sveltekit-ui 1.1.74 → 1.1.76

package/dist/client/index.js

@@ -14,17 +14,32 @@ export {
   get_val_from_time_object,
 } from "../Components/TimeInput/index.js"
 export { intersection_observer } from "../actions/index.js"
+export { normalize_link_href } from "./links.js"
+
+function has_own(value, key) {
+  return (
+    value !== null &&
+    (typeof value === "object" || typeof value === "function") &&
+    Object.prototype.hasOwnProperty.call(value, key)
+  )
+}
 
 export function format_date(date, is_add_zero = false) {
-  if (date) {
-    const d = new Date(date * 1000) // convert seconds to milliseconds
-    const year = d.getFullYear()
-    const month = ((is_add_zero ? "0" : "") + (d.getMonth() + 1)).slice(-2)
-    const day = ((is_add_zero ? "0" : "") + d.getDate()).slice(-2)
-    return [month, day, year].join("/")
-  } else {
+  if (date === null || date === undefined || date === "") {
+    return "mm/dd/yyyy"
+  }
+  const epoch_seconds = Number(date)
+  if (!Number.isFinite(epoch_seconds)) {
+    return "mm/dd/yyyy"
+  }
+  const d = new Date(epoch_seconds * 1000) // convert seconds to milliseconds
+  if (Number.isNaN(d.getTime())) {
     return "mm/dd/yyyy"
   }
+  const year = d.getFullYear()
+  const month = String(d.getMonth() + 1)
+  const day = String(d.getDate())
+  return [is_add_zero ? month.padStart(2, "0") : month, is_add_zero ? day.padStart(2, "0") : day, year].join("/")
 }
 
 export function truncate(str, n) {
@@ -32,8 +47,14 @@ export function truncate(str, n) {
 }
 
 export function get_obj_from_path(obj, path) {
+  if (path == null || typeof path.length !== "number") {
+    return false
+  }
   let current = obj
   for (let i = 0; i < path.length; i++) {
+    if (current === null || (typeof current !== "object" && typeof current !== "function")) {
+      return false
+    }
     if (!(path[i] in current)) return false
     current = current[path[i]]
   }
@@ -41,14 +62,17 @@ export function get_obj_from_path(obj, path) {
 }
 
 export function copy_to_clipboard(text) {
-  if (navigator && navigator.clipboard && navigator.clipboard.writeText) {
-    return navigator.clipboard.writeText(text)
+  const clipboard = globalThis.navigator?.clipboard
+  if (clipboard && typeof clipboard.writeText === "function") {
+    return clipboard.writeText(String(text))
   }
   return Promise.reject("The Clipboard API is not available.")
 }
 
 export function get_user_interface() {
-  const ua = navigator.userAgent
+  const navigator_ref = globalThis.navigator
+  const screen_ref = globalThis.screen
+  const ua = navigator_ref?.userAgent ?? ""
   let browser_name = "unknown"
   if (ua.indexOf("Firefox") > -1) {
     browser_name = "Mozilla Firefox"
@@ -75,19 +99,19 @@ export function get_user_interface() {
     device_type = "mobile"
   }
   const interface_data = {
-    language: navigator.language,
-    languages: navigator.languages,
-    platform: navigator.platform,
+    language: navigator_ref?.language ?? null,
+    languages: navigator_ref?.languages ?? [],
+    platform: navigator_ref?.platform ?? null,
     // 'platform': navigator.userAgentData.platform, navigator.platform dep but no userAgentData on safari
-    vendor: navigator.vendor,
+    vendor: navigator_ref?.vendor ?? null,
     device_type: device_type,
     browser_name: browser_name,
-    used_width: innerWidth,
-    used_height: innerHeight,
-    avail_height: screen.availHeight,
-    avail_width: screen.availWidth,
-    window_left: screenLeft,
-    window_top: screenTop,
+    used_width: globalThis.innerWidth ?? null,
+    used_height: globalThis.innerHeight ?? null,
+    avail_height: screen_ref?.availHeight ?? null,
+    avail_width: screen_ref?.availWidth ?? null,
+    window_left: globalThis.screenLeft ?? null,
+    window_top: globalThis.screenTop ?? null,
   }
   return interface_data
 }
@@ -103,18 +127,31 @@ export function color_var(l, c, h, o = 16, is_dark_theme_invert = true) {
 }
 
 export function deep_copy(val) {
-  return JSON.parse(JSON.stringify(set_closurable(val, null)))
-  // return structuredClone(val ?? null)
+  const value = set_closurable(val, null)
+  if (typeof globalThis.structuredClone === "function") {
+    try {
+      return globalThis.structuredClone(value)
+    } catch {
+      // Svelte state proxies cannot always be cloned directly, so preserve the
+      // previous JSON-compatible fallback for those values.
+    }
+  }
+  const serialized = JSON.stringify(value)
+  return serialized === undefined ? value : JSON.parse(serialized)
 }
 
 export function is_deep_equal(obj1, obj2) {
   if (obj1 === obj2) return true
   if (typeof obj1 === "object" && obj1 !== null && typeof obj2 === "object" && obj2 !== null) {
+    if (Array.isArray(obj1) !== Array.isArray(obj2)) return false
+    if (obj1 instanceof Date || obj2 instanceof Date) {
+      return obj1 instanceof Date && obj2 instanceof Date && obj1.getTime() === obj2.getTime()
+    }
     const keys1 = Object.keys(obj1)
     const keys2 = Object.keys(obj2)
     if (keys1.length !== keys2.length) return false
     for (const key of keys1) {
-      if (!obj2.hasOwnProperty(key)) return false
+      if (!has_own(obj2, key)) return false
       if (!is_deep_equal(obj1[key], obj2[key])) return false
     }
     return true
@@ -124,10 +161,29 @@ export function is_deep_equal(obj1, obj2) {
 }
 
 export function create_unique_id(prefix = null, len = 5) {
+  const length = Number(len)
+  if (!Number.isSafeInteger(length) || length < 0) {
+    throw new TypeError("create_unique_id length must be a non-negative safe integer")
+  }
+  const web_crypto = globalThis.crypto
+  if (!web_crypto || typeof web_crypto.getRandomValues !== "function") {
+    throw new Error("Secure random number generation is unavailable")
+  }
   const characters = "abcdefghijklmnopqrstuvwxyz"
   let randstr = ""
-  for (let i = 0; i < len; i++) {
-    randstr += characters.charAt(Math.floor(Math.random() * characters.length))
+  // 234 is the largest multiple of 26 below 256. Rejecting the remaining byte
+  // values avoids modulo bias while keeping this synchronous in browsers and
+  // Node runtimes that expose the Web Crypto API.
+  const unbiased_upper_bound = 234
+  const random_bytes = new Uint8Array(Math.min(Math.max(length, 32), 4096))
+  while (randstr.length < length) {
+    web_crypto.getRandomValues(random_bytes)
+    for (const random_byte of random_bytes) {
+      if (random_byte < unbiased_upper_bound) {
+        randstr += characters[random_byte % characters.length]
+        if (randstr.length === length) break
+      }
+    }
   }
   const unique_id = prefix ? `${prefix}_${randstr}` : randstr
   return unique_id
@@ -140,10 +196,10 @@ export function is_20_char_az_format(id_input) {
 
 export function create_file_name() {
   const now = new Date()
-  const start_of_year = new Date(now.getFullYear(), 0, 0)
-  const diff = now - start_of_year
   const one_day = 1000 * 60 * 60 * 24
-  const day_of_year = Math.floor(diff / one_day)
+  const day_of_year = Math.floor(
+    (Date.UTC(now.getFullYear(), now.getMonth(), now.getDate()) - Date.UTC(now.getFullYear(), 0, 0)) / one_day
+  )
   const current_year = now.getFullYear().toString()
   const hour = now.getHours().toString().padStart(2, "0")
   const minute = now.getMinutes().toString().padStart(2, "0")
@@ -195,21 +251,37 @@ export function clean_custom_identifier(identifier, maximum_length = 100) {
 }
 
 export async function url_to_file(src, file_name, mime_type) {
-  const response = await fetch(src)
+  if (typeof globalThis.fetch !== "function") {
+    throw new Error("The Fetch API is not available.")
+  }
+  const response = await globalThis.fetch(src)
+  if (!response.ok) {
+    const status = [response.status, response.statusText].filter(Boolean).join(" ")
+    throw new Error(`Failed to fetch file${status ? ` (${status})` : ""}`)
+  }
   const data = await response.blob()
   const metadata = {
     type: mime_type || data.type,
   }
-  const file = new File([data], file_name, metadata)
+  const FileConstructor = globalThis.File
+  if (typeof FileConstructor !== "function") {
+    throw new Error("The File API is not available.")
+  }
+  const file = new FileConstructor([data], file_name, metadata)
   return file
 }
 
 export function get_ordinal_suffix(input) {
-  if (input % 10 === 1 && input !== 11) {
+  const value = Math.abs(Math.trunc(Number(input)))
+  const last_two_digits = value % 100
+  if (last_two_digits >= 11 && last_two_digits <= 13) {
+    return "th"
+  }
+  if (value % 10 === 1) {
     return "st"
-  } else if (input % 10 === 2 && input !== 12) {
+  } else if (value % 10 === 2) {
     return "nd"
-  } else if (input % 10 === 3 && input !== 13) {
+  } else if (value % 10 === 3) {
     return "rd"
   } else {
     return "th"
@@ -217,44 +289,69 @@ export function get_ordinal_suffix(input) {
 }
 
 export function download_json(data, file_name) {
+  const { BlobConstructor, document_ref, url_api } = get_browser_download_apis()
   const json_string = JSON.stringify(data)
-  const data_blob = new Blob([json_string], { type: "application/json" })
-  const url = URL.createObjectURL(data_blob)
-  const link = document.createElement("a")
-  link.href = url
-  link.download = file_name ?? "data.json"
-  link.click()
-  URL.revokeObjectURL(url)
+  const data_blob = new BlobConstructor([json_string], { type: "application/json" })
+  const url = url_api.createObjectURL(data_blob)
+  try {
+    const link = document_ref.createElement("a")
+    link.href = url
+    link.download = file_name ?? "data.json"
+    link.click()
+  } finally {
+    url_api.revokeObjectURL(url)
+  }
 }
 
 export function download_csv(data) {
+  const { BlobConstructor, document_ref, url_api } = get_browser_download_apis()
   const json_string = JSON.stringify(data)
   const csv = json_to_csv(json_string)
-  const data_blob = new Blob([csv], { type: "text/csv;charset=utf-8;" })
-  const url = URL.createObjectURL(data_blob)
-  const link = document.createElement("a")
-  link.href = url
-  const filename = "data.csv"
-  link.download = filename
-  link.click()
-  URL.revokeObjectURL(url)
+  const data_blob = new BlobConstructor([csv], { type: "text/csv;charset=utf-8;" })
+  const url = url_api.createObjectURL(data_blob)
+  try {
+    const link = document_ref.createElement("a")
+    link.href = url
+    const filename = "data.csv"
+    link.download = filename
+    link.click()
+  } finally {
+    url_api.revokeObjectURL(url)
+  }
+}
+
+function get_browser_download_apis() {
+  const BlobConstructor = globalThis.Blob
+  const document_ref = globalThis.document
+  const url_api = globalThis.URL
+  if (
+    typeof BlobConstructor !== "function" ||
+    !document_ref?.createElement ||
+    typeof url_api?.createObjectURL !== "function" ||
+    typeof url_api?.revokeObjectURL !== "function"
+  ) {
+    throw new Error("File downloads are only available in a browser.")
+  }
+  return { BlobConstructor, document_ref, url_api }
+}
+
+function escape_csv_cell(value) {
+  const string_value = value === undefined ? "" : String(value)
+  return `"${string_value.replace(/"/g, '""')}"`
 }
 
 export function json_to_csv(obj_array) {
   let array = typeof obj_array != "object" ? JSON.parse(obj_array) : obj_array
   let str = ""
   let headers = get_headers(array)
-  str += headers.join(",") + "\r\n"
+  str += headers.map(escape_csv_cell).join(",") + "\r\n"
   for (let i = 0; i < array.length; i++) {
     let line = ""
     for (let header_index in headers) {
       let header = headers[header_index]
       let value = get_value_by_path(array?.[i], header.split("__"))
       if (line != "") line += ","
-      if (typeof value === "string") {
-        value = value.replace(/"/g, '""')
-      }
-      line += `"${value}"`
+      line += escape_csv_cell(value)
     }
     str += line + "\r\n"
   }
@@ -262,11 +359,14 @@ export function json_to_csv(obj_array) {
 }
 
 export function csv_to_json(csv_text) {
+  if (typeof csv_text !== "string") {
+    throw new TypeError("CSV input must be a string")
+  }
   let rows = []
   let current_row = []
   let current_field = ""
   let in_quotes = false
-  csv_text = csv_text.replace(/\\\""/g, "__ESCAPED_QUOTE__")
+  csv_text = csv_text.replace(/^\uFEFF/, "").replace(/\\\""/g, "__ESCAPED_QUOTE__")
   for (let i = 0; i < csv_text.length; i++) {
     const char = csv_text[i]
     if (char === '"') {
@@ -318,12 +418,17 @@ export function csv_to_json(csv_text) {
         } catch (e) {
           console.warn("JSON parse error for field:", header, val)
         }
-      } else if (!isNaN(val)) {
+      } else if (val !== "" && !Number.isNaN(Number(val))) {
         val = Number(val)
       } else if (val.toLowerCase() === "true" || val.toLowerCase() === "false") {
         val = val.toLowerCase() === "true"
       }
-      obj[header] = val
+      Object.defineProperty(obj, header, {
+        value: val,
+        enumerable: true,
+        configurable: true,
+        writable: true,
+      })
     })
     return obj
   })
@@ -339,7 +444,10 @@ function get_headers(array) {
 }
 
 function add_keys_to_set(obj, set, prefix) {
-  for (let key in obj) {
+  if (obj === null || (typeof obj !== "object" && typeof obj !== "function")) {
+    return
+  }
+  for (const key of Object.keys(obj)) {
     if (typeof obj[key] === "object" && obj[key] !== null) {
       add_keys_to_set(obj[key], set, prefix + key + "__")
     } else {
@@ -351,7 +459,7 @@ function add_keys_to_set(obj, set, prefix) {
 function get_value_by_path(obj, path) {
   if (Array.isArray(path)) {
     for (let i = 0; i < path.length; i++) {
-      if (obj && typeof obj == "object" && obj.hasOwnProperty(path?.[i])) {
+      if (has_own(obj, path?.[i])) {
         obj = obj?.[path?.[i]]
         if (i === path.length - 1 && typeof obj === "object" && obj !== null) {
           return ""
@@ -451,27 +559,34 @@ export function clean_folder_path(folder_path) {
     warnings.push("Folder path must be an array.")
     return { cleaned_folder_path: [], warnings }
   }
-  let cleaned_folder_path = folder_path.map((part) => {
+  let cleaned_folder_path = []
+  for (const part of folder_path) {
     let cleaned_part = clean_custom_identifier(part)
-    if (cleaned_part !== part) {
+    if (typeof cleaned_part === "string" && cleaned_part !== part) {
       warnings.push(`"${part}" cleaned to "${cleaned_part}".`)
     }
-    return cleaned_part
-  })
-  cleaned_folder_path = cleaned_folder_path.filter((part) => {
-    const is_valid = part.length <= 100 && !/^_|_$|__/.test(part)
+    const is_valid =
+      typeof cleaned_part === "string" &&
+      cleaned_part.length > 0 &&
+      cleaned_part.length <= 100 &&
+      !/^_|_$|__/.test(cleaned_part)
     if (!is_valid) {
       warnings.push(`"${part}" is not a valid folder name.`)
+      continue
     }
-    return is_valid
-  })
+    cleaned_folder_path.push(cleaned_part)
+  }
   return { cleaned_folder_path, warnings }
 }
 
 export async function get_image_dimensions_from_src(src) {
   return new Promise((resolve, reject) => {
-    const img = new Image()
-    img.src = src
+    const ImageConstructor = globalThis.Image
+    if (typeof ImageConstructor !== "function") {
+      reject(new Error("The Image API is not available."))
+      return
+    }
+    const img = new ImageConstructor()
     img.onload = () =>
       resolve({
         width: img.width,
@@ -479,6 +594,7 @@ export async function get_image_dimensions_from_src(src) {
         aspect_ratio: img.width && img.height ? Number((img.width / img.height).toFixed(5)) : null,
       })
     img.onerror = (error) => reject(error)
+    img.src = src
   })
 }
 
@@ -553,7 +669,7 @@ export function get_data_type_at_path(path, full_data_type) {
       if (Array.isArray(item)) {
         item = get_data_type_at_path(item)
       }
-      if (typeof item == "number" || data_type_at_path_loc?.hasOwnProperty("items")) {
+      if (typeof item == "number" || has_own(data_type_at_path_loc, "items")) {
         data_type_at_path_loc = data_type_at_path_loc?.items
       } else if (typeof item == "string") {
         data_type_at_path_loc = data_type_at_path_loc?.properties?.[item]
@@ -566,7 +682,7 @@ export function get_data_type_at_path(path, full_data_type) {
 export function get_def(input, definition_stack) {
   if (Array.isArray(definition_stack)) {
     for (let item of definition_stack) {
-      if (item.hasOwnProperty(input)) {
+      if (has_own(item, input)) {
         return item?.[input]
       }
     }
@@ -593,7 +709,7 @@ export function get_def_from_variable_path(input, definition_stack) {
 export function is_defined(input, definition_stack) {
   if (Array.isArray(definition_stack)) {
     for (let item of definition_stack) {
-      if (item && typeof item == "object" && item.hasOwnProperty(input)) {
+      if (has_own(item, input)) {
         return true
       }
     }
@@ -604,7 +720,9 @@ export function is_defined(input, definition_stack) {
 export function set_def(identifier, value, definition_stack) {
   if (Array.isArray(definition_stack)) {
     for (let i = 0; i < definition_stack.length; i++) {
-      if (definition_stack[i].hasOwnProperty(identifier)) {
+      if (
+        has_own(definition_stack[i], identifier)
+      ) {
         definition_stack[i][identifier] = value
       }
     }
@@ -613,14 +731,19 @@ export function set_def(identifier, value, definition_stack) {
 }
 
 export function set_definition_stack(input, definition_stack, pass_event_down) {
-  if (!Array.isArray(input?.variable_path_to_target) || !Array.isArray(definition_stack)) {
+  if (
+    !Array.isArray(input?.variable_path_to_target) ||
+    input.variable_path_to_target.length === 0 ||
+    !Array.isArray(definition_stack)
+  ) {
     throw new Error("Path must be an array")
   }
   let defined_i = null
   const path = input.variable_path_to_target
   const root_key = path[0]
   for (let i = 0; i < definition_stack.length; i++) {
-    if (definition_stack?.[i].hasOwnProperty(root_key)) {
+    const definition = definition_stack?.[i]
+    if (has_own(definition, root_key)) {
       defined_i = i
       break
     }
@@ -628,6 +751,27 @@ export function set_definition_stack(input, definition_stack, pass_event_down) {
   if (defined_i == null) {
     throw new Error("Root key not found in stack")
   }
+  const finish_update = (updated_root_value) => {
+    definition_stack[defined_i][root_key] = updated_root_value
+    if (typeof pass_event_down === "function") {
+      pass_event_down({
+        value: input.value,
+        definition_stack: definition_stack,
+        set_from_content_id: input.set_from_content_id,
+        variable_path_to_target: input.variable_path_to_target,
+      })
+    }
+    return {
+      is_success: true,
+      definition_stack: definition_stack,
+    }
+  }
+  if (
+    path.length === 1 &&
+    !["set_variables_insert", "set_variables_delete", "set_variables_key"].includes(input?.type)
+  ) {
+    return finish_update(input?.value)
+  }
   let defined_variables_loc = deep_copy(definition_stack[defined_i][root_key])
   let temp = defined_variables_loc
   const last_key = path[path.length - 1]
@@ -672,13 +816,13 @@ export function set_definition_stack(input, definition_stack, pass_event_down) {
       if (typeof last_key === "number" && last_key > -1 && last_key < temp.length) {
         temp.splice(last_key, 1)
       }
-    } else if (typeof temp === "object" && temp?.hasOwnProperty(last_key)) {
+    } else if (has_own(temp, last_key)) {
       delete temp[last_key]
     }
   } else if (input?.type == "set_variables_key") {
     if (Array.isArray(temp)) {
       throw new Error("Cannot change key in array")
-    } else if (typeof temp === "object" && temp?.hasOwnProperty(last_key)) {
+    } else if (has_own(temp, last_key)) {
       temp[input.value] = temp[last_key]
       delete temp[last_key]
     } else {
@@ -687,19 +831,7 @@ export function set_definition_stack(input, definition_stack, pass_event_down) {
   } else {
     temp[last_key] = input?.value
   }
-  definition_stack[defined_i][root_key] = defined_variables_loc
-  if (typeof pass_event_down === "function") {
-    pass_event_down({
-      value: input.value,
-      definition_stack: definition_stack,
-      set_from_content_id: input.set_from_content_id,
-      variable_path_to_target: input.variable_path_to_target,
-    })
-  }
-  return {
-    is_success: true,
-    definition_stack: definition_stack,
-  }
+  return finish_update(defined_variables_loc)
 }
 
 // tbd could also turn into a typed thing with arrays of v or objects, color, etc

package/dist/client/links.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Converts supported link-like input into a safe href.
+ *
+ * Relative URLs are preserved, obvious hostnames default to HTTPS, and
+ * executable or malformed schemes return null.
+ */
+export function normalize_link_href(input: any): string | null;

package/dist/client/links.js

@@ -0,0 +1,68 @@
+const allowed_link_protocols = new Set(["http:", "https:", "mailto:", "tel:"])
+const unsafe_url_characters = /[\u0000-\u001f\u007f\\]/
+
+function normalize_absolute_link(href) {
+  try {
+    const url = new URL(href)
+    if (!allowed_link_protocols.has(url.protocol)) return null
+    if (["http:", "https:"].includes(url.protocol) && !url.hostname) return null
+    return url.href
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Converts supported link-like input into a safe href.
+ *
+ * Relative URLs are preserved, obvious hostnames default to HTTPS, and
+ * executable or malformed schemes return null.
+ */
+export function normalize_link_href(input) {
+  if (input === null || input === undefined) return null
+  const href = String(input).trim()
+  if (!href || unsafe_url_characters.test(href)) return null
+
+  if (href.startsWith("//")) {
+    return normalize_absolute_link(`https:${href}`)
+  }
+  if (
+    href.startsWith("/") ||
+    href.startsWith("./") ||
+    href.startsWith("../") ||
+    href.startsWith("?") ||
+    href.startsWith("#")
+  ) {
+    return href
+  }
+
+  const scheme_match = href.match(/^([a-z][a-z0-9+.-]*):/i)
+  if (scheme_match) {
+    const protocol = `${scheme_match[1].toLowerCase()}:`
+    if (allowed_link_protocols.has(protocol)) {
+      return normalize_absolute_link(href)
+    }
+
+    // A hostname followed by a numeric port can resemble a custom protocol.
+    const looks_like_hostname_with_port =
+      /^(?:localhost|[^/:?#\s]+\.[^/:?#\s]+):\d+(?:[/?#]|$)/i.test(href)
+    if (!looks_like_hostname_with_port) return null
+  }
+
+  if (/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(href)) {
+    return normalize_absolute_link(`mailto:${href}`)
+  }
+
+  const first_path_part = href.split(/[/?#]/, 1)[0]
+  const looks_like_hostname =
+    first_path_part === "localhost" ||
+    first_path_part.startsWith("localhost:") ||
+    first_path_part.startsWith("[") ||
+    first_path_part.includes(".")
+
+  if (looks_like_hostname) {
+    return normalize_absolute_link(`https://${href}`)
+  }
+
+  return href
+}

package/dist/client/mapkit.d.ts

@@ -0,0 +1,4 @@
+export function get_mapkit_token_error(token: any, now_epoch_seconds?: number): "A MapKit token is required." | "The MapKit token is invalid." | "The MapKit token is expired." | null;
+export function get_mapkit_api(): any;
+export function load_mapkit_script(token: any): any;
+export const MAPKIT_SCRIPT_SRC: "https://cdn.apple-mapkit.com/mk/5.x.x/mapkit.core.js";