@mmlogic/components 0.5.0 → 0.5.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (47) hide show
  1. package/dist/cjs/cell-renderer-CmaO0CZT.js +862 -0
  2. package/dist/cjs/loader.cjs.js +1 -1
  3. package/dist/cjs/mosterdcomponents.cjs.js +1 -1
  4. package/dist/cjs/mrd-boolean-field_23.cjs.entry.js +2506 -832
  5. package/dist/cjs/mrd-merge-view.cjs.entry.js +273 -0
  6. package/dist/collection/collection-manifest.json +1 -0
  7. package/dist/collection/components/documents/mrd-document-view/mrd-document-view.css +27 -24
  8. package/dist/collection/components/documents/mrd-document-view/mrd-document-view.js +16 -9
  9. package/dist/collection/components/fields/mrd-textarea-field/mrd-textarea-field.js +9 -5
  10. package/dist/collection/components/merge/mrd-merge-view/merge-diff.js +99 -0
  11. package/dist/collection/components/merge/mrd-merge-view/merge-parts.js +44 -0
  12. package/dist/collection/components/merge/mrd-merge-view/mrd-merge-view.css +244 -0
  13. package/dist/collection/components/merge/mrd-merge-view/mrd-merge-view.js +397 -0
  14. package/dist/collection/components/table/mrd-table/mrd-table.js +2 -4
  15. package/dist/collection/components/table/mrd-table/table-parts.js +2 -5
  16. package/dist/collection/dev/api.js +24 -0
  17. package/dist/collection/dev/app.js +84 -4
  18. package/dist/collection/dev/example-data.js +2 -1
  19. package/dist/collection/utils/cell-renderer.js +6 -1
  20. package/dist/collection/utils/i18n.js +104 -0
  21. package/dist/components/cell-renderer.js +1 -0
  22. package/dist/components/format.js +1 -1
  23. package/dist/components/i18n.js +1 -1
  24. package/dist/components/mrd-document-view2.js +1 -1
  25. package/dist/components/mrd-layout-section.js +1 -1
  26. package/dist/components/mrd-merge-view.d.ts +11 -0
  27. package/dist/components/mrd-merge-view.js +1 -0
  28. package/dist/components/mrd-table2.js +1 -1
  29. package/dist/components/mrd-textarea-field2.js +2 -1
  30. package/dist/esm/cell-renderer-D63AUZxa.js +854 -0
  31. package/dist/esm/loader.js +1 -1
  32. package/dist/esm/mosterdcomponents.js +1 -1
  33. package/dist/esm/mrd-boolean-field_23.entry.js +2437 -763
  34. package/dist/esm/mrd-merge-view.entry.js +271 -0
  35. package/dist/mosterdcomponents/mosterdcomponents.esm.js +1 -1
  36. package/dist/mosterdcomponents/p-2e16a7d0.entry.js +1 -0
  37. package/dist/mosterdcomponents/p-CnqDM0Gb.js +1 -0
  38. package/dist/mosterdcomponents/p-b5f38707.entry.js +3 -0
  39. package/dist/types/components/documents/mrd-document-view/mrd-document-view.d.ts +9 -5
  40. package/dist/types/components/fields/mrd-textarea-field/mrd-textarea-field.d.ts +1 -0
  41. package/dist/types/components/merge/mrd-merge-view/merge-diff.d.ts +43 -0
  42. package/dist/types/components/merge/mrd-merge-view/merge-parts.d.ts +37 -0
  43. package/dist/types/components/merge/mrd-merge-view/mrd-merge-view.d.ts +68 -0
  44. package/dist/types/components.d.ts +167 -12
  45. package/dist/types/types/client-layout.d.ts +2 -3
  46. package/package.json +2 -1
  47. package/dist/mosterdcomponents/p-b56f9802.entry.js +0 -1
@@ -1,6 +1,7 @@
1
1
  'use strict';
2
2
 
3
3
  var index = require('./index-DzRfoAPz.js');
4
+ var cellRenderer = require('./cell-renderer-CmaO0CZT.js');
4
5
  var clientLayout = require('./client-layout-RZ3Ix-4a.js');
5
6
 
6
7
  const mrdBooleanFieldCss = () => `.sc-mrd-boolean-field-h{display:block}.mrd-boolean-field.sc-mrd-boolean-field{display:flex;align-items:center;width:100%}.mrd-boolean-field__toggle-label.sc-mrd-boolean-field{display:flex;align-items:center;gap:var(--mrd-space-3);cursor:pointer;user-select:none}.mrd-boolean-field__checkbox.sc-mrd-boolean-field{position:absolute;opacity:0;width:0;height:0;pointer-events:none}.mrd-boolean-field__checkbox.sc-mrd-boolean-field:checked+.mrd-boolean-field__toggle.sc-mrd-boolean-field{background-color:var(--mrd-color-primary)}.mrd-boolean-field__checkbox.sc-mrd-boolean-field:checked+.mrd-boolean-field__toggle.sc-mrd-boolean-field::after{transform:translateX(20px)}.mrd-boolean-field__checkbox.sc-mrd-boolean-field:focus+.mrd-boolean-field__toggle.sc-mrd-boolean-field{box-shadow:var(--mrd-shadow-focus)}.mrd-boolean-field__checkbox.sc-mrd-boolean-field:disabled+.mrd-boolean-field__toggle.sc-mrd-boolean-field{opacity:0.5;cursor:not-allowed}.mrd-boolean-field__toggle.sc-mrd-boolean-field{position:relative;display:inline-block;width:44px;height:24px;background-color:var(--mrd-color-neutral-300);border-radius:var(--mrd-border-radius-full);transition:background-color var(--mrd-transition);flex-shrink:0}.mrd-boolean-field__toggle.sc-mrd-boolean-field::after{content:"";position:absolute;top:2px;left:2px;width:20px;height:20px;background-color:var(--mrd-color-white);border-radius:50%;transition:transform var(--mrd-transition);box-shadow:var(--mrd-shadow-sm)}.mrd-boolean-field__text.sc-mrd-boolean-field{font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-base);color:var(--mrd-color-neutral-800)}.mrd-boolean-field__text--required.sc-mrd-boolean-field::after{content:" *";color:var(--mrd-color-danger)}`;
@@ -34,644 +35,6 @@ const MrdBooleanField = class {
34
35
  };
35
36
  MrdBooleanField.style = mrdBooleanFieldCss();
36
37
 
37
- function formatNumber(value, locale, options) {
38
- if (value === null || value === undefined || isNaN(value))
39
- return '';
40
- return new Intl.NumberFormat(locale, options).format(value);
41
- }
42
- function formatCurrency(amount, currency, locale) {
43
- if (amount === null || amount === undefined || isNaN(amount))
44
- return '';
45
- return new Intl.NumberFormat(locale, {
46
- style: 'currency',
47
- currency,
48
- minimumFractionDigits: 2,
49
- maximumFractionDigits: 2,
50
- }).format(amount);
51
- }
52
- function formatPercentage(value, locale, decimalPrecision = 2) {
53
- if (value === null || value === undefined || isNaN(value))
54
- return '';
55
- return new Intl.NumberFormat(locale, {
56
- style: 'percent',
57
- minimumFractionDigits: decimalPrecision,
58
- maximumFractionDigits: decimalPrecision,
59
- }).format(value);
60
- }
61
- function formatDate(value, locale) {
62
- if (!value)
63
- return '';
64
- const date = typeof value === 'string' ? new Date(value) : value;
65
- if (isNaN(date.getTime()))
66
- return '';
67
- return new Intl.DateTimeFormat(locale, { year: 'numeric', month: '2-digit', day: '2-digit' }).format(date);
68
- }
69
- function formatDateTime(value, locale) {
70
- if (!value)
71
- return '';
72
- const date = typeof value === 'string' ? new Date(value) : value;
73
- if (isNaN(date.getTime()))
74
- return '';
75
- return new Intl.DateTimeFormat(locale, {
76
- year: 'numeric',
77
- month: '2-digit',
78
- day: '2-digit',
79
- hour: '2-digit',
80
- minute: '2-digit',
81
- }).format(date);
82
- }
83
- function formatTime(value, locale) {
84
- if (!value)
85
- return '';
86
- // value is HH:MM or HH:MM:SS
87
- const [hours, minutes] = value.split(':').map(Number);
88
- const date = new Date();
89
- date.setHours(hours, minutes, 0, 0);
90
- return new Intl.DateTimeFormat(locale, { hour: '2-digit', minute: '2-digit' }).format(date);
91
- }
92
- function parseLocalizedNumber(str, locale) {
93
- var _a, _b, _c, _d;
94
- if (!str || !str.trim())
95
- return null;
96
- // Detect decimal and thousands separators from the locale
97
- const parts = new Intl.NumberFormat(locale).formatToParts(1234567.89);
98
- const groupSep = (_b = (_a = parts.find((p) => p.type === 'group')) === null || _a === void 0 ? void 0 : _a.value) !== null && _b !== void 0 ? _b : ',';
99
- const decimalSep = (_d = (_c = parts.find((p) => p.type === 'decimal')) === null || _c === void 0 ? void 0 : _c.value) !== null && _d !== void 0 ? _d : '.';
100
- // Remove group separators, replace decimal separator with '.'
101
- const normalized = str
102
- .replace(new RegExp(`\\${groupSep}`, 'g'), '')
103
- .replace(new RegExp(`\\${decimalSep}`), '.')
104
- .replace('%', '')
105
- .trim();
106
- const parsed = parseFloat(normalized);
107
- return isNaN(parsed) ? null : parsed;
108
- }
109
-
110
- const translations = {
111
- nl: {
112
- required: 'Dit veld is verplicht',
113
- select_placeholder: 'Selecteer een optie',
114
- search_placeholder: 'Zoeken...',
115
- upload_file: 'Bestand uploaden',
116
- choose_file: 'Bestand kiezen',
117
- clear: 'Wissen',
118
- today: 'Vandaag',
119
- invalid_email: 'Voer een geldig e-mailadres in',
120
- invalid_url: 'Voer een geldige URL in',
121
- invalid_number: 'Voer een geldig getal in',
122
- drop_file_here: 'Sleep bestand hierheen of',
123
- browse: 'bladeren',
124
- file_too_large: 'Bestand is te groot',
125
- invalid_image: 'Selecteer een afbeeldingsbestand',
126
- search_results: 'Zoekresultaten',
127
- no_results: 'Geen resultaten gevonden',
128
- load_failed_retry: 'Laden mislukt — opnieuw proberen',
129
- loading: 'Laden...',
130
- submit: 'Opslaan',
131
- cancel: 'Annuleren',
132
- remove: 'Verwijderen',
133
- add: 'Toevoegen',
134
- yes: 'Ja',
135
- no: 'Nee',
136
- // mrd-table footer
137
- table_of: 'van',
138
- download: 'Downloaden',
139
- // mrd-table toolbar
140
- table_filter: 'Filteren',
141
- table_filter_hide: 'Filter verbergen',
142
- table_filter_active: 'actief',
143
- table_filter_clear_all: 'Alle filters wissen',
144
- table_new_record: 'Nieuw record',
145
- table_export_excel: 'Exporteer naar Excel',
146
- doc_view_switch: 'Weergave wisselen',
147
- doc_view_tree: 'Boomweergave',
148
- doc_view_list: 'Lijstweergave',
149
- // mrd-table filter popup
150
- filter_sorting: 'Sortering',
151
- filter_ascending: 'Oplopend',
152
- filter_descending: 'Aflopend',
153
- filter_section: 'Filter',
154
- filter_apply: 'Toepassen',
155
- filter_clear: 'Wissen',
156
- filter_contains: 'Bevat',
157
- filter_starts_with: 'Begint met',
158
- filter_equals: 'Gelijk aan',
159
- filter_has_value: 'Heeft waarde',
160
- filter_is_empty: 'Is leeg',
161
- filter_is_not_empty: 'Is niet leeg',
162
- filter_exact: 'Exact',
163
- filter_range: 'Bereik',
164
- filter_from: 'Van',
165
- filter_to: 'Tot',
166
- filter_all: 'Alle',
167
- filter_select_all: 'Alles',
168
- filter_select_none: 'Geen',
169
- filter_search_value: 'Zoekwaarde...',
170
- filter_no_support: 'Geen filtering beschikbaar voor dit veldtype.',
171
- // mrd-table textblock
172
- textblock_show_more: 'Meer tonen',
173
- close: 'Sluiten',
174
- // history badge
175
- history_until: 'tot',
176
- history_badge_tooltip: 'Vorige waarden',
177
- hyperlink_name: 'Linktekst (optioneel)',
178
- // mrd-document-list
179
- new_folder: 'Nieuwe folder',
180
- folder_name_placeholder: 'Foldernaam',
181
- folder_no_slash: "Een foldernaam mag geen '/' bevatten",
182
- folder_duplicate: 'Er bestaat al een folder met deze naam',
183
- doc_empty_drop: 'Nog geen documenten — sleep bestanden hierheen',
184
- },
185
- en: {
186
- required: 'This field is required',
187
- select_placeholder: 'Select an option',
188
- search_placeholder: 'Search...',
189
- upload_file: 'Upload file',
190
- choose_file: 'Choose file',
191
- clear: 'Clear',
192
- today: 'Today',
193
- invalid_email: 'Please enter a valid email address',
194
- invalid_url: 'Please enter a valid URL',
195
- invalid_number: 'Please enter a valid number',
196
- drop_file_here: 'Drop file here or',
197
- browse: 'browse',
198
- file_too_large: 'File is too large',
199
- invalid_image: 'Please select an image file',
200
- search_results: 'Search results',
201
- no_results: 'No results found',
202
- load_failed_retry: 'Failed to load — retry',
203
- loading: 'Loading...',
204
- submit: 'Save',
205
- cancel: 'Cancel',
206
- remove: 'Remove',
207
- add: 'Add',
208
- yes: 'Yes',
209
- no: 'No',
210
- // mrd-table footer
211
- table_of: 'of',
212
- download: 'Download',
213
- // mrd-table toolbar
214
- table_filter: 'Filter',
215
- table_filter_hide: 'Hide filter',
216
- table_filter_active: 'active',
217
- table_filter_clear_all: 'Clear all filters',
218
- table_new_record: 'New record',
219
- table_export_excel: 'Export to Excel',
220
- doc_view_switch: 'Switch view',
221
- doc_view_tree: 'Tree view',
222
- doc_view_list: 'List view',
223
- // mrd-table filter popup
224
- filter_sorting: 'Sorting',
225
- filter_ascending: 'Ascending',
226
- filter_descending: 'Descending',
227
- filter_section: 'Filter',
228
- filter_apply: 'Apply',
229
- filter_clear: 'Clear',
230
- filter_contains: 'Contains',
231
- filter_starts_with: 'Starts with',
232
- filter_equals: 'Equals',
233
- filter_has_value: 'Has value',
234
- filter_is_empty: 'Is empty',
235
- filter_is_not_empty: 'Is not empty',
236
- filter_exact: 'Exact',
237
- filter_range: 'Range',
238
- filter_from: 'From',
239
- filter_to: 'To',
240
- filter_all: 'All',
241
- filter_select_all: 'All',
242
- filter_select_none: 'None',
243
- filter_search_value: 'Search value...',
244
- filter_no_support: 'Filtering is not available for this field type.',
245
- // mrd-table textblock
246
- textblock_show_more: 'Show more',
247
- close: 'Close',
248
- // history badge
249
- history_until: 'until',
250
- history_badge_tooltip: 'Previous values',
251
- hyperlink_name: 'Link text (optional)',
252
- // mrd-document-list
253
- new_folder: 'New folder',
254
- folder_name_placeholder: 'Folder name',
255
- folder_no_slash: "A folder name cannot contain '/'",
256
- folder_duplicate: 'A folder with this name already exists',
257
- doc_empty_drop: 'No documents yet — drop files here',
258
- },
259
- ar: {
260
- required: 'هذا الحقل مطلوب',
261
- select_placeholder: 'اختر خياراً',
262
- search_placeholder: 'بحث...',
263
- upload_file: 'رفع ملف',
264
- choose_file: 'اختر ملفاً',
265
- clear: 'مسح',
266
- today: 'اليوم',
267
- invalid_email: 'يرجى إدخال عنوان بريد إلكتروني صحيح',
268
- invalid_url: 'يرجى إدخال رابط صحيح',
269
- invalid_number: 'يرجى إدخال رقم صحيح',
270
- drop_file_here: 'اسحب الملف هنا أو',
271
- browse: 'تصفح',
272
- file_too_large: 'الملف كبير جداً',
273
- invalid_image: 'يرجى اختيار ملف صورة',
274
- search_results: 'نتائج البحث',
275
- no_results: 'لم يتم العثور على نتائج',
276
- load_failed_retry: 'فشل التحميل — إعادة المحاولة',
277
- loading: 'جار التحميل...',
278
- submit: 'حفظ',
279
- cancel: 'إلغاء',
280
- remove: 'إزالة',
281
- add: 'إضافة',
282
- yes: 'نعم',
283
- no: 'لا',
284
- // mrd-table footer
285
- table_of: 'من أصل',
286
- download: 'تنزيل',
287
- // mrd-table toolbar
288
- table_filter: 'تصفية',
289
- table_filter_hide: 'إخفاء التصفية',
290
- table_filter_active: 'نشط',
291
- table_filter_clear_all: 'مسح جميع الفلاتر',
292
- table_new_record: 'سجل جديد',
293
- table_export_excel: 'تصدير إلى Excel',
294
- doc_view_switch: 'تبديل العرض',
295
- doc_view_tree: 'عرض شجري',
296
- doc_view_list: 'عرض القائمة',
297
- // mrd-table filter popup
298
- filter_sorting: 'الترتيب',
299
- filter_ascending: 'تصاعدي',
300
- filter_descending: 'تنازلي',
301
- filter_section: 'تصفية',
302
- filter_apply: 'تطبيق',
303
- filter_clear: 'مسح',
304
- filter_contains: 'يحتوي على',
305
- filter_starts_with: 'يبدأ بـ',
306
- filter_equals: 'يساوي',
307
- filter_has_value: 'له قيمة',
308
- filter_is_empty: 'فارغ',
309
- filter_is_not_empty: 'ليس فارغاً',
310
- filter_exact: 'دقيق',
311
- filter_range: 'نطاق',
312
- filter_from: 'من',
313
- filter_to: 'إلى',
314
- filter_all: 'الكل',
315
- filter_select_all: 'الكل',
316
- filter_select_none: 'لا شيء',
317
- filter_search_value: 'قيمة البحث...',
318
- filter_no_support: 'التصفية غير متاحة لهذا النوع من الحقول.',
319
- // mrd-table textblock
320
- textblock_show_more: 'عرض المزيد',
321
- close: 'إغلاق',
322
- // history badge
323
- history_until: 'حتى',
324
- history_badge_tooltip: 'القيم السابقة',
325
- hyperlink_name: 'نص الرابط (اختياري)',
326
- },
327
- fr: {
328
- required: 'Ce champ est obligatoire',
329
- select_placeholder: 'Sélectionner une option',
330
- search_placeholder: 'Rechercher...',
331
- upload_file: 'Télécharger un fichier',
332
- choose_file: 'Choisir un fichier',
333
- clear: 'Effacer',
334
- today: "Aujourd'hui",
335
- invalid_email: 'Veuillez saisir une adresse e-mail valide',
336
- invalid_url: 'Veuillez saisir une URL valide',
337
- invalid_number: 'Veuillez saisir un nombre valide',
338
- drop_file_here: 'Déposez le fichier ici ou',
339
- browse: 'parcourir',
340
- file_too_large: 'Le fichier est trop volumineux',
341
- invalid_image: 'Veuillez sélectionner un fichier image',
342
- search_results: 'Résultats de recherche',
343
- no_results: 'Aucun résultat trouvé',
344
- load_failed_retry: 'Échec du chargement — réessayer',
345
- loading: 'Chargement...',
346
- submit: 'Enregistrer',
347
- cancel: 'Annuler',
348
- remove: 'Supprimer',
349
- add: 'Ajouter',
350
- yes: 'Oui',
351
- no: 'Non',
352
- // mrd-table footer
353
- table_of: 'sur',
354
- download: 'Télécharger',
355
- // mrd-table toolbar
356
- table_filter: 'Filtrer',
357
- table_filter_hide: 'Masquer le filtre',
358
- table_filter_active: 'actif',
359
- table_filter_clear_all: 'Effacer tous les filtres',
360
- table_new_record: 'Nouvel enregistrement',
361
- table_export_excel: 'Exporter vers Excel',
362
- doc_view_switch: 'Changer de vue',
363
- doc_view_tree: 'Vue arborescente',
364
- doc_view_list: 'Vue liste',
365
- // mrd-table filter popup
366
- filter_sorting: 'Tri',
367
- filter_ascending: 'Croissant',
368
- filter_descending: 'Décroissant',
369
- filter_section: 'Filtre',
370
- filter_apply: 'Appliquer',
371
- filter_clear: 'Effacer',
372
- filter_contains: 'Contient',
373
- filter_starts_with: 'Commence par',
374
- filter_equals: 'Égal à',
375
- filter_has_value: 'A une valeur',
376
- filter_is_empty: 'Est vide',
377
- filter_is_not_empty: "N'est pas vide",
378
- filter_exact: 'Exact',
379
- filter_range: 'Plage',
380
- filter_from: 'De',
381
- filter_to: 'À',
382
- filter_all: 'Tous',
383
- filter_select_all: 'Tous',
384
- filter_select_none: 'Aucun',
385
- filter_search_value: 'Valeur de recherche...',
386
- filter_no_support: "Le filtrage n'est pas disponible pour ce type de champ.",
387
- // mrd-table textblock
388
- textblock_show_more: 'Voir plus',
389
- close: 'Fermer',
390
- // history badge
391
- history_until: "jusqu'au",
392
- history_badge_tooltip: 'Valeurs précédentes',
393
- hyperlink_name: 'Texte du lien (optionnel)',
394
- },
395
- de: {
396
- required: 'Dieses Feld ist erforderlich',
397
- select_placeholder: 'Option auswählen',
398
- search_placeholder: 'Suchen...',
399
- upload_file: 'Datei hochladen',
400
- choose_file: 'Datei auswählen',
401
- clear: 'Löschen',
402
- today: 'Heute',
403
- invalid_email: 'Bitte geben Sie eine gültige E-Mail-Adresse ein',
404
- invalid_url: 'Bitte geben Sie eine gültige URL ein',
405
- invalid_number: 'Bitte geben Sie eine gültige Zahl ein',
406
- drop_file_here: 'Datei hier ablegen oder',
407
- browse: 'durchsuchen',
408
- file_too_large: 'Datei ist zu groß',
409
- invalid_image: 'Bitte eine Bilddatei auswählen',
410
- search_results: 'Suchergebnisse',
411
- no_results: 'Keine Ergebnisse gefunden',
412
- load_failed_retry: 'Laden fehlgeschlagen — erneut versuchen',
413
- loading: 'Laden...',
414
- submit: 'Speichern',
415
- cancel: 'Abbrechen',
416
- remove: 'Entfernen',
417
- add: 'Hinzufügen',
418
- yes: 'Ja',
419
- no: 'Nein',
420
- // mrd-table footer
421
- table_of: 'von',
422
- download: 'Herunterladen',
423
- // mrd-table toolbar
424
- table_filter: 'Filtern',
425
- table_filter_hide: 'Filter ausblenden',
426
- table_filter_active: 'aktiv',
427
- table_filter_clear_all: 'Alle Filter löschen',
428
- table_new_record: 'Neuer Eintrag',
429
- table_export_excel: 'Als Excel exportieren',
430
- doc_view_switch: 'Ansicht wechseln',
431
- doc_view_tree: 'Baumansicht',
432
- doc_view_list: 'Listenansicht',
433
- // mrd-table filter popup
434
- filter_sorting: 'Sortierung',
435
- filter_ascending: 'Aufsteigend',
436
- filter_descending: 'Absteigend',
437
- filter_section: 'Filter',
438
- filter_apply: 'Anwenden',
439
- filter_clear: 'Löschen',
440
- filter_contains: 'Enthält',
441
- filter_starts_with: 'Beginnt mit',
442
- filter_equals: 'Gleich',
443
- filter_has_value: 'Hat Wert',
444
- filter_is_empty: 'Ist leer',
445
- filter_is_not_empty: 'Ist nicht leer',
446
- filter_exact: 'Genau',
447
- filter_range: 'Bereich',
448
- filter_from: 'Von',
449
- filter_to: 'Bis',
450
- filter_all: 'Alle',
451
- filter_select_all: 'Alle',
452
- filter_select_none: 'Keine',
453
- filter_search_value: 'Suchwert...',
454
- filter_no_support: 'Filterung ist für diesen Feldtyp nicht verfügbar.',
455
- // mrd-table textblock
456
- textblock_show_more: 'Mehr anzeigen',
457
- close: 'Schließen',
458
- // history badge
459
- history_until: 'bis',
460
- history_badge_tooltip: 'Vorherige Werte',
461
- hyperlink_name: 'Linktext (optional)',
462
- },
463
- es: {
464
- required: 'Este campo es obligatorio',
465
- select_placeholder: 'Seleccionar una opción',
466
- search_placeholder: 'Buscar...',
467
- upload_file: 'Subir archivo',
468
- choose_file: 'Elegir archivo',
469
- clear: 'Borrar',
470
- today: 'Hoy',
471
- invalid_email: 'Por favor, introduzca una dirección de correo electrónico válida',
472
- invalid_url: 'Por favor, introduzca una URL válida',
473
- invalid_number: 'Por favor, introduzca un número válido',
474
- drop_file_here: 'Suelte el archivo aquí o',
475
- browse: 'explorar',
476
- file_too_large: 'El archivo es demasiado grande',
477
- invalid_image: 'Seleccione un archivo de imagen',
478
- search_results: 'Resultados de búsqueda',
479
- no_results: 'No se encontraron resultados',
480
- load_failed_retry: 'Error al cargar — reintentar',
481
- loading: 'Cargando...',
482
- submit: 'Guardar',
483
- cancel: 'Cancelar',
484
- remove: 'Eliminar',
485
- add: 'Añadir',
486
- yes: 'Sí',
487
- no: 'No',
488
- // mrd-table footer
489
- table_of: 'de',
490
- download: 'Descargar',
491
- // mrd-table toolbar
492
- table_filter: 'Filtrar',
493
- table_filter_hide: 'Ocultar filtro',
494
- table_filter_active: 'activo',
495
- table_filter_clear_all: 'Borrar todos los filtros',
496
- table_new_record: 'Nuevo registro',
497
- table_export_excel: 'Exportar a Excel',
498
- doc_view_switch: 'Cambiar vista',
499
- doc_view_tree: 'Vista de árbol',
500
- doc_view_list: 'Vista de lista',
501
- // mrd-table filter popup
502
- filter_sorting: 'Ordenación',
503
- filter_ascending: 'Ascendente',
504
- filter_descending: 'Descendente',
505
- filter_section: 'Filtro',
506
- filter_apply: 'Aplicar',
507
- filter_clear: 'Borrar',
508
- filter_contains: 'Contiene',
509
- filter_starts_with: 'Empieza por',
510
- filter_equals: 'Igual a',
511
- filter_has_value: 'Tiene valor',
512
- filter_is_empty: 'Está vacío',
513
- filter_is_not_empty: 'No está vacío',
514
- filter_exact: 'Exacto',
515
- filter_range: 'Rango',
516
- filter_from: 'Desde',
517
- filter_to: 'Hasta',
518
- filter_all: 'Todos',
519
- filter_select_all: 'Todos',
520
- filter_select_none: 'Ninguno',
521
- filter_search_value: 'Valor de búsqueda...',
522
- filter_no_support: 'El filtrado no está disponible para este tipo de campo.',
523
- // mrd-table textblock
524
- textblock_show_more: 'Mostrar más',
525
- close: 'Cerrar',
526
- // history badge
527
- history_until: 'hasta',
528
- history_badge_tooltip: 'Valores anteriores',
529
- hyperlink_name: 'Texto del enlace (opcional)',
530
- },
531
- it: {
532
- required: 'Questo campo è obbligatorio',
533
- select_placeholder: "Seleziona un'opzione",
534
- search_placeholder: 'Cerca...',
535
- upload_file: 'Carica file',
536
- choose_file: 'Scegli file',
537
- clear: 'Cancella',
538
- today: 'Oggi',
539
- invalid_email: 'Inserisci un indirizzo email valido',
540
- invalid_url: 'Inserisci un URL valido',
541
- invalid_number: 'Inserisci un numero valido',
542
- drop_file_here: 'Trascina il file qui o',
543
- browse: 'sfoglia',
544
- file_too_large: 'Il file è troppo grande',
545
- invalid_image: 'Seleziona un file immagine',
546
- search_results: 'Risultati della ricerca',
547
- no_results: 'Nessun risultato trovato',
548
- load_failed_retry: 'Caricamento non riuscito — riprova',
549
- loading: 'Caricamento...',
550
- submit: 'Salva',
551
- cancel: 'Annulla',
552
- remove: 'Rimuovi',
553
- add: 'Aggiungi',
554
- yes: 'Sì',
555
- no: 'No',
556
- // mrd-table footer
557
- table_of: 'di',
558
- download: 'Scarica',
559
- // mrd-table toolbar
560
- table_filter: 'Filtra',
561
- table_filter_hide: 'Nascondi filtro',
562
- table_filter_active: 'attivo',
563
- table_filter_clear_all: 'Cancella tutti i filtri',
564
- table_new_record: 'Nuovo record',
565
- table_export_excel: 'Esporta in Excel',
566
- doc_view_switch: 'Cambia vista',
567
- doc_view_tree: 'Vista ad albero',
568
- doc_view_list: 'Vista elenco',
569
- // mrd-table filter popup
570
- filter_sorting: 'Ordinamento',
571
- filter_ascending: 'Crescente',
572
- filter_descending: 'Decrescente',
573
- filter_section: 'Filtro',
574
- filter_apply: 'Applica',
575
- filter_clear: 'Cancella',
576
- filter_contains: 'Contiene',
577
- filter_starts_with: 'Inizia con',
578
- filter_equals: 'Uguale a',
579
- filter_has_value: 'Ha valore',
580
- filter_is_empty: 'È vuoto',
581
- filter_is_not_empty: 'Non è vuoto',
582
- filter_exact: 'Esatto',
583
- filter_range: 'Intervallo',
584
- filter_from: 'Da',
585
- filter_to: 'A',
586
- filter_all: 'Tutti',
587
- filter_select_all: 'Tutti',
588
- filter_select_none: 'Nessuno',
589
- filter_search_value: 'Valore di ricerca...',
590
- filter_no_support: 'Il filtro non è disponibile per questo tipo di campo.',
591
- // mrd-table textblock
592
- textblock_show_more: 'Mostra altro',
593
- close: 'Chiudi',
594
- // history badge
595
- history_until: 'fino a',
596
- history_badge_tooltip: 'Valori precedenti',
597
- hyperlink_name: 'Testo del collegamento (opzionale)',
598
- },
599
- uk: {
600
- required: "Це поле обов'язкове",
601
- select_placeholder: 'Виберіть варіант',
602
- search_placeholder: 'Пошук...',
603
- upload_file: 'Завантажити файл',
604
- choose_file: 'Вибрати файл',
605
- clear: 'Очистити',
606
- today: 'Сьогодні',
607
- invalid_email: 'Будь ласка, введіть дійсну адресу електронної пошти',
608
- invalid_url: 'Будь ласка, введіть дійсну URL-адресу',
609
- invalid_number: 'Будь ласка, введіть дійсне число',
610
- drop_file_here: 'Перетягніть файл сюди або',
611
- browse: 'огляд',
612
- file_too_large: 'Файл занадто великий',
613
- invalid_image: 'Будь ласка, виберіть файл зображення',
614
- search_results: 'Результати пошуку',
615
- no_results: 'Результатів не знайдено',
616
- load_failed_retry: 'Не вдалося завантажити — повторити',
617
- loading: 'Завантаження...',
618
- submit: 'Зберегти',
619
- cancel: 'Скасувати',
620
- remove: 'Видалити',
621
- add: 'Додати',
622
- yes: 'Так',
623
- no: 'Ні',
624
- // mrd-table footer
625
- table_of: 'з',
626
- download: 'Завантажити',
627
- // mrd-table toolbar
628
- table_filter: 'Фільтрувати',
629
- table_filter_hide: 'Сховати фільтр',
630
- table_filter_active: 'активний',
631
- table_filter_clear_all: 'Очистити всі фільтри',
632
- table_new_record: 'Новий запис',
633
- table_export_excel: 'Експортувати до Excel',
634
- doc_view_switch: 'Змінити вигляд',
635
- doc_view_tree: 'Деревоподібний вигляд',
636
- doc_view_list: 'Список',
637
- // mrd-table filter popup
638
- filter_sorting: 'Сортування',
639
- filter_ascending: 'За зростанням',
640
- filter_descending: 'За спаданням',
641
- filter_section: 'Фільтр',
642
- filter_apply: 'Застосувати',
643
- filter_clear: 'Очистити',
644
- filter_contains: 'Містить',
645
- filter_starts_with: 'Починається з',
646
- filter_equals: 'Дорівнює',
647
- filter_has_value: 'Має значення',
648
- filter_is_empty: 'Порожнє',
649
- filter_is_not_empty: 'Не порожнє',
650
- filter_exact: 'Точно',
651
- filter_range: 'Діапазон',
652
- filter_from: 'Від',
653
- filter_to: 'До',
654
- filter_all: 'Всі',
655
- filter_select_all: 'Всі',
656
- filter_select_none: 'Жодного',
657
- filter_search_value: 'Значення для пошуку...',
658
- filter_no_support: 'Фільтрування недоступне для цього типу поля.',
659
- // mrd-table textblock
660
- textblock_show_more: 'Показати більше',
661
- close: 'Закрити',
662
- // history badge
663
- history_until: 'до',
664
- history_badge_tooltip: 'Попередні значення',
665
- hyperlink_name: "Текст посилання (необов'язково)",
666
- },
667
- };
668
- function t(key, locale) {
669
- var _a, _b, _c;
670
- const lang = (locale !== null && locale !== void 0 ? locale : 'en').split('-')[0].toLowerCase();
671
- const dict = (_a = translations[lang]) !== null && _a !== void 0 ? _a : translations['en'];
672
- return (_c = (_b = dict[key]) !== null && _b !== void 0 ? _b : translations['en'][key]) !== null && _c !== void 0 ? _c : key;
673
- }
674
-
675
38
  function validateRequired(value) {
676
39
  if (value === null || value === undefined)
677
40
  return false;
@@ -734,7 +97,7 @@ function controlClass(base, hasError, element = 'input') {
734
97
  }
735
98
  /** Returns the localised required-error, or '' when the value passes. */
736
99
  function requiredError(value, required, locale) {
737
- return required && !validateRequired(value) ? t('required', locale) : '';
100
+ return required && !validateRequired(value) ? cellRenderer.t('required', locale) : '';
738
101
  }
739
102
 
740
103
  const mrdCurrencyFieldCss = () => `.sc-mrd-currency-field-h{display:block}.mrd-currency-field.sc-mrd-currency-field{display:flex;flex-direction:column;gap:var(--mrd-space-1);width:100%}.mrd-currency-field__label.sc-mrd-currency-field{display:block;font-family:var(--mrd-font-family);font-size:var(--mrd-label-font-size);font-weight:var(--mrd-label-font-weight);color:var(--mrd-label-color)}.mrd-currency-field__label--required.sc-mrd-currency-field::after{content:" *";color:var(--mrd-color-danger)}.mrd-currency-field__row.sc-mrd-currency-field{display:flex;gap:var(--mrd-space-2);align-items:stretch}.mrd-currency-field__amount.sc-mrd-currency-field{display:block;width:100%;height:var(--mrd-input-height);padding:var(--mrd-input-padding-y) var(--mrd-input-padding-x);font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-base);color:var(--mrd-input-color);background-color:var(--mrd-input-bg);border:var(--mrd-border-width) solid var(--mrd-border-color);border-radius:var(--mrd-border-radius);transition:border-color var(--mrd-transition), box-shadow var(--mrd-transition);outline:none;appearance:none;box-sizing:border-box}.mrd-currency-field__amount.sc-mrd-currency-field::placeholder{color:var(--mrd-input-placeholder-color)}.mrd-currency-field__amount.sc-mrd-currency-field:focus{border-color:var(--mrd-border-color-focus);box-shadow:var(--mrd-shadow-focus)}.mrd-currency-field__amount.sc-mrd-currency-field:disabled{background-color:var(--mrd-input-bg-disabled);cursor:not-allowed;opacity:0.7}.mrd-currency-field__amount--error.sc-mrd-currency-field{border-color:var(--mrd-border-color-error)}.mrd-currency-field__amount--error.sc-mrd-currency-field:focus{box-shadow:var(--mrd-shadow-focus-error)}.mrd-currency-field__amount.sc-mrd-currency-field{flex:1;text-align:right}.mrd-currency-field__currency.sc-mrd-currency-field{width:90px;height:var(--mrd-input-height);padding:var(--mrd-input-padding-y) var(--mrd-space-2);font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-sm);font-weight:var(--mrd-font-weight-medium);color:var(--mrd-input-color);background-color:var(--mrd-color-neutral-50);border:var(--mrd-border-width) solid var(--mrd-border-color);border-radius:var(--mrd-border-radius);outline:none;cursor:pointer;box-sizing:border-box;appearance:none;text-align:center}.mrd-currency-field__currency.sc-mrd-currency-field:focus{border-color:var(--mrd-border-color-focus);box-shadow:var(--mrd-shadow-focus)}.mrd-currency-field__currency.sc-mrd-currency-field:disabled{background-color:var(--mrd-input-bg-disabled);cursor:not-allowed;opacity:0.7}.mrd-currency-field__error.sc-mrd-currency-field{font-family:var(--mrd-font-family);font-size:var(--mrd-error-font-size);color:var(--mrd-error-color)}`;
@@ -763,7 +126,7 @@ const MrdCurrencyField = class {
763
126
  };
764
127
  this.handleAmountBlur = (e) => {
765
128
  const raw = e.target.value;
766
- const parsed = parseLocalizedNumber(raw, this.locale);
129
+ const parsed = cellRenderer.parseLocalizedNumber(raw, this.locale);
767
130
  this.error = requiredError(raw, this.required, this.locale);
768
131
  const val = { amount: parsed, currency: this.currency };
769
132
  this.mrdChange.emit({ name: this.name, value: val });
@@ -771,7 +134,7 @@ const MrdCurrencyField = class {
771
134
  };
772
135
  this.handleCurrencyChange = (e) => {
773
136
  this.currency = e.target.value;
774
- const parsed = parseLocalizedNumber(this.amountDisplay, this.locale);
137
+ const parsed = cellRenderer.parseLocalizedNumber(this.amountDisplay, this.locale);
775
138
  this.mrdChange.emit({ name: this.name, value: { amount: parsed, currency: this.currency } });
776
139
  };
777
140
  }
@@ -960,7 +323,7 @@ const MrdDocumentContainer = class {
960
323
  }
961
324
  // ── Toolbar ────────────────────────────────────────────────────────────────
962
325
  renderToolbar() {
963
- return (index.h("div", { class: "mrd-document-container__toolbar" }, this.mode === 'tree' && (index.h("button", { type: "button", class: "mrd-document-container__action", disabled: !this.canCreate, onClick: this.createFolder }, index.h("svg", { viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", "stroke-width": "2", "stroke-linecap": "round", "stroke-linejoin": "round", "aria-hidden": "true" }, index.h("path", { d: "M3 7a2 2 0 0 1 2-2h4l2 2h8a2 2 0 0 1 2 2v8a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z" }), index.h("path", { d: "M12 11v4M10 13h4" })), t('new_folder', this.locale))), index.h("div", { class: "mrd-document-container__seg", role: "group", "aria-label": t('doc_view_switch', this.locale) }, index.h("button", { class: "mrd-document-container__seg-btn", "aria-pressed": String(this.mode === 'tree'), title: t('doc_view_tree', this.locale), "aria-label": t('doc_view_tree', this.locale), onClick: () => this.setMode('tree') }, index.h("svg", { viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", "stroke-width": "2", "stroke-linecap": "round", "stroke-linejoin": "round", "aria-hidden": "true" }, index.h("path", { d: "M3 5h6M3 12h9M3 19h6" }), index.h("circle", { cx: "18", cy: "5", r: "1.6" }), index.h("circle", { cx: "18", cy: "19", r: "1.6" }), index.h("path", { d: "M16 12h4" }))), index.h("button", { class: "mrd-document-container__seg-btn", "aria-pressed": String(this.mode === 'list'), title: t('doc_view_list', this.locale), "aria-label": t('doc_view_list', this.locale), onClick: () => this.setMode('list') }, index.h("svg", { viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", "stroke-width": "2", "stroke-linecap": "round", "stroke-linejoin": "round", "aria-hidden": "true" }, index.h("path", { d: "M8 6h13M8 12h13M8 18h13M3 6h.01M3 12h.01M3 18h.01" }))))));
326
+ return (index.h("div", { class: "mrd-document-container__toolbar" }, this.mode === 'tree' && (index.h("button", { type: "button", class: "mrd-document-container__action", disabled: !this.canCreate, onClick: this.createFolder }, index.h("svg", { viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", "stroke-width": "2", "stroke-linecap": "round", "stroke-linejoin": "round", "aria-hidden": "true" }, index.h("path", { d: "M3 7a2 2 0 0 1 2-2h4l2 2h8a2 2 0 0 1 2 2v8a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z" }), index.h("path", { d: "M12 11v4M10 13h4" })), cellRenderer.t('new_folder', this.locale))), index.h("div", { class: "mrd-document-container__seg", role: "group", "aria-label": cellRenderer.t('doc_view_switch', this.locale) }, index.h("button", { class: "mrd-document-container__seg-btn", "aria-pressed": String(this.mode === 'tree'), title: cellRenderer.t('doc_view_tree', this.locale), "aria-label": cellRenderer.t('doc_view_tree', this.locale), onClick: () => this.setMode('tree') }, index.h("svg", { viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", "stroke-width": "2", "stroke-linecap": "round", "stroke-linejoin": "round", "aria-hidden": "true" }, index.h("path", { d: "M3 5h6M3 12h9M3 19h6" }), index.h("circle", { cx: "18", cy: "5", r: "1.6" }), index.h("circle", { cx: "18", cy: "19", r: "1.6" }), index.h("path", { d: "M16 12h4" }))), index.h("button", { class: "mrd-document-container__seg-btn", "aria-pressed": String(this.mode === 'list'), title: cellRenderer.t('doc_view_list', this.locale), "aria-label": cellRenderer.t('doc_view_list', this.locale), onClick: () => this.setMode('list') }, index.h("svg", { viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", "stroke-width": "2", "stroke-linecap": "round", "stroke-linejoin": "round", "aria-hidden": "true" }, index.h("path", { d: "M8 6h13M8 12h13M8 18h13M3 6h.01M3 12h.01M3 18h.01" }))))));
964
327
  }
965
328
  // ── Bodies ───────────────────────────────────────────────────────────────
966
329
  renderTree() {
@@ -1199,20 +562,20 @@ function labelOffset(depth) {
1199
562
  return depth === 0 ? 8 + chevronAndIcon : 8 + depth * 18 + chevronAndIcon;
1200
563
  }
1201
564
  function renderLoadingRow(ctx, depth) {
1202
- return (index.h("div", { class: "mrd-document-list__loading", key: "loading" }, indent(depth), index.h("span", { class: "mrd-document-list__spinner" }), t('loading', ctx.locale)));
565
+ return (index.h("div", { class: "mrd-document-list__loading", key: "loading" }, indent(depth), index.h("span", { class: "mrd-document-list__spinner" }), cellRenderer.t('loading', ctx.locale)));
1203
566
  }
1204
567
  function renderUploadingRow(ctx, depth) {
1205
- return (index.h("div", { class: "mrd-document-list__loading", key: "uploading" }, indent(depth), index.h("span", { class: "mrd-document-list__spinner" }), t('upload_file', ctx.locale)));
568
+ return (index.h("div", { class: "mrd-document-list__loading", key: "uploading" }, indent(depth), index.h("span", { class: "mrd-document-list__spinner" }), cellRenderer.t('upload_file', ctx.locale)));
1206
569
  }
1207
570
  function renderDocRow(ctx, doc, node, container, depth) {
1208
571
  var _a, _b, _c, _d, _e;
1209
572
  const label = (_b = (_a = doc === null || doc === void 0 ? void 0 : doc[ctx.titleField]) !== null && _a !== void 0 ? _a : doc === null || doc === void 0 ? void 0 : doc.name) !== null && _b !== void 0 ? _b : '';
1210
573
  const dateRaw = ctx.dateField ? doc === null || doc === void 0 ? void 0 : doc[ctx.dateField] : undefined;
1211
- const date = dateRaw ? formatDate(dateRaw, ctx.locale) : '';
574
+ const date = dateRaw ? cellRenderer.formatDate(dateRaw, ctx.locale) : '';
1212
575
  return (index.h("div", { class: "mrd-document-list__row mrd-document-list__row--doc", key: (_e = (_d = (_c = doc === null || doc === void 0 ? void 0 : doc._links) === null || _c === void 0 ? void 0 : _c.self) === null || _d === void 0 ? void 0 : _d.href) !== null && _e !== void 0 ? _e : label, draggable: true, onClick: () => ctx.on.openDoc(doc, node, container), onDragStart: (e) => ctx.on.docDragStart(e, doc, node), onDragEnd: ctx.on.docDragEnd, onDragOver: (e) => ctx.on.nodeDragOver(e, node), onDragLeave: () => ctx.on.nodeDragLeave(node), onDrop: (e) => ctx.on.nodeDrop(e, node, container) }, indent(depth), chevron(false, true), docIcon(), index.h("span", { class: "mrd-document-list__label" }, label), date && index.h("span", { class: "mrd-document-list__date" }, date)));
1213
576
  }
1214
577
  function renderFolderEditRow(ctx, node, depth) {
1215
- return (index.h("div", { class: "mrd-document-list__node", key: node.id }, index.h("div", { class: "mrd-document-list__row mrd-document-list__row--edit" }, indent(depth), chevron(false, true), folderIcon(), index.h("input", { class: "mrd-document-list__name-input", type: "text", placeholder: t('folder_name_placeholder', ctx.locale), ref: el => ctx.on.setPendingInputEl(el), onInput: ctx.on.pendingInput, onKeyDown: ctx.on.pendingKeyDown, onBlur: () => ctx.on.cancelFolder() })), node.error && (index.h("div", { class: "mrd-document-list__error", style: { paddingLeft: `${labelOffset(depth)}px` } }, node.error))));
578
+ return (index.h("div", { class: "mrd-document-list__node", key: node.id }, index.h("div", { class: "mrd-document-list__row mrd-document-list__row--edit" }, indent(depth), chevron(false, true), folderIcon(), index.h("input", { class: "mrd-document-list__name-input", type: "text", placeholder: cellRenderer.t('folder_name_placeholder', ctx.locale), ref: el => ctx.on.setPendingInputEl(el), onInput: ctx.on.pendingInput, onKeyDown: ctx.on.pendingKeyDown, onBlur: () => ctx.on.cancelFolder() })), node.error && (index.h("div", { class: "mrd-document-list__error", style: { paddingLeft: `${labelOffset(depth)}px` } }, node.error))));
1216
579
  }
1217
580
  function renderNodeChildren(ctx, container, node, depth) {
1218
581
  const out = [];
@@ -1699,13 +1062,13 @@ const MrdDocumentList = class {
1699
1062
  return;
1700
1063
  }
1701
1064
  if (name.includes('/')) {
1702
- node.error = t('folder_no_slash', this.locale);
1065
+ node.error = cellRenderer.t('folder_no_slash', this.locale);
1703
1066
  this.bump();
1704
1067
  return;
1705
1068
  }
1706
1069
  const dup = parent.children.some(c => c !== node && c.label.toLowerCase() === name.toLowerCase());
1707
1070
  if (dup) {
1708
- node.error = t('folder_duplicate', this.locale);
1071
+ node.error = cellRenderer.t('folder_duplicate', this.locale);
1709
1072
  this.bump();
1710
1073
  return;
1711
1074
  }
@@ -1894,7 +1257,7 @@ const MrdDocumentList = class {
1894
1257
  body = renderLoadingRow(ctx, 0);
1895
1258
  }
1896
1259
  else if (this.containers.length === 0) {
1897
- body = index.h("div", { key: '308725d741deb384082bd514edd34593f7d662a2', class: "mrd-document-list__empty" }, t('no_results', this.locale));
1260
+ body = index.h("div", { key: '308725d741deb384082bd514edd34593f7d662a2', class: "mrd-document-list__empty" }, cellRenderer.t('no_results', this.locale));
1898
1261
  }
1899
1262
  else if (this.singleContainer) {
1900
1263
  // Dossier context: render the single container's folder tree at the root.
@@ -1906,7 +1269,7 @@ const MrdDocumentList = class {
1906
1269
  const kids = renderNodeChildren(ctx, only, only, 0);
1907
1270
  body = kids.length
1908
1271
  ? kids
1909
- : index.h("div", { class: "mrd-document-list__empty" }, t('doc_empty_drop', this.locale));
1272
+ : index.h("div", { class: "mrd-document-list__empty" }, cellRenderer.t('doc_empty_drop', this.locale));
1910
1273
  }
1911
1274
  }
1912
1275
  else {
@@ -1920,7 +1283,7 @@ const MrdDocumentList = class {
1920
1283
  MrdDocumentList.ROOT = '__root__';
1921
1284
  MrdDocumentList.style = mrdDocumentListCss();
1922
1285
 
1923
- const mrdDocumentViewCss = () => `.sc-mrd-document-view-h{display:block}.mrd-document-view.sc-mrd-document-view{max-width:640px}.mrd-document-view__body.sc-mrd-document-view{display:flex;flex-direction:column;gap:var(--mrd-space-6)}.mrd-document-view__crumb.sc-mrd-document-view{display:inline-flex;align-items:center;gap:var(--mrd-space-2);margin-bottom:var(--mrd-space-4);padding:var(--mrd-space-1) var(--mrd-space-3);background:var(--mrd-color-primary-light);border:1px solid transparent;border-radius:var(--mrd-border-radius);font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-sm);color:var(--mrd-color-primary-dark);cursor:pointer}.mrd-document-view__crumb.sc-mrd-document-view:hover{border-color:var(--mrd-color-primary)}.mrd-document-view__crumb-icon.sc-mrd-document-view{width:0.875rem;height:0.875rem;flex-shrink:0}.mrd-document-view__title.sc-mrd-document-view{font-size:var(--mrd-font-size-2xl);font-weight:var(--mrd-font-weight-bold);color:var(--mrd-color-neutral-900);letter-spacing:-0.02em;margin:0 0 var(--mrd-space-1) 0}.mrd-document-view__date.sc-mrd-document-view{font-size:var(--mrd-font-size-sm);color:var(--mrd-color-neutral-400);font-variant-numeric:tabular-nums;margin:0 0 var(--mrd-space-6) 0}.mrd-document-view__file-meta.sc-mrd-document-view{display:flex;align-items:center;gap:var(--mrd-space-4);margin-bottom:var(--mrd-space-2)}.mrd-document-view__file-name.sc-mrd-document-view{flex:1;min-width:0;font-weight:var(--mrd-font-weight-semibold);font-size:var(--mrd-font-size-sm);color:var(--mrd-color-neutral-800);word-break:break-word}.mrd-document-view__download.sc-mrd-document-view{display:inline-flex;align-items:center;gap:var(--mrd-space-2);flex-shrink:0;height:2rem;padding:0 var(--mrd-space-3);background:var(--mrd-color-white);border:1px solid var(--mrd-color-neutral-300);border-radius:var(--mrd-border-radius);font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-sm);font-weight:var(--mrd-font-weight-medium);color:var(--mrd-color-neutral-700);cursor:pointer}.mrd-document-view__download.sc-mrd-document-view:hover{background:var(--mrd-color-neutral-100);color:var(--mrd-color-neutral-900)}.mrd-document-view__download.sc-mrd-document-view svg.sc-mrd-document-view{width:0.9375rem;height:0.9375rem}.mrd-document-view__summary-body.sc-mrd-document-view{font-size:var(--mrd-font-size-base);color:var(--mrd-color-neutral-700);line-height:var(--mrd-line-height-relaxed)}`;
1286
+ const mrdDocumentViewCss = () => `.sc-mrd-document-view-h{display:block}.mrd-document-view.sc-mrd-document-view{max-width:640px}.mrd-document-view__body.sc-mrd-document-view{display:flex;flex-direction:column;gap:var(--mrd-space-6)}.mrd-document-view__container.sc-mrd-document-view{display:flex;flex-direction:column;align-items:flex-start;gap:var(--mrd-space-1);margin-bottom:var(--mrd-space-6)}.mrd-document-view__container-link.sc-mrd-document-view{background:none;border:none;padding:0;font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-sm);font-weight:var(--mrd-font-weight-semibold);color:var(--mrd-color-primary);cursor:pointer;text-align:left}.mrd-document-view__container-link.sc-mrd-document-view:hover{text-decoration:underline}.mrd-document-view__folder.sc-mrd-document-view{display:inline-flex;align-items:center;gap:var(--mrd-space-1);font-size:var(--mrd-font-size-xs);color:var(--mrd-color-neutral-400);word-break:break-word}.mrd-document-view__folder-icon.sc-mrd-document-view{width:0.75rem;height:0.75rem;flex-shrink:0}.mrd-document-view__title.sc-mrd-document-view{font-size:var(--mrd-font-size-2xl);font-weight:var(--mrd-font-weight-bold);color:var(--mrd-color-neutral-900);letter-spacing:-0.02em;margin:0 0 var(--mrd-space-1) 0}.mrd-document-view__date.sc-mrd-document-view{font-size:var(--mrd-font-size-sm);color:var(--mrd-color-neutral-400);font-variant-numeric:tabular-nums;margin:0 0 var(--mrd-space-6) 0}.mrd-document-view__file-meta.sc-mrd-document-view{display:flex;align-items:center;margin-bottom:var(--mrd-space-2)}.mrd-document-view__download.sc-mrd-document-view{display:inline-flex;align-items:center;gap:var(--mrd-space-2);flex-shrink:0;height:2rem;padding:0 var(--mrd-space-3);background:var(--mrd-color-white);border:1px solid var(--mrd-color-neutral-300);border-radius:var(--mrd-border-radius);font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-sm);font-weight:var(--mrd-font-weight-medium);color:var(--mrd-color-neutral-700);cursor:pointer}.mrd-document-view__download.sc-mrd-document-view:hover{background:var(--mrd-color-neutral-100);color:var(--mrd-color-neutral-900)}.mrd-document-view__download.sc-mrd-document-view svg.sc-mrd-document-view{width:0.9375rem;height:0.9375rem}.mrd-document-view__summary-body.sc-mrd-document-view{font-size:var(--mrd-font-size-base);color:var(--mrd-color-neutral-700);line-height:var(--mrd-line-height-relaxed)}`;
1924
1287
 
1925
1288
  const MrdDocumentView = class {
1926
1289
  constructor(hostRef) {
@@ -1967,29 +1330,35 @@ const MrdDocumentView = class {
1967
1330
  const links = ((_d = (_c = this.data) === null || _c === void 0 ? void 0 : _c._links) !== null && _d !== void 0 ? _d : {});
1968
1331
  return links[field];
1969
1332
  }
1333
+ /** Container link (styled like relation links in layout sections: primary text
1334
+ * link) plus a muted, non-interactive folder path when present. */
1970
1335
  renderContainer() {
1971
1336
  const link = this.slotLink('container');
1972
- if (!(link === null || link === void 0 ? void 0 : link.href) || !link.name)
1337
+ const hasLink = !!((link === null || link === void 0 ? void 0 : link.href) && link.name);
1338
+ const folderRaw = this.slotValue('folder');
1339
+ const folder = folderRaw != null && folderRaw !== '' ? String(folderRaw) : null;
1340
+ if (!hasLink && !folder)
1973
1341
  return null;
1974
- return (index.h("button", { class: "mrd-document-view__crumb", onClick: () => this.mrdNavigate.emit({ href: link.href, label: link.name }) }, index.h("svg", { class: "mrd-document-view__crumb-icon", viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", "stroke-width": "2", "stroke-linecap": "round", "stroke-linejoin": "round", "aria-hidden": "true" }, index.h("path", { d: "M19 12H5M12 19l-7-7 7-7" })), link.name));
1342
+ return (index.h("div", { class: "mrd-document-view__container" }, hasLink && (index.h("button", { type: "button", class: "mrd-document-view__container-link", onClick: () => this.mrdNavigate.emit({ href: link.href, label: link.name }) }, link.name)), folder && (index.h("span", { class: "mrd-document-view__folder" }, index.h("svg", { class: "mrd-document-view__folder-icon", viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", "stroke-width": "2", "stroke-linecap": "round", "stroke-linejoin": "round", "aria-hidden": "true" }, index.h("path", { d: "M3 7a2 2 0 0 1 2-2h4l2 2h8a2 2 0 0 1 2 2v8a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z" })), folder))));
1975
1343
  }
1976
- /** Filename + download button — the only file-related UI this component owns;
1977
- * inline preview rendering is entirely the host's responsibility. */
1344
+ /** Download button — the only file-related UI this component owns; the filename
1345
+ * is deliberately not shown (rarely relevant, the title identifies the document)
1346
+ * and inline preview rendering is entirely the host's responsibility. */
1978
1347
  renderFileMeta(fileName, href) {
1979
- return (index.h("div", { class: "mrd-document-view__file-meta" }, index.h("span", { class: "mrd-document-view__file-name" }, fileName), href && (index.h("button", { type: "button", class: "mrd-document-view__download", onClick: () => this.mrdDownload.emit({ href, fileName }) }, index.h("svg", { viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", "stroke-width": "2", "stroke-linecap": "round", "stroke-linejoin": "round", "aria-hidden": "true" }, index.h("path", { d: "M12 3v12m0 0l-4-4m4 4l4-4M4 21h16" })), t('download', this.locale)))));
1348
+ return (index.h("div", { class: "mrd-document-view__file-meta" }, href && (index.h("button", { type: "button", class: "mrd-document-view__download", onClick: () => this.mrdDownload.emit({ href, fileName }) }, index.h("svg", { viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", "stroke-width": "2", "stroke-linecap": "round", "stroke-linejoin": "round", "aria-hidden": "true" }, index.h("path", { d: "M12 3v12m0 0l-4-4m4 4l4-4M4 21h16" })), cellRenderer.t('download', this.locale)))));
1980
1349
  }
1981
1350
  render() {
1982
1351
  var _a, _b;
1983
1352
  const titleRaw = this.slotValue('title');
1984
1353
  const title = titleRaw != null && titleRaw !== '' ? String(titleRaw) : null;
1985
1354
  const dateRaw = this.slotValue('date');
1986
- const date = dateRaw != null && dateRaw !== '' ? formatDate(dateRaw, this.locale) : null;
1355
+ const date = dateRaw != null && dateRaw !== '' ? cellRenderer.formatDate(dateRaw, this.locale) : null;
1987
1356
  const summaryRaw = this.slotValue('summary');
1988
1357
  const summary = summaryRaw != null && summaryRaw !== '' ? String(summaryRaw) : null;
1989
1358
  const fileRaw = this.slotValue('file');
1990
1359
  const fileHref = (_a = fileRaw === null || fileRaw === void 0 ? void 0 : fileRaw.href) !== null && _a !== void 0 ? _a : '';
1991
1360
  const fileName = (_b = fileRaw === null || fileRaw === void 0 ? void 0 : fileRaw.fileName) !== null && _b !== void 0 ? _b : (fileRaw ? String(fileRaw) : '');
1992
- return (index.h(index.Host, { key: 'e25995d61813ad0d285497c0abe74de0c1624cea' }, index.h("div", { key: '1d8e6c12c5db53bffd28b4bcff84a950c22cc8d8', class: "mrd-document-view" }, index.h("div", { key: 'b583648e524acd8156f92989b685b6343164738c', class: "mrd-document-view__body" }, index.h("div", { key: '8992b15a52edd64e2f0fd3269213302ab3989a20', class: "mrd-document-view__meta" }, this.renderContainer(), title && index.h("h1", { key: '0742816ed6ac927fa12410d723c9b0b8470800c7', class: "mrd-document-view__title" }, title), date && index.h("p", { key: '4803d2773ef904e3788a865db8e4653e5cb9d8df', class: "mrd-document-view__date" }, date), fileRaw && this.renderFileMeta(fileName, fileHref), summary && (index.h("div", { key: '502e9e844d474b692246e36c96245ba5321d2a9e', class: "mrd-document-view__summary" }, index.h("div", { key: 'b37d4c9cb9bc65c5abb0a4e1809e285032868e2c', class: "mrd-document-view__summary-body", innerHTML: summary }))))))));
1361
+ return (index.h(index.Host, { key: 'd4e8d4a6c5c66677df3d4e80943fc4538d9a2be7' }, index.h("div", { key: 'c67bb1742590dc3ab3cec959f20dfa9030268411', class: "mrd-document-view" }, index.h("div", { key: '5da6e15d1f67990a9ee06bc07b717e5fa17a2ee7', class: "mrd-document-view__body" }, index.h("div", { key: '0fc38933add3fff48096c48d2fb6cd06fb5d1eac', class: "mrd-document-view__meta" }, title && index.h("h1", { key: 'e9ac8d99f9afae6b64dd7e6bd461c54b92a6ea39', class: "mrd-document-view__title" }, title), date && index.h("p", { key: '8591d77b300ed3c021cfa64b8e9564dee98199cd', class: "mrd-document-view__date" }, date), this.renderContainer(), fileRaw && this.renderFileMeta(fileName, fileHref), summary && (index.h("div", { key: '8a6d630afcf187fa86c9bab77d06d93695fd5c9f', class: "mrd-document-view__summary" }, index.h("div", { key: 'bd98e2cf740d08837accd8d260973d4e51cd24f7', class: "mrd-document-view__summary-body", innerHTML: summary }))))))));
1993
1362
  }
1994
1363
  static get watchers() { return {
1995
1364
  "data": [{
@@ -2021,7 +1390,7 @@ const MrdEmailField = class {
2021
1390
  this.handleBlur = (e) => {
2022
1391
  const val = e.target.value;
2023
1392
  this.error = requiredError(val, this.required, this.locale)
2024
- || (val && !validateEmail(val) ? t('invalid_email', this.locale) : '');
1393
+ || (val && !validateEmail(val) ? cellRenderer.t('invalid_email', this.locale) : '');
2025
1394
  this.mrdBlur.emit({ name: this.name, value: val });
2026
1395
  };
2027
1396
  }
@@ -2146,7 +1515,7 @@ const MrdField = class {
2146
1515
  const addEntry = () => {
2147
1516
  this.emitHistoryChange([...this.historyEntries, { value: '', until: '' }]);
2148
1517
  };
2149
- return (index.h("div", { class: "mrd-field__history-editor" }, this.historyEntries.length > 0 && (index.h("span", { class: "mrd-field__history-editor-label" }, t('history_badge_tooltip', locale))), this.historyEntries.map((entry, i) => (index.h("div", { key: String(i), class: "mrd-field__history-editor-row" }, index.h("input", { class: "mrd-field__history-editor-value", type: valueType, value: entry.value, onInput: (e) => updateEntry(i, 'value', e.target.value) }), index.h("span", { class: "mrd-field__history-editor-sep" }, t('history_until', locale)), index.h("input", { class: "mrd-field__history-editor-until", type: "date", value: entry.until, onInput: (e) => updateEntry(i, 'until', e.target.value) }), index.h("button", { type: "button", class: "mrd-field__history-editor-remove", onClick: () => removeEntry(i), "aria-label": t('remove', locale) }, index.h("svg", { viewBox: "0 0 20 20", fill: "currentColor", "aria-hidden": "true" }, index.h("path", { "fill-rule": "evenodd", d: "M8.75 1A2.75 2.75 0 006 3.75v.443c-.795.077-1.584.176-2.365.298a.75.75 0 10.23 1.482l.149-.022.841 10.518A2.75 2.75 0 007.596 19h4.807a2.75 2.75 0 002.742-2.53l.841-10.52.149.023a.75.75 0 00.23-1.482A41.03 41.03 0 0014 4.193V3.75A2.75 2.75 0 0011.25 1h-2.5zM10 4c.84 0 1.673.025 2.5.075V3.75c0-.69-.56-1.25-1.25-1.25h-2.5c-.69 0-1.25.56-1.25 1.25v.325C8.327 4.025 9.16 4 10 4zM8.58 7.72a.75.75 0 00-1.5.06l.3 7.5a.75.75 0 101.5-.06l-.3-7.5zm4.34.06a.75.75 0 10-1.5-.06l-.3 7.5a.75.75 0 101.5.06l.3-7.5z", "clip-rule": "evenodd" })))))), index.h("button", { type: "button", class: "mrd-field__history-editor-add", onClick: addEntry }, "+ ", t('add', locale))));
1518
+ return (index.h("div", { class: "mrd-field__history-editor" }, this.historyEntries.length > 0 && (index.h("span", { class: "mrd-field__history-editor-label" }, cellRenderer.t('history_badge_tooltip', locale))), this.historyEntries.map((entry, i) => (index.h("div", { key: String(i), class: "mrd-field__history-editor-row" }, index.h("input", { class: "mrd-field__history-editor-value", type: valueType, value: entry.value, onInput: (e) => updateEntry(i, 'value', e.target.value) }), index.h("span", { class: "mrd-field__history-editor-sep" }, cellRenderer.t('history_until', locale)), index.h("input", { class: "mrd-field__history-editor-until", type: "date", value: entry.until, onInput: (e) => updateEntry(i, 'until', e.target.value) }), index.h("button", { type: "button", class: "mrd-field__history-editor-remove", onClick: () => removeEntry(i), "aria-label": cellRenderer.t('remove', locale) }, index.h("svg", { viewBox: "0 0 20 20", fill: "currentColor", "aria-hidden": "true" }, index.h("path", { "fill-rule": "evenodd", d: "M8.75 1A2.75 2.75 0 006 3.75v.443c-.795.077-1.584.176-2.365.298a.75.75 0 10.23 1.482l.149-.022.841 10.518A2.75 2.75 0 007.596 19h4.807a2.75 2.75 0 002.742-2.53l.841-10.52.149.023a.75.75 0 00.23-1.482A41.03 41.03 0 0014 4.193V3.75A2.75 2.75 0 0011.25 1h-2.5zM10 4c.84 0 1.673.025 2.5.075V3.75c0-.69-.56-1.25-1.25-1.25h-2.5c-.69 0-1.25.56-1.25 1.25v.325C8.327 4.025 9.16 4 10 4zM8.58 7.72a.75.75 0 00-1.5.06l.3 7.5a.75.75 0 101.5-.06l-.3-7.5zm4.34.06a.75.75 0 10-1.5-.06l-.3 7.5a.75.75 0 101.5.06l.3-7.5z", "clip-rule": "evenodd" })))))), index.h("button", { type: "button", class: "mrd-field__history-editor-add", onClick: addEntry }, "+ ", cellRenderer.t('add', locale))));
2150
1519
  }
2151
1520
  renderLeafField(displayValue) {
2152
1521
  var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x, _y, _z, _0, _1, _2, _3, _4;
@@ -2225,9 +1594,9 @@ MrdField.style = mrdFieldCss();
2225
1594
  /** Validates a selected/dropped file; returns a localised error message or '' when accepted. */
2226
1595
  function validateUploadFile(file, maxSize, locale, requireImage = false) {
2227
1596
  if (maxSize > 0 && file.size > maxSize)
2228
- return t('file_too_large', locale);
1597
+ return cellRenderer.t('file_too_large', locale);
2229
1598
  if (requireImage && !file.type.startsWith('image/'))
2230
- return t('invalid_image', locale);
1599
+ return cellRenderer.t('invalid_image', locale);
2231
1600
  return '';
2232
1601
  }
2233
1602
  /** BEM class string for the drop zone, e.g. base 'mrd-file-field' → 'mrd-file-field__zone …'. */
@@ -2334,7 +1703,7 @@ const MrdFileField = class {
2334
1703
  error: hasError,
2335
1704
  disabled: this.disabled || this.uploading,
2336
1705
  });
2337
- return (index.h(index.Host, { key: '6410e945bb873a05d0a1b3be45bc879b5e153a05' }, index.h("div", { key: '4d1d69d768b383f0d9190f88a50a87de8679d3d2', class: "mrd-file-field" }, index.h(FieldLabel, { key: '7e0009908fb4c087de16cf08251ab398199dae60', base: "mrd-file-field", label: this.label, required: this.required }), index.h("div", { key: '88dfc0d1c34670f7de8f3cf2dea4c95b0ae66f4c', class: zoneClass, onClick: this.handleZoneClick, onDragOver: this.drag.onDragOver, onDragLeave: this.drag.onDragLeave, onDrop: this.drag.onDrop }, index.h("input", { key: 'b6d678b5582a58721c928cef47dd8d6645b26a86', ref: el => (this.fileInputRef = el), class: "mrd-file-field__input", type: "file", name: this.name, accept: this.accept, disabled: this.disabled || this.uploading, required: this.required && !hasFile, onChange: this.handleInputChange }), hasFile ? (index.h("div", { class: "mrd-file-field__selected" }, this.uploading ? (index.h("span", { class: "mrd-file-field__spinner", "aria-label": t('loading', this.locale) })) : (index.h("svg", { class: "mrd-file-field__icon", viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", "stroke-width": "2" }, index.h("path", { d: "M14 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V8z" }), index.h("polyline", { points: "14 2 14 8 20 8" }))), index.h("span", { class: "mrd-file-field__filename" }, this.fileName), !this.uploading && (index.h("button", { class: "mrd-file-field__clear", type: "button", onClick: this.handleClear, "aria-label": t('clear', this.locale) }, "\u2715")))) : (index.h("div", { class: "mrd-file-field__prompt" }, index.h("svg", { class: "mrd-file-field__upload-icon", viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", "stroke-width": "2" }, index.h("polyline", { points: "16 16 12 12 8 16" }), index.h("line", { x1: "12", y1: "12", x2: "12", y2: "21" }), index.h("path", { d: "M20.39 18.39A5 5 0 0 0 18 9h-1.26A8 8 0 1 0 3 16.3" })), index.h("span", null, t('drop_file_here', this.locale), ' ', index.h("span", { class: "mrd-file-field__browse" }, t('browse', this.locale)))))), index.h(FieldError, { key: '80f1698819c60b15476b953f5f3216f195430b84', base: "mrd-file-field", error: this.error }))));
1706
+ return (index.h(index.Host, { key: '6410e945bb873a05d0a1b3be45bc879b5e153a05' }, index.h("div", { key: '4d1d69d768b383f0d9190f88a50a87de8679d3d2', class: "mrd-file-field" }, index.h(FieldLabel, { key: '7e0009908fb4c087de16cf08251ab398199dae60', base: "mrd-file-field", label: this.label, required: this.required }), index.h("div", { key: '88dfc0d1c34670f7de8f3cf2dea4c95b0ae66f4c', class: zoneClass, onClick: this.handleZoneClick, onDragOver: this.drag.onDragOver, onDragLeave: this.drag.onDragLeave, onDrop: this.drag.onDrop }, index.h("input", { key: 'b6d678b5582a58721c928cef47dd8d6645b26a86', ref: el => (this.fileInputRef = el), class: "mrd-file-field__input", type: "file", name: this.name, accept: this.accept, disabled: this.disabled || this.uploading, required: this.required && !hasFile, onChange: this.handleInputChange }), hasFile ? (index.h("div", { class: "mrd-file-field__selected" }, this.uploading ? (index.h("span", { class: "mrd-file-field__spinner", "aria-label": cellRenderer.t('loading', this.locale) })) : (index.h("svg", { class: "mrd-file-field__icon", viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", "stroke-width": "2" }, index.h("path", { d: "M14 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V8z" }), index.h("polyline", { points: "14 2 14 8 20 8" }))), index.h("span", { class: "mrd-file-field__filename" }, this.fileName), !this.uploading && (index.h("button", { class: "mrd-file-field__clear", type: "button", onClick: this.handleClear, "aria-label": cellRenderer.t('clear', this.locale) }, "\u2715")))) : (index.h("div", { class: "mrd-file-field__prompt" }, index.h("svg", { class: "mrd-file-field__upload-icon", viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", "stroke-width": "2" }, index.h("polyline", { points: "16 16 12 12 8 16" }), index.h("line", { x1: "12", y1: "12", x2: "12", y2: "21" }), index.h("path", { d: "M20.39 18.39A5 5 0 0 0 18 9h-1.26A8 8 0 1 0 3 16.3" })), index.h("span", null, cellRenderer.t('drop_file_here', this.locale), ' ', index.h("span", { class: "mrd-file-field__browse" }, cellRenderer.t('browse', this.locale)))))), index.h(FieldError, { key: '80f1698819c60b15476b953f5f3216f195430b84', base: "mrd-file-field", error: this.error }))));
2338
1707
  }
2339
1708
  static get watchers() { return {
2340
1709
  "value": [{
@@ -2610,7 +1979,7 @@ const MrdForm = class {
2610
1979
  if (!item.name)
2611
1980
  continue;
2612
1981
  if (item.required && !validateRequired(this.formValues[item.name])) {
2613
- newErrors[item.name] = t('required', this.locale);
1982
+ newErrors[item.name] = cellRenderer.t('required', this.locale);
2614
1983
  }
2615
1984
  }
2616
1985
  this.errors = newErrors;
@@ -2700,7 +2069,7 @@ const MrdForm = class {
2700
2069
  return index.h(index.Host, null);
2701
2070
  }
2702
2071
  const dir = this.locale.startsWith('ar') ? 'rtl' : 'ltr';
2703
- return (index.h(index.Host, null, index.h("form", { class: "mrd-form", dir: dir, onSubmit: this.handleSubmit, noValidate: true }, this.layout.title && index.h("h2", { class: "mrd-form__title" }, this.layout.title), index.h("div", { class: "mrd-form__body" }, this.renderItems(this.layout.items)), index.h("div", { class: "mrd-form__footer" }, index.h("button", { type: "submit", class: "mrd-form__submit" }, t('submit', this.locale)), this.showCancel && (index.h("button", { type: "button", class: "mrd-form__cancel", onClick: () => this.mrdCancel.emit() }, t('cancel', this.locale)))))));
2072
+ return (index.h(index.Host, null, index.h("form", { class: "mrd-form", dir: dir, onSubmit: this.handleSubmit, noValidate: true }, this.layout.title && index.h("h2", { class: "mrd-form__title" }, this.layout.title), index.h("div", { class: "mrd-form__body" }, this.renderItems(this.layout.items)), index.h("div", { class: "mrd-form__footer" }, index.h("button", { type: "submit", class: "mrd-form__submit" }, cellRenderer.t('submit', this.locale)), this.showCancel && (index.h("button", { type: "button", class: "mrd-form__cancel", onClick: () => this.mrdCancel.emit() }, cellRenderer.t('cancel', this.locale)))))));
2704
2073
  }
2705
2074
  static get watchers() { return {
2706
2075
  "values": [{
@@ -2740,7 +2109,7 @@ const MrdHyperlinkField = class {
2740
2109
  };
2741
2110
  this.handleBlur = () => {
2742
2111
  this.error = requiredError(this.internalHref, this.required, this.locale)
2743
- || (this.internalHref && !validateUrl(this.internalHref) ? t('invalid_url', this.locale) : '');
2112
+ || (this.internalHref && !validateUrl(this.internalHref) ? cellRenderer.t('invalid_url', this.locale) : '');
2744
2113
  this.mrdBlur.emit({ name: this.name, value: this.buildValue() });
2745
2114
  };
2746
2115
  }
@@ -2773,7 +2142,7 @@ const MrdHyperlinkField = class {
2773
2142
  ? index.h("a", { class: "mrd-hyperlink-field__link", href: this.internalHref, target: "_blank", rel: "noopener noreferrer" }, this.internalName || this.internalHref)
2774
2143
  : index.h("span", { class: "mrd-hyperlink-field__empty" }, "\u2014"))));
2775
2144
  }
2776
- return (index.h(index.Host, null, index.h("div", { class: "mrd-hyperlink-field" }, index.h(FieldLabel, { base: "mrd-hyperlink-field", label: this.label, required: this.required }), index.h("input", { class: controlClass('mrd-hyperlink-field', hasError), type: "url", name: this.name, value: this.internalHref, placeholder: this.placeholder || 'https://', required: this.required, onInput: this.handleHrefInput, onBlur: this.handleBlur }), index.h("input", { class: "mrd-hyperlink-field__input mrd-hyperlink-field__input--name", type: "text", value: this.internalName, placeholder: t('hyperlink_name', this.locale), onInput: this.handleNameInput, onBlur: this.handleBlur }), index.h(FieldError, { base: "mrd-hyperlink-field", error: this.error }))));
2145
+ return (index.h(index.Host, null, index.h("div", { class: "mrd-hyperlink-field" }, index.h(FieldLabel, { base: "mrd-hyperlink-field", label: this.label, required: this.required }), index.h("input", { class: controlClass('mrd-hyperlink-field', hasError), type: "url", name: this.name, value: this.internalHref, placeholder: this.placeholder || 'https://', required: this.required, onInput: this.handleHrefInput, onBlur: this.handleBlur }), index.h("input", { class: "mrd-hyperlink-field__input mrd-hyperlink-field__input--name", type: "text", value: this.internalName, placeholder: cellRenderer.t('hyperlink_name', this.locale), onInput: this.handleNameInput, onBlur: this.handleBlur }), index.h(FieldError, { base: "mrd-hyperlink-field", error: this.error }))));
2777
2146
  }
2778
2147
  static get watchers() { return {
2779
2148
  "value": [{
@@ -2871,7 +2240,7 @@ const MrdImageField = class {
2871
2240
  error: hasError,
2872
2241
  disabled: this.disabled || this.uploading,
2873
2242
  });
2874
- return (index.h(index.Host, { key: '700310af716dcc167f98bc7ae7024bb44e1285b6' }, index.h("div", { key: '95d29a82751249e560404488fb279138eee0c1be', class: "mrd-image-field" }, index.h(FieldLabel, { key: 'f53f040257a4b65d8435c836846adab137b91a5e', base: "mrd-image-field", label: this.label, required: this.required }), index.h("div", { key: 'a9cc7a0861b1457d8e4abb11b380b6eeb519a863', class: zoneClass, onClick: this.handleZoneClick, onDragOver: this.drag.onDragOver, onDragLeave: this.drag.onDragLeave, onDrop: this.drag.onDrop }, index.h("input", { key: '7112030bc2b80b4c3b31a4421656da4c926a2fe1', ref: el => (this.fileInputRef = el), class: "mrd-image-field__input", type: "file", name: this.name, accept: this.accept, disabled: this.disabled || this.uploading, required: this.required && !this.previewUrl, onChange: this.handleInputChange }), this.previewUrl ? (index.h("div", { class: "mrd-image-field__preview-container" }, index.h("div", { class: "mrd-image-field__preview-thumb" }, index.h("img", { class: "mrd-image-field__preview", src: this.previewUrl, alt: this.fileName }), this.uploading && index.h("div", { class: "mrd-image-field__preview-overlay" }, index.h("span", { class: "mrd-image-field__spinner" }))), index.h("div", { class: "mrd-image-field__preview-info" }, index.h("span", { class: "mrd-image-field__preview-name" }, this.fileName), this.uploading && (index.h("span", { class: "mrd-image-field__upload-status" }, t('loading', this.locale)))), !this.uploading && (index.h("button", { class: "mrd-image-field__clear", type: "button", onClick: this.handleClear, "aria-label": t('clear', this.locale) }, t('remove', this.locale))))) : (index.h("div", { class: "mrd-image-field__prompt" }, index.h("svg", { class: "mrd-image-field__upload-icon", viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", "stroke-width": "2" }, index.h("rect", { x: "3", y: "3", width: "18", height: "18", rx: "2", ry: "2" }), index.h("circle", { cx: "8.5", cy: "8.5", r: "1.5" }), index.h("polyline", { points: "21 15 16 10 5 21" })), index.h("span", null, t('drop_file_here', this.locale), ' ', index.h("span", { class: "mrd-image-field__browse" }, t('browse', this.locale)))))), index.h(FieldError, { key: '0cf5346ecb1a5d110822b087081b4b5f05255381', base: "mrd-image-field", error: this.error }))));
2243
+ return (index.h(index.Host, { key: '700310af716dcc167f98bc7ae7024bb44e1285b6' }, index.h("div", { key: '95d29a82751249e560404488fb279138eee0c1be', class: "mrd-image-field" }, index.h(FieldLabel, { key: 'f53f040257a4b65d8435c836846adab137b91a5e', base: "mrd-image-field", label: this.label, required: this.required }), index.h("div", { key: 'a9cc7a0861b1457d8e4abb11b380b6eeb519a863', class: zoneClass, onClick: this.handleZoneClick, onDragOver: this.drag.onDragOver, onDragLeave: this.drag.onDragLeave, onDrop: this.drag.onDrop }, index.h("input", { key: '7112030bc2b80b4c3b31a4421656da4c926a2fe1', ref: el => (this.fileInputRef = el), class: "mrd-image-field__input", type: "file", name: this.name, accept: this.accept, disabled: this.disabled || this.uploading, required: this.required && !this.previewUrl, onChange: this.handleInputChange }), this.previewUrl ? (index.h("div", { class: "mrd-image-field__preview-container" }, index.h("div", { class: "mrd-image-field__preview-thumb" }, index.h("img", { class: "mrd-image-field__preview", src: this.previewUrl, alt: this.fileName }), this.uploading && index.h("div", { class: "mrd-image-field__preview-overlay" }, index.h("span", { class: "mrd-image-field__spinner" }))), index.h("div", { class: "mrd-image-field__preview-info" }, index.h("span", { class: "mrd-image-field__preview-name" }, this.fileName), this.uploading && (index.h("span", { class: "mrd-image-field__upload-status" }, cellRenderer.t('loading', this.locale)))), !this.uploading && (index.h("button", { class: "mrd-image-field__clear", type: "button", onClick: this.handleClear, "aria-label": cellRenderer.t('clear', this.locale) }, cellRenderer.t('remove', this.locale))))) : (index.h("div", { class: "mrd-image-field__prompt" }, index.h("svg", { class: "mrd-image-field__upload-icon", viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", "stroke-width": "2" }, index.h("rect", { x: "3", y: "3", width: "18", height: "18", rx: "2", ry: "2" }), index.h("circle", { cx: "8.5", cy: "8.5", r: "1.5" }), index.h("polyline", { points: "21 15 16 10 5 21" })), index.h("span", null, cellRenderer.t('drop_file_here', this.locale), ' ', index.h("span", { class: "mrd-image-field__browse" }, cellRenderer.t('browse', this.locale)))))), index.h(FieldError, { key: '0cf5346ecb1a5d110822b087081b4b5f05255381', base: "mrd-image-field", error: this.error }))));
2875
2244
  }
2876
2245
  static get watchers() { return {
2877
2246
  "value": [{
@@ -2910,110 +2279,6 @@ function buildContainerHref(item, selfHref, parentId) {
2910
2279
  return `/${base}/${tenant}/${item.fromClass}/${parentId}`;
2911
2280
  }
2912
2281
 
2913
- class CellRenderer {
2914
- static render(column, row, locale) {
2915
- var _a, _b, _c, _d;
2916
- if (column.type === clientLayout.ClientLayoutItemType.RELATION) {
2917
- const name = (_a = column.name) !== null && _a !== void 0 ? _a : '';
2918
- const link = (_b = row === null || row === void 0 ? void 0 : row._links) === null || _b === void 0 ? void 0 : _b[name];
2919
- if (!link)
2920
- return '';
2921
- if (Array.isArray(link))
2922
- return link.map((l) => { var _a; return (_a = l.name) !== null && _a !== void 0 ? _a : ''; }).filter(Boolean).join(', ');
2923
- return (_c = link.name) !== null && _c !== void 0 ? _c : '';
2924
- }
2925
- if (column.type !== clientLayout.ClientLayoutItemType.FIELD)
2926
- return '';
2927
- const name = (_d = column.name) !== null && _d !== void 0 ? _d : '';
2928
- const dataType = column.dataType;
2929
- const listItems = column.listItems;
2930
- const raw = row === null || row === void 0 ? void 0 : row[name];
2931
- if (raw == null || raw === '')
2932
- return '';
2933
- const values = Array.isArray(raw) ? raw : [raw];
2934
- return values
2935
- .map(v => CellRenderer.renderValue(dataType !== null && dataType !== void 0 ? dataType : 'TEXT', v, listItems !== null && listItems !== void 0 ? listItems : [], locale))
2936
- .filter(s => s !== '')
2937
- .join(', ');
2938
- }
2939
- static renderValue(dataType, value, listItems, locale) {
2940
- var _a, _b;
2941
- switch (dataType) {
2942
- case 'INTEGER':
2943
- return formatNumber(Number(value), locale, { maximumFractionDigits: 0 });
2944
- case 'DECIMAL':
2945
- return formatNumber(Number(value), locale);
2946
- case 'PERCENTAGE':
2947
- return formatPercentage(Number(value), locale);
2948
- case 'CURRENCY': {
2949
- const { amount, currency } = typeof value === 'object' && value !== null
2950
- ? value
2951
- : { amount: value, currency: '' };
2952
- return currency
2953
- ? formatCurrency(Number(amount), currency, locale)
2954
- : formatNumber(Number(amount), locale);
2955
- }
2956
- case 'DATE':
2957
- return formatDate(value, locale);
2958
- case 'DATETIME':
2959
- return formatDateTime(value, locale);
2960
- case 'TIME':
2961
- return formatTime(value, locale);
2962
- case 'BOOLEAN':
2963
- return value ? '✓' : '';
2964
- case 'FILE':
2965
- case 'IMAGE':
2966
- return typeof value === 'object' && value !== null ? ((_a = value.fileName) !== null && _a !== void 0 ? _a : '') : '';
2967
- case 'LIST': {
2968
- const item = listItems.find(li => li.key === String(value));
2969
- return (_b = item === null || item === void 0 ? void 0 : item.label) !== null && _b !== void 0 ? _b : String(value);
2970
- }
2971
- case 'TEXTBLOCK': {
2972
- const stripped = String(value).replace(/<[^>]*>/g, '');
2973
- const txt = document.createElement('textarea');
2974
- txt.innerHTML = stripped;
2975
- return txt.value.trim();
2976
- }
2977
- case 'LONGTEXT':
2978
- return String(value).replace(/[\r\n]+/g, ' ').trim();
2979
- case 'JSON': {
2980
- const str = typeof value === 'object' ? JSON.stringify(value) : String(value);
2981
- return str.replace(/[\r\n]+/g, ' ').trim();
2982
- }
2983
- case 'SECRET':
2984
- return value ? '••••••••' : '';
2985
- default:
2986
- return String(value);
2987
- }
2988
- }
2989
- /**
2990
- * Returns syntax-highlighted JSON as an HTML string with inline styles.
2991
- * compact=true → single line (no indentation); compact=false → pretty-printed.
2992
- */
2993
- static formatJson(value, compact = false) {
2994
- try {
2995
- const parsed = typeof value === 'string' ? JSON.parse(value) : value;
2996
- const json = compact ? JSON.stringify(parsed) : JSON.stringify(parsed, null, 2);
2997
- return json.replace(/("(\\u[a-zA-Z0-9]{4}|\\[^u]|[^\\"])*"(\s*:)?|\b(true|false|null)\b|-?\d+(?:\.\d*)?(?:[eE][+\-]?\d+)?)/g, match => {
2998
- let style = 'color:#2aa198';
2999
- if (/^"/.test(match)) {
3000
- style = /:$/.test(match) ? 'color:#881391' : 'color:#268bd2';
3001
- }
3002
- else if (/true|false/.test(match)) {
3003
- style = 'color:#b58900';
3004
- }
3005
- else if (/null/.test(match)) {
3006
- style = 'color:#dc322f';
3007
- }
3008
- return `<span style="${style}">${match}</span>`;
3009
- });
3010
- }
3011
- catch (_a) {
3012
- return String(value);
3013
- }
3014
- }
3015
- }
3016
-
3017
2282
  /** FILE and IMAGE cells share the same download button. */
3018
2283
  function downloadLink(ctx, href, fileName, label) {
3019
2284
  return (index.h("button", { class: "mrd-layout-section__download-link", onClick: () => href && ctx.on.download({ href, fileName }) }, index.h("svg", { class: "mrd-layout-section__file-icon", viewBox: "0 0 24 24", "aria-hidden": "true" }, index.h("path", { fill: "currentColor", d: "M14 2H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h12c1.1 0 2-.9 2-2V8l-6-6zm-1 7V3.5L18.5 9H13zm-3 8l-3-3 1.41-1.41L10 14.17l4.59-4.58L16 11l-6 6z" })), label));
@@ -3033,12 +2298,12 @@ function renderSingleFieldValue(ctx, item, value) {
3033
2298
  case clientLayout.ClientLayoutItemFieldDataType.LONGTEXT:
3034
2299
  return index.h("pre", { class: "mrd-layout-section__pre" }, String(value));
3035
2300
  case clientLayout.ClientLayoutItemFieldDataType.JSON:
3036
- return index.h("pre", { class: "mrd-layout-section__pre", innerHTML: CellRenderer.formatJson(value) });
2301
+ return index.h("pre", { class: "mrd-layout-section__pre", innerHTML: cellRenderer.CellRenderer.formatJson(value) });
3037
2302
  case clientLayout.ClientLayoutItemFieldDataType.FILE: {
3038
2303
  const v = value;
3039
2304
  const fileName = (_e = v === null || v === void 0 ? void 0 : v.fileName) !== null && _e !== void 0 ? _e : String(value);
3040
2305
  const href = (_f = v === null || v === void 0 ? void 0 : v.href) !== null && _f !== void 0 ? _f : '';
3041
- return downloadLink(ctx, href, fileName, t('download', ctx.locale));
2306
+ return downloadLink(ctx, href, fileName, cellRenderer.t('download', ctx.locale));
3042
2307
  }
3043
2308
  case clientLayout.ClientLayoutItemFieldDataType.IMAGE: {
3044
2309
  const v = value;
@@ -3051,7 +2316,7 @@ function renderSingleFieldValue(ctx, item, value) {
3051
2316
  return downloadLink(ctx, href, fileName, fileName || href);
3052
2317
  }
3053
2318
  case clientLayout.ClientLayoutItemFieldDataType.BOOLEAN:
3054
- return (index.h("span", { class: `mrd-layout-section__boolean mrd-layout-section__boolean--${value ? 'true' : 'false'}` }, value ? t('yes', ctx.locale) : t('no', ctx.locale)));
2319
+ return (index.h("span", { class: `mrd-layout-section__boolean mrd-layout-section__boolean--${value ? 'true' : 'false'}` }, value ? cellRenderer.t('yes', ctx.locale) : cellRenderer.t('no', ctx.locale)));
3055
2320
  case clientLayout.ClientLayoutItemFieldDataType.LIST: {
3056
2321
  const listItem = ((_j = item.listItems) !== null && _j !== void 0 ? _j : []).find(li => li.key === String(value));
3057
2322
  const label = (_k = listItem === null || listItem === void 0 ? void 0 : listItem.label) !== null && _k !== void 0 ? _k : String(value);
@@ -3068,7 +2333,7 @@ function renderSingleFieldValue(ctx, item, value) {
3068
2333
  case clientLayout.ClientLayoutItemFieldDataType.SECRET:
3069
2334
  return value ? index.h("span", { class: "mrd-layout-section__secret-masked" }, '••••••••') : null;
3070
2335
  default: {
3071
- const text = CellRenderer.renderValue(dt, value, (_l = item.listItems) !== null && _l !== void 0 ? _l : [], ctx.locale);
2336
+ const text = cellRenderer.CellRenderer.renderValue(dt, value, (_l = item.listItems) !== null && _l !== void 0 ? _l : [], ctx.locale);
3072
2337
  return text || null;
3073
2338
  }
3074
2339
  }
@@ -3095,10 +2360,10 @@ function renderHistoryBadge(ctx, item, raw) {
3095
2360
  return null;
3096
2361
  const sorted = [...history].sort((a, b) => b.until.localeCompare(a.until));
3097
2362
  const isOpen = ctx.openHistoryField === item.name;
3098
- return (index.h("span", { class: "mrd-layout-section__history-wrap" }, index.h("button", { type: "button", class: "mrd-layout-section__history-btn", title: t('history_badge_tooltip', ctx.locale), "aria-label": t('history_badge_tooltip', ctx.locale), onClick: (e) => {
2363
+ return (index.h("span", { class: "mrd-layout-section__history-wrap" }, index.h("button", { type: "button", class: "mrd-layout-section__history-btn", title: cellRenderer.t('history_badge_tooltip', ctx.locale), "aria-label": cellRenderer.t('history_badge_tooltip', ctx.locale), onClick: (e) => {
3099
2364
  e.stopPropagation();
3100
2365
  ctx.on.toggleHistory(isOpen ? null : item.name);
3101
- } }, index.h("svg", { class: "mrd-layout-section__history-icon", viewBox: "0 0 20 20", fill: "currentColor", "aria-hidden": "true" }, index.h("path", { "fill-rule": "evenodd", d: "M10 18a8 8 0 100-16 8 8 0 000 16zm.75-13a.75.75 0 00-1.5 0v5c0 .207.085.394.22.53l2.5 2.5a.75.75 0 101.06-1.06L10.75 9.69V5z", "clip-rule": "evenodd" }))), isOpen && (index.h("div", { class: "mrd-layout-section__history-popover", role: "listbox" }, sorted.map((entry, i) => (index.h("div", { key: String(i), class: "mrd-layout-section__history-entry" }, entry.value, " (", t('history_until', ctx.locale), " ", formatDate(entry.until, ctx.locale), ")")))))));
2366
+ } }, index.h("svg", { class: "mrd-layout-section__history-icon", viewBox: "0 0 20 20", fill: "currentColor", "aria-hidden": "true" }, index.h("path", { "fill-rule": "evenodd", d: "M10 18a8 8 0 100-16 8 8 0 000 16zm.75-13a.75.75 0 00-1.5 0v5c0 .207.085.394.22.53l2.5 2.5a.75.75 0 101.06-1.06L10.75 9.69V5z", "clip-rule": "evenodd" }))), isOpen && (index.h("div", { class: "mrd-layout-section__history-popover", role: "listbox" }, sorted.map((entry, i) => (index.h("div", { key: String(i), class: "mrd-layout-section__history-entry" }, entry.value, " (", cellRenderer.t('history_until', ctx.locale), " ", cellRenderer.formatDate(entry.until, ctx.locale), ")")))))));
3102
2367
  }
3103
2368
  function renderField(ctx, item) {
3104
2369
  var _a, _b;
@@ -3546,7 +2811,7 @@ const MrdListField = class {
3546
2811
  return (index.h("label", { key: lv.key, class: "mrd-list-field__checkbox-item" }, index.h("input", { type: "checkbox", checked: this.selected.includes(lv.key), disabled: this.disabled, onChange: () => this.toggleCheckbox(lv.key) }), (lv.color || lv.backgroundColor) && (index.h("span", { class: "mrd-list-field__color-dot", style: { backgroundColor: (_b = (_a = lv.backgroundColor) !== null && _a !== void 0 ? _a : lv.color) !== null && _b !== void 0 ? _b : '' } })), index.h("span", null, lv.label)));
3547
2812
  })), index.h(FieldError, { base: "mrd-list-field", error: this.error }))));
3548
2813
  }
3549
- return (index.h(index.Host, null, index.h("div", { class: "mrd-list-field" }, index.h(FieldLabel, { base: "mrd-list-field", label: this.label, required: this.required }), index.h("select", { class: controlClass('mrd-list-field', hasError, 'select'), name: this.name, required: this.required, disabled: this.disabled, onChange: this.handleSelectChange, onBlur: this.handleBlur }, index.h("option", { value: "" }, t('select_placeholder', this.locale)), this.listItems.map(lv => {
2814
+ return (index.h(index.Host, null, index.h("div", { class: "mrd-list-field" }, index.h(FieldLabel, { base: "mrd-list-field", label: this.label, required: this.required }), index.h("select", { class: controlClass('mrd-list-field', hasError, 'select'), name: this.name, required: this.required, disabled: this.disabled, onChange: this.handleSelectChange, onBlur: this.handleBlur }, index.h("option", { value: "" }, cellRenderer.t('select_placeholder', this.locale)), this.listItems.map(lv => {
3550
2815
  var _a, _b;
3551
2816
  const bg = (_b = (_a = lv.backgroundColor) !== null && _a !== void 0 ? _a : lv.color) !== null && _b !== void 0 ? _b : null;
3552
2817
  const style = bg ? { backgroundColor: bg, color: this.getContrastColor(bg) } : {};
@@ -3610,12 +2875,12 @@ const MrdNumberField = class {
3610
2875
  };
3611
2876
  this.handleBlur = (e) => {
3612
2877
  const raw = e.target.value;
3613
- const parsed = parseLocalizedNumber(raw, this.locale);
2878
+ const parsed = cellRenderer.parseLocalizedNumber(raw, this.locale);
3614
2879
  if (this.required && (parsed === null || raw === '')) {
3615
- this.error = t('required', this.locale);
2880
+ this.error = cellRenderer.t('required', this.locale);
3616
2881
  }
3617
2882
  else if (raw !== '' && !validateNumber(parsed, this.dataType)) {
3618
- this.error = t('invalid_number', this.locale);
2883
+ this.error = cellRenderer.t('invalid_number', this.locale);
3619
2884
  }
3620
2885
  else {
3621
2886
  this.error = '';
@@ -3641,18 +2906,18 @@ const MrdNumberField = class {
3641
2906
  }
3642
2907
  formatForDisplay(val) {
3643
2908
  if (this.dataType === clientLayout.ClientLayoutItemFieldDataType.PERCENTAGE) {
3644
- return formatNumber(val, this.locale, {
2909
+ return cellRenderer.formatNumber(val, this.locale, {
3645
2910
  minimumFractionDigits: 0,
3646
2911
  maximumFractionDigits: this.decimalPrecision,
3647
2912
  }) + '%';
3648
2913
  }
3649
2914
  if (this.dataType === clientLayout.ClientLayoutItemFieldDataType.DECIMAL) {
3650
- return formatNumber(val, this.locale, {
2915
+ return cellRenderer.formatNumber(val, this.locale, {
3651
2916
  minimumFractionDigits: this.decimalPrecision,
3652
2917
  maximumFractionDigits: this.decimalPrecision,
3653
2918
  });
3654
2919
  }
3655
- return formatNumber(val, this.locale, { maximumFractionDigits: 0 });
2920
+ return cellRenderer.formatNumber(val, this.locale, { maximumFractionDigits: 0 });
3656
2921
  }
3657
2922
  render() {
3658
2923
  const hasError = !!this.error;
@@ -3884,19 +3149,19 @@ const MrdRelationField = class {
3884
3149
  const hasError = !!this.error;
3885
3150
  if (this.editBehavior === clientLayout.ClientLayoutItemRelationEditBehavior.DROPDOWN) {
3886
3151
  const currentValue = this.getValueHref();
3887
- return (index.h(index.Host, null, index.h("div", { class: "mrd-relation-field" }, index.h(FieldLabel, { base: "mrd-relation-field", label: this.label, required: this.required }), index.h("select", { class: controlClass('mrd-relation-field', hasError, 'select'), name: this.name, required: this.required, disabled: this.disabled, onChange: this.handleDropdownChange }, index.h("option", { value: "" }, t('select_placeholder', this.locale)), this.allRecords.map(record => (index.h("option", { key: record.id, value: record.id, selected: record.id === currentValue }, record.label)))), index.h(FieldError, { base: "mrd-relation-field", error: this.error }))));
3152
+ return (index.h(index.Host, null, index.h("div", { class: "mrd-relation-field" }, index.h(FieldLabel, { base: "mrd-relation-field", label: this.label, required: this.required }), index.h("select", { class: controlClass('mrd-relation-field', hasError, 'select'), name: this.name, required: this.required, disabled: this.disabled, onChange: this.handleDropdownChange }, index.h("option", { value: "" }, cellRenderer.t('select_placeholder', this.locale)), this.allRecords.map(record => (index.h("option", { key: record.id, value: record.id, selected: record.id === currentValue }, record.label)))), index.h(FieldError, { base: "mrd-relation-field", error: this.error }))));
3888
3153
  }
3889
3154
  if (this.displayType === clientLayout.ClientLayoutItemRelationDisplayType.DROPDOWN) {
3890
3155
  const currentValue = Array.isArray(this.value) ? ((_a = this.value[0]) !== null && _a !== void 0 ? _a : '') : ((_b = this.value) !== null && _b !== void 0 ? _b : '');
3891
- return (index.h(index.Host, null, index.h("div", { class: "mrd-relation-field" }, index.h(FieldLabel, { base: "mrd-relation-field", label: this.label, required: this.required }), index.h("select", { class: controlClass('mrd-relation-field', hasError, 'select'), name: this.name, required: this.required, disabled: this.disabled, onChange: this.handleDropdownChange }, index.h("option", { value: "" }, t('select_placeholder', this.locale)), this.dropdownValues.map(dv => (index.h("option", { key: dv.key, value: dv.key, selected: dv.key === currentValue }, dv.label)))), index.h(FieldError, { base: "mrd-relation-field", error: this.error }))));
3156
+ return (index.h(index.Host, null, index.h("div", { class: "mrd-relation-field" }, index.h(FieldLabel, { base: "mrd-relation-field", label: this.label, required: this.required }), index.h("select", { class: controlClass('mrd-relation-field', hasError, 'select'), name: this.name, required: this.required, disabled: this.disabled, onChange: this.handleDropdownChange }, index.h("option", { value: "" }, cellRenderer.t('select_placeholder', this.locale)), this.dropdownValues.map(dv => (index.h("option", { key: dv.key, value: dv.key, selected: dv.key === currentValue }, dv.label)))), index.h(FieldError, { base: "mrd-relation-field", error: this.error }))));
3892
3157
  }
3893
3158
  // SEARCH mode
3894
3159
  const labelEl = index.h(FieldLabel, { base: "mrd-relation-field", label: this.label, required: this.required });
3895
3160
  // Single selection: show selected value as a badge, hide the search input
3896
3161
  if (!this.multiple && this.selectedItems.length > 0) {
3897
- return (index.h(index.Host, null, index.h("div", { class: "mrd-relation-field" }, labelEl, index.h("div", { class: `mrd-relation-field__selected-value${hasError ? ' mrd-relation-field__selected-value--error' : ''}` }, index.h("span", { class: "mrd-relation-field__selected-name" }, this.selectedItems[0].label), index.h("button", { type: "button", class: "mrd-relation-field__selected-clear", onClick: this.clearSelection, "aria-label": t('remove', this.locale) }, "\u2715")), index.h(FieldError, { base: "mrd-relation-field", error: this.error }))));
3162
+ return (index.h(index.Host, null, index.h("div", { class: "mrd-relation-field" }, labelEl, index.h("div", { class: `mrd-relation-field__selected-value${hasError ? ' mrd-relation-field__selected-value--error' : ''}` }, index.h("span", { class: "mrd-relation-field__selected-name" }, this.selectedItems[0].label), index.h("button", { type: "button", class: "mrd-relation-field__selected-clear", onClick: this.clearSelection, "aria-label": cellRenderer.t('remove', this.locale) }, "\u2715")), index.h(FieldError, { base: "mrd-relation-field", error: this.error }))));
3898
3163
  }
3899
- return (index.h(index.Host, null, index.h("div", { class: "mrd-relation-field" }, labelEl, this.multiple && this.selectedItems.length > 0 && (index.h("div", { class: "mrd-relation-field__tags" }, this.selectedItems.map(item => (index.h("span", { key: item.id, class: "mrd-relation-field__tag" }, item.label, index.h("button", { type: "button", class: "mrd-relation-field__tag-remove", onClick: () => this.handleRemoveSelected(item.id), "aria-label": t('remove', this.locale) }, "\u2715")))))), index.h("div", { class: "mrd-relation-field__search-wrapper" }, index.h("input", { class: `mrd-relation-field__search${hasError ? ' mrd-relation-field__search--error' : ''}`, type: "text", value: this.searchQuery, placeholder: t('search_placeholder', this.locale), disabled: this.disabled, onInput: this.handleSearchInput, onKeyDown: this.handleKeyDown, onBlur: this.handleBlur }), this.isLoading && (index.h("span", { class: "mrd-relation-field__spinner", "aria-label": t('loading', this.locale) }))), this.showResults && (index.h("div", { class: "mrd-relation-field__results" }, this.searchResults.length === 0 && !this.isLoading ? (index.h("div", { class: "mrd-relation-field__no-results" }, t('no_results', this.locale))) : (this.searchResults.map((result, i) => (index.h("div", { key: result.id, class: `mrd-relation-field__result-item${i === this.highlightedIndex ? ' mrd-relation-field__result-item--highlighted' : ''}`, onMouseDown: () => this.handleResultSelect(result) }, index.h("span", { class: "mrd-relation-field__result-label" }, result.label), result.description && (index.h("span", { class: "mrd-relation-field__result-desc" }, result.description)))))))), index.h(FieldError, { base: "mrd-relation-field", error: this.error }))));
3164
+ return (index.h(index.Host, null, index.h("div", { class: "mrd-relation-field" }, labelEl, this.multiple && this.selectedItems.length > 0 && (index.h("div", { class: "mrd-relation-field__tags" }, this.selectedItems.map(item => (index.h("span", { key: item.id, class: "mrd-relation-field__tag" }, item.label, index.h("button", { type: "button", class: "mrd-relation-field__tag-remove", onClick: () => this.handleRemoveSelected(item.id), "aria-label": cellRenderer.t('remove', this.locale) }, "\u2715")))))), index.h("div", { class: "mrd-relation-field__search-wrapper" }, index.h("input", { class: `mrd-relation-field__search${hasError ? ' mrd-relation-field__search--error' : ''}`, type: "text", value: this.searchQuery, placeholder: cellRenderer.t('search_placeholder', this.locale), disabled: this.disabled, onInput: this.handleSearchInput, onKeyDown: this.handleKeyDown, onBlur: this.handleBlur }), this.isLoading && (index.h("span", { class: "mrd-relation-field__spinner", "aria-label": cellRenderer.t('loading', this.locale) }))), this.showResults && (index.h("div", { class: "mrd-relation-field__results" }, this.searchResults.length === 0 && !this.isLoading ? (index.h("div", { class: "mrd-relation-field__no-results" }, cellRenderer.t('no_results', this.locale))) : (this.searchResults.map((result, i) => (index.h("div", { key: result.id, class: `mrd-relation-field__result-item${i === this.highlightedIndex ? ' mrd-relation-field__result-item--highlighted' : ''}`, onMouseDown: () => this.handleResultSelect(result) }, index.h("span", { class: "mrd-relation-field__result-label" }, result.label), result.description && (index.h("span", { class: "mrd-relation-field__result-desc" }, result.description)))))))), index.h(FieldError, { base: "mrd-relation-field", error: this.error }))));
3900
3165
  }
3901
3166
  get el() { return index.getElement(this); }
3902
3167
  static get watchers() { return {
@@ -4140,48 +3405,45 @@ const TableCell = ({ col, row, locale, onDownload, onOpenTextblock, onOpenJson }
4140
3405
  return (index.h("td", { class: "mrd-table__cell" }, href && fileName ? (index.h("button", { class: "mrd-table__file-btn", title: fileName, onClick: (e) => {
4141
3406
  e.stopPropagation();
4142
3407
  onDownload({ href, fileName });
4143
- } }, index.h("svg", { class: "mrd-table__file-icon", viewBox: "0 0 24 24", "aria-hidden": "true" }, index.h("path", { fill: "currentColor", d: "M14 2H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h12c1.1 0 2-.9 2-2V8l-6-6zm-1 7V3.5L18.5 9H13zm-3 8l-3-3 1.41-1.41L10 14.17l4.59-4.58L16 11l-6 6z" })), t('download', locale))) : ''));
3408
+ } }, index.h("svg", { class: "mrd-table__file-icon", viewBox: "0 0 24 24", "aria-hidden": "true" }, index.h("path", { fill: "currentColor", d: "M14 2H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h12c1.1 0 2-.9 2-2V8l-6-6zm-1 7V3.5L18.5 9H13zm-3 8l-3-3 1.41-1.41L10 14.17l4.59-4.58L16 11l-6 6z" })), cellRenderer.t('download', locale))) : ''));
4144
3409
  }
4145
3410
  if (dataType === 'JSON') {
4146
3411
  const name = (_c = col.name) !== null && _c !== void 0 ? _c : '';
4147
3412
  const rawValue = name ? row === null || row === void 0 ? void 0 : row[name] : undefined;
4148
3413
  if (rawValue == null || rawValue === '')
4149
3414
  return index.h("td", { class: "mrd-table__cell" });
4150
- const compactHtml = CellRenderer.formatJson(rawValue, true);
4151
- const prettyHtml = CellRenderer.formatJson(rawValue, false);
4152
- return (index.h("td", { class: "mrd-table__cell" }, index.h("span", { class: "mrd-table__json-preview", innerHTML: compactHtml }), index.h("button", { class: "mrd-table__textblock-btn", onClick: (e) => { e.stopPropagation(); onOpenJson(prettyHtml); }, "aria-label": t('textblock_show_more', locale) }, "\u22EF")));
3415
+ const compactHtml = cellRenderer.CellRenderer.formatJson(rawValue, true);
3416
+ const prettyHtml = cellRenderer.CellRenderer.formatJson(rawValue, false);
3417
+ return (index.h("td", { class: "mrd-table__cell" }, index.h("span", { class: "mrd-table__json-preview", innerHTML: compactHtml }), index.h("button", { class: "mrd-table__textblock-btn", onClick: (e) => { e.stopPropagation(); onOpenJson(prettyHtml); }, "aria-label": cellRenderer.t('textblock_show_more', locale) }, "\u22EF")));
4153
3418
  }
4154
3419
  if (dataType === 'TEXTBLOCK') {
4155
- const full = CellRenderer.render(col, row, locale);
3420
+ const full = cellRenderer.CellRenderer.render(col, row, locale);
4156
3421
  if (full.length <= TEXTBLOCK_MAX) {
4157
3422
  return index.h("td", { class: "mrd-table__cell" }, full);
4158
3423
  }
4159
3424
  const preview = full.slice(0, TEXTBLOCK_MAX) + '…';
4160
- return (index.h("td", { class: "mrd-table__cell" }, preview, index.h("button", { class: "mrd-table__textblock-btn", onClick: (e) => { e.stopPropagation(); onOpenTextblock(full); }, "aria-label": t('textblock_show_more', locale) }, "\u22EF")));
3425
+ return (index.h("td", { class: "mrd-table__cell" }, preview, index.h("button", { class: "mrd-table__textblock-btn", onClick: (e) => { e.stopPropagation(); onOpenTextblock(full); }, "aria-label": cellRenderer.t('textblock_show_more', locale) }, "\u22EF")));
4161
3426
  }
4162
- const value = CellRenderer.render(col, row, locale);
3427
+ const value = cellRenderer.CellRenderer.render(col, row, locale);
4163
3428
  return (index.h("td", { class: `mrd-table__cell${isNumeric ? ' mrd-table__cell--numeric' : ''}` }, value));
4164
3429
  };
4165
3430
  /** Formats the aggregation total for one column, '' when not applicable. */
4166
3431
  function formatAggregationValue(col, aggregations, locale) {
4167
- var _a;
3432
+ var _a, _b;
4168
3433
  if (col.type !== 'FIELD' || !col.aggregate || !aggregations)
4169
3434
  return '';
4170
3435
  const fn = col.aggregate.toLowerCase();
4171
- const aggData = aggregations[fn];
4172
- const val = typeof aggData === 'object' && aggData !== null
4173
- ? aggData[(_a = col.name) !== null && _a !== void 0 ? _a : '']
4174
- : undefined;
3436
+ const val = (_a = aggregations[fn]) === null || _a === void 0 ? void 0 : _a[(_b = col.name) !== null && _b !== void 0 ? _b : ''];
4175
3437
  if (val == null)
4176
3438
  return '';
4177
3439
  const dt = col.dataType;
4178
3440
  if (dt === 'INTEGER')
4179
- return formatNumber(val, locale, { maximumFractionDigits: 0 });
3441
+ return cellRenderer.formatNumber(val, locale, { maximumFractionDigits: 0 });
4180
3442
  if (dt === 'PERCENTAGE')
4181
- return formatPercentage(val, locale);
3443
+ return cellRenderer.formatPercentage(val, locale);
4182
3444
  if (dt === 'CURRENCY' && col.currencyCode)
4183
- return formatCurrency(val, col.currencyCode, locale);
4184
- return formatNumber(val, locale);
3445
+ return cellRenderer.formatCurrency(val, col.currencyCode, locale);
3446
+ return cellRenderer.formatNumber(val, locale);
4185
3447
  }
4186
3448
  const TotalsRow = ({ columns, aggregations, locale }) => {
4187
3449
  if (!aggregations)
@@ -4198,18 +3460,18 @@ const TotalsRow = ({ columns, aggregations, locale }) => {
4198
3460
  const TextblockModal = ({ text, locale, onClose }) => {
4199
3461
  if (text === null)
4200
3462
  return null;
4201
- return (index.h("div", { class: "mrd-table__modal-backdrop", onClick: onClose, role: "dialog", "aria-modal": "true" }, index.h("div", { class: "mrd-table__modal", onClick: (e) => e.stopPropagation() }, index.h("button", { class: "mrd-table__modal-close", onClick: onClose, "aria-label": t('close', locale) }, "\u2715"), index.h("p", { class: "mrd-table__modal-text" }, text))));
3463
+ return (index.h("div", { class: "mrd-table__modal-backdrop", onClick: onClose, role: "dialog", "aria-modal": "true" }, index.h("div", { class: "mrd-table__modal", onClick: (e) => e.stopPropagation() }, index.h("button", { class: "mrd-table__modal-close", onClick: onClose, "aria-label": cellRenderer.t('close', locale) }, "\u2715"), index.h("p", { class: "mrd-table__modal-text" }, text))));
4202
3464
  };
4203
3465
  const JsonModal = ({ html, locale, onClose }) => {
4204
3466
  if (html === null)
4205
3467
  return null;
4206
- return (index.h("div", { class: "mrd-table__modal-backdrop", onClick: onClose, role: "dialog", "aria-modal": "true" }, index.h("div", { class: "mrd-table__modal", onClick: (e) => e.stopPropagation() }, index.h("button", { class: "mrd-table__modal-close", onClick: onClose, "aria-label": t('close', locale) }, "\u2715"), index.h("pre", { class: "mrd-table__modal-json", innerHTML: html }))));
3468
+ return (index.h("div", { class: "mrd-table__modal-backdrop", onClick: onClose, role: "dialog", "aria-modal": "true" }, index.h("div", { class: "mrd-table__modal", onClick: (e) => e.stopPropagation() }, index.h("button", { class: "mrd-table__modal-close", onClick: onClose, "aria-label": cellRenderer.t('close', locale) }, "\u2715"), index.h("pre", { class: "mrd-table__modal-json", innerHTML: html }))));
4207
3469
  };
4208
3470
  const Toolbar = ({ locale, filterMode, filterCount, actions, views, activeViewIdx, viewPopoverOpen, createPickerOpen, createTypes, cb }) => {
4209
3471
  var _a;
4210
3472
  const hasActions = actions.length > 0;
4211
3473
  const hasViewSwitcher = views.length > 1;
4212
- return (index.h("div", { class: "mrd-table__toolbar" }, index.h("div", { class: "mrd-table__toolbar-left" }, index.h("button", { class: `mrd-table__action mrd-table__action--secondary mrd-table__filter-toggle${filterMode ? ' mrd-table__filter-toggle--active' : ''}`, onClick: cb.onFilterToggle }, index.h("svg", { class: "mrd-table__action-icon", viewBox: "0 0 24 24", "aria-hidden": "true" }, index.h("path", { fill: "currentColor", d: "M10 18h4v-2h-4v2zM3 6v2h18V6H3zm3 7h12v-2H6v2z" })), filterCount > 0 && index.h("span", { class: "mrd-table__filter-badge" }, filterCount), index.h("span", { class: "mrd-table__action-tooltip" }, filterMode ? t('table_filter_hide', locale) : t('table_filter', locale), filterCount > 0 ? ` (${filterCount} ${t('table_filter_active', locale)})` : '')), filterCount > 0 && (index.h("button", { class: "mrd-table__action mrd-table__action--secondary", onClick: cb.onClearAllFilters }, index.h("svg", { class: "mrd-table__action-icon", viewBox: "0 0 24 24", "aria-hidden": "true" }, index.h("path", { fill: "currentColor", d: "M19 6.41L17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z" })), index.h("span", { class: "mrd-table__action-tooltip" }, t('table_filter_clear_all', locale))))), hasViewSwitcher && (index.h("div", { class: "mrd-table__toolbar-center" }, index.h("div", { class: "mrd-table__view-switcher" }, index.h("button", { class: "mrd-table__view-arrow", "aria-label": "Previous view", onClick: () => cb.onViewSwitch((activeViewIdx - 1 + views.length) % views.length) }, "\u25C0"), index.h("div", { class: "mrd-table__view-title-wrap" }, index.h("button", { class: "mrd-table__view-title", onClick: (e) => cb.onToggleViewPopover(e) }, (_a = views[activeViewIdx]) === null || _a === void 0 ? void 0 : _a.label), viewPopoverOpen && (index.h("div", { class: "mrd-table__view-popover", onClick: (e) => e.stopPropagation() }, views.map((v, i) => (index.h("button", { key: String(i), class: `mrd-table__view-popover-item${i === activeViewIdx ? ' mrd-table__view-popover-item--active' : ''}`, onClick: () => {
3474
+ return (index.h("div", { class: "mrd-table__toolbar" }, index.h("div", { class: "mrd-table__toolbar-left" }, index.h("button", { class: `mrd-table__action mrd-table__action--secondary mrd-table__filter-toggle${filterMode ? ' mrd-table__filter-toggle--active' : ''}`, onClick: cb.onFilterToggle }, index.h("svg", { class: "mrd-table__action-icon", viewBox: "0 0 24 24", "aria-hidden": "true" }, index.h("path", { fill: "currentColor", d: "M10 18h4v-2h-4v2zM3 6v2h18V6H3zm3 7h12v-2H6v2z" })), filterCount > 0 && index.h("span", { class: "mrd-table__filter-badge" }, filterCount), index.h("span", { class: "mrd-table__action-tooltip" }, filterMode ? cellRenderer.t('table_filter_hide', locale) : cellRenderer.t('table_filter', locale), filterCount > 0 ? ` (${filterCount} ${cellRenderer.t('table_filter_active', locale)})` : '')), filterCount > 0 && (index.h("button", { class: "mrd-table__action mrd-table__action--secondary", onClick: cb.onClearAllFilters }, index.h("svg", { class: "mrd-table__action-icon", viewBox: "0 0 24 24", "aria-hidden": "true" }, index.h("path", { fill: "currentColor", d: "M19 6.41L17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z" })), index.h("span", { class: "mrd-table__action-tooltip" }, cellRenderer.t('table_filter_clear_all', locale))))), hasViewSwitcher && (index.h("div", { class: "mrd-table__toolbar-center" }, index.h("div", { class: "mrd-table__view-switcher" }, index.h("button", { class: "mrd-table__view-arrow", "aria-label": "Previous view", onClick: () => cb.onViewSwitch((activeViewIdx - 1 + views.length) % views.length) }, "\u25C0"), index.h("div", { class: "mrd-table__view-title-wrap" }, index.h("button", { class: "mrd-table__view-title", onClick: (e) => cb.onToggleViewPopover(e) }, (_a = views[activeViewIdx]) === null || _a === void 0 ? void 0 : _a.label), viewPopoverOpen && (index.h("div", { class: "mrd-table__view-popover", onClick: (e) => e.stopPropagation() }, views.map((v, i) => (index.h("button", { key: String(i), class: `mrd-table__view-popover-item${i === activeViewIdx ? ' mrd-table__view-popover-item--active' : ''}`, onClick: () => {
4213
3475
  if (i !== activeViewIdx)
4214
3476
  cb.onViewSwitch(i);
4215
3477
  cb.onCloseViewPopover();
@@ -4231,7 +3493,7 @@ const FilterEditor = ({ col, dataType, openFilterCol, pendingFilter, locale, cb
4231
3493
  var _a, _b, _c, _d, _e, _f;
4232
3494
  const pf = pendingFilter;
4233
3495
  if (NO_FILTER_TYPES.has(dataType)) {
4234
- return index.h("p", { class: "mrd-table__filter-no-support" }, t('filter_no_support', locale));
3496
+ return index.h("p", { class: "mrd-table__filter-no-support" }, cellRenderer.t('filter_no_support', locale));
4235
3497
  }
4236
3498
  if (dataType === 'BOOLEAN') {
4237
3499
  const boolOp = pf.operator;
@@ -4240,12 +3502,12 @@ const FilterEditor = ({ col, dataType, openFilterCol, pendingFilter, locale, cb
4240
3502
  { labelKey: 'filter_all', value: null },
4241
3503
  { labelKey: 'yes', value: true },
4242
3504
  { labelKey: 'no', value: false },
4243
- ].map(opt => (index.h("label", { class: "mrd-table__filter-radio-label" }, index.h("input", { type: "radio", name: `bf-${openFilterCol}`, checked: !noValueOp && pf.value === opt.value, onChange: () => cb.onReplacePending(Object.assign(Object.assign({}, pf), { operator: undefined, value: opt.value })) }), t(opt.labelKey, locale)))), index.h("label", { class: "mrd-table__filter-radio-label" }, index.h("input", { type: "radio", name: `bf-${openFilterCol}`, checked: boolOp === 'isEmpty', onChange: () => cb.onReplacePending(Object.assign(Object.assign({}, pf), { operator: 'isEmpty', value: undefined })) }), t('filter_is_empty', locale)), index.h("label", { class: "mrd-table__filter-radio-label" }, index.h("input", { type: "radio", name: `bf-${openFilterCol}`, checked: boolOp === 'isNotEmpty', onChange: () => cb.onReplacePending(Object.assign(Object.assign({}, pf), { operator: 'isNotEmpty', value: undefined })) }), t('filter_is_not_empty', locale))));
3505
+ ].map(opt => (index.h("label", { class: "mrd-table__filter-radio-label" }, index.h("input", { type: "radio", name: `bf-${openFilterCol}`, checked: !noValueOp && pf.value === opt.value, onChange: () => cb.onReplacePending(Object.assign(Object.assign({}, pf), { operator: undefined, value: opt.value })) }), cellRenderer.t(opt.labelKey, locale)))), index.h("label", { class: "mrd-table__filter-radio-label" }, index.h("input", { type: "radio", name: `bf-${openFilterCol}`, checked: boolOp === 'isEmpty', onChange: () => cb.onReplacePending(Object.assign(Object.assign({}, pf), { operator: 'isEmpty', value: undefined })) }), cellRenderer.t('filter_is_empty', locale)), index.h("label", { class: "mrd-table__filter-radio-label" }, index.h("input", { type: "radio", name: `bf-${openFilterCol}`, checked: boolOp === 'isNotEmpty', onChange: () => cb.onReplacePending(Object.assign(Object.assign({}, pf), { operator: 'isNotEmpty', value: undefined })) }), cellRenderer.t('filter_is_not_empty', locale))));
4244
3506
  }
4245
3507
  if (dataType === 'LIST') {
4246
3508
  const items = (_a = col.listItems) !== null && _a !== void 0 ? _a : [];
4247
3509
  const selected = (_b = pf.values) !== null && _b !== void 0 ? _b : [];
4248
- return (index.h("div", { class: "mrd-table__filter-list" }, index.h("div", { class: "mrd-table__filter-list-controls" }, index.h("button", { class: "mrd-table__filter-list-btn", onClick: () => cb.onReplacePending(Object.assign(Object.assign({}, pf), { values: items.map(i => i.key) })) }, t('filter_select_all', locale)), index.h("button", { class: "mrd-table__filter-list-btn", onClick: () => cb.onReplacePending(Object.assign(Object.assign({}, pf), { values: [] })) }, t('filter_select_none', locale))), items.map(item => (index.h("label", { class: "mrd-table__filter-checkbox-label" }, index.h("input", { type: "checkbox", checked: selected.includes(item.key), onChange: (e) => cb.onToggleValue(item.key, e.target.checked) }), item.label)))));
3510
+ return (index.h("div", { class: "mrd-table__filter-list" }, index.h("div", { class: "mrd-table__filter-list-controls" }, index.h("button", { class: "mrd-table__filter-list-btn", onClick: () => cb.onReplacePending(Object.assign(Object.assign({}, pf), { values: items.map(i => i.key) })) }, cellRenderer.t('filter_select_all', locale)), index.h("button", { class: "mrd-table__filter-list-btn", onClick: () => cb.onReplacePending(Object.assign(Object.assign({}, pf), { values: [] })) }, cellRenderer.t('filter_select_none', locale))), items.map(item => (index.h("label", { class: "mrd-table__filter-checkbox-label" }, index.h("input", { type: "checkbox", checked: selected.includes(item.key), onChange: (e) => cb.onToggleValue(item.key, e.target.checked) }), item.label)))));
4249
3511
  }
4250
3512
  if (TEXT_TYPES.has(dataType) || dataType === 'RELATION') {
4251
3513
  const op = (_c = pf.operator) !== null && _c !== void 0 ? _c : 'startsWith';
@@ -4255,7 +3517,7 @@ const FilterEditor = ({ col, dataType, openFilterCol, pendingFilter, locale, cb
4255
3517
  { val: 'equals', labelKey: 'filter_equals' },
4256
3518
  { val: 'isEmpty', labelKey: 'filter_is_empty' },
4257
3519
  { val: 'isNotEmpty', labelKey: 'filter_is_not_empty' },
4258
- ].map(o => index.h("option", { value: o.val, selected: op === o.val }, t(o.labelKey, locale)))), !noInput && (index.h("input", { type: "text", class: "mrd-table__filter-input", value: String((_d = pf.value) !== null && _d !== void 0 ? _d : ''), placeholder: t('filter_search_value', locale), onInput: (e) => cb.onSetPending('value', e.target.value) }))));
3520
+ ].map(o => index.h("option", { value: o.val, selected: op === o.val }, cellRenderer.t(o.labelKey, locale)))), !noInput && (index.h("input", { type: "text", class: "mrd-table__filter-input", value: String((_d = pf.value) !== null && _d !== void 0 ? _d : ''), placeholder: cellRenderer.t('filter_search_value', locale), onInput: (e) => cb.onSetPending('value', e.target.value) }))));
4259
3521
  }
4260
3522
  if (NUMERIC_TYPES.has(dataType)) {
4261
3523
  const numOp = pf.operator;
@@ -4269,7 +3531,7 @@ const FilterEditor = ({ col, dataType, openFilterCol, pendingFilter, locale, cb
4269
3531
  else {
4270
3532
  cb.onReplacePending(Object.assign(Object.assign({}, pf), { operator: undefined }));
4271
3533
  }
4272
- } }, index.h("option", { value: "", selected: !noInput }, t('filter_has_value', locale)), index.h("option", { value: "isEmpty", selected: numOp === 'isEmpty' }, t('filter_is_empty', locale)), index.h("option", { value: "isNotEmpty", selected: numOp === 'isNotEmpty' }, t('filter_is_not_empty', locale))), !noInput && (index.h("div", { class: "mrd-table__filter-editor" }, index.h("div", { class: "mrd-table__filter-radio-group mrd-table__filter-radio-group--inline" }, index.h("label", { class: "mrd-table__filter-radio-label" }, index.h("input", { type: "radio", name: `nm-${openFilterCol}`, checked: !rangeMode, onChange: () => cb.onReplacePending(Object.assign(Object.assign({}, pf), { from: undefined, to: undefined })) }), t('filter_exact', locale)), index.h("label", { class: "mrd-table__filter-radio-label" }, index.h("input", { type: "radio", name: `nm-${openFilterCol}`, checked: rangeMode, onChange: () => cb.onReplacePending(Object.assign(Object.assign({}, pf), { value: undefined, from: null, to: null })) }), t('filter_range', locale))), !rangeMode ? (index.h("input", { type: "number", class: "mrd-table__filter-input", value: pf.value != null ? String(pf.value) : '', onInput: (e) => cb.onSetPending('value', e.target.value) })) : (index.h("div", { class: "mrd-table__filter-range" }, index.h("input", { type: "number", class: "mrd-table__filter-input", placeholder: t('filter_from', locale), value: pf.from != null ? String(pf.from) : '', onInput: (e) => cb.onSetPending('from', e.target.value) }), index.h("span", { class: "mrd-table__filter-range-sep" }, "\u2013"), index.h("input", { type: "number", class: "mrd-table__filter-input", placeholder: t('filter_to', locale), value: pf.to != null ? String(pf.to) : '', onInput: (e) => cb.onSetPending('to', e.target.value) })))))));
3534
+ } }, index.h("option", { value: "", selected: !noInput }, cellRenderer.t('filter_has_value', locale)), index.h("option", { value: "isEmpty", selected: numOp === 'isEmpty' }, cellRenderer.t('filter_is_empty', locale)), index.h("option", { value: "isNotEmpty", selected: numOp === 'isNotEmpty' }, cellRenderer.t('filter_is_not_empty', locale))), !noInput && (index.h("div", { class: "mrd-table__filter-editor" }, index.h("div", { class: "mrd-table__filter-radio-group mrd-table__filter-radio-group--inline" }, index.h("label", { class: "mrd-table__filter-radio-label" }, index.h("input", { type: "radio", name: `nm-${openFilterCol}`, checked: !rangeMode, onChange: () => cb.onReplacePending(Object.assign(Object.assign({}, pf), { from: undefined, to: undefined })) }), cellRenderer.t('filter_exact', locale)), index.h("label", { class: "mrd-table__filter-radio-label" }, index.h("input", { type: "radio", name: `nm-${openFilterCol}`, checked: rangeMode, onChange: () => cb.onReplacePending(Object.assign(Object.assign({}, pf), { value: undefined, from: null, to: null })) }), cellRenderer.t('filter_range', locale))), !rangeMode ? (index.h("input", { type: "number", class: "mrd-table__filter-input", value: pf.value != null ? String(pf.value) : '', onInput: (e) => cb.onSetPending('value', e.target.value) })) : (index.h("div", { class: "mrd-table__filter-range" }, index.h("input", { type: "number", class: "mrd-table__filter-input", placeholder: cellRenderer.t('filter_from', locale), value: pf.from != null ? String(pf.from) : '', onInput: (e) => cb.onSetPending('from', e.target.value) }), index.h("span", { class: "mrd-table__filter-range-sep" }, "\u2013"), index.h("input", { type: "number", class: "mrd-table__filter-input", placeholder: cellRenderer.t('filter_to', locale), value: pf.to != null ? String(pf.to) : '', onInput: (e) => cb.onSetPending('to', e.target.value) })))))));
4273
3535
  }
4274
3536
  if (dataType === 'DATETIME') {
4275
3537
  const dtOp = pf.operator;
@@ -4283,7 +3545,7 @@ const FilterEditor = ({ col, dataType, openFilterCol, pendingFilter, locale, cb
4283
3545
  else {
4284
3546
  cb.onReplacePending(Object.assign(Object.assign({}, pf), { operator: undefined }));
4285
3547
  }
4286
- } }, index.h("option", { value: "", selected: !noInput }, t('filter_has_value', locale)), index.h("option", { value: "isEmpty", selected: dtOp === 'isEmpty' }, t('filter_is_empty', locale)), index.h("option", { value: "isNotEmpty", selected: dtOp === 'isNotEmpty' }, t('filter_is_not_empty', locale))), !noInput && (index.h("div", { class: "mrd-table__filter-editor" }, index.h("div", { class: "mrd-table__filter-radio-group mrd-table__filter-radio-group--inline" }, index.h("label", { class: "mrd-table__filter-radio-label" }, index.h("input", { type: "radio", name: `dt-${openFilterCol}`, checked: !rangeMode, onChange: () => cb.onReplacePending(Object.assign(Object.assign({}, pf), { from: undefined, to: undefined })) }), t('filter_exact', locale)), index.h("label", { class: "mrd-table__filter-radio-label" }, index.h("input", { type: "radio", name: `dt-${openFilterCol}`, checked: rangeMode, onChange: () => cb.onReplacePending(Object.assign(Object.assign({}, pf), { value: undefined, from: null, to: null })) }), t('filter_range', locale))), !rangeMode ? (index.h("input", { type: "date", class: "mrd-table__filter-input", value: String((_e = pf.value) !== null && _e !== void 0 ? _e : ''), onInput: (e) => cb.onSetPending('value', e.target.value) })) : (index.h("div", { class: "mrd-table__filter-range mrd-table__filter-range--stacked" }, index.h("label", { class: "mrd-table__filter-range-label" }, t('filter_from', locale)), index.h("input", { type: "date", class: "mrd-table__filter-input", value: pf.from != null ? String(pf.from) : '', onInput: (e) => cb.onSetPending('from', e.target.value) }), index.h("label", { class: "mrd-table__filter-range-label" }, t('filter_to', locale)), index.h("input", { type: "date", class: "mrd-table__filter-input", value: pf.to != null ? String(pf.to) : '', onInput: (e) => cb.onSetPending('to', e.target.value) })))))));
3548
+ } }, index.h("option", { value: "", selected: !noInput }, cellRenderer.t('filter_has_value', locale)), index.h("option", { value: "isEmpty", selected: dtOp === 'isEmpty' }, cellRenderer.t('filter_is_empty', locale)), index.h("option", { value: "isNotEmpty", selected: dtOp === 'isNotEmpty' }, cellRenderer.t('filter_is_not_empty', locale))), !noInput && (index.h("div", { class: "mrd-table__filter-editor" }, index.h("div", { class: "mrd-table__filter-radio-group mrd-table__filter-radio-group--inline" }, index.h("label", { class: "mrd-table__filter-radio-label" }, index.h("input", { type: "radio", name: `dt-${openFilterCol}`, checked: !rangeMode, onChange: () => cb.onReplacePending(Object.assign(Object.assign({}, pf), { from: undefined, to: undefined })) }), cellRenderer.t('filter_exact', locale)), index.h("label", { class: "mrd-table__filter-radio-label" }, index.h("input", { type: "radio", name: `dt-${openFilterCol}`, checked: rangeMode, onChange: () => cb.onReplacePending(Object.assign(Object.assign({}, pf), { value: undefined, from: null, to: null })) }), cellRenderer.t('filter_range', locale))), !rangeMode ? (index.h("input", { type: "date", class: "mrd-table__filter-input", value: String((_e = pf.value) !== null && _e !== void 0 ? _e : ''), onInput: (e) => cb.onSetPending('value', e.target.value) })) : (index.h("div", { class: "mrd-table__filter-range mrd-table__filter-range--stacked" }, index.h("label", { class: "mrd-table__filter-range-label" }, cellRenderer.t('filter_from', locale)), index.h("input", { type: "date", class: "mrd-table__filter-input", value: pf.from != null ? String(pf.from) : '', onInput: (e) => cb.onSetPending('from', e.target.value) }), index.h("label", { class: "mrd-table__filter-range-label" }, cellRenderer.t('filter_to', locale)), index.h("input", { type: "date", class: "mrd-table__filter-input", value: pf.to != null ? String(pf.to) : '', onInput: (e) => cb.onSetPending('to', e.target.value) })))))));
4287
3549
  }
4288
3550
  if (DATE_TYPES.has(dataType)) {
4289
3551
  const inputType = dataType === 'DATE' ? 'date' : 'time';
@@ -4298,7 +3560,7 @@ const FilterEditor = ({ col, dataType, openFilterCol, pendingFilter, locale, cb
4298
3560
  else {
4299
3561
  cb.onReplacePending(Object.assign(Object.assign({}, pf), { operator: undefined }));
4300
3562
  }
4301
- } }, index.h("option", { value: "", selected: !noInput }, t('filter_has_value', locale)), index.h("option", { value: "isEmpty", selected: dtdOp === 'isEmpty' }, t('filter_is_empty', locale)), index.h("option", { value: "isNotEmpty", selected: dtdOp === 'isNotEmpty' }, t('filter_is_not_empty', locale))), !noInput && (index.h("div", { class: "mrd-table__filter-editor" }, index.h("div", { class: "mrd-table__filter-radio-group mrd-table__filter-radio-group--inline" }, index.h("label", { class: "mrd-table__filter-radio-label" }, index.h("input", { type: "radio", name: `dt-${openFilterCol}`, checked: !rangeMode, onChange: () => cb.onReplacePending(Object.assign(Object.assign({}, pf), { from: undefined, to: undefined })) }), t('filter_exact', locale)), index.h("label", { class: "mrd-table__filter-radio-label" }, index.h("input", { type: "radio", name: `dt-${openFilterCol}`, checked: rangeMode, onChange: () => cb.onReplacePending(Object.assign(Object.assign({}, pf), { value: undefined, from: null, to: null })) }), t('filter_range', locale))), !rangeMode ? (index.h("input", { type: inputType, class: "mrd-table__filter-input", value: String((_f = pf.value) !== null && _f !== void 0 ? _f : ''), onInput: (e) => cb.onSetPending('value', e.target.value) })) : (index.h("div", { class: "mrd-table__filter-range" }, index.h("input", { type: inputType, class: "mrd-table__filter-input", placeholder: t('filter_from', locale), value: pf.from != null ? String(pf.from) : '', onInput: (e) => cb.onSetPending('from', e.target.value) }), index.h("input", { type: inputType, class: "mrd-table__filter-input", placeholder: t('filter_to', locale), value: pf.to != null ? String(pf.to) : '', onInput: (e) => cb.onSetPending('to', e.target.value) })))))));
3563
+ } }, index.h("option", { value: "", selected: !noInput }, cellRenderer.t('filter_has_value', locale)), index.h("option", { value: "isEmpty", selected: dtdOp === 'isEmpty' }, cellRenderer.t('filter_is_empty', locale)), index.h("option", { value: "isNotEmpty", selected: dtdOp === 'isNotEmpty' }, cellRenderer.t('filter_is_not_empty', locale))), !noInput && (index.h("div", { class: "mrd-table__filter-editor" }, index.h("div", { class: "mrd-table__filter-radio-group mrd-table__filter-radio-group--inline" }, index.h("label", { class: "mrd-table__filter-radio-label" }, index.h("input", { type: "radio", name: `dt-${openFilterCol}`, checked: !rangeMode, onChange: () => cb.onReplacePending(Object.assign(Object.assign({}, pf), { from: undefined, to: undefined })) }), cellRenderer.t('filter_exact', locale)), index.h("label", { class: "mrd-table__filter-radio-label" }, index.h("input", { type: "radio", name: `dt-${openFilterCol}`, checked: rangeMode, onChange: () => cb.onReplacePending(Object.assign(Object.assign({}, pf), { value: undefined, from: null, to: null })) }), cellRenderer.t('filter_range', locale))), !rangeMode ? (index.h("input", { type: inputType, class: "mrd-table__filter-input", value: String((_f = pf.value) !== null && _f !== void 0 ? _f : ''), onInput: (e) => cb.onSetPending('value', e.target.value) })) : (index.h("div", { class: "mrd-table__filter-range" }, index.h("input", { type: inputType, class: "mrd-table__filter-input", placeholder: cellRenderer.t('filter_from', locale), value: pf.from != null ? String(pf.from) : '', onInput: (e) => cb.onSetPending('from', e.target.value) }), index.h("input", { type: inputType, class: "mrd-table__filter-input", placeholder: cellRenderer.t('filter_to', locale), value: pf.to != null ? String(pf.to) : '', onInput: (e) => cb.onSetPending('to', e.target.value) })))))));
4302
3564
  }
4303
3565
  return null;
4304
3566
  };
@@ -4307,7 +3569,7 @@ const FilterPopup = (props) => {
4307
3569
  const { col, openFilterCol, popupPos, sortField, sortDir, locale, cb } = props;
4308
3570
  const label = (_a = col.label) !== null && _a !== void 0 ? _a : openFilterCol;
4309
3571
  const sortActive = sortField === openFilterCol;
4310
- return (index.h("div", { class: "mrd-table__filter-popup", style: { top: `${popupPos.top}px`, left: `${popupPos.left}px` }, onClick: (e) => e.stopPropagation() }, index.h("div", { class: "mrd-table__filter-popup-header" }, index.h("span", { class: "mrd-table__filter-popup-title" }, label), index.h("button", { class: "mrd-table__filter-close", onClick: cb.onClose }, "\u2715")), index.h("div", { class: "mrd-table__filter-section" }, index.h("div", { class: "mrd-table__filter-section-label" }, t('filter_sorting', locale)), index.h("div", { class: "mrd-table__filter-sort-buttons" }, index.h("button", { class: `mrd-table__filter-sort-btn${sortActive && sortDir === 'asc' ? ' mrd-table__filter-sort-btn--active' : ''}`, onClick: () => cb.onApplySort('asc') }, "\u25B2 ", t('filter_ascending', locale)), index.h("button", { class: `mrd-table__filter-sort-btn${sortActive && sortDir === 'desc' ? ' mrd-table__filter-sort-btn--active' : ''}`, onClick: () => cb.onApplySort('desc') }, "\u25BC ", t('filter_descending', locale)))), index.h("div", { class: "mrd-table__filter-divider" }), index.h("div", { class: "mrd-table__filter-section" }, index.h("div", { class: "mrd-table__filter-section-label" }, t('filter_section', locale)), index.h(FilterEditor, Object.assign({}, props))), index.h("div", { class: "mrd-table__filter-popup-footer" }, index.h("button", { class: "mrd-table__filter-btn mrd-table__filter-btn--clear", onClick: cb.onClear }, t('filter_clear', locale)), index.h("button", { class: "mrd-table__filter-btn mrd-table__filter-btn--apply", onClick: cb.onApply }, t('filter_apply', locale)))));
3572
+ return (index.h("div", { class: "mrd-table__filter-popup", style: { top: `${popupPos.top}px`, left: `${popupPos.left}px` }, onClick: (e) => e.stopPropagation() }, index.h("div", { class: "mrd-table__filter-popup-header" }, index.h("span", { class: "mrd-table__filter-popup-title" }, label), index.h("button", { class: "mrd-table__filter-close", onClick: cb.onClose }, "\u2715")), index.h("div", { class: "mrd-table__filter-section" }, index.h("div", { class: "mrd-table__filter-section-label" }, cellRenderer.t('filter_sorting', locale)), index.h("div", { class: "mrd-table__filter-sort-buttons" }, index.h("button", { class: `mrd-table__filter-sort-btn${sortActive && sortDir === 'asc' ? ' mrd-table__filter-sort-btn--active' : ''}`, onClick: () => cb.onApplySort('asc') }, "\u25B2 ", cellRenderer.t('filter_ascending', locale)), index.h("button", { class: `mrd-table__filter-sort-btn${sortActive && sortDir === 'desc' ? ' mrd-table__filter-sort-btn--active' : ''}`, onClick: () => cb.onApplySort('desc') }, "\u25BC ", cellRenderer.t('filter_descending', locale)))), index.h("div", { class: "mrd-table__filter-divider" }), index.h("div", { class: "mrd-table__filter-section" }, index.h("div", { class: "mrd-table__filter-section-label" }, cellRenderer.t('filter_section', locale)), index.h(FilterEditor, Object.assign({}, props))), index.h("div", { class: "mrd-table__filter-popup-footer" }, index.h("button", { class: "mrd-table__filter-btn mrd-table__filter-btn--clear", onClick: cb.onClear }, cellRenderer.t('filter_clear', locale)), index.h("button", { class: "mrd-table__filter-btn mrd-table__filter-btn--apply", onClick: cb.onApply }, cellRenderer.t('filter_apply', locale)))));
4311
3573
  };
4312
3574
 
4313
3575
  /**
@@ -4576,10 +3838,8 @@ const MrdTable = class {
4576
3838
  }
4577
3839
  /** Inject aggregation totals returned by the /aggregations endpoint. */
4578
3840
  async setAggregations(data) {
4579
- var _a;
4580
- const total = (_a = data.total) !== null && _a !== void 0 ? _a : (typeof data.count === 'number' ? data.count : undefined);
4581
- if (total != null)
4582
- this.aggregationsTotal = total;
3841
+ if (data.total != null)
3842
+ this.aggregationsTotal = data.total;
4583
3843
  this.aggregations = data;
4584
3844
  }
4585
3845
  // ── Lifecycle ──────────────────────────────────────────────────────────────
@@ -4720,9 +3980,9 @@ const MrdTable = class {
4720
3980
  const raw = (_b = (_a = this.item) === null || _a === void 0 ? void 0 : _a.actions) !== null && _b !== void 0 ? _b : [];
4721
3981
  return (raw !== null && raw !== void 0 ? raw : []).reduce((acc, a) => {
4722
3982
  if (a === 'NEW')
4723
- acc.push({ action: 'create', label: t('table_new_record', this.locale), icon: 'assets/sprites.svg#icon-plus', variant: 'primary' });
3983
+ acc.push({ action: 'create', label: cellRenderer.t('table_new_record', this.locale), icon: 'assets/sprites.svg#icon-plus', variant: 'primary' });
4724
3984
  if (a === 'EXPORT')
4725
- acc.push({ action: 'export', label: t('table_export_excel', this.locale), icon: 'assets/sprites.svg#icon-file-excel' });
3985
+ acc.push({ action: 'export', label: cellRenderer.t('table_export_excel', this.locale), icon: 'assets/sprites.svg#icon-file-excel' });
4726
3986
  return acc;
4727
3987
  }, []);
4728
3988
  }
@@ -5131,7 +4391,7 @@ const MrdTable = class {
5131
4391
  const count = rowCount !== null && rowCount !== void 0 ? rowCount : 0;
5132
4392
  if (count === 0)
5133
4393
  return null;
5134
- return (index.h("div", { class: "mrd-table__footer" }, count, " ", t('table_of', this.locale), " ", count));
4394
+ return (index.h("div", { class: "mrd-table__footer" }, count, " ", cellRenderer.t('table_of', this.locale), " ", count));
5135
4395
  }
5136
4396
  // Paginated mode: only show once page 0 has loaded (avoids stale total during filter reset)
5137
4397
  if (!this.loadedPages.has(0))
@@ -5143,7 +4403,7 @@ const MrdTable = class {
5143
4403
  const to = Math.min(Math.ceil((this.scrollTop + this.tableHeight) / this.rowHeight), displayTotal);
5144
4404
  // Show '…' for the total until we have a reliable count (aggregations or last page loaded).
5145
4405
  const totalLabel = isTotalKnown ? String(displayTotal) : '…';
5146
- return (index.h("div", { class: "mrd-table__footer" }, from, "\u2013", to, " ", t('table_of', this.locale), " ", totalLabel));
4406
+ return (index.h("div", { class: "mrd-table__footer" }, from, "\u2013", to, " ", cellRenderer.t('table_of', this.locale), " ", totalLabel));
5147
4407
  }
5148
4408
  // ── Render: cell ──────────────────────────────────────────────────────────
5149
4409
  renderCell(col, row) {
@@ -5172,7 +4432,7 @@ const MrdTable = class {
5172
4432
  this.filterMode ? 'mrd-table__header--sortable' : '',
5173
4433
  ].filter(Boolean).join(' ');
5174
4434
  return (index.h("th", { class: cls, onClick: this.filterMode ? (e) => this.handleFilterOpen(col, e) : undefined }, index.h("span", { class: "mrd-table__header-label" }, (_a = col.label) !== null && _a !== void 0 ? _a : ''), isFiltered && index.h(FilterIcon, null)));
5175
- }))), index.h("tbody", null, (_b = this.rows) === null || _b === void 0 ? void 0 : _b.map((row, i) => (index.h("tr", { class: "mrd-table__row mrd-table__row--clickable", style: { background: i % 2 === 0 ? '' : 'var(--mrd-color-neutral-100)' }, onClick: () => this.mrdRowClick.emit({ row }) }, this.columns.map(col => this.renderCell(col, row)))))), this.renderTotalsRow()), (!this.rows || this.rows.length === 0) && (index.h("p", { class: "mrd-table__empty" }, t('no_results', this.locale)))), this.renderFooter((_c = this.rows) === null || _c === void 0 ? void 0 : _c.length), this.renderFilterPopup(), this.renderTextblockModal(), this.renderJsonModal()));
4435
+ }))), index.h("tbody", null, (_b = this.rows) === null || _b === void 0 ? void 0 : _b.map((row, i) => (index.h("tr", { class: "mrd-table__row mrd-table__row--clickable", style: { background: i % 2 === 0 ? '' : 'var(--mrd-color-neutral-100)' }, onClick: () => this.mrdRowClick.emit({ row }) }, this.columns.map(col => this.renderCell(col, row)))))), this.renderTotalsRow()), (!this.rows || this.rows.length === 0) && (index.h("p", { class: "mrd-table__empty" }, cellRenderer.t('no_results', this.locale)))), this.renderFooter((_c = this.rows) === null || _c === void 0 ? void 0 : _c.length), this.renderFilterPopup(), this.renderTextblockModal(), this.renderJsonModal()));
5176
4436
  }
5177
4437
  // ── Paginated / virtual-scroll mode ────────────────────────────────────
5178
4438
  // Derive the authoritative row count from loaded pages:
@@ -5194,7 +4454,7 @@ const MrdTable = class {
5194
4454
  if (row === null) {
5195
4455
  const page = Math.floor(i / this.pageSize);
5196
4456
  if (this.failedPages.has(page)) {
5197
- renderedRows.push(index.h("tr", { class: "mrd-table__row mrd-table__row--failed" }, index.h("td", { class: "mrd-table__cell--failed", colSpan: colCount }, index.h("button", { type: "button", class: "mrd-table__retry-button", onClick: () => this.retryPage(page) }, t('load_failed_retry', this.locale)))));
4457
+ renderedRows.push(index.h("tr", { class: "mrd-table__row mrd-table__row--failed" }, index.h("td", { class: "mrd-table__cell--failed", colSpan: colCount }, index.h("button", { type: "button", class: "mrd-table__retry-button", onClick: () => this.retryPage(page) }, cellRenderer.t('load_failed_retry', this.locale)))));
5198
4458
  }
5199
4459
  else {
5200
4460
  renderedRows.push(index.h("tr", { class: "mrd-table__row mrd-table__row--loading" }, index.h("td", { class: "mrd-table__cell--placeholder", colSpan: colCount }, index.h("span", { class: "mrd-table__placeholder-bar" }))));
@@ -5225,7 +4485,7 @@ const MrdTable = class {
5225
4485
  isFiltered ? 'mrd-table__header--filtered' : '',
5226
4486
  ].filter(Boolean).join(' ');
5227
4487
  return (index.h("th", { class: cls, style: this.colWidths[idx] ? { width: `${this.colWidths[idx]}px` } : undefined, onClick: isInteractive ? ((e) => this.filterMode ? this.handleFilterOpen(col, e) : this.handleSortClick(col)) : undefined }, index.h("span", { class: "mrd-table__header-label" }, (_a = col.label) !== null && _a !== void 0 ? _a : ''), isInteractive && isActive && (index.h("span", { class: "mrd-table__sort-icon", "aria-hidden": "true" }, this.sortDir === 'asc' ? '▲' : '▼')), isInteractive && !isActive && !this.filterMode && (index.h("span", { class: "mrd-table__sort-icon", "aria-hidden": "true" }, "\u21C5")), isInteractive && isFiltered && index.h(FilterIcon, null)));
5228
- }))), index.h("tbody", null, topSpacerHeight > 0 && (index.h("tr", { class: "mrd-table__spacer", style: { height: `${topSpacerHeight}px` } }, index.h("td", { colSpan: colCount }))), renderedRows, bottomSpacerHeight > 0 && (index.h("tr", { class: "mrd-table__spacer", style: { height: `${bottomSpacerHeight}px` } }, index.h("td", { colSpan: colCount })))), this.renderTotalsRow())), effectiveTotal === 0 && this.loadedPages.has(0) && (index.h("p", { class: "mrd-table__empty" }, t('no_results', this.locale))), effectiveTotal > 0 && this.renderFooter(undefined, effectiveTotal, this.isTotalKnown()), this.renderFilterPopup(), this.renderTextblockModal(), this.renderJsonModal()));
4488
+ }))), index.h("tbody", null, topSpacerHeight > 0 && (index.h("tr", { class: "mrd-table__spacer", style: { height: `${topSpacerHeight}px` } }, index.h("td", { colSpan: colCount }))), renderedRows, bottomSpacerHeight > 0 && (index.h("tr", { class: "mrd-table__spacer", style: { height: `${bottomSpacerHeight}px` } }, index.h("td", { colSpan: colCount })))), this.renderTotalsRow())), effectiveTotal === 0 && this.loadedPages.has(0) && (index.h("p", { class: "mrd-table__empty" }, cellRenderer.t('no_results', this.locale))), effectiveTotal > 0 && this.renderFooter(undefined, effectiveTotal, this.isTotalKnown()), this.renderFilterPopup(), this.renderTextblockModal(), this.renderJsonModal()));
5229
4489
  }
5230
4490
  renderTextblockModal() {
5231
4491
  return index.h(TextblockModal, { text: this.textblockModal, locale: this.locale, onClose: () => this.closeTextblockModal() });
@@ -5276,6 +4536,2417 @@ const MrdTextField = class {
5276
4536
  };
5277
4537
  MrdTextField.style = mrdTextFieldCss();
5278
4538
 
4539
+ /*! @license DOMPurify 3.4.12 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.4.12/LICENSE */
4540
+
4541
+ function _arrayLikeToArray(r, a) {
4542
+ (null == a || a > r.length) && (a = r.length);
4543
+ for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e];
4544
+ return n;
4545
+ }
4546
+ function _arrayWithHoles(r) {
4547
+ if (Array.isArray(r)) return r;
4548
+ }
4549
+ function _iterableToArrayLimit(r, l) {
4550
+ var t = null == r ? null : "undefined" != typeof Symbol && r[Symbol.iterator] || r["@@iterator"];
4551
+ if (null != t) {
4552
+ var e,
4553
+ n,
4554
+ i,
4555
+ u,
4556
+ a = [],
4557
+ f = true,
4558
+ o = false;
4559
+ try {
4560
+ if (i = (t = t.call(r)).next, 0 === l) ; else for (; !(f = (e = i.call(t)).done) && (a.push(e.value), a.length !== l); f = true);
4561
+ } catch (r) {
4562
+ o = true, n = r;
4563
+ } finally {
4564
+ try {
4565
+ if (!f && null != t.return && (u = t.return(), Object(u) !== u)) return;
4566
+ } finally {
4567
+ if (o) throw n;
4568
+ }
4569
+ }
4570
+ return a;
4571
+ }
4572
+ }
4573
+ function _nonIterableRest() {
4574
+ throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
4575
+ }
4576
+ function _slicedToArray(r, e) {
4577
+ return _arrayWithHoles(r) || _iterableToArrayLimit(r, e) || _unsupportedIterableToArray(r, e) || _nonIterableRest();
4578
+ }
4579
+ function _unsupportedIterableToArray(r, a) {
4580
+ if (r) {
4581
+ if ("string" == typeof r) return _arrayLikeToArray(r, a);
4582
+ var t = {}.toString.call(r).slice(8, -1);
4583
+ return "Object" === t && r.constructor && (t = r.constructor.name), "Map" === t || "Set" === t ? Array.from(r) : "Arguments" === t || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t) ? _arrayLikeToArray(r, a) : void 0;
4584
+ }
4585
+ }
4586
+
4587
+ const entries = Object.entries,
4588
+ setPrototypeOf = Object.setPrototypeOf,
4589
+ isFrozen = Object.isFrozen,
4590
+ getPrototypeOf = Object.getPrototypeOf,
4591
+ getOwnPropertyDescriptor = Object.getOwnPropertyDescriptor;
4592
+ let freeze = Object.freeze,
4593
+ seal = Object.seal,
4594
+ create = Object.create; // eslint-disable-line import/no-mutable-exports
4595
+ let _ref = typeof Reflect !== 'undefined' && Reflect,
4596
+ apply = _ref.apply,
4597
+ construct = _ref.construct;
4598
+ if (!freeze) {
4599
+ freeze = function freeze(x) {
4600
+ return x;
4601
+ };
4602
+ }
4603
+ if (!seal) {
4604
+ seal = function seal(x) {
4605
+ return x;
4606
+ };
4607
+ }
4608
+ if (!apply) {
4609
+ apply = function apply(func, thisArg) {
4610
+ for (var _len = arguments.length, args = new Array(_len > 2 ? _len - 2 : 0), _key = 2; _key < _len; _key++) {
4611
+ args[_key - 2] = arguments[_key];
4612
+ }
4613
+ return func.apply(thisArg, args);
4614
+ };
4615
+ }
4616
+ if (!construct) {
4617
+ construct = function construct(Func) {
4618
+ for (var _len2 = arguments.length, args = new Array(_len2 > 1 ? _len2 - 1 : 0), _key2 = 1; _key2 < _len2; _key2++) {
4619
+ args[_key2 - 1] = arguments[_key2];
4620
+ }
4621
+ return new Func(...args);
4622
+ };
4623
+ }
4624
+ const arrayForEach = unapply(Array.prototype.forEach);
4625
+ const arrayLastIndexOf = unapply(Array.prototype.lastIndexOf);
4626
+ const arrayPop = unapply(Array.prototype.pop);
4627
+ const arrayPush = unapply(Array.prototype.push);
4628
+ const arraySplice = unapply(Array.prototype.splice);
4629
+ const arrayIsArray = Array.isArray;
4630
+ const stringToLowerCase = unapply(String.prototype.toLowerCase);
4631
+ const stringToString = unapply(String.prototype.toString);
4632
+ const stringMatch = unapply(String.prototype.match);
4633
+ const stringReplace = unapply(String.prototype.replace);
4634
+ const stringIndexOf = unapply(String.prototype.indexOf);
4635
+ const stringTrim = unapply(String.prototype.trim);
4636
+ const numberToString = unapply(Number.prototype.toString);
4637
+ const booleanToString = unapply(Boolean.prototype.toString);
4638
+ const bigintToString = typeof BigInt === 'undefined' ? null : unapply(BigInt.prototype.toString);
4639
+ const symbolToString = typeof Symbol === 'undefined' ? null : unapply(Symbol.prototype.toString);
4640
+ const objectHasOwnProperty = unapply(Object.prototype.hasOwnProperty);
4641
+ const objectToString = unapply(Object.prototype.toString);
4642
+ const regExpTest = unapply(RegExp.prototype.test);
4643
+ const typeErrorCreate = unconstruct(TypeError);
4644
+ /**
4645
+ * Creates a new function that calls the given function with a specified thisArg and arguments.
4646
+ *
4647
+ * @param func - The function to be wrapped and called.
4648
+ * @returns A new function that calls the given function with a specified thisArg and arguments.
4649
+ */
4650
+ function unapply(func) {
4651
+ return function (thisArg) {
4652
+ if (thisArg instanceof RegExp) {
4653
+ thisArg.lastIndex = 0;
4654
+ }
4655
+ for (var _len3 = arguments.length, args = new Array(_len3 > 1 ? _len3 - 1 : 0), _key3 = 1; _key3 < _len3; _key3++) {
4656
+ args[_key3 - 1] = arguments[_key3];
4657
+ }
4658
+ return apply(func, thisArg, args);
4659
+ };
4660
+ }
4661
+ /**
4662
+ * Creates a new function that constructs an instance of the given constructor function with the provided arguments.
4663
+ *
4664
+ * @param func - The constructor function to be wrapped and called.
4665
+ * @returns A new function that constructs an instance of the given constructor function with the provided arguments.
4666
+ */
4667
+ function unconstruct(Func) {
4668
+ return function () {
4669
+ for (var _len4 = arguments.length, args = new Array(_len4), _key4 = 0; _key4 < _len4; _key4++) {
4670
+ args[_key4] = arguments[_key4];
4671
+ }
4672
+ return construct(Func, args);
4673
+ };
4674
+ }
4675
+ /**
4676
+ * Add properties to a lookup table
4677
+ *
4678
+ * @param set - The set to which elements will be added.
4679
+ * @param array - The array containing elements to be added to the set.
4680
+ * @param transformCaseFunc - An optional function to transform the case of each element before adding to the set.
4681
+ * @returns The modified set with added elements.
4682
+ */
4683
+ function addToSet(set, array) {
4684
+ let transformCaseFunc = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : stringToLowerCase;
4685
+ if (setPrototypeOf) {
4686
+ // Make 'in' and truthy checks like Boolean(set.constructor)
4687
+ // independent of any properties defined on Object.prototype.
4688
+ // Prevent prototype setters from intercepting set as a this value.
4689
+ setPrototypeOf(set, null);
4690
+ }
4691
+ if (!arrayIsArray(array)) {
4692
+ return set;
4693
+ }
4694
+ let l = array.length;
4695
+ while (l--) {
4696
+ let element = array[l];
4697
+ if (typeof element === 'string') {
4698
+ const lcElement = transformCaseFunc(element);
4699
+ if (lcElement !== element) {
4700
+ // Config presets (e.g. tags.js, attrs.js) are immutable.
4701
+ if (!isFrozen(array)) {
4702
+ array[l] = lcElement;
4703
+ }
4704
+ element = lcElement;
4705
+ }
4706
+ }
4707
+ set[element] = true;
4708
+ }
4709
+ return set;
4710
+ }
4711
+ /**
4712
+ * Clean up an array to harden against CSPP
4713
+ *
4714
+ * @param array - The array to be cleaned.
4715
+ * @returns The cleaned version of the array
4716
+ */
4717
+ function cleanArray(array) {
4718
+ for (let index = 0; index < array.length; index++) {
4719
+ const isPropertyExist = objectHasOwnProperty(array, index);
4720
+ if (!isPropertyExist) {
4721
+ array[index] = null;
4722
+ }
4723
+ }
4724
+ return array;
4725
+ }
4726
+ /**
4727
+ * Shallow clone an object
4728
+ *
4729
+ * @param object - The object to be cloned.
4730
+ * @returns A new object that copies the original.
4731
+ */
4732
+ function clone(object) {
4733
+ const newObject = create(null);
4734
+ for (const _ref2 of entries(object)) {
4735
+ var _ref3 = _slicedToArray(_ref2, 2);
4736
+ const property = _ref3[0];
4737
+ const value = _ref3[1];
4738
+ const isPropertyExist = objectHasOwnProperty(object, property);
4739
+ if (isPropertyExist) {
4740
+ if (arrayIsArray(value)) {
4741
+ newObject[property] = cleanArray(value);
4742
+ } else if (value && typeof value === 'object' && value.constructor === Object) {
4743
+ newObject[property] = clone(value);
4744
+ } else {
4745
+ newObject[property] = value;
4746
+ }
4747
+ }
4748
+ }
4749
+ return newObject;
4750
+ }
4751
+ /**
4752
+ * Convert non-node values into strings without depending on direct property access.
4753
+ *
4754
+ * @param value - The value to stringify.
4755
+ * @returns A string representation of the provided value.
4756
+ */
4757
+ function stringifyValue(value) {
4758
+ switch (typeof value) {
4759
+ case 'string':
4760
+ {
4761
+ return value;
4762
+ }
4763
+ case 'number':
4764
+ {
4765
+ return numberToString(value);
4766
+ }
4767
+ case 'boolean':
4768
+ {
4769
+ return booleanToString(value);
4770
+ }
4771
+ case 'bigint':
4772
+ {
4773
+ return bigintToString ? bigintToString(value) : '0';
4774
+ }
4775
+ case 'symbol':
4776
+ {
4777
+ return symbolToString ? symbolToString(value) : 'Symbol()';
4778
+ }
4779
+ case 'undefined':
4780
+ {
4781
+ return objectToString(value);
4782
+ }
4783
+ case 'function':
4784
+ case 'object':
4785
+ {
4786
+ if (value === null) {
4787
+ return objectToString(value);
4788
+ }
4789
+ const valueAsRecord = value;
4790
+ const valueToString = lookupGetter(valueAsRecord, 'toString');
4791
+ if (typeof valueToString === 'function') {
4792
+ const stringified = valueToString(valueAsRecord);
4793
+ return typeof stringified === 'string' ? stringified : objectToString(stringified);
4794
+ }
4795
+ return objectToString(value);
4796
+ }
4797
+ default:
4798
+ {
4799
+ return objectToString(value);
4800
+ }
4801
+ }
4802
+ }
4803
+ /**
4804
+ * This method automatically checks if the prop is function or getter and behaves accordingly.
4805
+ *
4806
+ * @param object - The object to look up the getter function in its prototype chain.
4807
+ * @param prop - The property name for which to find the getter function.
4808
+ * @returns The getter function found in the prototype chain or a fallback function.
4809
+ */
4810
+ function lookupGetter(object, prop) {
4811
+ while (object !== null) {
4812
+ const desc = getOwnPropertyDescriptor(object, prop);
4813
+ if (desc) {
4814
+ if (desc.get) {
4815
+ return unapply(desc.get);
4816
+ }
4817
+ if (typeof desc.value === 'function') {
4818
+ return unapply(desc.value);
4819
+ }
4820
+ }
4821
+ object = getPrototypeOf(object);
4822
+ }
4823
+ function fallbackValue() {
4824
+ return null;
4825
+ }
4826
+ return fallbackValue;
4827
+ }
4828
+ function isRegex(value) {
4829
+ try {
4830
+ regExpTest(value, '');
4831
+ return true;
4832
+ } catch (_unused) {
4833
+ return false;
4834
+ }
4835
+ }
4836
+
4837
+ const html$1 = freeze(['a', 'abbr', 'acronym', 'address', 'area', 'article', 'aside', 'audio', 'b', 'bdi', 'bdo', 'big', 'blink', 'blockquote', 'body', 'br', 'button', 'canvas', 'caption', 'center', 'cite', 'code', 'col', 'colgroup', 'content', 'data', 'datalist', 'dd', 'decorator', 'del', 'details', 'dfn', 'dialog', 'dir', 'div', 'dl', 'dt', 'element', 'em', 'fieldset', 'figcaption', 'figure', 'font', 'footer', 'form', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'head', 'header', 'hgroup', 'hr', 'html', 'i', 'img', 'input', 'ins', 'kbd', 'label', 'legend', 'li', 'main', 'map', 'mark', 'marquee', 'menu', 'menuitem', 'meter', 'nav', 'nobr', 'ol', 'optgroup', 'option', 'output', 'p', 'picture', 'pre', 'progress', 'q', 'rp', 'rt', 'ruby', 's', 'samp', 'search', 'section', 'select', 'shadow', 'slot', 'small', 'source', 'spacer', 'span', 'strike', 'strong', 'style', 'sub', 'summary', 'sup', 'table', 'tbody', 'td', 'template', 'textarea', 'tfoot', 'th', 'thead', 'time', 'tr', 'track', 'tt', 'u', 'ul', 'var', 'video', 'wbr']);
4838
+ const svg$1 = freeze(['svg', 'a', 'altglyph', 'altglyphdef', 'altglyphitem', 'animatecolor', 'animatemotion', 'animatetransform', 'circle', 'clippath', 'defs', 'desc', 'ellipse', 'enterkeyhint', 'exportparts', 'filter', 'font', 'g', 'glyph', 'glyphref', 'hkern', 'image', 'inputmode', 'line', 'lineargradient', 'marker', 'mask', 'metadata', 'mpath', 'part', 'path', 'pattern', 'polygon', 'polyline', 'radialgradient', 'rect', 'stop', 'style', 'switch', 'symbol', 'text', 'textpath', 'title', 'tref', 'tspan', 'view', 'vkern']);
4839
+ const svgFilters = freeze(['feBlend', 'feColorMatrix', 'feComponentTransfer', 'feComposite', 'feConvolveMatrix', 'feDiffuseLighting', 'feDisplacementMap', 'feDistantLight', 'feDropShadow', 'feFlood', 'feFuncA', 'feFuncB', 'feFuncG', 'feFuncR', 'feGaussianBlur', 'feImage', 'feMerge', 'feMergeNode', 'feMorphology', 'feOffset', 'fePointLight', 'feSpecularLighting', 'feSpotLight', 'feTile', 'feTurbulence']);
4840
+ // List of SVG elements that are disallowed by default.
4841
+ // We still need to know them so that we can do namespace
4842
+ // checks properly in case one wants to add them to
4843
+ // allow-list.
4844
+ const svgDisallowed = freeze(['animate', 'color-profile', 'cursor', 'discard', 'font-face', 'font-face-format', 'font-face-name', 'font-face-src', 'font-face-uri', 'foreignobject', 'hatch', 'hatchpath', 'mesh', 'meshgradient', 'meshpatch', 'meshrow', 'missing-glyph', 'script', 'set', 'solidcolor', 'unknown', 'use']);
4845
+ const mathMl$1 = freeze(['math', 'menclose', 'merror', 'mfenced', 'mfrac', 'mglyph', 'mi', 'mlabeledtr', 'mmultiscripts', 'mn', 'mo', 'mover', 'mpadded', 'mphantom', 'mroot', 'mrow', 'ms', 'mspace', 'msqrt', 'mstyle', 'msub', 'msup', 'msubsup', 'mtable', 'mtd', 'mtext', 'mtr', 'munder', 'munderover', 'mprescripts']);
4846
+ // Similarly to SVG, we want to know all MathML elements,
4847
+ // even those that we disallow by default.
4848
+ const mathMlDisallowed = freeze(['maction', 'maligngroup', 'malignmark', 'mlongdiv', 'mscarries', 'mscarry', 'msgroup', 'mstack', 'msline', 'msrow', 'semantics', 'annotation', 'annotation-xml', 'mprescripts', 'none']);
4849
+ const text = freeze(['#text']);
4850
+
4851
+ const html = freeze(['accept', 'action', 'align', 'alt', 'autocapitalize', 'autocomplete', 'autopictureinpicture', 'autoplay', 'background', 'bgcolor', 'border', 'capture', 'cellpadding', 'cellspacing', 'checked', 'cite', 'class', 'clear', 'color', 'cols', 'colspan', 'command', 'commandfor', 'controls', 'controlslist', 'coords', 'crossorigin', 'datetime', 'decoding', 'default', 'dir', 'disabled', 'disablepictureinpicture', 'disableremoteplayback', 'download', 'draggable', 'enctype', 'enterkeyhint', 'exportparts', 'face', 'for', 'headers', 'height', 'hidden', 'high', 'href', 'hreflang', 'id', 'inert', 'inputmode', 'integrity', 'ismap', 'kind', 'label', 'lang', 'list', 'loading', 'loop', 'low', 'max', 'maxlength', 'media', 'method', 'min', 'minlength', 'multiple', 'muted', 'name', 'nonce', 'noshade', 'novalidate', 'nowrap', 'open', 'optimum', 'part', 'pattern', 'placeholder', 'playsinline', 'popover', 'popovertarget', 'popovertargetaction', 'poster', 'preload', 'pubdate', 'radiogroup', 'readonly', 'rel', 'required', 'rev', 'reversed', 'role', 'rows', 'rowspan', 'spellcheck', 'scope', 'selected', 'shape', 'size', 'sizes', 'slot', 'span', 'srclang', 'start', 'src', 'srcset', 'step', 'style', 'summary', 'tabindex', 'title', 'translate', 'type', 'usemap', 'valign', 'value', 'width', 'wrap', 'xmlns']);
4852
+ const svg = freeze(['accent-height', 'accumulate', 'additive', 'alignment-baseline', 'amplitude', 'ascent', 'attributename', 'attributetype', 'azimuth', 'basefrequency', 'baseline-shift', 'begin', 'bias', 'by', 'class', 'clip', 'clippathunits', 'clip-path', 'clip-rule', 'color', 'color-interpolation', 'color-interpolation-filters', 'color-profile', 'color-rendering', 'cx', 'cy', 'd', 'dx', 'dy', 'diffuseconstant', 'direction', 'display', 'divisor', 'dominant-baseline', 'dur', 'edgemode', 'elevation', 'end', 'exponent', 'fill', 'fill-opacity', 'fill-rule', 'filter', 'filterunits', 'flood-color', 'flood-opacity', 'font-family', 'font-size', 'font-size-adjust', 'font-stretch', 'font-style', 'font-variant', 'font-weight', 'fx', 'fy', 'g1', 'g2', 'glyph-name', 'glyphref', 'gradientunits', 'gradienttransform', 'height', 'href', 'id', 'image-rendering', 'in', 'in2', 'intercept', 'k', 'k1', 'k2', 'k3', 'k4', 'kerning', 'keypoints', 'keysplines', 'keytimes', 'lang', 'lengthadjust', 'letter-spacing', 'kernelmatrix', 'kernelunitlength', 'lighting-color', 'local', 'marker-end', 'marker-mid', 'marker-start', 'markerheight', 'markerunits', 'markerwidth', 'maskcontentunits', 'maskunits', 'max', 'mask', 'mask-type', 'media', 'method', 'mode', 'min', 'name', 'numoctaves', 'offset', 'operator', 'opacity', 'order', 'orient', 'orientation', 'origin', 'overflow', 'paint-order', 'path', 'pathlength', 'patterncontentunits', 'patterntransform', 'patternunits', 'points', 'preservealpha', 'preserveaspectratio', 'primitiveunits', 'r', 'rx', 'ry', 'radius', 'refx', 'refy', 'repeatcount', 'repeatdur', 'restart', 'result', 'rotate', 'scale', 'seed', 'shape-rendering', 'slope', 'specularconstant', 'specularexponent', 'spreadmethod', 'startoffset', 'stddeviation', 'stitchtiles', 'stop-color', 'stop-opacity', 'stroke-dasharray', 'stroke-dashoffset', 'stroke-linecap', 'stroke-linejoin', 'stroke-miterlimit', 'stroke-opacity', 'stroke', 'stroke-width', 'style', 'surfacescale', 'systemlanguage', 'tabindex', 'tablevalues', 'targetx', 'targety', 'transform', 'transform-origin', 'text-anchor', 'text-decoration', 'text-orientation', 'text-rendering', 'textlength', 'type', 'u1', 'u2', 'unicode', 'values', 'viewbox', 'visibility', 'version', 'vert-adv-y', 'vert-origin-x', 'vert-origin-y', 'width', 'word-spacing', 'wrap', 'writing-mode', 'xchannelselector', 'ychannelselector', 'x', 'x1', 'x2', 'xmlns', 'y', 'y1', 'y2', 'z', 'zoomandpan']);
4853
+ const mathMl = freeze(['accent', 'accentunder', 'align', 'bevelled', 'close', 'columnalign', 'columnlines', 'columnspacing', 'columnspan', 'denomalign', 'depth', 'dir', 'display', 'displaystyle', 'encoding', 'fence', 'frame', 'height', 'href', 'id', 'largeop', 'length', 'linethickness', 'lquote', 'lspace', 'mathbackground', 'mathcolor', 'mathsize', 'mathvariant', 'maxsize', 'minsize', 'movablelimits', 'notation', 'numalign', 'open', 'rowalign', 'rowlines', 'rowspacing', 'rowspan', 'rspace', 'rquote', 'scriptlevel', 'scriptminsize', 'scriptsizemultiplier', 'selection', 'separator', 'separators', 'stretchy', 'subscriptshift', 'supscriptshift', 'symmetric', 'voffset', 'width', 'xmlns']);
4854
+ const xml = freeze(['xlink:href', 'xml:id', 'xlink:title', 'xml:space', 'xmlns:xlink']);
4855
+
4856
+ const MUSTACHE_EXPR = seal(/{{[\w\W]*|^[\w\W]*}}/g);
4857
+ const ERB_EXPR = seal(/<%[\w\W]*|^[\w\W]*%>/g);
4858
+ const TMPLIT_EXPR = seal(/\${[\w\W]*/g);
4859
+ const DATA_ATTR = seal(/^data-[\-\w.\u00B7-\uFFFF]+$/); // eslint-disable-line no-useless-escape
4860
+ const ARIA_ATTR = seal(/^aria-[\-\w]+$/); // eslint-disable-line no-useless-escape
4861
+ const IS_ALLOWED_URI = seal(/^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp|matrix):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i // eslint-disable-line no-useless-escape
4862
+ );
4863
+ const IS_SCRIPT_OR_DATA = seal(/^(?:\w+script|data):/i);
4864
+ const ATTR_WHITESPACE = seal(/[\u0000-\u0020\u00A0\u1680\u180E\u2000-\u2029\u205F\u3000]/g // eslint-disable-line no-control-regex
4865
+ );
4866
+ const DOCTYPE_NAME = seal(/^html$/i);
4867
+ const CUSTOM_ELEMENT = seal(/^[a-z][.\w]*(-[.\w]+)+$/i);
4868
+ // Markup-significant character probes used by _sanitizeElements.
4869
+ // Shared module-level instances are safe despite the sticky /g flags:
4870
+ // unapply() resets lastIndex for RegExp receivers before every call.
4871
+ const ELEMENT_MARKUP_PROBE = seal(/<[/\w!]/g);
4872
+ const COMMENT_MARKUP_PROBE = seal(/<[/\w]/g);
4873
+ const FALLBACK_TAG_CLOSE = seal(/<\/no(script|embed|frames)/i);
4874
+ const SELF_CLOSING_TAG = seal(/\/>/i);
4875
+
4876
+ // https://developer.mozilla.org/en-US/docs/Web/API/Node/nodeType
4877
+ const NODE_TYPE = {
4878
+ element: 1,
4879
+ text: 3,
4880
+ // Deprecated
4881
+ processingInstruction: 7,
4882
+ comment: 8,
4883
+ document: 9,
4884
+ documentFragment: 11};
4885
+ const getGlobal = function getGlobal() {
4886
+ return typeof window === 'undefined' ? null : window;
4887
+ };
4888
+ /**
4889
+ * Creates a no-op policy for internal use only.
4890
+ * Don't export this function outside this module!
4891
+ * @param trustedTypes The policy factory.
4892
+ * @param purifyHostElement The Script element used to load DOMPurify (to determine policy name suffix).
4893
+ * @return The policy created (or null, if Trusted Types
4894
+ * are not supported or creating the policy failed).
4895
+ */
4896
+ const _createTrustedTypesPolicy = function _createTrustedTypesPolicy(trustedTypes, purifyHostElement) {
4897
+ if (typeof trustedTypes !== 'object' || typeof trustedTypes.createPolicy !== 'function') {
4898
+ return null;
4899
+ }
4900
+ // Allow the callers to control the unique policy name
4901
+ // by adding a data-tt-policy-suffix to the script element with the DOMPurify.
4902
+ // Policy creation with duplicate names throws in Trusted Types.
4903
+ let suffix = null;
4904
+ const ATTR_NAME = 'data-tt-policy-suffix';
4905
+ if (purifyHostElement && purifyHostElement.hasAttribute(ATTR_NAME)) {
4906
+ suffix = purifyHostElement.getAttribute(ATTR_NAME);
4907
+ }
4908
+ const policyName = 'dompurify' + (suffix ? '#' + suffix : '');
4909
+ try {
4910
+ return trustedTypes.createPolicy(policyName, {
4911
+ createHTML(html) {
4912
+ return html;
4913
+ },
4914
+ createScriptURL(scriptUrl) {
4915
+ return scriptUrl;
4916
+ }
4917
+ });
4918
+ } catch (_) {
4919
+ // Policy creation failed (most likely another DOMPurify script has
4920
+ // already run). Skip creating the policy, as this will only cause errors
4921
+ // if TT are enforced.
4922
+ console.warn('TrustedTypes policy ' + policyName + ' could not be created.');
4923
+ return null;
4924
+ }
4925
+ };
4926
+ const _createHooksMap = function _createHooksMap() {
4927
+ return {
4928
+ afterSanitizeAttributes: [],
4929
+ afterSanitizeElements: [],
4930
+ afterSanitizeShadowDOM: [],
4931
+ beforeSanitizeAttributes: [],
4932
+ beforeSanitizeElements: [],
4933
+ beforeSanitizeShadowDOM: [],
4934
+ uponSanitizeAttribute: [],
4935
+ uponSanitizeElement: [],
4936
+ uponSanitizeShadowNode: []
4937
+ };
4938
+ };
4939
+ /**
4940
+ * Resolve a set-valued configuration option: a fresh set built from
4941
+ * cfg[key] when it is an own array property (seeded with a clone of
4942
+ * options.base when given, case-normalized via options.transform),
4943
+ * the fallback set otherwise.
4944
+ *
4945
+ * @param cfg the cloned, prototype-free configuration object
4946
+ * @param key the configuration property to read
4947
+ * @param fallback the set to use when the option is absent or not an array
4948
+ * @param options transform and optional base set to merge into
4949
+ * @returns the resolved set
4950
+ */
4951
+ const _resolveSetOption = function _resolveSetOption(cfg, key, fallback, options) {
4952
+ return objectHasOwnProperty(cfg, key) && arrayIsArray(cfg[key]) ? addToSet(options.base ? clone(options.base) : {}, cfg[key], options.transform) : fallback;
4953
+ };
4954
+ function createDOMPurify() {
4955
+ let window = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : getGlobal();
4956
+ const DOMPurify = root => createDOMPurify(root);
4957
+ DOMPurify.version = '3.4.12';
4958
+ DOMPurify.removed = [];
4959
+ if (!window || !window.document || window.document.nodeType !== NODE_TYPE.document || !window.Element) {
4960
+ // Not running in a browser, provide a factory function
4961
+ // so that you can pass your own Window
4962
+ DOMPurify.isSupported = false;
4963
+ return DOMPurify;
4964
+ }
4965
+ let document = window.document;
4966
+ const originalDocument = document;
4967
+ const currentScript = originalDocument.currentScript;
4968
+ const HTMLTemplateElement = window.HTMLTemplateElement,
4969
+ Node = window.Node,
4970
+ Element = window.Element,
4971
+ NodeFilter = window.NodeFilter;
4972
+ const DOMParser = window.DOMParser,
4973
+ trustedTypes = window.trustedTypes;
4974
+ const ElementPrototype = Element.prototype;
4975
+ const cloneNode = lookupGetter(ElementPrototype, 'cloneNode');
4976
+ const remove = lookupGetter(ElementPrototype, 'remove');
4977
+ const getNextSibling = lookupGetter(ElementPrototype, 'nextSibling');
4978
+ const getChildNodes = lookupGetter(ElementPrototype, 'childNodes');
4979
+ const getParentNode = lookupGetter(ElementPrototype, 'parentNode');
4980
+ const getShadowRoot = lookupGetter(ElementPrototype, 'shadowRoot');
4981
+ const getAttributes = lookupGetter(ElementPrototype, 'attributes');
4982
+ const getNodeType = Node && Node.prototype ? lookupGetter(Node.prototype, 'nodeType') : null;
4983
+ const getNodeName = Node && Node.prototype ? lookupGetter(Node.prototype, 'nodeName') : null;
4984
+ // As per issue #47, the web-components registry is inherited by a
4985
+ // new document created via createHTMLDocument. As per the spec
4986
+ // (http://w3c.github.io/webcomponents/spec/custom/#creating-and-passing-registries)
4987
+ // a new empty registry is used when creating a template contents owner
4988
+ // document, so we use that as our parent document to ensure nothing
4989
+ // is inherited.
4990
+ if (typeof HTMLTemplateElement === 'function') {
4991
+ const template = document.createElement('template');
4992
+ if (template.content && template.content.ownerDocument) {
4993
+ document = template.content.ownerDocument;
4994
+ }
4995
+ }
4996
+ let trustedTypesPolicy;
4997
+ let emptyHTML = '';
4998
+ // The instance's own internal Trusted Types policy. Unlike a caller-supplied
4999
+ // `TRUSTED_TYPES_POLICY`, this is created at most once — Trusted Types throws
5000
+ // on duplicate policy names — and is the only policy allowed to persist
5001
+ // across configurations and survive `clearConfig()`.
5002
+ let defaultTrustedTypesPolicy;
5003
+ let defaultTrustedTypesPolicyResolved = false;
5004
+ // Tracks whether we are already inside a call to the configured Trusted Types
5005
+ // policy (`createHTML` or `createScriptURL`). If a supplied policy callback
5006
+ // itself calls `DOMPurify.sanitize` (the cause of #1422), `sanitize` would
5007
+ // re-enter the policy and recurse until the stack overflows. We detect that
5008
+ // re-entry and throw a clear, actionable error instead. The guard is shared
5009
+ // across both callbacks, because either one re-entering `sanitize` triggers
5010
+ // the same unbounded recursion.
5011
+ let IN_TRUSTED_TYPES_POLICY = 0;
5012
+ const _assertNotInTrustedTypesPolicy = function _assertNotInTrustedTypesPolicy() {
5013
+ if (IN_TRUSTED_TYPES_POLICY > 0) {
5014
+ throw typeErrorCreate('A configured TRUSTED_TYPES_POLICY callback (createHTML or ' + 'createScriptURL) must not call DOMPurify.sanitize, as that causes ' + 'infinite recursion. Do not pass a policy whose callbacks wrap ' + 'DOMPurify as TRUSTED_TYPES_POLICY; see the "DOMPurify and Trusted ' + 'Types" section of the README.');
5015
+ }
5016
+ };
5017
+ const _createTrustedHTML = function _createTrustedHTML(html) {
5018
+ _assertNotInTrustedTypesPolicy();
5019
+ IN_TRUSTED_TYPES_POLICY++;
5020
+ try {
5021
+ return trustedTypesPolicy.createHTML(html);
5022
+ } finally {
5023
+ IN_TRUSTED_TYPES_POLICY--;
5024
+ }
5025
+ };
5026
+ const _createTrustedScriptURL = function _createTrustedScriptURL(scriptUrl) {
5027
+ _assertNotInTrustedTypesPolicy();
5028
+ IN_TRUSTED_TYPES_POLICY++;
5029
+ try {
5030
+ return trustedTypesPolicy.createScriptURL(scriptUrl);
5031
+ } finally {
5032
+ IN_TRUSTED_TYPES_POLICY--;
5033
+ }
5034
+ };
5035
+ // Lazily resolve (and cache) the instance's internal default policy.
5036
+ // Resolution is attempted at most once: a successful `createPolicy` cannot be
5037
+ // repeated (Trusted Types throws on duplicate names), and a failed or
5038
+ // unsupported attempt must not be retried on every parse.
5039
+ const _getDefaultTrustedTypesPolicy = function _getDefaultTrustedTypesPolicy() {
5040
+ if (!defaultTrustedTypesPolicyResolved) {
5041
+ defaultTrustedTypesPolicy = _createTrustedTypesPolicy(trustedTypes, currentScript);
5042
+ defaultTrustedTypesPolicyResolved = true;
5043
+ }
5044
+ return defaultTrustedTypesPolicy;
5045
+ };
5046
+ const _document = document,
5047
+ implementation = _document.implementation,
5048
+ createNodeIterator = _document.createNodeIterator,
5049
+ createDocumentFragment = _document.createDocumentFragment,
5050
+ getElementsByTagName = _document.getElementsByTagName;
5051
+ const importNode = originalDocument.importNode;
5052
+ let hooks = _createHooksMap();
5053
+ /**
5054
+ * Expose whether this browser supports running the full DOMPurify.
5055
+ */
5056
+ DOMPurify.isSupported = typeof entries === 'function' && typeof getParentNode === 'function' && implementation && implementation.createHTMLDocument !== undefined;
5057
+ const MUSTACHE_EXPR$1 = MUSTACHE_EXPR,
5058
+ ERB_EXPR$1 = ERB_EXPR,
5059
+ TMPLIT_EXPR$1 = TMPLIT_EXPR,
5060
+ DATA_ATTR$1 = DATA_ATTR,
5061
+ ARIA_ATTR$1 = ARIA_ATTR,
5062
+ IS_SCRIPT_OR_DATA$1 = IS_SCRIPT_OR_DATA,
5063
+ ATTR_WHITESPACE$1 = ATTR_WHITESPACE,
5064
+ CUSTOM_ELEMENT$1 = CUSTOM_ELEMENT;
5065
+ let IS_ALLOWED_URI$1 = IS_ALLOWED_URI;
5066
+ /**
5067
+ * We consider the elements and attributes below to be safe. Ideally
5068
+ * don't add any new ones but feel free to remove unwanted ones.
5069
+ */
5070
+ /* allowed element names */
5071
+ let ALLOWED_TAGS = null;
5072
+ const DEFAULT_ALLOWED_TAGS = addToSet({}, [...html$1, ...svg$1, ...svgFilters, ...mathMl$1, ...text]);
5073
+ /* Allowed attribute names */
5074
+ let ALLOWED_ATTR = null;
5075
+ const DEFAULT_ALLOWED_ATTR = addToSet({}, [...html, ...svg, ...mathMl, ...xml]);
5076
+ /*
5077
+ * Configure how DOMPurify should handle custom elements and their attributes as well as customized built-in elements.
5078
+ * @property {RegExp|Function|null} tagNameCheck one of [null, regexPattern, predicate]. Default: `null` (disallow any custom elements)
5079
+ * @property {RegExp|Function|null} attributeNameCheck one of [null, regexPattern, predicate]. Default: `null` (disallow any attributes not on the allow list)
5080
+ * @property {boolean} allowCustomizedBuiltInElements allow custom elements derived from built-ins if they pass CUSTOM_ELEMENT_HANDLING.tagNameCheck. Default: `false`.
5081
+ */
5082
+ let CUSTOM_ELEMENT_HANDLING = Object.seal(create(null, {
5083
+ tagNameCheck: {
5084
+ writable: true,
5085
+ configurable: false,
5086
+ enumerable: true,
5087
+ value: null
5088
+ },
5089
+ attributeNameCheck: {
5090
+ writable: true,
5091
+ configurable: false,
5092
+ enumerable: true,
5093
+ value: null
5094
+ },
5095
+ allowCustomizedBuiltInElements: {
5096
+ writable: true,
5097
+ configurable: false,
5098
+ enumerable: true,
5099
+ value: false
5100
+ }
5101
+ }));
5102
+ /* Explicitly forbidden tags (overrides ALLOWED_TAGS/ADD_TAGS) */
5103
+ let FORBID_TAGS = null;
5104
+ /* Explicitly forbidden attributes (overrides ALLOWED_ATTR/ADD_ATTR) */
5105
+ let FORBID_ATTR = null;
5106
+ /* Config object to store ADD_TAGS/ADD_ATTR functions (when used as functions) */
5107
+ const EXTRA_ELEMENT_HANDLING = Object.seal(create(null, {
5108
+ tagCheck: {
5109
+ writable: true,
5110
+ configurable: false,
5111
+ enumerable: true,
5112
+ value: null
5113
+ },
5114
+ attributeCheck: {
5115
+ writable: true,
5116
+ configurable: false,
5117
+ enumerable: true,
5118
+ value: null
5119
+ }
5120
+ }));
5121
+ /* Decide if ARIA attributes are okay */
5122
+ let ALLOW_ARIA_ATTR = true;
5123
+ /* Decide if custom data attributes are okay */
5124
+ let ALLOW_DATA_ATTR = true;
5125
+ /* Decide if unknown protocols are okay */
5126
+ let ALLOW_UNKNOWN_PROTOCOLS = false;
5127
+ /* Decide if self-closing tags in attributes are allowed.
5128
+ * Usually removed due to a mXSS issue in jQuery 3.0 */
5129
+ let ALLOW_SELF_CLOSE_IN_ATTR = true;
5130
+ /* Output should be safe for common template engines.
5131
+ * This means, DOMPurify removes data attributes, mustaches and ERB
5132
+ */
5133
+ let SAFE_FOR_TEMPLATES = false;
5134
+ /* Output should be safe even for XML used within HTML and alike.
5135
+ * This means, DOMPurify removes comments when containing risky content.
5136
+ */
5137
+ let SAFE_FOR_XML = true;
5138
+ /* Decide if document with <html>... should be returned */
5139
+ let WHOLE_DOCUMENT = false;
5140
+ /* Track whether config is already set on this instance of DOMPurify. */
5141
+ let SET_CONFIG = false;
5142
+ /* Pristine allowlist bindings captured at setConfig() time. On the
5143
+ * persistent-config path sanitize() restores the sets from these before
5144
+ * the per-walk hook clone-guard, so a hook's in-call widening cannot
5145
+ * carry across calls. Null until setConfig() is called; reset by
5146
+ * clearConfig(). */
5147
+ let SET_CONFIG_ALLOWED_TAGS = null;
5148
+ let SET_CONFIG_ALLOWED_ATTR = null;
5149
+ /* Decide if all elements (e.g. style, script) must be children of
5150
+ * document.body. By default, browsers might move them to document.head */
5151
+ let FORCE_BODY = false;
5152
+ /* Decide if a DOM `HTMLBodyElement` should be returned, instead of a html
5153
+ * string (or a TrustedHTML object if Trusted Types are supported).
5154
+ * If `WHOLE_DOCUMENT` is enabled a `HTMLHtmlElement` will be returned instead
5155
+ */
5156
+ let RETURN_DOM = false;
5157
+ /* Decide if a DOM `DocumentFragment` should be returned, instead of a html
5158
+ * string (or a TrustedHTML object if Trusted Types are supported) */
5159
+ let RETURN_DOM_FRAGMENT = false;
5160
+ /* Try to return a Trusted Type object instead of a string, return a string in
5161
+ * case Trusted Types are not supported */
5162
+ let RETURN_TRUSTED_TYPE = false;
5163
+ /* Output should be free from DOM clobbering attacks?
5164
+ * This sanitizes markups named with colliding, clobberable built-in DOM APIs.
5165
+ */
5166
+ let SANITIZE_DOM = true;
5167
+ /* Achieve full DOM Clobbering protection by isolating the namespace of named
5168
+ * properties and JS variables, mitigating attacks that abuse the HTML/DOM spec rules.
5169
+ *
5170
+ * HTML/DOM spec rules that enable DOM Clobbering:
5171
+ * - Named Access on Window (§7.3.3)
5172
+ * - DOM Tree Accessors (§3.1.5)
5173
+ * - Form Element Parent-Child Relations (§4.10.3)
5174
+ * - Iframe srcdoc / Nested WindowProxies (§4.8.5)
5175
+ * - HTMLCollection (§4.2.10.2)
5176
+ *
5177
+ * Namespace isolation is implemented by prefixing `id` and `name` attributes
5178
+ * with a constant string, i.e., `user-content-`
5179
+ */
5180
+ let SANITIZE_NAMED_PROPS = false;
5181
+ const SANITIZE_NAMED_PROPS_PREFIX = 'user-content-';
5182
+ /* Keep element content when removing element? */
5183
+ let KEEP_CONTENT = true;
5184
+ /* If a `Node` is passed to sanitize(), then performs sanitization in-place instead
5185
+ * of importing it into a new Document and returning a sanitized copy */
5186
+ let IN_PLACE = false;
5187
+ /* Allow usage of profiles like html, svg and mathMl */
5188
+ let USE_PROFILES = {};
5189
+ /* Tags to ignore content of when KEEP_CONTENT is true */
5190
+ let FORBID_CONTENTS = null;
5191
+ const DEFAULT_FORBID_CONTENTS = addToSet({}, ['annotation-xml', 'audio', 'colgroup', 'desc', 'foreignobject', 'head', 'iframe', 'math', 'mi', 'mn', 'mo', 'ms', 'mtext', 'noembed', 'noframes', 'noscript', 'plaintext', 'script',
5192
+ // <selectedcontent> mirrors the selected <option>'s subtree, cloned by
5193
+ // the UA (customizable <select>) — including any on* handlers — and the
5194
+ // engine re-mirrors synchronously whenever a removal changes which
5195
+ // option/selectedcontent is current, even inside DOMPurify's inert
5196
+ // DOMParser document. Hoisting its children on removal re-inserts a fresh
5197
+ // mirror target ahead of the walk, which the engine refills, looping
5198
+ // forever (DoS) and amplifying output. Dropping its content on removal
5199
+ // (rather than hoisting) breaks that cascade; the content is a duplicate
5200
+ // of the option, which is sanitized on its own. See campaign-3 F1/F6.
5201
+ 'selectedcontent', 'style', 'svg', 'template', 'thead', 'title', 'video', 'xmp']);
5202
+ /* Tags that are safe for data: URIs */
5203
+ let DATA_URI_TAGS = null;
5204
+ const DEFAULT_DATA_URI_TAGS = addToSet({}, ['audio', 'video', 'img', 'source', 'image', 'track']);
5205
+ /* Attributes safe for values like "javascript:" */
5206
+ let URI_SAFE_ATTRIBUTES = null;
5207
+ const DEFAULT_URI_SAFE_ATTRIBUTES = addToSet({}, ['alt', 'class', 'for', 'id', 'label', 'name', 'pattern', 'placeholder', 'role', 'summary', 'title', 'value', 'style', 'xmlns']);
5208
+ const MATHML_NAMESPACE = 'http://www.w3.org/1998/Math/MathML';
5209
+ const SVG_NAMESPACE = 'http://www.w3.org/2000/svg';
5210
+ const HTML_NAMESPACE = 'http://www.w3.org/1999/xhtml';
5211
+ /* Document namespace */
5212
+ let NAMESPACE = HTML_NAMESPACE;
5213
+ let IS_EMPTY_INPUT = false;
5214
+ /* Allowed XHTML+XML namespaces */
5215
+ let ALLOWED_NAMESPACES = null;
5216
+ const DEFAULT_ALLOWED_NAMESPACES = addToSet({}, [MATHML_NAMESPACE, SVG_NAMESPACE, HTML_NAMESPACE], stringToString);
5217
+ const DEFAULT_MATHML_TEXT_INTEGRATION_POINTS = freeze(['mi', 'mo', 'mn', 'ms', 'mtext']);
5218
+ let MATHML_TEXT_INTEGRATION_POINTS = addToSet({}, DEFAULT_MATHML_TEXT_INTEGRATION_POINTS);
5219
+ const DEFAULT_HTML_INTEGRATION_POINTS = freeze(['annotation-xml']);
5220
+ let HTML_INTEGRATION_POINTS = addToSet({}, DEFAULT_HTML_INTEGRATION_POINTS);
5221
+ // Certain elements are allowed in both SVG and HTML
5222
+ // namespace. We need to specify them explicitly
5223
+ // so that they don't get erroneously deleted from
5224
+ // HTML namespace.
5225
+ const COMMON_SVG_AND_HTML_ELEMENTS = addToSet({}, ['title', 'style', 'font', 'a', 'script']);
5226
+ /* Parsing of strict XHTML documents */
5227
+ let PARSER_MEDIA_TYPE = null;
5228
+ const SUPPORTED_PARSER_MEDIA_TYPES = ['application/xhtml+xml', 'text/html'];
5229
+ const DEFAULT_PARSER_MEDIA_TYPE = 'text/html';
5230
+ let transformCaseFunc = null;
5231
+ /* Keep a reference to config to pass to hooks */
5232
+ let CONFIG = null;
5233
+ /* Ideally, do not touch anything below this line */
5234
+ /* ______________________________________________ */
5235
+ const formElement = document.createElement('form');
5236
+ const isRegexOrFunction = function isRegexOrFunction(testValue) {
5237
+ return testValue instanceof RegExp || testValue instanceof Function;
5238
+ };
5239
+ /**
5240
+ * _parseConfig
5241
+ *
5242
+ * @param cfg optional config literal
5243
+ */
5244
+ // eslint-disable-next-line complexity
5245
+ const _parseConfig = function _parseConfig() {
5246
+ let cfg = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
5247
+ if (CONFIG && CONFIG === cfg) {
5248
+ return;
5249
+ }
5250
+ /* Shield configuration object from tampering */
5251
+ if (!cfg || typeof cfg !== 'object') {
5252
+ cfg = {};
5253
+ }
5254
+ /* Shield configuration object from prototype pollution */
5255
+ cfg = clone(cfg);
5256
+ PARSER_MEDIA_TYPE =
5257
+ // eslint-disable-next-line unicorn/prefer-includes
5258
+ SUPPORTED_PARSER_MEDIA_TYPES.indexOf(cfg.PARSER_MEDIA_TYPE) === -1 ? DEFAULT_PARSER_MEDIA_TYPE : cfg.PARSER_MEDIA_TYPE;
5259
+ // HTML tags and attributes are not case-sensitive, converting to lowercase. Keeping XHTML as is.
5260
+ transformCaseFunc = PARSER_MEDIA_TYPE === 'application/xhtml+xml' ? stringToString : stringToLowerCase;
5261
+ /* Set configuration parameters */
5262
+ ALLOWED_TAGS = _resolveSetOption(cfg, 'ALLOWED_TAGS', DEFAULT_ALLOWED_TAGS, {
5263
+ transform: transformCaseFunc
5264
+ });
5265
+ ALLOWED_ATTR = _resolveSetOption(cfg, 'ALLOWED_ATTR', DEFAULT_ALLOWED_ATTR, {
5266
+ transform: transformCaseFunc
5267
+ });
5268
+ ALLOWED_NAMESPACES = _resolveSetOption(cfg, 'ALLOWED_NAMESPACES', DEFAULT_ALLOWED_NAMESPACES, {
5269
+ transform: stringToString
5270
+ });
5271
+ URI_SAFE_ATTRIBUTES = _resolveSetOption(cfg, 'ADD_URI_SAFE_ATTR', DEFAULT_URI_SAFE_ATTRIBUTES, {
5272
+ transform: transformCaseFunc,
5273
+ base: DEFAULT_URI_SAFE_ATTRIBUTES
5274
+ });
5275
+ DATA_URI_TAGS = _resolveSetOption(cfg, 'ADD_DATA_URI_TAGS', DEFAULT_DATA_URI_TAGS, {
5276
+ transform: transformCaseFunc,
5277
+ base: DEFAULT_DATA_URI_TAGS
5278
+ });
5279
+ FORBID_CONTENTS = _resolveSetOption(cfg, 'FORBID_CONTENTS', DEFAULT_FORBID_CONTENTS, {
5280
+ transform: transformCaseFunc
5281
+ });
5282
+ FORBID_TAGS = _resolveSetOption(cfg, 'FORBID_TAGS', clone({}), {
5283
+ transform: transformCaseFunc
5284
+ });
5285
+ FORBID_ATTR = _resolveSetOption(cfg, 'FORBID_ATTR', clone({}), {
5286
+ transform: transformCaseFunc
5287
+ });
5288
+ USE_PROFILES = objectHasOwnProperty(cfg, 'USE_PROFILES') ? cfg.USE_PROFILES && typeof cfg.USE_PROFILES === 'object' ? clone(cfg.USE_PROFILES) : cfg.USE_PROFILES : false;
5289
+ ALLOW_ARIA_ATTR = cfg.ALLOW_ARIA_ATTR !== false; // Default true
5290
+ ALLOW_DATA_ATTR = cfg.ALLOW_DATA_ATTR !== false; // Default true
5291
+ ALLOW_UNKNOWN_PROTOCOLS = cfg.ALLOW_UNKNOWN_PROTOCOLS || false; // Default false
5292
+ ALLOW_SELF_CLOSE_IN_ATTR = cfg.ALLOW_SELF_CLOSE_IN_ATTR !== false; // Default true
5293
+ SAFE_FOR_TEMPLATES = cfg.SAFE_FOR_TEMPLATES || false; // Default false
5294
+ SAFE_FOR_XML = cfg.SAFE_FOR_XML !== false; // Default true
5295
+ WHOLE_DOCUMENT = cfg.WHOLE_DOCUMENT || false; // Default false
5296
+ RETURN_DOM = cfg.RETURN_DOM || false; // Default false
5297
+ RETURN_DOM_FRAGMENT = cfg.RETURN_DOM_FRAGMENT || false; // Default false
5298
+ RETURN_TRUSTED_TYPE = cfg.RETURN_TRUSTED_TYPE || false; // Default false
5299
+ FORCE_BODY = cfg.FORCE_BODY || false; // Default false
5300
+ SANITIZE_DOM = cfg.SANITIZE_DOM !== false; // Default true
5301
+ SANITIZE_NAMED_PROPS = cfg.SANITIZE_NAMED_PROPS || false; // Default false
5302
+ KEEP_CONTENT = cfg.KEEP_CONTENT !== false; // Default true
5303
+ IN_PLACE = cfg.IN_PLACE || false; // Default false
5304
+ IS_ALLOWED_URI$1 = isRegex(cfg.ALLOWED_URI_REGEXP) ? cfg.ALLOWED_URI_REGEXP : IS_ALLOWED_URI; // Default regexp
5305
+ NAMESPACE = typeof cfg.NAMESPACE === 'string' ? cfg.NAMESPACE : HTML_NAMESPACE; // Default HTML namespace
5306
+ MATHML_TEXT_INTEGRATION_POINTS = objectHasOwnProperty(cfg, 'MATHML_TEXT_INTEGRATION_POINTS') && cfg.MATHML_TEXT_INTEGRATION_POINTS && typeof cfg.MATHML_TEXT_INTEGRATION_POINTS === 'object' ? clone(cfg.MATHML_TEXT_INTEGRATION_POINTS) : addToSet({}, DEFAULT_MATHML_TEXT_INTEGRATION_POINTS); // Default built-in map
5307
+ HTML_INTEGRATION_POINTS = objectHasOwnProperty(cfg, 'HTML_INTEGRATION_POINTS') && cfg.HTML_INTEGRATION_POINTS && typeof cfg.HTML_INTEGRATION_POINTS === 'object' ? clone(cfg.HTML_INTEGRATION_POINTS) : addToSet({}, DEFAULT_HTML_INTEGRATION_POINTS); // Default built-in map
5308
+ const customElementHandling = objectHasOwnProperty(cfg, 'CUSTOM_ELEMENT_HANDLING') && cfg.CUSTOM_ELEMENT_HANDLING && typeof cfg.CUSTOM_ELEMENT_HANDLING === 'object' ? clone(cfg.CUSTOM_ELEMENT_HANDLING) : create(null);
5309
+ CUSTOM_ELEMENT_HANDLING = create(null);
5310
+ if (objectHasOwnProperty(customElementHandling, 'tagNameCheck') && isRegexOrFunction(customElementHandling.tagNameCheck)) {
5311
+ CUSTOM_ELEMENT_HANDLING.tagNameCheck = customElementHandling.tagNameCheck; // Default undefined
5312
+ }
5313
+ if (objectHasOwnProperty(customElementHandling, 'attributeNameCheck') && isRegexOrFunction(customElementHandling.attributeNameCheck)) {
5314
+ CUSTOM_ELEMENT_HANDLING.attributeNameCheck = customElementHandling.attributeNameCheck; // Default undefined
5315
+ }
5316
+ if (objectHasOwnProperty(customElementHandling, 'allowCustomizedBuiltInElements') && typeof customElementHandling.allowCustomizedBuiltInElements === 'boolean') {
5317
+ CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements = customElementHandling.allowCustomizedBuiltInElements; // Default undefined
5318
+ }
5319
+ seal(CUSTOM_ELEMENT_HANDLING);
5320
+ if (SAFE_FOR_TEMPLATES) {
5321
+ ALLOW_DATA_ATTR = false;
5322
+ }
5323
+ if (RETURN_DOM_FRAGMENT) {
5324
+ RETURN_DOM = true;
5325
+ }
5326
+ /* Parse profile info */
5327
+ if (USE_PROFILES) {
5328
+ ALLOWED_TAGS = addToSet({}, text);
5329
+ ALLOWED_ATTR = create(null);
5330
+ if (USE_PROFILES.html === true) {
5331
+ addToSet(ALLOWED_TAGS, html$1);
5332
+ addToSet(ALLOWED_ATTR, html);
5333
+ }
5334
+ if (USE_PROFILES.svg === true) {
5335
+ addToSet(ALLOWED_TAGS, svg$1);
5336
+ addToSet(ALLOWED_ATTR, svg);
5337
+ addToSet(ALLOWED_ATTR, xml);
5338
+ }
5339
+ if (USE_PROFILES.svgFilters === true) {
5340
+ addToSet(ALLOWED_TAGS, svgFilters);
5341
+ addToSet(ALLOWED_ATTR, svg);
5342
+ addToSet(ALLOWED_ATTR, xml);
5343
+ }
5344
+ if (USE_PROFILES.mathMl === true) {
5345
+ addToSet(ALLOWED_TAGS, mathMl$1);
5346
+ addToSet(ALLOWED_ATTR, mathMl);
5347
+ addToSet(ALLOWED_ATTR, xml);
5348
+ }
5349
+ }
5350
+ /* Always reset function-based ADD_TAGS / ADD_ATTR checks to prevent
5351
+ * leaking across calls when switching from function to array config */
5352
+ EXTRA_ELEMENT_HANDLING.tagCheck = null;
5353
+ EXTRA_ELEMENT_HANDLING.attributeCheck = null;
5354
+ /* Merge configuration parameters */
5355
+ if (objectHasOwnProperty(cfg, 'ADD_TAGS')) {
5356
+ if (typeof cfg.ADD_TAGS === 'function') {
5357
+ EXTRA_ELEMENT_HANDLING.tagCheck = cfg.ADD_TAGS;
5358
+ } else if (arrayIsArray(cfg.ADD_TAGS)) {
5359
+ if (ALLOWED_TAGS === DEFAULT_ALLOWED_TAGS) {
5360
+ ALLOWED_TAGS = clone(ALLOWED_TAGS);
5361
+ }
5362
+ addToSet(ALLOWED_TAGS, cfg.ADD_TAGS, transformCaseFunc);
5363
+ }
5364
+ }
5365
+ if (objectHasOwnProperty(cfg, 'ADD_ATTR')) {
5366
+ if (typeof cfg.ADD_ATTR === 'function') {
5367
+ EXTRA_ELEMENT_HANDLING.attributeCheck = cfg.ADD_ATTR;
5368
+ } else if (arrayIsArray(cfg.ADD_ATTR)) {
5369
+ if (ALLOWED_ATTR === DEFAULT_ALLOWED_ATTR) {
5370
+ ALLOWED_ATTR = clone(ALLOWED_ATTR);
5371
+ }
5372
+ addToSet(ALLOWED_ATTR, cfg.ADD_ATTR, transformCaseFunc);
5373
+ }
5374
+ }
5375
+ if (objectHasOwnProperty(cfg, 'ADD_URI_SAFE_ATTR') && arrayIsArray(cfg.ADD_URI_SAFE_ATTR)) {
5376
+ addToSet(URI_SAFE_ATTRIBUTES, cfg.ADD_URI_SAFE_ATTR, transformCaseFunc);
5377
+ }
5378
+ if (objectHasOwnProperty(cfg, 'FORBID_CONTENTS') && arrayIsArray(cfg.FORBID_CONTENTS)) {
5379
+ if (FORBID_CONTENTS === DEFAULT_FORBID_CONTENTS) {
5380
+ FORBID_CONTENTS = clone(FORBID_CONTENTS);
5381
+ }
5382
+ addToSet(FORBID_CONTENTS, cfg.FORBID_CONTENTS, transformCaseFunc);
5383
+ }
5384
+ if (objectHasOwnProperty(cfg, 'ADD_FORBID_CONTENTS') && arrayIsArray(cfg.ADD_FORBID_CONTENTS)) {
5385
+ if (FORBID_CONTENTS === DEFAULT_FORBID_CONTENTS) {
5386
+ FORBID_CONTENTS = clone(FORBID_CONTENTS);
5387
+ }
5388
+ addToSet(FORBID_CONTENTS, cfg.ADD_FORBID_CONTENTS, transformCaseFunc);
5389
+ }
5390
+ /* Add #text in case KEEP_CONTENT is set to true */
5391
+ if (KEEP_CONTENT) {
5392
+ ALLOWED_TAGS['#text'] = true;
5393
+ }
5394
+ /* Add html, head and body to ALLOWED_TAGS in case WHOLE_DOCUMENT is true */
5395
+ if (WHOLE_DOCUMENT) {
5396
+ addToSet(ALLOWED_TAGS, ['html', 'head', 'body']);
5397
+ }
5398
+ /* Add tbody to ALLOWED_TAGS in case tables are permitted, see #286, #365 */
5399
+ if (ALLOWED_TAGS.table) {
5400
+ addToSet(ALLOWED_TAGS, ['tbody']);
5401
+ delete FORBID_TAGS.tbody;
5402
+ }
5403
+ // Re-derive the active Trusted Types policy from this configuration on
5404
+ // every parse. The active policy must never be sticky closure state that
5405
+ // outlives the config that set it: a caller-supplied policy left in place
5406
+ // after `clearConfig()` — or after a later call that supplied none, or
5407
+ // `TRUSTED_TYPES_POLICY: null` — could sign a subsequent "default"
5408
+ // `RETURN_TRUSTED_TYPE` result with a foreign, possibly unsafe policy.
5409
+ // See GHSA-vxr8-fq34-vvx9.
5410
+ if (cfg.TRUSTED_TYPES_POLICY) {
5411
+ if (typeof cfg.TRUSTED_TYPES_POLICY.createHTML !== 'function') {
5412
+ throw typeErrorCreate('TRUSTED_TYPES_POLICY configuration option must provide a "createHTML" hook.');
5413
+ }
5414
+ if (typeof cfg.TRUSTED_TYPES_POLICY.createScriptURL !== 'function') {
5415
+ throw typeErrorCreate('TRUSTED_TYPES_POLICY configuration option must provide a "createScriptURL" hook.');
5416
+ }
5417
+ // A caller-supplied policy applies to this configuration only.
5418
+ const previousTrustedTypesPolicy = trustedTypesPolicy;
5419
+ trustedTypesPolicy = cfg.TRUSTED_TYPES_POLICY;
5420
+ // Sign local variables required by `sanitize`. If the supplied policy's
5421
+ // `createHTML` is circular (i.e. it calls `DOMPurify.sanitize`), this
5422
+ // throws via the re-entrancy guard. Restore the previous policy first so
5423
+ // the instance is not left in a poisoned state. See #1422.
5424
+ try {
5425
+ emptyHTML = _createTrustedHTML('');
5426
+ } catch (error) {
5427
+ trustedTypesPolicy = previousTrustedTypesPolicy;
5428
+ throw error;
5429
+ }
5430
+ } else if (cfg.TRUSTED_TYPES_POLICY === null) {
5431
+ // Explicit opt-out for this call: perform no Trusted Types signing and
5432
+ // create nothing (so a strict `trusted-types` CSP that disallows a
5433
+ // `dompurify` policy can still call `sanitize` from inside its own
5434
+ // policy — see #1422). Resetting to `undefined` rather than a sticky
5435
+ // `null` also drops any previously retained caller policy, so it cannot
5436
+ // resurface on a later call, while still allowing the next config-less
5437
+ // call to restore the internal default policy. See GHSA-vxr8-fq34-vvx9.
5438
+ trustedTypesPolicy = undefined;
5439
+ emptyHTML = '';
5440
+ } else {
5441
+ // No policy supplied: keep the currently active policy if one is set — a
5442
+ // previously supplied policy is intentionally sticky across config-less
5443
+ // calls — otherwise fall back to the instance's own internal policy,
5444
+ // created at most once. (A policy supplied for a *single* call still
5445
+ // lingers by design; what must not linger is a policy whose configuration
5446
+ // has been torn down via `clearConfig()`, which restores the default.)
5447
+ if (trustedTypesPolicy === undefined) {
5448
+ trustedTypesPolicy = _getDefaultTrustedTypesPolicy();
5449
+ }
5450
+ // Sign internal variables only when a policy is active. A falsy policy
5451
+ // (Trusted Types unsupported, creation failed, or an explicit opt-out)
5452
+ // leaves `emptyHTML` as a plain string, so we never call `.createHTML` on
5453
+ // a non-policy and throw. See #1422.
5454
+ if (trustedTypesPolicy && typeof emptyHTML === 'string') {
5455
+ emptyHTML = _createTrustedHTML('');
5456
+ }
5457
+ }
5458
+ // Prevent further manipulation of configuration.
5459
+ // Not available in IE8, Safari 5, etc.
5460
+ if (freeze) {
5461
+ freeze(cfg);
5462
+ }
5463
+ CONFIG = cfg;
5464
+ };
5465
+ /* Keep track of all possible SVG and MathML tags
5466
+ * so that we can perform the namespace checks
5467
+ * correctly. */
5468
+ const ALL_SVG_TAGS = addToSet({}, [...svg$1, ...svgFilters, ...svgDisallowed]);
5469
+ const ALL_MATHML_TAGS = addToSet({}, [...mathMl$1, ...mathMlDisallowed]);
5470
+ /**
5471
+ * Namespace rules for an element in the SVG namespace.
5472
+ *
5473
+ * @param tagName the element's lowercase tag name
5474
+ * @param parent the (possibly simulated) parent node
5475
+ * @param parentTagName the parent's lowercase tag name
5476
+ * @returns true if a spec-compliant parser could produce this element
5477
+ */
5478
+ const _checkSvgNamespace = function _checkSvgNamespace(tagName, parent, parentTagName) {
5479
+ // The only way to switch from HTML namespace to SVG
5480
+ // is via <svg>. If it happens via any other tag, then
5481
+ // it should be killed.
5482
+ if (parent.namespaceURI === HTML_NAMESPACE) {
5483
+ return tagName === 'svg';
5484
+ }
5485
+ // The only way to switch from MathML to SVG is via <svg>
5486
+ // if the parent is either <annotation-xml> or a MathML
5487
+ // text integration point.
5488
+ if (parent.namespaceURI === MATHML_NAMESPACE) {
5489
+ return tagName === 'svg' && (parentTagName === 'annotation-xml' || MATHML_TEXT_INTEGRATION_POINTS[parentTagName]);
5490
+ }
5491
+ // We only allow elements that are defined in SVG
5492
+ // spec. All others are disallowed in SVG namespace.
5493
+ return Boolean(ALL_SVG_TAGS[tagName]);
5494
+ };
5495
+ /**
5496
+ * Namespace rules for an element in the MathML namespace.
5497
+ *
5498
+ * @param tagName the element's lowercase tag name
5499
+ * @param parent the (possibly simulated) parent node
5500
+ * @param parentTagName the parent's lowercase tag name
5501
+ * @returns true if a spec-compliant parser could produce this element
5502
+ */
5503
+ const _checkMathMlNamespace = function _checkMathMlNamespace(tagName, parent, parentTagName) {
5504
+ // The only way to switch from HTML namespace to MathML
5505
+ // is via <math>. If it happens via any other tag, then
5506
+ // it should be killed.
5507
+ if (parent.namespaceURI === HTML_NAMESPACE) {
5508
+ return tagName === 'math';
5509
+ }
5510
+ // The only way to switch from SVG to MathML is via
5511
+ // <math> and HTML integration points
5512
+ if (parent.namespaceURI === SVG_NAMESPACE) {
5513
+ return tagName === 'math' && HTML_INTEGRATION_POINTS[parentTagName];
5514
+ }
5515
+ // We only allow elements that are defined in MathML
5516
+ // spec. All others are disallowed in MathML namespace.
5517
+ return Boolean(ALL_MATHML_TAGS[tagName]);
5518
+ };
5519
+ /**
5520
+ * Namespace rules for an element in the HTML namespace.
5521
+ *
5522
+ * @param tagName the element's lowercase tag name
5523
+ * @param parent the (possibly simulated) parent node
5524
+ * @param parentTagName the parent's lowercase tag name
5525
+ * @returns true if a spec-compliant parser could produce this element
5526
+ */
5527
+ const _checkHtmlNamespace = function _checkHtmlNamespace(tagName, parent, parentTagName) {
5528
+ // The only way to switch from SVG to HTML is via
5529
+ // HTML integration points, and from MathML to HTML
5530
+ // is via MathML text integration points
5531
+ if (parent.namespaceURI === SVG_NAMESPACE && !HTML_INTEGRATION_POINTS[parentTagName]) {
5532
+ return false;
5533
+ }
5534
+ if (parent.namespaceURI === MATHML_NAMESPACE && !MATHML_TEXT_INTEGRATION_POINTS[parentTagName]) {
5535
+ return false;
5536
+ }
5537
+ // We disallow tags that are specific for MathML
5538
+ // or SVG and should never appear in HTML namespace
5539
+ return !ALL_MATHML_TAGS[tagName] && (COMMON_SVG_AND_HTML_ELEMENTS[tagName] || !ALL_SVG_TAGS[tagName]);
5540
+ };
5541
+ /**
5542
+ * @param element a DOM element whose namespace is being checked
5543
+ * @returns Return false if the element has a
5544
+ * namespace that a spec-compliant parser would never
5545
+ * return. Return true otherwise.
5546
+ */
5547
+ const _checkValidNamespace = function _checkValidNamespace(element) {
5548
+ let parent = getParentNode(element);
5549
+ // In JSDOM, if we're inside shadow DOM, then parentNode
5550
+ // can be null. We just simulate parent in this case.
5551
+ if (!parent || !parent.tagName) {
5552
+ parent = {
5553
+ namespaceURI: NAMESPACE,
5554
+ tagName: 'template'
5555
+ };
5556
+ }
5557
+ const tagName = stringToLowerCase(element.tagName);
5558
+ const parentTagName = stringToLowerCase(parent.tagName);
5559
+ if (!ALLOWED_NAMESPACES[element.namespaceURI]) {
5560
+ return false;
5561
+ }
5562
+ if (element.namespaceURI === SVG_NAMESPACE) {
5563
+ return _checkSvgNamespace(tagName, parent, parentTagName);
5564
+ }
5565
+ if (element.namespaceURI === MATHML_NAMESPACE) {
5566
+ return _checkMathMlNamespace(tagName, parent, parentTagName);
5567
+ }
5568
+ if (element.namespaceURI === HTML_NAMESPACE) {
5569
+ return _checkHtmlNamespace(tagName, parent, parentTagName);
5570
+ }
5571
+ // For XHTML and XML documents that support custom namespaces
5572
+ if (PARSER_MEDIA_TYPE === 'application/xhtml+xml' && ALLOWED_NAMESPACES[element.namespaceURI]) {
5573
+ return true;
5574
+ }
5575
+ // The code should never reach this place (this means
5576
+ // that the element somehow got namespace that is not
5577
+ // HTML, SVG, MathML or allowed via ALLOWED_NAMESPACES).
5578
+ // Return false just in case.
5579
+ return false;
5580
+ };
5581
+ /**
5582
+ * _forceRemove
5583
+ *
5584
+ * @param node a DOM node
5585
+ */
5586
+ const _forceRemove = function _forceRemove(node) {
5587
+ arrayPush(DOMPurify.removed, {
5588
+ element: node
5589
+ });
5590
+ try {
5591
+ // eslint-disable-next-line unicorn/prefer-dom-node-remove
5592
+ getParentNode(node).removeChild(node);
5593
+ } catch (_) {
5594
+ /* The normal detach failed — this is reached for a parentless node
5595
+ (getParentNode() is null, so .removeChild throws). Element.prototype
5596
+ .remove() is itself a spec no-op on a parentless node, so a recorded
5597
+ "removal" would otherwise hand the caller back an intact,
5598
+ payload-bearing node (e.g. a detached IN_PLACE root the mXSS canary or
5599
+ the style-with-element-child rule decided to kill). Fail closed by
5600
+ throwing — exactly as a clobbered root does at the IN_PLACE entry —
5601
+ rather than trying to "neutralize" the node via its own methods.
5602
+ Neutralizing would mean calling getAttributeNames()/removeAttribute()
5603
+ on the node, both of which a <form> root can clobber via a named child
5604
+ (and _isClobbered does not even probe getAttributeNames), so the
5605
+ neutralize step could itself be silently defeated, leaving the payload
5606
+ intact. A throw touches only the cached, clobber-safe remove() and
5607
+ getParentNode(). Generalizes GHSA-r47g-fvhr-h676 (clobbered-form root)
5608
+ to every root-kill reason. REPORT-3.
5609
+ This lives inside the catch, so it never fires for a normally-removed
5610
+ in-tree node: those have a parent, removeChild() succeeds, and the
5611
+ catch is not entered. Only a kept (parentless) root reaches here. */
5612
+ remove(node);
5613
+ if (!getParentNode(node)) {
5614
+ throw typeErrorCreate('a node selected for removal could not be detached from its tree ' + 'and cannot be safely returned; refusing to sanitize in place');
5615
+ }
5616
+ }
5617
+ };
5618
+ /**
5619
+ * _neutralizeRoot
5620
+ *
5621
+ * Fail-closed teardown of an in-place root after the sanitize walk aborts
5622
+ * (campaign-3 F2). An internal throw mid-walk — e.g. a page-registered
5623
+ * custom element's reaction detaches a node so `_forceRemove`'s deliberate
5624
+ * parentless guard throws, or any other re-entrant engine mutation — would
5625
+ * otherwise leave the caller's *live* tree half-sanitized, with everything
5626
+ * after the abort point still carrying its handlers. There is no safe way
5627
+ * to resume the walk (the tree mutated under us), so we strip the root bare:
5628
+ * remove every child and every attribute, then let the caller's catch see
5629
+ * the original error. Clobber-safe (cached `remove`/`childNodes`/`attributes`
5630
+ * getters; the root was already clobber-pre-flighted at the IN_PLACE entry).
5631
+ *
5632
+ * @param root the in-place root to empty
5633
+ */
5634
+ const _neutralizeRoot = function _neutralizeRoot(root) {
5635
+ /* Strip every disallowed attribute (on* handlers included) off the whole
5636
+ subtree BEFORE detaching anything. Detaching first would hand back
5637
+ handler-bearing originals (e.g. an already-loading `<img onerror>`)
5638
+ whose queued resource event still fires in page scope after we throw.
5639
+ Clobber-safe reads; a doomed clobbered node's own attributes are
5640
+ irrelevant while its non-clobbered descendants are reached and scrubbed. */
5641
+ _neutralizeSubtree(root);
5642
+ const childNodes = getChildNodes(root);
5643
+ if (childNodes) {
5644
+ const snapshot = [];
5645
+ arrayForEach(childNodes, child => {
5646
+ arrayPush(snapshot, child);
5647
+ });
5648
+ arrayForEach(snapshot, child => {
5649
+ try {
5650
+ remove(child);
5651
+ } catch (_) {
5652
+ /* Best-effort teardown; a still-attached child is handled below */
5653
+ }
5654
+ });
5655
+ }
5656
+ const attributes = getAttributes(root);
5657
+ if (attributes) {
5658
+ for (let i = attributes.length - 1; i >= 0; --i) {
5659
+ const attribute = attributes[i];
5660
+ const name = attribute && attribute.name;
5661
+ if (typeof name === 'string') {
5662
+ try {
5663
+ root.removeAttribute(name);
5664
+ } catch (_) {
5665
+ /* Clobbered removeAttribute — ignore (fail-closed best effort) */
5666
+ }
5667
+ }
5668
+ }
5669
+ }
5670
+ };
5671
+ /**
5672
+ * _removeAttribute
5673
+ *
5674
+ * @param name an Attribute name
5675
+ * @param element a DOM node
5676
+ */
5677
+ const _removeAttribute = function _removeAttribute(name, element) {
5678
+ try {
5679
+ arrayPush(DOMPurify.removed, {
5680
+ attribute: element.getAttributeNode(name),
5681
+ from: element
5682
+ });
5683
+ } catch (_) {
5684
+ arrayPush(DOMPurify.removed, {
5685
+ attribute: null,
5686
+ from: element
5687
+ });
5688
+ }
5689
+ element.removeAttribute(name);
5690
+ // We void attribute values for unremovable "is" attributes
5691
+ if (name === 'is') {
5692
+ if (RETURN_DOM || RETURN_DOM_FRAGMENT) {
5693
+ try {
5694
+ _forceRemove(element);
5695
+ } catch (_) {}
5696
+ } else {
5697
+ try {
5698
+ element.setAttribute(name, '');
5699
+ } catch (_) {}
5700
+ }
5701
+ }
5702
+ };
5703
+ /**
5704
+ * _stripDisallowedAttributes
5705
+ *
5706
+ * Removes every attribute the active configuration does not allow from a
5707
+ * single element, using the same allowlist as the main attribute pass (so
5708
+ * `on*` handlers go, but no `/^on/` blocklist is introduced). Used only to
5709
+ * neutralise nodes that are being discarded from an in-place tree.
5710
+ *
5711
+ * @param element the element to strip
5712
+ */
5713
+ const _stripDisallowedAttributes = function _stripDisallowedAttributes(element) {
5714
+ const attributes = getAttributes(element);
5715
+ if (!attributes) {
5716
+ return;
5717
+ }
5718
+ for (let i = attributes.length - 1; i >= 0; --i) {
5719
+ const attribute = attributes[i];
5720
+ const name = attribute && attribute.name;
5721
+ if (typeof name !== 'string' || ALLOWED_ATTR[transformCaseFunc(name)]) {
5722
+ continue;
5723
+ }
5724
+ try {
5725
+ element.removeAttribute(name);
5726
+ } catch (_) {
5727
+ /* Clobbered removeAttribute on a doomed node — ignore */
5728
+ }
5729
+ }
5730
+ };
5731
+ /**
5732
+ * _neutralizeSubtree
5733
+ *
5734
+ * Completes the audit-5 F1 fix across every removal path. The KEEP_CONTENT
5735
+ * move-hoist neutralises only disallowed-tag removals; clobber, mXSS-canary,
5736
+ * namespace, comment, processing-instruction and KEEP_CONTENT:false removals
5737
+ * all drop their subtree wholesale via `_forceRemove`. On the IN_PLACE path
5738
+ * those dropped nodes are detached from the caller's LIVE tree but a
5739
+ * handler-bearing original among them (an `<img onerror>`/`<video>` that was
5740
+ * loading) keeps its queued resource event, which fires in page scope after
5741
+ * sanitize returns. This walks a removed subtree and strips every attribute
5742
+ * the active configuration does not allow — so `on*` handlers are cancelled
5743
+ * through the SAME allowlist that governs kept nodes, not a separate `/^on/`
5744
+ * blocklist. Run synchronously before sanitize returns, i.e. before any
5745
+ * queued event can fire. Hook-free by design: these nodes leave the output,
5746
+ * so firing attribute hooks for them would be surprising. Clobber-safe reads;
5747
+ * a doomed clobbered node may shadow `removeAttribute` (its own attributes are
5748
+ * irrelevant — it is discarded — while its non-clobbered descendants, e.g.
5749
+ * the `<img>`, are reached and scrubbed).
5750
+ *
5751
+ * @param root the root of a removed subtree to neutralise
5752
+ */
5753
+ const _neutralizeSubtree = function _neutralizeSubtree(root) {
5754
+ const stack = [root];
5755
+ while (stack.length > 0) {
5756
+ const node = stack.pop();
5757
+ const nodeType = getNodeType ? getNodeType(node) : node.nodeType;
5758
+ if (nodeType === NODE_TYPE.element) {
5759
+ _stripDisallowedAttributes(node);
5760
+ }
5761
+ const childNodes = getChildNodes(node);
5762
+ if (childNodes) {
5763
+ for (let i = childNodes.length - 1; i >= 0; --i) {
5764
+ stack.push(childNodes[i]);
5765
+ }
5766
+ }
5767
+ }
5768
+ };
5769
+ /**
5770
+ * _neutralizePatchLinkage
5771
+ *
5772
+ * IN_PLACE entry pre-pass (declarative-partial-updates / streaming
5773
+ * hardening, https://github.com/WICG/declarative-partial-updates).
5774
+ *
5775
+ * The main walk strips patch linkage (`for`/`patchsrc`) and removes range
5776
+ * markers (PIs / markup comments) node-by-node, in document order, AS it
5777
+ * reaches each node. On a live in-place root that leaves a window: from the
5778
+ * moment the root is connected until the walk arrives at a given node, that
5779
+ * node's linkage is live. A patch applied on connection/stream can fire as
5780
+ * a microtask during the walk and inject or teleport an unsanitized DOM
5781
+ * range into a region the iterator has already passed and will not revisit,
5782
+ * so the post-return "tree is sanitized" contract is violated. Sweep the
5783
+ * whole tree once up front and sever every linkage before the walk begins,
5784
+ * closing that window.
5785
+ *
5786
+ * This CANNOT undo a patch that already fired before sanitize ran — that is
5787
+ * the irreducible "do not IN_PLACE a live-connected attacker tree" caveat —
5788
+ * but it closes everything from sanitize-start onward. Gated on SAFE_FOR_XML
5789
+ * to group with the rest of the declarative-partial-updates handling and
5790
+ * stay overridable, consistent with the codebase.
5791
+ *
5792
+ * Clobber-safe traversal (cached childNodes getter); per-node try/catch so a
5793
+ * clobbered root cannot defeat the sweep of its non-clobbered descendants.
5794
+ *
5795
+ * NOTE (pending real-Chrome confirmation, see test/declarative-patch-probe
5796
+ * .html Q1): this mirrors the existing policy of keeping `for` on
5797
+ * <label>/<output>. If the shipping feature can drive a patch through a
5798
+ * surviving `for`-on-label/output + `id` pair, this pre-pass and the
5799
+ * attribute check at _isBasicCustomElement's caller must additionally drop
5800
+ * that pair on the IN_PLACE path. Left as-is until the taxonomy is verified.
5801
+ *
5802
+ * @param root the in-place root to sweep
5803
+ */
5804
+ const _neutralizePatchLinkage = function _neutralizePatchLinkage(root) {
5805
+ if (!SAFE_FOR_XML) {
5806
+ return;
5807
+ }
5808
+ const stack = [root];
5809
+ while (stack.length > 0) {
5810
+ const node = stack.pop();
5811
+ const nodeType = getNodeType ? getNodeType(node) : node.nodeType;
5812
+ /* Remove range markers (the target side of a patch linkage): every
5813
+ processing instruction, and any markup-bearing comment. */
5814
+ if (nodeType === NODE_TYPE.processingInstruction || nodeType === NODE_TYPE.comment && regExpTest(COMMENT_MARKUP_PROBE, node.data)) {
5815
+ try {
5816
+ remove(node);
5817
+ } catch (_) {
5818
+ /* Best-effort */
5819
+ }
5820
+ continue;
5821
+ }
5822
+ /* Strip patch-source attributes (the source side) off elements. */
5823
+ if (nodeType === NODE_TYPE.element) {
5824
+ const element = node;
5825
+ const lcTag = transformCaseFunc(getNodeName ? getNodeName(node) : node.nodeName);
5826
+ try {
5827
+ if (element.hasAttribute && element.hasAttribute('patchsrc')) {
5828
+ element.removeAttribute('patchsrc');
5829
+ }
5830
+ if (element.hasAttribute && element.hasAttribute('for') && lcTag !== 'label' && lcTag !== 'output') {
5831
+ element.removeAttribute('for');
5832
+ }
5833
+ } catch (_) {
5834
+ /* Clobbered removeAttribute/hasAttribute on a doomed node — ignore */
5835
+ }
5836
+ }
5837
+ const childNodes = getChildNodes(node);
5838
+ if (childNodes) {
5839
+ for (let i = childNodes.length - 1; i >= 0; --i) {
5840
+ stack.push(childNodes[i]);
5841
+ }
5842
+ }
5843
+ }
5844
+ };
5845
+ /**
5846
+ * _initDocument
5847
+ *
5848
+ * @param dirty - a string of dirty markup
5849
+ * @return a DOM, filled with the dirty markup
5850
+ */
5851
+ const _initDocument = function _initDocument(dirty) {
5852
+ /* Create a HTML document */
5853
+ let doc = null;
5854
+ let leadingWhitespace = null;
5855
+ if (FORCE_BODY) {
5856
+ dirty = '<remove></remove>' + dirty;
5857
+ } else {
5858
+ /* If FORCE_BODY isn't used, leading whitespace needs to be preserved manually */
5859
+ const matches = stringMatch(dirty, /^[\r\n\t ]+/);
5860
+ leadingWhitespace = matches && matches[0];
5861
+ }
5862
+ if (PARSER_MEDIA_TYPE === 'application/xhtml+xml' && NAMESPACE === HTML_NAMESPACE) {
5863
+ // Root of XHTML doc must contain xmlns declaration (see https://www.w3.org/TR/xhtml1/normative.html#strict)
5864
+ dirty = '<html xmlns="http://www.w3.org/1999/xhtml"><head></head><body>' + dirty + '</body></html>';
5865
+ }
5866
+ const dirtyPayload = trustedTypesPolicy ? _createTrustedHTML(dirty) : dirty;
5867
+ /*
5868
+ * Use the DOMParser API by default, fallback later if needs be
5869
+ * DOMParser not work for svg when has multiple root element.
5870
+ */
5871
+ if (NAMESPACE === HTML_NAMESPACE) {
5872
+ try {
5873
+ doc = new DOMParser().parseFromString(dirtyPayload, PARSER_MEDIA_TYPE);
5874
+ } catch (_) {}
5875
+ }
5876
+ /* Use createHTMLDocument in case DOMParser is not available */
5877
+ if (!doc || !doc.documentElement) {
5878
+ doc = implementation.createDocument(NAMESPACE, 'template', null);
5879
+ try {
5880
+ doc.documentElement.innerHTML = IS_EMPTY_INPUT ? emptyHTML : dirtyPayload;
5881
+ } catch (_) {
5882
+ // Syntax error if dirtyPayload is invalid xml
5883
+ }
5884
+ }
5885
+ const body = doc.body || doc.documentElement;
5886
+ if (dirty && leadingWhitespace) {
5887
+ body.insertBefore(document.createTextNode(leadingWhitespace), body.childNodes[0] || null);
5888
+ }
5889
+ /* Work on whole document or just its body */
5890
+ if (NAMESPACE === HTML_NAMESPACE) {
5891
+ return getElementsByTagName.call(doc, WHOLE_DOCUMENT ? 'html' : 'body')[0];
5892
+ }
5893
+ return WHOLE_DOCUMENT ? doc.documentElement : body;
5894
+ };
5895
+ /**
5896
+ * Creates a NodeIterator object that you can use to traverse filtered lists of nodes or elements in a document.
5897
+ *
5898
+ * @param root The root element or node to start traversing on.
5899
+ * @return The created NodeIterator
5900
+ */
5901
+ const _createNodeIterator = function _createNodeIterator(root) {
5902
+ return createNodeIterator.call(root.ownerDocument || root, root,
5903
+ // eslint-disable-next-line no-bitwise
5904
+ NodeFilter.SHOW_ELEMENT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_TEXT | NodeFilter.SHOW_PROCESSING_INSTRUCTION | NodeFilter.SHOW_CDATA_SECTION, null);
5905
+ };
5906
+ /**
5907
+ * Replace template expression syntax (mustache, ERB, template
5908
+ * literal) with a space; shared by all SAFE_FOR_TEMPLATES scrub
5909
+ * sites. Order matters: mustache, then ERB, then template literal.
5910
+ *
5911
+ * @param value the string to scrub
5912
+ * @returns the scrubbed string
5913
+ */
5914
+ const _stripTemplateExpressions = function _stripTemplateExpressions(value) {
5915
+ value = stringReplace(value, MUSTACHE_EXPR$1, ' ');
5916
+ value = stringReplace(value, ERB_EXPR$1, ' ');
5917
+ value = stringReplace(value, TMPLIT_EXPR$1, ' ');
5918
+ return value;
5919
+ };
5920
+ /**
5921
+ * Strip template-engine expressions ({{...}}, ${...}, <%...%>) from the
5922
+ * character data of an element subtree. Used as the final safety net for
5923
+ * SAFE_FOR_TEMPLATES on every DOM-returning code path so that expressions
5924
+ * which only form after text-node normalization (e.g. fragments split across
5925
+ * stripped elements) cannot survive into a template-evaluating framework.
5926
+ *
5927
+ * Walks text/comment/CDATA/processing-instruction nodes and mutates `.data`
5928
+ * in place rather than round-tripping through innerHTML. This preserves
5929
+ * descendant node references (important for IN_PLACE callers), avoids a
5930
+ * serialize/reparse cycle, and reads literal character data — which means
5931
+ * `<%...%>` in text content matches the ERB regex against its real bytes
5932
+ * instead of the HTML-entity-escaped form innerHTML would produce.
5933
+ *
5934
+ * Attribute values are not visited here; SAFE_FOR_TEMPLATES handling for
5935
+ * attributes is performed during the per-node `_sanitizeAttributes` pass.
5936
+ *
5937
+ * @param node The root element whose character data should be scrubbed.
5938
+ */
5939
+ const _scrubTemplateExpressions2 = function _scrubTemplateExpressions(node) {
5940
+ var _node$querySelectorAl;
5941
+ node.normalize();
5942
+ const walker = createNodeIterator.call(node.ownerDocument || node, node,
5943
+ // eslint-disable-next-line no-bitwise
5944
+ NodeFilter.SHOW_TEXT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_CDATA_SECTION | NodeFilter.SHOW_PROCESSING_INSTRUCTION, null);
5945
+ let currentNode = walker.nextNode();
5946
+ while (currentNode) {
5947
+ currentNode.data = _stripTemplateExpressions(currentNode.data);
5948
+ currentNode = walker.nextNode();
5949
+ }
5950
+ // NodeIterator does not descend into <template>.content per the DOM spec,
5951
+ // so we must explicitly recurse into each template's content fragment,
5952
+ // mirroring the approach used by _sanitizeShadowDOM.
5953
+ const templates = (_node$querySelectorAl = node.querySelectorAll) === null || _node$querySelectorAl === void 0 ? void 0 : _node$querySelectorAl.call(node, 'template');
5954
+ if (templates) {
5955
+ arrayForEach(templates, tmpl => {
5956
+ if (_isDocumentFragment(tmpl.content)) {
5957
+ _scrubTemplateExpressions2(tmpl.content);
5958
+ }
5959
+ });
5960
+ }
5961
+ };
5962
+ /**
5963
+ * _isClobbered
5964
+ *
5965
+ * Detect DOM-clobbering on HTMLFormElement nodes. Form is the only HTML
5966
+ * interface with [LegacyOverrideBuiltIns]; a descendant element with a
5967
+ * `name` attribute matching a prototype property shadows that property
5968
+ * on direct reads. We use this check at the IN_PLACE entry-point and
5969
+ * during attribute sanitization to refuse clobbered forms.
5970
+ *
5971
+ * @param element element to check for clobbering attacks
5972
+ * @return true if clobbered, false if safe
5973
+ */
5974
+ const _isClobbered = function _isClobbered(element) {
5975
+ // Realm-independent tag-name probe. If we can't determine the tag
5976
+ // name at all, we can't reason about clobbering — return false
5977
+ // (the caller's other defences still apply).
5978
+ const realTagName = getNodeName ? getNodeName(element) : null;
5979
+ if (typeof realTagName !== 'string') {
5980
+ return false;
5981
+ }
5982
+ if (transformCaseFunc(realTagName) !== 'form') {
5983
+ return false;
5984
+ }
5985
+ return typeof element.nodeName !== 'string' || typeof element.textContent !== 'string' || typeof element.removeChild !== 'function' ||
5986
+ // Realm-safe NamedNodeMap detection: equality against the cached
5987
+ // prototype getter. Clobbered .attributes (e.g. <input name="attributes">)
5988
+ // makes the direct read diverge from the cached read; a clean form
5989
+ // (same-realm OR foreign-realm) has both reads pointing at the same
5990
+ // canonical NamedNodeMap.
5991
+ element.attributes !== getAttributes(element) || typeof element.removeAttribute !== 'function' || typeof element.setAttribute !== 'function' || typeof element.namespaceURI !== 'string' || typeof element.insertBefore !== 'function' || typeof element.hasChildNodes !== 'function' ||
5992
+ // NodeType clobbering probe. Cached Node.prototype.nodeType getter
5993
+ // returns the integer 1 for any Element regardless of realm; direct
5994
+ // read on a clobbered form (e.g. <input name="nodeType">) returns
5995
+ // the named child element. Cheap addition — nodeType is read from
5996
+ // an internal slot, no serialization cost — and removes a residual
5997
+ // clobbering surface used by several mXSS / PI / comment branches
5998
+ // in _sanitizeElements that compare currentNode.nodeType directly.
5999
+ element.nodeType !== getNodeType(element) ||
6000
+ // HTMLFormElement has [LegacyOverrideBuiltIns]: a descendant named
6001
+ // "childNodes" shadows the prototype getter. Direct reads of
6002
+ // form.childNodes from a clobbered form return the named child
6003
+ // instead of the real NodeList, so any walk that reads it directly
6004
+ // skips the form's real children. Compare the direct read to the
6005
+ // cached Node.prototype getter — when the form's named-property
6006
+ // getter intercepts the read, the two values differ and we flag
6007
+ // the form. This catches every clobbering child type (input,
6008
+ // select, etc.) regardless of whether the named child happens to
6009
+ // carry a numeric .length, which a typeof-based probe would miss
6010
+ // (e.g. HTMLSelectElement.length is a defined unsigned-long).
6011
+ element.childNodes !== getChildNodes(element);
6012
+ };
6013
+ /**
6014
+ * Checks whether the given value is a DocumentFragment from any realm.
6015
+ *
6016
+ * The realm-independent replacement reads `nodeType` through the cached
6017
+ * Node.prototype getter and compares to the DOCUMENT_FRAGMENT_NODE
6018
+ * constant (11). nodeType is a numeric value resolved from the node's
6019
+ * internal slot, identical across realms for the same kind of node.
6020
+ *
6021
+ * @param value object to check
6022
+ * @return true if value is a DocumentFragment-shaped node from any realm
6023
+ */
6024
+ const _isDocumentFragment = function _isDocumentFragment(value) {
6025
+ if (!getNodeType || typeof value !== 'object' || value === null) {
6026
+ return false;
6027
+ }
6028
+ try {
6029
+ return getNodeType(value) === NODE_TYPE.documentFragment;
6030
+ } catch (_) {
6031
+ return false;
6032
+ }
6033
+ };
6034
+ /**
6035
+ * Checks whether the given object is a DOM node, including nodes that
6036
+ * originate from a different window/realm (e.g. an iframe's
6037
+ * contentDocument). The previous `value instanceof Node` check was
6038
+ * realm-bound: nodes from a different window failed it, causing
6039
+ * sanitize() to silently stringify them and reset IN_PLACE to false,
6040
+ * returning the original node unsanitized. See GHSA-4w3q-35jp-p934.
6041
+ *
6042
+ * @param value object to check whether it's a DOM node
6043
+ * @return true if value is a DOM node from any realm
6044
+ */
6045
+ const _isNode = function _isNode(value) {
6046
+ if (!getNodeType || typeof value !== 'object' || value === null) {
6047
+ return false;
6048
+ }
6049
+ try {
6050
+ return typeof getNodeType(value) === 'number';
6051
+ } catch (_) {
6052
+ return false;
6053
+ }
6054
+ };
6055
+ function _executeHooks(hooks, currentNode, data) {
6056
+ if (hooks.length === 0) {
6057
+ return;
6058
+ }
6059
+ arrayForEach(hooks, hook => {
6060
+ hook.call(DOMPurify, currentNode, data, CONFIG);
6061
+ });
6062
+ }
6063
+ /**
6064
+ * Structural-threat checks that condemn a node regardless of the
6065
+ * allowlists: mXSS via namespace confusion, risky CSS construction,
6066
+ * processing instructions, markup-bearing comments. Pure predicate;
6067
+ * the caller removes. Check order is load-bearing.
6068
+ *
6069
+ * @param currentNode the node to inspect
6070
+ * @param tagName the node's transformCaseFunc'd tag name
6071
+ * @return true if the node must be removed
6072
+ */
6073
+ const _isUnsafeNode = function _isUnsafeNode(currentNode, tagName) {
6074
+ /* Detect mXSS attempts abusing namespace confusion */
6075
+ if (SAFE_FOR_XML && currentNode.hasChildNodes() && !_isNode(currentNode.firstElementChild) && regExpTest(ELEMENT_MARKUP_PROBE, currentNode.textContent) && regExpTest(ELEMENT_MARKUP_PROBE, currentNode.innerHTML)) {
6076
+ return true;
6077
+ }
6078
+ /* Remove risky CSS construction leading to mXSS */
6079
+ if (SAFE_FOR_XML && currentNode.namespaceURI === HTML_NAMESPACE && tagName === 'style' && _isNode(currentNode.firstElementChild)) {
6080
+ return true;
6081
+ }
6082
+ /* Remove any occurrence of processing instructions */
6083
+ if (currentNode.nodeType === NODE_TYPE.processingInstruction) {
6084
+ return true;
6085
+ }
6086
+ /* Remove any kind of possibly harmful comments */
6087
+ if (SAFE_FOR_XML && currentNode.nodeType === NODE_TYPE.comment && regExpTest(COMMENT_MARKUP_PROBE, currentNode.data)) {
6088
+ return true;
6089
+ }
6090
+ return false;
6091
+ };
6092
+ /**
6093
+ * Handle a node whose tag is forbidden or not allowlisted: keep
6094
+ * allowed custom elements (false return exits _sanitizeElements
6095
+ * early - the namespace and fallback-tag removal checks are
6096
+ * intentionally skipped for kept custom elements), else hoist
6097
+ * content per KEEP_CONTENT and remove.
6098
+ *
6099
+ * A kept custom element is the ONLY case in which this function
6100
+ * returns false, so the caller uses that return value to run the
6101
+ * afterSanitizeElements hook on the kept element and keep the
6102
+ * element-hook lifecycle consistent with normal allowlisted
6103
+ * elements (GHSA-c2j3-45gr-mqc4).
6104
+ *
6105
+ * @param currentNode the disallowed node
6106
+ * @param tagName the node's transformCaseFunc'd tag name
6107
+ * @return true if the node was removed, false if kept
6108
+ */
6109
+ const _sanitizeDisallowedNode = function _sanitizeDisallowedNode(currentNode, tagName) {
6110
+ /* Check if we have a custom element to handle */
6111
+ if (!FORBID_TAGS[tagName] && _isBasicCustomElement(tagName)) {
6112
+ if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)) {
6113
+ return false;
6114
+ }
6115
+ if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(tagName)) {
6116
+ return false;
6117
+ }
6118
+ }
6119
+ /* Keep content except for bad-listed elements.
6120
+ Use the cached prototype getters exclusively — the previous code
6121
+ had `|| currentNode.parentNode` / `|| currentNode.childNodes`
6122
+ fallbacks, but the cached getters always return the canonical
6123
+ value (or null for a real parent-less node), so the fallback
6124
+ path was dead in safe cases and a clobbering surface in unsafe
6125
+ ones. Falsy cached results stay falsy; the `if (childNodes &&
6126
+ parentNode)` check already gates correctly. */
6127
+ if (KEEP_CONTENT && !FORBID_CONTENTS[tagName]) {
6128
+ const parentNode = getParentNode(currentNode);
6129
+ const childNodes = getChildNodes(currentNode);
6130
+ if (childNodes && parentNode) {
6131
+ const childCount = childNodes.length;
6132
+ /* In-place: hoist the *original* children so the iterator visits
6133
+ and sanitises them through the same allowlist pass as every other
6134
+ node. The caller built the tree in the live document, so the
6135
+ originals carry already-queued resource events (`<img onerror>`,
6136
+ `<video>`/`<audio>` error, lazy/`onload`, …); cloning would leave
6137
+ those originals detached but still armed, firing in page scope
6138
+ while the returned tree looked clean. Moving is safe in-place: the
6139
+ root is pre-validated as an allowed tag and so is never the node
6140
+ being removed, which keeps `parentNode` inside the iterator root
6141
+ and the relocated child inside the serialised tree.
6142
+ Otherwise (string / DOM-copy paths): clone. The iterator is rooted
6143
+ at — and the result serialised from — `body`, so a restrictive
6144
+ ALLOWED_TAGS that removes `body` itself must leave its content in
6145
+ place, which only cloning does; and those paths parse into an
6146
+ inert document, so their discarded originals never had a queued
6147
+ event to neutralise.
6148
+ `childNodes` is live; a tail-to-head walk keeps `childNodes[i]`
6149
+ valid whether we move (drops the trailing entry) or clone (leaves
6150
+ the list intact). */
6151
+ for (let i = childCount - 1; i >= 0; --i) {
6152
+ const hoisted = IN_PLACE ? childNodes[i] : cloneNode(childNodes[i], true);
6153
+ parentNode.insertBefore(hoisted, getNextSibling(currentNode));
6154
+ }
6155
+ }
6156
+ }
6157
+ _forceRemove(currentNode);
6158
+ return true;
6159
+ };
6160
+ /**
6161
+ * _sanitizeElements
6162
+ *
6163
+ * @protect nodeName
6164
+ * @protect textContent
6165
+ * @protect removeChild
6166
+ * @param currentNode to check for permission to exist
6167
+ * @return true if node was killed, false if left alive
6168
+ */
6169
+ // eslint-disable-next-line complexity
6170
+ const _sanitizeElements = function _sanitizeElements(currentNode, root) {
6171
+ /* Execute a hook if present */
6172
+ _executeHooks(hooks.beforeSanitizeElements, currentNode, null);
6173
+ /* A hook may have detached the node — treat it as removed (see the
6174
+ detached-node comment after the uponSanitizeElement hook below). */
6175
+ if (currentNode !== root && getParentNode(currentNode) === null) {
6176
+ return true;
6177
+ }
6178
+ /* Check if element is clobbered or can clobber */
6179
+ if (_isClobbered(currentNode)) {
6180
+ _forceRemove(currentNode);
6181
+ return true;
6182
+ }
6183
+ /* Now let's check the element's type and name */
6184
+ const tagName = transformCaseFunc(getNodeName ? getNodeName(currentNode) : currentNode.nodeName);
6185
+ /* Execute a hook if present */
6186
+ _executeHooks(hooks.uponSanitizeElement, currentNode, {
6187
+ tagName,
6188
+ allowedTags: ALLOWED_TAGS
6189
+ });
6190
+ /* A hook may have detached the node from the tree — a long-standing
6191
+ user pattern (issue #469; draw.io-style foreignObject filtering).
6192
+ Per the cached, unclobberable parentNode getter the node is
6193
+ genuinely out of the tree, so it can reach neither the serialized
6194
+ output nor an IN_PLACE live tree; treat it as removed and stop
6195
+ processing it. Without this guard, the unsafe-node / namespace
6196
+ checks below would call _forceRemove on a parentless node and hit
6197
+ the REPORT-3 fail-closed throw — which exists for nodes DOMPurify
6198
+ wants gone but *cannot* detach (clobbered / parentless roots), the
6199
+ opposite of a node that is already safely gone. The walk root is
6200
+ exempt: a detached IN_PLACE root is legitimate input and must still
6201
+ be fully sanitized, and a kill-decision on it must keep hitting the
6202
+ REPORT-3 throw. Nodes detached by hooks are the hook's
6203
+ responsibility: they are not recorded in DOMPurify.removed and are
6204
+ not neutralized by the post-walk IN_PLACE pass. */
6205
+ if (currentNode !== root && getParentNode(currentNode) === null) {
6206
+ return true;
6207
+ }
6208
+ /* Remove mXSS vectors, processing instructions and risky comments */
6209
+ if (_isUnsafeNode(currentNode, tagName)) {
6210
+ _forceRemove(currentNode);
6211
+ return true;
6212
+ }
6213
+ /* Remove element if anything forbids its presence */
6214
+ if (FORBID_TAGS[tagName] || !(EXTRA_ELEMENT_HANDLING.tagCheck instanceof Function && EXTRA_ELEMENT_HANDLING.tagCheck(tagName)) && !ALLOWED_TAGS[tagName]) {
6215
+ const removed = _sanitizeDisallowedNode(currentNode, tagName);
6216
+ /* A false return means the node is a custom element kept via
6217
+ CUSTOM_ELEMENT_HANDLING - the only keep path through
6218
+ _sanitizeDisallowedNode. Run afterSanitizeElements on it so the
6219
+ element-hook lifecycle matches normal allowlisted elements: a
6220
+ security policy applied in this hook (e.g. stripping an attribute
6221
+ from every surviving element) must not silently skip kept custom
6222
+ elements (GHSA-c2j3-45gr-mqc4). This mirrors the normal-element
6223
+ tail below - the hook runs, then the walker's subsequent
6224
+ _sanitizeAttributes pass sanitizes the element's attributes. The
6225
+ deliberately skipped namespace and fallback-tag removal checks stay
6226
+ skipped; they are removal decisions, not the hook contract. */
6227
+ if (removed === false) {
6228
+ _executeHooks(hooks.afterSanitizeElements, currentNode, null);
6229
+ }
6230
+ return removed;
6231
+ }
6232
+ /* Check whether element has a valid namespace.
6233
+ Realm-safe check (GHSA-hpcv-96wg-7vj8): use the cached Node.prototype
6234
+ nodeType getter rather than `instanceof Element`, which is realm-
6235
+ bound and short-circuits to false for any node minted in a different
6236
+ realm — letting a foreign-realm element with a forbidden namespace
6237
+ slip past the namespace check entirely. */
6238
+ const nt = getNodeType ? getNodeType(currentNode) : currentNode.nodeType;
6239
+ if (nt === NODE_TYPE.element && !_checkValidNamespace(currentNode)) {
6240
+ _forceRemove(currentNode);
6241
+ return true;
6242
+ }
6243
+ /* Make sure that older browsers don't get fallback-tag mXSS */
6244
+ if ((tagName === 'noscript' || tagName === 'noembed' || tagName === 'noframes') && regExpTest(FALLBACK_TAG_CLOSE, currentNode.innerHTML)) {
6245
+ _forceRemove(currentNode);
6246
+ return true;
6247
+ }
6248
+ /* Sanitize element content to be template-safe */
6249
+ if (SAFE_FOR_TEMPLATES && currentNode.nodeType === NODE_TYPE.text) {
6250
+ /* Get the element's text content */
6251
+ const content = _stripTemplateExpressions(currentNode.textContent);
6252
+ if (currentNode.textContent !== content) {
6253
+ arrayPush(DOMPurify.removed, {
6254
+ element: currentNode.cloneNode()
6255
+ });
6256
+ currentNode.textContent = content;
6257
+ }
6258
+ }
6259
+ /* Execute a hook if present */
6260
+ _executeHooks(hooks.afterSanitizeElements, currentNode, null);
6261
+ return false;
6262
+ };
6263
+ /**
6264
+ * _isValidAttribute
6265
+ *
6266
+ * @param lcTag Lowercase tag name of containing element.
6267
+ * @param lcName Lowercase attribute name.
6268
+ * @param value Attribute value.
6269
+ * @return Returns true if `value` is valid, otherwise false.
6270
+ */
6271
+ // eslint-disable-next-line complexity
6272
+ const _isValidAttribute = function _isValidAttribute(lcTag, lcName, value) {
6273
+ /* FORBID_ATTR must always win, even if ADD_ATTR predicate would allow it */
6274
+ if (FORBID_ATTR[lcName]) {
6275
+ return false;
6276
+ }
6277
+ /* Reject declarative-partial-updates patch-linkage attributes
6278
+ (https://github.com/WICG/declarative-partial-updates).
6279
+ Empirical note (Chrome 150, verified — see
6280
+ test/declarative-patch-probe-v3.html): expansion is NOT applied after
6281
+ sanitization. For the string path it fires during sanitize()'s own
6282
+ parse, so the walk sees and sanitizes the fully materialized expanded
6283
+ tree — teleports into MathML/SVG integration points included; a
6284
+ weaponized `<template for>`->`<img onerror>` comes back with the handler
6285
+ stripped. For the IN_PLACE path it fires on connection, before the walk.
6286
+ Either way DOMPurify is NOT blind to the patch.
6287
+ This removal is therefore defense-in-depth rather than the sole barrier:
6288
+ it prevents live linkage from surviving into the OUTPUT and re-expanding
6289
+ in the caller's context, and keeps behaviour deterministic if a future
6290
+ engine defers expansion. `for` is legitimate only on <label>/<output>;
6291
+ anywhere else (notably <template for>) it links the element to a patch
6292
+ target and teleports or removes an arbitrary DOM range by id/marker name.
6293
+ `patchsrc` fetches remote markup and is treated as a script-loading
6294
+ mechanism (CSP). Gated on SAFE_FOR_XML so the removal groups with the
6295
+ other structural-threat checks and stays overridable, consistent with
6296
+ the rest of the codebase. PI range markers are already removed by
6297
+ _isUnsafeNode. */
6298
+ if (SAFE_FOR_XML && lcName === 'patchsrc') {
6299
+ return false;
6300
+ }
6301
+ if (SAFE_FOR_XML && lcName === 'for' && lcTag !== 'label' && lcTag !== 'output') {
6302
+ return false;
6303
+ }
6304
+ /* Make sure attribute cannot clobber */
6305
+ if (SANITIZE_DOM && (lcName === 'id' || lcName === 'name') && (value in document || value in formElement)) {
6306
+ return false;
6307
+ }
6308
+ const nameIsPermitted = ALLOWED_ATTR[lcName] || EXTRA_ELEMENT_HANDLING.attributeCheck instanceof Function && EXTRA_ELEMENT_HANDLING.attributeCheck(lcName, lcTag);
6309
+ /* Allow valid data-* attributes: At least one character after "-"
6310
+ (https://html.spec.whatwg.org/multipage/dom.html#embedding-custom-non-visible-data-with-the-data-*-attributes)
6311
+ XML-compatible (https://html.spec.whatwg.org/multipage/infrastructure.html#xml-compatible and http://www.w3.org/TR/xml/#d0e804)
6312
+ We don't need to check the value; it's always URI safe. */
6313
+ if (ALLOW_DATA_ATTR && regExpTest(DATA_ATTR$1, lcName)) ; else if (ALLOW_ARIA_ATTR && regExpTest(ARIA_ATTR$1, lcName)) ; else if (!nameIsPermitted) {
6314
+ if (
6315
+ // First condition does a very basic check if a) it's basically a valid custom element tagname AND
6316
+ // b) if the tagName passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
6317
+ // and c) if the attribute name passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.attributeNameCheck
6318
+ _isBasicCustomElement(lcTag) && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, lcTag) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(lcTag)) && (CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.attributeNameCheck, lcName) || CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.attributeNameCheck(lcName, lcTag)) ||
6319
+ // Alternative, second condition checks if it's an `is`-attribute, AND
6320
+ // the value passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
6321
+ lcName === 'is' && CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, value) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(value))) ; else {
6322
+ return false;
6323
+ }
6324
+ /* Check value is safe. First, is attr inert? If so, is safe */
6325
+ } else if (URI_SAFE_ATTRIBUTES[lcName]) ; else if (regExpTest(IS_ALLOWED_URI$1, stringReplace(value, ATTR_WHITESPACE$1, ''))) ; else if ((lcName === 'src' || lcName === 'xlink:href' || lcName === 'href') && lcTag !== 'script' && stringIndexOf(value, 'data:') === 0 && DATA_URI_TAGS[lcTag]) ; else if (ALLOW_UNKNOWN_PROTOCOLS && !regExpTest(IS_SCRIPT_OR_DATA$1, stringReplace(value, ATTR_WHITESPACE$1, ''))) ; else if (value) {
6326
+ return false;
6327
+ } else ;
6328
+ return true;
6329
+ };
6330
+ /* Names the HTML spec reserves from valid-custom-element-name; these must
6331
+ * never be treated as basic custom elements even when a permissive
6332
+ * CUSTOM_ELEMENT_HANDLING.tagNameCheck is configured. */
6333
+ const RESERVED_CUSTOM_ELEMENT_NAMES = addToSet({}, ['annotation-xml', 'color-profile', 'font-face', 'font-face-format', 'font-face-name', 'font-face-src', 'font-face-uri', 'missing-glyph']);
6334
+ /**
6335
+ * _isBasicCustomElement
6336
+ * checks if at least one dash is included in tagName, and it's not the first char
6337
+ * for more sophisticated checking see https://github.com/sindresorhus/validate-element-name
6338
+ *
6339
+ * @param tagName name of the tag of the node to sanitize
6340
+ * @returns Returns true if the tag name meets the basic criteria for a custom element, otherwise false.
6341
+ */
6342
+ const _isBasicCustomElement = function _isBasicCustomElement(tagName) {
6343
+ return !RESERVED_CUSTOM_ELEMENT_NAMES[stringToLowerCase(tagName)] && regExpTest(CUSTOM_ELEMENT$1, tagName);
6344
+ };
6345
+ /**
6346
+ * Wrap an attribute value in the matching Trusted Types object when
6347
+ * the active policy requires it. Namespaced attributes pass through
6348
+ * unchanged (no TT support yet, see
6349
+ * https://bugs.chromium.org/p/chromium/issues/detail?id=1305293).
6350
+ *
6351
+ * @param lcTag lowercase tag name of the containing element
6352
+ * @param lcName lowercase attribute name
6353
+ * @param namespaceURI the attribute's namespace, if any
6354
+ * @param value the attribute value to wrap
6355
+ * @return the value, wrapped when Trusted Types demand it
6356
+ */
6357
+ const _applyTrustedTypesToAttribute = function _applyTrustedTypesToAttribute(lcTag, lcName, namespaceURI, value) {
6358
+ if (trustedTypesPolicy && typeof trustedTypes === 'object' && typeof trustedTypes.getAttributeType === 'function' && !namespaceURI) {
6359
+ switch (trustedTypes.getAttributeType(lcTag, lcName)) {
6360
+ case 'TrustedHTML':
6361
+ {
6362
+ return _createTrustedHTML(value);
6363
+ }
6364
+ case 'TrustedScriptURL':
6365
+ {
6366
+ return _createTrustedScriptURL(value);
6367
+ }
6368
+ }
6369
+ }
6370
+ return value;
6371
+ };
6372
+ /**
6373
+ * Write a modified attribute value back onto the element. On
6374
+ * success, re-probe for clobbering introduced by the new value and
6375
+ * remove the element when found; otherwise pop the removal entry
6376
+ * recorded by the earlier _removeAttribute (long-standing pairing
6377
+ * with the SANITIZE_NAMED_PROPS path - do not "fix" casually). On
6378
+ * failure, remove the attribute instead.
6379
+ *
6380
+ * @param currentNode the element carrying the attribute
6381
+ * @param name the attribute name as present on the element
6382
+ * @param namespaceURI the attribute's namespace, if any
6383
+ * @param value the new attribute value
6384
+ */
6385
+ const _setAttributeValue = function _setAttributeValue(currentNode, name, namespaceURI, value) {
6386
+ try {
6387
+ if (namespaceURI) {
6388
+ currentNode.setAttributeNS(namespaceURI, name, value);
6389
+ } else {
6390
+ /* Fallback to setAttribute() for browser-unrecognized namespaces e.g. "x-schema". */
6391
+ currentNode.setAttribute(name, value);
6392
+ }
6393
+ if (_isClobbered(currentNode)) {
6394
+ _forceRemove(currentNode);
6395
+ } else {
6396
+ arrayPop(DOMPurify.removed);
6397
+ }
6398
+ } catch (_) {
6399
+ _removeAttribute(name, currentNode);
6400
+ }
6401
+ };
6402
+ /**
6403
+ * _sanitizeAttributes
6404
+ *
6405
+ * @protect attributes
6406
+ * @protect nodeName
6407
+ * @protect removeAttribute
6408
+ * @protect setAttribute
6409
+ *
6410
+ * @param currentNode to sanitize
6411
+ */
6412
+ const _sanitizeAttributes = function _sanitizeAttributes(currentNode) {
6413
+ /* Execute a hook if present */
6414
+ _executeHooks(hooks.beforeSanitizeAttributes, currentNode, null);
6415
+ const attributes = currentNode.attributes;
6416
+ /* Check if we have attributes; if not we might have a text node */
6417
+ if (!attributes || _isClobbered(currentNode)) {
6418
+ return;
6419
+ }
6420
+ const hookEvent = {
6421
+ attrName: '',
6422
+ attrValue: '',
6423
+ keepAttr: true,
6424
+ allowedAttributes: ALLOWED_ATTR,
6425
+ forceKeepAttr: undefined
6426
+ };
6427
+ let l = attributes.length;
6428
+ const lcTag = transformCaseFunc(currentNode.nodeName);
6429
+ /* Go backwards over all attributes; safely remove bad ones */
6430
+ while (l--) {
6431
+ const attr = attributes[l];
6432
+ const name = attr.name,
6433
+ namespaceURI = attr.namespaceURI,
6434
+ attrValue = attr.value;
6435
+ const lcName = transformCaseFunc(name);
6436
+ const initValue = attrValue;
6437
+ let value = name === 'value' ? initValue : stringTrim(initValue);
6438
+ /* Execute a hook if present */
6439
+ hookEvent.attrName = lcName;
6440
+ hookEvent.attrValue = value;
6441
+ hookEvent.keepAttr = true;
6442
+ hookEvent.forceKeepAttr = undefined; // Allows developers to see this is a property they can set
6443
+ _executeHooks(hooks.uponSanitizeAttribute, currentNode, hookEvent);
6444
+ value = hookEvent.attrValue;
6445
+ /* Full DOM Clobbering protection via namespace isolation,
6446
+ * Prefix id and name attributes with `user-content-`
6447
+ */
6448
+ if (SANITIZE_NAMED_PROPS && (lcName === 'id' || lcName === 'name') && stringIndexOf(value, SANITIZE_NAMED_PROPS_PREFIX) !== 0) {
6449
+ // Remove the attribute with this value
6450
+ _removeAttribute(name, currentNode);
6451
+ // Prefix the value and later re-create the attribute with the sanitized value
6452
+ value = SANITIZE_NAMED_PROPS_PREFIX + value;
6453
+ }
6454
+ // Else: already prefixed, leave the attribute alone — the prefix is
6455
+ // itself the clobbering protection, and re-applying it is incorrect.
6456
+ /* Work around a security issue with comments inside attributes */
6457
+ if (SAFE_FOR_XML && regExpTest(/((--!?|])>)|<\/(style|script|title|xmp|textarea|noscript|iframe|noembed|noframes)/i, value)) {
6458
+ _removeAttribute(name, currentNode);
6459
+ continue;
6460
+ }
6461
+ /* Make sure we cannot easily use animated hrefs, even if animations are allowed */
6462
+ if (lcName === 'attributename' && stringMatch(value, 'href')) {
6463
+ _removeAttribute(name, currentNode);
6464
+ continue;
6465
+ }
6466
+ /* Did the hooks force-keep the attribute? */
6467
+ if (hookEvent.forceKeepAttr) {
6468
+ continue;
6469
+ }
6470
+ /* Did the hooks approve of the attribute? */
6471
+ if (!hookEvent.keepAttr) {
6472
+ _removeAttribute(name, currentNode);
6473
+ continue;
6474
+ }
6475
+ /* Work around a security issue in jQuery 3.0 */
6476
+ if (!ALLOW_SELF_CLOSE_IN_ATTR && regExpTest(SELF_CLOSING_TAG, value)) {
6477
+ _removeAttribute(name, currentNode);
6478
+ continue;
6479
+ }
6480
+ /* Sanitize attribute content to be template-safe */
6481
+ if (SAFE_FOR_TEMPLATES) {
6482
+ value = _stripTemplateExpressions(value);
6483
+ }
6484
+ /* Is `value` valid for this attribute? */
6485
+ if (!_isValidAttribute(lcTag, lcName, value)) {
6486
+ _removeAttribute(name, currentNode);
6487
+ continue;
6488
+ }
6489
+ /* Handle attributes that require Trusted Types */
6490
+ value = _applyTrustedTypesToAttribute(lcTag, lcName, namespaceURI, value);
6491
+ /* Handle invalid data-* attribute set by try-catching it */
6492
+ if (value !== initValue) {
6493
+ _setAttributeValue(currentNode, name, namespaceURI, value);
6494
+ }
6495
+ }
6496
+ /* Execute a hook if present */
6497
+ _executeHooks(hooks.afterSanitizeAttributes, currentNode, null);
6498
+ };
6499
+ /**
6500
+ * _sanitizeShadowDOM
6501
+ *
6502
+ * @param fragment to iterate over recursively
6503
+ */
6504
+ const _sanitizeShadowDOM2 = function _sanitizeShadowDOM(fragment) {
6505
+ let shadowNode = null;
6506
+ const shadowIterator = _createNodeIterator(fragment);
6507
+ /* Execute a hook if present */
6508
+ _executeHooks(hooks.beforeSanitizeShadowDOM, fragment, null);
6509
+ while (shadowNode = shadowIterator.nextNode()) {
6510
+ /* Execute a hook if present */
6511
+ _executeHooks(hooks.uponSanitizeShadowNode, shadowNode, null);
6512
+ /* Sanitize tags and elements */
6513
+ _sanitizeElements(shadowNode, fragment);
6514
+ /* Check attributes next */
6515
+ _sanitizeAttributes(shadowNode);
6516
+ /* Deep shadow DOM detected.
6517
+ Realm-safe check (GHSA-hpcv-96wg-7vj8): use nodeType against the
6518
+ DOCUMENT_FRAGMENT_NODE constant rather than instanceof, so we
6519
+ recurse into <template>.content from foreign realms too. */
6520
+ if (_isDocumentFragment(shadowNode.content)) {
6521
+ _sanitizeShadowDOM2(shadowNode.content);
6522
+ }
6523
+ /* An element iterated here may itself host an attached
6524
+ shadow root. The default NodeIterator does not enter shadow
6525
+ trees, so a shadow root nested inside template.content was
6526
+ previously reached by no walk at all (the pre-pass at
6527
+ _sanitizeAttachedShadowRoots descends via childNodes, which
6528
+ doesn't enter template.content; the template-content recursion
6529
+ above iterates the content but never inspected shadowRoot).
6530
+ Walk it explicitly. The nodeType guard avoids reading
6531
+ shadowRoot off text / comment / CDATA / PI nodes that the
6532
+ iterator also surfaces. */
6533
+ const shadowNodeType = getNodeType ? getNodeType(shadowNode) : shadowNode.nodeType;
6534
+ if (shadowNodeType === NODE_TYPE.element) {
6535
+ const innerSr = getShadowRoot(shadowNode);
6536
+ if (_isDocumentFragment(innerSr)) {
6537
+ _sanitizeAttachedShadowRoots(innerSr);
6538
+ _sanitizeShadowDOM2(innerSr);
6539
+ }
6540
+ }
6541
+ }
6542
+ /* Execute a hook if present */
6543
+ _executeHooks(hooks.afterSanitizeShadowDOM, fragment, null);
6544
+ };
6545
+ /**
6546
+ * _sanitizeAttachedShadowRoots
6547
+ *
6548
+ * Walks `root` and feeds every attached shadow root we encounter into
6549
+ * the existing _sanitizeShadowDOM pipeline. The default node iterator
6550
+ * does not descend into shadow trees, so nodes inside an attached
6551
+ * shadow root would otherwise be skipped entirely.
6552
+ *
6553
+ * Two real input paths put attached shadow roots in front of us:
6554
+ * 1. IN_PLACE on a DOM node that already has shadow roots attached.
6555
+ * 2. DOM-node input where importNode(dirty, true) deep-clones the
6556
+ * shadow root because it was created with `clonable: true`.
6557
+ *
6558
+ * This pass runs once, up front, so the main iteration loop (and the
6559
+ * existing _sanitizeShadowDOM template-content recursion) stay
6560
+ * untouched — string-input paths are not affected.
6561
+ *
6562
+ * @param root the subtree root to walk for attached shadow roots
6563
+ */
6564
+ const _sanitizeAttachedShadowRoots = function _sanitizeAttachedShadowRoots(root) {
6565
+ /* Iterative (explicit stack) rather than per-child recursion. DOM APIs
6566
+ impose no depth cap, so an attacker-shaped tree (JSON/CRDT/editor data
6567
+ built straight into the DOM — the IN_PLACE surface) deeper than the JS
6568
+ call-stack budget would otherwise overflow native recursion here and
6569
+ throw at the IN_PLACE entry pre-pass, before a single node is
6570
+ sanitized, leaving the caller's live tree untouched (fail-open). See
6571
+ campaign-3 F4. A heap stack keeps depth off the call stack.
6572
+ Each work item is either a node to descend into, or a deferred
6573
+ `_sanitizeShadowDOM` for an already-walked shadow root. The deferred
6574
+ form preserves the original post-order discipline: a shadow root's
6575
+ nested shadow roots are discovered before the outer shadow is
6576
+ sanitized (which may remove hosts). Pushes are in reverse of the
6577
+ desired processing order (LIFO): template content, then children, then
6578
+ the shadow-sanitize, then the shadow walk — so the order matches the
6579
+ previous recursion exactly. */
6580
+ const stack = [{
6581
+ node: root,
6582
+ shadow: null
6583
+ }];
6584
+ while (stack.length > 0) {
6585
+ const item = stack.pop();
6586
+ /* Deferred shadow-DOM sanitisation: runs after its subtree was walked. */
6587
+ if (item.shadow) {
6588
+ _sanitizeShadowDOM2(item.shadow);
6589
+ continue;
6590
+ }
6591
+ const node = item.node;
6592
+ const nodeType = getNodeType ? getNodeType(node) : node.nodeType;
6593
+ const isElement = nodeType === NODE_TYPE.element;
6594
+ /* (pushed last → processed first) Children, snapshotted in reverse so
6595
+ the first child is processed first. Snapshotting matters because a
6596
+ hook may detach siblings mid-walk. */
6597
+ const childNodes = getChildNodes(node);
6598
+ if (childNodes) {
6599
+ for (let i = childNodes.length - 1; i >= 0; --i) {
6600
+ stack.push({
6601
+ node: childNodes[i],
6602
+ shadow: null
6603
+ });
6604
+ }
6605
+ }
6606
+ /* (pushed before children → processed after them, matching the old
6607
+ "template content last" order) When the node is a <template>,
6608
+ descend into its content. */
6609
+ if (isElement) {
6610
+ const rootName = getNodeName ? getNodeName(node) : null;
6611
+ if (typeof rootName === 'string' && transformCaseFunc(rootName) === 'template') {
6612
+ const content = node.content;
6613
+ if (_isDocumentFragment(content)) {
6614
+ stack.push({
6615
+ node: content,
6616
+ shadow: null
6617
+ });
6618
+ }
6619
+ }
6620
+ }
6621
+ /* Shadow root (processed first): walk its subtree, then sanitise it.
6622
+ Realm-safe check (GHSA-hpcv-96wg-7vj8): nodeType-based detection
6623
+ rather than `instanceof DocumentFragment`, which is realm-bound and
6624
+ silently skipped foreign-realm shadow roots (e.g.
6625
+ iframe.contentDocument attachShadow). */
6626
+ if (isElement) {
6627
+ const sr = getShadowRoot(node);
6628
+ if (_isDocumentFragment(sr)) {
6629
+ /* Push the deferred sanitise first so it pops after the shadow
6630
+ walk we push next, i.e. nested shadow roots are discovered
6631
+ before this one is sanitised. */
6632
+ stack.push({
6633
+ node: null,
6634
+ shadow: sr
6635
+ }, {
6636
+ node: sr,
6637
+ shadow: null
6638
+ });
6639
+ }
6640
+ }
6641
+ }
6642
+ };
6643
+ // eslint-disable-next-line complexity
6644
+ DOMPurify.sanitize = function (dirty) {
6645
+ let cfg = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
6646
+ let body = null;
6647
+ let importedNode = null;
6648
+ let currentNode = null;
6649
+ let returnNode = null;
6650
+ /* Make sure we have a string to sanitize.
6651
+ DO NOT return early, as this will return the wrong type if
6652
+ the user has requested a DOM object rather than a string */
6653
+ IS_EMPTY_INPUT = !dirty;
6654
+ if (IS_EMPTY_INPUT) {
6655
+ dirty = '<!-->';
6656
+ }
6657
+ /* Stringify, in case dirty is an object */
6658
+ if (typeof dirty !== 'string' && !_isNode(dirty)) {
6659
+ dirty = stringifyValue(dirty);
6660
+ if (typeof dirty !== 'string') {
6661
+ throw typeErrorCreate('dirty is not a string, aborting');
6662
+ }
6663
+ }
6664
+ /* Return dirty HTML if DOMPurify cannot run */
6665
+ if (!DOMPurify.isSupported) {
6666
+ return dirty;
6667
+ }
6668
+ /* Assign config vars */
6669
+ if (SET_CONFIG) {
6670
+ /* Persistent setConfig() path: _parseConfig is skipped, so the sets are
6671
+ * not re-derived per call. Restore them from the pristine bindings
6672
+ * captured at setConfig() time so a previous call's hook clone (mutated
6673
+ * below) does not carry over. */
6674
+ ALLOWED_TAGS = SET_CONFIG_ALLOWED_TAGS;
6675
+ ALLOWED_ATTR = SET_CONFIG_ALLOWED_ATTR;
6676
+ } else {
6677
+ _parseConfig(cfg);
6678
+ }
6679
+ /* Clone the hook-mutable allowlists before the walk whenever an
6680
+ * uponSanitize* hook is registered. The hook event exposes ALLOWED_TAGS
6681
+ * and ALLOWED_ATTR by reference (as allowedTags / allowedAttributes), so
6682
+ * a hook that widens them would otherwise mutate the shared set
6683
+ * permanently: across later calls and across every element. Cloning per
6684
+ * walk keeps documented in-call widening working while scoping it to the
6685
+ * call. A single guard for both config paths - the per-call path rebinds
6686
+ * the sets in _parseConfig each call, the persistent path restores them
6687
+ * from the captured bindings just above - so the two cannot diverge. */
6688
+ if (hooks.uponSanitizeElement.length > 0 || hooks.uponSanitizeAttribute.length > 0) {
6689
+ ALLOWED_TAGS = clone(ALLOWED_TAGS);
6690
+ }
6691
+ if (hooks.uponSanitizeAttribute.length > 0) {
6692
+ ALLOWED_ATTR = clone(ALLOWED_ATTR);
6693
+ }
6694
+ /* Clean up removed elements */
6695
+ DOMPurify.removed = [];
6696
+ /* Resolve IN_PLACE for this call without mutating persistent config.
6697
+ Writing the IN_PLACE closure variable here leaks under setConfig(),
6698
+ where _parseConfig is skipped on later calls: a single string call would
6699
+ disable in-place mode for every subsequent node call, returning a
6700
+ sanitized copy while leaving the caller's node — which in-place callers
6701
+ keep using and whose return value they ignore — unsanitized. REPORT-2. */
6702
+ const inPlace = IN_PLACE && typeof dirty !== 'string' && _isNode(dirty);
6703
+ if (inPlace) {
6704
+ /* Declarative-partial-updates / streaming pre-pass: sever every patch
6705
+ linkage across the live tree BEFORE the walk, so no patch can fire
6706
+ mid-walk and inject into an already-processed region. Runs first, so
6707
+ it also covers the forbidden/clobbered roots that throw below. */
6708
+ _neutralizePatchLinkage(dirty);
6709
+ /* Do some early pre-sanitization to avoid unsafe root nodes.
6710
+ Read nodeName through the cached prototype getter — a clobbering
6711
+ child named "nodeName" on the form root would otherwise shadow
6712
+ the property and let this check skip the root-allowlist
6713
+ validation entirely. */
6714
+ const nn = getNodeName ? getNodeName(dirty) : dirty.nodeName;
6715
+ if (typeof nn === 'string') {
6716
+ const tagName = transformCaseFunc(nn);
6717
+ if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
6718
+ /* Fail closed on a live root: neutralize handlers/children before
6719
+ throwing, exactly as the mid-walk abort path does. */
6720
+ _neutralizeRoot(dirty);
6721
+ throw typeErrorCreate('root node is forbidden and cannot be sanitized in-place');
6722
+ }
6723
+ }
6724
+ /* Pre-flight the root through _isClobbered. The iterator-driven
6725
+ removal path can not detach a parent-less root: _forceRemove
6726
+ falls through to Element.prototype.remove(), which per spec
6727
+ is a no-op on a node with no parent. A clobbered root would
6728
+ then survive the main loop with its attributes uninspected,
6729
+ because _sanitizeAttributes early-returns on _isClobbered. The
6730
+ result would be an attacker-controlled form, complete with any
6731
+ event-handler attributes the caller passed in, handed back to
6732
+ the application unsanitized. Refuse to sanitize such a root
6733
+ the same way we refuse a forbidden tag. GHSA-r47g-fvhr-h676. */
6734
+ if (_isClobbered(dirty)) {
6735
+ /* Fail closed on a live clobbered root before throwing.
6736
+ _neutralizeRoot's reads are clobber-safe (cached getters); the
6737
+ form's non-clobbered descendants, e.g. an armed <img>, are scrubbed. */
6738
+ _neutralizeRoot(dirty);
6739
+ throw typeErrorCreate('root node is clobbered and cannot be sanitized in-place');
6740
+ }
6741
+ /* Sanitize attached shadow roots before the main iterator runs.
6742
+ The iterator does not descend into shadow trees. Same fail-closed
6743
+ barrier as the main walk (campaign-3 F2): a custom-element reaction
6744
+ inside a shadow root could abort this pre-pass before the walk runs,
6745
+ which would otherwise leave the entire live tree unsanitized. */
6746
+ try {
6747
+ _sanitizeAttachedShadowRoots(dirty);
6748
+ } catch (error) {
6749
+ _neutralizeRoot(dirty);
6750
+ throw error;
6751
+ }
6752
+ } else if (_isNode(dirty)) {
6753
+ /* If dirty is a DOM element, append to an empty document to avoid
6754
+ elements being stripped by the parser */
6755
+ body = _initDocument('<!---->');
6756
+ importedNode = body.ownerDocument.importNode(dirty, true);
6757
+ if (importedNode.nodeType === NODE_TYPE.element && importedNode.nodeName === 'BODY') {
6758
+ /* Node is already a body, use as is */
6759
+ body = importedNode;
6760
+ } else if (importedNode.nodeName === 'HTML') {
6761
+ body = importedNode;
6762
+ } else {
6763
+ // eslint-disable-next-line unicorn/prefer-dom-node-append
6764
+ body.appendChild(importedNode);
6765
+ }
6766
+ /* Clonable shadow roots are deep-cloned by importNode(); sanitize
6767
+ them before the main iterator runs, since the iterator does not
6768
+ descend into shadow trees. The walk routes every read through a
6769
+ cached prototype getter so clobbering descendants on a form root
6770
+ cannot hide a shadow host from this pass. */
6771
+ _sanitizeAttachedShadowRoots(importedNode);
6772
+ } else {
6773
+ /* Exit directly if we have nothing to do */
6774
+ if (!RETURN_DOM && !SAFE_FOR_TEMPLATES && !WHOLE_DOCUMENT &&
6775
+ // eslint-disable-next-line unicorn/prefer-includes
6776
+ dirty.indexOf('<') === -1) {
6777
+ return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? _createTrustedHTML(dirty) : dirty;
6778
+ }
6779
+ /* Initialize the document to work on */
6780
+ body = _initDocument(dirty);
6781
+ /* Check we have a DOM node from the data */
6782
+ if (!body) {
6783
+ return RETURN_DOM ? null : RETURN_TRUSTED_TYPE ? emptyHTML : '';
6784
+ }
6785
+ }
6786
+ /* Remove first element node (ours) if FORCE_BODY is set */
6787
+ if (body && FORCE_BODY) {
6788
+ _forceRemove(body.firstChild);
6789
+ }
6790
+ /* Get node iterator */
6791
+ const walkRoot = inPlace ? dirty : body;
6792
+ const nodeIterator = _createNodeIterator(walkRoot);
6793
+ /* Now start iterating over the created document.
6794
+ The walk runs inside an exception barrier (campaign-3 F2): a re-entrant
6795
+ engine/custom-element mutation can detach a node mid-walk so
6796
+ `_forceRemove`'s parentless guard throws, aborting the loop. Without the
6797
+ barrier the caller's in-place tree would be left half-sanitized with the
6798
+ unvisited tail still armed. On any throw we fail closed — strip the
6799
+ in-place root bare — then rethrow so the existing throw contract is
6800
+ preserved. (String/DOM-copy paths never return the partial body, so the
6801
+ propagating throw is already fail-closed there.) */
6802
+ try {
6803
+ while (currentNode = nodeIterator.nextNode()) {
6804
+ /* Sanitize tags and elements */
6805
+ _sanitizeElements(currentNode, walkRoot);
6806
+ /* Check attributes next */
6807
+ _sanitizeAttributes(currentNode);
6808
+ /* Shadow DOM detected, sanitize it.
6809
+ Realm-safe check (GHSA-hpcv-96wg-7vj8): nodeType-based detection
6810
+ instead of instanceof, so foreign-realm <template>.content is
6811
+ walked correctly. */
6812
+ if (_isDocumentFragment(currentNode.content)) {
6813
+ _sanitizeShadowDOM2(currentNode.content);
6814
+ }
6815
+ }
6816
+ } catch (error) {
6817
+ if (inPlace) {
6818
+ _neutralizeRoot(dirty);
6819
+ /* Nodes _forceRemove'd earlier in the aborted walk are already
6820
+ detached from the root, so _neutralizeRoot's subtree pass does not
6821
+ reach them. Defuse them too, mirroring the success-path loop below. */
6822
+ arrayForEach(DOMPurify.removed, entry => {
6823
+ if (entry.element) {
6824
+ _neutralizeSubtree(entry.element);
6825
+ }
6826
+ });
6827
+ }
6828
+ throw error;
6829
+ }
6830
+ /* If we sanitized `dirty` in-place, return it. */
6831
+ if (inPlace) {
6832
+ /* Fail-closed completion of the audit-5 F1 fix: every node removed from
6833
+ the caller's live tree is detached but may still hold a queued
6834
+ resource-event handler that fires in page scope after we return. The
6835
+ move-hoist covers only disallowed-tag KEEP_CONTENT removals; strip the
6836
+ non-allow-listed attributes off every other removed subtree (clobber,
6837
+ mXSS, namespace, comments, KEEP_CONTENT:false, …) so those handlers are
6838
+ cancelled before any event can fire. Runs synchronously, pre-return. */
6839
+ arrayForEach(DOMPurify.removed, entry => {
6840
+ if (entry.element) {
6841
+ _neutralizeSubtree(entry.element);
6842
+ }
6843
+ });
6844
+ if (SAFE_FOR_TEMPLATES) {
6845
+ _scrubTemplateExpressions2(dirty);
6846
+ }
6847
+ return dirty;
6848
+ }
6849
+ /* Return sanitized string or DOM */
6850
+ if (RETURN_DOM) {
6851
+ if (SAFE_FOR_TEMPLATES) {
6852
+ _scrubTemplateExpressions2(body);
6853
+ }
6854
+ if (RETURN_DOM_FRAGMENT) {
6855
+ returnNode = createDocumentFragment.call(body.ownerDocument);
6856
+ while (body.firstChild) {
6857
+ // eslint-disable-next-line unicorn/prefer-dom-node-append
6858
+ returnNode.appendChild(body.firstChild);
6859
+ }
6860
+ } else {
6861
+ returnNode = body;
6862
+ }
6863
+ if (ALLOWED_ATTR.shadowroot || ALLOWED_ATTR.shadowrootmode) {
6864
+ /*
6865
+ AdoptNode() is not used because internal state is not reset
6866
+ (e.g. the past names map of a HTMLFormElement), this is safe
6867
+ in theory but we would rather not risk another attack vector.
6868
+ The state that is cloned by importNode() is explicitly defined
6869
+ by the specs.
6870
+ */
6871
+ returnNode = importNode.call(originalDocument, returnNode, true);
6872
+ }
6873
+ return returnNode;
6874
+ }
6875
+ let serializedHTML = WHOLE_DOCUMENT ? body.outerHTML : body.innerHTML;
6876
+ /* Serialize doctype if allowed */
6877
+ if (WHOLE_DOCUMENT && ALLOWED_TAGS['!doctype'] && body.ownerDocument && body.ownerDocument.doctype && body.ownerDocument.doctype.name && regExpTest(DOCTYPE_NAME, body.ownerDocument.doctype.name)) {
6878
+ serializedHTML = '<!DOCTYPE ' + body.ownerDocument.doctype.name + '>\n' + serializedHTML;
6879
+ }
6880
+ /* Sanitize final string template-safe */
6881
+ if (SAFE_FOR_TEMPLATES) {
6882
+ serializedHTML = _stripTemplateExpressions(serializedHTML);
6883
+ }
6884
+ return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? _createTrustedHTML(serializedHTML) : serializedHTML;
6885
+ };
6886
+ DOMPurify.setConfig = function () {
6887
+ let cfg = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
6888
+ _parseConfig(cfg);
6889
+ SET_CONFIG = true;
6890
+ SET_CONFIG_ALLOWED_TAGS = ALLOWED_TAGS;
6891
+ SET_CONFIG_ALLOWED_ATTR = ALLOWED_ATTR;
6892
+ };
6893
+ DOMPurify.clearConfig = function () {
6894
+ CONFIG = null;
6895
+ SET_CONFIG = false;
6896
+ SET_CONFIG_ALLOWED_TAGS = null;
6897
+ SET_CONFIG_ALLOWED_ATTR = null;
6898
+ // Drop any caller-supplied Trusted Types policy so it cannot poison later
6899
+ // `RETURN_TRUSTED_TYPE` output. The internal default policy (cached, and
6900
+ // never recreated — Trusted Types throws on duplicate names) is restored by
6901
+ // the next `_parseConfig`. See GHSA-vxr8-fq34-vvx9.
6902
+ trustedTypesPolicy = defaultTrustedTypesPolicy;
6903
+ emptyHTML = '';
6904
+ };
6905
+ DOMPurify.isValidAttribute = function (tag, attr, value) {
6906
+ /* Initialize shared config vars if necessary. */
6907
+ if (!CONFIG) {
6908
+ _parseConfig({});
6909
+ }
6910
+ const lcTag = transformCaseFunc(tag);
6911
+ const lcName = transformCaseFunc(attr);
6912
+ return _isValidAttribute(lcTag, lcName, value);
6913
+ };
6914
+ DOMPurify.addHook = function (entryPoint, hookFunction) {
6915
+ if (typeof hookFunction !== 'function') {
6916
+ return;
6917
+ }
6918
+ /* Reject unknown entry points. Without this, a non-hook key (e.g.
6919
+ * '__proto__') indexes off the prototype chain rather than a real
6920
+ * hook array, and arrayPush then writes to Object.prototype. Guard
6921
+ * with an own-property check against the known hook names. */
6922
+ if (!objectHasOwnProperty(hooks, entryPoint)) {
6923
+ return;
6924
+ }
6925
+ arrayPush(hooks[entryPoint], hookFunction);
6926
+ };
6927
+ DOMPurify.removeHook = function (entryPoint, hookFunction) {
6928
+ if (!objectHasOwnProperty(hooks, entryPoint)) {
6929
+ return undefined;
6930
+ }
6931
+ if (hookFunction !== undefined) {
6932
+ const index = arrayLastIndexOf(hooks[entryPoint], hookFunction);
6933
+ return index === -1 ? undefined : arraySplice(hooks[entryPoint], index, 1)[0];
6934
+ }
6935
+ return arrayPop(hooks[entryPoint]);
6936
+ };
6937
+ DOMPurify.removeHooks = function (entryPoint) {
6938
+ if (!objectHasOwnProperty(hooks, entryPoint)) {
6939
+ return;
6940
+ }
6941
+ hooks[entryPoint] = [];
6942
+ };
6943
+ DOMPurify.removeAllHooks = function () {
6944
+ hooks = _createHooksMap();
6945
+ };
6946
+ return DOMPurify;
6947
+ }
6948
+ var purify = createDOMPurify();
6949
+
5279
6950
  const mrdTextareaFieldCss = () => `.sc-mrd-textarea-field-h{display:block}.mrd-textarea-field.sc-mrd-textarea-field{display:flex;flex-direction:column;gap:var(--mrd-space-1);width:100%}.mrd-textarea-field__label.sc-mrd-textarea-field{display:block;font-family:var(--mrd-font-family);font-size:var(--mrd-label-font-size);font-weight:var(--mrd-label-font-weight);color:var(--mrd-label-color)}.mrd-textarea-field__label--required.sc-mrd-textarea-field::after{content:" *";color:var(--mrd-color-danger)}.mrd-textarea-field__error.sc-mrd-textarea-field{font-family:var(--mrd-font-family);font-size:var(--mrd-error-font-size);color:var(--mrd-error-color)}.mrd-textarea-field__container.sc-mrd-textarea-field{border:var(--mrd-border-width) solid var(--mrd-border-color);border-radius:var(--mrd-border-radius);overflow:hidden;background-color:var(--mrd-input-bg);transition:border-color var(--mrd-transition), box-shadow var(--mrd-transition)}.mrd-textarea-field__container.sc-mrd-textarea-field:focus-within{border-color:var(--mrd-border-color-focus);box-shadow:var(--mrd-shadow-focus)}.mrd-textarea-field__container--error.sc-mrd-textarea-field{border-color:var(--mrd-border-color-error)}.mrd-textarea-field__container--error.sc-mrd-textarea-field:focus-within{box-shadow:var(--mrd-shadow-focus-error)}.mrd-textarea-field__editor.sc-mrd-textarea-field{min-height:150px;font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-base)}.mrd-textarea-field__editor.sc-mrd-textarea-field .ql-toolbar.sc-mrd-textarea-field{border:none;border-bottom:var(--mrd-border-width) solid var(--mrd-border-color);font-family:var(--mrd-font-family)}.mrd-textarea-field__editor.sc-mrd-textarea-field .ql-container.sc-mrd-textarea-field{border:none;font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-base)}.mrd-textarea-field__editor.sc-mrd-textarea-field .ql-editor.sc-mrd-textarea-field{min-height:120px;padding:var(--mrd-input-padding-y) var(--mrd-input-padding-x)}.mrd-textarea-field__editor.sc-mrd-textarea-field .ql-editor.ql-blank.sc-mrd-textarea-field::before{color:var(--mrd-input-placeholder-color);font-style:normal}`;
5280
6951
 
5281
6952
  const MrdTextareaField = class {
@@ -5321,14 +6992,12 @@ const MrdTextareaField = class {
5321
6992
  quill.clipboard.dangerouslyPasteHTML(this.value);
5322
6993
  }
5323
6994
  quill.on('text-change', () => {
5324
- var _a, _b;
5325
- const html = (_b = (_a = this.editorEl.querySelector('.ql-editor')) === null || _a === void 0 ? void 0 : _a.innerHTML) !== null && _b !== void 0 ? _b : '';
6995
+ const html = this.getSanitizedHtml();
5326
6996
  this.mrdChange.emit({ name: this.name, value: html });
5327
6997
  });
5328
6998
  quill.on('selection-change', (range) => {
5329
- var _a, _b;
5330
6999
  if (!range) {
5331
- const html = (_b = (_a = this.editorEl.querySelector('.ql-editor')) === null || _a === void 0 ? void 0 : _a.innerHTML) !== null && _b !== void 0 ? _b : '';
7000
+ const html = this.getSanitizedHtml();
5332
7001
  this.error = requiredError(html, this.required, this.locale);
5333
7002
  this.mrdBlur.emit({ name: this.name, value: html });
5334
7003
  }
@@ -5339,8 +7008,13 @@ const MrdTextareaField = class {
5339
7008
  console.error('Failed to load Quill editor:', err);
5340
7009
  }
5341
7010
  }
7011
+ getSanitizedHtml() {
7012
+ var _a, _b;
7013
+ const html = (_b = (_a = this.editorEl.querySelector('.ql-editor')) === null || _a === void 0 ? void 0 : _a.innerHTML) !== null && _b !== void 0 ? _b : '';
7014
+ return purify.sanitize(html);
7015
+ }
5342
7016
  render() {
5343
- return (index.h(index.Host, { key: 'de39890fc23146b880e69be7a8f04c91786ae9c9' }, index.h("div", { key: '0ccc855f3ee44553559a9ea8a70690466789f76d', class: "mrd-textarea-field" }, index.h(FieldLabel, { key: '2a16dcbeedbba8b5d8d1e8e8c0f021f14813f609', base: "mrd-textarea-field", label: this.label, required: this.required }), index.h("div", { key: '979ecb0ed163e3f753d75635452eea49d76edf29', class: controlClass('mrd-textarea-field', !!this.error, 'container') }, index.h("div", { key: '8ea96a080086b68df55017a1464f6bce502f9a58', class: "mrd-textarea-field__editor" })), index.h(FieldError, { key: 'd6ac1a12f7be3594ed8cdb6d94b304c46dc8285b', base: "mrd-textarea-field", error: this.error }))));
7017
+ return (index.h(index.Host, { key: '708c1f8f14d2de4b5a274155d190fc19a304d7f0' }, index.h("div", { key: 'cf5c7a571e74cad08e0e320e91db4e22a3b2e080', class: "mrd-textarea-field" }, index.h(FieldLabel, { key: '4ced05f3914440f89dc5605901fc311e8ad54360', base: "mrd-textarea-field", label: this.label, required: this.required }), index.h("div", { key: '81147829bc575d05f3521bf3704edfdfe0d9b2cf', class: controlClass('mrd-textarea-field', !!this.error, 'container') }, index.h("div", { key: 'a9f42d86cab460d5e0cf6de87e0c0a0a1ca7d77a', class: "mrd-textarea-field__editor" })), index.h(FieldError, { key: '9f4b5271d0901e474ef6c0f1170b3ef718a844a9', base: "mrd-textarea-field", error: this.error }))));
5344
7018
  }
5345
7019
  get el() { return index.getElement(this); }
5346
7020
  };