@performant-software/core-data 2.3.6-beta.7 → 2.3.6-beta.8

package/dist/index.es244.js

@@ -1,20 +1,681 @@
-import e from "./index.es435.js";
-import i from "./index.es436.js";
-import { unsafeStringify as d } from "./index.es437.js";
-function o(n, m, t) {
-  if (e.randomUUID && !m && !n)
-    return e.randomUUID();
-  n = n || {};
-  const r = n.random || (n.rng || i)();
-  if (r[6] = r[6] & 15 | 64, r[8] = r[8] & 63 | 128, m) {
-    t = t || 0;
-    for (let a = 0; a < 16; ++a)
-      m[t + a] = r[a];
-    return m;
-  }
-  return d(r);
+import { getDefaultExportFromCjs as Q } from "./index.es283.js";
+import "./index.es284.js";
+import { e as ee } from "./index.es285.js";
+import "./index.es286.js";
+import { c as te } from "./index.es287.js";
+import { p as re } from "./index.es288.js";
+import { p as ne } from "./index.es289.js";
+import { __exports as ie } from "./index.es290.js";
+import { __exports as se } from "./index.es291.js";
+const oe = ie, q = ee, { isPlainObject: le } = se, V = te, ae = re, { parse: ce } = ne, fe = [
+  "img",
+  "audio",
+  "video",
+  "picture",
+  "svg",
+  "object",
+  "map",
+  "iframe",
+  "embed"
+], de = ["script", "style"];
+function O(f, t) {
+  f && Object.keys(f).forEach(function(w) {
+    t(f[w], w);
+  });
 }
+function y(f, t) {
+  return {}.hasOwnProperty.call(f, t);
+}
+function Z(f, t) {
+  const w = [];
+  return O(f, function(l) {
+    t(l) && w.push(l);
+  }), w;
+}
+function ue(f) {
+  for (const t in f)
+    if (y(f, t))
+      return !1;
+  return !0;
+}
+function pe(f) {
+  return f.map(function(t) {
+    if (!t.url)
+      throw new Error("URL missing");
+    return t.url + (t.w ? ` ${t.w}w` : "") + (t.h ? ` ${t.h}h` : "") + (t.d ? ` ${t.d}x` : "");
+  }).join(", ");
+}
+var ge = H;
+const he = /^[^\0\t\n\f\r /<=>]+$/;
+function H(f, t, w) {
+  if (f == null)
+    return "";
+  typeof f == "number" && (f = f.toString());
+  let l = "", m = "";
+  function R(e, n) {
+    const r = this;
+    this.tag = e, this.attribs = n || {}, this.tagPosition = l.length, this.text = "", this.mediaChildren = [], this.updateParentNodeText = function() {
+      if (u.length) {
+        const i = u[u.length - 1];
+        i.text += r.text;
+      }
+    }, this.updateParentNodeMediaChildren = function() {
+      u.length && fe.includes(this.tag) && u[u.length - 1].mediaChildren.push(this.tag);
+    };
+  }
+  t = Object.assign({}, H.defaults, t), t.parser = Object.assign({}, me, t.parser);
+  const $ = function(e) {
+    return t.allowedTags === !1 || (t.allowedTags || []).indexOf(e) > -1;
+  };
+  de.forEach(function(e) {
+    $(e) && !t.allowVulnerableTags && console.warn(`
+
+⚠️ Your \`allowedTags\` option includes, \`${e}\`, which is inherently
+vulnerable to XSS attacks. Please remove it from \`allowedTags\`.
+Or, to disable this warning, add the \`allowVulnerableTags\` option
+and ensure you are accounting for this risk.
+
+`);
+  });
+  const X = t.nonTextTags || [
+    "script",
+    "style",
+    "textarea",
+    "option"
+  ];
+  let d, S;
+  t.allowedAttributes && (d = {}, S = {}, O(t.allowedAttributes, function(e, n) {
+    d[n] = [];
+    const r = [];
+    e.forEach(function(i) {
+      typeof i == "string" && i.indexOf("*") >= 0 ? r.push(q(i).replace(/\\\*/g, ".*")) : d[n].push(i);
+    }), r.length && (S[n] = new RegExp("^(" + r.join("|") + ")$"));
+  }));
+  const C = {}, N = {}, F = {};
+  O(t.allowedClasses, function(e, n) {
+    if (d && (y(d, n) || (d[n] = []), d[n].push("class")), C[n] = e, Array.isArray(e)) {
+      const r = [];
+      C[n] = [], F[n] = [], e.forEach(function(i) {
+        typeof i == "string" && i.indexOf("*") >= 0 ? r.push(q(i).replace(/\\\*/g, ".*")) : i instanceof RegExp ? F[n].push(i) : C[n].push(i);
+      }), r.length && (N[n] = new RegExp("^(" + r.join("|") + ")$"));
+    }
+  });
+  const I = {};
+  let z;
+  O(t.transformTags, function(e, n) {
+    let r;
+    typeof e == "function" ? r = e : typeof e == "string" && (r = H.simpleTransform(e)), n === "*" ? z = r : I[n] = r;
+  });
+  let g, u, A, v, T, M, P = !1;
+  _();
+  const B = new oe.Parser({
+    onopentag: function(e, n) {
+      if (t.enforceHtmlBoundary && e === "html" && _(), T) {
+        M++;
+        return;
+      }
+      const r = new R(e, n);
+      u.push(r);
+      let i = !1;
+      const h = !!r.text;
+      let p;
+      if (y(I, e) && (p = I[e](e, n), r.attribs = n = p.attribs, p.text !== void 0 && (r.innerText = p.text), e !== p.tagName && (r.name = e = p.tagName, v[g] = p.tagName)), z && (p = z(e, n), r.attribs = n = p.attribs, e !== p.tagName && (r.name = e = p.tagName, v[g] = p.tagName)), (!$(e) || t.disallowedTagsMode === "recursiveEscape" && !ue(A) || t.nestingLimit != null && g >= t.nestingLimit) && (i = !0, A[g] = !0, t.disallowedTagsMode === "discard" && X.indexOf(e) !== -1 && (T = !0, M = 1), A[g] = !0), g++, i) {
+        if (t.disallowedTagsMode === "discard")
+          return;
+        m = l, l = "";
+      }
+      l += "<" + e, e === "script" && (t.allowedScriptHostnames || t.allowedScriptDomains) && (r.innerText = ""), (!d || y(d, e) || d["*"]) && O(n, function(c, a) {
+        if (!he.test(a)) {
+          delete r.attribs[a];
+          return;
+        }
+        if (c === "" && (t.nonBooleanAttributes.includes(a) || t.nonBooleanAttributes.includes("*"))) {
+          delete r.attribs[a];
+          return;
+        }
+        let D = !1;
+        if (!d || y(d, e) && d[e].indexOf(a) !== -1 || d["*"] && d["*"].indexOf(a) !== -1 || y(S, e) && S[e].test(a) || S["*"] && S["*"].test(a))
+          D = !0;
+        else if (d && d[e]) {
+          for (const s of d[e])
+            if (le(s) && s.name && s.name === a) {
+              D = !0;
+              let o = "";
+              if (s.multiple === !0) {
+                const k = c.split(" ");
+                for (const b of k)
+                  s.values.indexOf(b) !== -1 && (o === "" ? o = b : o += " " + b);
+              } else
+                s.values.indexOf(c) >= 0 && (o = c);
+              c = o;
+            }
+        }
+        if (D) {
+          if (t.allowedSchemesAppliedToAttributes.indexOf(a) !== -1 && U(e, c)) {
+            delete r.attribs[a];
+            return;
+          }
+          if (e === "script" && a === "src") {
+            let s = !0;
+            try {
+              const o = G(c);
+              if (t.allowedScriptHostnames || t.allowedScriptDomains) {
+                const k = (t.allowedScriptHostnames || []).find(function(x) {
+                  return x === o.url.hostname;
+                }), b = (t.allowedScriptDomains || []).find(function(x) {
+                  return o.url.hostname === x || o.url.hostname.endsWith(`.${x}`);
+                });
+                s = k || b;
+              }
+            } catch {
+              s = !1;
+            }
+            if (!s) {
+              delete r.attribs[a];
+              return;
+            }
+          }
+          if (e === "iframe" && a === "src") {
+            let s = !0;
+            try {
+              const o = G(c);
+              if (o.isRelativeUrl)
+                s = y(t, "allowIframeRelativeUrls") ? t.allowIframeRelativeUrls : !t.allowedIframeHostnames && !t.allowedIframeDomains;
+              else if (t.allowedIframeHostnames || t.allowedIframeDomains) {
+                const k = (t.allowedIframeHostnames || []).find(function(x) {
+                  return x === o.url.hostname;
+                }), b = (t.allowedIframeDomains || []).find(function(x) {
+                  return o.url.hostname === x || o.url.hostname.endsWith(`.${x}`);
+                });
+                s = k || b;
+              }
+            } catch {
+              s = !1;
+            }
+            if (!s) {
+              delete r.attribs[a];
+              return;
+            }
+          }
+          if (a === "srcset")
+            try {
+              let s = ae(c);
+              if (s.forEach(function(o) {
+                U("srcset", o.url) && (o.evil = !0);
+              }), s = Z(s, function(o) {
+                return !o.evil;
+              }), s.length)
+                c = pe(Z(s, function(o) {
+                  return !o.evil;
+                })), r.attribs[a] = c;
+              else {
+                delete r.attribs[a];
+                return;
+              }
+            } catch {
+              delete r.attribs[a];
+              return;
+            }
+          if (a === "class") {
+            const s = C[e], o = C["*"], k = N[e], b = F[e], x = N["*"], W = [
+              k,
+              x
+            ].concat(b).filter(function(K) {
+              return K;
+            });
+            if (s && o ? c = L(c, V(s, o), W) : c = L(c, s || o, W), !c.length) {
+              delete r.attribs[a];
+              return;
+            }
+          }
+          if (a === "style") {
+            if (t.parseStyleAttributes)
+              try {
+                const s = ce(e + " {" + c + "}"), o = Y(s, t.allowedStyles);
+                if (c = j(o), c.length === 0) {
+                  delete r.attribs[a];
+                  return;
+                }
+              } catch {
+                typeof window < "u" && console.warn('Failed to parse "' + e + " {" + c + `}", If you're running this in a browser, we recommend to disable style parsing: options.parseStyleAttributes: false, since this only works in a node environment due to a postcss dependency, More info: https://github.com/apostrophecms/sanitize-html/issues/547`), delete r.attribs[a];
+                return;
+              }
+            else if (t.allowedStyles)
+              throw new Error("allowedStyles option cannot be used together with parseStyleAttributes: false.");
+          }
+          l += " " + a, c && c.length && (l += '="' + E(c, !0) + '"');
+        } else
+          delete r.attribs[a];
+      }), t.selfClosing.indexOf(e) !== -1 ? l += " />" : (l += ">", r.innerText && !h && !t.textFilter && (l += E(r.innerText), P = !0)), i && (l = m + E(l), m = "");
+    },
+    ontext: function(e) {
+      if (T)
+        return;
+      const n = u[u.length - 1];
+      let r;
+      if (n && (r = n.tag, e = n.innerText !== void 0 ? n.innerText : e), t.disallowedTagsMode === "discard" && (r === "script" || r === "style"))
+        l += e;
+      else {
+        const i = E(e, !1);
+        t.textFilter && !P ? l += t.textFilter(i, r) : P || (l += i);
+      }
+      if (u.length) {
+        const i = u[u.length - 1];
+        i.text += e;
+      }
+    },
+    onclosetag: function(e, n) {
+      if (T)
+        if (M--, !M)
+          T = !1;
+        else
+          return;
+      const r = u.pop();
+      if (!r)
+        return;
+      if (r.tag !== e) {
+        u.push(r);
+        return;
+      }
+      T = t.enforceHtmlBoundary ? e === "html" : !1, g--;
+      const i = A[g];
+      if (i) {
+        if (delete A[g], t.disallowedTagsMode === "discard") {
+          r.updateParentNodeText();
+          return;
+        }
+        m = l, l = "";
+      }
+      if (v[g] && (e = v[g], delete v[g]), t.exclusiveFilter && t.exclusiveFilter(r)) {
+        l = l.substr(0, r.tagPosition);
+        return;
+      }
+      if (r.updateParentNodeMediaChildren(), r.updateParentNodeText(), // Already output />
+      t.selfClosing.indexOf(e) !== -1 || // Escaped tag, closing tag is implied
+      n && !$(e) && ["escape", "recursiveEscape"].indexOf(t.disallowedTagsMode) >= 0) {
+        i && (l = m, m = "");
+        return;
+      }
+      l += "</" + e + ">", i && (l = m + E(l), m = ""), P = !1;
+    }
+  }, t.parser);
+  return B.write(f), B.end(), l;
+  function _() {
+    l = "", g = 0, u = [], A = {}, v = {}, T = !1, M = 0;
+  }
+  function E(e, n) {
+    return typeof e != "string" && (e = e + ""), t.parser.decodeEntities && (e = e.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;"), n && (e = e.replace(/"/g, "&quot;"))), e = e.replace(/&(?![a-zA-Z0-9#]{1,20};)/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;"), n && (e = e.replace(/"/g, "&quot;")), e;
+  }
+  function U(e, n) {
+    for (n = n.replace(/[\x00-\x20]+/g, ""); ; ) {
+      const h = n.indexOf("<!--");
+      if (h === -1)
+        break;
+      const p = n.indexOf("-->", h + 4);
+      if (p === -1)
+        break;
+      n = n.substring(0, h) + n.substring(p + 3);
+    }
+    const r = n.match(/^([a-zA-Z][a-zA-Z0-9.\-+]*):/);
+    if (!r)
+      return n.match(/^[/\\]{2}/) ? !t.allowProtocolRelative : !1;
+    const i = r[1].toLowerCase();
+    return y(t.allowedSchemesByTag, e) ? t.allowedSchemesByTag[e].indexOf(i) === -1 : !t.allowedSchemes || t.allowedSchemes.indexOf(i) === -1;
+  }
+  function G(e) {
+    if (e = e.replace(/^(\w+:)?\s*[\\/]\s*[\\/]/, "$1//"), e.startsWith("relative:"))
+      throw new Error("relative: exploit attempt");
+    let n = "relative://relative-site";
+    for (let h = 0; h < 100; h++)
+      n += `/${h}`;
+    const r = new URL(e, n);
+    return {
+      isRelativeUrl: r && r.hostname === "relative-site" && r.protocol === "relative:",
+      url: r
+    };
+  }
+  function Y(e, n) {
+    if (!n)
+      return e;
+    const r = e.nodes[0];
+    let i;
+    return n[r.selector] && n["*"] ? i = V(
+      n[r.selector],
+      n["*"]
+    ) : i = n[r.selector] || n["*"], i && (e.nodes[0].nodes = r.nodes.reduce(J(i), [])), e;
+  }
+  function j(e) {
+    return e.nodes[0].nodes.reduce(function(n, r) {
+      return n.push(
+        `${r.prop}:${r.value}${r.important ? " !important" : ""}`
+      ), n;
+    }, []).join(";");
+  }
+  function J(e) {
+    return function(n, r) {
+      return y(e, r.prop) && e[r.prop].some(function(h) {
+        return h.test(r.value);
+      }) && n.push(r), n;
+    };
+  }
+  function L(e, n, r) {
+    return n ? (e = e.split(/\s+/), e.filter(function(i) {
+      return n.indexOf(i) !== -1 || r.some(function(h) {
+        return h.test(i);
+      });
+    }).join(" ")) : e;
+  }
+}
+const me = {
+  decodeEntities: !0
+};
+H.defaults = {
+  allowedTags: [
+    // Sections derived from MDN element categories and limited to the more
+    // benign categories.
+    // https://developer.mozilla.org/en-US/docs/Web/HTML/Element
+    // Content sectioning
+    "address",
+    "article",
+    "aside",
+    "footer",
+    "header",
+    "h1",
+    "h2",
+    "h3",
+    "h4",
+    "h5",
+    "h6",
+    "hgroup",
+    "main",
+    "nav",
+    "section",
+    // Text content
+    "blockquote",
+    "dd",
+    "div",
+    "dl",
+    "dt",
+    "figcaption",
+    "figure",
+    "hr",
+    "li",
+    "main",
+    "ol",
+    "p",
+    "pre",
+    "ul",
+    // Inline text semantics
+    "a",
+    "abbr",
+    "b",
+    "bdi",
+    "bdo",
+    "br",
+    "cite",
+    "code",
+    "data",
+    "dfn",
+    "em",
+    "i",
+    "kbd",
+    "mark",
+    "q",
+    "rb",
+    "rp",
+    "rt",
+    "rtc",
+    "ruby",
+    "s",
+    "samp",
+    "small",
+    "span",
+    "strong",
+    "sub",
+    "sup",
+    "time",
+    "u",
+    "var",
+    "wbr",
+    // Table content
+    "caption",
+    "col",
+    "colgroup",
+    "table",
+    "tbody",
+    "td",
+    "tfoot",
+    "th",
+    "thead",
+    "tr"
+  ],
+  // Tags that cannot be boolean
+  nonBooleanAttributes: [
+    "abbr",
+    "accept",
+    "accept-charset",
+    "accesskey",
+    "action",
+    "allow",
+    "alt",
+    "as",
+    "autocapitalize",
+    "autocomplete",
+    "blocking",
+    "charset",
+    "cite",
+    "class",
+    "color",
+    "cols",
+    "colspan",
+    "content",
+    "contenteditable",
+    "coords",
+    "crossorigin",
+    "data",
+    "datetime",
+    "decoding",
+    "dir",
+    "dirname",
+    "download",
+    "draggable",
+    "enctype",
+    "enterkeyhint",
+    "fetchpriority",
+    "for",
+    "form",
+    "formaction",
+    "formenctype",
+    "formmethod",
+    "formtarget",
+    "headers",
+    "height",
+    "hidden",
+    "high",
+    "href",
+    "hreflang",
+    "http-equiv",
+    "id",
+    "imagesizes",
+    "imagesrcset",
+    "inputmode",
+    "integrity",
+    "is",
+    "itemid",
+    "itemprop",
+    "itemref",
+    "itemtype",
+    "kind",
+    "label",
+    "lang",
+    "list",
+    "loading",
+    "low",
+    "max",
+    "maxlength",
+    "media",
+    "method",
+    "min",
+    "minlength",
+    "name",
+    "nonce",
+    "optimum",
+    "pattern",
+    "ping",
+    "placeholder",
+    "popover",
+    "popovertarget",
+    "popovertargetaction",
+    "poster",
+    "preload",
+    "referrerpolicy",
+    "rel",
+    "rows",
+    "rowspan",
+    "sandbox",
+    "scope",
+    "shape",
+    "size",
+    "sizes",
+    "slot",
+    "span",
+    "spellcheck",
+    "src",
+    "srcdoc",
+    "srclang",
+    "srcset",
+    "start",
+    "step",
+    "style",
+    "tabindex",
+    "target",
+    "title",
+    "translate",
+    "type",
+    "usemap",
+    "value",
+    "width",
+    "wrap",
+    // Event handlers
+    "onauxclick",
+    "onafterprint",
+    "onbeforematch",
+    "onbeforeprint",
+    "onbeforeunload",
+    "onbeforetoggle",
+    "onblur",
+    "oncancel",
+    "oncanplay",
+    "oncanplaythrough",
+    "onchange",
+    "onclick",
+    "onclose",
+    "oncontextlost",
+    "oncontextmenu",
+    "oncontextrestored",
+    "oncopy",
+    "oncuechange",
+    "oncut",
+    "ondblclick",
+    "ondrag",
+    "ondragend",
+    "ondragenter",
+    "ondragleave",
+    "ondragover",
+    "ondragstart",
+    "ondrop",
+    "ondurationchange",
+    "onemptied",
+    "onended",
+    "onerror",
+    "onfocus",
+    "onformdata",
+    "onhashchange",
+    "oninput",
+    "oninvalid",
+    "onkeydown",
+    "onkeypress",
+    "onkeyup",
+    "onlanguagechange",
+    "onload",
+    "onloadeddata",
+    "onloadedmetadata",
+    "onloadstart",
+    "onmessage",
+    "onmessageerror",
+    "onmousedown",
+    "onmouseenter",
+    "onmouseleave",
+    "onmousemove",
+    "onmouseout",
+    "onmouseover",
+    "onmouseup",
+    "onoffline",
+    "ononline",
+    "onpagehide",
+    "onpageshow",
+    "onpaste",
+    "onpause",
+    "onplay",
+    "onplaying",
+    "onpopstate",
+    "onprogress",
+    "onratechange",
+    "onreset",
+    "onresize",
+    "onrejectionhandled",
+    "onscroll",
+    "onscrollend",
+    "onsecuritypolicyviolation",
+    "onseeked",
+    "onseeking",
+    "onselect",
+    "onslotchange",
+    "onstalled",
+    "onstorage",
+    "onsubmit",
+    "onsuspend",
+    "ontimeupdate",
+    "ontoggle",
+    "onunhandledrejection",
+    "onunload",
+    "onvolumechange",
+    "onwaiting",
+    "onwheel"
+  ],
+  disallowedTagsMode: "discard",
+  allowedAttributes: {
+    a: ["href", "name", "target"],
+    // We don't currently allow img itself by default, but
+    // these attributes would make sense if we did.
+    img: ["src", "srcset", "alt", "title", "width", "height", "loading"]
+  },
+  // Lots of these won't come up by default because we don't allow them
+  selfClosing: ["img", "br", "hr", "area", "base", "basefont", "input", "link", "meta"],
+  // URL schemes we permit
+  allowedSchemes: ["http", "https", "ftp", "mailto", "tel"],
+  allowedSchemesByTag: {},
+  allowedSchemesAppliedToAttributes: ["href", "src", "cite"],
+  allowProtocolRelative: !0,
+  enforceHtmlBoundary: !1,
+  parseStyleAttributes: !0
+};
+H.simpleTransform = function(f, t, w) {
+  return w = w === void 0 ? !0 : w, t = t || {}, function(l, m) {
+    let R;
+    if (w)
+      for (R in t)
+        m[R] = t[R];
+    else
+      m = t;
+    return {
+      tagName: f,
+      attribs: m
+    };
+  };
+};
+const Re = /* @__PURE__ */ Q(ge);
 export {
-  o as default
+  Re as default
 };
 //# sourceMappingURL=index.es244.js.map