@mmlogic/components 0.5.1 → 0.5.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (113) hide show
  1. package/dist/cjs/cell-renderer-7KX9Qbml.js +983 -0
  2. package/dist/cjs/{client-layout-RZ3Ix-4a.js → client-layout-CqVuJumR.js} +9 -0
  3. package/dist/cjs/{index-DzRfoAPz.js → index-DVbdkYO3.js} +468 -6
  4. package/dist/cjs/index.cjs.js +4 -1
  5. package/dist/cjs/loader.cjs.js +2 -2
  6. package/dist/cjs/mosterdcomponents.cjs.js +2 -2
  7. package/dist/cjs/{mrd-boolean-field_23.cjs.entry.js → mrd-boolean-field_25.cjs.entry.js} +3017 -951
  8. package/dist/cjs/mrd-merge-view.cjs.entry.js +273 -0
  9. package/dist/collection/collection-manifest.json +3 -0
  10. package/dist/collection/components/documents/mrd-document-view/mrd-document-view.js +7 -8
  11. package/dist/collection/components/email/mrd-email-view/mrd-email-view.css +126 -0
  12. package/dist/collection/components/email/mrd-email-view/mrd-email-view.js +247 -0
  13. package/dist/collection/components/fields/file-upload-common.js +23 -7
  14. package/dist/collection/components/fields/mrd-boolean-field/mrd-boolean-field.js +1 -1
  15. package/dist/collection/components/fields/mrd-currency-field/mrd-currency-field.js +1 -1
  16. package/dist/collection/components/fields/mrd-date-field/mrd-date-field.js +1 -1
  17. package/dist/collection/components/fields/mrd-datetime-field/mrd-datetime-field.js +1 -1
  18. package/dist/collection/components/fields/mrd-email-field/mrd-email-field.js +1 -1
  19. package/dist/collection/components/fields/mrd-file-field/mrd-file-field.css +20 -1
  20. package/dist/collection/components/fields/mrd-file-field/mrd-file-field.js +108 -47
  21. package/dist/collection/components/fields/mrd-image-field/mrd-image-field.css +44 -0
  22. package/dist/collection/components/fields/mrd-image-field/mrd-image-field.js +126 -58
  23. package/dist/collection/components/fields/mrd-longtext-field/mrd-longtext-field.js +1 -1
  24. package/dist/collection/components/fields/mrd-number-field/mrd-number-field.js +1 -1
  25. package/dist/collection/components/fields/mrd-secret-field/mrd-secret-field.js +2 -2
  26. package/dist/collection/components/fields/mrd-text-field/mrd-text-field.js +1 -1
  27. package/dist/collection/components/fields/mrd-textarea-field/mrd-textarea-field.js +9 -5
  28. package/dist/collection/components/fields/mrd-time-field/mrd-time-field.js +1 -1
  29. package/dist/collection/components/form/mrd-field/mrd-field.js +5 -5
  30. package/dist/collection/components/form/mrd-form/mrd-form.js +55 -6
  31. package/dist/collection/components/invoice/mrd-invoice-view/mrd-invoice-view.css +145 -0
  32. package/dist/collection/components/invoice/mrd-invoice-view/mrd-invoice-view.js +281 -0
  33. package/dist/collection/components/layout/mrd-layout-section/field-value.js +5 -1
  34. package/dist/collection/components/layout/mrd-layout-section/mrd-layout-section.css +10 -0
  35. package/dist/collection/components/layout/mrd-layout-section/mrd-layout-section.js +38 -8
  36. package/dist/collection/components/merge/mrd-merge-view/merge-diff.js +99 -0
  37. package/dist/collection/components/merge/mrd-merge-view/merge-parts.js +44 -0
  38. package/dist/collection/components/merge/mrd-merge-view/mrd-merge-view.css +244 -0
  39. package/dist/collection/components/merge/mrd-merge-view/mrd-merge-view.js +397 -0
  40. package/dist/collection/dev/api.js +41 -2
  41. package/dist/collection/dev/app.js +135 -17
  42. package/dist/collection/dev/example-data.js +126 -2
  43. package/dist/collection/types/client-layout.js +6 -0
  44. package/dist/collection/utils/cell-renderer.js +6 -1
  45. package/dist/collection/utils/document-attachments.js +27 -14
  46. package/dist/collection/utils/i18n.js +224 -0
  47. package/dist/components/cell-renderer.js +1 -0
  48. package/dist/components/client-layout.js +1 -1
  49. package/dist/components/document-attachments.js +1 -1
  50. package/dist/components/file-upload-common.js +1 -1
  51. package/dist/components/format.js +1 -1
  52. package/dist/components/i18n.js +1 -1
  53. package/dist/components/index.js +1 -1
  54. package/dist/components/mrd-boolean-field2.js +1 -1
  55. package/dist/components/mrd-currency-field2.js +1 -1
  56. package/dist/components/mrd-date-field2.js +1 -1
  57. package/dist/components/mrd-datetime-field2.js +1 -1
  58. package/dist/components/mrd-document-view2.js +1 -1
  59. package/dist/components/mrd-email-field2.js +1 -1
  60. package/dist/components/mrd-email-view.d.ts +11 -0
  61. package/dist/components/mrd-email-view.js +1 -0
  62. package/dist/components/mrd-email-view2.js +1 -0
  63. package/dist/components/mrd-field2.js +1 -1
  64. package/dist/components/mrd-file-field2.js +1 -1
  65. package/dist/components/mrd-form.js +1 -1
  66. package/dist/components/mrd-image-field2.js +1 -1
  67. package/dist/components/mrd-invoice-view.d.ts +11 -0
  68. package/dist/components/mrd-invoice-view.js +1 -0
  69. package/dist/components/mrd-invoice-view2.js +1 -0
  70. package/dist/components/mrd-layout-section.js +1 -1
  71. package/dist/components/mrd-longtext-field2.js +1 -1
  72. package/dist/components/mrd-merge-view.d.ts +11 -0
  73. package/dist/components/mrd-merge-view.js +1 -0
  74. package/dist/components/mrd-number-field2.js +1 -1
  75. package/dist/components/mrd-secret-field2.js +1 -1
  76. package/dist/components/mrd-table2.js +1 -1
  77. package/dist/components/mrd-text-field2.js +1 -1
  78. package/dist/components/mrd-textarea-field2.js +1 -1
  79. package/dist/components/mrd-time-field2.js +1 -1
  80. package/dist/components/purify.es.js +2 -0
  81. package/dist/esm/cell-renderer-DIsNX9D7.js +974 -0
  82. package/dist/esm/{client-layout-DCOAAH92.js → client-layout-Bc42CfJB.js} +7 -1
  83. package/dist/esm/{index-DiSe6vjv.js → index-CDiBvvJU.js} +468 -6
  84. package/dist/esm/index.js +1 -1
  85. package/dist/esm/loader.js +3 -3
  86. package/dist/esm/mosterdcomponents.js +3 -3
  87. package/dist/esm/{mrd-boolean-field_23.entry.js → mrd-boolean-field_25.entry.js} +2949 -885
  88. package/dist/esm/mrd-merge-view.entry.js +271 -0
  89. package/dist/mosterdcomponents/index.esm.js +1 -1
  90. package/dist/mosterdcomponents/mosterdcomponents.esm.js +1 -1
  91. package/dist/mosterdcomponents/p-4e061416.entry.js +1 -0
  92. package/dist/mosterdcomponents/p-910ebfee.entry.js +3 -0
  93. package/dist/mosterdcomponents/{p-DCOAAH92.js → p-Bc42CfJB.js} +1 -1
  94. package/dist/mosterdcomponents/p-CDiBvvJU.js +2 -0
  95. package/dist/mosterdcomponents/p-Ce2QDq0t.js +1 -0
  96. package/dist/types/components/documents/mrd-document-view/mrd-document-view.d.ts +2 -2
  97. package/dist/types/components/email/mrd-email-view/mrd-email-view.d.ts +52 -0
  98. package/dist/types/components/fields/file-upload-common.d.ts +19 -1
  99. package/dist/types/components/fields/mrd-file-field/mrd-file-field.d.ts +24 -10
  100. package/dist/types/components/fields/mrd-image-field/mrd-image-field.d.ts +27 -11
  101. package/dist/types/components/fields/mrd-textarea-field/mrd-textarea-field.d.ts +1 -0
  102. package/dist/types/components/form/mrd-form/mrd-form.d.ts +16 -1
  103. package/dist/types/components/invoice/mrd-invoice-view/mrd-invoice-view.d.ts +60 -0
  104. package/dist/types/components/layout/mrd-layout-section/mrd-layout-section.d.ts +13 -0
  105. package/dist/types/components/merge/mrd-merge-view/merge-diff.d.ts +43 -0
  106. package/dist/types/components/merge/mrd-merge-view/merge-parts.d.ts +37 -0
  107. package/dist/types/components/merge/mrd-merge-view/mrd-merge-view.d.ts +68 -0
  108. package/dist/types/components.d.ts +445 -19
  109. package/dist/types/types/client-layout.d.ts +6 -0
  110. package/dist/types/utils/document-attachments.d.ts +12 -5
  111. package/package.json +2 -1
  112. package/dist/mosterdcomponents/p-DiSe6vjv.js +0 -2
  113. package/dist/mosterdcomponents/p-cdecc698.entry.js +0 -1
@@ -1,5 +1,6 @@
1
- import { r as registerInstance, c as createEvent, h, H as Host, g as getElement, w as writeTask } from './index-DiSe6vjv.js';
2
- import { b as ClientLayoutItemFieldDataType, e as ClientLayoutNavigateBehaviour, a as ClientLayoutItemType, c as ClientLayoutItemRelationDisplayType, d as ClientLayoutItemRelationEditBehavior, r as resolveArchetype, A as ARCHETYPE_DOCUMENT } from './client-layout-DCOAAH92.js';
1
+ import { r as registerInstance, c as createEvent, h, H as Host, g as getElement, w as writeTask } from './index-CDiBvvJU.js';
2
+ import { t, p as parseLocalizedNumber, f as formatDate, a as formatDateTime, b as formatCurrency, C as CellRenderer, c as formatNumber, d as formatPercentage } from './cell-renderer-DIsNX9D7.js';
3
+ import { b as ClientLayoutItemFieldDataType, e as ClientLayoutNavigateBehaviour, a as ClientLayoutItemType, c as ClientLayoutItemRelationDisplayType, d as ClientLayoutItemRelationEditBehavior, r as resolveArchetype, A as ARCHETYPE_DOCUMENT, h as ARCHETYPE_INVOICE_LINE, f as ARCHETYPE_INVOICE, g as ARCHETYPE_EMAIL } from './client-layout-Bc42CfJB.js';
3
4
 
4
5
  const mrdBooleanFieldCss = () => `.sc-mrd-boolean-field-h{display:block}.mrd-boolean-field.sc-mrd-boolean-field{display:flex;align-items:center;width:100%}.mrd-boolean-field__toggle-label.sc-mrd-boolean-field{display:flex;align-items:center;gap:var(--mrd-space-3);cursor:pointer;user-select:none}.mrd-boolean-field__checkbox.sc-mrd-boolean-field{position:absolute;opacity:0;width:0;height:0;pointer-events:none}.mrd-boolean-field__checkbox.sc-mrd-boolean-field:checked+.mrd-boolean-field__toggle.sc-mrd-boolean-field{background-color:var(--mrd-color-primary)}.mrd-boolean-field__checkbox.sc-mrd-boolean-field:checked+.mrd-boolean-field__toggle.sc-mrd-boolean-field::after{transform:translateX(20px)}.mrd-boolean-field__checkbox.sc-mrd-boolean-field:focus+.mrd-boolean-field__toggle.sc-mrd-boolean-field{box-shadow:var(--mrd-shadow-focus)}.mrd-boolean-field__checkbox.sc-mrd-boolean-field:disabled+.mrd-boolean-field__toggle.sc-mrd-boolean-field{opacity:0.5;cursor:not-allowed}.mrd-boolean-field__toggle.sc-mrd-boolean-field{position:relative;display:inline-block;width:44px;height:24px;background-color:var(--mrd-color-neutral-300);border-radius:var(--mrd-border-radius-full);transition:background-color var(--mrd-transition);flex-shrink:0}.mrd-boolean-field__toggle.sc-mrd-boolean-field::after{content:"";position:absolute;top:2px;left:2px;width:20px;height:20px;background-color:var(--mrd-color-white);border-radius:50%;transition:transform var(--mrd-transition);box-shadow:var(--mrd-shadow-sm)}.mrd-boolean-field__text.sc-mrd-boolean-field{font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-base);color:var(--mrd-color-neutral-800)}.mrd-boolean-field__text--required.sc-mrd-boolean-field::after{content:" *";color:var(--mrd-color-danger)}`;
5
6
 
@@ -27,649 +28,11 @@ const MrdBooleanField = class {
27
28
  this.checked = !!this.value;
28
29
  }
29
30
  render() {
30
- return (h(Host, { key: 'c0e92a50b1512d7b7f36f151b34bcb5b9497ca59' }, h("div", { key: 'e3f70c88321d8e72784b81092a9ebc0451ba330d', class: "mrd-boolean-field" }, h("label", { key: '3e6d907b72a5e1da7e268685c67811ebf264d5d8', class: "mrd-boolean-field__toggle-label" }, h("input", { key: '2b6df62a72cba19aa26374a2448c26666e28b03d', class: "mrd-boolean-field__checkbox", type: "checkbox", name: this.name, checked: this.checked, disabled: this.disabled, onChange: this.handleChange, onBlur: this.handleBlur }), h("span", { key: '77cbe5c1a25153de745f5e91eef589f40cb3237d', class: "mrd-boolean-field__toggle", "aria-hidden": "true" }), this.label && (h("span", { key: '34daaa269ed64ed3be71ecfd15d79eb42d746247', class: `mrd-boolean-field__text${this.required ? ' mrd-boolean-field__text--required' : ''}` }, this.label))))));
31
+ return (h(Host, { key: 'd60835bfd40ab3708692991f3c9862dfcbe98191' }, h("div", { key: 'b6ab1893b75f2a826e4bbac11a465e3d2b88f5d7', class: "mrd-boolean-field" }, h("label", { key: '86562c85d903cbf7295e69a11c4c724f0f8beeb5', class: "mrd-boolean-field__toggle-label" }, h("input", { key: '3e92957abb190ff8d0b9c3294c44cb27b81947d0', class: "mrd-boolean-field__checkbox", type: "checkbox", name: this.name, checked: this.checked, disabled: this.disabled, onChange: this.handleChange, onBlur: this.handleBlur }), h("span", { key: 'b632d9da279ebb823120e38540506568bff9ebbb', class: "mrd-boolean-field__toggle", "aria-hidden": "true" }), this.label && (h("span", { key: '9e0eeb0ba9056bf5ae18b893c0566fed2ad2fda2', class: `mrd-boolean-field__text${this.required ? ' mrd-boolean-field__text--required' : ''}` }, this.label))))));
31
32
  }
32
33
  };
33
34
  MrdBooleanField.style = mrdBooleanFieldCss();
34
35
 
35
- function formatNumber(value, locale, options) {
36
- if (value === null || value === undefined || isNaN(value))
37
- return '';
38
- return new Intl.NumberFormat(locale, options).format(value);
39
- }
40
- function formatCurrency(amount, currency, locale) {
41
- if (amount === null || amount === undefined || isNaN(amount))
42
- return '';
43
- return new Intl.NumberFormat(locale, {
44
- style: 'currency',
45
- currency,
46
- minimumFractionDigits: 2,
47
- maximumFractionDigits: 2,
48
- }).format(amount);
49
- }
50
- function formatPercentage(value, locale, decimalPrecision = 2) {
51
- if (value === null || value === undefined || isNaN(value))
52
- return '';
53
- return new Intl.NumberFormat(locale, {
54
- style: 'percent',
55
- minimumFractionDigits: decimalPrecision,
56
- maximumFractionDigits: decimalPrecision,
57
- }).format(value);
58
- }
59
- function formatDate(value, locale) {
60
- if (!value)
61
- return '';
62
- const date = typeof value === 'string' ? new Date(value) : value;
63
- if (isNaN(date.getTime()))
64
- return '';
65
- return new Intl.DateTimeFormat(locale, { year: 'numeric', month: '2-digit', day: '2-digit' }).format(date);
66
- }
67
- function formatDateTime(value, locale) {
68
- if (!value)
69
- return '';
70
- const date = typeof value === 'string' ? new Date(value) : value;
71
- if (isNaN(date.getTime()))
72
- return '';
73
- return new Intl.DateTimeFormat(locale, {
74
- year: 'numeric',
75
- month: '2-digit',
76
- day: '2-digit',
77
- hour: '2-digit',
78
- minute: '2-digit',
79
- }).format(date);
80
- }
81
- function formatTime(value, locale) {
82
- if (!value)
83
- return '';
84
- // value is HH:MM or HH:MM:SS
85
- const [hours, minutes] = value.split(':').map(Number);
86
- const date = new Date();
87
- date.setHours(hours, minutes, 0, 0);
88
- return new Intl.DateTimeFormat(locale, { hour: '2-digit', minute: '2-digit' }).format(date);
89
- }
90
- function parseLocalizedNumber(str, locale) {
91
- var _a, _b, _c, _d;
92
- if (!str || !str.trim())
93
- return null;
94
- // Detect decimal and thousands separators from the locale
95
- const parts = new Intl.NumberFormat(locale).formatToParts(1234567.89);
96
- const groupSep = (_b = (_a = parts.find((p) => p.type === 'group')) === null || _a === void 0 ? void 0 : _a.value) !== null && _b !== void 0 ? _b : ',';
97
- const decimalSep = (_d = (_c = parts.find((p) => p.type === 'decimal')) === null || _c === void 0 ? void 0 : _c.value) !== null && _d !== void 0 ? _d : '.';
98
- // Remove group separators, replace decimal separator with '.'
99
- const normalized = str
100
- .replace(new RegExp(`\\${groupSep}`, 'g'), '')
101
- .replace(new RegExp(`\\${decimalSep}`), '.')
102
- .replace('%', '')
103
- .trim();
104
- const parsed = parseFloat(normalized);
105
- return isNaN(parsed) ? null : parsed;
106
- }
107
-
108
- const translations = {
109
- nl: {
110
- required: 'Dit veld is verplicht',
111
- select_placeholder: 'Selecteer een optie',
112
- search_placeholder: 'Zoeken...',
113
- upload_file: 'Bestand uploaden',
114
- choose_file: 'Bestand kiezen',
115
- clear: 'Wissen',
116
- today: 'Vandaag',
117
- invalid_email: 'Voer een geldig e-mailadres in',
118
- invalid_url: 'Voer een geldige URL in',
119
- invalid_number: 'Voer een geldig getal in',
120
- drop_file_here: 'Sleep bestand hierheen of',
121
- browse: 'bladeren',
122
- file_too_large: 'Bestand is te groot',
123
- invalid_image: 'Selecteer een afbeeldingsbestand',
124
- search_results: 'Zoekresultaten',
125
- no_results: 'Geen resultaten gevonden',
126
- load_failed_retry: 'Laden mislukt — opnieuw proberen',
127
- loading: 'Laden...',
128
- submit: 'Opslaan',
129
- cancel: 'Annuleren',
130
- remove: 'Verwijderen',
131
- add: 'Toevoegen',
132
- yes: 'Ja',
133
- no: 'Nee',
134
- // mrd-table footer
135
- table_of: 'van',
136
- download: 'Downloaden',
137
- // mrd-table toolbar
138
- table_filter: 'Filteren',
139
- table_filter_hide: 'Filter verbergen',
140
- table_filter_active: 'actief',
141
- table_filter_clear_all: 'Alle filters wissen',
142
- table_new_record: 'Nieuw record',
143
- table_export_excel: 'Exporteer naar Excel',
144
- doc_view_switch: 'Weergave wisselen',
145
- doc_view_tree: 'Boomweergave',
146
- doc_view_list: 'Lijstweergave',
147
- // mrd-table filter popup
148
- filter_sorting: 'Sortering',
149
- filter_ascending: 'Oplopend',
150
- filter_descending: 'Aflopend',
151
- filter_section: 'Filter',
152
- filter_apply: 'Toepassen',
153
- filter_clear: 'Wissen',
154
- filter_contains: 'Bevat',
155
- filter_starts_with: 'Begint met',
156
- filter_equals: 'Gelijk aan',
157
- filter_has_value: 'Heeft waarde',
158
- filter_is_empty: 'Is leeg',
159
- filter_is_not_empty: 'Is niet leeg',
160
- filter_exact: 'Exact',
161
- filter_range: 'Bereik',
162
- filter_from: 'Van',
163
- filter_to: 'Tot',
164
- filter_all: 'Alle',
165
- filter_select_all: 'Alles',
166
- filter_select_none: 'Geen',
167
- filter_search_value: 'Zoekwaarde...',
168
- filter_no_support: 'Geen filtering beschikbaar voor dit veldtype.',
169
- // mrd-table textblock
170
- textblock_show_more: 'Meer tonen',
171
- close: 'Sluiten',
172
- // history badge
173
- history_until: 'tot',
174
- history_badge_tooltip: 'Vorige waarden',
175
- hyperlink_name: 'Linktekst (optioneel)',
176
- // mrd-document-list
177
- new_folder: 'Nieuwe folder',
178
- folder_name_placeholder: 'Foldernaam',
179
- folder_no_slash: "Een foldernaam mag geen '/' bevatten",
180
- folder_duplicate: 'Er bestaat al een folder met deze naam',
181
- doc_empty_drop: 'Nog geen documenten — sleep bestanden hierheen',
182
- },
183
- en: {
184
- required: 'This field is required',
185
- select_placeholder: 'Select an option',
186
- search_placeholder: 'Search...',
187
- upload_file: 'Upload file',
188
- choose_file: 'Choose file',
189
- clear: 'Clear',
190
- today: 'Today',
191
- invalid_email: 'Please enter a valid email address',
192
- invalid_url: 'Please enter a valid URL',
193
- invalid_number: 'Please enter a valid number',
194
- drop_file_here: 'Drop file here or',
195
- browse: 'browse',
196
- file_too_large: 'File is too large',
197
- invalid_image: 'Please select an image file',
198
- search_results: 'Search results',
199
- no_results: 'No results found',
200
- load_failed_retry: 'Failed to load — retry',
201
- loading: 'Loading...',
202
- submit: 'Save',
203
- cancel: 'Cancel',
204
- remove: 'Remove',
205
- add: 'Add',
206
- yes: 'Yes',
207
- no: 'No',
208
- // mrd-table footer
209
- table_of: 'of',
210
- download: 'Download',
211
- // mrd-table toolbar
212
- table_filter: 'Filter',
213
- table_filter_hide: 'Hide filter',
214
- table_filter_active: 'active',
215
- table_filter_clear_all: 'Clear all filters',
216
- table_new_record: 'New record',
217
- table_export_excel: 'Export to Excel',
218
- doc_view_switch: 'Switch view',
219
- doc_view_tree: 'Tree view',
220
- doc_view_list: 'List view',
221
- // mrd-table filter popup
222
- filter_sorting: 'Sorting',
223
- filter_ascending: 'Ascending',
224
- filter_descending: 'Descending',
225
- filter_section: 'Filter',
226
- filter_apply: 'Apply',
227
- filter_clear: 'Clear',
228
- filter_contains: 'Contains',
229
- filter_starts_with: 'Starts with',
230
- filter_equals: 'Equals',
231
- filter_has_value: 'Has value',
232
- filter_is_empty: 'Is empty',
233
- filter_is_not_empty: 'Is not empty',
234
- filter_exact: 'Exact',
235
- filter_range: 'Range',
236
- filter_from: 'From',
237
- filter_to: 'To',
238
- filter_all: 'All',
239
- filter_select_all: 'All',
240
- filter_select_none: 'None',
241
- filter_search_value: 'Search value...',
242
- filter_no_support: 'Filtering is not available for this field type.',
243
- // mrd-table textblock
244
- textblock_show_more: 'Show more',
245
- close: 'Close',
246
- // history badge
247
- history_until: 'until',
248
- history_badge_tooltip: 'Previous values',
249
- hyperlink_name: 'Link text (optional)',
250
- // mrd-document-list
251
- new_folder: 'New folder',
252
- folder_name_placeholder: 'Folder name',
253
- folder_no_slash: "A folder name cannot contain '/'",
254
- folder_duplicate: 'A folder with this name already exists',
255
- doc_empty_drop: 'No documents yet — drop files here',
256
- },
257
- ar: {
258
- required: 'هذا الحقل مطلوب',
259
- select_placeholder: 'اختر خياراً',
260
- search_placeholder: 'بحث...',
261
- upload_file: 'رفع ملف',
262
- choose_file: 'اختر ملفاً',
263
- clear: 'مسح',
264
- today: 'اليوم',
265
- invalid_email: 'يرجى إدخال عنوان بريد إلكتروني صحيح',
266
- invalid_url: 'يرجى إدخال رابط صحيح',
267
- invalid_number: 'يرجى إدخال رقم صحيح',
268
- drop_file_here: 'اسحب الملف هنا أو',
269
- browse: 'تصفح',
270
- file_too_large: 'الملف كبير جداً',
271
- invalid_image: 'يرجى اختيار ملف صورة',
272
- search_results: 'نتائج البحث',
273
- no_results: 'لم يتم العثور على نتائج',
274
- load_failed_retry: 'فشل التحميل — إعادة المحاولة',
275
- loading: 'جار التحميل...',
276
- submit: 'حفظ',
277
- cancel: 'إلغاء',
278
- remove: 'إزالة',
279
- add: 'إضافة',
280
- yes: 'نعم',
281
- no: 'لا',
282
- // mrd-table footer
283
- table_of: 'من أصل',
284
- download: 'تنزيل',
285
- // mrd-table toolbar
286
- table_filter: 'تصفية',
287
- table_filter_hide: 'إخفاء التصفية',
288
- table_filter_active: 'نشط',
289
- table_filter_clear_all: 'مسح جميع الفلاتر',
290
- table_new_record: 'سجل جديد',
291
- table_export_excel: 'تصدير إلى Excel',
292
- doc_view_switch: 'تبديل العرض',
293
- doc_view_tree: 'عرض شجري',
294
- doc_view_list: 'عرض القائمة',
295
- // mrd-table filter popup
296
- filter_sorting: 'الترتيب',
297
- filter_ascending: 'تصاعدي',
298
- filter_descending: 'تنازلي',
299
- filter_section: 'تصفية',
300
- filter_apply: 'تطبيق',
301
- filter_clear: 'مسح',
302
- filter_contains: 'يحتوي على',
303
- filter_starts_with: 'يبدأ بـ',
304
- filter_equals: 'يساوي',
305
- filter_has_value: 'له قيمة',
306
- filter_is_empty: 'فارغ',
307
- filter_is_not_empty: 'ليس فارغاً',
308
- filter_exact: 'دقيق',
309
- filter_range: 'نطاق',
310
- filter_from: 'من',
311
- filter_to: 'إلى',
312
- filter_all: 'الكل',
313
- filter_select_all: 'الكل',
314
- filter_select_none: 'لا شيء',
315
- filter_search_value: 'قيمة البحث...',
316
- filter_no_support: 'التصفية غير متاحة لهذا النوع من الحقول.',
317
- // mrd-table textblock
318
- textblock_show_more: 'عرض المزيد',
319
- close: 'إغلاق',
320
- // history badge
321
- history_until: 'حتى',
322
- history_badge_tooltip: 'القيم السابقة',
323
- hyperlink_name: 'نص الرابط (اختياري)',
324
- },
325
- fr: {
326
- required: 'Ce champ est obligatoire',
327
- select_placeholder: 'Sélectionner une option',
328
- search_placeholder: 'Rechercher...',
329
- upload_file: 'Télécharger un fichier',
330
- choose_file: 'Choisir un fichier',
331
- clear: 'Effacer',
332
- today: "Aujourd'hui",
333
- invalid_email: 'Veuillez saisir une adresse e-mail valide',
334
- invalid_url: 'Veuillez saisir une URL valide',
335
- invalid_number: 'Veuillez saisir un nombre valide',
336
- drop_file_here: 'Déposez le fichier ici ou',
337
- browse: 'parcourir',
338
- file_too_large: 'Le fichier est trop volumineux',
339
- invalid_image: 'Veuillez sélectionner un fichier image',
340
- search_results: 'Résultats de recherche',
341
- no_results: 'Aucun résultat trouvé',
342
- load_failed_retry: 'Échec du chargement — réessayer',
343
- loading: 'Chargement...',
344
- submit: 'Enregistrer',
345
- cancel: 'Annuler',
346
- remove: 'Supprimer',
347
- add: 'Ajouter',
348
- yes: 'Oui',
349
- no: 'Non',
350
- // mrd-table footer
351
- table_of: 'sur',
352
- download: 'Télécharger',
353
- // mrd-table toolbar
354
- table_filter: 'Filtrer',
355
- table_filter_hide: 'Masquer le filtre',
356
- table_filter_active: 'actif',
357
- table_filter_clear_all: 'Effacer tous les filtres',
358
- table_new_record: 'Nouvel enregistrement',
359
- table_export_excel: 'Exporter vers Excel',
360
- doc_view_switch: 'Changer de vue',
361
- doc_view_tree: 'Vue arborescente',
362
- doc_view_list: 'Vue liste',
363
- // mrd-table filter popup
364
- filter_sorting: 'Tri',
365
- filter_ascending: 'Croissant',
366
- filter_descending: 'Décroissant',
367
- filter_section: 'Filtre',
368
- filter_apply: 'Appliquer',
369
- filter_clear: 'Effacer',
370
- filter_contains: 'Contient',
371
- filter_starts_with: 'Commence par',
372
- filter_equals: 'Égal à',
373
- filter_has_value: 'A une valeur',
374
- filter_is_empty: 'Est vide',
375
- filter_is_not_empty: "N'est pas vide",
376
- filter_exact: 'Exact',
377
- filter_range: 'Plage',
378
- filter_from: 'De',
379
- filter_to: 'À',
380
- filter_all: 'Tous',
381
- filter_select_all: 'Tous',
382
- filter_select_none: 'Aucun',
383
- filter_search_value: 'Valeur de recherche...',
384
- filter_no_support: "Le filtrage n'est pas disponible pour ce type de champ.",
385
- // mrd-table textblock
386
- textblock_show_more: 'Voir plus',
387
- close: 'Fermer',
388
- // history badge
389
- history_until: "jusqu'au",
390
- history_badge_tooltip: 'Valeurs précédentes',
391
- hyperlink_name: 'Texte du lien (optionnel)',
392
- },
393
- de: {
394
- required: 'Dieses Feld ist erforderlich',
395
- select_placeholder: 'Option auswählen',
396
- search_placeholder: 'Suchen...',
397
- upload_file: 'Datei hochladen',
398
- choose_file: 'Datei auswählen',
399
- clear: 'Löschen',
400
- today: 'Heute',
401
- invalid_email: 'Bitte geben Sie eine gültige E-Mail-Adresse ein',
402
- invalid_url: 'Bitte geben Sie eine gültige URL ein',
403
- invalid_number: 'Bitte geben Sie eine gültige Zahl ein',
404
- drop_file_here: 'Datei hier ablegen oder',
405
- browse: 'durchsuchen',
406
- file_too_large: 'Datei ist zu groß',
407
- invalid_image: 'Bitte eine Bilddatei auswählen',
408
- search_results: 'Suchergebnisse',
409
- no_results: 'Keine Ergebnisse gefunden',
410
- load_failed_retry: 'Laden fehlgeschlagen — erneut versuchen',
411
- loading: 'Laden...',
412
- submit: 'Speichern',
413
- cancel: 'Abbrechen',
414
- remove: 'Entfernen',
415
- add: 'Hinzufügen',
416
- yes: 'Ja',
417
- no: 'Nein',
418
- // mrd-table footer
419
- table_of: 'von',
420
- download: 'Herunterladen',
421
- // mrd-table toolbar
422
- table_filter: 'Filtern',
423
- table_filter_hide: 'Filter ausblenden',
424
- table_filter_active: 'aktiv',
425
- table_filter_clear_all: 'Alle Filter löschen',
426
- table_new_record: 'Neuer Eintrag',
427
- table_export_excel: 'Als Excel exportieren',
428
- doc_view_switch: 'Ansicht wechseln',
429
- doc_view_tree: 'Baumansicht',
430
- doc_view_list: 'Listenansicht',
431
- // mrd-table filter popup
432
- filter_sorting: 'Sortierung',
433
- filter_ascending: 'Aufsteigend',
434
- filter_descending: 'Absteigend',
435
- filter_section: 'Filter',
436
- filter_apply: 'Anwenden',
437
- filter_clear: 'Löschen',
438
- filter_contains: 'Enthält',
439
- filter_starts_with: 'Beginnt mit',
440
- filter_equals: 'Gleich',
441
- filter_has_value: 'Hat Wert',
442
- filter_is_empty: 'Ist leer',
443
- filter_is_not_empty: 'Ist nicht leer',
444
- filter_exact: 'Genau',
445
- filter_range: 'Bereich',
446
- filter_from: 'Von',
447
- filter_to: 'Bis',
448
- filter_all: 'Alle',
449
- filter_select_all: 'Alle',
450
- filter_select_none: 'Keine',
451
- filter_search_value: 'Suchwert...',
452
- filter_no_support: 'Filterung ist für diesen Feldtyp nicht verfügbar.',
453
- // mrd-table textblock
454
- textblock_show_more: 'Mehr anzeigen',
455
- close: 'Schließen',
456
- // history badge
457
- history_until: 'bis',
458
- history_badge_tooltip: 'Vorherige Werte',
459
- hyperlink_name: 'Linktext (optional)',
460
- },
461
- es: {
462
- required: 'Este campo es obligatorio',
463
- select_placeholder: 'Seleccionar una opción',
464
- search_placeholder: 'Buscar...',
465
- upload_file: 'Subir archivo',
466
- choose_file: 'Elegir archivo',
467
- clear: 'Borrar',
468
- today: 'Hoy',
469
- invalid_email: 'Por favor, introduzca una dirección de correo electrónico válida',
470
- invalid_url: 'Por favor, introduzca una URL válida',
471
- invalid_number: 'Por favor, introduzca un número válido',
472
- drop_file_here: 'Suelte el archivo aquí o',
473
- browse: 'explorar',
474
- file_too_large: 'El archivo es demasiado grande',
475
- invalid_image: 'Seleccione un archivo de imagen',
476
- search_results: 'Resultados de búsqueda',
477
- no_results: 'No se encontraron resultados',
478
- load_failed_retry: 'Error al cargar — reintentar',
479
- loading: 'Cargando...',
480
- submit: 'Guardar',
481
- cancel: 'Cancelar',
482
- remove: 'Eliminar',
483
- add: 'Añadir',
484
- yes: 'Sí',
485
- no: 'No',
486
- // mrd-table footer
487
- table_of: 'de',
488
- download: 'Descargar',
489
- // mrd-table toolbar
490
- table_filter: 'Filtrar',
491
- table_filter_hide: 'Ocultar filtro',
492
- table_filter_active: 'activo',
493
- table_filter_clear_all: 'Borrar todos los filtros',
494
- table_new_record: 'Nuevo registro',
495
- table_export_excel: 'Exportar a Excel',
496
- doc_view_switch: 'Cambiar vista',
497
- doc_view_tree: 'Vista de árbol',
498
- doc_view_list: 'Vista de lista',
499
- // mrd-table filter popup
500
- filter_sorting: 'Ordenación',
501
- filter_ascending: 'Ascendente',
502
- filter_descending: 'Descendente',
503
- filter_section: 'Filtro',
504
- filter_apply: 'Aplicar',
505
- filter_clear: 'Borrar',
506
- filter_contains: 'Contiene',
507
- filter_starts_with: 'Empieza por',
508
- filter_equals: 'Igual a',
509
- filter_has_value: 'Tiene valor',
510
- filter_is_empty: 'Está vacío',
511
- filter_is_not_empty: 'No está vacío',
512
- filter_exact: 'Exacto',
513
- filter_range: 'Rango',
514
- filter_from: 'Desde',
515
- filter_to: 'Hasta',
516
- filter_all: 'Todos',
517
- filter_select_all: 'Todos',
518
- filter_select_none: 'Ninguno',
519
- filter_search_value: 'Valor de búsqueda...',
520
- filter_no_support: 'El filtrado no está disponible para este tipo de campo.',
521
- // mrd-table textblock
522
- textblock_show_more: 'Mostrar más',
523
- close: 'Cerrar',
524
- // history badge
525
- history_until: 'hasta',
526
- history_badge_tooltip: 'Valores anteriores',
527
- hyperlink_name: 'Texto del enlace (opcional)',
528
- },
529
- it: {
530
- required: 'Questo campo è obbligatorio',
531
- select_placeholder: "Seleziona un'opzione",
532
- search_placeholder: 'Cerca...',
533
- upload_file: 'Carica file',
534
- choose_file: 'Scegli file',
535
- clear: 'Cancella',
536
- today: 'Oggi',
537
- invalid_email: 'Inserisci un indirizzo email valido',
538
- invalid_url: 'Inserisci un URL valido',
539
- invalid_number: 'Inserisci un numero valido',
540
- drop_file_here: 'Trascina il file qui o',
541
- browse: 'sfoglia',
542
- file_too_large: 'Il file è troppo grande',
543
- invalid_image: 'Seleziona un file immagine',
544
- search_results: 'Risultati della ricerca',
545
- no_results: 'Nessun risultato trovato',
546
- load_failed_retry: 'Caricamento non riuscito — riprova',
547
- loading: 'Caricamento...',
548
- submit: 'Salva',
549
- cancel: 'Annulla',
550
- remove: 'Rimuovi',
551
- add: 'Aggiungi',
552
- yes: 'Sì',
553
- no: 'No',
554
- // mrd-table footer
555
- table_of: 'di',
556
- download: 'Scarica',
557
- // mrd-table toolbar
558
- table_filter: 'Filtra',
559
- table_filter_hide: 'Nascondi filtro',
560
- table_filter_active: 'attivo',
561
- table_filter_clear_all: 'Cancella tutti i filtri',
562
- table_new_record: 'Nuovo record',
563
- table_export_excel: 'Esporta in Excel',
564
- doc_view_switch: 'Cambia vista',
565
- doc_view_tree: 'Vista ad albero',
566
- doc_view_list: 'Vista elenco',
567
- // mrd-table filter popup
568
- filter_sorting: 'Ordinamento',
569
- filter_ascending: 'Crescente',
570
- filter_descending: 'Decrescente',
571
- filter_section: 'Filtro',
572
- filter_apply: 'Applica',
573
- filter_clear: 'Cancella',
574
- filter_contains: 'Contiene',
575
- filter_starts_with: 'Inizia con',
576
- filter_equals: 'Uguale a',
577
- filter_has_value: 'Ha valore',
578
- filter_is_empty: 'È vuoto',
579
- filter_is_not_empty: 'Non è vuoto',
580
- filter_exact: 'Esatto',
581
- filter_range: 'Intervallo',
582
- filter_from: 'Da',
583
- filter_to: 'A',
584
- filter_all: 'Tutti',
585
- filter_select_all: 'Tutti',
586
- filter_select_none: 'Nessuno',
587
- filter_search_value: 'Valore di ricerca...',
588
- filter_no_support: 'Il filtro non è disponibile per questo tipo di campo.',
589
- // mrd-table textblock
590
- textblock_show_more: 'Mostra altro',
591
- close: 'Chiudi',
592
- // history badge
593
- history_until: 'fino a',
594
- history_badge_tooltip: 'Valori precedenti',
595
- hyperlink_name: 'Testo del collegamento (opzionale)',
596
- },
597
- uk: {
598
- required: "Це поле обов'язкове",
599
- select_placeholder: 'Виберіть варіант',
600
- search_placeholder: 'Пошук...',
601
- upload_file: 'Завантажити файл',
602
- choose_file: 'Вибрати файл',
603
- clear: 'Очистити',
604
- today: 'Сьогодні',
605
- invalid_email: 'Будь ласка, введіть дійсну адресу електронної пошти',
606
- invalid_url: 'Будь ласка, введіть дійсну URL-адресу',
607
- invalid_number: 'Будь ласка, введіть дійсне число',
608
- drop_file_here: 'Перетягніть файл сюди або',
609
- browse: 'огляд',
610
- file_too_large: 'Файл занадто великий',
611
- invalid_image: 'Будь ласка, виберіть файл зображення',
612
- search_results: 'Результати пошуку',
613
- no_results: 'Результатів не знайдено',
614
- load_failed_retry: 'Не вдалося завантажити — повторити',
615
- loading: 'Завантаження...',
616
- submit: 'Зберегти',
617
- cancel: 'Скасувати',
618
- remove: 'Видалити',
619
- add: 'Додати',
620
- yes: 'Так',
621
- no: 'Ні',
622
- // mrd-table footer
623
- table_of: 'з',
624
- download: 'Завантажити',
625
- // mrd-table toolbar
626
- table_filter: 'Фільтрувати',
627
- table_filter_hide: 'Сховати фільтр',
628
- table_filter_active: 'активний',
629
- table_filter_clear_all: 'Очистити всі фільтри',
630
- table_new_record: 'Новий запис',
631
- table_export_excel: 'Експортувати до Excel',
632
- doc_view_switch: 'Змінити вигляд',
633
- doc_view_tree: 'Деревоподібний вигляд',
634
- doc_view_list: 'Список',
635
- // mrd-table filter popup
636
- filter_sorting: 'Сортування',
637
- filter_ascending: 'За зростанням',
638
- filter_descending: 'За спаданням',
639
- filter_section: 'Фільтр',
640
- filter_apply: 'Застосувати',
641
- filter_clear: 'Очистити',
642
- filter_contains: 'Містить',
643
- filter_starts_with: 'Починається з',
644
- filter_equals: 'Дорівнює',
645
- filter_has_value: 'Має значення',
646
- filter_is_empty: 'Порожнє',
647
- filter_is_not_empty: 'Не порожнє',
648
- filter_exact: 'Точно',
649
- filter_range: 'Діапазон',
650
- filter_from: 'Від',
651
- filter_to: 'До',
652
- filter_all: 'Всі',
653
- filter_select_all: 'Всі',
654
- filter_select_none: 'Жодного',
655
- filter_search_value: 'Значення для пошуку...',
656
- filter_no_support: 'Фільтрування недоступне для цього типу поля.',
657
- // mrd-table textblock
658
- textblock_show_more: 'Показати більше',
659
- close: 'Закрити',
660
- // history badge
661
- history_until: 'до',
662
- history_badge_tooltip: 'Попередні значення',
663
- hyperlink_name: "Текст посилання (необов'язково)",
664
- },
665
- };
666
- function t(key, locale) {
667
- var _a, _b, _c;
668
- const lang = (locale !== null && locale !== void 0 ? locale : 'en').split('-')[0].toLowerCase();
669
- const dict = (_a = translations[lang]) !== null && _a !== void 0 ? _a : translations['en'];
670
- return (_c = (_b = dict[key]) !== null && _b !== void 0 ? _b : translations['en'][key]) !== null && _c !== void 0 ? _c : key;
671
- }
672
-
673
36
  function validateRequired(value) {
674
37
  if (value === null || value === undefined)
675
38
  return false;
@@ -781,7 +144,7 @@ const MrdCurrencyField = class {
781
144
  }
782
145
  render() {
783
146
  const hasError = !!this.error;
784
- return (h(Host, { key: '7265395c3b93c3b4daf4c4221da13e01b2fed2e8' }, h("div", { key: 'e644b67a7aba6e8f5b7175f5f79a4bf5e99cb611', class: "mrd-currency-field" }, h(FieldLabel, { key: 'd47a215c0684aea8a3253ae6edc4628d20733d90', base: "mrd-currency-field", label: this.label, required: this.required }), h("div", { key: 'b8f67f8188ad9cd8ba2b6869fcb2b4cd413dec32', class: "mrd-currency-field__row" }, h("input", { key: '8d643424d8932d11ceea0435353c54bc9399c187', class: controlClass('mrd-currency-field', hasError, 'amount'), type: "text", inputMode: "decimal", name: `${this.name}_amount`, value: this.amountDisplay, placeholder: "0.00", required: this.required, disabled: this.disabled, onInput: this.handleAmountInput, onBlur: this.handleAmountBlur }), h("select", { key: '55b12e960646c2420883df848ae440d45f808300', class: "mrd-currency-field__currency", disabled: this.disabled, onChange: this.handleCurrencyChange }, COMMON_CURRENCIES.map(c => (h("option", { key: c, value: c, selected: c === this.currency }, c))))), h(FieldError, { key: 'd0a6adbb83af8fde047eff22c8efd9bbe1ae638f', base: "mrd-currency-field", error: this.error }))));
147
+ return (h(Host, { key: 'e1a76ab778820c0d781d5ec1549448716d368c1f' }, h("div", { key: '8298720abac7f689fe3e697c3c4410702e6a87f2', class: "mrd-currency-field" }, h(FieldLabel, { key: 'b23782aef9a866f1fb72e152cb91aeae00a975fa', base: "mrd-currency-field", label: this.label, required: this.required }), h("div", { key: '51e5177f9be3c5a6bdf3a5c1187f9261fcc349cf', class: "mrd-currency-field__row" }, h("input", { key: 'c6bda6cc92f3a2a34861d44b6163d417e200a6e4', class: controlClass('mrd-currency-field', hasError, 'amount'), type: "text", inputMode: "decimal", name: `${this.name}_amount`, value: this.amountDisplay, placeholder: "0.00", required: this.required, disabled: this.disabled, onInput: this.handleAmountInput, onBlur: this.handleAmountBlur }), h("select", { key: '29231cfa142d26aa81594609f1bf7bd5168df073', class: "mrd-currency-field__currency", disabled: this.disabled, onChange: this.handleCurrencyChange }, COMMON_CURRENCIES.map(c => (h("option", { key: c, value: c, selected: c === this.currency }, c))))), h(FieldError, { key: 'bea9615466427631f08a6ac8a779ae77695d36e3', base: "mrd-currency-field", error: this.error }))));
785
148
  }
786
149
  };
787
150
  MrdCurrencyField.style = mrdCurrencyFieldCss();
@@ -811,7 +174,7 @@ const MrdDateField = class {
811
174
  };
812
175
  }
813
176
  render() {
814
- return (h(Host, { key: 'c0b9d684c5e0b5e3da785c383472ed5d6c13c39f' }, h("div", { key: '304c9b5c9570a369258f5f6fd0877a01a87d98d5', class: "mrd-date-field" }, h(FieldLabel, { key: '72c5ec21699a314920ea1217aee9a353bc8b4b7e', base: "mrd-date-field", label: this.label, required: this.required }), h("input", { key: 'be18df6c7e5fe89bf00cef38484711a9a685e0dc', class: controlClass('mrd-date-field', !!this.error), type: "date", name: this.name, value: this.value, required: this.required, disabled: this.disabled, onChange: this.handleChange, onBlur: this.handleBlur }), h(FieldError, { key: 'f16ffb7e14f9ac9af4a34a96361a25dd4d738d68', base: "mrd-date-field", error: this.error }))));
177
+ return (h(Host, { key: 'd83beef11c2b9402e251a50885b92e7a057f02ee' }, h("div", { key: '6a26e4969e9bde8c5c87771d7b8c7b4d6c1dd942', class: "mrd-date-field" }, h(FieldLabel, { key: 'a7bc1b1c56e933a51f6b1b1feb794a4678d9d334', base: "mrd-date-field", label: this.label, required: this.required }), h("input", { key: '82e3855654f3b3c554f80d647e783234cca8dae1', class: controlClass('mrd-date-field', !!this.error), type: "date", name: this.name, value: this.value, required: this.required, disabled: this.disabled, onChange: this.handleChange, onBlur: this.handleBlur }), h(FieldError, { key: '294b3cdc1004725267aa8265366f5009ab324203', base: "mrd-date-field", error: this.error }))));
815
178
  }
816
179
  };
817
180
  MrdDateField.style = mrdDateFieldCss();
@@ -868,7 +231,7 @@ const MrdDatetimeField = class {
868
231
  return d.toISOString().replace(/\.\d{3}Z$/, 'Z');
869
232
  }
870
233
  render() {
871
- return (h(Host, { key: '0ee285553f3d5e1a9984619795543d67d581c76f' }, h("div", { key: '2c93dffe3701da9099f4b34a9d7c1d0619fa824e', class: "mrd-datetime-field" }, h(FieldLabel, { key: 'ebda087fdcb2a956933758e6250a8e4dc0484ef9', base: "mrd-datetime-field", label: this.label, required: this.required }), h("input", { key: '06b012fc78c76e3b08ef24af5e134aa691975285', class: controlClass('mrd-datetime-field', !!this.error), type: "datetime-local", name: this.name, value: this.localValue, required: this.required, disabled: this.disabled, onChange: this.handleChange, onBlur: this.handleBlur }), h(FieldError, { key: '54e7acdd051c00893eb17cbf4911917fceddb54f', base: "mrd-datetime-field", error: this.error }))));
234
+ return (h(Host, { key: '6f8020590ac879992058aa9547b90c11250fa303' }, h("div", { key: '76abff48cae58d156540181a6577729a449bb888', class: "mrd-datetime-field" }, h(FieldLabel, { key: 'a8c3688980347a27d6467987f11a3c4135ac5234', base: "mrd-datetime-field", label: this.label, required: this.required }), h("input", { key: '1bb1aa7536a6a82313f51240030c828028cafd76', class: controlClass('mrd-datetime-field', !!this.error), type: "datetime-local", name: this.name, value: this.localValue, required: this.required, disabled: this.disabled, onChange: this.handleChange, onBlur: this.handleBlur }), h(FieldError, { key: 'c97301640980bf04311751124fc8e87023d59f87', base: "mrd-datetime-field", error: this.error }))));
872
235
  }
873
236
  static get watchers() { return {
874
237
  "value": [{
@@ -879,24 +242,37 @@ const MrdDatetimeField = class {
879
242
  MrdDatetimeField.style = mrdDatetimeFieldCss();
880
243
 
881
244
  /**
882
- * Extract the `commons.document` archetype's file slot from a data record as a
883
- * `DocumentAttachment[]` — empty when the slot is unmapped or has no value.
884
- * Shared by mrd-document-view (on load/data-change) and mrd-document-container
885
- * (row-click prefetch on mrdNavigate), so both report the exact same shape.
245
+ * Extract an archetype's file slot from a data record as a `DocumentAttachment[]` —
246
+ * empty when the slot is unmapped or has no value. `slot` defaults to `'file'` (the
247
+ * commons.document single-file slot); pass `'attachments'` for the multi-file slots
248
+ * on commons.email / commons.invoice. A single-object slot value yields a one-entry
249
+ * array, an array-valued slot yields one entry per item.
250
+ * Shared by mrd-document-view / mrd-invoice-view / mrd-email-view (on load/data-change)
251
+ * and mrd-document-container (row-click prefetch on mrdNavigate), so all report the
252
+ * exact same shape.
886
253
  */
887
- function attachmentsFromRecord(archetype, record) {
888
- var _a, _b, _c, _d;
889
- const field = (_a = archetype === null || archetype === void 0 ? void 0 : archetype.slots) === null || _a === void 0 ? void 0 : _a['file'];
254
+ function attachmentsFromRecord(archetype, record, slot = 'file') {
255
+ var _a;
256
+ const field = (_a = archetype === null || archetype === void 0 ? void 0 : archetype.slots) === null || _a === void 0 ? void 0 : _a[slot];
890
257
  if (!field)
891
258
  return [];
892
- const fileRaw = record === null || record === void 0 ? void 0 : record[field];
893
- if (!fileRaw)
259
+ const raw = record === null || record === void 0 ? void 0 : record[field];
260
+ if (!raw)
894
261
  return [];
895
- return [{
896
- href: fileRaw.href,
897
- fileName: (_b = fileRaw.fileName) !== null && _b !== void 0 ? _b : String(fileRaw),
898
- mimeType: (_d = (_c = fileRaw.mimeType) !== null && _c !== void 0 ? _c : fileRaw.contentType) !== null && _d !== void 0 ? _d : undefined,
899
- }];
262
+ const items = Array.isArray(raw) ? raw : [raw];
263
+ return items.filter(Boolean).map(item => {
264
+ var _a, _b, _c;
265
+ return ({
266
+ href: item.href,
267
+ fileName: (_a = item.fileName) !== null && _a !== void 0 ? _a : String(item),
268
+ mimeType: (_c = (_b = item.mimeType) !== null && _b !== void 0 ? _b : item.contentType) !== null && _c !== void 0 ? _c : undefined,
269
+ });
270
+ });
271
+ }
272
+ /** Dedup key for the componentDidLoad/@Watch('data') "emit mrdAttachments only on
273
+ * change" guard shared by mrd-document-view / mrd-invoice-view / mrd-email-view. */
274
+ function attachmentsKey(attachments) {
275
+ return attachments.map(a => a.href).join('|');
900
276
  }
901
277
 
902
278
  const mrdDocumentContainerCss = () => `.sc-mrd-document-container-h{display:block}.mrd-document-container__toolbar.sc-mrd-document-container{display:flex;align-items:center;justify-content:flex-end;gap:var(--mrd-space-2);padding:var(--mrd-space-2) 0;border-bottom:1px solid var(--mrd-color-neutral-100)}.mrd-document-container__body--tree.sc-mrd-document-container{border:1px solid var(--mrd-border-color);border-radius:var(--mrd-border-radius);overflow:hidden}.mrd-document-container__action.sc-mrd-document-container{display:inline-flex;align-items:center;gap:var(--mrd-space-2);height:1.625rem;padding:0 var(--mrd-space-3);font-size:var(--mrd-font-size-sm);color:var(--mrd-color-neutral-700);background:var(--mrd-color-white);border:1px solid var(--mrd-color-neutral-200);border-radius:var(--mrd-border-radius);cursor:pointer;transition:background var(--mrd-transition-fast), border-color var(--mrd-transition-fast)}.mrd-document-container__action.sc-mrd-document-container svg.sc-mrd-document-container{width:1rem;height:1rem;color:var(--mrd-color-folder)}.mrd-document-container__action.sc-mrd-document-container:hover:not(:disabled){background:var(--mrd-color-neutral-50);border-color:var(--mrd-color-neutral-300)}.mrd-document-container__action.sc-mrd-document-container:disabled{opacity:0.5;cursor:not-allowed}.mrd-document-container__seg.sc-mrd-document-container{display:inline-flex;gap:2px;padding:2px;background:var(--mrd-color-neutral-100);border-radius:var(--mrd-border-radius)}.mrd-document-container__seg-btn.sc-mrd-document-container{width:1.875rem;height:1.625rem;display:grid;place-items:center;border:none;background:none;border-radius:var(--mrd-border-radius-sm);color:var(--mrd-color-neutral-500);cursor:pointer;transition:color var(--mrd-transition-fast), background var(--mrd-transition-fast)}.mrd-document-container__seg-btn.sc-mrd-document-container:hover{color:var(--mrd-color-neutral-800)}.mrd-document-container__seg-btn[aria-pressed=true].sc-mrd-document-container{background:var(--mrd-color-white);color:var(--mrd-color-primary-dark);box-shadow:var(--mrd-shadow-sm)}.mrd-document-container__seg-btn.sc-mrd-document-container svg.sc-mrd-document-container{width:1rem;height:1rem}`;
@@ -1929,9 +1305,9 @@ const MrdDocumentView = class {
1929
1305
  /** The data record from the /data endpoint. Fields keyed by name; relations under `_links`. */
1930
1306
  this.data = {};
1931
1307
  this.locale = navigator.language;
1932
- /** Tracks the href attachments were last emitted for, so componentDidLoad and
1308
+ /** Tracks the key attachments were last emitted for, so componentDidLoad and
1933
1309
  * the data watcher don't emit duplicate events for the same file. */
1934
- this.lastAttachmentHref = null;
1310
+ this.lastAttachmentKey = null;
1935
1311
  }
1936
1312
  componentDidLoad() {
1937
1313
  this.emitAttachmentsIfNeeded();
@@ -1940,12 +1316,11 @@ const MrdDocumentView = class {
1940
1316
  this.emitAttachmentsIfNeeded();
1941
1317
  }
1942
1318
  emitAttachmentsIfNeeded() {
1943
- var _a, _b;
1944
1319
  const attachments = attachmentsFromRecord(this.archetype, this.data);
1945
- const href = (_b = (_a = attachments[0]) === null || _a === void 0 ? void 0 : _a.href) !== null && _b !== void 0 ? _b : null;
1946
- if (href === this.lastAttachmentHref)
1320
+ const key = attachmentsKey(attachments);
1321
+ if (key === this.lastAttachmentKey)
1947
1322
  return;
1948
- this.lastAttachmentHref = href;
1323
+ this.lastAttachmentKey = key;
1949
1324
  this.mrdAttachments.emit({ attachments });
1950
1325
  }
1951
1326
  /** Value of a value-slot: reads data[field] via the slot→field map. */
@@ -1993,7 +1368,7 @@ const MrdDocumentView = class {
1993
1368
  const fileRaw = this.slotValue('file');
1994
1369
  const fileHref = (_a = fileRaw === null || fileRaw === void 0 ? void 0 : fileRaw.href) !== null && _a !== void 0 ? _a : '';
1995
1370
  const fileName = (_b = fileRaw === null || fileRaw === void 0 ? void 0 : fileRaw.fileName) !== null && _b !== void 0 ? _b : (fileRaw ? String(fileRaw) : '');
1996
- return (h(Host, { key: 'd4e8d4a6c5c66677df3d4e80943fc4538d9a2be7' }, h("div", { key: 'c67bb1742590dc3ab3cec959f20dfa9030268411', class: "mrd-document-view" }, h("div", { key: '5da6e15d1f67990a9ee06bc07b717e5fa17a2ee7', class: "mrd-document-view__body" }, h("div", { key: '0fc38933add3fff48096c48d2fb6cd06fb5d1eac', class: "mrd-document-view__meta" }, title && h("h1", { key: 'e9ac8d99f9afae6b64dd7e6bd461c54b92a6ea39', class: "mrd-document-view__title" }, title), date && h("p", { key: '8591d77b300ed3c021cfa64b8e9564dee98199cd', class: "mrd-document-view__date" }, date), this.renderContainer(), fileRaw && this.renderFileMeta(fileName, fileHref), summary && (h("div", { key: '8a6d630afcf187fa86c9bab77d06d93695fd5c9f', class: "mrd-document-view__summary" }, h("div", { key: 'bd98e2cf740d08837accd8d260973d4e51cd24f7', class: "mrd-document-view__summary-body", innerHTML: summary }))))))));
1371
+ return (h(Host, { key: '405890ef9135d4e9f15532dbc669c4d8d1e8b201' }, h("div", { key: 'be60f0867664a0ded6a85b17999ab207f042d8e2', class: "mrd-document-view" }, h("div", { key: 'f0202da7e83a05f782ba70c3cff91049d56c3e04', class: "mrd-document-view__body" }, h("div", { key: '85d5075c6751200ae3840b1d9e4544792ea52b5e', class: "mrd-document-view__meta" }, title && h("h1", { key: '63a4676ef488f2b0cf2347e0aa4e3c728b2d9351', class: "mrd-document-view__title" }, title), date && h("p", { key: '4ff630a9967509f661050ba04eece5ca26773ce2', class: "mrd-document-view__date" }, date), this.renderContainer(), fileRaw && this.renderFileMeta(fileName, fileHref), summary && (h("div", { key: '412e4934755e801e8a6cd10f5d00da82f9b6aa6a', class: "mrd-document-view__summary" }, h("div", { key: 'fc5c1b88cdba2f2398d09b42ede0b4dc556cd0f3', class: "mrd-document-view__summary-body", innerHTML: summary }))))))));
1997
1372
  }
1998
1373
  static get watchers() { return {
1999
1374
  "data": [{
@@ -2030,11 +1405,2521 @@ const MrdEmailField = class {
2030
1405
  };
2031
1406
  }
2032
1407
  render() {
2033
- return (h(Host, { key: 'e113fb3958c06ee4d4e870b6005e07b1793835a1' }, h("div", { key: '9393b859167f1474d944575f464e1523f1dcf469', class: "mrd-email-field" }, h(FieldLabel, { key: '57c134921adb7f941c19d2fa36cce213bc12ae1e', base: "mrd-email-field", label: this.label, required: this.required }), h("input", { key: '67496689526d2fa96a087b00a9436e9de4d69415', class: controlClass('mrd-email-field', !!this.error), type: "email", name: this.name, value: this.value, placeholder: this.placeholder || 'name@example.com', required: this.required, disabled: this.disabled, onInput: this.handleInput, onBlur: this.handleBlur }), h(FieldError, { key: '5a151c2995db77771fe8f98a24c627b0060f655a', base: "mrd-email-field", error: this.error }))));
1408
+ return (h(Host, { key: '3253124dadc7f0b3f120c11f8c35604a2f671b0a' }, h("div", { key: 'db820652452145c30f21b41a65942c0a4c6f45f1', class: "mrd-email-field" }, h(FieldLabel, { key: '8b1c5a84afce9fd18c3f644e5c92f07363e116d4', base: "mrd-email-field", label: this.label, required: this.required }), h("input", { key: 'dc4bada3208aa6cb7585b1872f53605177371493', class: controlClass('mrd-email-field', !!this.error), type: "email", name: this.name, value: this.value, placeholder: this.placeholder || 'name@example.com', required: this.required, disabled: this.disabled, onInput: this.handleInput, onBlur: this.handleBlur }), h(FieldError, { key: 'c44377d1b6a4a4c468b080b23eecd4ba9ca326e1', base: "mrd-email-field", error: this.error }))));
2034
1409
  }
2035
1410
  };
2036
1411
  MrdEmailField.style = mrdEmailFieldCss();
2037
1412
 
1413
+ /*! @license DOMPurify 3.4.12 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.4.12/LICENSE */
1414
+
1415
+ function _arrayLikeToArray(r, a) {
1416
+ (null == a || a > r.length) && (a = r.length);
1417
+ for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e];
1418
+ return n;
1419
+ }
1420
+ function _arrayWithHoles(r) {
1421
+ if (Array.isArray(r)) return r;
1422
+ }
1423
+ function _iterableToArrayLimit(r, l) {
1424
+ var t = null == r ? null : "undefined" != typeof Symbol && r[Symbol.iterator] || r["@@iterator"];
1425
+ if (null != t) {
1426
+ var e,
1427
+ n,
1428
+ i,
1429
+ u,
1430
+ a = [],
1431
+ f = true,
1432
+ o = false;
1433
+ try {
1434
+ if (i = (t = t.call(r)).next, 0 === l) ; else for (; !(f = (e = i.call(t)).done) && (a.push(e.value), a.length !== l); f = true);
1435
+ } catch (r) {
1436
+ o = true, n = r;
1437
+ } finally {
1438
+ try {
1439
+ if (!f && null != t.return && (u = t.return(), Object(u) !== u)) return;
1440
+ } finally {
1441
+ if (o) throw n;
1442
+ }
1443
+ }
1444
+ return a;
1445
+ }
1446
+ }
1447
+ function _nonIterableRest() {
1448
+ throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
1449
+ }
1450
+ function _slicedToArray(r, e) {
1451
+ return _arrayWithHoles(r) || _iterableToArrayLimit(r, e) || _unsupportedIterableToArray(r, e) || _nonIterableRest();
1452
+ }
1453
+ function _unsupportedIterableToArray(r, a) {
1454
+ if (r) {
1455
+ if ("string" == typeof r) return _arrayLikeToArray(r, a);
1456
+ var t = {}.toString.call(r).slice(8, -1);
1457
+ return "Object" === t && r.constructor && (t = r.constructor.name), "Map" === t || "Set" === t ? Array.from(r) : "Arguments" === t || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t) ? _arrayLikeToArray(r, a) : void 0;
1458
+ }
1459
+ }
1460
+
1461
+ const entries = Object.entries,
1462
+ setPrototypeOf = Object.setPrototypeOf,
1463
+ isFrozen = Object.isFrozen,
1464
+ getPrototypeOf = Object.getPrototypeOf,
1465
+ getOwnPropertyDescriptor = Object.getOwnPropertyDescriptor;
1466
+ let freeze = Object.freeze,
1467
+ seal = Object.seal,
1468
+ create = Object.create; // eslint-disable-line import/no-mutable-exports
1469
+ let _ref = typeof Reflect !== 'undefined' && Reflect,
1470
+ apply = _ref.apply,
1471
+ construct = _ref.construct;
1472
+ if (!freeze) {
1473
+ freeze = function freeze(x) {
1474
+ return x;
1475
+ };
1476
+ }
1477
+ if (!seal) {
1478
+ seal = function seal(x) {
1479
+ return x;
1480
+ };
1481
+ }
1482
+ if (!apply) {
1483
+ apply = function apply(func, thisArg) {
1484
+ for (var _len = arguments.length, args = new Array(_len > 2 ? _len - 2 : 0), _key = 2; _key < _len; _key++) {
1485
+ args[_key - 2] = arguments[_key];
1486
+ }
1487
+ return func.apply(thisArg, args);
1488
+ };
1489
+ }
1490
+ if (!construct) {
1491
+ construct = function construct(Func) {
1492
+ for (var _len2 = arguments.length, args = new Array(_len2 > 1 ? _len2 - 1 : 0), _key2 = 1; _key2 < _len2; _key2++) {
1493
+ args[_key2 - 1] = arguments[_key2];
1494
+ }
1495
+ return new Func(...args);
1496
+ };
1497
+ }
1498
+ const arrayForEach = unapply(Array.prototype.forEach);
1499
+ const arrayLastIndexOf = unapply(Array.prototype.lastIndexOf);
1500
+ const arrayPop = unapply(Array.prototype.pop);
1501
+ const arrayPush = unapply(Array.prototype.push);
1502
+ const arraySplice = unapply(Array.prototype.splice);
1503
+ const arrayIsArray = Array.isArray;
1504
+ const stringToLowerCase = unapply(String.prototype.toLowerCase);
1505
+ const stringToString = unapply(String.prototype.toString);
1506
+ const stringMatch = unapply(String.prototype.match);
1507
+ const stringReplace = unapply(String.prototype.replace);
1508
+ const stringIndexOf = unapply(String.prototype.indexOf);
1509
+ const stringTrim = unapply(String.prototype.trim);
1510
+ const numberToString = unapply(Number.prototype.toString);
1511
+ const booleanToString = unapply(Boolean.prototype.toString);
1512
+ const bigintToString = typeof BigInt === 'undefined' ? null : unapply(BigInt.prototype.toString);
1513
+ const symbolToString = typeof Symbol === 'undefined' ? null : unapply(Symbol.prototype.toString);
1514
+ const objectHasOwnProperty = unapply(Object.prototype.hasOwnProperty);
1515
+ const objectToString = unapply(Object.prototype.toString);
1516
+ const regExpTest = unapply(RegExp.prototype.test);
1517
+ const typeErrorCreate = unconstruct(TypeError);
1518
+ /**
1519
+ * Creates a new function that calls the given function with a specified thisArg and arguments.
1520
+ *
1521
+ * @param func - The function to be wrapped and called.
1522
+ * @returns A new function that calls the given function with a specified thisArg and arguments.
1523
+ */
1524
+ function unapply(func) {
1525
+ return function (thisArg) {
1526
+ if (thisArg instanceof RegExp) {
1527
+ thisArg.lastIndex = 0;
1528
+ }
1529
+ for (var _len3 = arguments.length, args = new Array(_len3 > 1 ? _len3 - 1 : 0), _key3 = 1; _key3 < _len3; _key3++) {
1530
+ args[_key3 - 1] = arguments[_key3];
1531
+ }
1532
+ return apply(func, thisArg, args);
1533
+ };
1534
+ }
1535
+ /**
1536
+ * Creates a new function that constructs an instance of the given constructor function with the provided arguments.
1537
+ *
1538
+ * @param func - The constructor function to be wrapped and called.
1539
+ * @returns A new function that constructs an instance of the given constructor function with the provided arguments.
1540
+ */
1541
+ function unconstruct(Func) {
1542
+ return function () {
1543
+ for (var _len4 = arguments.length, args = new Array(_len4), _key4 = 0; _key4 < _len4; _key4++) {
1544
+ args[_key4] = arguments[_key4];
1545
+ }
1546
+ return construct(Func, args);
1547
+ };
1548
+ }
1549
+ /**
1550
+ * Add properties to a lookup table
1551
+ *
1552
+ * @param set - The set to which elements will be added.
1553
+ * @param array - The array containing elements to be added to the set.
1554
+ * @param transformCaseFunc - An optional function to transform the case of each element before adding to the set.
1555
+ * @returns The modified set with added elements.
1556
+ */
1557
+ function addToSet(set, array) {
1558
+ let transformCaseFunc = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : stringToLowerCase;
1559
+ if (setPrototypeOf) {
1560
+ // Make 'in' and truthy checks like Boolean(set.constructor)
1561
+ // independent of any properties defined on Object.prototype.
1562
+ // Prevent prototype setters from intercepting set as a this value.
1563
+ setPrototypeOf(set, null);
1564
+ }
1565
+ if (!arrayIsArray(array)) {
1566
+ return set;
1567
+ }
1568
+ let l = array.length;
1569
+ while (l--) {
1570
+ let element = array[l];
1571
+ if (typeof element === 'string') {
1572
+ const lcElement = transformCaseFunc(element);
1573
+ if (lcElement !== element) {
1574
+ // Config presets (e.g. tags.js, attrs.js) are immutable.
1575
+ if (!isFrozen(array)) {
1576
+ array[l] = lcElement;
1577
+ }
1578
+ element = lcElement;
1579
+ }
1580
+ }
1581
+ set[element] = true;
1582
+ }
1583
+ return set;
1584
+ }
1585
+ /**
1586
+ * Clean up an array to harden against CSPP
1587
+ *
1588
+ * @param array - The array to be cleaned.
1589
+ * @returns The cleaned version of the array
1590
+ */
1591
+ function cleanArray(array) {
1592
+ for (let index = 0; index < array.length; index++) {
1593
+ const isPropertyExist = objectHasOwnProperty(array, index);
1594
+ if (!isPropertyExist) {
1595
+ array[index] = null;
1596
+ }
1597
+ }
1598
+ return array;
1599
+ }
1600
+ /**
1601
+ * Shallow clone an object
1602
+ *
1603
+ * @param object - The object to be cloned.
1604
+ * @returns A new object that copies the original.
1605
+ */
1606
+ function clone(object) {
1607
+ const newObject = create(null);
1608
+ for (const _ref2 of entries(object)) {
1609
+ var _ref3 = _slicedToArray(_ref2, 2);
1610
+ const property = _ref3[0];
1611
+ const value = _ref3[1];
1612
+ const isPropertyExist = objectHasOwnProperty(object, property);
1613
+ if (isPropertyExist) {
1614
+ if (arrayIsArray(value)) {
1615
+ newObject[property] = cleanArray(value);
1616
+ } else if (value && typeof value === 'object' && value.constructor === Object) {
1617
+ newObject[property] = clone(value);
1618
+ } else {
1619
+ newObject[property] = value;
1620
+ }
1621
+ }
1622
+ }
1623
+ return newObject;
1624
+ }
1625
+ /**
1626
+ * Convert non-node values into strings without depending on direct property access.
1627
+ *
1628
+ * @param value - The value to stringify.
1629
+ * @returns A string representation of the provided value.
1630
+ */
1631
+ function stringifyValue(value) {
1632
+ switch (typeof value) {
1633
+ case 'string':
1634
+ {
1635
+ return value;
1636
+ }
1637
+ case 'number':
1638
+ {
1639
+ return numberToString(value);
1640
+ }
1641
+ case 'boolean':
1642
+ {
1643
+ return booleanToString(value);
1644
+ }
1645
+ case 'bigint':
1646
+ {
1647
+ return bigintToString ? bigintToString(value) : '0';
1648
+ }
1649
+ case 'symbol':
1650
+ {
1651
+ return symbolToString ? symbolToString(value) : 'Symbol()';
1652
+ }
1653
+ case 'undefined':
1654
+ {
1655
+ return objectToString(value);
1656
+ }
1657
+ case 'function':
1658
+ case 'object':
1659
+ {
1660
+ if (value === null) {
1661
+ return objectToString(value);
1662
+ }
1663
+ const valueAsRecord = value;
1664
+ const valueToString = lookupGetter(valueAsRecord, 'toString');
1665
+ if (typeof valueToString === 'function') {
1666
+ const stringified = valueToString(valueAsRecord);
1667
+ return typeof stringified === 'string' ? stringified : objectToString(stringified);
1668
+ }
1669
+ return objectToString(value);
1670
+ }
1671
+ default:
1672
+ {
1673
+ return objectToString(value);
1674
+ }
1675
+ }
1676
+ }
1677
+ /**
1678
+ * This method automatically checks if the prop is function or getter and behaves accordingly.
1679
+ *
1680
+ * @param object - The object to look up the getter function in its prototype chain.
1681
+ * @param prop - The property name for which to find the getter function.
1682
+ * @returns The getter function found in the prototype chain or a fallback function.
1683
+ */
1684
+ function lookupGetter(object, prop) {
1685
+ while (object !== null) {
1686
+ const desc = getOwnPropertyDescriptor(object, prop);
1687
+ if (desc) {
1688
+ if (desc.get) {
1689
+ return unapply(desc.get);
1690
+ }
1691
+ if (typeof desc.value === 'function') {
1692
+ return unapply(desc.value);
1693
+ }
1694
+ }
1695
+ object = getPrototypeOf(object);
1696
+ }
1697
+ function fallbackValue() {
1698
+ return null;
1699
+ }
1700
+ return fallbackValue;
1701
+ }
1702
+ function isRegex(value) {
1703
+ try {
1704
+ regExpTest(value, '');
1705
+ return true;
1706
+ } catch (_unused) {
1707
+ return false;
1708
+ }
1709
+ }
1710
+
1711
+ const html$1 = freeze(['a', 'abbr', 'acronym', 'address', 'area', 'article', 'aside', 'audio', 'b', 'bdi', 'bdo', 'big', 'blink', 'blockquote', 'body', 'br', 'button', 'canvas', 'caption', 'center', 'cite', 'code', 'col', 'colgroup', 'content', 'data', 'datalist', 'dd', 'decorator', 'del', 'details', 'dfn', 'dialog', 'dir', 'div', 'dl', 'dt', 'element', 'em', 'fieldset', 'figcaption', 'figure', 'font', 'footer', 'form', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'head', 'header', 'hgroup', 'hr', 'html', 'i', 'img', 'input', 'ins', 'kbd', 'label', 'legend', 'li', 'main', 'map', 'mark', 'marquee', 'menu', 'menuitem', 'meter', 'nav', 'nobr', 'ol', 'optgroup', 'option', 'output', 'p', 'picture', 'pre', 'progress', 'q', 'rp', 'rt', 'ruby', 's', 'samp', 'search', 'section', 'select', 'shadow', 'slot', 'small', 'source', 'spacer', 'span', 'strike', 'strong', 'style', 'sub', 'summary', 'sup', 'table', 'tbody', 'td', 'template', 'textarea', 'tfoot', 'th', 'thead', 'time', 'tr', 'track', 'tt', 'u', 'ul', 'var', 'video', 'wbr']);
1712
+ const svg$1 = freeze(['svg', 'a', 'altglyph', 'altglyphdef', 'altglyphitem', 'animatecolor', 'animatemotion', 'animatetransform', 'circle', 'clippath', 'defs', 'desc', 'ellipse', 'enterkeyhint', 'exportparts', 'filter', 'font', 'g', 'glyph', 'glyphref', 'hkern', 'image', 'inputmode', 'line', 'lineargradient', 'marker', 'mask', 'metadata', 'mpath', 'part', 'path', 'pattern', 'polygon', 'polyline', 'radialgradient', 'rect', 'stop', 'style', 'switch', 'symbol', 'text', 'textpath', 'title', 'tref', 'tspan', 'view', 'vkern']);
1713
+ const svgFilters = freeze(['feBlend', 'feColorMatrix', 'feComponentTransfer', 'feComposite', 'feConvolveMatrix', 'feDiffuseLighting', 'feDisplacementMap', 'feDistantLight', 'feDropShadow', 'feFlood', 'feFuncA', 'feFuncB', 'feFuncG', 'feFuncR', 'feGaussianBlur', 'feImage', 'feMerge', 'feMergeNode', 'feMorphology', 'feOffset', 'fePointLight', 'feSpecularLighting', 'feSpotLight', 'feTile', 'feTurbulence']);
1714
+ // List of SVG elements that are disallowed by default.
1715
+ // We still need to know them so that we can do namespace
1716
+ // checks properly in case one wants to add them to
1717
+ // allow-list.
1718
+ const svgDisallowed = freeze(['animate', 'color-profile', 'cursor', 'discard', 'font-face', 'font-face-format', 'font-face-name', 'font-face-src', 'font-face-uri', 'foreignobject', 'hatch', 'hatchpath', 'mesh', 'meshgradient', 'meshpatch', 'meshrow', 'missing-glyph', 'script', 'set', 'solidcolor', 'unknown', 'use']);
1719
+ const mathMl$1 = freeze(['math', 'menclose', 'merror', 'mfenced', 'mfrac', 'mglyph', 'mi', 'mlabeledtr', 'mmultiscripts', 'mn', 'mo', 'mover', 'mpadded', 'mphantom', 'mroot', 'mrow', 'ms', 'mspace', 'msqrt', 'mstyle', 'msub', 'msup', 'msubsup', 'mtable', 'mtd', 'mtext', 'mtr', 'munder', 'munderover', 'mprescripts']);
1720
+ // Similarly to SVG, we want to know all MathML elements,
1721
+ // even those that we disallow by default.
1722
+ const mathMlDisallowed = freeze(['maction', 'maligngroup', 'malignmark', 'mlongdiv', 'mscarries', 'mscarry', 'msgroup', 'mstack', 'msline', 'msrow', 'semantics', 'annotation', 'annotation-xml', 'mprescripts', 'none']);
1723
+ const text = freeze(['#text']);
1724
+
1725
+ const html = freeze(['accept', 'action', 'align', 'alt', 'autocapitalize', 'autocomplete', 'autopictureinpicture', 'autoplay', 'background', 'bgcolor', 'border', 'capture', 'cellpadding', 'cellspacing', 'checked', 'cite', 'class', 'clear', 'color', 'cols', 'colspan', 'command', 'commandfor', 'controls', 'controlslist', 'coords', 'crossorigin', 'datetime', 'decoding', 'default', 'dir', 'disabled', 'disablepictureinpicture', 'disableremoteplayback', 'download', 'draggable', 'enctype', 'enterkeyhint', 'exportparts', 'face', 'for', 'headers', 'height', 'hidden', 'high', 'href', 'hreflang', 'id', 'inert', 'inputmode', 'integrity', 'ismap', 'kind', 'label', 'lang', 'list', 'loading', 'loop', 'low', 'max', 'maxlength', 'media', 'method', 'min', 'minlength', 'multiple', 'muted', 'name', 'nonce', 'noshade', 'novalidate', 'nowrap', 'open', 'optimum', 'part', 'pattern', 'placeholder', 'playsinline', 'popover', 'popovertarget', 'popovertargetaction', 'poster', 'preload', 'pubdate', 'radiogroup', 'readonly', 'rel', 'required', 'rev', 'reversed', 'role', 'rows', 'rowspan', 'spellcheck', 'scope', 'selected', 'shape', 'size', 'sizes', 'slot', 'span', 'srclang', 'start', 'src', 'srcset', 'step', 'style', 'summary', 'tabindex', 'title', 'translate', 'type', 'usemap', 'valign', 'value', 'width', 'wrap', 'xmlns']);
1726
+ const svg = freeze(['accent-height', 'accumulate', 'additive', 'alignment-baseline', 'amplitude', 'ascent', 'attributename', 'attributetype', 'azimuth', 'basefrequency', 'baseline-shift', 'begin', 'bias', 'by', 'class', 'clip', 'clippathunits', 'clip-path', 'clip-rule', 'color', 'color-interpolation', 'color-interpolation-filters', 'color-profile', 'color-rendering', 'cx', 'cy', 'd', 'dx', 'dy', 'diffuseconstant', 'direction', 'display', 'divisor', 'dominant-baseline', 'dur', 'edgemode', 'elevation', 'end', 'exponent', 'fill', 'fill-opacity', 'fill-rule', 'filter', 'filterunits', 'flood-color', 'flood-opacity', 'font-family', 'font-size', 'font-size-adjust', 'font-stretch', 'font-style', 'font-variant', 'font-weight', 'fx', 'fy', 'g1', 'g2', 'glyph-name', 'glyphref', 'gradientunits', 'gradienttransform', 'height', 'href', 'id', 'image-rendering', 'in', 'in2', 'intercept', 'k', 'k1', 'k2', 'k3', 'k4', 'kerning', 'keypoints', 'keysplines', 'keytimes', 'lang', 'lengthadjust', 'letter-spacing', 'kernelmatrix', 'kernelunitlength', 'lighting-color', 'local', 'marker-end', 'marker-mid', 'marker-start', 'markerheight', 'markerunits', 'markerwidth', 'maskcontentunits', 'maskunits', 'max', 'mask', 'mask-type', 'media', 'method', 'mode', 'min', 'name', 'numoctaves', 'offset', 'operator', 'opacity', 'order', 'orient', 'orientation', 'origin', 'overflow', 'paint-order', 'path', 'pathlength', 'patterncontentunits', 'patterntransform', 'patternunits', 'points', 'preservealpha', 'preserveaspectratio', 'primitiveunits', 'r', 'rx', 'ry', 'radius', 'refx', 'refy', 'repeatcount', 'repeatdur', 'restart', 'result', 'rotate', 'scale', 'seed', 'shape-rendering', 'slope', 'specularconstant', 'specularexponent', 'spreadmethod', 'startoffset', 'stddeviation', 'stitchtiles', 'stop-color', 'stop-opacity', 'stroke-dasharray', 'stroke-dashoffset', 'stroke-linecap', 'stroke-linejoin', 'stroke-miterlimit', 'stroke-opacity', 'stroke', 'stroke-width', 'style', 'surfacescale', 'systemlanguage', 'tabindex', 'tablevalues', 'targetx', 'targety', 'transform', 'transform-origin', 'text-anchor', 'text-decoration', 'text-orientation', 'text-rendering', 'textlength', 'type', 'u1', 'u2', 'unicode', 'values', 'viewbox', 'visibility', 'version', 'vert-adv-y', 'vert-origin-x', 'vert-origin-y', 'width', 'word-spacing', 'wrap', 'writing-mode', 'xchannelselector', 'ychannelselector', 'x', 'x1', 'x2', 'xmlns', 'y', 'y1', 'y2', 'z', 'zoomandpan']);
1727
+ const mathMl = freeze(['accent', 'accentunder', 'align', 'bevelled', 'close', 'columnalign', 'columnlines', 'columnspacing', 'columnspan', 'denomalign', 'depth', 'dir', 'display', 'displaystyle', 'encoding', 'fence', 'frame', 'height', 'href', 'id', 'largeop', 'length', 'linethickness', 'lquote', 'lspace', 'mathbackground', 'mathcolor', 'mathsize', 'mathvariant', 'maxsize', 'minsize', 'movablelimits', 'notation', 'numalign', 'open', 'rowalign', 'rowlines', 'rowspacing', 'rowspan', 'rspace', 'rquote', 'scriptlevel', 'scriptminsize', 'scriptsizemultiplier', 'selection', 'separator', 'separators', 'stretchy', 'subscriptshift', 'supscriptshift', 'symmetric', 'voffset', 'width', 'xmlns']);
1728
+ const xml = freeze(['xlink:href', 'xml:id', 'xlink:title', 'xml:space', 'xmlns:xlink']);
1729
+
1730
+ const MUSTACHE_EXPR = seal(/{{[\w\W]*|^[\w\W]*}}/g);
1731
+ const ERB_EXPR = seal(/<%[\w\W]*|^[\w\W]*%>/g);
1732
+ const TMPLIT_EXPR = seal(/\${[\w\W]*/g);
1733
+ const DATA_ATTR = seal(/^data-[\-\w.\u00B7-\uFFFF]+$/); // eslint-disable-line no-useless-escape
1734
+ const ARIA_ATTR = seal(/^aria-[\-\w]+$/); // eslint-disable-line no-useless-escape
1735
+ const IS_ALLOWED_URI = seal(/^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp|matrix):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i // eslint-disable-line no-useless-escape
1736
+ );
1737
+ const IS_SCRIPT_OR_DATA = seal(/^(?:\w+script|data):/i);
1738
+ const ATTR_WHITESPACE = seal(/[\u0000-\u0020\u00A0\u1680\u180E\u2000-\u2029\u205F\u3000]/g // eslint-disable-line no-control-regex
1739
+ );
1740
+ const DOCTYPE_NAME = seal(/^html$/i);
1741
+ const CUSTOM_ELEMENT = seal(/^[a-z][.\w]*(-[.\w]+)+$/i);
1742
+ // Markup-significant character probes used by _sanitizeElements.
1743
+ // Shared module-level instances are safe despite the sticky /g flags:
1744
+ // unapply() resets lastIndex for RegExp receivers before every call.
1745
+ const ELEMENT_MARKUP_PROBE = seal(/<[/\w!]/g);
1746
+ const COMMENT_MARKUP_PROBE = seal(/<[/\w]/g);
1747
+ const FALLBACK_TAG_CLOSE = seal(/<\/no(script|embed|frames)/i);
1748
+ const SELF_CLOSING_TAG = seal(/\/>/i);
1749
+
1750
+ // https://developer.mozilla.org/en-US/docs/Web/API/Node/nodeType
1751
+ const NODE_TYPE = {
1752
+ element: 1,
1753
+ text: 3,
1754
+ // Deprecated
1755
+ processingInstruction: 7,
1756
+ comment: 8,
1757
+ document: 9,
1758
+ documentFragment: 11};
1759
+ const getGlobal = function getGlobal() {
1760
+ return typeof window === 'undefined' ? null : window;
1761
+ };
1762
+ /**
1763
+ * Creates a no-op policy for internal use only.
1764
+ * Don't export this function outside this module!
1765
+ * @param trustedTypes The policy factory.
1766
+ * @param purifyHostElement The Script element used to load DOMPurify (to determine policy name suffix).
1767
+ * @return The policy created (or null, if Trusted Types
1768
+ * are not supported or creating the policy failed).
1769
+ */
1770
+ const _createTrustedTypesPolicy = function _createTrustedTypesPolicy(trustedTypes, purifyHostElement) {
1771
+ if (typeof trustedTypes !== 'object' || typeof trustedTypes.createPolicy !== 'function') {
1772
+ return null;
1773
+ }
1774
+ // Allow the callers to control the unique policy name
1775
+ // by adding a data-tt-policy-suffix to the script element with the DOMPurify.
1776
+ // Policy creation with duplicate names throws in Trusted Types.
1777
+ let suffix = null;
1778
+ const ATTR_NAME = 'data-tt-policy-suffix';
1779
+ if (purifyHostElement && purifyHostElement.hasAttribute(ATTR_NAME)) {
1780
+ suffix = purifyHostElement.getAttribute(ATTR_NAME);
1781
+ }
1782
+ const policyName = 'dompurify' + (suffix ? '#' + suffix : '');
1783
+ try {
1784
+ return trustedTypes.createPolicy(policyName, {
1785
+ createHTML(html) {
1786
+ return html;
1787
+ },
1788
+ createScriptURL(scriptUrl) {
1789
+ return scriptUrl;
1790
+ }
1791
+ });
1792
+ } catch (_) {
1793
+ // Policy creation failed (most likely another DOMPurify script has
1794
+ // already run). Skip creating the policy, as this will only cause errors
1795
+ // if TT are enforced.
1796
+ console.warn('TrustedTypes policy ' + policyName + ' could not be created.');
1797
+ return null;
1798
+ }
1799
+ };
1800
+ const _createHooksMap = function _createHooksMap() {
1801
+ return {
1802
+ afterSanitizeAttributes: [],
1803
+ afterSanitizeElements: [],
1804
+ afterSanitizeShadowDOM: [],
1805
+ beforeSanitizeAttributes: [],
1806
+ beforeSanitizeElements: [],
1807
+ beforeSanitizeShadowDOM: [],
1808
+ uponSanitizeAttribute: [],
1809
+ uponSanitizeElement: [],
1810
+ uponSanitizeShadowNode: []
1811
+ };
1812
+ };
1813
+ /**
1814
+ * Resolve a set-valued configuration option: a fresh set built from
1815
+ * cfg[key] when it is an own array property (seeded with a clone of
1816
+ * options.base when given, case-normalized via options.transform),
1817
+ * the fallback set otherwise.
1818
+ *
1819
+ * @param cfg the cloned, prototype-free configuration object
1820
+ * @param key the configuration property to read
1821
+ * @param fallback the set to use when the option is absent or not an array
1822
+ * @param options transform and optional base set to merge into
1823
+ * @returns the resolved set
1824
+ */
1825
+ const _resolveSetOption = function _resolveSetOption(cfg, key, fallback, options) {
1826
+ return objectHasOwnProperty(cfg, key) && arrayIsArray(cfg[key]) ? addToSet(options.base ? clone(options.base) : {}, cfg[key], options.transform) : fallback;
1827
+ };
1828
+ function createDOMPurify() {
1829
+ let window = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : getGlobal();
1830
+ const DOMPurify = root => createDOMPurify(root);
1831
+ DOMPurify.version = '3.4.12';
1832
+ DOMPurify.removed = [];
1833
+ if (!window || !window.document || window.document.nodeType !== NODE_TYPE.document || !window.Element) {
1834
+ // Not running in a browser, provide a factory function
1835
+ // so that you can pass your own Window
1836
+ DOMPurify.isSupported = false;
1837
+ return DOMPurify;
1838
+ }
1839
+ let document = window.document;
1840
+ const originalDocument = document;
1841
+ const currentScript = originalDocument.currentScript;
1842
+ const HTMLTemplateElement = window.HTMLTemplateElement,
1843
+ Node = window.Node,
1844
+ Element = window.Element,
1845
+ NodeFilter = window.NodeFilter;
1846
+ const DOMParser = window.DOMParser,
1847
+ trustedTypes = window.trustedTypes;
1848
+ const ElementPrototype = Element.prototype;
1849
+ const cloneNode = lookupGetter(ElementPrototype, 'cloneNode');
1850
+ const remove = lookupGetter(ElementPrototype, 'remove');
1851
+ const getNextSibling = lookupGetter(ElementPrototype, 'nextSibling');
1852
+ const getChildNodes = lookupGetter(ElementPrototype, 'childNodes');
1853
+ const getParentNode = lookupGetter(ElementPrototype, 'parentNode');
1854
+ const getShadowRoot = lookupGetter(ElementPrototype, 'shadowRoot');
1855
+ const getAttributes = lookupGetter(ElementPrototype, 'attributes');
1856
+ const getNodeType = Node && Node.prototype ? lookupGetter(Node.prototype, 'nodeType') : null;
1857
+ const getNodeName = Node && Node.prototype ? lookupGetter(Node.prototype, 'nodeName') : null;
1858
+ // As per issue #47, the web-components registry is inherited by a
1859
+ // new document created via createHTMLDocument. As per the spec
1860
+ // (http://w3c.github.io/webcomponents/spec/custom/#creating-and-passing-registries)
1861
+ // a new empty registry is used when creating a template contents owner
1862
+ // document, so we use that as our parent document to ensure nothing
1863
+ // is inherited.
1864
+ if (typeof HTMLTemplateElement === 'function') {
1865
+ const template = document.createElement('template');
1866
+ if (template.content && template.content.ownerDocument) {
1867
+ document = template.content.ownerDocument;
1868
+ }
1869
+ }
1870
+ let trustedTypesPolicy;
1871
+ let emptyHTML = '';
1872
+ // The instance's own internal Trusted Types policy. Unlike a caller-supplied
1873
+ // `TRUSTED_TYPES_POLICY`, this is created at most once — Trusted Types throws
1874
+ // on duplicate policy names — and is the only policy allowed to persist
1875
+ // across configurations and survive `clearConfig()`.
1876
+ let defaultTrustedTypesPolicy;
1877
+ let defaultTrustedTypesPolicyResolved = false;
1878
+ // Tracks whether we are already inside a call to the configured Trusted Types
1879
+ // policy (`createHTML` or `createScriptURL`). If a supplied policy callback
1880
+ // itself calls `DOMPurify.sanitize` (the cause of #1422), `sanitize` would
1881
+ // re-enter the policy and recurse until the stack overflows. We detect that
1882
+ // re-entry and throw a clear, actionable error instead. The guard is shared
1883
+ // across both callbacks, because either one re-entering `sanitize` triggers
1884
+ // the same unbounded recursion.
1885
+ let IN_TRUSTED_TYPES_POLICY = 0;
1886
+ const _assertNotInTrustedTypesPolicy = function _assertNotInTrustedTypesPolicy() {
1887
+ if (IN_TRUSTED_TYPES_POLICY > 0) {
1888
+ throw typeErrorCreate('A configured TRUSTED_TYPES_POLICY callback (createHTML or ' + 'createScriptURL) must not call DOMPurify.sanitize, as that causes ' + 'infinite recursion. Do not pass a policy whose callbacks wrap ' + 'DOMPurify as TRUSTED_TYPES_POLICY; see the "DOMPurify and Trusted ' + 'Types" section of the README.');
1889
+ }
1890
+ };
1891
+ const _createTrustedHTML = function _createTrustedHTML(html) {
1892
+ _assertNotInTrustedTypesPolicy();
1893
+ IN_TRUSTED_TYPES_POLICY++;
1894
+ try {
1895
+ return trustedTypesPolicy.createHTML(html);
1896
+ } finally {
1897
+ IN_TRUSTED_TYPES_POLICY--;
1898
+ }
1899
+ };
1900
+ const _createTrustedScriptURL = function _createTrustedScriptURL(scriptUrl) {
1901
+ _assertNotInTrustedTypesPolicy();
1902
+ IN_TRUSTED_TYPES_POLICY++;
1903
+ try {
1904
+ return trustedTypesPolicy.createScriptURL(scriptUrl);
1905
+ } finally {
1906
+ IN_TRUSTED_TYPES_POLICY--;
1907
+ }
1908
+ };
1909
+ // Lazily resolve (and cache) the instance's internal default policy.
1910
+ // Resolution is attempted at most once: a successful `createPolicy` cannot be
1911
+ // repeated (Trusted Types throws on duplicate names), and a failed or
1912
+ // unsupported attempt must not be retried on every parse.
1913
+ const _getDefaultTrustedTypesPolicy = function _getDefaultTrustedTypesPolicy() {
1914
+ if (!defaultTrustedTypesPolicyResolved) {
1915
+ defaultTrustedTypesPolicy = _createTrustedTypesPolicy(trustedTypes, currentScript);
1916
+ defaultTrustedTypesPolicyResolved = true;
1917
+ }
1918
+ return defaultTrustedTypesPolicy;
1919
+ };
1920
+ const _document = document,
1921
+ implementation = _document.implementation,
1922
+ createNodeIterator = _document.createNodeIterator,
1923
+ createDocumentFragment = _document.createDocumentFragment,
1924
+ getElementsByTagName = _document.getElementsByTagName;
1925
+ const importNode = originalDocument.importNode;
1926
+ let hooks = _createHooksMap();
1927
+ /**
1928
+ * Expose whether this browser supports running the full DOMPurify.
1929
+ */
1930
+ DOMPurify.isSupported = typeof entries === 'function' && typeof getParentNode === 'function' && implementation && implementation.createHTMLDocument !== undefined;
1931
+ const MUSTACHE_EXPR$1 = MUSTACHE_EXPR,
1932
+ ERB_EXPR$1 = ERB_EXPR,
1933
+ TMPLIT_EXPR$1 = TMPLIT_EXPR,
1934
+ DATA_ATTR$1 = DATA_ATTR,
1935
+ ARIA_ATTR$1 = ARIA_ATTR,
1936
+ IS_SCRIPT_OR_DATA$1 = IS_SCRIPT_OR_DATA,
1937
+ ATTR_WHITESPACE$1 = ATTR_WHITESPACE,
1938
+ CUSTOM_ELEMENT$1 = CUSTOM_ELEMENT;
1939
+ let IS_ALLOWED_URI$1 = IS_ALLOWED_URI;
1940
+ /**
1941
+ * We consider the elements and attributes below to be safe. Ideally
1942
+ * don't add any new ones but feel free to remove unwanted ones.
1943
+ */
1944
+ /* allowed element names */
1945
+ let ALLOWED_TAGS = null;
1946
+ const DEFAULT_ALLOWED_TAGS = addToSet({}, [...html$1, ...svg$1, ...svgFilters, ...mathMl$1, ...text]);
1947
+ /* Allowed attribute names */
1948
+ let ALLOWED_ATTR = null;
1949
+ const DEFAULT_ALLOWED_ATTR = addToSet({}, [...html, ...svg, ...mathMl, ...xml]);
1950
+ /*
1951
+ * Configure how DOMPurify should handle custom elements and their attributes as well as customized built-in elements.
1952
+ * @property {RegExp|Function|null} tagNameCheck one of [null, regexPattern, predicate]. Default: `null` (disallow any custom elements)
1953
+ * @property {RegExp|Function|null} attributeNameCheck one of [null, regexPattern, predicate]. Default: `null` (disallow any attributes not on the allow list)
1954
+ * @property {boolean} allowCustomizedBuiltInElements allow custom elements derived from built-ins if they pass CUSTOM_ELEMENT_HANDLING.tagNameCheck. Default: `false`.
1955
+ */
1956
+ let CUSTOM_ELEMENT_HANDLING = Object.seal(create(null, {
1957
+ tagNameCheck: {
1958
+ writable: true,
1959
+ configurable: false,
1960
+ enumerable: true,
1961
+ value: null
1962
+ },
1963
+ attributeNameCheck: {
1964
+ writable: true,
1965
+ configurable: false,
1966
+ enumerable: true,
1967
+ value: null
1968
+ },
1969
+ allowCustomizedBuiltInElements: {
1970
+ writable: true,
1971
+ configurable: false,
1972
+ enumerable: true,
1973
+ value: false
1974
+ }
1975
+ }));
1976
+ /* Explicitly forbidden tags (overrides ALLOWED_TAGS/ADD_TAGS) */
1977
+ let FORBID_TAGS = null;
1978
+ /* Explicitly forbidden attributes (overrides ALLOWED_ATTR/ADD_ATTR) */
1979
+ let FORBID_ATTR = null;
1980
+ /* Config object to store ADD_TAGS/ADD_ATTR functions (when used as functions) */
1981
+ const EXTRA_ELEMENT_HANDLING = Object.seal(create(null, {
1982
+ tagCheck: {
1983
+ writable: true,
1984
+ configurable: false,
1985
+ enumerable: true,
1986
+ value: null
1987
+ },
1988
+ attributeCheck: {
1989
+ writable: true,
1990
+ configurable: false,
1991
+ enumerable: true,
1992
+ value: null
1993
+ }
1994
+ }));
1995
+ /* Decide if ARIA attributes are okay */
1996
+ let ALLOW_ARIA_ATTR = true;
1997
+ /* Decide if custom data attributes are okay */
1998
+ let ALLOW_DATA_ATTR = true;
1999
+ /* Decide if unknown protocols are okay */
2000
+ let ALLOW_UNKNOWN_PROTOCOLS = false;
2001
+ /* Decide if self-closing tags in attributes are allowed.
2002
+ * Usually removed due to a mXSS issue in jQuery 3.0 */
2003
+ let ALLOW_SELF_CLOSE_IN_ATTR = true;
2004
+ /* Output should be safe for common template engines.
2005
+ * This means, DOMPurify removes data attributes, mustaches and ERB
2006
+ */
2007
+ let SAFE_FOR_TEMPLATES = false;
2008
+ /* Output should be safe even for XML used within HTML and alike.
2009
+ * This means, DOMPurify removes comments when containing risky content.
2010
+ */
2011
+ let SAFE_FOR_XML = true;
2012
+ /* Decide if document with <html>... should be returned */
2013
+ let WHOLE_DOCUMENT = false;
2014
+ /* Track whether config is already set on this instance of DOMPurify. */
2015
+ let SET_CONFIG = false;
2016
+ /* Pristine allowlist bindings captured at setConfig() time. On the
2017
+ * persistent-config path sanitize() restores the sets from these before
2018
+ * the per-walk hook clone-guard, so a hook's in-call widening cannot
2019
+ * carry across calls. Null until setConfig() is called; reset by
2020
+ * clearConfig(). */
2021
+ let SET_CONFIG_ALLOWED_TAGS = null;
2022
+ let SET_CONFIG_ALLOWED_ATTR = null;
2023
+ /* Decide if all elements (e.g. style, script) must be children of
2024
+ * document.body. By default, browsers might move them to document.head */
2025
+ let FORCE_BODY = false;
2026
+ /* Decide if a DOM `HTMLBodyElement` should be returned, instead of a html
2027
+ * string (or a TrustedHTML object if Trusted Types are supported).
2028
+ * If `WHOLE_DOCUMENT` is enabled a `HTMLHtmlElement` will be returned instead
2029
+ */
2030
+ let RETURN_DOM = false;
2031
+ /* Decide if a DOM `DocumentFragment` should be returned, instead of a html
2032
+ * string (or a TrustedHTML object if Trusted Types are supported) */
2033
+ let RETURN_DOM_FRAGMENT = false;
2034
+ /* Try to return a Trusted Type object instead of a string, return a string in
2035
+ * case Trusted Types are not supported */
2036
+ let RETURN_TRUSTED_TYPE = false;
2037
+ /* Output should be free from DOM clobbering attacks?
2038
+ * This sanitizes markups named with colliding, clobberable built-in DOM APIs.
2039
+ */
2040
+ let SANITIZE_DOM = true;
2041
+ /* Achieve full DOM Clobbering protection by isolating the namespace of named
2042
+ * properties and JS variables, mitigating attacks that abuse the HTML/DOM spec rules.
2043
+ *
2044
+ * HTML/DOM spec rules that enable DOM Clobbering:
2045
+ * - Named Access on Window (§7.3.3)
2046
+ * - DOM Tree Accessors (§3.1.5)
2047
+ * - Form Element Parent-Child Relations (§4.10.3)
2048
+ * - Iframe srcdoc / Nested WindowProxies (§4.8.5)
2049
+ * - HTMLCollection (§4.2.10.2)
2050
+ *
2051
+ * Namespace isolation is implemented by prefixing `id` and `name` attributes
2052
+ * with a constant string, i.e., `user-content-`
2053
+ */
2054
+ let SANITIZE_NAMED_PROPS = false;
2055
+ const SANITIZE_NAMED_PROPS_PREFIX = 'user-content-';
2056
+ /* Keep element content when removing element? */
2057
+ let KEEP_CONTENT = true;
2058
+ /* If a `Node` is passed to sanitize(), then performs sanitization in-place instead
2059
+ * of importing it into a new Document and returning a sanitized copy */
2060
+ let IN_PLACE = false;
2061
+ /* Allow usage of profiles like html, svg and mathMl */
2062
+ let USE_PROFILES = {};
2063
+ /* Tags to ignore content of when KEEP_CONTENT is true */
2064
+ let FORBID_CONTENTS = null;
2065
+ const DEFAULT_FORBID_CONTENTS = addToSet({}, ['annotation-xml', 'audio', 'colgroup', 'desc', 'foreignobject', 'head', 'iframe', 'math', 'mi', 'mn', 'mo', 'ms', 'mtext', 'noembed', 'noframes', 'noscript', 'plaintext', 'script',
2066
+ // <selectedcontent> mirrors the selected <option>'s subtree, cloned by
2067
+ // the UA (customizable <select>) — including any on* handlers — and the
2068
+ // engine re-mirrors synchronously whenever a removal changes which
2069
+ // option/selectedcontent is current, even inside DOMPurify's inert
2070
+ // DOMParser document. Hoisting its children on removal re-inserts a fresh
2071
+ // mirror target ahead of the walk, which the engine refills, looping
2072
+ // forever (DoS) and amplifying output. Dropping its content on removal
2073
+ // (rather than hoisting) breaks that cascade; the content is a duplicate
2074
+ // of the option, which is sanitized on its own. See campaign-3 F1/F6.
2075
+ 'selectedcontent', 'style', 'svg', 'template', 'thead', 'title', 'video', 'xmp']);
2076
+ /* Tags that are safe for data: URIs */
2077
+ let DATA_URI_TAGS = null;
2078
+ const DEFAULT_DATA_URI_TAGS = addToSet({}, ['audio', 'video', 'img', 'source', 'image', 'track']);
2079
+ /* Attributes safe for values like "javascript:" */
2080
+ let URI_SAFE_ATTRIBUTES = null;
2081
+ const DEFAULT_URI_SAFE_ATTRIBUTES = addToSet({}, ['alt', 'class', 'for', 'id', 'label', 'name', 'pattern', 'placeholder', 'role', 'summary', 'title', 'value', 'style', 'xmlns']);
2082
+ const MATHML_NAMESPACE = 'http://www.w3.org/1998/Math/MathML';
2083
+ const SVG_NAMESPACE = 'http://www.w3.org/2000/svg';
2084
+ const HTML_NAMESPACE = 'http://www.w3.org/1999/xhtml';
2085
+ /* Document namespace */
2086
+ let NAMESPACE = HTML_NAMESPACE;
2087
+ let IS_EMPTY_INPUT = false;
2088
+ /* Allowed XHTML+XML namespaces */
2089
+ let ALLOWED_NAMESPACES = null;
2090
+ const DEFAULT_ALLOWED_NAMESPACES = addToSet({}, [MATHML_NAMESPACE, SVG_NAMESPACE, HTML_NAMESPACE], stringToString);
2091
+ const DEFAULT_MATHML_TEXT_INTEGRATION_POINTS = freeze(['mi', 'mo', 'mn', 'ms', 'mtext']);
2092
+ let MATHML_TEXT_INTEGRATION_POINTS = addToSet({}, DEFAULT_MATHML_TEXT_INTEGRATION_POINTS);
2093
+ const DEFAULT_HTML_INTEGRATION_POINTS = freeze(['annotation-xml']);
2094
+ let HTML_INTEGRATION_POINTS = addToSet({}, DEFAULT_HTML_INTEGRATION_POINTS);
2095
+ // Certain elements are allowed in both SVG and HTML
2096
+ // namespace. We need to specify them explicitly
2097
+ // so that they don't get erroneously deleted from
2098
+ // HTML namespace.
2099
+ const COMMON_SVG_AND_HTML_ELEMENTS = addToSet({}, ['title', 'style', 'font', 'a', 'script']);
2100
+ /* Parsing of strict XHTML documents */
2101
+ let PARSER_MEDIA_TYPE = null;
2102
+ const SUPPORTED_PARSER_MEDIA_TYPES = ['application/xhtml+xml', 'text/html'];
2103
+ const DEFAULT_PARSER_MEDIA_TYPE = 'text/html';
2104
+ let transformCaseFunc = null;
2105
+ /* Keep a reference to config to pass to hooks */
2106
+ let CONFIG = null;
2107
+ /* Ideally, do not touch anything below this line */
2108
+ /* ______________________________________________ */
2109
+ const formElement = document.createElement('form');
2110
+ const isRegexOrFunction = function isRegexOrFunction(testValue) {
2111
+ return testValue instanceof RegExp || testValue instanceof Function;
2112
+ };
2113
+ /**
2114
+ * _parseConfig
2115
+ *
2116
+ * @param cfg optional config literal
2117
+ */
2118
+ // eslint-disable-next-line complexity
2119
+ const _parseConfig = function _parseConfig() {
2120
+ let cfg = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
2121
+ if (CONFIG && CONFIG === cfg) {
2122
+ return;
2123
+ }
2124
+ /* Shield configuration object from tampering */
2125
+ if (!cfg || typeof cfg !== 'object') {
2126
+ cfg = {};
2127
+ }
2128
+ /* Shield configuration object from prototype pollution */
2129
+ cfg = clone(cfg);
2130
+ PARSER_MEDIA_TYPE =
2131
+ // eslint-disable-next-line unicorn/prefer-includes
2132
+ SUPPORTED_PARSER_MEDIA_TYPES.indexOf(cfg.PARSER_MEDIA_TYPE) === -1 ? DEFAULT_PARSER_MEDIA_TYPE : cfg.PARSER_MEDIA_TYPE;
2133
+ // HTML tags and attributes are not case-sensitive, converting to lowercase. Keeping XHTML as is.
2134
+ transformCaseFunc = PARSER_MEDIA_TYPE === 'application/xhtml+xml' ? stringToString : stringToLowerCase;
2135
+ /* Set configuration parameters */
2136
+ ALLOWED_TAGS = _resolveSetOption(cfg, 'ALLOWED_TAGS', DEFAULT_ALLOWED_TAGS, {
2137
+ transform: transformCaseFunc
2138
+ });
2139
+ ALLOWED_ATTR = _resolveSetOption(cfg, 'ALLOWED_ATTR', DEFAULT_ALLOWED_ATTR, {
2140
+ transform: transformCaseFunc
2141
+ });
2142
+ ALLOWED_NAMESPACES = _resolveSetOption(cfg, 'ALLOWED_NAMESPACES', DEFAULT_ALLOWED_NAMESPACES, {
2143
+ transform: stringToString
2144
+ });
2145
+ URI_SAFE_ATTRIBUTES = _resolveSetOption(cfg, 'ADD_URI_SAFE_ATTR', DEFAULT_URI_SAFE_ATTRIBUTES, {
2146
+ transform: transformCaseFunc,
2147
+ base: DEFAULT_URI_SAFE_ATTRIBUTES
2148
+ });
2149
+ DATA_URI_TAGS = _resolveSetOption(cfg, 'ADD_DATA_URI_TAGS', DEFAULT_DATA_URI_TAGS, {
2150
+ transform: transformCaseFunc,
2151
+ base: DEFAULT_DATA_URI_TAGS
2152
+ });
2153
+ FORBID_CONTENTS = _resolveSetOption(cfg, 'FORBID_CONTENTS', DEFAULT_FORBID_CONTENTS, {
2154
+ transform: transformCaseFunc
2155
+ });
2156
+ FORBID_TAGS = _resolveSetOption(cfg, 'FORBID_TAGS', clone({}), {
2157
+ transform: transformCaseFunc
2158
+ });
2159
+ FORBID_ATTR = _resolveSetOption(cfg, 'FORBID_ATTR', clone({}), {
2160
+ transform: transformCaseFunc
2161
+ });
2162
+ USE_PROFILES = objectHasOwnProperty(cfg, 'USE_PROFILES') ? cfg.USE_PROFILES && typeof cfg.USE_PROFILES === 'object' ? clone(cfg.USE_PROFILES) : cfg.USE_PROFILES : false;
2163
+ ALLOW_ARIA_ATTR = cfg.ALLOW_ARIA_ATTR !== false; // Default true
2164
+ ALLOW_DATA_ATTR = cfg.ALLOW_DATA_ATTR !== false; // Default true
2165
+ ALLOW_UNKNOWN_PROTOCOLS = cfg.ALLOW_UNKNOWN_PROTOCOLS || false; // Default false
2166
+ ALLOW_SELF_CLOSE_IN_ATTR = cfg.ALLOW_SELF_CLOSE_IN_ATTR !== false; // Default true
2167
+ SAFE_FOR_TEMPLATES = cfg.SAFE_FOR_TEMPLATES || false; // Default false
2168
+ SAFE_FOR_XML = cfg.SAFE_FOR_XML !== false; // Default true
2169
+ WHOLE_DOCUMENT = cfg.WHOLE_DOCUMENT || false; // Default false
2170
+ RETURN_DOM = cfg.RETURN_DOM || false; // Default false
2171
+ RETURN_DOM_FRAGMENT = cfg.RETURN_DOM_FRAGMENT || false; // Default false
2172
+ RETURN_TRUSTED_TYPE = cfg.RETURN_TRUSTED_TYPE || false; // Default false
2173
+ FORCE_BODY = cfg.FORCE_BODY || false; // Default false
2174
+ SANITIZE_DOM = cfg.SANITIZE_DOM !== false; // Default true
2175
+ SANITIZE_NAMED_PROPS = cfg.SANITIZE_NAMED_PROPS || false; // Default false
2176
+ KEEP_CONTENT = cfg.KEEP_CONTENT !== false; // Default true
2177
+ IN_PLACE = cfg.IN_PLACE || false; // Default false
2178
+ IS_ALLOWED_URI$1 = isRegex(cfg.ALLOWED_URI_REGEXP) ? cfg.ALLOWED_URI_REGEXP : IS_ALLOWED_URI; // Default regexp
2179
+ NAMESPACE = typeof cfg.NAMESPACE === 'string' ? cfg.NAMESPACE : HTML_NAMESPACE; // Default HTML namespace
2180
+ MATHML_TEXT_INTEGRATION_POINTS = objectHasOwnProperty(cfg, 'MATHML_TEXT_INTEGRATION_POINTS') && cfg.MATHML_TEXT_INTEGRATION_POINTS && typeof cfg.MATHML_TEXT_INTEGRATION_POINTS === 'object' ? clone(cfg.MATHML_TEXT_INTEGRATION_POINTS) : addToSet({}, DEFAULT_MATHML_TEXT_INTEGRATION_POINTS); // Default built-in map
2181
+ HTML_INTEGRATION_POINTS = objectHasOwnProperty(cfg, 'HTML_INTEGRATION_POINTS') && cfg.HTML_INTEGRATION_POINTS && typeof cfg.HTML_INTEGRATION_POINTS === 'object' ? clone(cfg.HTML_INTEGRATION_POINTS) : addToSet({}, DEFAULT_HTML_INTEGRATION_POINTS); // Default built-in map
2182
+ const customElementHandling = objectHasOwnProperty(cfg, 'CUSTOM_ELEMENT_HANDLING') && cfg.CUSTOM_ELEMENT_HANDLING && typeof cfg.CUSTOM_ELEMENT_HANDLING === 'object' ? clone(cfg.CUSTOM_ELEMENT_HANDLING) : create(null);
2183
+ CUSTOM_ELEMENT_HANDLING = create(null);
2184
+ if (objectHasOwnProperty(customElementHandling, 'tagNameCheck') && isRegexOrFunction(customElementHandling.tagNameCheck)) {
2185
+ CUSTOM_ELEMENT_HANDLING.tagNameCheck = customElementHandling.tagNameCheck; // Default undefined
2186
+ }
2187
+ if (objectHasOwnProperty(customElementHandling, 'attributeNameCheck') && isRegexOrFunction(customElementHandling.attributeNameCheck)) {
2188
+ CUSTOM_ELEMENT_HANDLING.attributeNameCheck = customElementHandling.attributeNameCheck; // Default undefined
2189
+ }
2190
+ if (objectHasOwnProperty(customElementHandling, 'allowCustomizedBuiltInElements') && typeof customElementHandling.allowCustomizedBuiltInElements === 'boolean') {
2191
+ CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements = customElementHandling.allowCustomizedBuiltInElements; // Default undefined
2192
+ }
2193
+ seal(CUSTOM_ELEMENT_HANDLING);
2194
+ if (SAFE_FOR_TEMPLATES) {
2195
+ ALLOW_DATA_ATTR = false;
2196
+ }
2197
+ if (RETURN_DOM_FRAGMENT) {
2198
+ RETURN_DOM = true;
2199
+ }
2200
+ /* Parse profile info */
2201
+ if (USE_PROFILES) {
2202
+ ALLOWED_TAGS = addToSet({}, text);
2203
+ ALLOWED_ATTR = create(null);
2204
+ if (USE_PROFILES.html === true) {
2205
+ addToSet(ALLOWED_TAGS, html$1);
2206
+ addToSet(ALLOWED_ATTR, html);
2207
+ }
2208
+ if (USE_PROFILES.svg === true) {
2209
+ addToSet(ALLOWED_TAGS, svg$1);
2210
+ addToSet(ALLOWED_ATTR, svg);
2211
+ addToSet(ALLOWED_ATTR, xml);
2212
+ }
2213
+ if (USE_PROFILES.svgFilters === true) {
2214
+ addToSet(ALLOWED_TAGS, svgFilters);
2215
+ addToSet(ALLOWED_ATTR, svg);
2216
+ addToSet(ALLOWED_ATTR, xml);
2217
+ }
2218
+ if (USE_PROFILES.mathMl === true) {
2219
+ addToSet(ALLOWED_TAGS, mathMl$1);
2220
+ addToSet(ALLOWED_ATTR, mathMl);
2221
+ addToSet(ALLOWED_ATTR, xml);
2222
+ }
2223
+ }
2224
+ /* Always reset function-based ADD_TAGS / ADD_ATTR checks to prevent
2225
+ * leaking across calls when switching from function to array config */
2226
+ EXTRA_ELEMENT_HANDLING.tagCheck = null;
2227
+ EXTRA_ELEMENT_HANDLING.attributeCheck = null;
2228
+ /* Merge configuration parameters */
2229
+ if (objectHasOwnProperty(cfg, 'ADD_TAGS')) {
2230
+ if (typeof cfg.ADD_TAGS === 'function') {
2231
+ EXTRA_ELEMENT_HANDLING.tagCheck = cfg.ADD_TAGS;
2232
+ } else if (arrayIsArray(cfg.ADD_TAGS)) {
2233
+ if (ALLOWED_TAGS === DEFAULT_ALLOWED_TAGS) {
2234
+ ALLOWED_TAGS = clone(ALLOWED_TAGS);
2235
+ }
2236
+ addToSet(ALLOWED_TAGS, cfg.ADD_TAGS, transformCaseFunc);
2237
+ }
2238
+ }
2239
+ if (objectHasOwnProperty(cfg, 'ADD_ATTR')) {
2240
+ if (typeof cfg.ADD_ATTR === 'function') {
2241
+ EXTRA_ELEMENT_HANDLING.attributeCheck = cfg.ADD_ATTR;
2242
+ } else if (arrayIsArray(cfg.ADD_ATTR)) {
2243
+ if (ALLOWED_ATTR === DEFAULT_ALLOWED_ATTR) {
2244
+ ALLOWED_ATTR = clone(ALLOWED_ATTR);
2245
+ }
2246
+ addToSet(ALLOWED_ATTR, cfg.ADD_ATTR, transformCaseFunc);
2247
+ }
2248
+ }
2249
+ if (objectHasOwnProperty(cfg, 'ADD_URI_SAFE_ATTR') && arrayIsArray(cfg.ADD_URI_SAFE_ATTR)) {
2250
+ addToSet(URI_SAFE_ATTRIBUTES, cfg.ADD_URI_SAFE_ATTR, transformCaseFunc);
2251
+ }
2252
+ if (objectHasOwnProperty(cfg, 'FORBID_CONTENTS') && arrayIsArray(cfg.FORBID_CONTENTS)) {
2253
+ if (FORBID_CONTENTS === DEFAULT_FORBID_CONTENTS) {
2254
+ FORBID_CONTENTS = clone(FORBID_CONTENTS);
2255
+ }
2256
+ addToSet(FORBID_CONTENTS, cfg.FORBID_CONTENTS, transformCaseFunc);
2257
+ }
2258
+ if (objectHasOwnProperty(cfg, 'ADD_FORBID_CONTENTS') && arrayIsArray(cfg.ADD_FORBID_CONTENTS)) {
2259
+ if (FORBID_CONTENTS === DEFAULT_FORBID_CONTENTS) {
2260
+ FORBID_CONTENTS = clone(FORBID_CONTENTS);
2261
+ }
2262
+ addToSet(FORBID_CONTENTS, cfg.ADD_FORBID_CONTENTS, transformCaseFunc);
2263
+ }
2264
+ /* Add #text in case KEEP_CONTENT is set to true */
2265
+ if (KEEP_CONTENT) {
2266
+ ALLOWED_TAGS['#text'] = true;
2267
+ }
2268
+ /* Add html, head and body to ALLOWED_TAGS in case WHOLE_DOCUMENT is true */
2269
+ if (WHOLE_DOCUMENT) {
2270
+ addToSet(ALLOWED_TAGS, ['html', 'head', 'body']);
2271
+ }
2272
+ /* Add tbody to ALLOWED_TAGS in case tables are permitted, see #286, #365 */
2273
+ if (ALLOWED_TAGS.table) {
2274
+ addToSet(ALLOWED_TAGS, ['tbody']);
2275
+ delete FORBID_TAGS.tbody;
2276
+ }
2277
+ // Re-derive the active Trusted Types policy from this configuration on
2278
+ // every parse. The active policy must never be sticky closure state that
2279
+ // outlives the config that set it: a caller-supplied policy left in place
2280
+ // after `clearConfig()` — or after a later call that supplied none, or
2281
+ // `TRUSTED_TYPES_POLICY: null` — could sign a subsequent "default"
2282
+ // `RETURN_TRUSTED_TYPE` result with a foreign, possibly unsafe policy.
2283
+ // See GHSA-vxr8-fq34-vvx9.
2284
+ if (cfg.TRUSTED_TYPES_POLICY) {
2285
+ if (typeof cfg.TRUSTED_TYPES_POLICY.createHTML !== 'function') {
2286
+ throw typeErrorCreate('TRUSTED_TYPES_POLICY configuration option must provide a "createHTML" hook.');
2287
+ }
2288
+ if (typeof cfg.TRUSTED_TYPES_POLICY.createScriptURL !== 'function') {
2289
+ throw typeErrorCreate('TRUSTED_TYPES_POLICY configuration option must provide a "createScriptURL" hook.');
2290
+ }
2291
+ // A caller-supplied policy applies to this configuration only.
2292
+ const previousTrustedTypesPolicy = trustedTypesPolicy;
2293
+ trustedTypesPolicy = cfg.TRUSTED_TYPES_POLICY;
2294
+ // Sign local variables required by `sanitize`. If the supplied policy's
2295
+ // `createHTML` is circular (i.e. it calls `DOMPurify.sanitize`), this
2296
+ // throws via the re-entrancy guard. Restore the previous policy first so
2297
+ // the instance is not left in a poisoned state. See #1422.
2298
+ try {
2299
+ emptyHTML = _createTrustedHTML('');
2300
+ } catch (error) {
2301
+ trustedTypesPolicy = previousTrustedTypesPolicy;
2302
+ throw error;
2303
+ }
2304
+ } else if (cfg.TRUSTED_TYPES_POLICY === null) {
2305
+ // Explicit opt-out for this call: perform no Trusted Types signing and
2306
+ // create nothing (so a strict `trusted-types` CSP that disallows a
2307
+ // `dompurify` policy can still call `sanitize` from inside its own
2308
+ // policy — see #1422). Resetting to `undefined` rather than a sticky
2309
+ // `null` also drops any previously retained caller policy, so it cannot
2310
+ // resurface on a later call, while still allowing the next config-less
2311
+ // call to restore the internal default policy. See GHSA-vxr8-fq34-vvx9.
2312
+ trustedTypesPolicy = undefined;
2313
+ emptyHTML = '';
2314
+ } else {
2315
+ // No policy supplied: keep the currently active policy if one is set — a
2316
+ // previously supplied policy is intentionally sticky across config-less
2317
+ // calls — otherwise fall back to the instance's own internal policy,
2318
+ // created at most once. (A policy supplied for a *single* call still
2319
+ // lingers by design; what must not linger is a policy whose configuration
2320
+ // has been torn down via `clearConfig()`, which restores the default.)
2321
+ if (trustedTypesPolicy === undefined) {
2322
+ trustedTypesPolicy = _getDefaultTrustedTypesPolicy();
2323
+ }
2324
+ // Sign internal variables only when a policy is active. A falsy policy
2325
+ // (Trusted Types unsupported, creation failed, or an explicit opt-out)
2326
+ // leaves `emptyHTML` as a plain string, so we never call `.createHTML` on
2327
+ // a non-policy and throw. See #1422.
2328
+ if (trustedTypesPolicy && typeof emptyHTML === 'string') {
2329
+ emptyHTML = _createTrustedHTML('');
2330
+ }
2331
+ }
2332
+ // Prevent further manipulation of configuration.
2333
+ // Not available in IE8, Safari 5, etc.
2334
+ if (freeze) {
2335
+ freeze(cfg);
2336
+ }
2337
+ CONFIG = cfg;
2338
+ };
2339
+ /* Keep track of all possible SVG and MathML tags
2340
+ * so that we can perform the namespace checks
2341
+ * correctly. */
2342
+ const ALL_SVG_TAGS = addToSet({}, [...svg$1, ...svgFilters, ...svgDisallowed]);
2343
+ const ALL_MATHML_TAGS = addToSet({}, [...mathMl$1, ...mathMlDisallowed]);
2344
+ /**
2345
+ * Namespace rules for an element in the SVG namespace.
2346
+ *
2347
+ * @param tagName the element's lowercase tag name
2348
+ * @param parent the (possibly simulated) parent node
2349
+ * @param parentTagName the parent's lowercase tag name
2350
+ * @returns true if a spec-compliant parser could produce this element
2351
+ */
2352
+ const _checkSvgNamespace = function _checkSvgNamespace(tagName, parent, parentTagName) {
2353
+ // The only way to switch from HTML namespace to SVG
2354
+ // is via <svg>. If it happens via any other tag, then
2355
+ // it should be killed.
2356
+ if (parent.namespaceURI === HTML_NAMESPACE) {
2357
+ return tagName === 'svg';
2358
+ }
2359
+ // The only way to switch from MathML to SVG is via <svg>
2360
+ // if the parent is either <annotation-xml> or a MathML
2361
+ // text integration point.
2362
+ if (parent.namespaceURI === MATHML_NAMESPACE) {
2363
+ return tagName === 'svg' && (parentTagName === 'annotation-xml' || MATHML_TEXT_INTEGRATION_POINTS[parentTagName]);
2364
+ }
2365
+ // We only allow elements that are defined in SVG
2366
+ // spec. All others are disallowed in SVG namespace.
2367
+ return Boolean(ALL_SVG_TAGS[tagName]);
2368
+ };
2369
+ /**
2370
+ * Namespace rules for an element in the MathML namespace.
2371
+ *
2372
+ * @param tagName the element's lowercase tag name
2373
+ * @param parent the (possibly simulated) parent node
2374
+ * @param parentTagName the parent's lowercase tag name
2375
+ * @returns true if a spec-compliant parser could produce this element
2376
+ */
2377
+ const _checkMathMlNamespace = function _checkMathMlNamespace(tagName, parent, parentTagName) {
2378
+ // The only way to switch from HTML namespace to MathML
2379
+ // is via <math>. If it happens via any other tag, then
2380
+ // it should be killed.
2381
+ if (parent.namespaceURI === HTML_NAMESPACE) {
2382
+ return tagName === 'math';
2383
+ }
2384
+ // The only way to switch from SVG to MathML is via
2385
+ // <math> and HTML integration points
2386
+ if (parent.namespaceURI === SVG_NAMESPACE) {
2387
+ return tagName === 'math' && HTML_INTEGRATION_POINTS[parentTagName];
2388
+ }
2389
+ // We only allow elements that are defined in MathML
2390
+ // spec. All others are disallowed in MathML namespace.
2391
+ return Boolean(ALL_MATHML_TAGS[tagName]);
2392
+ };
2393
+ /**
2394
+ * Namespace rules for an element in the HTML namespace.
2395
+ *
2396
+ * @param tagName the element's lowercase tag name
2397
+ * @param parent the (possibly simulated) parent node
2398
+ * @param parentTagName the parent's lowercase tag name
2399
+ * @returns true if a spec-compliant parser could produce this element
2400
+ */
2401
+ const _checkHtmlNamespace = function _checkHtmlNamespace(tagName, parent, parentTagName) {
2402
+ // The only way to switch from SVG to HTML is via
2403
+ // HTML integration points, and from MathML to HTML
2404
+ // is via MathML text integration points
2405
+ if (parent.namespaceURI === SVG_NAMESPACE && !HTML_INTEGRATION_POINTS[parentTagName]) {
2406
+ return false;
2407
+ }
2408
+ if (parent.namespaceURI === MATHML_NAMESPACE && !MATHML_TEXT_INTEGRATION_POINTS[parentTagName]) {
2409
+ return false;
2410
+ }
2411
+ // We disallow tags that are specific for MathML
2412
+ // or SVG and should never appear in HTML namespace
2413
+ return !ALL_MATHML_TAGS[tagName] && (COMMON_SVG_AND_HTML_ELEMENTS[tagName] || !ALL_SVG_TAGS[tagName]);
2414
+ };
2415
+ /**
2416
+ * @param element a DOM element whose namespace is being checked
2417
+ * @returns Return false if the element has a
2418
+ * namespace that a spec-compliant parser would never
2419
+ * return. Return true otherwise.
2420
+ */
2421
+ const _checkValidNamespace = function _checkValidNamespace(element) {
2422
+ let parent = getParentNode(element);
2423
+ // In JSDOM, if we're inside shadow DOM, then parentNode
2424
+ // can be null. We just simulate parent in this case.
2425
+ if (!parent || !parent.tagName) {
2426
+ parent = {
2427
+ namespaceURI: NAMESPACE,
2428
+ tagName: 'template'
2429
+ };
2430
+ }
2431
+ const tagName = stringToLowerCase(element.tagName);
2432
+ const parentTagName = stringToLowerCase(parent.tagName);
2433
+ if (!ALLOWED_NAMESPACES[element.namespaceURI]) {
2434
+ return false;
2435
+ }
2436
+ if (element.namespaceURI === SVG_NAMESPACE) {
2437
+ return _checkSvgNamespace(tagName, parent, parentTagName);
2438
+ }
2439
+ if (element.namespaceURI === MATHML_NAMESPACE) {
2440
+ return _checkMathMlNamespace(tagName, parent, parentTagName);
2441
+ }
2442
+ if (element.namespaceURI === HTML_NAMESPACE) {
2443
+ return _checkHtmlNamespace(tagName, parent, parentTagName);
2444
+ }
2445
+ // For XHTML and XML documents that support custom namespaces
2446
+ if (PARSER_MEDIA_TYPE === 'application/xhtml+xml' && ALLOWED_NAMESPACES[element.namespaceURI]) {
2447
+ return true;
2448
+ }
2449
+ // The code should never reach this place (this means
2450
+ // that the element somehow got namespace that is not
2451
+ // HTML, SVG, MathML or allowed via ALLOWED_NAMESPACES).
2452
+ // Return false just in case.
2453
+ return false;
2454
+ };
2455
+ /**
2456
+ * _forceRemove
2457
+ *
2458
+ * @param node a DOM node
2459
+ */
2460
+ const _forceRemove = function _forceRemove(node) {
2461
+ arrayPush(DOMPurify.removed, {
2462
+ element: node
2463
+ });
2464
+ try {
2465
+ // eslint-disable-next-line unicorn/prefer-dom-node-remove
2466
+ getParentNode(node).removeChild(node);
2467
+ } catch (_) {
2468
+ /* The normal detach failed — this is reached for a parentless node
2469
+ (getParentNode() is null, so .removeChild throws). Element.prototype
2470
+ .remove() is itself a spec no-op on a parentless node, so a recorded
2471
+ "removal" would otherwise hand the caller back an intact,
2472
+ payload-bearing node (e.g. a detached IN_PLACE root the mXSS canary or
2473
+ the style-with-element-child rule decided to kill). Fail closed by
2474
+ throwing — exactly as a clobbered root does at the IN_PLACE entry —
2475
+ rather than trying to "neutralize" the node via its own methods.
2476
+ Neutralizing would mean calling getAttributeNames()/removeAttribute()
2477
+ on the node, both of which a <form> root can clobber via a named child
2478
+ (and _isClobbered does not even probe getAttributeNames), so the
2479
+ neutralize step could itself be silently defeated, leaving the payload
2480
+ intact. A throw touches only the cached, clobber-safe remove() and
2481
+ getParentNode(). Generalizes GHSA-r47g-fvhr-h676 (clobbered-form root)
2482
+ to every root-kill reason. REPORT-3.
2483
+ This lives inside the catch, so it never fires for a normally-removed
2484
+ in-tree node: those have a parent, removeChild() succeeds, and the
2485
+ catch is not entered. Only a kept (parentless) root reaches here. */
2486
+ remove(node);
2487
+ if (!getParentNode(node)) {
2488
+ throw typeErrorCreate('a node selected for removal could not be detached from its tree ' + 'and cannot be safely returned; refusing to sanitize in place');
2489
+ }
2490
+ }
2491
+ };
2492
+ /**
2493
+ * _neutralizeRoot
2494
+ *
2495
+ * Fail-closed teardown of an in-place root after the sanitize walk aborts
2496
+ * (campaign-3 F2). An internal throw mid-walk — e.g. a page-registered
2497
+ * custom element's reaction detaches a node so `_forceRemove`'s deliberate
2498
+ * parentless guard throws, or any other re-entrant engine mutation — would
2499
+ * otherwise leave the caller's *live* tree half-sanitized, with everything
2500
+ * after the abort point still carrying its handlers. There is no safe way
2501
+ * to resume the walk (the tree mutated under us), so we strip the root bare:
2502
+ * remove every child and every attribute, then let the caller's catch see
2503
+ * the original error. Clobber-safe (cached `remove`/`childNodes`/`attributes`
2504
+ * getters; the root was already clobber-pre-flighted at the IN_PLACE entry).
2505
+ *
2506
+ * @param root the in-place root to empty
2507
+ */
2508
+ const _neutralizeRoot = function _neutralizeRoot(root) {
2509
+ /* Strip every disallowed attribute (on* handlers included) off the whole
2510
+ subtree BEFORE detaching anything. Detaching first would hand back
2511
+ handler-bearing originals (e.g. an already-loading `<img onerror>`)
2512
+ whose queued resource event still fires in page scope after we throw.
2513
+ Clobber-safe reads; a doomed clobbered node's own attributes are
2514
+ irrelevant while its non-clobbered descendants are reached and scrubbed. */
2515
+ _neutralizeSubtree(root);
2516
+ const childNodes = getChildNodes(root);
2517
+ if (childNodes) {
2518
+ const snapshot = [];
2519
+ arrayForEach(childNodes, child => {
2520
+ arrayPush(snapshot, child);
2521
+ });
2522
+ arrayForEach(snapshot, child => {
2523
+ try {
2524
+ remove(child);
2525
+ } catch (_) {
2526
+ /* Best-effort teardown; a still-attached child is handled below */
2527
+ }
2528
+ });
2529
+ }
2530
+ const attributes = getAttributes(root);
2531
+ if (attributes) {
2532
+ for (let i = attributes.length - 1; i >= 0; --i) {
2533
+ const attribute = attributes[i];
2534
+ const name = attribute && attribute.name;
2535
+ if (typeof name === 'string') {
2536
+ try {
2537
+ root.removeAttribute(name);
2538
+ } catch (_) {
2539
+ /* Clobbered removeAttribute — ignore (fail-closed best effort) */
2540
+ }
2541
+ }
2542
+ }
2543
+ }
2544
+ };
2545
+ /**
2546
+ * _removeAttribute
2547
+ *
2548
+ * @param name an Attribute name
2549
+ * @param element a DOM node
2550
+ */
2551
+ const _removeAttribute = function _removeAttribute(name, element) {
2552
+ try {
2553
+ arrayPush(DOMPurify.removed, {
2554
+ attribute: element.getAttributeNode(name),
2555
+ from: element
2556
+ });
2557
+ } catch (_) {
2558
+ arrayPush(DOMPurify.removed, {
2559
+ attribute: null,
2560
+ from: element
2561
+ });
2562
+ }
2563
+ element.removeAttribute(name);
2564
+ // We void attribute values for unremovable "is" attributes
2565
+ if (name === 'is') {
2566
+ if (RETURN_DOM || RETURN_DOM_FRAGMENT) {
2567
+ try {
2568
+ _forceRemove(element);
2569
+ } catch (_) {}
2570
+ } else {
2571
+ try {
2572
+ element.setAttribute(name, '');
2573
+ } catch (_) {}
2574
+ }
2575
+ }
2576
+ };
2577
+ /**
2578
+ * _stripDisallowedAttributes
2579
+ *
2580
+ * Removes every attribute the active configuration does not allow from a
2581
+ * single element, using the same allowlist as the main attribute pass (so
2582
+ * `on*` handlers go, but no `/^on/` blocklist is introduced). Used only to
2583
+ * neutralise nodes that are being discarded from an in-place tree.
2584
+ *
2585
+ * @param element the element to strip
2586
+ */
2587
+ const _stripDisallowedAttributes = function _stripDisallowedAttributes(element) {
2588
+ const attributes = getAttributes(element);
2589
+ if (!attributes) {
2590
+ return;
2591
+ }
2592
+ for (let i = attributes.length - 1; i >= 0; --i) {
2593
+ const attribute = attributes[i];
2594
+ const name = attribute && attribute.name;
2595
+ if (typeof name !== 'string' || ALLOWED_ATTR[transformCaseFunc(name)]) {
2596
+ continue;
2597
+ }
2598
+ try {
2599
+ element.removeAttribute(name);
2600
+ } catch (_) {
2601
+ /* Clobbered removeAttribute on a doomed node — ignore */
2602
+ }
2603
+ }
2604
+ };
2605
+ /**
2606
+ * _neutralizeSubtree
2607
+ *
2608
+ * Completes the audit-5 F1 fix across every removal path. The KEEP_CONTENT
2609
+ * move-hoist neutralises only disallowed-tag removals; clobber, mXSS-canary,
2610
+ * namespace, comment, processing-instruction and KEEP_CONTENT:false removals
2611
+ * all drop their subtree wholesale via `_forceRemove`. On the IN_PLACE path
2612
+ * those dropped nodes are detached from the caller's LIVE tree but a
2613
+ * handler-bearing original among them (an `<img onerror>`/`<video>` that was
2614
+ * loading) keeps its queued resource event, which fires in page scope after
2615
+ * sanitize returns. This walks a removed subtree and strips every attribute
2616
+ * the active configuration does not allow — so `on*` handlers are cancelled
2617
+ * through the SAME allowlist that governs kept nodes, not a separate `/^on/`
2618
+ * blocklist. Run synchronously before sanitize returns, i.e. before any
2619
+ * queued event can fire. Hook-free by design: these nodes leave the output,
2620
+ * so firing attribute hooks for them would be surprising. Clobber-safe reads;
2621
+ * a doomed clobbered node may shadow `removeAttribute` (its own attributes are
2622
+ * irrelevant — it is discarded — while its non-clobbered descendants, e.g.
2623
+ * the `<img>`, are reached and scrubbed).
2624
+ *
2625
+ * @param root the root of a removed subtree to neutralise
2626
+ */
2627
+ const _neutralizeSubtree = function _neutralizeSubtree(root) {
2628
+ const stack = [root];
2629
+ while (stack.length > 0) {
2630
+ const node = stack.pop();
2631
+ const nodeType = getNodeType ? getNodeType(node) : node.nodeType;
2632
+ if (nodeType === NODE_TYPE.element) {
2633
+ _stripDisallowedAttributes(node);
2634
+ }
2635
+ const childNodes = getChildNodes(node);
2636
+ if (childNodes) {
2637
+ for (let i = childNodes.length - 1; i >= 0; --i) {
2638
+ stack.push(childNodes[i]);
2639
+ }
2640
+ }
2641
+ }
2642
+ };
2643
+ /**
2644
+ * _neutralizePatchLinkage
2645
+ *
2646
+ * IN_PLACE entry pre-pass (declarative-partial-updates / streaming
2647
+ * hardening, https://github.com/WICG/declarative-partial-updates).
2648
+ *
2649
+ * The main walk strips patch linkage (`for`/`patchsrc`) and removes range
2650
+ * markers (PIs / markup comments) node-by-node, in document order, AS it
2651
+ * reaches each node. On a live in-place root that leaves a window: from the
2652
+ * moment the root is connected until the walk arrives at a given node, that
2653
+ * node's linkage is live. A patch applied on connection/stream can fire as
2654
+ * a microtask during the walk and inject or teleport an unsanitized DOM
2655
+ * range into a region the iterator has already passed and will not revisit,
2656
+ * so the post-return "tree is sanitized" contract is violated. Sweep the
2657
+ * whole tree once up front and sever every linkage before the walk begins,
2658
+ * closing that window.
2659
+ *
2660
+ * This CANNOT undo a patch that already fired before sanitize ran — that is
2661
+ * the irreducible "do not IN_PLACE a live-connected attacker tree" caveat —
2662
+ * but it closes everything from sanitize-start onward. Gated on SAFE_FOR_XML
2663
+ * to group with the rest of the declarative-partial-updates handling and
2664
+ * stay overridable, consistent with the codebase.
2665
+ *
2666
+ * Clobber-safe traversal (cached childNodes getter); per-node try/catch so a
2667
+ * clobbered root cannot defeat the sweep of its non-clobbered descendants.
2668
+ *
2669
+ * NOTE (pending real-Chrome confirmation, see test/declarative-patch-probe
2670
+ * .html Q1): this mirrors the existing policy of keeping `for` on
2671
+ * <label>/<output>. If the shipping feature can drive a patch through a
2672
+ * surviving `for`-on-label/output + `id` pair, this pre-pass and the
2673
+ * attribute check at _isBasicCustomElement's caller must additionally drop
2674
+ * that pair on the IN_PLACE path. Left as-is until the taxonomy is verified.
2675
+ *
2676
+ * @param root the in-place root to sweep
2677
+ */
2678
+ const _neutralizePatchLinkage = function _neutralizePatchLinkage(root) {
2679
+ if (!SAFE_FOR_XML) {
2680
+ return;
2681
+ }
2682
+ const stack = [root];
2683
+ while (stack.length > 0) {
2684
+ const node = stack.pop();
2685
+ const nodeType = getNodeType ? getNodeType(node) : node.nodeType;
2686
+ /* Remove range markers (the target side of a patch linkage): every
2687
+ processing instruction, and any markup-bearing comment. */
2688
+ if (nodeType === NODE_TYPE.processingInstruction || nodeType === NODE_TYPE.comment && regExpTest(COMMENT_MARKUP_PROBE, node.data)) {
2689
+ try {
2690
+ remove(node);
2691
+ } catch (_) {
2692
+ /* Best-effort */
2693
+ }
2694
+ continue;
2695
+ }
2696
+ /* Strip patch-source attributes (the source side) off elements. */
2697
+ if (nodeType === NODE_TYPE.element) {
2698
+ const element = node;
2699
+ const lcTag = transformCaseFunc(getNodeName ? getNodeName(node) : node.nodeName);
2700
+ try {
2701
+ if (element.hasAttribute && element.hasAttribute('patchsrc')) {
2702
+ element.removeAttribute('patchsrc');
2703
+ }
2704
+ if (element.hasAttribute && element.hasAttribute('for') && lcTag !== 'label' && lcTag !== 'output') {
2705
+ element.removeAttribute('for');
2706
+ }
2707
+ } catch (_) {
2708
+ /* Clobbered removeAttribute/hasAttribute on a doomed node — ignore */
2709
+ }
2710
+ }
2711
+ const childNodes = getChildNodes(node);
2712
+ if (childNodes) {
2713
+ for (let i = childNodes.length - 1; i >= 0; --i) {
2714
+ stack.push(childNodes[i]);
2715
+ }
2716
+ }
2717
+ }
2718
+ };
2719
+ /**
2720
+ * _initDocument
2721
+ *
2722
+ * @param dirty - a string of dirty markup
2723
+ * @return a DOM, filled with the dirty markup
2724
+ */
2725
+ const _initDocument = function _initDocument(dirty) {
2726
+ /* Create a HTML document */
2727
+ let doc = null;
2728
+ let leadingWhitespace = null;
2729
+ if (FORCE_BODY) {
2730
+ dirty = '<remove></remove>' + dirty;
2731
+ } else {
2732
+ /* If FORCE_BODY isn't used, leading whitespace needs to be preserved manually */
2733
+ const matches = stringMatch(dirty, /^[\r\n\t ]+/);
2734
+ leadingWhitespace = matches && matches[0];
2735
+ }
2736
+ if (PARSER_MEDIA_TYPE === 'application/xhtml+xml' && NAMESPACE === HTML_NAMESPACE) {
2737
+ // Root of XHTML doc must contain xmlns declaration (see https://www.w3.org/TR/xhtml1/normative.html#strict)
2738
+ dirty = '<html xmlns="http://www.w3.org/1999/xhtml"><head></head><body>' + dirty + '</body></html>';
2739
+ }
2740
+ const dirtyPayload = trustedTypesPolicy ? _createTrustedHTML(dirty) : dirty;
2741
+ /*
2742
+ * Use the DOMParser API by default, fallback later if needs be
2743
+ * DOMParser not work for svg when has multiple root element.
2744
+ */
2745
+ if (NAMESPACE === HTML_NAMESPACE) {
2746
+ try {
2747
+ doc = new DOMParser().parseFromString(dirtyPayload, PARSER_MEDIA_TYPE);
2748
+ } catch (_) {}
2749
+ }
2750
+ /* Use createHTMLDocument in case DOMParser is not available */
2751
+ if (!doc || !doc.documentElement) {
2752
+ doc = implementation.createDocument(NAMESPACE, 'template', null);
2753
+ try {
2754
+ doc.documentElement.innerHTML = IS_EMPTY_INPUT ? emptyHTML : dirtyPayload;
2755
+ } catch (_) {
2756
+ // Syntax error if dirtyPayload is invalid xml
2757
+ }
2758
+ }
2759
+ const body = doc.body || doc.documentElement;
2760
+ if (dirty && leadingWhitespace) {
2761
+ body.insertBefore(document.createTextNode(leadingWhitespace), body.childNodes[0] || null);
2762
+ }
2763
+ /* Work on whole document or just its body */
2764
+ if (NAMESPACE === HTML_NAMESPACE) {
2765
+ return getElementsByTagName.call(doc, WHOLE_DOCUMENT ? 'html' : 'body')[0];
2766
+ }
2767
+ return WHOLE_DOCUMENT ? doc.documentElement : body;
2768
+ };
2769
+ /**
2770
+ * Creates a NodeIterator object that you can use to traverse filtered lists of nodes or elements in a document.
2771
+ *
2772
+ * @param root The root element or node to start traversing on.
2773
+ * @return The created NodeIterator
2774
+ */
2775
+ const _createNodeIterator = function _createNodeIterator(root) {
2776
+ return createNodeIterator.call(root.ownerDocument || root, root,
2777
+ // eslint-disable-next-line no-bitwise
2778
+ NodeFilter.SHOW_ELEMENT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_TEXT | NodeFilter.SHOW_PROCESSING_INSTRUCTION | NodeFilter.SHOW_CDATA_SECTION, null);
2779
+ };
2780
+ /**
2781
+ * Replace template expression syntax (mustache, ERB, template
2782
+ * literal) with a space; shared by all SAFE_FOR_TEMPLATES scrub
2783
+ * sites. Order matters: mustache, then ERB, then template literal.
2784
+ *
2785
+ * @param value the string to scrub
2786
+ * @returns the scrubbed string
2787
+ */
2788
+ const _stripTemplateExpressions = function _stripTemplateExpressions(value) {
2789
+ value = stringReplace(value, MUSTACHE_EXPR$1, ' ');
2790
+ value = stringReplace(value, ERB_EXPR$1, ' ');
2791
+ value = stringReplace(value, TMPLIT_EXPR$1, ' ');
2792
+ return value;
2793
+ };
2794
+ /**
2795
+ * Strip template-engine expressions ({{...}}, ${...}, <%...%>) from the
2796
+ * character data of an element subtree. Used as the final safety net for
2797
+ * SAFE_FOR_TEMPLATES on every DOM-returning code path so that expressions
2798
+ * which only form after text-node normalization (e.g. fragments split across
2799
+ * stripped elements) cannot survive into a template-evaluating framework.
2800
+ *
2801
+ * Walks text/comment/CDATA/processing-instruction nodes and mutates `.data`
2802
+ * in place rather than round-tripping through innerHTML. This preserves
2803
+ * descendant node references (important for IN_PLACE callers), avoids a
2804
+ * serialize/reparse cycle, and reads literal character data — which means
2805
+ * `<%...%>` in text content matches the ERB regex against its real bytes
2806
+ * instead of the HTML-entity-escaped form innerHTML would produce.
2807
+ *
2808
+ * Attribute values are not visited here; SAFE_FOR_TEMPLATES handling for
2809
+ * attributes is performed during the per-node `_sanitizeAttributes` pass.
2810
+ *
2811
+ * @param node The root element whose character data should be scrubbed.
2812
+ */
2813
+ const _scrubTemplateExpressions2 = function _scrubTemplateExpressions(node) {
2814
+ var _node$querySelectorAl;
2815
+ node.normalize();
2816
+ const walker = createNodeIterator.call(node.ownerDocument || node, node,
2817
+ // eslint-disable-next-line no-bitwise
2818
+ NodeFilter.SHOW_TEXT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_CDATA_SECTION | NodeFilter.SHOW_PROCESSING_INSTRUCTION, null);
2819
+ let currentNode = walker.nextNode();
2820
+ while (currentNode) {
2821
+ currentNode.data = _stripTemplateExpressions(currentNode.data);
2822
+ currentNode = walker.nextNode();
2823
+ }
2824
+ // NodeIterator does not descend into <template>.content per the DOM spec,
2825
+ // so we must explicitly recurse into each template's content fragment,
2826
+ // mirroring the approach used by _sanitizeShadowDOM.
2827
+ const templates = (_node$querySelectorAl = node.querySelectorAll) === null || _node$querySelectorAl === void 0 ? void 0 : _node$querySelectorAl.call(node, 'template');
2828
+ if (templates) {
2829
+ arrayForEach(templates, tmpl => {
2830
+ if (_isDocumentFragment(tmpl.content)) {
2831
+ _scrubTemplateExpressions2(tmpl.content);
2832
+ }
2833
+ });
2834
+ }
2835
+ };
2836
+ /**
2837
+ * _isClobbered
2838
+ *
2839
+ * Detect DOM-clobbering on HTMLFormElement nodes. Form is the only HTML
2840
+ * interface with [LegacyOverrideBuiltIns]; a descendant element with a
2841
+ * `name` attribute matching a prototype property shadows that property
2842
+ * on direct reads. We use this check at the IN_PLACE entry-point and
2843
+ * during attribute sanitization to refuse clobbered forms.
2844
+ *
2845
+ * @param element element to check for clobbering attacks
2846
+ * @return true if clobbered, false if safe
2847
+ */
2848
+ const _isClobbered = function _isClobbered(element) {
2849
+ // Realm-independent tag-name probe. If we can't determine the tag
2850
+ // name at all, we can't reason about clobbering — return false
2851
+ // (the caller's other defences still apply).
2852
+ const realTagName = getNodeName ? getNodeName(element) : null;
2853
+ if (typeof realTagName !== 'string') {
2854
+ return false;
2855
+ }
2856
+ if (transformCaseFunc(realTagName) !== 'form') {
2857
+ return false;
2858
+ }
2859
+ return typeof element.nodeName !== 'string' || typeof element.textContent !== 'string' || typeof element.removeChild !== 'function' ||
2860
+ // Realm-safe NamedNodeMap detection: equality against the cached
2861
+ // prototype getter. Clobbered .attributes (e.g. <input name="attributes">)
2862
+ // makes the direct read diverge from the cached read; a clean form
2863
+ // (same-realm OR foreign-realm) has both reads pointing at the same
2864
+ // canonical NamedNodeMap.
2865
+ element.attributes !== getAttributes(element) || typeof element.removeAttribute !== 'function' || typeof element.setAttribute !== 'function' || typeof element.namespaceURI !== 'string' || typeof element.insertBefore !== 'function' || typeof element.hasChildNodes !== 'function' ||
2866
+ // NodeType clobbering probe. Cached Node.prototype.nodeType getter
2867
+ // returns the integer 1 for any Element regardless of realm; direct
2868
+ // read on a clobbered form (e.g. <input name="nodeType">) returns
2869
+ // the named child element. Cheap addition — nodeType is read from
2870
+ // an internal slot, no serialization cost — and removes a residual
2871
+ // clobbering surface used by several mXSS / PI / comment branches
2872
+ // in _sanitizeElements that compare currentNode.nodeType directly.
2873
+ element.nodeType !== getNodeType(element) ||
2874
+ // HTMLFormElement has [LegacyOverrideBuiltIns]: a descendant named
2875
+ // "childNodes" shadows the prototype getter. Direct reads of
2876
+ // form.childNodes from a clobbered form return the named child
2877
+ // instead of the real NodeList, so any walk that reads it directly
2878
+ // skips the form's real children. Compare the direct read to the
2879
+ // cached Node.prototype getter — when the form's named-property
2880
+ // getter intercepts the read, the two values differ and we flag
2881
+ // the form. This catches every clobbering child type (input,
2882
+ // select, etc.) regardless of whether the named child happens to
2883
+ // carry a numeric .length, which a typeof-based probe would miss
2884
+ // (e.g. HTMLSelectElement.length is a defined unsigned-long).
2885
+ element.childNodes !== getChildNodes(element);
2886
+ };
2887
+ /**
2888
+ * Checks whether the given value is a DocumentFragment from any realm.
2889
+ *
2890
+ * The realm-independent replacement reads `nodeType` through the cached
2891
+ * Node.prototype getter and compares to the DOCUMENT_FRAGMENT_NODE
2892
+ * constant (11). nodeType is a numeric value resolved from the node's
2893
+ * internal slot, identical across realms for the same kind of node.
2894
+ *
2895
+ * @param value object to check
2896
+ * @return true if value is a DocumentFragment-shaped node from any realm
2897
+ */
2898
+ const _isDocumentFragment = function _isDocumentFragment(value) {
2899
+ if (!getNodeType || typeof value !== 'object' || value === null) {
2900
+ return false;
2901
+ }
2902
+ try {
2903
+ return getNodeType(value) === NODE_TYPE.documentFragment;
2904
+ } catch (_) {
2905
+ return false;
2906
+ }
2907
+ };
2908
+ /**
2909
+ * Checks whether the given object is a DOM node, including nodes that
2910
+ * originate from a different window/realm (e.g. an iframe's
2911
+ * contentDocument). The previous `value instanceof Node` check was
2912
+ * realm-bound: nodes from a different window failed it, causing
2913
+ * sanitize() to silently stringify them and reset IN_PLACE to false,
2914
+ * returning the original node unsanitized. See GHSA-4w3q-35jp-p934.
2915
+ *
2916
+ * @param value object to check whether it's a DOM node
2917
+ * @return true if value is a DOM node from any realm
2918
+ */
2919
+ const _isNode = function _isNode(value) {
2920
+ if (!getNodeType || typeof value !== 'object' || value === null) {
2921
+ return false;
2922
+ }
2923
+ try {
2924
+ return typeof getNodeType(value) === 'number';
2925
+ } catch (_) {
2926
+ return false;
2927
+ }
2928
+ };
2929
+ function _executeHooks(hooks, currentNode, data) {
2930
+ if (hooks.length === 0) {
2931
+ return;
2932
+ }
2933
+ arrayForEach(hooks, hook => {
2934
+ hook.call(DOMPurify, currentNode, data, CONFIG);
2935
+ });
2936
+ }
2937
+ /**
2938
+ * Structural-threat checks that condemn a node regardless of the
2939
+ * allowlists: mXSS via namespace confusion, risky CSS construction,
2940
+ * processing instructions, markup-bearing comments. Pure predicate;
2941
+ * the caller removes. Check order is load-bearing.
2942
+ *
2943
+ * @param currentNode the node to inspect
2944
+ * @param tagName the node's transformCaseFunc'd tag name
2945
+ * @return true if the node must be removed
2946
+ */
2947
+ const _isUnsafeNode = function _isUnsafeNode(currentNode, tagName) {
2948
+ /* Detect mXSS attempts abusing namespace confusion */
2949
+ if (SAFE_FOR_XML && currentNode.hasChildNodes() && !_isNode(currentNode.firstElementChild) && regExpTest(ELEMENT_MARKUP_PROBE, currentNode.textContent) && regExpTest(ELEMENT_MARKUP_PROBE, currentNode.innerHTML)) {
2950
+ return true;
2951
+ }
2952
+ /* Remove risky CSS construction leading to mXSS */
2953
+ if (SAFE_FOR_XML && currentNode.namespaceURI === HTML_NAMESPACE && tagName === 'style' && _isNode(currentNode.firstElementChild)) {
2954
+ return true;
2955
+ }
2956
+ /* Remove any occurrence of processing instructions */
2957
+ if (currentNode.nodeType === NODE_TYPE.processingInstruction) {
2958
+ return true;
2959
+ }
2960
+ /* Remove any kind of possibly harmful comments */
2961
+ if (SAFE_FOR_XML && currentNode.nodeType === NODE_TYPE.comment && regExpTest(COMMENT_MARKUP_PROBE, currentNode.data)) {
2962
+ return true;
2963
+ }
2964
+ return false;
2965
+ };
2966
+ /**
2967
+ * Handle a node whose tag is forbidden or not allowlisted: keep
2968
+ * allowed custom elements (false return exits _sanitizeElements
2969
+ * early - the namespace and fallback-tag removal checks are
2970
+ * intentionally skipped for kept custom elements), else hoist
2971
+ * content per KEEP_CONTENT and remove.
2972
+ *
2973
+ * A kept custom element is the ONLY case in which this function
2974
+ * returns false, so the caller uses that return value to run the
2975
+ * afterSanitizeElements hook on the kept element and keep the
2976
+ * element-hook lifecycle consistent with normal allowlisted
2977
+ * elements (GHSA-c2j3-45gr-mqc4).
2978
+ *
2979
+ * @param currentNode the disallowed node
2980
+ * @param tagName the node's transformCaseFunc'd tag name
2981
+ * @return true if the node was removed, false if kept
2982
+ */
2983
+ const _sanitizeDisallowedNode = function _sanitizeDisallowedNode(currentNode, tagName) {
2984
+ /* Check if we have a custom element to handle */
2985
+ if (!FORBID_TAGS[tagName] && _isBasicCustomElement(tagName)) {
2986
+ if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)) {
2987
+ return false;
2988
+ }
2989
+ if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(tagName)) {
2990
+ return false;
2991
+ }
2992
+ }
2993
+ /* Keep content except for bad-listed elements.
2994
+ Use the cached prototype getters exclusively — the previous code
2995
+ had `|| currentNode.parentNode` / `|| currentNode.childNodes`
2996
+ fallbacks, but the cached getters always return the canonical
2997
+ value (or null for a real parent-less node), so the fallback
2998
+ path was dead in safe cases and a clobbering surface in unsafe
2999
+ ones. Falsy cached results stay falsy; the `if (childNodes &&
3000
+ parentNode)` check already gates correctly. */
3001
+ if (KEEP_CONTENT && !FORBID_CONTENTS[tagName]) {
3002
+ const parentNode = getParentNode(currentNode);
3003
+ const childNodes = getChildNodes(currentNode);
3004
+ if (childNodes && parentNode) {
3005
+ const childCount = childNodes.length;
3006
+ /* In-place: hoist the *original* children so the iterator visits
3007
+ and sanitises them through the same allowlist pass as every other
3008
+ node. The caller built the tree in the live document, so the
3009
+ originals carry already-queued resource events (`<img onerror>`,
3010
+ `<video>`/`<audio>` error, lazy/`onload`, …); cloning would leave
3011
+ those originals detached but still armed, firing in page scope
3012
+ while the returned tree looked clean. Moving is safe in-place: the
3013
+ root is pre-validated as an allowed tag and so is never the node
3014
+ being removed, which keeps `parentNode` inside the iterator root
3015
+ and the relocated child inside the serialised tree.
3016
+ Otherwise (string / DOM-copy paths): clone. The iterator is rooted
3017
+ at — and the result serialised from — `body`, so a restrictive
3018
+ ALLOWED_TAGS that removes `body` itself must leave its content in
3019
+ place, which only cloning does; and those paths parse into an
3020
+ inert document, so their discarded originals never had a queued
3021
+ event to neutralise.
3022
+ `childNodes` is live; a tail-to-head walk keeps `childNodes[i]`
3023
+ valid whether we move (drops the trailing entry) or clone (leaves
3024
+ the list intact). */
3025
+ for (let i = childCount - 1; i >= 0; --i) {
3026
+ const hoisted = IN_PLACE ? childNodes[i] : cloneNode(childNodes[i], true);
3027
+ parentNode.insertBefore(hoisted, getNextSibling(currentNode));
3028
+ }
3029
+ }
3030
+ }
3031
+ _forceRemove(currentNode);
3032
+ return true;
3033
+ };
3034
+ /**
3035
+ * _sanitizeElements
3036
+ *
3037
+ * @protect nodeName
3038
+ * @protect textContent
3039
+ * @protect removeChild
3040
+ * @param currentNode to check for permission to exist
3041
+ * @return true if node was killed, false if left alive
3042
+ */
3043
+ // eslint-disable-next-line complexity
3044
+ const _sanitizeElements = function _sanitizeElements(currentNode, root) {
3045
+ /* Execute a hook if present */
3046
+ _executeHooks(hooks.beforeSanitizeElements, currentNode, null);
3047
+ /* A hook may have detached the node — treat it as removed (see the
3048
+ detached-node comment after the uponSanitizeElement hook below). */
3049
+ if (currentNode !== root && getParentNode(currentNode) === null) {
3050
+ return true;
3051
+ }
3052
+ /* Check if element is clobbered or can clobber */
3053
+ if (_isClobbered(currentNode)) {
3054
+ _forceRemove(currentNode);
3055
+ return true;
3056
+ }
3057
+ /* Now let's check the element's type and name */
3058
+ const tagName = transformCaseFunc(getNodeName ? getNodeName(currentNode) : currentNode.nodeName);
3059
+ /* Execute a hook if present */
3060
+ _executeHooks(hooks.uponSanitizeElement, currentNode, {
3061
+ tagName,
3062
+ allowedTags: ALLOWED_TAGS
3063
+ });
3064
+ /* A hook may have detached the node from the tree — a long-standing
3065
+ user pattern (issue #469; draw.io-style foreignObject filtering).
3066
+ Per the cached, unclobberable parentNode getter the node is
3067
+ genuinely out of the tree, so it can reach neither the serialized
3068
+ output nor an IN_PLACE live tree; treat it as removed and stop
3069
+ processing it. Without this guard, the unsafe-node / namespace
3070
+ checks below would call _forceRemove on a parentless node and hit
3071
+ the REPORT-3 fail-closed throw — which exists for nodes DOMPurify
3072
+ wants gone but *cannot* detach (clobbered / parentless roots), the
3073
+ opposite of a node that is already safely gone. The walk root is
3074
+ exempt: a detached IN_PLACE root is legitimate input and must still
3075
+ be fully sanitized, and a kill-decision on it must keep hitting the
3076
+ REPORT-3 throw. Nodes detached by hooks are the hook's
3077
+ responsibility: they are not recorded in DOMPurify.removed and are
3078
+ not neutralized by the post-walk IN_PLACE pass. */
3079
+ if (currentNode !== root && getParentNode(currentNode) === null) {
3080
+ return true;
3081
+ }
3082
+ /* Remove mXSS vectors, processing instructions and risky comments */
3083
+ if (_isUnsafeNode(currentNode, tagName)) {
3084
+ _forceRemove(currentNode);
3085
+ return true;
3086
+ }
3087
+ /* Remove element if anything forbids its presence */
3088
+ if (FORBID_TAGS[tagName] || !(EXTRA_ELEMENT_HANDLING.tagCheck instanceof Function && EXTRA_ELEMENT_HANDLING.tagCheck(tagName)) && !ALLOWED_TAGS[tagName]) {
3089
+ const removed = _sanitizeDisallowedNode(currentNode, tagName);
3090
+ /* A false return means the node is a custom element kept via
3091
+ CUSTOM_ELEMENT_HANDLING - the only keep path through
3092
+ _sanitizeDisallowedNode. Run afterSanitizeElements on it so the
3093
+ element-hook lifecycle matches normal allowlisted elements: a
3094
+ security policy applied in this hook (e.g. stripping an attribute
3095
+ from every surviving element) must not silently skip kept custom
3096
+ elements (GHSA-c2j3-45gr-mqc4). This mirrors the normal-element
3097
+ tail below - the hook runs, then the walker's subsequent
3098
+ _sanitizeAttributes pass sanitizes the element's attributes. The
3099
+ deliberately skipped namespace and fallback-tag removal checks stay
3100
+ skipped; they are removal decisions, not the hook contract. */
3101
+ if (removed === false) {
3102
+ _executeHooks(hooks.afterSanitizeElements, currentNode, null);
3103
+ }
3104
+ return removed;
3105
+ }
3106
+ /* Check whether element has a valid namespace.
3107
+ Realm-safe check (GHSA-hpcv-96wg-7vj8): use the cached Node.prototype
3108
+ nodeType getter rather than `instanceof Element`, which is realm-
3109
+ bound and short-circuits to false for any node minted in a different
3110
+ realm — letting a foreign-realm element with a forbidden namespace
3111
+ slip past the namespace check entirely. */
3112
+ const nt = getNodeType ? getNodeType(currentNode) : currentNode.nodeType;
3113
+ if (nt === NODE_TYPE.element && !_checkValidNamespace(currentNode)) {
3114
+ _forceRemove(currentNode);
3115
+ return true;
3116
+ }
3117
+ /* Make sure that older browsers don't get fallback-tag mXSS */
3118
+ if ((tagName === 'noscript' || tagName === 'noembed' || tagName === 'noframes') && regExpTest(FALLBACK_TAG_CLOSE, currentNode.innerHTML)) {
3119
+ _forceRemove(currentNode);
3120
+ return true;
3121
+ }
3122
+ /* Sanitize element content to be template-safe */
3123
+ if (SAFE_FOR_TEMPLATES && currentNode.nodeType === NODE_TYPE.text) {
3124
+ /* Get the element's text content */
3125
+ const content = _stripTemplateExpressions(currentNode.textContent);
3126
+ if (currentNode.textContent !== content) {
3127
+ arrayPush(DOMPurify.removed, {
3128
+ element: currentNode.cloneNode()
3129
+ });
3130
+ currentNode.textContent = content;
3131
+ }
3132
+ }
3133
+ /* Execute a hook if present */
3134
+ _executeHooks(hooks.afterSanitizeElements, currentNode, null);
3135
+ return false;
3136
+ };
3137
+ /**
3138
+ * _isValidAttribute
3139
+ *
3140
+ * @param lcTag Lowercase tag name of containing element.
3141
+ * @param lcName Lowercase attribute name.
3142
+ * @param value Attribute value.
3143
+ * @return Returns true if `value` is valid, otherwise false.
3144
+ */
3145
+ // eslint-disable-next-line complexity
3146
+ const _isValidAttribute = function _isValidAttribute(lcTag, lcName, value) {
3147
+ /* FORBID_ATTR must always win, even if ADD_ATTR predicate would allow it */
3148
+ if (FORBID_ATTR[lcName]) {
3149
+ return false;
3150
+ }
3151
+ /* Reject declarative-partial-updates patch-linkage attributes
3152
+ (https://github.com/WICG/declarative-partial-updates).
3153
+ Empirical note (Chrome 150, verified — see
3154
+ test/declarative-patch-probe-v3.html): expansion is NOT applied after
3155
+ sanitization. For the string path it fires during sanitize()'s own
3156
+ parse, so the walk sees and sanitizes the fully materialized expanded
3157
+ tree — teleports into MathML/SVG integration points included; a
3158
+ weaponized `<template for>`->`<img onerror>` comes back with the handler
3159
+ stripped. For the IN_PLACE path it fires on connection, before the walk.
3160
+ Either way DOMPurify is NOT blind to the patch.
3161
+ This removal is therefore defense-in-depth rather than the sole barrier:
3162
+ it prevents live linkage from surviving into the OUTPUT and re-expanding
3163
+ in the caller's context, and keeps behaviour deterministic if a future
3164
+ engine defers expansion. `for` is legitimate only on <label>/<output>;
3165
+ anywhere else (notably <template for>) it links the element to a patch
3166
+ target and teleports or removes an arbitrary DOM range by id/marker name.
3167
+ `patchsrc` fetches remote markup and is treated as a script-loading
3168
+ mechanism (CSP). Gated on SAFE_FOR_XML so the removal groups with the
3169
+ other structural-threat checks and stays overridable, consistent with
3170
+ the rest of the codebase. PI range markers are already removed by
3171
+ _isUnsafeNode. */
3172
+ if (SAFE_FOR_XML && lcName === 'patchsrc') {
3173
+ return false;
3174
+ }
3175
+ if (SAFE_FOR_XML && lcName === 'for' && lcTag !== 'label' && lcTag !== 'output') {
3176
+ return false;
3177
+ }
3178
+ /* Make sure attribute cannot clobber */
3179
+ if (SANITIZE_DOM && (lcName === 'id' || lcName === 'name') && (value in document || value in formElement)) {
3180
+ return false;
3181
+ }
3182
+ const nameIsPermitted = ALLOWED_ATTR[lcName] || EXTRA_ELEMENT_HANDLING.attributeCheck instanceof Function && EXTRA_ELEMENT_HANDLING.attributeCheck(lcName, lcTag);
3183
+ /* Allow valid data-* attributes: At least one character after "-"
3184
+ (https://html.spec.whatwg.org/multipage/dom.html#embedding-custom-non-visible-data-with-the-data-*-attributes)
3185
+ XML-compatible (https://html.spec.whatwg.org/multipage/infrastructure.html#xml-compatible and http://www.w3.org/TR/xml/#d0e804)
3186
+ We don't need to check the value; it's always URI safe. */
3187
+ if (ALLOW_DATA_ATTR && regExpTest(DATA_ATTR$1, lcName)) ; else if (ALLOW_ARIA_ATTR && regExpTest(ARIA_ATTR$1, lcName)) ; else if (!nameIsPermitted) {
3188
+ if (
3189
+ // First condition does a very basic check if a) it's basically a valid custom element tagname AND
3190
+ // b) if the tagName passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
3191
+ // and c) if the attribute name passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.attributeNameCheck
3192
+ _isBasicCustomElement(lcTag) && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, lcTag) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(lcTag)) && (CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.attributeNameCheck, lcName) || CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.attributeNameCheck(lcName, lcTag)) ||
3193
+ // Alternative, second condition checks if it's an `is`-attribute, AND
3194
+ // the value passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
3195
+ lcName === 'is' && CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, value) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(value))) ; else {
3196
+ return false;
3197
+ }
3198
+ /* Check value is safe. First, is attr inert? If so, is safe */
3199
+ } else if (URI_SAFE_ATTRIBUTES[lcName]) ; else if (regExpTest(IS_ALLOWED_URI$1, stringReplace(value, ATTR_WHITESPACE$1, ''))) ; else if ((lcName === 'src' || lcName === 'xlink:href' || lcName === 'href') && lcTag !== 'script' && stringIndexOf(value, 'data:') === 0 && DATA_URI_TAGS[lcTag]) ; else if (ALLOW_UNKNOWN_PROTOCOLS && !regExpTest(IS_SCRIPT_OR_DATA$1, stringReplace(value, ATTR_WHITESPACE$1, ''))) ; else if (value) {
3200
+ return false;
3201
+ } else ;
3202
+ return true;
3203
+ };
3204
+ /* Names the HTML spec reserves from valid-custom-element-name; these must
3205
+ * never be treated as basic custom elements even when a permissive
3206
+ * CUSTOM_ELEMENT_HANDLING.tagNameCheck is configured. */
3207
+ const RESERVED_CUSTOM_ELEMENT_NAMES = addToSet({}, ['annotation-xml', 'color-profile', 'font-face', 'font-face-format', 'font-face-name', 'font-face-src', 'font-face-uri', 'missing-glyph']);
3208
+ /**
3209
+ * _isBasicCustomElement
3210
+ * checks if at least one dash is included in tagName, and it's not the first char
3211
+ * for more sophisticated checking see https://github.com/sindresorhus/validate-element-name
3212
+ *
3213
+ * @param tagName name of the tag of the node to sanitize
3214
+ * @returns Returns true if the tag name meets the basic criteria for a custom element, otherwise false.
3215
+ */
3216
+ const _isBasicCustomElement = function _isBasicCustomElement(tagName) {
3217
+ return !RESERVED_CUSTOM_ELEMENT_NAMES[stringToLowerCase(tagName)] && regExpTest(CUSTOM_ELEMENT$1, tagName);
3218
+ };
3219
+ /**
3220
+ * Wrap an attribute value in the matching Trusted Types object when
3221
+ * the active policy requires it. Namespaced attributes pass through
3222
+ * unchanged (no TT support yet, see
3223
+ * https://bugs.chromium.org/p/chromium/issues/detail?id=1305293).
3224
+ *
3225
+ * @param lcTag lowercase tag name of the containing element
3226
+ * @param lcName lowercase attribute name
3227
+ * @param namespaceURI the attribute's namespace, if any
3228
+ * @param value the attribute value to wrap
3229
+ * @return the value, wrapped when Trusted Types demand it
3230
+ */
3231
+ const _applyTrustedTypesToAttribute = function _applyTrustedTypesToAttribute(lcTag, lcName, namespaceURI, value) {
3232
+ if (trustedTypesPolicy && typeof trustedTypes === 'object' && typeof trustedTypes.getAttributeType === 'function' && !namespaceURI) {
3233
+ switch (trustedTypes.getAttributeType(lcTag, lcName)) {
3234
+ case 'TrustedHTML':
3235
+ {
3236
+ return _createTrustedHTML(value);
3237
+ }
3238
+ case 'TrustedScriptURL':
3239
+ {
3240
+ return _createTrustedScriptURL(value);
3241
+ }
3242
+ }
3243
+ }
3244
+ return value;
3245
+ };
3246
+ /**
3247
+ * Write a modified attribute value back onto the element. On
3248
+ * success, re-probe for clobbering introduced by the new value and
3249
+ * remove the element when found; otherwise pop the removal entry
3250
+ * recorded by the earlier _removeAttribute (long-standing pairing
3251
+ * with the SANITIZE_NAMED_PROPS path - do not "fix" casually). On
3252
+ * failure, remove the attribute instead.
3253
+ *
3254
+ * @param currentNode the element carrying the attribute
3255
+ * @param name the attribute name as present on the element
3256
+ * @param namespaceURI the attribute's namespace, if any
3257
+ * @param value the new attribute value
3258
+ */
3259
+ const _setAttributeValue = function _setAttributeValue(currentNode, name, namespaceURI, value) {
3260
+ try {
3261
+ if (namespaceURI) {
3262
+ currentNode.setAttributeNS(namespaceURI, name, value);
3263
+ } else {
3264
+ /* Fallback to setAttribute() for browser-unrecognized namespaces e.g. "x-schema". */
3265
+ currentNode.setAttribute(name, value);
3266
+ }
3267
+ if (_isClobbered(currentNode)) {
3268
+ _forceRemove(currentNode);
3269
+ } else {
3270
+ arrayPop(DOMPurify.removed);
3271
+ }
3272
+ } catch (_) {
3273
+ _removeAttribute(name, currentNode);
3274
+ }
3275
+ };
3276
+ /**
3277
+ * _sanitizeAttributes
3278
+ *
3279
+ * @protect attributes
3280
+ * @protect nodeName
3281
+ * @protect removeAttribute
3282
+ * @protect setAttribute
3283
+ *
3284
+ * @param currentNode to sanitize
3285
+ */
3286
+ const _sanitizeAttributes = function _sanitizeAttributes(currentNode) {
3287
+ /* Execute a hook if present */
3288
+ _executeHooks(hooks.beforeSanitizeAttributes, currentNode, null);
3289
+ const attributes = currentNode.attributes;
3290
+ /* Check if we have attributes; if not we might have a text node */
3291
+ if (!attributes || _isClobbered(currentNode)) {
3292
+ return;
3293
+ }
3294
+ const hookEvent = {
3295
+ attrName: '',
3296
+ attrValue: '',
3297
+ keepAttr: true,
3298
+ allowedAttributes: ALLOWED_ATTR,
3299
+ forceKeepAttr: undefined
3300
+ };
3301
+ let l = attributes.length;
3302
+ const lcTag = transformCaseFunc(currentNode.nodeName);
3303
+ /* Go backwards over all attributes; safely remove bad ones */
3304
+ while (l--) {
3305
+ const attr = attributes[l];
3306
+ const name = attr.name,
3307
+ namespaceURI = attr.namespaceURI,
3308
+ attrValue = attr.value;
3309
+ const lcName = transformCaseFunc(name);
3310
+ const initValue = attrValue;
3311
+ let value = name === 'value' ? initValue : stringTrim(initValue);
3312
+ /* Execute a hook if present */
3313
+ hookEvent.attrName = lcName;
3314
+ hookEvent.attrValue = value;
3315
+ hookEvent.keepAttr = true;
3316
+ hookEvent.forceKeepAttr = undefined; // Allows developers to see this is a property they can set
3317
+ _executeHooks(hooks.uponSanitizeAttribute, currentNode, hookEvent);
3318
+ value = hookEvent.attrValue;
3319
+ /* Full DOM Clobbering protection via namespace isolation,
3320
+ * Prefix id and name attributes with `user-content-`
3321
+ */
3322
+ if (SANITIZE_NAMED_PROPS && (lcName === 'id' || lcName === 'name') && stringIndexOf(value, SANITIZE_NAMED_PROPS_PREFIX) !== 0) {
3323
+ // Remove the attribute with this value
3324
+ _removeAttribute(name, currentNode);
3325
+ // Prefix the value and later re-create the attribute with the sanitized value
3326
+ value = SANITIZE_NAMED_PROPS_PREFIX + value;
3327
+ }
3328
+ // Else: already prefixed, leave the attribute alone — the prefix is
3329
+ // itself the clobbering protection, and re-applying it is incorrect.
3330
+ /* Work around a security issue with comments inside attributes */
3331
+ if (SAFE_FOR_XML && regExpTest(/((--!?|])>)|<\/(style|script|title|xmp|textarea|noscript|iframe|noembed|noframes)/i, value)) {
3332
+ _removeAttribute(name, currentNode);
3333
+ continue;
3334
+ }
3335
+ /* Make sure we cannot easily use animated hrefs, even if animations are allowed */
3336
+ if (lcName === 'attributename' && stringMatch(value, 'href')) {
3337
+ _removeAttribute(name, currentNode);
3338
+ continue;
3339
+ }
3340
+ /* Did the hooks force-keep the attribute? */
3341
+ if (hookEvent.forceKeepAttr) {
3342
+ continue;
3343
+ }
3344
+ /* Did the hooks approve of the attribute? */
3345
+ if (!hookEvent.keepAttr) {
3346
+ _removeAttribute(name, currentNode);
3347
+ continue;
3348
+ }
3349
+ /* Work around a security issue in jQuery 3.0 */
3350
+ if (!ALLOW_SELF_CLOSE_IN_ATTR && regExpTest(SELF_CLOSING_TAG, value)) {
3351
+ _removeAttribute(name, currentNode);
3352
+ continue;
3353
+ }
3354
+ /* Sanitize attribute content to be template-safe */
3355
+ if (SAFE_FOR_TEMPLATES) {
3356
+ value = _stripTemplateExpressions(value);
3357
+ }
3358
+ /* Is `value` valid for this attribute? */
3359
+ if (!_isValidAttribute(lcTag, lcName, value)) {
3360
+ _removeAttribute(name, currentNode);
3361
+ continue;
3362
+ }
3363
+ /* Handle attributes that require Trusted Types */
3364
+ value = _applyTrustedTypesToAttribute(lcTag, lcName, namespaceURI, value);
3365
+ /* Handle invalid data-* attribute set by try-catching it */
3366
+ if (value !== initValue) {
3367
+ _setAttributeValue(currentNode, name, namespaceURI, value);
3368
+ }
3369
+ }
3370
+ /* Execute a hook if present */
3371
+ _executeHooks(hooks.afterSanitizeAttributes, currentNode, null);
3372
+ };
3373
+ /**
3374
+ * _sanitizeShadowDOM
3375
+ *
3376
+ * @param fragment to iterate over recursively
3377
+ */
3378
+ const _sanitizeShadowDOM2 = function _sanitizeShadowDOM(fragment) {
3379
+ let shadowNode = null;
3380
+ const shadowIterator = _createNodeIterator(fragment);
3381
+ /* Execute a hook if present */
3382
+ _executeHooks(hooks.beforeSanitizeShadowDOM, fragment, null);
3383
+ while (shadowNode = shadowIterator.nextNode()) {
3384
+ /* Execute a hook if present */
3385
+ _executeHooks(hooks.uponSanitizeShadowNode, shadowNode, null);
3386
+ /* Sanitize tags and elements */
3387
+ _sanitizeElements(shadowNode, fragment);
3388
+ /* Check attributes next */
3389
+ _sanitizeAttributes(shadowNode);
3390
+ /* Deep shadow DOM detected.
3391
+ Realm-safe check (GHSA-hpcv-96wg-7vj8): use nodeType against the
3392
+ DOCUMENT_FRAGMENT_NODE constant rather than instanceof, so we
3393
+ recurse into <template>.content from foreign realms too. */
3394
+ if (_isDocumentFragment(shadowNode.content)) {
3395
+ _sanitizeShadowDOM2(shadowNode.content);
3396
+ }
3397
+ /* An element iterated here may itself host an attached
3398
+ shadow root. The default NodeIterator does not enter shadow
3399
+ trees, so a shadow root nested inside template.content was
3400
+ previously reached by no walk at all (the pre-pass at
3401
+ _sanitizeAttachedShadowRoots descends via childNodes, which
3402
+ doesn't enter template.content; the template-content recursion
3403
+ above iterates the content but never inspected shadowRoot).
3404
+ Walk it explicitly. The nodeType guard avoids reading
3405
+ shadowRoot off text / comment / CDATA / PI nodes that the
3406
+ iterator also surfaces. */
3407
+ const shadowNodeType = getNodeType ? getNodeType(shadowNode) : shadowNode.nodeType;
3408
+ if (shadowNodeType === NODE_TYPE.element) {
3409
+ const innerSr = getShadowRoot(shadowNode);
3410
+ if (_isDocumentFragment(innerSr)) {
3411
+ _sanitizeAttachedShadowRoots(innerSr);
3412
+ _sanitizeShadowDOM2(innerSr);
3413
+ }
3414
+ }
3415
+ }
3416
+ /* Execute a hook if present */
3417
+ _executeHooks(hooks.afterSanitizeShadowDOM, fragment, null);
3418
+ };
3419
+ /**
3420
+ * _sanitizeAttachedShadowRoots
3421
+ *
3422
+ * Walks `root` and feeds every attached shadow root we encounter into
3423
+ * the existing _sanitizeShadowDOM pipeline. The default node iterator
3424
+ * does not descend into shadow trees, so nodes inside an attached
3425
+ * shadow root would otherwise be skipped entirely.
3426
+ *
3427
+ * Two real input paths put attached shadow roots in front of us:
3428
+ * 1. IN_PLACE on a DOM node that already has shadow roots attached.
3429
+ * 2. DOM-node input where importNode(dirty, true) deep-clones the
3430
+ * shadow root because it was created with `clonable: true`.
3431
+ *
3432
+ * This pass runs once, up front, so the main iteration loop (and the
3433
+ * existing _sanitizeShadowDOM template-content recursion) stay
3434
+ * untouched — string-input paths are not affected.
3435
+ *
3436
+ * @param root the subtree root to walk for attached shadow roots
3437
+ */
3438
+ const _sanitizeAttachedShadowRoots = function _sanitizeAttachedShadowRoots(root) {
3439
+ /* Iterative (explicit stack) rather than per-child recursion. DOM APIs
3440
+ impose no depth cap, so an attacker-shaped tree (JSON/CRDT/editor data
3441
+ built straight into the DOM — the IN_PLACE surface) deeper than the JS
3442
+ call-stack budget would otherwise overflow native recursion here and
3443
+ throw at the IN_PLACE entry pre-pass, before a single node is
3444
+ sanitized, leaving the caller's live tree untouched (fail-open). See
3445
+ campaign-3 F4. A heap stack keeps depth off the call stack.
3446
+ Each work item is either a node to descend into, or a deferred
3447
+ `_sanitizeShadowDOM` for an already-walked shadow root. The deferred
3448
+ form preserves the original post-order discipline: a shadow root's
3449
+ nested shadow roots are discovered before the outer shadow is
3450
+ sanitized (which may remove hosts). Pushes are in reverse of the
3451
+ desired processing order (LIFO): template content, then children, then
3452
+ the shadow-sanitize, then the shadow walk — so the order matches the
3453
+ previous recursion exactly. */
3454
+ const stack = [{
3455
+ node: root,
3456
+ shadow: null
3457
+ }];
3458
+ while (stack.length > 0) {
3459
+ const item = stack.pop();
3460
+ /* Deferred shadow-DOM sanitisation: runs after its subtree was walked. */
3461
+ if (item.shadow) {
3462
+ _sanitizeShadowDOM2(item.shadow);
3463
+ continue;
3464
+ }
3465
+ const node = item.node;
3466
+ const nodeType = getNodeType ? getNodeType(node) : node.nodeType;
3467
+ const isElement = nodeType === NODE_TYPE.element;
3468
+ /* (pushed last → processed first) Children, snapshotted in reverse so
3469
+ the first child is processed first. Snapshotting matters because a
3470
+ hook may detach siblings mid-walk. */
3471
+ const childNodes = getChildNodes(node);
3472
+ if (childNodes) {
3473
+ for (let i = childNodes.length - 1; i >= 0; --i) {
3474
+ stack.push({
3475
+ node: childNodes[i],
3476
+ shadow: null
3477
+ });
3478
+ }
3479
+ }
3480
+ /* (pushed before children → processed after them, matching the old
3481
+ "template content last" order) When the node is a <template>,
3482
+ descend into its content. */
3483
+ if (isElement) {
3484
+ const rootName = getNodeName ? getNodeName(node) : null;
3485
+ if (typeof rootName === 'string' && transformCaseFunc(rootName) === 'template') {
3486
+ const content = node.content;
3487
+ if (_isDocumentFragment(content)) {
3488
+ stack.push({
3489
+ node: content,
3490
+ shadow: null
3491
+ });
3492
+ }
3493
+ }
3494
+ }
3495
+ /* Shadow root (processed first): walk its subtree, then sanitise it.
3496
+ Realm-safe check (GHSA-hpcv-96wg-7vj8): nodeType-based detection
3497
+ rather than `instanceof DocumentFragment`, which is realm-bound and
3498
+ silently skipped foreign-realm shadow roots (e.g.
3499
+ iframe.contentDocument attachShadow). */
3500
+ if (isElement) {
3501
+ const sr = getShadowRoot(node);
3502
+ if (_isDocumentFragment(sr)) {
3503
+ /* Push the deferred sanitise first so it pops after the shadow
3504
+ walk we push next, i.e. nested shadow roots are discovered
3505
+ before this one is sanitised. */
3506
+ stack.push({
3507
+ node: null,
3508
+ shadow: sr
3509
+ }, {
3510
+ node: sr,
3511
+ shadow: null
3512
+ });
3513
+ }
3514
+ }
3515
+ }
3516
+ };
3517
+ // eslint-disable-next-line complexity
3518
+ DOMPurify.sanitize = function (dirty) {
3519
+ let cfg = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
3520
+ let body = null;
3521
+ let importedNode = null;
3522
+ let currentNode = null;
3523
+ let returnNode = null;
3524
+ /* Make sure we have a string to sanitize.
3525
+ DO NOT return early, as this will return the wrong type if
3526
+ the user has requested a DOM object rather than a string */
3527
+ IS_EMPTY_INPUT = !dirty;
3528
+ if (IS_EMPTY_INPUT) {
3529
+ dirty = '<!-->';
3530
+ }
3531
+ /* Stringify, in case dirty is an object */
3532
+ if (typeof dirty !== 'string' && !_isNode(dirty)) {
3533
+ dirty = stringifyValue(dirty);
3534
+ if (typeof dirty !== 'string') {
3535
+ throw typeErrorCreate('dirty is not a string, aborting');
3536
+ }
3537
+ }
3538
+ /* Return dirty HTML if DOMPurify cannot run */
3539
+ if (!DOMPurify.isSupported) {
3540
+ return dirty;
3541
+ }
3542
+ /* Assign config vars */
3543
+ if (SET_CONFIG) {
3544
+ /* Persistent setConfig() path: _parseConfig is skipped, so the sets are
3545
+ * not re-derived per call. Restore them from the pristine bindings
3546
+ * captured at setConfig() time so a previous call's hook clone (mutated
3547
+ * below) does not carry over. */
3548
+ ALLOWED_TAGS = SET_CONFIG_ALLOWED_TAGS;
3549
+ ALLOWED_ATTR = SET_CONFIG_ALLOWED_ATTR;
3550
+ } else {
3551
+ _parseConfig(cfg);
3552
+ }
3553
+ /* Clone the hook-mutable allowlists before the walk whenever an
3554
+ * uponSanitize* hook is registered. The hook event exposes ALLOWED_TAGS
3555
+ * and ALLOWED_ATTR by reference (as allowedTags / allowedAttributes), so
3556
+ * a hook that widens them would otherwise mutate the shared set
3557
+ * permanently: across later calls and across every element. Cloning per
3558
+ * walk keeps documented in-call widening working while scoping it to the
3559
+ * call. A single guard for both config paths - the per-call path rebinds
3560
+ * the sets in _parseConfig each call, the persistent path restores them
3561
+ * from the captured bindings just above - so the two cannot diverge. */
3562
+ if (hooks.uponSanitizeElement.length > 0 || hooks.uponSanitizeAttribute.length > 0) {
3563
+ ALLOWED_TAGS = clone(ALLOWED_TAGS);
3564
+ }
3565
+ if (hooks.uponSanitizeAttribute.length > 0) {
3566
+ ALLOWED_ATTR = clone(ALLOWED_ATTR);
3567
+ }
3568
+ /* Clean up removed elements */
3569
+ DOMPurify.removed = [];
3570
+ /* Resolve IN_PLACE for this call without mutating persistent config.
3571
+ Writing the IN_PLACE closure variable here leaks under setConfig(),
3572
+ where _parseConfig is skipped on later calls: a single string call would
3573
+ disable in-place mode for every subsequent node call, returning a
3574
+ sanitized copy while leaving the caller's node — which in-place callers
3575
+ keep using and whose return value they ignore — unsanitized. REPORT-2. */
3576
+ const inPlace = IN_PLACE && typeof dirty !== 'string' && _isNode(dirty);
3577
+ if (inPlace) {
3578
+ /* Declarative-partial-updates / streaming pre-pass: sever every patch
3579
+ linkage across the live tree BEFORE the walk, so no patch can fire
3580
+ mid-walk and inject into an already-processed region. Runs first, so
3581
+ it also covers the forbidden/clobbered roots that throw below. */
3582
+ _neutralizePatchLinkage(dirty);
3583
+ /* Do some early pre-sanitization to avoid unsafe root nodes.
3584
+ Read nodeName through the cached prototype getter — a clobbering
3585
+ child named "nodeName" on the form root would otherwise shadow
3586
+ the property and let this check skip the root-allowlist
3587
+ validation entirely. */
3588
+ const nn = getNodeName ? getNodeName(dirty) : dirty.nodeName;
3589
+ if (typeof nn === 'string') {
3590
+ const tagName = transformCaseFunc(nn);
3591
+ if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
3592
+ /* Fail closed on a live root: neutralize handlers/children before
3593
+ throwing, exactly as the mid-walk abort path does. */
3594
+ _neutralizeRoot(dirty);
3595
+ throw typeErrorCreate('root node is forbidden and cannot be sanitized in-place');
3596
+ }
3597
+ }
3598
+ /* Pre-flight the root through _isClobbered. The iterator-driven
3599
+ removal path can not detach a parent-less root: _forceRemove
3600
+ falls through to Element.prototype.remove(), which per spec
3601
+ is a no-op on a node with no parent. A clobbered root would
3602
+ then survive the main loop with its attributes uninspected,
3603
+ because _sanitizeAttributes early-returns on _isClobbered. The
3604
+ result would be an attacker-controlled form, complete with any
3605
+ event-handler attributes the caller passed in, handed back to
3606
+ the application unsanitized. Refuse to sanitize such a root
3607
+ the same way we refuse a forbidden tag. GHSA-r47g-fvhr-h676. */
3608
+ if (_isClobbered(dirty)) {
3609
+ /* Fail closed on a live clobbered root before throwing.
3610
+ _neutralizeRoot's reads are clobber-safe (cached getters); the
3611
+ form's non-clobbered descendants, e.g. an armed <img>, are scrubbed. */
3612
+ _neutralizeRoot(dirty);
3613
+ throw typeErrorCreate('root node is clobbered and cannot be sanitized in-place');
3614
+ }
3615
+ /* Sanitize attached shadow roots before the main iterator runs.
3616
+ The iterator does not descend into shadow trees. Same fail-closed
3617
+ barrier as the main walk (campaign-3 F2): a custom-element reaction
3618
+ inside a shadow root could abort this pre-pass before the walk runs,
3619
+ which would otherwise leave the entire live tree unsanitized. */
3620
+ try {
3621
+ _sanitizeAttachedShadowRoots(dirty);
3622
+ } catch (error) {
3623
+ _neutralizeRoot(dirty);
3624
+ throw error;
3625
+ }
3626
+ } else if (_isNode(dirty)) {
3627
+ /* If dirty is a DOM element, append to an empty document to avoid
3628
+ elements being stripped by the parser */
3629
+ body = _initDocument('<!---->');
3630
+ importedNode = body.ownerDocument.importNode(dirty, true);
3631
+ if (importedNode.nodeType === NODE_TYPE.element && importedNode.nodeName === 'BODY') {
3632
+ /* Node is already a body, use as is */
3633
+ body = importedNode;
3634
+ } else if (importedNode.nodeName === 'HTML') {
3635
+ body = importedNode;
3636
+ } else {
3637
+ // eslint-disable-next-line unicorn/prefer-dom-node-append
3638
+ body.appendChild(importedNode);
3639
+ }
3640
+ /* Clonable shadow roots are deep-cloned by importNode(); sanitize
3641
+ them before the main iterator runs, since the iterator does not
3642
+ descend into shadow trees. The walk routes every read through a
3643
+ cached prototype getter so clobbering descendants on a form root
3644
+ cannot hide a shadow host from this pass. */
3645
+ _sanitizeAttachedShadowRoots(importedNode);
3646
+ } else {
3647
+ /* Exit directly if we have nothing to do */
3648
+ if (!RETURN_DOM && !SAFE_FOR_TEMPLATES && !WHOLE_DOCUMENT &&
3649
+ // eslint-disable-next-line unicorn/prefer-includes
3650
+ dirty.indexOf('<') === -1) {
3651
+ return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? _createTrustedHTML(dirty) : dirty;
3652
+ }
3653
+ /* Initialize the document to work on */
3654
+ body = _initDocument(dirty);
3655
+ /* Check we have a DOM node from the data */
3656
+ if (!body) {
3657
+ return RETURN_DOM ? null : RETURN_TRUSTED_TYPE ? emptyHTML : '';
3658
+ }
3659
+ }
3660
+ /* Remove first element node (ours) if FORCE_BODY is set */
3661
+ if (body && FORCE_BODY) {
3662
+ _forceRemove(body.firstChild);
3663
+ }
3664
+ /* Get node iterator */
3665
+ const walkRoot = inPlace ? dirty : body;
3666
+ const nodeIterator = _createNodeIterator(walkRoot);
3667
+ /* Now start iterating over the created document.
3668
+ The walk runs inside an exception barrier (campaign-3 F2): a re-entrant
3669
+ engine/custom-element mutation can detach a node mid-walk so
3670
+ `_forceRemove`'s parentless guard throws, aborting the loop. Without the
3671
+ barrier the caller's in-place tree would be left half-sanitized with the
3672
+ unvisited tail still armed. On any throw we fail closed — strip the
3673
+ in-place root bare — then rethrow so the existing throw contract is
3674
+ preserved. (String/DOM-copy paths never return the partial body, so the
3675
+ propagating throw is already fail-closed there.) */
3676
+ try {
3677
+ while (currentNode = nodeIterator.nextNode()) {
3678
+ /* Sanitize tags and elements */
3679
+ _sanitizeElements(currentNode, walkRoot);
3680
+ /* Check attributes next */
3681
+ _sanitizeAttributes(currentNode);
3682
+ /* Shadow DOM detected, sanitize it.
3683
+ Realm-safe check (GHSA-hpcv-96wg-7vj8): nodeType-based detection
3684
+ instead of instanceof, so foreign-realm <template>.content is
3685
+ walked correctly. */
3686
+ if (_isDocumentFragment(currentNode.content)) {
3687
+ _sanitizeShadowDOM2(currentNode.content);
3688
+ }
3689
+ }
3690
+ } catch (error) {
3691
+ if (inPlace) {
3692
+ _neutralizeRoot(dirty);
3693
+ /* Nodes _forceRemove'd earlier in the aborted walk are already
3694
+ detached from the root, so _neutralizeRoot's subtree pass does not
3695
+ reach them. Defuse them too, mirroring the success-path loop below. */
3696
+ arrayForEach(DOMPurify.removed, entry => {
3697
+ if (entry.element) {
3698
+ _neutralizeSubtree(entry.element);
3699
+ }
3700
+ });
3701
+ }
3702
+ throw error;
3703
+ }
3704
+ /* If we sanitized `dirty` in-place, return it. */
3705
+ if (inPlace) {
3706
+ /* Fail-closed completion of the audit-5 F1 fix: every node removed from
3707
+ the caller's live tree is detached but may still hold a queued
3708
+ resource-event handler that fires in page scope after we return. The
3709
+ move-hoist covers only disallowed-tag KEEP_CONTENT removals; strip the
3710
+ non-allow-listed attributes off every other removed subtree (clobber,
3711
+ mXSS, namespace, comments, KEEP_CONTENT:false, …) so those handlers are
3712
+ cancelled before any event can fire. Runs synchronously, pre-return. */
3713
+ arrayForEach(DOMPurify.removed, entry => {
3714
+ if (entry.element) {
3715
+ _neutralizeSubtree(entry.element);
3716
+ }
3717
+ });
3718
+ if (SAFE_FOR_TEMPLATES) {
3719
+ _scrubTemplateExpressions2(dirty);
3720
+ }
3721
+ return dirty;
3722
+ }
3723
+ /* Return sanitized string or DOM */
3724
+ if (RETURN_DOM) {
3725
+ if (SAFE_FOR_TEMPLATES) {
3726
+ _scrubTemplateExpressions2(body);
3727
+ }
3728
+ if (RETURN_DOM_FRAGMENT) {
3729
+ returnNode = createDocumentFragment.call(body.ownerDocument);
3730
+ while (body.firstChild) {
3731
+ // eslint-disable-next-line unicorn/prefer-dom-node-append
3732
+ returnNode.appendChild(body.firstChild);
3733
+ }
3734
+ } else {
3735
+ returnNode = body;
3736
+ }
3737
+ if (ALLOWED_ATTR.shadowroot || ALLOWED_ATTR.shadowrootmode) {
3738
+ /*
3739
+ AdoptNode() is not used because internal state is not reset
3740
+ (e.g. the past names map of a HTMLFormElement), this is safe
3741
+ in theory but we would rather not risk another attack vector.
3742
+ The state that is cloned by importNode() is explicitly defined
3743
+ by the specs.
3744
+ */
3745
+ returnNode = importNode.call(originalDocument, returnNode, true);
3746
+ }
3747
+ return returnNode;
3748
+ }
3749
+ let serializedHTML = WHOLE_DOCUMENT ? body.outerHTML : body.innerHTML;
3750
+ /* Serialize doctype if allowed */
3751
+ if (WHOLE_DOCUMENT && ALLOWED_TAGS['!doctype'] && body.ownerDocument && body.ownerDocument.doctype && body.ownerDocument.doctype.name && regExpTest(DOCTYPE_NAME, body.ownerDocument.doctype.name)) {
3752
+ serializedHTML = '<!DOCTYPE ' + body.ownerDocument.doctype.name + '>\n' + serializedHTML;
3753
+ }
3754
+ /* Sanitize final string template-safe */
3755
+ if (SAFE_FOR_TEMPLATES) {
3756
+ serializedHTML = _stripTemplateExpressions(serializedHTML);
3757
+ }
3758
+ return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? _createTrustedHTML(serializedHTML) : serializedHTML;
3759
+ };
3760
+ DOMPurify.setConfig = function () {
3761
+ let cfg = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
3762
+ _parseConfig(cfg);
3763
+ SET_CONFIG = true;
3764
+ SET_CONFIG_ALLOWED_TAGS = ALLOWED_TAGS;
3765
+ SET_CONFIG_ALLOWED_ATTR = ALLOWED_ATTR;
3766
+ };
3767
+ DOMPurify.clearConfig = function () {
3768
+ CONFIG = null;
3769
+ SET_CONFIG = false;
3770
+ SET_CONFIG_ALLOWED_TAGS = null;
3771
+ SET_CONFIG_ALLOWED_ATTR = null;
3772
+ // Drop any caller-supplied Trusted Types policy so it cannot poison later
3773
+ // `RETURN_TRUSTED_TYPE` output. The internal default policy (cached, and
3774
+ // never recreated — Trusted Types throws on duplicate names) is restored by
3775
+ // the next `_parseConfig`. See GHSA-vxr8-fq34-vvx9.
3776
+ trustedTypesPolicy = defaultTrustedTypesPolicy;
3777
+ emptyHTML = '';
3778
+ };
3779
+ DOMPurify.isValidAttribute = function (tag, attr, value) {
3780
+ /* Initialize shared config vars if necessary. */
3781
+ if (!CONFIG) {
3782
+ _parseConfig({});
3783
+ }
3784
+ const lcTag = transformCaseFunc(tag);
3785
+ const lcName = transformCaseFunc(attr);
3786
+ return _isValidAttribute(lcTag, lcName, value);
3787
+ };
3788
+ DOMPurify.addHook = function (entryPoint, hookFunction) {
3789
+ if (typeof hookFunction !== 'function') {
3790
+ return;
3791
+ }
3792
+ /* Reject unknown entry points. Without this, a non-hook key (e.g.
3793
+ * '__proto__') indexes off the prototype chain rather than a real
3794
+ * hook array, and arrayPush then writes to Object.prototype. Guard
3795
+ * with an own-property check against the known hook names. */
3796
+ if (!objectHasOwnProperty(hooks, entryPoint)) {
3797
+ return;
3798
+ }
3799
+ arrayPush(hooks[entryPoint], hookFunction);
3800
+ };
3801
+ DOMPurify.removeHook = function (entryPoint, hookFunction) {
3802
+ if (!objectHasOwnProperty(hooks, entryPoint)) {
3803
+ return undefined;
3804
+ }
3805
+ if (hookFunction !== undefined) {
3806
+ const index = arrayLastIndexOf(hooks[entryPoint], hookFunction);
3807
+ return index === -1 ? undefined : arraySplice(hooks[entryPoint], index, 1)[0];
3808
+ }
3809
+ return arrayPop(hooks[entryPoint]);
3810
+ };
3811
+ DOMPurify.removeHooks = function (entryPoint) {
3812
+ if (!objectHasOwnProperty(hooks, entryPoint)) {
3813
+ return;
3814
+ }
3815
+ hooks[entryPoint] = [];
3816
+ };
3817
+ DOMPurify.removeAllHooks = function () {
3818
+ hooks = _createHooksMap();
3819
+ };
3820
+ return DOMPurify;
3821
+ }
3822
+ var purify = createDOMPurify();
3823
+
3824
+ const mrdEmailViewCss = () => `.sc-mrd-email-view-h{display:block}.mrd-email-view.sc-mrd-email-view{max-width:720px;display:flex;flex-direction:column;gap:var(--mrd-space-4)}.mrd-email-view__subject.sc-mrd-email-view{font-size:var(--mrd-font-size-2xl);font-weight:var(--mrd-font-weight-bold);color:var(--mrd-color-neutral-900);letter-spacing:-0.02em;margin:0}.mrd-email-view__header.sc-mrd-email-view{display:flex;flex-direction:column;gap:var(--mrd-space-1)}.mrd-email-view__header-row.sc-mrd-email-view{display:flex;gap:var(--mrd-space-3);font-size:var(--mrd-font-size-sm)}.mrd-email-view__header-label.sc-mrd-email-view{flex-shrink:0;width:3rem;font-weight:var(--mrd-font-weight-medium);color:var(--mrd-color-neutral-400)}.mrd-email-view__header-value.sc-mrd-email-view{color:var(--mrd-color-neutral-700)}.mrd-email-view__link.sc-mrd-email-view{background:none;border:none;padding:0;font-family:var(--mrd-font-family);font-size:inherit;font-weight:var(--mrd-font-weight-medium);color:var(--mrd-color-primary);cursor:pointer}.mrd-email-view__link.sc-mrd-email-view:hover{text-decoration:underline}.mrd-email-view__container-link.sc-mrd-email-view{align-self:flex-start;background:none;border:none;padding:0;font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-sm);font-weight:var(--mrd-font-weight-semibold);color:var(--mrd-color-primary);cursor:pointer}.mrd-email-view__container-link.sc-mrd-email-view:hover{text-decoration:underline}.mrd-email-view__divider.sc-mrd-email-view{height:var(--mrd-border-width);background:var(--mrd-color-neutral-200)}.mrd-email-view__body-html.sc-mrd-email-view{font-size:var(--mrd-font-size-base);color:var(--mrd-color-neutral-700);line-height:var(--mrd-line-height-relaxed);word-break:break-word}.mrd-email-view__body-text.sc-mrd-email-view{font-size:var(--mrd-font-size-base);color:var(--mrd-color-neutral-700);line-height:var(--mrd-line-height-relaxed);white-space:pre-wrap;word-break:break-word}.mrd-email-view__attachments.sc-mrd-email-view{display:flex;flex-direction:column;gap:var(--mrd-space-2)}.mrd-email-view__attachment.sc-mrd-email-view{display:inline-flex;align-items:center;gap:var(--mrd-space-2);align-self:flex-start;height:2rem;padding:0 var(--mrd-space-3);background:var(--mrd-color-white);border:1px solid var(--mrd-color-neutral-300);border-radius:var(--mrd-border-radius);font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-sm);font-weight:var(--mrd-font-weight-medium);color:var(--mrd-color-neutral-700);cursor:pointer}.mrd-email-view__attachment.sc-mrd-email-view:hover{background:var(--mrd-color-neutral-100);color:var(--mrd-color-neutral-900)}.mrd-email-view__attachment-icon.sc-mrd-email-view{width:0.9375rem;height:0.9375rem;flex-shrink:0}.mrd-email-view__headers.sc-mrd-email-view{font-size:var(--mrd-font-size-xs);color:var(--mrd-color-neutral-400)}.mrd-email-view__headers.sc-mrd-email-view summary.sc-mrd-email-view{cursor:pointer;font-weight:var(--mrd-font-weight-medium)}.mrd-email-view__headers-body.sc-mrd-email-view{margin:var(--mrd-space-2) 0 0 0;padding:var(--mrd-space-3);background:var(--mrd-color-neutral-50);border-radius:var(--mrd-border-radius);white-space:pre-wrap;word-break:break-word}`;
3825
+
3826
+ const MrdEmailView = class {
3827
+ constructor(hostRef) {
3828
+ registerInstance(this, hostRef);
3829
+ this.mrdNavigate = createEvent(this, "mrdNavigate");
3830
+ this.mrdDownload = createEvent(this, "mrdDownload");
3831
+ this.mrdAttachments = createEvent(this, "mrdAttachments");
3832
+ /** The data record from the /data endpoint. Fields keyed by name; relations under `_links`. */
3833
+ this.data = {};
3834
+ this.locale = navigator.language;
3835
+ /** Tracks the key attachments were last emitted for, so componentDidLoad and the
3836
+ * data watcher don't emit duplicate events for the same set of files. */
3837
+ this.lastAttachmentKey = null;
3838
+ }
3839
+ componentDidLoad() {
3840
+ this.emitAttachmentsIfNeeded();
3841
+ }
3842
+ dataChanged() {
3843
+ this.emitAttachmentsIfNeeded();
3844
+ }
3845
+ emitAttachmentsIfNeeded() {
3846
+ const attachments = attachmentsFromRecord(this.archetype, this.data, 'attachments');
3847
+ const key = attachmentsKey(attachments);
3848
+ if (key === this.lastAttachmentKey)
3849
+ return;
3850
+ this.lastAttachmentKey = key;
3851
+ this.mrdAttachments.emit({ attachments });
3852
+ }
3853
+ /** Value of a value-slot: reads data[field] via the slot→field map. */
3854
+ slotValue(slot) {
3855
+ var _a, _b;
3856
+ const field = (_b = (_a = this.archetype) === null || _a === void 0 ? void 0 : _a.slots) === null || _b === void 0 ? void 0 : _b[slot];
3857
+ if (!field)
3858
+ return undefined;
3859
+ return this.data[field];
3860
+ }
3861
+ /** Relation link for a relation-slot: reads data._links[field]. */
3862
+ slotLink(slot) {
3863
+ var _a, _b, _c, _d;
3864
+ const field = (_b = (_a = this.archetype) === null || _a === void 0 ? void 0 : _a.slots) === null || _b === void 0 ? void 0 : _b[slot];
3865
+ if (!field)
3866
+ return undefined;
3867
+ const links = ((_d = (_c = this.data) === null || _c === void 0 ? void 0 : _c._links) !== null && _d !== void 0 ? _d : {});
3868
+ return links[field];
3869
+ }
3870
+ renderAddressRow(slot, label) {
3871
+ var _a;
3872
+ const link = this.slotLink(slot);
3873
+ const entries = ((_a = link === null || link === void 0 ? void 0 : link.values) === null || _a === void 0 ? void 0 : _a.length)
3874
+ ? link.values
3875
+ : (link === null || link === void 0 ? void 0 : link.href) && (link === null || link === void 0 ? void 0 : link.name) ? [{ href: link.href, name: link.name }] : [];
3876
+ if (!entries.length)
3877
+ return null;
3878
+ return (h("div", { class: "mrd-email-view__header-row" }, h("span", { class: "mrd-email-view__header-label" }, label), h("span", { class: "mrd-email-view__header-value" }, entries.map((entry, i) => (h("span", { key: entry.href }, h("button", { type: "button", class: "mrd-email-view__link", onClick: () => this.mrdNavigate.emit({ href: entry.href, label: entry.name }) }, entry.name), i < entries.length - 1 ? ', ' : ''))))));
3879
+ }
3880
+ renderContainer() {
3881
+ const link = this.slotLink('container');
3882
+ if (!(link === null || link === void 0 ? void 0 : link.href) || !link.name)
3883
+ return null;
3884
+ return (h("button", { type: "button", class: "mrd-email-view__container-link", onClick: () => this.mrdNavigate.emit({ href: link.href, label: link.name }) }, link.name));
3885
+ }
3886
+ renderBody() {
3887
+ const bodyHtmlRaw = this.slotValue('bodyHtml');
3888
+ if (bodyHtmlRaw != null && bodyHtmlRaw !== '') {
3889
+ return h("div", { class: "mrd-email-view__body-html", innerHTML: purify.sanitize(String(bodyHtmlRaw)) });
3890
+ }
3891
+ const bodyTextRaw = this.slotValue('bodyText');
3892
+ if (bodyTextRaw != null && bodyTextRaw !== '') {
3893
+ return h("div", { class: "mrd-email-view__body-text" }, String(bodyTextRaw));
3894
+ }
3895
+ return null;
3896
+ }
3897
+ renderHeaders() {
3898
+ const headersRaw = this.slotValue('headers');
3899
+ if (headersRaw == null || headersRaw === '')
3900
+ return null;
3901
+ return (h("details", { class: "mrd-email-view__headers" }, h("summary", null, t('email_show_headers', this.locale)), h("pre", { class: "mrd-email-view__headers-body" }, String(headersRaw))));
3902
+ }
3903
+ renderAttachments() {
3904
+ const attachments = attachmentsFromRecord(this.archetype, this.data, 'attachments');
3905
+ if (!attachments.length)
3906
+ return null;
3907
+ return (h("div", { class: "mrd-email-view__attachments" }, attachments.map(a => (h("button", { type: "button", key: a.href, class: "mrd-email-view__attachment", onClick: () => this.mrdDownload.emit({ href: a.href, fileName: a.fileName }) }, h("svg", { class: "mrd-email-view__attachment-icon", viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", "stroke-width": "2", "stroke-linecap": "round", "stroke-linejoin": "round", "aria-hidden": "true" }, h("path", { d: "M21.44 11.05l-9.19 9.19a5 5 0 01-7.07-7.07l9.19-9.19a3 3 0 014.24 4.24l-9.2 9.19a1 1 0 01-1.41-1.41l8.49-8.48" })), a.fileName)))));
3908
+ }
3909
+ render() {
3910
+ const subjectRaw = this.slotValue('subject');
3911
+ const subject = subjectRaw != null && subjectRaw !== '' ? String(subjectRaw) : null;
3912
+ const dateRaw = this.slotValue('date');
3913
+ return (h(Host, { key: '3f36e4df048a71075193d61d0455f94a9121cacf' }, h("div", { key: '164a3d686a462ede237d1aa0892c041ec7ee30b5', class: "mrd-email-view" }, subject && h("h1", { key: '46111bedb40e60189f00232ec5f670c9d027c781', class: "mrd-email-view__subject" }, subject), h("div", { key: '492616cf77aa2351c680509c14328178426be7ed', class: "mrd-email-view__header" }, this.renderAddressRow('from', t('email_from', this.locale)), this.renderAddressRow('to', t('email_to', this.locale)), this.renderAddressRow('cc', t('email_cc', this.locale)), dateRaw != null && dateRaw !== '' && (h("div", { key: 'bc89fb4adec45280b3cbb7216455a7a8a5530f51', class: "mrd-email-view__header-row" }, h("span", { key: '2c0a90c5061261b8b70ba3eb0bf8b9fab793cc7d', class: "mrd-email-view__header-label" }, t('email_date', this.locale)), h("span", { key: 'de3edda49ec15795c9e91297ade9535f06b53b29', class: "mrd-email-view__header-value" }, formatDateTime(dateRaw, this.locale))))), this.renderContainer(), h("div", { key: '6e834f73168f167dac9b90a492db168b0dacc62e', class: "mrd-email-view__divider" }), this.renderBody(), this.renderAttachments(), this.renderHeaders())));
3914
+ }
3915
+ static get watchers() { return {
3916
+ "data": [{
3917
+ "dataChanged": 0
3918
+ }]
3919
+ }; }
3920
+ };
3921
+ MrdEmailView.style = mrdEmailViewCss();
3922
+
2038
3923
  const mrdFieldCss = () => `.sc-mrd-field-h{display:block}.mrd-field__inner.sc-mrd-field{display:block;width:100%}.mrd-field__history-editor.sc-mrd-field{margin-top:var(--mrd-space-2);display:flex;flex-direction:column;gap:var(--mrd-space-1)}.mrd-field__history-editor-label.sc-mrd-field{font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-xs);font-weight:var(--mrd-font-weight-medium);color:var(--mrd-color-neutral-500)}.mrd-field__history-editor-row.sc-mrd-field{display:flex;align-items:center;gap:var(--mrd-space-2)}.mrd-field__history-editor-sep.sc-mrd-field{flex-shrink:0;font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-xs);color:var(--mrd-color-neutral-500)}.mrd-field__history-editor-value.sc-mrd-field{flex:1 1 0;min-width:0;height:var(--mrd-input-height);padding:0 var(--mrd-space-3);font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-sm);color:var(--mrd-color-neutral-800);background-color:var(--mrd-color-white);border:var(--mrd-border-width) solid var(--mrd-border-color);border-radius:var(--mrd-border-radius-md);outline:none;transition:border-color var(--mrd-transition-fast), box-shadow var(--mrd-transition-fast)}.mrd-field__history-editor-value.sc-mrd-field:focus{border-color:var(--mrd-color-primary);box-shadow:var(--mrd-shadow-focus)}.mrd-field__history-editor-until.sc-mrd-field{flex:0 0 10rem;height:var(--mrd-input-height);padding:0 var(--mrd-space-3);font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-sm);color:var(--mrd-color-neutral-800);background-color:var(--mrd-color-white);border:var(--mrd-border-width) solid var(--mrd-border-color);border-radius:var(--mrd-border-radius-md);outline:none;transition:border-color var(--mrd-transition-fast), box-shadow var(--mrd-transition-fast)}.mrd-field__history-editor-until.sc-mrd-field:focus{border-color:var(--mrd-color-primary);box-shadow:var(--mrd-shadow-focus)}.mrd-field__history-editor-remove.sc-mrd-field{display:inline-flex;align-items:center;justify-content:center;flex-shrink:0;width:2rem;height:2rem;padding:0;background:transparent;border:none;border-radius:var(--mrd-border-radius-sm);color:var(--mrd-color-neutral-400);cursor:pointer;transition:color var(--mrd-transition-fast), background-color var(--mrd-transition-fast)}.mrd-field__history-editor-remove.sc-mrd-field:hover{color:var(--mrd-color-danger);background-color:var(--mrd-color-danger-light)}.mrd-field__history-editor-remove.sc-mrd-field svg.sc-mrd-field{width:1rem;height:1rem}.mrd-field__history-editor-add.sc-mrd-field{align-self:flex-start;padding:var(--mrd-space-1) var(--mrd-space-3);font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-xs);font-weight:var(--mrd-font-weight-medium);color:var(--mrd-color-primary);background:transparent;border:var(--mrd-border-width) solid var(--mrd-color-primary);border-radius:var(--mrd-border-radius-md);cursor:pointer;transition:background-color var(--mrd-transition-fast), color var(--mrd-transition-fast)}.mrd-field__history-editor-add.sc-mrd-field:hover{background-color:var(--mrd-color-primary-light)}`;
2039
3924
 
2040
3925
  const MrdField = class {
@@ -2153,7 +4038,7 @@ const MrdField = class {
2153
4038
  return (h("div", { class: "mrd-field__history-editor" }, this.historyEntries.length > 0 && (h("span", { class: "mrd-field__history-editor-label" }, t('history_badge_tooltip', locale))), this.historyEntries.map((entry, i) => (h("div", { key: String(i), class: "mrd-field__history-editor-row" }, h("input", { class: "mrd-field__history-editor-value", type: valueType, value: entry.value, onInput: (e) => updateEntry(i, 'value', e.target.value) }), h("span", { class: "mrd-field__history-editor-sep" }, t('history_until', locale)), h("input", { class: "mrd-field__history-editor-until", type: "date", value: entry.until, onInput: (e) => updateEntry(i, 'until', e.target.value) }), h("button", { type: "button", class: "mrd-field__history-editor-remove", onClick: () => removeEntry(i), "aria-label": t('remove', locale) }, h("svg", { viewBox: "0 0 20 20", fill: "currentColor", "aria-hidden": "true" }, h("path", { "fill-rule": "evenodd", d: "M8.75 1A2.75 2.75 0 006 3.75v.443c-.795.077-1.584.176-2.365.298a.75.75 0 10.23 1.482l.149-.022.841 10.518A2.75 2.75 0 007.596 19h4.807a2.75 2.75 0 002.742-2.53l.841-10.52.149.023a.75.75 0 00.23-1.482A41.03 41.03 0 0014 4.193V3.75A2.75 2.75 0 0011.25 1h-2.5zM10 4c.84 0 1.673.025 2.5.075V3.75c0-.69-.56-1.25-1.25-1.25h-2.5c-.69 0-1.25.56-1.25 1.25v.325C8.327 4.025 9.16 4 10 4zM8.58 7.72a.75.75 0 00-1.5.06l.3 7.5a.75.75 0 101.5-.06l-.3-7.5zm4.34.06a.75.75 0 10-1.5-.06l-.3 7.5a.75.75 0 101.5.06l.3-7.5z", "clip-rule": "evenodd" })))))), h("button", { type: "button", class: "mrd-field__history-editor-add", onClick: addEntry }, "+ ", t('add', locale))));
2154
4039
  }
2155
4040
  renderLeafField(displayValue) {
2156
- var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x, _y, _z, _0, _1, _2, _3, _4;
4041
+ var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x, _y, _z, _0, _1, _2, _3, _4, _5, _6;
2157
4042
  const { item, locale } = this;
2158
4043
  const commonProps = {
2159
4044
  name: item.name,
@@ -2190,13 +4075,13 @@ const MrdField = class {
2190
4075
  case ClientLayoutItemFieldDataType.LIST:
2191
4076
  return (h("mrd-list-field", Object.assign({}, commonProps, { value: (_u = displayValue) !== null && _u !== void 0 ? _u : '', multiple: (_v = item.multiple) !== null && _v !== void 0 ? _v : false, listItems: (_w = item.listItems) !== null && _w !== void 0 ? _w : [] })));
2192
4077
  case ClientLayoutItemFieldDataType.FILE:
2193
- return (h("mrd-file-field", Object.assign({}, commonProps, { value: displayValue, accept: (_x = item.accept) !== null && _x !== void 0 ? _x : '', maxSize: (_y = item.maxSize) !== null && _y !== void 0 ? _y : 0, onMrdUpload: this.handleUpload })));
4078
+ return (h("mrd-file-field", Object.assign({}, commonProps, { value: displayValue, accept: (_x = item.accept) !== null && _x !== void 0 ? _x : '', maxSize: (_y = item.maxSize) !== null && _y !== void 0 ? _y : 0, multiple: (_z = item.multiple) !== null && _z !== void 0 ? _z : false, onMrdUpload: this.handleUpload })));
2194
4079
  case ClientLayoutItemFieldDataType.IMAGE:
2195
- return (h("mrd-image-field", Object.assign({}, commonProps, { value: displayValue, accept: (_z = item.accept) !== null && _z !== void 0 ? _z : 'image/*', maxSize: (_0 = item.maxSize) !== null && _0 !== void 0 ? _0 : 0, onMrdUpload: this.handleUpload })));
4080
+ return (h("mrd-image-field", Object.assign({}, commonProps, { value: displayValue, accept: (_0 = item.accept) !== null && _0 !== void 0 ? _0 : 'image/*', maxSize: (_1 = item.maxSize) !== null && _1 !== void 0 ? _1 : 0, multiple: (_2 = item.multiple) !== null && _2 !== void 0 ? _2 : false, onMrdUpload: this.handleUpload })));
2196
4081
  case ClientLayoutItemFieldDataType.LONGTEXT:
2197
- return (h("mrd-longtext-field", Object.assign({}, commonProps, { value: (_1 = displayValue) !== null && _1 !== void 0 ? _1 : '', placeholder: (_2 = item.placeholder) !== null && _2 !== void 0 ? _2 : '' })));
4082
+ return (h("mrd-longtext-field", Object.assign({}, commonProps, { value: (_3 = displayValue) !== null && _3 !== void 0 ? _3 : '', placeholder: (_4 = item.placeholder) !== null && _4 !== void 0 ? _4 : '' })));
2198
4083
  case ClientLayoutItemFieldDataType.SECRET:
2199
- return (h("mrd-secret-field", Object.assign({}, commonProps, { value: (_3 = displayValue) !== null && _3 !== void 0 ? _3 : '', placeholder: (_4 = item.placeholder) !== null && _4 !== void 0 ? _4 : '' })));
4084
+ return (h("mrd-secret-field", Object.assign({}, commonProps, { value: (_5 = displayValue) !== null && _5 !== void 0 ? _5 : '', placeholder: (_6 = item.placeholder) !== null && _6 !== void 0 ? _6 : '' })));
2200
4085
  default:
2201
4086
  return null;
2202
4087
  }
@@ -2222,10 +4107,26 @@ const MrdField = class {
2222
4107
  };
2223
4108
  MrdField.style = mrdFieldCss();
2224
4109
 
2225
- /**
2226
- * Shared upload behaviour for mrd-file-field and mrd-image-field:
2227
- * file validation, drop-zone class building and drag-drop wiring.
2228
- */
4110
+ /** True while the entry is still a local `File` awaiting upload resolution. */
4111
+ function isPending(entry) {
4112
+ return entry instanceof File;
4113
+ }
4114
+ /** Display name for an entry: the `File`'s own name, the resolved `fileName`, or — for the
4115
+ * legacy bare-href shape — a best-effort basename of the URI. */
4116
+ function entryLabel(entry) {
4117
+ var _a;
4118
+ if (entry instanceof File)
4119
+ return entry.name;
4120
+ if (typeof entry !== 'string')
4121
+ return entry.fileName || entry.href;
4122
+ const base = (_a = entry.split('/').pop()) !== null && _a !== void 0 ? _a : entry;
4123
+ try {
4124
+ return decodeURIComponent(base);
4125
+ }
4126
+ catch (_b) {
4127
+ return base;
4128
+ }
4129
+ }
2229
4130
  /** Validates a selected/dropped file; returns a localised error message or '' when accepted. */
2230
4131
  function validateUploadFile(file, maxSize, locale, requireImage = false) {
2231
4132
  if (maxSize > 0 && file.size > maxSize)
@@ -2244,7 +4145,7 @@ function uploadZoneClass(base, opts) {
2244
4145
  ].filter(Boolean).join(' ');
2245
4146
  }
2246
4147
  /** Drag-drop handlers for the drop zone; the component owns the dragging state and file handling. */
2247
- function makeDragHandlers(setDragging, onFile) {
4148
+ function makeDragHandlers(setDragging, onFiles) {
2248
4149
  return {
2249
4150
  onDragOver: (e) => {
2250
4151
  e.preventDefault();
@@ -2252,15 +4153,15 @@ function makeDragHandlers(setDragging, onFile) {
2252
4153
  },
2253
4154
  onDragLeave: () => setDragging(false),
2254
4155
  onDrop: (e) => {
2255
- var _a, _b, _c;
4156
+ var _a, _b;
2256
4157
  e.preventDefault();
2257
4158
  setDragging(false);
2258
- onFile((_c = (_b = (_a = e.dataTransfer) === null || _a === void 0 ? void 0 : _a.files) === null || _b === void 0 ? void 0 : _b[0]) !== null && _c !== void 0 ? _c : null);
4159
+ onFiles(Array.from((_b = (_a = e.dataTransfer) === null || _a === void 0 ? void 0 : _a.files) !== null && _b !== void 0 ? _b : []));
2259
4160
  },
2260
4161
  };
2261
4162
  }
2262
4163
 
2263
- const mrdFileFieldCss = () => `.sc-mrd-file-field-h{display:block}.mrd-file-field.sc-mrd-file-field{display:flex;flex-direction:column;gap:var(--mrd-space-1);width:100%}.mrd-file-field__label.sc-mrd-file-field{display:block;font-family:var(--mrd-font-family);font-size:var(--mrd-label-font-size);font-weight:var(--mrd-label-font-weight);color:var(--mrd-label-color)}.mrd-file-field__label--required.sc-mrd-file-field::after{content:" *";color:var(--mrd-color-danger)}.mrd-file-field__error.sc-mrd-file-field{font-family:var(--mrd-font-family);font-size:var(--mrd-error-font-size);color:var(--mrd-error-color)}.mrd-file-field__zone.sc-mrd-file-field{display:flex;align-items:center;justify-content:center;border:2px dashed var(--mrd-border-color);border-radius:var(--mrd-border-radius-md);background-color:var(--mrd-color-neutral-50);cursor:pointer;transition:border-color var(--mrd-transition), background-color var(--mrd-transition);min-height:100px;position:relative}.mrd-file-field__zone.sc-mrd-file-field:hover,.mrd-file-field__zone--dragging.sc-mrd-file-field{border-color:var(--mrd-color-primary);background-color:var(--mrd-color-primary-light)}.mrd-file-field__zone--error.sc-mrd-file-field{border-color:var(--mrd-border-color-error)}.mrd-file-field__zone--disabled.sc-mrd-file-field{opacity:0.6;cursor:not-allowed}.mrd-file-field__zone--disabled.sc-mrd-file-field:hover{border-color:var(--mrd-border-color);background-color:var(--mrd-color-neutral-50)}.mrd-file-field__zone.sc-mrd-file-field{padding:var(--mrd-space-6)}.mrd-file-field__input.sc-mrd-file-field{position:absolute;inset:0;opacity:0;width:100%;height:100%;pointer-events:none;cursor:pointer}.mrd-file-field__prompt.sc-mrd-file-field{display:flex;flex-direction:column;align-items:center;gap:var(--mrd-space-2);font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-sm);color:var(--mrd-color-neutral-500);text-align:center}.mrd-file-field__upload-icon.sc-mrd-file-field{width:32px;height:32px;color:var(--mrd-color-neutral-400)}.mrd-file-field__browse.sc-mrd-file-field{color:var(--mrd-color-primary);font-weight:var(--mrd-font-weight-medium);text-decoration:underline}.mrd-file-field__selected.sc-mrd-file-field{display:flex;align-items:center;gap:var(--mrd-space-2);font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-sm);color:var(--mrd-color-neutral-700)}.mrd-file-field__icon.sc-mrd-file-field{width:20px;height:20px;color:var(--mrd-color-primary);flex-shrink:0}.mrd-file-field__filename.sc-mrd-file-field{flex:1;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;max-width:200px}.mrd-file-field__clear.sc-mrd-file-field{background:none;border:none;cursor:pointer;color:var(--mrd-color-neutral-400);font-size:var(--mrd-font-size-sm);padding:var(--mrd-space-1);border-radius:var(--mrd-border-radius-sm);line-height:1}.mrd-file-field__clear.sc-mrd-file-field:hover{color:var(--mrd-color-danger);background-color:var(--mrd-color-danger-light)}.mrd-file-field__spinner.sc-mrd-file-field{display:inline-block;width:18px;height:18px;border:2px solid var(--mrd-color-neutral-300);border-top-color:var(--mrd-color-primary);border-radius:50%;animation:mrd-spin 0.6s linear infinite;flex-shrink:0}@keyframes mrd-spin{to{transform:rotate(360deg)}}`;
4164
+ const mrdFileFieldCss = () => `.sc-mrd-file-field-h{display:block}.mrd-file-field.sc-mrd-file-field{display:flex;flex-direction:column;gap:var(--mrd-space-1);width:100%}.mrd-file-field__label.sc-mrd-file-field{display:block;font-family:var(--mrd-font-family);font-size:var(--mrd-label-font-size);font-weight:var(--mrd-label-font-weight);color:var(--mrd-label-color)}.mrd-file-field__label--required.sc-mrd-file-field::after{content:" *";color:var(--mrd-color-danger)}.mrd-file-field__error.sc-mrd-file-field{font-family:var(--mrd-font-family);font-size:var(--mrd-error-font-size);color:var(--mrd-error-color)}.mrd-file-field__zone.sc-mrd-file-field{display:flex;align-items:center;justify-content:center;border:2px dashed var(--mrd-border-color);border-radius:var(--mrd-border-radius-md);background-color:var(--mrd-color-neutral-50);cursor:pointer;transition:border-color var(--mrd-transition), background-color var(--mrd-transition);min-height:100px;position:relative}.mrd-file-field__zone.sc-mrd-file-field:hover,.mrd-file-field__zone--dragging.sc-mrd-file-field{border-color:var(--mrd-color-primary);background-color:var(--mrd-color-primary-light)}.mrd-file-field__zone--error.sc-mrd-file-field{border-color:var(--mrd-border-color-error)}.mrd-file-field__zone--disabled.sc-mrd-file-field{opacity:0.6;cursor:not-allowed}.mrd-file-field__zone--disabled.sc-mrd-file-field:hover{border-color:var(--mrd-border-color);background-color:var(--mrd-color-neutral-50)}.mrd-file-field__zone.sc-mrd-file-field{padding:var(--mrd-space-6)}.mrd-file-field__input.sc-mrd-file-field{position:absolute;inset:0;opacity:0;width:100%;height:100%;pointer-events:none;cursor:pointer}.mrd-file-field__prompt.sc-mrd-file-field{display:flex;flex-direction:column;align-items:center;gap:var(--mrd-space-2);font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-sm);color:var(--mrd-color-neutral-500);text-align:center}.mrd-file-field__upload-icon.sc-mrd-file-field{width:32px;height:32px;color:var(--mrd-color-neutral-400)}.mrd-file-field__browse.sc-mrd-file-field{color:var(--mrd-color-primary);font-weight:var(--mrd-font-weight-medium);text-decoration:underline}.mrd-file-field__selected.sc-mrd-file-field{display:flex;align-items:center;gap:var(--mrd-space-2);font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-sm);color:var(--mrd-color-neutral-700)}.mrd-file-field__list.sc-mrd-file-field{list-style:none;display:flex;flex-direction:column;gap:var(--mrd-space-1);margin:var(--mrd-space-2) 0 0;padding:0}.mrd-file-field__item.sc-mrd-file-field{display:flex;align-items:center;gap:var(--mrd-space-2);padding:var(--mrd-space-1) var(--mrd-space-2);border:var(--mrd-border-width) solid var(--mrd-border-color);border-radius:var(--mrd-border-radius-sm);font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-sm);color:var(--mrd-color-neutral-700)}.mrd-file-field__icon.sc-mrd-file-field{width:20px;height:20px;color:var(--mrd-color-primary);flex-shrink:0}.mrd-file-field__filename.sc-mrd-file-field{flex:1;min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.mrd-file-field__clear.sc-mrd-file-field{background:none;border:none;cursor:pointer;color:var(--mrd-color-neutral-400);font-size:var(--mrd-font-size-sm);padding:var(--mrd-space-1);border-radius:var(--mrd-border-radius-sm);line-height:1}.mrd-file-field__clear.sc-mrd-file-field:hover{color:var(--mrd-color-danger);background-color:var(--mrd-color-danger-light)}.mrd-file-field__spinner.sc-mrd-file-field{display:inline-block;width:18px;height:18px;border:2px solid var(--mrd-color-neutral-300);border-top-color:var(--mrd-color-primary);border-radius:50%;animation:mrd-spin 0.6s linear infinite;flex-shrink:0}@keyframes mrd-spin{to{transform:rotate(360deg)}}`;
2264
4165
 
2265
4166
  const MrdFileField = class {
2266
4167
  constructor(hostRef) {
@@ -2276,69 +4177,107 @@ const MrdFileField = class {
2276
4177
  this.locale = navigator.language;
2277
4178
  this.accept = '';
2278
4179
  this.maxSize = 0; // bytes, 0 = no limit
2279
- this.fileName = '';
4180
+ this.multiple = false;
4181
+ /** Working copy of the field's files, kept in sync with `value`. Entries still
4182
+ * a `File` are pending upload; resolved entries are `{ href, fileName }` (or a
4183
+ * bare href string for older hosts). */
4184
+ this.entries = [];
2280
4185
  this.isDragging = false;
2281
- this.uploading = false;
2282
4186
  this.error = '';
2283
4187
  this.handleInputChange = (e) => {
2284
4188
  var _a;
2285
- const files = e.target.files;
2286
- this.handleFile((_a = files === null || files === void 0 ? void 0 : files[0]) !== null && _a !== void 0 ? _a : null);
4189
+ const input = e.target;
4190
+ this.addFiles(Array.from((_a = input.files) !== null && _a !== void 0 ? _a : []));
4191
+ input.value = '';
2287
4192
  };
2288
- this.drag = makeDragHandlers(dragging => (this.isDragging = dragging), file => this.handleFile(file));
4193
+ this.drag = makeDragHandlers(dragging => (this.isDragging = dragging), files => this.addFiles(files));
2289
4194
  this.handleZoneClick = () => {
2290
4195
  var _a;
2291
- if (!this.disabled && !this.uploading) {
4196
+ if (!this.disabled && !this.zoneBusy) {
2292
4197
  (_a = this.fileInputRef) === null || _a === void 0 ? void 0 : _a.click();
2293
4198
  }
2294
4199
  };
2295
- this.handleClear = (e) => {
4200
+ this.handleRemove = (index) => (e) => {
2296
4201
  e.stopPropagation();
2297
- this.fileName = '';
4202
+ const next = this.entries.filter((_, i) => i !== index);
4203
+ this.entries = next;
2298
4204
  this.error = '';
2299
- this.uploading = false;
2300
4205
  if (this.fileInputRef)
2301
4206
  this.fileInputRef.value = '';
2302
- this.mrdChange.emit({ name: this.name, value: null });
4207
+ this.emitValue(next);
2303
4208
  };
2304
4209
  }
2305
- /** When the host provides a URI back via setFieldValue, the upload is done. */
2306
- valueChanged(newVal) {
2307
- if (typeof newVal === 'string' && newVal) {
2308
- this.uploading = false;
4210
+ componentWillLoad() {
4211
+ this.syncEntriesFromValue();
4212
+ }
4213
+ /** The host (via mrd-form.setFieldValue) is the source of truth once a value round-trips back. */
4214
+ valueChanged() {
4215
+ this.syncEntriesFromValue();
4216
+ }
4217
+ syncEntriesFromValue() {
4218
+ const v = this.value;
4219
+ if (this.multiple) {
4220
+ this.entries = Array.isArray(v) ? [...v] : v ? [v] : [];
2309
4221
  }
2310
- else if (!newVal) {
2311
- this.uploading = false;
2312
- this.fileName = '';
4222
+ else {
4223
+ this.entries = v ? [v] : [];
2313
4224
  }
2314
4225
  }
2315
- handleFile(file) {
2316
- if (!file) {
2317
- this.fileName = '';
2318
- this.uploading = false;
2319
- this.mrdChange.emit({ name: this.name, value: null });
4226
+ emitValue(entries) {
4227
+ var _a;
4228
+ const value = this.multiple ? entries : (_a = entries[0]) !== null && _a !== void 0 ? _a : null;
4229
+ this.mrdChange.emit({ name: this.name, value: value });
4230
+ }
4231
+ addFiles(files) {
4232
+ if (this.disabled || this.zoneBusy)
2320
4233
  return;
2321
- }
2322
- const uploadError = validateUploadFile(file, this.maxSize, this.locale);
2323
- if (uploadError) {
2324
- this.error = uploadError;
4234
+ const candidates = this.multiple ? files : files.slice(0, 1);
4235
+ if (!candidates.length)
2325
4236
  return;
4237
+ const accepted = [];
4238
+ let uploadError = '';
4239
+ for (const file of candidates) {
4240
+ const err = validateUploadFile(file, this.maxSize, this.locale);
4241
+ if (err) {
4242
+ uploadError = err;
4243
+ continue;
4244
+ }
4245
+ accepted.push(file);
2326
4246
  }
2327
- this.error = '';
2328
- this.fileName = file.name;
2329
- this.uploading = true;
2330
- this.mrdChange.emit({ name: this.name, value: file });
2331
- this.mrdUpload.emit({ name: this.name, file });
4247
+ this.error = uploadError;
4248
+ if (!accepted.length)
4249
+ return;
4250
+ const next = this.multiple ? [...this.entries, ...accepted] : [accepted[0]];
4251
+ this.entries = next;
4252
+ this.emitValue(next);
4253
+ for (const file of accepted) {
4254
+ this.mrdUpload.emit({ name: this.name, file });
4255
+ }
4256
+ }
4257
+ /** In single mode, block re-selection while the one file is still uploading;
4258
+ * in multiple mode, more files can always be added alongside pending uploads. */
4259
+ get zoneBusy() {
4260
+ return !this.multiple && this.entries.some(isPending);
4261
+ }
4262
+ /** Icon/spinner + filename + remove button — the caller supplies the wrapping element
4263
+ * (a plain row for single mode, an `<li>` for the multi-mode list). */
4264
+ renderEntry(entry, index) {
4265
+ const uploading = isPending(entry);
4266
+ return [
4267
+ uploading ? (h("span", { class: "mrd-file-field__spinner", "aria-label": t('loading', this.locale) })) : (h("svg", { class: "mrd-file-field__icon", viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", "stroke-width": "2" }, h("path", { d: "M14 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V8z" }), h("polyline", { points: "14 2 14 8 20 8" }))),
4268
+ h("span", { class: "mrd-file-field__filename" }, entryLabel(entry)),
4269
+ !uploading && (h("button", { class: "mrd-file-field__clear", type: "button", onClick: this.handleRemove(index), "aria-label": t('remove', this.locale) }, "\u2715")),
4270
+ ];
2332
4271
  }
2333
4272
  render() {
2334
- const hasFile = this.uploading || (typeof this.value === 'string' && this.value) || this.fileName;
2335
4273
  const hasError = !!this.error;
4274
+ const hasEntries = this.entries.length > 0;
2336
4275
  const zoneClass = uploadZoneClass('mrd-file-field', {
2337
4276
  dragging: this.isDragging,
2338
4277
  error: hasError,
2339
- disabled: this.disabled || this.uploading,
4278
+ disabled: this.disabled || this.zoneBusy,
2340
4279
  });
2341
- return (h(Host, { key: '6410e945bb873a05d0a1b3be45bc879b5e153a05' }, h("div", { key: '4d1d69d768b383f0d9190f88a50a87de8679d3d2', class: "mrd-file-field" }, h(FieldLabel, { key: '7e0009908fb4c087de16cf08251ab398199dae60', base: "mrd-file-field", label: this.label, required: this.required }), h("div", { key: '88dfc0d1c34670f7de8f3cf2dea4c95b0ae66f4c', class: zoneClass, onClick: this.handleZoneClick, onDragOver: this.drag.onDragOver, onDragLeave: this.drag.onDragLeave, onDrop: this.drag.onDrop }, h("input", { key: 'b6d678b5582a58721c928cef47dd8d6645b26a86', ref: el => (this.fileInputRef = el), class: "mrd-file-field__input", type: "file", name: this.name, accept: this.accept, disabled: this.disabled || this.uploading, required: this.required && !hasFile, onChange: this.handleInputChange }), hasFile ? (h("div", { class: "mrd-file-field__selected" }, this.uploading ? (h("span", { class: "mrd-file-field__spinner", "aria-label": t('loading', this.locale) })) : (h("svg", { class: "mrd-file-field__icon", viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", "stroke-width": "2" }, h("path", { d: "M14 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V8z" }), h("polyline", { points: "14 2 14 8 20 8" }))), h("span", { class: "mrd-file-field__filename" }, this.fileName), !this.uploading && (h("button", { class: "mrd-file-field__clear", type: "button", onClick: this.handleClear, "aria-label": t('clear', this.locale) }, "\u2715")))) : (h("div", { class: "mrd-file-field__prompt" }, h("svg", { class: "mrd-file-field__upload-icon", viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", "stroke-width": "2" }, h("polyline", { points: "16 16 12 12 8 16" }), h("line", { x1: "12", y1: "12", x2: "12", y2: "21" }), h("path", { d: "M20.39 18.39A5 5 0 0 0 18 9h-1.26A8 8 0 1 0 3 16.3" })), h("span", null, t('drop_file_here', this.locale), ' ', h("span", { class: "mrd-file-field__browse" }, t('browse', this.locale)))))), h(FieldError, { key: '80f1698819c60b15476b953f5f3216f195430b84', base: "mrd-file-field", error: this.error }))));
4280
+ return (h(Host, { key: '2e740a0857b069740a6a13616d0a0dfee2b945be' }, h("div", { key: '069b25ced3b2f1ce547819086dadbd53ade2378c', class: "mrd-file-field" }, h(FieldLabel, { key: 'd13f3cb0af766d6328772dab865b2079c85ec075', base: "mrd-file-field", label: this.label, required: this.required }), h("div", { key: '9ffdbb508e3934854034c46e6f719a88d4175920', class: zoneClass, onClick: this.handleZoneClick, onDragOver: this.drag.onDragOver, onDragLeave: this.drag.onDragLeave, onDrop: this.drag.onDrop }, h("input", { key: 'c5d6954b8fa050889b5b65e15fde229dd64d7cc7', ref: el => (this.fileInputRef = el), class: "mrd-file-field__input", type: "file", name: this.name, accept: this.accept, multiple: this.multiple, disabled: this.disabled || this.zoneBusy, required: this.required && !hasEntries, onChange: this.handleInputChange }), hasEntries && !this.multiple ? (h("div", { class: "mrd-file-field__selected" }, this.renderEntry(this.entries[0], 0))) : (h("div", { class: "mrd-file-field__prompt" }, h("svg", { class: "mrd-file-field__upload-icon", viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", "stroke-width": "2" }, h("polyline", { points: "16 16 12 12 8 16" }), h("line", { x1: "12", y1: "12", x2: "12", y2: "21" }), h("path", { d: "M20.39 18.39A5 5 0 0 0 18 9h-1.26A8 8 0 1 0 3 16.3" })), h("span", null, t('drop_file_here', this.locale), ' ', h("span", { class: "mrd-file-field__browse" }, t('browse', this.locale)))))), this.multiple && hasEntries && (h("ul", { key: '910a3e89f74d93ab16fb9f677a4276d5ad88897d', class: "mrd-file-field__list" }, this.entries.map((entry, index) => (h("li", { class: "mrd-file-field__item", key: `${index}-${entryLabel(entry)}` }, this.renderEntry(entry, index)))))), h(FieldError, { key: '4f0f071b0a1460ea1d6067a8fa4f588ebc620f2a', base: "mrd-file-field", error: this.error }))));
2342
4281
  }
2343
4282
  static get watchers() { return {
2344
4283
  "value": [{
@@ -2553,7 +4492,31 @@ const MrdForm = class {
2553
4492
  }
2554
4493
  return null;
2555
4494
  }
2556
- async setFieldValue(name, value) {
4495
+ /**
4496
+ * Inject a value from outside (e.g. after a file upload completes).
4497
+ * `file` is optional and only meaningful for `multiple` FILE/IMAGE fields: when
4498
+ * the field's current value is an array, mrd-form replaces the array entry that
4499
+ * `=== file` with `value`, leaving other pending/resolved entries untouched —
4500
+ * this is how mrd-file-field/mrd-image-field resolve concurrent per-file uploads.
4501
+ * Pass the `file` from the originating mrdUpload event back unchanged.
4502
+ */
4503
+ async setFieldValue(name, value, file) {
4504
+ if (file) {
4505
+ const current = this.formValues[name];
4506
+ if (Array.isArray(current)) {
4507
+ const index = current.indexOf(file);
4508
+ if (index === -1)
4509
+ return; // the file was removed from the field before its upload resolved
4510
+ const next = [...current];
4511
+ next[index] = value;
4512
+ this.formValues = Object.assign(Object.assign({}, this.formValues), { [name]: next });
4513
+ if (this.errors[name])
4514
+ this.errors = Object.assign(Object.assign({}, this.errors), { [name]: '' });
4515
+ return;
4516
+ }
4517
+ if (current !== file)
4518
+ return; // stale resolution for a value that was since cleared/replaced
4519
+ }
2557
4520
  this.formValues = Object.assign(Object.assign({}, this.formValues), { [name]: value });
2558
4521
  if (this.errors[name]) {
2559
4522
  this.errors = Object.assign(Object.assign({}, this.errors), { [name]: '' });
@@ -2623,6 +4586,20 @@ const MrdForm = class {
2623
4586
  normalizeFieldValue(value) {
2624
4587
  return (value === '' || value == null) ? null : value;
2625
4588
  }
4589
+ /** FILE/IMAGE entries render as `{ href, fileName, contentType?, size? }` — the same
4590
+ * shape the API returns for an already-persisted file — or a bare href string for
4591
+ * freshly-resolved uploads. Only `href` is meaningful to the API, so unwrap before
4592
+ * submit (mirrors normalizeRelationValue). Do NOT fall back to any other key (e.g.
4593
+ * `id`) as a stand-in for `href` — a bare id is not a valid/complete reference on its
4594
+ * own; if `href` is ever missing that's an API bug to fix upstream, not to paper over here. */
4595
+ normalizeFileFieldValue(value) {
4596
+ const toHref = (v) => v && typeof v === 'object' && 'href' in v ? v.href : v;
4597
+ if (Array.isArray(value)) {
4598
+ const hrefs = value.map(toHref).filter(v => v != null && v !== '');
4599
+ return hrefs.length ? hrefs : null;
4600
+ }
4601
+ return this.normalizeFieldValue(toHref(value));
4602
+ }
2626
4603
  normalizeRelationValue(value) {
2627
4604
  if (value == null || value === '')
2628
4605
  return null;
@@ -2669,8 +4646,11 @@ const MrdForm = class {
2669
4646
  const rawValue = this.formValues[name];
2670
4647
  if (rawValue instanceof File)
2671
4648
  continue;
2672
- const current = this.normalizeFieldValue(rawValue);
2673
- const initial = this.normalizeFieldValue(this.initialValues[name]);
4649
+ if (Array.isArray(rawValue) && rawValue.some(v => v instanceof File))
4650
+ continue;
4651
+ const isFileField = item.dataType === ClientLayoutItemFieldDataType.FILE || item.dataType === ClientLayoutItemFieldDataType.IMAGE;
4652
+ const current = isFileField ? this.normalizeFileFieldValue(rawValue) : this.normalizeFieldValue(rawValue);
4653
+ const initial = isFileField ? this.normalizeFileFieldValue(this.initialValues[name]) : this.normalizeFieldValue(this.initialValues[name]);
2674
4654
  if (this.deepEqual(current, initial))
2675
4655
  continue;
2676
4656
  payload[name] = current;
@@ -2787,7 +4767,7 @@ const MrdHyperlinkField = class {
2787
4767
  };
2788
4768
  MrdHyperlinkField.style = mrdHyperlinkFieldCss();
2789
4769
 
2790
- const mrdImageFieldCss = () => `.sc-mrd-image-field-h{display:block}.mrd-image-field.sc-mrd-image-field{display:flex;flex-direction:column;gap:var(--mrd-space-1);width:100%}.mrd-image-field__label.sc-mrd-image-field{display:block;font-family:var(--mrd-font-family);font-size:var(--mrd-label-font-size);font-weight:var(--mrd-label-font-weight);color:var(--mrd-label-color)}.mrd-image-field__label--required.sc-mrd-image-field::after{content:" *";color:var(--mrd-color-danger)}.mrd-image-field__error.sc-mrd-image-field{font-family:var(--mrd-font-family);font-size:var(--mrd-error-font-size);color:var(--mrd-error-color)}.mrd-image-field__zone.sc-mrd-image-field{display:flex;align-items:center;justify-content:center;border:2px dashed var(--mrd-border-color);border-radius:var(--mrd-border-radius-md);background-color:var(--mrd-color-neutral-50);cursor:pointer;transition:border-color var(--mrd-transition), background-color var(--mrd-transition);min-height:100px;position:relative}.mrd-image-field__zone.sc-mrd-image-field:hover,.mrd-image-field__zone--dragging.sc-mrd-image-field{border-color:var(--mrd-color-primary);background-color:var(--mrd-color-primary-light)}.mrd-image-field__zone--error.sc-mrd-image-field{border-color:var(--mrd-border-color-error)}.mrd-image-field__zone--disabled.sc-mrd-image-field{opacity:0.6;cursor:not-allowed}.mrd-image-field__zone--disabled.sc-mrd-image-field:hover{border-color:var(--mrd-border-color);background-color:var(--mrd-color-neutral-50)}.mrd-image-field__input.sc-mrd-image-field{position:absolute;inset:0;opacity:0;width:100%;height:100%;pointer-events:none}.mrd-image-field__prompt.sc-mrd-image-field{display:flex;flex-direction:column;align-items:center;gap:var(--mrd-space-2);padding:var(--mrd-space-6);font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-sm);color:var(--mrd-color-neutral-500);text-align:center}.mrd-image-field__upload-icon.sc-mrd-image-field{width:40px;height:40px;color:var(--mrd-color-neutral-400)}.mrd-image-field__browse.sc-mrd-image-field{color:var(--mrd-color-primary);font-weight:var(--mrd-font-weight-medium);text-decoration:underline}.mrd-image-field__preview-container.sc-mrd-image-field{display:flex;align-items:center;gap:var(--mrd-space-4);padding:var(--mrd-space-4);width:100%}.mrd-image-field__preview-thumb.sc-mrd-image-field{flex-shrink:0;width:80px;height:80px;border-radius:var(--mrd-border-radius);overflow:hidden;border:var(--mrd-border-width) solid var(--mrd-border-color);background-color:var(--mrd-color-neutral-100)}.mrd-image-field__preview.sc-mrd-image-field{width:100%;height:100%;object-fit:cover;display:block}.mrd-image-field__preview-info.sc-mrd-image-field{flex:1;min-width:0;display:flex;flex-direction:column;gap:var(--mrd-space-1)}.mrd-image-field__preview-name.sc-mrd-image-field{font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-sm);font-weight:var(--mrd-font-weight-medium);color:var(--mrd-color-neutral-800);overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.mrd-image-field__preview-overlay.sc-mrd-image-field{position:absolute;inset:0;background:rgba(255, 255, 255, 0.7);display:flex;align-items:center;justify-content:center;border-radius:var(--mrd-border-radius)}.mrd-image-field__spinner.sc-mrd-image-field{display:inline-block;width:24px;height:24px;border:2px solid var(--mrd-color-neutral-300);border-top-color:var(--mrd-color-primary);border-radius:50%;animation:mrd-spin 0.6s linear infinite}.mrd-image-field__upload-status.sc-mrd-image-field{font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-xs);color:var(--mrd-color-neutral-500)}.mrd-image-field__clear.sc-mrd-image-field{flex-shrink:0;background-color:var(--mrd-color-white);color:var(--mrd-color-danger);border:var(--mrd-border-width) solid var(--mrd-color-danger);border-radius:var(--mrd-border-radius);padding:var(--mrd-space-1) var(--mrd-space-3);font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-sm);font-weight:var(--mrd-font-weight-medium);cursor:pointer;transition:background-color var(--mrd-transition), color var(--mrd-transition)}.mrd-image-field__clear.sc-mrd-image-field:hover{background-color:var(--mrd-color-danger);color:var(--mrd-color-white)}@keyframes mrd-spin{to{transform:rotate(360deg)}}`;
4770
+ const mrdImageFieldCss = () => `.sc-mrd-image-field-h{display:block}.mrd-image-field.sc-mrd-image-field{display:flex;flex-direction:column;gap:var(--mrd-space-1);width:100%}.mrd-image-field__label.sc-mrd-image-field{display:block;font-family:var(--mrd-font-family);font-size:var(--mrd-label-font-size);font-weight:var(--mrd-label-font-weight);color:var(--mrd-label-color)}.mrd-image-field__label--required.sc-mrd-image-field::after{content:" *";color:var(--mrd-color-danger)}.mrd-image-field__error.sc-mrd-image-field{font-family:var(--mrd-font-family);font-size:var(--mrd-error-font-size);color:var(--mrd-error-color)}.mrd-image-field__zone.sc-mrd-image-field{display:flex;align-items:center;justify-content:center;border:2px dashed var(--mrd-border-color);border-radius:var(--mrd-border-radius-md);background-color:var(--mrd-color-neutral-50);cursor:pointer;transition:border-color var(--mrd-transition), background-color var(--mrd-transition);min-height:100px;position:relative}.mrd-image-field__zone.sc-mrd-image-field:hover,.mrd-image-field__zone--dragging.sc-mrd-image-field{border-color:var(--mrd-color-primary);background-color:var(--mrd-color-primary-light)}.mrd-image-field__zone--error.sc-mrd-image-field{border-color:var(--mrd-border-color-error)}.mrd-image-field__zone--disabled.sc-mrd-image-field{opacity:0.6;cursor:not-allowed}.mrd-image-field__zone--disabled.sc-mrd-image-field:hover{border-color:var(--mrd-border-color);background-color:var(--mrd-color-neutral-50)}.mrd-image-field__input.sc-mrd-image-field{position:absolute;inset:0;opacity:0;width:100%;height:100%;pointer-events:none}.mrd-image-field__prompt.sc-mrd-image-field{display:flex;flex-direction:column;align-items:center;gap:var(--mrd-space-2);padding:var(--mrd-space-6);font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-sm);color:var(--mrd-color-neutral-500);text-align:center}.mrd-image-field__upload-icon.sc-mrd-image-field{width:40px;height:40px;color:var(--mrd-color-neutral-400)}.mrd-image-field__browse.sc-mrd-image-field{color:var(--mrd-color-primary);font-weight:var(--mrd-font-weight-medium);text-decoration:underline}.mrd-image-field__preview-container.sc-mrd-image-field{display:flex;align-items:center;gap:var(--mrd-space-4);padding:var(--mrd-space-4);width:100%}.mrd-image-field__preview-thumb.sc-mrd-image-field{position:relative;flex-shrink:0;width:80px;height:80px;border-radius:var(--mrd-border-radius);overflow:hidden;border:var(--mrd-border-width) solid var(--mrd-border-color);background-color:var(--mrd-color-neutral-100)}.mrd-image-field__preview.sc-mrd-image-field{width:100%;height:100%;object-fit:cover;display:block}.mrd-image-field__preview-info.sc-mrd-image-field{flex:1;min-width:0;display:flex;flex-direction:column;gap:var(--mrd-space-1)}.mrd-image-field__preview-name.sc-mrd-image-field{font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-sm);font-weight:var(--mrd-font-weight-medium);color:var(--mrd-color-neutral-800);overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.mrd-image-field__preview-overlay.sc-mrd-image-field{position:absolute;inset:0;background:rgba(255, 255, 255, 0.7);display:flex;align-items:center;justify-content:center;border-radius:var(--mrd-border-radius)}.mrd-image-field__spinner.sc-mrd-image-field{display:inline-block;width:24px;height:24px;border:2px solid var(--mrd-color-neutral-300);border-top-color:var(--mrd-color-primary);border-radius:50%;animation:mrd-spin 0.6s linear infinite}.mrd-image-field__upload-status.sc-mrd-image-field{font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-xs);color:var(--mrd-color-neutral-500)}.mrd-image-field__clear.sc-mrd-image-field{flex-shrink:0;background-color:var(--mrd-color-white);color:var(--mrd-color-danger);border:var(--mrd-border-width) solid var(--mrd-color-danger);border-radius:var(--mrd-border-radius);padding:var(--mrd-space-1) var(--mrd-space-3);font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-sm);font-weight:var(--mrd-font-weight-medium);cursor:pointer;transition:background-color var(--mrd-transition), color var(--mrd-transition)}.mrd-image-field__clear.sc-mrd-image-field:hover{background-color:var(--mrd-color-danger);color:var(--mrd-color-white)}.mrd-image-field__grid.sc-mrd-image-field{list-style:none;display:flex;flex-wrap:wrap;gap:var(--mrd-space-3);margin:var(--mrd-space-2) 0 0;padding:0}.mrd-image-field__grid-item.sc-mrd-image-field{position:relative;display:flex;flex-direction:column;align-items:center;gap:var(--mrd-space-1);width:88px}.mrd-image-field__grid-name.sc-mrd-image-field{font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-xs);color:var(--mrd-color-neutral-600);max-width:100%;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.mrd-image-field__grid-remove.sc-mrd-image-field{position:absolute;top:-6px;right:-6px;width:20px;height:20px;line-height:1;background-color:var(--mrd-color-white);color:var(--mrd-color-neutral-500);border:var(--mrd-border-width) solid var(--mrd-border-color);border-radius:50%;cursor:pointer;font-size:var(--mrd-font-size-xs)}.mrd-image-field__grid-remove.sc-mrd-image-field:hover{color:var(--mrd-color-danger);border-color:var(--mrd-color-danger)}@keyframes mrd-spin{to{transform:rotate(360deg)}}`;
2791
4771
 
2792
4772
  const MrdImageField = class {
2793
4773
  constructor(hostRef) {
@@ -2803,79 +4783,125 @@ const MrdImageField = class {
2803
4783
  this.locale = navigator.language;
2804
4784
  this.accept = 'image/*';
2805
4785
  this.maxSize = 0;
2806
- this.previewUrl = '';
2807
- this.fileName = '';
4786
+ this.multiple = false;
4787
+ /** Working copy of the field's files, kept in sync with `value`. Entries still
4788
+ * a `File` are pending upload; resolved entries are `{ href, fileName }` (or a
4789
+ * bare href string for older hosts). */
4790
+ this.entries = [];
2808
4791
  this.isDragging = false;
2809
- this.uploading = false;
2810
4792
  this.error = '';
4793
+ /** Local data-URL previews for pending File entries, keyed by File reference. */
4794
+ this.previewCache = new Map();
2811
4795
  this.handleInputChange = (e) => {
2812
4796
  var _a;
2813
- const files = e.target.files;
2814
- this.handleFile((_a = files === null || files === void 0 ? void 0 : files[0]) !== null && _a !== void 0 ? _a : null);
4797
+ const input = e.target;
4798
+ this.addFiles(Array.from((_a = input.files) !== null && _a !== void 0 ? _a : []));
4799
+ input.value = '';
2815
4800
  };
2816
- this.drag = makeDragHandlers(dragging => (this.isDragging = dragging), file => this.handleFile(file));
4801
+ this.drag = makeDragHandlers(dragging => (this.isDragging = dragging), files => this.addFiles(files));
2817
4802
  this.handleZoneClick = () => {
2818
4803
  var _a;
2819
- if (!this.disabled && !this.uploading) {
4804
+ if (!this.disabled && !this.zoneBusy) {
2820
4805
  (_a = this.fileInputRef) === null || _a === void 0 ? void 0 : _a.click();
2821
4806
  }
2822
4807
  };
2823
- this.handleClear = (e) => {
4808
+ this.handleRemove = (index) => (e) => {
2824
4809
  e.stopPropagation();
2825
- this.previewUrl = '';
2826
- this.fileName = '';
4810
+ const removed = this.entries[index];
4811
+ if (removed instanceof File)
4812
+ this.previewCache.delete(removed);
4813
+ const next = this.entries.filter((_, i) => i !== index);
4814
+ this.entries = next;
2827
4815
  this.error = '';
2828
- this.uploading = false;
2829
4816
  if (this.fileInputRef)
2830
4817
  this.fileInputRef.value = '';
2831
- this.mrdChange.emit({ name: this.name, value: null });
4818
+ this.emitValue(next);
2832
4819
  };
2833
4820
  }
2834
- /** When the host provides a URI back via setFieldValue, the upload is done. */
2835
- valueChanged(newVal) {
2836
- if (typeof newVal === 'string' && newVal) {
2837
- this.uploading = false;
2838
- }
2839
- else if (!newVal) {
2840
- this.uploading = false;
2841
- this.previewUrl = '';
2842
- this.fileName = '';
2843
- }
4821
+ componentWillLoad() {
4822
+ this.syncEntriesFromValue();
2844
4823
  }
2845
- handleFile(file) {
2846
- if (!file) {
2847
- this.previewUrl = '';
2848
- this.fileName = '';
2849
- this.uploading = false;
2850
- this.mrdChange.emit({ name: this.name, value: null });
2851
- return;
4824
+ /** The host (via mrd-form.setFieldValue) is the source of truth once a value round-trips back. */
4825
+ valueChanged() {
4826
+ this.syncEntriesFromValue();
4827
+ }
4828
+ syncEntriesFromValue() {
4829
+ const v = this.value;
4830
+ if (this.multiple) {
4831
+ this.entries = Array.isArray(v) ? [...v] : v ? [v] : [];
2852
4832
  }
2853
- const uploadError = validateUploadFile(file, this.maxSize, this.locale, true);
2854
- if (uploadError) {
2855
- this.error = uploadError;
2856
- return;
4833
+ else {
4834
+ this.entries = v ? [v] : [];
2857
4835
  }
2858
- this.error = '';
2859
- this.fileName = file.name;
2860
- this.uploading = true;
2861
- // Show local preview immediately while upload is in progress
4836
+ }
4837
+ emitValue(entries) {
4838
+ var _a;
4839
+ const value = this.multiple ? entries : (_a = entries[0]) !== null && _a !== void 0 ? _a : null;
4840
+ this.mrdChange.emit({ name: this.name, value: value });
4841
+ }
4842
+ readPreview(file) {
2862
4843
  const reader = new FileReader();
2863
- reader.onload = (ev) => {
4844
+ reader.onload = ev => {
2864
4845
  var _a;
2865
- this.previewUrl = (_a = ev.target) === null || _a === void 0 ? void 0 : _a.result;
4846
+ this.previewCache.set(file, (_a = ev.target) === null || _a === void 0 ? void 0 : _a.result);
4847
+ this.entries = [...this.entries]; // trigger re-render now that the preview is ready
2866
4848
  };
2867
4849
  reader.readAsDataURL(file);
2868
- this.mrdChange.emit({ name: this.name, value: file });
2869
- this.mrdUpload.emit({ name: this.name, file });
4850
+ }
4851
+ addFiles(files) {
4852
+ if (this.disabled || this.zoneBusy)
4853
+ return;
4854
+ const candidates = this.multiple ? files : files.slice(0, 1);
4855
+ if (!candidates.length)
4856
+ return;
4857
+ const accepted = [];
4858
+ let uploadError = '';
4859
+ for (const file of candidates) {
4860
+ const err = validateUploadFile(file, this.maxSize, this.locale, true);
4861
+ if (err) {
4862
+ uploadError = err;
4863
+ continue;
4864
+ }
4865
+ accepted.push(file);
4866
+ }
4867
+ this.error = uploadError;
4868
+ if (!accepted.length)
4869
+ return;
4870
+ const next = this.multiple ? [...this.entries, ...accepted] : [accepted[0]];
4871
+ this.entries = next;
4872
+ this.emitValue(next);
4873
+ for (const file of accepted) {
4874
+ this.readPreview(file);
4875
+ this.mrdUpload.emit({ name: this.name, file });
4876
+ }
4877
+ }
4878
+ /** In single mode, block re-selection while the one image is still uploading;
4879
+ * in multiple mode, more images can always be added alongside pending uploads. */
4880
+ get zoneBusy() {
4881
+ return !this.multiple && this.entries.some(isPending);
4882
+ }
4883
+ renderThumb(entry) {
4884
+ const uploading = isPending(entry);
4885
+ const previewUrl = uploading ? this.previewCache.get(entry) : null;
4886
+ return (h("div", { class: "mrd-image-field__preview-thumb" }, previewUrl && h("img", { class: "mrd-image-field__preview", src: previewUrl, alt: entryLabel(entry) }), uploading && (h("div", { class: "mrd-image-field__preview-overlay" }, h("span", { class: "mrd-image-field__spinner", "aria-label": t('loading', this.locale) })))));
4887
+ }
4888
+ renderSingle(entry) {
4889
+ const uploading = isPending(entry);
4890
+ return (h("div", { class: "mrd-image-field__preview-container" }, this.renderThumb(entry), h("div", { class: "mrd-image-field__preview-info" }, h("span", { class: "mrd-image-field__preview-name" }, entryLabel(entry)), uploading && h("span", { class: "mrd-image-field__upload-status" }, t('loading', this.locale))), !uploading && (h("button", { class: "mrd-image-field__clear", type: "button", onClick: this.handleRemove(0), "aria-label": t('remove', this.locale) }, t('remove', this.locale)))));
4891
+ }
4892
+ renderGridItem(entry, index) {
4893
+ const uploading = isPending(entry);
4894
+ return (h("li", { class: "mrd-image-field__grid-item", key: `${index}-${entryLabel(entry)}` }, this.renderThumb(entry), h("span", { class: "mrd-image-field__grid-name" }, entryLabel(entry)), !uploading && (h("button", { class: "mrd-image-field__grid-remove", type: "button", onClick: this.handleRemove(index), "aria-label": t('remove', this.locale) }, "\u2715"))));
2870
4895
  }
2871
4896
  render() {
2872
4897
  const hasError = !!this.error;
4898
+ const hasEntries = this.entries.length > 0;
2873
4899
  const zoneClass = uploadZoneClass('mrd-image-field', {
2874
4900
  dragging: this.isDragging,
2875
4901
  error: hasError,
2876
- disabled: this.disabled || this.uploading,
4902
+ disabled: this.disabled || this.zoneBusy,
2877
4903
  });
2878
- return (h(Host, { key: '700310af716dcc167f98bc7ae7024bb44e1285b6' }, h("div", { key: '95d29a82751249e560404488fb279138eee0c1be', class: "mrd-image-field" }, h(FieldLabel, { key: 'f53f040257a4b65d8435c836846adab137b91a5e', base: "mrd-image-field", label: this.label, required: this.required }), h("div", { key: 'a9cc7a0861b1457d8e4abb11b380b6eeb519a863', class: zoneClass, onClick: this.handleZoneClick, onDragOver: this.drag.onDragOver, onDragLeave: this.drag.onDragLeave, onDrop: this.drag.onDrop }, h("input", { key: '7112030bc2b80b4c3b31a4421656da4c926a2fe1', ref: el => (this.fileInputRef = el), class: "mrd-image-field__input", type: "file", name: this.name, accept: this.accept, disabled: this.disabled || this.uploading, required: this.required && !this.previewUrl, onChange: this.handleInputChange }), this.previewUrl ? (h("div", { class: "mrd-image-field__preview-container" }, h("div", { class: "mrd-image-field__preview-thumb" }, h("img", { class: "mrd-image-field__preview", src: this.previewUrl, alt: this.fileName }), this.uploading && h("div", { class: "mrd-image-field__preview-overlay" }, h("span", { class: "mrd-image-field__spinner" }))), h("div", { class: "mrd-image-field__preview-info" }, h("span", { class: "mrd-image-field__preview-name" }, this.fileName), this.uploading && (h("span", { class: "mrd-image-field__upload-status" }, t('loading', this.locale)))), !this.uploading && (h("button", { class: "mrd-image-field__clear", type: "button", onClick: this.handleClear, "aria-label": t('clear', this.locale) }, t('remove', this.locale))))) : (h("div", { class: "mrd-image-field__prompt" }, h("svg", { class: "mrd-image-field__upload-icon", viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", "stroke-width": "2" }, h("rect", { x: "3", y: "3", width: "18", height: "18", rx: "2", ry: "2" }), h("circle", { cx: "8.5", cy: "8.5", r: "1.5" }), h("polyline", { points: "21 15 16 10 5 21" })), h("span", null, t('drop_file_here', this.locale), ' ', h("span", { class: "mrd-image-field__browse" }, t('browse', this.locale)))))), h(FieldError, { key: '0cf5346ecb1a5d110822b087081b4b5f05255381', base: "mrd-image-field", error: this.error }))));
4904
+ return (h(Host, { key: '51d39ea80195565a5dc780ff6a7923a976cfb0a7' }, h("div", { key: 'd76edb7ac9f1efea8c7c3d5b04e906ad4ab4c761', class: "mrd-image-field" }, h(FieldLabel, { key: 'b46a67a76188047677c40ce3f406daed7d8de141', base: "mrd-image-field", label: this.label, required: this.required }), h("div", { key: '0156a9722ea48d84e3ea1a829e4266425a594a6a', class: zoneClass, onClick: this.handleZoneClick, onDragOver: this.drag.onDragOver, onDragLeave: this.drag.onDragLeave, onDrop: this.drag.onDrop }, h("input", { key: '1b8e41da71bb57254bfd2e5527b05e1aeb32eb2f', ref: el => (this.fileInputRef = el), class: "mrd-image-field__input", type: "file", name: this.name, accept: this.accept, multiple: this.multiple, disabled: this.disabled || this.zoneBusy, required: this.required && !hasEntries, onChange: this.handleInputChange }), hasEntries && !this.multiple ? (this.renderSingle(this.entries[0])) : (h("div", { class: "mrd-image-field__prompt" }, h("svg", { class: "mrd-image-field__upload-icon", viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", "stroke-width": "2" }, h("rect", { x: "3", y: "3", width: "18", height: "18", rx: "2", ry: "2" }), h("circle", { cx: "8.5", cy: "8.5", r: "1.5" }), h("polyline", { points: "21 15 16 10 5 21" })), h("span", null, t('drop_file_here', this.locale), ' ', h("span", { class: "mrd-image-field__browse" }, t('browse', this.locale)))))), this.multiple && hasEntries && (h("ul", { key: '9211b5212eae0629f7c9b2b49d80e2b658a9ddd3', class: "mrd-image-field__grid" }, this.entries.map((entry, index) => this.renderGridItem(entry, index)))), h(FieldError, { key: '5f49c03156ed18e7c8307adff679b149658ca4a6', base: "mrd-image-field", error: this.error }))));
2879
4905
  }
2880
4906
  static get watchers() { return {
2881
4907
  "value": [{
@@ -2885,6 +4911,111 @@ const MrdImageField = class {
2885
4911
  };
2886
4912
  MrdImageField.style = mrdImageFieldCss();
2887
4913
 
4914
+ const mrdInvoiceViewCss = () => `.sc-mrd-invoice-view-h{display:block}.mrd-invoice-view.sc-mrd-invoice-view{max-width:720px;display:flex;flex-direction:column;gap:var(--mrd-space-6)}.mrd-invoice-view__title-row.sc-mrd-invoice-view{display:flex;align-items:center;gap:var(--mrd-space-3);flex-wrap:wrap}.mrd-invoice-view__title.sc-mrd-invoice-view{font-size:var(--mrd-font-size-2xl);font-weight:var(--mrd-font-weight-bold);color:var(--mrd-color-neutral-900);letter-spacing:-0.02em;margin:0}.mrd-invoice-view__badge.sc-mrd-invoice-view{display:inline-block;font-size:var(--mrd-font-size-xs);font-weight:var(--mrd-font-weight-medium);padding:2px var(--mrd-space-3);border-radius:var(--mrd-border-radius-full)}.mrd-invoice-view__badge--plain.sc-mrd-invoice-view{color:var(--mrd-color-neutral-600);background:var(--mrd-color-neutral-100)}.mrd-invoice-view__dates.sc-mrd-invoice-view{display:flex;gap:var(--mrd-space-4);font-size:var(--mrd-font-size-sm);color:var(--mrd-color-neutral-400);font-variant-numeric:tabular-nums;margin-top:var(--mrd-space-1)}.mrd-invoice-view__container-link.sc-mrd-invoice-view{display:inline-block;margin-top:var(--mrd-space-3);background:none;border:none;padding:0;font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-sm);font-weight:var(--mrd-font-weight-semibold);color:var(--mrd-color-primary);cursor:pointer;text-align:left}.mrd-invoice-view__container-link.sc-mrd-invoice-view:hover{text-decoration:underline}.mrd-invoice-view__parties.sc-mrd-invoice-view{display:flex;gap:var(--mrd-space-8);flex-wrap:wrap}.mrd-invoice-view__party.sc-mrd-invoice-view{display:flex;flex-direction:column;gap:var(--mrd-space-1)}.mrd-invoice-view__party-label.sc-mrd-invoice-view{font-size:var(--mrd-font-size-xs);font-weight:var(--mrd-font-weight-medium);color:var(--mrd-color-neutral-400);text-transform:uppercase;letter-spacing:0.04em}.mrd-invoice-view__link.sc-mrd-invoice-view{background:none;border:none;padding:0;font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-sm);font-weight:var(--mrd-font-weight-semibold);color:var(--mrd-color-primary);cursor:pointer;text-align:left}.mrd-invoice-view__link.sc-mrd-invoice-view:hover{text-decoration:underline}.mrd-invoice-view__lines.sc-mrd-invoice-view{border-top:var(--mrd-border-width) solid var(--mrd-color-neutral-200);border-bottom:var(--mrd-border-width) solid var(--mrd-color-neutral-200);padding:var(--mrd-space-4) 0}.mrd-invoice-view__amounts.sc-mrd-invoice-view{align-self:flex-end;display:flex;flex-direction:column;gap:var(--mrd-space-2);min-width:16rem}.mrd-invoice-view__amount-row.sc-mrd-invoice-view{display:flex;justify-content:space-between;gap:var(--mrd-space-6);font-size:var(--mrd-font-size-sm);color:var(--mrd-color-neutral-700)}.mrd-invoice-view__amount-row--total.sc-mrd-invoice-view{padding-top:var(--mrd-space-2);border-top:var(--mrd-border-width) solid var(--mrd-color-neutral-200);font-size:var(--mrd-font-size-base);font-weight:var(--mrd-font-weight-bold);color:var(--mrd-color-neutral-900)}.mrd-invoice-view__attachments.sc-mrd-invoice-view{display:flex;flex-direction:column;gap:var(--mrd-space-2)}.mrd-invoice-view__attachment.sc-mrd-invoice-view{display:inline-flex;align-items:center;gap:var(--mrd-space-2);align-self:flex-start;height:2rem;padding:0 var(--mrd-space-3);background:var(--mrd-color-white);border:1px solid var(--mrd-color-neutral-300);border-radius:var(--mrd-border-radius);font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-sm);font-weight:var(--mrd-font-weight-medium);color:var(--mrd-color-neutral-700);cursor:pointer}.mrd-invoice-view__attachment.sc-mrd-invoice-view:hover{background:var(--mrd-color-neutral-100);color:var(--mrd-color-neutral-900)}.mrd-invoice-view__attachment-icon.sc-mrd-invoice-view{width:0.9375rem;height:0.9375rem;flex-shrink:0}`;
4915
+
4916
+ const MrdInvoiceView = class {
4917
+ constructor(hostRef) {
4918
+ registerInstance(this, hostRef);
4919
+ this.mrdNavigate = createEvent(this, "mrdNavigate");
4920
+ this.mrdDownload = createEvent(this, "mrdDownload");
4921
+ this.mrdAttachments = createEvent(this, "mrdAttachments");
4922
+ /** The data record from the /data endpoint. Fields keyed by name; relations under `_links`. */
4923
+ this.data = {};
4924
+ this.locale = navigator.language;
4925
+ /** listItems of the FIELD bound to the `status` slot, resolved by mrd-layout-section
4926
+ * from its own items array (archetype metadata does not publish listItems), so the
4927
+ * status badge can get a real label/color instead of the raw stored key. */
4928
+ this.statusListItems = null;
4929
+ /** Tracks the key attachments were last emitted for, so componentDidLoad and the
4930
+ * data watcher don't emit duplicate events for the same set of files. */
4931
+ this.lastAttachmentKey = null;
4932
+ }
4933
+ componentDidLoad() {
4934
+ this.emitAttachmentsIfNeeded();
4935
+ }
4936
+ dataChanged() {
4937
+ this.emitAttachmentsIfNeeded();
4938
+ }
4939
+ emitAttachmentsIfNeeded() {
4940
+ const attachments = attachmentsFromRecord(this.archetype, this.data, 'attachments');
4941
+ const key = attachmentsKey(attachments);
4942
+ if (key === this.lastAttachmentKey)
4943
+ return;
4944
+ this.lastAttachmentKey = key;
4945
+ this.mrdAttachments.emit({ attachments });
4946
+ }
4947
+ /** Value of a value-slot: reads data[field] via the slot→field map. */
4948
+ slotValue(slot) {
4949
+ var _a, _b;
4950
+ const field = (_b = (_a = this.archetype) === null || _a === void 0 ? void 0 : _a.slots) === null || _b === void 0 ? void 0 : _b[slot];
4951
+ if (!field)
4952
+ return undefined;
4953
+ return this.data[field];
4954
+ }
4955
+ /** Relation link for a relation-slot: reads data._links[field]. */
4956
+ slotLink(slot) {
4957
+ var _a, _b, _c, _d;
4958
+ const field = (_b = (_a = this.archetype) === null || _a === void 0 ? void 0 : _a.slots) === null || _b === void 0 ? void 0 : _b[slot];
4959
+ if (!field)
4960
+ return undefined;
4961
+ const links = ((_d = (_c = this.data) === null || _c === void 0 ? void 0 : _c._links) !== null && _d !== void 0 ? _d : {});
4962
+ return links[field];
4963
+ }
4964
+ renderPartyLink(slot, label) {
4965
+ const link = this.slotLink(slot);
4966
+ if (!(link === null || link === void 0 ? void 0 : link.href) || !link.name)
4967
+ return null;
4968
+ return (h("div", { class: "mrd-invoice-view__party" }, h("span", { class: "mrd-invoice-view__party-label" }, label), h("button", { type: "button", class: "mrd-invoice-view__link", onClick: () => this.mrdNavigate.emit({ href: link.href, label: link.name }) }, link.name)));
4969
+ }
4970
+ renderContainer() {
4971
+ const link = this.slotLink('container');
4972
+ if (!(link === null || link === void 0 ? void 0 : link.href) || !link.name)
4973
+ return null;
4974
+ return (h("button", { type: "button", class: "mrd-invoice-view__container-link", onClick: () => this.mrdNavigate.emit({ href: link.href, label: link.name }) }, link.name));
4975
+ }
4976
+ renderStatus() {
4977
+ var _a, _b;
4978
+ const statusRaw = this.slotValue('status');
4979
+ if (statusRaw == null || statusRaw === '')
4980
+ return null;
4981
+ const listItem = ((_a = this.statusListItems) !== null && _a !== void 0 ? _a : []).find(li => li.key === String(statusRaw));
4982
+ const label = (_b = listItem === null || listItem === void 0 ? void 0 : listItem.label) !== null && _b !== void 0 ? _b : String(statusRaw);
4983
+ if ((listItem === null || listItem === void 0 ? void 0 : listItem.color) && (listItem === null || listItem === void 0 ? void 0 : listItem.backgroundColor)) {
4984
+ return (h("span", { class: "mrd-invoice-view__badge", style: { color: listItem.color, backgroundColor: listItem.backgroundColor } }, label));
4985
+ }
4986
+ return h("span", { class: "mrd-invoice-view__badge mrd-invoice-view__badge--plain" }, label);
4987
+ }
4988
+ renderAmounts() {
4989
+ const net = this.slotValue('netAmount');
4990
+ const tax = this.slotValue('taxAmount');
4991
+ const total = this.slotValue('amount');
4992
+ if ((net === null || net === void 0 ? void 0 : net.amount) == null && (tax === null || tax === void 0 ? void 0 : tax.amount) == null && (total === null || total === void 0 ? void 0 : total.amount) == null)
4993
+ return null;
4994
+ return (h("div", { class: "mrd-invoice-view__amounts" }, (net === null || net === void 0 ? void 0 : net.amount) != null && (h("div", { class: "mrd-invoice-view__amount-row" }, h("span", null, t('invoice_subtotal', this.locale)), h("span", null, formatCurrency(net.amount, net.currency, this.locale)))), (tax === null || tax === void 0 ? void 0 : tax.amount) != null && (h("div", { class: "mrd-invoice-view__amount-row" }, h("span", null, t('invoice_tax', this.locale)), h("span", null, formatCurrency(tax.amount, tax.currency, this.locale)))), (total === null || total === void 0 ? void 0 : total.amount) != null && (h("div", { class: "mrd-invoice-view__amount-row mrd-invoice-view__amount-row--total" }, h("span", null, t('invoice_total', this.locale)), h("span", null, formatCurrency(total.amount, total.currency, this.locale))))));
4995
+ }
4996
+ renderAttachments() {
4997
+ const attachments = attachmentsFromRecord(this.archetype, this.data, 'attachments');
4998
+ if (!attachments.length)
4999
+ return null;
5000
+ return (h("div", { class: "mrd-invoice-view__attachments" }, attachments.map(a => (h("button", { type: "button", key: a.href, class: "mrd-invoice-view__attachment", onClick: () => this.mrdDownload.emit({ href: a.href, fileName: a.fileName }) }, h("svg", { class: "mrd-invoice-view__attachment-icon", viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", "stroke-width": "2", "stroke-linecap": "round", "stroke-linejoin": "round", "aria-hidden": "true" }, h("path", { d: "M21.44 11.05l-9.19 9.19a5 5 0 01-7.07-7.07l9.19-9.19a3 3 0 014.24 4.24l-9.2 9.19a1 1 0 01-1.41-1.41l8.49-8.48" })), a.fileName)))));
5001
+ }
5002
+ render() {
5003
+ var _a, _b;
5004
+ const invoiceNumberRaw = this.slotValue('invoiceNumber');
5005
+ const invoiceNumber = invoiceNumberRaw != null && invoiceNumberRaw !== '' ? String(invoiceNumberRaw) : null;
5006
+ const invoiceDateRaw = this.slotValue('invoiceDate');
5007
+ const dueDateRaw = this.slotValue('dueDate');
5008
+ const hasLines = !!((_b = (_a = this.archetype) === null || _a === void 0 ? void 0 : _a.slots) === null || _b === void 0 ? void 0 : _b['lines']);
5009
+ return (h(Host, { key: 'a97c51e53e39ace913c902ad2ba6813eb85e4561' }, h("div", { key: '6938267848bceed5b28b56c3cdd6d6693e57cdbf', class: "mrd-invoice-view" }, h("div", { key: '7a0b3346232abfc1e35805e4e92c19d35698f881', class: "mrd-invoice-view__header" }, h("div", { key: '5c0471dd8ebd94dd9b374897268c7c03bec66ec7', class: "mrd-invoice-view__title-row" }, invoiceNumber && h("h1", { key: '86b4c0ebd0a5b83ae03b731b7e41394645aae954', class: "mrd-invoice-view__title" }, t('invoice_title', this.locale), " ", invoiceNumber), this.renderStatus()), h("div", { key: 'd209bc34d989146b5f510f2bcdc4c484d723378c', class: "mrd-invoice-view__dates" }, invoiceDateRaw != null && invoiceDateRaw !== '' && (h("span", { key: '8fffcd1ab10e511c9d939c351ea93e4d8a902688' }, t('invoice_date', this.locale), ": ", formatDate(invoiceDateRaw, this.locale))), dueDateRaw != null && dueDateRaw !== '' && (h("span", { key: '8d13c6660798108cc2f54137c8415173326d5bf2' }, t('invoice_due_date', this.locale), ": ", formatDate(dueDateRaw, this.locale)))), this.renderContainer()), h("div", { key: 'cb08c6fd7e6b46a46a69f11aafa960ab5cb35544', class: "mrd-invoice-view__parties" }, this.renderPartyLink('customer', t('invoice_customer', this.locale)), this.renderPartyLink('supplier', t('invoice_supplier', this.locale))), hasLines && (h("div", { key: '8321e74171fe933a4e10fc202b66cd3720ba959e', class: "mrd-invoice-view__lines" }, h("slot", { key: 'eb31d97080173413e74e5b0024984a4b06aa5bdd', name: "lines" }))), this.renderAmounts(), this.renderAttachments())));
5010
+ }
5011
+ static get watchers() { return {
5012
+ "data": [{
5013
+ "dataChanged": 0
5014
+ }]
5015
+ }; }
5016
+ };
5017
+ MrdInvoiceView.style = mrdInvoiceViewCss();
5018
+
2888
5019
  /** Key an embedded view is addressed by (setViewPage etc.). */
2889
5020
  function viewKeyFor(item) {
2890
5021
  var _a, _b, _c, _d;
@@ -2914,110 +5045,6 @@ function buildContainerHref(item, selfHref, parentId) {
2914
5045
  return `/${base}/${tenant}/${item.fromClass}/${parentId}`;
2915
5046
  }
2916
5047
 
2917
- class CellRenderer {
2918
- static render(column, row, locale) {
2919
- var _a, _b, _c, _d;
2920
- if (column.type === ClientLayoutItemType.RELATION) {
2921
- const name = (_a = column.name) !== null && _a !== void 0 ? _a : '';
2922
- const link = (_b = row === null || row === void 0 ? void 0 : row._links) === null || _b === void 0 ? void 0 : _b[name];
2923
- if (!link)
2924
- return '';
2925
- if (Array.isArray(link))
2926
- return link.map((l) => { var _a; return (_a = l.name) !== null && _a !== void 0 ? _a : ''; }).filter(Boolean).join(', ');
2927
- return (_c = link.name) !== null && _c !== void 0 ? _c : '';
2928
- }
2929
- if (column.type !== ClientLayoutItemType.FIELD)
2930
- return '';
2931
- const name = (_d = column.name) !== null && _d !== void 0 ? _d : '';
2932
- const dataType = column.dataType;
2933
- const listItems = column.listItems;
2934
- const raw = row === null || row === void 0 ? void 0 : row[name];
2935
- if (raw == null || raw === '')
2936
- return '';
2937
- const values = Array.isArray(raw) ? raw : [raw];
2938
- return values
2939
- .map(v => CellRenderer.renderValue(dataType !== null && dataType !== void 0 ? dataType : 'TEXT', v, listItems !== null && listItems !== void 0 ? listItems : [], locale))
2940
- .filter(s => s !== '')
2941
- .join(', ');
2942
- }
2943
- static renderValue(dataType, value, listItems, locale) {
2944
- var _a, _b;
2945
- switch (dataType) {
2946
- case 'INTEGER':
2947
- return formatNumber(Number(value), locale, { maximumFractionDigits: 0 });
2948
- case 'DECIMAL':
2949
- return formatNumber(Number(value), locale);
2950
- case 'PERCENTAGE':
2951
- return formatPercentage(Number(value), locale);
2952
- case 'CURRENCY': {
2953
- const { amount, currency } = typeof value === 'object' && value !== null
2954
- ? value
2955
- : { amount: value, currency: '' };
2956
- return currency
2957
- ? formatCurrency(Number(amount), currency, locale)
2958
- : formatNumber(Number(amount), locale);
2959
- }
2960
- case 'DATE':
2961
- return formatDate(value, locale);
2962
- case 'DATETIME':
2963
- return formatDateTime(value, locale);
2964
- case 'TIME':
2965
- return formatTime(value, locale);
2966
- case 'BOOLEAN':
2967
- return value ? '✓' : '';
2968
- case 'FILE':
2969
- case 'IMAGE':
2970
- return typeof value === 'object' && value !== null ? ((_a = value.fileName) !== null && _a !== void 0 ? _a : '') : '';
2971
- case 'LIST': {
2972
- const item = listItems.find(li => li.key === String(value));
2973
- return (_b = item === null || item === void 0 ? void 0 : item.label) !== null && _b !== void 0 ? _b : String(value);
2974
- }
2975
- case 'TEXTBLOCK': {
2976
- const stripped = String(value).replace(/<[^>]*>/g, '');
2977
- const txt = document.createElement('textarea');
2978
- txt.innerHTML = stripped;
2979
- return txt.value.trim();
2980
- }
2981
- case 'LONGTEXT':
2982
- return String(value).replace(/[\r\n]+/g, ' ').trim();
2983
- case 'JSON': {
2984
- const str = typeof value === 'object' ? JSON.stringify(value) : String(value);
2985
- return str.replace(/[\r\n]+/g, ' ').trim();
2986
- }
2987
- case 'SECRET':
2988
- return value ? '••••••••' : '';
2989
- default:
2990
- return String(value);
2991
- }
2992
- }
2993
- /**
2994
- * Returns syntax-highlighted JSON as an HTML string with inline styles.
2995
- * compact=true → single line (no indentation); compact=false → pretty-printed.
2996
- */
2997
- static formatJson(value, compact = false) {
2998
- try {
2999
- const parsed = typeof value === 'string' ? JSON.parse(value) : value;
3000
- const json = compact ? JSON.stringify(parsed) : JSON.stringify(parsed, null, 2);
3001
- return json.replace(/("(\\u[a-zA-Z0-9]{4}|\\[^u]|[^\\"])*"(\s*:)?|\b(true|false|null)\b|-?\d+(?:\.\d*)?(?:[eE][+\-]?\d+)?)/g, match => {
3002
- let style = 'color:#2aa198';
3003
- if (/^"/.test(match)) {
3004
- style = /:$/.test(match) ? 'color:#881391' : 'color:#268bd2';
3005
- }
3006
- else if (/true|false/.test(match)) {
3007
- style = 'color:#b58900';
3008
- }
3009
- else if (/null/.test(match)) {
3010
- style = 'color:#dc322f';
3011
- }
3012
- return `<span style="${style}">${match}</span>`;
3013
- });
3014
- }
3015
- catch (_a) {
3016
- return String(value);
3017
- }
3018
- }
3019
- }
3020
-
3021
5048
  /** FILE and IMAGE cells share the same download button. */
3022
5049
  function downloadLink(ctx, href, fileName, label) {
3023
5050
  return (h("button", { class: "mrd-layout-section__download-link", onClick: () => href && ctx.on.download({ href, fileName }) }, h("svg", { class: "mrd-layout-section__file-icon", viewBox: "0 0 24 24", "aria-hidden": "true" }, h("path", { fill: "currentColor", d: "M14 2H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h12c1.1 0 2-.9 2-2V8l-6-6zm-1 7V3.5L18.5 9H13zm-3 8l-3-3 1.41-1.41L10 14.17l4.59-4.58L16 11l-6 6z" })), label));
@@ -3042,7 +5069,7 @@ function renderSingleFieldValue(ctx, item, value) {
3042
5069
  const v = value;
3043
5070
  const fileName = (_e = v === null || v === void 0 ? void 0 : v.fileName) !== null && _e !== void 0 ? _e : String(value);
3044
5071
  const href = (_f = v === null || v === void 0 ? void 0 : v.href) !== null && _f !== void 0 ? _f : '';
3045
- return downloadLink(ctx, href, fileName, t('download', ctx.locale));
5072
+ return downloadLink(ctx, href, fileName, fileName || t('download', ctx.locale));
3046
5073
  }
3047
5074
  case ClientLayoutItemFieldDataType.IMAGE: {
3048
5075
  const v = value;
@@ -3081,6 +5108,10 @@ function renderFieldValue(ctx, item, rawValue) {
3081
5108
  if (rawValue == null || rawValue === '')
3082
5109
  return null;
3083
5110
  if (item.multiple && Array.isArray(rawValue)) {
5111
+ const isFileType = item.dataType === ClientLayoutItemFieldDataType.FILE || item.dataType === ClientLayoutItemFieldDataType.IMAGE;
5112
+ if (isFileType) {
5113
+ return (h("div", { class: "mrd-layout-section__file-list" }, rawValue.map((v, i) => (h("div", { class: "mrd-layout-section__file-list-item", key: String(i) }, renderSingleFieldValue(ctx, item, v))))));
5114
+ }
3084
5115
  const rendered = rawValue.map(v => renderSingleFieldValue(ctx, item, v));
3085
5116
  if (rendered.every(r => typeof r === 'string' || r == null)) {
3086
5117
  return rendered.filter(Boolean).join(', ') || null;
@@ -3125,7 +5156,7 @@ function renderField(ctx, item) {
3125
5156
  return (h("div", { class: `mrd-layout-section__field${isBlock ? ' mrd-layout-section__field--block' : ''}`, key: item.name }, h("span", { class: "mrd-layout-section__field-label" }, item.label), h("span", { class: "mrd-layout-section__field-value" }, renderedValue, renderHistoryBadge(ctx, item, raw))));
3126
5157
  }
3127
5158
 
3128
- const mrdLayoutSectionCss = () => `.sc-mrd-layout-section-h{display:block;width:100%}.mrd-layout-section.sc-mrd-layout-section{font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-base);color:var(--mrd-color-neutral-800)}.mrd-layout-section__field.sc-mrd-layout-section{display:grid;grid-template-columns:200px 1fr;align-items:baseline;gap:0 var(--mrd-space-2);padding:var(--mrd-space-1) 0}.mrd-layout-section__field--block.sc-mrd-layout-section{grid-template-columns:1fr}.mrd-layout-section__field-label.sc-mrd-layout-section{font-size:var(--mrd-font-size-xs);font-weight:var(--mrd-font-weight-normal);color:var(--mrd-color-neutral-500);padding-top:1px}.mrd-layout-section__field-value.sc-mrd-layout-section{font-size:var(--mrd-font-size-sm);font-weight:var(--mrd-font-weight-medium);color:var(--mrd-color-neutral-800);word-break:break-word;display:inline-flex;align-items:center;gap:var(--mrd-space-1)}.mrd-layout-section__history-wrap.sc-mrd-layout-section{position:relative;display:inline-flex;align-items:center}.mrd-layout-section__history-btn.sc-mrd-layout-section{display:inline-flex;align-items:center;justify-content:center;width:1.25rem;height:1.25rem;padding:0;background:transparent;border:none;border-radius:var(--mrd-border-radius-sm);color:var(--mrd-color-neutral-400);cursor:pointer;flex-shrink:0;transition:color var(--mrd-transition-fast), background-color var(--mrd-transition-fast)}.mrd-layout-section__history-btn.sc-mrd-layout-section:hover{color:var(--mrd-color-neutral-700);background-color:var(--mrd-color-neutral-100)}.mrd-layout-section__history-btn.sc-mrd-layout-section:focus{outline:none;box-shadow:var(--mrd-shadow-focus)}.mrd-layout-section__history-icon.sc-mrd-layout-section{width:0.875rem;height:0.875rem}.mrd-layout-section__history-popover.sc-mrd-layout-section{position:absolute;top:calc(100% + 0.25rem);left:0;min-width:24rem;max-width:24rem;background-color:var(--mrd-color-white);border:var(--mrd-border-width) solid var(--mrd-border-color);border-radius:var(--mrd-border-radius-md);box-shadow:var(--mrd-shadow-md);padding:var(--mrd-space-1) 0;z-index:var(--mrd-z-dropdown)}.mrd-layout-section__history-entry.sc-mrd-layout-section{font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-sm);font-weight:var(--mrd-font-weight-normal);color:var(--mrd-color-neutral-700);padding:var(--mrd-space-2) var(--mrd-space-3);line-height:var(--mrd-line-height-normal)}.mrd-layout-section__history-entry.sc-mrd-layout-section:not(:last-child){border-bottom:var(--mrd-border-width) solid var(--mrd-color-neutral-100)}.mrd-layout-section__field-header.sc-mrd-layout-section{font-size:var(--mrd-font-size-2xl);font-weight:var(--mrd-font-weight-bold);color:var(--mrd-color-neutral-900);margin:0 0 var(--mrd-space-4) 0;padding:0}.mrd-layout-section__header.sc-mrd-layout-section{font-size:var(--mrd-font-size-xl);font-weight:var(--mrd-font-weight-semibold);color:var(--mrd-color-neutral-800);margin:var(--mrd-space-4) 0 var(--mrd-space-2) 0;padding:0}.mrd-layout-section__text.sc-mrd-layout-section{font-size:var(--mrd-font-size-base);color:var(--mrd-color-neutral-700);line-height:var(--mrd-line-height-relaxed);margin:var(--mrd-space-2) 0}.mrd-layout-section__navigate.sc-mrd-layout-section{display:inline-flex;align-items:center;gap:var(--mrd-space-2);padding:var(--mrd-space-2) var(--mrd-space-3);background:none;border:1px solid var(--mrd-color-neutral-300);border-radius:var(--mrd-border-radius);font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-sm);color:var(--mrd-color-primary);cursor:pointer;margin:var(--mrd-space-2) 0}.mrd-layout-section__navigate.sc-mrd-layout-section:hover{background-color:var(--mrd-color-primary-light);border-color:var(--mrd-color-primary)}.mrd-layout-section__link.sc-mrd-layout-section{color:var(--mrd-color-primary);text-decoration:none}.mrd-layout-section__link.sc-mrd-layout-section:hover{text-decoration:underline}.mrd-layout-section__relation-link.sc-mrd-layout-section{background:none;border:none;padding:0;font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-sm);font-weight:var(--mrd-font-weight-semibold);color:var(--mrd-color-primary);cursor:pointer;text-align:left}.mrd-layout-section__relation-link.sc-mrd-layout-section:hover{text-decoration:underline}.mrd-layout-section__download-link.sc-mrd-layout-section{display:inline-flex;align-items:center;gap:var(--mrd-space-1);background:none;border:none;padding:0;font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-sm);color:var(--mrd-color-primary);cursor:pointer;text-align:left}.mrd-layout-section__download-link.sc-mrd-layout-section:hover{text-decoration:underline;color:var(--mrd-color-primary-dark)}.mrd-layout-section__file-icon.sc-mrd-layout-section{flex-shrink:0;width:1rem;height:1rem}.mrd-layout-section__boolean--true.sc-mrd-layout-section{color:var(--mrd-color-success);font-weight:var(--mrd-font-weight-semibold)}.mrd-layout-section__boolean--false.sc-mrd-layout-section{color:var(--mrd-color-neutral-400)}.mrd-layout-section__badge.sc-mrd-layout-section{display:inline-block;font-size:var(--mrd-font-size-xs);font-weight:var(--mrd-font-weight-medium);padding:2px var(--mrd-space-3);border-radius:10px}.mrd-layout-section__badge-dot-row.sc-mrd-layout-section{display:inline-flex;align-items:center;gap:var(--mrd-space-2)}.mrd-layout-section__badge-dot.sc-mrd-layout-section{display:inline-block;width:10px;height:10px;border-radius:50%;flex-shrink:0}.mrd-layout-section__secret-masked.sc-mrd-layout-section{font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-base);color:var(--mrd-label-color);letter-spacing:0.15em;user-select:none;pointer-events:none}.mrd-layout-section__pre.sc-mrd-layout-section{font-family:var(--mrd-font-family-mono);font-size:var(--mrd-font-size-xs);background-color:var(--mrd-color-neutral-50);border:1px solid var(--mrd-color-neutral-200);border-radius:var(--mrd-border-radius);padding:var(--mrd-space-3);margin:0;max-height:calc(15 * var(--mrd-font-size-xs));overflow-x:auto;overflow-y:auto;white-space:pre-wrap;word-break:break-word}.mrd-layout-section__group.sc-mrd-layout-section{margin:var(--mrd-space-4) 0}.mrd-layout-section__group-title.sc-mrd-layout-section{font-size:var(--mrd-font-size-xs);font-weight:var(--mrd-font-weight-semibold);color:var(--mrd-color-neutral-500);margin:0 0 var(--mrd-space-2) 0;padding-bottom:0;letter-spacing:0.01em}.mrd-layout-section__related-view.sc-mrd-layout-section{margin:var(--mrd-space-4) 0}.mrd-layout-section__related-view-title.sc-mrd-layout-section{font-size:var(--mrd-font-size-lg);font-weight:var(--mrd-font-weight-semibold);color:var(--mrd-color-neutral-800);margin:0 0 var(--mrd-space-3) 0}.mrd-layout-section__search.sc-mrd-layout-section{position:relative;margin:var(--mrd-space-2) 0}.mrd-layout-section__search-wrap.sc-mrd-layout-section{position:relative}.mrd-layout-section__search-icon.sc-mrd-layout-section{position:absolute;left:var(--mrd-input-padding-x);top:50%;transform:translateY(-50%);width:1rem;height:1rem;color:var(--mrd-color-neutral-400);pointer-events:none}.mrd-layout-section__search-input.sc-mrd-layout-section{display:block;width:100%;height:var(--mrd-input-height);padding:var(--mrd-input-padding-y) var(--mrd-input-padding-x) var(--mrd-input-padding-y) calc(var(--mrd-input-padding-x) + 1rem + var(--mrd-space-2));font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-base);color:var(--mrd-input-color);background-color:var(--mrd-input-bg);border:var(--mrd-border-width) solid var(--mrd-border-color);border-radius:var(--mrd-border-radius);outline:none;appearance:none;box-sizing:border-box}.mrd-layout-section__search-input.sc-mrd-layout-section:focus{border-color:var(--mrd-border-color-focus);box-shadow:var(--mrd-shadow-focus)}.mrd-layout-section__search-input.sc-mrd-layout-section::placeholder{color:var(--mrd-input-placeholder-color)}.mrd-layout-section__search-results.sc-mrd-layout-section{position:absolute;top:100%;left:0;right:0;background-color:var(--mrd-color-white);border:1px solid var(--mrd-color-neutral-300);border-top:none;border-radius:0 0 var(--mrd-border-radius) var(--mrd-border-radius);box-shadow:var(--mrd-shadow-sm);z-index:100;max-height:300px;overflow-y:auto;list-style:none;margin:0;padding:var(--mrd-space-1) 0}.mrd-layout-section__search-result.sc-mrd-layout-section{margin:0;padding:0}.mrd-layout-section__search-result-btn.sc-mrd-layout-section{display:flex;flex-direction:column;width:100%;padding:var(--mrd-space-2) var(--mrd-space-3);background:none;border:none;text-align:left;cursor:pointer;font-family:var(--mrd-font-family)}.mrd-layout-section__search-result-btn.sc-mrd-layout-section:hover{background-color:var(--mrd-color-primary-light)}.mrd-layout-section__search-result-label.sc-mrd-layout-section{font-size:var(--mrd-font-size-sm);font-weight:var(--mrd-font-weight-medium);color:var(--mrd-color-neutral-800)}.mrd-layout-section__search-result-desc.sc-mrd-layout-section{font-size:var(--mrd-font-size-xs);color:var(--mrd-color-neutral-500);margin-top:var(--mrd-space-1)}.mrd-layout-section__image-thumb-btn.sc-mrd-layout-section{background:none;border:none;padding:0;cursor:pointer;display:inline-block;border-radius:var(--mrd-border-radius);overflow:hidden;line-height:0}.mrd-layout-section__image-thumb-btn.sc-mrd-layout-section:hover .mrd-layout-section__image-thumb.sc-mrd-layout-section{opacity:0.85}.mrd-layout-section__image-thumb.sc-mrd-layout-section{display:block;max-width:160px;max-height:100px;border-radius:var(--mrd-border-radius);object-fit:cover;transition:opacity 0.15s}.mrd-layout-section__modal-backdrop.sc-mrd-layout-section{position:fixed;inset:0;background:rgba(0, 0, 0, 0.6);z-index:300;display:flex;align-items:center;justify-content:center}.mrd-layout-section__modal.sc-mrd-layout-section{position:relative;background:var(--mrd-color-white);border-radius:var(--mrd-border-radius);padding:var(--mrd-space-3);max-width:min(90vw, 900px);max-height:90vh;display:flex;align-items:center;justify-content:center;box-shadow:var(--mrd-shadow-lg)}.mrd-layout-section__modal-close.sc-mrd-layout-section{position:absolute;top:var(--mrd-space-2);right:var(--mrd-space-2);background:rgba(0, 0, 0, 0.5);border:none;border-radius:50%;width:28px;height:28px;display:flex;align-items:center;justify-content:center;color:var(--mrd-color-white);cursor:pointer;font-size:var(--mrd-font-size-sm);line-height:1;z-index:1}.mrd-layout-section__modal-close.sc-mrd-layout-section:hover{background:rgba(0, 0, 0, 0.8)}.mrd-layout-section__modal-image.sc-mrd-layout-section{display:block;max-width:100%;max-height:calc(90vh - 2rem);border-radius:var(--mrd-border-radius);object-fit:contain}`;
5159
+ const mrdLayoutSectionCss = () => `.sc-mrd-layout-section-h{display:block;width:100%}.mrd-layout-section.sc-mrd-layout-section{font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-base);color:var(--mrd-color-neutral-800)}.mrd-layout-section__field.sc-mrd-layout-section{display:grid;grid-template-columns:200px 1fr;align-items:baseline;gap:0 var(--mrd-space-2);padding:var(--mrd-space-1) 0}.mrd-layout-section__field--block.sc-mrd-layout-section{grid-template-columns:1fr}.mrd-layout-section__field-label.sc-mrd-layout-section{font-size:var(--mrd-font-size-xs);font-weight:var(--mrd-font-weight-normal);color:var(--mrd-color-neutral-500);padding-top:1px}.mrd-layout-section__field-value.sc-mrd-layout-section{font-size:var(--mrd-font-size-sm);font-weight:var(--mrd-font-weight-medium);color:var(--mrd-color-neutral-800);word-break:break-word;display:inline-flex;align-items:center;gap:var(--mrd-space-1)}.mrd-layout-section__history-wrap.sc-mrd-layout-section{position:relative;display:inline-flex;align-items:center}.mrd-layout-section__history-btn.sc-mrd-layout-section{display:inline-flex;align-items:center;justify-content:center;width:1.25rem;height:1.25rem;padding:0;background:transparent;border:none;border-radius:var(--mrd-border-radius-sm);color:var(--mrd-color-neutral-400);cursor:pointer;flex-shrink:0;transition:color var(--mrd-transition-fast), background-color var(--mrd-transition-fast)}.mrd-layout-section__history-btn.sc-mrd-layout-section:hover{color:var(--mrd-color-neutral-700);background-color:var(--mrd-color-neutral-100)}.mrd-layout-section__history-btn.sc-mrd-layout-section:focus{outline:none;box-shadow:var(--mrd-shadow-focus)}.mrd-layout-section__history-icon.sc-mrd-layout-section{width:0.875rem;height:0.875rem}.mrd-layout-section__history-popover.sc-mrd-layout-section{position:absolute;top:calc(100% + 0.25rem);left:0;min-width:24rem;max-width:24rem;background-color:var(--mrd-color-white);border:var(--mrd-border-width) solid var(--mrd-border-color);border-radius:var(--mrd-border-radius-md);box-shadow:var(--mrd-shadow-md);padding:var(--mrd-space-1) 0;z-index:var(--mrd-z-dropdown)}.mrd-layout-section__history-entry.sc-mrd-layout-section{font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-sm);font-weight:var(--mrd-font-weight-normal);color:var(--mrd-color-neutral-700);padding:var(--mrd-space-2) var(--mrd-space-3);line-height:var(--mrd-line-height-normal)}.mrd-layout-section__history-entry.sc-mrd-layout-section:not(:last-child){border-bottom:var(--mrd-border-width) solid var(--mrd-color-neutral-100)}.mrd-layout-section__field-header.sc-mrd-layout-section{font-size:var(--mrd-font-size-2xl);font-weight:var(--mrd-font-weight-bold);color:var(--mrd-color-neutral-900);margin:0 0 var(--mrd-space-4) 0;padding:0}.mrd-layout-section__header.sc-mrd-layout-section{font-size:var(--mrd-font-size-xl);font-weight:var(--mrd-font-weight-semibold);color:var(--mrd-color-neutral-800);margin:var(--mrd-space-4) 0 var(--mrd-space-2) 0;padding:0}.mrd-layout-section__text.sc-mrd-layout-section{font-size:var(--mrd-font-size-base);color:var(--mrd-color-neutral-700);line-height:var(--mrd-line-height-relaxed);margin:var(--mrd-space-2) 0}.mrd-layout-section__navigate.sc-mrd-layout-section{display:inline-flex;align-items:center;gap:var(--mrd-space-2);padding:var(--mrd-space-2) var(--mrd-space-3);background:none;border:1px solid var(--mrd-color-neutral-300);border-radius:var(--mrd-border-radius);font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-sm);color:var(--mrd-color-primary);cursor:pointer;margin:var(--mrd-space-2) 0}.mrd-layout-section__navigate.sc-mrd-layout-section:hover{background-color:var(--mrd-color-primary-light);border-color:var(--mrd-color-primary)}.mrd-layout-section__link.sc-mrd-layout-section{color:var(--mrd-color-primary);text-decoration:none}.mrd-layout-section__link.sc-mrd-layout-section:hover{text-decoration:underline}.mrd-layout-section__relation-link.sc-mrd-layout-section{background:none;border:none;padding:0;font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-sm);font-weight:var(--mrd-font-weight-semibold);color:var(--mrd-color-primary);cursor:pointer;text-align:left}.mrd-layout-section__relation-link.sc-mrd-layout-section:hover{text-decoration:underline}.mrd-layout-section__download-link.sc-mrd-layout-section{display:inline-flex;align-items:center;gap:var(--mrd-space-1);background:none;border:none;padding:0;font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-sm);color:var(--mrd-color-primary);cursor:pointer;text-align:left}.mrd-layout-section__download-link.sc-mrd-layout-section:hover{text-decoration:underline;color:var(--mrd-color-primary-dark)}.mrd-layout-section__file-icon.sc-mrd-layout-section{flex-shrink:0;width:1rem;height:1rem}.mrd-layout-section__file-list.sc-mrd-layout-section{display:flex;flex-direction:column;align-items:flex-start;gap:var(--mrd-space-1)}.mrd-layout-section__file-list-item.sc-mrd-layout-section{min-width:0;max-width:100%}.mrd-layout-section__boolean--true.sc-mrd-layout-section{color:var(--mrd-color-success);font-weight:var(--mrd-font-weight-semibold)}.mrd-layout-section__boolean--false.sc-mrd-layout-section{color:var(--mrd-color-neutral-400)}.mrd-layout-section__badge.sc-mrd-layout-section{display:inline-block;font-size:var(--mrd-font-size-xs);font-weight:var(--mrd-font-weight-medium);padding:2px var(--mrd-space-3);border-radius:10px}.mrd-layout-section__badge-dot-row.sc-mrd-layout-section{display:inline-flex;align-items:center;gap:var(--mrd-space-2)}.mrd-layout-section__badge-dot.sc-mrd-layout-section{display:inline-block;width:10px;height:10px;border-radius:50%;flex-shrink:0}.mrd-layout-section__secret-masked.sc-mrd-layout-section{font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-base);color:var(--mrd-label-color);letter-spacing:0.15em;user-select:none;pointer-events:none}.mrd-layout-section__pre.sc-mrd-layout-section{font-family:var(--mrd-font-family-mono);font-size:var(--mrd-font-size-xs);background-color:var(--mrd-color-neutral-50);border:1px solid var(--mrd-color-neutral-200);border-radius:var(--mrd-border-radius);padding:var(--mrd-space-3);margin:0;max-height:calc(15 * var(--mrd-font-size-xs));overflow-x:auto;overflow-y:auto;white-space:pre-wrap;word-break:break-word}.mrd-layout-section__group.sc-mrd-layout-section{margin:var(--mrd-space-4) 0}.mrd-layout-section__group-title.sc-mrd-layout-section{font-size:var(--mrd-font-size-xs);font-weight:var(--mrd-font-weight-semibold);color:var(--mrd-color-neutral-500);margin:0 0 var(--mrd-space-2) 0;padding-bottom:0;letter-spacing:0.01em}.mrd-layout-section__related-view.sc-mrd-layout-section{margin:var(--mrd-space-4) 0}.mrd-layout-section__related-view-title.sc-mrd-layout-section{font-size:var(--mrd-font-size-lg);font-weight:var(--mrd-font-weight-semibold);color:var(--mrd-color-neutral-800);margin:0 0 var(--mrd-space-3) 0}.mrd-layout-section__search.sc-mrd-layout-section{position:relative;margin:var(--mrd-space-2) 0}.mrd-layout-section__search-wrap.sc-mrd-layout-section{position:relative}.mrd-layout-section__search-icon.sc-mrd-layout-section{position:absolute;left:var(--mrd-input-padding-x);top:50%;transform:translateY(-50%);width:1rem;height:1rem;color:var(--mrd-color-neutral-400);pointer-events:none}.mrd-layout-section__search-input.sc-mrd-layout-section{display:block;width:100%;height:var(--mrd-input-height);padding:var(--mrd-input-padding-y) var(--mrd-input-padding-x) var(--mrd-input-padding-y) calc(var(--mrd-input-padding-x) + 1rem + var(--mrd-space-2));font-family:var(--mrd-font-family);font-size:var(--mrd-font-size-base);color:var(--mrd-input-color);background-color:var(--mrd-input-bg);border:var(--mrd-border-width) solid var(--mrd-border-color);border-radius:var(--mrd-border-radius);outline:none;appearance:none;box-sizing:border-box}.mrd-layout-section__search-input.sc-mrd-layout-section:focus{border-color:var(--mrd-border-color-focus);box-shadow:var(--mrd-shadow-focus)}.mrd-layout-section__search-input.sc-mrd-layout-section::placeholder{color:var(--mrd-input-placeholder-color)}.mrd-layout-section__search-results.sc-mrd-layout-section{position:absolute;top:100%;left:0;right:0;background-color:var(--mrd-color-white);border:1px solid var(--mrd-color-neutral-300);border-top:none;border-radius:0 0 var(--mrd-border-radius) var(--mrd-border-radius);box-shadow:var(--mrd-shadow-sm);z-index:100;max-height:300px;overflow-y:auto;list-style:none;margin:0;padding:var(--mrd-space-1) 0}.mrd-layout-section__search-result.sc-mrd-layout-section{margin:0;padding:0}.mrd-layout-section__search-result-btn.sc-mrd-layout-section{display:flex;flex-direction:column;width:100%;padding:var(--mrd-space-2) var(--mrd-space-3);background:none;border:none;text-align:left;cursor:pointer;font-family:var(--mrd-font-family)}.mrd-layout-section__search-result-btn.sc-mrd-layout-section:hover{background-color:var(--mrd-color-primary-light)}.mrd-layout-section__search-result-label.sc-mrd-layout-section{font-size:var(--mrd-font-size-sm);font-weight:var(--mrd-font-weight-medium);color:var(--mrd-color-neutral-800)}.mrd-layout-section__search-result-desc.sc-mrd-layout-section{font-size:var(--mrd-font-size-xs);color:var(--mrd-color-neutral-500);margin-top:var(--mrd-space-1)}.mrd-layout-section__image-thumb-btn.sc-mrd-layout-section{background:none;border:none;padding:0;cursor:pointer;display:inline-block;border-radius:var(--mrd-border-radius);overflow:hidden;line-height:0}.mrd-layout-section__image-thumb-btn.sc-mrd-layout-section:hover .mrd-layout-section__image-thumb.sc-mrd-layout-section{opacity:0.85}.mrd-layout-section__image-thumb.sc-mrd-layout-section{display:block;max-width:160px;max-height:100px;border-radius:var(--mrd-border-radius);object-fit:cover;transition:opacity 0.15s}.mrd-layout-section__modal-backdrop.sc-mrd-layout-section{position:fixed;inset:0;background:rgba(0, 0, 0, 0.6);z-index:300;display:flex;align-items:center;justify-content:center}.mrd-layout-section__modal.sc-mrd-layout-section{position:relative;background:var(--mrd-color-white);border-radius:var(--mrd-border-radius);padding:var(--mrd-space-3);max-width:min(90vw, 900px);max-height:90vh;display:flex;align-items:center;justify-content:center;box-shadow:var(--mrd-shadow-lg)}.mrd-layout-section__modal-close.sc-mrd-layout-section{position:absolute;top:var(--mrd-space-2);right:var(--mrd-space-2);background:rgba(0, 0, 0, 0.5);border:none;border-radius:50%;width:28px;height:28px;display:flex;align-items:center;justify-content:center;color:var(--mrd-color-white);cursor:pointer;font-size:var(--mrd-font-size-sm);line-height:1;z-index:1}.mrd-layout-section__modal-close.sc-mrd-layout-section:hover{background:rgba(0, 0, 0, 0.8)}.mrd-layout-section__modal-image.sc-mrd-layout-section{display:block;max-width:100%;max-height:calc(90vh - 2rem);border-radius:var(--mrd-border-radius);object-fit:contain}`;
3129
5160
 
3130
5161
  const MrdLayoutSection = class {
3131
5162
  constructor(hostRef) {
@@ -3451,23 +5482,53 @@ const MrdLayoutSection = class {
3451
5482
  return null;
3452
5483
  return (h("div", { class: "mrd-layout-section__modal-backdrop", onClick: () => { this.imagePreviewUrl = null; } }, h("div", { class: "mrd-layout-section__modal", onClick: (e) => e.stopPropagation() }, h("button", { class: "mrd-layout-section__modal-close", onClick: () => { this.imagePreviewUrl = null; } }, "\u2715"), h("img", { class: "mrd-layout-section__modal-image", src: this.imagePreviewUrl, alt: "" }))));
3453
5484
  }
5485
+ /** Related VIEW/RELATED_VIEW/SEARCH items to keep rendering below an archetype's
5486
+ * single-object view, excluding any item already consumed by that view itself
5487
+ * (e.g. invoice's `lines`, see renderInvoiceObject). */
5488
+ relatedItems(exclude) {
5489
+ return this.items.filter(it => it !== exclude &&
5490
+ (it.type === ClientLayoutItemType.VIEW || it.type === ClientLayoutItemType.RELATED_VIEW || it.type === ClientLayoutItemType.SEARCH));
5491
+ }
3454
5492
  /** Single-document view: the record's own type carries commons.document. Renders
3455
5493
  * a recognisable document instead of generic fields, keeping any related views/
3456
5494
  * searches below it. */
3457
5495
  renderDocumentObject(archetype) {
3458
- const related = this.items.filter(it => it.type === ClientLayoutItemType.VIEW ||
3459
- it.type === ClientLayoutItemType.RELATED_VIEW ||
3460
- it.type === ClientLayoutItemType.SEARCH);
3461
5496
  return [
3462
5497
  h("mrd-document-view", { archetype: archetype, data: this.data, locale: this.locale, onMrdNavigate: (e) => { e.stopPropagation(); this.mrdNavigate.emit(e.detail); }, onMrdDownload: (e) => { e.stopPropagation(); this.mrdDownload.emit(e.detail); }, onMrdAttachments: (e) => { e.stopPropagation(); this.mrdAttachments.emit(e.detail); } }),
3463
- ...related.map(it => this.renderItem(it)),
5498
+ ...this.relatedItems().map(it => this.renderItem(it)),
5499
+ ];
5500
+ }
5501
+ /** Single-invoice view: the record's own type carries commons.invoice. The `lines`
5502
+ * RELATED_VIEW (matched generically by the commons.invoiceLine archetype on the
5503
+ * item, not by name) is rendered *inside* mrd-invoice-view via its `slot="lines"` —
5504
+ * reusing the existing renderRelatedView()/renderTable() wiring unchanged, so all
5505
+ * page/sort/aggregation state stays owned here, only the DOM placement moves. */
5506
+ renderInvoiceObject(archetype) {
5507
+ var _a, _b, _c;
5508
+ const linesItem = (_a = this.items.find(it => {
5509
+ var _a, _b;
5510
+ return (it.type === ClientLayoutItemType.VIEW || it.type === ClientLayoutItemType.RELATED_VIEW) &&
5511
+ !!resolveArchetype((_a = it.archetypes) !== null && _a !== void 0 ? _a : (_b = it.view) === null || _b === void 0 ? void 0 : _b.archetypes, ARCHETYPE_INVOICE_LINE);
5512
+ })) !== null && _a !== void 0 ? _a : null;
5513
+ const statusListItems = (_c = (_b = this.items.find(it => { var _a; return it.name === ((_a = archetype.slots) === null || _a === void 0 ? void 0 : _a.status); })) === null || _b === void 0 ? void 0 : _b.listItems) !== null && _c !== void 0 ? _c : null;
5514
+ return [
5515
+ h("mrd-invoice-view", { archetype: archetype, data: this.data, locale: this.locale, statusListItems: statusListItems, onMrdNavigate: (e) => { e.stopPropagation(); this.mrdNavigate.emit(e.detail); }, onMrdDownload: (e) => { e.stopPropagation(); this.mrdDownload.emit(e.detail); }, onMrdAttachments: (e) => { e.stopPropagation(); this.mrdAttachments.emit(e.detail); } }, linesItem && h("div", { slot: "lines" }, this.renderRelatedView(linesItem))),
5516
+ ...this.relatedItems(linesItem).map(it => this.renderItem(it)),
5517
+ ];
5518
+ }
5519
+ /** Single-email view: the record's own type carries commons.email. Fully read-only —
5520
+ * emails have no editable child collection, so this mirrors renderDocumentObject. */
5521
+ renderEmailObject(archetype) {
5522
+ return [
5523
+ h("mrd-email-view", { archetype: archetype, data: this.data, locale: this.locale, onMrdNavigate: (e) => { e.stopPropagation(); this.mrdNavigate.emit(e.detail); }, onMrdDownload: (e) => { e.stopPropagation(); this.mrdDownload.emit(e.detail); }, onMrdAttachments: (e) => { e.stopPropagation(); this.mrdAttachments.emit(e.detail); } }),
5524
+ ...this.relatedItems().map(it => this.renderItem(it)),
3464
5525
  ];
3465
5526
  }
3466
5527
  render() {
3467
5528
  const docArchetype = resolveArchetype(this.archetypes, ARCHETYPE_DOCUMENT);
3468
- return (h(Host, { key: '8585dae577d38e3c9517039b48aa9e798190937c' }, h("div", { key: '020b942996b1346bdc3bc89938e4b020823cfcea', class: "mrd-layout-section" }, docArchetype
3469
- ? this.renderDocumentObject(docArchetype)
3470
- : this.items.map(item => this.renderItem(item))), this.renderImageModal()));
5529
+ const invoiceArchetype = !docArchetype ? resolveArchetype(this.archetypes, ARCHETYPE_INVOICE) : undefined;
5530
+ const emailArchetype = !docArchetype && !invoiceArchetype ? resolveArchetype(this.archetypes, ARCHETYPE_EMAIL) : undefined;
5531
+ return (h(Host, { key: '0078764a136e7ca9561632718c1b527ec3bc01c5' }, h("div", { key: '0c1428ce20bd7d2bbce467a36b6c25ffa0e6367e', class: "mrd-layout-section" }, docArchetype && this.renderDocumentObject(docArchetype), invoiceArchetype && this.renderInvoiceObject(invoiceArchetype), emailArchetype && this.renderEmailObject(emailArchetype), !docArchetype && !invoiceArchetype && !emailArchetype && this.items.map(item => this.renderItem(item))), this.renderImageModal()));
3471
5532
  }
3472
5533
  get el() { return getElement(this); }
3473
5534
  static get watchers() { return {
@@ -3586,7 +5647,7 @@ const MrdLongtextField = class {
3586
5647
  };
3587
5648
  }
3588
5649
  render() {
3589
- return (h(Host, { key: 'b27d14772f5184d41c178606629a9945120296ef' }, h("div", { key: '206b1b9ee1d37e05680e31bf8b324455867fd93b', class: "mrd-longtext-field" }, h(FieldLabel, { key: '0b6f4959f32a097907965753ed8708d7580aee53', base: "mrd-longtext-field", label: this.label, required: this.required }), this.disabled ? (h("pre", { class: "mrd-longtext-field__content" }, this.value)) : (h("textarea", { class: controlClass('mrd-longtext-field', !!this.error), name: this.name, placeholder: this.placeholder, required: this.required, rows: 10, onInput: this.handleInput, onBlur: this.handleBlur }, this.value)), h(FieldError, { key: '0803cf0c1b6409e6c8a65121efef97d28d870119', base: "mrd-longtext-field", error: this.error }))));
5650
+ return (h(Host, { key: 'e53fec4d4eafbd68d9cffb1f064d8e0c4c37839c' }, h("div", { key: '8843a23e42b0545c269fc6c924e7ae295770064e', class: "mrd-longtext-field" }, h(FieldLabel, { key: '8767676dd35f25f9bf5ebdb26887edc0882582e0', base: "mrd-longtext-field", label: this.label, required: this.required }), this.disabled ? (h("pre", { class: "mrd-longtext-field__content" }, this.value)) : (h("textarea", { class: controlClass('mrd-longtext-field', !!this.error), name: this.name, placeholder: this.placeholder, required: this.required, rows: 10, onInput: this.handleInput, onBlur: this.handleBlur }, this.value)), h(FieldError, { key: '54dc790173575e8a02764e5b14040b900c2eb609', base: "mrd-longtext-field", error: this.error }))));
3590
5651
  }
3591
5652
  };
3592
5653
  MrdLongtextField.style = mrdLongtextFieldCss();
@@ -3662,7 +5723,7 @@ const MrdNumberField = class {
3662
5723
  const hasError = !!this.error;
3663
5724
  const suffix = this.dataType === ClientLayoutItemFieldDataType.PERCENTAGE ? '%' :
3664
5725
  this.dataType === ClientLayoutItemFieldDataType.DECIMAL ? '' : '';
3665
- return (h(Host, { key: '90cae99b332f9554bc80d4044fce892ae37a48cf' }, h("div", { key: '26a9cfcc662eaeb571d17785f10f74269cf78537', class: "mrd-number-field" }, h(FieldLabel, { key: '0d9e70c1591f309ad2875d9e9fe6dbb8aa910323', base: "mrd-number-field", label: this.label, required: this.required }), h("div", { key: '95e9b53fa73c452491f65355915bf04912900ded', class: "mrd-number-field__input-wrapper" }, h("input", { key: '1d341c270a21b1a10c51757e90257e48e741abd7', class: controlClass('mrd-number-field', hasError), type: "text", inputMode: "decimal", name: this.name, value: this.displayValue, placeholder: this.placeholder || (suffix ? `0${suffix}` : '0'), required: this.required, disabled: this.disabled, onInput: this.handleInput, onBlur: this.handleBlur, onFocus: this.handleFocus })), h(FieldError, { key: '0dba75e0f7355b71bfa71dab16cd1a6fcc36922f', base: "mrd-number-field", error: this.error }))));
5726
+ return (h(Host, { key: '5df5c2e16c85cd54944d95b7a8c340ae1a4ddb34' }, h("div", { key: 'e332bd0190d537c002b14090fa96ec6502e34746', class: "mrd-number-field" }, h(FieldLabel, { key: 'e26ae85ef6c6d7935b2d34041a7ee2294da392a4', base: "mrd-number-field", label: this.label, required: this.required }), h("div", { key: 'fb1a44a363a36b69124a0092e80b67d41b538c03', class: "mrd-number-field__input-wrapper" }, h("input", { key: '175c448177bbd46015fc7f47b98b76e16ee3b743', class: controlClass('mrd-number-field', hasError), type: "text", inputMode: "decimal", name: this.name, value: this.displayValue, placeholder: this.placeholder || (suffix ? `0${suffix}` : '0'), required: this.required, disabled: this.disabled, onInput: this.handleInput, onBlur: this.handleBlur, onFocus: this.handleFocus })), h(FieldError, { key: 'ecb16ddf655e563f0569e774ab2f2e419f60b0f1', base: "mrd-number-field", error: this.error }))));
3666
5727
  }
3667
5728
  };
3668
5729
  MrdNumberField.style = mrdNumberFieldCss();
@@ -3940,9 +6001,9 @@ const MrdSecretField = class {
3940
6001
  };
3941
6002
  }
3942
6003
  render() {
3943
- return (h(Host, { key: '9883a87b7fcc840aa4bbe0a3cde163cc58bda65d' }, h("div", { key: '3c7ec45d59a1a17863daa39b7c115db5c58815ee', class: "mrd-secret-field" }, h(FieldLabel, { key: '2dda66c7e6d4946661bff5a5a46589a7e17f569a', base: "mrd-secret-field", label: this.label, required: this.required }), this.disabled
6004
+ return (h(Host, { key: 'e06d04fdae34b42441976e21605fe94ad935382e' }, h("div", { key: '2889e1eb1b6d0887ae531523a0b9b43c49ef6f99', class: "mrd-secret-field" }, h(FieldLabel, { key: 'c40907905292cdef8bb0b8b9b0c03e05650bef37', base: "mrd-secret-field", label: this.label, required: this.required }), this.disabled
3944
6005
  ? (h("span", { class: "mrd-secret-field__masked", "aria-label": this.label }, this.value ? '••••••••' : ''))
3945
- : (h("input", { class: controlClass('mrd-secret-field', !!this.error), type: "password", name: this.name, value: this.value, placeholder: this.placeholder, required: this.required, autocomplete: "new-password", onInput: this.handleInput, onBlur: this.handleBlur })), h(FieldError, { key: 'ad8f54a7c76c59591fee77e11a12bbd62c392d91', base: "mrd-secret-field", error: this.error }))));
6006
+ : (h("input", { class: controlClass('mrd-secret-field', !!this.error), type: "password", name: this.name, value: this.value, placeholder: this.placeholder, required: this.required, autocomplete: "new-password", onInput: this.handleInput, onBlur: this.handleBlur })), h(FieldError, { key: '6353e4b40566852dbc1994c7c9c409d0d0aa1b37', base: "mrd-secret-field", error: this.error }))));
3946
6007
  }
3947
6008
  };
3948
6009
  MrdSecretField.style = mrdSecretFieldCss();
@@ -5270,7 +7331,7 @@ const MrdTextField = class {
5270
7331
  };
5271
7332
  }
5272
7333
  render() {
5273
- return (h(Host, { key: 'd2a6fb5735a3a01887cc467274a0ff9d71312124' }, h("div", { key: '7864bf852d43f93ebd0120a3ec1b72e54837d1ba', class: "mrd-text-field" }, h(FieldLabel, { key: 'bdad112197b44a643a58dd79c4648e284311199d', base: "mrd-text-field", label: this.label, required: this.required }), h("input", { key: '1d3e1cf3374ea2e5a83794b5110205964fff86e1', class: controlClass('mrd-text-field', !!this.error), type: "text", name: this.name, value: this.value, placeholder: this.placeholder, required: this.required, disabled: this.disabled, onInput: this.handleInput, onBlur: this.handleBlur }), h(FieldError, { key: 'bb4ec51de7b6d360fdb3d46dd53e85a5d497bcce', base: "mrd-text-field", error: this.error }))));
7334
+ return (h(Host, { key: '3153f0c6f8ab4d9dae93306f7507399aeda75eaf' }, h("div", { key: '5d9c28023fdfb5472fc115c66bc3df509506e10f', class: "mrd-text-field" }, h(FieldLabel, { key: '1e21139aae0cc1ae95aa3297271b618a40043e77', base: "mrd-text-field", label: this.label, required: this.required }), h("input", { key: '46f98d5e39bb834075449fac7096b077a1ae7bb3', class: controlClass('mrd-text-field', !!this.error), type: "text", name: this.name, value: this.value, placeholder: this.placeholder, required: this.required, disabled: this.disabled, onInput: this.handleInput, onBlur: this.handleBlur }), h(FieldError, { key: '10b6ddae9cd9f36dc9d7176167d79df8e4102c03', base: "mrd-text-field", error: this.error }))));
5274
7335
  }
5275
7336
  };
5276
7337
  MrdTextField.style = mrdTextFieldCss();
@@ -5320,14 +7381,12 @@ const MrdTextareaField = class {
5320
7381
  quill.clipboard.dangerouslyPasteHTML(this.value);
5321
7382
  }
5322
7383
  quill.on('text-change', () => {
5323
- var _a, _b;
5324
- const html = (_b = (_a = this.editorEl.querySelector('.ql-editor')) === null || _a === void 0 ? void 0 : _a.innerHTML) !== null && _b !== void 0 ? _b : '';
7384
+ const html = this.getSanitizedHtml();
5325
7385
  this.mrdChange.emit({ name: this.name, value: html });
5326
7386
  });
5327
7387
  quill.on('selection-change', (range) => {
5328
- var _a, _b;
5329
7388
  if (!range) {
5330
- const html = (_b = (_a = this.editorEl.querySelector('.ql-editor')) === null || _a === void 0 ? void 0 : _a.innerHTML) !== null && _b !== void 0 ? _b : '';
7389
+ const html = this.getSanitizedHtml();
5331
7390
  this.error = requiredError(html, this.required, this.locale);
5332
7391
  this.mrdBlur.emit({ name: this.name, value: html });
5333
7392
  }
@@ -5338,8 +7397,13 @@ const MrdTextareaField = class {
5338
7397
  console.error('Failed to load Quill editor:', err);
5339
7398
  }
5340
7399
  }
7400
+ getSanitizedHtml() {
7401
+ var _a, _b;
7402
+ const html = (_b = (_a = this.editorEl.querySelector('.ql-editor')) === null || _a === void 0 ? void 0 : _a.innerHTML) !== null && _b !== void 0 ? _b : '';
7403
+ return purify.sanitize(html);
7404
+ }
5341
7405
  render() {
5342
- return (h(Host, { key: 'de39890fc23146b880e69be7a8f04c91786ae9c9' }, h("div", { key: '0ccc855f3ee44553559a9ea8a70690466789f76d', class: "mrd-textarea-field" }, h(FieldLabel, { key: '2a16dcbeedbba8b5d8d1e8e8c0f021f14813f609', base: "mrd-textarea-field", label: this.label, required: this.required }), h("div", { key: '979ecb0ed163e3f753d75635452eea49d76edf29', class: controlClass('mrd-textarea-field', !!this.error, 'container') }, h("div", { key: '8ea96a080086b68df55017a1464f6bce502f9a58', class: "mrd-textarea-field__editor" })), h(FieldError, { key: 'd6ac1a12f7be3594ed8cdb6d94b304c46dc8285b', base: "mrd-textarea-field", error: this.error }))));
7406
+ return (h(Host, { key: 'e132531881f68f373e700617aac8033c8ebccb47' }, h("div", { key: 'fec0cf56cd7868d3fcd5a4e8a382b2dcdb6e5c50', class: "mrd-textarea-field" }, h(FieldLabel, { key: '333aa2ff57cce9e3178f0c4be4a1df1077884248', base: "mrd-textarea-field", label: this.label, required: this.required }), h("div", { key: '40025207580eb5768981b85aaa0a8ff95fce7234', class: controlClass('mrd-textarea-field', !!this.error, 'container') }, h("div", { key: '621987b3b2b1d8b4836bff065075ba527a82db81', class: "mrd-textarea-field__editor" })), h(FieldError, { key: 'ac2d8de22f008cd1c91842137ccd0cd36eb9ce19', base: "mrd-textarea-field", error: this.error }))));
5343
7407
  }
5344
7408
  get el() { return getElement(this); }
5345
7409
  };
@@ -5370,9 +7434,9 @@ const MrdTimeField = class {
5370
7434
  };
5371
7435
  }
5372
7436
  render() {
5373
- return (h(Host, { key: '588e298c4f52aa4e65d87bfdc6918282ed97b3ae' }, h("div", { key: 'eed7332ca78747d4ff8b6c8d06ad4674e1c37e69', class: "mrd-time-field" }, h(FieldLabel, { key: '6383beb79fd05dabdc408256e3326f9637e4c993', base: "mrd-time-field", label: this.label, required: this.required }), h("input", { key: 'b372d8b5dd523ee6182fe302450ce904ac17cc3c', class: controlClass('mrd-time-field', !!this.error), type: "time", name: this.name, value: this.value, required: this.required, disabled: this.disabled, onChange: this.handleChange, onBlur: this.handleBlur }), h(FieldError, { key: '7d8ce1e557bf583c0409e8f02893a15fadeab634', base: "mrd-time-field", error: this.error }))));
7437
+ return (h(Host, { key: 'd521c654bc7beda71a31542a25198edaaf53b838' }, h("div", { key: '084ab16ac8aed952bd0ec50e0430591d4db5bd4b', class: "mrd-time-field" }, h(FieldLabel, { key: '43938ad7c5a9765353f6523d399d4b74cbb9ec6f', base: "mrd-time-field", label: this.label, required: this.required }), h("input", { key: 'e46eda620e7a5f1bb3b433a4c051e913675c33f9', class: controlClass('mrd-time-field', !!this.error), type: "time", name: this.name, value: this.value, required: this.required, disabled: this.disabled, onChange: this.handleChange, onBlur: this.handleBlur }), h(FieldError, { key: '34bc1eaa1b969951dffaaacad73af532b6d290fb', base: "mrd-time-field", error: this.error }))));
5374
7438
  }
5375
7439
  };
5376
7440
  MrdTimeField.style = mrdTimeFieldCss();
5377
7441
 
5378
- export { MrdBooleanField as mrd_boolean_field, MrdCurrencyField as mrd_currency_field, MrdDateField as mrd_date_field, MrdDatetimeField as mrd_datetime_field, MrdDocumentContainer as mrd_document_container, MrdDocumentList as mrd_document_list, MrdDocumentView as mrd_document_view, MrdEmailField as mrd_email_field, MrdField as mrd_field, MrdFileField as mrd_file_field, MrdForm as mrd_form, MrdHyperlinkField as mrd_hyperlink_field, MrdImageField as mrd_image_field, MrdLayoutSection as mrd_layout_section, MrdListField as mrd_list_field, MrdLongtextField as mrd_longtext_field, MrdNumberField as mrd_number_field, MrdRelationField as mrd_relation_field, MrdSecretField as mrd_secret_field, MrdTable as mrd_table, MrdTextField as mrd_text_field, MrdTextareaField as mrd_textarea_field, MrdTimeField as mrd_time_field };
7442
+ export { MrdBooleanField as mrd_boolean_field, MrdCurrencyField as mrd_currency_field, MrdDateField as mrd_date_field, MrdDatetimeField as mrd_datetime_field, MrdDocumentContainer as mrd_document_container, MrdDocumentList as mrd_document_list, MrdDocumentView as mrd_document_view, MrdEmailField as mrd_email_field, MrdEmailView as mrd_email_view, MrdField as mrd_field, MrdFileField as mrd_file_field, MrdForm as mrd_form, MrdHyperlinkField as mrd_hyperlink_field, MrdImageField as mrd_image_field, MrdInvoiceView as mrd_invoice_view, MrdLayoutSection as mrd_layout_section, MrdListField as mrd_list_field, MrdLongtextField as mrd_longtext_field, MrdNumberField as mrd_number_field, MrdRelationField as mrd_relation_field, MrdSecretField as mrd_secret_field, MrdTable as mrd_table, MrdTextField as mrd_text_field, MrdTextareaField as mrd_textarea_field, MrdTimeField as mrd_time_field };