plutonium 0.60.5 → 0.61.0

data/app/assets/plutonium.js

@@ -6,7 +6,11 @@
   var __getProtoOf = Object.getPrototypeOf;
   var __hasOwnProp = Object.prototype.hasOwnProperty;
   var __commonJS = (cb, mod) => function __require() {
-    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+    try {
+      return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+    } catch (e4) {
+      throw mod = 0, e4;
+    }
   };
   var __copyProps = (to, from, except, desc) => {
     if (from && typeof from === "object" || typeof from === "function") {
@@ -13655,7 +13659,7 @@
   var mathMl$1 = freeze(["math", "menclose", "merror", "mfenced", "mfrac", "mglyph", "mi", "mlabeledtr", "mmultiscripts", "mn", "mo", "mover", "mpadded", "mphantom", "mroot", "mrow", "ms", "mspace", "msqrt", "mstyle", "msub", "msup", "msubsup", "mtable", "mtd", "mtext", "mtr", "munder", "munderover", "mprescripts"]);
   var mathMlDisallowed = freeze(["maction", "maligngroup", "malignmark", "mlongdiv", "mscarries", "mscarry", "msgroup", "mstack", "msline", "msrow", "semantics", "annotation", "annotation-xml", "mprescripts", "none"]);
   var text = freeze(["#text"]);
-  var html = freeze(["accept", "action", "align", "alt", "autocapitalize", "autocomplete", "autopictureinpicture", "autoplay", "background", "bgcolor", "border", "capture", "cellpadding", "cellspacing", "checked", "cite", "class", "clear", "color", "cols", "colspan", "controls", "controlslist", "coords", "crossorigin", "datetime", "decoding", "default", "dir", "disabled", "disablepictureinpicture", "disableremoteplayback", "download", "draggable", "enctype", "enterkeyhint", "exportparts", "face", "for", "headers", "height", "hidden", "high", "href", "hreflang", "id", "inert", "inputmode", "integrity", "ismap", "kind", "label", "lang", "list", "loading", "loop", "low", "max", "maxlength", "media", "method", "min", "minlength", "multiple", "muted", "name", "nonce", "noshade", "novalidate", "nowrap", "open", "optimum", "part", "pattern", "placeholder", "playsinline", "popover", "popovertarget", "popovertargetaction", "poster", "preload", "pubdate", "radiogroup", "readonly", "rel", "required", "rev", "reversed", "role", "rows", "rowspan", "spellcheck", "scope", "selected", "shape", "size", "sizes", "slot", "span", "srclang", "start", "src", "srcset", "step", "style", "summary", "tabindex", "title", "translate", "type", "usemap", "valign", "value", "width", "wrap", "xmlns"]);
+  var html = freeze(["accept", "action", "align", "alt", "autocapitalize", "autocomplete", "autopictureinpicture", "autoplay", "background", "bgcolor", "border", "capture", "cellpadding", "cellspacing", "checked", "cite", "class", "clear", "color", "cols", "colspan", "command", "commandfor", "controls", "controlslist", "coords", "crossorigin", "datetime", "decoding", "default", "dir", "disabled", "disablepictureinpicture", "disableremoteplayback", "download", "draggable", "enctype", "enterkeyhint", "exportparts", "face", "for", "headers", "height", "hidden", "high", "href", "hreflang", "id", "inert", "inputmode", "integrity", "ismap", "kind", "label", "lang", "list", "loading", "loop", "low", "max", "maxlength", "media", "method", "min", "minlength", "multiple", "muted", "name", "nonce", "noshade", "novalidate", "nowrap", "open", "optimum", "part", "pattern", "placeholder", "playsinline", "popover", "popovertarget", "popovertargetaction", "poster", "preload", "pubdate", "radiogroup", "readonly", "rel", "required", "rev", "reversed", "role", "rows", "rowspan", "spellcheck", "scope", "selected", "shape", "size", "sizes", "slot", "span", "srclang", "start", "src", "srcset", "step", "style", "summary", "tabindex", "title", "translate", "type", "usemap", "valign", "value", "width", "wrap", "xmlns"]);
   var svg = freeze(["accent-height", "accumulate", "additive", "alignment-baseline", "amplitude", "ascent", "attributename", "attributetype", "azimuth", "basefrequency", "baseline-shift", "begin", "bias", "by", "class", "clip", "clippathunits", "clip-path", "clip-rule", "color", "color-interpolation", "color-interpolation-filters", "color-profile", "color-rendering", "cx", "cy", "d", "dx", "dy", "diffuseconstant", "direction", "display", "divisor", "dur", "edgemode", "elevation", "end", "exponent", "fill", "fill-opacity", "fill-rule", "filter", "filterunits", "flood-color", "flood-opacity", "font-family", "font-size", "font-size-adjust", "font-stretch", "font-style", "font-variant", "font-weight", "fx", "fy", "g1", "g2", "glyph-name", "glyphref", "gradientunits", "gradienttransform", "height", "href", "id", "image-rendering", "in", "in2", "intercept", "k", "k1", "k2", "k3", "k4", "kerning", "keypoints", "keysplines", "keytimes", "lang", "lengthadjust", "letter-spacing", "kernelmatrix", "kernelunitlength", "lighting-color", "local", "marker-end", "marker-mid", "marker-start", "markerheight", "markerunits", "markerwidth", "maskcontentunits", "maskunits", "max", "mask", "mask-type", "media", "method", "mode", "min", "name", "numoctaves", "offset", "operator", "opacity", "order", "orient", "orientation", "origin", "overflow", "paint-order", "path", "pathlength", "patterncontentunits", "patterntransform", "patternunits", "points", "preservealpha", "preserveaspectratio", "primitiveunits", "r", "rx", "ry", "radius", "refx", "refy", "repeatcount", "repeatdur", "restart", "result", "rotate", "scale", "seed", "shape-rendering", "slope", "specularconstant", "specularexponent", "spreadmethod", "startoffset", "stddeviation", "stitchtiles", "stop-color", "stop-opacity", "stroke-dasharray", "stroke-dashoffset", "stroke-linecap", "stroke-linejoin", "stroke-miterlimit", "stroke-opacity", "stroke", "stroke-width", "style", "surfacescale", "systemlanguage", "tabindex", "tablevalues", "targetx", "targety", "transform", "transform-origin", "text-anchor", "text-decoration", "text-rendering", "textlength", "type", "u1", "u2", "unicode", "values", "viewbox", "visibility", "version", "vert-adv-y", "vert-origin-x", "vert-origin-y", "width", "word-spacing", "wrap", "writing-mode", "xchannelselector", "ychannelselector", "x", "x1", "x2", "xmlns", "y", "y1", "y2", "z", "zoomandpan"]);
   var mathMl = freeze(["accent", "accentunder", "align", "bevelled", "close", "columnalign", "columnlines", "columnspacing", "columnspan", "denomalign", "depth", "dir", "display", "displaystyle", "encoding", "fence", "frame", "height", "href", "id", "largeop", "length", "linethickness", "lquote", "lspace", "mathbackground", "mathcolor", "mathsize", "mathvariant", "maxsize", "minsize", "movablelimits", "notation", "numalign", "open", "rowalign", "rowlines", "rowspacing", "rowspan", "rspace", "rquote", "scriptlevel", "scriptminsize", "scriptsizemultiplier", "selection", "separator", "separators", "stretchy", "subscriptshift", "supscriptshift", "symmetric", "voffset", "width", "xmlns"]);
   var xml = freeze(["xlink:href", "xml:id", "xlink:title", "xml:space", "xmlns:xlink"]);
@@ -13675,13 +13679,26 @@
   );
   var DOCTYPE_NAME = seal(/^html$/i);
   var CUSTOM_ELEMENT = seal(/^[a-z][.\w]*(-[.\w]+)+$/i);
+  var ELEMENT_MARKUP_PROBE = seal(/<[/\w!]/g);
+  var COMMENT_MARKUP_PROBE = seal(/<[/\w]/g);
+  var FALLBACK_TAG_CLOSE = seal(/<\/no(script|embed|frames)/i);
+  var SELF_CLOSING_TAG = seal(/\/>/i);
   var NODE_TYPE = {
     element: 1,
+    attribute: 2,
     text: 3,
+    cdataSection: 4,
+    entityReference: 5,
+    // Deprecated
+    entityNode: 6,
     // Deprecated
-    progressingInstruction: 7,
+    processingInstruction: 7,
     comment: 8,
-    document: 9
+    document: 9,
+    documentType: 10,
+    documentFragment: 11,
+    notation: 12
+    // Deprecated
   };
   var getGlobal = function getGlobal2() {
     return typeof window === "undefined" ? null : window;
@@ -13723,10 +13740,13 @@
       uponSanitizeShadowNode: []
     };
   };
+  var _resolveSetOption = function _resolveSetOption2(cfg, key, fallback, options2) {
+    return objectHasOwnProperty(cfg, key) && arrayIsArray(cfg[key]) ? addToSet(options2.base ? clone(options2.base) : {}, cfg[key], options2.transform) : fallback;
+  };
   function createDOMPurify() {
     let window2 = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : getGlobal();
     const DOMPurify = (root) => createDOMPurify(root);
-    DOMPurify.version = "3.4.3";
+    DOMPurify.version = "3.4.11";
     DOMPurify.removed = [];
     if (!window2 || !window2.document || window2.document.nodeType !== NODE_TYPE.document || !window2.Element) {
       DOMPurify.isSupported = false;
@@ -13735,13 +13755,21 @@
     let document2 = window2.document;
     const originalDocument = document2;
     const currentScript = originalDocument.currentScript;
-    const DocumentFragment = window2.DocumentFragment, HTMLTemplateElement2 = window2.HTMLTemplateElement, Node2 = window2.Node, Element2 = window2.Element, NodeFilter = window2.NodeFilter, _window$NamedNodeMap = window2.NamedNodeMap, NamedNodeMap = _window$NamedNodeMap === void 0 ? window2.NamedNodeMap || window2.MozNamedAttrMap : _window$NamedNodeMap, HTMLFormElement2 = window2.HTMLFormElement, DOMParser2 = window2.DOMParser, trustedTypes = window2.trustedTypes;
+    window2.DocumentFragment;
+    const HTMLTemplateElement2 = window2.HTMLTemplateElement, Node2 = window2.Node, Element2 = window2.Element, NodeFilter = window2.NodeFilter, _window$NamedNodeMap = window2.NamedNodeMap;
+    _window$NamedNodeMap === void 0 ? window2.NamedNodeMap || window2.MozNamedAttrMap : _window$NamedNodeMap;
+    window2.HTMLFormElement;
+    const DOMParser2 = window2.DOMParser, trustedTypes = window2.trustedTypes;
     const ElementPrototype = Element2.prototype;
     const cloneNode = lookupGetter(ElementPrototype, "cloneNode");
     const remove = lookupGetter(ElementPrototype, "remove");
     const getNextSibling = lookupGetter(ElementPrototype, "nextSibling");
     const getChildNodes = lookupGetter(ElementPrototype, "childNodes");
     const getParentNode2 = lookupGetter(ElementPrototype, "parentNode");
+    const getShadowRoot = lookupGetter(ElementPrototype, "shadowRoot");
+    const getAttributes = lookupGetter(ElementPrototype, "attributes");
+    const getNodeType = Node2 && Node2.prototype ? lookupGetter(Node2.prototype, "nodeType") : null;
+    const getNodeName2 = Node2 && Node2.prototype ? lookupGetter(Node2.prototype, "nodeName") : null;
     if (typeof HTMLTemplateElement2 === "function") {
       const template = document2.createElement("template");
       if (template.content && template.content.ownerDocument) {
@@ -13750,6 +13778,39 @@
     }
     let trustedTypesPolicy;
     let emptyHTML = "";
+    let defaultTrustedTypesPolicy;
+    let defaultTrustedTypesPolicyResolved = false;
+    let IN_TRUSTED_TYPES_POLICY = 0;
+    const _assertNotInTrustedTypesPolicy = function _assertNotInTrustedTypesPolicy2() {
+      if (IN_TRUSTED_TYPES_POLICY > 0) {
+        throw typeErrorCreate('A configured TRUSTED_TYPES_POLICY callback (createHTML or createScriptURL) must not call DOMPurify.sanitize, as that causes infinite recursion. Do not pass a policy whose callbacks wrap DOMPurify as TRUSTED_TYPES_POLICY; see the "DOMPurify and Trusted Types" section of the README.');
+      }
+    };
+    const _createTrustedHTML = function _createTrustedHTML2(html3) {
+      _assertNotInTrustedTypesPolicy();
+      IN_TRUSTED_TYPES_POLICY++;
+      try {
+        return trustedTypesPolicy.createHTML(html3);
+      } finally {
+        IN_TRUSTED_TYPES_POLICY--;
+      }
+    };
+    const _createTrustedScriptURL = function _createTrustedScriptURL2(scriptUrl) {
+      _assertNotInTrustedTypesPolicy();
+      IN_TRUSTED_TYPES_POLICY++;
+      try {
+        return trustedTypesPolicy.createScriptURL(scriptUrl);
+      } finally {
+        IN_TRUSTED_TYPES_POLICY--;
+      }
+    };
+    const _getDefaultTrustedTypesPolicy = function _getDefaultTrustedTypesPolicy2() {
+      if (!defaultTrustedTypesPolicyResolved) {
+        defaultTrustedTypesPolicy = _createTrustedTypesPolicy(trustedTypes, currentScript);
+        defaultTrustedTypesPolicyResolved = true;
+      }
+      return defaultTrustedTypesPolicy;
+    };
     const _document = document2, implementation = _document.implementation, createNodeIterator = _document.createNodeIterator, createDocumentFragment2 = _document.createDocumentFragment, getElementsByTagName = _document.getElementsByTagName;
     const importNode = originalDocument.importNode;
     let hooks = _createHooksMap();
@@ -13804,6 +13865,8 @@
     let SAFE_FOR_XML = true;
     let WHOLE_DOCUMENT = false;
     let SET_CONFIG = false;
+    let SET_CONFIG_ALLOWED_TAGS = null;
+    let SET_CONFIG_ALLOWED_ATTR = null;
     let FORCE_BODY = false;
     let RETURN_DOM = false;
     let RETURN_DOM_FRAGMENT = false;
@@ -13815,7 +13878,43 @@
     let IN_PLACE = false;
     let USE_PROFILES = {};
     let FORBID_CONTENTS = null;
-    const DEFAULT_FORBID_CONTENTS = addToSet({}, ["annotation-xml", "audio", "colgroup", "desc", "foreignobject", "head", "iframe", "math", "mi", "mn", "mo", "ms", "mtext", "noembed", "noframes", "noscript", "plaintext", "script", "style", "svg", "template", "thead", "title", "video", "xmp"]);
+    const DEFAULT_FORBID_CONTENTS = addToSet({}, [
+      "annotation-xml",
+      "audio",
+      "colgroup",
+      "desc",
+      "foreignobject",
+      "head",
+      "iframe",
+      "math",
+      "mi",
+      "mn",
+      "mo",
+      "ms",
+      "mtext",
+      "noembed",
+      "noframes",
+      "noscript",
+      "plaintext",
+      "script",
+      // <selectedcontent> mirrors the selected <option>'s subtree, cloned by
+      // the UA (customizable <select>) — including any on* handlers — and the
+      // engine re-mirrors synchronously whenever a removal changes which
+      // option/selectedcontent is current, even inside DOMPurify's inert
+      // DOMParser document. Hoisting its children on removal re-inserts a fresh
+      // mirror target ahead of the walk, which the engine refills, looping
+      // forever (DoS) and amplifying output. Dropping its content on removal
+      // (rather than hoisting) breaks that cascade; the content is a duplicate
+      // of the option, which is sanitized on its own. See campaign-3 F1/F6.
+      "selectedcontent",
+      "style",
+      "svg",
+      "template",
+      "thead",
+      "title",
+      "video",
+      "xmp"
+    ]);
     let DATA_URI_TAGS = null;
     const DEFAULT_DATA_URI_TAGS = addToSet({}, ["audio", "video", "img", "source", "image", "track"]);
     let URI_SAFE_ATTRIBUTES = null;
@@ -13827,8 +13926,10 @@
     let IS_EMPTY_INPUT = false;
     let ALLOWED_NAMESPACES = null;
     const DEFAULT_ALLOWED_NAMESPACES = addToSet({}, [MATHML_NAMESPACE, SVG_NAMESPACE, HTML_NAMESPACE], stringToString);
-    let MATHML_TEXT_INTEGRATION_POINTS = addToSet({}, ["mi", "mo", "mn", "ms", "mtext"]);
-    let HTML_INTEGRATION_POINTS = addToSet({}, ["annotation-xml"]);
+    const DEFAULT_MATHML_TEXT_INTEGRATION_POINTS = freeze(["mi", "mo", "mn", "ms", "mtext"]);
+    let MATHML_TEXT_INTEGRATION_POINTS = addToSet({}, DEFAULT_MATHML_TEXT_INTEGRATION_POINTS);
+    const DEFAULT_HTML_INTEGRATION_POINTS = freeze(["annotation-xml"]);
+    let HTML_INTEGRATION_POINTS = addToSet({}, DEFAULT_HTML_INTEGRATION_POINTS);
     const COMMON_SVG_AND_HTML_ELEMENTS = addToSet({}, ["title", "style", "font", "a", "script"]);
     let PARSER_MEDIA_TYPE = null;
     const SUPPORTED_PARSER_MEDIA_TYPES = ["application/xhtml+xml", "text/html"];
@@ -13851,14 +13952,32 @@
       PARSER_MEDIA_TYPE = // eslint-disable-next-line unicorn/prefer-includes
       SUPPORTED_PARSER_MEDIA_TYPES.indexOf(cfg.PARSER_MEDIA_TYPE) === -1 ? DEFAULT_PARSER_MEDIA_TYPE : cfg.PARSER_MEDIA_TYPE;
       transformCaseFunc = PARSER_MEDIA_TYPE === "application/xhtml+xml" ? stringToString : stringToLowerCase;
-      ALLOWED_TAGS = objectHasOwnProperty(cfg, "ALLOWED_TAGS") && arrayIsArray(cfg.ALLOWED_TAGS) ? addToSet({}, cfg.ALLOWED_TAGS, transformCaseFunc) : DEFAULT_ALLOWED_TAGS;
-      ALLOWED_ATTR = objectHasOwnProperty(cfg, "ALLOWED_ATTR") && arrayIsArray(cfg.ALLOWED_ATTR) ? addToSet({}, cfg.ALLOWED_ATTR, transformCaseFunc) : DEFAULT_ALLOWED_ATTR;
-      ALLOWED_NAMESPACES = objectHasOwnProperty(cfg, "ALLOWED_NAMESPACES") && arrayIsArray(cfg.ALLOWED_NAMESPACES) ? addToSet({}, cfg.ALLOWED_NAMESPACES, stringToString) : DEFAULT_ALLOWED_NAMESPACES;
-      URI_SAFE_ATTRIBUTES = objectHasOwnProperty(cfg, "ADD_URI_SAFE_ATTR") && arrayIsArray(cfg.ADD_URI_SAFE_ATTR) ? addToSet(clone(DEFAULT_URI_SAFE_ATTRIBUTES), cfg.ADD_URI_SAFE_ATTR, transformCaseFunc) : DEFAULT_URI_SAFE_ATTRIBUTES;
-      DATA_URI_TAGS = objectHasOwnProperty(cfg, "ADD_DATA_URI_TAGS") && arrayIsArray(cfg.ADD_DATA_URI_TAGS) ? addToSet(clone(DEFAULT_DATA_URI_TAGS), cfg.ADD_DATA_URI_TAGS, transformCaseFunc) : DEFAULT_DATA_URI_TAGS;
-      FORBID_CONTENTS = objectHasOwnProperty(cfg, "FORBID_CONTENTS") && arrayIsArray(cfg.FORBID_CONTENTS) ? addToSet({}, cfg.FORBID_CONTENTS, transformCaseFunc) : DEFAULT_FORBID_CONTENTS;
-      FORBID_TAGS = objectHasOwnProperty(cfg, "FORBID_TAGS") && arrayIsArray(cfg.FORBID_TAGS) ? addToSet({}, cfg.FORBID_TAGS, transformCaseFunc) : clone({});
-      FORBID_ATTR = objectHasOwnProperty(cfg, "FORBID_ATTR") && arrayIsArray(cfg.FORBID_ATTR) ? addToSet({}, cfg.FORBID_ATTR, transformCaseFunc) : clone({});
+      ALLOWED_TAGS = _resolveSetOption(cfg, "ALLOWED_TAGS", DEFAULT_ALLOWED_TAGS, {
+        transform: transformCaseFunc
+      });
+      ALLOWED_ATTR = _resolveSetOption(cfg, "ALLOWED_ATTR", DEFAULT_ALLOWED_ATTR, {
+        transform: transformCaseFunc
+      });
+      ALLOWED_NAMESPACES = _resolveSetOption(cfg, "ALLOWED_NAMESPACES", DEFAULT_ALLOWED_NAMESPACES, {
+        transform: stringToString
+      });
+      URI_SAFE_ATTRIBUTES = _resolveSetOption(cfg, "ADD_URI_SAFE_ATTR", DEFAULT_URI_SAFE_ATTRIBUTES, {
+        transform: transformCaseFunc,
+        base: DEFAULT_URI_SAFE_ATTRIBUTES
+      });
+      DATA_URI_TAGS = _resolveSetOption(cfg, "ADD_DATA_URI_TAGS", DEFAULT_DATA_URI_TAGS, {
+        transform: transformCaseFunc,
+        base: DEFAULT_DATA_URI_TAGS
+      });
+      FORBID_CONTENTS = _resolveSetOption(cfg, "FORBID_CONTENTS", DEFAULT_FORBID_CONTENTS, {
+        transform: transformCaseFunc
+      });
+      FORBID_TAGS = _resolveSetOption(cfg, "FORBID_TAGS", clone({}), {
+        transform: transformCaseFunc
+      });
+      FORBID_ATTR = _resolveSetOption(cfg, "FORBID_ATTR", clone({}), {
+        transform: transformCaseFunc
+      });
       USE_PROFILES = objectHasOwnProperty(cfg, "USE_PROFILES") ? cfg.USE_PROFILES && typeof cfg.USE_PROFILES === "object" ? clone(cfg.USE_PROFILES) : cfg.USE_PROFILES : false;
       ALLOW_ARIA_ATTR = cfg.ALLOW_ARIA_ATTR !== false;
       ALLOW_DATA_ATTR = cfg.ALLOW_DATA_ATTR !== false;
@@ -13877,8 +13996,8 @@
       IN_PLACE = cfg.IN_PLACE || false;
       IS_ALLOWED_URI$1 = isRegex(cfg.ALLOWED_URI_REGEXP) ? cfg.ALLOWED_URI_REGEXP : IS_ALLOWED_URI;
       NAMESPACE = typeof cfg.NAMESPACE === "string" ? cfg.NAMESPACE : HTML_NAMESPACE;
-      MATHML_TEXT_INTEGRATION_POINTS = objectHasOwnProperty(cfg, "MATHML_TEXT_INTEGRATION_POINTS") && cfg.MATHML_TEXT_INTEGRATION_POINTS && typeof cfg.MATHML_TEXT_INTEGRATION_POINTS === "object" ? clone(cfg.MATHML_TEXT_INTEGRATION_POINTS) : addToSet({}, ["mi", "mo", "mn", "ms", "mtext"]);
-      HTML_INTEGRATION_POINTS = objectHasOwnProperty(cfg, "HTML_INTEGRATION_POINTS") && cfg.HTML_INTEGRATION_POINTS && typeof cfg.HTML_INTEGRATION_POINTS === "object" ? clone(cfg.HTML_INTEGRATION_POINTS) : addToSet({}, ["annotation-xml"]);
+      MATHML_TEXT_INTEGRATION_POINTS = objectHasOwnProperty(cfg, "MATHML_TEXT_INTEGRATION_POINTS") && cfg.MATHML_TEXT_INTEGRATION_POINTS && typeof cfg.MATHML_TEXT_INTEGRATION_POINTS === "object" ? clone(cfg.MATHML_TEXT_INTEGRATION_POINTS) : addToSet({}, DEFAULT_MATHML_TEXT_INTEGRATION_POINTS);
+      HTML_INTEGRATION_POINTS = objectHasOwnProperty(cfg, "HTML_INTEGRATION_POINTS") && cfg.HTML_INTEGRATION_POINTS && typeof cfg.HTML_INTEGRATION_POINTS === "object" ? clone(cfg.HTML_INTEGRATION_POINTS) : addToSet({}, DEFAULT_HTML_INTEGRATION_POINTS);
       const customElementHandling = objectHasOwnProperty(cfg, "CUSTOM_ELEMENT_HANDLING") && cfg.CUSTOM_ELEMENT_HANDLING && typeof cfg.CUSTOM_ELEMENT_HANDLING === "object" ? clone(cfg.CUSTOM_ELEMENT_HANDLING) : create(null);
       CUSTOM_ELEMENT_HANDLING = create(null);
       if (objectHasOwnProperty(customElementHandling, "tagNameCheck") && isRegexOrFunction(customElementHandling.tagNameCheck)) {
@@ -13890,6 +14009,7 @@
       if (objectHasOwnProperty(customElementHandling, "allowCustomizedBuiltInElements") && typeof customElementHandling.allowCustomizedBuiltInElements === "boolean") {
         CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements = customElementHandling.allowCustomizedBuiltInElements;
       }
+      seal(CUSTOM_ELEMENT_HANDLING);
       if (SAFE_FOR_TEMPLATES) {
         ALLOW_DATA_ATTR = false;
       }
@@ -13973,14 +14093,23 @@
         if (typeof cfg.TRUSTED_TYPES_POLICY.createScriptURL !== "function") {
           throw typeErrorCreate('TRUSTED_TYPES_POLICY configuration option must provide a "createScriptURL" hook.');
         }
+        const previousTrustedTypesPolicy = trustedTypesPolicy;
         trustedTypesPolicy = cfg.TRUSTED_TYPES_POLICY;
-        emptyHTML = trustedTypesPolicy.createHTML("");
+        try {
+          emptyHTML = _createTrustedHTML("");
+        } catch (error2) {
+          trustedTypesPolicy = previousTrustedTypesPolicy;
+          throw error2;
+        }
+      } else if (cfg.TRUSTED_TYPES_POLICY === null) {
+        trustedTypesPolicy = void 0;
+        emptyHTML = "";
       } else {
         if (trustedTypesPolicy === void 0) {
-          trustedTypesPolicy = _createTrustedTypesPolicy(trustedTypes, currentScript);
+          trustedTypesPolicy = _getDefaultTrustedTypesPolicy();
         }
-        if (trustedTypesPolicy !== null && typeof emptyHTML === "string") {
-          emptyHTML = trustedTypesPolicy.createHTML("");
+        if (trustedTypesPolicy && typeof emptyHTML === "string") {
+          emptyHTML = _createTrustedHTML("");
         }
       }
       if (freeze) {
@@ -13990,6 +14119,33 @@
     };
     const ALL_SVG_TAGS = addToSet({}, [...svg$1, ...svgFilters, ...svgDisallowed]);
     const ALL_MATHML_TAGS = addToSet({}, [...mathMl$1, ...mathMlDisallowed]);
+    const _checkSvgNamespace = function _checkSvgNamespace2(tagName, parent, parentTagName) {
+      if (parent.namespaceURI === HTML_NAMESPACE) {
+        return tagName === "svg";
+      }
+      if (parent.namespaceURI === MATHML_NAMESPACE) {
+        return tagName === "svg" && (parentTagName === "annotation-xml" || MATHML_TEXT_INTEGRATION_POINTS[parentTagName]);
+      }
+      return Boolean(ALL_SVG_TAGS[tagName]);
+    };
+    const _checkMathMlNamespace = function _checkMathMlNamespace2(tagName, parent, parentTagName) {
+      if (parent.namespaceURI === HTML_NAMESPACE) {
+        return tagName === "math";
+      }
+      if (parent.namespaceURI === SVG_NAMESPACE) {
+        return tagName === "math" && HTML_INTEGRATION_POINTS[parentTagName];
+      }
+      return Boolean(ALL_MATHML_TAGS[tagName]);
+    };
+    const _checkHtmlNamespace = function _checkHtmlNamespace2(tagName, parent, parentTagName) {
+      if (parent.namespaceURI === SVG_NAMESPACE && !HTML_INTEGRATION_POINTS[parentTagName]) {
+        return false;
+      }
+      if (parent.namespaceURI === MATHML_NAMESPACE && !MATHML_TEXT_INTEGRATION_POINTS[parentTagName]) {
+        return false;
+      }
+      return !ALL_MATHML_TAGS[tagName] && (COMMON_SVG_AND_HTML_ELEMENTS[tagName] || !ALL_SVG_TAGS[tagName]);
+    };
     const _checkValidNamespace = function _checkValidNamespace2(element) {
       let parent = getParentNode2(element);
       if (!parent || !parent.tagName) {
@@ -14004,31 +14160,13 @@
         return false;
       }
       if (element.namespaceURI === SVG_NAMESPACE) {
-        if (parent.namespaceURI === HTML_NAMESPACE) {
-          return tagName === "svg";
-        }
-        if (parent.namespaceURI === MATHML_NAMESPACE) {
-          return tagName === "svg" && (parentTagName === "annotation-xml" || MATHML_TEXT_INTEGRATION_POINTS[parentTagName]);
-        }
-        return Boolean(ALL_SVG_TAGS[tagName]);
+        return _checkSvgNamespace(tagName, parent, parentTagName);
       }
       if (element.namespaceURI === MATHML_NAMESPACE) {
-        if (parent.namespaceURI === HTML_NAMESPACE) {
-          return tagName === "math";
-        }
-        if (parent.namespaceURI === SVG_NAMESPACE) {
-          return tagName === "math" && HTML_INTEGRATION_POINTS[parentTagName];
-        }
-        return Boolean(ALL_MATHML_TAGS[tagName]);
+        return _checkMathMlNamespace(tagName, parent, parentTagName);
       }
       if (element.namespaceURI === HTML_NAMESPACE) {
-        if (parent.namespaceURI === SVG_NAMESPACE && !HTML_INTEGRATION_POINTS[parentTagName]) {
-          return false;
-        }
-        if (parent.namespaceURI === MATHML_NAMESPACE && !MATHML_TEXT_INTEGRATION_POINTS[parentTagName]) {
-          return false;
-        }
-        return !ALL_MATHML_TAGS[tagName] && (COMMON_SVG_AND_HTML_ELEMENTS[tagName] || !ALL_SVG_TAGS[tagName]);
+        return _checkHtmlNamespace(tagName, parent, parentTagName);
       }
       if (PARSER_MEDIA_TYPE === "application/xhtml+xml" && ALLOWED_NAMESPACES[element.namespaceURI]) {
         return true;
@@ -14043,6 +14181,37 @@
         getParentNode2(node).removeChild(node);
       } catch (_4) {
         remove(node);
+        if (!getParentNode2(node)) {
+          throw typeErrorCreate("a node selected for removal could not be detached from its tree and cannot be safely returned; refusing to sanitize in place");
+        }
+      }
+    };
+    const _neutralizeRoot = function _neutralizeRoot2(root) {
+      const childNodes = getChildNodes(root);
+      if (childNodes) {
+        const snapshot = [];
+        arrayForEach(childNodes, (child) => {
+          arrayPush(snapshot, child);
+        });
+        arrayForEach(snapshot, (child) => {
+          try {
+            remove(child);
+          } catch (_4) {
+          }
+        });
+      }
+      const attributes = getAttributes(root);
+      if (attributes) {
+        for (let i4 = attributes.length - 1; i4 >= 0; --i4) {
+          const attribute = attributes[i4];
+          const name = attribute && attribute.name;
+          if (typeof name === "string") {
+            try {
+              root.removeAttribute(name);
+            } catch (_4) {
+            }
+          }
+        }
       }
     };
     const _removeAttribute = function _removeAttribute2(name, element) {
@@ -14072,6 +14241,39 @@
         }
       }
     };
+    const _stripDisallowedAttributes = function _stripDisallowedAttributes2(element) {
+      const attributes = getAttributes(element);
+      if (!attributes) {
+        return;
+      }
+      for (let i4 = attributes.length - 1; i4 >= 0; --i4) {
+        const attribute = attributes[i4];
+        const name = attribute && attribute.name;
+        if (typeof name !== "string" || ALLOWED_ATTR[transformCaseFunc(name)]) {
+          continue;
+        }
+        try {
+          element.removeAttribute(name);
+        } catch (_4) {
+        }
+      }
+    };
+    const _neutralizeSubtree = function _neutralizeSubtree2(root) {
+      const stack = [root];
+      while (stack.length > 0) {
+        const node = stack.pop();
+        const nodeType = getNodeType ? getNodeType(node) : node.nodeType;
+        if (nodeType === NODE_TYPE.element) {
+          _stripDisallowedAttributes(node);
+        }
+        const childNodes = getChildNodes(node);
+        if (childNodes) {
+          for (let i4 = childNodes.length - 1; i4 >= 0; --i4) {
+            stack.push(childNodes[i4]);
+          }
+        }
+      }
+    };
     const _initDocument = function _initDocument2(dirty) {
       let doc = null;
       let leadingWhitespace = null;
@@ -14084,7 +14286,7 @@
       if (PARSER_MEDIA_TYPE === "application/xhtml+xml" && NAMESPACE === HTML_NAMESPACE) {
         dirty = '<html xmlns="http://www.w3.org/1999/xhtml"><head></head><body>' + dirty + "</body></html>";
       }
-      const dirtyPayload = trustedTypesPolicy ? trustedTypesPolicy.createHTML(dirty) : dirty;
+      const dirtyPayload = trustedTypesPolicy ? _createTrustedHTML(dirty) : dirty;
       if (NAMESPACE === HTML_NAMESPACE) {
         try {
           doc = new DOMParser2().parseFromString(dirtyPayload, PARSER_MEDIA_TYPE);
@@ -14116,81 +14318,164 @@
         null
       );
     };
+    const _stripTemplateExpressions = function _stripTemplateExpressions2(value) {
+      value = stringReplace(value, MUSTACHE_EXPR$1, " ");
+      value = stringReplace(value, ERB_EXPR$1, " ");
+      value = stringReplace(value, TMPLIT_EXPR$1, " ");
+      return value;
+    };
+    const _scrubTemplateExpressions2 = function _scrubTemplateExpressions(node) {
+      var _node$querySelectorAl;
+      node.normalize();
+      const walker = createNodeIterator.call(
+        node.ownerDocument || node,
+        node,
+        // eslint-disable-next-line no-bitwise
+        NodeFilter.SHOW_TEXT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_CDATA_SECTION | NodeFilter.SHOW_PROCESSING_INSTRUCTION,
+        null
+      );
+      let currentNode = walker.nextNode();
+      while (currentNode) {
+        currentNode.data = _stripTemplateExpressions(currentNode.data);
+        currentNode = walker.nextNode();
+      }
+      const templates = (_node$querySelectorAl = node.querySelectorAll) === null || _node$querySelectorAl === void 0 ? void 0 : _node$querySelectorAl.call(node, "template");
+      if (templates) {
+        arrayForEach(templates, (tmpl) => {
+          if (_isDocumentFragment(tmpl.content)) {
+            _scrubTemplateExpressions2(tmpl.content);
+          }
+        });
+      }
+    };
     const _isClobbered = function _isClobbered2(element) {
-      return element instanceof HTMLFormElement2 && (typeof element.nodeName !== "string" || typeof element.textContent !== "string" || typeof element.removeChild !== "function" || !(element.attributes instanceof NamedNodeMap) || typeof element.removeAttribute !== "function" || typeof element.setAttribute !== "function" || typeof element.namespaceURI !== "string" || typeof element.insertBefore !== "function" || typeof element.hasChildNodes !== "function");
+      const realTagName = getNodeName2 ? getNodeName2(element) : null;
+      if (typeof realTagName !== "string") {
+        return false;
+      }
+      if (transformCaseFunc(realTagName) !== "form") {
+        return false;
+      }
+      return typeof element.nodeName !== "string" || typeof element.textContent !== "string" || typeof element.removeChild !== "function" || // Realm-safe NamedNodeMap detection: equality against the cached
+      // prototype getter. Clobbered .attributes (e.g. <input name="attributes">)
+      // makes the direct read diverge from the cached read; a clean form
+      // (same-realm OR foreign-realm) has both reads pointing at the same
+      // canonical NamedNodeMap.
+      element.attributes !== getAttributes(element) || typeof element.removeAttribute !== "function" || typeof element.setAttribute !== "function" || typeof element.namespaceURI !== "string" || typeof element.insertBefore !== "function" || typeof element.hasChildNodes !== "function" || // NodeType clobbering probe. Cached Node.prototype.nodeType getter
+      // returns the integer 1 for any Element regardless of realm; direct
+      // read on a clobbered form (e.g. <input name="nodeType">) returns
+      // the named child element. Cheap addition — nodeType is read from
+      // an internal slot, no serialization cost — and removes a residual
+      // clobbering surface used by several mXSS / PI / comment branches
+      // in _sanitizeElements that compare currentNode.nodeType directly.
+      element.nodeType !== getNodeType(element) || // HTMLFormElement has [LegacyOverrideBuiltIns]: a descendant named
+      // "childNodes" shadows the prototype getter. Direct reads of
+      // form.childNodes from a clobbered form return the named child
+      // instead of the real NodeList, so any walk that reads it directly
+      // skips the form's real children. Compare the direct read to the
+      // cached Node.prototype getter — when the form's named-property
+      // getter intercepts the read, the two values differ and we flag
+      // the form. This catches every clobbering child type (input,
+      // select, etc.) regardless of whether the named child happens to
+      // carry a numeric .length, which a typeof-based probe would miss
+      // (e.g. HTMLSelectElement.length is a defined unsigned-long).
+      element.childNodes !== getChildNodes(element);
+    };
+    const _isDocumentFragment = function _isDocumentFragment2(value) {
+      if (!getNodeType || typeof value !== "object" || value === null) {
+        return false;
+      }
+      try {
+        return getNodeType(value) === NODE_TYPE.documentFragment;
+      } catch (_4) {
+        return false;
+      }
     };
     const _isNode = function _isNode2(value) {
-      return typeof Node2 === "function" && value instanceof Node2;
+      if (!getNodeType || typeof value !== "object" || value === null) {
+        return false;
+      }
+      try {
+        return typeof getNodeType(value) === "number";
+      } catch (_4) {
+        return false;
+      }
     };
     function _executeHooks(hooks2, currentNode, data) {
+      if (hooks2.length === 0) {
+        return;
+      }
       arrayForEach(hooks2, (hook) => {
         hook.call(DOMPurify, currentNode, data, CONFIG);
       });
     }
-    const _sanitizeElements = function _sanitizeElements2(currentNode) {
-      let content = null;
-      _executeHooks(hooks.beforeSanitizeElements, currentNode, null);
-      if (_isClobbered(currentNode)) {
-        _forceRemove(currentNode);
-        return true;
-      }
-      const tagName = transformCaseFunc(currentNode.nodeName);
-      _executeHooks(hooks.uponSanitizeElement, currentNode, {
-        tagName,
-        allowedTags: ALLOWED_TAGS
-      });
-      if (SAFE_FOR_XML && currentNode.hasChildNodes() && !_isNode(currentNode.firstElementChild) && regExpTest(/<[/\w!]/g, currentNode.innerHTML) && regExpTest(/<[/\w!]/g, currentNode.textContent)) {
-        _forceRemove(currentNode);
+    const _isUnsafeNode = function _isUnsafeNode2(currentNode, tagName) {
+      if (SAFE_FOR_XML && currentNode.hasChildNodes() && !_isNode(currentNode.firstElementChild) && regExpTest(ELEMENT_MARKUP_PROBE, currentNode.textContent) && regExpTest(ELEMENT_MARKUP_PROBE, currentNode.innerHTML)) {
         return true;
       }
       if (SAFE_FOR_XML && currentNode.namespaceURI === HTML_NAMESPACE && tagName === "style" && _isNode(currentNode.firstElementChild)) {
-        _forceRemove(currentNode);
         return true;
       }
-      if (currentNode.nodeType === NODE_TYPE.progressingInstruction) {
-        _forceRemove(currentNode);
+      if (currentNode.nodeType === NODE_TYPE.processingInstruction) {
         return true;
       }
-      if (SAFE_FOR_XML && currentNode.nodeType === NODE_TYPE.comment && regExpTest(/<[/\w]/g, currentNode.data)) {
-        _forceRemove(currentNode);
+      if (SAFE_FOR_XML && currentNode.nodeType === NODE_TYPE.comment && regExpTest(COMMENT_MARKUP_PROBE, currentNode.data)) {
         return true;
       }
-      if (FORBID_TAGS[tagName] || !(EXTRA_ELEMENT_HANDLING.tagCheck instanceof Function && EXTRA_ELEMENT_HANDLING.tagCheck(tagName)) && !ALLOWED_TAGS[tagName]) {
-        if (!FORBID_TAGS[tagName] && _isBasicCustomElement(tagName)) {
-          if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)) {
-            return false;
-          }
-          if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(tagName)) {
-            return false;
-          }
+      return false;
+    };
+    const _sanitizeDisallowedNode = function _sanitizeDisallowedNode2(currentNode, tagName) {
+      if (!FORBID_TAGS[tagName] && _isBasicCustomElement(tagName)) {
+        if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)) {
+          return false;
         }
-        if (KEEP_CONTENT && !FORBID_CONTENTS[tagName]) {
-          const parentNode = getParentNode2(currentNode) || currentNode.parentNode;
-          const childNodes = getChildNodes(currentNode) || currentNode.childNodes;
-          if (childNodes && parentNode) {
-            const childCount = childNodes.length;
-            for (let i4 = childCount - 1; i4 >= 0; --i4) {
-              const childClone = cloneNode(childNodes[i4], true);
-              parentNode.insertBefore(childClone, getNextSibling(currentNode));
-            }
+        if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(tagName)) {
+          return false;
+        }
+      }
+      if (KEEP_CONTENT && !FORBID_CONTENTS[tagName]) {
+        const parentNode = getParentNode2(currentNode);
+        const childNodes = getChildNodes(currentNode);
+        if (childNodes && parentNode) {
+          const childCount = childNodes.length;
+          for (let i4 = childCount - 1; i4 >= 0; --i4) {
+            const hoisted = IN_PLACE ? childNodes[i4] : cloneNode(childNodes[i4], true);
+            parentNode.insertBefore(hoisted, getNextSibling(currentNode));
           }
         }
+      }
+      _forceRemove(currentNode);
+      return true;
+    };
+    const _sanitizeElements = function _sanitizeElements2(currentNode) {
+      _executeHooks(hooks.beforeSanitizeElements, currentNode, null);
+      if (_isClobbered(currentNode)) {
+        _forceRemove(currentNode);
+        return true;
+      }
+      const tagName = transformCaseFunc(getNodeName2 ? getNodeName2(currentNode) : currentNode.nodeName);
+      _executeHooks(hooks.uponSanitizeElement, currentNode, {
+        tagName,
+        allowedTags: ALLOWED_TAGS
+      });
+      if (_isUnsafeNode(currentNode, tagName)) {
         _forceRemove(currentNode);
         return true;
       }
-      if (currentNode instanceof Element2 && !_checkValidNamespace(currentNode)) {
+      if (FORBID_TAGS[tagName] || !(EXTRA_ELEMENT_HANDLING.tagCheck instanceof Function && EXTRA_ELEMENT_HANDLING.tagCheck(tagName)) && !ALLOWED_TAGS[tagName]) {
+        return _sanitizeDisallowedNode(currentNode, tagName);
+      }
+      const nt = getNodeType ? getNodeType(currentNode) : currentNode.nodeType;
+      if (nt === NODE_TYPE.element && !_checkValidNamespace(currentNode)) {
         _forceRemove(currentNode);
         return true;
       }
-      if ((tagName === "noscript" || tagName === "noembed" || tagName === "noframes") && regExpTest(/<\/no(script|embed|frames)/i, currentNode.innerHTML)) {
+      if ((tagName === "noscript" || tagName === "noembed" || tagName === "noframes") && regExpTest(FALLBACK_TAG_CLOSE, currentNode.innerHTML)) {
         _forceRemove(currentNode);
         return true;
       }
       if (SAFE_FOR_TEMPLATES && currentNode.nodeType === NODE_TYPE.text) {
-        content = currentNode.textContent;
-        arrayForEach([MUSTACHE_EXPR$1, ERB_EXPR$1, TMPLIT_EXPR$1], (expr) => {
-          content = stringReplace(content, expr, " ");
-        });
+        const content = _stripTemplateExpressions(currentNode.textContent);
         if (currentNode.textContent !== content) {
           arrayPush(DOMPurify.removed, {
             element: currentNode.cloneNode()
@@ -14209,9 +14494,9 @@
         return false;
       }
       const nameIsPermitted = ALLOWED_ATTR[lcName] || EXTRA_ELEMENT_HANDLING.attributeCheck instanceof Function && EXTRA_ELEMENT_HANDLING.attributeCheck(lcName, lcTag);
-      if (ALLOW_DATA_ATTR && !FORBID_ATTR[lcName] && regExpTest(DATA_ATTR$1, lcName)) ;
+      if (ALLOW_DATA_ATTR && regExpTest(DATA_ATTR$1, lcName)) ;
       else if (ALLOW_ARIA_ATTR && regExpTest(ARIA_ATTR$1, lcName)) ;
-      else if (!nameIsPermitted || FORBID_ATTR[lcName]) {
+      else if (!nameIsPermitted) {
         if (
           // First condition does a very basic check if a) it's basically a valid custom element tagname AND
           // b) if the tagName passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
@@ -14236,6 +14521,35 @@
     const _isBasicCustomElement = function _isBasicCustomElement2(tagName) {
       return !RESERVED_CUSTOM_ELEMENT_NAMES[stringToLowerCase(tagName)] && regExpTest(CUSTOM_ELEMENT$1, tagName);
     };
+    const _applyTrustedTypesToAttribute = function _applyTrustedTypesToAttribute2(lcTag, lcName, namespaceURI, value) {
+      if (trustedTypesPolicy && typeof trustedTypes === "object" && typeof trustedTypes.getAttributeType === "function" && !namespaceURI) {
+        switch (trustedTypes.getAttributeType(lcTag, lcName)) {
+          case "TrustedHTML": {
+            return _createTrustedHTML(value);
+          }
+          case "TrustedScriptURL": {
+            return _createTrustedScriptURL(value);
+          }
+        }
+      }
+      return value;
+    };
+    const _setAttributeValue = function _setAttributeValue2(currentNode, name, namespaceURI, value) {
+      try {
+        if (namespaceURI) {
+          currentNode.setAttributeNS(namespaceURI, name, value);
+        } else {
+          currentNode.setAttribute(name, value);
+        }
+        if (_isClobbered(currentNode)) {
+          _forceRemove(currentNode);
+        } else {
+          arrayPop(DOMPurify.removed);
+        }
+      } catch (_4) {
+        _removeAttribute(name, currentNode);
+      }
+    };
     const _sanitizeAttributes = function _sanitizeAttributes2(currentNode) {
       _executeHooks(hooks.beforeSanitizeAttributes, currentNode, null);
       const attributes = currentNode.attributes;
@@ -14250,6 +14564,7 @@
         forceKeepAttr: void 0
       };
       let l4 = attributes.length;
+      const lcTag = transformCaseFunc(currentNode.nodeName);
       while (l4--) {
         const attr = attributes[l4];
         const name = attr.name, namespaceURI = attr.namespaceURI, attrValue = attr.value;
@@ -14281,50 +14596,20 @@
           _removeAttribute(name, currentNode);
           continue;
         }
-        if (!ALLOW_SELF_CLOSE_IN_ATTR && regExpTest(/\/>/i, value)) {
+        if (!ALLOW_SELF_CLOSE_IN_ATTR && regExpTest(SELF_CLOSING_TAG, value)) {
           _removeAttribute(name, currentNode);
           continue;
         }
         if (SAFE_FOR_TEMPLATES) {
-          arrayForEach([MUSTACHE_EXPR$1, ERB_EXPR$1, TMPLIT_EXPR$1], (expr) => {
-            value = stringReplace(value, expr, " ");
-          });
+          value = _stripTemplateExpressions(value);
         }
-        const lcTag = transformCaseFunc(currentNode.nodeName);
         if (!_isValidAttribute(lcTag, lcName, value)) {
           _removeAttribute(name, currentNode);
           continue;
         }
-        if (trustedTypesPolicy && typeof trustedTypes === "object" && typeof trustedTypes.getAttributeType === "function") {
-          if (namespaceURI) ;
-          else {
-            switch (trustedTypes.getAttributeType(lcTag, lcName)) {
-              case "TrustedHTML": {
-                value = trustedTypesPolicy.createHTML(value);
-                break;
-              }
-              case "TrustedScriptURL": {
-                value = trustedTypesPolicy.createScriptURL(value);
-                break;
-              }
-            }
-          }
-        }
+        value = _applyTrustedTypesToAttribute(lcTag, lcName, namespaceURI, value);
         if (value !== initValue) {
-          try {
-            if (namespaceURI) {
-              currentNode.setAttributeNS(namespaceURI, name, value);
-            } else {
-              currentNode.setAttribute(name, value);
-            }
-            if (_isClobbered(currentNode)) {
-              _forceRemove(currentNode);
-            } else {
-              arrayPop(DOMPurify.removed);
-            }
-          } catch (_4) {
-            _removeAttribute(name, currentNode);
-          }
+          _setAttributeValue(currentNode, name, namespaceURI, value);
         }
       }
       _executeHooks(hooks.afterSanitizeAttributes, currentNode, null);
@@ -14337,28 +14622,67 @@
         _executeHooks(hooks.uponSanitizeShadowNode, shadowNode, null);
         _sanitizeElements(shadowNode);
         _sanitizeAttributes(shadowNode);
-        if (shadowNode.content instanceof DocumentFragment) {
+        if (_isDocumentFragment(shadowNode.content)) {
           _sanitizeShadowDOM2(shadowNode.content);
         }
+        const shadowNodeType = getNodeType ? getNodeType(shadowNode) : shadowNode.nodeType;
+        if (shadowNodeType === NODE_TYPE.element) {
+          const innerSr = getShadowRoot(shadowNode);
+          if (_isDocumentFragment(innerSr)) {
+            _sanitizeAttachedShadowRoots(innerSr);
+            _sanitizeShadowDOM2(innerSr);
+          }
+        }
       }
       _executeHooks(hooks.afterSanitizeShadowDOM, fragment, null);
     };
-    const _sanitizeAttachedShadowRoots2 = function _sanitizeAttachedShadowRoots(root) {
-      if (root.nodeType === NODE_TYPE.element && root.shadowRoot instanceof DocumentFragment) {
-        const sr = root.shadowRoot;
-        _sanitizeAttachedShadowRoots2(sr);
-        _sanitizeShadowDOM2(sr);
-      }
-      const childNodes = root.childNodes;
-      if (!childNodes) {
-        return;
-      }
-      const snapshot = [];
-      arrayForEach(childNodes, (child) => {
-        arrayPush(snapshot, child);
-      });
-      for (const child of snapshot) {
-        _sanitizeAttachedShadowRoots2(child);
+    const _sanitizeAttachedShadowRoots = function _sanitizeAttachedShadowRoots2(root) {
+      const stack = [{
+        node: root,
+        shadow: null
+      }];
+      while (stack.length > 0) {
+        const item = stack.pop();
+        if (item.shadow) {
+          _sanitizeShadowDOM2(item.shadow);
+          continue;
+        }
+        const node = item.node;
+        const nodeType = getNodeType ? getNodeType(node) : node.nodeType;
+        const isElement2 = nodeType === NODE_TYPE.element;
+        const childNodes = getChildNodes(node);
+        if (childNodes) {
+          for (let i4 = childNodes.length - 1; i4 >= 0; --i4) {
+            stack.push({
+              node: childNodes[i4],
+              shadow: null
+            });
+          }
+        }
+        if (isElement2) {
+          const rootName = getNodeName2 ? getNodeName2(node) : null;
+          if (typeof rootName === "string" && transformCaseFunc(rootName) === "template") {
+            const content = node.content;
+            if (_isDocumentFragment(content)) {
+              stack.push({
+                node: content,
+                shadow: null
+              });
+            }
+          }
+        }
+        if (isElement2) {
+          const sr = getShadowRoot(node);
+          if (_isDocumentFragment(sr)) {
+            stack.push({
+              node: null,
+              shadow: sr
+            }, {
+              node: sr,
+              shadow: null
+            });
+          }
+        }
       }
     };
     DOMPurify.sanitize = function(dirty) {
@@ -14380,23 +14704,38 @@
       if (!DOMPurify.isSupported) {
         return dirty;
       }
-      if (!SET_CONFIG) {
+      if (SET_CONFIG) {
+        ALLOWED_TAGS = SET_CONFIG_ALLOWED_TAGS;
+        ALLOWED_ATTR = SET_CONFIG_ALLOWED_ATTR;
+      } else {
         _parseConfig(cfg);
       }
-      DOMPurify.removed = [];
-      if (typeof dirty === "string") {
-        IN_PLACE = false;
+      if (hooks.uponSanitizeElement.length > 0 || hooks.uponSanitizeAttribute.length > 0) {
+        ALLOWED_TAGS = clone(ALLOWED_TAGS);
+      }
+      if (hooks.uponSanitizeAttribute.length > 0) {
+        ALLOWED_ATTR = clone(ALLOWED_ATTR);
       }
-      if (IN_PLACE) {
-        const nn2 = dirty.nodeName;
+      DOMPurify.removed = [];
+      const inPlace = IN_PLACE && typeof dirty !== "string" && _isNode(dirty);
+      if (inPlace) {
+        const nn2 = getNodeName2 ? getNodeName2(dirty) : dirty.nodeName;
         if (typeof nn2 === "string") {
           const tagName = transformCaseFunc(nn2);
           if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
             throw typeErrorCreate("root node is forbidden and cannot be sanitized in-place");
           }
         }
-        _sanitizeAttachedShadowRoots2(dirty);
-      } else if (dirty instanceof Node2) {
+        if (_isClobbered(dirty)) {
+          throw typeErrorCreate("root node is clobbered and cannot be sanitized in-place");
+        }
+        try {
+          _sanitizeAttachedShadowRoots(dirty);
+        } catch (error2) {
+          _neutralizeRoot(dirty);
+          throw error2;
+        }
+      } else if (_isNode(dirty)) {
         body = _initDocument("<!---->");
         importedNode = body.ownerDocument.importNode(dirty, true);
         if (importedNode.nodeType === NODE_TYPE.element && importedNode.nodeName === "BODY") {
@@ -14406,11 +14745,11 @@
         } else {
           body.appendChild(importedNode);
         }
-        _sanitizeAttachedShadowRoots2(importedNode);
+        _sanitizeAttachedShadowRoots(importedNode);
       } else {
         if (!RETURN_DOM && !SAFE_FOR_TEMPLATES && !WHOLE_DOCUMENT && // eslint-disable-next-line unicorn/prefer-includes
         dirty.indexOf("<") === -1) {
-          return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML(dirty) : dirty;
+          return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? _createTrustedHTML(dirty) : dirty;
         }
         body = _initDocument(dirty);
         if (!body) {
@@ -14420,25 +14759,35 @@
       if (body && FORCE_BODY) {
         _forceRemove(body.firstChild);
       }
-      const nodeIterator = _createNodeIterator(IN_PLACE ? dirty : body);
-      while (currentNode = nodeIterator.nextNode()) {
-        _sanitizeElements(currentNode);
-        _sanitizeAttributes(currentNode);
-        if (currentNode.content instanceof DocumentFragment) {
-          _sanitizeShadowDOM2(currentNode.content);
+      const nodeIterator = _createNodeIterator(inPlace ? dirty : body);
+      try {
+        while (currentNode = nodeIterator.nextNode()) {
+          _sanitizeElements(currentNode);
+          _sanitizeAttributes(currentNode);
+          if (_isDocumentFragment(currentNode.content)) {
+            _sanitizeShadowDOM2(currentNode.content);
+          }
         }
+      } catch (error2) {
+        if (inPlace) {
+          _neutralizeRoot(dirty);
+        }
+        throw error2;
       }
-      if (IN_PLACE) {
+      if (inPlace) {
+        arrayForEach(DOMPurify.removed, (entry) => {
+          if (entry.element) {
+            _neutralizeSubtree(entry.element);
+          }
+        });
+        if (SAFE_FOR_TEMPLATES) {
+          _scrubTemplateExpressions2(dirty);
+        }
         return dirty;
       }
       if (RETURN_DOM) {
         if (SAFE_FOR_TEMPLATES) {
-          body.normalize();
-          let html3 = body.innerHTML;
-          arrayForEach([MUSTACHE_EXPR$1, ERB_EXPR$1, TMPLIT_EXPR$1], (expr) => {
-            html3 = stringReplace(html3, expr, " ");
-          });
-          body.innerHTML = html3;
+          _scrubTemplateExpressions2(body);
         }
         if (RETURN_DOM_FRAGMENT) {
           returnNode = createDocumentFragment2.call(body.ownerDocument);
@@ -14458,20 +14807,24 @@
         serializedHTML = "<!DOCTYPE " + body.ownerDocument.doctype.name + ">\n" + serializedHTML;
       }
       if (SAFE_FOR_TEMPLATES) {
-        arrayForEach([MUSTACHE_EXPR$1, ERB_EXPR$1, TMPLIT_EXPR$1], (expr) => {
-          serializedHTML = stringReplace(serializedHTML, expr, " ");
-        });
+        serializedHTML = _stripTemplateExpressions(serializedHTML);
       }
-      return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML(serializedHTML) : serializedHTML;
+      return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? _createTrustedHTML(serializedHTML) : serializedHTML;
     };
     DOMPurify.setConfig = function() {
       let cfg = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : {};
       _parseConfig(cfg);
       SET_CONFIG = true;
+      SET_CONFIG_ALLOWED_TAGS = ALLOWED_TAGS;
+      SET_CONFIG_ALLOWED_ATTR = ALLOWED_ATTR;
     };
     DOMPurify.clearConfig = function() {
       CONFIG = null;
       SET_CONFIG = false;
+      SET_CONFIG_ALLOWED_TAGS = null;
+      SET_CONFIG_ALLOWED_ATTR = null;
+      trustedTypesPolicy = defaultTrustedTypesPolicy;
+      emptyHTML = "";
     };
     DOMPurify.isValidAttribute = function(tag2, attr, value) {
       if (!CONFIG) {
@@ -14485,9 +14838,15 @@
       if (typeof hookFunction !== "function") {
         return;
       }
+      if (!objectHasOwnProperty(hooks, entryPoint)) {
+        return;
+      }
       arrayPush(hooks[entryPoint], hookFunction);
     };
     DOMPurify.removeHook = function(entryPoint, hookFunction) {
+      if (!objectHasOwnProperty(hooks, entryPoint)) {
+        return void 0;
+      }
       if (hookFunction !== void 0) {
         const index = arrayLastIndexOf(hooks[entryPoint], hookFunction);
         return index === -1 ? void 0 : arraySplice(hooks[entryPoint], index, 1)[0];
@@ -14495,6 +14854,9 @@
       return arrayPop(hooks[entryPoint]);
     };
     DOMPurify.removeHooks = function(entryPoint) {
+      if (!objectHasOwnProperty(hooks, entryPoint)) {
+        return;
+      }
       hooks[entryPoint] = [];
     };
     DOMPurify.removeAllHooks = function() {
@@ -27293,6 +27655,9 @@ this.ifd0Offset: ${this.ifd0Offset}, file.byteLength: ${e4.byteLength}`), e4.tif
     }
     //======= Config
     configureUppy() {
+      const dashboardOptions = { inline: false, closeAfterFinish: true };
+      const dialog2 = this.element.closest("dialog");
+      if (dialog2) dashboardOptions.target = dialog2;
       this.uppy = new Uppy_default({
         restrictions: {
           maxFileSize: this.maxFileSizeValue,
@@ -27303,7 +27668,7 @@ this.ifd0Offset: ${this.ifd0Offset}, file.byteLength: ${e4.byteLength}`), e4.tif
           allowedFileTypes: this.allowedFileTypesValue,
           requiredMetaFields: this.requiredMetaFieldsValue
         }
-      }).use(Dashboard2, { inline: false, closeAfterFinish: true }).use(ImageEditor, { target: Dashboard2 });
+      }).use(Dashboard2, dashboardOptions).use(ImageEditor, { target: Dashboard2 });
       this.#configureUploader();
       this.#configureEventHandlers();
     }
@@ -27638,6 +28003,28 @@ this.ifd0Offset: ${this.ifd0Offset}, file.byteLength: ${e4.byteLength}`), e4.tif
     }
   };
 
+  // src/js/controllers/password_sentinel_controller.js
+  var password_sentinel_controller_default = class extends Controller {
+    static values = { sentinel: String };
+    connect() {
+      this.armed = this.element.value === this.sentinelValue;
+    }
+    beforeinput(event) {
+      if (!this.armed) return;
+      event.preventDefault();
+      this.armed = false;
+      let next = "";
+      if (event.inputType === "insertText" && event.data != null) {
+        next = event.data;
+      } else if (event.inputType === "insertFromPaste" && event.dataTransfer) {
+        next = event.dataTransfer.getData("text");
+      }
+      this.element.value = next;
+      this.element.setSelectionRange(next.length, next.length);
+      this.element.dispatchEvent(new Event("input", { bubbles: true }));
+    }
+  };
+
   // src/js/controllers/remote_modal_controller.js
   var remote_modal_controller_default = class extends Controller {
     connect() {
@@ -27680,6 +28067,7 @@ this.ifd0Offset: ${this.ifd0Offset}, file.byteLength: ${e4.byteLength}`), e4.tif
     async #animateClose() {
       if (this._closing) return;
       this._closing = true;
+      this.element.getAnimations().forEach((animation) => animation.finish());
       this.element.removeAttribute("data-open");
       const animations = this.element.getAnimations({ subtree: true });
       await Promise.allSettled(animations.map((a4) => a4.finished));
@@ -28201,7 +28589,13 @@ this.ifd0Offset: ${this.ifd0Offset}, file.byteLength: ${e4.byteLength}`), e4.tif
       if (event.target.closest("a, button, input, label, select, textarea, [data-row-click-ignore]")) {
         return;
       }
-      this.element.querySelector('[data-row-click-target="show"]')?.click();
+      const show = this.element.querySelector('[data-row-click-target="show"]');
+      if (!show) return;
+      if (event.metaKey || event.ctrlKey || event.button === 1) {
+        window.open(show.href, "_blank", "noopener");
+        return;
+      }
+      show.click();
     }
   };
 
@@ -28256,40 +28650,52 @@ this.ifd0Offset: ${this.ifd0Offset}, file.byteLength: ${e4.byteLength}`), e4.tif
     ]);
     connect() {
       this.dialog = this.element.closest("dialog");
-      if (!this.dialog) return;
       this.baseline = null;
       this.forceClose = false;
       this.submitting = false;
       this.onFirstIntent = this.#onFirstIntent.bind(this);
-      this.onCancel = this.#onCancel.bind(this);
       this.onSubmit = this.#onSubmit.bind(this);
-      this.onCloseButtonClick = this.#onCloseButtonClick.bind(this);
-      this.onConfirmCancel = this.#onConfirmCancel.bind(this);
-      this.onKeydown = this.#onKeydown.bind(this);
+      this.onLeaveClick = this.#onLeaveClick.bind(this);
+      this.onSettled = this.#onSettled.bind(this);
       this.element.addEventListener("pointerdown", this.onFirstIntent, true);
       this.element.addEventListener("keydown", this.onFirstIntent, true);
-      document.addEventListener("keydown", this.onKeydown, true);
-      this.dialog.addEventListener("cancel", this.onCancel, true);
       this.element.addEventListener("submit", this.onSubmit);
-      this.#closeButtons().forEach(
-        (btn) => btn.addEventListener("click", this.onCloseButtonClick, true)
-      );
-      if (this.hasConfirmDialogTarget) {
-        this.confirmDialogTarget.addEventListener("cancel", this.onConfirmCancel);
+      this.element.addEventListener("turbo:submit-end", this.onSettled);
+      if (!this.dialog) {
+        document.addEventListener("click", this.onLeaveClick, true);
+      }
+      if (this.dialog) {
+        this.onCancel = this.#onCancel.bind(this);
+        this.onCloseButtonClick = this.#onCloseButtonClick.bind(this);
+        this.onConfirmCancel = this.#onConfirmCancel.bind(this);
+        this.onKeydown = this.#onKeydown.bind(this);
+        document.addEventListener("keydown", this.onKeydown, true);
+        this.dialog.addEventListener("cancel", this.onCancel, true);
+        this.#closeButtons().forEach(
+          (btn) => btn.addEventListener("click", this.onCloseButtonClick, true)
+        );
+        if (this.hasConfirmDialogTarget) {
+          this.confirmDialogTarget.addEventListener("cancel", this.onConfirmCancel);
+        }
       }
     }
     disconnect() {
-      if (!this.dialog) return;
       this.element.removeEventListener("pointerdown", this.onFirstIntent, true);
       this.element.removeEventListener("keydown", this.onFirstIntent, true);
-      document.removeEventListener("keydown", this.onKeydown, true);
-      this.dialog.removeEventListener("cancel", this.onCancel, true);
       this.element.removeEventListener("submit", this.onSubmit);
-      this.#closeButtons().forEach(
-        (btn) => btn.removeEventListener("click", this.onCloseButtonClick, true)
-      );
-      if (this.hasConfirmDialogTarget) {
-        this.confirmDialogTarget.removeEventListener("cancel", this.onConfirmCancel);
+      this.element.removeEventListener("turbo:submit-end", this.onSettled);
+      if (!this.dialog) {
+        document.removeEventListener("click", this.onLeaveClick, true);
+      }
+      if (this.dialog) {
+        document.removeEventListener("keydown", this.onKeydown, true);
+        this.dialog.removeEventListener("cancel", this.onCancel, true);
+        this.#closeButtons().forEach(
+          (btn) => btn.removeEventListener("click", this.onCloseButtonClick, true)
+        );
+        if (this.hasConfirmDialogTarget) {
+          this.confirmDialogTarget.removeEventListener("cancel", this.onConfirmCancel);
+        }
       }
     }
     discard() {
@@ -28331,6 +28737,79 @@ this.ifd0Offset: ${this.ifd0Offset}, file.byteLength: ${e4.byteLength}`), e4.tif
     #onSubmit() {
       this.submitting = true;
     }
+    // A submission settled. Reset the transient guards so a same-URL Turbo-morph
+    // re-render (which keeps this element and does NOT reconnect the controller)
+    // doesn't leave the guard permanently disabled. Re-baseline on next interaction.
+    #onSettled() {
+      this.submitting = false;
+      this.forceClose = false;
+      this.baseline = null;
+    }
+    // Full-page leave guard. A control marked `data-dirty-form-guard-leave` posts
+    // without this form's fields, so its unsaved edits would be lost. If the form
+    // is dirty, confirm first through the app's themed dialog; the attribute's
+    // value is the prompt. We always intercept the click (the themed confirm is
+    // async), then re-submit the trigger's form if the user confirms.
+    async #onLeaveClick(event) {
+      const trigger = event.target.closest("[data-dirty-form-guard-leave]");
+      if (!trigger) return;
+      if (this.#guardedFormFor(trigger) !== this.element) return;
+      if (this.forceClose || this.submitting) return;
+      if (!this.#isDirty()) return;
+      event.preventDefault();
+      event.stopPropagation();
+      const message = trigger.getAttribute("data-dirty-form-guard-leave") || "You have unsaved changes that will be lost. Continue?";
+      const confirmed = await this.#confirm(message);
+      if (!confirmed) return;
+      this.forceClose = true;
+      const form = trigger.closest("form");
+      if (form) {
+        const submitter2 = trigger.matches("button, input[type=submit], input[type=image]") ? trigger : null;
+        form.requestSubmit(submitter2);
+      }
+    }
+    // The CSS selector for a guarded form. The guard is attached as a Stimulus
+    // controller (`data-controller="… dirty-form-guard"`), NOT as a CSS class — so
+    // match on the controller token, not `form.dirty-form-guard` (which never
+    // matches the framework's forms, leaving the leave guard silently dormant).
+    static GUARDED_FORM_SELECTOR = "form[data-controller~='dirty-form-guard']";
+    // The single guarded form a leave control discards: the one containing it, or —
+    // for a control outside any form (a wizard's sibling nav strip) — the closest
+    // guarded form, i.e. the one sharing the deepest common ancestor with the
+    // trigger. Returns the only guarded form on simple pages.
+    #guardedFormFor(trigger) {
+      const selector = this.constructor.GUARDED_FORM_SELECTOR;
+      const inside = trigger.closest(selector);
+      if (inside) return inside;
+      let best = null;
+      let bestDepth = -1;
+      document.querySelectorAll(selector).forEach((form) => {
+        let ancestor = form;
+        while (ancestor && !ancestor.contains(trigger)) ancestor = ancestor.parentElement;
+        if (!ancestor) return;
+        const depth = this.#depthOf(ancestor);
+        if (depth > bestDepth) {
+          bestDepth = depth;
+          best = form;
+        }
+      });
+      return best;
+    }
+    #depthOf(node) {
+      let depth = 0;
+      while (node = node.parentElement) depth++;
+      return depth;
+    }
+    // Defer to the themed Turbo confirm dialog the app installs as the global
+    // confirm method (a styled <dialog>, not the native chrome bar); fall back to
+    // window.confirm only if it isn't available. Returns a Promise<boolean>.
+    #confirm(message) {
+      const turboConfirm = window.Turbo?.config?.forms?.confirm;
+      if (typeof turboConfirm === "function") {
+        return Promise.resolve(turboConfirm(message));
+      }
+      return Promise.resolve(window.confirm(message));
+    }
     #confirmIsOpen() {
       return this.hasConfirmDialogTarget && this.confirmDialogTarget.open;
     }
@@ -28400,9 +28879,230 @@ this.ifd0Offset: ${this.ifd0Offset}, file.byteLength: ${e4.byteLength}`), e4.tif
     }
   };
 
+  // src/js/controllers/wizard_controller.js
+  var wizard_controller_default = class extends Controller {
+    static targets = ["direction"];
+    connect() {
+      this.submitting = false;
+      this.element.addEventListener("submit", this.onSubmit);
+      this.element.addEventListener("turbo:submit-end", this.onSettled);
+      document.addEventListener("turbo:load", this.onSettled);
+      window.addEventListener("pageshow", this.onSettled);
+    }
+    disconnect() {
+      this.element.removeEventListener("submit", this.onSubmit);
+      this.element.removeEventListener("turbo:submit-end", this.onSettled);
+      document.removeEventListener("turbo:load", this.onSettled);
+      window.removeEventListener("pageshow", this.onSettled);
+    }
+    // Set the hidden `_direction` value programmatically (optional helper).
+    setDirection(value) {
+      if (this.hasDirectionTarget) this.directionTarget.value = value;
+    }
+    onSubmit = (event) => {
+      if (this.submitting) {
+        event.preventDefault();
+        return;
+      }
+      this.submitting = true;
+    };
+    onSettled = () => {
+      this.submitting = false;
+    };
+  };
+
+  // src/js/controllers/kanban_controller.js
+  var kanban_controller_default = class extends Controller {
+    static values = { moveUrlTemplate: String };
+    static targets = ["column"];
+    connect() {
+      this.draggedCard = null;
+      this.onDragStart = this.#onDragStart.bind(this);
+      this.onDragOver = this.#onDragOver.bind(this);
+      this.onDragLeave = this.#onDragLeave.bind(this);
+      this.onDrop = this.#onDrop.bind(this);
+      this.onDragEnd = this.#onDragEnd.bind(this);
+      this.element.addEventListener("dragstart", this.onDragStart);
+      this.element.addEventListener("dragover", this.onDragOver);
+      this.element.addEventListener("dragleave", this.onDragLeave);
+      this.element.addEventListener("drop", this.onDrop);
+      this.element.addEventListener("dragend", this.onDragEnd);
+      this.#applyPersistedCollapseStates();
+    }
+    disconnect() {
+      this.element.removeEventListener("dragstart", this.onDragStart);
+      this.element.removeEventListener("dragover", this.onDragOver);
+      this.element.removeEventListener("dragleave", this.onDragLeave);
+      this.element.removeEventListener("drop", this.onDrop);
+      this.element.removeEventListener("dragend", this.onDragEnd);
+    }
+    // ─── Collapse toggle ─────────────────────────────────────────────────────────
+    // Stimulus action: data-action="click->kanban#toggleColumn"
+    // Expected on the expand button in the collapsed strip and the collapse
+    // button in the expanded header.  data-kanban-column-key on the button
+    // identifies which column to toggle.
+    toggleColumn(event) {
+      const key = event.currentTarget.dataset.kanbanColumnKey;
+      if (!key) return;
+      const wrapper = this.element.querySelector(`[data-kanban-col="${key}"]`);
+      if (!wrapper) return;
+      const strip = wrapper.querySelector("[data-kanban-role='strip']");
+      const body = wrapper.querySelector("[data-kanban-role='body']");
+      if (!strip || !body) return;
+      const isCollapsed = wrapper.classList.contains("pu-kanban-column-collapsed");
+      if (isCollapsed) {
+        wrapper.classList.remove("pu-kanban-column-collapsed");
+        this.#saveCollapseState(key, false);
+      } else {
+        wrapper.classList.add("pu-kanban-column-collapsed");
+        this.#saveCollapseState(key, true);
+      }
+    }
+    // ─── drag lifecycle ──────────────────────────────────────────────────────────
+    #onDragStart(event) {
+      const card = event.target.closest("[data-kanban-record-id]");
+      if (!card) return;
+      this.draggedCard = card;
+      event.dataTransfer.effectAllowed = "move";
+      event.dataTransfer.setData("text/plain", card.dataset.kanbanRecordId);
+      requestAnimationFrame(() => card.classList.add("pu-kanban-dragging"));
+      this.#applyDropHints(card.dataset.kanbanColumnKey);
+    }
+    #onDragOver(event) {
+      const column = event.target.closest("[data-kanban-target='column']");
+      if (!column) return;
+      const wrapper = event.target.closest("[data-kanban-col]");
+      if (wrapper?.classList.contains("pu-kanban-no-drop")) return;
+      event.preventDefault();
+      event.dataTransfer.dropEffect = "move";
+      this.#highlightColumn(column);
+    }
+    #onDragLeave(event) {
+      if (!this.element.contains(event.relatedTarget)) {
+        this.#clearHighlights();
+      }
+    }
+    async #onDrop(event) {
+      event.preventDefault();
+      this.#clearHighlights();
+      if (!this.draggedCard) return;
+      const wrapper = event.target.closest("[data-kanban-col]");
+      if (wrapper?.classList.contains("pu-kanban-no-drop")) return;
+      const column = event.target.closest("[data-kanban-target='column']");
+      if (!column) return;
+      const recordId = this.draggedCard.dataset.kanbanRecordId;
+      const fromColumn = this.draggedCard.dataset.kanbanColumnKey;
+      const toColumn = column.dataset.kanbanColumnKeyValue;
+      const existingCards = [...column.querySelectorAll("[data-kanban-record-id]")].filter((c4) => c4 !== this.draggedCard);
+      const toIndex = this.#computeDropIndex(event.clientY, existingCards);
+      const url = this.moveUrlTemplateValue.replace("__ID__", recordId);
+      const csrfToken = document.querySelector('meta[name="csrf-token"]')?.content ?? "";
+      try {
+        const response = await fetch(url, {
+          method: "POST",
+          headers: {
+            "Accept": "text/vnd.turbo-stream.html",
+            "Content-Type": "application/x-www-form-urlencoded",
+            "X-CSRF-Token": csrfToken
+          },
+          body: new URLSearchParams({
+            from_column: fromColumn,
+            to_column: toColumn,
+            to_index: toIndex
+          }),
+          credentials: "same-origin"
+        });
+        const body = await response.text();
+        if (window.Turbo) {
+          Turbo.renderStreamMessage(body);
+        }
+      } catch (error2) {
+        console.error("[kanban] move request failed:", error2);
+      }
+    }
+    #onDragEnd(_event) {
+      this.#clearHighlights();
+      this.#clearDropHints();
+      if (this.draggedCard) {
+        this.draggedCard.classList.remove("pu-kanban-dragging");
+        this.draggedCard = null;
+      }
+    }
+    // ─── drop hints ──────────────────────────────────────────────────────────────
+    // Marks each column wrapper with `pu-kanban-no-drop` when it would refuse
+    // a card dragged from sourceKey. The server remains the authority; this
+    // is a display-only hint to give the user immediate visual feedback.
+    #applyDropHints(sourceKey) {
+      const sourceWrapper = this.element.querySelector(`[data-kanban-col="${sourceKey}"]`);
+      const sourceLocked = sourceWrapper?.dataset.kanbanLocked === "true";
+      this.element.querySelectorAll("[data-kanban-col]").forEach((wrapper) => {
+        const noDrop = sourceLocked || !this.#columnAccepts(wrapper.dataset.kanbanAccepts, sourceKey);
+        wrapper.classList.toggle("pu-kanban-no-drop", noDrop);
+      });
+    }
+    #clearDropHints() {
+      this.element.querySelectorAll("[data-kanban-col]").forEach((w4) => w4.classList.remove("pu-kanban-no-drop"));
+    }
+    // Returns true if the column described by `accepts` (the serialised form
+    // from data-kanban-accepts) would accept a card from `sourceKey`.
+    #columnAccepts(accepts, sourceKey) {
+      if (!accepts || accepts === "all") return true;
+      if (accepts === "none") return false;
+      return accepts.split(",").map((k4) => k4.trim()).includes(sourceKey);
+    }
+    // ─── collapse persistence ─────────────────────────────────────────────────────
+    // Applies localStorage collapse states to all column wrappers currently in
+    // the DOM. Called on connect() and implicitly after Turbo frame swaps
+    // because Stimulus re-connects the controller when the frame content changes.
+    #applyPersistedCollapseStates() {
+      this.element.querySelectorAll("[data-kanban-col]").forEach((wrapper) => {
+        const key = wrapper.dataset.kanbanCol;
+        const stored = localStorage.getItem(this.#storageKey(key));
+        if (stored === null) return;
+        const collapsed = stored === "1";
+        wrapper.classList.toggle("pu-kanban-column-collapsed", collapsed);
+      });
+    }
+    #saveCollapseState(key, collapsed) {
+      try {
+        localStorage.setItem(this.#storageKey(key), collapsed ? "1" : "0");
+      } catch {
+      }
+    }
+    // Derives a unique localStorage key from the resource collection path so
+    // different boards (different resources / tenants) don't share state.
+    // The move URL template is "/path/__ID__/kanban_move"; strip the suffix to
+    // recover the collection path.
+    #storageKey(key) {
+      const path = this.moveUrlTemplateValue.replace("/__ID__/kanban_move", "");
+      return `pu-kanban:${path}:${key}:collapsed`;
+    }
+    // ─── helpers ─────────────────────────────────────────────────────────────────
+    // Returns the 0-based insertion index within the destination column by
+    // comparing the cursor y-position against each card's vertical midpoint.
+    // The card is inserted before the first card whose midpoint is below the
+    // cursor, or appended after all cards if the cursor is below every midpoint.
+    #computeDropIndex(clientY, cards) {
+      for (let i4 = 0; i4 < cards.length; i4++) {
+        const rect = cards[i4].getBoundingClientRect();
+        if (clientY < rect.top + rect.height / 2) return i4;
+      }
+      return cards.length;
+    }
+    #highlightColumn(column) {
+      this.columnTargets.forEach((c4) => {
+        c4.classList.toggle("pu-kanban-drop-target", c4 === column);
+      });
+    }
+    #clearHighlights() {
+      this.columnTargets.forEach((c4) => c4.classList.remove("pu-kanban-drop-target"));
+    }
+  };
+
   // src/js/controllers/register_controllers.js
   function register_controllers_default(application2) {
     application2.register("password-visibility", password_visibility_controller_default);
+    application2.register("password-sentinel", password_sentinel_controller_default);
     application2.register("sidebar", sidebar_controller_default);
     application2.register("resource-header", resource_header_controller_default);
     application2.register("nested-resource-form-fields", nested_resource_form_fields_controller_default);
@@ -28437,6 +29137,8 @@ this.ifd0Offset: ${this.ifd0Offset}, file.byteLength: ${e4.byteLength}`), e4.tif
     application2.register("view-switcher", view_switcher_controller_default);
     application2.register("autosubmit", autosubmit_controller_default);
     application2.register("dirty-form-guard", dirty_form_guard_controller_default);
+    application2.register("wizard", wizard_controller_default);
+    application2.register("kanban", kanban_controller_default);
   }
 
   // src/js/turbo/turbo_actions.js
@@ -28489,7 +29191,7 @@ this.ifd0Offset: ${this.ifd0Offset}, file.byteLength: ${e4.byteLength}`), e4.tif
       "scale-95",
       "data-[open]:opacity-100",
       "data-[open]:scale-100",
-      "transition-[opacity,transform]",
+      "transition-[opacity,scale]",
       "duration-200",
       "ease-out"
     ].join(" ");
@@ -28594,7 +29296,7 @@ cropperjs/dist/cropper.js:
    *)
 
 dompurify/dist/purify.es.mjs:
-  (*! @license DOMPurify 3.4.3 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.4.3/LICENSE *)
+  (*! @license DOMPurify 3.4.11 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.4.11/LICENSE *)
 
 @uppy/utils/lib/Translator.js:
   (**