thunderous 0.4.2 → 0.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/index.js CHANGED
@@ -9,9 +9,9 @@ var parseFragment = (htmlStr) => {
9
9
  range.selectNode(document.body);
10
10
  return range.createContextualFragment(htmlStr);
11
11
  };
12
- var setInnerHTML = (element, html2) => {
12
+ var setInnerHTML = (element, html3) => {
13
13
  clearHTML(element);
14
- const fragment = typeof html2 === "string" ? parseFragment(html2) : html2;
14
+ const fragment = typeof html3 === "string" ? parseFragment(html3) : html3;
15
15
  element.append(fragment);
16
16
  };
17
17
 
@@ -100,9 +100,973 @@ var createEffect = (fn) => {
100
100
  subscriber = null;
101
101
  };
102
102
 
103
+ // node_modules/dompurify/dist/purify.es.mjs
104
+ var {
105
+ entries,
106
+ setPrototypeOf,
107
+ isFrozen,
108
+ getPrototypeOf,
109
+ getOwnPropertyDescriptor
110
+ } = Object;
111
+ var {
112
+ freeze,
113
+ seal,
114
+ create
115
+ } = Object;
116
+ var {
117
+ apply,
118
+ construct
119
+ } = typeof Reflect !== "undefined" && Reflect;
120
+ if (!freeze) {
121
+ freeze = function freeze2(x) {
122
+ return x;
123
+ };
124
+ }
125
+ if (!seal) {
126
+ seal = function seal2(x) {
127
+ return x;
128
+ };
129
+ }
130
+ if (!apply) {
131
+ apply = function apply2(fun, thisValue, args) {
132
+ return fun.apply(thisValue, args);
133
+ };
134
+ }
135
+ if (!construct) {
136
+ construct = function construct2(Func, args) {
137
+ return new Func(...args);
138
+ };
139
+ }
140
+ var arrayForEach = unapply(Array.prototype.forEach);
141
+ var arrayPop = unapply(Array.prototype.pop);
142
+ var arrayPush = unapply(Array.prototype.push);
143
+ var stringToLowerCase = unapply(String.prototype.toLowerCase);
144
+ var stringToString = unapply(String.prototype.toString);
145
+ var stringMatch = unapply(String.prototype.match);
146
+ var stringReplace = unapply(String.prototype.replace);
147
+ var stringIndexOf = unapply(String.prototype.indexOf);
148
+ var stringTrim = unapply(String.prototype.trim);
149
+ var objectHasOwnProperty = unapply(Object.prototype.hasOwnProperty);
150
+ var regExpTest = unapply(RegExp.prototype.test);
151
+ var typeErrorCreate = unconstruct(TypeError);
152
+ function unapply(func) {
153
+ return function(thisArg) {
154
+ for (var _len = arguments.length, args = new Array(_len > 1 ? _len - 1 : 0), _key = 1; _key < _len; _key++) {
155
+ args[_key - 1] = arguments[_key];
156
+ }
157
+ return apply(func, thisArg, args);
158
+ };
159
+ }
160
+ function unconstruct(func) {
161
+ return function() {
162
+ for (var _len2 = arguments.length, args = new Array(_len2), _key2 = 0; _key2 < _len2; _key2++) {
163
+ args[_key2] = arguments[_key2];
164
+ }
165
+ return construct(func, args);
166
+ };
167
+ }
168
+ function addToSet(set, array) {
169
+ let transformCaseFunc = arguments.length > 2 && arguments[2] !== void 0 ? arguments[2] : stringToLowerCase;
170
+ if (setPrototypeOf) {
171
+ setPrototypeOf(set, null);
172
+ }
173
+ let l = array.length;
174
+ while (l--) {
175
+ let element = array[l];
176
+ if (typeof element === "string") {
177
+ const lcElement = transformCaseFunc(element);
178
+ if (lcElement !== element) {
179
+ if (!isFrozen(array)) {
180
+ array[l] = lcElement;
181
+ }
182
+ element = lcElement;
183
+ }
184
+ }
185
+ set[element] = true;
186
+ }
187
+ return set;
188
+ }
189
+ function cleanArray(array) {
190
+ for (let index = 0; index < array.length; index++) {
191
+ const isPropertyExist = objectHasOwnProperty(array, index);
192
+ if (!isPropertyExist) {
193
+ array[index] = null;
194
+ }
195
+ }
196
+ return array;
197
+ }
198
+ function clone(object) {
199
+ const newObject = create(null);
200
+ for (const [property, value] of entries(object)) {
201
+ const isPropertyExist = objectHasOwnProperty(object, property);
202
+ if (isPropertyExist) {
203
+ if (Array.isArray(value)) {
204
+ newObject[property] = cleanArray(value);
205
+ } else if (value && typeof value === "object" && value.constructor === Object) {
206
+ newObject[property] = clone(value);
207
+ } else {
208
+ newObject[property] = value;
209
+ }
210
+ }
211
+ }
212
+ return newObject;
213
+ }
214
+ function lookupGetter(object, prop) {
215
+ while (object !== null) {
216
+ const desc = getOwnPropertyDescriptor(object, prop);
217
+ if (desc) {
218
+ if (desc.get) {
219
+ return unapply(desc.get);
220
+ }
221
+ if (typeof desc.value === "function") {
222
+ return unapply(desc.value);
223
+ }
224
+ }
225
+ object = getPrototypeOf(object);
226
+ }
227
+ function fallbackValue() {
228
+ return null;
229
+ }
230
+ return fallbackValue;
231
+ }
232
+ var html$1 = freeze(["a", "abbr", "acronym", "address", "area", "article", "aside", "audio", "b", "bdi", "bdo", "big", "blink", "blockquote", "body", "br", "button", "canvas", "caption", "center", "cite", "code", "col", "colgroup", "content", "data", "datalist", "dd", "decorator", "del", "details", "dfn", "dialog", "dir", "div", "dl", "dt", "element", "em", "fieldset", "figcaption", "figure", "font", "footer", "form", "h1", "h2", "h3", "h4", "h5", "h6", "head", "header", "hgroup", "hr", "html", "i", "img", "input", "ins", "kbd", "label", "legend", "li", "main", "map", "mark", "marquee", "menu", "menuitem", "meter", "nav", "nobr", "ol", "optgroup", "option", "output", "p", "picture", "pre", "progress", "q", "rp", "rt", "ruby", "s", "samp", "section", "select", "shadow", "small", "source", "spacer", "span", "strike", "strong", "style", "sub", "summary", "sup", "table", "tbody", "td", "template", "textarea", "tfoot", "th", "thead", "time", "tr", "track", "tt", "u", "ul", "var", "video", "wbr"]);
233
+ var svg$1 = freeze(["svg", "a", "altglyph", "altglyphdef", "altglyphitem", "animatecolor", "animatemotion", "animatetransform", "circle", "clippath", "defs", "desc", "ellipse", "filter", "font", "g", "glyph", "glyphref", "hkern", "image", "line", "lineargradient", "marker", "mask", "metadata", "mpath", "path", "pattern", "polygon", "polyline", "radialgradient", "rect", "stop", "style", "switch", "symbol", "text", "textpath", "title", "tref", "tspan", "view", "vkern"]);
234
+ var svgFilters = freeze(["feBlend", "feColorMatrix", "feComponentTransfer", "feComposite", "feConvolveMatrix", "feDiffuseLighting", "feDisplacementMap", "feDistantLight", "feDropShadow", "feFlood", "feFuncA", "feFuncB", "feFuncG", "feFuncR", "feGaussianBlur", "feImage", "feMerge", "feMergeNode", "feMorphology", "feOffset", "fePointLight", "feSpecularLighting", "feSpotLight", "feTile", "feTurbulence"]);
235
+ var svgDisallowed = freeze(["animate", "color-profile", "cursor", "discard", "font-face", "font-face-format", "font-face-name", "font-face-src", "font-face-uri", "foreignobject", "hatch", "hatchpath", "mesh", "meshgradient", "meshpatch", "meshrow", "missing-glyph", "script", "set", "solidcolor", "unknown", "use"]);
236
+ var mathMl$1 = freeze(["math", "menclose", "merror", "mfenced", "mfrac", "mglyph", "mi", "mlabeledtr", "mmultiscripts", "mn", "mo", "mover", "mpadded", "mphantom", "mroot", "mrow", "ms", "mspace", "msqrt", "mstyle", "msub", "msup", "msubsup", "mtable", "mtd", "mtext", "mtr", "munder", "munderover", "mprescripts"]);
237
+ var mathMlDisallowed = freeze(["maction", "maligngroup", "malignmark", "mlongdiv", "mscarries", "mscarry", "msgroup", "mstack", "msline", "msrow", "semantics", "annotation", "annotation-xml", "mprescripts", "none"]);
238
+ var text = freeze(["#text"]);
239
+ var html = freeze(["accept", "action", "align", "alt", "autocapitalize", "autocomplete", "autopictureinpicture", "autoplay", "background", "bgcolor", "border", "capture", "cellpadding", "cellspacing", "checked", "cite", "class", "clear", "color", "cols", "colspan", "controls", "controlslist", "coords", "crossorigin", "datetime", "decoding", "default", "dir", "disabled", "disablepictureinpicture", "disableremoteplayback", "download", "draggable", "enctype", "enterkeyhint", "face", "for", "headers", "height", "hidden", "high", "href", "hreflang", "id", "inputmode", "integrity", "ismap", "kind", "label", "lang", "list", "loading", "loop", "low", "max", "maxlength", "media", "method", "min", "minlength", "multiple", "muted", "name", "nonce", "noshade", "novalidate", "nowrap", "open", "optimum", "pattern", "placeholder", "playsinline", "popover", "popovertarget", "popovertargetaction", "poster", "preload", "pubdate", "radiogroup", "readonly", "rel", "required", "rev", "reversed", "role", "rows", "rowspan", "spellcheck", "scope", "selected", "shape", "size", "sizes", "span", "srclang", "start", "src", "srcset", "step", "style", "summary", "tabindex", "title", "translate", "type", "usemap", "valign", "value", "width", "wrap", "xmlns", "slot"]);
240
+ var svg = freeze(["accent-height", "accumulate", "additive", "alignment-baseline", "amplitude", "ascent", "attributename", "attributetype", "azimuth", "basefrequency", "baseline-shift", "begin", "bias", "by", "class", "clip", "clippathunits", "clip-path", "clip-rule", "color", "color-interpolation", "color-interpolation-filters", "color-profile", "color-rendering", "cx", "cy", "d", "dx", "dy", "diffuseconstant", "direction", "display", "divisor", "dur", "edgemode", "elevation", "end", "exponent", "fill", "fill-opacity", "fill-rule", "filter", "filterunits", "flood-color", "flood-opacity", "font-family", "font-size", "font-size-adjust", "font-stretch", "font-style", "font-variant", "font-weight", "fx", "fy", "g1", "g2", "glyph-name", "glyphref", "gradientunits", "gradienttransform", "height", "href", "id", "image-rendering", "in", "in2", "intercept", "k", "k1", "k2", "k3", "k4", "kerning", "keypoints", "keysplines", "keytimes", "lang", "lengthadjust", "letter-spacing", "kernelmatrix", "kernelunitlength", "lighting-color", "local", "marker-end", "marker-mid", "marker-start", "markerheight", "markerunits", "markerwidth", "maskcontentunits", "maskunits", "max", "mask", "media", "method", "mode", "min", "name", "numoctaves", "offset", "operator", "opacity", "order", "orient", "orientation", "origin", "overflow", "paint-order", "path", "pathlength", "patterncontentunits", "patterntransform", "patternunits", "points", "preservealpha", "preserveaspectratio", "primitiveunits", "r", "rx", "ry", "radius", "refx", "refy", "repeatcount", "repeatdur", "restart", "result", "rotate", "scale", "seed", "shape-rendering", "slope", "specularconstant", "specularexponent", "spreadmethod", "startoffset", "stddeviation", "stitchtiles", "stop-color", "stop-opacity", "stroke-dasharray", "stroke-dashoffset", "stroke-linecap", "stroke-linejoin", "stroke-miterlimit", "stroke-opacity", "stroke", "stroke-width", "style", "surfacescale", "systemlanguage", "tabindex", "tablevalues", "targetx", "targety", "transform", "transform-origin", "text-anchor", "text-decoration", "text-rendering", "textlength", "type", "u1", "u2", "unicode", "values", "viewbox", "visibility", "version", "vert-adv-y", "vert-origin-x", "vert-origin-y", "width", "word-spacing", "wrap", "writing-mode", "xchannelselector", "ychannelselector", "x", "x1", "x2", "xmlns", "y", "y1", "y2", "z", "zoomandpan"]);
241
+ var mathMl = freeze(["accent", "accentunder", "align", "bevelled", "close", "columnsalign", "columnlines", "columnspan", "denomalign", "depth", "dir", "display", "displaystyle", "encoding", "fence", "frame", "height", "href", "id", "largeop", "length", "linethickness", "lspace", "lquote", "mathbackground", "mathcolor", "mathsize", "mathvariant", "maxsize", "minsize", "movablelimits", "notation", "numalign", "open", "rowalign", "rowlines", "rowspacing", "rowspan", "rspace", "rquote", "scriptlevel", "scriptminsize", "scriptsizemultiplier", "selection", "separator", "separators", "stretchy", "subscriptshift", "supscriptshift", "symmetric", "voffset", "width", "xmlns"]);
242
+ var xml = freeze(["xlink:href", "xml:id", "xlink:title", "xml:space", "xmlns:xlink"]);
243
+ var MUSTACHE_EXPR = seal(/\{\{[\w\W]*|[\w\W]*\}\}/gm);
244
+ var ERB_EXPR = seal(/<%[\w\W]*|[\w\W]*%>/gm);
245
+ var TMPLIT_EXPR = seal(/\${[\w\W]*}/gm);
246
+ var DATA_ATTR = seal(/^data-[\-\w.\u00B7-\uFFFF]/);
247
+ var ARIA_ATTR = seal(/^aria-[\-\w]+$/);
248
+ var IS_ALLOWED_URI = seal(
249
+ /^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i
250
+ // eslint-disable-line no-useless-escape
251
+ );
252
+ var IS_SCRIPT_OR_DATA = seal(/^(?:\w+script|data):/i);
253
+ var ATTR_WHITESPACE = seal(
254
+ /[\u0000-\u0020\u00A0\u1680\u180E\u2000-\u2029\u205F\u3000]/g
255
+ // eslint-disable-line no-control-regex
256
+ );
257
+ var DOCTYPE_NAME = seal(/^html$/i);
258
+ var CUSTOM_ELEMENT = seal(/^[a-z][.\w]*(-[.\w]+)+$/i);
259
+ var EXPRESSIONS = /* @__PURE__ */ Object.freeze({
260
+ __proto__: null,
261
+ ARIA_ATTR,
262
+ ATTR_WHITESPACE,
263
+ CUSTOM_ELEMENT,
264
+ DATA_ATTR,
265
+ DOCTYPE_NAME,
266
+ ERB_EXPR,
267
+ IS_ALLOWED_URI,
268
+ IS_SCRIPT_OR_DATA,
269
+ MUSTACHE_EXPR,
270
+ TMPLIT_EXPR
271
+ });
272
+ var NODE_TYPE = {
273
+ element: 1,
274
+ attribute: 2,
275
+ text: 3,
276
+ cdataSection: 4,
277
+ entityReference: 5,
278
+ // Deprecated
279
+ entityNode: 6,
280
+ // Deprecated
281
+ progressingInstruction: 7,
282
+ comment: 8,
283
+ document: 9,
284
+ documentType: 10,
285
+ documentFragment: 11,
286
+ notation: 12
287
+ // Deprecated
288
+ };
289
+ var getGlobal = function getGlobal2() {
290
+ return typeof window === "undefined" ? null : window;
291
+ };
292
+ var _createTrustedTypesPolicy = function _createTrustedTypesPolicy2(trustedTypes, purifyHostElement) {
293
+ if (typeof trustedTypes !== "object" || typeof trustedTypes.createPolicy !== "function") {
294
+ return null;
295
+ }
296
+ let suffix = null;
297
+ const ATTR_NAME = "data-tt-policy-suffix";
298
+ if (purifyHostElement && purifyHostElement.hasAttribute(ATTR_NAME)) {
299
+ suffix = purifyHostElement.getAttribute(ATTR_NAME);
300
+ }
301
+ const policyName = "dompurify" + (suffix ? "#" + suffix : "");
302
+ try {
303
+ return trustedTypes.createPolicy(policyName, {
304
+ createHTML(html3) {
305
+ return html3;
306
+ },
307
+ createScriptURL(scriptUrl) {
308
+ return scriptUrl;
309
+ }
310
+ });
311
+ } catch (_) {
312
+ console.warn("TrustedTypes policy " + policyName + " could not be created.");
313
+ return null;
314
+ }
315
+ };
316
+ function createDOMPurify() {
317
+ let window2 = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : getGlobal();
318
+ const DOMPurify = (root) => createDOMPurify(root);
319
+ DOMPurify.version = "3.2.1";
320
+ DOMPurify.removed = [];
321
+ if (!window2 || !window2.document || window2.document.nodeType !== NODE_TYPE.document) {
322
+ DOMPurify.isSupported = false;
323
+ return DOMPurify;
324
+ }
325
+ let {
326
+ document: document2
327
+ } = window2;
328
+ const originalDocument = document2;
329
+ const currentScript = originalDocument.currentScript;
330
+ const {
331
+ DocumentFragment: DocumentFragment2,
332
+ HTMLTemplateElement,
333
+ Node,
334
+ Element: Element2,
335
+ NodeFilter,
336
+ NamedNodeMap = window2.NamedNodeMap || window2.MozNamedAttrMap,
337
+ HTMLFormElement,
338
+ DOMParser,
339
+ trustedTypes
340
+ } = window2;
341
+ const ElementPrototype = Element2.prototype;
342
+ const cloneNode = lookupGetter(ElementPrototype, "cloneNode");
343
+ const remove = lookupGetter(ElementPrototype, "remove");
344
+ const getNextSibling = lookupGetter(ElementPrototype, "nextSibling");
345
+ const getChildNodes = lookupGetter(ElementPrototype, "childNodes");
346
+ const getParentNode = lookupGetter(ElementPrototype, "parentNode");
347
+ if (typeof HTMLTemplateElement === "function") {
348
+ const template = document2.createElement("template");
349
+ if (template.content && template.content.ownerDocument) {
350
+ document2 = template.content.ownerDocument;
351
+ }
352
+ }
353
+ let trustedTypesPolicy;
354
+ let emptyHTML = "";
355
+ const {
356
+ implementation,
357
+ createNodeIterator,
358
+ createDocumentFragment,
359
+ getElementsByTagName
360
+ } = document2;
361
+ const {
362
+ importNode
363
+ } = originalDocument;
364
+ let hooks = {};
365
+ DOMPurify.isSupported = typeof entries === "function" && typeof getParentNode === "function" && implementation && implementation.createHTMLDocument !== void 0;
366
+ const {
367
+ MUSTACHE_EXPR: MUSTACHE_EXPR2,
368
+ ERB_EXPR: ERB_EXPR2,
369
+ TMPLIT_EXPR: TMPLIT_EXPR2,
370
+ DATA_ATTR: DATA_ATTR2,
371
+ ARIA_ATTR: ARIA_ATTR2,
372
+ IS_SCRIPT_OR_DATA: IS_SCRIPT_OR_DATA2,
373
+ ATTR_WHITESPACE: ATTR_WHITESPACE2,
374
+ CUSTOM_ELEMENT: CUSTOM_ELEMENT2
375
+ } = EXPRESSIONS;
376
+ let {
377
+ IS_ALLOWED_URI: IS_ALLOWED_URI$1
378
+ } = EXPRESSIONS;
379
+ let ALLOWED_TAGS = null;
380
+ const DEFAULT_ALLOWED_TAGS = addToSet({}, [...html$1, ...svg$1, ...svgFilters, ...mathMl$1, ...text]);
381
+ let ALLOWED_ATTR = null;
382
+ const DEFAULT_ALLOWED_ATTR = addToSet({}, [...html, ...svg, ...mathMl, ...xml]);
383
+ let CUSTOM_ELEMENT_HANDLING = Object.seal(create(null, {
384
+ tagNameCheck: {
385
+ writable: true,
386
+ configurable: false,
387
+ enumerable: true,
388
+ value: null
389
+ },
390
+ attributeNameCheck: {
391
+ writable: true,
392
+ configurable: false,
393
+ enumerable: true,
394
+ value: null
395
+ },
396
+ allowCustomizedBuiltInElements: {
397
+ writable: true,
398
+ configurable: false,
399
+ enumerable: true,
400
+ value: false
401
+ }
402
+ }));
403
+ let FORBID_TAGS = null;
404
+ let FORBID_ATTR = null;
405
+ let ALLOW_ARIA_ATTR = true;
406
+ let ALLOW_DATA_ATTR = true;
407
+ let ALLOW_UNKNOWN_PROTOCOLS = false;
408
+ let ALLOW_SELF_CLOSE_IN_ATTR = true;
409
+ let SAFE_FOR_TEMPLATES = false;
410
+ let SAFE_FOR_XML = true;
411
+ let WHOLE_DOCUMENT = false;
412
+ let SET_CONFIG = false;
413
+ let FORCE_BODY = false;
414
+ let RETURN_DOM = false;
415
+ let RETURN_DOM_FRAGMENT = false;
416
+ let RETURN_TRUSTED_TYPE = false;
417
+ let SANITIZE_DOM = true;
418
+ let SANITIZE_NAMED_PROPS = false;
419
+ const SANITIZE_NAMED_PROPS_PREFIX = "user-content-";
420
+ let KEEP_CONTENT = true;
421
+ let IN_PLACE = false;
422
+ let USE_PROFILES = {};
423
+ let FORBID_CONTENTS = null;
424
+ const DEFAULT_FORBID_CONTENTS = addToSet({}, ["annotation-xml", "audio", "colgroup", "desc", "foreignobject", "head", "iframe", "math", "mi", "mn", "mo", "ms", "mtext", "noembed", "noframes", "noscript", "plaintext", "script", "style", "svg", "template", "thead", "title", "video", "xmp"]);
425
+ let DATA_URI_TAGS = null;
426
+ const DEFAULT_DATA_URI_TAGS = addToSet({}, ["audio", "video", "img", "source", "image", "track"]);
427
+ let URI_SAFE_ATTRIBUTES = null;
428
+ const DEFAULT_URI_SAFE_ATTRIBUTES = addToSet({}, ["alt", "class", "for", "id", "label", "name", "pattern", "placeholder", "role", "summary", "title", "value", "style", "xmlns"]);
429
+ const MATHML_NAMESPACE = "http://www.w3.org/1998/Math/MathML";
430
+ const SVG_NAMESPACE = "http://www.w3.org/2000/svg";
431
+ const HTML_NAMESPACE = "http://www.w3.org/1999/xhtml";
432
+ let NAMESPACE = HTML_NAMESPACE;
433
+ let IS_EMPTY_INPUT = false;
434
+ let ALLOWED_NAMESPACES = null;
435
+ const DEFAULT_ALLOWED_NAMESPACES = addToSet({}, [MATHML_NAMESPACE, SVG_NAMESPACE, HTML_NAMESPACE], stringToString);
436
+ let MATHML_TEXT_INTEGRATION_POINTS = addToSet({}, ["mi", "mo", "mn", "ms", "mtext"]);
437
+ let HTML_INTEGRATION_POINTS = addToSet({}, ["annotation-xml"]);
438
+ const COMMON_SVG_AND_HTML_ELEMENTS = addToSet({}, ["title", "style", "font", "a", "script"]);
439
+ let PARSER_MEDIA_TYPE = null;
440
+ const SUPPORTED_PARSER_MEDIA_TYPES = ["application/xhtml+xml", "text/html"];
441
+ const DEFAULT_PARSER_MEDIA_TYPE = "text/html";
442
+ let transformCaseFunc = null;
443
+ let CONFIG = null;
444
+ const formElement = document2.createElement("form");
445
+ const isRegexOrFunction = function isRegexOrFunction2(testValue) {
446
+ return testValue instanceof RegExp || testValue instanceof Function;
447
+ };
448
+ const _parseConfig = function _parseConfig2() {
449
+ let cfg = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : {};
450
+ if (CONFIG && CONFIG === cfg) {
451
+ return;
452
+ }
453
+ if (!cfg || typeof cfg !== "object") {
454
+ cfg = {};
455
+ }
456
+ cfg = clone(cfg);
457
+ PARSER_MEDIA_TYPE = // eslint-disable-next-line unicorn/prefer-includes
458
+ SUPPORTED_PARSER_MEDIA_TYPES.indexOf(cfg.PARSER_MEDIA_TYPE) === -1 ? DEFAULT_PARSER_MEDIA_TYPE : cfg.PARSER_MEDIA_TYPE;
459
+ transformCaseFunc = PARSER_MEDIA_TYPE === "application/xhtml+xml" ? stringToString : stringToLowerCase;
460
+ ALLOWED_TAGS = objectHasOwnProperty(cfg, "ALLOWED_TAGS") ? addToSet({}, cfg.ALLOWED_TAGS, transformCaseFunc) : DEFAULT_ALLOWED_TAGS;
461
+ ALLOWED_ATTR = objectHasOwnProperty(cfg, "ALLOWED_ATTR") ? addToSet({}, cfg.ALLOWED_ATTR, transformCaseFunc) : DEFAULT_ALLOWED_ATTR;
462
+ ALLOWED_NAMESPACES = objectHasOwnProperty(cfg, "ALLOWED_NAMESPACES") ? addToSet({}, cfg.ALLOWED_NAMESPACES, stringToString) : DEFAULT_ALLOWED_NAMESPACES;
463
+ URI_SAFE_ATTRIBUTES = objectHasOwnProperty(cfg, "ADD_URI_SAFE_ATTR") ? addToSet(clone(DEFAULT_URI_SAFE_ATTRIBUTES), cfg.ADD_URI_SAFE_ATTR, transformCaseFunc) : DEFAULT_URI_SAFE_ATTRIBUTES;
464
+ DATA_URI_TAGS = objectHasOwnProperty(cfg, "ADD_DATA_URI_TAGS") ? addToSet(clone(DEFAULT_DATA_URI_TAGS), cfg.ADD_DATA_URI_TAGS, transformCaseFunc) : DEFAULT_DATA_URI_TAGS;
465
+ FORBID_CONTENTS = objectHasOwnProperty(cfg, "FORBID_CONTENTS") ? addToSet({}, cfg.FORBID_CONTENTS, transformCaseFunc) : DEFAULT_FORBID_CONTENTS;
466
+ FORBID_TAGS = objectHasOwnProperty(cfg, "FORBID_TAGS") ? addToSet({}, cfg.FORBID_TAGS, transformCaseFunc) : {};
467
+ FORBID_ATTR = objectHasOwnProperty(cfg, "FORBID_ATTR") ? addToSet({}, cfg.FORBID_ATTR, transformCaseFunc) : {};
468
+ USE_PROFILES = objectHasOwnProperty(cfg, "USE_PROFILES") ? cfg.USE_PROFILES : false;
469
+ ALLOW_ARIA_ATTR = cfg.ALLOW_ARIA_ATTR !== false;
470
+ ALLOW_DATA_ATTR = cfg.ALLOW_DATA_ATTR !== false;
471
+ ALLOW_UNKNOWN_PROTOCOLS = cfg.ALLOW_UNKNOWN_PROTOCOLS || false;
472
+ ALLOW_SELF_CLOSE_IN_ATTR = cfg.ALLOW_SELF_CLOSE_IN_ATTR !== false;
473
+ SAFE_FOR_TEMPLATES = cfg.SAFE_FOR_TEMPLATES || false;
474
+ SAFE_FOR_XML = cfg.SAFE_FOR_XML !== false;
475
+ WHOLE_DOCUMENT = cfg.WHOLE_DOCUMENT || false;
476
+ RETURN_DOM = cfg.RETURN_DOM || false;
477
+ RETURN_DOM_FRAGMENT = cfg.RETURN_DOM_FRAGMENT || false;
478
+ RETURN_TRUSTED_TYPE = cfg.RETURN_TRUSTED_TYPE || false;
479
+ FORCE_BODY = cfg.FORCE_BODY || false;
480
+ SANITIZE_DOM = cfg.SANITIZE_DOM !== false;
481
+ SANITIZE_NAMED_PROPS = cfg.SANITIZE_NAMED_PROPS || false;
482
+ KEEP_CONTENT = cfg.KEEP_CONTENT !== false;
483
+ IN_PLACE = cfg.IN_PLACE || false;
484
+ IS_ALLOWED_URI$1 = cfg.ALLOWED_URI_REGEXP || IS_ALLOWED_URI;
485
+ NAMESPACE = cfg.NAMESPACE || HTML_NAMESPACE;
486
+ MATHML_TEXT_INTEGRATION_POINTS = cfg.MATHML_TEXT_INTEGRATION_POINTS || MATHML_TEXT_INTEGRATION_POINTS;
487
+ HTML_INTEGRATION_POINTS = cfg.HTML_INTEGRATION_POINTS || HTML_INTEGRATION_POINTS;
488
+ CUSTOM_ELEMENT_HANDLING = cfg.CUSTOM_ELEMENT_HANDLING || {};
489
+ if (cfg.CUSTOM_ELEMENT_HANDLING && isRegexOrFunction(cfg.CUSTOM_ELEMENT_HANDLING.tagNameCheck)) {
490
+ CUSTOM_ELEMENT_HANDLING.tagNameCheck = cfg.CUSTOM_ELEMENT_HANDLING.tagNameCheck;
491
+ }
492
+ if (cfg.CUSTOM_ELEMENT_HANDLING && isRegexOrFunction(cfg.CUSTOM_ELEMENT_HANDLING.attributeNameCheck)) {
493
+ CUSTOM_ELEMENT_HANDLING.attributeNameCheck = cfg.CUSTOM_ELEMENT_HANDLING.attributeNameCheck;
494
+ }
495
+ if (cfg.CUSTOM_ELEMENT_HANDLING && typeof cfg.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements === "boolean") {
496
+ CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements = cfg.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements;
497
+ }
498
+ if (SAFE_FOR_TEMPLATES) {
499
+ ALLOW_DATA_ATTR = false;
500
+ }
501
+ if (RETURN_DOM_FRAGMENT) {
502
+ RETURN_DOM = true;
503
+ }
504
+ if (USE_PROFILES) {
505
+ ALLOWED_TAGS = addToSet({}, text);
506
+ ALLOWED_ATTR = [];
507
+ if (USE_PROFILES.html === true) {
508
+ addToSet(ALLOWED_TAGS, html$1);
509
+ addToSet(ALLOWED_ATTR, html);
510
+ }
511
+ if (USE_PROFILES.svg === true) {
512
+ addToSet(ALLOWED_TAGS, svg$1);
513
+ addToSet(ALLOWED_ATTR, svg);
514
+ addToSet(ALLOWED_ATTR, xml);
515
+ }
516
+ if (USE_PROFILES.svgFilters === true) {
517
+ addToSet(ALLOWED_TAGS, svgFilters);
518
+ addToSet(ALLOWED_ATTR, svg);
519
+ addToSet(ALLOWED_ATTR, xml);
520
+ }
521
+ if (USE_PROFILES.mathMl === true) {
522
+ addToSet(ALLOWED_TAGS, mathMl$1);
523
+ addToSet(ALLOWED_ATTR, mathMl);
524
+ addToSet(ALLOWED_ATTR, xml);
525
+ }
526
+ }
527
+ if (cfg.ADD_TAGS) {
528
+ if (ALLOWED_TAGS === DEFAULT_ALLOWED_TAGS) {
529
+ ALLOWED_TAGS = clone(ALLOWED_TAGS);
530
+ }
531
+ addToSet(ALLOWED_TAGS, cfg.ADD_TAGS, transformCaseFunc);
532
+ }
533
+ if (cfg.ADD_ATTR) {
534
+ if (ALLOWED_ATTR === DEFAULT_ALLOWED_ATTR) {
535
+ ALLOWED_ATTR = clone(ALLOWED_ATTR);
536
+ }
537
+ addToSet(ALLOWED_ATTR, cfg.ADD_ATTR, transformCaseFunc);
538
+ }
539
+ if (cfg.ADD_URI_SAFE_ATTR) {
540
+ addToSet(URI_SAFE_ATTRIBUTES, cfg.ADD_URI_SAFE_ATTR, transformCaseFunc);
541
+ }
542
+ if (cfg.FORBID_CONTENTS) {
543
+ if (FORBID_CONTENTS === DEFAULT_FORBID_CONTENTS) {
544
+ FORBID_CONTENTS = clone(FORBID_CONTENTS);
545
+ }
546
+ addToSet(FORBID_CONTENTS, cfg.FORBID_CONTENTS, transformCaseFunc);
547
+ }
548
+ if (KEEP_CONTENT) {
549
+ ALLOWED_TAGS["#text"] = true;
550
+ }
551
+ if (WHOLE_DOCUMENT) {
552
+ addToSet(ALLOWED_TAGS, ["html", "head", "body"]);
553
+ }
554
+ if (ALLOWED_TAGS.table) {
555
+ addToSet(ALLOWED_TAGS, ["tbody"]);
556
+ delete FORBID_TAGS.tbody;
557
+ }
558
+ if (cfg.TRUSTED_TYPES_POLICY) {
559
+ if (typeof cfg.TRUSTED_TYPES_POLICY.createHTML !== "function") {
560
+ throw typeErrorCreate('TRUSTED_TYPES_POLICY configuration option must provide a "createHTML" hook.');
561
+ }
562
+ if (typeof cfg.TRUSTED_TYPES_POLICY.createScriptURL !== "function") {
563
+ throw typeErrorCreate('TRUSTED_TYPES_POLICY configuration option must provide a "createScriptURL" hook.');
564
+ }
565
+ trustedTypesPolicy = cfg.TRUSTED_TYPES_POLICY;
566
+ emptyHTML = trustedTypesPolicy.createHTML("");
567
+ } else {
568
+ if (trustedTypesPolicy === void 0) {
569
+ trustedTypesPolicy = _createTrustedTypesPolicy(trustedTypes, currentScript);
570
+ }
571
+ if (trustedTypesPolicy !== null && typeof emptyHTML === "string") {
572
+ emptyHTML = trustedTypesPolicy.createHTML("");
573
+ }
574
+ }
575
+ if (freeze) {
576
+ freeze(cfg);
577
+ }
578
+ CONFIG = cfg;
579
+ };
580
+ const ALL_SVG_TAGS = addToSet({}, [...svg$1, ...svgFilters, ...svgDisallowed]);
581
+ const ALL_MATHML_TAGS = addToSet({}, [...mathMl$1, ...mathMlDisallowed]);
582
+ const _checkValidNamespace = function _checkValidNamespace2(element) {
583
+ let parent = getParentNode(element);
584
+ if (!parent || !parent.tagName) {
585
+ parent = {
586
+ namespaceURI: NAMESPACE,
587
+ tagName: "template"
588
+ };
589
+ }
590
+ const tagName = stringToLowerCase(element.tagName);
591
+ const parentTagName = stringToLowerCase(parent.tagName);
592
+ if (!ALLOWED_NAMESPACES[element.namespaceURI]) {
593
+ return false;
594
+ }
595
+ if (element.namespaceURI === SVG_NAMESPACE) {
596
+ if (parent.namespaceURI === HTML_NAMESPACE) {
597
+ return tagName === "svg";
598
+ }
599
+ if (parent.namespaceURI === MATHML_NAMESPACE) {
600
+ return tagName === "svg" && (parentTagName === "annotation-xml" || MATHML_TEXT_INTEGRATION_POINTS[parentTagName]);
601
+ }
602
+ return Boolean(ALL_SVG_TAGS[tagName]);
603
+ }
604
+ if (element.namespaceURI === MATHML_NAMESPACE) {
605
+ if (parent.namespaceURI === HTML_NAMESPACE) {
606
+ return tagName === "math";
607
+ }
608
+ if (parent.namespaceURI === SVG_NAMESPACE) {
609
+ return tagName === "math" && HTML_INTEGRATION_POINTS[parentTagName];
610
+ }
611
+ return Boolean(ALL_MATHML_TAGS[tagName]);
612
+ }
613
+ if (element.namespaceURI === HTML_NAMESPACE) {
614
+ if (parent.namespaceURI === SVG_NAMESPACE && !HTML_INTEGRATION_POINTS[parentTagName]) {
615
+ return false;
616
+ }
617
+ if (parent.namespaceURI === MATHML_NAMESPACE && !MATHML_TEXT_INTEGRATION_POINTS[parentTagName]) {
618
+ return false;
619
+ }
620
+ return !ALL_MATHML_TAGS[tagName] && (COMMON_SVG_AND_HTML_ELEMENTS[tagName] || !ALL_SVG_TAGS[tagName]);
621
+ }
622
+ if (PARSER_MEDIA_TYPE === "application/xhtml+xml" && ALLOWED_NAMESPACES[element.namespaceURI]) {
623
+ return true;
624
+ }
625
+ return false;
626
+ };
627
+ const _forceRemove = function _forceRemove2(node) {
628
+ arrayPush(DOMPurify.removed, {
629
+ element: node
630
+ });
631
+ try {
632
+ getParentNode(node).removeChild(node);
633
+ } catch (_) {
634
+ remove(node);
635
+ }
636
+ };
637
+ const _removeAttribute = function _removeAttribute2(name, element) {
638
+ try {
639
+ arrayPush(DOMPurify.removed, {
640
+ attribute: element.getAttributeNode(name),
641
+ from: element
642
+ });
643
+ } catch (_) {
644
+ arrayPush(DOMPurify.removed, {
645
+ attribute: null,
646
+ from: element
647
+ });
648
+ }
649
+ element.removeAttribute(name);
650
+ if (name === "is" && !ALLOWED_ATTR[name]) {
651
+ if (RETURN_DOM || RETURN_DOM_FRAGMENT) {
652
+ try {
653
+ _forceRemove(element);
654
+ } catch (_) {
655
+ }
656
+ } else {
657
+ try {
658
+ element.setAttribute(name, "");
659
+ } catch (_) {
660
+ }
661
+ }
662
+ }
663
+ };
664
+ const _initDocument = function _initDocument2(dirty) {
665
+ let doc = null;
666
+ let leadingWhitespace = null;
667
+ if (FORCE_BODY) {
668
+ dirty = "<remove></remove>" + dirty;
669
+ } else {
670
+ const matches = stringMatch(dirty, /^[\r\n\t ]+/);
671
+ leadingWhitespace = matches && matches[0];
672
+ }
673
+ if (PARSER_MEDIA_TYPE === "application/xhtml+xml" && NAMESPACE === HTML_NAMESPACE) {
674
+ dirty = '<html xmlns="http://www.w3.org/1999/xhtml"><head></head><body>' + dirty + "</body></html>";
675
+ }
676
+ const dirtyPayload = trustedTypesPolicy ? trustedTypesPolicy.createHTML(dirty) : dirty;
677
+ if (NAMESPACE === HTML_NAMESPACE) {
678
+ try {
679
+ doc = new DOMParser().parseFromString(dirtyPayload, PARSER_MEDIA_TYPE);
680
+ } catch (_) {
681
+ }
682
+ }
683
+ if (!doc || !doc.documentElement) {
684
+ doc = implementation.createDocument(NAMESPACE, "template", null);
685
+ try {
686
+ doc.documentElement.innerHTML = IS_EMPTY_INPUT ? emptyHTML : dirtyPayload;
687
+ } catch (_) {
688
+ }
689
+ }
690
+ const body = doc.body || doc.documentElement;
691
+ if (dirty && leadingWhitespace) {
692
+ body.insertBefore(document2.createTextNode(leadingWhitespace), body.childNodes[0] || null);
693
+ }
694
+ if (NAMESPACE === HTML_NAMESPACE) {
695
+ return getElementsByTagName.call(doc, WHOLE_DOCUMENT ? "html" : "body")[0];
696
+ }
697
+ return WHOLE_DOCUMENT ? doc.documentElement : body;
698
+ };
699
+ const _createNodeIterator = function _createNodeIterator2(root) {
700
+ return createNodeIterator.call(
701
+ root.ownerDocument || root,
702
+ root,
703
+ // eslint-disable-next-line no-bitwise
704
+ NodeFilter.SHOW_ELEMENT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_TEXT | NodeFilter.SHOW_PROCESSING_INSTRUCTION | NodeFilter.SHOW_CDATA_SECTION,
705
+ null
706
+ );
707
+ };
708
+ const _isClobbered = function _isClobbered2(element) {
709
+ return element instanceof HTMLFormElement && (typeof element.nodeName !== "string" || typeof element.textContent !== "string" || typeof element.removeChild !== "function" || !(element.attributes instanceof NamedNodeMap) || typeof element.removeAttribute !== "function" || typeof element.setAttribute !== "function" || typeof element.namespaceURI !== "string" || typeof element.insertBefore !== "function" || typeof element.hasChildNodes !== "function");
710
+ };
711
+ const _isNode = function _isNode2(value) {
712
+ return typeof Node === "function" && value instanceof Node;
713
+ };
714
+ function _executeHook(entryPoint, currentNode, data) {
715
+ if (!hooks[entryPoint]) {
716
+ return;
717
+ }
718
+ arrayForEach(hooks[entryPoint], (hook) => {
719
+ hook.call(DOMPurify, currentNode, data, CONFIG);
720
+ });
721
+ }
722
+ const _sanitizeElements = function _sanitizeElements2(currentNode) {
723
+ let content = null;
724
+ _executeHook("beforeSanitizeElements", currentNode, null);
725
+ if (_isClobbered(currentNode)) {
726
+ _forceRemove(currentNode);
727
+ return true;
728
+ }
729
+ const tagName = transformCaseFunc(currentNode.nodeName);
730
+ _executeHook("uponSanitizeElement", currentNode, {
731
+ tagName,
732
+ allowedTags: ALLOWED_TAGS
733
+ });
734
+ if (currentNode.hasChildNodes() && !_isNode(currentNode.firstElementChild) && regExpTest(/<[/\w]/g, currentNode.innerHTML) && regExpTest(/<[/\w]/g, currentNode.textContent)) {
735
+ _forceRemove(currentNode);
736
+ return true;
737
+ }
738
+ if (currentNode.nodeType === NODE_TYPE.progressingInstruction) {
739
+ _forceRemove(currentNode);
740
+ return true;
741
+ }
742
+ if (SAFE_FOR_XML && currentNode.nodeType === NODE_TYPE.comment && regExpTest(/<[/\w]/g, currentNode.data)) {
743
+ _forceRemove(currentNode);
744
+ return true;
745
+ }
746
+ if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
747
+ if (!FORBID_TAGS[tagName] && _isBasicCustomElement(tagName)) {
748
+ if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)) {
749
+ return false;
750
+ }
751
+ if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(tagName)) {
752
+ return false;
753
+ }
754
+ }
755
+ if (KEEP_CONTENT && !FORBID_CONTENTS[tagName]) {
756
+ const parentNode = getParentNode(currentNode) || currentNode.parentNode;
757
+ const childNodes = getChildNodes(currentNode) || currentNode.childNodes;
758
+ if (childNodes && parentNode) {
759
+ const childCount = childNodes.length;
760
+ for (let i = childCount - 1; i >= 0; --i) {
761
+ const childClone = cloneNode(childNodes[i], true);
762
+ childClone.__removalCount = (currentNode.__removalCount || 0) + 1;
763
+ parentNode.insertBefore(childClone, getNextSibling(currentNode));
764
+ }
765
+ }
766
+ }
767
+ _forceRemove(currentNode);
768
+ return true;
769
+ }
770
+ if (currentNode instanceof Element2 && !_checkValidNamespace(currentNode)) {
771
+ _forceRemove(currentNode);
772
+ return true;
773
+ }
774
+ if ((tagName === "noscript" || tagName === "noembed" || tagName === "noframes") && regExpTest(/<\/no(script|embed|frames)/i, currentNode.innerHTML)) {
775
+ _forceRemove(currentNode);
776
+ return true;
777
+ }
778
+ if (SAFE_FOR_TEMPLATES && currentNode.nodeType === NODE_TYPE.text) {
779
+ content = currentNode.textContent;
780
+ arrayForEach([MUSTACHE_EXPR2, ERB_EXPR2, TMPLIT_EXPR2], (expr) => {
781
+ content = stringReplace(content, expr, " ");
782
+ });
783
+ if (currentNode.textContent !== content) {
784
+ arrayPush(DOMPurify.removed, {
785
+ element: currentNode.cloneNode()
786
+ });
787
+ currentNode.textContent = content;
788
+ }
789
+ }
790
+ _executeHook("afterSanitizeElements", currentNode, null);
791
+ return false;
792
+ };
793
+ const _isValidAttribute = function _isValidAttribute2(lcTag, lcName, value) {
794
+ if (SANITIZE_DOM && (lcName === "id" || lcName === "name") && (value in document2 || value in formElement)) {
795
+ return false;
796
+ }
797
+ if (ALLOW_DATA_ATTR && !FORBID_ATTR[lcName] && regExpTest(DATA_ATTR2, lcName)) ;
798
+ else if (ALLOW_ARIA_ATTR && regExpTest(ARIA_ATTR2, lcName)) ;
799
+ else if (!ALLOWED_ATTR[lcName] || FORBID_ATTR[lcName]) {
800
+ if (
801
+ // First condition does a very basic check if a) it's basically a valid custom element tagname AND
802
+ // b) if the tagName passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
803
+ // and c) if the attribute name passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.attributeNameCheck
804
+ _isBasicCustomElement(lcTag) && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, lcTag) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(lcTag)) && (CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.attributeNameCheck, lcName) || CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.attributeNameCheck(lcName)) || // Alternative, second condition checks if it's an `is`-attribute, AND
805
+ // the value passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
806
+ lcName === "is" && CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, value) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(value))
807
+ ) ;
808
+ else {
809
+ return false;
810
+ }
811
+ } else if (URI_SAFE_ATTRIBUTES[lcName]) ;
812
+ else if (regExpTest(IS_ALLOWED_URI$1, stringReplace(value, ATTR_WHITESPACE2, ""))) ;
813
+ else if ((lcName === "src" || lcName === "xlink:href" || lcName === "href") && lcTag !== "script" && stringIndexOf(value, "data:") === 0 && DATA_URI_TAGS[lcTag]) ;
814
+ else if (ALLOW_UNKNOWN_PROTOCOLS && !regExpTest(IS_SCRIPT_OR_DATA2, stringReplace(value, ATTR_WHITESPACE2, ""))) ;
815
+ else if (value) {
816
+ return false;
817
+ } else ;
818
+ return true;
819
+ };
820
+ const _isBasicCustomElement = function _isBasicCustomElement2(tagName) {
821
+ return tagName !== "annotation-xml" && stringMatch(tagName, CUSTOM_ELEMENT2);
822
+ };
823
+ const _sanitizeAttributes = function _sanitizeAttributes2(currentNode) {
824
+ _executeHook("beforeSanitizeAttributes", currentNode, null);
825
+ const {
826
+ attributes
827
+ } = currentNode;
828
+ if (!attributes) {
829
+ return;
830
+ }
831
+ const hookEvent = {
832
+ attrName: "",
833
+ attrValue: "",
834
+ keepAttr: true,
835
+ allowedAttributes: ALLOWED_ATTR,
836
+ forceKeepAttr: void 0
837
+ };
838
+ let l = attributes.length;
839
+ while (l--) {
840
+ const attr = attributes[l];
841
+ const {
842
+ name,
843
+ namespaceURI,
844
+ value: attrValue
845
+ } = attr;
846
+ const lcName = transformCaseFunc(name);
847
+ let value = name === "value" ? attrValue : stringTrim(attrValue);
848
+ hookEvent.attrName = lcName;
849
+ hookEvent.attrValue = value;
850
+ hookEvent.keepAttr = true;
851
+ hookEvent.forceKeepAttr = void 0;
852
+ _executeHook("uponSanitizeAttribute", currentNode, hookEvent);
853
+ value = hookEvent.attrValue;
854
+ if (SANITIZE_NAMED_PROPS && (lcName === "id" || lcName === "name")) {
855
+ _removeAttribute(name, currentNode);
856
+ value = SANITIZE_NAMED_PROPS_PREFIX + value;
857
+ }
858
+ if (SAFE_FOR_XML && regExpTest(/((--!?|])>)|<\/(style|title)/i, value)) {
859
+ _removeAttribute(name, currentNode);
860
+ continue;
861
+ }
862
+ if (hookEvent.forceKeepAttr) {
863
+ continue;
864
+ }
865
+ _removeAttribute(name, currentNode);
866
+ if (!hookEvent.keepAttr) {
867
+ continue;
868
+ }
869
+ if (!ALLOW_SELF_CLOSE_IN_ATTR && regExpTest(/\/>/i, value)) {
870
+ _removeAttribute(name, currentNode);
871
+ continue;
872
+ }
873
+ if (SAFE_FOR_TEMPLATES) {
874
+ arrayForEach([MUSTACHE_EXPR2, ERB_EXPR2, TMPLIT_EXPR2], (expr) => {
875
+ value = stringReplace(value, expr, " ");
876
+ });
877
+ }
878
+ const lcTag = transformCaseFunc(currentNode.nodeName);
879
+ if (!_isValidAttribute(lcTag, lcName, value)) {
880
+ continue;
881
+ }
882
+ if (trustedTypesPolicy && typeof trustedTypes === "object" && typeof trustedTypes.getAttributeType === "function") {
883
+ if (namespaceURI) ;
884
+ else {
885
+ switch (trustedTypes.getAttributeType(lcTag, lcName)) {
886
+ case "TrustedHTML": {
887
+ value = trustedTypesPolicy.createHTML(value);
888
+ break;
889
+ }
890
+ case "TrustedScriptURL": {
891
+ value = trustedTypesPolicy.createScriptURL(value);
892
+ break;
893
+ }
894
+ }
895
+ }
896
+ }
897
+ try {
898
+ if (namespaceURI) {
899
+ currentNode.setAttributeNS(namespaceURI, name, value);
900
+ } else {
901
+ currentNode.setAttribute(name, value);
902
+ }
903
+ if (_isClobbered(currentNode)) {
904
+ _forceRemove(currentNode);
905
+ } else {
906
+ arrayPop(DOMPurify.removed);
907
+ }
908
+ } catch (_) {
909
+ }
910
+ }
911
+ _executeHook("afterSanitizeAttributes", currentNode, null);
912
+ };
913
+ const _sanitizeShadowDOM = function _sanitizeShadowDOM2(fragment) {
914
+ let shadowNode = null;
915
+ const shadowIterator = _createNodeIterator(fragment);
916
+ _executeHook("beforeSanitizeShadowDOM", fragment, null);
917
+ while (shadowNode = shadowIterator.nextNode()) {
918
+ _executeHook("uponSanitizeShadowNode", shadowNode, null);
919
+ if (_sanitizeElements(shadowNode)) {
920
+ continue;
921
+ }
922
+ if (shadowNode.content instanceof DocumentFragment2) {
923
+ _sanitizeShadowDOM2(shadowNode.content);
924
+ }
925
+ _sanitizeAttributes(shadowNode);
926
+ }
927
+ _executeHook("afterSanitizeShadowDOM", fragment, null);
928
+ };
929
+ DOMPurify.sanitize = function(dirty) {
930
+ let cfg = arguments.length > 1 && arguments[1] !== void 0 ? arguments[1] : {};
931
+ let body = null;
932
+ let importedNode = null;
933
+ let currentNode = null;
934
+ let returnNode = null;
935
+ IS_EMPTY_INPUT = !dirty;
936
+ if (IS_EMPTY_INPUT) {
937
+ dirty = "<!-->";
938
+ }
939
+ if (typeof dirty !== "string" && !_isNode(dirty)) {
940
+ if (typeof dirty.toString === "function") {
941
+ dirty = dirty.toString();
942
+ if (typeof dirty !== "string") {
943
+ throw typeErrorCreate("dirty is not a string, aborting");
944
+ }
945
+ } else {
946
+ throw typeErrorCreate("toString is not a function");
947
+ }
948
+ }
949
+ if (!DOMPurify.isSupported) {
950
+ return dirty;
951
+ }
952
+ if (!SET_CONFIG) {
953
+ _parseConfig(cfg);
954
+ }
955
+ DOMPurify.removed = [];
956
+ if (typeof dirty === "string") {
957
+ IN_PLACE = false;
958
+ }
959
+ if (IN_PLACE) {
960
+ if (dirty.nodeName) {
961
+ const tagName = transformCaseFunc(dirty.nodeName);
962
+ if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
963
+ throw typeErrorCreate("root node is forbidden and cannot be sanitized in-place");
964
+ }
965
+ }
966
+ } else if (dirty instanceof Node) {
967
+ body = _initDocument("<!---->");
968
+ importedNode = body.ownerDocument.importNode(dirty, true);
969
+ if (importedNode.nodeType === NODE_TYPE.element && importedNode.nodeName === "BODY") {
970
+ body = importedNode;
971
+ } else if (importedNode.nodeName === "HTML") {
972
+ body = importedNode;
973
+ } else {
974
+ body.appendChild(importedNode);
975
+ }
976
+ } else {
977
+ if (!RETURN_DOM && !SAFE_FOR_TEMPLATES && !WHOLE_DOCUMENT && // eslint-disable-next-line unicorn/prefer-includes
978
+ dirty.indexOf("<") === -1) {
979
+ return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML(dirty) : dirty;
980
+ }
981
+ body = _initDocument(dirty);
982
+ if (!body) {
983
+ return RETURN_DOM ? null : RETURN_TRUSTED_TYPE ? emptyHTML : "";
984
+ }
985
+ }
986
+ if (body && FORCE_BODY) {
987
+ _forceRemove(body.firstChild);
988
+ }
989
+ const nodeIterator = _createNodeIterator(IN_PLACE ? dirty : body);
990
+ while (currentNode = nodeIterator.nextNode()) {
991
+ if (_sanitizeElements(currentNode)) {
992
+ continue;
993
+ }
994
+ if (currentNode.content instanceof DocumentFragment2) {
995
+ _sanitizeShadowDOM(currentNode.content);
996
+ }
997
+ _sanitizeAttributes(currentNode);
998
+ }
999
+ if (IN_PLACE) {
1000
+ return dirty;
1001
+ }
1002
+ if (RETURN_DOM) {
1003
+ if (RETURN_DOM_FRAGMENT) {
1004
+ returnNode = createDocumentFragment.call(body.ownerDocument);
1005
+ while (body.firstChild) {
1006
+ returnNode.appendChild(body.firstChild);
1007
+ }
1008
+ } else {
1009
+ returnNode = body;
1010
+ }
1011
+ if (ALLOWED_ATTR.shadowroot || ALLOWED_ATTR.shadowrootmode) {
1012
+ returnNode = importNode.call(originalDocument, returnNode, true);
1013
+ }
1014
+ return returnNode;
1015
+ }
1016
+ let serializedHTML = WHOLE_DOCUMENT ? body.outerHTML : body.innerHTML;
1017
+ if (WHOLE_DOCUMENT && ALLOWED_TAGS["!doctype"] && body.ownerDocument && body.ownerDocument.doctype && body.ownerDocument.doctype.name && regExpTest(DOCTYPE_NAME, body.ownerDocument.doctype.name)) {
1018
+ serializedHTML = "<!DOCTYPE " + body.ownerDocument.doctype.name + ">\n" + serializedHTML;
1019
+ }
1020
+ if (SAFE_FOR_TEMPLATES) {
1021
+ arrayForEach([MUSTACHE_EXPR2, ERB_EXPR2, TMPLIT_EXPR2], (expr) => {
1022
+ serializedHTML = stringReplace(serializedHTML, expr, " ");
1023
+ });
1024
+ }
1025
+ return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML(serializedHTML) : serializedHTML;
1026
+ };
1027
+ DOMPurify.setConfig = function() {
1028
+ let cfg = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : {};
1029
+ _parseConfig(cfg);
1030
+ SET_CONFIG = true;
1031
+ };
1032
+ DOMPurify.clearConfig = function() {
1033
+ CONFIG = null;
1034
+ SET_CONFIG = false;
1035
+ };
1036
+ DOMPurify.isValidAttribute = function(tag, attr, value) {
1037
+ if (!CONFIG) {
1038
+ _parseConfig({});
1039
+ }
1040
+ const lcTag = transformCaseFunc(tag);
1041
+ const lcName = transformCaseFunc(attr);
1042
+ return _isValidAttribute(lcTag, lcName, value);
1043
+ };
1044
+ DOMPurify.addHook = function(entryPoint, hookFunction) {
1045
+ if (typeof hookFunction !== "function") {
1046
+ return;
1047
+ }
1048
+ hooks[entryPoint] = hooks[entryPoint] || [];
1049
+ arrayPush(hooks[entryPoint], hookFunction);
1050
+ };
1051
+ DOMPurify.removeHook = function(entryPoint) {
1052
+ if (hooks[entryPoint]) {
1053
+ return arrayPop(hooks[entryPoint]);
1054
+ }
1055
+ };
1056
+ DOMPurify.removeHooks = function(entryPoint) {
1057
+ if (hooks[entryPoint]) {
1058
+ hooks[entryPoint] = [];
1059
+ }
1060
+ };
1061
+ DOMPurify.removeAllHooks = function() {
1062
+ hooks = {};
1063
+ };
1064
+ return DOMPurify;
1065
+ }
1066
+ var purify = createDOMPurify();
1067
+
103
1068
  // src/render.ts
104
- import DOMPurify from "dompurify";
105
- var html = (strings, ...values) => {
1069
+ var html2 = (strings, ...values) => {
106
1070
  let innerHTML = "";
107
1071
  const signalMap = /* @__PURE__ */ new Map();
108
1072
  strings.forEach((string, i) => {
@@ -114,7 +1078,7 @@ var html = (strings, ...values) => {
114
1078
  }
115
1079
  innerHTML += string + String(value);
116
1080
  });
117
- DOMPurify.sanitize(innerHTML);
1081
+ purify.sanitize(innerHTML);
118
1082
  const fragment = parseFragment(innerHTML);
119
1083
  const callbackBindingRegex = /(\{\{callback:.+\}\})/;
120
1084
  const signalBindingRegex = /(\{\{signal:.+\}\})/;
@@ -122,10 +1086,10 @@ var html = (strings, ...values) => {
122
1086
  for (const child of element.childNodes) {
123
1087
  if (child instanceof Text && signalBindingRegex.test(child.data)) {
124
1088
  const textList = child.data.split(signalBindingRegex);
125
- textList.forEach((text, i) => {
126
- const uniqueKey = text.replace(/\{\{signal:(.+)\}\}/, "$1");
127
- const signal = uniqueKey !== text ? signalMap.get(uniqueKey) : void 0;
128
- const newValue = signal !== void 0 ? signal() : text;
1089
+ textList.forEach((text2, i) => {
1090
+ const uniqueKey = text2.replace(/\{\{signal:(.+)\}\}/, "$1");
1091
+ const signal = uniqueKey !== text2 ? signalMap.get(uniqueKey) : void 0;
1092
+ const newValue = signal !== void 0 ? signal() : text2;
129
1093
  const newNode = (() => {
130
1094
  if (typeof newValue === "string") return new Text(newValue);
131
1095
  if (newValue instanceof DocumentFragment) return newValue;
@@ -150,10 +1114,10 @@ var html = (strings, ...values) => {
150
1114
  createEffect(() => {
151
1115
  let newText = "";
152
1116
  let hasNull = false;
153
- for (const text of textList) {
154
- const uniqueKey = text.replace(/\{\{signal:(.+)\}\}/, "$1");
155
- const signal = uniqueKey !== text ? signalMap.get(uniqueKey) : void 0;
156
- const value = signal !== void 0 ? signal() : text;
1117
+ for (const text2 of textList) {
1118
+ const uniqueKey = text2.replace(/\{\{signal:(.+)\}\}/, "$1");
1119
+ const signal = uniqueKey !== text2 ? signalMap.get(uniqueKey) : void 0;
1120
+ const value = signal !== void 0 ? signal() : text2;
157
1121
  if (value === null) hasNull = true;
158
1122
  newText += value;
159
1123
  }
@@ -201,10 +1165,10 @@ var css = (strings, ...values) => {
201
1165
  const textList = cssText.split(signalBindingRegex);
202
1166
  createEffect(() => {
203
1167
  const newCSSTextList = [];
204
- for (const text of textList) {
205
- const uniqueKey = text.replace(/\{\{signal:(.+)\}\}/, "$1");
206
- const signal = uniqueKey !== text ? signalMap.get(uniqueKey) : null;
207
- const newText = signal !== null ? signal() : text;
1168
+ for (const text2 of textList) {
1169
+ const uniqueKey = text2.replace(/\{\{signal:(.+)\}\}/, "$1");
1170
+ const signal = uniqueKey !== text2 ? signalMap.get(uniqueKey) : null;
1171
+ const newText = signal !== null ? signal() : text2;
208
1172
  newCSSTextList.push(newText);
209
1173
  }
210
1174
  const newCSSText = newCSSTextList.join("");
@@ -472,7 +1436,15 @@ You must set an initial value before calling a property signal's getter.
472
1436
  }
473
1437
  }
474
1438
  let _tagname = null;
475
- return {
1439
+ let _registry = null;
1440
+ let _registered = false;
1441
+ const register = () => {
1442
+ if (_tagname === null || _registry === null || _registered) return;
1443
+ _registry.register(_tagname, CustomElement);
1444
+ _registry.register(_tagname, elementResult);
1445
+ _registered = true;
1446
+ };
1447
+ const elementResult = {
476
1448
  define(tagname) {
477
1449
  if (customElements.get(tagname) !== void 0) {
478
1450
  console.warn(`Custom element "${tagname}" was already defined. Skipping...`);
@@ -480,18 +1452,17 @@ You must set an initial value before calling a property signal's getter.
480
1452
  }
481
1453
  customElements.define(tagname, CustomElement);
482
1454
  _tagname = tagname;
1455
+ register();
483
1456
  return this;
484
1457
  },
485
1458
  register(registry) {
486
- if (_tagname === null) {
487
- console.error("Custom element must be defined before registering.");
488
- return this;
489
- }
490
- registry.register(_tagname, CustomElement);
1459
+ _registry = registry;
1460
+ register();
491
1461
  return this;
492
1462
  },
493
1463
  eject: () => CustomElement
494
1464
  };
1465
+ return elementResult;
495
1466
  };
496
1467
  var createRegistry = () => {
497
1468
  const registry = /* @__PURE__ */ new Map();
@@ -513,5 +1484,10 @@ export {
513
1484
  css,
514
1485
  customElement,
515
1486
  derived,
516
- html
1487
+ html2 as html
517
1488
  };
1489
+ /*! Bundled license information:
1490
+
1491
+ dompurify/dist/purify.es.mjs:
1492
+ (*! @license DOMPurify 3.2.1 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.2.1/LICENSE *)
1493
+ */