@sankhyalabs/ezui 7.3.2 → 7.3.3

package/dist/custom-elements/index.js

@@ -11080,7 +11080,7 @@ const EzFormView$1 = class extends HTMLElement$1 {
    */
   async setFieldProp(fieldName, propName, value) {
     const fields = this.fields.map(field => {
-      if (field.name === fieldName && (value || value === 0)) {
+      if (field.name === fieldName && value !== null && value !== undefined) {
         field.props = field.props || {};
         field.props[propName] = value;
       }
@@ -75228,7 +75228,7 @@ var MenuModule = {
 };
 
 var purify = createCommonjsModule(function (module, exports) {
-/*! @license DOMPurify 3.4.12 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.4.12/LICENSE */
+/*! @license DOMPurify 3.4.13 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.4.13/LICENSE */
 
 (function (global, factory) {
   module.exports = factory() ;
@@ -75656,7 +75656,7 @@ var purify = createCommonjsModule(function (module, exports) {
   function createDOMPurify() {
     let window = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : getGlobal();
     const DOMPurify = root => createDOMPurify(root);
-    DOMPurify.version = '3.4.12';
+    DOMPurify.version = '3.4.13';
     DOMPurify.removed = [];
     if (!window || !window.document || window.document.nodeType !== NODE_TYPE.document || !window.Element) {
       // Not running in a browser, provide a factory function
@@ -75683,6 +75683,7 @@ var purify = createCommonjsModule(function (module, exports) {
     const getAttributes = lookupGetter(ElementPrototype, 'attributes');
     const getNodeType = Node && Node.prototype ? lookupGetter(Node.prototype, 'nodeType') : null;
     const getNodeName = Node && Node.prototype ? lookupGetter(Node.prototype, 'nodeName') : null;
+    const getOwnerDocument = Node && Node.prototype ? lookupGetter(Node.prototype, 'ownerDocument') : null;
     // As per issue #47, the web-components registry is inherited by a
     // new document created via createHTMLDocument. As per the spec
     // (http://w3c.github.io/webcomponents/spec/custom/#creating-and-passing-registries)
@@ -76601,7 +76602,17 @@ var purify = createCommonjsModule(function (module, exports) {
      * @return The created NodeIterator
      */
     const _createNodeIterator = function _createNodeIterator(root) {
-      return createNodeIterator.call(root.ownerDocument || root, root,
+      /* Read ownerDocument through the cached Node.prototype getter, never the
+         direct property. HTMLFormElement has [LegacyOverrideBuiltIns], so a
+         clobbering child (<input name="ownerDocument"> or a form-associated
+         external input) shadows the prototype getter and makes a direct read
+         return that <input>. createNodeIterator.call(<input>, ...) then throws
+         "Illegal invocation", and on the IN_PLACE path that throw lands before
+         the walk's fail-closed barrier - leaving the caller's live tree, with
+         any already-armed handler in it, un-neutralized. The cached getter
+         returns the real Document regardless of the clobber. */
+      const doc = getOwnerDocument ? getOwnerDocument(root) : root.ownerDocument;
+      return createNodeIterator.call(doc || root, root,
       // eslint-disable-next-line no-bitwise
       NodeFilter.SHOW_ELEMENT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_TEXT | NodeFilter.SHOW_PROCESSING_INSTRUCTION | NodeFilter.SHOW_CDATA_SECTION, null);
     };
@@ -76641,7 +76652,11 @@ var purify = createCommonjsModule(function (module, exports) {
     const _scrubTemplateExpressions2 = function _scrubTemplateExpressions(node) {
       var _node$querySelectorAl;
       node.normalize();
-      const walker = createNodeIterator.call(node.ownerDocument || node, node,
+      /* Clobber-safe ownerDocument read, same reasoning as _createNodeIterator:
+         under SAFE_FOR_TEMPLATES this runs on the live IN_PLACE root, which may
+         carry a form-named-getter override of ownerDocument. */
+      const doc = getOwnerDocument ? getOwnerDocument(node) : node.ownerDocument;
+      const walker = createNodeIterator.call(doc || node, node,
       // eslint-disable-next-line no-bitwise
       NodeFilter.SHOW_TEXT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_CDATA_SECTION | NodeFilter.SHOW_PROCESSING_INSTRUCTION, null);
       let currentNode = walker.nextNode();
@@ -76808,7 +76823,7 @@ var purify = createCommonjsModule(function (module, exports) {
      * @param tagName the node's transformCaseFunc'd tag name
      * @return true if the node was removed, false if kept
      */
-    const _sanitizeDisallowedNode = function _sanitizeDisallowedNode(currentNode, tagName) {
+    const _sanitizeDisallowedNode = function _sanitizeDisallowedNode(currentNode, tagName, root) {
       /* Check if we have a custom element to handle */
       if (!FORBID_TAGS[tagName] && _isBasicCustomElement(tagName)) {
         if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)) {
@@ -76831,27 +76846,26 @@ var purify = createCommonjsModule(function (module, exports) {
         const childNodes = getChildNodes(currentNode);
         if (childNodes && parentNode) {
           const childCount = childNodes.length;
-          /* In-place: hoist the *original* children so the iterator visits
-               and sanitises them through the same allowlist pass as every other
-               node. The caller built the tree in the live document, so the
-               originals carry already-queued resource events (`<img onerror>`,
-               `<video>`/`<audio>` error, lazy/`onload`, …); cloning would leave
-               those originals detached but still armed, firing in page scope
-               while the returned tree looked clean. Moving is safe in-place: the
-               root is pre-validated as an allowed tag and so is never the node
-               being removed, which keeps `parentNode` inside the iterator root
-               and the relocated child inside the serialised tree.
-                        Otherwise (string / DOM-copy paths): clone. The iterator is rooted
-               at — and the result serialised from — `body`, so a restrictive
-               ALLOWED_TAGS that removes `body` itself must leave its content in
-               place, which only cloning does; and those paths parse into an
-               inert document, so their discarded originals never had a queued
-               event to neutralise.
+          /* Hoist by moving each child up one level rather than deep-cloning
+               it. Moving transfers every descendant exactly once, so a chain of
+               nested disallowed elements costs O(n) instead of the O(n^2) that
+               re-cloning the shrinking subtree at each level produced; it also
+               empties the removed original, so `DOMPurify.removed` no longer
+               pins whole subtrees. Moving preserves the in-place guarantee too:
+               an original carrying already-queued resource events (`<img
+               onerror>`, `<video>`/`<audio>` error, lazy/`onload`, …) is
+               relocated and sanitised rather than left detached but still armed.
+                        The sole case that must clone is removing the walk root itself.
+               The result is serialised from the root's subtree, so a restrictive
+               ALLOWED_TAGS that strips the root (`body` on the string path) must
+               leave the content inside it, which only cloning does. In IN_PLACE
+               the root is pre-validated as an allowed tag and so is never removed
+               here, so that path always takes the move branch.
                         `childNodes` is live; a tail-to-head walk keeps `childNodes[i]`
                valid whether we move (drops the trailing entry) or clone (leaves
                the list intact). */
           for (let i = childCount - 1; i >= 0; --i) {
-            const hoisted = IN_PLACE ? childNodes[i] : cloneNode(childNodes[i], true);
+            const hoisted = currentNode === root ? cloneNode(childNodes[i], true) : childNodes[i];
             parentNode.insertBefore(hoisted, getNextSibling(currentNode));
           }
         }
@@ -76859,6 +76873,26 @@ var purify = createCommonjsModule(function (module, exports) {
       _forceRemove(currentNode);
       return true;
     };
+    /**
+     * Fork a hook-mutable allowlist off its shared binding the first time a
+     * (possibly lazily-installed) uponSanitize* hook is about to see it, so the
+     * hook cannot widen the per-instance default or the setConfig binding by
+     * reference and leak past the call. Returns the set unchanged once it is
+     * already call-local, so repeated calls across elements are idempotent.
+     *
+     * @param hookList the uponSanitize* hook array for this event
+     * @param set the current ALLOWED_TAGS / ALLOWED_ATTR binding
+     * @param defaultSet the per-instance DEFAULT_ALLOWED_* constant
+     * @param setConfigSet the captured setConfig() binding, or null
+     * @return a call-local clone if a hook is present and set is still shared,
+     *   else set unchanged
+     */
+    const _forkSharedAllowlist = function _forkSharedAllowlist(hookList, set, defaultSet, setConfigSet) {
+      if (hookList.length === 0) {
+        return set;
+      }
+      return set === defaultSet || set === setConfigSet ? clone(set) : set;
+    };
     /**
      * _sanitizeElements
      *
@@ -76872,9 +76906,14 @@ var purify = createCommonjsModule(function (module, exports) {
     const _sanitizeElements = function _sanitizeElements(currentNode, root) {
       /* Execute a hook if present */
       _executeHooks(hooks.beforeSanitizeElements, currentNode, null);
-      /* A hook may have detached the node — treat it as removed (see the
-         detached-node comment after the uponSanitizeElement hook below). */
+      /* A hook may have detached the node - treat it as removed (see the
+         detached-node comment after the uponSanitizeElement hook below). On
+         the IN_PLACE path, neutralize the detached subtree first so a queued
+         resource handler on it cannot fire in page scope after we return. */
       if (currentNode !== root && getParentNode(currentNode) === null) {
+        if (IN_PLACE) {
+          _neutralizeSubtree(currentNode);
+        }
         return true;
       }
       /* Check if element is clobbered or can clobber */
@@ -76884,6 +76923,12 @@ var purify = createCommonjsModule(function (module, exports) {
       }
       /* Now let's check the element's type and name */
       const tagName = transformCaseFunc(getNodeName ? getNodeName(currentNode) : currentNode.nodeName);
+      /* Close the pre-walk clone-guard's timing gap: an uponSanitizeElement
+         hook may have been installed after that guard sampled the hook arrays
+         (e.g. lazily from beforeSanitizeElements), leaving ALLOWED_TAGS still
+         aliasing a shared binding that a widening hook would mutate by
+         reference. Fork it before exposing it to the hook. */
+      ALLOWED_TAGS = _forkSharedAllowlist(hooks.uponSanitizeElement, ALLOWED_TAGS, DEFAULT_ALLOWED_TAGS, SET_CONFIG_ALLOWED_TAGS);
       /* Execute a hook if present */
       _executeHooks(hooks.uponSanitizeElement, currentNode, {
         tagName,
@@ -76901,10 +76946,22 @@ var purify = createCommonjsModule(function (module, exports) {
          opposite of a node that is already safely gone. The walk root is
          exempt: a detached IN_PLACE root is legitimate input and must still
          be fully sanitized, and a kill-decision on it must keep hitting the
-         REPORT-3 throw. Nodes detached by hooks are the hook's
-         responsibility: they are not recorded in DOMPurify.removed and are
-         not neutralized by the post-walk IN_PLACE pass. */
+         REPORT-3 throw. Nodes detached by hooks stay the hook's
+         responsibility for placement: they are not recorded in
+         DOMPurify.removed, so the post-walk IN_PLACE pass (which iterates
+         DOMPurify.removed) does not reach them. But a hook-detached subtree
+         can still hold a queued resource-event handler - e.g. an <img onload>
+         that began loading when the caller built the live tree - which fires
+         in page scope after sanitize returns even though the handler never
+         reached the returned tree. That is the audit-5 F1 hazard, and the
+         documented node.remove() hook pattern walks straight into it. So on
+         the IN_PLACE path we neutralize the detached subtree inline here,
+         stripping its non-allow-listed attributes before returning, exactly
+         as the post-walk pass does for _forceRemove'd subtrees. */
       if (currentNode !== root && getParentNode(currentNode) === null) {
+        if (IN_PLACE) {
+          _neutralizeSubtree(currentNode);
+        }
         return true;
       }
       /* Remove mXSS vectors, processing instructions and risky comments */
@@ -76914,7 +76971,7 @@ var purify = createCommonjsModule(function (module, exports) {
       }
       /* Remove element if anything forbids its presence */
       if (FORBID_TAGS[tagName] || !(EXTRA_ELEMENT_HANDLING.tagCheck instanceof Function && EXTRA_ELEMENT_HANDLING.tagCheck(tagName)) && !ALLOWED_TAGS[tagName]) {
-        const removed = _sanitizeDisallowedNode(currentNode, tagName);
+        const removed = _sanitizeDisallowedNode(currentNode, tagName, root);
         /* A false return means the node is a custom element kept via
            CUSTOM_ELEMENT_HANDLING - the only keep path through
            _sanitizeDisallowedNode. Run afterSanitizeElements on it so the
@@ -77119,6 +77176,9 @@ var purify = createCommonjsModule(function (module, exports) {
       if (!attributes || _isClobbered(currentNode)) {
         return;
       }
+      /* Same lazy-install guard as uponSanitizeElement (see there): fork the
+         attribute allowlist off its shared binding before a hook can see it. */
+      ALLOWED_ATTR = _forkSharedAllowlist(hooks.uponSanitizeAttribute, ALLOWED_ATTR, DEFAULT_ALLOWED_ATTR, SET_CONFIG_ALLOWED_ATTR);
       const hookEvent = {
         attrName: '',
         attrValue: '',
@@ -77491,17 +77551,20 @@ var purify = createCommonjsModule(function (module, exports) {
       }
       /* Get node iterator */
       const walkRoot = inPlace ? dirty : body;
-      const nodeIterator = _createNodeIterator(walkRoot);
       /* Now start iterating over the created document.
          The walk runs inside an exception barrier (campaign-3 F2): a re-entrant
          engine/custom-element mutation can detach a node mid-walk so
          `_forceRemove`'s parentless guard throws, aborting the loop. Without the
          barrier the caller's in-place tree would be left half-sanitized with the
-         unvisited tail still armed. On any throw we fail closed — strip the
-         in-place root bare — then rethrow so the existing throw contract is
-         preserved. (String/DOM-copy paths never return the partial body, so the
-         propagating throw is already fail-closed there.) */
+         unvisited tail still armed. _createNodeIterator itself is inside the
+         barrier too: constructing the iterator dereferences the root's document,
+         and any failure there (e.g. an exotic/clobbered root) must still fail
+         closed rather than skip the neutralize. On any throw we fail closed -
+         strip the in-place root bare - then rethrow so the existing throw
+         contract is preserved. (String/DOM-copy paths never return the partial
+         body, so the propagating throw is already fail-closed there.) */
       try {
+        const nodeIterator = _createNodeIterator(walkRoot);
         while (currentNode = nodeIterator.nextNode()) {
           /* Sanitize tags and elements */
           _sanitizeElements(currentNode, walkRoot);
@@ -78855,9 +78918,31 @@ class AgGridController {
       }
       info['isUserChange'] = isUserChange;
       info['isElementResize'] = this.isElementResize(e);
+      if (type === 'columnMovedEnd' && isUserChange) {
+        this.syncCachedConfigOrderWithLiveOrder();
+      }
       this._columnStateChangeCallback(type, this.getColumnsState(), info);
     }
   }
+  syncCachedConfigOrderWithLiveOrder() {
+    var _a, _b, _c;
+    if (!this._lastColsConfig) {
+      return;
+    }
+    const liveState = (_c = (_b = (_a = this._gridOptions) === null || _a === void 0 ? void 0 : _a.columnApi) === null || _b === void 0 ? void 0 : _b.getColumnState()) !== null && _c !== void 0 ? _c : [];
+    if (liveState.length === 0) {
+      return;
+    }
+    const liveOrderByName = liveState.reduce((map, col, index) => {
+      map[col.colId] = index;
+      return map;
+    }, {});
+    const reorderByLiveOrder = (config) => [...config].sort((a, b) => { var _a, _b; return ((_a = liveOrderByName[a.name]) !== null && _a !== void 0 ? _a : Number.MAX_VALUE) - ((_b = liveOrderByName[b.name]) !== null && _b !== void 0 ? _b : Number.MAX_VALUE); });
+    this._lastColsConfig = reorderByLiveOrder(this._lastColsConfig);
+    if (this._gridConfig) {
+      this._gridConfig = reorderByLiveOrder(this._gridConfig);
+    }
+  }
   onCellClicked(event) {
     this._editionManager.verifyClickToEdition(event.api, {
       rowIndex: event.rowIndex,

package/dist/esm/ez-actions-button.entry.js

@@ -1,4 +1,4 @@
-import { r as registerInstance, c as createEvent, h, H as Host, g as getElement } from './index-5a720e56.js';
+import { r as registerInstance, c as createEvent, h, H as Host, g as getElement } from './index-baa5e267.js';
 import { FloatingManager, ElementIDUtils } from '@sankhyalabs/core';
 import './ApplicationUtils-1569f757.js';
 import { C as CSSVarsUtils } from './CSSVarsUtils-acba92d7.js';

package/dist/esm/ez-alert-list.entry.js

@@ -1,4 +1,4 @@
-import { r as registerInstance, h, H as Host, g as getElement } from './index-5a720e56.js';
+import { r as registerInstance, h, H as Host, g as getElement } from './index-baa5e267.js';
 import { FloatingManager, ElementIDUtils } from '@sankhyalabs/core';
 import { i as initI18n } from './index-41363fa6.js';