Version 0.18.0

🔒 Per-origin mixin security policies · 🐛 Cross-list drag-and-drop insertion order · 🐛 Nested list onRendered lifecycle

SmarkForm 0.18.0 extends the mixin security model with per-origin object policies — allowCrossOriginMixinScripts and friends now accept a { origin: policy } map for fine-grained trust. Two bugs were also fixed: cross-list drag-and-drop now consistently inserts after the target item, and nested lists use instance onRendered instead of the root one, fixing initialization for dynamically-added parents.

Features

• Per-origin mixin security policies: allowExternalMixins, allowLocalMixinScripts, allowSameOriginMixinScripts, and allowCrossOriginMixinScripts now accept a per-origin object map (e.g. { 'https://trusted.example.com': 'allow', '*': 'block' }) in addition to string values. A resolvePolicy helper and getUrlOrigin utility support the new object form.

Bug Fixes

• Cross-list drag-and-drop always inserts after target: Fixed drop event handler and move method failback to consistently use "after" position for cross-list moves, regardless of source/target index comparison.
• Nested list onRendered lifecycle: Changed me.root.onRendered to me.onRendered in list type so that dynamically-added nested lists correctly initialize empty-list display, min_items population, and aria-live attributes.