@selwise/widget 0.0.1

package/dist/npm/cjs/types/index.js

@@ -0,0 +1,27 @@
+"use strict";
+/**
+ * Central Type Exports
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// Re-export all types
+__exportStar(require("./config"), exports);
+__exportStar(require("./experiments"), exports);
+__exportStar(require("./renderer"), exports);
+__exportStar(require("./recommendation"), exports);
+__exportStar(require("./search"), exports);
+__exportStar(require("./global-api"), exports);
+//# sourceMappingURL=index.js.map

package/dist/npm/cjs/types/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/types/index.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;AAEH,sBAAsB;AACtB,2CAAyB;AACzB,gDAA8B;AAC9B,6CAA2B;AAC3B,mDAAiC;AACjC,2CAAyB;AACzB,+CAA6B"}

package/dist/npm/cjs/types/recommendation.js

@@ -0,0 +1,6 @@
+"use strict";
+/**
+ * Recommendation Module Type Definitions
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=recommendation.js.map

package/dist/npm/cjs/types/recommendation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recommendation.js","sourceRoot":"","sources":["../../../../src/types/recommendation.ts"],"names":[],"mappings":";AAAA;;GAEG"}

package/dist/npm/cjs/types/renderer.js

@@ -0,0 +1,6 @@
+"use strict";
+/**
+ * Renderer Type Definitions
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=renderer.js.map

package/dist/npm/cjs/types/renderer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"renderer.js","sourceRoot":"","sources":["../../../../src/types/renderer.ts"],"names":[],"mappings":";AAAA;;GAEG"}

package/dist/npm/cjs/types/search.js

@@ -0,0 +1,6 @@
+"use strict";
+/**
+ * Search Module Type Definitions
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=search.js.map

package/dist/npm/cjs/types/search.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"search.js","sourceRoot":"","sources":["../../../../src/types/search.ts"],"names":[],"mappings":";AAAA;;GAEG"}

package/dist/npm/cjs/utils/api-url.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveApiUrl = resolveApiUrl;
+const DEFAULT_API_BASE_URL = 'https://api.selwise.com';
+const API_VERSION_PREFIX = '/api/v1';
+function sanitize(value) {
+    if (!value)
+        return null;
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : null;
+}
+function normalizePath(pathname) {
+    const basePath = pathname.replace(/\/+$/, '');
+    if (!basePath || basePath === '/') {
+        return API_VERSION_PREFIX;
+    }
+    if (basePath === API_VERSION_PREFIX || basePath.endsWith(API_VERSION_PREFIX)) {
+        return basePath;
+    }
+    return `${basePath}${API_VERSION_PREFIX}`;
+}
+function resolveApiUrl(input) {
+    const envUrl = typeof process !== 'undefined' ? sanitize(process.env?.NEXT_PUBLIC_API_URL) : null;
+    const inputUrl = sanitize(input);
+    const selected = envUrl || inputUrl || DEFAULT_API_BASE_URL;
+    try {
+        const url = new URL(selected);
+        const pathname = normalizePath(url.pathname || '/');
+        return `${url.origin}${pathname}`;
+    }
+    catch {
+        return `${DEFAULT_API_BASE_URL}${API_VERSION_PREFIX}`;
+    }
+}
+//# sourceMappingURL=api-url.js.map

package/dist/npm/cjs/utils/api-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-url.js","sourceRoot":"","sources":["../../../../src/utils/api-url.ts"],"names":[],"mappings":";;AAuBA,sCAYC;AAnCD,MAAM,oBAAoB,GAAG,yBAAyB,CAAC;AACvD,MAAM,kBAAkB,GAAG,SAAS,CAAC;AAErC,SAAS,QAAQ,CAAC,KAAqB;IACrC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAE9C,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;QAClC,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IAED,IAAI,QAAQ,KAAK,kBAAkB,IAAI,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC7E,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO,GAAG,QAAQ,GAAG,kBAAkB,EAAE,CAAC;AAC5C,CAAC;AAED,SAAgB,aAAa,CAAC,KAAqB;IACjD,MAAM,MAAM,GAAG,OAAO,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClG,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,QAAQ,IAAI,oBAAoB,CAAC;IAE5D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC;QACpD,OAAO,GAAG,GAAG,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,oBAAoB,GAAG,kBAAkB,EAAE,CAAC;IACxD,CAAC;AACH,CAAC"}

package/dist/npm/cjs/utils/debounce.js

@@ -0,0 +1,74 @@
+"use strict";
+/**
+ * Debounce Utility
+ * Prevents a function from being called too frequently
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.debounce = debounce;
+exports.throttle = throttle;
+/**
+ * Creates a debounced version of a function that delays invoking func
+ * until after `wait` milliseconds have elapsed since the last time the
+ * debounced function was invoked.
+ *
+ * @param func The function to debounce
+ * @param wait The number of milliseconds to delay
+ * @returns Debounced function with cancel method
+ */
+function debounce(func, wait) {
+    let timeoutId = null;
+    const debounced = function (...args) {
+        if (timeoutId !== null) {
+            clearTimeout(timeoutId);
+        }
+        timeoutId = setTimeout(() => {
+            timeoutId = null;
+            func.apply(this, args);
+        }, wait);
+    };
+    debounced.cancel = () => {
+        if (timeoutId !== null) {
+            clearTimeout(timeoutId);
+            timeoutId = null;
+        }
+    };
+    return debounced;
+}
+/**
+ * Creates a throttled version of a function that only invokes func
+ * at most once per every `wait` milliseconds.
+ *
+ * @param func The function to throttle
+ * @param wait The number of milliseconds to throttle
+ * @returns Throttled function with cancel method
+ */
+function throttle(func, wait) {
+    let timeoutId = null;
+    let lastArgs = null;
+    let lastThis = null;
+    const throttled = function (...args) {
+        lastArgs = args;
+        lastThis = this;
+        if (timeoutId === null) {
+            func.apply(lastThis, lastArgs);
+            lastArgs = null;
+            lastThis = null;
+            timeoutId = setTimeout(() => {
+                timeoutId = null;
+                if (lastArgs !== null) {
+                    throttled.apply(lastThis, lastArgs);
+                }
+            }, wait);
+        }
+    };
+    throttled.cancel = () => {
+        if (timeoutId !== null) {
+            clearTimeout(timeoutId);
+            timeoutId = null;
+        }
+        lastArgs = null;
+        lastThis = null;
+    };
+    return throttled;
+}
+//# sourceMappingURL=debounce.js.map

package/dist/npm/cjs/utils/debounce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"debounce.js","sourceRoot":"","sources":["../../../../src/utils/debounce.ts"],"names":[],"mappings":";AAAA;;;GAGG;;AAWH,4BAwBC;AAUD,4BAoCC;AA/ED;;;;;;;;GAQG;AACH,SAAgB,QAAQ,CACtB,IAAO,EACP,IAAY;IAEZ,IAAI,SAAS,GAAyC,IAAI,CAAC;IAE3D,MAAM,SAAS,GAAG,UAAqB,GAAG,IAAmB;QAC3D,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,YAAY,CAAC,SAAS,CAAC,CAAC;QAC1B,CAAC;QACD,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;YAC1B,SAAS,GAAG,IAAI,CAAC;YACjB,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzB,CAAC,EAAE,IAAI,CAAC,CAAC;IACX,CAA+B,CAAC;IAEhC,SAAS,CAAC,MAAM,GAAG,GAAG,EAAE;QACtB,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,YAAY,CAAC,SAAS,CAAC,CAAC;YACxB,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;IAEF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,QAAQ,CACtB,IAAO,EACP,IAAY;IAEZ,IAAI,SAAS,GAAyC,IAAI,CAAC;IAC3D,IAAI,QAAQ,GAAyB,IAAI,CAAC;IAC1C,IAAI,QAAQ,GAAQ,IAAI,CAAC;IAEzB,MAAM,SAAS,GAAG,UAAqB,GAAG,IAAmB;QAC3D,QAAQ,GAAG,IAAI,CAAC;QAChB,QAAQ,GAAG,IAAI,CAAC;QAEhB,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC/B,QAAQ,GAAG,IAAI,CAAC;YAChB,QAAQ,GAAG,IAAI,CAAC;YAEhB,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC1B,SAAS,GAAG,IAAI,CAAC;gBACjB,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;oBACtB,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC,EAAE,IAAI,CAAC,CAAC;QACX,CAAC;IACH,CAA+B,CAAC;IAEhC,SAAS,CAAC,MAAM,GAAG,GAAG,EAAE;QACtB,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,YAAY,CAAC,SAAS,CAAC,CAAC;YACxB,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;QACD,QAAQ,GAAG,IAAI,CAAC;QAChB,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/npm/cjs/utils/event-id.js

@@ -0,0 +1,23 @@
+"use strict";
+/**
+ * Event ID Generation Utility
+ * Uses cryptographically secure random generation
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateEventId = generateEventId;
+function generateEventId() {
+    const timestamp = Date.now().toString(36);
+    // Use crypto.getRandomValues for secure randomness
+    if (typeof crypto !== 'undefined' && typeof crypto.getRandomValues === 'function') {
+        const array = new Uint8Array(8);
+        crypto.getRandomValues(array);
+        const random = Array.from(array)
+            .map(b => b.toString(16).padStart(2, '0'))
+            .join('');
+        return `eid_${timestamp}_${random}`;
+    }
+    // Fallback (should rarely be needed)
+    const random = Math.random().toString(36).substring(2, 10);
+    return `eid_${timestamp}_${random}`;
+}
+//# sourceMappingURL=event-id.js.map

package/dist/npm/cjs/utils/event-id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-id.js","sourceRoot":"","sources":["../../../../src/utils/event-id.ts"],"names":[],"mappings":";AAAA;;;GAGG;;AAEH,0CAgBC;AAhBD,SAAgB,eAAe;IAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAE1C,mDAAmD;IACnD,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,OAAO,MAAM,CAAC,eAAe,KAAK,UAAU,EAAE,CAAC;QAClF,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;aAC7B,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aACzC,IAAI,CAAC,EAAE,CAAC,CAAC;QACZ,OAAO,OAAO,SAAS,IAAI,MAAM,EAAE,CAAC;IACtC,CAAC;IAED,qCAAqC;IACrC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3D,OAAO,OAAO,SAAS,IAAI,MAAM,EAAE,CAAC;AACtC,CAAC"}

package/dist/npm/cjs/utils/index.js

@@ -0,0 +1,28 @@
+"use strict";
+/**
+ * Central Utility Exports
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./url-matcher"), exports);
+__exportStar(require("./storage"), exports);
+__exportStar(require("./event-id"), exports);
+__exportStar(require("./sanitize"), exports);
+__exportStar(require("./debounce"), exports);
+__exportStar(require("./logger"), exports);
+__exportStar(require("./api-url"), exports);
+__exportStar(require("./tracking-metadata"), exports);
+//# sourceMappingURL=index.js.map

package/dist/npm/cjs/utils/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/utils/index.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;AAEH,gDAA8B;AAC9B,4CAA0B;AAC1B,6CAA2B;AAC3B,6CAA2B;AAC3B,6CAA2B;AAC3B,2CAAyB;AACzB,4CAA0B;AAC1B,sDAAoC"}

package/dist/npm/cjs/utils/logger.js

@@ -0,0 +1,74 @@
+"use strict";
+/**
+ * Test Mode Logger Utility
+ *
+ * Centralized logging that respects test mode and debug mode configuration.
+ * Debug/info logs show when:
+ * 1. Test mode is enabled (selwise_test_mode = 'true')
+ * 2. Debug mode is enabled (selwise_debug = 'true')
+ * 3. Global debug mode is set from server config
+ * Error and warning logs always show (important for production debugging).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.testModeWarn = exports.testModeError = exports.testModeDebug = exports.testModeLog = void 0;
+exports.setDebugMode = setDebugMode;
+// Global debug mode flag - can be set by server config
+let globalDebugMode = false;
+/**
+ * Enable or disable global debug mode
+ * This is set by the tracking config from server
+ */
+function setDebugMode(enabled) {
+    globalDebugMode = enabled;
+}
+/**
+ * Check if any form of debug logging is enabled
+ * - Test mode (localStorage)
+ * - Debug mode (localStorage)
+ * - Global debug mode (from server config)
+ */
+function isDebugLoggingEnabled() {
+    if (typeof localStorage === 'undefined')
+        return false;
+    try {
+        return (globalDebugMode ||
+            localStorage.getItem('selwise_test_mode') === 'true' ||
+            localStorage.getItem('selwise_debug') === 'true');
+    }
+    catch {
+        return globalDebugMode;
+    }
+}
+/**
+ * Log informational messages - only when debug mode is enabled
+ */
+const testModeLog = (prefix, ...args) => {
+    if (isDebugLoggingEnabled()) {
+        console.log(`[${prefix}]`, ...args);
+    }
+};
+exports.testModeLog = testModeLog;
+/**
+ * Log debug messages - only when debug mode is enabled
+ */
+const testModeDebug = (prefix, ...args) => {
+    if (isDebugLoggingEnabled()) {
+        console.debug(`[${prefix}]`, ...args);
+    }
+};
+exports.testModeDebug = testModeDebug;
+/**
+ * Log errors - always shows (important for production debugging)
+ */
+const testModeError = (prefix, ...args) => {
+    console.error(`[${prefix}]`, ...args);
+};
+exports.testModeError = testModeError;
+/**
+ * Log warnings - always shows (important for production debugging)
+ */
+const testModeWarn = (prefix, ...args) => {
+    console.warn(`[${prefix}]`, ...args);
+};
+exports.testModeWarn = testModeWarn;
+//# sourceMappingURL=logger.js.map

package/dist/npm/cjs/utils/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../../../src/utils/logger.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AASH,oCAEC;AATD,uDAAuD;AACvD,IAAI,eAAe,GAAG,KAAK,CAAC;AAE5B;;;GAGG;AACH,SAAgB,YAAY,CAAC,OAAgB;IAC3C,eAAe,GAAG,OAAO,CAAC;AAC5B,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB;IAC5B,IAAI,OAAO,YAAY,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC;IACtD,IAAI,CAAC;QACH,OAAO,CACL,eAAe;YACf,YAAY,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,MAAM;YACpD,YAAY,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,MAAM,CACjD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,eAAe,CAAC;IACzB,CAAC;AACH,CAAC;AAED;;GAEG;AACI,MAAM,WAAW,GAAG,CAAC,MAAc,EAAE,GAAG,IAAW,EAAQ,EAAE;IAClE,IAAI,qBAAqB,EAAE,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACtC,CAAC;AACH,CAAC,CAAC;AAJW,QAAA,WAAW,eAItB;AAEF;;GAEG;AACI,MAAM,aAAa,GAAG,CAAC,MAAc,EAAE,GAAG,IAAW,EAAQ,EAAE;IACpE,IAAI,qBAAqB,EAAE,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CAAC,IAAI,MAAM,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACxC,CAAC;AACH,CAAC,CAAC;AAJW,QAAA,aAAa,iBAIxB;AAEF;;GAEG;AACI,MAAM,aAAa,GAAG,CAAC,MAAc,EAAE,GAAG,IAAW,EAAQ,EAAE;IACpE,OAAO,CAAC,KAAK,CAAC,IAAI,MAAM,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AACxC,CAAC,CAAC;AAFW,QAAA,aAAa,iBAExB;AAEF;;GAEG;AACI,MAAM,YAAY,GAAG,CAAC,MAAc,EAAE,GAAG,IAAW,EAAQ,EAAE;IACnE,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AACvC,CAAC,CAAC;AAFW,QAAA,YAAY,gBAEvB"}

package/dist/npm/cjs/utils/sanitize.js

@@ -0,0 +1,159 @@
+"use strict";
+/**
+ * HTML Sanitization Utilities
+ * Provides XSS protection for innerHTML operations
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DOMPurify = void 0;
+exports.sanitizeHTML = sanitizeHTML;
+exports.sanitizeHTMLStrict = sanitizeHTMLStrict;
+exports.sanitizeProductHTML = sanitizeProductHTML;
+exports.sanitizeWidgetHTML = sanitizeWidgetHTML;
+exports.sanitizeCSS = sanitizeCSS;
+exports.setInnerHTMLSafe = setInnerHTMLSafe;
+const dompurify_1 = __importDefault(require("dompurify"));
+exports.DOMPurify = dompurify_1.default;
+/**
+ * Default DOMPurify configuration
+ * Allows safe HTML elements and attributes while blocking dangerous ones
+ */
+const DEFAULT_CONFIG = {
+    ALLOWED_TAGS: [
+        // Structure
+        'div', 'span', 'p', 'section', 'article', 'header', 'footer', 'main', 'nav', 'aside',
+        // Text
+        'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'strong', 'em', 'b', 'i', 'u', 's', 'small', 'mark',
+        'sub', 'sup', 'br', 'hr',
+        // Lists
+        'ul', 'ol', 'li', 'dl', 'dt', 'dd',
+        // Links & Media
+        'a', 'img', 'picture', 'source', 'figure', 'figcaption', 'video', 'audio',
+        // Tables
+        'table', 'thead', 'tbody', 'tfoot', 'tr', 'th', 'td', 'caption', 'colgroup', 'col',
+        // Forms (display only, not interactive)
+        'form', 'input', 'button', 'select', 'option', 'optgroup', 'textarea', 'label', 'fieldset', 'legend',
+        // Other
+        'blockquote', 'pre', 'code', 'kbd', 'samp', 'var', 'time', 'address', 'abbr', 'cite', 'q',
+        // SVG basics
+        'svg', 'path', 'circle', 'rect', 'line', 'polyline', 'polygon', 'ellipse', 'g', 'text', 'tspan', 'defs', 'use',
+        // Style (will be sanitized separately)
+        'style',
+    ],
+    ALLOWED_ATTR: [
+        // Global
+        'id', 'class', 'style', 'title', 'lang', 'dir', 'hidden', 'tabindex', 'role',
+        'aria-label', 'aria-labelledby', 'aria-describedby', 'aria-hidden', 'aria-live',
+        'aria-atomic', 'aria-busy', 'aria-controls', 'aria-current', 'aria-disabled',
+        'aria-expanded', 'aria-haspopup', 'aria-invalid', 'aria-pressed', 'aria-selected',
+        // Data attributes
+        'data-*',
+        // Links
+        'href', 'target', 'rel', 'download',
+        // Media
+        'src', 'srcset', 'sizes', 'alt', 'width', 'height', 'loading', 'decoding',
+        'poster', 'controls', 'autoplay', 'loop', 'muted', 'playsinline', 'preload',
+        // Forms
+        'type', 'name', 'value', 'placeholder', 'disabled', 'readonly', 'required',
+        'checked', 'selected', 'multiple', 'min', 'max', 'step', 'pattern', 'maxlength', 'minlength',
+        'for', 'form', 'autocomplete', 'autofocus',
+        // Tables
+        'colspan', 'rowspan', 'scope', 'headers',
+        // SVG
+        'viewBox', 'xmlns', 'fill', 'stroke', 'stroke-width', 'stroke-linecap', 'stroke-linejoin',
+        'd', 'cx', 'cy', 'r', 'rx', 'ry', 'x', 'y', 'x1', 'y1', 'x2', 'y2', 'points',
+        'transform', 'opacity', 'fill-opacity', 'stroke-opacity',
+    ],
+    // Block dangerous protocols
+    ALLOWED_URI_REGEXP: /^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp|xxx):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i,
+    // Keep safe URLs
+    ADD_URI_SAFE_ATTR: ['href', 'src', 'srcset'],
+    // Remove dangerous tags completely (don't just strip)
+    FORBID_TAGS: ['script', 'iframe', 'object', 'embed', 'base', 'meta', 'link'],
+    FORBID_ATTR: ['onerror', 'onload', 'onclick', 'onmouseover', 'onfocus', 'onblur', 'onchange', 'onsubmit', 'onkeydown', 'onkeyup', 'onkeypress'],
+};
+/**
+ * Sanitize HTML string to prevent XSS attacks
+ * @param dirty - Untrusted HTML string
+ * @param config - Optional DOMPurify configuration override
+ * @returns Sanitized HTML string safe for innerHTML
+ */
+function sanitizeHTML(dirty, config) {
+    if (!dirty)
+        return '';
+    const finalConfig = config ? { ...DEFAULT_CONFIG, ...config } : DEFAULT_CONFIG;
+    return dompurify_1.default.sanitize(dirty, finalConfig);
+}
+/**
+ * Strict sanitization - allows only basic formatting tags
+ * Use for user-generated content like comments or descriptions
+ */
+function sanitizeHTMLStrict(dirty) {
+    if (!dirty)
+        return '';
+    return dompurify_1.default.sanitize(dirty, {
+        ALLOWED_TAGS: ['b', 'i', 'em', 'strong', 'u', 's', 'p', 'br', 'span', 'div', 'a', 'ul', 'ol', 'li'],
+        ALLOWED_ATTR: ['href', 'target', 'rel', 'class', 'style'],
+        ALLOW_DATA_ATTR: false,
+    });
+}
+/**
+ * Sanitize for product cards - allows images and basic structure
+ */
+function sanitizeProductHTML(dirty) {
+    if (!dirty)
+        return '';
+    return dompurify_1.default.sanitize(dirty, {
+        ...DEFAULT_CONFIG,
+        // Ensure images and product-related elements are allowed
+        ADD_TAGS: ['img', 'picture', 'source'],
+        ADD_ATTR: ['loading', 'decoding', 'srcset', 'sizes', 'data-product-id', 'data-action'],
+    });
+}
+/**
+ * Sanitize for widget custom HTML - more permissive but still safe
+ */
+function sanitizeWidgetHTML(dirty) {
+    if (!dirty)
+        return '';
+    return dompurify_1.default.sanitize(dirty, {
+        ...DEFAULT_CONFIG,
+        // Allow more styling options for custom widgets
+        ADD_TAGS: ['style'],
+        // Still block event handlers
+        FORBID_ATTR: ['onerror', 'onload', 'onclick', 'onmouseover', 'onfocus', 'onblur'],
+    });
+}
+/**
+ * Sanitize CSS to prevent CSS injection attacks
+ * Removes potentially dangerous CSS like expressions, behaviors, and URLs to external resources
+ */
+function sanitizeCSS(css) {
+    if (!css)
+        return '';
+    // Remove CSS expressions (IE-specific but still good to block)
+    let safe = css.replace(/expression\s*\([^)]*\)/gi, '');
+    // Remove behavior (IE-specific)
+    safe = safe.replace(/behavior\s*:\s*[^;]*/gi, '');
+    // Remove -moz-binding (Firefox-specific, deprecated but block anyway)
+    safe = safe.replace(/-moz-binding\s*:\s*[^;]*/gi, '');
+    // Remove javascript: URLs in CSS
+    safe = safe.replace(/javascript\s*:/gi, '');
+    // Remove data: URLs (can contain scripts)
+    safe = safe.replace(/data\s*:/gi, '');
+    // Remove @import to prevent external CSS loading
+    safe = safe.replace(/@import\s+[^;]*/gi, '');
+    return safe;
+}
+/**
+ * Set innerHTML safely with sanitization
+ * @param element - Target DOM element
+ * @param html - HTML string to set
+ * @param sanitizer - Sanitization function to use (defaults to sanitizeHTML)
+ */
+function setInnerHTMLSafe(element, html, sanitizer = sanitizeHTML) {
+    element.innerHTML = sanitizer(html);
+}
+//# sourceMappingURL=sanitize.js.map

package/dist/npm/cjs/utils/sanitize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../../../../src/utils/sanitize.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;;;AAqEH,oCAKC;AAMD,gDAQC;AAKD,kDASC;AAKD,gDAUC;AAMD,kCAsBC;AAQD,4CAMC;AA7JD,0DAAkC;AAgKzB,oBAhKF,mBAAS,CAgKE;AA9JlB;;;GAGG;AACH,MAAM,cAAc,GAAqB;IACvC,YAAY,EAAE;QACZ,YAAY;QACZ,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO;QACpF,OAAO;QACP,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM;QACvF,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI;QACxB,QAAQ;QACR,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;QAClC,gBAAgB;QAChB,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO;QACzE,SAAS;QACT,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK;QAClF,wCAAwC;QACxC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ;QACpG,QAAQ;QACR,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG;QACzF,aAAa;QACb,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;QAC9G,uCAAuC;QACvC,OAAO;KACR;IACD,YAAY,EAAE;QACZ,SAAS;QACT,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM;QAC5E,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,aAAa,EAAE,WAAW;QAC/E,aAAa,EAAE,WAAW,EAAE,eAAe,EAAE,cAAc,EAAE,eAAe;QAC5E,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe;QACjF,kBAAkB;QAClB,QAAQ;QACR,QAAQ;QACR,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU;QACnC,QAAQ;QACR,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU;QACzE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS;QAC3E,QAAQ;QACR,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;QAC1E,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW;QAC5F,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,WAAW;QAC1C,SAAS;QACT,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS;QACxC,MAAM;QACN,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,gBAAgB,EAAE,iBAAiB;QACzF,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ;QAC5E,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,gBAAgB;KACzD;IACD,4BAA4B;IAC5B,kBAAkB,EAAE,+FAA+F;IACnH,iBAAiB;IACjB,iBAAiB,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC;IAC5C,sDAAsD;IACtD,WAAW,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;IAC5E,WAAW,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,CAAC;CAChJ,CAAC;AAEF;;;;;GAKG;AACH,SAAgB,YAAY,CAAC,KAAa,EAAE,MAAyB;IACnE,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IAEtB,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,cAAc,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC;IAC/E,OAAO,mBAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,SAAgB,kBAAkB,CAAC,KAAa;IAC9C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IAEtB,OAAO,mBAAS,CAAC,QAAQ,CAAC,KAAK,EAAE;QAC/B,YAAY,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QACnG,YAAY,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC;QACzD,eAAe,EAAE,KAAK;KACvB,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAgB,mBAAmB,CAAC,KAAa;IAC/C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IAEtB,OAAO,mBAAS,CAAC,QAAQ,CAAC,KAAK,EAAE;QAC/B,GAAG,cAAc;QACjB,yDAAyD;QACzD,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,CAAC;QACtC,QAAQ,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,EAAE,aAAa,CAAC;KACvF,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAgB,kBAAkB,CAAC,KAAa;IAC9C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IAEtB,OAAO,mBAAS,CAAC,QAAQ,CAAC,KAAK,EAAE;QAC/B,GAAG,cAAc;QACjB,gDAAgD;QAChD,QAAQ,EAAE,CAAC,OAAO,CAAC;QACnB,6BAA6B;QAC7B,WAAW,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,QAAQ,CAAC;KAClF,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAgB,WAAW,CAAC,GAAW;IACrC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IAEpB,+DAA+D;IAC/D,IAAI,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,0BAA0B,EAAE,EAAE,CAAC,CAAC;IAEvD,gCAAgC;IAChC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;IAElD,sEAAsE;IACtE,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,4BAA4B,EAAE,EAAE,CAAC,CAAC;IAEtD,iCAAiC;IACjC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAE5C,0CAA0C;IAC1C,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAEtC,iDAAiD;IACjD,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;IAE7C,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAgB,gBAAgB,CAC9B,OAAoB,EACpB,IAAY,EACZ,YAAsC,YAAY;IAElD,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC"}