handsontable 18.0.0 → 18.1.0-rc7

package/utils/licenseBranding/lockScreen.mjs

@@ -0,0 +1,159 @@
+import { html } from '../../helpers/templateLiteralTag.mjs';
+// The lock reuses the confirm Dialog's CSS by wearing its class names. The stylesheet ships in full
+// regardless of which JS plugins are bundled, so borrowing the classes inherits the dialog's whole
+// look and sizing for free - while the JS below is a minimal, self-contained copy that never
+// imports the (optional) Dialog plugin. Keep these names in sync with `plugins/dialog/constants.ts`
+// and the confirm template.
+const DIALOG_CLASS = 'ht-dialog';
+const LOCK_CLASS = 'ht-license-lock';
+const SCOPE_ID = 'licenseLock';
+const SHORTCUTS_CONTEXT_NAME = `plugin:${SCOPE_ID}`;
+const SHORTCUTS_GROUP = SCOPE_ID;
+/**
+ * Mounts the license lock screen: a blocking, non-dismissable overlay covering the grid.
+ * It looks and sizes itself exactly like a confirm Dialog by wearing the dialog's own CSS class
+ * names (the stylesheet is always shipped in full, so the styling is inherited without duplicating
+ * it), but it is a self-contained Core-owned element - it never touches the Dialog PLUGIN, which is
+ * optional (it may be absent from a bundle) and, being a single shared surface an app uses for its
+ * own dialogs, could not tell its own lifecycle apart from the lock's. This lock owns its element,
+ * so showing it is unambiguous.
+ *
+ * Only the copy and behavior differ from a confirm dialog: it cannot be dismissed (no Close button,
+ * no Escape shortcut - the hard stop is final), and it sits above app dialogs. Its width is pinned
+ * to the table's workspace width on every render (the `.ht-dialog` box is otherwise `width: 100%`,
+ * which would span the whole root wrapper, not the grid - a minimal copy of the plugin's own
+ * sizing); its height is the grid box. It integrates with the focus manager as a modal scope and
+ * routes its Tab focus trap through the shortcut manager, exactly like the Dialog plugin.
+ *
+ * @param {HotInstance} hotInstance The root Handsontable instance.
+ * @param {LockContent} content The lock copy.
+ * @returns {void}
+ */ export function mountLicenseLock(hotInstance, content) {
+    const host = hotInstance.rootOverlaysElement;
+    if (!host) {
+        return;
+    }
+    const focusScopeManager = hotInstance.getFocusScopeManager();
+    const shortcutManager = hotInstance.getShortcutManager();
+    const isRtl = hotInstance.isRtl();
+    const titleId = `${hotInstance.guid}-license-lock-title`;
+    const descriptionId = `${hotInstance.guid}-license-lock-description`;
+    // The exact class set the plugin's confirm dialog carries when shown, plus `ht-license-lock`.
+    const lockClassName = `${DIALOG_CLASS} ${DIALOG_CLASS}--confirm handsontable ${LOCK_CLASS} ` + `${DIALOG_CLASS}--background-solid ${DIALOG_CLASS}--show`;
+    // The confirm-dialog DOM, rebuilt with the dialog's class names (`ht-dialog--confirm`,
+    // `__content-wrapper`, `__content`, `__title`, `__description`, `__buttons`, `ht-button`) plus the
+    // `handsontable` class the dialog carries (the `.ht-button` base rules are scoped under it). The
+    // copy is assigned through `textContent` below, never interpolated into the markup.
+    const { refs } = html`
+    <div data-ref="lock" class="${lockClassName}"
+      role="alertdialog" aria-modal="true"
+      aria-labelledby="${titleId}" aria-describedby="${descriptionId}"
+      tabindex="-1" dir="${isRtl ? 'rtl' : 'ltr'}" style="display: block;">
+      <div class="${DIALOG_CLASS}__content-wrapper">
+        <div data-ref="inner" tabindex="-1" class="${DIALOG_CLASS}__content-wrapper-inner">
+          <div class="${DIALOG_CLASS}__content">
+            <h2 data-ref="title" id="${titleId}" class="${DIALOG_CLASS}__title"></h2>
+            <p data-ref="description" id="${descriptionId}" class="${DIALOG_CLASS}__description"></p>
+          </div>
+          <div class="${DIALOG_CLASS}__buttons">
+            <a data-ref="contactButton" class="ht-button ht-button--secondary" rel="noopener"></a>
+          </div>
+        </div>
+      </div>
+    </div>
+  `;
+    const lock = refs.lock;
+    refs.title.textContent = content.title;
+    refs.description.textContent = content.description;
+    // A real ANCHOR wearing the button classes, not a button with a click handler. The action is a
+    // `mailto:` address, and neither scripted route is safe for one: `window.open(..., '_blank')`
+    // leaves an empty tab behind on Firefox and Safari once the mail client takes over, and assigning
+    // `location.href` is treated as a real navigation by several browsers when no mail handler is
+    // registered - which would unload the app, or the iframe, from under a lock that cannot be
+    // dismissed. A same-window anchor click is the one path browsers special-case, and it is what the
+    // bottom bar and the badge popover already use for the same addresses.
+    refs.contactButton.textContent = content.action.text;
+    // `setAttribute`, because the template's refs are plain `HTMLElement`s - no cast needed for one
+    // attribute.
+    refs.contactButton.setAttribute('href', content.action.href);
+    // Built as nodes, never interpolated: the copy is authored here, but keeping it out of `innerHTML`
+    // means no license sentence can ever become markup. The anchor joins the Tab trap for free -
+    // `getFocusableControls` below collects `a[href]` too.
+    if (content.docsLink) {
+        const link = hotInstance.rootDocument.createElement('a');
+        link.href = content.docsLink.href;
+        link.target = '_blank';
+        link.rel = 'noopener';
+        link.textContent = content.docsLink.text;
+        refs.description.appendChild(link);
+        refs.description.appendChild(hotInstance.rootDocument.createTextNode(content.docsLink.trailingText));
+    }
+    // Collects the action anchor and the optional documentation link, in document order.
+    const getFocusableControls = ()=>Array.from(lock.querySelectorAll('a[href], button'));
+    // Match the dialog's sizing: the `.ht-dialog` box is `width: 100%` of the root wrapper, so it is
+    // pinned to the table's workspace width on every render (a minimal copy of the plugin's
+    // `#onAfterViewRender`); the height is the grid box via the CSS `height: 100%`.
+    const syncWidth = ()=>{
+        const { view } = hotInstance;
+        const width = view.isHorizontallyScrollableByWindow() ? view.getTotalTableWidth() : view.getWorkspaceWidth();
+        lock.style.width = `${width}px`;
+    };
+    hotInstance.addHook('afterViewRender', syncWidth);
+    const shortcutsContext = shortcutManager.getContext(SHORTCUTS_CONTEXT_NAME) ?? shortcutManager.addContext(SHORTCUTS_CONTEXT_NAME);
+    // The modal focus trap: Tab cycles through the lock's own controls and never leaves. The focus
+    // scope switches the manager to this context while focus is inside the lock, so these shortcuts
+    // never fire for the grid and the grid's shortcuts never fire under the lock.
+    shortcutsContext.addShortcut({
+        keys: [
+            [
+                'Tab'
+            ],
+            [
+                'Shift',
+                'Tab'
+            ]
+        ],
+        callback: (event)=>{
+            const controls = getFocusableControls();
+            const index = controls.indexOf(hotInstance.rootDocument.activeElement);
+            const delta = event.shiftKey ? -1 : 1;
+            controls[(index + delta + controls.length) % controls.length]?.focus();
+        },
+        group: SHORTCUTS_GROUP
+    });
+    focusScopeManager.registerScope(SCOPE_ID, lock, {
+        shortcutsContextName: SHORTCUTS_CONTEXT_NAME,
+        type: 'modal',
+        onActivate: (focusSource)=>{
+            const controls = getFocusableControls();
+            if (focusSource === 'tab_from_below') {
+                controls[controls.length - 1]?.focus();
+            } else {
+                // The ACTION, not the first control in document order: where a lock carries a documentation
+                // link, that link sits inside the description and so comes first in the DOM. Tab still
+                // cycles in document order - only the landing point is the button.
+                refs.contactButton.focus();
+            }
+        }
+    });
+    host.appendChild(lock);
+    // The lock mounts during `init()`, before the grid's first render, so its width sync waits for
+    // `afterInit`.
+    //
+    // It does NOT take focus here. A grid can initialize while the user is typing somewhere else on the
+    // page (a login form above it, another grid), and grabbing the keyboard at construction would pull
+    // focus out of that field, scroll the page down to the lock, and - because `listen()` un-listens
+    // every other instance - take the keyboard away from a licensed grid too. Two blocked grids would
+    // fight over it. The Dialog plugin guards its own focus grab the same way, on whether the grid was
+    // already listening.
+    //
+    // Nothing is lost by waiting: the focus scope manager activates a scope, and calls `listen()`
+    // itself, on the first focusin or click inside the scope element. So the Tab trap engages the moment
+    // the user actually reaches the lock - by clicking it (it covers the whole grid) or by tabbing in
+    // through a focus catcher - and not one moment earlier.
+    hotInstance.addHookOnce('afterInit', ()=>{
+        syncWidth();
+        // The grid underneath is unusable, so it must not look selected. This moves no focus.
+        hotInstance.deselectCell();
+    });
+}

package/utils/licenseNotification.d.ts

@@ -1,4 +1,23 @@
 import type { HotInstance } from '../core/types';
+export declare const LICENSE_INFO_CLASS = "hot-display-license-info";
+/**
+ * Mounts a license bar as the last element of the bottom slot and registers a focus scope so
+ * keyboard navigation (Tab/Shift+Tab) includes its links. Its one caller is the built-in
+ * notification below (a missing, invalid or expired key, and a soft-stopped trial).
+ *
+ * The bar is intentionally a foreign node, NOT registered with the LayoutManager: registering it would
+ * expose it to the user's `layout` setting (reorder/remove) and to `DomSlot.clear()`, but a license
+ * notice must always sit last and must not be user-removable. It carries the slot-item class and
+ * refreshes the slot-filled state by hand, exactly as the layout module documents foreign nodes do.
+ *
+ * At most one license bar exists at a time - a key is in exactly one lifecycle state - so the single
+ * `licenseNotification` scope is never contended.
+ *
+ * @param {HotInstance} hotInstance The root Handsontable instance.
+ * @param {HTMLElement} barElement The license bar element to mount into the bottom slot.
+ * @returns {void}
+ */
+export declare function mountBottomLicenseBar(hotInstance: HotInstance, barElement: HTMLElement): void;
 /**
  * Initializes the built-in license notification: injects the product info message as the last
  * element of the bottom slot when the license is invalid, expired, or missing, and registers

package/utils/licenseNotification.js

@@ -2,14 +2,26 @@
 Object.defineProperty(exports, "__esModule", {
     value: true
 });
-Object.defineProperty(exports, "initLicenseNotification", {
-    enumerable: true,
-    get: function() {
+function _export(target, all) {
+    for(var name in all)Object.defineProperty(target, name, {
+        enumerable: true,
+        get: Object.getOwnPropertyDescriptor(all, name).get
+    });
+}
+_export(exports, {
+    get LICENSE_INFO_CLASS () {
+        return LICENSE_INFO_CLASS;
+    },
+    get initLicenseNotification () {
         return initLicenseNotification;
+    },
+    get mountBottomLicenseBar () {
+        return mountBottomLicenseBar;
     }
 });
 const _mixed = require("../helpers/mixed");
 const _constants = require("../core/layout/constants");
+const _layoutManager = require("../core/layout/layoutManager");
 const SCOPE_ID = 'licenseNotification';
 const SHORTCUTS_CONTEXT_NAME = `plugin:${SCOPE_ID}`;
 const LICENSE_INFO_CLASS = 'hot-display-license-info';
@@ -33,46 +45,61 @@ const LICENSE_INFO_CLASS = 'hot-display-license-info';
     }
     return Array.from(notification.querySelectorAll('a[href]'));
 }
-function initLicenseNotification(hotInstance) {
+function mountBottomLicenseBar(hotInstance, barElement) {
     const container = hotInstance.rootSlotBottomElement;
     if (!container) {
         return;
     }
-    const licenseKey = hotInstance.getSettings().licenseKey;
-    const releaseDate = typeof process !== 'undefined' && process.env?.HOT_RELEASE_DATE ? "30/06/2026" : '';
-    const notificationElement = (0, _mixed._injectProductInfo)({
-        className: LICENSE_INFO_CLASS,
-        key: licenseKey,
-        element: container,
-        releaseDate
-    });
-    if (!notificationElement) {
-        return;
-    }
-    // `_injectProductInfo` appended this element into the bottom slot element and returned it. The
-    // notification is intentionally NOT registered with the LayoutManager: it must always sit last in
-    // the bottom slot and must not be removable or reorderable through the `layout` setting or
-    // `getLayoutManager().unregister`. Re-append it so it is the last child, and carry the shared
-    // slot-item class so it gets the same separator styling as registered slot items. Because it is a
-    // foreign (unregistered) node, `DomSlot` always inserts registered items before it, keeping it last
-    // as other contributors (for example pagination) register or reorder.
-    notificationElement.classList.add(_constants.SLOT_ITEM_CLASS);
-    container.appendChild(notificationElement);
-    // The scope is intentionally never unregistered: the license notification is created once during
-    // init, cannot be disabled, and lives for the whole instance lifetime. It is cleaned up when
+    // Append as the last child and carry the shared slot-item class so it gets the same separator
+    // styling as registered slot items. Because it is a foreign (unregistered) node, `DomSlot` always
+    // inserts registered items before it, keeping it last as other contributors (for example pagination)
+    // register or reorder.
+    barElement.classList.add(_constants.SLOT_ITEM_CLASS);
+    container.appendChild(barElement);
+    // The bar bypasses `DomSlot`, so the wrapper's slot-filled state class (kept in sync by the
+    // `LayoutManager` for registered items) has to be refreshed here explicitly.
+    (0, _layoutManager.refreshSlotFilledState)(_constants.LAYOUT_SLOTS.BOTTOM, container);
+    // The scope is intentionally never unregistered: the license bar is created once during init,
+    // cannot be disabled, and lives for the whole instance lifetime. It is cleaned up when
     // `getFocusScopeManager().destroy()` runs on `hot.destroy()`.
-    hotInstance.getFocusScopeManager().registerScope(SCOPE_ID, notificationElement, {
+    hotInstance.getFocusScopeManager().registerScope(SCOPE_ID, barElement, {
         shortcutsContextName: SHORTCUTS_CONTEXT_NAME,
         runOnlyIf: ()=>getNotificationElement(hotInstance) !== null,
         onActivate: (focusSource)=>{
             const focusableElements = getFocusableElements(hotInstance);
             if (focusableElements.length > 0) {
                 if (focusSource === 'tab_from_above') {
-                    focusableElements.at(0)?.focus();
+                    focusableElements[0]?.focus();
                 } else if (focusSource === 'tab_from_below') {
-                    focusableElements.at(-1)?.focus();
+                    focusableElements[focusableElements.length - 1]?.focus();
                 }
             }
         }
     });
 }
+function initLicenseNotification(hotInstance) {
+    const container = hotInstance.rootSlotBottomElement;
+    if (!container) {
+        return;
+    }
+    const licenseKey = hotInstance.getSettings().licenseKey;
+    // DO NOT wrap this in a `typeof process` guard (or any `process` existence check). The bundler
+    // replaces the whole `"28/08/2026"` expression with a string literal at build time,
+    // so the bare read never touches a runtime `process` object and cannot crash. A guard is NOT
+    // inlined - it survives as `typeof process !== 'undefined' && "..."`, which is `false` in every
+    // browser bundle, blanks the release date, and silently kills expired-key detection. That was the
+    // 18.0.0 regression this read restores; re-adding the guard reintroduces it.
+    const releaseDate = "28/08/2026" || '';
+    const notificationElement = (0, _mixed._injectProductInfo)({
+        className: LICENSE_INFO_CLASS,
+        key: licenseKey,
+        element: container,
+        releaseDate
+    });
+    if (!notificationElement) {
+        return;
+    }
+    // `_injectProductInfo` already appended this element into the bottom slot and returned it;
+    // `mountBottomLicenseBar` re-appends it as the last child and wires the focus scope.
+    mountBottomLicenseBar(hotInstance, notificationElement);
+}

package/utils/licenseNotification.mjs

@@ -1,8 +1,9 @@
 import { _injectProductInfo } from '../helpers/mixed.mjs';
-import { SLOT_ITEM_CLASS } from '../core/layout/constants.mjs';
+import { LAYOUT_SLOTS, SLOT_ITEM_CLASS } from '../core/layout/constants.mjs';
+import { refreshSlotFilledState } from '../core/layout/layoutManager.mjs';
 const SCOPE_ID = 'licenseNotification';
 const SHORTCUTS_CONTEXT_NAME = `plugin:${SCOPE_ID}`;
-const LICENSE_INFO_CLASS = 'hot-display-license-info';
+export const LICENSE_INFO_CLASS = 'hot-display-license-info';
 /**
  * Returns the license notification DOM element when present.
  *
@@ -23,6 +24,54 @@ const LICENSE_INFO_CLASS = 'hot-display-license-info';
     }
     return Array.from(notification.querySelectorAll('a[href]'));
 }
+/**
+ * Mounts a license bar as the last element of the bottom slot and registers a focus scope so
+ * keyboard navigation (Tab/Shift+Tab) includes its links. Its one caller is the built-in
+ * notification below (a missing, invalid or expired key, and a soft-stopped trial).
+ *
+ * The bar is intentionally a foreign node, NOT registered with the LayoutManager: registering it would
+ * expose it to the user's `layout` setting (reorder/remove) and to `DomSlot.clear()`, but a license
+ * notice must always sit last and must not be user-removable. It carries the slot-item class and
+ * refreshes the slot-filled state by hand, exactly as the layout module documents foreign nodes do.
+ *
+ * At most one license bar exists at a time - a key is in exactly one lifecycle state - so the single
+ * `licenseNotification` scope is never contended.
+ *
+ * @param {HotInstance} hotInstance The root Handsontable instance.
+ * @param {HTMLElement} barElement The license bar element to mount into the bottom slot.
+ * @returns {void}
+ */ export function mountBottomLicenseBar(hotInstance, barElement) {
+    const container = hotInstance.rootSlotBottomElement;
+    if (!container) {
+        return;
+    }
+    // Append as the last child and carry the shared slot-item class so it gets the same separator
+    // styling as registered slot items. Because it is a foreign (unregistered) node, `DomSlot` always
+    // inserts registered items before it, keeping it last as other contributors (for example pagination)
+    // register or reorder.
+    barElement.classList.add(SLOT_ITEM_CLASS);
+    container.appendChild(barElement);
+    // The bar bypasses `DomSlot`, so the wrapper's slot-filled state class (kept in sync by the
+    // `LayoutManager` for registered items) has to be refreshed here explicitly.
+    refreshSlotFilledState(LAYOUT_SLOTS.BOTTOM, container);
+    // The scope is intentionally never unregistered: the license bar is created once during init,
+    // cannot be disabled, and lives for the whole instance lifetime. It is cleaned up when
+    // `getFocusScopeManager().destroy()` runs on `hot.destroy()`.
+    hotInstance.getFocusScopeManager().registerScope(SCOPE_ID, barElement, {
+        shortcutsContextName: SHORTCUTS_CONTEXT_NAME,
+        runOnlyIf: ()=>getNotificationElement(hotInstance) !== null,
+        onActivate: (focusSource)=>{
+            const focusableElements = getFocusableElements(hotInstance);
+            if (focusableElements.length > 0) {
+                if (focusSource === 'tab_from_above') {
+                    focusableElements[0]?.focus();
+                } else if (focusSource === 'tab_from_below') {
+                    focusableElements[focusableElements.length - 1]?.focus();
+                }
+            }
+        }
+    });
+}
 /**
  * Initializes the built-in license notification: injects the product info message as the last
  * element of the bottom slot when the license is invalid, expired, or missing, and registers
@@ -38,7 +87,13 @@ const LICENSE_INFO_CLASS = 'hot-display-license-info';
         return;
     }
     const licenseKey = hotInstance.getSettings().licenseKey;
-    const releaseDate = typeof process !== 'undefined' && process.env?.HOT_RELEASE_DATE ? "30/06/2026" : '';
+    // DO NOT wrap this in a `typeof process` guard (or any `process` existence check). The bundler
+    // replaces the whole `"28/08/2026"` expression with a string literal at build time,
+    // so the bare read never touches a runtime `process` object and cannot crash. A guard is NOT
+    // inlined - it survives as `typeof process !== 'undefined' && "..."`, which is `false` in every
+    // browser bundle, blanks the release date, and silently kills expired-key detection. That was the
+    // 18.0.0 regression this read restores; re-adding the guard reintroduces it.
+    const releaseDate = "28/08/2026" || '';
     const notificationElement = _injectProductInfo({
         className: LICENSE_INFO_CLASS,
         key: licenseKey,
@@ -48,30 +103,7 @@ const LICENSE_INFO_CLASS = 'hot-display-license-info';
     if (!notificationElement) {
         return;
     }
-    // `_injectProductInfo` appended this element into the bottom slot element and returned it. The
-    // notification is intentionally NOT registered with the LayoutManager: it must always sit last in
-    // the bottom slot and must not be removable or reorderable through the `layout` setting or
-    // `getLayoutManager().unregister`. Re-append it so it is the last child, and carry the shared
-    // slot-item class so it gets the same separator styling as registered slot items. Because it is a
-    // foreign (unregistered) node, `DomSlot` always inserts registered items before it, keeping it last
-    // as other contributors (for example pagination) register or reorder.
-    notificationElement.classList.add(SLOT_ITEM_CLASS);
-    container.appendChild(notificationElement);
-    // The scope is intentionally never unregistered: the license notification is created once during
-    // init, cannot be disabled, and lives for the whole instance lifetime. It is cleaned up when
-    // `getFocusScopeManager().destroy()` runs on `hot.destroy()`.
-    hotInstance.getFocusScopeManager().registerScope(SCOPE_ID, notificationElement, {
-        shortcutsContextName: SHORTCUTS_CONTEXT_NAME,
-        runOnlyIf: ()=>getNotificationElement(hotInstance) !== null,
-        onActivate: (focusSource)=>{
-            const focusableElements = getFocusableElements(hotInstance);
-            if (focusableElements.length > 0) {
-                if (focusSource === 'tab_from_above') {
-                    focusableElements.at(0)?.focus();
-                } else if (focusSource === 'tab_from_below') {
-                    focusableElements.at(-1)?.focus();
-                }
-            }
-        }
-    });
+    // `_injectProductInfo` already appended this element into the bottom slot and returned it;
+    // `mountBottomLicenseBar` re-appends it as the last child and wires the focus scope.
+    mountBottomLicenseBar(hotInstance, notificationElement);
 }

package/utils/movableMeta.d.mts

@@ -0,0 +1 @@
+export * from './movableMeta.js';

package/utils/movableMeta.d.ts

@@ -0,0 +1,40 @@
+import type { HotInstance } from '../core/types';
+/**
+ * The cell-meta keys that travel with a cell moved by the `moveCells` feature. Shared between the
+ * MoveCells plugin (which moves the meta) and the UndoRedo `MoveCellsAction` (which must restore
+ * exactly this set — a key added in one place but missed in the other would silently stop being
+ * undone). It lives outside both plugins so that neither imports the other — registering just one
+ * of them through the tree-shakeable `base.ts` entry must not pull the other in.
+ */
+export declare const MOVABLE_META_KEYS: ReadonlyArray<string>;
+/**
+ * A sparse record of one cell's own movable meta: the cell's visual coordinates plus only the
+ * movable keys the cell carries as its own properties.
+ */
+export interface MovableMetaEntry {
+    /**
+     * The visual row index of the cell.
+     */
+    row: number;
+    /**
+     * The visual column index of the cell.
+     */
+    col: number;
+    /**
+     * The cell's own movable meta keys and their values.
+     */
+    meta: Record<string, unknown>;
+}
+/**
+ * Collects the cells of a visual region that carry their own movable meta keys. The result is
+ * sparse — cells without any own movable key produce no entry — so a move allocates
+ * proportionally to the number of styled cells, not to the range area.
+ *
+ * @param {HotInstance} hot The Handsontable instance.
+ * @param {number} fromRow The visual top row of the region.
+ * @param {number} fromCol The visual start column of the region.
+ * @param {number} toRow The visual bottom row of the region.
+ * @param {number} toCol The visual end column of the region.
+ * @returns {MovableMetaEntry[]}
+ */
+export declare function collectMovableMeta(hot: HotInstance, fromRow: number, fromCol: number, toRow: number, toCol: number): MovableMetaEntry[];

package/utils/movableMeta.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+function _export(target, all) {
+    for(var name in all)Object.defineProperty(target, name, {
+        enumerable: true,
+        get: Object.getOwnPropertyDescriptor(all, name).get
+    });
+}
+_export(exports, {
+    get MOVABLE_META_KEYS () {
+        return MOVABLE_META_KEYS;
+    },
+    get collectMovableMeta () {
+        return collectMovableMeta;
+    }
+});
+const _object = require("../helpers/object");
+const MOVABLE_META_KEYS = [
+    'className'
+];
+function collectMovableMeta(hot, fromRow, fromCol, toRow, toCol) {
+    const entries = [];
+    for(let row = fromRow; row <= toRow; row++){
+        for(let col = fromCol; col <= toCol; col++){
+            // Transient: only the movable keys are copied out below and the meta object is discarded, so
+            // materializing one per visited cell would retain memory the viewport cannot evict.
+            const cellMeta = hot.getCellMetaTransient(row, col);
+            let meta = null;
+            for (const key of MOVABLE_META_KEYS){
+                if ((0, _object.hasOwnProperty)(cellMeta, key)) {
+                    meta = meta ?? {};
+                    meta[key] = cellMeta[key];
+                }
+            }
+            if (meta !== null) {
+                entries.push({
+                    row,
+                    col,
+                    meta
+                });
+            }
+        }
+    }
+    return entries;
+}

package/utils/movableMeta.mjs

@@ -0,0 +1,46 @@
+import { hasOwnProperty } from '../helpers/object.mjs';
+/**
+ * The cell-meta keys that travel with a cell moved by the `moveCells` feature. Shared between the
+ * MoveCells plugin (which moves the meta) and the UndoRedo `MoveCellsAction` (which must restore
+ * exactly this set — a key added in one place but missed in the other would silently stop being
+ * undone). It lives outside both plugins so that neither imports the other — registering just one
+ * of them through the tree-shakeable `base.ts` entry must not pull the other in.
+ */ export const MOVABLE_META_KEYS = [
+    'className'
+];
+/**
+ * Collects the cells of a visual region that carry their own movable meta keys. The result is
+ * sparse — cells without any own movable key produce no entry — so a move allocates
+ * proportionally to the number of styled cells, not to the range area.
+ *
+ * @param {HotInstance} hot The Handsontable instance.
+ * @param {number} fromRow The visual top row of the region.
+ * @param {number} fromCol The visual start column of the region.
+ * @param {number} toRow The visual bottom row of the region.
+ * @param {number} toCol The visual end column of the region.
+ * @returns {MovableMetaEntry[]}
+ */ export function collectMovableMeta(hot, fromRow, fromCol, toRow, toCol) {
+    const entries = [];
+    for(let row = fromRow; row <= toRow; row++){
+        for(let col = fromCol; col <= toCol; col++){
+            // Transient: only the movable keys are copied out below and the meta object is discarded, so
+            // materializing one per visited cell would retain memory the viewport cannot evict.
+            const cellMeta = hot.getCellMetaTransient(row, col);
+            let meta = null;
+            for (const key of MOVABLE_META_KEYS){
+                if (hasOwnProperty(cellMeta, key)) {
+                    meta = meta ?? {};
+                    meta[key] = cellMeta[key];
+                }
+            }
+            if (meta !== null) {
+                entries.push({
+                    row,
+                    col,
+                    meta
+                });
+            }
+        }
+    }
+    return entries;
+}

package/utils/parseTable.js

@@ -76,7 +76,7 @@ function instanceToHTML(instance) {
                 cell = `<th>${instance.getRowHeader(row - columnModifier)}</th>`;
             } else {
                 const cellData = data[row][column];
-                const { hidden, rowspan, colspan } = instance.getCellMeta(row - columnModifier, column - rowModifier);
+                const { hidden, rowspan, colspan } = instance.getCellMetaTransient(row - columnModifier, column - rowModifier);
                 if (!hidden) {
                     const attrs = [];
                     if (rowspan) {
@@ -215,21 +215,30 @@ function replaceTdCellsWithTextContent(html) {
 }
 function htmlToGridSettings(element, rootDocument = document) {
     const settingsObj = {};
-    const fragment = rootDocument.createDocumentFragment();
-    const tempElem = rootDocument.createElement('div');
-    fragment.appendChild(tempElem);
     let checkElement = element;
+    // Root the sibling-node lookups below (currently only the generator `<meta>`) at the parsed
+    // markup. Stays `null` when a live element is passed in, which is what the previous
+    // implementation effectively did - the scratch element it searched was empty in that case.
+    let parsedRoot = null;
     if (typeof checkElement === 'string') {
         // Use replaceTdCellsWithTextContent so nested <td> (e.g. Excel shape cells) are matched correctly
         const normalizedHTML = replaceTdCellsWithTextContent(checkElement);
-        tempElem.insertAdjacentHTML('afterbegin', normalizedHTML);
-        checkElement = tempElem.querySelector('table');
+        // `DOMParser` builds a document with no browsing context, so reading the pasted markup cannot
+        // run any of it: no image fetch, no `onerror`, no script. Writing the same string into a
+        // detached element of `rootDocument` does run it - the element is detached, but the document
+        // owning it is not inert, which is how an `<img src=x onerror>` in a paste payload executed.
+        // The parsed nodes are only ever read from here. Importing them into `rootDocument` would
+        // make them live again, so never do that.
+        // eslint-disable-next-line no-restricted-globals
+        const Parser = rootDocument.defaultView?.DOMParser ?? DOMParser;
+        parsedRoot = new Parser().parseFromString(normalizedHTML, 'text/html');
+        checkElement = parsedRoot.querySelector('table');
     }
     if (!checkElement || !isHTMLTable(checkElement)) {
         return;
     }
     const el = checkElement;
-    const generator = tempElem.querySelector('meta[name$="enerator"]');
+    const generator = parsedRoot?.querySelector('meta[name$="enerator"]') ?? null;
     const hasRowHeaders = el.querySelector('tbody th') !== null;
     const trElement = el.querySelector('tr');
     const countCols = !trElement ? 0 : Array.from(trElement.cells).reduce((cols, cell)=>cols + cell.colSpan, 0) - (hasRowHeaders ? 1 : 0);

package/utils/parseTable.mjs

@@ -57,7 +57,7 @@ const regEscapedChars = new RegExp(Object.keys(ESCAPED_HTML_CHARS).map((key)=>`(
                 cell = `<th>${instance.getRowHeader(row - columnModifier)}</th>`;
             } else {
                 const cellData = data[row][column];
-                const { hidden, rowspan, colspan } = instance.getCellMeta(row - columnModifier, column - rowModifier);
+                const { hidden, rowspan, colspan } = instance.getCellMetaTransient(row - columnModifier, column - rowModifier);
                 if (!hidden) {
                     const attrs = [];
                     if (rowspan) {
@@ -217,21 +217,30 @@ const paragraphRegexp = /<p.*?>/g;
  */ // eslint-disable-next-line no-restricted-globals
 export function htmlToGridSettings(element, rootDocument = document) {
     const settingsObj = {};
-    const fragment = rootDocument.createDocumentFragment();
-    const tempElem = rootDocument.createElement('div');
-    fragment.appendChild(tempElem);
     let checkElement = element;
+    // Root the sibling-node lookups below (currently only the generator `<meta>`) at the parsed
+    // markup. Stays `null` when a live element is passed in, which is what the previous
+    // implementation effectively did - the scratch element it searched was empty in that case.
+    let parsedRoot = null;
     if (typeof checkElement === 'string') {
         // Use replaceTdCellsWithTextContent so nested <td> (e.g. Excel shape cells) are matched correctly
         const normalizedHTML = replaceTdCellsWithTextContent(checkElement);
-        tempElem.insertAdjacentHTML('afterbegin', normalizedHTML);
-        checkElement = tempElem.querySelector('table');
+        // `DOMParser` builds a document with no browsing context, so reading the pasted markup cannot
+        // run any of it: no image fetch, no `onerror`, no script. Writing the same string into a
+        // detached element of `rootDocument` does run it - the element is detached, but the document
+        // owning it is not inert, which is how an `<img src=x onerror>` in a paste payload executed.
+        // The parsed nodes are only ever read from here. Importing them into `rootDocument` would
+        // make them live again, so never do that.
+        // eslint-disable-next-line no-restricted-globals
+        const Parser = rootDocument.defaultView?.DOMParser ?? DOMParser;
+        parsedRoot = new Parser().parseFromString(normalizedHTML, 'text/html');
+        checkElement = parsedRoot.querySelector('table');
     }
     if (!checkElement || !isHTMLTable(checkElement)) {
         return;
     }
     const el = checkElement;
-    const generator = tempElem.querySelector('meta[name$="enerator"]');
+    const generator = parsedRoot?.querySelector('meta[name$="enerator"]') ?? null;
     const hasRowHeaders = el.querySelector('tbody th') !== null;
     const trElement = el.querySelector('tr');
     const countCols = !trElement ? 0 : Array.from(trElement.cells).reduce((cols, cell)=>cols + cell.colSpan, 0) - (hasRowHeaders ? 1 : 0);