ngwr 13.0.0 → 13.0.1

package/fesm2022/ngwr-overlay.mjs

@@ -11,14 +11,43 @@ import { WrVisualViewport } from 'ngwr/platform';
  * Use of this source code is governed by an MIT-style license that can be
  * found in the LICENSE file at https://github.com/thekhegay/ngwr/blob/main/LICENSE
  */
+const SVG_NS = 'http://www.w3.org/2000/svg';
+/** The same 24×24 stroked ✕ the rest of the library's chrome draws (alert, toast, lightbox). */
+const CLOSE_ICON_ATTRS = [
+    ['class', 'wr-icon__svg'],
+    ['viewBox', '0 0 24 24'],
+    ['fill', 'none'],
+    ['stroke', 'currentColor'],
+    ['stroke-width', '2'],
+    ['stroke-linecap', 'round'],
+    ['stroke-linejoin', 'round'],
+    ['aria-hidden', 'true'],
+];
+const CLOSE_ICON_PATHS = ['M18 6 6 18', 'm6 6 12 12'];
 /**
- * The same 24×24 stroked ✕ the rest of the library's chrome draws (alert, toast,
- * lightbox). Static markup — the caller's label goes on via `setAttribute`, so
- * nothing from a catalog or a consumer is ever parsed as HTML.
+ * Builds the ✕ node by node.
+ *
+ * It was one `innerHTML = CLOSE_ICON`, and the string was a compile-time
+ * constant, so it was never an injection risk — it was an AVAILABILITY one.
+ * Under `require-trusted-types-for 'script'` an `innerHTML` write throws
+ * `TrustedHTML assignment` whatever the string is, and the throw landed after
+ * the overlay was on screen: a modal with no ✕, no backdrop subscription and no
+ * Escape handler, over the whole application. `createElementNS` is not a
+ * Trusted Types sink, so there is nothing left to police.
  */
-const CLOSE_ICON = '<svg class="wr-icon__svg" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none"' +
-    ' stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">' +
-    '<path d="M18 6 6 18" /><path d="m6 6 12 12" /></svg>';
+function createCloseIcon(doc) {
+    const svg = doc.createElementNS(SVG_NS, 'svg');
+    // `setAttribute`, not `.className` — on an SVG element that property is an
+    // `SVGAnimatedString` and assigning a string to it silently does nothing.
+    for (const [name, value] of CLOSE_ICON_ATTRS)
+        svg.setAttribute(name, value);
+    for (const d of CLOSE_ICON_PATHS) {
+        const path = doc.createElementNS(SVG_NS, 'path');
+        path.setAttribute('d', d);
+        svg.appendChild(path);
+    }
+    return svg;
+}
 /**
  * Appends a dismiss (✕) button to a service-opened overlay panel.
  *
@@ -41,7 +70,7 @@ function wrAppendOverlayClose(host, className, label, onClose) {
     button.type = 'button';
     button.className = className;
     button.setAttribute('aria-label', label);
-    button.innerHTML = CLOSE_ICON;
+    button.appendChild(createCloseIcon(host.ownerDocument));
     button.addEventListener('click', onClose);
     host.appendChild(button);
     return button;

package/fesm2022/ngwr-overlay.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"ngwr-overlay.mjs","sources":["../../../projects/lib/overlay/wr-overlay-close.ts","../../../projects/lib/overlay/wr-mirror-offsets.ts","../../../projects/lib/overlay/wr-outside-click.ts","../../../projects/lib/overlay/wr-overlay-container.ts","../../../projects/lib/overlay/tokens/wr-overlay.token.ts","../../../projects/lib/overlay/tokens/wr-overlay-container.token.ts","../../../projects/lib/overlay/tokens/wr-responsive-overlays.token.ts","../../../projects/lib/overlay/provide-wr-overlay.ts","../../../projects/lib/overlay/provide-wr-responsive-overlays.ts","../../../projects/lib/overlay/ngwr-overlay.ts"],"sourcesContent":["/**\n * @license\n *\n * Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://github.com/thekhegay/ngwr/blob/main/LICENSE\n */\n\n/**\n * The same 24×24 stroked ✕ the rest of the library's chrome draws (alert, toast,\n * lightbox). Static markup — the caller's label goes on via `setAttribute`, so\n * nothing from a catalog or a consumer is ever parsed as HTML.\n */\nconst CLOSE_ICON =\n  '<svg class=\"wr-icon__svg\" xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\" fill=\"none\"' +\n  ' stroke=\"currentColor\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" aria-hidden=\"true\">' +\n  '<path d=\"M18 6 6 18\" /><path d=\"m6 6 12 12\" /></svg>';\n\n/**\n * Appends a dismiss (✕) button to a service-opened overlay panel.\n *\n * `WrDialog` and `WrDrawerManager` build their panel around a component the\n * consumer supplies, so there is no template of their own to put a corner button\n * in — they call this instead. Component-driven overlays (`<wr-drawer>`) render\n * the same markup in their template.\n *\n * Uses `host.ownerDocument` rather than the global `document`, so it carries no\n * hidden browser-only assumption; callers still gate on the platform because\n * they have nothing to append to on the server.\n *\n * @param host Panel element the button is appended to (and positioned against).\n * @param className BEM class for the button, e.g. `wr-dialog__close`.\n * @param label Accessible name — already localized by the caller.\n * @param onClose Invoked on click.\n */\nexport function wrAppendOverlayClose(\n  host: HTMLElement,\n  className: string,\n  label: string,\n  onClose: () => void\n): HTMLButtonElement {\n  const button = host.ownerDocument.createElement('button');\n  button.type = 'button';\n  button.className = className;\n  button.setAttribute('aria-label', label);\n  button.innerHTML = CLOSE_ICON;\n  button.addEventListener('click', onClose);\n  host.appendChild(button);\n  return button;\n}\n","/**\n * @license\n *\n * Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://github.com/thekhegay/ngwr/blob/main/LICENSE\n */\n\nimport type { ConnectedPosition } from '@angular/cdk/overlay';\n\n/**\n * Mirror the horizontal offsets of a connected-position list for RTL.\n *\n * The CDK mirrors `originX` / `overlayX` under `dir=\"rtl\"` — a `start` anchor\n * resolves to the origin's right edge — but it does NOT mirror `offsetX`, which\n * it adds to the final PHYSICAL x (`_getOffset` returns `position.offsetX`\n * verbatim). So a position that meant \"sit to the inline-start of the trigger,\n * 8px clear of it\" keeps its `-8` under RTL, where the panel is now on the\n * right: the gap becomes an 8px OVERLAP, and the panel sits on top of the thing\n * it is describing.\n *\n * Nothing in the CDK will do this for us, and the amount is per position, so\n * every ngwr overlay that offsets along the inline axis passes its list through\n * here. `offsetY` is untouched: the block axis does not flip.\n *\n * @example\n * ```ts\n * const dir = inject(Directionality, { optional: true });\n *\n * strategy.withPositions(wrMirrorOffsets(WR_POPOVER_POSITIONS[position], dir?.value === 'rtl'));\n * ```\n */\nexport function wrMirrorOffsets(positions: readonly ConnectedPosition[], isRtl: boolean): ConnectedPosition[] {\n  // Copied rather than mutated even when there is nothing to do: the position\n  // tables are module-level constants shared by every instance, so handing back\n  // the same objects invites a caller to write through them.\n  if (!isRtl) return positions.map(position => ({ ...position }));\n\n  return positions.map(position => ({\n    ...position,\n    ...(position.offsetX == null ? {} : { offsetX: -position.offsetX }),\n  }));\n}\n","/**\n * @license\n *\n * Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://github.com/thekhegay/ngwr/blob/main/LICENSE\n */\n\nimport type { OverlayRef } from '@angular/cdk/overlay';\nimport { DOCUMENT, isPlatformBrowser } from '@angular/common';\nimport { PLATFORM_ID, Service, inject } from '@angular/core';\n\nimport { Observable, type Subscriber } from 'rxjs';\n\n/** One live subscription to `WrOutsideClick.outsidePointerEvents()`. */\ninterface Watcher {\n  readonly overlayRef: OverlayRef;\n  readonly subscriber: Subscriber<MouseEvent>;\n}\n\n/**\n * Shadow-piercing `event.target` — `composedPath()[0]` is the real originator\n * when the click started inside a shadow root, where `target` is retargeted to\n * the host.\n */\nfunction eventTarget(event: Event): EventTarget | null {\n  if (event.composedPath) {\n    try {\n      return event.composedPath()[0] ?? event.target;\n    } catch {\n      /* Detached / synthetic events can throw — fall through to `target`. */\n    }\n  }\n  return event.target;\n}\n\n/** `parent.contains(child)`, but stepping out of shadow roots through their hosts. */\nfunction containsAcrossShadow(parent: Node, child: EventTarget | null): boolean {\n  const hasShadowRoot = typeof ShadowRoot !== 'undefined';\n  let current = child as Node | null;\n  while (current) {\n    if (current === parent) return true;\n    current = hasShadowRoot && current instanceof ShadowRoot ? current.host : current.parentNode;\n  }\n  return false;\n}\n\n/**\n * Outside-click source for overlays — a drop-in replacement for\n * `OverlayRef.outsidePointerEvents()`.\n *\n * **Why this exists.** CDK's `OverlayOutsideClickDispatcher` binds its\n * listeners to `document.body`. When page content is shorter than the viewport,\n * a click in the empty space below it targets `<html>` — and `<html>` is\n * `body`'s *parent*, so the event bubbles straight to the document and `body`\n * never sees it. The overlay silently stays open. Listening on the document\n * itself catches both cases, and costs nothing else.\n *\n * Semantics are otherwise identical to the CDK's, deliberately:\n *\n * - Emits on `click` / `auxclick` / `contextmenu`, in the capture phase, and\n *   tracks `pointerdown` so a `click` is judged by where the press *started*\n *   (a drag that ends outside the pane doesn't count as an outside click).\n * - Walks watchers top-most first and stops at the first one that contains the\n *   event, so clicking inside a stacked overlay can't close the ones beneath\n *   it (a `wr-select` opened inside a `wr-popover`, say).\n * - Fires for the very click that opened the overlay, which is why every caller\n *   also ignores events landing on its own trigger.\n *\n * Registration is per subscription: the document listeners go up with the first\n * watcher and come down with the last, so an app with no open overlay has none.\n * That sentence was aspirational until v11 — see {@link outsidePointerEvents}.\n */\n@Service()\nexport class WrOutsideClick {\n  private readonly doc = inject(DOCUMENT);\n  private readonly isBrowser = isPlatformBrowser(inject(PLATFORM_ID));\n\n  /** In attach order — last is top-most. */\n  private readonly watchers: Watcher[] = [];\n  private cleanup: (() => void) | null = null;\n  private pressOrigin: EventTarget | null = null;\n\n  /**\n   * Emits every `click` / `auxclick` / `contextmenu` that lands outside the\n   * given overlay's pane, for as long as the overlay is attached.\n   *\n   * **It completes when the overlay detaches, and that is load-bearing.** Every\n   * one of the ten call sites subscribes inside its own `openOverlay()` and\n   * pipes `takeUntilDestroyed(destroyRef)` — a DIRECTIVE lifetime, not an\n   * overlay one — and none of them unsubscribes on close, because the natural\n   * reading of that idiom is \"this ends with the component\". Without the\n   * completion below the teardown never ran: one watcher accumulated per OPEN\n   * for the life of the page, each pinning a disposed `OverlayRef` (and through\n   * it a detached pane, its portal outlet and their injectors), the four\n   * capture-phase document listeners could never come down because\n   * `watchers.length` never reached zero, and every click on the page walked a\n   * list that only grew. A `mode=\"tooltip\"` popover made it unbounded — one\n   * permanent watcher per hover.\n   *\n   * Completing here rather than fixing ten call sites is deliberate: the next\n   * component to open an overlay would have made the same reasonable mistake.\n   * It is also what CDK's own `OverlayRef.outsidePointerEvents()` does.\n   */\n  outsidePointerEvents(overlayRef: OverlayRef): Observable<MouseEvent> {\n    return new Observable<MouseEvent>(subscriber => {\n      if (!this.isBrowser) return;\n\n      const watcher: Watcher = { overlayRef, subscriber };\n      this.watchers.push(watcher);\n      if (this.watchers.length === 1) this.listen();\n\n      // BOTH handlers, and the second one is not defensive padding. `dispose()`\n      // emits a detachment and then completes the subject, so a live overlay\n      // arrives through `next` — but a ref that was already disposed before\n      // anyone subscribed has nothing left to emit and arrives through\n      // `complete` alone. Listening for `next` only left exactly the watcher\n      // this whole change exists to remove.\n      const ended = (): void => subscriber.complete();\n      const detached = overlayRef.detachments().subscribe({ next: ended, complete: ended });\n\n      return () => {\n        detached.unsubscribe();\n        const index = this.watchers.indexOf(watcher);\n        if (index > -1) this.watchers.splice(index, 1);\n        if (!this.watchers.length) this.unlisten();\n      };\n    });\n  }\n\n  private readonly onPointerDown = (event: Event): void => {\n    this.pressOrigin = eventTarget(event);\n  };\n\n  private readonly onClick = (event: Event): void => {\n    const target = eventTarget(event);\n    // `detail > 0` means the click really came from a pointer press. A click\n    // activated by Enter or Space carries `detail: 0` and has no `pointerdown`\n    // of its own — so trusting a leftover origin there judged it by a press\n    // that belonged to something else entirely. A press inside the pane that\n    // never produced a click (a drag released off-window, a node removed under\n    // the finger, a cancelled touch) survives in `pressOrigin`, and the next\n    // keyboard activation anywhere on the page then read as \"inside\": the panel\n    // would not close, for keyboard users only.\n    const fromPointer = event.type === 'click' && (event as MouseEvent).detail > 0;\n    const origin = fromPointer && this.pressOrigin ? this.pressOrigin : target;\n    this.pressOrigin = null;\n\n    // Snapshot: a watcher that closes on this event unsubscribes synchronously,\n    // mutating `watchers` while we're walking it.\n    const watchers = this.watchers.slice();\n    for (let i = watchers.length - 1; i > -1; i--) {\n      const { overlayRef, subscriber } = watchers[i];\n      if (!overlayRef.hasAttached()) continue;\n\n      const pane = overlayRef.overlayElement;\n      if (containsAcrossShadow(pane, target) || containsAcrossShadow(pane, origin)) break;\n\n      subscriber.next(event as MouseEvent);\n    }\n  };\n\n  private listen(): void {\n    const options: AddEventListenerOptions = { capture: true };\n    const doc = this.doc;\n\n    doc.addEventListener('pointerdown', this.onPointerDown, options);\n    doc.addEventListener('click', this.onClick, options);\n    doc.addEventListener('auxclick', this.onClick, options);\n    doc.addEventListener('contextmenu', this.onClick, options);\n\n    this.cleanup = () => {\n      doc.removeEventListener('pointerdown', this.onPointerDown, options);\n      doc.removeEventListener('click', this.onClick, options);\n      doc.removeEventListener('auxclick', this.onClick, options);\n      doc.removeEventListener('contextmenu', this.onClick, options);\n    };\n  }\n\n  private unlisten(): void {\n    this.cleanup?.();\n    this.cleanup = null;\n    this.pressOrigin = null;\n  }\n}\n","/**\n * @license\n *\n * Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://github.com/thekhegay/ngwr/blob/main/LICENSE\n */\n\nimport { OverlayContainer } from '@angular/cdk/overlay';\nimport { Service } from '@angular/core';\n\n/**\n * Custom CDK `OverlayContainer` subclass that tags its DOM element with\n * `.wr-overlay-container` in addition to CDK's own `.cdk-overlay-container`.\n *\n * Why: CDK uses a single overlay container per app — every CDK consumer\n * (this lib, Angular Material, NG-ZORRO, etc.) puts its overlays in the\n * same root element. With this class applied you can scope NGWR-specific\n * overlay styles via the tag, e.g.:\n *\n * ```scss\n * .wr-overlay-container .cdk-overlay-pane { z-index: 1100; }\n * ```\n *\n * It does **not** isolate two libraries that both subclass OverlayContainer\n * — the last provider wins. It does give NGWR overlays a stable CSS hook.\n */\n@Service()\nexport class WrOverlayContainer extends OverlayContainer {\n  protected override _createContainer(): void {\n    super._createContainer();\n    this._containerElement?.classList.add('wr-overlay-container');\n  }\n}\n","/**\n * @license\n *\n * Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://github.com/thekhegay/ngwr/blob/main/LICENSE\n */\n\nimport { Overlay } from '@angular/cdk/overlay';\nimport { InjectionToken, inject } from '@angular/core';\n\n/**\n * Injection token for the CDK `Overlay` service NGWR components should\n * use to open panels.\n *\n * Defaults to CDK's root `Overlay` (shared with every other CDK consumer\n * in the app). Call `provideWrOverlay()` to bind it to an isolated\n * `Overlay` instance backed by a separate `OverlayContainer` — that way\n * NGWR overlays don't share the same DOM root with other libraries.\n *\n * @internal — directives/services inside the lib inject this instead of\n * CDK's `Overlay` directly.\n */\nexport const WR_OVERLAY = new InjectionToken<Overlay>('WR_OVERLAY', {\n  providedIn: 'root',\n  factory: () => inject(Overlay),\n});\n","/**\n * @license\n *\n * Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://github.com/thekhegay/ngwr/blob/main/LICENSE\n */\n\nimport { OverlayContainer } from '@angular/cdk/overlay';\nimport { InjectionToken, inject } from '@angular/core';\n\n/**\n * Injection token for the overlay container NGWR components should use.\n *\n * Defaults to CDK's `OverlayContainer` — i.e. the same root element every\n * CDK consumer shares. Call `provideWrOverlay()` to replace it with an\n * isolated instance so NGWR overlays don't collide with other libraries.\n *\n * @internal\n */\nexport const WR_OVERLAY_CONTAINER = new InjectionToken<OverlayContainer>('WR_OVERLAY_CONTAINER', {\n  providedIn: 'root',\n  factory: () => inject(OverlayContainer),\n});\n","/**\n * @license\n *\n * Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://github.com/thekhegay/ngwr/blob/main/LICENSE\n */\n\nimport { InjectionToken } from '@angular/core';\n\n/** Configuration for responsive (bottom-sheet) overlay presentation. */\ninterface WrResponsiveOverlaysConfig {\n  /**\n   * Viewport width (CSS px) at or below which overlays present as a\n   * bottom-sheet instead of a floating panel. @default 640\n   */\n  readonly breakpoint: number;\n}\n\n/**\n * When set, overlay services (dialog, select, dropdown, …) present as a\n * slide-up bottom-sheet on viewports at or below `breakpoint`. `null`\n * (the default) keeps every overlay floating. Configure via\n * {@link provideWrResponsiveOverlays}; override per call with a\n * component's `responsive` option.\n *\n * @internal\n */\nconst WR_RESPONSIVE_OVERLAYS = new InjectionToken<WrResponsiveOverlaysConfig | null>('WR_RESPONSIVE_OVERLAYS', {\n  factory: () => null,\n});\n\n/**\n * Decide whether an overlay should present as a bottom-sheet for the\n * current viewport.\n *\n * - `responsive === true` — sheet on small viewports regardless of config.\n * - `responsive === false` — never a sheet.\n * - `responsive === undefined` — follow the global config (sheet when\n *   {@link provideWrResponsiveOverlays} is configured).\n *\n * SSR-safe: returns `false` when there's no `window`.\n *\n * @internal\n */\nfunction wrPresentAsSheet(responsive: boolean | undefined, config: WrResponsiveOverlaysConfig | null): boolean {\n  const enabled = responsive ?? config !== null;\n  if (!enabled || typeof window === 'undefined') return false;\n  return window.innerWidth <= (config?.breakpoint ?? 640);\n}\n\nexport { WR_RESPONSIVE_OVERLAYS, wrPresentAsSheet };\nexport type { WrResponsiveOverlaysConfig };\n","/**\n * @license\n *\n * Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://github.com/thekhegay/ngwr/blob/main/LICENSE\n */\n\nimport { Overlay, OverlayContainer } from '@angular/cdk/overlay';\nimport {\n  EnvironmentInjector,\n  Injector,\n  type EnvironmentProviders,\n  inject,\n  makeEnvironmentProviders,\n  provideEnvironmentInitializer,\n} from '@angular/core';\n\nimport { WrVisualViewport } from 'ngwr/platform';\n\nimport { WR_OVERLAY, WR_OVERLAY_CONTAINER } from './tokens';\nimport { WrOverlayContainer } from './wr-overlay-container';\n\n/**\n * Isolates NGWR overlays from other CDK consumers in the app.\n *\n * Without this call, NGWR overlays use CDK's root `Overlay` — they\n * render into the same `.cdk-overlay-container` element as Angular\n * Material, NG-ZORRO, etc. With it, NGWR gets its own `OverlayContainer`\n * (marked `.wr-overlay-container`) **and** its own `Overlay` service\n * instance — so styles, z-index, and lifecycle never collide.\n *\n * It does this by replacing two injection tokens:\n * - `WR_OVERLAY_CONTAINER` → custom `WrOverlayContainer` subclass\n * - `WR_OVERLAY` → a fresh `Overlay` instance built in a child injector\n *   that resolves `OverlayContainer` to the custom subclass\n *\n * CDK's own root `Overlay` / `OverlayContainer` are left untouched, so\n * other libraries keep working with their original container.\n *\n * @example\n * ```ts\n * import { provideWrOverlay } from 'ngwr/overlay';\n *\n * bootstrapApplication(AppComponent, {\n *   providers: [\n *     provideWrOverlay(),\n *   ],\n * });\n * ```\n */\nexport function provideWrOverlay(): EnvironmentProviders {\n  return makeEnvironmentProviders([\n    // Track the visual viewport app-wide so overlay sheets (and the\n    // command-palette) can lift above the on-screen keyboard. No-op on the\n    // server / in browsers without the API.\n    provideEnvironmentInitializer(() => void inject(WrVisualViewport)),\n    { provide: WR_OVERLAY_CONTAINER, useClass: WrOverlayContainer },\n    {\n      provide: WR_OVERLAY,\n      useFactory: (): Overlay => {\n        const parent = inject(EnvironmentInjector);\n        const container = inject(WR_OVERLAY_CONTAINER);\n\n        // Child injector resolves `OverlayContainer` to our subclass and\n        // creates a fresh `Overlay` instance bound to it. CDK's own root\n        // `Overlay` and `OverlayContainer` are untouched in the parent.\n        const child = Injector.create({\n          parent,\n          providers: [\n            { provide: OverlayContainer, useValue: container },\n            { provide: Overlay, useClass: Overlay },\n          ],\n        });\n\n        return child.get(Overlay);\n      },\n    },\n  ]);\n}\n","/**\n * @license\n *\n * Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://github.com/thekhegay/ngwr/blob/main/LICENSE\n */\n\nimport { type EnvironmentProviders, makeEnvironmentProviders } from '@angular/core';\n\nimport { WR_RESPONSIVE_OVERLAYS, type WrResponsiveOverlaysConfig } from './tokens/wr-responsive-overlays.token';\n\n/**\n * Opt every NGWR overlay into responsive presentation — on viewports at or\n * below `breakpoint`, dialogs / selects / dropdowns and friends slide up as\n * a full-width bottom-sheet instead of a floating panel. Built on the same\n * overlay plumbing, so focus-trap, backdrop and scroll-blocking carry over.\n *\n * Individual components can still opt out (or in) per instance via their\n * `responsive` option.\n *\n * @example\n * ```ts\n * bootstrapApplication(AppComponent, {\n *   providers: [provideWrOverlay(), provideWrResponsiveOverlays()],\n * });\n *\n * // Custom breakpoint:\n * provideWrResponsiveOverlays({ breakpoint: 768 });\n * ```\n */\nexport function provideWrResponsiveOverlays(config?: Partial<WrResponsiveOverlaysConfig>): EnvironmentProviders {\n  return makeEnvironmentProviders([\n    { provide: WR_RESPONSIVE_OVERLAYS, useValue: { breakpoint: config?.breakpoint ?? 640 } },\n  ]);\n}\n","/**\n * Generated bundle index. Do not edit.\n */\n\nexport * from './public-api';\n"],"names":[],"mappings":";;;;;;;AAAA;;;;;AAKG;AAEH;;;;AAIG;AACH,MAAM,UAAU,GACd,8FAA8F;IAC9F,4GAA4G;AAC5G,IAAA,sDAAsD;AAExD;;;;;;;;;;;;;;;;AAgBG;AACG,SAAU,oBAAoB,CAClC,IAAiB,EACjB,SAAiB,EACjB,KAAa,EACb,OAAmB,EAAA;IAEnB,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,QAAQ,CAAC;AACzD,IAAA,MAAM,CAAC,IAAI,GAAG,QAAQ;AACtB,IAAA,MAAM,CAAC,SAAS,GAAG,SAAS;AAC5B,IAAA,MAAM,CAAC,YAAY,CAAC,YAAY,EAAE,KAAK,CAAC;AACxC,IAAA,MAAM,CAAC,SAAS,GAAG,UAAU;AAC7B,IAAA,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC;AACzC,IAAA,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;AACxB,IAAA,OAAO,MAAM;AACf;;AChDA;;;;;AAKG;AAIH;;;;;;;;;;;;;;;;;;;;;AAqBG;AACG,SAAU,eAAe,CAAC,SAAuC,EAAE,KAAc,EAAA;;;;AAIrF,IAAA,IAAI,CAAC,KAAK;AAAE,QAAA,OAAO,SAAS,CAAC,GAAG,CAAC,QAAQ,KAAK,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;IAE/D,OAAO,SAAS,CAAC,GAAG,CAAC,QAAQ,KAAK;AAChC,QAAA,GAAG,QAAQ;QACX,IAAI,QAAQ,CAAC,OAAO,IAAI,IAAI,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;AACpE,KAAA,CAAC,CAAC;AACL;;ACtBA;;;;AAIG;AACH,SAAS,WAAW,CAAC,KAAY,EAAA;AAC/B,IAAA,IAAI,KAAK,CAAC,YAAY,EAAE;AACtB,QAAA,IAAI;YACF,OAAO,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM;QAChD;AAAE,QAAA,MAAM;;QAER;IACF;IACA,OAAO,KAAK,CAAC,MAAM;AACrB;AAEA;AACA,SAAS,oBAAoB,CAAC,MAAY,EAAE,KAAyB,EAAA;AACnE,IAAA,MAAM,aAAa,GAAG,OAAO,UAAU,KAAK,WAAW;IACvD,IAAI,OAAO,GAAG,KAAoB;IAClC,OAAO,OAAO,EAAE;QACd,IAAI,OAAO,KAAK,MAAM;AAAE,YAAA,OAAO,IAAI;AACnC,QAAA,OAAO,GAAG,aAAa,IAAI,OAAO,YAAY,UAAU,GAAG,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,UAAU;IAC9F;AACA,IAAA,OAAO,KAAK;AACd;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;AAyBG;MAEU,cAAc,CAAA;AACR,IAAA,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC;IACtB,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;;IAGlD,QAAQ,GAAc,EAAE;IACjC,OAAO,GAAwB,IAAI;IACnC,WAAW,GAAuB,IAAI;AAE9C;;;;;;;;;;;;;;;;;;;;AAoBG;AACH,IAAA,oBAAoB,CAAC,UAAsB,EAAA;AACzC,QAAA,OAAO,IAAI,UAAU,CAAa,UAAU,IAAG;YAC7C,IAAI,CAAC,IAAI,CAAC,SAAS;gBAAE;AAErB,YAAA,MAAM,OAAO,GAAY,EAAE,UAAU,EAAE,UAAU,EAAE;AACnD,YAAA,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;AAC3B,YAAA,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,IAAI,CAAC,MAAM,EAAE;;;;;;;YAQ7C,MAAM,KAAK,GAAG,MAAY,UAAU,CAAC,QAAQ,EAAE;AAC/C,YAAA,MAAM,QAAQ,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAErF,YAAA,OAAO,MAAK;gBACV,QAAQ,CAAC,WAAW,EAAE;gBACtB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;gBAC5C,IAAI,KAAK,GAAG,CAAC,CAAC;oBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;AAC9C,gBAAA,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM;oBAAE,IAAI,CAAC,QAAQ,EAAE;AAC5C,YAAA,CAAC;AACH,QAAA,CAAC,CAAC;IACJ;AAEiB,IAAA,aAAa,GAAG,CAAC,KAAY,KAAU;AACtD,QAAA,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC;AACvC,IAAA,CAAC;AAEgB,IAAA,OAAO,GAAG,CAAC,KAAY,KAAU;AAChD,QAAA,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC;;;;;;;;;AASjC,QAAA,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,KAAK,OAAO,IAAK,KAAoB,CAAC,MAAM,GAAG,CAAC;AAC9E,QAAA,MAAM,MAAM,GAAG,WAAW,IAAI,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,GAAG,MAAM;AAC1E,QAAA,IAAI,CAAC,WAAW,GAAG,IAAI;;;QAIvB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE;AACtC,QAAA,KAAK,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YAC7C,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC;AAC9C,YAAA,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE;gBAAE;AAE/B,YAAA,MAAM,IAAI,GAAG,UAAU,CAAC,cAAc;AACtC,YAAA,IAAI,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC;gBAAE;AAE9E,YAAA,UAAU,CAAC,IAAI,CAAC,KAAmB,CAAC;QACtC;AACF,IAAA,CAAC;IAEO,MAAM,GAAA;AACZ,QAAA,MAAM,OAAO,GAA4B,EAAE,OAAO,EAAE,IAAI,EAAE;AAC1D,QAAA,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG;QAEpB,GAAG,CAAC,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC;QAChE,GAAG,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;QACpD,GAAG,CAAC,gBAAgB,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;QACvD,GAAG,CAAC,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;AAE1D,QAAA,IAAI,CAAC,OAAO,GAAG,MAAK;YAClB,GAAG,CAAC,mBAAmB,CAAC,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC;YACnE,GAAG,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;YACvD,GAAG,CAAC,mBAAmB,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;YAC1D,GAAG,CAAC,mBAAmB,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;AAC/D,QAAA,CAAC;IACH;IAEQ,QAAQ,GAAA;AACd,QAAA,IAAI,CAAC,OAAO,IAAI;AAChB,QAAA,IAAI,CAAC,OAAO,GAAG,IAAI;AACnB,QAAA,IAAI,CAAC,WAAW,GAAG,IAAI;IACzB;uGA7GW,cAAc,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,OAAA,EAAA,CAAA;wGAAd,cAAc,EAAA,CAAA;;2FAAd,cAAc,EAAA,UAAA,EAAA,CAAA;kBAD1B;;;ACxED;;;;;AAKG;AAKH;;;;;;;;;;;;;;;AAeG;AAEG,MAAO,kBAAmB,SAAQ,gBAAgB,CAAA;IACnC,gBAAgB,GAAA;QACjC,KAAK,CAAC,gBAAgB,EAAE;QACxB,IAAI,CAAC,iBAAiB,EAAE,SAAS,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAC/D;uGAJW,kBAAkB,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,OAAA,EAAA,CAAA;wGAAlB,kBAAkB,EAAA,CAAA;;2FAAlB,kBAAkB,EAAA,UAAA,EAAA,CAAA;kBAD9B;;;AC1BD;;;;;AAKG;AAKH;;;;;;;;;;;AAWG;MACU,UAAU,GAAG,IAAI,cAAc,CAAU,YAAY,EAAE;AAClE,IAAA,UAAU,EAAE,MAAM;AAClB,IAAA,OAAO,EAAE,MAAM,MAAM,CAAC,OAAO,CAAC;AAC/B,CAAA;;ACzBD;;;;;AAKG;AAKH;;;;;;;;AAQG;MACU,oBAAoB,GAAG,IAAI,cAAc,CAAmB,sBAAsB,EAAE;AAC/F,IAAA,UAAU,EAAE,MAAM;AAClB,IAAA,OAAO,EAAE,MAAM,MAAM,CAAC,gBAAgB,CAAC;AACxC,CAAA;;ACtBD;;;;;AAKG;AAaH;;;;;;;;AAQG;AACH,MAAM,sBAAsB,GAAG,IAAI,cAAc,CAAoC,wBAAwB,EAAE;AAC7G,IAAA,OAAO,EAAE,MAAM,IAAI;AACpB,CAAA;AAED;;;;;;;;;;;;AAYG;AACH,SAAS,gBAAgB,CAAC,UAA+B,EAAE,MAAyC,EAAA;AAClG,IAAA,MAAM,OAAO,GAAG,UAAU,IAAI,MAAM,KAAK,IAAI;AAC7C,IAAA,IAAI,CAAC,OAAO,IAAI,OAAO,MAAM,KAAK,WAAW;AAAE,QAAA,OAAO,KAAK;IAC3D,OAAO,MAAM,CAAC,UAAU,KAAK,MAAM,EAAE,UAAU,IAAI,GAAG,CAAC;AACzD;;AChDA;;;;;AAKG;AAiBH;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BG;SACa,gBAAgB,GAAA;AAC9B,IAAA,OAAO,wBAAwB,CAAC;;;;QAI9B,6BAA6B,CAAC,MAAM,KAAK,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAClE,QAAA,EAAE,OAAO,EAAE,oBAAoB,EAAE,QAAQ,EAAE,kBAAkB,EAAE;AAC/D,QAAA;AACE,YAAA,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,MAAc;AACxB,gBAAA,MAAM,MAAM,GAAG,MAAM,CAAC,mBAAmB,CAAC;AAC1C,gBAAA,MAAM,SAAS,GAAG,MAAM,CAAC,oBAAoB,CAAC;;;;AAK9C,gBAAA,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC;oBAC5B,MAAM;AACN,oBAAA,SAAS,EAAE;AACT,wBAAA,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE;AAClD,wBAAA,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE;AACxC,qBAAA;AACF,iBAAA,CAAC;AAEF,gBAAA,OAAO,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;YAC3B,CAAC;AACF,SAAA;AACF,KAAA,CAAC;AACJ;;AC9EA;;;;;AAKG;AAMH;;;;;;;;;;;;;;;;;;AAkBG;AACG,SAAU,2BAA2B,CAAC,MAA4C,EAAA;AACtF,IAAA,OAAO,wBAAwB,CAAC;AAC9B,QAAA,EAAE,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,IAAI,GAAG,EAAE,EAAE;AACzF,KAAA,CAAC;AACJ;;AClCA;;AAEG;;;;"}
+{"version":3,"file":"ngwr-overlay.mjs","sources":["../../../projects/lib/overlay/wr-overlay-close.ts","../../../projects/lib/overlay/wr-mirror-offsets.ts","../../../projects/lib/overlay/wr-outside-click.ts","../../../projects/lib/overlay/wr-overlay-container.ts","../../../projects/lib/overlay/tokens/wr-overlay.token.ts","../../../projects/lib/overlay/tokens/wr-overlay-container.token.ts","../../../projects/lib/overlay/tokens/wr-responsive-overlays.token.ts","../../../projects/lib/overlay/provide-wr-overlay.ts","../../../projects/lib/overlay/provide-wr-responsive-overlays.ts","../../../projects/lib/overlay/ngwr-overlay.ts"],"sourcesContent":["/**\n * @license\n *\n * Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://github.com/thekhegay/ngwr/blob/main/LICENSE\n */\n\nconst SVG_NS = 'http://www.w3.org/2000/svg';\n\n/** The same 24×24 stroked ✕ the rest of the library's chrome draws (alert, toast, lightbox). */\nconst CLOSE_ICON_ATTRS: readonly (readonly [string, string])[] = [\n  ['class', 'wr-icon__svg'],\n  ['viewBox', '0 0 24 24'],\n  ['fill', 'none'],\n  ['stroke', 'currentColor'],\n  ['stroke-width', '2'],\n  ['stroke-linecap', 'round'],\n  ['stroke-linejoin', 'round'],\n  ['aria-hidden', 'true'],\n];\nconst CLOSE_ICON_PATHS: readonly string[] = ['M18 6 6 18', 'm6 6 12 12'];\n\n/**\n * Builds the ✕ node by node.\n *\n * It was one `innerHTML = CLOSE_ICON`, and the string was a compile-time\n * constant, so it was never an injection risk — it was an AVAILABILITY one.\n * Under `require-trusted-types-for 'script'` an `innerHTML` write throws\n * `TrustedHTML assignment` whatever the string is, and the throw landed after\n * the overlay was on screen: a modal with no ✕, no backdrop subscription and no\n * Escape handler, over the whole application. `createElementNS` is not a\n * Trusted Types sink, so there is nothing left to police.\n */\nfunction createCloseIcon(doc: Document): SVGSVGElement {\n  const svg = doc.createElementNS(SVG_NS, 'svg');\n  // `setAttribute`, not `.className` — on an SVG element that property is an\n  // `SVGAnimatedString` and assigning a string to it silently does nothing.\n  for (const [name, value] of CLOSE_ICON_ATTRS) svg.setAttribute(name, value);\n  for (const d of CLOSE_ICON_PATHS) {\n    const path = doc.createElementNS(SVG_NS, 'path');\n    path.setAttribute('d', d);\n    svg.appendChild(path);\n  }\n  return svg;\n}\n\n/**\n * Appends a dismiss (✕) button to a service-opened overlay panel.\n *\n * `WrDialog` and `WrDrawerManager` build their panel around a component the\n * consumer supplies, so there is no template of their own to put a corner button\n * in — they call this instead. Component-driven overlays (`<wr-drawer>`) render\n * the same markup in their template.\n *\n * Uses `host.ownerDocument` rather than the global `document`, so it carries no\n * hidden browser-only assumption; callers still gate on the platform because\n * they have nothing to append to on the server.\n *\n * @param host Panel element the button is appended to (and positioned against).\n * @param className BEM class for the button, e.g. `wr-dialog__close`.\n * @param label Accessible name — already localized by the caller.\n * @param onClose Invoked on click.\n */\nexport function wrAppendOverlayClose(\n  host: HTMLElement,\n  className: string,\n  label: string,\n  onClose: () => void\n): HTMLButtonElement {\n  const button = host.ownerDocument.createElement('button');\n  button.type = 'button';\n  button.className = className;\n  button.setAttribute('aria-label', label);\n  button.appendChild(createCloseIcon(host.ownerDocument));\n  button.addEventListener('click', onClose);\n  host.appendChild(button);\n  return button;\n}\n","/**\n * @license\n *\n * Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://github.com/thekhegay/ngwr/blob/main/LICENSE\n */\n\nimport type { ConnectedPosition } from '@angular/cdk/overlay';\n\n/**\n * Mirror the horizontal offsets of a connected-position list for RTL.\n *\n * The CDK mirrors `originX` / `overlayX` under `dir=\"rtl\"` — a `start` anchor\n * resolves to the origin's right edge — but it does NOT mirror `offsetX`, which\n * it adds to the final PHYSICAL x (`_getOffset` returns `position.offsetX`\n * verbatim). So a position that meant \"sit to the inline-start of the trigger,\n * 8px clear of it\" keeps its `-8` under RTL, where the panel is now on the\n * right: the gap becomes an 8px OVERLAP, and the panel sits on top of the thing\n * it is describing.\n *\n * Nothing in the CDK will do this for us, and the amount is per position, so\n * every ngwr overlay that offsets along the inline axis passes its list through\n * here. `offsetY` is untouched: the block axis does not flip.\n *\n * @example\n * ```ts\n * const dir = inject(Directionality, { optional: true });\n *\n * strategy.withPositions(wrMirrorOffsets(WR_POPOVER_POSITIONS[position], dir?.value === 'rtl'));\n * ```\n */\nexport function wrMirrorOffsets(positions: readonly ConnectedPosition[], isRtl: boolean): ConnectedPosition[] {\n  // Copied rather than mutated even when there is nothing to do: the position\n  // tables are module-level constants shared by every instance, so handing back\n  // the same objects invites a caller to write through them.\n  if (!isRtl) return positions.map(position => ({ ...position }));\n\n  return positions.map(position => ({\n    ...position,\n    ...(position.offsetX == null ? {} : { offsetX: -position.offsetX }),\n  }));\n}\n","/**\n * @license\n *\n * Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://github.com/thekhegay/ngwr/blob/main/LICENSE\n */\n\nimport type { OverlayRef } from '@angular/cdk/overlay';\nimport { DOCUMENT, isPlatformBrowser } from '@angular/common';\nimport { PLATFORM_ID, Service, inject } from '@angular/core';\n\nimport { Observable, type Subscriber } from 'rxjs';\n\n/** One live subscription to `WrOutsideClick.outsidePointerEvents()`. */\ninterface Watcher {\n  readonly overlayRef: OverlayRef;\n  readonly subscriber: Subscriber<MouseEvent>;\n}\n\n/**\n * Shadow-piercing `event.target` — `composedPath()[0]` is the real originator\n * when the click started inside a shadow root, where `target` is retargeted to\n * the host.\n */\nfunction eventTarget(event: Event): EventTarget | null {\n  if (event.composedPath) {\n    try {\n      return event.composedPath()[0] ?? event.target;\n    } catch {\n      /* Detached / synthetic events can throw — fall through to `target`. */\n    }\n  }\n  return event.target;\n}\n\n/** `parent.contains(child)`, but stepping out of shadow roots through their hosts. */\nfunction containsAcrossShadow(parent: Node, child: EventTarget | null): boolean {\n  const hasShadowRoot = typeof ShadowRoot !== 'undefined';\n  let current = child as Node | null;\n  while (current) {\n    if (current === parent) return true;\n    current = hasShadowRoot && current instanceof ShadowRoot ? current.host : current.parentNode;\n  }\n  return false;\n}\n\n/**\n * Outside-click source for overlays — a drop-in replacement for\n * `OverlayRef.outsidePointerEvents()`.\n *\n * **Why this exists.** CDK's `OverlayOutsideClickDispatcher` binds its\n * listeners to `document.body`. When page content is shorter than the viewport,\n * a click in the empty space below it targets `<html>` — and `<html>` is\n * `body`'s *parent*, so the event bubbles straight to the document and `body`\n * never sees it. The overlay silently stays open. Listening on the document\n * itself catches both cases, and costs nothing else.\n *\n * Semantics are otherwise identical to the CDK's, deliberately:\n *\n * - Emits on `click` / `auxclick` / `contextmenu`, in the capture phase, and\n *   tracks `pointerdown` so a `click` is judged by where the press *started*\n *   (a drag that ends outside the pane doesn't count as an outside click).\n * - Walks watchers top-most first and stops at the first one that contains the\n *   event, so clicking inside a stacked overlay can't close the ones beneath\n *   it (a `wr-select` opened inside a `wr-popover`, say).\n * - Fires for the very click that opened the overlay, which is why every caller\n *   also ignores events landing on its own trigger.\n *\n * Registration is per subscription: the document listeners go up with the first\n * watcher and come down with the last, so an app with no open overlay has none.\n * That sentence was aspirational until v11 — see {@link outsidePointerEvents}.\n */\n@Service()\nexport class WrOutsideClick {\n  private readonly doc = inject(DOCUMENT);\n  private readonly isBrowser = isPlatformBrowser(inject(PLATFORM_ID));\n\n  /** In attach order — last is top-most. */\n  private readonly watchers: Watcher[] = [];\n  private cleanup: (() => void) | null = null;\n  private pressOrigin: EventTarget | null = null;\n\n  /**\n   * Emits every `click` / `auxclick` / `contextmenu` that lands outside the\n   * given overlay's pane, for as long as the overlay is attached.\n   *\n   * **It completes when the overlay detaches, and that is load-bearing.** Every\n   * one of the ten call sites subscribes inside its own `openOverlay()` and\n   * pipes `takeUntilDestroyed(destroyRef)` — a DIRECTIVE lifetime, not an\n   * overlay one — and none of them unsubscribes on close, because the natural\n   * reading of that idiom is \"this ends with the component\". Without the\n   * completion below the teardown never ran: one watcher accumulated per OPEN\n   * for the life of the page, each pinning a disposed `OverlayRef` (and through\n   * it a detached pane, its portal outlet and their injectors), the four\n   * capture-phase document listeners could never come down because\n   * `watchers.length` never reached zero, and every click on the page walked a\n   * list that only grew. A `mode=\"tooltip\"` popover made it unbounded — one\n   * permanent watcher per hover.\n   *\n   * Completing here rather than fixing ten call sites is deliberate: the next\n   * component to open an overlay would have made the same reasonable mistake.\n   * It is also what CDK's own `OverlayRef.outsidePointerEvents()` does.\n   */\n  outsidePointerEvents(overlayRef: OverlayRef): Observable<MouseEvent> {\n    return new Observable<MouseEvent>(subscriber => {\n      if (!this.isBrowser) return;\n\n      const watcher: Watcher = { overlayRef, subscriber };\n      this.watchers.push(watcher);\n      if (this.watchers.length === 1) this.listen();\n\n      // BOTH handlers, and the second one is not defensive padding. `dispose()`\n      // emits a detachment and then completes the subject, so a live overlay\n      // arrives through `next` — but a ref that was already disposed before\n      // anyone subscribed has nothing left to emit and arrives through\n      // `complete` alone. Listening for `next` only left exactly the watcher\n      // this whole change exists to remove.\n      const ended = (): void => subscriber.complete();\n      const detached = overlayRef.detachments().subscribe({ next: ended, complete: ended });\n\n      return () => {\n        detached.unsubscribe();\n        const index = this.watchers.indexOf(watcher);\n        if (index > -1) this.watchers.splice(index, 1);\n        if (!this.watchers.length) this.unlisten();\n      };\n    });\n  }\n\n  private readonly onPointerDown = (event: Event): void => {\n    this.pressOrigin = eventTarget(event);\n  };\n\n  private readonly onClick = (event: Event): void => {\n    const target = eventTarget(event);\n    // `detail > 0` means the click really came from a pointer press. A click\n    // activated by Enter or Space carries `detail: 0` and has no `pointerdown`\n    // of its own — so trusting a leftover origin there judged it by a press\n    // that belonged to something else entirely. A press inside the pane that\n    // never produced a click (a drag released off-window, a node removed under\n    // the finger, a cancelled touch) survives in `pressOrigin`, and the next\n    // keyboard activation anywhere on the page then read as \"inside\": the panel\n    // would not close, for keyboard users only.\n    const fromPointer = event.type === 'click' && (event as MouseEvent).detail > 0;\n    const origin = fromPointer && this.pressOrigin ? this.pressOrigin : target;\n    this.pressOrigin = null;\n\n    // Snapshot: a watcher that closes on this event unsubscribes synchronously,\n    // mutating `watchers` while we're walking it.\n    const watchers = this.watchers.slice();\n    for (let i = watchers.length - 1; i > -1; i--) {\n      const { overlayRef, subscriber } = watchers[i];\n      if (!overlayRef.hasAttached()) continue;\n\n      const pane = overlayRef.overlayElement;\n      if (containsAcrossShadow(pane, target) || containsAcrossShadow(pane, origin)) break;\n\n      subscriber.next(event as MouseEvent);\n    }\n  };\n\n  private listen(): void {\n    const options: AddEventListenerOptions = { capture: true };\n    const doc = this.doc;\n\n    doc.addEventListener('pointerdown', this.onPointerDown, options);\n    doc.addEventListener('click', this.onClick, options);\n    doc.addEventListener('auxclick', this.onClick, options);\n    doc.addEventListener('contextmenu', this.onClick, options);\n\n    this.cleanup = () => {\n      doc.removeEventListener('pointerdown', this.onPointerDown, options);\n      doc.removeEventListener('click', this.onClick, options);\n      doc.removeEventListener('auxclick', this.onClick, options);\n      doc.removeEventListener('contextmenu', this.onClick, options);\n    };\n  }\n\n  private unlisten(): void {\n    this.cleanup?.();\n    this.cleanup = null;\n    this.pressOrigin = null;\n  }\n}\n","/**\n * @license\n *\n * Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://github.com/thekhegay/ngwr/blob/main/LICENSE\n */\n\nimport { OverlayContainer } from '@angular/cdk/overlay';\nimport { Service } from '@angular/core';\n\n/**\n * Custom CDK `OverlayContainer` subclass that tags its DOM element with\n * `.wr-overlay-container` in addition to CDK's own `.cdk-overlay-container`.\n *\n * Why: CDK uses a single overlay container per app — every CDK consumer\n * (this lib, Angular Material, NG-ZORRO, etc.) puts its overlays in the\n * same root element. With this class applied you can scope NGWR-specific\n * overlay styles via the tag, e.g.:\n *\n * ```scss\n * .wr-overlay-container .cdk-overlay-pane { z-index: 1100; }\n * ```\n *\n * It does **not** isolate two libraries that both subclass OverlayContainer\n * — the last provider wins. It does give NGWR overlays a stable CSS hook.\n */\n@Service()\nexport class WrOverlayContainer extends OverlayContainer {\n  protected override _createContainer(): void {\n    super._createContainer();\n    this._containerElement?.classList.add('wr-overlay-container');\n  }\n}\n","/**\n * @license\n *\n * Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://github.com/thekhegay/ngwr/blob/main/LICENSE\n */\n\nimport { Overlay } from '@angular/cdk/overlay';\nimport { InjectionToken, inject } from '@angular/core';\n\n/**\n * Injection token for the CDK `Overlay` service NGWR components should\n * use to open panels.\n *\n * Defaults to CDK's root `Overlay` (shared with every other CDK consumer\n * in the app). Call `provideWrOverlay()` to bind it to an isolated\n * `Overlay` instance backed by a separate `OverlayContainer` — that way\n * NGWR overlays don't share the same DOM root with other libraries.\n *\n * @internal — directives/services inside the lib inject this instead of\n * CDK's `Overlay` directly.\n */\nexport const WR_OVERLAY = new InjectionToken<Overlay>('WR_OVERLAY', {\n  providedIn: 'root',\n  factory: () => inject(Overlay),\n});\n","/**\n * @license\n *\n * Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://github.com/thekhegay/ngwr/blob/main/LICENSE\n */\n\nimport { OverlayContainer } from '@angular/cdk/overlay';\nimport { InjectionToken, inject } from '@angular/core';\n\n/**\n * Injection token for the overlay container NGWR components should use.\n *\n * Defaults to CDK's `OverlayContainer` — i.e. the same root element every\n * CDK consumer shares. Call `provideWrOverlay()` to replace it with an\n * isolated instance so NGWR overlays don't collide with other libraries.\n *\n * @internal\n */\nexport const WR_OVERLAY_CONTAINER = new InjectionToken<OverlayContainer>('WR_OVERLAY_CONTAINER', {\n  providedIn: 'root',\n  factory: () => inject(OverlayContainer),\n});\n","/**\n * @license\n *\n * Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://github.com/thekhegay/ngwr/blob/main/LICENSE\n */\n\nimport { InjectionToken } from '@angular/core';\n\n/** Configuration for responsive (bottom-sheet) overlay presentation. */\ninterface WrResponsiveOverlaysConfig {\n  /**\n   * Viewport width (CSS px) at or below which overlays present as a\n   * bottom-sheet instead of a floating panel. @default 640\n   */\n  readonly breakpoint: number;\n}\n\n/**\n * When set, overlay services (dialog, select, dropdown, …) present as a\n * slide-up bottom-sheet on viewports at or below `breakpoint`. `null`\n * (the default) keeps every overlay floating. Configure via\n * {@link provideWrResponsiveOverlays}; override per call with a\n * component's `responsive` option.\n *\n * @internal\n */\nconst WR_RESPONSIVE_OVERLAYS = new InjectionToken<WrResponsiveOverlaysConfig | null>('WR_RESPONSIVE_OVERLAYS', {\n  factory: () => null,\n});\n\n/**\n * Decide whether an overlay should present as a bottom-sheet for the\n * current viewport.\n *\n * - `responsive === true` — sheet on small viewports regardless of config.\n * - `responsive === false` — never a sheet.\n * - `responsive === undefined` — follow the global config (sheet when\n *   {@link provideWrResponsiveOverlays} is configured).\n *\n * SSR-safe: returns `false` when there's no `window`.\n *\n * @internal\n */\nfunction wrPresentAsSheet(responsive: boolean | undefined, config: WrResponsiveOverlaysConfig | null): boolean {\n  const enabled = responsive ?? config !== null;\n  if (!enabled || typeof window === 'undefined') return false;\n  return window.innerWidth <= (config?.breakpoint ?? 640);\n}\n\nexport { WR_RESPONSIVE_OVERLAYS, wrPresentAsSheet };\nexport type { WrResponsiveOverlaysConfig };\n","/**\n * @license\n *\n * Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://github.com/thekhegay/ngwr/blob/main/LICENSE\n */\n\nimport { Overlay, OverlayContainer } from '@angular/cdk/overlay';\nimport {\n  EnvironmentInjector,\n  Injector,\n  type EnvironmentProviders,\n  inject,\n  makeEnvironmentProviders,\n  provideEnvironmentInitializer,\n} from '@angular/core';\n\nimport { WrVisualViewport } from 'ngwr/platform';\n\nimport { WR_OVERLAY, WR_OVERLAY_CONTAINER } from './tokens';\nimport { WrOverlayContainer } from './wr-overlay-container';\n\n/**\n * Isolates NGWR overlays from other CDK consumers in the app.\n *\n * Without this call, NGWR overlays use CDK's root `Overlay` — they\n * render into the same `.cdk-overlay-container` element as Angular\n * Material, NG-ZORRO, etc. With it, NGWR gets its own `OverlayContainer`\n * (marked `.wr-overlay-container`) **and** its own `Overlay` service\n * instance — so styles, z-index, and lifecycle never collide.\n *\n * It does this by replacing two injection tokens:\n * - `WR_OVERLAY_CONTAINER` → custom `WrOverlayContainer` subclass\n * - `WR_OVERLAY` → a fresh `Overlay` instance built in a child injector\n *   that resolves `OverlayContainer` to the custom subclass\n *\n * CDK's own root `Overlay` / `OverlayContainer` are left untouched, so\n * other libraries keep working with their original container.\n *\n * @example\n * ```ts\n * import { provideWrOverlay } from 'ngwr/overlay';\n *\n * bootstrapApplication(AppComponent, {\n *   providers: [\n *     provideWrOverlay(),\n *   ],\n * });\n * ```\n */\nexport function provideWrOverlay(): EnvironmentProviders {\n  return makeEnvironmentProviders([\n    // Track the visual viewport app-wide so overlay sheets (and the\n    // command-palette) can lift above the on-screen keyboard. No-op on the\n    // server / in browsers without the API.\n    provideEnvironmentInitializer(() => void inject(WrVisualViewport)),\n    { provide: WR_OVERLAY_CONTAINER, useClass: WrOverlayContainer },\n    {\n      provide: WR_OVERLAY,\n      useFactory: (): Overlay => {\n        const parent = inject(EnvironmentInjector);\n        const container = inject(WR_OVERLAY_CONTAINER);\n\n        // Child injector resolves `OverlayContainer` to our subclass and\n        // creates a fresh `Overlay` instance bound to it. CDK's own root\n        // `Overlay` and `OverlayContainer` are untouched in the parent.\n        const child = Injector.create({\n          parent,\n          providers: [\n            { provide: OverlayContainer, useValue: container },\n            { provide: Overlay, useClass: Overlay },\n          ],\n        });\n\n        return child.get(Overlay);\n      },\n    },\n  ]);\n}\n","/**\n * @license\n *\n * Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://github.com/thekhegay/ngwr/blob/main/LICENSE\n */\n\nimport { type EnvironmentProviders, makeEnvironmentProviders } from '@angular/core';\n\nimport { WR_RESPONSIVE_OVERLAYS, type WrResponsiveOverlaysConfig } from './tokens/wr-responsive-overlays.token';\n\n/**\n * Opt every NGWR overlay into responsive presentation — on viewports at or\n * below `breakpoint`, dialogs / selects / dropdowns and friends slide up as\n * a full-width bottom-sheet instead of a floating panel. Built on the same\n * overlay plumbing, so focus-trap, backdrop and scroll-blocking carry over.\n *\n * Individual components can still opt out (or in) per instance via their\n * `responsive` option.\n *\n * @example\n * ```ts\n * bootstrapApplication(AppComponent, {\n *   providers: [provideWrOverlay(), provideWrResponsiveOverlays()],\n * });\n *\n * // Custom breakpoint:\n * provideWrResponsiveOverlays({ breakpoint: 768 });\n * ```\n */\nexport function provideWrResponsiveOverlays(config?: Partial<WrResponsiveOverlaysConfig>): EnvironmentProviders {\n  return makeEnvironmentProviders([\n    { provide: WR_RESPONSIVE_OVERLAYS, useValue: { breakpoint: config?.breakpoint ?? 640 } },\n  ]);\n}\n","/**\n * Generated bundle index. Do not edit.\n */\n\nexport * from './public-api';\n"],"names":[],"mappings":";;;;;;;AAAA;;;;;AAKG;AAEH,MAAM,MAAM,GAAG,4BAA4B;AAE3C;AACA,MAAM,gBAAgB,GAA2C;IAC/D,CAAC,OAAO,EAAE,cAAc,CAAC;IACzB,CAAC,SAAS,EAAE,WAAW,CAAC;IACxB,CAAC,MAAM,EAAE,MAAM,CAAC;IAChB,CAAC,QAAQ,EAAE,cAAc,CAAC;IAC1B,CAAC,cAAc,EAAE,GAAG,CAAC;IACrB,CAAC,gBAAgB,EAAE,OAAO,CAAC;IAC3B,CAAC,iBAAiB,EAAE,OAAO,CAAC;IAC5B,CAAC,aAAa,EAAE,MAAM,CAAC;CACxB;AACD,MAAM,gBAAgB,GAAsB,CAAC,YAAY,EAAE,YAAY,CAAC;AAExE;;;;;;;;;;AAUG;AACH,SAAS,eAAe,CAAC,GAAa,EAAA;IACpC,MAAM,GAAG,GAAG,GAAG,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC;;;AAG9C,IAAA,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,gBAAgB;AAAE,QAAA,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC;AAC3E,IAAA,KAAK,MAAM,CAAC,IAAI,gBAAgB,EAAE;QAChC,MAAM,IAAI,GAAG,GAAG,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC;AAChD,QAAA,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC;AACzB,QAAA,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC;IACvB;AACA,IAAA,OAAO,GAAG;AACZ;AAEA;;;;;;;;;;;;;;;;AAgBG;AACG,SAAU,oBAAoB,CAClC,IAAiB,EACjB,SAAiB,EACjB,KAAa,EACb,OAAmB,EAAA;IAEnB,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,QAAQ,CAAC;AACzD,IAAA,MAAM,CAAC,IAAI,GAAG,QAAQ;AACtB,IAAA,MAAM,CAAC,SAAS,GAAG,SAAS;AAC5B,IAAA,MAAM,CAAC,YAAY,CAAC,YAAY,EAAE,KAAK,CAAC;IACxC,MAAM,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;AACvD,IAAA,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC;AACzC,IAAA,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;AACxB,IAAA,OAAO,MAAM;AACf;;AC7EA;;;;;AAKG;AAIH;;;;;;;;;;;;;;;;;;;;;AAqBG;AACG,SAAU,eAAe,CAAC,SAAuC,EAAE,KAAc,EAAA;;;;AAIrF,IAAA,IAAI,CAAC,KAAK;AAAE,QAAA,OAAO,SAAS,CAAC,GAAG,CAAC,QAAQ,KAAK,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;IAE/D,OAAO,SAAS,CAAC,GAAG,CAAC,QAAQ,KAAK;AAChC,QAAA,GAAG,QAAQ;QACX,IAAI,QAAQ,CAAC,OAAO,IAAI,IAAI,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;AACpE,KAAA,CAAC,CAAC;AACL;;ACtBA;;;;AAIG;AACH,SAAS,WAAW,CAAC,KAAY,EAAA;AAC/B,IAAA,IAAI,KAAK,CAAC,YAAY,EAAE;AACtB,QAAA,IAAI;YACF,OAAO,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM;QAChD;AAAE,QAAA,MAAM;;QAER;IACF;IACA,OAAO,KAAK,CAAC,MAAM;AACrB;AAEA;AACA,SAAS,oBAAoB,CAAC,MAAY,EAAE,KAAyB,EAAA;AACnE,IAAA,MAAM,aAAa,GAAG,OAAO,UAAU,KAAK,WAAW;IACvD,IAAI,OAAO,GAAG,KAAoB;IAClC,OAAO,OAAO,EAAE;QACd,IAAI,OAAO,KAAK,MAAM;AAAE,YAAA,OAAO,IAAI;AACnC,QAAA,OAAO,GAAG,aAAa,IAAI,OAAO,YAAY,UAAU,GAAG,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,UAAU;IAC9F;AACA,IAAA,OAAO,KAAK;AACd;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;AAyBG;MAEU,cAAc,CAAA;AACR,IAAA,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC;IACtB,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;;IAGlD,QAAQ,GAAc,EAAE;IACjC,OAAO,GAAwB,IAAI;IACnC,WAAW,GAAuB,IAAI;AAE9C;;;;;;;;;;;;;;;;;;;;AAoBG;AACH,IAAA,oBAAoB,CAAC,UAAsB,EAAA;AACzC,QAAA,OAAO,IAAI,UAAU,CAAa,UAAU,IAAG;YAC7C,IAAI,CAAC,IAAI,CAAC,SAAS;gBAAE;AAErB,YAAA,MAAM,OAAO,GAAY,EAAE,UAAU,EAAE,UAAU,EAAE;AACnD,YAAA,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;AAC3B,YAAA,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,IAAI,CAAC,MAAM,EAAE;;;;;;;YAQ7C,MAAM,KAAK,GAAG,MAAY,UAAU,CAAC,QAAQ,EAAE;AAC/C,YAAA,MAAM,QAAQ,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAErF,YAAA,OAAO,MAAK;gBACV,QAAQ,CAAC,WAAW,EAAE;gBACtB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;gBAC5C,IAAI,KAAK,GAAG,CAAC,CAAC;oBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;AAC9C,gBAAA,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM;oBAAE,IAAI,CAAC,QAAQ,EAAE;AAC5C,YAAA,CAAC;AACH,QAAA,CAAC,CAAC;IACJ;AAEiB,IAAA,aAAa,GAAG,CAAC,KAAY,KAAU;AACtD,QAAA,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC;AACvC,IAAA,CAAC;AAEgB,IAAA,OAAO,GAAG,CAAC,KAAY,KAAU;AAChD,QAAA,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC;;;;;;;;;AASjC,QAAA,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,KAAK,OAAO,IAAK,KAAoB,CAAC,MAAM,GAAG,CAAC;AAC9E,QAAA,MAAM,MAAM,GAAG,WAAW,IAAI,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,GAAG,MAAM;AAC1E,QAAA,IAAI,CAAC,WAAW,GAAG,IAAI;;;QAIvB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE;AACtC,QAAA,KAAK,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YAC7C,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC;AAC9C,YAAA,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE;gBAAE;AAE/B,YAAA,MAAM,IAAI,GAAG,UAAU,CAAC,cAAc;AACtC,YAAA,IAAI,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC;gBAAE;AAE9E,YAAA,UAAU,CAAC,IAAI,CAAC,KAAmB,CAAC;QACtC;AACF,IAAA,CAAC;IAEO,MAAM,GAAA;AACZ,QAAA,MAAM,OAAO,GAA4B,EAAE,OAAO,EAAE,IAAI,EAAE;AAC1D,QAAA,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG;QAEpB,GAAG,CAAC,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC;QAChE,GAAG,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;QACpD,GAAG,CAAC,gBAAgB,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;QACvD,GAAG,CAAC,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;AAE1D,QAAA,IAAI,CAAC,OAAO,GAAG,MAAK;YAClB,GAAG,CAAC,mBAAmB,CAAC,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC;YACnE,GAAG,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;YACvD,GAAG,CAAC,mBAAmB,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;YAC1D,GAAG,CAAC,mBAAmB,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;AAC/D,QAAA,CAAC;IACH;IAEQ,QAAQ,GAAA;AACd,QAAA,IAAI,CAAC,OAAO,IAAI;AAChB,QAAA,IAAI,CAAC,OAAO,GAAG,IAAI;AACnB,QAAA,IAAI,CAAC,WAAW,GAAG,IAAI;IACzB;uGA7GW,cAAc,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,OAAA,EAAA,CAAA;wGAAd,cAAc,EAAA,CAAA;;2FAAd,cAAc,EAAA,UAAA,EAAA,CAAA;kBAD1B;;;ACxED;;;;;AAKG;AAKH;;;;;;;;;;;;;;;AAeG;AAEG,MAAO,kBAAmB,SAAQ,gBAAgB,CAAA;IACnC,gBAAgB,GAAA;QACjC,KAAK,CAAC,gBAAgB,EAAE;QACxB,IAAI,CAAC,iBAAiB,EAAE,SAAS,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAC/D;uGAJW,kBAAkB,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,OAAA,EAAA,CAAA;wGAAlB,kBAAkB,EAAA,CAAA;;2FAAlB,kBAAkB,EAAA,UAAA,EAAA,CAAA;kBAD9B;;;AC1BD;;;;;AAKG;AAKH;;;;;;;;;;;AAWG;MACU,UAAU,GAAG,IAAI,cAAc,CAAU,YAAY,EAAE;AAClE,IAAA,UAAU,EAAE,MAAM;AAClB,IAAA,OAAO,EAAE,MAAM,MAAM,CAAC,OAAO,CAAC;AAC/B,CAAA;;ACzBD;;;;;AAKG;AAKH;;;;;;;;AAQG;MACU,oBAAoB,GAAG,IAAI,cAAc,CAAmB,sBAAsB,EAAE;AAC/F,IAAA,UAAU,EAAE,MAAM;AAClB,IAAA,OAAO,EAAE,MAAM,MAAM,CAAC,gBAAgB,CAAC;AACxC,CAAA;;ACtBD;;;;;AAKG;AAaH;;;;;;;;AAQG;AACH,MAAM,sBAAsB,GAAG,IAAI,cAAc,CAAoC,wBAAwB,EAAE;AAC7G,IAAA,OAAO,EAAE,MAAM,IAAI;AACpB,CAAA;AAED;;;;;;;;;;;;AAYG;AACH,SAAS,gBAAgB,CAAC,UAA+B,EAAE,MAAyC,EAAA;AAClG,IAAA,MAAM,OAAO,GAAG,UAAU,IAAI,MAAM,KAAK,IAAI;AAC7C,IAAA,IAAI,CAAC,OAAO,IAAI,OAAO,MAAM,KAAK,WAAW;AAAE,QAAA,OAAO,KAAK;IAC3D,OAAO,MAAM,CAAC,UAAU,KAAK,MAAM,EAAE,UAAU,IAAI,GAAG,CAAC;AACzD;;AChDA;;;;;AAKG;AAiBH;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BG;SACa,gBAAgB,GAAA;AAC9B,IAAA,OAAO,wBAAwB,CAAC;;;;QAI9B,6BAA6B,CAAC,MAAM,KAAK,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAClE,QAAA,EAAE,OAAO,EAAE,oBAAoB,EAAE,QAAQ,EAAE,kBAAkB,EAAE;AAC/D,QAAA;AACE,YAAA,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,MAAc;AACxB,gBAAA,MAAM,MAAM,GAAG,MAAM,CAAC,mBAAmB,CAAC;AAC1C,gBAAA,MAAM,SAAS,GAAG,MAAM,CAAC,oBAAoB,CAAC;;;;AAK9C,gBAAA,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC;oBAC5B,MAAM;AACN,oBAAA,SAAS,EAAE;AACT,wBAAA,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE;AAClD,wBAAA,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE;AACxC,qBAAA;AACF,iBAAA,CAAC;AAEF,gBAAA,OAAO,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;YAC3B,CAAC;AACF,SAAA;AACF,KAAA,CAAC;AACJ;;AC9EA;;;;;AAKG;AAMH;;;;;;;;;;;;;;;;;;AAkBG;AACG,SAAU,2BAA2B,CAAC,MAA4C,EAAA;AACtF,IAAA,OAAO,wBAAwB,CAAC;AAC9B,QAAA,EAAE,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,IAAI,GAAG,EAAE,EAAE;AACzF,KAAA,CAAC;AACJ;;AClCA;;AAEG;;;;"}

package/fesm2022/ngwr-qr.mjs

@@ -919,10 +919,47 @@ function drawModules(ctx, code, padding, color) {
         }
     }
 }
+/**
+ * The `iconUrl` a consumer bound, or `null` when it names a scheme an image must
+ * not fetch.
+ *
+ * A security audit of 13.0.0 bound an attacker-shaped `[iconUrl]` and watched the
+ * page make the request: the value went to `new Image().src` verbatim, which is
+ * the one thing Angular would have sanitised had the template written `[src]`
+ * itself. The library does the loading here, so the app loses that protection
+ * without being told.
+ *
+ * Same rules as `safeMarkdownUrl` in `ngwr/markdown`, and deliberately a copy
+ * rather than an import: an entry point may not depend on another's internals,
+ * and one call site does not earn a shared util. A third would — put it in
+ * `ngwr/utils` beside `isSafeCssValue` when that happens.
+ *
+ * `data:` is allowed for raster types only. An SVG can carry script, and
+ * `data:text/html` is a same-origin document.
+ */
+function safeIconUrl(raw) {
+    const url = raw.trim();
+    // Control characters are stripped BEFORE the scheme is read: a browser ignores
+    // them while resolving, so a check reading the raw string sees a relative path
+    // and waves `java\u0000script:` through.
+    // eslint-disable-next-line no-control-regex
+    const bare = url.replace(/[\s\u0000-\u001f\u007f]/g, '');
+    const scheme = /^([a-z][a-z0-9+.-]*):/i.exec(bare);
+    // No scheme: a relative path or `//host` — nothing executable.
+    if (!scheme)
+        return url;
+    const name = scheme[1].toLowerCase();
+    if (name === 'data')
+        return /^data:image\/(?:png|jpe?g|gif|webp|avif);base64,[a-z0-9+/=]+$/i.test(bare) ? bare : null;
+    return name === 'http' || name === 'https' ? url : null;
+}
 function overlayIcon(canvas, ctx, options) {
+    const src = safeIconUrl(options.iconUrl);
+    if (src === null)
+        return;
     const iconImg = new Image();
     iconImg.crossOrigin = 'anonymous';
-    iconImg.src = options.iconUrl;
+    iconImg.src = src;
     const ratio = canvas.width / options.size;
     const iconPx = (options.iconSize ?? 42) * ratio;
     const coord = canvas.width / 2 - iconPx / 2;