@sankhyalabs/ezui 7.3.2 → 7.3.3

package/dist/esm/ez-tile.entry.js

@@ -1,4 +1,4 @@
-import { r as registerInstance, c as createEvent, h, H as Host, g as getElement } from './index-5a720e56.js';
+import { r as registerInstance, c as createEvent, h, H as Host, g as getElement } from './index-baa5e267.js';
 import { ElementIDUtils } from '@sankhyalabs/core';
 
 const ezTileCss = ":host{--ez-tile--width:120px;--ez-tile--height:80px;--ez-tile--padding:var(--space--12, 12px);--ez-tile--icon--margin-bottom:var(--space--8);--ez-tile--border-radius:var(--border--radius-16, 16px);--ez-tile--background-color:var(--color--gray-70, #ffffff);--ez-tile--color:var(--color--ocean-green-900, #003D2D);--ez-tile--icon-color:var(--color--ocean-green-400, #42A58A);--ez-tile--hover-background-color:var(--color--gray-80, #F9F9F9);--ez-tile--hover-color:var(--color--ocean-green-900, #003D2D);--ez-tile--hover-icon-color:var(--color--ocean-green-400, #42A58A);--ez-tile--focus-visible-border:2px solid var(--color--petroleum-400, #626D80);--ez-tile--font-family:var(--font-pattern, Arial);--ez-tile--font-weight:var(--font-weight--regular, 400);--ez-tile--font-size:var(--font-size--default, 14px);--ez-tile--title-line-height:var(--line-height--20, 20px);--ez-tile--icon-line-height:var(--line-height--24, 24px)}button{display:flex;flex-wrap:wrap;align-content:space-between;overflow:hidden;outline:none;box-shadow:none;width:var(--ez-tile--custom-width, var(--ez-tile--width));height:var(--ez-tile--custom-height, var(--ez-tile--height));border-radius:var(--ez-tile--border-radius);background-color:var(--ez-tile--background-color);color:var(--ez-tile--color);box-sizing:border-box;padding:var(--ez-tile--padding);border:2px solid var(--ez-tile--background-color)}button:focus-visible{border:var(--ez-tile--focus-visible-border)}.medium{--ez-tile--width:var(--ez-tile--custom-width, 120px);--ez-tile--height:var(--ez-tile--custom-height, 170px)}.isInteractive:hover,.isInteractive:focus{--ez-icon--color:var(--ez-tile--hover-icon-color);--ez-tile--background-color:var(--ez-tile--hover-background-color);--ez-tile--color:var(--ez-tile--hover-color);cursor:pointer}span{-webkit-line-clamp:var(--ez-tile--custom-maximum-lines, 1);line-clamp:var(--ez-tile--custom-maximum-lines,1);font-family:var(--ez-tile--font-family);font-weight:var(--ez-tile--font-weight);font-size:var(--ez-tile--font-size);line-height:var(--ez-tile--title-line-height);display:-webkit-box;-webkit-box-orient:vertical;width:100%;overflow:hidden;text-overflow:ellipsis;text-align:left;white-space:pre-wrap}ez-icon{--ez-icon--color:var(--ez-tile--icon-color);margin-bottom:var(--ez-tile--icon--margin-bottom);line-height:var(--ez-tile--icon-line-height)}.isInteractive:hover,.isInteractive:focus{outline:none}.green{--ez-tile--background-color:var(--color--ocean-green-90);--ez-tile--icon-color:var(--color--ocean-green-500)}.isInteractive.green:hover,.isInteractive.green:focus{--ez-tile--hover-background-color:var(--color--ocean-green-100);--ez-tile--icon-color:var(--color--ocean-green-500);outline:none}.gray{--ez-tile--background-color:var(--color--gray-80);--ez-tile--icon-color:var(--color--ocean-green-400)}.isInteractive.gray:hover,.isInteractive.gray:focus{--ez-tile--hover-background-color:var(--color--gray-90);--ez-tile--hover-icon-color:var(--color--ocean-green-400)}.red{--ez-tile--background-color:var(--color--red-100);--ez-tile--icon-color:var(--color--red-300)}.isInteractive.red:hover,.isInteractive.red:focus{--ez-tile--hover-background-color:var(--color--red-200);--ez-tile--hover-icon-color:var(--color--red-300)}.yellow{--ez-tile--background-color:var(--color--yellow-100);--ez-tile--icon-color:var(--color--yellow-400)}.isInteractive.yellow:hover,.isInteractive.yellow:focus{--ez-tile--hover-background-color:var(--color--yellow-200);--ez-tile--hover-icon-color:var(--color--yellow-400)}";

package/dist/esm/ez-time-input.entry.js

@@ -1,4 +1,4 @@
-import { r as registerInstance, c as createEvent, h, H as Host, g as getElement } from './index-5a720e56.js';
+import { r as registerInstance, c as createEvent, h, H as Host, g as getElement } from './index-baa5e267.js';
 import { TimeFormatter, MaskFormatter, NumberUtils, ElementIDUtils } from '@sankhyalabs/core';
 import { C as CSSVarsUtils } from './CSSVarsUtils-acba92d7.js';
 import { i as initI18n } from './index-41363fa6.js';

package/dist/esm/ez-toast.entry.js

@@ -1,4 +1,4 @@
-import { r as registerInstance, f as forceUpdate, h, H as Host, g as getElement } from './index-5a720e56.js';
+import { r as registerInstance, f as forceUpdate, h, H as Host, g as getElement } from './index-baa5e267.js';
 import { ElementIDUtils } from '@sankhyalabs/core';
 
 const ezToastCss = ":host{--ez-toast__btn__close__image:url('data:image/svg+xml;utf8,<svg width=\"12\" height=\"12\" viewBox=\"0 0 12 12\" xmlns=\"http://www.w3.org/2000/svg%22%3E<path d=\"M 7.0060773,5.995511 11.461972,1.5397722 c 0.132856,-0.1328413 0.207547,-0.3130253 0.207547,-0.5009046 0,-0.18786999 -0.07469,-0.3680541 -0.207547,-0.5009048 -0.132857,-0.13284126 -0.31302,-0.20748126 -0.500927,-0.20748126 -0.187812,0 -0.36807,0.07464 -0.500926,0.20748126 L 6.0042244,4.9937015 1.5482921,0.5379628 C 1.4154357,0.40512154 1.2352533,0.33048154 1.0473657,0.33048154 c -0.18787813,0 -0.36807,0.07464 -0.50092647,0.20748126 -0.13285646,0.1328507 -0.20749026,0.31303481 -0.20749026,0.5009048 0,0.1878793 0.0746338,0.3680633 0.20749026,0.5009046 L 5.0023715,5.995511 0.54643923,10.452213 c -0.0676086,0.06534 -0.12151598,0.14352 -0.15859681,0.229916 -0.0370714,0.08639 -0.0565645,0.1794 -0.0573369,0.27335 -7.724e-4,0.09404 0.0171873,0.187331 0.0528423,0.274293 0.0356455,0.08705 0.0882688,0.166087 0.15479148,0.23256 0.0665321,0.06648 0.14562277,0.11897 0.2326735,0.154567 0.0870507,0.0356 0.18031463,0.05344 0.2743433,0.05259 0.094029,-8.5e-4 0.1869528,-0.02049 0.2733331,-0.0576 0.08639,-0.0372 0.1645078,-0.09121 0.2298029,-0.158817 L 6.0042244,6.9973204 10.460119,11.453078 c 0.132856,0.132851 0.313114,0.207444 0.500926,0.207444 0.187907,0 0.36807,-0.07459 0.500927,-0.207444 0.132856,-0.13285 0.207547,-0.313006 0.207547,-0.500904 0,-0.187898 -0.07469,-0.368054 -0.207547,-0.500905 z\"/></svg>');--ez-toast__container--z-index:var(--elevation--100, 100);--ez-toast__container--background-color:var(--color--secondary, #383c45);--ez-toast__container--left:var(--space--large, 24px);--ez-toast__container--bottom:var(--space--large, 24px);--ez-toast__container--width:400px;--ez-toast__icon--padding-left:var(--space--small, 6px)}.toast__container{position:fixed;display:flex;box-sizing:border-box;border-radius:6px;align-items:center;padding:12px;visibility:hidden;width:var(--ez-toast__container--width);left:var(--ez-toast__container--left);bottom:var(--ez-toast__container--bottom);z-index:var(--ez-toast__container--z-index);background-color:var(--ez-toast__container--background-color)}.message__container{text-shadow:0 0 0 #353535, 0 0 1px transparent;color:#FFFFFF;font-size:14px;width:90%;overflow:hidden;hyphens:auto;height:auto;-webkit-box-orient:vertical;-webkit-line-clamp:4;display:-webkit-box;text-overflow:ellipsis;font-family:var(--font-pattern, \"Roboto\")}.message__container--icon{width:80%;padding-left:var(--ez-toast__icon--padding-left)}.btn-close{margin-top:3px;display:flex;justify-content:flex-end;align-self:flex-start;padding:0;outline:none;width:10%;border:none;background-color:unset;cursor:pointer}.btn-close::after{content:'';display:flex;background-color:#FFFFFF;width:12px;height:12px;-webkit-mask-image:var(--ez-toast__btn__close__image);mask-image:var(--ez-toast__btn__close__image)}.toast__container--opened{animation:fadein 0.5s, fadeout 0.5s 3s;visibility:visible}@-webkit-keyframes fadein{from{opacity:0;left:calc(var(--ez-toast__container--left) * -1)}to{opacity:1;left:var(--ez-toast__container--left)}}@keyframes fadein{from{opacity:0;left:calc(var(--ez-toast__container--left) * -1)}to{opacity:1;left:var(--ez-toast__container--left)}}@-webkit-keyframes fadeout{from{opacity:1;left:var(--ez-toast__container--left)}to{bottom:0;opacity:0}}@keyframes fadeout{from{opacity:1;left:var(--ez-toast__container--left)}to{bottom:0;opacity:0}}";

package/dist/esm/ez-tooltip.entry.js

@@ -1,4 +1,4 @@
-import { r as registerInstance, h, H as Host, g as getElement } from './index-5a720e56.js';
+import { r as registerInstance, h, H as Host, g as getElement } from './index-baa5e267.js';
 import { b as autoUpdate, c as computePosition, o as offset, f as flip, s as shift, d as arrow } from './floating-ui.dom.esm-c94d4011.js';
 import { ElementIDUtils } from '@sankhyalabs/core';
 

package/dist/esm/ez-tree.entry.js

@@ -1,4 +1,4 @@
-import { h, r as registerInstance, c as createEvent, f as forceUpdate, H as Host, g as getElement } from './index-5a720e56.js';
+import { h, r as registerInstance, c as createEvent, f as forceUpdate, H as Host, g as getElement } from './index-baa5e267.js';
 import { ElementIDUtils, StringUtils, ObjectUtils } from '@sankhyalabs/core';
 import { i as initI18n } from './index-41363fa6.js';
 

package/dist/esm/ez-underface.entry.js

@@ -1,4 +1,4 @@
-import { r as registerInstance, h, H as Host, g as getElement } from './index-5a720e56.js';
+import { r as registerInstance, h, H as Host, g as getElement } from './index-baa5e267.js';
 import { ElementIDUtils } from '@sankhyalabs/core';
 
 const ezUnderfaceCss = ":host{--ez-underface--width:693px;--ez-underface--height:247px;--ez-underface--padding:var(--space--24, 24px);--ez-underface--border-radius:var(--border--radius-26, 26px)}div{width:var(--ez-underface--custom-width, var(--ez-underface--width));height:var(--ez-underface--custom-height, var(--ez-underface--height));border-radius:var(--ez-underface--border-radius);padding:var(--ez-underface--padding);display:block;overflow:hidden;outline:none;box-shadow:none;border:none;box-sizing:border-box;background-color:var(--ez-underface--custom-background-color, var(--color--petroleum-700, #222D42))}.light-green{background-color:var(--ez-underface--custom-background-color, var(--color--ocean-green-90))}.green{background-color:var(--ez-underface--custom-background-color, var(--color--green-600))}.light-gray{background-color:var(--ez-underface--custom-background-color, var(--color--gray-80))}.dark-petroleum{background-color:var(--ez-underface--custom-background-color, var(--color--petroleum-900))}.ocean-green{background-color:var(--ez-underface--custom-background-color, var(--color--ocean-green-600))}";

package/dist/esm/ez-upload.entry.js

@@ -1,4 +1,4 @@
-import { r as registerInstance, c as createEvent, f as forceUpdate, h, g as getElement } from './index-5a720e56.js';
+import { r as registerInstance, c as createEvent, f as forceUpdate, h, g as getElement } from './index-baa5e267.js';
 import { ElementIDUtils } from '@sankhyalabs/core';
 import { A as ApplicationUtils } from './ApplicationUtils-1569f757.js';
 import { i as initI18n } from './index-41363fa6.js';

package/dist/esm/ez-view-stack.entry.js

@@ -1,4 +1,4 @@
-import { r as registerInstance, h, g as getElement, H as Host } from './index-5a720e56.js';
+import { r as registerInstance, h, g as getElement, H as Host } from './index-baa5e267.js';
 import { JSUtils, ElementIDUtils } from '@sankhyalabs/core';
 
 const ezViewStackCss = ":host{width:100%;height:100%}.ez-view-stack__container{width:100%;height:100%}";

package/dist/esm/ezui.js

@@ -1,5 +1,5 @@
-import { p as promiseResolve, b as bootstrapLazy } from './index-5a720e56.js';
-export { s as setNonce } from './index-5a720e56.js';
+import { p as promiseResolve, b as bootstrapLazy } from './index-baa5e267.js';
+export { s as setNonce } from './index-baa5e267.js';
 import { g as globalScripts } from './app-globals-c0ac93c0.js';
 import './index-41363fa6.js';
 import '@sankhyalabs/core';

package/dist/esm/filter-column.entry.js

@@ -1,4 +1,4 @@
-import { r as registerInstance, c as createEvent, h } from './index-5a720e56.js';
+import { r as registerInstance, c as createEvent, h } from './index-baa5e267.js';
 import { UserInterface } from '@sankhyalabs/core';
 import { a as PRESENTATION_FROM_COL_PROP_NAME } from './constants-3fabe81e.js';
 import { i as initI18n } from './index-41363fa6.js';

package/dist/esm/{index-5a720e56.js → index-baa5e267.js}

@@ -2362,8 +2362,6 @@ const loadModule = (cmpMeta, hostRef, hmrVersionId) => {
 const styles = /*@__PURE__*/ new Map();
 const win = typeof window !== 'undefined' ? window : {};
 const doc = win.document || { head: {} };
-const H = (win.HTMLElement || class {
-});
 const plt = {
     $flags$: 0,
     $resourcesUrl$: '',
@@ -2426,4 +2424,4 @@ const flush = () => {
 const nextTick = /*@__PURE__*/ (cb) => promiseResolve().then(cb);
 const writeTask = /*@__PURE__*/ queueTask(queueDomWrites, true);
 
-export { Fragment as F, Host as H, H as a, bootstrapLazy as b, createEvent as c, forceUpdate as f, getElement as g, h, promiseResolve as p, registerInstance as r, setNonce as s };
+export { Fragment as F, Host as H, bootstrapLazy as b, createEvent as c, forceUpdate as f, getElement as g, h, promiseResolve as p, registerInstance as r, setNonce as s };

package/dist/esm/loader.js

@@ -1,5 +1,5 @@
-import { p as promiseResolve, b as bootstrapLazy } from './index-5a720e56.js';
-export { s as setNonce } from './index-5a720e56.js';
+import { p as promiseResolve, b as bootstrapLazy } from './index-baa5e267.js';
+export { s as setNonce } from './index-baa5e267.js';
 import { g as globalScripts } from './app-globals-c0ac93c0.js';
 import './index-41363fa6.js';
 import '@sankhyalabs/core';

package/dist/esm/{purify-055bfb9f.js → purify-ca96ec34.js}

@@ -1,7 +1,7 @@
 import { c as createCommonjsModule, a as commonjsGlobal } from './_commonjsHelpers-9943807e.js';
 
 var purify = createCommonjsModule(function (module, exports) {
-/*! @license DOMPurify 3.4.12 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.4.12/LICENSE */
+/*! @license DOMPurify 3.4.13 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.4.13/LICENSE */
 
 (function (global, factory) {
   module.exports = factory() ;
@@ -429,7 +429,7 @@ var purify = createCommonjsModule(function (module, exports) {
   function createDOMPurify() {
     let window = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : getGlobal();
     const DOMPurify = root => createDOMPurify(root);
-    DOMPurify.version = '3.4.12';
+    DOMPurify.version = '3.4.13';
     DOMPurify.removed = [];
     if (!window || !window.document || window.document.nodeType !== NODE_TYPE.document || !window.Element) {
       // Not running in a browser, provide a factory function
@@ -456,6 +456,7 @@ var purify = createCommonjsModule(function (module, exports) {
     const getAttributes = lookupGetter(ElementPrototype, 'attributes');
     const getNodeType = Node && Node.prototype ? lookupGetter(Node.prototype, 'nodeType') : null;
     const getNodeName = Node && Node.prototype ? lookupGetter(Node.prototype, 'nodeName') : null;
+    const getOwnerDocument = Node && Node.prototype ? lookupGetter(Node.prototype, 'ownerDocument') : null;
     // As per issue #47, the web-components registry is inherited by a
     // new document created via createHTMLDocument. As per the spec
     // (http://w3c.github.io/webcomponents/spec/custom/#creating-and-passing-registries)
@@ -1374,7 +1375,17 @@ var purify = createCommonjsModule(function (module, exports) {
      * @return The created NodeIterator
      */
     const _createNodeIterator = function _createNodeIterator(root) {
-      return createNodeIterator.call(root.ownerDocument || root, root,
+      /* Read ownerDocument through the cached Node.prototype getter, never the
+         direct property. HTMLFormElement has [LegacyOverrideBuiltIns], so a
+         clobbering child (<input name="ownerDocument"> or a form-associated
+         external input) shadows the prototype getter and makes a direct read
+         return that <input>. createNodeIterator.call(<input>, ...) then throws
+         "Illegal invocation", and on the IN_PLACE path that throw lands before
+         the walk's fail-closed barrier - leaving the caller's live tree, with
+         any already-armed handler in it, un-neutralized. The cached getter
+         returns the real Document regardless of the clobber. */
+      const doc = getOwnerDocument ? getOwnerDocument(root) : root.ownerDocument;
+      return createNodeIterator.call(doc || root, root,
       // eslint-disable-next-line no-bitwise
       NodeFilter.SHOW_ELEMENT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_TEXT | NodeFilter.SHOW_PROCESSING_INSTRUCTION | NodeFilter.SHOW_CDATA_SECTION, null);
     };
@@ -1414,7 +1425,11 @@ var purify = createCommonjsModule(function (module, exports) {
     const _scrubTemplateExpressions2 = function _scrubTemplateExpressions(node) {
       var _node$querySelectorAl;
       node.normalize();
-      const walker = createNodeIterator.call(node.ownerDocument || node, node,
+      /* Clobber-safe ownerDocument read, same reasoning as _createNodeIterator:
+         under SAFE_FOR_TEMPLATES this runs on the live IN_PLACE root, which may
+         carry a form-named-getter override of ownerDocument. */
+      const doc = getOwnerDocument ? getOwnerDocument(node) : node.ownerDocument;
+      const walker = createNodeIterator.call(doc || node, node,
       // eslint-disable-next-line no-bitwise
       NodeFilter.SHOW_TEXT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_CDATA_SECTION | NodeFilter.SHOW_PROCESSING_INSTRUCTION, null);
       let currentNode = walker.nextNode();
@@ -1581,7 +1596,7 @@ var purify = createCommonjsModule(function (module, exports) {
      * @param tagName the node's transformCaseFunc'd tag name
      * @return true if the node was removed, false if kept
      */
-    const _sanitizeDisallowedNode = function _sanitizeDisallowedNode(currentNode, tagName) {
+    const _sanitizeDisallowedNode = function _sanitizeDisallowedNode(currentNode, tagName, root) {
       /* Check if we have a custom element to handle */
       if (!FORBID_TAGS[tagName] && _isBasicCustomElement(tagName)) {
         if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)) {
@@ -1604,27 +1619,26 @@ var purify = createCommonjsModule(function (module, exports) {
         const childNodes = getChildNodes(currentNode);
         if (childNodes && parentNode) {
           const childCount = childNodes.length;
-          /* In-place: hoist the *original* children so the iterator visits
-               and sanitises them through the same allowlist pass as every other
-               node. The caller built the tree in the live document, so the
-               originals carry already-queued resource events (`<img onerror>`,
-               `<video>`/`<audio>` error, lazy/`onload`, …); cloning would leave
-               those originals detached but still armed, firing in page scope
-               while the returned tree looked clean. Moving is safe in-place: the
-               root is pre-validated as an allowed tag and so is never the node
-               being removed, which keeps `parentNode` inside the iterator root
-               and the relocated child inside the serialised tree.
-                        Otherwise (string / DOM-copy paths): clone. The iterator is rooted
-               at — and the result serialised from — `body`, so a restrictive
-               ALLOWED_TAGS that removes `body` itself must leave its content in
-               place, which only cloning does; and those paths parse into an
-               inert document, so their discarded originals never had a queued
-               event to neutralise.
+          /* Hoist by moving each child up one level rather than deep-cloning
+               it. Moving transfers every descendant exactly once, so a chain of
+               nested disallowed elements costs O(n) instead of the O(n^2) that
+               re-cloning the shrinking subtree at each level produced; it also
+               empties the removed original, so `DOMPurify.removed` no longer
+               pins whole subtrees. Moving preserves the in-place guarantee too:
+               an original carrying already-queued resource events (`<img
+               onerror>`, `<video>`/`<audio>` error, lazy/`onload`, …) is
+               relocated and sanitised rather than left detached but still armed.
+                        The sole case that must clone is removing the walk root itself.
+               The result is serialised from the root's subtree, so a restrictive
+               ALLOWED_TAGS that strips the root (`body` on the string path) must
+               leave the content inside it, which only cloning does. In IN_PLACE
+               the root is pre-validated as an allowed tag and so is never removed
+               here, so that path always takes the move branch.
                         `childNodes` is live; a tail-to-head walk keeps `childNodes[i]`
                valid whether we move (drops the trailing entry) or clone (leaves
                the list intact). */
           for (let i = childCount - 1; i >= 0; --i) {
-            const hoisted = IN_PLACE ? childNodes[i] : cloneNode(childNodes[i], true);
+            const hoisted = currentNode === root ? cloneNode(childNodes[i], true) : childNodes[i];
             parentNode.insertBefore(hoisted, getNextSibling(currentNode));
           }
         }
@@ -1632,6 +1646,26 @@ var purify = createCommonjsModule(function (module, exports) {
       _forceRemove(currentNode);
       return true;
     };
+    /**
+     * Fork a hook-mutable allowlist off its shared binding the first time a
+     * (possibly lazily-installed) uponSanitize* hook is about to see it, so the
+     * hook cannot widen the per-instance default or the setConfig binding by
+     * reference and leak past the call. Returns the set unchanged once it is
+     * already call-local, so repeated calls across elements are idempotent.
+     *
+     * @param hookList the uponSanitize* hook array for this event
+     * @param set the current ALLOWED_TAGS / ALLOWED_ATTR binding
+     * @param defaultSet the per-instance DEFAULT_ALLOWED_* constant
+     * @param setConfigSet the captured setConfig() binding, or null
+     * @return a call-local clone if a hook is present and set is still shared,
+     *   else set unchanged
+     */
+    const _forkSharedAllowlist = function _forkSharedAllowlist(hookList, set, defaultSet, setConfigSet) {
+      if (hookList.length === 0) {
+        return set;
+      }
+      return set === defaultSet || set === setConfigSet ? clone(set) : set;
+    };
     /**
      * _sanitizeElements
      *
@@ -1645,9 +1679,14 @@ var purify = createCommonjsModule(function (module, exports) {
     const _sanitizeElements = function _sanitizeElements(currentNode, root) {
       /* Execute a hook if present */
       _executeHooks(hooks.beforeSanitizeElements, currentNode, null);
-      /* A hook may have detached the node — treat it as removed (see the
-         detached-node comment after the uponSanitizeElement hook below). */
+      /* A hook may have detached the node - treat it as removed (see the
+         detached-node comment after the uponSanitizeElement hook below). On
+         the IN_PLACE path, neutralize the detached subtree first so a queued
+         resource handler on it cannot fire in page scope after we return. */
       if (currentNode !== root && getParentNode(currentNode) === null) {
+        if (IN_PLACE) {
+          _neutralizeSubtree(currentNode);
+        }
         return true;
       }
       /* Check if element is clobbered or can clobber */
@@ -1657,6 +1696,12 @@ var purify = createCommonjsModule(function (module, exports) {
       }
       /* Now let's check the element's type and name */
       const tagName = transformCaseFunc(getNodeName ? getNodeName(currentNode) : currentNode.nodeName);
+      /* Close the pre-walk clone-guard's timing gap: an uponSanitizeElement
+         hook may have been installed after that guard sampled the hook arrays
+         (e.g. lazily from beforeSanitizeElements), leaving ALLOWED_TAGS still
+         aliasing a shared binding that a widening hook would mutate by
+         reference. Fork it before exposing it to the hook. */
+      ALLOWED_TAGS = _forkSharedAllowlist(hooks.uponSanitizeElement, ALLOWED_TAGS, DEFAULT_ALLOWED_TAGS, SET_CONFIG_ALLOWED_TAGS);
       /* Execute a hook if present */
       _executeHooks(hooks.uponSanitizeElement, currentNode, {
         tagName,
@@ -1674,10 +1719,22 @@ var purify = createCommonjsModule(function (module, exports) {
          opposite of a node that is already safely gone. The walk root is
          exempt: a detached IN_PLACE root is legitimate input and must still
          be fully sanitized, and a kill-decision on it must keep hitting the
-         REPORT-3 throw. Nodes detached by hooks are the hook's
-         responsibility: they are not recorded in DOMPurify.removed and are
-         not neutralized by the post-walk IN_PLACE pass. */
+         REPORT-3 throw. Nodes detached by hooks stay the hook's
+         responsibility for placement: they are not recorded in
+         DOMPurify.removed, so the post-walk IN_PLACE pass (which iterates
+         DOMPurify.removed) does not reach them. But a hook-detached subtree
+         can still hold a queued resource-event handler - e.g. an <img onload>
+         that began loading when the caller built the live tree - which fires
+         in page scope after sanitize returns even though the handler never
+         reached the returned tree. That is the audit-5 F1 hazard, and the
+         documented node.remove() hook pattern walks straight into it. So on
+         the IN_PLACE path we neutralize the detached subtree inline here,
+         stripping its non-allow-listed attributes before returning, exactly
+         as the post-walk pass does for _forceRemove'd subtrees. */
       if (currentNode !== root && getParentNode(currentNode) === null) {
+        if (IN_PLACE) {
+          _neutralizeSubtree(currentNode);
+        }
         return true;
       }
       /* Remove mXSS vectors, processing instructions and risky comments */
@@ -1687,7 +1744,7 @@ var purify = createCommonjsModule(function (module, exports) {
       }
       /* Remove element if anything forbids its presence */
       if (FORBID_TAGS[tagName] || !(EXTRA_ELEMENT_HANDLING.tagCheck instanceof Function && EXTRA_ELEMENT_HANDLING.tagCheck(tagName)) && !ALLOWED_TAGS[tagName]) {
-        const removed = _sanitizeDisallowedNode(currentNode, tagName);
+        const removed = _sanitizeDisallowedNode(currentNode, tagName, root);
         /* A false return means the node is a custom element kept via
            CUSTOM_ELEMENT_HANDLING - the only keep path through
            _sanitizeDisallowedNode. Run afterSanitizeElements on it so the
@@ -1892,6 +1949,9 @@ var purify = createCommonjsModule(function (module, exports) {
       if (!attributes || _isClobbered(currentNode)) {
         return;
       }
+      /* Same lazy-install guard as uponSanitizeElement (see there): fork the
+         attribute allowlist off its shared binding before a hook can see it. */
+      ALLOWED_ATTR = _forkSharedAllowlist(hooks.uponSanitizeAttribute, ALLOWED_ATTR, DEFAULT_ALLOWED_ATTR, SET_CONFIG_ALLOWED_ATTR);
       const hookEvent = {
         attrName: '',
         attrValue: '',
@@ -2264,17 +2324,20 @@ var purify = createCommonjsModule(function (module, exports) {
       }
       /* Get node iterator */
       const walkRoot = inPlace ? dirty : body;
-      const nodeIterator = _createNodeIterator(walkRoot);
       /* Now start iterating over the created document.
          The walk runs inside an exception barrier (campaign-3 F2): a re-entrant
          engine/custom-element mutation can detach a node mid-walk so
          `_forceRemove`'s parentless guard throws, aborting the loop. Without the
          barrier the caller's in-place tree would be left half-sanitized with the
-         unvisited tail still armed. On any throw we fail closed — strip the
-         in-place root bare — then rethrow so the existing throw contract is
-         preserved. (String/DOM-copy paths never return the partial body, so the
-         propagating throw is already fail-closed there.) */
+         unvisited tail still armed. _createNodeIterator itself is inside the
+         barrier too: constructing the iterator dereferences the root's document,
+         and any failure there (e.g. an exotic/clobbered root) must still fail
+         closed rather than skip the neutralize. On any throw we fail closed -
+         strip the in-place root bare - then rethrow so the existing throw
+         contract is preserved. (String/DOM-copy paths never return the partial
+         body, so the propagating throw is already fail-closed there.) */
       try {
+        const nodeIterator = _createNodeIterator(walkRoot);
         while (currentNode = nodeIterator.nextNode()) {
           /* Sanitize tags and elements */
           _sanitizeElements(currentNode, walkRoot);

package/dist/esm/{search-column-8b9d1486.js → search-column-c20d2b01.js}

@@ -1,7 +1,7 @@
 import { UserInterface, Action, StringUtils, ApplicationContext, ObjectUtils, WaitingChangeException, DataUnitAction } from '@sankhyalabs/core';
 import { A as ApplicationUtils } from './ApplicationUtils-1569f757.js';
 import { g as getI18n } from './index-41363fa6.js';
-import { h } from './index-5a720e56.js';
+import { h } from './index-baa5e267.js';
 
 const isSystemRequired = (descriptor) => {
   var _a;