@memberjunction/ng-shared-generic 5.37.0 → 5.39.0

package/README.md

@@ -162,5 +162,5 @@ For the full token catalog, architecture details, custom theme creation guide, a
 
 ## Dependencies
 
-- [@memberjunction/core](../../MJCore/README.md) -- Core MJ framework
-- [@memberjunction/core-entities](../../MJCoreEntities/README.md) -- Entity types
+- [@memberjunction/core](../../../MJCore/readme.md) -- Core MJ framework
+- [@memberjunction/core-entities](../../../MJCoreEntities/readme.md) -- Entity types

package/dist/__tests__/rich-text-sanitize.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=rich-text-sanitize.test.d.ts.map

package/dist/__tests__/rich-text-sanitize.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rich-text-sanitize.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/rich-text-sanitize.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/rich-text-sanitize.test.js

@@ -0,0 +1,54 @@
+// @vitest-environment jsdom
+import { describe, it, expect } from 'vitest';
+import { PurifyRichTextHtml } from '../lib/rich-text/rich-text-sanitize';
+describe('PurifyRichTextHtml', () => {
+    describe('strips dangerous vectors', () => {
+        it('removes <script> tags', () => {
+            const out = PurifyRichTextHtml('<p>ok</p><script>alert(1)</script>');
+            expect(out).toContain('<p>ok</p>');
+            expect(out.toLowerCase()).not.toContain('<script');
+            expect(out).not.toContain('alert(1)');
+        });
+        it('strips on* event handler attributes', () => {
+            const out = PurifyRichTextHtml('<img src="x" onerror="alert(1)">');
+            expect(out.toLowerCase()).not.toContain('onerror');
+        });
+        it('strips javascript: URLs', () => {
+            const out = PurifyRichTextHtml('<a href="javascript:alert(1)">x</a>');
+            expect(out.toLowerCase()).not.toContain('javascript:');
+        });
+        it('removes <script> embedded inside SVG', () => {
+            const out = PurifyRichTextHtml('<svg><script>alert(1)</script><rect/></svg>');
+            expect(out.toLowerCase()).not.toContain('<script');
+            expect(out).not.toContain('alert(1)');
+        });
+    });
+    describe('keeps safe rich content', () => {
+        it('preserves structural HTML', () => {
+            const out = PurifyRichTextHtml('<h2>Title</h2><ul><li>a</li></ul><table><tr><td>c</td></tr></table>');
+            expect(out).toContain('<h2>Title</h2>');
+            expect(out).toContain('<li>a</li>');
+            expect(out).toContain('<td>c</td>');
+        });
+        it('preserves inline SVG shapes (the whole point of swapping the sanitizer)', () => {
+            const svg = '<svg viewBox="0 0 10 10"><defs><linearGradient id="g"><stop offset="0%"/></linearGradient></defs><rect fill="url(#g)"/><path d="M0 0 L10 10"/><circle cx="5" cy="5" r="3"/></svg>';
+            const out = PurifyRichTextHtml(svg);
+            expect(out.toLowerCase()).toContain('<svg');
+            expect(out.toLowerCase()).toContain('<rect');
+            expect(out.toLowerCase()).toContain('<path');
+            expect(out.toLowerCase()).toContain('<circle');
+            expect(out.toLowerCase()).toContain('lineargradient');
+        });
+    });
+    describe('edge cases', () => {
+        it('returns empty string for null/undefined/empty', () => {
+            expect(PurifyRichTextHtml(null)).toBe('');
+            expect(PurifyRichTextHtml(undefined)).toBe('');
+            expect(PurifyRichTextHtml('')).toBe('');
+        });
+        it('passes plain text through unchanged', () => {
+            expect(PurifyRichTextHtml('just text')).toBe('just text');
+        });
+    });
+});
+//# sourceMappingURL=rich-text-sanitize.test.js.map

package/dist/__tests__/rich-text-sanitize.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rich-text-sanitize.test.js","sourceRoot":"","sources":["../../src/__tests__/rich-text-sanitize.test.ts"],"names":[],"mappings":"AAAA,4BAA4B;AAC5B,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAEzE,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;QACxC,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;YAC/B,MAAM,GAAG,GAAG,kBAAkB,CAAC,oCAAoC,CAAC,CAAC;YACrE,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;YACnC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YACnD,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;YAC7C,MAAM,GAAG,GAAG,kBAAkB,CAAC,kCAAkC,CAAC,CAAC;YACnE,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;YACjC,MAAM,GAAG,GAAG,kBAAkB,CAAC,qCAAqC,CAAC,CAAC;YACtE,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;YAC9C,MAAM,GAAG,GAAG,kBAAkB,CAAC,6CAA6C,CAAC,CAAC;YAC9E,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YACnD,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACvC,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;YACnC,MAAM,GAAG,GAAG,kBAAkB,CAAC,qEAAqE,CAAC,CAAC;YACtG,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;YACxC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;YACpC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;YACjF,MAAM,GAAG,GAAG,mLAAmL,CAAC;YAChM,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC5C,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YAC7C,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YAC7C,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YAC/C,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;QAC1B,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;YACvD,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1C,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/C,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;YAC7C,MAAM,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment jsdom\nimport { describe, it, expect } from 'vitest';\nimport { PurifyRichTextHtml } from '../lib/rich-text/rich-text-sanitize';\n\ndescribe('PurifyRichTextHtml', () => {\n  describe('strips dangerous vectors', () => {\n    it('removes <script> tags', () => {\n      const out = PurifyRichTextHtml('<p>ok</p><script>alert(1)</script>');\n      expect(out).toContain('<p>ok</p>');\n      expect(out.toLowerCase()).not.toContain('<script');\n      expect(out).not.toContain('alert(1)');\n    });\n\n    it('strips on* event handler attributes', () => {\n      const out = PurifyRichTextHtml('<img src=\"x\" onerror=\"alert(1)\">');\n      expect(out.toLowerCase()).not.toContain('onerror');\n    });\n\n    it('strips javascript: URLs', () => {\n      const out = PurifyRichTextHtml('<a href=\"javascript:alert(1)\">x</a>');\n      expect(out.toLowerCase()).not.toContain('javascript:');\n    });\n\n    it('removes <script> embedded inside SVG', () => {\n      const out = PurifyRichTextHtml('<svg><script>alert(1)</script><rect/></svg>');\n      expect(out.toLowerCase()).not.toContain('<script');\n      expect(out).not.toContain('alert(1)');\n    });\n  });\n\n  describe('keeps safe rich content', () => {\n    it('preserves structural HTML', () => {\n      const out = PurifyRichTextHtml('<h2>Title</h2><ul><li>a</li></ul><table><tr><td>c</td></tr></table>');\n      expect(out).toContain('<h2>Title</h2>');\n      expect(out).toContain('<li>a</li>');\n      expect(out).toContain('<td>c</td>');\n    });\n\n    it('preserves inline SVG shapes (the whole point of swapping the sanitizer)', () => {\n      const svg = '<svg viewBox=\"0 0 10 10\"><defs><linearGradient id=\"g\"><stop offset=\"0%\"/></linearGradient></defs><rect fill=\"url(#g)\"/><path d=\"M0 0 L10 10\"/><circle cx=\"5\" cy=\"5\" r=\"3\"/></svg>';\n      const out = PurifyRichTextHtml(svg);\n      expect(out.toLowerCase()).toContain('<svg');\n      expect(out.toLowerCase()).toContain('<rect');\n      expect(out.toLowerCase()).toContain('<path');\n      expect(out.toLowerCase()).toContain('<circle');\n      expect(out.toLowerCase()).toContain('lineargradient');\n    });\n  });\n\n  describe('edge cases', () => {\n    it('returns empty string for null/undefined/empty', () => {\n      expect(PurifyRichTextHtml(null)).toBe('');\n      expect(PurifyRichTextHtml(undefined)).toBe('');\n      expect(PurifyRichTextHtml('')).toBe('');\n    });\n\n    it('passes plain text through unchanged', () => {\n      expect(PurifyRichTextHtml('just text')).toBe('just text');\n    });\n  });\n});\n"]}

package/dist/lib/_tokens.scss

@@ -211,6 +211,11 @@
   --mj-highlight-subtle: var(--mj-brand-accent-subtle);
   --mj-on-highlight: var(--mj-brand-on-accent);
 
+  /* Search-match highlight — the <mark> wrapping typed-query matches in lists,
+     field labels, FK dropdowns, etc. Muted amber (not the garish browser default). */
+  --mj-search-highlight-bg: color-mix(in srgb, var(--mj-status-warning) 24%, transparent);
+  --mj-search-highlight-text: var(--mj-text-primary);
+
   /* Login Banner Gradient & Waves */
   --mj-login-grad-start: var(--mj-color-brand-900);
   --mj-login-grad-mid:   var(--mj-color-brand-700);
@@ -413,6 +418,10 @@
   --mj-status-warning-text: var(--mj-color-warning-100);
   --mj-status-warning-border: var(--mj-color-warning-600);
 
+  /* Slightly stronger search highlight on dark surfaces so it stays visible. */
+  --mj-search-highlight-bg: color-mix(in srgb, var(--mj-status-warning) 30%, transparent);
+  --mj-search-highlight-text: var(--mj-text-primary);
+
   --mj-status-error-bg: rgba(239, 68, 68, 0.15);
   --mj-status-error-text: var(--mj-color-error-100);
   --mj-status-error-border: var(--mj-color-error-600);

package/dist/lib/rich-text/rich-text-sanitize.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Sanitize untrusted HTML for safe rich-text rendering.
+ *
+ * Use this instead of relying on Angular's built-in `[innerHTML]` sanitizer
+ * (which strips ALL SVG and inline styles). Configured for the HTML + SVG
+ * profiles, DOMPurify keeps safe structural HTML **and** inline vector graphics
+ * (`<svg>`, `<path>`, gradients, `<text>`, …) and inline `style`, while removing
+ * the dangerous vectors: `<script>`, `on*` event handlers, `javascript:`/`data:`
+ * script URLs, `<foreignObject>`, and friends.
+ *
+ * Because DOMPurify has already neutralized the markup, a caller may then bind
+ * the result via `DomSanitizer.bypassSecurityTrustHtml(...)` — the documented
+ * safe pattern (sanitize first, then bypass Angular's redundant re-sanitize).
+ * The {@link MJSafeRichHtmlPipe} pipe does exactly that; prefer it in templates.
+ *
+ * Safe for untrusted input by design, so it suits both explicitly-typed HTML
+ * fields and content that was only heuristically detected as HTML.
+ *
+ * @param raw the raw HTML string (null/undefined → '')
+ * @returns a sanitized HTML string safe to render
+ */
+export declare function PurifyRichTextHtml(raw: string | null | undefined): string;
+//# sourceMappingURL=rich-text-sanitize.d.ts.map

package/dist/lib/rich-text/rich-text-sanitize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rich-text-sanitize.d.ts","sourceRoot":"","sources":["../../../src/lib/rich-text/rich-text-sanitize.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAIzE"}

package/dist/lib/rich-text/rich-text-sanitize.js

@@ -0,0 +1,28 @@
+import DOMPurify from 'dompurify';
+/**
+ * Sanitize untrusted HTML for safe rich-text rendering.
+ *
+ * Use this instead of relying on Angular's built-in `[innerHTML]` sanitizer
+ * (which strips ALL SVG and inline styles). Configured for the HTML + SVG
+ * profiles, DOMPurify keeps safe structural HTML **and** inline vector graphics
+ * (`<svg>`, `<path>`, gradients, `<text>`, …) and inline `style`, while removing
+ * the dangerous vectors: `<script>`, `on*` event handlers, `javascript:`/`data:`
+ * script URLs, `<foreignObject>`, and friends.
+ *
+ * Because DOMPurify has already neutralized the markup, a caller may then bind
+ * the result via `DomSanitizer.bypassSecurityTrustHtml(...)` — the documented
+ * safe pattern (sanitize first, then bypass Angular's redundant re-sanitize).
+ * The {@link MJSafeRichHtmlPipe} pipe does exactly that; prefer it in templates.
+ *
+ * Safe for untrusted input by design, so it suits both explicitly-typed HTML
+ * fields and content that was only heuristically detected as HTML.
+ *
+ * @param raw the raw HTML string (null/undefined → '')
+ * @returns a sanitized HTML string safe to render
+ */
+export function PurifyRichTextHtml(raw) {
+    return DOMPurify.sanitize(raw ?? '', {
+        USE_PROFILES: { html: true, svg: true, svgFilters: true },
+    });
+}
+//# sourceMappingURL=rich-text-sanitize.js.map

package/dist/lib/rich-text/rich-text-sanitize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rich-text-sanitize.js","sourceRoot":"","sources":["../../../src/lib/rich-text/rich-text-sanitize.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,WAAW,CAAC;AAElC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAA8B;IAC7D,OAAO,SAAS,CAAC,QAAQ,CAAC,GAAG,IAAI,EAAE,EAAE;QACjC,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE;KAC5D,CAAC,CAAC;AACP,CAAC","sourcesContent":["import DOMPurify from 'dompurify';\n\n/**\n * Sanitize untrusted HTML for safe rich-text rendering.\n *\n * Use this instead of relying on Angular's built-in `[innerHTML]` sanitizer\n * (which strips ALL SVG and inline styles). Configured for the HTML + SVG\n * profiles, DOMPurify keeps safe structural HTML **and** inline vector graphics\n * (`<svg>`, `<path>`, gradients, `<text>`, …) and inline `style`, while removing\n * the dangerous vectors: `<script>`, `on*` event handlers, `javascript:`/`data:`\n * script URLs, `<foreignObject>`, and friends.\n *\n * Because DOMPurify has already neutralized the markup, a caller may then bind\n * the result via `DomSanitizer.bypassSecurityTrustHtml(...)` — the documented\n * safe pattern (sanitize first, then bypass Angular's redundant re-sanitize).\n * The {@link MJSafeRichHtmlPipe} pipe does exactly that; prefer it in templates.\n *\n * Safe for untrusted input by design, so it suits both explicitly-typed HTML\n * fields and content that was only heuristically detected as HTML.\n *\n * @param raw the raw HTML string (null/undefined → '')\n * @returns a sanitized HTML string safe to render\n */\nexport function PurifyRichTextHtml(raw: string | null | undefined): string {\n    return DOMPurify.sanitize(raw ?? '', {\n        USE_PROFILES: { html: true, svg: true, svgFilters: true },\n    });\n}\n"]}

package/dist/lib/rich-text/safe-rich-html.pipe.d.ts

@@ -0,0 +1,24 @@
+import { PipeTransform } from '@angular/core';
+import { SafeHtml } from '@angular/platform-browser';
+import * as i0 from "@angular/core";
+/**
+ * Renders untrusted HTML safely — keeping SVG and richer markup — for use with
+ * `[innerHTML]`. Sanitizes with DOMPurify (HTML + SVG profiles) and then wraps
+ * the cleaned string with `bypassSecurityTrustHtml`, so Angular doesn't strip
+ * the now-safe SVG/styles a second time.
+ *
+ * Pure pipe → Angular memoizes by input value, so it only re-sanitizes when the
+ * string actually changes (cheap under OnPush).
+ *
+ * @example
+ * ```html
+ * <div [innerHTML]="someHtmlString | mjSafeRichHtml"></div>
+ * ```
+ */
+export declare class MJSafeRichHtmlPipe implements PipeTransform {
+    private sanitizer;
+    transform(value: string | null | undefined): SafeHtml;
+    static ɵfac: i0.ɵɵFactoryDeclaration<MJSafeRichHtmlPipe, never>;
+    static ɵpipe: i0.ɵɵPipeDeclaration<MJSafeRichHtmlPipe, "mjSafeRichHtml", true>;
+}
+//# sourceMappingURL=safe-rich-html.pipe.d.ts.map

package/dist/lib/rich-text/safe-rich-html.pipe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-rich-html.pipe.d.ts","sourceRoot":"","sources":["../../../src/lib/rich-text/safe-rich-html.pipe.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,aAAa,EAAU,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAgB,QAAQ,EAAE,MAAM,2BAA2B,CAAC;;AAGnE;;;;;;;;;;;;;GAaG;AACH,qBAKa,kBAAmB,YAAW,aAAa;IACpD,OAAO,CAAC,SAAS,CAAwB;IAEzC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,QAAQ;yCAH5C,kBAAkB;uCAAlB,kBAAkB;CAM9B"}

package/dist/lib/rich-text/safe-rich-html.pipe.js

@@ -0,0 +1,35 @@
+import { Pipe, inject } from '@angular/core';
+import { DomSanitizer } from '@angular/platform-browser';
+import { PurifyRichTextHtml } from './rich-text-sanitize';
+import * as i0 from "@angular/core";
+/**
+ * Renders untrusted HTML safely — keeping SVG and richer markup — for use with
+ * `[innerHTML]`. Sanitizes with DOMPurify (HTML + SVG profiles) and then wraps
+ * the cleaned string with `bypassSecurityTrustHtml`, so Angular doesn't strip
+ * the now-safe SVG/styles a second time.
+ *
+ * Pure pipe → Angular memoizes by input value, so it only re-sanitizes when the
+ * string actually changes (cheap under OnPush).
+ *
+ * @example
+ * ```html
+ * <div [innerHTML]="someHtmlString | mjSafeRichHtml"></div>
+ * ```
+ */
+export class MJSafeRichHtmlPipe {
+    sanitizer = inject(DomSanitizer);
+    transform(value) {
+        return this.sanitizer.bypassSecurityTrustHtml(PurifyRichTextHtml(value));
+    }
+    static ɵfac = function MJSafeRichHtmlPipe_Factory(__ngFactoryType__) { return new (__ngFactoryType__ || MJSafeRichHtmlPipe)(); };
+    static ɵpipe = /*@__PURE__*/ i0.ɵɵdefinePipe({ name: "mjSafeRichHtml", type: MJSafeRichHtmlPipe, pure: true });
+}
+(() => { (typeof ngDevMode === "undefined" || ngDevMode) && i0.ɵsetClassMetadata(MJSafeRichHtmlPipe, [{
+        type: Pipe,
+        args: [{
+                name: 'mjSafeRichHtml',
+                standalone: true,
+                pure: true,
+            }]
+    }], null, null); })();
+//# sourceMappingURL=safe-rich-html.pipe.js.map

package/dist/lib/rich-text/safe-rich-html.pipe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-rich-html.pipe.js","sourceRoot":"","sources":["../../../src/lib/rich-text/safe-rich-html.pipe.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAiB,MAAM,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAY,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;;AAE1D;;;;;;;;;;;;;GAaG;AAMH,MAAM,OAAO,kBAAkB;IACnB,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;IAEzC,SAAS,CAAC,KAAgC;QACtC,OAAO,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7E,CAAC;4GALQ,kBAAkB;iFAAlB,kBAAkB;;iFAAlB,kBAAkB;cAL9B,IAAI;eAAC;gBACF,IAAI,EAAE,gBAAgB;gBACtB,UAAU,EAAE,IAAI;gBAChB,IAAI,EAAE,IAAI;aACb","sourcesContent":["import { Pipe, PipeTransform, inject } from '@angular/core';\nimport { DomSanitizer, SafeHtml } from '@angular/platform-browser';\nimport { PurifyRichTextHtml } from './rich-text-sanitize';\n\n/**\n * Renders untrusted HTML safely — keeping SVG and richer markup — for use with\n * `[innerHTML]`. Sanitizes with DOMPurify (HTML + SVG profiles) and then wraps\n * the cleaned string with `bypassSecurityTrustHtml`, so Angular doesn't strip\n * the now-safe SVG/styles a second time.\n *\n * Pure pipe → Angular memoizes by input value, so it only re-sanitizes when the\n * string actually changes (cheap under OnPush).\n *\n * @example\n * ```html\n * <div [innerHTML]=\"someHtmlString | mjSafeRichHtml\"></div>\n * ```\n */\n@Pipe({\n    name: 'mjSafeRichHtml',\n    standalone: true,\n    pure: true,\n})\nexport class MJSafeRichHtmlPipe implements PipeTransform {\n    private sanitizer = inject(DomSanitizer);\n\n    transform(value: string | null | undefined): SafeHtml {\n        return this.sanitizer.bypassSecurityTrustHtml(PurifyRichTextHtml(value));\n    }\n}\n"]}

package/dist/public-api.d.ts

@@ -2,4 +2,6 @@ export * from './lib/module';
 export * from './lib/recent-access.service';
 export * from './lib/theme.service';
 export * from './lib/loading/loading.component';
+export * from './lib/rich-text/rich-text-sanitize';
+export * from './lib/rich-text/safe-rich-html.pipe';
 //# sourceMappingURL=public-api.d.ts.map

package/dist/public-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"public-api.d.ts","sourceRoot":"","sources":["../src/public-api.ts"],"names":[],"mappings":"AAKA,cAAc,cAAc,CAAC;AAG7B,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qBAAqB,CAAC;AAGpC,cAAc,iCAAiC,CAAC"}
+{"version":3,"file":"public-api.d.ts","sourceRoot":"","sources":["../src/public-api.ts"],"names":[],"mappings":"AAKA,cAAc,cAAc,CAAC;AAG7B,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qBAAqB,CAAC;AAGpC,cAAc,iCAAiC,CAAC;AAGhD,cAAc,oCAAoC,CAAC;AACnD,cAAc,qCAAqC,CAAC"}

package/dist/public-api.js

@@ -8,4 +8,7 @@ export * from './lib/recent-access.service';
 export * from './lib/theme.service';
 // Components
 export * from './lib/loading/loading.component';
+// Rich-text rendering (safe HTML/SVG sanitization)
+export * from './lib/rich-text/rich-text-sanitize';
+export * from './lib/rich-text/safe-rich-html.pipe';
 //# sourceMappingURL=public-api.js.map

package/dist/public-api.js.map

@@ -1 +1 @@
-{"version":3,"file":"public-api.js","sourceRoot":"","sources":["../src/public-api.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,SAAS;AACT,cAAc,cAAc,CAAC;AAE7B,WAAW;AACX,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qBAAqB,CAAC;AAEpC,aAAa;AACb,cAAc,iCAAiC,CAAC","sourcesContent":["/*\n * Public API Surface for @memberjunction/ng-shared-generic\n */\n\n// Module\nexport * from './lib/module';\n\n// Services\nexport * from './lib/recent-access.service';\nexport * from './lib/theme.service';\n\n// Components\nexport * from './lib/loading/loading.component';\n"]}
+{"version":3,"file":"public-api.js","sourceRoot":"","sources":["../src/public-api.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,SAAS;AACT,cAAc,cAAc,CAAC;AAE7B,WAAW;AACX,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qBAAqB,CAAC;AAEpC,aAAa;AACb,cAAc,iCAAiC,CAAC;AAEhD,mDAAmD;AACnD,cAAc,oCAAoC,CAAC;AACnD,cAAc,qCAAqC,CAAC","sourcesContent":["/*\n * Public API Surface for @memberjunction/ng-shared-generic\n */\n\n// Module\nexport * from './lib/module';\n\n// Services\nexport * from './lib/recent-access.service';\nexport * from './lib/theme.service';\n\n// Components\nexport * from './lib/loading/loading.component';\n\n// Rich-text rendering (safe HTML/SVG sanitization)\nexport * from './lib/rich-text/rich-text-sanitize';\nexport * from './lib/rich-text/safe-rich-html.pipe';\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@memberjunction/ng-shared-generic",
-  "version": "5.37.0",
+  "version": "5.39.0",
   "description": "MemberJunction: Generic Angular Shared Package - utility services and reusable elements used in any Angular application.",
   "main": "./dist/public-api.js",
   "typings": "./dist/public-api.d.ts",
@@ -8,7 +8,7 @@
     "/dist"
   ],
   "scripts": {
-    "test": "echo \"No tests configured yet\"",
+    "test": "vitest run",
     "build": "npm run clean && ngc && npm run copy-assets",
     "copy-assets": "cpy 'src/lib/_tokens.scss' dist/lib --flat",
     "clean": "rimraf dist",
@@ -28,13 +28,15 @@
   "peerDependencies": {
     "@angular/common": "21.1.3",
     "@angular/core": "21.1.3",
+    "@angular/platform-browser": "21.1.3",
     "rxjs": "^7.8.2"
   },
   "dependencies": {
-    "@memberjunction/core": "5.37.0",
-    "@memberjunction/ng-base-types": "5.37.0",
-    "@memberjunction/core-entities": "5.37.0",
-    "@memberjunction/global": "5.37.0",
+    "@memberjunction/core": "5.39.0",
+    "@memberjunction/ng-base-types": "5.39.0",
+    "@memberjunction/core-entities": "5.39.0",
+    "@memberjunction/global": "5.39.0",
+    "dompurify": "^3.3.0",
     "tslib": "^2.8.1"
   },
   "sideEffects": false,