@diagrammo/dgmo 0.86.0 → 0.87.0

package/dist/{chunk-FWNJDD4U.js → chunk-S7W75MIM.js}

@@ -1,26 +1,10 @@
+import {
+  safeHref
+} from "./chunk-Z6DXWULM.js";
 import {
   MONO_FAMILY
 } from "./chunk-ICLB27PZ.js";
 
-// src/utils/safe-href.ts
-var ALLOWED_SCHEMES = ["http", "https", "mailto"];
-var SCHEME_RE = /^([a-z][a-z0-9+.-]*):/i;
-var LEADING_TRIM_RE = /^[\x00-\x20]+/;
-function safeHref(url) {
-  if (typeof url !== "string") return null;
-  const trimmed = url.replace(LEADING_TRIM_RE, "");
-  if (trimmed.length === 0) return null;
-  const match = SCHEME_RE.exec(trimmed);
-  if (!match) {
-    return url;
-  }
-  const scheme = match[1].toLowerCase();
-  if (ALLOWED_SCHEMES.includes(scheme)) {
-    return url;
-  }
-  return null;
-}
-
 // src/utils/inline-markdown.ts
 function parseInlineMarkdown(text) {
   const spans = [];
@@ -88,7 +72,6 @@ function renderInlineText(textEl, text, palette, fontSize) {
 }
 
 export {
-  safeHref,
   parseInlineMarkdown,
   truncateBareUrl,
   stripInlineMarkdown,

package/dist/{chunk-C6FZZFYD.js → chunk-WZ23JJ7U.js}

@@ -11,7 +11,7 @@ import {
 } from "./chunk-XBJJP2HN.js";
 import {
   renderInlineText
-} from "./chunk-FWNJDD4U.js";
+} from "./chunk-S7W75MIM.js";
 import {
   ARROWHEAD_HEIGHT,
   ARROWHEAD_WIDTH,

package/dist/{chunk-LIYWJ6DV.js → chunk-XIFK423U.js}

@@ -3,10 +3,10 @@ import {
   NODE_HEIGHT,
   NODE_WIDTH,
   placeEdgeLabels
-} from "./chunk-TW6WMZFW.js";
+} from "./chunk-QT3KDDXK.js";
 import {
   buildPlacedNotes
-} from "./chunk-HBCAY3KR.js";
+} from "./chunk-HTNLLT34.js";
 import {
   noteCanvasShift
 } from "./chunk-6EK55ART.js";
@@ -22,6 +22,9 @@ import {
 var MARGIN = 40;
 var MAX_PARALLEL_EDGES = 5;
 var PARALLEL_SPACING = 22;
+var DETOUR_TOLERANCE = 2 * PARALLEL_SPACING;
+var MIN_PORT_GAP = 16;
+var PORT_CORNER_CLEAR = 6;
 var DESC_NODE_WIDTH = 140;
 var DESC_FONT_SIZE = 10;
 var DESC_LINE_HEIGHT = 1.4;
@@ -104,7 +107,7 @@ function computeNodeSize(node, reserveValueRow) {
   return { width: w, height: Math.max(NODE_HEIGHT, totalHeight) };
 }
 async function layoutBoxesAndLines(parsed, collapseInfo, layoutOptions) {
-  const { layoutBoxesAndLinesSearch } = await import("./layout-search-AW5VBDCV.js");
+  const { layoutBoxesAndLinesSearch } = await import("./layout-search-VKSBUCDM.js");
   const searchOpts = {
     ...layoutOptions?.hideDescriptions !== void 0 && {
       hideDescriptions: layoutOptions.hideDescriptions
@@ -117,13 +120,6 @@ async function layoutBoxesAndLines(parsed, collapseInfo, layoutOptions) {
     },
     ...layoutOptions?.onProgress !== void 0 && {
       onProgress: layoutOptions.onProgress
-    },
-    // Spread into the label-reserving relayout below too, via `...searchOpts`:
-    // that second search has its OWN clock, so a caller that disabled the
-    // deadline must have it disabled for both passes or the fixture that needs
-    // two passes is exactly the one still racing.
-    ...layoutOptions?.budgetMs !== void 0 && {
-      budgetMs: layoutOptions.budgetMs
     }
   };
   let topConfigs;
@@ -134,7 +130,7 @@ async function layoutBoxesAndLines(parsed, collapseInfo, layoutOptions) {
     }
   });
   const labelOpts = { groups: parsed.groups };
-  let chosen = applyParallelEdgeOffsets(searched);
+  let chosen = applyParallelEdgeOffsets(spreadCrowdedPorts(searched));
   let placed = placeEdgeLabels(chosen, labelOpts);
   if (placed.unresolved.length > 0) {
     const relaid = await layoutBoxesAndLinesSearch(parsed, collapseInfo, {
@@ -145,7 +141,7 @@ async function layoutBoxesAndLines(parsed, collapseInfo, layoutOptions) {
       // first search surfaced no dagre candidates.
       ...topConfigs !== void 0 && topConfigs.length > 0 && { configs: topConfigs }
     });
-    const relaidChosen = applyParallelEdgeOffsets(relaid);
+    const relaidChosen = applyParallelEdgeOffsets(spreadCrowdedPorts(relaid));
     const relaidPlaced = placeEdgeLabels(relaidChosen, labelOpts);
     if (relaidPlaced.unresolved.length < placed.unresolved.length) {
       placed = relaidPlaced;
@@ -242,6 +238,102 @@ function attachNotes(layout, parsed, collapsedNotes) {
     height: bbMaxY + shiftY + MARGIN
   };
 }
+function spreadCrowdedPorts(layout) {
+  const boxes = /* @__PURE__ */ new Map();
+  for (const n of layout.nodes)
+    boxes.set(n.label, { x: n.x, y: n.y, w: n.width, h: n.height });
+  for (const g of layout.groups)
+    if (g.collapsed)
+      boxes.set("__group_" + g.label, {
+        x: g.x,
+        y: g.y,
+        w: g.width,
+        h: g.height
+      });
+  const faces = /* @__PURE__ */ new Map();
+  const onSide = (box, p) => {
+    const E = 1;
+    const l = box.x - box.w / 2;
+    const r = box.x + box.w / 2;
+    const t = box.y - box.h / 2;
+    const b = box.y + box.h / 2;
+    if (p.x < l - E || p.x > r + E || p.y < t - E || p.y > b + E) return null;
+    if (Math.abs(p.y - t) <= E) return "top";
+    if (Math.abs(p.y - b) <= E) return "bottom";
+    if (Math.abs(p.x - l) <= E) return "left";
+    if (Math.abs(p.x - r) <= E) return "right";
+    return null;
+  };
+  layout.edges.forEach((e, i) => {
+    if (e.source === e.target || e.points.length < 2) return;
+    for (const last of [false, true]) {
+      const id = last ? e.target : e.source;
+      const box = boxes.get(id);
+      const p = last ? e.points[e.points.length - 1] : e.points[0];
+      if (!box) continue;
+      const side = onSide(box, p);
+      if (!side) continue;
+      const horiz = side === "top" || side === "bottom";
+      const key = `${id}\0${side}`;
+      let f = faces.get(key);
+      if (!f) faces.set(key, f = { box, horiz, ends: [] });
+      f.ends.push({ edge: i, last, along: horiz ? p.x : p.y });
+    }
+  });
+  const moved = /* @__PURE__ */ new Map();
+  for (const { box, horiz, ends } of faces.values()) {
+    if (ends.length < 2) continue;
+    ends.sort((a, b) => a.along - b.along || a.edge - b.edge);
+    let crowded = false;
+    for (let k = 1; k < ends.length; k++)
+      if (ends[k].along - ends[k - 1].along < MIN_PORT_GAP) crowded = true;
+    if (!crowded) continue;
+    const half = (horiz ? box.w : box.h) / 2 - PORT_CORNER_CLEAR;
+    const ctr = horiz ? box.x : box.y;
+    if (half <= 0) continue;
+    const gap = Math.min(MIN_PORT_GAP, 2 * half / (ends.length - 1));
+    const mean = ends.reduce((acc, e) => acc + e.along, 0) / ends.length;
+    const span = gap * (ends.length - 1);
+    const first = Math.max(
+      ctr - half,
+      Math.min(ctr + half - span, mean - span / 2)
+    );
+    ends.forEach((e, k) => {
+      moved.set(`${e.edge}:${e.last}`, { along: first + k * gap, horiz });
+    });
+  }
+  if (moved.size === 0) return layout;
+  return {
+    ...layout,
+    edges: layout.edges.map((e, i) => {
+      const a = moved.get(`${i}:false`);
+      const b = moved.get(`${i}:true`);
+      if (a === void 0 && b === void 0) return e;
+      const pts = e.points.map((p) => ({ x: p.x, y: p.y }));
+      const shift = (idx, to) => {
+        if (to.horiz) pts[idx].x = to.along;
+        else pts[idx].y = to.along;
+      };
+      if (a !== void 0) shift(0, a);
+      if (b !== void 0) shift(pts.length - 1, b);
+      return { ...e, points: pts };
+    })
+  };
+}
+function routeDetour(points) {
+  const s = points[0];
+  const t = points[points.length - 1];
+  if (!s || !t) return 0;
+  const dx = t.x - s.x;
+  const dy = t.y - s.y;
+  const len = Math.hypot(dx, dy);
+  let worst = 0;
+  for (const p of points) {
+    const d = len < 1e-6 ? Math.hypot(p.x - s.x, p.y - s.y) : Math.abs((p.x - s.x) * dy - (p.y - s.y) * dx) / len;
+    if (d > worst) worst = d;
+  }
+  return worst;
+}
 function applyParallelEdgeOffsets(layout) {
   const groups = /* @__PURE__ */ new Map();
   layout.edges.forEach((e, i) => {
@@ -262,8 +354,11 @@ function applyParallelEdgeOffsets(layout) {
     layout.edges.length
   ).fill(void 0);
   for (const [key, idxs] of groups) {
-    const capped = idxs.slice(0, MAX_PARALLEL_EDGES);
+    const kept = idxs.slice(0, MAX_PARALLEL_EDGES);
     for (const drop of idxs.slice(MAX_PARALLEL_EDGES)) count[drop] = 0;
+    const capped = kept.filter(
+      (idx) => routeDetour(layout.edges[idx].points) <= DETOUR_TOLERANCE
+    );
     if (capped.length < 2) continue;
     const sep = key.indexOf("\0");
     const ca = centre.get(key.slice(0, sep));

package/dist/{chunk-4ELXLATB.js → chunk-XUDGZJTJ.js}

@@ -3,14 +3,14 @@ import {
 } from "./chunk-26EVL454.js";
 import {
   layoutGraph
-} from "./chunk-PBEH52A2.js";
+} from "./chunk-ZNNVI5SR.js";
 import {
   NOTE_BADGE_RADIUS,
   noteConnectorPoints,
   renderNoteBadge,
   renderNoteBox,
   renderNoteConnector
-} from "./chunk-5JO443MB.js";
+} from "./chunk-HAH5X345.js";
 import {
   appendArrowheadMarkers
 } from "./chunk-XBJJP2HN.js";

package/dist/{chunk-H6AFNCN3.js → chunk-XVSJYAK7.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-LNO3ASX5.js";
 import {
   parseInlineMarkdown
-} from "./chunk-FWNJDD4U.js";
+} from "./chunk-S7W75MIM.js";
 import {
   TITLE_FONT_WEIGHT
 } from "./chunk-VLC6WNRD.js";

package/dist/{chunk-LHBMQJC3.js → chunk-XWYR5T52.js}

@@ -1,13 +1,13 @@
 import {
   layoutClassDiagram
-} from "./chunk-BP4BT5TH.js";
+} from "./chunk-CLQIXD2C.js";
 import {
   NOTE_BADGE_RADIUS,
   noteConnectorPoints,
   renderNoteBadge,
   renderNoteBox,
   renderNoteConnector
-} from "./chunk-5JO443MB.js";
+} from "./chunk-HAH5X345.js";
 import {
   ScaleContext
 } from "./chunk-24YPR5EH.js";

package/dist/{chunk-QNKHJ5CK.js → chunk-YK4N6TBN.js}

@@ -1,7 +1,9 @@
 import {
-  parseInlineMarkdown,
+  parseInlineMarkdown
+} from "./chunk-S7W75MIM.js";
+import {
   safeHref
-} from "./chunk-FWNJDD4U.js";
+} from "./chunk-Z6DXWULM.js";
 import {
   ScaleContext
 } from "./chunk-24YPR5EH.js";

package/dist/{chunk-XFMQSFS4.js → chunk-YMG7JDEY.js}

@@ -1,9 +1,9 @@
 import {
   wrapDescriptionLines
-} from "./chunk-WMIKC5XO.js";
+} from "./chunk-NPWVOFB3.js";
 import {
   renderInlineText
-} from "./chunk-FWNJDD4U.js";
+} from "./chunk-S7W75MIM.js";
 import {
   ScaleContext
 } from "./chunk-24YPR5EH.js";
@@ -842,7 +842,7 @@ function renderSequenceDiagram(container, parsed, palette, isDark, _onNavigateTo
     }
     msgToLastStep.set(step.messageIndex, si);
   });
-  const findAssociatedLastStep = (note) => {
+  const closestPrecedingMsgIndex = (note) => {
     let closestMsgIndex = -1;
     let closestLine = -1;
     for (let mi = 0; mi < messages.length; mi++) {
@@ -852,9 +852,15 @@ function renderSequenceDiagram(container, parsed, palette, isDark, _onNavigateTo
         closestMsgIndex = mi;
       }
     }
-    if (closestMsgIndex >= 0 && hiddenMsgIndices.has(closestMsgIndex)) {
-      return -1;
-    }
+    return closestMsgIndex;
+  };
+  const isNoteHiddenByCollapse = (note) => {
+    const closestMsgIndex = closestPrecedingMsgIndex(note);
+    return closestMsgIndex >= 0 && hiddenMsgIndices.has(closestMsgIndex);
+  };
+  const findAssociatedLastStep = (note) => {
+    if (isNoteHiddenByCollapse(note)) return -1;
+    const closestMsgIndex = closestPrecedingMsgIndex(note);
     if (closestMsgIndex < 0) return -1;
     return msgToLastStep.get(closestMsgIndex) ?? -1;
   };
@@ -942,6 +948,10 @@ function renderSequenceDiagram(container, parsed, palette, isDark, _onNavigateTo
     for (let i = 0; i < els.length; i++) {
       const el = els[i];
       if (isSequenceNote(el)) {
+        if (isNoteHiddenByCollapse(el)) {
+          while (i + 1 < els.length && isSequenceNote(els[i + 1])) i++;
+          continue;
+        }
         const firstOffset = noteOffsetBelow(el);
         let totalExtent = firstOffset;
         let j = i;

package/dist/chunk-Z6DXWULM.js

@@ -0,0 +1,23 @@
+// src/utils/safe-href.ts
+var ALLOWED_SCHEMES = ["http", "https", "mailto"];
+var SCHEME_RE = /^([a-z][a-z0-9+.-]*):/i;
+var LEADING_TRIM_RE = /^[\x00-\x20]+/;
+var URL_STRIP_RE = /[\x09\x0A\x0D]/g;
+function safeHref(url) {
+  if (typeof url !== "string") return null;
+  const trimmed = url.replace(URL_STRIP_RE, "").replace(LEADING_TRIM_RE, "");
+  if (trimmed.length === 0) return null;
+  const match = SCHEME_RE.exec(trimmed);
+  if (!match) {
+    return url;
+  }
+  const scheme = match[1].toLowerCase();
+  if (ALLOWED_SCHEMES.includes(scheme)) {
+    return url;
+  }
+  return null;
+}
+
+export {
+  safeHref
+};

package/dist/{chunk-PBEH52A2.js → chunk-ZNNVI5SR.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-6EK55ART.js";
 import {
   noteBoxSize
-} from "./chunk-ZGHV4QLK.js";
+} from "./chunk-RJNZHFNG.js";
 import {
   resolveNotes
 } from "./chunk-O753JUEZ.js";

package/dist/{flowchart-renderer-H72L7BEC.js → flowchart-renderer-THC6Y7EH.js}

@@ -1,16 +1,17 @@
 import {
   renderFlowchart,
   renderFlowchartForExport
-} from "./chunk-4ELXLATB.js";
+} from "./chunk-XUDGZJTJ.js";
 import "./chunk-26EVL454.js";
-import "./chunk-PBEH52A2.js";
-import "./chunk-5JO443MB.js";
+import "./chunk-ZNNVI5SR.js";
+import "./chunk-HAH5X345.js";
 import "./chunk-XBJJP2HN.js";
 import "./chunk-6EK55ART.js";
-import "./chunk-ZGHV4QLK.js";
+import "./chunk-RJNZHFNG.js";
 import "./chunk-5DH3KYFH.js";
-import "./chunk-WMIKC5XO.js";
-import "./chunk-FWNJDD4U.js";
+import "./chunk-NPWVOFB3.js";
+import "./chunk-S7W75MIM.js";
+import "./chunk-Z6DXWULM.js";
 import "./chunk-EPDBWATV.js";
 import "./chunk-24YPR5EH.js";
 import "./chunk-XCKNFFKM.js";

package/dist/index.d.ts

@@ -102,6 +102,73 @@ declare function attachDataChartInteractions(svg: SVGSVGElement, opts?: DataChar
 declare const D3_DATA_CHART_TYPES: Set<string>;
 declare function supportsD3DataChart(type: string): boolean;
 
+/**
+ * The supported sanitizing boundary for renderer output that is about to land
+ * in a live document.
+ *
+ * Renderer output is trusted only as far as the renderer that produced it, and
+ * every host — the desktop app, the web editor, Obsidian, the script-tag
+ * drop-ins, this library's own `mountD3DataChart` — puts that output into the
+ * DOM. This module is what they call first. It lives here, beside `safe-href`,
+ * rather than inside `src/auto/shared.ts` where it started: that module is the
+ * browser-embed bundle's private toolbox, reachable only from the two IIFE
+ * script-tag builds, so a host importing `@diagrammo/dgmo` could not call the
+ * sanitizer at all however much it wanted to.
+ *
+ * 🔴 **Parse into a DETACHED holder, take the `<svg>`, sanitize, insert.** All
+ * four steps, in that order:
+ *
+ * ```ts
+ * const holder = document.createElement('div');
+ * holder.innerHTML = svg;          // inert: nothing here is connected yet
+ * const svgEl = holder.querySelector('svg');
+ * if (svgEl) {
+ *   sanitizeSvgInPlace(svgEl);
+ *   container.replaceChildren(svgEl);
+ * }
+ * ```
+ *
+ * Sanitizing *after* assigning into a live container is too late: connecting
+ * the subtree is what creates a nested browsing context for an `<iframe>` and
+ * runs a custom element's `connectedCallback`, both synchronously inside the
+ * assignment. And taking only the `<svg>` is half the safety — moving every
+ * child of the holder across would connect whatever a hostile document put
+ * *beside* the diagram. `auto/index.ts` and `element/index.ts` have always done
+ * both; `mount.ts` learned them on diagrammo/diagrammo#884.
+ *
+ * 🔴 **What this does NOT do**, so a caller is not misled about the contract:
+ *
+ * - It does not parse CSS. An `@import` or a `url()` inside a `<style>`
+ *   element passes through untouched.
+ * - It removes the elements listed in `REMOVED_TAGS` and nothing else. That
+ *   set is the script-execution and remote-content surface as of
+ *   diagrammo/diagrammo#884; an element neither it nor the attribute scrub
+ *   below names survives, so a caller sanitizing *arbitrary* HTML rather than
+ *   dgmo renderer output needs its own allowlist on top.
+ * - It does not stop a resource load that an attribute alone starts —
+ *   `<img src>` fetches whether or not the node is connected. What protects
+ *   that case is the `on*` strip, not the detached holder.
+ * - It is no substitute for escaping where a renderer interpolates author
+ *   text (see `src/embed/escape.ts`).
+ *
+ * Browser-only — it needs a live DOM. There is nothing to sanitize on the
+ * rasterising path, which never builds a document.
+ */
+/**
+ * Strip script-execution surface from a freshly parsed SVG tree before it
+ * lands in the live DOM. This is the safety net that lets us build SVG from
+ * markup without trusting renderer output to be fully sanitized.
+ *
+ * Removes every element in `REMOVED_TAGS`, any SMIL element animating an
+ * `href`, any `on*` event-handler attribute, and any `href`/`xlink:href`
+ * failing the `safeHref` allowlist.
+ *
+ * Mutates `root` and returns nothing. Call it on a detached holder — see the
+ * module comment above for why the order matters, and for what this does not
+ * cover.
+ */
+declare function sanitizeSvgInPlace(root: Element): void;
+
 /**
  * The full diagnostic catalog, sorted by code. Every coded diagnostic
  * dgmo can emit — its severity, owning chart type, canonical message,
@@ -206,4 +273,4 @@ interface DecodedDiagramUrl {
  */
 declare function decodeDiagramUrl(url: string): DecodedDiagramUrl | null;
 
-export { CompactViewState, D3_DATA_CHART_TYPES, type DataChartInteractionOpts, type DecodedDiagramUrl, DgmoError, DiagnosticSpec, type EncodeDiagramUrlOptions, MapDataSource, type MountD3Opts, type MountedD3Chart, type NormalizeSvgForEmbedOptions, PaletteConfig, type RenderOptions, type RenderResult, Theme, attachDataChartInteractions, decodeDiagramUrl, defaultEmbedBackground, encodeDiagramUrl, getDiagnosticSpec, getEmbedSvgViewBox, listDiagnosticCodes, mountD3DataChart, normalizeSvgForEmbed, render, supportsD3DataChart };
+export { CompactViewState, D3_DATA_CHART_TYPES, type DataChartInteractionOpts, type DecodedDiagramUrl, DgmoError, DiagnosticSpec, type EncodeDiagramUrlOptions, MapDataSource, type MountD3Opts, type MountedD3Chart, type NormalizeSvgForEmbedOptions, PaletteConfig, type RenderOptions, type RenderResult, Theme, attachDataChartInteractions, decodeDiagramUrl, defaultEmbedBackground, encodeDiagramUrl, getDiagnosticSpec, getEmbedSvgViewBox, listDiagnosticCodes, mountD3DataChart, normalizeSvgForEmbed, render, sanitizeSvgInPlace, supportsD3DataChart };

package/dist/index.js

@@ -9,9 +9,12 @@ import {
   searchMapLocations,
   themes
 } from "./chunk-SQAG3UXH.js";
+import {
+  safeHref
+} from "./chunk-Z6DXWULM.js";
 import {
   render
-} from "./chunk-4YA5XW43.js";
+} from "./chunk-PJQZWJ5I.js";
 import {
   renderErrorCard
 } from "./chunk-D4M25W6R.js";
@@ -34,7 +37,7 @@ import "./chunk-KMU65FYM.js";
 import "./chunk-EPDBWATV.js";
 import "./chunk-7UDAIP6W.js";
 import "./chunk-2CW5ZTNH.js";
-import "./chunk-QPE646M2.js";
+import "./chunk-LPXC4I4R.js";
 import "./chunk-YRYKTYMQ.js";
 import "./chunk-24YPR5EH.js";
 import {
@@ -124,6 +127,50 @@ import {
 } from "./chunk-BYU54C3S.js";
 import "./chunk-5WRI5ZAA.js";
 
+// src/utils/sanitize-svg.ts
+var XLINK_NS = "http://www.w3.org/1999/xlink";
+var REMOVED_TAGS = "script, foreignObject, iframe, object, embed, frame, base, link, meta";
+var ANIMATION_TAGS = new Set(
+  ["animate", "set", "animateTransform", "animateMotion"].map(
+    (t) => t.toLowerCase()
+  )
+);
+var ANIMATED_URL_ATTRS = /* @__PURE__ */ new Set(["href", "xlink:href"]);
+function isUrlAnimation(node) {
+  if (!ANIMATION_TAGS.has(node.localName.toLowerCase())) return false;
+  const target = (node.getAttribute("attributeName") ?? "").trim().toLowerCase();
+  return ANIMATED_URL_ATTRS.has(target);
+}
+function scrubElement(node) {
+  for (const attr of Array.from(node.attributes)) {
+    if (attr.name.toLowerCase().startsWith("on")) {
+      node.removeAttribute(attr.name);
+    }
+  }
+  if (node.hasAttribute("href")) {
+    const safe = safeHref(node.getAttribute("href"));
+    if (safe === null) node.removeAttribute("href");
+  }
+  if (node.hasAttributeNS(XLINK_NS, "href")) {
+    const v = node.getAttributeNS(XLINK_NS, "href");
+    if (safeHref(v) === null) {
+      node.removeAttributeNS(XLINK_NS, "href");
+    }
+  }
+}
+function sanitizeSvgInPlace(root) {
+  const dangerous = root.querySelectorAll(REMOVED_TAGS);
+  dangerous.forEach((n) => n.remove());
+  const all = [root, ...Array.from(root.querySelectorAll("*"))];
+  for (const node of all) {
+    if (isUrlAnimation(node)) {
+      node.remove();
+      continue;
+    }
+    scrubElement(node);
+  }
+}
+
 // src/charts-d3/interactions.ts
 var NS = "http://www.w3.org/2000/svg";
 var STYLE_ID = "dgmo-chart-interactions-style";
@@ -134,7 +181,8 @@ function ensureStyle(svg, muted) {
   style.id = STYLE_ID;
   style.textContent = `
     .dgmo-series,.dgmo-datum,.dgmo-tick,.dgmo-ptlabel{transition:opacity .12s ease}
-    .dgmo-series.dgmo-dim,.dgmo-datum.dgmo-dim,.dgmo-ptlabel.dgmo-dim{opacity:.18}
+    [data-legend-entry]{transition:opacity .12s ease}
+    .dgmo-series.dgmo-dim,.dgmo-datum.dgmo-dim,.dgmo-ptlabel.dgmo-dim,[data-legend-entry].dgmo-dim{opacity:.18}
     .dgmo-tick.dgmo-faded{opacity:.22}
     .dgmo-datum{cursor:pointer}
     .dgmo-axis-label{cursor:pointer}
@@ -177,6 +225,9 @@ function attachDataChartInteractions(svg, opts = {}) {
     svg.querySelectorAll(".dgmo-series")
   );
   const datums = Array.from(svg.querySelectorAll(".dgmo-datum"));
+  const legendEntries = Array.from(
+    svg.querySelectorAll(".chart-legend [data-legend-entry]")
+  );
   const circles = Array.from(
     svg.querySelectorAll(".dgmo-pt")
   );
@@ -247,6 +298,15 @@ function attachDataChartInteractions(svg, opts = {}) {
   const ptLabels = Array.from(
     svg.querySelectorAll(".dgmo-ptlabel")
   );
+  const dimLegendExcept = (el) => {
+    const name = el?.getAttribute("data-series-name") ?? el?.getAttribute("data-emph-key") ?? null;
+    const paired = name != null && legendEntries.some((e) => e.getAttribute("data-series-name") === name);
+    for (const e of legendEntries)
+      e.classList.toggle(
+        "dgmo-dim",
+        paired && e.getAttribute("data-series-name") !== name
+      );
+  };
   const dimDatumsExcept = (el) => {
     for (const d of datums) d.classList.toggle("dgmo-dim", d !== el);
     const line = el?.getAttribute("data-line-number");
@@ -255,6 +315,7 @@ function attachDataChartInteractions(svg, opts = {}) {
         "dgmo-dim",
         line == null || l.getAttribute("data-line-number") !== line
       );
+    dimLegendExcept(el);
   };
   const dimByKey = (el) => {
     const key = el.getAttribute("data-emph-key");
@@ -263,11 +324,13 @@ function attachDataChartInteractions(svg, opts = {}) {
       if (key) d.classList.toggle("dgmo-dim", dk !== key);
       else d.classList.toggle("dgmo-dim", d !== el);
     }
+    dimLegendExcept(el);
   };
   const clearDim = () => {
     for (const d of datums) d.classList.remove("dgmo-dim");
     for (const g of seriesGroups) g.classList.remove("dgmo-dim");
     for (const l of ptLabels) l.classList.remove("dgmo-dim");
+    for (const e of legendEntries) e.classList.remove("dgmo-dim");
     reapplyAxisPin();
   };
   let axisPin = null;
@@ -513,9 +576,6 @@ function attachDataChartInteractions(svg, opts = {}) {
     svg.addEventListener("mousemove", onSvgMove);
   svg.addEventListener("mouseleave", onLeave);
   svg.addEventListener("click", onClick);
-  const legendEntries = Array.from(
-    svg.querySelectorAll(".chart-legend [data-legend-entry]")
-  );
   const emphasizeSeries = (name) => {
     for (const g of seriesGroups) {
       const sn = g.getAttribute("data-series-name");
@@ -637,7 +697,14 @@ function mountD3DataChart(container, content, opts = {}) {
       interaction.destroy();
       interaction = null;
     }
-    container.innerHTML = svg;
+    const holder = document.createElement("div");
+    holder.innerHTML = svg;
+    const parsed = holder.querySelector("svg");
+    container.innerHTML = "";
+    if (parsed) {
+      sanitizeSvgInPlace(parsed);
+      container.append(parsed);
+    }
     const el = container.querySelector("svg");
     if (el) {
       const pal = paletteOf(current);
@@ -750,6 +817,7 @@ export {
   palettes,
   render2 as render,
   resolvePaletteOrFallback,
+  sanitizeSvgInPlace,
   searchMapLocations,
   supportsD3DataChart,
   themes,

package/dist/{layout-QIPCNUSB.js → layout-BOVTLAOT.js}

@@ -1,14 +1,15 @@
 import {
   computeNodeSize,
   layoutBoxesAndLines
-} from "./chunk-LIYWJ6DV.js";
-import "./chunk-TW6WMZFW.js";
-import "./chunk-HBCAY3KR.js";
+} from "./chunk-XIFK423U.js";
+import "./chunk-QT3KDDXK.js";
+import "./chunk-HTNLLT34.js";
 import "./chunk-6EK55ART.js";
-import "./chunk-ZGHV4QLK.js";
+import "./chunk-RJNZHFNG.js";
 import "./chunk-5DH3KYFH.js";
-import "./chunk-WMIKC5XO.js";
-import "./chunk-FWNJDD4U.js";
+import "./chunk-NPWVOFB3.js";
+import "./chunk-S7W75MIM.js";
+import "./chunk-Z6DXWULM.js";
 import "./chunk-ICLB27PZ.js";
 import "./chunk-KAO7JL4I.js";
 import "./chunk-O753JUEZ.js";

package/dist/{layout-6JARW64V.js → layout-EHTYSMV4.js}

@@ -1,12 +1,13 @@
 import {
   layoutERDiagram
-} from "./chunk-FAV4RDVT.js";
-import "./chunk-HBCAY3KR.js";
+} from "./chunk-2A4DQAXG.js";
+import "./chunk-HTNLLT34.js";
 import "./chunk-6EK55ART.js";
-import "./chunk-ZGHV4QLK.js";
+import "./chunk-RJNZHFNG.js";
 import "./chunk-5DH3KYFH.js";
-import "./chunk-WMIKC5XO.js";
-import "./chunk-FWNJDD4U.js";
+import "./chunk-NPWVOFB3.js";
+import "./chunk-S7W75MIM.js";
+import "./chunk-Z6DXWULM.js";
 import "./chunk-ICLB27PZ.js";
 import "./chunk-KAO7JL4I.js";
 import "./chunk-O753JUEZ.js";