanitizeStrategy();

package/dist/collection/utils/sanitize/strategies/empty-sanitize-strategy.js

@@ -0,0 +1,17 @@
+import { SanitizeStrategy } from '../core/sanitize-strategy';
+/**
+ * Strategy that always returns empty output.
+ */
+export class EmptySanitizeStrategy extends SanitizeStrategy {
+  constructor() {
+    super(...arguments);
+    this.allowedTags = new Set();
+    this.preserveTextContent = false;
+  }
+  /**
+   * @returns {Nullable<Node>} - Sanitized node
+   */
+  execute() {
+    return null;
+  }
+}

package/dist/collection/utils/sanitize/strategies/index.js

@@ -0,0 +1,3 @@
+export { LabelSanitizeStrategy } from './label-sanitize-strategy';
+export { StyleSanitizeStrategy } from './style-sanitize-strategy';
+export { EmptySanitizeStrategy } from './empty-sanitize-strategy';

package/dist/collection/utils/sanitize/strategies/label-sanitize-strategy.js

@@ -0,0 +1,13 @@
+import { SanitizeStrategy } from '../core/sanitize-strategy';
+import { LABEL_ALLOWED_TAGS } from '../constants/tag-sets';
+/**
+ * Label HTML sanitization strategy.
+ *
+ * Allows minimal formatting tags only.
+ */
+export class LabelSanitizeStrategy extends SanitizeStrategy {
+  constructor() {
+    super(...arguments);
+    this.allowedTags = LABEL_ALLOWED_TAGS;
+  }
+}

package/dist/collection/utils/sanitize/strategies/style-sanitize-strategy.js

@@ -0,0 +1,50 @@
+import { SanitizeStrategy } from '../core/sanitize-strategy';
+/**
+ * CSS / style sanitization strategy.
+ *
+ * - Strips all HTML elements
+ * - Preserves text nodes
+ * - Blocks dangerous CSS patterns (expression(), javascript:)
+ */
+export class StyleSanitizeStrategy extends SanitizeStrategy {
+  constructor() {
+    super(...arguments);
+    this.allowedTags = new Set();
+    this.preserveTextContent = true;
+  }
+  /**
+   * @param {Node} node - Node to sanitize.
+   * @param {Document} doc - document reference.
+   * @returns {Nullable<Node>} - Sanitized node
+   */
+  execute(node, doc) {
+    var _a;
+    switch (node.nodeType) {
+      case Node.TEXT_NODE: {
+        const css = (_a = node.textContent) !== null && _a !== void 0 ? _a : '';
+        // Strip dangerous CSS patterns
+        return this.isSafeCss(css) ? doc.createTextNode(css) : null;
+      }
+      case Node.ELEMENT_NODE: {
+        // Recurse into children but discard the element itself
+        const fragment = doc.createDocumentFragment();
+        node.childNodes.forEach((child) => {
+          const clean = this.execute(child, doc);
+          if (clean)
+            fragment.appendChild(clean);
+        });
+        return fragment;
+      }
+      default:
+        return null;
+    }
+  }
+  /**
+   * @param {string} css - CSS string.
+   * @returns {boolean} - True or false
+   */
+  isSafeCss(css) {
+    // Block known XSS patterns
+    return !/expression\s*\(|javascript:|url\s*\(/i.test(css);
+  }
+}

package/dist/collection/utils/sanitize/test/empty-strategy.test.js

@@ -0,0 +1,12 @@
+import { HtmlSanitizer } from '../core/html-sanitizer';
+import { EmptySanitizeStrategy } from '../strategies/empty-sanitize-strategy';
+describe('EmptySanitizeStrategy', () => {
+  const sanitizer = new HtmlSanitizer();
+  const strategy = new EmptySanitizeStrategy();
+  it('should always return empty string', () => {
+    const inputs = ['Hello', '<b>Bold</b>', '<script>alert(1)</script>', '', '   '];
+    inputs.forEach((input) => {
+      expect(sanitizer.sanitize(input, strategy)).toBe('');
+    });
+  });
+});

package/dist/collection/utils/sanitize/test/html-sanitizer.test.js

@@ -0,0 +1,57 @@
+import { tryGetDocument } from '../../try-get-document';
+import { HtmlSanitizer } from '../core/html-sanitizer';
+import { labelSanitizeStrategy, styleSanitizeStrategy, emptySanitizeStrategy } from '../index';
+describe('HtmlSanitizer', () => {
+  const sanitizer = new HtmlSanitizer();
+  it('should return empty string for empty input', () => {
+    expect(sanitizer.sanitize('', labelSanitizeStrategy)).toBe('');
+    expect(sanitizer.sanitize('   ', labelSanitizeStrategy)).toBe('');
+  });
+  it('should sanitize label content correctly', () => {
+    const input = '<b>Bold</b> <i>Italic</i> <script>alert(1)</script>';
+    const result = sanitizer.sanitize(input, labelSanitizeStrategy);
+    expect(result).toBe('<b>Bold</b> <i>Italic</i> alert(1)');
+  });
+  it('should preserve text if no tags exist', () => {
+    const input = 'Hello world';
+    const result = sanitizer.sanitize(input, labelSanitizeStrategy);
+    expect(result).toBe('Hello world');
+  });
+  it('should unwrap disallowed elements', () => {
+    const input = '<div><span>Text</span></div>';
+    const result = sanitizer.sanitize(input, labelSanitizeStrategy);
+    expect(result).toBe('Text');
+  });
+  it('should remove unsupported node types (comment nodes)', () => {
+    const input = '<!-- comment -->Visible';
+    const result = sanitizer.sanitize(input, labelSanitizeStrategy);
+    expect(result).toBe('Visible');
+  });
+  it('should preserve safe CSS text in style strategy', () => {
+    const css = 'body { color: red; }';
+    const result = sanitizer.sanitize(css, styleSanitizeStrategy);
+    expect(result).toBe(css);
+  });
+  it('should remove dangerous CSS in style strategy', () => {
+    const css = 'body { background: url(javascript:alert(1)) }';
+    const result = sanitizer.sanitize(css, styleSanitizeStrategy);
+    expect(result).toBe('');
+  });
+  it('should always return empty string for empty strategy', () => {
+    const input = '<b>Bold</b> <i>Italic</i>';
+    const result = sanitizer.sanitize(input, emptySanitizeStrategy);
+    expect(result).toBe('');
+  });
+  it('sanitizeHtmlLabel should not return empty string if document is available', () => {
+    expect(typeof document).toBe('object');
+    expect(tryGetDocument()).toBe(document);
+    expect(sanitizer.sanitize('<b>Some</b> text', labelSanitizeStrategy)).toEqual('<b>Some</b> text');
+  });
+  it('sanitizeHtmlLabel should return empty string if document is not available', () => {
+    const originalDocument = globalThis.document;
+    delete globalThis.document;
+    expect(tryGetDocument()).toBeUndefined();
+    expect(sanitizer.sanitize('<b>Some</b> text', labelSanitizeStrategy)).toEqual('');
+    globalThis.document = originalDocument;
+  });
+});

package/dist/collection/utils/sanitize/test/label-strategy.test.js

@@ -0,0 +1,56 @@
+import { HtmlSanitizer } from '../core/html-sanitizer';
+import { LabelSanitizeStrategy } from '../strategies/label-sanitize-strategy';
+describe('LabelSanitizeStrategy', () => {
+  const sanitizer = new HtmlSanitizer();
+  const strategy = new LabelSanitizeStrategy();
+  it('should allow <b>, <i>, <strong>, <em>', () => {
+    const input = '<b>Bold</b><i>Italic</i><strong>Strong</strong><em>Em</em>';
+    const result = sanitizer.sanitize(input, strategy);
+    expect(result).toBe(input);
+  });
+  it('should unwrap disallowed tags but preserve text', () => {
+    const input = '<span>Span</span><div>Div</div>';
+    const result = sanitizer.sanitize(input, strategy);
+    expect(result).toBe('SpanDiv');
+  });
+  it('should strip attributes even on allowed tags', () => {
+    const input = '<b style="color:red">Bold</b>';
+    const result = sanitizer.sanitize(input, strategy);
+    expect(result).toBe('<b>Bold</b>');
+  });
+  it('should preserve plain text nodes', () => {
+    const input = 'Just some text';
+    const result = sanitizer.sanitize(input, strategy);
+    expect(result).toBe('Just some text');
+  });
+  it('should handle mixed allowed and disallowed tags', () => {
+    const input = '<b>Bold</b> <script>alert(1)</script>';
+    const result = sanitizer.sanitize(input, strategy);
+    expect(result).toBe('<b>Bold</b> alert(1)');
+  });
+  test('sanitizeHtmlLabel should return textContent if no HTML elements exist', () => {
+    expect(sanitizer.sanitize('>hello', strategy)).toEqual('>hello');
+    expect(sanitizer.sanitize('Me > You', strategy)).toEqual('Me > You');
+    expect(sanitizer.sanitize('Me <b>></b> You', strategy)).toEqual('Me <b>&gt;</b> You');
+  });
+  test('serializeFragment should return innerHTML when HTML elements exist', () => {
+    const result = sanitizer.sanitize('<b>Bold</b>', strategy);
+    expect(result).toBe('<b>Bold</b>');
+  });
+  test('serializeFragment falls back to empty string when textContent is null', () => {
+    const originalCreateElement = document.createElement;
+    jest.spyOn(document, 'createElement').mockImplementation((tagName) => {
+      const el = originalCreateElement.call(document, tagName);
+      if (tagName === 'div') {
+        Object.defineProperty(el, 'textContent', {
+          get: () => null,
+          configurable: true,
+        });
+      }
+      return el;
+    });
+    const result = sanitizer.sanitize('plain text', strategy);
+    expect(result).toBe('');
+    document.createElement.mockRestore();
+  });
+});

package/dist/collection/utils/sanitize/test/sanitize-strategy.test.js

@@ -0,0 +1,85 @@
+import { SanitizeStrategy } from '../core/sanitize-strategy';
+describe('SanitizeStrategy (base)', () => {
+  /**
+   * Concrete implementation for testing base class behavior.
+   * Allows only <b> tags.
+   */
+  class TestStrategy extends SanitizeStrategy {
+    constructor() {
+      super(...arguments);
+      this.allowedTags = new Set(['B']);
+      this.allowedAttributes = new Map([
+        ['B', new Set(['class', 'id'])],
+      ]);
+    }
+  }
+  class NoTextStrategy extends SanitizeStrategy {
+    constructor() {
+      super(...arguments);
+      this.allowedTags = new Set();
+      this.preserveTextContent = false;
+    }
+  }
+  let strategy;
+  let doc;
+  beforeEach(() => {
+    strategy = new TestStrategy();
+    doc = document;
+  });
+  it('should preserve text nodes', () => {
+    const textNode = doc.createTextNode('Hello');
+    const result = strategy.execute(textNode, doc);
+    expect(result).not.toBeNull();
+    expect(result === null || result === void 0 ? void 0 : result.textContent).toBe('Hello');
+  });
+  it('should allow allowed tags', () => {
+    const element = doc.createElement('b');
+    element.textContent = 'Bold';
+    const result = strategy.execute(element, doc);
+    expect(result).not.toBeNull();
+    expect(result.tagName).toBe('B');
+    expect(result === null || result === void 0 ? void 0 : result.textContent).toBe('Bold');
+  });
+  it('should unwrap disallowed tags but preserve children', () => {
+    const div = doc.createElement('div');
+    const span = doc.createElement('span');
+    span.textContent = 'Inner';
+    div.appendChild(span);
+    const result = strategy.execute(div, doc);
+    expect(result).not.toBeNull();
+    expect(result === null || result === void 0 ? void 0 : result.textContent).toBe('Inner');
+  });
+  it('should return null for unsupported node types (base implementation)', () => {
+    const comment = doc.createComment('test');
+    const result = strategy.execute(comment, doc);
+    expect(result).toBeNull();
+  });
+  it('should preserve only allowed attributes', () => {
+    const element = doc.createElement('b');
+    element.setAttribute('class', 'allowed');
+    element.setAttribute('id', 'also-allowed');
+    element.setAttribute('style', 'color:red'); // disallowed attribute
+    const result = strategy.execute(element, doc);
+    expect(result).not.toBeNull();
+    const cleanElement = result;
+    expect(cleanElement.getAttribute('class')).toBe('allowed');
+    expect(cleanElement.getAttribute('id')).toBe('also-allowed');
+    expect(cleanElement.hasAttribute('style')).toBe(false);
+  });
+  it('should fallback to empty string when textContent is null', () => {
+    const textNode = doc.createTextNode('test');
+    Object.defineProperty(textNode, 'textContent', {
+      value: null,
+      configurable: true,
+    });
+    const result = strategy.execute(textNode, doc);
+    expect(result).not.toBeNull();
+    expect(result === null || result === void 0 ? void 0 : result.textContent).toBe('');
+  });
+  it('should return null when preserveTextContent is false', () => {
+    const noTextStrategy = new NoTextStrategy();
+    const textNode = doc.createTextNode('Hidden');
+    const result = noTextStrategy.execute(textNode, doc);
+    expect(result).toBeNull();
+  });
+});

package/dist/collection/utils/sanitize/test/sanitize.test.js

@@ -0,0 +1,22 @@
+import { HtmlSanitizer, SanitizeStrategy, LabelSanitizeStrategy, StyleSanitizeStrategy, EmptySanitizeStrategy, htmlSanitizer, labelSanitizeStrategy, styleSanitizeStrategy, emptySanitizeStrategy, } from '../index';
+describe('utils/sanitize/index.ts exports', () => {
+  it('should export HtmlSanitizer class and instance', () => {
+    expect(typeof HtmlSanitizer).toBe('function');
+    expect(htmlSanitizer).toBeInstanceOf(HtmlSanitizer);
+  });
+  it('should export SanitizeStrategy class', () => {
+    expect(typeof SanitizeStrategy).toBe('function');
+  });
+  it('should export LabelSanitizeStrategy class and instance', () => {
+    expect(typeof LabelSanitizeStrategy).toBe('function');
+    expect(labelSanitizeStrategy).toBeInstanceOf(LabelSanitizeStrategy);
+  });
+  it('should export StyleSanitizeStrategy class and instance', () => {
+    expect(typeof StyleSanitizeStrategy).toBe('function');
+    expect(styleSanitizeStrategy).toBeInstanceOf(StyleSanitizeStrategy);
+  });
+  it('should export EmptySanitizeStrategy class and instance', () => {
+    expect(typeof EmptySanitizeStrategy).toBe('function');
+    expect(emptySanitizeStrategy).toBeInstanceOf(EmptySanitizeStrategy);
+  });
+});

package/dist/collection/utils/sanitize/test/serialize-fragment.test.js

@@ -0,0 +1,25 @@
+import { serializeFragment } from '../utils/serialize-fragment';
+describe('serializeFragment', () => {
+  it('should return textContent when there are no element children', () => {
+    const doc = document;
+    const fragment = doc.createDocumentFragment();
+    fragment.appendChild(doc.createTextNode('Hello World'));
+    const result = serializeFragment(fragment, doc);
+    expect(result).toBe('Hello World');
+  });
+  it('should return innerHTML when element children exist', () => {
+    const doc = document;
+    const fragment = doc.createDocumentFragment();
+    const div = doc.createElement('div');
+    div.textContent = 'Inside';
+    fragment.appendChild(div);
+    const result = serializeFragment(fragment, doc);
+    expect(result).toBe('<div>Inside</div>');
+  });
+  it('should return empty string when textContent is null', () => {
+    const doc = document;
+    const fragment = doc.createDocumentFragment();
+    const result = serializeFragment(fragment, doc);
+    expect(result).toBe('');
+  });
+});

package/dist/collection/utils/sanitize/test/style-strategy.test.js

@@ -0,0 +1,45 @@
+import { HtmlSanitizer } from '../core/html-sanitizer';
+import { StyleSanitizeStrategy } from '../strategies/style-sanitize-strategy';
+describe('StyleSanitizeStrategy', () => {
+  const sanitizer = new HtmlSanitizer();
+  const strategy = new StyleSanitizeStrategy();
+  it('should preserve safe CSS text', () => {
+    const css = 'body { color: red; }';
+    const result = sanitizer.sanitize(css, strategy);
+    expect(result).toBe(css);
+  });
+  it('should remove CSS with expression()', () => {
+    const css = 'body { width: expression(alert(1)); }';
+    const result = sanitizer.sanitize(css, strategy);
+    expect(result).toBe('');
+  });
+  it('should remove CSS with javascript: URL', () => {
+    const css = 'background: url(javascript:alert(1));';
+    const result = sanitizer.sanitize(css, strategy);
+    expect(result).toBe('');
+  });
+  it('should remove HTML tags entirely', () => {
+    const input = '<div>Some HTML</div>';
+    const result = sanitizer.sanitize(input, strategy);
+    expect(result).toBe('Some HTML');
+  });
+  it('should return null for unsupported node types', () => {
+    const doc = document;
+    const comment = doc.createComment('unsafe');
+    const result = strategy.execute(comment, doc);
+    expect(result).toBeNull();
+  });
+  it('should fallback to empty string when textContent is null', () => {
+    const doc = document;
+    const textNode = doc.createTextNode('test');
+    Object.defineProperty(textNode, 'textContent', {
+      value: null,
+      configurable: true,
+    });
+    const result = strategy.execute(textNode, doc);
+    // Since css becomes '', and empty string is safe,
+    // it should return an empty text node
+    expect(result).not.toBeNull();
+    expect(result === null || result === void 0 ? void 0 : result.textContent).toBe('');
+  });
+});

package/dist/collection/utils/sanitize/utils/serialize-fragment.js

@@ -0,0 +1,17 @@
+/**
+ * Serializes a DocumentFragment into HTML string.
+ *
+ * If fragment contains no element nodes,
+ * returns textContent to avoid encoding issues.
+ */
+/**
+ * @param {DocumentFragment} fragment - fragment to serialize.
+ * @param {Document} doc - document reference.
+ * @returns {string} - Serialized string
+ */
+export function serializeFragment(fragment, doc) {
+  var _a;
+  const container = doc.createElement('div');
+  container.appendChild(fragment);
+  return container.children.length === 0 ? (_a = container.textContent) !== null && _a !== void 0 ? _a : '' : container.innerHTML;
+}

package/dist/esm/{app-globals-f3414aca.js → app-globals-c0676920.js}

@@ -1,23 +1,19 @@
-import { F as FeatureFlag } from './feature-flag-controller-51659753.js';
-import { V as VegaLoader, a as VegaNotify, b as VegaThemeManager, c as VegaDialog, d as VegaEventManager, e as VegaZIndexManager, f as VegaSkeletonLoader, g as VegaRTETokenExtension, h as VegaRTEFunctionExtension } from './function-extension-63028f20.js';
+import { F as FeatureFlag } from './feature-flag-controller-09ea7e87.js';
+import { V as VegaLoader, a as VegaNotify, b as VegaThemeManager, c as VegaEventManager, d as VegaZIndexManager, w as waitForVega, e as VegaSkeletonLoader, f as VegaTranslation, g as VegaRTETokenExtension, h as VegaRTELanguageExtension, i as VegaRTEFunctionExtension } from './token-extension-e33fd151.js';
 import { M as MapToComponentMethod, V as VegaSlimmer, s as setVegaLogLevel, G as GlobalSlimmersRegistry } from './global-slimmer-registry-17c4efd4.js';
-import { v as vegaEnvManager } from './vega-env-manager-8f8dc473.js';
-import { V as VegaIconManager } from './internal-icon-manager-f0486245.js';
-import './wait-for-vega-handler-c2c07ac3.js';
-import './ui-bb99c0c2.js';
-import { V as VegaInternalTranslation, a as VegaTranslation, s as staticTranslations } from './translation-96e5debd.js';
-import { V as VegaRTEContent } from './dto-renderer-manager-f07cf2d9.js';
-import { v as vegaNonceManager, s as setVegaNonce } from './vega-nonce-manager-497e5eb5.js';
-import { V as VegaRTEPresetToolbarItems } from './code-block-8ee34ab6.js';
-import './type-guard-c65a227d.js';
+import { V as VegaDialog } from './vega-dialog-controller-bbb2fc52.js';
 import { T as TypographyUrls } from './typography-396de03f.js';
-import { V as ValidCreditCardNumberRule } from './valid-credit-card-number-rule-666c415d.js';
-import { w as waitForVega } from './index-51a7da7f.js';
-import { V as VegaRTELanguageExtension } from './language-extension-c4ff21dd.js';
+import { V as VegaIconManager } from './icon-manager-539d7cf7.js';
+import { V as VegaInternalTranslation, s as staticTranslations } from './internal-translation-controller-911515f9.js';
+import { V as ValidCreditCardNumberRule } from './valid-credit-card-number-rule-22ce81db.js';
+import { v as vegaEnvManager } from './vega-env-manager-8f8dc473.js';
 import { U as UPDATE_TRANSLATION } from './static-subject-title-52f93124.js';
 import { C as ChangeManager } from './change-manager-6a7eb88c.js';
 import { O as Observer } from './observer-3959f9dd.js';
 import { f as forceUpdate } from './index-090d31ca.js';
+import { V as VegaRTEContent } from './dto-renderer-manager-6fd22ab7.js';
+import { v as vegaNonceManager, s as setVegaNonce } from './vega-nonce-manager-497e5eb5.js';
+import { V as VegaRTEPresetToolbarItems } from './code-block-b6247a45.js';
 
 var __decorate$2 = (undefined && undefined.__decorate) || function (decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -356,7 +352,7 @@ function injectValidCreditCardNumberRuleIntoGlobal() {
 function initRuntimeMetricsTelemetryCollection() {
   globalThis.VegaEnvInfo = vegaEnvManager.getVegaEnv();
   // eslint-disable-next-line spellcheck/spell-checker
-  void import('./index-e9da316f.js').then((
+  void import('./index-bfc6dfa2.js').then((
   // eslint-disable-next-line spellcheck/spell-checker
   module) => {
     module['default']['init'](FeatureFlag);
@@ -398,7 +394,7 @@ function injectVegaRichTextEditorClassIntoGlobal() {
  * Inject VegaPublicValidationRules to global as a public api
  */
 function injectVegaPublicValidationRules() {
-  void import('./public-rules-6ebdfcf5.js').then((module) => {
+  void import('./public-rules-25cc3a39.js').then((module) => {
     Object.entries(module).forEach(([name, value]) => {
       globalThis[name] = value;
     });