sveltekit-ui 1.1.74 → 1.1.76

package/dist/actions/stop_scroll_propagation_y.js

@@ -4,39 +4,47 @@ export default function stop_scroll_propagation_y(node) {
     if (e.deltaY) {
       dy = e.deltaY
     } else if (e.wheelDelta) {
-      dy = e.wheelDelta
+      dy = -e.wheelDelta
     }
     check_to_prevent(e, dy)
   }
 
   let prev_touch_y
   const handle_touchstart = (e) => {
-    prev_touch_y = e.changedTouches[0].clientY
+    const touch = e.changedTouches?.[0]
+    if (!touch) return
+    prev_touch_y = touch.clientY
   }
   const handle_touchmove = (e) => {
-    let dy = prev_touch_y - e.changedTouches[0].clientY
+    const touch = e.changedTouches?.[0]
+    if (!touch || !Number.isFinite(prev_touch_y)) return
+    let dy = prev_touch_y - touch.clientY
     check_to_prevent(e, dy)
-    prev_touch_y = e.changedTouches[0].clientY
+    prev_touch_y = touch.clientY
   }
 
   function check_to_prevent(e, dy) {
-    if (node.scrollTop === 0 && dy < 0) {
+    const max_scroll_top = Math.max(0, node.scrollHeight - node.clientHeight)
+    if (node.scrollTop <= 0 && dy < 0) {
       e.stopPropagation()
       if (e.cancelable) e.preventDefault()
-    } else if (node.scrollTop === node.scrollHeight - node.clientHeight && dy > 0) {
+    } else if (node.scrollTop >= max_scroll_top && dy > 0) {
       e.stopPropagation()
       if (e.cancelable) e.preventDefault()
     }
   }
-  node.addEventListener("wheel", handle_wheel, { passive: true })
-  node.addEventListener("touchmove", handle_touchmove)
-  node.addEventListener("touchstart", handle_touchstart)
+  const wheel_listener_options = { passive: false }
+  const touchmove_listener_options = { passive: false }
+  const touchstart_listener_options = { passive: true }
+  node.addEventListener("wheel", handle_wheel, wheel_listener_options)
+  node.addEventListener("touchmove", handle_touchmove, touchmove_listener_options)
+  node.addEventListener("touchstart", handle_touchstart, touchstart_listener_options)
 
   return {
     destroy() {
-      node.removeEventListener("wheel", handle_wheel)
-      node.removeEventListener("touchmove", handle_touchmove)
-      node.removeEventListener("touchstart", handle_touchstart)
+      node.removeEventListener("wheel", handle_wheel, wheel_listener_options)
+      node.removeEventListener("touchmove", handle_touchmove, touchmove_listener_options)
+      node.removeEventListener("touchstart", handle_touchstart, touchstart_listener_options)
     },
   }
 }

package/dist/actions/swipe_handler.d.ts

@@ -0,0 +1,3 @@
+export default function swipe_handler(node: any): {
+    destroy(): void;
+};

package/dist/actions/swipe_handler.js

@@ -91,9 +91,16 @@ export default function swipe_handler(node) {
   }
 
   let timer_y
+  function clear_reset_timer() {
+    if (timer_y != null) {
+      clearTimeout(timer_y)
+      timer_y = null
+    }
+  }
   function reset_timer() {
-    timer_y && clearTimeout(timer_y)
+    clear_reset_timer()
     timer_y = setTimeout(() => {
+      timer_y = null
       // set_dy(0, 0)
       smooth_dy_to_zero()
       smooth_dx_to_zero()
@@ -228,35 +235,39 @@ export default function swipe_handler(node) {
   let dy_outer_at_start
   let dx_outer_at_start
   const handle_touchstart = (e) => {
-    touch_reference_y = e.changedTouches[0].clientY
+    const touch = e.changedTouches?.[0]
+    if (!touch) return
+    touch_reference_y = touch.clientY
     dy_outer_at_start = dy_outer
-    touch_reference_x = e.changedTouches[0].clientX
+    touch_reference_x = touch.clientX
     dx_outer_at_start = dx_outer
     // e.stopPropagation()
   }
 
   const handle_touchmove = (e) => {
+    const touch = e.changedTouches?.[0]
+    if (!touch) return
     if (is_at_bottom || is_at_top) {
-      if (!touch_reference_y) {
-        touch_reference_y = e.changedTouches[0].clientY
+      if (touch_reference_y == null) {
+        touch_reference_y = touch.clientY
         dy_outer_at_start = 0
       }
       set_dy(
         null,
         Math.round(
-          dy_outer_at_start + touch_reference_y - e.changedTouches[0].clientY
+          dy_outer_at_start + touch_reference_y - touch.clientY
         )
       )
     }
     if (is_at_left || is_at_right) {
-      if (!touch_reference_x) {
-        touch_reference_x = e.changedTouches[0].clientX
+      if (touch_reference_x == null) {
+        touch_reference_x = touch.clientX
         dx_outer_at_start = 0
       }
       set_dx(
         null,
         Math.round(
-          dx_outer_at_start + touch_reference_x - e.changedTouches[0].clientX
+          dx_outer_at_start + touch_reference_x - touch.clientX
         )
       )
     }
@@ -271,8 +282,13 @@ export default function swipe_handler(node) {
   }
 
   const handleTouchend = () => {
+    clear_reset_timer()
     smooth_dy_to_zero()
     smooth_dx_to_zero()
+    is_reference_scroll_top_set = false
+    touch_reference_y = null
+    is_reference_scroll_left_set = false
+    touch_reference_x = null
   }
 
   node.addEventListener("scroll", handle_scroll)
@@ -283,6 +299,7 @@ export default function swipe_handler(node) {
 
   return {
     destroy() {
+      clear_reset_timer()
       node.removeEventListener("scroll", handle_scroll)
       node.removeEventListener("wheel", handle_wheel, { passive: true })
       node.removeEventListener("touchstart", handle_touchstart, {

package/dist/client/astc_formatting/index.d.ts

@@ -0,0 +1,25 @@
+export function astc_element(type_id: any, children?: any[], attrs?: {}): {
+    type_id: any;
+    selector_id: string;
+    children: any[];
+    attributes: {};
+};
+export function markdown_to_astc(markdown: any): {
+    type_id: string;
+    children: any;
+    attributes: {};
+    selector_id: string;
+};
+export function astc_to_markdown(astc: any): any;
+export function get_variable_from_path(path: any, variables: any, defs: any): any;
+export function clean_variable_path(path: any, variables: any, defs: any): any[] | null;
+export function clean_attributes_from_variable_path(attributes: any, variables: any, defs: any): any;
+export function astc_to_static_attributes(astc: any, variables: any, defs: any): any;
+export function astc_to_embedding_text(astc: any): string;
+export function hcl_to_hex(h: any, c: any, l: any): string;
+export function astc_to_email_html(astc: any, options: any, slots_html_and_text_body: any): any;
+export function variables_data_type_remaining_to_astc(variables_data_type_remaining: any, preferred_content_use?: string, leading_variable_path?: any[]): any;
+export function json_to_data_type(data: any, type?: null, is_list_child?: boolean): {
+    type: null;
+    attributes: {};
+};

package/dist/client/astc_formatting/index.js

@@ -1,4 +1,5 @@
 import { create_unique_id, deep_copy, time_zone_options, language_options } from "../index.js"
+import { normalize_link_href } from "../links.js"
 
 export function astc_element(type_id, children = [], attrs = {}) {
   return {
@@ -477,13 +478,53 @@ export function hcl_to_hex(h, c, l) {
   return `#${r}${g}${b}`
 }
 
-function attribute_to_string(attr_obj) {
-  return attr_obj
-    ? Object.entries(attr_obj || {})
-        .filter(([key, value]) => value !== null)
-        .map(([key, value]) => `${key}="${value}"`)
-        .join(" ")
-    : ""
+function escape_html(input) {
+  return String(input ?? "").replace(
+    /[&<>"']/g,
+    (character) =>
+      ({
+        "&": "&amp;",
+        "<": "&lt;",
+        ">": "&gt;",
+        '"': "&quot;",
+        "'": "&#39;",
+      })[character]
+  )
+}
+
+function sanitize_css_value(input, fallback = "") {
+  const value = String(input ?? "").trim()
+  return value && !/[<>"'{};\\]/.test(value) && !/(?:url|expression)\s*\(|@import/i.test(value) ? value : fallback
+}
+
+function normalize_email_image_src(input) {
+  const src = String(input ?? "").trim()
+  if (!src || /[\u0000-\u001f\u007f\\]/.test(src)) return null
+  if (/^cid:[a-z0-9._@+-]+$/i.test(src)) return src
+  if (/^data:image\/(?:avif|gif|jpeg|png|webp);base64,[a-z0-9+/=\s]+$/i.test(src)) return src
+  const href = normalize_link_href(src)
+  return href && !/^(?:mailto|tel):/i.test(href) ? href : null
+}
+
+const safe_email_attributes = new Set([
+  "align",
+  "class",
+  "colspan",
+  "dir",
+  "height",
+  "id",
+  "lang",
+  "rowspan",
+  "title",
+  "valign",
+  "width",
+])
+
+function attribute_to_string(attr_obj, allowed_attributes = safe_email_attributes) {
+  return Object.entries(attr_obj || {})
+    .filter(([key, value]) => allowed_attributes.has(key) && value !== null && value !== undefined)
+    .map(([key, value]) => `${key}="${escape_html(value)}"`)
+    .join(" ")
 }
 
 export function astc_to_email_html(astc, options, slots_html_and_text_body) {
@@ -497,11 +538,15 @@ export function astc_to_email_html(astc, options, slots_html_and_text_body) {
       return null
     }
   }
-  let font_family = options?.font_family
-  let text_color_hex = options?.text_color_hex
+  const render_children = () =>
+    (Array.isArray(astc?.children) ? astc.children : [])
+      .map((child) => astc_to_email_html(child, options, slots_html_and_text_body))
+      .join("")
+  let font_family = sanitize_css_value(options?.font_family, "sans-serif")
+  let text_color_hex = sanitize_css_value(options?.text_color_hex, "#111111")
   if (["h1", "h2", "h3", "h4", "h5", "h6"].includes(astc?.type_id)) {
-    font_family = options?.font_family_serif
-    text_color_hex = options?.header_color_hex
+    font_family = sanitize_css_value(options?.font_family_serif, "serif")
+    text_color_hex = sanitize_css_value(options?.header_color_hex, text_color_hex)
   }
   let style_attributes = `font-family: ${font_family}; color: ${text_color_hex};`
   if (astc?.type_id === "table") {
@@ -510,39 +555,44 @@ export function astc_to_email_html(astc, options, slots_html_and_text_body) {
     style_attributes += `border: 1px solid ${text_color_hex}; text-align: left; padding: 8px;`
   } else if (["div"].includes(astc?.type_id)) {
     if (astc?.attributes?.background_color) {
-      style_attributes += `background-color: ${astc?.attributes.background_color};`
+      style_attributes += `background-color: ${sanitize_css_value(astc.attributes.background_color, "transparent")};`
     }
     if (astc?.attributes?.border_color) {
-      style_attributes += `border: 1px solid ${astc?.attributes.border_color};`
+      style_attributes += `border: 1px solid ${sanitize_css_value(astc.attributes.border_color, "transparent")};`
     }
-    if (astc?.attributes?.border_radius) {
-      style_attributes += `border-radius: ${astc?.attributes?.border_radius}rem;`
+    const border_radius = Number(astc?.attributes?.border_radius)
+    if (Number.isFinite(border_radius)) {
+      style_attributes += `border-radius: ${Math.max(0, border_radius)}rem;`
     }
-    if (astc?.attributes?.padding) {
-      style_attributes += `padding: ${astc?.attributes?.padding}rem;`
+    const padding = Number(astc?.attributes?.padding)
+    if (Number.isFinite(padding)) {
+      style_attributes += `padding: ${Math.max(0, padding)}rem;`
     }
     if (astc?.attributes?.align_content || astc?.attributes?.justify_content) {
-      style_attributes += `display: grid; place-content: ${astc?.attributes?.align_content ?? "stretch"} ${
-        astc?.attributes?.justify_content ?? "stretch"
-      };`
+      const allowed_alignment = new Set(["baseline", "center", "end", "space-around", "space-between", "space-evenly", "start", "stretch"])
+      const align_content = allowed_alignment.has(astc?.attributes?.align_content)
+        ? astc.attributes.align_content
+        : "stretch"
+      const justify_content = allowed_alignment.has(astc?.attributes?.justify_content)
+        ? astc.attributes.justify_content
+        : "stretch"
+      style_attributes += `display: grid; place-content: ${align_content} ${justify_content};`
     }
   }
-  style_attributes = `style="${style_attributes}"`
+  style_attributes = `style="${escape_html(style_attributes)}"`
   switch (astc?.type_id) {
-    case "slot":
-      console.log("slot_case", astc, slots_html_and_text_body)
+    case "slot": {
       if (Object.keys(slots_html_and_text_body || {}).includes(astc?.attributes?.val)) {
-        console.log("return_slot_html", slots_html_and_text_body?.[astc?.attributes?.val]?.html_body)
-        return slots_html_and_text_body?.[astc?.attributes?.val]?.html_body
+        return slots_html_and_text_body?.[astc?.attributes?.val]?.html_body ?? ""
       }
+      return ""
+    }
     case "link": {
-      const text = astc.attributes.display_text
-        ? astc.attributes.display_text
-        : (astc.children || []).map((child) => astc_to_email_html(child, options, slots_html_and_text_body)).join("") ||
-          astc.attributes.href
-      return `<a ${attribute_to_string(astc.attributes)}>
-        ${text}
-      </a>`
+      const href = normalize_link_href(astc?.attributes?.href)
+      const text = astc?.attributes?.display_text
+        ? escape_html(astc.attributes.display_text)
+        : render_children() || escape_html(astc?.attributes?.href)
+      return href ? `<a href="${escape_html(href)}">${text}</a>` : text
     }
     case "h1":
     case "h2":
@@ -563,41 +613,44 @@ export function astc_to_email_html(astc, options, slots_html_and_text_body) {
     case "tr":
     case "th":
     case "td":
-      return `<${astc?.type_id} ${style_attributes} ${attribute_to_string(astc?.attributes)}>${astc?.children
-        .map((child) => astc_to_email_html(child, options, slots_html_and_text_body))
-        .join("")}</${astc?.type_id}>`
+      return `<${astc.type_id} ${style_attributes} ${attribute_to_string(astc?.attributes)}>${render_children()}</${astc.type_id}>`
     case "strong":
-      return `<strong>${astc?.attributes.content}</strong>`
+      return `<strong>${escape_html(astc?.attributes?.content)}</strong>`
     case "em":
-      return `<em>${astc?.attributes.content}</em>`
+      return `<em>${escape_html(astc?.attributes?.content)}</em>`
     case "strong_em":
-      return `<strong><em>${astc?.attributes.content}</em></strong>`
+      return `<strong><em>${escape_html(astc?.attributes?.content)}</em></strong>`
     case "code_inline":
-      return `<code>${astc?.attributes.content}</code>`
-    case "a":
-      return `<a href="${astc?.attributes.href}">${astc?.attributes.content || astc?.attributes.href}</a>`
-    case "image": // img tbd
-      return `<img style="border-radius: 10px;" width="100%" height="auto" src="${get_src(
-        astc?.attributes?.src,
-        astc?.attributes?.storage_id
-      )}" alt="${astc?.attributes?.alt ?? "unknown"}" ${attribute_to_string(astc?.attributes)} />`
-    case "code":
-      return `<pre><code ${astc?.attributes?.language ? `class="${astc?.attributes?.language}"` : ""}>${
-        astc?.attributes?.content
-      }</code></pre>`
-    case "figure":
-      const caption = astc?.attributes?.caption ? `<figcaption>${astc?.attributes?.caption}</figcaption>` : ""
-      return `<figure ${style_attributes} ${attribute_to_string(astc?.attributes)}>${astc?.children
-        .map((child) => astc_to_email_html(child, options, slots_html_and_text_body))
-        .join("")}${caption}</figure>`
-    case "blockquote":
-      return `<blockquote cite="${astc?.attributes.cite}">${astc?.children
-        .map((child) => astc_to_email_html(child, options, slots_html_and_text_body))
-        .join("")}</blockquote>`
+      return `<code>${escape_html(astc?.attributes?.content)}</code>`
+    case "a": {
+      const href = normalize_link_href(astc?.attributes?.href)
+      const text = escape_html(astc?.attributes?.content || astc?.attributes?.href)
+      return href ? `<a href="${escape_html(href)}">${text}</a>` : text
+    }
+    case "image": { // img tbd
+      const src = normalize_email_image_src(get_src(astc?.attributes?.src, astc?.attributes?.storage_id))
+      return src
+        ? `<img style="border-radius: 10px;" width="100%" height="auto" src="${escape_html(src)}" alt="${escape_html(astc?.attributes?.alt ?? "unknown")}" />`
+        : ""
+    }
+    case "code": {
+      const language = String(astc?.attributes?.language ?? "").replace(/[^a-z0-9_-]/gi, "")
+      return `<pre><code ${language ? `class="${escape_html(language)}"` : ""}>${escape_html(astc?.attributes?.content)}</code></pre>`
+    }
+    case "figure": {
+      const caption = astc?.attributes?.caption
+        ? `<figcaption>${escape_html(astc.attributes.caption)}</figcaption>`
+        : ""
+      return `<figure ${style_attributes} ${attribute_to_string(astc?.attributes)}>${render_children()}${caption}</figure>`
+    }
+    case "blockquote": {
+      const cite = normalize_link_href(astc?.attributes?.cite)
+      return `<blockquote${cite ? ` cite="${escape_html(cite)}"` : ""}>${render_children()}</blockquote>`
+    }
     case "hr":
       return `<hr ${attribute_to_string(astc?.attributes)} />`
     case "base_text":
-      return astc?.attributes.content
+      return escape_html(astc?.attributes?.content)
     default:
       return ""
   }

package/dist/client/index.d.ts

@@ -0,0 +1,61 @@
+export function format_date(date: any, is_add_zero?: boolean): string;
+export function truncate(str: any, n: any): any;
+export function get_obj_from_path(obj: any, path: any): any;
+export function copy_to_clipboard(text: any): Promise<void>;
+export function get_user_interface(): {
+    language: string;
+    languages: readonly string[];
+    platform: string;
+    vendor: string;
+    device_type: string;
+    browser_name: string;
+    used_width: number;
+    used_height: number;
+    avail_height: number;
+    avail_width: number;
+    window_left: number;
+    window_top: number;
+};
+export function color_var(l: any, c: any, h: any, o?: number, is_dark_theme_invert?: boolean): string;
+export function deep_copy(val: any): any;
+export function is_deep_equal(obj1: any, obj2: any): boolean;
+export function create_unique_id(prefix?: null, len?: number): string;
+export function is_20_char_az_format(id_input: any): boolean;
+export function create_file_name(): string;
+export function clean_file_name(file_name: any): any;
+export function clean_custom_identifier(identifier: any, maximum_length?: number): any;
+export function url_to_file(src: any, file_name: any, mime_type: any): Promise<File>;
+export function get_ordinal_suffix(input: any): "th" | "st" | "nd" | "rd";
+export function download_json(data: any, file_name: any): void;
+export function download_csv(data: any): void;
+export function json_to_csv(obj_array: any): string;
+export function csv_to_json(csv_text: any): {}[];
+export function cron_to_english(input: any): string | undefined;
+export function set_closurable(input: any, default_value?: null): any;
+export function set_closurable_color(input: any, default_value?: null, is_css?: boolean): any;
+export function color_to_css(input: any): any;
+export function clean_folder_path(folder_path: any): {
+    cleaned_folder_path: string[];
+    warnings: string[];
+};
+export function get_image_dimensions_from_src(src: any): Promise<any>;
+export function time_ago(epoch: any): string;
+export function format_full_date(epoch: any): string | null;
+export function get_data_type_at_path(path: any, full_data_type: any): any;
+export function get_def(input: any, definition_stack: any): any;
+export function get_def_from_variable_path(input: any, definition_stack: any): any;
+export function is_defined(input: any, definition_stack: any): boolean;
+export function set_def(identifier: any, value: any, definition_stack: any): any;
+export function set_definition_stack(input: any, definition_stack: any, pass_event_down: any): {
+    is_success: boolean;
+    definition_stack: any[];
+};
+export function v(config: any): {
+    val: null;
+    set_val(input: any): void;
+};
+export * from "./types/index.js";
+export * from "./astc_formatting/index.js";
+export { intersection_observer } from "../actions/index.js";
+export { normalize_link_href } from "./links.js";
+export { time_formats, granularities, month_names, days_of_week_names, common_timezones, period_iso_8601_to_period_full, total_seconds_to_period_full, period_full_parts_to_full, get_time_full_from_object, get_time_object_from_val, get_val_from_time_object } from "../Components/TimeInput/index.js";