@aicayzer/inkkit 0.1.5 → 0.1.6

package/dist/THIRD-PARTY-NOTICES.txt

@@ -480,7 +480,7 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ------------------------------------------------------------------------
 
-dompurify@3.4.16 ((MPL-2.0 OR Apache-2.0))
+dompurify@3.4.17 ((MPL-2.0 OR Apache-2.0))
 
 Apache License
                            Version 2.0, January 2004

package/dist/chunks/{core-D7n0IhAZ.js → core-nIObsA9D.js}

@@ -28391,8 +28391,8 @@ function editorLabels(ctx) {
 	return ctx.isInjected(labelsCtx.key) ? ctx.get(labelsCtx.key) : defaultLabels;
 }
 //#endregion
-//#region node_modules/.pnpm/dompurify@3.4.16/node_modules/dompurify/dist/purify.es.mjs
-/*! @license DOMPurify 3.4.16 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.4.16/LICENSE */
+//#region node_modules/.pnpm/dompurify@3.4.17/node_modules/dompurify/dist/purify.es.mjs
+/*! @license DOMPurify 3.4.17 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.4.17/LICENSE */
 function _OverloadYield(e, d) {
 	this.v = e, this.k = d;
 }
@@ -28516,9 +28516,12 @@ Array.prototype.indexOf;
 var arrayLastIndexOf = unapply(Array.prototype.lastIndexOf);
 var arrayPop = unapply(Array.prototype.pop);
 var arrayPush = unapply(Array.prototype.push);
-Array.prototype.slice;
+var arraySlice = unapply(Array.prototype.slice);
 var arraySplice = unapply(Array.prototype.splice);
 var arrayIsArray = Array.isArray;
+var setCreate = unconstruct(Set);
+var setAdd = unapply(Set.prototype.add);
+var setHas = unapply(Set.prototype.has);
 var stringToLowerCase = unapply(String.prototype.toLowerCase);
 var stringToString = unapply(String.prototype.toString);
 var stringMatch = unapply(String.prototype.match);
@@ -28663,6 +28666,25 @@ function lookupGetter(object, prop) {
 	}
 	return fallbackValue;
 }
+/**
+* Like lookupGetter, but for accessor properties only, and returns null
+* instead of a null-returning fallback when no getter exists on the chain.
+* Lets a caller fall back to a direct property read in environments that
+* lack the getter, where a fallback returning null would be indistinguishable
+* from a legitimate null value (e.g. namespaceURI of a no-namespace element).
+*
+* @param object - The object (usually a prototype) to start the lookup at.
+* @param prop - The accessor property name.
+* @returns The unapplied getter, or null if none was found.
+*/
+function lookupAccessor(object, prop) {
+	while (object !== null) {
+		const desc = getOwnPropertyDescriptor(object, prop);
+		if (desc) return desc.get ? unapply(desc.get) : null;
+		object = getPrototypeOf(object);
+	}
+	return null;
+}
 function isRegex(value) {
 	try {
 		regExpTest(value, "");
@@ -29347,7 +29369,7 @@ var NODE_TYPE = {
 	documentFragment: 11,
 	notation: 12
 };
-var LITERAL_TEXT_ELEMENT_NAMES = [
+var LITERAL_TEXT_ELEMENTS = freeze(addToSet({}, [
 	"style",
 	"script",
 	"xmp",
@@ -29356,15 +29378,7 @@ var LITERAL_TEXT_ELEMENT_NAMES = [
 	"noframes",
 	"plaintext",
 	"noscript"
-];
-var LITERAL_TEXT_ELEMENTS = freeze(addToSet({}, LITERAL_TEXT_ELEMENT_NAMES));
-var LITERAL_TEXT_CLOSE = function() {
-	const map = {};
-	arrayForEach(LITERAL_TEXT_ELEMENT_NAMES, (name) => {
-		map[name] = seal(new RegExp("</" + name + "(?=[\\t\\n\\f\\r />])", "i"));
-	});
-	return freeze(map);
-}();
+]));
 var getGlobal = function getGlobal() {
 	return typeof window === "undefined" ? null : window;
 };
@@ -29442,7 +29456,7 @@ var _resolveObjectOption = function _resolveObjectOption(cfg, key, makeFallback)
 function createDOMPurify() {
 	let window = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : getGlobal();
 	const DOMPurify = (root) => createDOMPurify(root);
-	DOMPurify.version = "3.4.16";
+	DOMPurify.version = "3.4.17";
 	DOMPurify.removed = [];
 	if (!window || !window.document || window.document.nodeType !== NODE_TYPE.document || !window.Element) {
 		DOMPurify.isSupported = false;
@@ -29474,6 +29488,10 @@ function createDOMPurify() {
 	const _readNodeName = function _readNodeName(node) {
 		return getNodeName ? getNodeName(node) : node.nodeName;
 	};
+	const getNamespaceURI = lookupAccessor(ElementPrototype, "namespaceURI");
+	const _readNamespaceURI = function _readNamespaceURI(element) {
+		return getNamespaceURI ? getNamespaceURI(element) : element.namespaceURI;
+	};
 	if (typeof HTMLTemplateElement === "function") {
 		const template = document.createElement("template");
 		if (template.content && template.content.ownerDocument) document = template.content.ownerDocument;
@@ -29594,6 +29612,7 @@ function createDOMPurify() {
 	const SANITIZE_NAMED_PROPS_PREFIX = "user-content-";
 	let KEEP_CONTENT = true;
 	let IN_PLACE = false;
+	let IN_PLACE_VISITED = null;
 	let USE_PROFILES = {};
 	let FORBID_CONTENTS = null;
 	const DEFAULT_FORBID_CONTENTS = addToSet({}, [
@@ -29867,18 +29886,23 @@ function createDOMPurify() {
 	*  return. Return true otherwise.
 	*/
 	const _checkValidNamespace = function _checkValidNamespace(element) {
-		let parent = getParentNode(element);
-		if (!parent || !parent.tagName) parent = {
-			namespaceURI: NAMESPACE,
-			tagName: "template"
-		};
-		const tagName = stringToLowerCase(element.tagName);
-		const parentTagName = stringToLowerCase(parent.tagName);
-		if (!ALLOWED_NAMESPACES[element.namespaceURI]) return false;
-		if (element.namespaceURI === SVG_NAMESPACE) return _checkSvgNamespace(tagName, parent, parentTagName);
-		if (element.namespaceURI === MATHML_NAMESPACE) return _checkMathMlNamespace(tagName, parent, parentTagName);
-		if (element.namespaceURI === HTML_NAMESPACE) return _checkHtmlNamespace(tagName, parent, parentTagName);
-		if (PARSER_MEDIA_TYPE === "application/xhtml+xml" && ALLOWED_NAMESPACES[element.namespaceURI]) return true;
+		const elementNamespace = _readNamespaceURI(element);
+		const tagName = stringToLowerCase(_readNodeName(element));
+		const parentNode = getParentNode(element);
+		let parent;
+		let parentTagName;
+		if (parentNode && _readNodeType(parentNode) === NODE_TYPE.element) {
+			parent = { namespaceURI: _readNamespaceURI(parentNode) };
+			parentTagName = stringToLowerCase(_readNodeName(parentNode));
+		} else {
+			parent = { namespaceURI: NAMESPACE };
+			parentTagName = "template";
+		}
+		if (!ALLOWED_NAMESPACES[elementNamespace]) return false;
+		if (elementNamespace === SVG_NAMESPACE) return _checkSvgNamespace(tagName, parent, parentTagName);
+		if (elementNamespace === MATHML_NAMESPACE) return _checkMathMlNamespace(tagName, parent, parentTagName);
+		if (elementNamespace === HTML_NAMESPACE) return _checkHtmlNamespace(tagName, parent, parentTagName);
+		if (PARSER_MEDIA_TYPE === "application/xhtml+xml" && ALLOWED_NAMESPACES[elementNamespace]) return true;
 		return false;
 	};
 	/**
@@ -29922,36 +29946,21 @@ function createDOMPurify() {
 		}
 	};
 	/**
-	* _neutralizeRoot
-	*
-	* Fail-closed teardown of an in-place root after the sanitize walk aborts
-	* (campaign-3 F2). An internal throw mid-walk — e.g. a page-registered
-	* custom element's reaction detaches a node so `_forceRemove`'s deliberate
-	* parentless guard throws, or any other re-entrant engine mutation — would
-	* otherwise leave the caller's *live* tree half-sanitized, with everything
-	* after the abort point still carrying its handlers. There is no safe way
-	* to resume the walk (the tree mutated under us), so we strip the root bare:
-	* remove every child and every attribute, then let the caller's catch see
-	* the original error. Clobber-safe (cached `remove`/`childNodes`/`attributes`
-	* getters; the root was already clobber-pre-flighted at the IN_PLACE entry).
+	* Fail-closed teardown of an in-place root: strip every disallowed attribute
+	* in the subtree first, so nothing armed is left behind, then remove all
+	* children and the root's own attributes.
 	*
 	* @param root the in-place root to empty
 	*/
 	const _neutralizeRoot = function _neutralizeRoot(root) {
 		_neutralizeSubtree(root);
 		const childNodes = getChildNodes(root);
-		if (childNodes) {
-			const snapshot = [];
-			arrayForEach(childNodes, (child) => {
-				arrayPush(snapshot, child);
-			});
-			arrayForEach(snapshot, (child) => {
-				try {
-					remove(child);
-				} catch (_) {}
-			});
-		}
-		const attributes = getAttributes(root);
+		if (childNodes) arrayForEach(arraySlice(childNodes), (child) => {
+			try {
+				remove(child);
+			} catch (_) {}
+		});
+		const attributes = _readNodeType(root) === NODE_TYPE.element ? getAttributes(root) : null;
 		if (attributes) for (let i = attributes.length - 1; i >= 0; --i) {
 			const attribute = attributes[i];
 			const name = attribute && attribute.name;
@@ -29959,18 +29968,9 @@ function createDOMPurify() {
 		}
 	};
 	/**
-	* _removeAttribute
-	*
-	* Name-based getAttributeNode()/removeAttribute() ASCII-lowercase their
-	* lookup key for HTML elements in an HTML document, so they silently miss an
-	* attribute whose stored qualified name still contains uppercase ASCII
-	* letters. That happens when the node came from a case-preserving source
-	* (an XML/XHTML document imported via importNode(), or createAttributeNS()),
-	* where e.g. `ONERROR` survives the walk: the policy check lowercases to
-	* `onerror` and rejects it, but `removeAttribute('ONERROR')` looks up
-	* `onerror` and finds nothing. Remove the exact Attr node instead, which is
-	* case- and namespace-exact, and fall back to name-based removal only when
-	* the caller could not supply the node.
+	* Removes an attribute, preferably as its exact Attr node: name-based
+	* removal lowercases the name in HTML documents and misses case-preserved
+	* names, e.g. from imported XHTML.
 	*
 	* @param name an Attribute name
 	* @param element a DOM node
@@ -30004,12 +30004,8 @@ function createDOMPurify() {
 		}
 	};
 	/**
-	* _stripDisallowedAttributes
-	*
-	* Removes every attribute the active configuration does not allow from a
-	* single element, using the same allowlist as the main attribute pass (so
-	* `on*` handlers go, but no `/^on/` blocklist is introduced). Used only to
-	* neutralise nodes that are being discarded from an in-place tree.
+	* Removes every attribute the configuration does not allow. Used to
+	* neutralize nodes discarded from an in-place tree.
 	*
 	* @param element the element to strip
 	*/
@@ -30024,77 +30020,158 @@ function createDOMPurify() {
 		}
 	};
 	/**
-	* _neutralizeSubtree
+	* Iterative depth-first walk, so deep trees cannot overflow the call stack,
+	* reading through the cached getters, so clobbering cannot hide children.
+	* When `visit` returns false, the node's children are skipped. With
+	* `intoShadow`, open shadow roots are walked after their host's children.
 	*
-	* Completes the audit-5 F1 fix across every removal path. The KEEP_CONTENT
-	* move-hoist neutralises only disallowed-tag removals; clobber, mXSS-canary,
-	* namespace, comment, processing-instruction and KEEP_CONTENT:false removals
-	* all drop their subtree wholesale via `_forceRemove`. On the IN_PLACE path
-	* those dropped nodes are detached from the caller's LIVE tree but a
-	* handler-bearing original among them (an `<img onerror>`/`<video>` that was
-	* loading) keeps its queued resource event, which fires in page scope after
-	* sanitize returns. This walks a removed subtree and strips every attribute
-	* the active configuration does not allow — so `on*` handlers are cancelled
-	* through the SAME allowlist that governs kept nodes, not a separate `/^on/`
-	* blocklist. Run synchronously before sanitize returns, i.e. before any
-	* queued event can fire. Hook-free by design: these nodes leave the output,
-	* so firing attribute hooks for them would be surprising. Clobber-safe reads;
-	* a doomed clobbered node may shadow `removeAttribute` (its own attributes are
-	* irrelevant — it is discarded — while its non-clobbered descendants, e.g.
-	* the `<img>`, are reached and scrubbed).
-	*
-	* @param root the root of a removed subtree to neutralise
+	* @param root where to start
+	* @param visit called for every node
+	* @param intoShadow whether to enter open shadow roots
 	*/
-	const _neutralizeSubtree = function _neutralizeSubtree(root) {
+	const _walkTree = function _walkTree(root, visit) {
+		let intoShadow = arguments.length > 2 && arguments[2] !== void 0 ? arguments[2] : false;
 		const stack = [root];
 		while (stack.length > 0) {
 			const node = stack.pop();
-			if (_readNodeType(node) === NODE_TYPE.element) _stripDisallowedAttributes(node);
+			if (visit(node) === false) continue;
+			if (intoShadow && _readNodeType(node) === NODE_TYPE.element) {
+				const shadowRoot = getShadowRoot(node);
+				if (_isDocumentFragment(shadowRoot)) stack.push(shadowRoot);
+			}
 			const childNodes = getChildNodes(node);
 			if (childNodes) for (let i = childNodes.length - 1; i >= 0; --i) stack.push(childNodes[i]);
 		}
 	};
 	/**
-	* _neutralizePatchLinkage
+	* Strips disallowed attributes from every element of a discarded subtree,
+	* so a handler that is already queued (a loading image) cannot fire.
 	*
-	* IN_PLACE entry pre-pass (declarative-partial-updates / streaming
-	* hardening, https://github.com/WICG/declarative-partial-updates).
+	* @param root the root of a removed subtree
+	*/
+	const _neutralizeSubtree = function _neutralizeSubtree(root) {
+		_walkTree(root, (node) => {
+			if (_readNodeType(node) === NODE_TYPE.element) _stripDisallowedAttributes(node);
+		});
+	};
+	/**
+	* All nodes under `root`, root first, including open shadow roots. Template
+	* content is not entered, it is inert.
 	*
-	* The main walk strips patch linkage (`for`/`patchsrc`) and removes range
-	* markers (PIs / markup comments) node-by-node, in document order, AS it
-	* reaches each node. On a live in-place root that leaves a window: from the
-	* moment the root is connected until the walk arrives at a given node, that
-	* node's linkage is live. A patch applied on connection/stream can fire as
-	* a microtask during the walk and inject or teleport an unsanitized DOM
-	* range into a region the iterator has already passed and will not revisit,
-	* so the post-return "tree is sanitized" contract is violated. Sweep the
-	* whole tree once up front and sever every linkage before the walk begins,
-	* closing that window.
+	* @param root the in-place root
+	* @return the nodes
+	*/
+	const _collectLiveNodes = function _collectLiveNodes(root) {
+		const nodes = [];
+		_walkTree(root, (node) => {
+			nodes.push(node);
+		}, true);
+		return nodes;
+	};
+	/**
+	* Strips disallowed attributes from every element that was under the
+	* in-place root when the call started and no longer is, whatever removed
+	* or moved it.
 	*
-	* This CANNOT undo a patch that already fired before sanitize ran — that is
-	* the irreducible "do not IN_PLACE a live-connected attacker tree" caveat —
-	* but it closes everything from sanitize-start onward. Gated on SAFE_FOR_XML
-	* to group with the rest of the declarative-partial-updates handling and
-	* stay overridable, consistent with the codebase.
+	* @param root the in-place root
+	* @param before the root's nodes, collected before the walk
+	*/
+	const _neutralizeEscapedElements = function _neutralizeEscapedElements(root, before) {
+		const reachable = setCreate();
+		arrayForEach(_collectLiveNodes(root), (node) => {
+			if (_readNodeType(node) === NODE_TYPE.element) setAdd(reachable, node);
+		});
+		arrayForEach(before, (node) => {
+			if (_readNodeType(node) === NODE_TYPE.element && !setHas(reachable, node)) _stripDisallowedAttributes(node);
+		});
+	};
+	/**
+	* Neutralizes everything that left the in-place tree during the call: what
+	* DOMPurify removed, and what hooks or custom elements removed or moved out.
 	*
-	* Clobber-safe traversal (cached childNodes getter); per-node try/catch so a
-	* clobbered root cannot defeat the sweep of its non-clobbered descendants.
+	* @param root the in-place root
+	* @param before the root's nodes, collected before the walk
+	* @return true if the root itself was removed
+	*/
+	const _neutralizeDiscarded = function _neutralizeDiscarded(root, before) {
+		let rootRemoved = false;
+		arrayForEach(DOMPurify.removed, (entry) => {
+			if (entry.element) {
+				rootRemoved = rootRemoved || entry.element === root;
+				_neutralizeSubtree(entry.element);
+			}
+		});
+		_neutralizeEscapedElements(root, before);
+		return rootRemoved;
+	};
+	const MAX_UNVISITED_ROUNDS = 8;
+	/**
+	* The walk only moves forward, so a node moved to a position it already
+	* passed is never visited. Give every original node that is still in the
+	* tree but unvisited the normal treatment, hooks included. Nodes created
+	* during the call are left alone. Fails closed if the tree keeps changing.
+	*
+	* @param root the in-place root
+	* @param before the root's nodes, collected before the walk
+	*/
+	const _sanitizeUnvisitedNodes = function _sanitizeUnvisitedNodes(root, before) {
+		const visited = IN_PLACE_VISITED;
+		let original = null;
+		const getOriginal = () => {
+			if (!original) {
+				original = setCreate();
+				arrayForEach(before, (beforeNode) => {
+					setAdd(original, beforeNode);
+				});
+			}
+			return original;
+		};
+		for (let round = 0;; round++) {
+			const live = _collectLiveNodes(root);
+			const containers = [root];
+			let pending = false;
+			arrayForEach(live, (node) => {
+				if (_readNodeType(node) === NODE_TYPE.documentFragment) arrayPush(containers, node);
+				else if (!pending && !setHas(visited, node)) pending = setHas(getOriginal(), node);
+			});
+			if (!pending) return;
+			if (round >= MAX_UNVISITED_ROUNDS) throw typeErrorCreate("the tree kept changing during in-place sanitization; refusing to return it");
+			arrayForEach(containers, (container, index) => {
+				_sanitizeUnvisitedIn(container, index > 0, root, getOriginal());
+			});
+		}
+	};
+	/**
+	* One _sanitizeUnvisitedNodes pass over the root or an open shadow root.
 	*
-	* NOTE (pending real-Chrome confirmation, see test/declarative-patch-probe
-	* .html Q1): this mirrors the existing policy of keeping `for` on
-	* <label>/<output>. If the shipping feature can drive a patch through a
-	* surviving `for`-on-label/output + `id` pair, this pre-pass and the
-	* attribute check at _isBasicCustomElement's caller must additionally drop
-	* that pair on the IN_PLACE path. Left as-is until the taxonomy is verified.
+	* @param container the root or an open shadow root
+	* @param inShadow whether container is a shadow root
+	* @param root the in-place root
+	* @param original the root's nodes collected before the walk, as a set
+	*/
+	const _sanitizeUnvisitedIn = function _sanitizeUnvisitedIn(container, inShadow, root, original) {
+		const iterator = _createNodeIterator(container);
+		let node;
+		while (node = iterator.nextNode()) {
+			if (!setHas(original, node) || setHas(IN_PLACE_VISITED, node)) continue;
+			if (inShadow) _executeHooks(hooks.uponSanitizeShadowNode, node, null);
+			_sanitizeElements(node, root);
+			_sanitizeAttributes(node, root);
+			if (_isDocumentFragment(node.content)) _sanitizeShadowDOM2(node.content);
+		}
+	};
+	/**
+	* Records that _sanitizeElements processed `node`. No-op outside IN_PLACE.
 	*
-	* @param root the in-place root to sweep
+	* @param node the node being processed
 	*/
+	const _markVisited = function _markVisited(node) {
+		if (IN_PLACE_VISITED) setAdd(IN_PLACE_VISITED, node);
+	};
 	/**
-	* Central policy for declarative-partial-updates patch-linkage attributes,
-	* shared by the _neutralizePatchLinkage pre-pass and _isValidAttribute so
-	* the two sites cannot drift: `patchsrc` always links, `for` links
-	* everywhere except on <label>/<output>, and the whole policy is gated on
-	* SAFE_FOR_XML (see the rationale block in _isValidAttribute).
+	* Patch-linkage attributes (declarative partial updates): `patchsrc`
+	* always, `for` everywhere except on <label> and <output>. Gated on
+	* SAFE_FOR_XML. Shared by the IN_PLACE pre-pass and _isValidAttribute.
 	*
 	* @param lcName the transformCaseFunc'd attribute name
 	* @param lcTag the transformCaseFunc'd tag name of the carrying element
@@ -30105,17 +30182,26 @@ function createDOMPurify() {
 		if (lcName === "patchsrc") return true;
 		return lcName === "for" && lcTag !== "label" && lcTag !== "output";
 	};
+	/**
+	* IN_PLACE pre-pass: sever all patch linkage before the walk, so no patch
+	* can fire mid-walk into a part of the tree the walker already passed.
+	* Removes range markers (processing instructions, comments with markup)
+	* and strips linkage attributes. It cannot undo a patch that already fired.
+	*
+	* TODO: if the shipped feature can patch through `for` on <label>/<output>,
+	* drop that pair here too (see test/declarative-patch-probe.html).
+	*
+	* @param root the in-place root to sweep
+	*/
 	const _neutralizePatchLinkage = function _neutralizePatchLinkage(root) {
 		if (!SAFE_FOR_XML) return;
-		const stack = [root];
-		while (stack.length > 0) {
-			const node = stack.pop();
+		_walkTree(root, (node) => {
 			const nodeType = _readNodeType(node);
 			if (nodeType === NODE_TYPE.processingInstruction || nodeType === NODE_TYPE.comment && regExpTest(COMMENT_MARKUP_PROBE, node.data)) {
 				try {
 					remove(node);
 				} catch (_) {}
-				continue;
+				return false;
 			}
 			if (nodeType === NODE_TYPE.element) {
 				const element = node;
@@ -30125,9 +30211,8 @@ function createDOMPurify() {
 					if (element.hasAttribute && element.hasAttribute("for") && _isPatchLinkageAttribute("for", lcTag)) element.removeAttribute("for");
 				} catch (_) {}
 			}
-			const childNodes = getChildNodes(node);
-			if (childNodes) for (let i = childNodes.length - 1; i >= 0; --i) stack.push(childNodes[i]);
-		}
+			return true;
+		});
 	};
 	/**
 	* _initDocument
@@ -30204,6 +30289,27 @@ function createDOMPurify() {
 	*/
 	const _scrubTemplateExpressions2 = function _scrubTemplateExpressions(node) {
 		var _node$querySelectorAl;
+		_scrubOwnCharacterData(node);
+		const templates = (_node$querySelectorAl = node.querySelectorAll) === null || _node$querySelectorAl === void 0 ? void 0 : _node$querySelectorAl.call(node, "template");
+		if (templates) arrayForEach(templates, (tmpl) => {
+			if (_isDocumentFragment(tmpl.content)) _scrubTemplateExpressions2(tmpl.content);
+		});
+	};
+	/**
+	* _scrubOwnCharacterData
+	*
+	* Non-recursive core of _scrubTemplateExpressions: normalize `node` and
+	* strip template expressions from its own character data only. Does not
+	* enter <template>.content or attached shadow roots (NodeIterator never
+	* does). Used by _sanitizeShadowDOM, where every nested template content
+	* and shadow root is already walked - and therefore scrubbed - by its own
+	* recursive _sanitizeShadowDOM call; recursing here as well would rescrub
+	* each nested fragment once per ancestor, which is quadratic in nesting
+	* depth.
+	*
+	* @param node The root whose own character data should be scrubbed.
+	*/
+	const _scrubOwnCharacterData = function _scrubOwnCharacterData(node) {
 		node.normalize();
 		const doc = getOwnerDocument ? getOwnerDocument(node) : node.ownerDocument;
 		const walker = createNodeIterator.call(doc || node, node, NodeFilter.SHOW_TEXT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_CDATA_SECTION | NodeFilter.SHOW_PROCESSING_INSTRUCTION, null);
@@ -30212,10 +30318,6 @@ function createDOMPurify() {
 			currentNode.data = _stripTemplateExpressions(currentNode.data);
 			currentNode = walker.nextNode();
 		}
-		const templates = (_node$querySelectorAl = node.querySelectorAll) === null || _node$querySelectorAl === void 0 ? void 0 : _node$querySelectorAl.call(node, "template");
-		if (templates) arrayForEach(templates, (tmpl) => {
-			if (_isDocumentFragment(tmpl.content)) _scrubTemplateExpressions2(tmpl.content);
-		});
 	};
 	/**
 	* _isClobbered
@@ -30291,7 +30393,7 @@ function createDOMPurify() {
 	*/
 	const _isUnsafeNode = function _isUnsafeNode(currentNode, tagName) {
 		if (SAFE_FOR_XML && currentNode.hasChildNodes() && !_isNode(currentNode.firstElementChild) && regExpTest(ELEMENT_MARKUP_PROBE, currentNode.textContent) && regExpTest(ELEMENT_MARKUP_PROBE, currentNode.innerHTML)) return true;
-		if (SAFE_FOR_XML && currentNode.namespaceURI === HTML_NAMESPACE && LITERAL_TEXT_ELEMENTS[tagName] && (_isNode(currentNode.firstElementChild) || typeof currentNode.textContent === "string" && regExpTest(LITERAL_TEXT_CLOSE[tagName], currentNode.textContent))) return true;
+		if (SAFE_FOR_XML && LITERAL_TEXT_ELEMENTS[tagName] && _readNodeType(currentNode) === NODE_TYPE.element && _readNamespaceURI(currentNode) === HTML_NAMESPACE && (_isNode(currentNode.firstElementChild) || typeof currentNode.textContent === "string" && regExpTest(ELEMENT_MARKUP_PROBE, currentNode.textContent))) return true;
 		if (currentNode.nodeType === NODE_TYPE.processingInstruction) return true;
 		if (SAFE_FOR_XML && currentNode.nodeType === NODE_TYPE.comment && regExpTest(COMMENT_MARKUP_PROBE, currentNode.data)) return true;
 		return false;
@@ -30335,7 +30437,7 @@ function createDOMPurify() {
 	*/
 	const _sanitizeDisallowedNode = function _sanitizeDisallowedNode(currentNode, tagName, root) {
 		if (!FORBID_TAGS[tagName] && _isBasicCustomElement(tagName) && _matchesNameCheck(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)) return false;
-		if (KEEP_CONTENT && !FORBID_CONTENTS[tagName]) {
+		if (KEEP_CONTENT && !FORBID_CONTENTS[tagName] && !FORBID_CONTENTS[stringToLowerCase(tagName)]) {
 			const parentNode = getParentNode(currentNode);
 			const childNodes = getChildNodes(currentNode);
 			if (childNodes && parentNode) {
@@ -30368,35 +30470,13 @@ function createDOMPurify() {
 		return set === defaultSet || set === setConfigSet ? clone(set) : set;
 	};
 	/**
-	* Shared guard for a node that a hook has detached from the walk tree,
-	* used after each element-hook site in _sanitizeElements. Detaching is a
-	* long-standing user pattern (issue #469; draw.io-style foreignObject
-	* filtering). Per the cached, unclobberable parentNode getter the node is
-	* genuinely out of the tree, so it can reach neither the serialized
-	* output nor an IN_PLACE live tree; treat it as removed and stop
-	* processing it. Without this guard, the unsafe-node / namespace checks
-	* would call _forceRemove on a parentless node and hit the REPORT-3
-	* fail-closed throw — which exists for nodes DOMPurify wants gone but
-	* *cannot* detach (clobbered / parentless roots), the opposite of a node
-	* that is already safely gone. The walk root is exempt: a detached
-	* IN_PLACE root is legitimate input and must still be fully sanitized,
-	* and a kill-decision on it must keep hitting the REPORT-3 throw.
-	*
-	* Nodes detached by hooks stay the hook's responsibility for placement:
-	* they are not recorded in DOMPurify.removed, so the post-walk IN_PLACE
-	* pass (which iterates DOMPurify.removed) does not reach them. But a
-	* hook-detached subtree can still hold a queued resource-event handler -
-	* e.g. an <img onload> that began loading when the caller built the live
-	* tree - which fires in page scope after sanitize returns even though the
-	* handler never reached the returned tree. That is the audit-5 F1 hazard,
-	* and the documented node.remove() hook pattern walks straight into it.
-	* So on the IN_PLACE path we neutralize the detached subtree inline,
-	* stripping its non-allow-listed attributes before returning, exactly as
-	* the post-walk pass does for _forceRemove'd subtrees.
+	* A hook may have detached the node it was called for. If so, treat it as
+	* removed and stop processing it; the walk root is exempt. On the IN_PLACE
+	* path the detached subtree is neutralized right away.
 	*
 	* @param currentNode the node a hook may have detached
 	* @param root the current walk root
-	* @return true if the node is detached and now handled, false otherwise
+	* @return true if the node was detached
 	*/
 	const _handleHookDetachedNode = function _handleHookDetachedNode(currentNode, root) {
 		if (currentNode === root || getParentNode(currentNode) !== null) return false;
@@ -30413,6 +30493,7 @@ function createDOMPurify() {
 	* @return true if node was killed, false if left alive
 	*/
 	const _sanitizeElements = function _sanitizeElements(currentNode, root) {
+		_markVisited(currentNode);
 		_executeHooks(hooks.beforeSanitizeElements, currentNode, null);
 		if (_handleHookDetachedNode(currentNode, root)) return true;
 		if (_isClobbered(currentNode)) {
@@ -30556,6 +30637,22 @@ function createDOMPurify() {
 		}
 	};
 	/**
+	* _isUnsafeAttributeValue
+	*
+	* Value-based attribute checks that the attribute walk applies before any
+	* hook can force-keep an attribute, shared with the public
+	* isValidAttribute() so that it never approves a value sanitize() would
+	* strip.
+	*
+	* @param name the attribute name as found on the node (case preserved)
+	* @param value the attribute value
+	* @returns true if the attribute must be removed because of its value
+	*/
+	const _isUnsafeAttributeValue = function _isUnsafeAttributeValue(name, value) {
+		if (SAFE_FOR_XML && regExpTest(/((--!?|])>)|<\/(style|script|title|xmp|textarea|noscript|iframe|noembed|noframes)/i, value)) return true;
+		return stringToLowerCase(name) === "attributename" && stringMatch(value, "href") !== null;
+	};
+	/**
 	* _sanitizeAttributes
 	*
 	* @protect attributes
@@ -30599,11 +30696,7 @@ function createDOMPurify() {
 				value = SANITIZE_NAMED_PROPS_PREFIX + value;
 				recreatedNamedProp = true;
 			}
-			if (SAFE_FOR_XML && regExpTest(/((--!?|])>)|<\/(style|script|title|xmp|textarea|noscript|iframe|noembed|noframes)/i, value)) {
-				_removeAttribute(name, currentNode, attr);
-				continue;
-			}
-			if (lcName === "attributename" && stringMatch(value, "href")) {
+			if (_isUnsafeAttributeValue(name, value)) {
 				_removeAttribute(name, currentNode, attr);
 				continue;
 			}
@@ -30651,24 +30744,13 @@ function createDOMPurify() {
 				}
 			}
 		}
+		if (SAFE_FOR_TEMPLATES) _scrubOwnCharacterData(fragment);
 		_executeHooks(hooks.afterSanitizeShadowDOM, fragment, null);
 	};
 	/**
-	* _sanitizeAttachedShadowRoots
-	*
-	* Walks `root` and feeds every attached shadow root we encounter into
-	* the existing _sanitizeShadowDOM pipeline. The default node iterator
-	* does not descend into shadow trees, so nodes inside an attached
-	* shadow root would otherwise be skipped entirely.
-	*
-	* Two real input paths put attached shadow roots in front of us:
-	*   1. IN_PLACE on a DOM node that already has shadow roots attached.
-	*   2. DOM-node input where importNode(dirty, true) deep-clones the
-	*      shadow root because it was created with `clonable: true`.
-	*
-	* This pass runs once, up front, so the main iteration loop (and the
-	* existing _sanitizeShadowDOM template-content recursion) stay
-	* untouched — string-input paths are not affected.
+	* Sanitizes every attached shadow root under `root`, since the node
+	* iterator does not enter shadow trees. Needed for IN_PLACE input and for
+	* DOM input whose clonable shadow roots were copied by importNode().
 	*
 	* @param root the subtree root to walk for attached shadow roots
 	*/
@@ -30733,6 +30815,8 @@ function createDOMPurify() {
 		if (hooks.uponSanitizeAttribute.length > 0) ALLOWED_ATTR = clone(ALLOWED_ATTR);
 		DOMPurify.removed = [];
 		const inPlace = IN_PLACE && typeof dirty !== "string" && _isNode(dirty);
+		let inPlaceNodes = [];
+		const outerVisited = IN_PLACE_VISITED;
 		if (inPlace) {
 			_neutralizePatchLinkage(dirty);
 			const nn = _readNodeName(dirty);
@@ -30747,12 +30831,8 @@ function createDOMPurify() {
 				_neutralizeRoot(dirty);
 				throw typeErrorCreate("root node is clobbered and cannot be sanitized in-place");
 			}
-			try {
-				_sanitizeAttachedShadowRoots(dirty);
-			} catch (error) {
-				_neutralizeRoot(dirty);
-				throw error;
-			}
+			inPlaceNodes = _collectLiveNodes(dirty);
+			IN_PLACE_VISITED = setCreate();
 		} else if (_isNode(dirty)) {
 			body = _initDocument("<!---->");
 			importedNode = body.ownerDocument.importNode(dirty, true);
@@ -30768,30 +30848,25 @@ function createDOMPurify() {
 		if (body && FORCE_BODY) _forceRemove(body.firstChild);
 		const walkRoot = inPlace ? dirty : body;
 		try {
+			if (inPlace) _sanitizeAttachedShadowRoots(dirty);
 			const nodeIterator = _createNodeIterator(walkRoot);
 			while (currentNode = nodeIterator.nextNode()) {
 				_sanitizeElements(currentNode, walkRoot);
 				_sanitizeAttributes(currentNode, walkRoot);
 				if (_isDocumentFragment(currentNode.content)) _sanitizeShadowDOM2(currentNode.content);
 			}
+			if (inPlace) _sanitizeUnvisitedNodes(dirty, inPlaceNodes);
 		} catch (error) {
 			if (inPlace) {
 				_neutralizeRoot(dirty);
-				arrayForEach(DOMPurify.removed, (entry) => {
-					if (entry.element) _neutralizeSubtree(entry.element);
-				});
+				_neutralizeDiscarded(dirty, inPlaceNodes);
 			}
 			throw error;
+		} finally {
+			IN_PLACE_VISITED = outerVisited;
 		}
 		if (inPlace) {
-			let rootWasRemoved = false;
-			arrayForEach(DOMPurify.removed, (entry) => {
-				if (entry.element) {
-					if (entry.element === dirty) rootWasRemoved = true;
-					_neutralizeSubtree(entry.element);
-				}
-			});
-			if (rootWasRemoved) throw typeErrorCreate("a node selected for removal could not be safely returned; refusing to sanitize in place");
+			if (_neutralizeDiscarded(dirty, inPlaceNodes)) throw typeErrorCreate("a node selected for removal could not be safely returned; refusing to sanitize in place");
 			if (SAFE_FOR_TEMPLATES) _scrubTemplateExpressions2(dirty);
 			return dirty;
 		}
@@ -30828,6 +30903,7 @@ function createDOMPurify() {
 		if (!CONFIG) _parseConfig({});
 		const lcTag = transformCaseFunc(tag);
 		const lcName = transformCaseFunc(attr);
+		if (typeof value === "string" && (_isUnsafeAttributeValue(attr, value) || !ALLOW_SELF_CLOSE_IN_ATTR && regExpTest(SELF_CLOSING_TAG, value))) return false;
 		return _isValidAttribute(lcTag, lcName, value);
 	};
 	DOMPurify.addHook = function(entryPoint, hookFunction) {
@@ -57189,7 +57265,7 @@ var InkKitEditor = class InkKitEditor {
 					return true;
 				}
 			}));
-		}).use(labelsCtx).use(instance.pasteController.plugin).use(visibleClipboard).use($prose(() => instance.suggestions.plugin())).use(instance.keymapPlugin).use(createDialect(Boolean(options.images || options.files), Boolean(options.wikiLinks), Boolean(options.files))).use(codeControlCtx).use(codeControlsPlugin(() => instance.viewport().rect)).use(tablePlugins).use(tableBlock).use(instance.changePlugin).use(instance.historyInputPlugin).use(history).use(clipboard).use(cursor).use(taskListPlugin).use(quoteBackspace).use(calloutEnter).use(literalEnter).use(literalReread).use(listItemBackspace).use(listItemShiftTab).use(nestedItemEnter).use(rejoinLists).use(movedListItems).use(textInputPolicy).use(events.copy ? codeCopyPlugin((text) => events.copy?.(text)) : []).use(placeholderPlugin).use(options.rendering?.codeHighlighting === false ? [] : (await import("./highlight-BIasnL-b.js")).highlightPlugin).use(options.rendering?.diagramPreview === false || !diagramsAvailable() ? [] : mermaidPreview((error) => instance.report(error))).use(selectionPlugin).use($prose(() => search())).use(instance.policyPlugin).use(options.wikiLinks ? wikiLinkView(options.wikiLinks, {
+		}).use(labelsCtx).use(instance.pasteController.plugin).use(visibleClipboard).use($prose(() => instance.suggestions.plugin())).use(instance.keymapPlugin).use(createDialect(Boolean(options.images || options.files), Boolean(options.wikiLinks), Boolean(options.files))).use(codeControlCtx).use(codeControlsPlugin(() => instance.viewport().rect)).use(tablePlugins).use(tableBlock).use(instance.changePlugin).use(instance.historyInputPlugin).use(history).use(clipboard).use(cursor).use(taskListPlugin).use(quoteBackspace).use(calloutEnter).use(literalEnter).use(literalReread).use(listItemBackspace).use(listItemShiftTab).use(nestedItemEnter).use(rejoinLists).use(movedListItems).use(textInputPolicy).use(events.copy ? codeCopyPlugin((text) => events.copy?.(text)) : []).use(placeholderPlugin).use(options.rendering?.codeHighlighting === false ? [] : (await import("./highlight-CeNqcHAb.js")).highlightPlugin).use(options.rendering?.diagramPreview === false || !diagramsAvailable() ? [] : mermaidPreview((error) => instance.report(error))).use(selectionPlugin).use($prose(() => search())).use(instance.policyPlugin).use(options.wikiLinks ? wikiLinkView(options.wikiLinks, {
 			capture: () => instance.adapterCapture(),
 			active: () => instance.ready && !instance.destroyed && !instance.literalSurface,
 			labels: {

package/dist/chunks/{highlight-BIasnL-b.js → highlight-CeNqcHAb.js}

@@ -1,4 +1,4 @@
-import { a as Decoration, c as PluginKey, d as __toESM, i as $prose, o as DecorationSet, s as Plugin, u as __commonJSMin } from "./core-D7n0IhAZ.js";
+import { a as Decoration, c as PluginKey, d as __toESM, i as $prose, o as DecorationSet, s as Plugin, u as __commonJSMin } from "./core-nIObsA9D.js";
 //#region node_modules/.pnpm/highlight.js@11.11.2/node_modules/highlight.js/es/languages/arduino.js
 /** @type LanguageFn */
 function cPlusPlus(hljs) {

package/dist/core.js

@@ -1,2 +1,2 @@
-import { r as InkKitError, t as InkKitEditor } from "./chunks/core-D7n0IhAZ.js";
+import { r as InkKitError, t as InkKitEditor } from "./chunks/core-nIObsA9D.js";
 export { InkKitEditor, InkKitError };

package/dist/index.js

@@ -1,4 +1,4 @@
-import { n as registerMermaid, r as InkKitError, t as InkKitEditor } from "./chunks/core-D7n0IhAZ.js";
+import { n as registerMermaid, r as InkKitError, t as InkKitEditor } from "./chunks/core-nIObsA9D.js";
 //#region src/index.ts
 registerMermaid(async () => (await import("mermaid")).default);
 //#endregion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aicayzer/inkkit",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "A preserving Markdown editor for offline web views and the web",
   "license": "MIT",
   "type": "module",
@@ -64,7 +64,7 @@
     "@types/mdast": "^4.0.4",
     "@types/node": "^26.6.2",
     "axe-core": "^4.14.0",
-    "dompurify": "3.4.16",
+    "dompurify": "3.4.17",
     "jsdom": "^30.1.0",
     "lowlight": "^3.3.0",
     "mdast-util-from-markdown": "^2.1.0",