@isi-ui7/bos7-shared 0.3.2 → 0.3.3

package/dist/purify.es-Cm3utOpm.js

@@ -0,0 +1,560 @@
+/*! @license DOMPurify 3.4.0 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.4.0/LICENSE */
+const {
+  entries: gt,
+  setPrototypeOf: ft,
+  isFrozen: Yt,
+  getPrototypeOf: Xt,
+  getOwnPropertyDescriptor: jt
+} = Object;
+let {
+  freeze: S,
+  seal: b,
+  create: ne
+} = Object, {
+  apply: Ue,
+  construct: Fe
+} = typeof Reflect < "u" && Reflect;
+S || (S = function(o) {
+  return o;
+});
+b || (b = function(o) {
+  return o;
+});
+Ue || (Ue = function(o, l) {
+  for (var a = arguments.length, c = new Array(a > 2 ? a - 2 : 0), O = 2; O < a; O++)
+    c[O - 2] = arguments[O];
+  return o.apply(l, c);
+});
+Fe || (Fe = function(o) {
+  for (var l = arguments.length, a = new Array(l > 1 ? l - 1 : 0), c = 1; c < l; c++)
+    a[c - 1] = arguments[c];
+  return new o(...a);
+});
+const Z = R(Array.prototype.forEach), Vt = R(Array.prototype.lastIndexOf), ut = R(Array.prototype.pop), J = R(Array.prototype.push), $t = R(Array.prototype.splice), Ee = R(String.prototype.toLowerCase), Me = R(String.prototype.toString), we = R(String.prototype.match), B = R(String.prototype.replace), qt = R(String.prototype.indexOf), Kt = R(String.prototype.trim), C = R(Object.prototype.hasOwnProperty), A = R(RegExp.prototype.test), Q = Zt(TypeError);
+function R(s) {
+  return function(o) {
+    o instanceof RegExp && (o.lastIndex = 0);
+    for (var l = arguments.length, a = new Array(l > 1 ? l - 1 : 0), c = 1; c < l; c++)
+      a[c - 1] = arguments[c];
+    return Ue(s, o, a);
+  };
+}
+function Zt(s) {
+  return function() {
+    for (var o = arguments.length, l = new Array(o), a = 0; a < o; a++)
+      l[a] = arguments[a];
+    return Fe(s, l);
+  };
+}
+function r(s, o) {
+  let l = arguments.length > 2 && arguments[2] !== void 0 ? arguments[2] : Ee;
+  ft && ft(s, null);
+  let a = o.length;
+  for (; a--; ) {
+    let c = o[a];
+    if (typeof c == "string") {
+      const O = l(c);
+      O !== c && (Yt(o) || (o[a] = O), c = O);
+    }
+    s[c] = !0;
+  }
+  return s;
+}
+function Jt(s) {
+  for (let o = 0; o < s.length; o++)
+    C(s, o) || (s[o] = null);
+  return s;
+}
+function M(s) {
+  const o = ne(null);
+  for (const [l, a] of gt(s))
+    C(s, l) && (Array.isArray(a) ? o[l] = Jt(a) : a && typeof a == "object" && a.constructor === Object ? o[l] = M(a) : o[l] = a);
+  return o;
+}
+function ee(s, o) {
+  for (; s !== null; ) {
+    const a = jt(s, o);
+    if (a) {
+      if (a.get)
+        return R(a.get);
+      if (typeof a.value == "function")
+        return R(a.value);
+    }
+    s = Xt(s);
+  }
+  function l() {
+    return null;
+  }
+  return l;
+}
+const mt = S(["a", "abbr", "acronym", "address", "area", "article", "aside", "audio", "b", "bdi", "bdo", "big", "blink", "blockquote", "body", "br", "button", "canvas", "caption", "center", "cite", "code", "col", "colgroup", "content", "data", "datalist", "dd", "decorator", "del", "details", "dfn", "dialog", "dir", "div", "dl", "dt", "element", "em", "fieldset", "figcaption", "figure", "font", "footer", "form", "h1", "h2", "h3", "h4", "h5", "h6", "head", "header", "hgroup", "hr", "html", "i", "img", "input", "ins", "kbd", "label", "legend", "li", "main", "map", "mark", "marquee", "menu", "menuitem", "meter", "nav", "nobr", "ol", "optgroup", "option", "output", "p", "picture", "pre", "progress", "q", "rp", "rt", "ruby", "s", "samp", "search", "section", "select", "shadow", "slot", "small", "source", "spacer", "span", "strike", "strong", "style", "sub", "summary", "sup", "table", "tbody", "td", "template", "textarea", "tfoot", "th", "thead", "time", "tr", "track", "tt", "u", "ul", "var", "video", "wbr"]), xe = S(["svg", "a", "altglyph", "altglyphdef", "altglyphitem", "animatecolor", "animatemotion", "animatetransform", "circle", "clippath", "defs", "desc", "ellipse", "enterkeyhint", "exportparts", "filter", "font", "g", "glyph", "glyphref", "hkern", "image", "inputmode", "line", "lineargradient", "marker", "mask", "metadata", "mpath", "part", "path", "pattern", "polygon", "polyline", "radialgradient", "rect", "stop", "style", "switch", "symbol", "text", "textpath", "title", "tref", "tspan", "view", "vkern"]), Pe = S(["feBlend", "feColorMatrix", "feComponentTransfer", "feComposite", "feConvolveMatrix", "feDiffuseLighting", "feDisplacementMap", "feDistantLight", "feDropShadow", "feFlood", "feFuncA", "feFuncB", "feFuncG", "feFuncR", "feGaussianBlur", "feImage", "feMerge", "feMergeNode", "feMorphology", "feOffset", "fePointLight", "feSpecularLighting", "feSpotLight", "feTile", "feTurbulence"]), Qt = S(["animate", "color-profile", "cursor", "discard", "font-face", "font-face-format", "font-face-name", "font-face-src", "font-face-uri", "foreignobject", "hatch", "hatchpath", "mesh", "meshgradient", "meshpatch", "meshrow", "missing-glyph", "script", "set", "solidcolor", "unknown", "use"]), ke = S(["math", "menclose", "merror", "mfenced", "mfrac", "mglyph", "mi", "mlabeledtr", "mmultiscripts", "mn", "mo", "mover", "mpadded", "mphantom", "mroot", "mrow", "ms", "mspace", "msqrt", "mstyle", "msub", "msup", "msubsup", "mtable", "mtd", "mtext", "mtr", "munder", "munderover", "mprescripts"]), en = S(["maction", "maligngroup", "malignmark", "mlongdiv", "mscarries", "mscarry", "msgroup", "mstack", "msline", "msrow", "semantics", "annotation", "annotation-xml", "mprescripts", "none"]), pt = S(["#text"]), Tt = S(["accept", "action", "align", "alt", "autocapitalize", "autocomplete", "autopictureinpicture", "autoplay", "background", "bgcolor", "border", "capture", "cellpadding", "cellspacing", "checked", "cite", "class", "clear", "color", "cols", "colspan", "controls", "controlslist", "coords", "crossorigin", "datetime", "decoding", "default", "dir", "disabled", "disablepictureinpicture", "disableremoteplayback", "download", "draggable", "enctype", "enterkeyhint", "exportparts", "face", "for", "headers", "height", "hidden", "high", "href", "hreflang", "id", "inert", "inputmode", "integrity", "ismap", "kind", "label", "lang", "list", "loading", "loop", "low", "max", "maxlength", "media", "method", "min", "minlength", "multiple", "muted", "name", "nonce", "noshade", "novalidate", "nowrap", "open", "optimum", "part", "pattern", "placeholder", "playsinline", "popover", "popovertarget", "popovertargetaction", "poster", "preload", "pubdate", "radiogroup", "readonly", "rel", "required", "rev", "reversed", "role", "rows", "rowspan", "spellcheck", "scope", "selected", "shape", "size", "sizes", "slot", "span", "srclang", "start", "src", "srcset", "step", "style", "summary", "tabindex", "title", "translate", "type", "usemap", "valign", "value", "width", "wrap", "xmlns", "slot"]), ve = S(["accent-height", "accumulate", "additive", "alignment-baseline", "amplitude", "ascent", "attributename", "attributetype", "azimuth", "basefrequency", "baseline-shift", "begin", "bias", "by", "class", "clip", "clippathunits", "clip-path", "clip-rule", "color", "color-interpolation", "color-interpolation-filters", "color-profile", "color-rendering", "cx", "cy", "d", "dx", "dy", "diffuseconstant", "direction", "display", "divisor", "dur", "edgemode", "elevation", "end", "exponent", "fill", "fill-opacity", "fill-rule", "filter", "filterunits", "flood-color", "flood-opacity", "font-family", "font-size", "font-size-adjust", "font-stretch", "font-style", "font-variant", "font-weight", "fx", "fy", "g1", "g2", "glyph-name", "glyphref", "gradientunits", "gradienttransform", "height", "href", "id", "image-rendering", "in", "in2", "intercept", "k", "k1", "k2", "k3", "k4", "kerning", "keypoints", "keysplines", "keytimes", "lang", "lengthadjust", "letter-spacing", "kernelmatrix", "kernelunitlength", "lighting-color", "local", "marker-end", "marker-mid", "marker-start", "markerheight", "markerunits", "markerwidth", "maskcontentunits", "maskunits", "max", "mask", "mask-type", "media", "method", "mode", "min", "name", "numoctaves", "offset", "operator", "opacity", "order", "orient", "orientation", "origin", "overflow", "paint-order", "path", "pathlength", "patterncontentunits", "patterntransform", "patternunits", "points", "preservealpha", "preserveaspectratio", "primitiveunits", "r", "rx", "ry", "radius", "refx", "refy", "repeatcount", "repeatdur", "restart", "result", "rotate", "scale", "seed", "shape-rendering", "slope", "specularconstant", "specularexponent", "spreadmethod", "startoffset", "stddeviation", "stitchtiles", "stop-color", "stop-opacity", "stroke-dasharray", "stroke-dashoffset", "stroke-linecap", "stroke-linejoin", "stroke-miterlimit", "stroke-opacity", "stroke", "stroke-width", "style", "surfacescale", "systemlanguage", "tabindex", "tablevalues", "targetx", "targety", "transform", "transform-origin", "text-anchor", "text-decoration", "text-rendering", "textlength", "type", "u1", "u2", "unicode", "values", "viewbox", "visibility", "version", "vert-adv-y", "vert-origin-x", "vert-origin-y", "width", "word-spacing", "wrap", "writing-mode", "xchannelselector", "ychannelselector", "x", "x1", "x2", "xmlns", "y", "y1", "y2", "z", "zoomandpan"]), dt = S(["accent", "accentunder", "align", "bevelled", "close", "columnalign", "columnlines", "columnspacing", "columnspan", "denomalign", "depth", "dir", "display", "displaystyle", "encoding", "fence", "frame", "height", "href", "id", "largeop", "length", "linethickness", "lquote", "lspace", "mathbackground", "mathcolor", "mathsize", "mathvariant", "maxsize", "minsize", "movablelimits", "notation", "numalign", "open", "rowalign", "rowlines", "rowspacing", "rowspan", "rspace", "rquote", "scriptlevel", "scriptminsize", "scriptsizemultiplier", "selection", "separator", "separators", "stretchy", "subscriptshift", "supscriptshift", "symmetric", "voffset", "width", "xmlns"]), de = S(["xlink:href", "xml:id", "xlink:title", "xml:space", "xmlns:xlink"]), tn = b(/\{\{[\w\W]*|[\w\W]*\}\}/gm), nn = b(/<%[\w\W]*|[\w\W]*%>/gm), on = b(/\$\{[\w\W]*/gm), an = b(/^data-[\-\w.\u00B7-\uFFFF]+$/), rn = b(/^aria-[\-\w]+$/), ht = b(
+  /^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp|matrix):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i
+  // eslint-disable-line no-useless-escape
+), sn = b(/^(?:\w+script|data):/i), ln = b(
+  /[\u0000-\u0020\u00A0\u1680\u180E\u2000-\u2029\u205F\u3000]/g
+  // eslint-disable-line no-control-regex
+), At = b(/^html$/i), cn = b(/^[a-z][.\w]*(-[.\w]+)+$/i);
+var Et = /* @__PURE__ */ Object.freeze({
+  __proto__: null,
+  ARIA_ATTR: rn,
+  ATTR_WHITESPACE: ln,
+  CUSTOM_ELEMENT: cn,
+  DATA_ATTR: an,
+  DOCTYPE_NAME: At,
+  ERB_EXPR: nn,
+  IS_ALLOWED_URI: ht,
+  IS_SCRIPT_OR_DATA: sn,
+  MUSTACHE_EXPR: tn,
+  TMPLIT_EXPR: on
+});
+const te = {
+  element: 1,
+  text: 3,
+  // Deprecated
+  progressingInstruction: 7,
+  comment: 8,
+  document: 9
+}, fn = function() {
+  return typeof window > "u" ? null : window;
+}, un = function(o, l) {
+  if (typeof o != "object" || typeof o.createPolicy != "function")
+    return null;
+  let a = null;
+  const c = "data-tt-policy-suffix";
+  l && l.hasAttribute(c) && (a = l.getAttribute(c));
+  const O = "dompurify" + (a ? "#" + a : "");
+  try {
+    return o.createPolicy(O, {
+      createHTML(F) {
+        return F;
+      },
+      createScriptURL(F) {
+        return F;
+      }
+    });
+  } catch {
+    return console.warn("TrustedTypes policy " + O + " could not be created."), null;
+  }
+}, _t = function() {
+  return {
+    afterSanitizeAttributes: [],
+    afterSanitizeElements: [],
+    afterSanitizeShadowDOM: [],
+    beforeSanitizeAttributes: [],
+    beforeSanitizeElements: [],
+    beforeSanitizeShadowDOM: [],
+    uponSanitizeAttribute: [],
+    uponSanitizeElement: [],
+    uponSanitizeShadowNode: []
+  };
+};
+function St() {
+  let s = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : fn();
+  const o = (i) => St(i);
+  if (o.version = "3.4.0", o.removed = [], !s || !s.document || s.document.nodeType !== te.document || !s.Element)
+    return o.isSupported = !1, o;
+  let {
+    document: l
+  } = s;
+  const a = l, c = a.currentScript, {
+    DocumentFragment: O,
+    HTMLTemplateElement: F,
+    Node: _e,
+    Element: He,
+    NodeFilter: Y,
+    NamedNodeMap: Rt = s.NamedNodeMap || s.MozNamedAttrMap,
+    HTMLFormElement: Ot,
+    DOMParser: Dt,
+    trustedTypes: oe
+  } = s, X = He.prototype, Lt = ee(X, "cloneNode"), bt = ee(X, "remove"), yt = ee(X, "nextSibling"), Ct = ee(X, "childNodes"), ie = ee(X, "parentNode");
+  if (typeof F == "function") {
+    const i = l.createElement("template");
+    i.content && i.content.ownerDocument && (l = i.content.ownerDocument);
+  }
+  let g, j = "";
+  const {
+    implementation: ge,
+    createNodeIterator: It,
+    createDocumentFragment: Nt,
+    getElementsByTagName: Mt
+  } = l, {
+    importNode: wt
+  } = a;
+  let h = _t();
+  o.isSupported = typeof gt == "function" && typeof ie == "function" && ge && ge.createHTMLDocument !== void 0;
+  const {
+    MUSTACHE_EXPR: ae,
+    ERB_EXPR: re,
+    TMPLIT_EXPR: se,
+    DATA_ATTR: xt,
+    ARIA_ATTR: Pt,
+    IS_SCRIPT_OR_DATA: kt,
+    ATTR_WHITESPACE: ze,
+    CUSTOM_ELEMENT: vt
+  } = Et;
+  let {
+    IS_ALLOWED_URI: Ge
+  } = Et, T = null;
+  const We = r({}, [...mt, ...xe, ...Pe, ...ke, ...pt]);
+  let d = null;
+  const Be = r({}, [...Tt, ...ve, ...dt, ...de]);
+  let u = Object.seal(ne(null, {
+    tagNameCheck: {
+      writable: !0,
+      configurable: !1,
+      enumerable: !0,
+      value: null
+    },
+    attributeNameCheck: {
+      writable: !0,
+      configurable: !1,
+      enumerable: !0,
+      value: null
+    },
+    allowCustomizedBuiltInElements: {
+      writable: !0,
+      configurable: !1,
+      enumerable: !0,
+      value: !1
+    }
+  })), V = null, le = null;
+  const x = Object.seal(ne(null, {
+    tagCheck: {
+      writable: !0,
+      configurable: !1,
+      enumerable: !0,
+      value: null
+    },
+    attributeCheck: {
+      writable: !0,
+      configurable: !1,
+      enumerable: !0,
+      value: null
+    }
+  }));
+  let Ye = !0, he = !0, Xe = !1, je = !0, k = !1, $ = !0, v = !1, Ae = !1, Se = !1, H = !1, ce = !1, fe = !1, Ve = !0, $e = !1;
+  const Ut = "user-content-";
+  let Re = !0, q = !1, z = {}, I = null;
+  const Oe = r({}, ["annotation-xml", "audio", "colgroup", "desc", "foreignobject", "head", "iframe", "math", "mi", "mn", "mo", "ms", "mtext", "noembed", "noframes", "noscript", "plaintext", "script", "style", "svg", "template", "thead", "title", "video", "xmp"]);
+  let qe = null;
+  const Ke = r({}, ["audio", "video", "img", "source", "image", "track"]);
+  let De = null;
+  const Ze = r({}, ["alt", "class", "for", "id", "label", "name", "pattern", "placeholder", "role", "summary", "title", "value", "style", "xmlns"]), ue = "http://www.w3.org/1998/Math/MathML", me = "http://www.w3.org/2000/svg", N = "http://www.w3.org/1999/xhtml";
+  let G = N, Le = !1, be = null;
+  const Ft = r({}, [ue, me, N], Me);
+  let pe = r({}, ["mi", "mo", "mn", "ms", "mtext"]), Te = r({}, ["annotation-xml"]);
+  const Ht = r({}, ["title", "style", "font", "a", "script"]);
+  let K = null;
+  const zt = ["application/xhtml+xml", "text/html"], Gt = "text/html";
+  let p = null, W = null;
+  const Wt = l.createElement("form"), Je = function(e) {
+    return e instanceof RegExp || e instanceof Function;
+  }, ye = function() {
+    let e = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : {};
+    if (!(W && W === e)) {
+      if ((!e || typeof e != "object") && (e = {}), e = M(e), K = // eslint-disable-next-line unicorn/prefer-includes
+      zt.indexOf(e.PARSER_MEDIA_TYPE) === -1 ? Gt : e.PARSER_MEDIA_TYPE, p = K === "application/xhtml+xml" ? Me : Ee, T = C(e, "ALLOWED_TAGS") ? r({}, e.ALLOWED_TAGS, p) : We, d = C(e, "ALLOWED_ATTR") ? r({}, e.ALLOWED_ATTR, p) : Be, be = C(e, "ALLOWED_NAMESPACES") ? r({}, e.ALLOWED_NAMESPACES, Me) : Ft, De = C(e, "ADD_URI_SAFE_ATTR") ? r(M(Ze), e.ADD_URI_SAFE_ATTR, p) : Ze, qe = C(e, "ADD_DATA_URI_TAGS") ? r(M(Ke), e.ADD_DATA_URI_TAGS, p) : Ke, I = C(e, "FORBID_CONTENTS") ? r({}, e.FORBID_CONTENTS, p) : Oe, V = C(e, "FORBID_TAGS") ? r({}, e.FORBID_TAGS, p) : M({}), le = C(e, "FORBID_ATTR") ? r({}, e.FORBID_ATTR, p) : M({}), z = C(e, "USE_PROFILES") ? e.USE_PROFILES : !1, Ye = e.ALLOW_ARIA_ATTR !== !1, he = e.ALLOW_DATA_ATTR !== !1, Xe = e.ALLOW_UNKNOWN_PROTOCOLS || !1, je = e.ALLOW_SELF_CLOSE_IN_ATTR !== !1, k = e.SAFE_FOR_TEMPLATES || !1, $ = e.SAFE_FOR_XML !== !1, v = e.WHOLE_DOCUMENT || !1, H = e.RETURN_DOM || !1, ce = e.RETURN_DOM_FRAGMENT || !1, fe = e.RETURN_TRUSTED_TYPE || !1, Se = e.FORCE_BODY || !1, Ve = e.SANITIZE_DOM !== !1, $e = e.SANITIZE_NAMED_PROPS || !1, Re = e.KEEP_CONTENT !== !1, q = e.IN_PLACE || !1, Ge = e.ALLOWED_URI_REGEXP || ht, G = e.NAMESPACE || N, pe = e.MATHML_TEXT_INTEGRATION_POINTS || pe, Te = e.HTML_INTEGRATION_POINTS || Te, u = e.CUSTOM_ELEMENT_HANDLING || ne(null), e.CUSTOM_ELEMENT_HANDLING && Je(e.CUSTOM_ELEMENT_HANDLING.tagNameCheck) && (u.tagNameCheck = e.CUSTOM_ELEMENT_HANDLING.tagNameCheck), e.CUSTOM_ELEMENT_HANDLING && Je(e.CUSTOM_ELEMENT_HANDLING.attributeNameCheck) && (u.attributeNameCheck = e.CUSTOM_ELEMENT_HANDLING.attributeNameCheck), e.CUSTOM_ELEMENT_HANDLING && typeof e.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements == "boolean" && (u.allowCustomizedBuiltInElements = e.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements), k && (he = !1), ce && (H = !0), z && (T = r({}, pt), d = ne(null), z.html === !0 && (r(T, mt), r(d, Tt)), z.svg === !0 && (r(T, xe), r(d, ve), r(d, de)), z.svgFilters === !0 && (r(T, Pe), r(d, ve), r(d, de)), z.mathMl === !0 && (r(T, ke), r(d, dt), r(d, de))), x.tagCheck = null, x.attributeCheck = null, e.ADD_TAGS && (typeof e.ADD_TAGS == "function" ? x.tagCheck = e.ADD_TAGS : (T === We && (T = M(T)), r(T, e.ADD_TAGS, p))), e.ADD_ATTR && (typeof e.ADD_ATTR == "function" ? x.attributeCheck = e.ADD_ATTR : (d === Be && (d = M(d)), r(d, e.ADD_ATTR, p))), e.ADD_URI_SAFE_ATTR && r(De, e.ADD_URI_SAFE_ATTR, p), e.FORBID_CONTENTS && (I === Oe && (I = M(I)), r(I, e.FORBID_CONTENTS, p)), e.ADD_FORBID_CONTENTS && (I === Oe && (I = M(I)), r(I, e.ADD_FORBID_CONTENTS, p)), Re && (T["#text"] = !0), v && r(T, ["html", "head", "body"]), T.table && (r(T, ["tbody"]), delete V.tbody), e.TRUSTED_TYPES_POLICY) {
+        if (typeof e.TRUSTED_TYPES_POLICY.createHTML != "function")
+          throw Q('TRUSTED_TYPES_POLICY configuration option must provide a "createHTML" hook.');
+        if (typeof e.TRUSTED_TYPES_POLICY.createScriptURL != "function")
+          throw Q('TRUSTED_TYPES_POLICY configuration option must provide a "createScriptURL" hook.');
+        g = e.TRUSTED_TYPES_POLICY, j = g.createHTML("");
+      } else
+        g === void 0 && (g = un(oe, c)), g !== null && typeof j == "string" && (j = g.createHTML(""));
+      S && S(e), W = e;
+    }
+  }, Qe = r({}, [...xe, ...Pe, ...Qt]), et = r({}, [...ke, ...en]), Bt = function(e) {
+    let t = ie(e);
+    (!t || !t.tagName) && (t = {
+      namespaceURI: G,
+      tagName: "template"
+    });
+    const n = Ee(e.tagName), f = Ee(t.tagName);
+    return be[e.namespaceURI] ? e.namespaceURI === me ? t.namespaceURI === N ? n === "svg" : t.namespaceURI === ue ? n === "svg" && (f === "annotation-xml" || pe[f]) : !!Qe[n] : e.namespaceURI === ue ? t.namespaceURI === N ? n === "math" : t.namespaceURI === me ? n === "math" && Te[f] : !!et[n] : e.namespaceURI === N ? t.namespaceURI === me && !Te[f] || t.namespaceURI === ue && !pe[f] ? !1 : !et[n] && (Ht[n] || !Qe[n]) : !!(K === "application/xhtml+xml" && be[e.namespaceURI]) : !1;
+  }, y = function(e) {
+    J(o.removed, {
+      element: e
+    });
+    try {
+      ie(e).removeChild(e);
+    } catch {
+      bt(e);
+    }
+  }, U = function(e, t) {
+    try {
+      J(o.removed, {
+        attribute: t.getAttributeNode(e),
+        from: t
+      });
+    } catch {
+      J(o.removed, {
+        attribute: null,
+        from: t
+      });
+    }
+    if (t.removeAttribute(e), e === "is")
+      if (H || ce)
+        try {
+          y(t);
+        } catch {
+        }
+      else
+        try {
+          t.setAttribute(e, "");
+        } catch {
+        }
+  }, tt = function(e) {
+    let t = null, n = null;
+    if (Se)
+      e = "<remove></remove>" + e;
+    else {
+      const m = we(e, /^[\r\n\t ]+/);
+      n = m && m[0];
+    }
+    K === "application/xhtml+xml" && G === N && (e = '<html xmlns="http://www.w3.org/1999/xhtml"><head></head><body>' + e + "</body></html>");
+    const f = g ? g.createHTML(e) : e;
+    if (G === N)
+      try {
+        t = new Dt().parseFromString(f, K);
+      } catch {
+      }
+    if (!t || !t.documentElement) {
+      t = ge.createDocument(G, "template", null);
+      try {
+        t.documentElement.innerHTML = Le ? j : f;
+      } catch {
+      }
+    }
+    const _ = t.body || t.documentElement;
+    return e && n && _.insertBefore(l.createTextNode(n), _.childNodes[0] || null), G === N ? Mt.call(t, v ? "html" : "body")[0] : v ? t.documentElement : _;
+  }, nt = function(e) {
+    return It.call(
+      e.ownerDocument || e,
+      e,
+      // eslint-disable-next-line no-bitwise
+      Y.SHOW_ELEMENT | Y.SHOW_COMMENT | Y.SHOW_TEXT | Y.SHOW_PROCESSING_INSTRUCTION | Y.SHOW_CDATA_SECTION,
+      null
+    );
+  }, Ce = function(e) {
+    return e instanceof Ot && (typeof e.nodeName != "string" || typeof e.textContent != "string" || typeof e.removeChild != "function" || !(e.attributes instanceof Rt) || typeof e.removeAttribute != "function" || typeof e.setAttribute != "function" || typeof e.namespaceURI != "string" || typeof e.insertBefore != "function" || typeof e.hasChildNodes != "function");
+  }, Ie = function(e) {
+    return typeof _e == "function" && e instanceof _e;
+  };
+  function w(i, e, t) {
+    Z(i, (n) => {
+      n.call(o, e, t, W);
+    });
+  }
+  const ot = function(e) {
+    let t = null;
+    if (w(h.beforeSanitizeElements, e, null), Ce(e))
+      return y(e), !0;
+    const n = p(e.nodeName);
+    if (w(h.uponSanitizeElement, e, {
+      tagName: n,
+      allowedTags: T
+    }), $ && e.hasChildNodes() && !Ie(e.firstElementChild) && A(/<[/\w!]/g, e.innerHTML) && A(/<[/\w!]/g, e.textContent) || $ && e.namespaceURI === N && n === "style" && Ie(e.firstElementChild) || e.nodeType === te.progressingInstruction || $ && e.nodeType === te.comment && A(/<[/\w]/g, e.data))
+      return y(e), !0;
+    if (V[n] || !(x.tagCheck instanceof Function && x.tagCheck(n)) && !T[n]) {
+      if (!V[n] && at(n) && (u.tagNameCheck instanceof RegExp && A(u.tagNameCheck, n) || u.tagNameCheck instanceof Function && u.tagNameCheck(n)))
+        return !1;
+      if (Re && !I[n]) {
+        const f = ie(e) || e.parentNode, _ = Ct(e) || e.childNodes;
+        if (_ && f) {
+          const m = _.length;
+          for (let D = m - 1; D >= 0; --D) {
+            const L = Lt(_[D], !0);
+            L.__removalCount = (e.__removalCount || 0) + 1, f.insertBefore(L, yt(e));
+          }
+        }
+      }
+      return y(e), !0;
+    }
+    return e instanceof He && !Bt(e) || (n === "noscript" || n === "noembed" || n === "noframes") && A(/<\/no(script|embed|frames)/i, e.innerHTML) ? (y(e), !0) : (k && e.nodeType === te.text && (t = e.textContent, Z([ae, re, se], (f) => {
+      t = B(t, f, " ");
+    }), e.textContent !== t && (J(o.removed, {
+      element: e.cloneNode()
+    }), e.textContent = t)), w(h.afterSanitizeElements, e, null), !1);
+  }, it = function(e, t, n) {
+    if (le[t] || Ve && (t === "id" || t === "name") && (n in l || n in Wt))
+      return !1;
+    if (!(he && !le[t] && A(xt, t))) {
+      if (!(Ye && A(Pt, t))) {
+        if (!(x.attributeCheck instanceof Function && x.attributeCheck(t, e))) {
+          if (!d[t] || le[t]) {
+            if (
+              // First condition does a very basic check if a) it's basically a valid custom element tagname AND
+              // b) if the tagName passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
+              // and c) if the attribute name passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.attributeNameCheck
+              !(at(e) && (u.tagNameCheck instanceof RegExp && A(u.tagNameCheck, e) || u.tagNameCheck instanceof Function && u.tagNameCheck(e)) && (u.attributeNameCheck instanceof RegExp && A(u.attributeNameCheck, t) || u.attributeNameCheck instanceof Function && u.attributeNameCheck(t, e)) || // Alternative, second condition checks if it's an `is`-attribute, AND
+              // the value passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
+              t === "is" && u.allowCustomizedBuiltInElements && (u.tagNameCheck instanceof RegExp && A(u.tagNameCheck, n) || u.tagNameCheck instanceof Function && u.tagNameCheck(n)))
+            ) return !1;
+          } else if (!De[t]) {
+            if (!A(Ge, B(n, ze, ""))) {
+              if (!((t === "src" || t === "xlink:href" || t === "href") && e !== "script" && qt(n, "data:") === 0 && qe[e])) {
+                if (!(Xe && !A(kt, B(n, ze, "")))) {
+                  if (n)
+                    return !1;
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+    return !0;
+  }, at = function(e) {
+    return e !== "annotation-xml" && we(e, vt);
+  }, rt = function(e) {
+    w(h.beforeSanitizeAttributes, e, null);
+    const {
+      attributes: t
+    } = e;
+    if (!t || Ce(e))
+      return;
+    const n = {
+      attrName: "",
+      attrValue: "",
+      keepAttr: !0,
+      allowedAttributes: d,
+      forceKeepAttr: void 0
+    };
+    let f = t.length;
+    for (; f--; ) {
+      const _ = t[f], {
+        name: m,
+        namespaceURI: D,
+        value: L
+      } = _, P = p(m), Ne = L;
+      let E = m === "value" ? Ne : Kt(Ne);
+      if (n.attrName = P, n.attrValue = E, n.keepAttr = !0, n.forceKeepAttr = void 0, w(h.uponSanitizeAttribute, e, n), E = n.attrValue, $e && (P === "id" || P === "name") && (U(m, e), E = Ut + E), $ && A(/((--!?|])>)|<\/(style|script|title|xmp|textarea|noscript|iframe|noembed|noframes)/i, E)) {
+        U(m, e);
+        continue;
+      }
+      if (P === "attributename" && we(E, "href")) {
+        U(m, e);
+        continue;
+      }
+      if (n.forceKeepAttr)
+        continue;
+      if (!n.keepAttr) {
+        U(m, e);
+        continue;
+      }
+      if (!je && A(/\/>/i, E)) {
+        U(m, e);
+        continue;
+      }
+      k && Z([ae, re, se], (ct) => {
+        E = B(E, ct, " ");
+      });
+      const lt = p(e.nodeName);
+      if (!it(lt, P, E)) {
+        U(m, e);
+        continue;
+      }
+      if (g && typeof oe == "object" && typeof oe.getAttributeType == "function" && !D)
+        switch (oe.getAttributeType(lt, P)) {
+          case "TrustedHTML": {
+            E = g.createHTML(E);
+            break;
+          }
+          case "TrustedScriptURL": {
+            E = g.createScriptURL(E);
+            break;
+          }
+        }
+      if (E !== Ne)
+        try {
+          D ? e.setAttributeNS(D, m, E) : e.setAttribute(m, E), Ce(e) ? y(e) : ut(o.removed);
+        } catch {
+          U(m, e);
+        }
+    }
+    w(h.afterSanitizeAttributes, e, null);
+  }, st = function(e) {
+    let t = null;
+    const n = nt(e);
+    for (w(h.beforeSanitizeShadowDOM, e, null); t = n.nextNode(); )
+      w(h.uponSanitizeShadowNode, t, null), ot(t), rt(t), t.content instanceof O && st(t.content);
+    w(h.afterSanitizeShadowDOM, e, null);
+  };
+  return o.sanitize = function(i) {
+    let e = arguments.length > 1 && arguments[1] !== void 0 ? arguments[1] : {}, t = null, n = null, f = null, _ = null;
+    if (Le = !i, Le && (i = "<!-->"), typeof i != "string" && !Ie(i))
+      if (typeof i.toString == "function") {
+        if (i = i.toString(), typeof i != "string")
+          throw Q("dirty is not a string, aborting");
+      } else
+        throw Q("toString is not a function");
+    if (!o.isSupported)
+      return i;
+    if (Ae || ye(e), o.removed = [], typeof i == "string" && (q = !1), q) {
+      if (i.nodeName) {
+        const L = p(i.nodeName);
+        if (!T[L] || V[L])
+          throw Q("root node is forbidden and cannot be sanitized in-place");
+      }
+    } else if (i instanceof _e)
+      t = tt("<!---->"), n = t.ownerDocument.importNode(i, !0), n.nodeType === te.element && n.nodeName === "BODY" || n.nodeName === "HTML" ? t = n : t.appendChild(n);
+    else {
+      if (!H && !k && !v && // eslint-disable-next-line unicorn/prefer-includes
+      i.indexOf("<") === -1)
+        return g && fe ? g.createHTML(i) : i;
+      if (t = tt(i), !t)
+        return H ? null : fe ? j : "";
+    }
+    t && Se && y(t.firstChild);
+    const m = nt(q ? i : t);
+    for (; f = m.nextNode(); )
+      ot(f), rt(f), f.content instanceof O && st(f.content);
+    if (q)
+      return i;
+    if (H) {
+      if (k) {
+        t.normalize();
+        let L = t.innerHTML;
+        Z([ae, re, se], (P) => {
+          L = B(L, P, " ");
+        }), t.innerHTML = L;
+      }
+      if (ce)
+        for (_ = Nt.call(t.ownerDocument); t.firstChild; )
+          _.appendChild(t.firstChild);
+      else
+        _ = t;
+      return (d.shadowroot || d.shadowrootmode) && (_ = wt.call(a, _, !0)), _;
+    }
+    let D = v ? t.outerHTML : t.innerHTML;
+    return v && T["!doctype"] && t.ownerDocument && t.ownerDocument.doctype && t.ownerDocument.doctype.name && A(At, t.ownerDocument.doctype.name) && (D = "<!DOCTYPE " + t.ownerDocument.doctype.name + `>
+` + D), k && Z([ae, re, se], (L) => {
+      D = B(D, L, " ");
+    }), g && fe ? g.createHTML(D) : D;
+  }, o.setConfig = function() {
+    let i = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : {};
+    ye(i), Ae = !0;
+  }, o.clearConfig = function() {
+    W = null, Ae = !1;
+  }, o.isValidAttribute = function(i, e, t) {
+    W || ye({});
+    const n = p(i), f = p(e);
+    return it(n, f, t);
+  }, o.addHook = function(i, e) {
+    typeof e == "function" && J(h[i], e);
+  }, o.removeHook = function(i, e) {
+    if (e !== void 0) {
+      const t = Vt(h[i], e);
+      return t === -1 ? void 0 : $t(h[i], t, 1)[0];
+    }
+    return ut(h[i]);
+  }, o.removeHooks = function(i) {
+    h[i] = [];
+  }, o.removeAllHooks = function() {
+    h = _t();
+  }, o;
+}
+var mn = St();
+export {
+  mn as default
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@isi-ui7/bos7-shared",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "Shared auth7 and layout primitives for bos7 applications.",
   "license": "MIT",
   "repository": {
@@ -119,6 +119,7 @@
   ],
   "scripts": {
     "build": "vite build",
+    "prepublishOnly": "pnpm run build",
     "lint": "eslint \"src/**/*.{ts,tsx}\"",
     "test": "vitest run --passWithNoTests",
     "typecheck": "tsc --noEmit"

package/src/form-types.ts

@@ -171,7 +171,31 @@ export type FormPageDef<TData extends Record<string, unknown>> = {
 export type FormLayout<TData extends Record<string, unknown>> =
   | { type: "single-page"; sections: FormSection<TData>[] }
   | { type: "tabs"; pages: FormPageDef<TData>[] }
-  | { type: "wizard"; pages: FormPageDef<TData>[]; validateOnNext?: boolean };
+  | {
+      type: "wizard";
+      pages: FormPageDef<TData>[];
+      validateOnNext?: boolean;
+      /**
+       * Gerbang antar-langkah. Dipanggil SEBELUM pindah dari `fromPage`;
+       * mengembalikan `{ ok: false, message }` membatalkan navigasi dan
+       * menampilkan pesannya.
+       *
+       * Ada karena sebagian wizard punya langkah yang berfungsi sebagai
+       * GERBANG, bukan sekadar formulir — mis. registrasi nasabah: verifikasi
+       * identitas di Langkah 1 harus berhasil sebelum data lengkap boleh
+       * diisi, supaya dua CIF untuk satu orang tidak pernah terbentuk.
+       *
+       * Tanpa ini, satu-satunya cara menegakkannya adalah membangun wizard
+       * bespoke per layar — dan ada EMPAT layar registrasi (perorangan,
+       * badan usaha, WIC perorangan, WIC badan usaha) yang butuh gerbang yang
+       * sama persis.
+       *
+       * ⚠️ Ini penjaga NAVIGASI, bukan penjaga keamanan. Ia mencegah operator
+       * melangkah lebih jauh; ia TIDAK mencegah payload dikirim langsung ke
+       * backend. Aturan yang sama WAJIB ditegakkan lagi di server.
+       */
+      canLeavePage?: (fromPage: number, data: TData) => { ok: boolean; message?: string };
+    };
 
 // ── CrudForm (schema-driven) ──────────────────────────────────────────────────