plutonium 0.62.2 → 0.63.0

data/app/assets/plutonium.js

@@ -13180,6 +13180,7 @@
       this.menu.classList.remove("hidden");
       this.menu.classList.add("block");
       this.menu.removeAttribute("aria-hidden");
+      this.triggerTarget.setAttribute("aria-expanded", "true");
       this.popperInstance.setOptions((options2) => ({
         ...options2,
         modifiers: [
@@ -13195,6 +13196,7 @@
       this.menu.classList.remove("block");
       this.menu.classList.add("hidden");
       this.menu.setAttribute("aria-hidden", "true");
+      this.triggerTarget.setAttribute("aria-expanded", "false");
       this.popperInstance.setOptions((options2) => ({
         ...options2,
         modifiers: [
@@ -13660,7 +13662,7 @@
   var mathMlDisallowed = freeze(["maction", "maligngroup", "malignmark", "mlongdiv", "mscarries", "mscarry", "msgroup", "mstack", "msline", "msrow", "semantics", "annotation", "annotation-xml", "mprescripts", "none"]);
   var text = freeze(["#text"]);
   var html = freeze(["accept", "action", "align", "alt", "autocapitalize", "autocomplete", "autopictureinpicture", "autoplay", "background", "bgcolor", "border", "capture", "cellpadding", "cellspacing", "checked", "cite", "class", "clear", "color", "cols", "colspan", "command", "commandfor", "controls", "controlslist", "coords", "crossorigin", "datetime", "decoding", "default", "dir", "disabled", "disablepictureinpicture", "disableremoteplayback", "download", "draggable", "enctype", "enterkeyhint", "exportparts", "face", "for", "headers", "height", "hidden", "high", "href", "hreflang", "id", "inert", "inputmode", "integrity", "ismap", "kind", "label", "lang", "list", "loading", "loop", "low", "max", "maxlength", "media", "method", "min", "minlength", "multiple", "muted", "name", "nonce", "noshade", "novalidate", "nowrap", "open", "optimum", "part", "pattern", "placeholder", "playsinline", "popover", "popovertarget", "popovertargetaction", "poster", "preload", "pubdate", "radiogroup", "readonly", "rel", "required", "rev", "reversed", "role", "rows", "rowspan", "spellcheck", "scope", "selected", "shape", "size", "sizes", "slot", "span", "srclang", "start", "src", "srcset", "step", "style", "summary", "tabindex", "title", "translate", "type", "usemap", "valign", "value", "width", "wrap", "xmlns"]);
-  var svg = freeze(["accent-height", "accumulate", "additive", "alignment-baseline", "amplitude", "ascent", "attributename", "attributetype", "azimuth", "basefrequency", "baseline-shift", "begin", "bias", "by", "class", "clip", "clippathunits", "clip-path", "clip-rule", "color", "color-interpolation", "color-interpolation-filters", "color-profile", "color-rendering", "cx", "cy", "d", "dx", "dy", "diffuseconstant", "direction", "display", "divisor", "dur", "edgemode", "elevation", "end", "exponent", "fill", "fill-opacity", "fill-rule", "filter", "filterunits", "flood-color", "flood-opacity", "font-family", "font-size", "font-size-adjust", "font-stretch", "font-style", "font-variant", "font-weight", "fx", "fy", "g1", "g2", "glyph-name", "glyphref", "gradientunits", "gradienttransform", "height", "href", "id", "image-rendering", "in", "in2", "intercept", "k", "k1", "k2", "k3", "k4", "kerning", "keypoints", "keysplines", "keytimes", "lang", "lengthadjust", "letter-spacing", "kernelmatrix", "kernelunitlength", "lighting-color", "local", "marker-end", "marker-mid", "marker-start", "markerheight", "markerunits", "markerwidth", "maskcontentunits", "maskunits", "max", "mask", "mask-type", "media", "method", "mode", "min", "name", "numoctaves", "offset", "operator", "opacity", "order", "orient", "orientation", "origin", "overflow", "paint-order", "path", "pathlength", "patterncontentunits", "patterntransform", "patternunits", "points", "preservealpha", "preserveaspectratio", "primitiveunits", "r", "rx", "ry", "radius", "refx", "refy", "repeatcount", "repeatdur", "restart", "result", "rotate", "scale", "seed", "shape-rendering", "slope", "specularconstant", "specularexponent", "spreadmethod", "startoffset", "stddeviation", "stitchtiles", "stop-color", "stop-opacity", "stroke-dasharray", "stroke-dashoffset", "stroke-linecap", "stroke-linejoin", "stroke-miterlimit", "stroke-opacity", "stroke", "stroke-width", "style", "surfacescale", "systemlanguage", "tabindex", "tablevalues", "targetx", "targety", "transform", "transform-origin", "text-anchor", "text-decoration", "text-rendering", "textlength", "type", "u1", "u2", "unicode", "values", "viewbox", "visibility", "version", "vert-adv-y", "vert-origin-x", "vert-origin-y", "width", "word-spacing", "wrap", "writing-mode", "xchannelselector", "ychannelselector", "x", "x1", "x2", "xmlns", "y", "y1", "y2", "z", "zoomandpan"]);
+  var svg = freeze(["accent-height", "accumulate", "additive", "alignment-baseline", "amplitude", "ascent", "attributename", "attributetype", "azimuth", "basefrequency", "baseline-shift", "begin", "bias", "by", "class", "clip", "clippathunits", "clip-path", "clip-rule", "color", "color-interpolation", "color-interpolation-filters", "color-profile", "color-rendering", "cx", "cy", "d", "dx", "dy", "diffuseconstant", "direction", "display", "divisor", "dominant-baseline", "dur", "edgemode", "elevation", "end", "exponent", "fill", "fill-opacity", "fill-rule", "filter", "filterunits", "flood-color", "flood-opacity", "font-family", "font-size", "font-size-adjust", "font-stretch", "font-style", "font-variant", "font-weight", "fx", "fy", "g1", "g2", "glyph-name", "glyphref", "gradientunits", "gradienttransform", "height", "href", "id", "image-rendering", "in", "in2", "intercept", "k", "k1", "k2", "k3", "k4", "kerning", "keypoints", "keysplines", "keytimes", "lang", "lengthadjust", "letter-spacing", "kernelmatrix", "kernelunitlength", "lighting-color", "local", "marker-end", "marker-mid", "marker-start", "markerheight", "markerunits", "markerwidth", "maskcontentunits", "maskunits", "max", "mask", "mask-type", "media", "method", "mode", "min", "name", "numoctaves", "offset", "operator", "opacity", "order", "orient", "orientation", "origin", "overflow", "paint-order", "path", "pathlength", "patterncontentunits", "patterntransform", "patternunits", "pointer-events", "points", "preservealpha", "preserveaspectratio", "primitiveunits", "r", "rx", "ry", "radius", "refx", "refy", "repeatcount", "repeatdur", "restart", "result", "rotate", "scale", "seed", "shape-rendering", "slope", "specularconstant", "specularexponent", "spreadmethod", "startoffset", "stddeviation", "stitchtiles", "stop-color", "stop-opacity", "stroke-dasharray", "stroke-dashoffset", "stroke-linecap", "stroke-linejoin", "stroke-miterlimit", "stroke-opacity", "stroke", "stroke-width", "style", "surfacescale", "systemlanguage", "tabindex", "tablevalues", "targetx", "targety", "transform", "transform-origin", "text-anchor", "text-decoration", "text-orientation", "text-rendering", "textlength", "type", "u1", "u2", "unicode", "values", "vector-effect", "viewbox", "visibility", "version", "vert-adv-y", "vert-origin-x", "vert-origin-y", "width", "word-spacing", "wrap", "writing-mode", "xchannelselector", "ychannelselector", "x", "x1", "x2", "xmlns", "y", "y1", "y2", "z", "zoomandpan"]);
   var mathMl = freeze(["accent", "accentunder", "align", "bevelled", "close", "columnalign", "columnlines", "columnspacing", "columnspan", "denomalign", "depth", "dir", "display", "displaystyle", "encoding", "fence", "frame", "height", "href", "id", "largeop", "length", "linethickness", "lquote", "lspace", "mathbackground", "mathcolor", "mathsize", "mathvariant", "maxsize", "minsize", "movablelimits", "notation", "numalign", "open", "rowalign", "rowlines", "rowspacing", "rowspan", "rspace", "rquote", "scriptlevel", "scriptminsize", "scriptsizemultiplier", "selection", "separator", "separators", "stretchy", "subscriptshift", "supscriptshift", "symmetric", "voffset", "width", "xmlns"]);
   var xml = freeze(["xlink:href", "xml:id", "xlink:title", "xml:space", "xmlns:xlink"]);
   var MUSTACHE_EXPR = seal(/{{[\w\W]*|^[\w\W]*}}/g);
@@ -13700,6 +13702,15 @@
     notation: 12
     // Deprecated
   };
+  var LITERAL_TEXT_ELEMENT_NAMES = ["style", "script", "xmp", "iframe", "noembed", "noframes", "plaintext", "noscript"];
+  var LITERAL_TEXT_ELEMENTS = freeze(addToSet({}, LITERAL_TEXT_ELEMENT_NAMES));
+  var LITERAL_TEXT_CLOSE = (function() {
+    const map = {};
+    arrayForEach(LITERAL_TEXT_ELEMENT_NAMES, (name) => {
+      map[name] = seal(new RegExp("</" + name + "(?=[\\t\\n\\f\\r />])", "i"));
+    });
+    return freeze(map);
+  })();
   var getGlobal = function getGlobal2() {
     return typeof window === "undefined" ? null : window;
   };
@@ -13743,10 +13754,14 @@
   var _resolveSetOption = function _resolveSetOption2(cfg, key, fallback, options2) {
     return objectHasOwnProperty(cfg, key) && arrayIsArray(cfg[key]) ? addToSet(options2.base ? clone(options2.base) : {}, cfg[key], options2.transform) : fallback;
   };
+  var _resolveObjectOption = function _resolveObjectOption2(cfg, key, makeFallback) {
+    const value = objectHasOwnProperty(cfg, key) ? cfg[key] : void 0;
+    return value && typeof value === "object" ? clone(value) : makeFallback();
+  };
   function createDOMPurify() {
     let window2 = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : getGlobal();
     const DOMPurify = (root) => createDOMPurify(root);
-    DOMPurify.version = "3.4.11";
+    DOMPurify.version = "3.4.14";
     DOMPurify.removed = [];
     if (!window2 || !window2.document || window2.document.nodeType !== NODE_TYPE.document || !window2.Element) {
       DOMPurify.isSupported = false;
@@ -13770,6 +13785,13 @@
     const getAttributes = lookupGetter(ElementPrototype, "attributes");
     const getNodeType = Node2 && Node2.prototype ? lookupGetter(Node2.prototype, "nodeType") : null;
     const getNodeName2 = Node2 && Node2.prototype ? lookupGetter(Node2.prototype, "nodeName") : null;
+    const getOwnerDocument = Node2 && Node2.prototype ? lookupGetter(Node2.prototype, "ownerDocument") : null;
+    const _readNodeType = function _readNodeType2(node) {
+      return getNodeType ? getNodeType(node) : node.nodeType;
+    };
+    const _readNodeName = function _readNodeName2(node) {
+      return getNodeName2 ? getNodeName2(node) : node.nodeName;
+    };
     if (typeof HTMLTemplateElement2 === "function") {
       const template = document2.createElement("template");
       if (template.content && template.content.ownerDocument) {
@@ -13996,9 +14018,19 @@
       IN_PLACE = cfg.IN_PLACE || false;
       IS_ALLOWED_URI$1 = isRegex(cfg.ALLOWED_URI_REGEXP) ? cfg.ALLOWED_URI_REGEXP : IS_ALLOWED_URI;
       NAMESPACE = typeof cfg.NAMESPACE === "string" ? cfg.NAMESPACE : HTML_NAMESPACE;
-      MATHML_TEXT_INTEGRATION_POINTS = objectHasOwnProperty(cfg, "MATHML_TEXT_INTEGRATION_POINTS") && cfg.MATHML_TEXT_INTEGRATION_POINTS && typeof cfg.MATHML_TEXT_INTEGRATION_POINTS === "object" ? clone(cfg.MATHML_TEXT_INTEGRATION_POINTS) : addToSet({}, DEFAULT_MATHML_TEXT_INTEGRATION_POINTS);
-      HTML_INTEGRATION_POINTS = objectHasOwnProperty(cfg, "HTML_INTEGRATION_POINTS") && cfg.HTML_INTEGRATION_POINTS && typeof cfg.HTML_INTEGRATION_POINTS === "object" ? clone(cfg.HTML_INTEGRATION_POINTS) : addToSet({}, DEFAULT_HTML_INTEGRATION_POINTS);
-      const customElementHandling = objectHasOwnProperty(cfg, "CUSTOM_ELEMENT_HANDLING") && cfg.CUSTOM_ELEMENT_HANDLING && typeof cfg.CUSTOM_ELEMENT_HANDLING === "object" ? clone(cfg.CUSTOM_ELEMENT_HANDLING) : create(null);
+      MATHML_TEXT_INTEGRATION_POINTS = _resolveObjectOption(
+        cfg,
+        "MATHML_TEXT_INTEGRATION_POINTS",
+        () => addToSet({}, DEFAULT_MATHML_TEXT_INTEGRATION_POINTS)
+        // Default built-in map
+      );
+      HTML_INTEGRATION_POINTS = _resolveObjectOption(
+        cfg,
+        "HTML_INTEGRATION_POINTS",
+        () => addToSet({}, DEFAULT_HTML_INTEGRATION_POINTS)
+        // Default built-in map
+      );
+      const customElementHandling = _resolveObjectOption(cfg, "CUSTOM_ELEMENT_HANDLING", () => create(null));
       CUSTOM_ELEMENT_HANDLING = create(null);
       if (objectHasOwnProperty(customElementHandling, "tagNameCheck") && isRegexOrFunction(customElementHandling.tagNameCheck)) {
         CUSTOM_ELEMENT_HANDLING.tagNameCheck = customElementHandling.tagNameCheck;
@@ -14061,15 +14093,6 @@
           addToSet(ALLOWED_ATTR, cfg.ADD_ATTR, transformCaseFunc);
         }
       }
-      if (objectHasOwnProperty(cfg, "ADD_URI_SAFE_ATTR") && arrayIsArray(cfg.ADD_URI_SAFE_ATTR)) {
-        addToSet(URI_SAFE_ATTRIBUTES, cfg.ADD_URI_SAFE_ATTR, transformCaseFunc);
-      }
-      if (objectHasOwnProperty(cfg, "FORBID_CONTENTS") && arrayIsArray(cfg.FORBID_CONTENTS)) {
-        if (FORBID_CONTENTS === DEFAULT_FORBID_CONTENTS) {
-          FORBID_CONTENTS = clone(FORBID_CONTENTS);
-        }
-        addToSet(FORBID_CONTENTS, cfg.FORBID_CONTENTS, transformCaseFunc);
-      }
       if (objectHasOwnProperty(cfg, "ADD_FORBID_CONTENTS") && arrayIsArray(cfg.ADD_FORBID_CONTENTS)) {
         if (FORBID_CONTENTS === DEFAULT_FORBID_CONTENTS) {
           FORBID_CONTENTS = clone(FORBID_CONTENTS);
@@ -14186,7 +14209,18 @@
         }
       }
     };
+    const _stripAttributeNode = function _stripAttributeNode2(element, attribute, name) {
+      try {
+        element.removeAttributeNode(attribute);
+      } catch (_4) {
+        try {
+          element.removeAttribute(name);
+        } catch (_5) {
+        }
+      }
+    };
     const _neutralizeRoot = function _neutralizeRoot2(root) {
+      _neutralizeSubtree(root);
       const childNodes = getChildNodes(root);
       if (childNodes) {
         const snapshot = [];
@@ -14206,27 +14240,35 @@
           const attribute = attributes[i4];
           const name = attribute && attribute.name;
           if (typeof name === "string") {
-            try {
-              root.removeAttribute(name);
-            } catch (_4) {
-            }
+            _stripAttributeNode(root, attribute, name);
           }
         }
       }
     };
-    const _removeAttribute = function _removeAttribute2(name, element) {
+    const _removeAttribute = function _removeAttribute2(name, element, attr) {
+      if (!attr) {
+        try {
+          attr = element.getAttributeNode(name);
+        } catch (_4) {
+          attr = null;
+        }
+      }
+      arrayPush(DOMPurify.removed, {
+        attribute: attr || null,
+        from: element
+      });
       try {
-        arrayPush(DOMPurify.removed, {
-          attribute: element.getAttributeNode(name),
-          from: element
-        });
+        if (attr) {
+          element.removeAttributeNode(attr);
+        } else {
+          element.removeAttribute(name);
+        }
       } catch (_4) {
-        arrayPush(DOMPurify.removed, {
-          attribute: null,
-          from: element
-        });
+        try {
+          element.removeAttribute(name);
+        } catch (_5) {
+        }
       }
-      element.removeAttribute(name);
       if (name === "is") {
         if (RETURN_DOM || RETURN_DOM_FRAGMENT) {
           try {
@@ -14252,17 +14294,14 @@
         if (typeof name !== "string" || ALLOWED_ATTR[transformCaseFunc(name)]) {
           continue;
         }
-        try {
-          element.removeAttribute(name);
-        } catch (_4) {
-        }
+        _stripAttributeNode(element, attribute, name);
       }
     };
     const _neutralizeSubtree = function _neutralizeSubtree2(root) {
       const stack = [root];
       while (stack.length > 0) {
         const node = stack.pop();
-        const nodeType = getNodeType ? getNodeType(node) : node.nodeType;
+        const nodeType = _readNodeType(node);
         if (nodeType === NODE_TYPE.element) {
           _stripDisallowedAttributes(node);
         }
@@ -14274,6 +14313,51 @@
         }
       }
     };
+    const _isPatchLinkageAttribute = function _isPatchLinkageAttribute2(lcName, lcTag) {
+      if (!SAFE_FOR_XML) {
+        return false;
+      }
+      if (lcName === "patchsrc") {
+        return true;
+      }
+      return lcName === "for" && lcTag !== "label" && lcTag !== "output";
+    };
+    const _neutralizePatchLinkage = function _neutralizePatchLinkage2(root) {
+      if (!SAFE_FOR_XML) {
+        return;
+      }
+      const stack = [root];
+      while (stack.length > 0) {
+        const node = stack.pop();
+        const nodeType = _readNodeType(node);
+        if (nodeType === NODE_TYPE.processingInstruction || nodeType === NODE_TYPE.comment && regExpTest(COMMENT_MARKUP_PROBE, node.data)) {
+          try {
+            remove(node);
+          } catch (_4) {
+          }
+          continue;
+        }
+        if (nodeType === NODE_TYPE.element) {
+          const element = node;
+          const lcTag = transformCaseFunc(_readNodeName(node));
+          try {
+            if (element.hasAttribute && element.hasAttribute("patchsrc")) {
+              element.removeAttribute("patchsrc");
+            }
+            if (element.hasAttribute && element.hasAttribute("for") && _isPatchLinkageAttribute("for", lcTag)) {
+              element.removeAttribute("for");
+            }
+          } catch (_4) {
+          }
+        }
+        const childNodes = getChildNodes(node);
+        if (childNodes) {
+          for (let i4 = childNodes.length - 1; i4 >= 0; --i4) {
+            stack.push(childNodes[i4]);
+          }
+        }
+      }
+    };
     const _initDocument = function _initDocument2(dirty) {
       let doc = null;
       let leadingWhitespace = null;
@@ -14310,8 +14394,9 @@
       return WHOLE_DOCUMENT ? doc.documentElement : body;
     };
     const _createNodeIterator = function _createNodeIterator2(root) {
+      const doc = getOwnerDocument ? getOwnerDocument(root) : root.ownerDocument;
       return createNodeIterator.call(
-        root.ownerDocument || root,
+        doc || root,
         root,
         // eslint-disable-next-line no-bitwise
         NodeFilter.SHOW_ELEMENT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_TEXT | NodeFilter.SHOW_PROCESSING_INSTRUCTION | NodeFilter.SHOW_CDATA_SECTION,
@@ -14327,8 +14412,9 @@
     const _scrubTemplateExpressions2 = function _scrubTemplateExpressions(node) {
       var _node$querySelectorAl;
       node.normalize();
+      const doc = getOwnerDocument ? getOwnerDocument(node) : node.ownerDocument;
       const walker = createNodeIterator.call(
-        node.ownerDocument || node,
+        doc || node,
         node,
         // eslint-disable-next-line no-bitwise
         NodeFilter.SHOW_TEXT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_CDATA_SECTION | NodeFilter.SHOW_PROCESSING_INSTRUCTION,
@@ -14413,7 +14499,7 @@
       if (SAFE_FOR_XML && currentNode.hasChildNodes() && !_isNode(currentNode.firstElementChild) && regExpTest(ELEMENT_MARKUP_PROBE, currentNode.textContent) && regExpTest(ELEMENT_MARKUP_PROBE, currentNode.innerHTML)) {
         return true;
       }
-      if (SAFE_FOR_XML && currentNode.namespaceURI === HTML_NAMESPACE && tagName === "style" && _isNode(currentNode.firstElementChild)) {
+      if (SAFE_FOR_XML && currentNode.namespaceURI === HTML_NAMESPACE && LITERAL_TEXT_ELEMENTS[tagName] && (_isNode(currentNode.firstElementChild) || typeof currentNode.textContent === "string" && regExpTest(LITERAL_TEXT_CLOSE[tagName], currentNode.textContent))) {
         return true;
       }
       if (currentNode.nodeType === NODE_TYPE.processingInstruction) {
@@ -14424,14 +14510,21 @@
       }
       return false;
     };
-    const _sanitizeDisallowedNode = function _sanitizeDisallowedNode2(currentNode, tagName) {
-      if (!FORBID_TAGS[tagName] && _isBasicCustomElement(tagName)) {
-        if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)) {
-          return false;
-        }
-        if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(tagName)) {
-          return false;
+    const _matchesNameCheck = function _matchesNameCheck2(check, name) {
+      if (check instanceof RegExp) {
+        return regExpTest(check, name);
+      }
+      if (check instanceof Function) {
+        for (var _len = arguments.length, args = new Array(_len > 2 ? _len - 2 : 0), _key = 2; _key < _len; _key++) {
+          args[_key - 2] = arguments[_key];
         }
+        return Boolean(check(name, ...args));
+      }
+      return false;
+    };
+    const _sanitizeDisallowedNode = function _sanitizeDisallowedNode2(currentNode, tagName, root) {
+      if (!FORBID_TAGS[tagName] && _isBasicCustomElement(tagName) && _matchesNameCheck(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)) {
+        return false;
       }
       if (KEEP_CONTENT && !FORBID_CONTENTS[tagName]) {
         const parentNode = getParentNode2(currentNode);
@@ -14439,7 +14532,7 @@
         if (childNodes && parentNode) {
           const childCount = childNodes.length;
           for (let i4 = childCount - 1; i4 >= 0; --i4) {
-            const hoisted = IN_PLACE ? childNodes[i4] : cloneNode(childNodes[i4], true);
+            const hoisted = currentNode === root ? cloneNode(childNodes[i4], true) : childNodes[i4];
             parentNode.insertBefore(hoisted, getNextSibling(currentNode));
           }
         }
@@ -14447,25 +14540,51 @@
       _forceRemove(currentNode);
       return true;
     };
-    const _sanitizeElements = function _sanitizeElements2(currentNode) {
+    const _forkSharedAllowlist = function _forkSharedAllowlist2(hookList, set, defaultSet, setConfigSet) {
+      if (hookList.length === 0) {
+        return set;
+      }
+      return set === defaultSet || set === setConfigSet ? clone(set) : set;
+    };
+    const _handleHookDetachedNode = function _handleHookDetachedNode2(currentNode, root) {
+      if (currentNode === root || getParentNode2(currentNode) !== null) {
+        return false;
+      }
+      if (IN_PLACE) {
+        _neutralizeSubtree(currentNode);
+      }
+      return true;
+    };
+    const _sanitizeElements = function _sanitizeElements2(currentNode, root) {
       _executeHooks(hooks.beforeSanitizeElements, currentNode, null);
+      if (_handleHookDetachedNode(currentNode, root)) {
+        return true;
+      }
       if (_isClobbered(currentNode)) {
         _forceRemove(currentNode);
         return true;
       }
-      const tagName = transformCaseFunc(getNodeName2 ? getNodeName2(currentNode) : currentNode.nodeName);
+      const tagName = transformCaseFunc(_readNodeName(currentNode));
+      ALLOWED_TAGS = _forkSharedAllowlist(hooks.uponSanitizeElement, ALLOWED_TAGS, DEFAULT_ALLOWED_TAGS, SET_CONFIG_ALLOWED_TAGS);
       _executeHooks(hooks.uponSanitizeElement, currentNode, {
         tagName,
         allowedTags: ALLOWED_TAGS
       });
+      if (_handleHookDetachedNode(currentNode, root)) {
+        return true;
+      }
       if (_isUnsafeNode(currentNode, tagName)) {
         _forceRemove(currentNode);
         return true;
       }
       if (FORBID_TAGS[tagName] || !(EXTRA_ELEMENT_HANDLING.tagCheck instanceof Function && EXTRA_ELEMENT_HANDLING.tagCheck(tagName)) && !ALLOWED_TAGS[tagName]) {
-        return _sanitizeDisallowedNode(currentNode, tagName);
+        const removed = _sanitizeDisallowedNode(currentNode, tagName, root);
+        if (removed === false) {
+          _executeHooks(hooks.afterSanitizeElements, currentNode, null);
+        }
+        return removed;
       }
-      const nt = getNodeType ? getNodeType(currentNode) : currentNode.nodeType;
+      const nt = _readNodeType(currentNode);
       if (nt === NODE_TYPE.element && !_checkValidNamespace(currentNode)) {
         _forceRemove(currentNode);
         return true;
@@ -14490,32 +14609,43 @@
       if (FORBID_ATTR[lcName]) {
         return false;
       }
+      if (_isPatchLinkageAttribute(lcName, lcTag)) {
+        return false;
+      }
       if (SANITIZE_DOM && (lcName === "id" || lcName === "name") && (value in document2 || value in formElement)) {
         return false;
       }
       const nameIsPermitted = ALLOWED_ATTR[lcName] || EXTRA_ELEMENT_HANDLING.attributeCheck instanceof Function && EXTRA_ELEMENT_HANDLING.attributeCheck(lcName, lcTag);
-      if (ALLOW_DATA_ATTR && regExpTest(DATA_ATTR$1, lcName)) ;
-      else if (ALLOW_ARIA_ATTR && regExpTest(ARIA_ATTR$1, lcName)) ;
-      else if (!nameIsPermitted) {
-        if (
-          // First condition does a very basic check if a) it's basically a valid custom element tagname AND
-          // b) if the tagName passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
-          // and c) if the attribute name passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.attributeNameCheck
-          _isBasicCustomElement(lcTag) && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, lcTag) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(lcTag)) && (CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.attributeNameCheck, lcName) || CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.attributeNameCheck(lcName, lcTag)) || // Alternative, second condition checks if it's an `is`-attribute, AND
-          // the value passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
-          lcName === "is" && CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, value) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(value))
-        ) ;
-        else {
-          return false;
-        }
-      } else if (URI_SAFE_ATTRIBUTES[lcName]) ;
-      else if (regExpTest(IS_ALLOWED_URI$1, stringReplace(value, ATTR_WHITESPACE$1, ""))) ;
-      else if ((lcName === "src" || lcName === "xlink:href" || lcName === "href") && lcTag !== "script" && stringIndexOf(value, "data:") === 0 && DATA_URI_TAGS[lcTag]) ;
-      else if (ALLOW_UNKNOWN_PROTOCOLS && !regExpTest(IS_SCRIPT_OR_DATA$1, stringReplace(value, ATTR_WHITESPACE$1, ""))) ;
-      else if (value) {
-        return false;
-      } else ;
-      return true;
+      if (ALLOW_DATA_ATTR && regExpTest(DATA_ATTR$1, lcName)) {
+        return true;
+      }
+      if (ALLOW_ARIA_ATTR && regExpTest(ARIA_ATTR$1, lcName)) {
+        return true;
+      }
+      if (!nameIsPermitted) {
+        return (
+          // Condition a) covers a basically valid custom element tag name whose
+          // tag passes the configured tagNameCheck and whose attribute name
+          // passes the configured attributeNameCheck ...
+          _isBasicCustomElement(lcTag) && _matchesNameCheck(CUSTOM_ELEMENT_HANDLING.tagNameCheck, lcTag) && _matchesNameCheck(CUSTOM_ELEMENT_HANDLING.attributeNameCheck, lcName, lcTag) || // Condition b) covers an `is` attribute whose value passes the
+          // configured tagNameCheck while customized built-in elements are
+          // allowed.
+          lcName === "is" && CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements && _matchesNameCheck(CUSTOM_ELEMENT_HANDLING.tagNameCheck, value)
+        );
+      }
+      if (URI_SAFE_ATTRIBUTES[lcName]) {
+        return true;
+      }
+      if (regExpTest(IS_ALLOWED_URI$1, stringReplace(value, ATTR_WHITESPACE$1, ""))) {
+        return true;
+      }
+      if ((lcName === "src" || lcName === "xlink:href" || lcName === "href") && lcTag !== "script" && stringIndexOf(value, "data:") === 0 && DATA_URI_TAGS[lcTag]) {
+        return true;
+      }
+      if (ALLOW_UNKNOWN_PROTOCOLS && !regExpTest(IS_SCRIPT_OR_DATA$1, stringReplace(value, ATTR_WHITESPACE$1, ""))) {
+        return true;
+      }
+      return !value;
     };
     const RESERVED_CUSTOM_ELEMENT_NAMES = addToSet({}, ["annotation-xml", "color-profile", "font-face", "font-face-format", "font-face-name", "font-face-src", "font-face-uri", "missing-glyph"]);
     const _isBasicCustomElement = function _isBasicCustomElement2(tagName) {
@@ -14556,6 +14686,7 @@
       if (!attributes || _isClobbered(currentNode)) {
         return;
       }
+      ALLOWED_ATTR = _forkSharedAllowlist(hooks.uponSanitizeAttribute, ALLOWED_ATTR, DEFAULT_ALLOWED_ATTR, SET_CONFIG_ALLOWED_ATTR);
       const hookEvent = {
         attrName: "",
         attrValue: "",
@@ -14578,33 +14709,33 @@
         _executeHooks(hooks.uponSanitizeAttribute, currentNode, hookEvent);
         value = hookEvent.attrValue;
         if (SANITIZE_NAMED_PROPS && (lcName === "id" || lcName === "name") && stringIndexOf(value, SANITIZE_NAMED_PROPS_PREFIX) !== 0) {
-          _removeAttribute(name, currentNode);
+          _removeAttribute(name, currentNode, attr);
           value = SANITIZE_NAMED_PROPS_PREFIX + value;
         }
         if (SAFE_FOR_XML && regExpTest(/((--!?|])>)|<\/(style|script|title|xmp|textarea|noscript|iframe|noembed|noframes)/i, value)) {
-          _removeAttribute(name, currentNode);
+          _removeAttribute(name, currentNode, attr);
           continue;
         }
         if (lcName === "attributename" && stringMatch(value, "href")) {
-          _removeAttribute(name, currentNode);
+          _removeAttribute(name, currentNode, attr);
           continue;
         }
         if (hookEvent.forceKeepAttr) {
           continue;
         }
         if (!hookEvent.keepAttr) {
-          _removeAttribute(name, currentNode);
+          _removeAttribute(name, currentNode, attr);
           continue;
         }
         if (!ALLOW_SELF_CLOSE_IN_ATTR && regExpTest(SELF_CLOSING_TAG, value)) {
-          _removeAttribute(name, currentNode);
+          _removeAttribute(name, currentNode, attr);
           continue;
         }
         if (SAFE_FOR_TEMPLATES) {
           value = _stripTemplateExpressions(value);
         }
         if (!_isValidAttribute(lcTag, lcName, value)) {
-          _removeAttribute(name, currentNode);
+          _removeAttribute(name, currentNode, attr);
           continue;
         }
         value = _applyTrustedTypesToAttribute(lcTag, lcName, namespaceURI, value);
@@ -14620,13 +14751,12 @@
       _executeHooks(hooks.beforeSanitizeShadowDOM, fragment, null);
       while (shadowNode = shadowIterator.nextNode()) {
         _executeHooks(hooks.uponSanitizeShadowNode, shadowNode, null);
-        _sanitizeElements(shadowNode);
+        _sanitizeElements(shadowNode, fragment);
         _sanitizeAttributes(shadowNode);
         if (_isDocumentFragment(shadowNode.content)) {
           _sanitizeShadowDOM2(shadowNode.content);
         }
-        const shadowNodeType = getNodeType ? getNodeType(shadowNode) : shadowNode.nodeType;
-        if (shadowNodeType === NODE_TYPE.element) {
+        if (_readNodeType(shadowNode) === NODE_TYPE.element) {
           const innerSr = getShadowRoot(shadowNode);
           if (_isDocumentFragment(innerSr)) {
             _sanitizeAttachedShadowRoots(innerSr);
@@ -14648,7 +14778,7 @@
           continue;
         }
         const node = item.node;
-        const nodeType = getNodeType ? getNodeType(node) : node.nodeType;
+        const nodeType = _readNodeType(node);
         const isElement2 = nodeType === NODE_TYPE.element;
         const childNodes = getChildNodes(node);
         if (childNodes) {
@@ -14719,14 +14849,17 @@
       DOMPurify.removed = [];
       const inPlace = IN_PLACE && typeof dirty !== "string" && _isNode(dirty);
       if (inPlace) {
-        const nn2 = getNodeName2 ? getNodeName2(dirty) : dirty.nodeName;
+        _neutralizePatchLinkage(dirty);
+        const nn2 = _readNodeName(dirty);
         if (typeof nn2 === "string") {
           const tagName = transformCaseFunc(nn2);
           if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
+            _neutralizeRoot(dirty);
             throw typeErrorCreate("root node is forbidden and cannot be sanitized in-place");
           }
         }
         if (_isClobbered(dirty)) {
+          _neutralizeRoot(dirty);
           throw typeErrorCreate("root node is clobbered and cannot be sanitized in-place");
         }
         try {
@@ -14759,10 +14892,11 @@
       if (body && FORCE_BODY) {
         _forceRemove(body.firstChild);
       }
-      const nodeIterator = _createNodeIterator(inPlace ? dirty : body);
+      const walkRoot = inPlace ? dirty : body;
       try {
+        const nodeIterator = _createNodeIterator(walkRoot);
         while (currentNode = nodeIterator.nextNode()) {
-          _sanitizeElements(currentNode);
+          _sanitizeElements(currentNode, walkRoot);
           _sanitizeAttributes(currentNode);
           if (_isDocumentFragment(currentNode.content)) {
             _sanitizeShadowDOM2(currentNode.content);
@@ -14771,6 +14905,11 @@
       } catch (error2) {
         if (inPlace) {
           _neutralizeRoot(dirty);
+          arrayForEach(DOMPurify.removed, (entry) => {
+            if (entry.element) {
+              _neutralizeSubtree(entry.element);
+            }
+          });
         }
         throw error2;
       }
@@ -18614,7 +18753,7 @@ ${text2}</tr>
   var nanoid = (size = 21) => {
     let id2 = "";
     let i4 = size | 0;
-    while (i4--) {
+    while (i4-- > 0) {
       id2 += urlAlphabet[Math.random() * 64 | 0];
     }
     return id2;
@@ -28216,7 +28355,9 @@ this.ifd0Offset: ${this.ifd0Offset}, file.byteLength: ${e4.byteLength}`), e4.tif
         const baseUrl = button.dataset.bulkActionUrl;
         const actionName = button.dataset.bulkActionName;
         if (baseUrl) {
-          button.href = idsParam ? `${baseUrl}?${idsParam}` : baseUrl;
+          const [path, query] = baseUrl.split("?");
+          const merged = [query, idsParam].filter(Boolean).join("&");
+          button.href = merged ? `${path}?${merged}` : path;
         }
         button.style.display = allowedActions.has(actionName) ? "" : "none";
       });
@@ -28913,6 +29054,97 @@ this.ifd0Offset: ${this.ifd0Offset}, file.byteLength: ${e4.byteLength}`), e4.tif
     };
   };
 
+  // src/js/drag/sortable.js
+  function computeDropIndex(clientY, items) {
+    for (let i4 = 0; i4 < items.length; i4++) {
+      const rect = items[i4].getBoundingClientRect();
+      if (clientY < rect.top + rect.height / 2) return i4;
+    }
+    return items.length;
+  }
+  function computeDropIndexHorizontal(clientX, items) {
+    for (let i4 = 0; i4 < items.length; i4++) {
+      const rect = items[i4].getBoundingClientRect();
+      if (clientX < rect.left + rect.width / 2) return i4;
+    }
+    return items.length;
+  }
+  function beginDrag(event, element, { draggingClass, payload, dragImage = null }) {
+    event.dataTransfer.effectAllowed = "move";
+    event.dataTransfer.setData("text/plain", payload);
+    if (dragImage) {
+      const rect = dragImage.getBoundingClientRect();
+      event.dataTransfer.setDragImage(dragImage, event.clientX - rect.left, event.clientY - rect.top);
+    }
+    requestAnimationFrame(() => element.classList.add(draggingClass));
+  }
+  function endDrag(element, { draggingClass }) {
+    element.classList.remove(draggingClass);
+    hideInsertionMarker();
+  }
+  var MARKER_ID = "pu-drag-insertion-marker";
+  function insertionMarker() {
+    let marker = document.getElementById(MARKER_ID);
+    if (!marker) {
+      marker = document.createElement("div");
+      marker.id = MARKER_ID;
+      marker.className = "pu-drag-marker";
+      marker.setAttribute("aria-hidden", "true");
+      document.body.appendChild(marker);
+    }
+    return marker;
+  }
+  function showInsertionMarker(items, index, { axis = "vertical", container = null, gap = null } = {}) {
+    const marker = insertionMarker();
+    if (gap) {
+      marker.style.setProperty("--pu-drag-marker-gap", gap);
+    } else {
+      marker.style.removeProperty("--pu-drag-marker-gap");
+    }
+    const vertical = axis !== "horizontal";
+    const near = (rect) => vertical ? rect.top : rect.left;
+    const far = (rect) => vertical ? rect.bottom : rect.right;
+    let span;
+    let offset2;
+    let edge;
+    if (items.length === 0) {
+      if (!container) return hideInsertionMarker();
+      span = container.getBoundingClientRect();
+      offset2 = near(span);
+      edge = "leading";
+    } else if (index <= 0) {
+      span = items[0].getBoundingClientRect();
+      offset2 = near(span);
+      edge = "leading";
+    } else if (index >= items.length) {
+      span = items[items.length - 1].getBoundingClientRect();
+      offset2 = far(span);
+      edge = "trailing";
+    } else {
+      span = items[index].getBoundingClientRect();
+      offset2 = (far(items[index - 1].getBoundingClientRect()) + near(span)) / 2;
+      edge = "between";
+    }
+    if (vertical) {
+      marker.style.left = `${span.left}px`;
+      marker.style.top = `${offset2}px`;
+      marker.style.width = `${span.width}px`;
+      marker.style.height = "";
+    } else {
+      marker.style.left = `${offset2}px`;
+      marker.style.top = `${span.top}px`;
+      marker.style.height = `${span.height}px`;
+      marker.style.width = "";
+    }
+    marker.dataset.axis = axis;
+    marker.dataset.edge = edge;
+    marker.style.display = "block";
+  }
+  function hideInsertionMarker() {
+    const marker = document.getElementById(MARKER_ID);
+    if (marker) marker.style.display = "none";
+  }
+
   // src/js/controllers/kanban_controller.js
   var kanban_controller_default = class extends Controller {
     static values = { moveUrlTemplate: String, collapseCookie: String, collapsePath: String };
@@ -29166,9 +29398,10 @@ this.ifd0Offset: ${this.ifd0Offset}, file.byteLength: ${e4.byteLength}`), e4.tif
       const card = event.target.closest("[data-kanban-record-id]");
       if (!card) return;
       this.draggedCard = card;
-      event.dataTransfer.effectAllowed = "move";
-      event.dataTransfer.setData("text/plain", card.dataset.kanbanRecordId);
-      requestAnimationFrame(() => card.classList.add("pu-kanban-dragging"));
+      beginDrag(event, card, {
+        draggingClass: "pu-kanban-dragging",
+        payload: card.dataset.kanbanRecordId
+      });
       this.#applyDropHints(card.dataset.kanbanColumnKey);
     }
     #onDragOver(event) {
@@ -29179,15 +29412,25 @@ this.ifd0Offset: ${this.ifd0Offset}, file.byteLength: ${e4.byteLength}`), e4.tif
       event.preventDefault();
       event.dataTransfer.dropEffect = "move";
       this.#highlightColumn(column);
+      const existingCards = [...column.querySelectorAll("[data-kanban-record-id]")].filter((c4) => c4 !== this.draggedCard);
+      showInsertionMarker(existingCards, computeDropIndex(event.clientY, existingCards), {
+        axis: "vertical",
+        container: column,
+        // Cards sit further apart than table rows, so the table's clearance reads
+        // as cramped against a card's edge here.
+        gap: "10px"
+      });
     }
     #onDragLeave(event) {
       if (!this.element.contains(event.relatedTarget)) {
         this.#clearHighlights();
+        hideInsertionMarker();
       }
     }
     async #onDrop(event) {
       event.preventDefault();
       this.#clearHighlights();
+      hideInsertionMarker();
       if (!this.draggedCard) return;
       const wrapper = event.target.closest("[data-kanban-col]");
       if (wrapper?.classList.contains("pu-kanban-no-drop")) return;
@@ -29197,7 +29440,7 @@ this.ifd0Offset: ${this.ifd0Offset}, file.byteLength: ${e4.byteLength}`), e4.tif
       const fromColumn = this.draggedCard.dataset.kanbanColumnKey;
       const toColumn = column.dataset.kanbanColumnKeyValue;
       const existingCards = [...column.querySelectorAll("[data-kanban-record-id]")].filter((c4) => c4 !== this.draggedCard);
-      const toIndex = this.#computeDropIndex(event.clientY, existingCards);
+      const toIndex = computeDropIndex(event.clientY, existingCards);
       const destWrapper = column.closest("[data-kanban-col]");
       if (destWrapper?.dataset.kanbanDropInteraction === "true" && fromColumn !== toColumn) {
         if (destWrapper.dataset.kanbanDropImmediate === "true") {
@@ -29276,7 +29519,7 @@ this.ifd0Offset: ${this.ifd0Offset}, file.byteLength: ${e4.byteLength}`), e4.tif
       this.#clearHighlights();
       this.#clearDropHints();
       if (this.draggedCard) {
-        this.draggedCard.classList.remove("pu-kanban-dragging");
+        endDrag(this.draggedCard, { draggingClass: "pu-kanban-dragging" });
         this.draggedCard = null;
       }
     }
@@ -29336,17 +29579,6 @@ this.ifd0Offset: ${this.ifd0Offset}, file.byteLength: ${e4.byteLength}`), e4.tif
       document.cookie = `${name}=${value}; path=${path}; max-age=${60 * 60 * 24 * 180}; SameSite=Lax`;
     }
     // ─── helpers ─────────────────────────────────────────────────────────────────
-    // Returns the 0-based insertion index within the destination column by
-    // comparing the cursor y-position against each card's vertical midpoint.
-    // The card is inserted before the first card whose midpoint is below the
-    // cursor, or appended after all cards if the cursor is below every midpoint.
-    #computeDropIndex(clientY, cards) {
-      for (let i4 = 0; i4 < cards.length; i4++) {
-        const rect = cards[i4].getBoundingClientRect();
-        if (clientY < rect.top + rect.height / 2) return i4;
-      }
-      return cards.length;
-    }
     #highlightColumn(column) {
       this.columnTargets.forEach((c4) => {
         c4.classList.toggle("pu-kanban-drop-target", c4 === column);
@@ -29357,6 +29589,254 @@ this.ifd0Offset: ${this.ifd0Offset}, file.byteLength: ${e4.byteLength}`), e4.tif
     }
   };
 
+  // src/js/controllers/positioned_controller.js
+  var DRAGGING_CLASS = "opacity-30";
+  var positioned_controller_default = class extends Controller {
+    static values = { urlTemplate: String, axis: { type: String, default: "vertical" } };
+    connect() {
+      this.draggedRow = null;
+      this.onDragStart = this.#onDragStart.bind(this);
+      this.onDragOver = this.#onDragOver.bind(this);
+      this.onDragLeave = this.#onDragLeave.bind(this);
+      this.onDrop = this.#onDrop.bind(this);
+      this.onDragEnd = this.#onDragEnd.bind(this);
+      this.onKeyDown = this.#onKeyDown.bind(this);
+      this.element.addEventListener("dragstart", this.onDragStart);
+      this.element.addEventListener("dragover", this.onDragOver);
+      this.element.addEventListener("dragleave", this.onDragLeave);
+      this.element.addEventListener("drop", this.onDrop);
+      this.element.addEventListener("dragend", this.onDragEnd);
+      this.element.addEventListener("keydown", this.onKeyDown);
+    }
+    disconnect() {
+      this.element.removeEventListener("dragstart", this.onDragStart);
+      this.element.removeEventListener("dragover", this.onDragOver);
+      this.element.removeEventListener("dragleave", this.onDragLeave);
+      this.element.removeEventListener("drop", this.onDrop);
+      this.element.removeEventListener("dragend", this.onDragEnd);
+      this.element.removeEventListener("keydown", this.onKeyDown);
+      hideInsertionMarker();
+    }
+    // ─── drag lifecycle ─────────────────────────────────────────────────────────
+    #onDragStart(event) {
+      const grip = event.target.closest("[data-positioned-grip]");
+      if (!grip) return;
+      const row = this.#rowFor(grip);
+      if (!row) return;
+      this.draggedRow = row;
+      beginDrag(event, row, {
+        draggingClass: DRAGGING_CLASS,
+        payload: row.dataset.positionedRowId,
+        // The grip carries draggable="true", so without this the browser ghosts
+        // the grip alone and the row looks like it never left.
+        dragImage: row
+      });
+    }
+    #onDragOver(event) {
+      if (!this.draggedRow) return;
+      if (!this.#sameGroupAs(event.target)) {
+        hideInsertionMarker();
+        return;
+      }
+      event.preventDefault();
+      event.dataTransfer.dropEffect = "move";
+      const others = this.#rows().filter((r4) => r4 !== this.draggedRow);
+      showInsertionMarker(others, this.#dropIndex(event, others), {
+        axis: this.axisValue === "horizontal" ? "horizontal" : "vertical",
+        container: this.element
+      });
+    }
+    #onDragLeave(event) {
+      if (event.relatedTarget && this.element.contains(event.relatedTarget)) return;
+      hideInsertionMarker();
+    }
+    #onDrop(event) {
+      event.preventDefault();
+      hideInsertionMarker();
+      if (!this.draggedRow) return;
+      const row = this.draggedRow;
+      const others = this.#rows().filter((r4) => r4 !== row);
+      this.#applyMove(row, others, this.#dropIndex(event, others));
+    }
+    // Where a drop at the cursor lands, in `items`' own order.
+    //
+    // A table stacks: one row per line, so the vertical midpoint test is the
+    // whole story. A grid WRAPS: cards flow left-to-right and then onto a new
+    // line, and reading that layout off clientY alone would collapse every card
+    // on a line into a single slot — the drop would land at the start of the row
+    // no matter which gap the user aimed at.
+    //
+    // But clientX alone is no better, because every visual row starts at the same
+    // left edge: x=250 is "after the third card" in row 1 and row 4 alike. So
+    // narrow to the row the cursor is over FIRST, then let the horizontal
+    // midpoint test choose the gap inside it.
+    #dropIndex(event, items) {
+      if (this.axisValue !== "horizontal") return computeDropIndex(event.clientY, items);
+      if (items.length === 0) return 0;
+      const rows = this.#visualRows(items);
+      if (event.clientY < rows[0].top) return 0;
+      const row = rows.find((r4) => event.clientY <= r4.bottom);
+      if (!row) return items.length;
+      return row.start + computeDropIndexHorizontal(event.clientX, items.slice(row.start, row.end));
+    }
+    // Groups `items` into the lines the browser actually laid them out on, as
+    // {top, bottom, start, end} spans over `items`.
+    //
+    // Recovered from geometry rather than from a column count on purpose: the
+    // grid is responsive (1/2/3/4 columns by breakpoint) and a definition may pin
+    // its own, so the only thing that reliably knows how the cards wrapped is
+    // where they ended up. A new line starts wherever an item's top edge leaves
+    // the current one's — with a pixel of slack, since equal-height cards in a
+    // row can still differ by a sub-pixel.
+    #visualRows(items) {
+      const rows = [];
+      items.forEach((item, i4) => {
+        const rect = item.getBoundingClientRect();
+        const row = rows[rows.length - 1];
+        if (row && Math.abs(rect.top - row.top) <= 1) {
+          row.end = i4 + 1;
+          row.bottom = Math.max(row.bottom, rect.bottom);
+        } else {
+          rows.push({ top: rect.top, bottom: rect.bottom, start: i4, end: i4 + 1 });
+        }
+      });
+      return rows;
+    }
+    #onDragEnd(_event) {
+      if (!this.draggedRow) return;
+      endDrag(this.draggedRow, { draggingClass: DRAGGING_CLASS });
+      this.draggedRow = null;
+    }
+    // ─── keyboard ───────────────────────────────────────────────────────────────
+    #onKeyDown(event) {
+      if (event.key !== "ArrowUp" && event.key !== "ArrowDown") return;
+      const grip = event.target.closest("[data-positioned-grip]");
+      if (!grip) return;
+      const row = this.#rowFor(grip);
+      if (!row) return;
+      event.preventDefault();
+      const rows = this.#rows();
+      const from = rows.indexOf(row);
+      const to = event.key === "ArrowUp" ? from - 1 : from + 1;
+      if (to < 0 || to >= rows.length) return;
+      const others = rows.filter((r4) => r4 !== row);
+      this.#applyMove(row, others, to);
+      grip.focus();
+    }
+    // ─── the move itself ────────────────────────────────────────────────────────
+    // Moves `row` to `index` among `others` (which must already exclude `row`),
+    // optimistically, then tells the server. Shared by drop and keyboard so the
+    // two can never compute neighbours differently.
+    #applyMove(row, others, index) {
+      const before = others[index] ?? null;
+      const after = others[index - 1] ?? null;
+      if (row.nextElementSibling === before && row.previousElementSibling === after) return;
+      const restoreAnchor = row.nextSibling;
+      row.parentElement.insertBefore(row, before);
+      this.#submit(row, restoreAnchor, {
+        // The ids of the row's VISIBLE neighbours. A blank one means "nothing on
+        // that side of my page" — the server treats that as a claim about the
+        // viewport, not about the positioning group, and looks the real boundary
+        // neighbour up itself (see PositionActions#resolve_position_boundaries).
+        prevId: after?.dataset.positionedRowId ?? "",
+        nextId: before?.dataset.positionedRowId ?? "",
+        toIndex: index
+      });
+    }
+    // `row` is the already-moved element and `restoreAnchor` the sibling it sat
+    // in front of beforehand, so every path that does not end in the server's own
+    // truth can undo the optimistic move rather than leave it standing.
+    async #submit(row, restoreAnchor, { prevId, nextId, toIndex }) {
+      const recordId = row.dataset.positionedRowId;
+      const url = this.urlTemplateValue.replace("__ID__", recordId) + window.location.search;
+      const csrfToken = document.querySelector('meta[name="csrf-token"]')?.content ?? "";
+      try {
+        const response = await fetch(url, {
+          method: "POST",
+          headers: {
+            "Accept": "text/vnd.turbo-stream.html",
+            "Content-Type": "application/x-www-form-urlencoded",
+            "X-CSRF-Token": csrfToken
+          },
+          body: new URLSearchParams({
+            prev_id: prevId,
+            next_id: nextId,
+            to_index: toIndex
+          }),
+          credentials: "same-origin"
+        });
+        if (response.status === 204) return;
+        const contentType = response.headers.get("Content-Type") || "";
+        if (contentType.includes("text/vnd.turbo-stream.html") && window.Turbo) {
+          const focusedRowId = this.#focusedRowId();
+          window.Turbo.renderStreamMessage(await response.text());
+          if (focusedRowId) this.#restoreFocus(focusedRowId);
+        } else if (!response.ok) {
+          console.error(`[positioned] reposition rejected (${response.status}); reverting the move`);
+          this.#revertMove(row, restoreAnchor);
+        } else {
+          console.warn("[positioned] reposition returned a non-stream response (session expired?); reverting the move");
+          this.#revertMove(row, restoreAnchor);
+        }
+      } catch (error2) {
+        console.error("[positioned] reposition request failed:", error2);
+        this.#revertMove(row, restoreAnchor);
+      }
+    }
+    // Undoes the optimistic move. Only meaningful while the row is still the node
+    // we moved: once a turbo-stream has replaced the collection the server's truth
+    // owns the DOM, and this instance's nodes are detached.
+    //
+    // A missing/relocated anchor falls back to appending, which is also what a
+    // null anchor legitimately means — the row was last before the move.
+    #revertMove(row, anchor) {
+      const parent = row.parentElement;
+      if (!parent || !row.isConnected) return;
+      const refocus = row.contains(document.activeElement);
+      parent.insertBefore(row, anchor?.parentNode === parent ? anchor : null);
+      if (refocus) row.querySelector("[data-positioned-grip]")?.focus();
+    }
+    // ─── helpers ────────────────────────────────────────────────────────────────
+    #rows() {
+      return [...this.element.querySelectorAll("[data-positioned-row-id]")];
+    }
+    #rowFor(element) {
+      return element.closest("[data-positioned-row-id]");
+    }
+    // Whether the row under the cursor shares the dragged row's positioning
+    // group. An UNSCOPED resource emits no group attribute at all, so both sides
+    // read undefined and every row matches — the guard costs nothing there.
+    //
+    // Pointing at no row (the gutter below the last one, the wrapper's padding)
+    // counts as a match: the drop resolves against the collection's own ends,
+    // which are in the dragged row's group by construction.
+    #sameGroupAs(target) {
+      const row = this.#rowFor(target);
+      if (!row) return true;
+      return row.dataset.positionedGroup === this.draggedRow.dataset.positionedGroup;
+    }
+    #focusedRowId() {
+      const grip = document.activeElement?.closest?.("[data-positioned-grip]");
+      return grip ? this.#rowFor(grip)?.dataset.positionedRowId : null;
+    }
+    // Deferred a frame: renderStreamMessage resolves its render asynchronously,
+    // so the replacement rows are not in the document yet when it returns.
+    //
+    // Queried off `document`, NOT `this.element`. The stream replaces the contents
+    // of the collection wrapper (Page::Index.collection_dom_id), and this
+    // controller's element — the div around the <table>, or the grid div — is one
+    // of the nodes it discards. By the time this callback runs `this.element` is
+    // detached, so scoping the lookup to it finds nothing and focus is silently
+    // lost on exactly the path this method exists to cover: a keyboard move that
+    // triggered a rebalance. A fresh controller is already connected to the
+    // replacement; `document` is the only handle that spans both.
+    #restoreFocus(rowId) {
+      requestAnimationFrame(() => {
+        document.querySelector(`[data-positioned-row-id="${CSS.escape(rowId)}"] [data-positioned-grip]`)?.focus();
+      });
+    }
+  };
+
   // src/js/controllers/currency_input_controller.js
   var currency_input_controller_default = class extends Controller {
     static targets = ["prefix", "field"];
@@ -29375,6 +29855,106 @@ this.ifd0Offset: ${this.ifd0Offset}, file.byteLength: ${e4.byteLength}`), e4.tif
     }
   };
 
+  // src/js/controllers/breadcrumbs_controller.js
+  var breadcrumbs_controller_default = class extends Controller {
+    static targets = ["list", "item", "last", "overflow", "menuItem"];
+    connect() {
+      this.menuItems = this.menuItemTargets;
+      this.observer = new ResizeObserver(() => this.reflow());
+      this.observer.observe(this.element);
+      this.reflow();
+      document.fonts?.ready.then(() => this.reflow());
+    }
+    disconnect() {
+      this.observer.disconnect();
+    }
+    reflow() {
+      if (!this.element.isConnected || !this.hasListTarget) return;
+      this.itemTargets.forEach((el) => this.#show(el));
+      if (this.hasOverflowTarget) this.#hide(this.overflowTarget);
+      if (this.hasLastTarget) this.lastTarget.classList.add("shrink-0");
+      if (this.#overflows()) {
+        if (this.hasOverflowTarget) {
+          this.#show(this.overflowTarget);
+          for (const item of this.itemTargets) {
+            if (!this.#overflows()) break;
+            this.#hide(item);
+          }
+        }
+        if (this.#overflows() && this.hasLastTarget) {
+          this.lastTarget.classList.remove("shrink-0");
+        }
+      }
+      this.#syncMenu();
+    }
+    // Measured on the nav rather than the <ol>, because the nav is the element
+    // that actually clips (`overflow-hidden`). A non-scrolling box reports
+    // overflow inconsistently once direction is rtl; the clipping box doesn't.
+    #overflows() {
+      return this.element.scrollWidth > this.element.clientWidth;
+    }
+    #show(el) {
+      el.classList.remove("hidden");
+      el.classList.add("flex");
+    }
+    #hide(el) {
+      el.classList.remove("flex");
+      el.classList.add("hidden");
+    }
+    // A menu row is shown exactly when its inline twin has been folded away.
+    #syncMenu() {
+      if (!this.hasOverflowTarget) return;
+      const folded = this.itemTargets.map((el) => el.classList.contains("hidden"));
+      this.menuItems.forEach((row, i4) => {
+        row.classList.toggle("hidden", !folded[i4]);
+      });
+      if (!folded.some(Boolean)) this.#closeOverflowMenu();
+    }
+    // The trail grew back far enough that the control is gone. Its menu may
+    // still be open — and teleported to <body>, so hiding the control does not
+    // hide the menu. Popper would go on positioning it against a display:none
+    // trigger, whose rect is all zeros, parking the menu in the viewport corner.
+    #closeOverflowMenu() {
+      const host = this.overflowTarget.querySelector('[data-controller~="resource-drop-down"]');
+      const dropdown = this.application.getControllerForElementAndIdentifier(host, "resource-drop-down");
+      if (dropdown?.visible) dropdown.hide();
+    }
+  };
+
+  // src/js/controllers/run_progress_controller.js
+  var run_progress_controller_default = class extends Controller {
+    static values = {
+      url: String,
+      interval: { type: Number, default: 2e3 },
+      // Set by the server on the LAST poll only — see AsyncRunProgress#poll_attributes.
+      finished: Boolean
+    };
+    connect() {
+      if (this.finishedValue) return this.reloadPage();
+      this.schedule();
+    }
+    disconnect() {
+      if (this.timer) clearTimeout(this.timer);
+      this.timer = null;
+    }
+    schedule() {
+      this.timer = setTimeout(() => this.refresh(), this.intervalValue);
+    }
+    reloadPage() {
+      window.Turbo?.visit(window.location.href, { action: "replace" });
+    }
+    refresh() {
+      const frame = this.element.closest("turbo-frame");
+      if (!frame) return;
+      this.schedule();
+      if (frame.src) {
+        frame.reload();
+      } else {
+        frame.src = this.urlValue;
+      }
+    }
+  };
+
   // src/js/controllers/register_controllers.js
   function register_controllers_default(application2) {
     application2.register("password-visibility", password_visibility_controller_default);
@@ -29415,7 +29995,10 @@ this.ifd0Offset: ${this.ifd0Offset}, file.byteLength: ${e4.byteLength}`), e4.tif
     application2.register("dirty-form-guard", dirty_form_guard_controller_default);
     application2.register("wizard", wizard_controller_default);
     application2.register("kanban", kanban_controller_default);
+    application2.register("positioned", positioned_controller_default);
     application2.register("currency-input", currency_input_controller_default);
+    application2.register("breadcrumbs", breadcrumbs_controller_default);
+    application2.register("run-progress", run_progress_controller_default);
   }
 
   // src/js/turbo/turbo_actions.js
@@ -29573,7 +30156,7 @@ cropperjs/dist/cropper.js:
    *)
 
 dompurify/dist/purify.es.mjs:
-  (*! @license DOMPurify 3.4.11 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.4.11/LICENSE *)
+  (*! @license DOMPurify 3.4.14 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.4.14/LICENSE *)
 
 @uppy/utils/lib/Translator.js:
   (**