url-sanitizer 2.3.1 → 3.0.0

package/README.md

@@ -15,7 +15,7 @@ It also provides built-in utilities to parse URLs and verify URI schemes.
 * **Deep Data URL Inspection**: Parses, decodes (including base64), and sanitizes nested data URLs.
 * **Blob URL Support**: Converts and sanitizes blob URLs into safe data URLs (async).
 * **Relative & Absolute Path Support**: Safely allows same-origin absolute paths and relative paths via an opt-in parameter.
-* **DOMPurify Integration**: Purifies HTML/SVG content embedded within data URLs. *Note: This library is optimized for URL sanitization and is not intended as a complete HTML sanitizer for arbitrary untrusted markup.*
+* **DOMPurify Integration**: Purifies HTML/SVG content embedded within data URLs. **Note:** This library is optimized for URL sanitization and is **not intended** as a complete HTML sanitizer for arbitrary untrusted markup.
 * **Pure ESM with TypeScript Support**: Works seamlessly across modern environments like Node.js, Deno, websites, and browsers (including WebExtensions).
 
 ## Table of Contents
@@ -42,9 +42,10 @@ npm i url-sanitizer
 
 ### Deno
 
-You can import directly in your code without installing:
+You can import directly in your code without installing.
+
 ``` javascript
-import urlSanitizer from "npm:url-sanitizer";
+import urlSanitizer from 'npm:url-sanitizer';
 ```
 
 ### Browsers and Websites
@@ -55,7 +56,13 @@ Standalone ESM builds are available in the `dist/` directory:
 * node_modules/url-sanitizer/dist/url-sanitizer-wo-dompurify.min.js
 
 Alternatively, download them from [Releases](https://github.com/asamuzaK/urlSanitizer/releases).
-**NOTE:** url-sanitizer-wo-dompurify.min.js is a lightweight build without [DOMPurify](https://www.npmjs.com/package/dompurify) bundled.
+``` html
+<script type="module">
+  import urlSanitizer from 'path/to/url-sanitizer.min.js';
+</script>
+```
+
+**Note:** `url-sanitizer-wo-dompurify.min.js` is a lightweight build without [DOMPurify](https://www.npmjs.com/package/dompurify) bundled.
 If you use this build, ensure DOMPurify is exposed globally (e.g., `window.DOMPurify`), otherwise the sanitizer will throw an error at runtime.
 
 ## Usage
@@ -87,65 +94,80 @@ Sanitizes the given URL asynchronously.
   * opt.debug **boolean?** If `true`, outputs internal error/warning logs to the console. Default is `false`.
   * opt.maxBlobSize **number?** Maximum allowed blob size in bytes. Default is `33554432` (32MB). Exceeding this limit will result in parsing failure to prevent memory exhaustion.
 
-**Returns** **Promise<string?>** Sanitized URL, nullable.
+**Returns** **Promise&lt;string?&gt;** Sanitized URL, nullable.
 
 #### Samples
 
+Never allow `javascript:` and/or `vbscript:` schemes:
+``` javascript
+const res1 = await sanitizeURL('javascript:alert(1)');
+// => null
+
+const res1_2 = await sanitizeURL('vbscript:msgbox("XSS")');
+// => null
+
+// Even if explicitly added to the `allow` or `only` list, they are strictly blocked:
+const res1_3 = await sanitizeURL('javascript:alert(1)', {
+  allow: ['javascript']
+});
+// => null
+```
+
 Sanitize tags and quotes:
 ``` javascript
-const res1 = await sanitizeURL('https://example.com/?<script>alert(1)</script>');
+const res2 = await sanitizeURL('https://example.com/?<script>alert(1)</script>');
 // => 'https://example.com/'
 
-const res1_2 = await sanitizeURL('https://example.com/" onclick="alert(1)"');
+const res2_2 = await sanitizeURL('https://example.com/" onclick="alert(1)"');
 // => 'https://example.com/'
 ```
 
 Parse and sanitize data URLs:
 ``` javascript
-const res2 = await sanitizeURL('data:text/html,<div><script>alert(1);</script></div><p onclick="alert(2)"></p>', {
+const res3 = await sanitizeURL('data:text/html,<div><script>alert(1);</script></div><p onclick="alert(2)"></p>', {
   allow: ['data']
 });
 // => 'data:text/html,%3Cdiv%3E%3C/div%3E%3Cp%3E%3C/p%3E'
 
-console.log(decodeURIComponent(res2));
+console.log(decodeURIComponent(res3));
 // => 'data:text/html,<div></div><p></p>'
 
 // Also can parse and sanitize base64 encoded data:
-const base64data3 = btoa('<div><script>alert(1);</script></div>');
-const res3 = await sanitizeURL(`data:text/html;base64,${base64data3}`, {
+const base64data4 = btoa('<div><script>alert(1);</script></div>');
+const res4 = await sanitizeURL(`data:text/html;base64,${base64data4}`, {
   allow: ['data']
 });
 // => 'data:text/html,%3Cdiv%3E%3C/div%3E'
 
-console.log(decodeURIComponent(res3));
+console.log(decodeURIComponent(res4));
 // => 'data:text/html,<div></div>'
 
-const base64data3_2 = btoa('<div><img src="javascript:alert(1)"></div>');
-const res3_2 = await sanitizeURL(`data:text/html;base64,${base64data3_2}`);
+const base64data4_2 = btoa('<div><img src="javascript:alert(1)"></div>');
+const res4_2 = await sanitizeURL(`data:text/html;base64,${base64data4_2}`);
 // => 'data:text/html,%3Cdiv%3E%3Cimg%3E%3C/div%3E'
 
-console.log(decodeURIComponent(res3_2));
+console.log(decodeURIComponent(res4_2));
 // => 'data:text/html,<div><img></div>'
 ```
 
 Parse and sanitize blob URLs:
 ``` javascript
-const blob4 = new Blob(['<svg><g onload="alert(1)"/></svg>'], {
+const blob5 = new Blob(['<svg><g onload="alert(1)"/></svg>'], {
   type: 'image/svg+xml'
 });
-const url4 = URL.createObjectURL(blob4);
-const res4 = await sanitizeURL(url4, {
+const url5 = URL.createObjectURL(blob5);
+const res5 = await sanitizeURL(url5, {
   allow: ['blob']
 });
 // => 'data:image/svg+xml,%3Csvg%3E%3Cg%3E%3C/g%3E%3C/svg%3E'
 
-console.log(decodeURIComponent(res4));
+console.log(decodeURIComponent(res5));
 // => 'data:image/svg+xml,<svg><g></g></svg>'
 ```
 
 Denies if the scheme matches the `deny` list:
 ``` javascript
-const res5 = await sanitizeURL('web+foo://example.com', {
+const res6 = await sanitizeURL('web+foo://example.com', {
   deny: ['web+foo']
 });
 // => null
@@ -153,18 +175,18 @@ const res5 = await sanitizeURL('web+foo://example.com', {
 
 Allows only if the scheme matches the `only` list:
 ``` javascript
-const res6 = await sanitizeURL('http://example.com', {
+const res7 = await sanitizeURL('http://example.com', {
   only: ['data', 'git', 'https']
 });
 // => null
 
-const res6_2 = await sanitizeURL('https://example.com/"onmouseover="alert(1)"', {
+const res7_2 = await sanitizeURL('https://example.com/"onmouseover="alert(1)"', {
   only: ['data', 'git', 'https']
 });
 // => 'https://example.com/'
 
 // `only` also allows combination of the schemes in the list
-const res7 = await sanitizeURL('git+https://example.com/foo.git?<script>alert(1)</script>', {
+const res8 = await sanitizeURL('git+https://example.com/foo.git?<script>alert(1)</script>', {
   only: ['data', 'git', 'https']
 });
 // => 'git+https://example.com/foo.git'
@@ -175,19 +197,23 @@ const res7 = await sanitizeURL('git+https://example.com/foo.git?<script>alert(1)
 Synchronous version of `sanitizeURL()`.
 
 * `data` and `file` schemes must be explicitly allowed.
-* `blob` scheme is not supported and will return `null`. Use the async version for `blob`.
+
+**Note:** `blob` scheme is **not supported** and will return `null`.
+Use the async version for `blob`.
 
 ### parseURL(url)
 
 Parses the given URL asynchronously.
 
-* Blob URLs are simply parsed and not yet sanitized at this stage.
+* **Data URLs**: Parsed, decoded, and **sanitized** during this process.
+  For example, if the payload contains HTML/SVG, malicious attributes are removed and the content is safely re-encoded.
+* **Blob URLs**: Simply parsed and **not yet sanitized** at this stage.
 
 #### Parameters
 
 * url **string** URL input.
 
-**Returns** **Promise<ParsedURL>** Result.
+**Returns** **Promise&lt;ParsedURL&gt;** Result.
 
 #### ParsedURL
 
@@ -281,16 +307,20 @@ Synchronous version of `parseURL()`.
 
 ### isURI(uri)
 
-Verifies if the given URI is valid and registered.
+Checks if the given string is a valid URI and whether its scheme is recognized as safe and allowed.
+
+Specifically, it verifies that the input has a correct URI syntax, is not a denied scheme (like `javascript:`), and meets one of the following criteria:
+* The scheme is registered in the default list (e.g., IANA registered schemes, `https`, `mailto`).
+* The scheme has a custom prefix like `web+` or `ext+` (which are always allowed for web applications).
 
 #### Parameters
 
 * uri **string** URI input.
 
-**Returns** **Promise<boolean>** Result.
+**Returns** **Promise&lt;boolean&gt;** `true` if the URI is syntactically valid and uses an allowed/registered scheme; otherwise `false`.
 
-* Always `true` for `web+*` and `ext+*` schemes (except `web+javascript`, `web+vbscript`, `ext+javascript`, and `ext+vbscript`).
-* `false` for `javascript` and `vbscript` schemes.
+* Always `true` for valid `web+*` and `ext+*` schemes (except `web+javascript`, `web+vbscript`, `ext+javascript`, and `ext+vbscript`).
+* Always `false` for `javascript` and `vbscript` schemes, or any unknown/unregistered schemes (e.g., `foo:`).
 
 ``` javascript
 const res1 = await isURI('https://example.com/foo');
@@ -341,7 +371,7 @@ Remove a scheme from the list of registered URI schemes.
 
 #### urlSanitizer.reset()
 
-Reset registered schemes to the default list and clear internal cache.
+Reset registered schemes to the default list.
 
 ## Performance
 
@@ -351,9 +381,9 @@ Execution times were measured using [mitata](https://github.com/evanwashere/mita
 
 | URL Type | `url-sanitizer` | [@braintree/sanitize-url](https://www.npmjs.com/package/@braintree/sanitize-url) | [strict-url-sanitise](https://www.npmjs.com/package/strict-url-sanitise) |
 | :--- | :--- | :--- | :--- |
-| **Normal HTTP URL** | ~2.90 µs/iter | ~4.55 µs/iter | ~4.17 µs/iter |
-| **XSS URL** | ~1.31 µs/iter | ~1.58 µs/iter | ~10.19 µs/iter |
-| **Complex Data URL** | ~263.16 µs/iter | ~2.76 µs/iter | ~9.76 µs/iter |
+| **Normal HTTP URL** | ~2.63 µs/iter | ~4.24 µs/iter | ~4.02 µs/iter |
+| **XSS URL** | ~1.23 µs/iter | ~1.55 µs/iter | ~9.47 µs/iter |
+| **Complex Data URL** | ~246.46 µs/iter | ~2.76 µs/iter | ~9.60 µs/iter |
 
 ### Characteristics & Trade-offs
 

package/dist/url-sanitizer-wo-dompurify.min.js

@@ -1,4 +1,4 @@
-var Q={sanitize:(...t)=>{if(globalThis?.DOMPurify)return globalThis.DOMPurify.sanitize(...t);let e=["DOMPurify is not available.","Ensure DOMPurify is exposed globally (e.g., window.DOMPurify)."];throw new Error(e.join(" "))}};var K=/^[\w+/=-]+$/;var k=/data:[\w#&+./;=-]*,/,B=/data:[\w#&+./;=^]*base64,[\w+/=-]+/i,V=/data:[\w#&+./;=-]*,[^\x22]+/g,J=/&#(x(?:00)?[\dA-F]{2}|0?\d{1,3});?/gi,W=/^(?:application\/(?:[\w#&.;-]+\+)?x|image\/svg\+x|text\/(?:ht|x))ml;?/;var ee=/^[a-z][\da-z+.-]*$/,te=/^(?:ext|web)\+[a-z]+$/,F=/(?:java|vb)script/,M=/(?:java|vb)script|blob/,N=/%(?:22|27|3C|3E)|[\x22\x27<>]/,se=/^%[\dA-F]{2}$/i;var y=t=>Object.prototype.toString.call(t).slice(8,-1),f=t=>typeof t=="string"||t instanceof String;var{FileReader:re}=globalThis;var O=[7,8,9,10,11,12,13,27,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255];var G=["aaa","aaas","about","acap","acct","acd","acr","adiumxtra","adt","afp","afs","agtp","aim","amss","android","appdata","apt","ar","ari","ark","at","attachment","aw","barion","beshare","bitcoin","bitcoincash","bl","blob","bluetooth","bolo","brid","browserext","cabal","caip","calculator","callto","cap","cast","casts","chrome","chrome-extension","cid","coap","coaps","com-eventbrite-attendee","content","content-type","crid","cstr","cttps","cvs","dab","dat","data","dav","dhttp","diaspora","dict","did","dilithium3","dis","dlna-playcontainer","dlna-playsingle","dnp","dns","dntp","doi","donau","dpp","drm","dtmi","dtn","dvb","dvx","dweb","ed2k","eid","elsi","embedded","ens","esim","ethereum","example","facetime","feed","feedready","fido","file","finger","first-run-pen-experience","fish","fm","ftp","fuchsia-pkg","geo","gg","git","gitoid","gizmoproject","go","gopher","graph","gtalk","h323","ham","hcap","hcp","hs20","http","https","hxxp","hxxps","hydrazone","hyper","i0","iax","ibi","ibi-","icap","icon","ilstring","im","imap","info","iotdisco","ipfs","ipn","ipns","ipp","ipps","irc","irc6","ircs","iris","iris.beep","iris.lwz","iris.xpc","iris.xpcs","isostore","itms","jabber","jar","jms","keyparc","lastfm","lbry","ldap","ldaps","leaptofrogans","lid","linkid","lorawan","lpa","lvlt","machineProvisioningProgressReporter","magnet","mailto","maps","market","matrix","message","microsoft.windows.camera","microsoft.windows.camera.multipicker","microsoft.windows.camera.picker","mid","mms","mongodb","moz","moz-extension","mqtt","mqtts","ms-access","ms-appinstaller","ms-browser-extension","ms-calculator","ms-drive-to","ms-enrollment","ms-excel","ms-eyecontrolspeech","ms-gamebarservices","ms-gamingoverlay","ms-getoffice","ms-help","ms-infopath","ms-inputapp","ms-launchremotedesktop","ms-lockscreencomponent-config","ms-media-stream-id","ms-meetnow","ms-mixedrealitycapture","ms-mobileplans","ms-newsandinterests","ms-officeapp","ms-people","ms-personacard","ms-powerpoint","ms-project","ms-publisher","ms-recall","ms-remotedesktop","ms-remotedesktop-launch","ms-restoretabcompanion","ms-screenclip","ms-screensketch","ms-search","ms-search-repair","ms-secondary-screen-controller","ms-secondary-screen-setup","ms-settings","ms-settings-airplanemode","ms-settings-bluetooth","ms-settings-camera","ms-settings-cellular","ms-settings-cloudstorage","ms-settings-connectabledevices","ms-settings-displays-topology","ms-settings-emailandaccounts","ms-settings-language","ms-settings-location","ms-settings-lock","ms-settings-nfctransactions","ms-settings-notifications","ms-settings-power","ms-settings-privacy","ms-settings-proximity","ms-settings-screenrotation","ms-settings-wifi","ms-settings-workplace","ms-spd","ms-stickers","ms-sttoverlay","ms-transit-to","ms-useractivityset","ms-uup","ms-virtualtouchpad","ms-visio","ms-walk-to","ms-whiteboard","ms-whiteboard-cmd","ms-widgetboard","ms-widgets","ms-word","msnim","msrp","msrps","mss","mt","mtqp","mtrust","mumble","mupdate","mvn","mvrp","mvrps","news","nfs","ni","nih","nntp","notes","num","ocf","oid","onenote","onenote-cmd","opaquelocktoken","openid","openpgp4fpr","otpauth","palm","paparazzi","payto","pkcs11","platform","pop","pres","proxy","psyc","pttp","pwid","qb","query","quic-transport","redis","rediss","reload","res","resource","rmi","rsync","rtmfp","rtmp","rtsp","rtsps","rtspu","sarif","secondlife","secret-token","service","session","sftp","sgn","shc","shelter","sieve","simpleledger","simplex","sip","sips","skype","smb","smp","sms","smtp","snmp","soap.beep","soap.beeps","soldat","spacify","spiffe","spotify","ssb","ssh","starknet","steam","stun","stuns","submit","svn","swh","swid","swidpath","tag","taler","teamspeak","teapot","teapots","tel","teliaeid","telnet","tftp","things","thismessage","tip","tn3270","tool","turn","turns","tv","udp","unreal","upn","urn","ut2004","uuid-in-package","v-event","vemmi","ventrilo","ves","view-source","vnc","vscode","vscode-insiders","vsls","w3","wasm","wasm-js","wcr","web3","webcal","wifi","ws","wss","wtai","wyciwyg","xcompute","xcon","xcon-userid","xfire","xftp","xmlrpc.beep","xmlrpc.beeps","xmpp","xrcp","xri","ymsgr","z39.50r","z39.50s","ztdnaid"];var ie=t=>{if(!f(t))throw new TypeError(`Expected String but got ${y(t)}.`);let e=[];for(let s of t)e.push(`%${s.charCodeAt(0).toString(16).toUpperCase()}`);return e.join("")},ae=t=>{f(t)&&se.test(t)&&(t=t.toUpperCase());let[e,s,i,r,o,n]=["&","#","<",">",'"',"'"].map(ie),a;return t===e?a=`${e}amp;`:t===i?a=`${e}lt;`:t===r?a=`${e}gt;`:t===o?a=`${e}quot;`:t===n?a=`${e}${s}39;`:a=t,a},oe=t=>{if(f(t)){if(!K.test(t))throw new Error(`Invalid base64 data: ${t}`)}else throw new TypeError(`Expected String but got ${y(t)}.`);let e=atob(t),s=Uint8Array.from([...e].map(o=>o.charCodeAt(0))),i=new Set(O),r;return s.every(o=>i.has(o))?r=e.replace(/\s/g,ie):r=t,r},H=(t,e=0)=>{if(!f(t))throw new TypeError(`Expected String but got ${y(t)}.`);if(Number.isInteger(e)){if(e>16)throw new Error("Character references nested too deeply.")}else throw new TypeError(`Expected Number but got ${y(e)}.`);let s=decodeURIComponent(t);if(/&#/.test(s)){let i=new Set(O),r=[...s.matchAll(J)].reverse();for(let o of r){let[n,a]=o,c;if(/^x[\dA-F]+/i.test(a)?c=parseInt(`0${a}`,16):/^\d+/.test(a)&&(c=parseInt(a)),Number.isInteger(c)){let{index:h}=o,[l,g]=[s.substring(0,h),s.substring(h+n.length)];i.has(c)?(s=`${l}${String.fromCharCode(c)}${g}`,(/#x?$/.test(l)||/^#(?:x(?:00)?[2-7]|\d)/.test(g))&&(s=H(s,++e))):c<256&&(s=`${l}${g}`)}}}return s},ne=(t,e=33554432)=>new Promise((s,i)=>{if(Number.isInteger(t?.size)){if(Number.isInteger(e)&&t.size>e)return i(new DOMException(`Blob size (${t.size} bytes) exceeds the maximum allowed size of ${e} bytes.`,"NotReadableError"))}else return s(null);let r=new re;r.addEventListener("error",()=>i(r.error)),r.addEventListener("abort",()=>s(r.result)),r.addEventListener("load",()=>s(r.result)),r.readAsDataURL(t)}),I=class{#e;constructor(){this.#e=new Set(G)}get(){return[...this.#e]}has(e){return this.#e.has(e)}add(e){if(f(e)){if(F.test(e)||!ee.test(e))throw new Error(`Invalid scheme: ${e}`)}else throw new TypeError(`Expected String but got ${y(e)}.`);return this.#e.add(e),[...this.#e]}remove(e){return this.#e.delete(e)}verify(e){let s;if(f(e))try{let{protocol:i}=new URL(e),r=i.replace(/:$/,""),o=r.split("+");s=!F.test(r)&&te.test(r)||o.every(n=>this.#e.has(n))}catch{s=!1}return!!s}reset(){this.#e.clear();for(let e of G)this.#e.add(e)}};var E=(t,e,s)=>{t&&console.warn(`[URLSanitizer Debug] ${e}`,s?s.message:"")},q=class extends I{#e;#t=new Set;constructor(){super(),this.#e=0}replace(e){if(!f(e))throw new TypeError(`Expected String but got ${y(e)}.`);let s=e;if(k.test(s)){let r=[...s.matchAll(V)].reverse();for(let o of r){let[n]=o;B.test(n)&&([n]=B.exec(n)),this.#e++,this.#t.add(n);let a;try{a=this.sanitize(n,{allow:["data"]})}finally{this.#e--,this.#t.delete(n)}let{index:c}=o,[h,l]=[s.substring(0,c),s.substring(c+n.length)];a?s=`${h}${a}${l}`:s=`${h}${l}`}}return s}purify(e){if(!f(e))throw new TypeError(`Expected String but got ${y(e)}.`);let s=e;try{s=decodeURIComponent(e)}catch{}let i=Q.sanitize(s);i&&k.test(i)&&(i=this.replace(i)),i=i.replace(/(?:#|%23)$/,"").replace(/(?<!(?:#|%23).*)(?:\?|%3F)$/,"");try{return encodeURI(i)}catch{return i}}sanitize(e,s){if(this.#e>16)throw new Error("Data URLs nested too deeply.");let{allow:i,deny:r,only:o,allowRelative:n=!1,debug:a=!1}=s??{},c=new Map([["blob",!1],["data",!1],["file",!1],["javascript",!1],["vbscript",!1]]),h=new Set,l=!1;if(Array.isArray(o)&&o.length){let d=super.get();for(let m of d)c.set(m,!1);let p=Object.values(o);for(let m of p)if(f(m)&&(m=m.trim(),!M.test(m))){if(super.has(m))c.set(m,!0);else{try{super.add(m)}catch(U){let T=`Failed to add scheme '${m}' in 'only' list.`;E(a,T,U)}super.has(m)&&(c.set(m,!0),h.add(m))}!l&&c.has(m)&&(l=c.get(m))}}else{if(Array.isArray(i)&&i.length){let d=Object.values(i);for(let p of d)if(f(p)&&(p=p.trim(),!M.test(p)))if(super.has(p))c.set(p,!0);else{try{super.add(p)}catch(m){let U=`Failed to add scheme '${p}' in 'allow' list.`;E(a,U,m)}super.has(p)&&(c.set(p,!0),h.add(p))}}if(Array.isArray(r)&&r.length){let d=Object.values(r);for(let p of d)f(p)&&(p=p.trim(),p&&c.set(p,!1))}}let g,_=super.verify(e),v=!1;if(!_&&n)try{let{hostname:d,protocol:p}=new URL(e,"http://dummy.local");p==="http:"&&d==="dummy.local"&&(_=!0,v=!0)}catch(d){E(a,"Failed to parse relative URL.",d)}if(_){let d,p,m,U,T,A="",z=[],$=!1;if(v)$=!0;else if({hash:d,href:p,pathname:m,protocol:U,search:T}=new URL(e),A=U.replace(/:$/,""),z=A.split("+"),l)$=z.every(u=>c.get(u));else for(let[u,x]of c.entries())if($=x||A!==u&&z.every(S=>S!==u),!$)break;if($){let L=v?!1:z.includes("data"),u=v?e:p;if(L){let[x,...S]=m.split(","),D=`${S.join(",")}${T}${d}`,C=x.split(";"),X=C[C.length-1]==="base64",b=D;X&&(b=oe(D));try{let P=H(b).trim(),{protocol:Z}=new URL(P);Z.replace(/:$/,"").split("+").some(ce=>M.test(ce))&&(u="")}catch(P){E(a,"Failed to parse inner data URL protocol.",P)}let Y=k.test(b);(b!==D||Y)&&Y&&(b=this.replace(b)),(!x||W.test(x))&&(b=this.purify(b)),u&&b?(X&&b!==D&&C.pop(),u=`${A}:${C.join(";")},${b}`):u=""}if(!L&&N.test(u)){let x=N.exec(u),{index:S}=x;u=u.substring(0,S).replace(/[?&]$/,"")}u&&(g=u.replace(/%26/g,ae))}h.size&&h.forEach(L=>{super.remove(L)})}return g||null}parse(e,s){if(!f(e))throw new TypeError(`Expected String but got ${y(e)}.`);let i=new Map([["input",e]]),r;if(this.verify(e)){let{protocol:o}=new URL(e);o==="blob:"?r=e:r=this.sanitize(e,s??{allow:["data","file"]})}if(r){let o=new URL(r),{pathname:n,protocol:a}=o,h=a.replace(/:$/,"").split("+").includes("data");if(i.set("valid",!0),h){let l=new Map,[g,..._]=n.split(","),v=`${_.join(",")}`,d=g.split(";"),p=d[d.length-1]==="base64";p&&d.pop(),l.set("mime",d.join(";")),l.set("base64",p),l.set("data",v),i.set("data",Object.fromEntries(l))}else i.set("data",null);for(let l in o){let g=o[l];f(g)&&i.set(l,g)}}else i.set("valid",!1);return Object.fromEntries(i)}reset(){super.reset(),this.#e=0,this.#t.clear()}};var w=new q,fe=async(t,e={allow:[],deny:[],only:[],allowRelative:!1,debug:!1,maxBlobSize:33554432})=>{let s=!!e?.debug,i=Number.isInteger(e?.maxBlobSize)&&e.maxBlobSize>0?e.maxBlobSize:33554432,r;if(t&&f(t)){let o;try{let{protocol:n}=new URL(t);o=n.replace(/:$/,"")}catch(n){E(s,`Invalid URL input format: ${t}`,n)}if(o==="blob"){let{allow:n,deny:a,only:c}=e;if(Array.isArray(n)&&n.includes("blob")&&!(Array.isArray(a)&&a.includes("blob"))||Array.isArray(c)&&c.includes("blob")){let h;try{h=await fetch(t).then(l=>l.blob()).then(l=>ne(l,i))}catch(l){let g=`Failed to fetch and convert blob URL: ${t}`;E(s,g,l)}if(h){if(Array.isArray(c))c.includes("data")||c.push("data");else if(Array.isArray(n)&&(n.includes("data")||n.push("data"),Array.isArray(a)&&a.includes("data"))){let l=a.indexOf("data");a.splice(l,1)}r=w.sanitize(h,e)}}URL.revokeObjectURL(t)}else(o||e.allowRelative)&&(r=w.sanitize(t,e))}return r||null},he=(t,e)=>{let s;if(t&&f(t)){let i;try{let{protocol:r}=new URL(t);i=r.replace(/:$/,"")}catch(r){let o=`Failed to parse URL: ${t}`;E(e?.debug,o,r)}i==="blob"?URL.revokeObjectURL(t):(i||e?.allowRelative)&&(s=w.sanitize(t,e))}return s||null},ue=async t=>w.parse(t),ge=t=>w.parse(t),be=async t=>w.verify(t),ye=t=>w.verify(t),we=w;export{we as default,be as isURI,ye as isURISync,ue as parseURL,ge as parseURLSync,fe as sanitizeURL,he as sanitizeURLSync};
+var K={sanitize:(...t)=>{if(globalThis?.DOMPurify)return globalThis.DOMPurify.sanitize(...t);let e=["DOMPurify is not available.","Ensure DOMPurify is exposed globally (e.g., window.DOMPurify)."];throw new Error(e.join(" "))}};var V=/^[\w+/=-]+$/;var D=/data:[\w#&+./;=-]*,/,I=/data:[\w#&+./;=^]*base64,[\w+/=-]+/i,J=/data:[\w#&+./;=-]*,[^\x22]+/g,W=/&#(x(?:00)?[\dA-F]{2}|0?\d{1,3});?/gi,ee=/^(?:application\/(?:[\w#&.;-]+\+)?x|image\/svg\+x|text\/(?:ht|x))ml;?/;var te=/^[a-z][\da-z+.-]*$/,se=/^(?:ext|web)\+[a-z]+$/,O=/(?:java|vb)script/,P=/(?:java|vb)script|blob/,j=/%(?:22|27|3C|3E)|[\x22\x27<>]/,re=/^%[\dA-F]{2}$/i;var b=t=>Object.prototype.toString.call(t).slice(8,-1),m=t=>typeof t=="string"||t instanceof String;var B=[7,8,9,10,11,12,13,27,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255];var F=["aaa","aaas","about","acap","acct","acd","acr","adiumxtra","adt","afp","afs","agtp","aim","amss","android","appdata","apt","ar","ari","ark","at","attachment","aw","barion","beshare","bitcoin","bitcoincash","bl","blob","bluetooth","bolo","brid","browserext","cabal","caip","calculator","callto","cap","cast","casts","chrome","chrome-extension","cid","coap","coaps","com-eventbrite-attendee","content","content-type","crid","cstr","cttps","cvs","dab","dat","data","dav","dhttp","diaspora","dict","did","dilithium3","dis","dlna-playcontainer","dlna-playsingle","dnp","dns","dntp","doi","donau","dpp","drm","dtmi","dtn","dvb","dvx","dweb","ed2k","eid","elsi","embedded","ens","esim","ethereum","example","facetime","feed","feedready","fido","file","finger","first-run-pen-experience","fish","fm","ftp","fuchsia-pkg","geo","gg","git","gitoid","gizmoproject","go","gopher","graph","gtalk","h323","ham","hcap","hcp","hs20","http","https","hxxp","hxxps","hydrazone","hyper","i0","iax","ibi","ibi-","icap","icon","ilstring","im","imap","info","iotdisco","ipfs","ipn","ipns","ipp","ipps","irc","irc6","ircs","iris","iris.beep","iris.lwz","iris.xpc","iris.xpcs","isostore","itms","jabber","jar","jms","keyparc","lastfm","lbry","ldap","ldaps","leaptofrogans","lid","linkid","lorawan","lpa","lvlt","machineProvisioningProgressReporter","magnet","mailto","maps","market","matrix","message","microsoft.windows.camera","microsoft.windows.camera.multipicker","microsoft.windows.camera.picker","mid","mms","mongodb","moz","moz-extension","mqtt","mqtts","ms-access","ms-appinstaller","ms-browser-extension","ms-calculator","ms-drive-to","ms-enrollment","ms-excel","ms-eyecontrolspeech","ms-gamebarservices","ms-gamingoverlay","ms-getoffice","ms-help","ms-infopath","ms-inputapp","ms-launchremotedesktop","ms-lockscreencomponent-config","ms-media-stream-id","ms-meetnow","ms-mixedrealitycapture","ms-mobileplans","ms-newsandinterests","ms-officeapp","ms-people","ms-personacard","ms-powerpoint","ms-project","ms-publisher","ms-recall","ms-remotedesktop","ms-remotedesktop-launch","ms-restoretabcompanion","ms-screenclip","ms-screensketch","ms-search","ms-search-repair","ms-secondary-screen-controller","ms-secondary-screen-setup","ms-settings","ms-settings-airplanemode","ms-settings-bluetooth","ms-settings-camera","ms-settings-cellular","ms-settings-cloudstorage","ms-settings-connectabledevices","ms-settings-displays-topology","ms-settings-emailandaccounts","ms-settings-language","ms-settings-location","ms-settings-lock","ms-settings-nfctransactions","ms-settings-notifications","ms-settings-power","ms-settings-privacy","ms-settings-proximity","ms-settings-screenrotation","ms-settings-wifi","ms-settings-workplace","ms-spd","ms-stickers","ms-sttoverlay","ms-transit-to","ms-useractivityset","ms-uup","ms-virtualtouchpad","ms-visio","ms-walk-to","ms-whiteboard","ms-whiteboard-cmd","ms-widgetboard","ms-widgets","ms-word","msnim","msrp","msrps","mss","mt","mtqp","mtrust","mumble","mupdate","mvn","mvrp","mvrps","news","nfs","ni","nih","nntp","notes","num","ocf","oid","onenote","onenote-cmd","opaquelocktoken","openid","openpgp4fpr","otpauth","palm","paparazzi","payto","pkcs11","platform","pop","pres","proxy","psyc","pttp","pwid","qb","query","quic-transport","redis","rediss","reload","res","resource","rmi","rsync","rtmfp","rtmp","rtsp","rtsps","rtspu","sarif","secondlife","secret-token","service","session","sftp","sgn","shc","shelter","sieve","simpleledger","simplex","sip","sips","skype","smb","smp","sms","smtp","snmp","soap.beep","soap.beeps","soldat","spacify","spiffe","spotify","ssb","ssh","starknet","steam","stun","stuns","submit","svn","swh","swid","swidpath","tag","taler","teamspeak","teapot","teapots","tel","teliaeid","telnet","tftp","things","thismessage","tip","tn3270","tool","turn","turns","tv","udp","unreal","upn","urn","ut2004","uuid-in-package","v-event","vemmi","ventrilo","ves","view-source","vnc","vscode","vscode-insiders","vsls","w3","wasm","wasm-js","wcr","web3","webcal","wifi","ws","wss","wtai","wyciwyg","xcompute","xcon","xcon-userid","xfire","xftp","xmlrpc.beep","xmlrpc.beeps","xmpp","xrcp","xri","ymsgr","z39.50r","z39.50s","ztdnaid"];var{FileReader:ie}=globalThis;var ae=t=>{if(!m(t))throw new TypeError(`Expected String but got ${b(t)}.`);let e=[];for(let s of t)e.push(`%${s.charCodeAt(0).toString(16).toUpperCase()}`);return e.join("")},oe=t=>{m(t)&&re.test(t)&&(t=t.toUpperCase());let[e,s,r,i,a,n]=["&","#","<",">",'"',"'"].map(ae),o;return t===e?o=`${e}amp;`:t===r?o=`${e}lt;`:t===i?o=`${e}gt;`:t===a?o=`${e}quot;`:t===n?o=`${e}${s}39;`:o=t,o},ne=t=>{if(m(t)){if(!V.test(t))throw new Error(`Invalid base64 data: ${t}`)}else throw new TypeError(`Expected String but got ${b(t)}.`);let e=atob(t),s=Uint8Array.from([...e].map(a=>a.charCodeAt(0))),r=new Set(B),i;return s.every(a=>r.has(a))?i=e.replace(/\s/g,ae):i=t,i},N=(t,e=0)=>{if(!m(t))throw new TypeError(`Expected String but got ${b(t)}.`);if(Number.isInteger(e)){if(e>16)throw new Error("Character references nested too deeply.")}else throw new TypeError(`Expected Number but got ${b(e)}.`);let s=decodeURIComponent(t);if(/&#/.test(s)){let r=new Set(B),i=[...s.matchAll(W)].reverse();for(let a of i){let[n,o]=a,p;if(/^x[\dA-F]+/i.test(o)?p=parseInt(`0${o}`,16):/^\d+/.test(o)&&(p=parseInt(o)),Number.isInteger(p)){let{index:d}=a,[c,h]=[s.substring(0,d),s.substring(d+n.length)];r.has(p)?(s=`${c}${String.fromCharCode(p)}${h}`,(/#x?$/.test(c)||/^#(?:x(?:00)?[2-7]|\d)/.test(h))&&(s=N(s,++e))):p<256&&(s=`${c}${h}`)}}}return s},ce=(t,e=33554432)=>new Promise((s,r)=>{if(Number.isInteger(t?.size)){if(Number.isInteger(e)&&t.size>e)return r(new DOMException(`Blob size (${t.size} bytes) exceeds the maximum allowed size of ${e} bytes.`,"NotReadableError"))}else return s(null);let i=new ie;i.addEventListener("error",()=>r(i.error)),i.addEventListener("abort",()=>s(i.result)),i.addEventListener("load",()=>s(i.result)),i.readAsDataURL(t)}),C=class{#e=new Set(F);get(){return[...this.#e]}has(e){return this.#e.has(e)}add(e){if(m(e)){if(O.test(e)||!te.test(e))throw new Error(`Invalid scheme: ${e}`)}else throw new TypeError(`Expected String but got ${b(e)}.`);return this.#e.add(e),[...this.#e]}remove(e){return this.#e.delete(e)}verify(e){let s;if(m(e))try{let{protocol:r}=new URL(e),i=r.replace(/:$/,""),a=i.split("+");s=!O.test(i)&&se.test(i)||a.every(n=>this.#e.has(n))}catch{s=!1}return!!s}reset(){this.#e=new Set(F)}};var E=(t,e,s)=>{t&&console.warn(`[URLSanitizer Debug] ${e}`,s?s.message:"")},H=class extends C{#e;#t=new Set;constructor(){super(),this.#e=0}#s(e,s,r){if(!P.test(e)){if(super.has(e))r.schemeMap.set(e,!0);else{try{super.add(e)}catch(i){let a=`Failed to add scheme '${e}' in '${s}' list.`;E(r.debug,a,i)}super.has(e)&&(r.schemeMap.set(e,!0),r.tempScheme.add(e))}return!0}return!1}replace(e){if(!m(e))throw new TypeError(`Expected String but got ${b(e)}.`);let s=e;if(D.test(s)){let i=[...s.matchAll(J)].reverse();for(let a of i){let[n]=a;I.test(n)&&([n]=I.exec(n)),this.#e++,this.#t.add(n);let o;try{o=this.sanitize(n,{allow:["data"]})}finally{this.#e--,this.#t.delete(n)}let{index:p}=a,[d,c]=[s.substring(0,p),s.substring(p+n.length)];o?s=`${d}${o}${c}`:s=`${d}${c}`}}return s}purify(e){if(!m(e))throw new TypeError(`Expected String but got ${b(e)}.`);let s=e;try{s=decodeURIComponent(e)}catch{}let r=K.sanitize(s);r&&D.test(r)&&(r=this.replace(r)),r=r.replace(/(?:#|%23)$/,"").replace(/(?<!(?:#|%23).*)(?:\?|%3F)$/,"");try{return encodeURI(r)}catch{return r}}sanitize(e,s){if(this.#e>16)throw new Error("Data URLs nested too deeply.");let{allow:r,deny:i,only:a,allowRelative:n=!1,debug:o=!1}=s??{},p=new Map([["blob",!1],["data",!1],["file",!1],["javascript",!1],["vbscript",!1]]),d=new Set,c={schemeMap:p,tempScheme:d,debug:o},h=!1;if(Array.isArray(a)&&a.length){let l=super.get();for(let u of l)p.set(u,!1);for(let u of a)m(u)&&(u=u.trim(),this.#s(u,"only",c)&&!h&&p.has(u)&&(h=p.get(u)))}else{if(Array.isArray(r)&&r.length)for(let l of r)m(l)&&this.#s(l.trim(),"allow",c);if(Array.isArray(i)&&i.length)for(let l of i)m(l)&&(l=l.trim(),l&&p.set(l,!1))}let S,v=super.verify(e),y=!1;if(!v&&n)try{let{hostname:l,protocol:u}=new URL(e,"http://dummy.local");u==="http:"&&l==="dummy.local"&&(v=!0,y=!0)}catch(l){E(o,"Failed to parse relative URL.",l)}if(v){let l,u,k,q,X,L="",T=[],U=!1;if(y)U=!0;else if({hash:l,href:u,pathname:k,protocol:q,search:X}=new URL(e),L=q.replace(/:$/,""),T=L.split("+"),h)U=T.every(f=>p.get(f));else for(let[f,x]of p.entries())if(U=x||L!==f&&T.every($=>$!==f),!U)break;if(U){let _=y?!1:T.includes("data"),f=y?e:u;if(_){let[x,...$]=k.split(","),A=`${$.join(",")}${X}${l}`,z=x.split(";"),Y=z[z.length-1]==="base64",g=A;Y&&(g=ne(A));try{let G=N(g).trim(),{protocol:Q}=new URL(G);Q.replace(/:$/,"").split("+").some(pe=>P.test(pe))&&(f="")}catch(G){E(o,"Failed to parse inner data URL protocol.",G)}let Z=D.test(g);(g!==A||Z)&&Z&&(g=this.replace(g)),(!x||ee.test(x))&&(g=this.purify(g)),f&&g?(Y&&g!==A&&z.pop(),f=`${L}:${z.join(";")},${g}`):f=""}if(!_&&j.test(f)){let x=j.exec(f),{index:$}=x;f=f.substring(0,$).replace(/[?&]$/,"")}f&&(S=f.replace(/%26/g,oe))}d.size&&d.forEach(_=>{super.remove(_)})}return S||null}parse(e,s){if(!m(e))throw new TypeError(`Expected String but got ${b(e)}.`);let r=new Map([["input",e]]),i;if(this.verify(e)){let{protocol:a}=new URL(e);a==="blob:"?i=e:i=this.sanitize(e,s??{allow:["data","file"]})}if(i){let a=new URL(i),{pathname:n,protocol:o}=a,d=o.replace(/:$/,"").split("+").includes("data");if(r.set("valid",!0),d){let c=new Map,[h,...S]=n.split(","),v=`${S.join(",")}`,y=h.split(";"),l=y[y.length-1]==="base64";l&&y.pop(),c.set("mime",y.join(";")),c.set("base64",l),c.set("data",v),r.set("data",Object.fromEntries(c))}else r.set("data",null);for(let c in a){let h=a[c];m(h)&&r.set(c,h)}}else r.set("valid",!1);return Object.fromEntries(r)}reset(){super.reset(),this.#e=0,this.#t.clear()}};var w=new H,he=async(t,e={allow:[],deny:[],only:[],allowRelative:!1,debug:!1,maxBlobSize:33554432})=>{let s=!!e?.debug,r=Number.isInteger(e?.maxBlobSize)&&e.maxBlobSize>0?e.maxBlobSize:33554432,i;if(t&&m(t)){let a;try{let{protocol:n}=new URL(t);a=n.replace(/:$/,"")}catch(n){E(s,`Invalid URL input format: ${t}`,n)}if(a==="blob"){let{allow:n,deny:o,only:p}=e;if(Array.isArray(n)&&n.includes("blob")&&!(Array.isArray(o)&&o.includes("blob"))||Array.isArray(p)&&p.includes("blob")){let d;try{d=await fetch(t).then(c=>c.blob()).then(c=>ce(c,r))}catch(c){let h=`Failed to fetch and convert blob URL: ${t}`;E(s,h,c)}if(d){if(Array.isArray(p))p.includes("data")||p.push("data");else if(Array.isArray(n)&&(n.includes("data")||n.push("data"),Array.isArray(o)&&o.includes("data"))){let c=o.indexOf("data");o.splice(c,1)}i=w.sanitize(d,e)}}URL.revokeObjectURL(t)}else(a||e.allowRelative)&&(i=w.sanitize(t,e))}return i||null},ue=(t,e)=>{let s;if(t&&m(t)){let r;try{let{protocol:i}=new URL(t);r=i.replace(/:$/,"")}catch(i){let a=`Failed to parse URL: ${t}`;E(e?.debug,a,i)}r==="blob"?URL.revokeObjectURL(t):(r||e?.allowRelative)&&(s=w.sanitize(t,e))}return s||null},ge=async t=>w.parse(t),be=t=>w.parse(t),ye=async t=>w.verify(t),we=t=>w.verify(t),xe=w;export{xe as default,ye as isURI,we as isURISync,ge as parseURL,be as parseURLSync,he as sanitizeURL,ue as sanitizeURLSync};
 /*!
  * URL Sanitizer
  *

package/dist/url-sanitizer-wo-dompurify.min.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
-  "sources": ["../bundle_wo_dompurify/mjs/dompurify.js", "../bundle_wo_dompurify/mjs/constant.js", "../bundle_wo_dompurify/mjs/common.js", "../bundle_wo_dompurify/mjs/file-reader.js", "../bundle_wo_dompurify/lib/file/text-chars.json", "../bundle_wo_dompurify/lib/iana/uri-schemes.json", "../bundle_wo_dompurify/mjs/uri-util.js", "../bundle_wo_dompurify/mjs/sanitizer.js"],
-  "sourcesContent": ["/**\n * dompurify.js\n */\n\nconst domPurify = {\n  sanitize: (...args) => {\n    if (globalThis?.DOMPurify) {\n      return globalThis.DOMPurify.sanitize(...args);\n    }\n\n    const msg = [\n      'DOMPurify is not available.',\n      'Ensure DOMPurify is exposed globally (e.g., window.DOMPurify).'\n    ];\n    throw new Error(msg.join(' '));\n  }\n};\n\nexport {\n  domPurify\n};\n", "/**\n * constant.js\n */\n\n/* numeric */\nexport const CHUNK_SIZE = 8 * 1024;\nexport const HEX = 16;\nexport const MAX_BLOB_SIZE = 32 * 1024 * 1024;\nexport const TYPE_FROM = 8;\nexport const TYPE_TO = -1;\n\n/* regexp */\nexport const REG_B64 = /^[\\w+/=-]+$/;\nexport const REG_CHARSET = /^charset=([\\w#&.;-]+)$/;\nexport const REG_DATA_URL = /data:[\\w#&+./;=-]*,/;\nexport const REG_DATA_URL_B64 = /data:[\\w#&+./;=^]*base64,[\\w+/=-]+/i;\nexport const REG_DATA_URL_G = /data:[\\w#&+./;=-]*,[^\\x22]+/g;\nexport const REG_NUM_REF = /&#(x(?:00)?[\\dA-F]{2}|0?\\d{1,3});?/gi;\nexport const REG_MIME_DOM =\n  /^(?:application\\/(?:[\\w#&.;-]+\\+)?x|image\\/svg\\+x|text\\/(?:ht|x))ml;?/;\nexport const REG_MIME_TEXT = /^text\\/[\\w#&.;-]+/;\nexport const REG_SCHEME = /^[a-z][\\da-z+.-]*$/;\nexport const REG_SCHEME_EXT = /^(?:ext|web)\\+[a-z]+$/;\nexport const REG_SCRIPT = /(?:java|vb)script/;\nexport const REG_SCRIPT_BLOB = /(?:java|vb)script|blob/;\nexport const REG_TAG_QUOT = /%(?:22|27|3C|3E)|[\\x22\\x27<>]/;\nexport const REG_URL_ENC = /^%[\\dA-F]{2}$/i;\n", "/**\n * common.js\n */\n\n/* shared */\nimport { TYPE_FROM, TYPE_TO } from './constant.js';\n\n/**\n * get type\n * @param {object} o - object to check\n * @returns {string} - type of object\n */\nexport const getType = o =>\n  Object.prototype.toString.call(o).slice(TYPE_FROM, TYPE_TO);\n\n/**\n * is string\n * @param {object} o - object to check\n * @returns {boolean} - result\n */\nexport const isString = o => typeof o === 'string' || o instanceof String;\n", "/**\n * file-reader.js\n */\n\nconst { FileReader } = globalThis;\n\nexport {\n  FileReader\n};\n", "[7,8,9,10,11,12,13,27,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255]\n", "[\"aaa\",\"aaas\",\"about\",\"acap\",\"acct\",\"acd\",\"acr\",\"adiumxtra\",\"adt\",\"afp\",\"afs\",\"agtp\",\"aim\",\"amss\",\"android\",\"appdata\",\"apt\",\"ar\",\"ari\",\"ark\",\"at\",\"attachment\",\"aw\",\"barion\",\"beshare\",\"bitcoin\",\"bitcoincash\",\"bl\",\"blob\",\"bluetooth\",\"bolo\",\"brid\",\"browserext\",\"cabal\",\"caip\",\"calculator\",\"callto\",\"cap\",\"cast\",\"casts\",\"chrome\",\"chrome-extension\",\"cid\",\"coap\",\"coaps\",\"com-eventbrite-attendee\",\"content\",\"content-type\",\"crid\",\"cstr\",\"cttps\",\"cvs\",\"dab\",\"dat\",\"data\",\"dav\",\"dhttp\",\"diaspora\",\"dict\",\"did\",\"dilithium3\",\"dis\",\"dlna-playcontainer\",\"dlna-playsingle\",\"dnp\",\"dns\",\"dntp\",\"doi\",\"donau\",\"dpp\",\"drm\",\"dtmi\",\"dtn\",\"dvb\",\"dvx\",\"dweb\",\"ed2k\",\"eid\",\"elsi\",\"embedded\",\"ens\",\"esim\",\"ethereum\",\"example\",\"facetime\",\"feed\",\"feedready\",\"fido\",\"file\",\"finger\",\"first-run-pen-experience\",\"fish\",\"fm\",\"ftp\",\"fuchsia-pkg\",\"geo\",\"gg\",\"git\",\"gitoid\",\"gizmoproject\",\"go\",\"gopher\",\"graph\",\"gtalk\",\"h323\",\"ham\",\"hcap\",\"hcp\",\"hs20\",\"http\",\"https\",\"hxxp\",\"hxxps\",\"hydrazone\",\"hyper\",\"i0\",\"iax\",\"ibi\",\"ibi-\",\"icap\",\"icon\",\"ilstring\",\"im\",\"imap\",\"info\",\"iotdisco\",\"ipfs\",\"ipn\",\"ipns\",\"ipp\",\"ipps\",\"irc\",\"irc6\",\"ircs\",\"iris\",\"iris.beep\",\"iris.lwz\",\"iris.xpc\",\"iris.xpcs\",\"isostore\",\"itms\",\"jabber\",\"jar\",\"jms\",\"keyparc\",\"lastfm\",\"lbry\",\"ldap\",\"ldaps\",\"leaptofrogans\",\"lid\",\"linkid\",\"lorawan\",\"lpa\",\"lvlt\",\"machineProvisioningProgressReporter\",\"magnet\",\"mailto\",\"maps\",\"market\",\"matrix\",\"message\",\"microsoft.windows.camera\",\"microsoft.windows.camera.multipicker\",\"microsoft.windows.camera.picker\",\"mid\",\"mms\",\"mongodb\",\"moz\",\"moz-extension\",\"mqtt\",\"mqtts\",\"ms-access\",\"ms-appinstaller\",\"ms-browser-extension\",\"ms-calculator\",\"ms-drive-to\",\"ms-enrollment\",\"ms-excel\",\"ms-eyecontrolspeech\",\"ms-gamebarservices\",\"ms-gamingoverlay\",\"ms-getoffice\",\"ms-help\",\"ms-infopath\",\"ms-inputapp\",\"ms-launchremotedesktop\",\"ms-lockscreencomponent-config\",\"ms-media-stream-id\",\"ms-meetnow\",\"ms-mixedrealitycapture\",\"ms-mobileplans\",\"ms-newsandinterests\",\"ms-officeapp\",\"ms-people\",\"ms-personacard\",\"ms-powerpoint\",\"ms-project\",\"ms-publisher\",\"ms-recall\",\"ms-remotedesktop\",\"ms-remotedesktop-launch\",\"ms-restoretabcompanion\",\"ms-screenclip\",\"ms-screensketch\",\"ms-search\",\"ms-search-repair\",\"ms-secondary-screen-controller\",\"ms-secondary-screen-setup\",\"ms-settings\",\"ms-settings-airplanemode\",\"ms-settings-bluetooth\",\"ms-settings-camera\",\"ms-settings-cellular\",\"ms-settings-cloudstorage\",\"ms-settings-connectabledevices\",\"ms-settings-displays-topology\",\"ms-settings-emailandaccounts\",\"ms-settings-language\",\"ms-settings-location\",\"ms-settings-lock\",\"ms-settings-nfctransactions\",\"ms-settings-notifications\",\"ms-settings-power\",\"ms-settings-privacy\",\"ms-settings-proximity\",\"ms-settings-screenrotation\",\"ms-settings-wifi\",\"ms-settings-workplace\",\"ms-spd\",\"ms-stickers\",\"ms-sttoverlay\",\"ms-transit-to\",\"ms-useractivityset\",\"ms-uup\",\"ms-virtualtouchpad\",\"ms-visio\",\"ms-walk-to\",\"ms-whiteboard\",\"ms-whiteboard-cmd\",\"ms-widgetboard\",\"ms-widgets\",\"ms-word\",\"msnim\",\"msrp\",\"msrps\",\"mss\",\"mt\",\"mtqp\",\"mtrust\",\"mumble\",\"mupdate\",\"mvn\",\"mvrp\",\"mvrps\",\"news\",\"nfs\",\"ni\",\"nih\",\"nntp\",\"notes\",\"num\",\"ocf\",\"oid\",\"onenote\",\"onenote-cmd\",\"opaquelocktoken\",\"openid\",\"openpgp4fpr\",\"otpauth\",\"palm\",\"paparazzi\",\"payto\",\"pkcs11\",\"platform\",\"pop\",\"pres\",\"proxy\",\"psyc\",\"pttp\",\"pwid\",\"qb\",\"query\",\"quic-transport\",\"redis\",\"rediss\",\"reload\",\"res\",\"resource\",\"rmi\",\"rsync\",\"rtmfp\",\"rtmp\",\"rtsp\",\"rtsps\",\"rtspu\",\"sarif\",\"secondlife\",\"secret-token\",\"service\",\"session\",\"sftp\",\"sgn\",\"shc\",\"shelter\",\"sieve\",\"simpleledger\",\"simplex\",\"sip\",\"sips\",\"skype\",\"smb\",\"smp\",\"sms\",\"smtp\",\"snmp\",\"soap.beep\",\"soap.beeps\",\"soldat\",\"spacify\",\"spiffe\",\"spotify\",\"ssb\",\"ssh\",\"starknet\",\"steam\",\"stun\",\"stuns\",\"submit\",\"svn\",\"swh\",\"swid\",\"swidpath\",\"tag\",\"taler\",\"teamspeak\",\"teapot\",\"teapots\",\"tel\",\"teliaeid\",\"telnet\",\"tftp\",\"things\",\"thismessage\",\"tip\",\"tn3270\",\"tool\",\"turn\",\"turns\",\"tv\",\"udp\",\"unreal\",\"upn\",\"urn\",\"ut2004\",\"uuid-in-package\",\"v-event\",\"vemmi\",\"ventrilo\",\"ves\",\"view-source\",\"vnc\",\"vscode\",\"vscode-insiders\",\"vsls\",\"w3\",\"wasm\",\"wasm-js\",\"wcr\",\"web3\",\"webcal\",\"wifi\",\"ws\",\"wss\",\"wtai\",\"wyciwyg\",\"xcompute\",\"xcon\",\"xcon-userid\",\"xfire\",\"xftp\",\"xmlrpc.beep\",\"xmlrpc.beeps\",\"xmpp\",\"xrcp\",\"xri\",\"ymsgr\",\"z39.50r\",\"z39.50s\",\"ztdnaid\"]\n", "/**\n * uri-util.js\n */\n\n/* shared */\nimport { getType, isString } from './common.js';\nimport { FileReader } from './file-reader.js';\nimport { textChars, uriSchemes } from './lib-util.js';\n\nimport {\n  HEX, MAX_BLOB_SIZE, REG_B64, REG_NUM_REF, REG_SCHEME, REG_SCHEME_EXT,\n  REG_SCRIPT, REG_URL_ENC\n} from './constant.js';\n\n/**\n * get URL encoded string\n * @param {string} str - string\n * @returns {string} - URL encoded string\n */\nexport const getURLEncodedString = str => {\n  if (!isString(str)) {\n    throw new TypeError(`Expected String but got ${getType(str)}.`);\n  }\n  const chars = [];\n  for (const ch of str) {\n    chars.push(`%${ch.charCodeAt(0).toString(HEX).toUpperCase()}`);\n  }\n  return chars.join('');\n};\n\n/**\n * escape URL encoded HTML special chars\n * @param {string} ch - URL encoded (percent encoded) char\n * @returns {string} - escaped URL encoded HTML special char / URL encoded char\n */\nexport const escapeURLEncodedHTMLChars = ch => {\n  if (isString(ch) && REG_URL_ENC.test(ch)) {\n    ch = ch.toUpperCase();\n  }\n  const [amp, num, lt, gt, quot, apos] =\n    ['&', '#', '<', '>', '\"', \"'\"].map(getURLEncodedString);\n  let escapedChar;\n  if (ch === amp) {\n    escapedChar = `${amp}amp;`;\n  } else if (ch === lt) {\n    escapedChar = `${amp}lt;`;\n  } else if (ch === gt) {\n    escapedChar = `${amp}gt;`;\n  } else if (ch === quot) {\n    escapedChar = `${amp}quot;`;\n  } else if (ch === apos) {\n    escapedChar = `${amp}${num}39;`;\n  } else {\n    escapedChar = ch;\n  }\n  return escapedChar;\n};\n\n/**\n * parse base64 encoded data\n * @param {string} data - base64 encoded data\n * @returns {string} - parsed text data / base64 encoded data if binary\n */\nexport const parseBase64 = data => {\n  if (!isString(data)) {\n    throw new TypeError(`Expected String but got ${getType(data)}.`);\n  } else if (!REG_B64.test(data)) {\n    throw new Error(`Invalid base64 data: ${data}`);\n  }\n  const bin = atob(data);\n  const uint8arr = Uint8Array.from([...bin].map(c => c.charCodeAt(0)));\n  const textCharCodes = new Set(textChars);\n  let parsedData;\n  if (uint8arr.every(c => textCharCodes.has(c))) {\n    parsedData = bin.replace(/\\s/g, getURLEncodedString);\n  } else {\n    parsedData = data;\n  }\n  return parsedData;\n};\n\n/**\n * parse URL encoded numeric character references in the range 0x00 to 0xFF\n * @param {string} str - string\n * @param {number} [nest] - nest level\n * @returns {string} - parsed string\n */\nexport const parseURLEncodedNumCharRef = (str, nest = 0) => {\n  if (!isString(str)) {\n    throw new TypeError(`Expected String but got ${getType(str)}.`);\n  }\n  if (!Number.isInteger(nest)) {\n    throw new TypeError(`Expected Number but got ${getType(nest)}.`);\n  } else if (nest > HEX) {\n    throw new Error('Character references nested too deeply.');\n  }\n  let res = decodeURIComponent(str);\n  if (/&#/.test(res)) {\n    const textCharCodes = new Set(textChars);\n    const items = [...res.matchAll(REG_NUM_REF)].reverse();\n    for (const item of items) {\n      const [numCharRef, value] = item;\n      let num;\n      if (/^x[\\dA-F]+/i.test(value)) {\n        num = parseInt(`0${value}`, HEX);\n      } else if (/^\\d+/.test(value)) {\n        num = parseInt(value);\n      }\n      if (Number.isInteger(num)) {\n        const { index } = item;\n        const [preNum, postNum] = [\n          res.substring(0, index),\n          res.substring(index + numCharRef.length)\n        ];\n        if (textCharCodes.has(num)) {\n          res = `${preNum}${String.fromCharCode(num)}${postNum}`;\n          if (/#x?$/.test(preNum) || /^#(?:x(?:00)?[2-7]|\\d)/.test(postNum)) {\n            res = parseURLEncodedNumCharRef(res, ++nest);\n          }\n        } else if (num < HEX * HEX) {\n          res = `${preNum}${postNum}`;\n        }\n      }\n    }\n  }\n  return res;\n};\n\n/**\n * create data URL from blob\n * @param {object} blob - blob\n * @param {number} maxBlobSize - max blob size\n * @returns {Promise.<?string>} - data URL\n */\nexport const createDataURLFromBlob = (blob, maxBlobSize = MAX_BLOB_SIZE) =>\n  new Promise((resolve, reject) => {\n    if (!Number.isInteger(blob?.size)) {\n      return resolve(null);\n    } else if (Number.isInteger(maxBlobSize) && blob.size > maxBlobSize) {\n      return reject(new DOMException(\n        `Blob size (${blob.size} bytes) exceeds the maximum allowed size of ${maxBlobSize} bytes.`,\n        'NotReadableError'\n      ));\n    }\n    const reader = new FileReader();\n    reader.addEventListener('error', () => reject(reader.error));\n    reader.addEventListener('abort', () => resolve(reader.result));\n    reader.addEventListener('load', () => resolve(reader.result));\n    reader.readAsDataURL(blob);\n  });\n\n/**\n * URI schemes\n */\nexport class URISchemes {\n  /* private fields */\n  #schemes;\n\n  /**\n   * construct\n   */\n  constructor() {\n    this.#schemes = new Set(uriSchemes);\n  }\n\n  /**\n   * get schemes\n   * @see {@link https://www.iana.org/assignments/uri-schemes/uri-schemes.xhtml}\n   *      - Historical schemes omitted\n   *      - 'moz-extension' scheme added\n   * @returns {Array.<string>} - array of schemes\n   */\n  get() {\n    return [...this.#schemes];\n  }\n\n  /**\n   * has scheme\n   * @param {string} scheme - scheme\n   * @returns {boolean} - result\n   */\n  has(scheme) {\n    return this.#schemes.has(scheme);\n  }\n\n  /**\n   * add scheme\n   * NOTE: `javascript` and/or `vbscript` schemes can not be registered\n   * @param {string} scheme - scheme\n   * @returns {Array.<string>} - array of schemes\n   */\n  add(scheme) {\n    if (!isString(scheme)) {\n      throw new TypeError(`Expected String but got ${getType(scheme)}.`);\n    } else if (REG_SCRIPT.test(scheme) || !REG_SCHEME.test(scheme)) {\n      throw new Error(`Invalid scheme: ${scheme}`);\n    }\n    this.#schemes.add(scheme);\n    return [...this.#schemes];\n  }\n\n  /**\n   * remove scheme\n   * @param {string} scheme - scheme\n   * @returns {boolean} - result\n   */\n  remove(scheme) {\n    return this.#schemes.delete(scheme);\n  }\n\n  /**\n   * verify URI\n   * @param {string} uri - URI\n   * @returns {boolean} - result\n   */\n  verify(uri) {\n    let res;\n    if (isString(uri)) {\n      try {\n        const { protocol } = new URL(uri);\n        const scheme = protocol.replace(/:$/, '');\n        const schemeParts = scheme.split('+');\n        res = (!REG_SCRIPT.test(scheme) && REG_SCHEME_EXT.test(scheme)) ||\n              schemeParts.every(s => this.#schemes.has(s));\n      } catch (e) {\n        res = false;\n      }\n    }\n    return !!res;\n  }\n\n  /**\n   * reset schemes\n   * @returns {void}\n   */\n  reset() {\n    this.#schemes.clear();\n    for (const scheme of uriSchemes) {\n      this.#schemes.add(scheme);\n    }\n  }\n}\n", "/**\n * sanitizer.js\n */\n\n/* shared */\nimport { domPurify } from './dompurify.js';\nimport { getType, isString } from './common.js';\nimport {\n  createDataURLFromBlob, escapeURLEncodedHTMLChars, parseBase64,\n  parseURLEncodedNumCharRef, URISchemes\n} from './uri-util.js';\nimport {\n  HEX, MAX_BLOB_SIZE, REG_DATA_URL, REG_DATA_URL_B64, REG_DATA_URL_G,\n  REG_MIME_DOM, REG_SCRIPT_BLOB, REG_TAG_QUOT\n} from './constant.js';\n\n/* typedef */\n/**\n * @typedef {object} ParsedURL - object with additional props based on URL API\n * @property {string} input - URL input\n * @property {boolean} valid - is valid URI\n * @property {object} [data] - parsed result of data URL, `null`able\n * @property {string} [data.mime] - MIME type\n * @property {boolean} [data.base64] - is base64 encoded\n * @property {string} [data.data] - data part of the data URL\n * @property {string} [href] - sanitized URL input\n * @property {string} [origin] - scheme, domain and port of the sanitized URL\n * @property {string} [protocol] - protocol scheme of the sanitized URL\n * @property {string} [username] - username specified before the domain name\n * @property {string} [password] - password specified before the domain name\n * @property {string} [host] - domain and port of the sanitized URL\n * @property {string} [hostname] - domain of the sanitized URL\n * @property {string} [port] - port number of the sanitized URL\n * @property {string} [pathname] - path of the sanitized URL\n * @property {string} [search] - query string of the sanitized URL\n * @property {string} [hash] - fragment identifier of the sanitized URL\n */\n\n/**\n * Internal debug logger.\n * @param {boolean} isDebug - Debug flag.\n * @param {string} message - Output message.\n * @param {Error} [error] - Caught error object.\n */\nexport const logDebug = (isDebug, message, error) => {\n  if (isDebug) {\n    console.warn(`[URLSanitizer Debug] ${message}`, error ? error.message : '');\n  }\n};\n\n/**\n * URL sanitizer\n */\nclass URLSanitizer extends URISchemes {\n  /* private fields */\n  #nest;\n  #recurse = new Set();\n\n  /**\n   * construct\n   */\n  constructor() {\n    super();\n    this.#nest = 0;\n  }\n\n  /**\n   * replace matched data URLs\n   * @param {string} data - data URL\n   * @returns {string} - replaced data URL\n   */\n  replace(data) {\n    if (!isString(data)) {\n      throw new TypeError(`Expected String but got ${getType(data)}.`);\n    }\n    let replacedData = data;\n    if (REG_DATA_URL.test(replacedData)) {\n      const matchedDataUrls = replacedData.matchAll(REG_DATA_URL_G);\n      const items = [...matchedDataUrls].reverse();\n      for (const item of items) {\n        let [dataUrl] = item;\n        if (REG_DATA_URL_B64.test(dataUrl)) {\n          [dataUrl] = REG_DATA_URL_B64.exec(dataUrl);\n        }\n        this.#nest++;\n        this.#recurse.add(dataUrl);\n        let parsedDataUrl;\n        try {\n          parsedDataUrl = this.sanitize(dataUrl, {\n            allow: ['data']\n          });\n        } finally {\n          this.#nest--;\n          this.#recurse.delete(dataUrl);\n        }\n        const { index } = item;\n        const [preDataUrl, postDataUrl] = [\n          replacedData.substring(0, index),\n          replacedData.substring(index + dataUrl.length)\n        ];\n        if (parsedDataUrl) {\n          replacedData = `${preDataUrl}${parsedDataUrl}${postDataUrl}`;\n        } else {\n          replacedData = `${preDataUrl}${postDataUrl}`;\n        }\n      }\n    }\n    return replacedData;\n  }\n\n  /**\n   * purify URL encoded DOM\n   * @param {string} dom - DOM string\n   * @returns {string} - purified DOM string\n   */\n  purify(dom) {\n    if (!isString(dom)) {\n      throw new TypeError(`Expected String but got ${getType(dom)}.`);\n    }\n    let decodedDom = dom;\n    try {\n      // prevent URIError caused by malformed percent-encoding\n      // e.g., a standalone '%'\n      decodedDom = decodeURIComponent(dom);\n    } catch (e) {\n      // fall through\n    }\n    let purifiedDom = domPurify.sanitize(decodedDom);\n    if (purifiedDom && REG_DATA_URL.test(purifiedDom)) {\n      purifiedDom = this.replace(purifiedDom);\n    }\n    purifiedDom = purifiedDom.replace(/(?:#|%23)$/, '')\n      .replace(/(?<!(?:#|%23).*)(?:\\?|%3F)$/, '');\n    try {\n      // prevent URIError caused by lone surrogates\n      return encodeURI(purifiedDom);\n    } catch (e) {\n      return purifiedDom;\n    }\n  }\n\n  /**\n   * sanitize URL\n   * NOTE: `data` and `file` schemes must be explicitly allowed\n   * `blob` URLs should be converted to `data` URLs\n   * `javascript` and `vbscript` schemes can not be allowed\n   * @param {string} url - URL\n   * @param {object} [opt] - options\n   * @param {Array.<string>} [opt.allow] - array of allowed schemes\n   * @param {Array.<string>} [opt.deny] - array of denied schemes\n   * @param {Array.<string>} [opt.only] - array of specific schemes to allow\n   * @param {boolean} [opt.allowRelative] - allow relative URLs\n   * @param {boolean} [opt.debug] - enable debug mode\n   * @returns {?string} - sanitized URL\n   */\n  sanitize(url, opt) {\n    if (this.#nest > HEX) {\n      throw new Error('Data URLs nested too deeply.');\n    }\n    const {\n      allow, deny, only, allowRelative = false, debug = false\n    } = opt ?? {};\n    const schemeMap = new Map([\n      ['blob', false],\n      ['data', false],\n      ['file', false],\n      ['javascript', false],\n      ['vbscript', false]\n    ]);\n    const tempScheme = new Set();\n    let restrictScheme = false;\n    if (Array.isArray(only) && only.length) {\n      const schemes = super.get();\n      for (const item of schemes) {\n        schemeMap.set(item, false);\n      }\n      const items = Object.values(only);\n      for (let item of items) {\n        if (isString(item)) {\n          item = item.trim();\n          if (!REG_SCRIPT_BLOB.test(item)) {\n            if (super.has(item)) {\n              schemeMap.set(item, true);\n            } else {\n              try {\n                super.add(item);\n              } catch (e) {\n                const msg = `Failed to add scheme '${item}' in 'only' list.`;\n                logDebug(debug, msg, e);\n              }\n              if (super.has(item)) {\n                schemeMap.set(item, true);\n                tempScheme.add(item);\n              }\n            }\n            if (!restrictScheme && schemeMap.has(item)) {\n              restrictScheme = schemeMap.get(item);\n            }\n          }\n        }\n      }\n    } else {\n      if (Array.isArray(allow) && allow.length) {\n        const items = Object.values(allow);\n        for (let item of items) {\n          if (isString(item)) {\n            item = item.trim();\n            if (!REG_SCRIPT_BLOB.test(item)) {\n              if (super.has(item)) {\n                schemeMap.set(item, true);\n              } else {\n                try {\n                  super.add(item);\n                } catch (e) {\n                  const msg = `Failed to add scheme '${item}' in 'allow' list.`;\n                  logDebug(debug, msg, e);\n                }\n                if (super.has(item)) {\n                  schemeMap.set(item, true);\n                  tempScheme.add(item);\n                }\n              }\n            }\n          }\n        }\n      }\n      if (Array.isArray(deny) && deny.length) {\n        const items = Object.values(deny);\n        for (let item of items) {\n          if (isString(item)) {\n            item = item.trim();\n            if (item) {\n              schemeMap.set(item, false);\n            }\n          }\n        }\n      }\n    }\n    let sanitizedUrl;\n    let isVerified = super.verify(url);\n    let isRelative = false;\n    if (!isVerified && allowRelative) {\n      try {\n        const { hostname, protocol } = new URL(url, 'http://dummy.local');\n        if (protocol === 'http:' && hostname === 'dummy.local') {\n          isVerified = true;\n          isRelative = true;\n        }\n      } catch (e) {\n        logDebug(debug, 'Failed to parse relative URL.', e);\n      }\n    }\n    if (isVerified) {\n      let hash, href, pathname, protocol, search;\n      let scheme = '';\n      let schemeParts = [];\n      let bool = false;\n      if (isRelative) {\n        bool = true;\n      } else {\n        const urlObj = new URL(url);\n        ({ hash, href, pathname, protocol, search } = urlObj);\n        scheme = protocol.replace(/:$/, '');\n        schemeParts = scheme.split('+');\n        if (restrictScheme) {\n          bool = schemeParts.every(s => schemeMap.get(s));\n        } else {\n          for (const [key, value] of schemeMap.entries()) {\n            bool =\n              value || (scheme !== key && schemeParts.every(s => s !== key));\n            if (!bool) {\n              break;\n            }\n          }\n        }\n      }\n      if (bool) {\n        const isDataUrl = isRelative ? false : schemeParts.includes('data');\n        let urlToSanitize = isRelative ? url : href;\n        if (isDataUrl) {\n          const [mediaType, ...dataParts] = pathname.split(',');\n          const data = `${dataParts.join(',')}${search}${hash}`;\n          const mediaTypes = mediaType.split(';');\n          const isBase64 = mediaTypes[mediaTypes.length - 1] === 'base64';\n          let parsedData = data;\n          if (isBase64) {\n            parsedData = parseBase64(data);\n          }\n          try {\n            const decodedData = parseURLEncodedNumCharRef(parsedData).trim();\n            const { protocol: dataScheme } = new URL(decodedData);\n            const dataSchemeParts = dataScheme.replace(/:$/, '').split('+');\n            if (dataSchemeParts.some(s => REG_SCRIPT_BLOB.test(s))) {\n              urlToSanitize = '';\n            }\n          } catch (e) {\n            const msg = 'Failed to parse inner data URL protocol.';\n            logDebug(debug, msg, e);\n          }\n          const containsDataUrl = REG_DATA_URL.test(parsedData);\n          if (parsedData !== data || containsDataUrl) {\n            if (containsDataUrl) {\n              parsedData = this.replace(parsedData);\n            }\n          }\n          if (!mediaType || REG_MIME_DOM.test(mediaType)) {\n            parsedData = this.purify(parsedData);\n          }\n          if (urlToSanitize && parsedData) {\n            if (isBase64 && parsedData !== data) {\n              mediaTypes.pop();\n            }\n            urlToSanitize = `${scheme}:${mediaTypes.join(';')},${parsedData}`;\n          } else {\n            urlToSanitize = '';\n          }\n        }\n        if (!isDataUrl && REG_TAG_QUOT.test(urlToSanitize)) {\n          const item = REG_TAG_QUOT.exec(urlToSanitize);\n          const { index } = item;\n          urlToSanitize =\n            urlToSanitize.substring(0, index).replace(/[?&]$/, '');\n        }\n        if (urlToSanitize) {\n          sanitizedUrl =\n            urlToSanitize.replace(/%26/g, escapeURLEncodedHTMLChars);\n        }\n      }\n      if (tempScheme.size) {\n        tempScheme.forEach(item => {\n          super.remove(item);\n        });\n      }\n    }\n    return sanitizedUrl || null;\n  }\n\n  /**\n   * parse sanitized URL\n   * @param {string} url - URL\n   * @param {object} [opt] - options\n   * @param {Array.<string>} [opt.allow] - array of allowed schemes\n   * @param {Array.<string>} [opt.deny] - array of denied schemes\n   * @param {Array.<string>} [opt.only] - array of specific schemes to allow\n   * @returns {ParsedURL} - result with additional props based on URL API\n   */\n  parse(url, opt) {\n    if (!isString(url)) {\n      throw new TypeError(`Expected String but got ${getType(url)}.`);\n    }\n    const parsedUrl = new Map([\n      ['input', url]\n    ]);\n    let sanitizedUrl;\n    if (this.verify(url)) {\n      const { protocol } = new URL(url);\n      if (protocol === 'blob:') {\n        sanitizedUrl = url;\n      } else {\n        sanitizedUrl = this.sanitize(url, opt ?? {\n          allow: ['data', 'file']\n        });\n      }\n    }\n    if (sanitizedUrl) {\n      const urlObj = new URL(sanitizedUrl);\n      const { pathname, protocol } = urlObj;\n      const schemeParts = protocol.replace(/:$/, '').split('+');\n      const isDataUrl = schemeParts.includes('data');\n      parsedUrl.set('valid', true);\n      if (isDataUrl) {\n        const dataUrl = new Map();\n        const [mediaType, ...dataParts] = pathname.split(',');\n        const data = `${dataParts.join(',')}`;\n        const mediaTypes = mediaType.split(';');\n        const isBase64 = mediaTypes[mediaTypes.length - 1] === 'base64';\n        if (isBase64) {\n          mediaTypes.pop();\n        }\n        dataUrl.set('mime', mediaTypes.join(';'));\n        dataUrl.set('base64', isBase64);\n        dataUrl.set('data', data);\n        parsedUrl.set('data', Object.fromEntries(dataUrl));\n      } else {\n        parsedUrl.set('data', null);\n      }\n      for (const key in urlObj) {\n        const value = urlObj[key];\n        if (isString(value)) {\n          parsedUrl.set(key, value);\n        }\n      }\n    } else {\n      parsedUrl.set('valid', false);\n    }\n    return Object.fromEntries(parsedUrl);\n  }\n\n  /**\n   * reset sanitizer\n   * @returns {void}\n   */\n  reset() {\n    super.reset();\n    this.#nest = 0;\n    this.#recurse.clear();\n  }\n}\nexport { URLSanitizer };\n\n/* aliases and async wrappers */\n/* instance */\nconst urlSanitizer = new URLSanitizer();\n\n/**\n * sanitize URL async\n * NOTE: `blob`, `data` and `file` schemes must be explicitly allowed\n * given a `blob` URL, returns a sanitized `data` URL\n * @param {string} url - URL\n * @param {object} [opt] - options\n * @param {Array.<string>} [opt.allow] - array of allowed schemes\n * @param {Array.<string>} [opt.deny] - array of denied schemes\n * @param {Array.<string>} [opt.only] - array of specific schemes to allow\n * @returns {Promise.<?string>} - sanitized URL\n */\nexport const sanitizeURL = async (url, opt = {\n  allow: [],\n  deny: [],\n  only: [],\n  allowRelative: false,\n  debug: false,\n  maxBlobSize: MAX_BLOB_SIZE\n}) => {\n  const isDebug = !!opt?.debug;\n  const maxBlobSize = Number.isInteger(opt?.maxBlobSize) && opt.maxBlobSize > 0\n    ? opt.maxBlobSize\n    : MAX_BLOB_SIZE;\n  let res;\n  if (url && isString(url)) {\n    let scheme;\n    try {\n      const { protocol } = new URL(url);\n      scheme = protocol.replace(/:$/, '');\n    } catch (e) {\n      logDebug(isDebug, `Invalid URL input format: ${url}`, e);\n    }\n    if (scheme === 'blob') {\n      const { allow, deny, only } = opt;\n      if ((Array.isArray(allow) && allow.includes('blob') &&\n           !(Array.isArray(deny) && deny.includes('blob'))) ||\n          (Array.isArray(only) && only.includes('blob'))) {\n        let data;\n        try {\n          data = await fetch(url)\n            .then(r => r.blob())\n            .then(b => createDataURLFromBlob(b, maxBlobSize));\n        } catch (e) {\n          const msg = `Failed to fetch and convert blob URL: ${url}`;\n          logDebug(isDebug, msg, e);\n        }\n        if (data) {\n          if (Array.isArray(only)) {\n            if (!only.includes('data')) {\n              only.push('data');\n            }\n          } else if (Array.isArray(allow)) {\n            if (!allow.includes('data')) {\n              allow.push('data');\n            }\n            if (Array.isArray(deny) && deny.includes('data')) {\n              const i = deny.indexOf('data');\n              deny.splice(i, 1);\n            }\n          }\n          res = urlSanitizer.sanitize(data, opt);\n        }\n      }\n      URL.revokeObjectURL(url);\n    } else if (scheme || opt.allowRelative) {\n      res = urlSanitizer.sanitize(url, opt);\n    }\n  }\n  return res || null;\n};\n\n/**\n * sanitize URL sync\n * NOTE: `data` and `file` schemes must be explicitly allowed\n * `blob` scheme returns `null`\n * @param {string} url - URL\n * @param {object} [opt] - options\n * @param {Array.<string>} [opt.allow] - array of allowed schemes\n * @param {Array.<string>} [opt.deny] - array of denied schemes\n * @param {Array.<string>} [opt.only] - array of specific schemes to allow\n * @returns {?string} - sanitized URL\n */\nexport const sanitizeURLSync = (url, opt) => {\n  let res;\n  if (url && isString(url)) {\n    let scheme;\n    try {\n      const { protocol } = new URL(url);\n      scheme = protocol.replace(/:$/, '');\n    } catch (e) {\n      const msg = `Failed to parse URL: ${url}`;\n      logDebug(opt?.debug, msg, e);\n    }\n    if (scheme === 'blob') {\n      URL.revokeObjectURL(url);\n    } else if (scheme || opt?.allowRelative) {\n      res = urlSanitizer.sanitize(url, opt);\n    }\n  }\n  return res || null;\n};\n\n/**\n * parse URL async\n * @param {string} url - URL\n * @returns {Promise.<ParsedURL>} - result\n */\nexport const parseURL = async url => {\n  const res = urlSanitizer.parse(url);\n  return res;\n};\n\n/**\n * parse URL sync\n * @param {string} url - URL\n * @returns {ParsedURL} - result\n */\nexport const parseURLSync = url => urlSanitizer.parse(url);\n\n/**\n * is URI async\n * @param {string} uri - URI\n * @returns {Promise.<boolean>} - result\n */\nexport const isURI = async uri => {\n  const res = urlSanitizer.verify(uri);\n  return res;\n};\n\n/**\n * is URI sync\n * @param {string} uri - URI\n * @returns {boolean} - result\n */\nexport const isURISync = uri => urlSanitizer.verify(uri);\n\n/* export instance */\nexport default urlSanitizer;\n"],
-  "mappings": "AAIA,IAAMA,EAAY,CAChB,SAAU,IAAIC,IAAS,CACrB,GAAI,YAAY,UACd,OAAO,WAAW,UAAU,SAAS,GAAGA,CAAI,EAG9C,IAAMC,EAAM,CACV,8BACA,gEACF,EACA,MAAM,IAAI,MAAMA,EAAI,KAAK,GAAG,CAAC,CAC/B,CACF,ECJO,IAAMC,EAAU,cAEhB,IAAMC,EAAe,sBACfC,EAAmB,sCACnBC,EAAiB,+BACjBC,EAAc,uCACdC,EACX,wEAEK,IAAMC,GAAa,qBACbC,GAAiB,wBACjBC,EAAa,oBACbC,EAAkB,yBAClBC,EAAe,gCACfC,GAAc,iBCdpB,IAAMC,EAAUC,GACrB,OAAO,UAAU,SAAS,KAAKA,CAAC,EAAE,MAAM,EAAW,EAAO,EAO/CC,EAAWD,GAAK,OAAOA,GAAM,UAAYA,aAAa,OChBnE,GAAM,CAAE,WAAAE,EAAW,EAAI,WCJvB,IAAAC,EAAA,CAAC,EAAE,EAAE,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,GAAG,ECA70B,IAAAC,EAAA,CAAC,MAAM,OAAO,QAAQ,OAAO,OAAO,MAAM,MAAM,YAAY,MAAM,MAAM,MAAM,OAAO,MAAM,OAAO,UAAU,UAAU,MAAM,KAAK,MAAM,MAAM,KAAK,aAAa,KAAK,SAAS,UAAU,UAAU,cAAc,KAAK,OAAO,YAAY,OAAO,OAAO,aAAa,QAAQ,OAAO,aAAa,SAAS,MAAM,OAAO,QAAQ,SAAS,mBAAmB,MAAM,OAAO,QAAQ,0BAA0B,UAAU,eAAe,OAAO,OAAO,QAAQ,MAAM,MAAM,MAAM,OAAO,MAAM,QAAQ,WAAW,OAAO,MAAM,aAAa,MAAM,qBAAqB,kBAAkB,MAAM,MAAM,OAAO,MAAM,QAAQ,MAAM,MAAM,OAAO,MAAM,MAAM,MAAM,OAAO,OAAO,MAAM,OAAO,WAAW,MAAM,OAAO,WAAW,UAAU,WAAW,OAAO,YAAY,OAAO,OAAO,SAAS,2BAA2B,OAAO,KAAK,MAAM,cAAc,MAAM,KAAK,MAAM,SAAS,eAAe,KAAK,SAAS,QAAQ,QAAQ,OAAO,MAAM,OAAO,MAAM,OAAO,OAAO,QAAQ,OAAO,QAAQ,YAAY,QAAQ,KAAK,MAAM,MAAM,OAAO,OAAO,OAAO,WAAW,KAAK,OAAO,OAAO,WAAW,OAAO,MAAM,OAAO,MAAM,OAAO,MAAM,OAAO,OAAO,OAAO,YAAY,WAAW,WAAW,YAAY,WAAW,OAAO,SAAS,MAAM,MAAM,UAAU,SAAS,OAAO,OAAO,QAAQ,gBAAgB,MAAM,SAAS,UAAU,MAAM,OAAO,sCAAsC,SAAS,SAAS,OAAO,SAAS,SAAS,UAAU,2BAA2B,uCAAuC,kCAAkC,MAAM,MAAM,UAAU,MAAM,gBAAgB,OAAO,QAAQ,YAAY,kBAAkB,uBAAuB,gBAAgB,cAAc,gBAAgB,WAAW,sBAAsB,qBAAqB,mBAAmB,eAAe,UAAU,cAAc,cAAc,yBAAyB,gCAAgC,qBAAqB,aAAa,yBAAyB,iBAAiB,sBAAsB,eAAe,YAAY,iBAAiB,gBAAgB,aAAa,eAAe,YAAY,mBAAmB,0BAA0B,yBAAyB,gBAAgB,kBAAkB,YAAY,mBAAmB,iCAAiC,4BAA4B,cAAc,2BAA2B,wBAAwB,qBAAqB,uBAAuB,2BAA2B,iCAAiC,gCAAgC,+BAA+B,uBAAuB,uBAAuB,mBAAmB,8BAA8B,4BAA4B,oBAAoB,sBAAsB,wBAAwB,6BAA6B,mBAAmB,wBAAwB,SAAS,cAAc,gBAAgB,gBAAgB,qBAAqB,SAAS,qBAAqB,WAAW,aAAa,gBAAgB,oBAAoB,iBAAiB,aAAa,UAAU,QAAQ,OAAO,QAAQ,MAAM,KAAK,OAAO,SAAS,SAAS,UAAU,MAAM,OAAO,QAAQ,OAAO,MAAM,KAAK,MAAM,OAAO,QAAQ,MAAM,MAAM,MAAM,UAAU,cAAc,kBAAkB,SAAS,cAAc,UAAU,OAAO,YAAY,QAAQ,SAAS,WAAW,MAAM,OAAO,QAAQ,OAAO,OAAO,OAAO,KAAK,QAAQ,iBAAiB,QAAQ,SAAS,SAAS,MAAM,WAAW,MAAM,QAAQ,QAAQ,OAAO,OAAO,QAAQ,QAAQ,QAAQ,aAAa,eAAe,UAAU,UAAU,OAAO,MAAM,MAAM,UAAU,QAAQ,eAAe,UAAU,MAAM,OAAO,QAAQ,MAAM,MAAM,MAAM,OAAO,OAAO,YAAY,aAAa,SAAS,UAAU,SAAS,UAAU,MAAM,MAAM,WAAW,QAAQ,OAAO,QAAQ,SAAS,MAAM,MAAM,OAAO,WAAW,MAAM,QAAQ,YAAY,SAAS,UAAU,MAAM,WAAW,SAAS,OAAO,SAAS,cAAc,MAAM,SAAS,OAAO,OAAO,QAAQ,KAAK,MAAM,SAAS,MAAM,MAAM,SAAS,kBAAkB,UAAU,QAAQ,WAAW,MAAM,cAAc,MAAM,SAAS,kBAAkB,OAAO,KAAK,OAAO,UAAU,MAAM,OAAO,SAAS,OAAO,KAAK,MAAM,OAAO,UAAU,WAAW,OAAO,cAAc,QAAQ,OAAO,cAAc,eAAe,OAAO,OAAO,MAAM,QAAQ,UAAU,UAAU,SAAS,ECmB7jI,IAAMC,GAAsBC,GAAO,CACxC,GAAI,CAACC,EAASD,CAAG,EACf,MAAM,IAAI,UAAU,2BAA2BE,EAAQF,CAAG,CAAC,GAAG,EAEhE,IAAMG,EAAQ,CAAC,EACf,QAAWC,KAAMJ,EACfG,EAAM,KAAK,IAAIC,EAAG,WAAW,CAAC,EAAE,SAAS,EAAG,EAAE,YAAY,CAAC,EAAE,EAE/D,OAAOD,EAAM,KAAK,EAAE,CACtB,EAOaE,GAA4BD,GAAM,CACzCH,EAASG,CAAE,GAAKE,GAAY,KAAKF,CAAE,IACrCA,EAAKA,EAAG,YAAY,GAEtB,GAAM,CAACG,EAAKC,EAAKC,EAAIC,EAAIC,EAAMC,CAAI,EACjC,CAAC,IAAK,IAAK,IAAK,IAAK,IAAK,GAAG,EAAE,IAAIb,EAAmB,EACpDc,EACJ,OAAIT,IAAOG,EACTM,EAAc,GAAGN,CAAG,OACXH,IAAOK,EAChBI,EAAc,GAAGN,CAAG,MACXH,IAAOM,EAChBG,EAAc,GAAGN,CAAG,MACXH,IAAOO,EAChBE,EAAc,GAAGN,CAAG,QACXH,IAAOQ,EAChBC,EAAc,GAAGN,CAAG,GAAGC,CAAG,MAE1BK,EAAcT,EAETS,CACT,EAOaC,GAAcC,GAAQ,CACjC,GAAKd,EAASc,CAAI,GAEX,GAAI,CAACC,EAAQ,KAAKD,CAAI,EAC3B,MAAM,IAAI,MAAM,wBAAwBA,CAAI,EAAE,MAF9C,OAAM,IAAI,UAAU,2BAA2Bb,EAAQa,CAAI,CAAC,GAAG,EAIjE,IAAME,EAAM,KAAKF,CAAI,EACfG,EAAW,WAAW,KAAK,CAAC,GAAGD,CAAG,EAAE,IAAIE,GAAKA,EAAE,WAAW,CAAC,CAAC,CAAC,EAC7DC,EAAgB,IAAI,IAAIC,CAAS,EACnCC,EACJ,OAAIJ,EAAS,MAAMC,GAAKC,EAAc,IAAID,CAAC,CAAC,EAC1CG,EAAaL,EAAI,QAAQ,MAAOlB,EAAmB,EAEnDuB,EAAaP,EAERO,CACT,EAQaC,EAA4B,CAACvB,EAAKwB,EAAO,IAAM,CAC1D,GAAI,CAACvB,EAASD,CAAG,EACf,MAAM,IAAI,UAAU,2BAA2BE,EAAQF,CAAG,CAAC,GAAG,EAEhE,GAAK,OAAO,UAAUwB,CAAI,GAEnB,GAAIA,EAAO,GAChB,MAAM,IAAI,MAAM,yCAAyC,MAFzD,OAAM,IAAI,UAAU,2BAA2BtB,EAAQsB,CAAI,CAAC,GAAG,EAIjE,IAAIC,EAAM,mBAAmBzB,CAAG,EAChC,GAAI,KAAK,KAAKyB,CAAG,EAAG,CAClB,IAAML,EAAgB,IAAI,IAAIC,CAAS,EACjCK,EAAQ,CAAC,GAAGD,EAAI,SAASE,CAAW,CAAC,EAAE,QAAQ,EACrD,QAAWC,KAAQF,EAAO,CACxB,GAAM,CAACG,EAAYC,CAAK,EAAIF,EACxBpB,EAMJ,GALI,cAAc,KAAKsB,CAAK,EAC1BtB,EAAM,SAAS,IAAIsB,CAAK,GAAI,EAAG,EACtB,OAAO,KAAKA,CAAK,IAC1BtB,EAAM,SAASsB,CAAK,GAElB,OAAO,UAAUtB,CAAG,EAAG,CACzB,GAAM,CAAE,MAAAuB,CAAM,EAAIH,EACZ,CAACI,EAAQC,CAAO,EAAI,CACxBR,EAAI,UAAU,EAAGM,CAAK,EACtBN,EAAI,UAAUM,EAAQF,EAAW,MAAM,CACzC,EACIT,EAAc,IAAIZ,CAAG,GACvBiB,EAAM,GAAGO,CAAM,GAAG,OAAO,aAAaxB,CAAG,CAAC,GAAGyB,CAAO,IAChD,OAAO,KAAKD,CAAM,GAAK,yBAAyB,KAAKC,CAAO,KAC9DR,EAAMF,EAA0BE,EAAK,EAAED,CAAI,IAEpChB,EAAM,MACfiB,EAAM,GAAGO,CAAM,GAAGC,CAAO,GAE7B,CACF,CACF,CACA,OAAOR,CACT,EAQaS,GAAwB,CAACC,EAAMC,EAAc,WACxD,IAAI,QAAQ,CAACC,EAASC,IAAW,CAC/B,GAAK,OAAO,UAAUH,GAAM,IAAI,GAEzB,GAAI,OAAO,UAAUC,CAAW,GAAKD,EAAK,KAAOC,EACtD,OAAOE,EAAO,IAAI,aAChB,cAAcH,EAAK,IAAI,+CAA+CC,CAAW,UACjF,kBACF,CAAC,MALD,QAAOC,EAAQ,IAAI,EAOrB,IAAME,EAAS,IAAIC,GACnBD,EAAO,iBAAiB,QAAS,IAAMD,EAAOC,EAAO,KAAK,CAAC,EAC3DA,EAAO,iBAAiB,QAAS,IAAMF,EAAQE,EAAO,MAAM,CAAC,EAC7DA,EAAO,iBAAiB,OAAQ,IAAMF,EAAQE,EAAO,MAAM,CAAC,EAC5DA,EAAO,cAAcJ,CAAI,CAC3B,CAAC,EAKUM,EAAN,KAAiB,CAEtBC,GAKA,aAAc,CACZ,KAAKA,GAAW,IAAI,IAAIC,CAAU,CACpC,CASA,KAAM,CACJ,MAAO,CAAC,GAAG,KAAKD,EAAQ,CAC1B,CAOA,IAAIE,EAAQ,CACV,OAAO,KAAKF,GAAS,IAAIE,CAAM,CACjC,CAQA,IAAIA,EAAQ,CACV,GAAK3C,EAAS2C,CAAM,GAEb,GAAIC,EAAW,KAAKD,CAAM,GAAK,CAACE,GAAW,KAAKF,CAAM,EAC3D,MAAM,IAAI,MAAM,mBAAmBA,CAAM,EAAE,MAF3C,OAAM,IAAI,UAAU,2BAA2B1C,EAAQ0C,CAAM,CAAC,GAAG,EAInE,YAAKF,GAAS,IAAIE,CAAM,EACjB,CAAC,GAAG,KAAKF,EAAQ,CAC1B,CAOA,OAAOE,EAAQ,CACb,OAAO,KAAKF,GAAS,OAAOE,CAAM,CACpC,CAOA,OAAOG,EAAK,CACV,IAAItB,EACJ,GAAIxB,EAAS8C,CAAG,EACd,GAAI,CACF,GAAM,CAAE,SAAAC,CAAS,EAAI,IAAI,IAAID,CAAG,EAC1BH,EAASI,EAAS,QAAQ,KAAM,EAAE,EAClCC,EAAcL,EAAO,MAAM,GAAG,EACpCnB,EAAO,CAACoB,EAAW,KAAKD,CAAM,GAAKM,GAAe,KAAKN,CAAM,GACvDK,EAAY,MAAME,GAAK,KAAKT,GAAS,IAAIS,CAAC,CAAC,CACnD,MAAY,CACV1B,EAAM,EACR,CAEF,MAAO,CAAC,CAACA,CACX,CAMA,OAAQ,CACN,KAAKiB,GAAS,MAAM,EACpB,QAAWE,KAAUD,EACnB,KAAKD,GAAS,IAAIE,CAAM,CAE5B,CACF,ECrMO,IAAMQ,EAAW,CAACC,EAASC,EAASC,IAAU,CAC/CF,GACF,QAAQ,KAAK,wBAAwBC,CAAO,GAAIC,EAAQA,EAAM,QAAU,EAAE,CAE9E,EAKMC,EAAN,cAA2BC,CAAW,CAEpCC,GACAC,GAAW,IAAI,IAKf,aAAc,CACZ,MAAM,EACN,KAAKD,GAAQ,CACf,CAOA,QAAQE,EAAM,CACZ,GAAI,CAACC,EAASD,CAAI,EAChB,MAAM,IAAI,UAAU,2BAA2BE,EAAQF,CAAI,CAAC,GAAG,EAEjE,IAAIG,EAAeH,EACnB,GAAII,EAAa,KAAKD,CAAY,EAAG,CAEnC,IAAME,EAAQ,CAAC,GADSF,EAAa,SAASG,CAAc,CAC3B,EAAE,QAAQ,EAC3C,QAAWC,KAAQF,EAAO,CACxB,GAAI,CAACG,CAAO,EAAID,EACZE,EAAiB,KAAKD,CAAO,IAC/B,CAACA,CAAO,EAAIC,EAAiB,KAAKD,CAAO,GAE3C,KAAKV,KACL,KAAKC,GAAS,IAAIS,CAAO,EACzB,IAAIE,EACJ,GAAI,CACFA,EAAgB,KAAK,SAASF,EAAS,CACrC,MAAO,CAAC,MAAM,CAChB,CAAC,CACH,QAAE,CACA,KAAKV,KACL,KAAKC,GAAS,OAAOS,CAAO,CAC9B,CACA,GAAM,CAAE,MAAAG,CAAM,EAAIJ,EACZ,CAACK,EAAYC,CAAW,EAAI,CAChCV,EAAa,UAAU,EAAGQ,CAAK,EAC/BR,EAAa,UAAUQ,EAAQH,EAAQ,MAAM,CAC/C,EACIE,EACFP,EAAe,GAAGS,CAAU,GAAGF,CAAa,GAAGG,CAAW,GAE1DV,EAAe,GAAGS,CAAU,GAAGC,CAAW,EAE9C,CACF,CACA,OAAOV,CACT,CAOA,OAAOW,EAAK,CACV,GAAI,CAACb,EAASa,CAAG,EACf,MAAM,IAAI,UAAU,2BAA2BZ,EAAQY,CAAG,CAAC,GAAG,EAEhE,IAAIC,EAAaD,EACjB,GAAI,CAGFC,EAAa,mBAAmBD,CAAG,CACrC,MAAY,CAEZ,CACA,IAAIE,EAAcC,EAAU,SAASF,CAAU,EAC3CC,GAAeZ,EAAa,KAAKY,CAAW,IAC9CA,EAAc,KAAK,QAAQA,CAAW,GAExCA,EAAcA,EAAY,QAAQ,aAAc,EAAE,EAC/C,QAAQ,8BAA+B,EAAE,EAC5C,GAAI,CAEF,OAAO,UAAUA,CAAW,CAC9B,MAAY,CACV,OAAOA,CACT,CACF,CAgBA,SAASE,EAAKC,EAAK,CACjB,GAAI,KAAKrB,GAAQ,GACf,MAAM,IAAI,MAAM,8BAA8B,EAEhD,GAAM,CACJ,MAAAsB,EAAO,KAAAC,EAAM,KAAAC,EAAM,cAAAC,EAAgB,GAAO,MAAAC,EAAQ,EACpD,EAAIL,GAAO,CAAC,EACNM,EAAY,IAAI,IAAI,CACxB,CAAC,OAAQ,EAAK,EACd,CAAC,OAAQ,EAAK,EACd,CAAC,OAAQ,EAAK,EACd,CAAC,aAAc,EAAK,EACpB,CAAC,WAAY,EAAK,CACpB,CAAC,EACKC,EAAa,IAAI,IACnBC,EAAiB,GACrB,GAAI,MAAM,QAAQL,CAAI,GAAKA,EAAK,OAAQ,CACtC,IAAMM,EAAU,MAAM,IAAI,EAC1B,QAAWrB,KAAQqB,EACjBH,EAAU,IAAIlB,EAAM,EAAK,EAE3B,IAAMF,EAAQ,OAAO,OAAOiB,CAAI,EAChC,QAASf,KAAQF,EACf,GAAIJ,EAASM,CAAI,IACfA,EAAOA,EAAK,KAAK,EACb,CAACsB,EAAgB,KAAKtB,CAAI,GAAG,CAC/B,GAAI,MAAM,IAAIA,CAAI,EAChBkB,EAAU,IAAIlB,EAAM,EAAI,MACnB,CACL,GAAI,CACF,MAAM,IAAIA,CAAI,CAChB,OAASuB,EAAG,CACV,IAAMC,EAAM,yBAAyBxB,CAAI,oBACzCf,EAASgC,EAAOO,EAAKD,CAAC,CACxB,CACI,MAAM,IAAIvB,CAAI,IAChBkB,EAAU,IAAIlB,EAAM,EAAI,EACxBmB,EAAW,IAAInB,CAAI,EAEvB,CACI,CAACoB,GAAkBF,EAAU,IAAIlB,CAAI,IACvCoB,EAAiBF,EAAU,IAAIlB,CAAI,EAEvC,CAGN,KAAO,CACL,GAAI,MAAM,QAAQa,CAAK,GAAKA,EAAM,OAAQ,CACxC,IAAMf,EAAQ,OAAO,OAAOe,CAAK,EACjC,QAASb,KAAQF,EACf,GAAIJ,EAASM,CAAI,IACfA,EAAOA,EAAK,KAAK,EACb,CAACsB,EAAgB,KAAKtB,CAAI,GAC5B,GAAI,MAAM,IAAIA,CAAI,EAChBkB,EAAU,IAAIlB,EAAM,EAAI,MACnB,CACL,GAAI,CACF,MAAM,IAAIA,CAAI,CAChB,OAASuB,EAAG,CACV,IAAMC,EAAM,yBAAyBxB,CAAI,qBACzCf,EAASgC,EAAOO,EAAKD,CAAC,CACxB,CACI,MAAM,IAAIvB,CAAI,IAChBkB,EAAU,IAAIlB,EAAM,EAAI,EACxBmB,EAAW,IAAInB,CAAI,EAEvB,CAIR,CACA,GAAI,MAAM,QAAQc,CAAI,GAAKA,EAAK,OAAQ,CACtC,IAAMhB,EAAQ,OAAO,OAAOgB,CAAI,EAChC,QAASd,KAAQF,EACXJ,EAASM,CAAI,IACfA,EAAOA,EAAK,KAAK,EACbA,GACFkB,EAAU,IAAIlB,EAAM,EAAK,EAIjC,CACF,CACA,IAAIyB,EACAC,EAAa,MAAM,OAAOf,CAAG,EAC7BgB,EAAa,GACjB,GAAI,CAACD,GAAcV,EACjB,GAAI,CACF,GAAM,CAAE,SAAAY,EAAU,SAAAC,CAAS,EAAI,IAAI,IAAIlB,EAAK,oBAAoB,EAC5DkB,IAAa,SAAWD,IAAa,gBACvCF,EAAa,GACbC,EAAa,GAEjB,OAASJ,EAAG,CACVtC,EAASgC,EAAO,gCAAiCM,CAAC,CACpD,CAEF,GAAIG,EAAY,CACd,IAAII,EAAMC,EAAMC,EAAUH,EAAUI,EAChCC,EAAS,GACTC,EAAc,CAAC,EACfC,EAAO,GACX,GAAIT,EACFS,EAAO,WAGN,CAAE,KAAAN,EAAM,KAAAC,EAAM,SAAAC,EAAU,SAAAH,EAAU,OAAAI,CAAO,EAD3B,IAAI,IAAItB,CAAG,EAE1BuB,EAASL,EAAS,QAAQ,KAAM,EAAE,EAClCM,EAAcD,EAAO,MAAM,GAAG,EAC1Bd,EACFgB,EAAOD,EAAY,MAAME,GAAKnB,EAAU,IAAImB,CAAC,CAAC,MAE9C,QAAW,CAACC,EAAKC,CAAK,IAAKrB,EAAU,QAAQ,EAG3C,GAFAkB,EACEG,GAAUL,IAAWI,GAAOH,EAAY,MAAME,GAAKA,IAAMC,CAAG,EAC1D,CAACF,EACH,MAKR,GAAIA,EAAM,CACR,IAAMI,EAAYb,EAAa,GAAQQ,EAAY,SAAS,MAAM,EAC9DM,EAAgBd,EAAahB,EAAMoB,EACvC,GAAIS,EAAW,CACb,GAAM,CAACE,EAAW,GAAGC,CAAS,EAAIX,EAAS,MAAM,GAAG,EAC9CvC,EAAO,GAAGkD,EAAU,KAAK,GAAG,CAAC,GAAGV,CAAM,GAAGH,CAAI,GAC7Cc,EAAaF,EAAU,MAAM,GAAG,EAChCG,EAAWD,EAAWA,EAAW,OAAS,CAAC,IAAM,SACnDE,EAAarD,EACboD,IACFC,EAAaC,GAAYtD,CAAI,GAE/B,GAAI,CACF,IAAMuD,EAAcC,EAA0BH,CAAU,EAAE,KAAK,EACzD,CAAE,SAAUI,CAAW,EAAI,IAAI,IAAIF,CAAW,EAC5BE,EAAW,QAAQ,KAAM,EAAE,EAAE,MAAM,GAAG,EAC1C,KAAKb,IAAKf,EAAgB,KAAKe,EAAC,CAAC,IACnDI,EAAgB,GAEpB,OAASlB,EAAG,CAEVtC,EAASgC,EADG,2CACSM,CAAC,CACxB,CACA,IAAM4B,EAAkBtD,EAAa,KAAKiD,CAAU,GAChDA,IAAerD,GAAQ0D,IACrBA,IACFL,EAAa,KAAK,QAAQA,CAAU,IAGpC,CAACJ,GAAaU,EAAa,KAAKV,CAAS,KAC3CI,EAAa,KAAK,OAAOA,CAAU,GAEjCL,GAAiBK,GACfD,GAAYC,IAAerD,GAC7BmD,EAAW,IAAI,EAEjBH,EAAgB,GAAGP,CAAM,IAAIU,EAAW,KAAK,GAAG,CAAC,IAAIE,CAAU,IAE/DL,EAAgB,EAEpB,CACA,GAAI,CAACD,GAAaa,EAAa,KAAKZ,CAAa,EAAG,CAClD,IAAMzC,EAAOqD,EAAa,KAAKZ,CAAa,EACtC,CAAE,MAAArC,CAAM,EAAIJ,EAClByC,EACEA,EAAc,UAAU,EAAGrC,CAAK,EAAE,QAAQ,QAAS,EAAE,CACzD,CACIqC,IACFhB,EACEgB,EAAc,QAAQ,OAAQa,EAAyB,EAE7D,CACInC,EAAW,MACbA,EAAW,QAAQnB,GAAQ,CACzB,MAAM,OAAOA,CAAI,CACnB,CAAC,CAEL,CACA,OAAOyB,GAAgB,IACzB,CAWA,MAAMd,EAAKC,EAAK,CACd,GAAI,CAAClB,EAASiB,CAAG,EACf,MAAM,IAAI,UAAU,2BAA2BhB,EAAQgB,CAAG,CAAC,GAAG,EAEhE,IAAM4C,EAAY,IAAI,IAAI,CACxB,CAAC,QAAS5C,CAAG,CACf,CAAC,EACGc,EACJ,GAAI,KAAK,OAAOd,CAAG,EAAG,CACpB,GAAM,CAAE,SAAAkB,CAAS,EAAI,IAAI,IAAIlB,CAAG,EAC5BkB,IAAa,QACfJ,EAAed,EAEfc,EAAe,KAAK,SAASd,EAAKC,GAAO,CACvC,MAAO,CAAC,OAAQ,MAAM,CACxB,CAAC,CAEL,CACA,GAAIa,EAAc,CAChB,IAAM+B,EAAS,IAAI,IAAI/B,CAAY,EAC7B,CAAE,SAAAO,EAAU,SAAAH,CAAS,EAAI2B,EAEzBhB,EADcX,EAAS,QAAQ,KAAM,EAAE,EAAE,MAAM,GAAG,EAC1B,SAAS,MAAM,EAE7C,GADA0B,EAAU,IAAI,QAAS,EAAI,EACvBf,EAAW,CACb,IAAMvC,EAAU,IAAI,IACd,CAACyC,EAAW,GAAGC,CAAS,EAAIX,EAAS,MAAM,GAAG,EAC9CvC,EAAO,GAAGkD,EAAU,KAAK,GAAG,CAAC,GAC7BC,EAAaF,EAAU,MAAM,GAAG,EAChCG,EAAWD,EAAWA,EAAW,OAAS,CAAC,IAAM,SACnDC,GACFD,EAAW,IAAI,EAEjB3C,EAAQ,IAAI,OAAQ2C,EAAW,KAAK,GAAG,CAAC,EACxC3C,EAAQ,IAAI,SAAU4C,CAAQ,EAC9B5C,EAAQ,IAAI,OAAQR,CAAI,EACxB8D,EAAU,IAAI,OAAQ,OAAO,YAAYtD,CAAO,CAAC,CACnD,MACEsD,EAAU,IAAI,OAAQ,IAAI,EAE5B,QAAWjB,KAAOkB,EAAQ,CACxB,IAAMjB,EAAQiB,EAAOlB,CAAG,EACpB5C,EAAS6C,CAAK,GAChBgB,EAAU,IAAIjB,EAAKC,CAAK,CAE5B,CACF,MACEgB,EAAU,IAAI,QAAS,EAAK,EAE9B,OAAO,OAAO,YAAYA,CAAS,CACrC,CAMA,OAAQ,CACN,MAAM,MAAM,EACZ,KAAKhE,GAAQ,EACb,KAAKC,GAAS,MAAM,CACtB,CACF,EAKA,IAAMiE,EAAe,IAAIC,EAaZC,GAAc,MAAOC,EAAKC,EAAM,CAC3C,MAAO,CAAC,EACR,KAAM,CAAC,EACP,KAAM,CAAC,EACP,cAAe,GACf,MAAO,GACP,YAAa,QACf,IAAM,CACJ,IAAMC,EAAU,CAAC,CAACD,GAAK,MACjBE,EAAc,OAAO,UAAUF,GAAK,WAAW,GAAKA,EAAI,YAAc,EACxEA,EAAI,YACJ,SACAG,EACJ,GAAIJ,GAAOK,EAASL,CAAG,EAAG,CACxB,IAAIM,EACJ,GAAI,CACF,GAAM,CAAE,SAAAC,CAAS,EAAI,IAAI,IAAIP,CAAG,EAChCM,EAASC,EAAS,QAAQ,KAAM,EAAE,CACpC,OAASC,EAAG,CACVC,EAASP,EAAS,6BAA6BF,CAAG,GAAIQ,CAAC,CACzD,CACA,GAAIF,IAAW,OAAQ,CACrB,GAAM,CAAE,MAAAI,EAAO,KAAAC,EAAM,KAAAC,CAAK,EAAIX,EAC9B,GAAK,MAAM,QAAQS,CAAK,GAAKA,EAAM,SAAS,MAAM,GAC7C,EAAE,MAAM,QAAQC,CAAI,GAAKA,EAAK,SAAS,MAAM,IAC7C,MAAM,QAAQC,CAAI,GAAKA,EAAK,SAAS,MAAM,EAAI,CAClD,IAAIC,EACJ,GAAI,CACFA,EAAO,MAAM,MAAMb,CAAG,EACnB,KAAKc,GAAKA,EAAE,KAAK,CAAC,EAClB,KAAKC,GAAKC,GAAsBD,EAAGZ,CAAW,CAAC,CACpD,OAASK,EAAG,CACV,IAAMS,EAAM,yCAAyCjB,CAAG,GACxDS,EAASP,EAASe,EAAKT,CAAC,CAC1B,CACA,GAAIK,EAAM,CACR,GAAI,MAAM,QAAQD,CAAI,EACfA,EAAK,SAAS,MAAM,GACvBA,EAAK,KAAK,MAAM,UAET,MAAM,QAAQF,CAAK,IACvBA,EAAM,SAAS,MAAM,GACxBA,EAAM,KAAK,MAAM,EAEf,MAAM,QAAQC,CAAI,GAAKA,EAAK,SAAS,MAAM,GAAG,CAChD,IAAMO,EAAIP,EAAK,QAAQ,MAAM,EAC7BA,EAAK,OAAOO,EAAG,CAAC,CAClB,CAEFd,EAAMP,EAAa,SAASgB,EAAMZ,CAAG,CACvC,CACF,CACA,IAAI,gBAAgBD,CAAG,CACzB,MAAWM,GAAUL,EAAI,iBACvBG,EAAMP,EAAa,SAASG,EAAKC,CAAG,EAExC,CACA,OAAOG,GAAO,IAChB,EAaae,GAAkB,CAACnB,EAAKC,IAAQ,CAC3C,IAAIG,EACJ,GAAIJ,GAAOK,EAASL,CAAG,EAAG,CACxB,IAAIM,EACJ,GAAI,CACF,GAAM,CAAE,SAAAC,CAAS,EAAI,IAAI,IAAIP,CAAG,EAChCM,EAASC,EAAS,QAAQ,KAAM,EAAE,CACpC,OAASC,EAAG,CACV,IAAMS,EAAM,wBAAwBjB,CAAG,GACvCS,EAASR,GAAK,MAAOgB,EAAKT,CAAC,CAC7B,CACIF,IAAW,OACb,IAAI,gBAAgBN,CAAG,GACdM,GAAUL,GAAK,iBACxBG,EAAMP,EAAa,SAASG,EAAKC,CAAG,EAExC,CACA,OAAOG,GAAO,IAChB,EAOagB,GAAW,MAAMpB,GAChBH,EAAa,MAAMG,CAAG,EASvBqB,GAAerB,GAAOH,EAAa,MAAMG,CAAG,EAO5CsB,GAAQ,MAAMC,GACb1B,EAAa,OAAO0B,CAAG,EASxBC,GAAYD,GAAO1B,EAAa,OAAO0B,CAAG,EAGhDE,GAAQ5B",
-  "names": ["domPurify", "args", "msg", "REG_B64", "REG_DATA_URL", "REG_DATA_URL_B64", "REG_DATA_URL_G", "REG_NUM_REF", "REG_MIME_DOM", "REG_SCHEME", "REG_SCHEME_EXT", "REG_SCRIPT", "REG_SCRIPT_BLOB", "REG_TAG_QUOT", "REG_URL_ENC", "getType", "o", "isString", "FileReader", "text_chars_default", "uri_schemes_default", "getURLEncodedString", "str", "isString", "getType", "chars", "ch", "escapeURLEncodedHTMLChars", "REG_URL_ENC", "amp", "num", "lt", "gt", "quot", "apos", "escapedChar", "parseBase64", "data", "REG_B64", "bin", "uint8arr", "c", "textCharCodes", "text_chars_default", "parsedData", "parseURLEncodedNumCharRef", "nest", "res", "items", "REG_NUM_REF", "item", "numCharRef", "value", "index", "preNum", "postNum", "createDataURLFromBlob", "blob", "maxBlobSize", "resolve", "reject", "reader", "FileReader", "URISchemes", "#schemes", "uri_schemes_default", "scheme", "REG_SCRIPT", "REG_SCHEME", "uri", "protocol", "schemeParts", "REG_SCHEME_EXT", "s", "logDebug", "isDebug", "message", "error", "URLSanitizer", "URISchemes", "#nest", "#recurse", "data", "isString", "getType", "replacedData", "REG_DATA_URL", "items", "REG_DATA_URL_G", "item", "dataUrl", "REG_DATA_URL_B64", "parsedDataUrl", "index", "preDataUrl", "postDataUrl", "dom", "decodedDom", "purifiedDom", "domPurify", "url", "opt", "allow", "deny", "only", "allowRelative", "debug", "schemeMap", "tempScheme", "restrictScheme", "schemes", "REG_SCRIPT_BLOB", "e", "msg", "sanitizedUrl", "isVerified", "isRelative", "hostname", "protocol", "hash", "href", "pathname", "search", "scheme", "schemeParts", "bool", "s", "key", "value", "isDataUrl", "urlToSanitize", "mediaType", "dataParts", "mediaTypes", "isBase64", "parsedData", "parseBase64", "decodedData", "parseURLEncodedNumCharRef", "dataScheme", "containsDataUrl", "REG_MIME_DOM", "REG_TAG_QUOT", "escapeURLEncodedHTMLChars", "parsedUrl", "urlObj", "urlSanitizer", "URLSanitizer", "sanitizeURL", "url", "opt", "isDebug", "maxBlobSize", "res", "isString", "scheme", "protocol", "e", "logDebug", "allow", "deny", "only", "data", "r", "b", "createDataURLFromBlob", "msg", "i", "sanitizeURLSync", "parseURL", "parseURLSync", "isURI", "uri", "isURISync", "sanitizer_default"]
+  "sources": ["../bundle_wo_dompurify/mjs/dompurify.js", "../bundle_wo_dompurify/mjs/constant.js", "../bundle_wo_dompurify/mjs/common.js", "../bundle_wo_dompurify/lib/file/text-chars.json", "../bundle_wo_dompurify/lib/iana/uri-schemes.json", "../bundle_wo_dompurify/mjs/file-reader.js", "../bundle_wo_dompurify/mjs/uri-util.js", "../bundle_wo_dompurify/mjs/sanitizer.js"],
+  "sourcesContent": ["/**\n * dompurify.js\n */\n\nconst domPurify = {\n  sanitize: (...args) => {\n    if (globalThis?.DOMPurify) {\n      return globalThis.DOMPurify.sanitize(...args);\n    }\n\n    const msg = [\n      'DOMPurify is not available.',\n      'Ensure DOMPurify is exposed globally (e.g., window.DOMPurify).'\n    ];\n    throw new Error(msg.join(' '));\n  }\n};\n\nexport {\n  domPurify\n};\n", "/**\n * constant.js\n */\n\n/* numeric */\nexport const CHUNK_SIZE = 8 * 1024;\nexport const HEX = 16;\nexport const MAX_BLOB_SIZE = 32 * 1024 * 1024;\nexport const TYPE_FROM = 8;\nexport const TYPE_TO = -1;\n\n/* regexp */\nexport const REG_B64 = /^[\\w+/=-]+$/;\nexport const REG_CHARSET = /^charset=([\\w#&.;-]+)$/;\nexport const REG_DATA_URL = /data:[\\w#&+./;=-]*,/;\nexport const REG_DATA_URL_B64 = /data:[\\w#&+./;=^]*base64,[\\w+/=-]+/i;\nexport const REG_DATA_URL_G = /data:[\\w#&+./;=-]*,[^\\x22]+/g;\nexport const REG_NUM_REF = /&#(x(?:00)?[\\dA-F]{2}|0?\\d{1,3});?/gi;\nexport const REG_MIME_DOM =\n  /^(?:application\\/(?:[\\w#&.;-]+\\+)?x|image\\/svg\\+x|text\\/(?:ht|x))ml;?/;\nexport const REG_MIME_TEXT = /^text\\/[\\w#&.;-]+/;\nexport const REG_SCHEME = /^[a-z][\\da-z+.-]*$/;\nexport const REG_SCHEME_EXT = /^(?:ext|web)\\+[a-z]+$/;\nexport const REG_SCRIPT = /(?:java|vb)script/;\nexport const REG_SCRIPT_BLOB = /(?:java|vb)script|blob/;\nexport const REG_TAG_QUOT = /%(?:22|27|3C|3E)|[\\x22\\x27<>]/;\nexport const REG_URL_ENC = /^%[\\dA-F]{2}$/i;\n", "/**\n * common.js\n */\n\n/* shared */\nimport { TYPE_FROM, TYPE_TO } from './constant.js';\n\n/**\n * get type\n * @param {object} o - object to check\n * @returns {string} - type of object\n */\nexport const getType = o =>\n  Object.prototype.toString.call(o).slice(TYPE_FROM, TYPE_TO);\n\n/**\n * is string\n * @param {object} o - object to check\n * @returns {boolean} - result\n */\nexport const isString = o => typeof o === 'string' || o instanceof String;\n", "[7,8,9,10,11,12,13,27,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255]\n", "[\"aaa\",\"aaas\",\"about\",\"acap\",\"acct\",\"acd\",\"acr\",\"adiumxtra\",\"adt\",\"afp\",\"afs\",\"agtp\",\"aim\",\"amss\",\"android\",\"appdata\",\"apt\",\"ar\",\"ari\",\"ark\",\"at\",\"attachment\",\"aw\",\"barion\",\"beshare\",\"bitcoin\",\"bitcoincash\",\"bl\",\"blob\",\"bluetooth\",\"bolo\",\"brid\",\"browserext\",\"cabal\",\"caip\",\"calculator\",\"callto\",\"cap\",\"cast\",\"casts\",\"chrome\",\"chrome-extension\",\"cid\",\"coap\",\"coaps\",\"com-eventbrite-attendee\",\"content\",\"content-type\",\"crid\",\"cstr\",\"cttps\",\"cvs\",\"dab\",\"dat\",\"data\",\"dav\",\"dhttp\",\"diaspora\",\"dict\",\"did\",\"dilithium3\",\"dis\",\"dlna-playcontainer\",\"dlna-playsingle\",\"dnp\",\"dns\",\"dntp\",\"doi\",\"donau\",\"dpp\",\"drm\",\"dtmi\",\"dtn\",\"dvb\",\"dvx\",\"dweb\",\"ed2k\",\"eid\",\"elsi\",\"embedded\",\"ens\",\"esim\",\"ethereum\",\"example\",\"facetime\",\"feed\",\"feedready\",\"fido\",\"file\",\"finger\",\"first-run-pen-experience\",\"fish\",\"fm\",\"ftp\",\"fuchsia-pkg\",\"geo\",\"gg\",\"git\",\"gitoid\",\"gizmoproject\",\"go\",\"gopher\",\"graph\",\"gtalk\",\"h323\",\"ham\",\"hcap\",\"hcp\",\"hs20\",\"http\",\"https\",\"hxxp\",\"hxxps\",\"hydrazone\",\"hyper\",\"i0\",\"iax\",\"ibi\",\"ibi-\",\"icap\",\"icon\",\"ilstring\",\"im\",\"imap\",\"info\",\"iotdisco\",\"ipfs\",\"ipn\",\"ipns\",\"ipp\",\"ipps\",\"irc\",\"irc6\",\"ircs\",\"iris\",\"iris.beep\",\"iris.lwz\",\"iris.xpc\",\"iris.xpcs\",\"isostore\",\"itms\",\"jabber\",\"jar\",\"jms\",\"keyparc\",\"lastfm\",\"lbry\",\"ldap\",\"ldaps\",\"leaptofrogans\",\"lid\",\"linkid\",\"lorawan\",\"lpa\",\"lvlt\",\"machineProvisioningProgressReporter\",\"magnet\",\"mailto\",\"maps\",\"market\",\"matrix\",\"message\",\"microsoft.windows.camera\",\"microsoft.windows.camera.multipicker\",\"microsoft.windows.camera.picker\",\"mid\",\"mms\",\"mongodb\",\"moz\",\"moz-extension\",\"mqtt\",\"mqtts\",\"ms-access\",\"ms-appinstaller\",\"ms-browser-extension\",\"ms-calculator\",\"ms-drive-to\",\"ms-enrollment\",\"ms-excel\",\"ms-eyecontrolspeech\",\"ms-gamebarservices\",\"ms-gamingoverlay\",\"ms-getoffice\",\"ms-help\",\"ms-infopath\",\"ms-inputapp\",\"ms-launchremotedesktop\",\"ms-lockscreencomponent-config\",\"ms-media-stream-id\",\"ms-meetnow\",\"ms-mixedrealitycapture\",\"ms-mobileplans\",\"ms-newsandinterests\",\"ms-officeapp\",\"ms-people\",\"ms-personacard\",\"ms-powerpoint\",\"ms-project\",\"ms-publisher\",\"ms-recall\",\"ms-remotedesktop\",\"ms-remotedesktop-launch\",\"ms-restoretabcompanion\",\"ms-screenclip\",\"ms-screensketch\",\"ms-search\",\"ms-search-repair\",\"ms-secondary-screen-controller\",\"ms-secondary-screen-setup\",\"ms-settings\",\"ms-settings-airplanemode\",\"ms-settings-bluetooth\",\"ms-settings-camera\",\"ms-settings-cellular\",\"ms-settings-cloudstorage\",\"ms-settings-connectabledevices\",\"ms-settings-displays-topology\",\"ms-settings-emailandaccounts\",\"ms-settings-language\",\"ms-settings-location\",\"ms-settings-lock\",\"ms-settings-nfctransactions\",\"ms-settings-notifications\",\"ms-settings-power\",\"ms-settings-privacy\",\"ms-settings-proximity\",\"ms-settings-screenrotation\",\"ms-settings-wifi\",\"ms-settings-workplace\",\"ms-spd\",\"ms-stickers\",\"ms-sttoverlay\",\"ms-transit-to\",\"ms-useractivityset\",\"ms-uup\",\"ms-virtualtouchpad\",\"ms-visio\",\"ms-walk-to\",\"ms-whiteboard\",\"ms-whiteboard-cmd\",\"ms-widgetboard\",\"ms-widgets\",\"ms-word\",\"msnim\",\"msrp\",\"msrps\",\"mss\",\"mt\",\"mtqp\",\"mtrust\",\"mumble\",\"mupdate\",\"mvn\",\"mvrp\",\"mvrps\",\"news\",\"nfs\",\"ni\",\"nih\",\"nntp\",\"notes\",\"num\",\"ocf\",\"oid\",\"onenote\",\"onenote-cmd\",\"opaquelocktoken\",\"openid\",\"openpgp4fpr\",\"otpauth\",\"palm\",\"paparazzi\",\"payto\",\"pkcs11\",\"platform\",\"pop\",\"pres\",\"proxy\",\"psyc\",\"pttp\",\"pwid\",\"qb\",\"query\",\"quic-transport\",\"redis\",\"rediss\",\"reload\",\"res\",\"resource\",\"rmi\",\"rsync\",\"rtmfp\",\"rtmp\",\"rtsp\",\"rtsps\",\"rtspu\",\"sarif\",\"secondlife\",\"secret-token\",\"service\",\"session\",\"sftp\",\"sgn\",\"shc\",\"shelter\",\"sieve\",\"simpleledger\",\"simplex\",\"sip\",\"sips\",\"skype\",\"smb\",\"smp\",\"sms\",\"smtp\",\"snmp\",\"soap.beep\",\"soap.beeps\",\"soldat\",\"spacify\",\"spiffe\",\"spotify\",\"ssb\",\"ssh\",\"starknet\",\"steam\",\"stun\",\"stuns\",\"submit\",\"svn\",\"swh\",\"swid\",\"swidpath\",\"tag\",\"taler\",\"teamspeak\",\"teapot\",\"teapots\",\"tel\",\"teliaeid\",\"telnet\",\"tftp\",\"things\",\"thismessage\",\"tip\",\"tn3270\",\"tool\",\"turn\",\"turns\",\"tv\",\"udp\",\"unreal\",\"upn\",\"urn\",\"ut2004\",\"uuid-in-package\",\"v-event\",\"vemmi\",\"ventrilo\",\"ves\",\"view-source\",\"vnc\",\"vscode\",\"vscode-insiders\",\"vsls\",\"w3\",\"wasm\",\"wasm-js\",\"wcr\",\"web3\",\"webcal\",\"wifi\",\"ws\",\"wss\",\"wtai\",\"wyciwyg\",\"xcompute\",\"xcon\",\"xcon-userid\",\"xfire\",\"xftp\",\"xmlrpc.beep\",\"xmlrpc.beeps\",\"xmpp\",\"xrcp\",\"xri\",\"ymsgr\",\"z39.50r\",\"z39.50s\",\"ztdnaid\"]\n", "/**\n * file-reader.js\n */\n\nconst { FileReader } = globalThis;\n\nexport {\n  FileReader\n};\n", "/**\n * uri-util.js\n */\n\n/* shared */\nimport textChars from '../lib/file/text-chars.json' with { type: 'json' };\nimport uriSchemes from '../lib/iana/uri-schemes.json' with { type: 'json' };\nimport { getType, isString } from './common.js';\nimport { FileReader } from './file-reader.js';\n\n/* constants */\nimport {\n  HEX, MAX_BLOB_SIZE, REG_B64, REG_NUM_REF, REG_SCHEME, REG_SCHEME_EXT,\n  REG_SCRIPT, REG_URL_ENC\n} from './constant.js';\n\n/**\n * get URL encoded string\n * @param {string} str - string\n * @returns {string} - URL encoded string\n */\nexport const getURLEncodedString = str => {\n  if (!isString(str)) {\n    throw new TypeError(`Expected String but got ${getType(str)}.`);\n  }\n  const chars = [];\n  for (const ch of str) {\n    chars.push(`%${ch.charCodeAt(0).toString(HEX).toUpperCase()}`);\n  }\n  return chars.join('');\n};\n\n/**\n * escape URL encoded HTML special chars\n * @param {string} ch - URL encoded (percent encoded) char\n * @returns {string} - escaped URL encoded HTML special char / URL encoded char\n */\nexport const escapeURLEncodedHTMLChars = ch => {\n  if (isString(ch) && REG_URL_ENC.test(ch)) {\n    ch = ch.toUpperCase();\n  }\n  const [amp, num, lt, gt, quot, apos] =\n    ['&', '#', '<', '>', '\"', \"'\"].map(getURLEncodedString);\n  let escapedChar;\n  if (ch === amp) {\n    escapedChar = `${amp}amp;`;\n  } else if (ch === lt) {\n    escapedChar = `${amp}lt;`;\n  } else if (ch === gt) {\n    escapedChar = `${amp}gt;`;\n  } else if (ch === quot) {\n    escapedChar = `${amp}quot;`;\n  } else if (ch === apos) {\n    escapedChar = `${amp}${num}39;`;\n  } else {\n    escapedChar = ch;\n  }\n  return escapedChar;\n};\n\n/**\n * parse base64 encoded data\n * @param {string} data - base64 encoded data\n * @returns {string} - parsed text data / base64 encoded data if binary\n */\nexport const parseBase64 = data => {\n  if (!isString(data)) {\n    throw new TypeError(`Expected String but got ${getType(data)}.`);\n  } else if (!REG_B64.test(data)) {\n    throw new Error(`Invalid base64 data: ${data}`);\n  }\n  const bin = atob(data);\n  const uint8arr = Uint8Array.from([...bin].map(c => c.charCodeAt(0)));\n  const textCharCodes = new Set(textChars);\n  let parsedData;\n  if (uint8arr.every(c => textCharCodes.has(c))) {\n    parsedData = bin.replace(/\\s/g, getURLEncodedString);\n  } else {\n    parsedData = data;\n  }\n  return parsedData;\n};\n\n/**\n * parse URL encoded numeric character references in the range 0x00 to 0xFF\n * @param {string} str - string\n * @param {number} [nest] - nest level\n * @returns {string} - parsed string\n */\nexport const parseURLEncodedNumCharRef = (str, nest = 0) => {\n  if (!isString(str)) {\n    throw new TypeError(`Expected String but got ${getType(str)}.`);\n  }\n  if (!Number.isInteger(nest)) {\n    throw new TypeError(`Expected Number but got ${getType(nest)}.`);\n  } else if (nest > HEX) {\n    throw new Error('Character references nested too deeply.');\n  }\n  let res = decodeURIComponent(str);\n  if (/&#/.test(res)) {\n    const textCharCodes = new Set(textChars);\n    const items = [...res.matchAll(REG_NUM_REF)].reverse();\n    for (const item of items) {\n      const [numCharRef, value] = item;\n      let num;\n      if (/^x[\\dA-F]+/i.test(value)) {\n        num = parseInt(`0${value}`, HEX);\n      } else if (/^\\d+/.test(value)) {\n        num = parseInt(value);\n      }\n      if (Number.isInteger(num)) {\n        const { index } = item;\n        const [preNum, postNum] = [\n          res.substring(0, index),\n          res.substring(index + numCharRef.length)\n        ];\n        if (textCharCodes.has(num)) {\n          res = `${preNum}${String.fromCharCode(num)}${postNum}`;\n          if (/#x?$/.test(preNum) || /^#(?:x(?:00)?[2-7]|\\d)/.test(postNum)) {\n            res = parseURLEncodedNumCharRef(res, ++nest);\n          }\n        } else if (num < HEX * HEX) {\n          res = `${preNum}${postNum}`;\n        }\n      }\n    }\n  }\n  return res;\n};\n\n/**\n * create data URL from blob\n * @param {object} blob - blob\n * @param {number} maxBlobSize - max blob size\n * @returns {Promise.<?string>} - data URL\n */\nexport const createDataURLFromBlob = (blob, maxBlobSize = MAX_BLOB_SIZE) =>\n  new Promise((resolve, reject) => {\n    if (!Number.isInteger(blob?.size)) {\n      return resolve(null);\n    } else if (Number.isInteger(maxBlobSize) && blob.size > maxBlobSize) {\n      return reject(new DOMException(\n        `Blob size (${blob.size} bytes) exceeds the maximum allowed size of ${maxBlobSize} bytes.`,\n        'NotReadableError'\n      ));\n    }\n    const reader = new FileReader();\n    reader.addEventListener('error', () => reject(reader.error));\n    reader.addEventListener('abort', () => resolve(reader.result));\n    reader.addEventListener('load', () => resolve(reader.result));\n    reader.readAsDataURL(blob);\n  });\n\n/**\n * URI schemes\n */\nexport class URISchemes {\n  /* private fields */\n  #schemes = new Set(uriSchemes);\n\n  /**\n   * get schemes\n   * @see {@link https://www.iana.org/assignments/uri-schemes/uri-schemes.xhtml}\n   *      - Historical schemes omitted\n   *      - 'moz-extension' scheme added\n   * @returns {Array.<string>} - array of schemes\n   */\n  get() {\n    return [...this.#schemes];\n  }\n\n  /**\n   * has scheme\n   * @param {string} scheme - scheme\n   * @returns {boolean} - result\n   */\n  has(scheme) {\n    return this.#schemes.has(scheme);\n  }\n\n  /**\n   * add scheme\n   * NOTE: `javascript` and/or `vbscript` schemes can not be registered\n   * @param {string} scheme - scheme\n   * @returns {Array.<string>} - array of schemes\n   */\n  add(scheme) {\n    if (!isString(scheme)) {\n      throw new TypeError(`Expected String but got ${getType(scheme)}.`);\n    } else if (REG_SCRIPT.test(scheme) || !REG_SCHEME.test(scheme)) {\n      throw new Error(`Invalid scheme: ${scheme}`);\n    }\n    this.#schemes.add(scheme);\n    return [...this.#schemes];\n  }\n\n  /**\n   * remove scheme\n   * @param {string} scheme - scheme\n   * @returns {boolean} - result\n   */\n  remove(scheme) {\n    return this.#schemes.delete(scheme);\n  }\n\n  /**\n   * verify URI\n   * @param {string} uri - URI\n   * @returns {boolean} - result\n   */\n  verify(uri) {\n    let res;\n    if (isString(uri)) {\n      try {\n        const { protocol } = new URL(uri);\n        const scheme = protocol.replace(/:$/, '');\n        const schemeParts = scheme.split('+');\n        res = (!REG_SCRIPT.test(scheme) && REG_SCHEME_EXT.test(scheme)) ||\n              schemeParts.every(s => this.#schemes.has(s));\n      } catch (e) {\n        res = false;\n      }\n    }\n    return !!res;\n  }\n\n  /**\n   * reset schemes\n   * @returns {void}\n   */\n  reset() {\n    this.#schemes = new Set(uriSchemes);\n  }\n}\n", "/**\n * sanitizer.js\n */\n\n/* shared */\nimport { domPurify } from './dompurify.js';\nimport { getType, isString } from './common.js';\nimport {\n  createDataURLFromBlob, escapeURLEncodedHTMLChars, parseBase64,\n  parseURLEncodedNumCharRef, URISchemes\n} from './uri-util.js';\nimport {\n  HEX, MAX_BLOB_SIZE, REG_DATA_URL, REG_DATA_URL_B64, REG_DATA_URL_G,\n  REG_MIME_DOM, REG_SCRIPT_BLOB, REG_TAG_QUOT\n} from './constant.js';\n\n/* typedef */\n/**\n * @typedef {object} ParsedURL - object with additional props based on URL API\n * @property {string} input - URL input\n * @property {boolean} valid - is valid URI\n * @property {object} [data] - parsed result of data URL, `null`able\n * @property {string} [data.mime] - MIME type\n * @property {boolean} [data.base64] - is base64 encoded\n * @property {string} [data.data] - data part of the data URL\n * @property {string} [href] - sanitized URL input\n * @property {string} [origin] - scheme, domain and port of the sanitized URL\n * @property {string} [protocol] - protocol scheme of the sanitized URL\n * @property {string} [username] - username specified before the domain name\n * @property {string} [password] - password specified before the domain name\n * @property {string} [host] - domain and port of the sanitized URL\n * @property {string} [hostname] - domain of the sanitized URL\n * @property {string} [port] - port number of the sanitized URL\n * @property {string} [pathname] - path of the sanitized URL\n * @property {string} [search] - query string of the sanitized URL\n * @property {string} [hash] - fragment identifier of the sanitized URL\n */\n\n/**\n * Internal debug logger.\n * @param {boolean} isDebug - Debug flag.\n * @param {string} message - Output message.\n * @param {Error} [error] - Caught error object.\n */\nexport const logDebug = (isDebug, message, error) => {\n  if (isDebug) {\n    console.warn(`[URLSanitizer Debug] ${message}`, error ? error.message : '');\n  }\n};\n\n/**\n * URL sanitizer\n */\nclass URLSanitizer extends URISchemes {\n  /* private fields */\n  #nest;\n  #recurse = new Set();\n\n  /**\n   * construct\n   */\n  constructor() {\n    super();\n    this.#nest = 0;\n  }\n\n  /**\n   * helper to register schemes for allow/only options\n   * @private\n   * @param {string} item - scheme to register\n   * @param {string} listName - name of the option list\n   * @param {object} ctx - local context for state management\n   * @returns {boolean} - true if scheme is acceptable\n   */\n  #registerScheme(item, listName, ctx) {\n    if (!REG_SCRIPT_BLOB.test(item)) {\n      if (super.has(item)) {\n        ctx.schemeMap.set(item, true);\n      } else {\n        try {\n          super.add(item);\n        } catch (e) {\n          const msg = `Failed to add scheme '${item}' in '${listName}' list.`;\n          logDebug(ctx.debug, msg, e);\n        }\n        if (super.has(item)) {\n          ctx.schemeMap.set(item, true);\n          ctx.tempScheme.add(item);\n        }\n      }\n      return true;\n    }\n    return false;\n  }\n\n  /**\n   * replace matched data URLs\n   * @param {string} data - data URL\n   * @returns {string} - replaced data URL\n   */\n  replace(data) {\n    if (!isString(data)) {\n      throw new TypeError(`Expected String but got ${getType(data)}.`);\n    }\n    let replacedData = data;\n    if (REG_DATA_URL.test(replacedData)) {\n      const matchedDataUrls = replacedData.matchAll(REG_DATA_URL_G);\n      const items = [...matchedDataUrls].reverse();\n      for (const item of items) {\n        let [dataUrl] = item;\n        if (REG_DATA_URL_B64.test(dataUrl)) {\n          [dataUrl] = REG_DATA_URL_B64.exec(dataUrl);\n        }\n        this.#nest++;\n        this.#recurse.add(dataUrl);\n        let parsedDataUrl;\n        try {\n          parsedDataUrl = this.sanitize(dataUrl, {\n            allow: ['data']\n          });\n        } finally {\n          this.#nest--;\n          this.#recurse.delete(dataUrl);\n        }\n        const { index } = item;\n        const [preDataUrl, postDataUrl] = [\n          replacedData.substring(0, index),\n          replacedData.substring(index + dataUrl.length)\n        ];\n        if (parsedDataUrl) {\n          replacedData = `${preDataUrl}${parsedDataUrl}${postDataUrl}`;\n        } else {\n          replacedData = `${preDataUrl}${postDataUrl}`;\n        }\n      }\n    }\n    return replacedData;\n  }\n\n  /**\n   * purify URL encoded DOM\n   * @param {string} dom - DOM string\n   * @returns {string} - purified DOM string\n   */\n  purify(dom) {\n    if (!isString(dom)) {\n      throw new TypeError(`Expected String but got ${getType(dom)}.`);\n    }\n    let decodedDom = dom;\n    try {\n      // prevent URIError caused by malformed percent-encoding\n      // e.g., a standalone '%'\n      decodedDom = decodeURIComponent(dom);\n    } catch (e) {\n      // fall through\n    }\n    let purifiedDom = domPurify.sanitize(decodedDom);\n    if (purifiedDom && REG_DATA_URL.test(purifiedDom)) {\n      purifiedDom = this.replace(purifiedDom);\n    }\n    purifiedDom = purifiedDom.replace(/(?:#|%23)$/, '')\n      .replace(/(?<!(?:#|%23).*)(?:\\?|%3F)$/, '');\n    try {\n      // prevent URIError caused by lone surrogates\n      return encodeURI(purifiedDom);\n    } catch (e) {\n      return purifiedDom;\n    }\n  }\n\n  /**\n   * sanitize URL\n   * NOTE: `data` and `file` schemes must be explicitly allowed\n   * `blob` URLs should be converted to `data` URLs\n   * `javascript` and `vbscript` schemes can not be allowed\n   * @param {string} url - URL\n   * @param {object} [opt] - options\n   * @param {Array.<string>} [opt.allow] - array of allowed schemes\n   * @param {Array.<string>} [opt.deny] - array of denied schemes\n   * @param {Array.<string>} [opt.only] - array of specific schemes to allow\n   * @param {boolean} [opt.allowRelative] - allow relative URLs\n   * @param {boolean} [opt.debug] - enable debug mode\n   * @returns {?string} - sanitized URL\n   */\n  sanitize(url, opt) {\n    if (this.#nest > HEX) {\n      throw new Error('Data URLs nested too deeply.');\n    }\n    const {\n      allow, deny, only, allowRelative = false, debug = false\n    } = opt ?? {};\n    const schemeMap = new Map([\n      ['blob', false],\n      ['data', false],\n      ['file', false],\n      ['javascript', false],\n      ['vbscript', false]\n    ]);\n    const tempScheme = new Set();\n    const ctx = { schemeMap, tempScheme, debug };\n    let restrictScheme = false;\n    if (Array.isArray(only) && only.length) {\n      const schemes = super.get();\n      for (const item of schemes) {\n        schemeMap.set(item, false);\n      }\n      for (let item of only) {\n        if (isString(item)) {\n          item = item.trim();\n          const registered = this.#registerScheme(item, 'only', ctx);\n          if (registered && !restrictScheme && schemeMap.has(item)) {\n            restrictScheme = schemeMap.get(item);\n          }\n        }\n      }\n    } else {\n      if (Array.isArray(allow) && allow.length) {\n        for (const item of allow) {\n          if (isString(item)) {\n            this.#registerScheme(item.trim(), 'allow', ctx);\n          }\n        }\n      }\n      if (Array.isArray(deny) && deny.length) {\n        for (let item of deny) {\n          if (isString(item)) {\n            item = item.trim();\n            if (item) {\n              schemeMap.set(item, false);\n            }\n          }\n        }\n      }\n    }\n    let sanitizedUrl;\n    let isVerified = super.verify(url);\n    let isRelative = false;\n    if (!isVerified && allowRelative) {\n      try {\n        const { hostname, protocol } = new URL(url, 'http://dummy.local');\n        if (protocol === 'http:' && hostname === 'dummy.local') {\n          isVerified = true;\n          isRelative = true;\n        }\n      } catch (e) {\n        logDebug(debug, 'Failed to parse relative URL.', e);\n      }\n    }\n    if (isVerified) {\n      let hash, href, pathname, protocol, search;\n      let scheme = '';\n      let schemeParts = [];\n      let bool = false;\n      if (isRelative) {\n        bool = true;\n      } else {\n        const urlObj = new URL(url);\n        ({ hash, href, pathname, protocol, search } = urlObj);\n        scheme = protocol.replace(/:$/, '');\n        schemeParts = scheme.split('+');\n        if (restrictScheme) {\n          bool = schemeParts.every(s => schemeMap.get(s));\n        } else {\n          for (const [key, value] of schemeMap.entries()) {\n            bool =\n              value || (scheme !== key && schemeParts.every(s => s !== key));\n            if (!bool) {\n              break;\n            }\n          }\n        }\n      }\n      if (bool) {\n        const isDataUrl = isRelative ? false : schemeParts.includes('data');\n        let urlToSanitize = isRelative ? url : href;\n        if (isDataUrl) {\n          const [mediaType, ...dataParts] = pathname.split(',');\n          const data = `${dataParts.join(',')}${search}${hash}`;\n          const mediaTypes = mediaType.split(';');\n          const isBase64 = mediaTypes[mediaTypes.length - 1] === 'base64';\n          let parsedData = data;\n          if (isBase64) {\n            parsedData = parseBase64(data);\n          }\n          try {\n            const decodedData = parseURLEncodedNumCharRef(parsedData).trim();\n            const { protocol: dataScheme } = new URL(decodedData);\n            const dataSchemeParts = dataScheme.replace(/:$/, '').split('+');\n            if (dataSchemeParts.some(s => REG_SCRIPT_BLOB.test(s))) {\n              urlToSanitize = '';\n            }\n          } catch (e) {\n            const msg = 'Failed to parse inner data URL protocol.';\n            logDebug(debug, msg, e);\n          }\n          const containsDataUrl = REG_DATA_URL.test(parsedData);\n          if (parsedData !== data || containsDataUrl) {\n            if (containsDataUrl) {\n              parsedData = this.replace(parsedData);\n            }\n          }\n          if (!mediaType || REG_MIME_DOM.test(mediaType)) {\n            parsedData = this.purify(parsedData);\n          }\n          if (urlToSanitize && parsedData) {\n            if (isBase64 && parsedData !== data) {\n              mediaTypes.pop();\n            }\n            urlToSanitize = `${scheme}:${mediaTypes.join(';')},${parsedData}`;\n          } else {\n            urlToSanitize = '';\n          }\n        }\n        if (!isDataUrl && REG_TAG_QUOT.test(urlToSanitize)) {\n          const item = REG_TAG_QUOT.exec(urlToSanitize);\n          const { index } = item;\n          urlToSanitize =\n            urlToSanitize.substring(0, index).replace(/[?&]$/, '');\n        }\n        if (urlToSanitize) {\n          sanitizedUrl =\n            urlToSanitize.replace(/%26/g, escapeURLEncodedHTMLChars);\n        }\n      }\n      if (tempScheme.size) {\n        tempScheme.forEach(item => {\n          super.remove(item);\n        });\n      }\n    }\n    return sanitizedUrl || null;\n  }\n\n  /**\n   * parse sanitized URL\n   * @param {string} url - URL\n   * @param {object} [opt] - options\n   * @param {Array.<string>} [opt.allow] - array of allowed schemes\n   * @param {Array.<string>} [opt.deny] - array of denied schemes\n   * @param {Array.<string>} [opt.only] - array of specific schemes to allow\n   * @returns {ParsedURL} - result with additional props based on URL API\n   */\n  parse(url, opt) {\n    if (!isString(url)) {\n      throw new TypeError(`Expected String but got ${getType(url)}.`);\n    }\n    const parsedUrl = new Map([\n      ['input', url]\n    ]);\n    let sanitizedUrl;\n    if (this.verify(url)) {\n      const { protocol } = new URL(url);\n      if (protocol === 'blob:') {\n        sanitizedUrl = url;\n      } else {\n        sanitizedUrl = this.sanitize(url, opt ?? {\n          allow: ['data', 'file']\n        });\n      }\n    }\n    if (sanitizedUrl) {\n      const urlObj = new URL(sanitizedUrl);\n      const { pathname, protocol } = urlObj;\n      const schemeParts = protocol.replace(/:$/, '').split('+');\n      const isDataUrl = schemeParts.includes('data');\n      parsedUrl.set('valid', true);\n      if (isDataUrl) {\n        const dataUrl = new Map();\n        const [mediaType, ...dataParts] = pathname.split(',');\n        const data = `${dataParts.join(',')}`;\n        const mediaTypes = mediaType.split(';');\n        const isBase64 = mediaTypes[mediaTypes.length - 1] === 'base64';\n        if (isBase64) {\n          mediaTypes.pop();\n        }\n        dataUrl.set('mime', mediaTypes.join(';'));\n        dataUrl.set('base64', isBase64);\n        dataUrl.set('data', data);\n        parsedUrl.set('data', Object.fromEntries(dataUrl));\n      } else {\n        parsedUrl.set('data', null);\n      }\n      for (const key in urlObj) {\n        const value = urlObj[key];\n        if (isString(value)) {\n          parsedUrl.set(key, value);\n        }\n      }\n    } else {\n      parsedUrl.set('valid', false);\n    }\n    return Object.fromEntries(parsedUrl);\n  }\n\n  /**\n   * reset sanitizer\n   * @returns {void}\n   */\n  reset() {\n    super.reset();\n    this.#nest = 0;\n    this.#recurse.clear();\n  }\n}\nexport { URLSanitizer };\n\n/* aliases and async wrappers */\n/* instance */\nconst urlSanitizer = new URLSanitizer();\n\n/**\n * sanitize URL async\n * NOTE: `blob`, `data` and `file` schemes must be explicitly allowed\n * given a `blob` URL, returns a sanitized `data` URL\n * @param {string} url - URL\n * @param {object} [opt] - options\n * @param {Array.<string>} [opt.allow] - array of allowed schemes\n * @param {Array.<string>} [opt.deny] - array of denied schemes\n * @param {Array.<string>} [opt.only] - array of specific schemes to allow\n * @returns {Promise.<?string>} - sanitized URL\n */\nexport const sanitizeURL = async (url, opt = {\n  allow: [],\n  deny: [],\n  only: [],\n  allowRelative: false,\n  debug: false,\n  maxBlobSize: MAX_BLOB_SIZE\n}) => {\n  const isDebug = !!opt?.debug;\n  const maxBlobSize = Number.isInteger(opt?.maxBlobSize) && opt.maxBlobSize > 0\n    ? opt.maxBlobSize\n    : MAX_BLOB_SIZE;\n  let res;\n  if (url && isString(url)) {\n    let scheme;\n    try {\n      const { protocol } = new URL(url);\n      scheme = protocol.replace(/:$/, '');\n    } catch (e) {\n      logDebug(isDebug, `Invalid URL input format: ${url}`, e);\n    }\n    if (scheme === 'blob') {\n      const { allow, deny, only } = opt;\n      if ((Array.isArray(allow) && allow.includes('blob') &&\n           !(Array.isArray(deny) && deny.includes('blob'))) ||\n          (Array.isArray(only) && only.includes('blob'))) {\n        let data;\n        try {\n          data = await fetch(url)\n            .then(r => r.blob())\n            .then(b => createDataURLFromBlob(b, maxBlobSize));\n        } catch (e) {\n          const msg = `Failed to fetch and convert blob URL: ${url}`;\n          logDebug(isDebug, msg, e);\n        }\n        if (data) {\n          if (Array.isArray(only)) {\n            if (!only.includes('data')) {\n              only.push('data');\n            }\n          } else if (Array.isArray(allow)) {\n            if (!allow.includes('data')) {\n              allow.push('data');\n            }\n            if (Array.isArray(deny) && deny.includes('data')) {\n              const i = deny.indexOf('data');\n              deny.splice(i, 1);\n            }\n          }\n          res = urlSanitizer.sanitize(data, opt);\n        }\n      }\n      URL.revokeObjectURL(url);\n    } else if (scheme || opt.allowRelative) {\n      res = urlSanitizer.sanitize(url, opt);\n    }\n  }\n  return res || null;\n};\n\n/**\n * sanitize URL sync\n * NOTE: `data` and `file` schemes must be explicitly allowed\n * `blob` scheme returns `null`\n * @param {string} url - URL\n * @param {object} [opt] - options\n * @param {Array.<string>} [opt.allow] - array of allowed schemes\n * @param {Array.<string>} [opt.deny] - array of denied schemes\n * @param {Array.<string>} [opt.only] - array of specific schemes to allow\n * @returns {?string} - sanitized URL\n */\nexport const sanitizeURLSync = (url, opt) => {\n  let res;\n  if (url && isString(url)) {\n    let scheme;\n    try {\n      const { protocol } = new URL(url);\n      scheme = protocol.replace(/:$/, '');\n    } catch (e) {\n      const msg = `Failed to parse URL: ${url}`;\n      logDebug(opt?.debug, msg, e);\n    }\n    if (scheme === 'blob') {\n      URL.revokeObjectURL(url);\n    } else if (scheme || opt?.allowRelative) {\n      res = urlSanitizer.sanitize(url, opt);\n    }\n  }\n  return res || null;\n};\n\n/**\n * parse URL async\n * @param {string} url - URL\n * @returns {Promise.<ParsedURL>} - result\n */\nexport const parseURL = async url => {\n  const res = urlSanitizer.parse(url);\n  return res;\n};\n\n/**\n * parse URL sync\n * @param {string} url - URL\n * @returns {ParsedURL} - result\n */\nexport const parseURLSync = url => urlSanitizer.parse(url);\n\n/**\n * is URI async\n * @param {string} uri - URI\n * @returns {Promise.<boolean>} - result\n */\nexport const isURI = async uri => {\n  const res = urlSanitizer.verify(uri);\n  return res;\n};\n\n/**\n * is URI sync\n * @param {string} uri - URI\n * @returns {boolean} - result\n */\nexport const isURISync = uri => urlSanitizer.verify(uri);\n\n/* export instance */\nexport default urlSanitizer;\n"],
+  "mappings": "AAIA,IAAMA,EAAY,CAChB,SAAU,IAAIC,IAAS,CACrB,GAAI,YAAY,UACd,OAAO,WAAW,UAAU,SAAS,GAAGA,CAAI,EAG9C,IAAMC,EAAM,CACV,8BACA,gEACF,EACA,MAAM,IAAI,MAAMA,EAAI,KAAK,GAAG,CAAC,CAC/B,CACF,ECJO,IAAMC,EAAU,cAEhB,IAAMC,EAAe,sBACfC,EAAmB,sCACnBC,EAAiB,+BACjBC,EAAc,uCACdC,GACX,wEAEK,IAAMC,GAAa,qBACbC,GAAiB,wBACjBC,EAAa,oBACbC,EAAkB,yBAClBC,EAAe,gCACfC,GAAc,iBCdpB,IAAMC,EAAUC,GACrB,OAAO,UAAU,SAAS,KAAKA,CAAC,EAAE,MAAM,EAAW,EAAO,EAO/CC,EAAWD,GAAK,OAAOA,GAAM,UAAYA,aAAa,OCpBnE,IAAAE,EAAA,CAAC,EAAE,EAAE,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,GAAG,ECA70B,IAAAC,EAAA,CAAC,MAAM,OAAO,QAAQ,OAAO,OAAO,MAAM,MAAM,YAAY,MAAM,MAAM,MAAM,OAAO,MAAM,OAAO,UAAU,UAAU,MAAM,KAAK,MAAM,MAAM,KAAK,aAAa,KAAK,SAAS,UAAU,UAAU,cAAc,KAAK,OAAO,YAAY,OAAO,OAAO,aAAa,QAAQ,OAAO,aAAa,SAAS,MAAM,OAAO,QAAQ,SAAS,mBAAmB,MAAM,OAAO,QAAQ,0BAA0B,UAAU,eAAe,OAAO,OAAO,QAAQ,MAAM,MAAM,MAAM,OAAO,MAAM,QAAQ,WAAW,OAAO,MAAM,aAAa,MAAM,qBAAqB,kBAAkB,MAAM,MAAM,OAAO,MAAM,QAAQ,MAAM,MAAM,OAAO,MAAM,MAAM,MAAM,OAAO,OAAO,MAAM,OAAO,WAAW,MAAM,OAAO,WAAW,UAAU,WAAW,OAAO,YAAY,OAAO,OAAO,SAAS,2BAA2B,OAAO,KAAK,MAAM,cAAc,MAAM,KAAK,MAAM,SAAS,eAAe,KAAK,SAAS,QAAQ,QAAQ,OAAO,MAAM,OAAO,MAAM,OAAO,OAAO,QAAQ,OAAO,QAAQ,YAAY,QAAQ,KAAK,MAAM,MAAM,OAAO,OAAO,OAAO,WAAW,KAAK,OAAO,OAAO,WAAW,OAAO,MAAM,OAAO,MAAM,OAAO,MAAM,OAAO,OAAO,OAAO,YAAY,WAAW,WAAW,YAAY,WAAW,OAAO,SAAS,MAAM,MAAM,UAAU,SAAS,OAAO,OAAO,QAAQ,gBAAgB,MAAM,SAAS,UAAU,MAAM,OAAO,sCAAsC,SAAS,SAAS,OAAO,SAAS,SAAS,UAAU,2BAA2B,uCAAuC,kCAAkC,MAAM,MAAM,UAAU,MAAM,gBAAgB,OAAO,QAAQ,YAAY,kBAAkB,uBAAuB,gBAAgB,cAAc,gBAAgB,WAAW,sBAAsB,qBAAqB,mBAAmB,eAAe,UAAU,cAAc,cAAc,yBAAyB,gCAAgC,qBAAqB,aAAa,yBAAyB,iBAAiB,sBAAsB,eAAe,YAAY,iBAAiB,gBAAgB,aAAa,eAAe,YAAY,mBAAmB,0BAA0B,yBAAyB,gBAAgB,kBAAkB,YAAY,mBAAmB,iCAAiC,4BAA4B,cAAc,2BAA2B,wBAAwB,qBAAqB,uBAAuB,2BAA2B,iCAAiC,gCAAgC,+BAA+B,uBAAuB,uBAAuB,mBAAmB,8BAA8B,4BAA4B,oBAAoB,sBAAsB,wBAAwB,6BAA6B,mBAAmB,wBAAwB,SAAS,cAAc,gBAAgB,gBAAgB,qBAAqB,SAAS,qBAAqB,WAAW,aAAa,gBAAgB,oBAAoB,iBAAiB,aAAa,UAAU,QAAQ,OAAO,QAAQ,MAAM,KAAK,OAAO,SAAS,SAAS,UAAU,MAAM,OAAO,QAAQ,OAAO,MAAM,KAAK,MAAM,OAAO,QAAQ,MAAM,MAAM,MAAM,UAAU,cAAc,kBAAkB,SAAS,cAAc,UAAU,OAAO,YAAY,QAAQ,SAAS,WAAW,MAAM,OAAO,QAAQ,OAAO,OAAO,OAAO,KAAK,QAAQ,iBAAiB,QAAQ,SAAS,SAAS,MAAM,WAAW,MAAM,QAAQ,QAAQ,OAAO,OAAO,QAAQ,QAAQ,QAAQ,aAAa,eAAe,UAAU,UAAU,OAAO,MAAM,MAAM,UAAU,QAAQ,eAAe,UAAU,MAAM,OAAO,QAAQ,MAAM,MAAM,MAAM,OAAO,OAAO,YAAY,aAAa,SAAS,UAAU,SAAS,UAAU,MAAM,MAAM,WAAW,QAAQ,OAAO,QAAQ,SAAS,MAAM,MAAM,OAAO,WAAW,MAAM,QAAQ,YAAY,SAAS,UAAU,MAAM,WAAW,SAAS,OAAO,SAAS,cAAc,MAAM,SAAS,OAAO,OAAO,QAAQ,KAAK,MAAM,SAAS,MAAM,MAAM,SAAS,kBAAkB,UAAU,QAAQ,WAAW,MAAM,cAAc,MAAM,SAAS,kBAAkB,OAAO,KAAK,OAAO,UAAU,MAAM,OAAO,SAAS,OAAO,KAAK,MAAM,OAAO,UAAU,WAAW,OAAO,cAAc,QAAQ,OAAO,cAAc,eAAe,OAAO,OAAO,MAAM,QAAQ,UAAU,UAAU,SAAS,ECIpkI,GAAM,CAAE,WAAAC,EAAW,EAAI,WCiBhB,IAAMC,GAAsBC,GAAO,CACxC,GAAI,CAACC,EAASD,CAAG,EACf,MAAM,IAAI,UAAU,2BAA2BE,EAAQF,CAAG,CAAC,GAAG,EAEhE,IAAMG,EAAQ,CAAC,EACf,QAAWC,KAAMJ,EACfG,EAAM,KAAK,IAAIC,EAAG,WAAW,CAAC,EAAE,SAAS,EAAG,EAAE,YAAY,CAAC,EAAE,EAE/D,OAAOD,EAAM,KAAK,EAAE,CACtB,EAOaE,GAA4BD,GAAM,CACzCH,EAASG,CAAE,GAAKE,GAAY,KAAKF,CAAE,IACrCA,EAAKA,EAAG,YAAY,GAEtB,GAAM,CAACG,EAAKC,EAAKC,EAAIC,EAAIC,EAAMC,CAAI,EACjC,CAAC,IAAK,IAAK,IAAK,IAAK,IAAK,GAAG,EAAE,IAAIb,EAAmB,EACpDc,EACJ,OAAIT,IAAOG,EACTM,EAAc,GAAGN,CAAG,OACXH,IAAOK,EAChBI,EAAc,GAAGN,CAAG,MACXH,IAAOM,EAChBG,EAAc,GAAGN,CAAG,MACXH,IAAOO,EAChBE,EAAc,GAAGN,CAAG,QACXH,IAAOQ,EAChBC,EAAc,GAAGN,CAAG,GAAGC,CAAG,MAE1BK,EAAcT,EAETS,CACT,EAOaC,GAAcC,GAAQ,CACjC,GAAKd,EAASc,CAAI,GAEX,GAAI,CAACC,EAAQ,KAAKD,CAAI,EAC3B,MAAM,IAAI,MAAM,wBAAwBA,CAAI,EAAE,MAF9C,OAAM,IAAI,UAAU,2BAA2Bb,EAAQa,CAAI,CAAC,GAAG,EAIjE,IAAME,EAAM,KAAKF,CAAI,EACfG,EAAW,WAAW,KAAK,CAAC,GAAGD,CAAG,EAAE,IAAIE,GAAKA,EAAE,WAAW,CAAC,CAAC,CAAC,EAC7DC,EAAgB,IAAI,IAAIC,CAAS,EACnCC,EACJ,OAAIJ,EAAS,MAAMC,GAAKC,EAAc,IAAID,CAAC,CAAC,EAC1CG,EAAaL,EAAI,QAAQ,MAAOlB,EAAmB,EAEnDuB,EAAaP,EAERO,CACT,EAQaC,EAA4B,CAACvB,EAAKwB,EAAO,IAAM,CAC1D,GAAI,CAACvB,EAASD,CAAG,EACf,MAAM,IAAI,UAAU,2BAA2BE,EAAQF,CAAG,CAAC,GAAG,EAEhE,GAAK,OAAO,UAAUwB,CAAI,GAEnB,GAAIA,EAAO,GAChB,MAAM,IAAI,MAAM,yCAAyC,MAFzD,OAAM,IAAI,UAAU,2BAA2BtB,EAAQsB,CAAI,CAAC,GAAG,EAIjE,IAAIC,EAAM,mBAAmBzB,CAAG,EAChC,GAAI,KAAK,KAAKyB,CAAG,EAAG,CAClB,IAAML,EAAgB,IAAI,IAAIC,CAAS,EACjCK,EAAQ,CAAC,GAAGD,EAAI,SAASE,CAAW,CAAC,EAAE,QAAQ,EACrD,QAAWC,KAAQF,EAAO,CACxB,GAAM,CAACG,EAAYC,CAAK,EAAIF,EACxBpB,EAMJ,GALI,cAAc,KAAKsB,CAAK,EAC1BtB,EAAM,SAAS,IAAIsB,CAAK,GAAI,EAAG,EACtB,OAAO,KAAKA,CAAK,IAC1BtB,EAAM,SAASsB,CAAK,GAElB,OAAO,UAAUtB,CAAG,EAAG,CACzB,GAAM,CAAE,MAAAuB,CAAM,EAAIH,EACZ,CAACI,EAAQC,CAAO,EAAI,CACxBR,EAAI,UAAU,EAAGM,CAAK,EACtBN,EAAI,UAAUM,EAAQF,EAAW,MAAM,CACzC,EACIT,EAAc,IAAIZ,CAAG,GACvBiB,EAAM,GAAGO,CAAM,GAAG,OAAO,aAAaxB,CAAG,CAAC,GAAGyB,CAAO,IAChD,OAAO,KAAKD,CAAM,GAAK,yBAAyB,KAAKC,CAAO,KAC9DR,EAAMF,EAA0BE,EAAK,EAAED,CAAI,IAEpChB,EAAM,MACfiB,EAAM,GAAGO,CAAM,GAAGC,CAAO,GAE7B,CACF,CACF,CACA,OAAOR,CACT,EAQaS,GAAwB,CAACC,EAAMC,EAAc,WACxD,IAAI,QAAQ,CAACC,EAASC,IAAW,CAC/B,GAAK,OAAO,UAAUH,GAAM,IAAI,GAEzB,GAAI,OAAO,UAAUC,CAAW,GAAKD,EAAK,KAAOC,EACtD,OAAOE,EAAO,IAAI,aAChB,cAAcH,EAAK,IAAI,+CAA+CC,CAAW,UACjF,kBACF,CAAC,MALD,QAAOC,EAAQ,IAAI,EAOrB,IAAME,EAAS,IAAIC,GACnBD,EAAO,iBAAiB,QAAS,IAAMD,EAAOC,EAAO,KAAK,CAAC,EAC3DA,EAAO,iBAAiB,QAAS,IAAMF,EAAQE,EAAO,MAAM,CAAC,EAC7DA,EAAO,iBAAiB,OAAQ,IAAMF,EAAQE,EAAO,MAAM,CAAC,EAC5DA,EAAO,cAAcJ,CAAI,CAC3B,CAAC,EAKUM,EAAN,KAAiB,CAEtBC,GAAW,IAAI,IAAIC,CAAU,EAS7B,KAAM,CACJ,MAAO,CAAC,GAAG,KAAKD,EAAQ,CAC1B,CAOA,IAAIE,EAAQ,CACV,OAAO,KAAKF,GAAS,IAAIE,CAAM,CACjC,CAQA,IAAIA,EAAQ,CACV,GAAK3C,EAAS2C,CAAM,GAEb,GAAIC,EAAW,KAAKD,CAAM,GAAK,CAACE,GAAW,KAAKF,CAAM,EAC3D,MAAM,IAAI,MAAM,mBAAmBA,CAAM,EAAE,MAF3C,OAAM,IAAI,UAAU,2BAA2B1C,EAAQ0C,CAAM,CAAC,GAAG,EAInE,YAAKF,GAAS,IAAIE,CAAM,EACjB,CAAC,GAAG,KAAKF,EAAQ,CAC1B,CAOA,OAAOE,EAAQ,CACb,OAAO,KAAKF,GAAS,OAAOE,CAAM,CACpC,CAOA,OAAOG,EAAK,CACV,IAAItB,EACJ,GAAIxB,EAAS8C,CAAG,EACd,GAAI,CACF,GAAM,CAAE,SAAAC,CAAS,EAAI,IAAI,IAAID,CAAG,EAC1BH,EAASI,EAAS,QAAQ,KAAM,EAAE,EAClCC,EAAcL,EAAO,MAAM,GAAG,EACpCnB,EAAO,CAACoB,EAAW,KAAKD,CAAM,GAAKM,GAAe,KAAKN,CAAM,GACvDK,EAAY,MAAME,GAAK,KAAKT,GAAS,IAAIS,CAAC,CAAC,CACnD,MAAY,CACV1B,EAAM,EACR,CAEF,MAAO,CAAC,CAACA,CACX,CAMA,OAAQ,CACN,KAAKiB,GAAW,IAAI,IAAIC,CAAU,CACpC,CACF,EC7LO,IAAMS,EAAW,CAACC,EAASC,EAASC,IAAU,CAC/CF,GACF,QAAQ,KAAK,wBAAwBC,CAAO,GAAIC,EAAQA,EAAM,QAAU,EAAE,CAE9E,EAKMC,EAAN,cAA2BC,CAAW,CAEpCC,GACAC,GAAW,IAAI,IAKf,aAAc,CACZ,MAAM,EACN,KAAKD,GAAQ,CACf,CAUAE,GAAgBC,EAAMC,EAAUC,EAAK,CACnC,GAAI,CAACC,EAAgB,KAAKH,CAAI,EAAG,CAC/B,GAAI,MAAM,IAAIA,CAAI,EAChBE,EAAI,UAAU,IAAIF,EAAM,EAAI,MACvB,CACL,GAAI,CACF,MAAM,IAAIA,CAAI,CAChB,OAASI,EAAG,CACV,IAAMC,EAAM,yBAAyBL,CAAI,SAASC,CAAQ,UAC1DV,EAASW,EAAI,MAAOG,EAAKD,CAAC,CAC5B,CACI,MAAM,IAAIJ,CAAI,IAChBE,EAAI,UAAU,IAAIF,EAAM,EAAI,EAC5BE,EAAI,WAAW,IAAIF,CAAI,EAE3B,CACA,MAAO,EACT,CACA,MAAO,EACT,CAOA,QAAQM,EAAM,CACZ,GAAI,CAACC,EAASD,CAAI,EAChB,MAAM,IAAI,UAAU,2BAA2BE,EAAQF,CAAI,CAAC,GAAG,EAEjE,IAAIG,EAAeH,EACnB,GAAII,EAAa,KAAKD,CAAY,EAAG,CAEnC,IAAME,EAAQ,CAAC,GADSF,EAAa,SAASG,CAAc,CAC3B,EAAE,QAAQ,EAC3C,QAAWZ,KAAQW,EAAO,CACxB,GAAI,CAACE,CAAO,EAAIb,EACZc,EAAiB,KAAKD,CAAO,IAC/B,CAACA,CAAO,EAAIC,EAAiB,KAAKD,CAAO,GAE3C,KAAKhB,KACL,KAAKC,GAAS,IAAIe,CAAO,EACzB,IAAIE,EACJ,GAAI,CACFA,EAAgB,KAAK,SAASF,EAAS,CACrC,MAAO,CAAC,MAAM,CAChB,CAAC,CACH,QAAE,CACA,KAAKhB,KACL,KAAKC,GAAS,OAAOe,CAAO,CAC9B,CACA,GAAM,CAAE,MAAAG,CAAM,EAAIhB,EACZ,CAACiB,EAAYC,CAAW,EAAI,CAChCT,EAAa,UAAU,EAAGO,CAAK,EAC/BP,EAAa,UAAUO,EAAQH,EAAQ,MAAM,CAC/C,EACIE,EACFN,EAAe,GAAGQ,CAAU,GAAGF,CAAa,GAAGG,CAAW,GAE1DT,EAAe,GAAGQ,CAAU,GAAGC,CAAW,EAE9C,CACF,CACA,OAAOT,CACT,CAOA,OAAOU,EAAK,CACV,GAAI,CAACZ,EAASY,CAAG,EACf,MAAM,IAAI,UAAU,2BAA2BX,EAAQW,CAAG,CAAC,GAAG,EAEhE,IAAIC,EAAaD,EACjB,GAAI,CAGFC,EAAa,mBAAmBD,CAAG,CACrC,MAAY,CAEZ,CACA,IAAIE,EAAcC,EAAU,SAASF,CAAU,EAC3CC,GAAeX,EAAa,KAAKW,CAAW,IAC9CA,EAAc,KAAK,QAAQA,CAAW,GAExCA,EAAcA,EAAY,QAAQ,aAAc,EAAE,EAC/C,QAAQ,8BAA+B,EAAE,EAC5C,GAAI,CAEF,OAAO,UAAUA,CAAW,CAC9B,MAAY,CACV,OAAOA,CACT,CACF,CAgBA,SAASE,EAAKC,EAAK,CACjB,GAAI,KAAK3B,GAAQ,GACf,MAAM,IAAI,MAAM,8BAA8B,EAEhD,GAAM,CACJ,MAAA4B,EAAO,KAAAC,EAAM,KAAAC,EAAM,cAAAC,EAAgB,GAAO,MAAAC,EAAQ,EACpD,EAAIL,GAAO,CAAC,EACNM,EAAY,IAAI,IAAI,CACxB,CAAC,OAAQ,EAAK,EACd,CAAC,OAAQ,EAAK,EACd,CAAC,OAAQ,EAAK,EACd,CAAC,aAAc,EAAK,EACpB,CAAC,WAAY,EAAK,CACpB,CAAC,EACKC,EAAa,IAAI,IACjB7B,EAAM,CAAE,UAAA4B,EAAW,WAAAC,EAAY,MAAAF,CAAM,EACvCG,EAAiB,GACrB,GAAI,MAAM,QAAQL,CAAI,GAAKA,EAAK,OAAQ,CACtC,IAAMM,EAAU,MAAM,IAAI,EAC1B,QAAWjC,KAAQiC,EACjBH,EAAU,IAAI9B,EAAM,EAAK,EAE3B,QAASA,KAAQ2B,EACXpB,EAASP,CAAI,IACfA,EAAOA,EAAK,KAAK,EACE,KAAKD,GAAgBC,EAAM,OAAQE,CAAG,GACvC,CAAC8B,GAAkBF,EAAU,IAAI9B,CAAI,IACrDgC,EAAiBF,EAAU,IAAI9B,CAAI,GAI3C,KAAO,CACL,GAAI,MAAM,QAAQyB,CAAK,GAAKA,EAAM,OAChC,QAAWzB,KAAQyB,EACblB,EAASP,CAAI,GACf,KAAKD,GAAgBC,EAAK,KAAK,EAAG,QAASE,CAAG,EAIpD,GAAI,MAAM,QAAQwB,CAAI,GAAKA,EAAK,OAC9B,QAAS1B,KAAQ0B,EACXnB,EAASP,CAAI,IACfA,EAAOA,EAAK,KAAK,EACbA,GACF8B,EAAU,IAAI9B,EAAM,EAAK,EAKnC,CACA,IAAIkC,EACAC,EAAa,MAAM,OAAOZ,CAAG,EAC7Ba,EAAa,GACjB,GAAI,CAACD,GAAcP,EACjB,GAAI,CACF,GAAM,CAAE,SAAAS,EAAU,SAAAC,CAAS,EAAI,IAAI,IAAIf,EAAK,oBAAoB,EAC5De,IAAa,SAAWD,IAAa,gBACvCF,EAAa,GACbC,EAAa,GAEjB,OAAShC,EAAG,CACVb,EAASsC,EAAO,gCAAiCzB,CAAC,CACpD,CAEF,GAAI+B,EAAY,CACd,IAAII,EAAMC,EAAMC,EAAUH,EAAUI,EAChCC,EAAS,GACTC,EAAc,CAAC,EACfC,EAAO,GACX,GAAIT,EACFS,EAAO,WAGN,CAAE,KAAAN,EAAM,KAAAC,EAAM,SAAAC,EAAU,SAAAH,EAAU,OAAAI,CAAO,EAD3B,IAAI,IAAInB,CAAG,EAE1BoB,EAASL,EAAS,QAAQ,KAAM,EAAE,EAClCM,EAAcD,EAAO,MAAM,GAAG,EAC1BX,EACFa,EAAOD,EAAY,MAAME,GAAKhB,EAAU,IAAIgB,CAAC,CAAC,MAE9C,QAAW,CAACC,EAAKC,CAAK,IAAKlB,EAAU,QAAQ,EAG3C,GAFAe,EACEG,GAAUL,IAAWI,GAAOH,EAAY,MAAME,GAAKA,IAAMC,CAAG,EAC1D,CAACF,EACH,MAKR,GAAIA,EAAM,CACR,IAAMI,EAAYb,EAAa,GAAQQ,EAAY,SAAS,MAAM,EAC9DM,EAAgBd,EAAab,EAAMiB,EACvC,GAAIS,EAAW,CACb,GAAM,CAACE,EAAW,GAAGC,CAAS,EAAIX,EAAS,MAAM,GAAG,EAC9CnC,EAAO,GAAG8C,EAAU,KAAK,GAAG,CAAC,GAAGV,CAAM,GAAGH,CAAI,GAC7Cc,EAAaF,EAAU,MAAM,GAAG,EAChCG,EAAWD,EAAWA,EAAW,OAAS,CAAC,IAAM,SACnDE,EAAajD,EACbgD,IACFC,EAAaC,GAAYlD,CAAI,GAE/B,GAAI,CACF,IAAMmD,EAAcC,EAA0BH,CAAU,EAAE,KAAK,EACzD,CAAE,SAAUI,CAAW,EAAI,IAAI,IAAIF,CAAW,EAC5BE,EAAW,QAAQ,KAAM,EAAE,EAAE,MAAM,GAAG,EAC1C,KAAKb,IAAK3C,EAAgB,KAAK2C,EAAC,CAAC,IACnDI,EAAgB,GAEpB,OAAS9C,EAAG,CAEVb,EAASsC,EADG,2CACSzB,CAAC,CACxB,CACA,IAAMwD,EAAkBlD,EAAa,KAAK6C,CAAU,GAChDA,IAAejD,GAAQsD,IACrBA,IACFL,EAAa,KAAK,QAAQA,CAAU,IAGpC,CAACJ,GAAaU,GAAa,KAAKV,CAAS,KAC3CI,EAAa,KAAK,OAAOA,CAAU,GAEjCL,GAAiBK,GACfD,GAAYC,IAAejD,GAC7B+C,EAAW,IAAI,EAEjBH,EAAgB,GAAGP,CAAM,IAAIU,EAAW,KAAK,GAAG,CAAC,IAAIE,CAAU,IAE/DL,EAAgB,EAEpB,CACA,GAAI,CAACD,GAAaa,EAAa,KAAKZ,CAAa,EAAG,CAClD,IAAMlD,EAAO8D,EAAa,KAAKZ,CAAa,EACtC,CAAE,MAAAlC,CAAM,EAAIhB,EAClBkD,EACEA,EAAc,UAAU,EAAGlC,CAAK,EAAE,QAAQ,QAAS,EAAE,CACzD,CACIkC,IACFhB,EACEgB,EAAc,QAAQ,OAAQa,EAAyB,EAE7D,CACIhC,EAAW,MACbA,EAAW,QAAQ/B,GAAQ,CACzB,MAAM,OAAOA,CAAI,CACnB,CAAC,CAEL,CACA,OAAOkC,GAAgB,IACzB,CAWA,MAAMX,EAAKC,EAAK,CACd,GAAI,CAACjB,EAASgB,CAAG,EACf,MAAM,IAAI,UAAU,2BAA2Bf,EAAQe,CAAG,CAAC,GAAG,EAEhE,IAAMyC,EAAY,IAAI,IAAI,CACxB,CAAC,QAASzC,CAAG,CACf,CAAC,EACGW,EACJ,GAAI,KAAK,OAAOX,CAAG,EAAG,CACpB,GAAM,CAAE,SAAAe,CAAS,EAAI,IAAI,IAAIf,CAAG,EAC5Be,IAAa,QACfJ,EAAeX,EAEfW,EAAe,KAAK,SAASX,EAAKC,GAAO,CACvC,MAAO,CAAC,OAAQ,MAAM,CACxB,CAAC,CAEL,CACA,GAAIU,EAAc,CAChB,IAAM+B,EAAS,IAAI,IAAI/B,CAAY,EAC7B,CAAE,SAAAO,EAAU,SAAAH,CAAS,EAAI2B,EAEzBhB,EADcX,EAAS,QAAQ,KAAM,EAAE,EAAE,MAAM,GAAG,EAC1B,SAAS,MAAM,EAE7C,GADA0B,EAAU,IAAI,QAAS,EAAI,EACvBf,EAAW,CACb,IAAMpC,EAAU,IAAI,IACd,CAACsC,EAAW,GAAGC,CAAS,EAAIX,EAAS,MAAM,GAAG,EAC9CnC,EAAO,GAAG8C,EAAU,KAAK,GAAG,CAAC,GAC7BC,EAAaF,EAAU,MAAM,GAAG,EAChCG,EAAWD,EAAWA,EAAW,OAAS,CAAC,IAAM,SACnDC,GACFD,EAAW,IAAI,EAEjBxC,EAAQ,IAAI,OAAQwC,EAAW,KAAK,GAAG,CAAC,EACxCxC,EAAQ,IAAI,SAAUyC,CAAQ,EAC9BzC,EAAQ,IAAI,OAAQP,CAAI,EACxB0D,EAAU,IAAI,OAAQ,OAAO,YAAYnD,CAAO,CAAC,CACnD,MACEmD,EAAU,IAAI,OAAQ,IAAI,EAE5B,QAAWjB,KAAOkB,EAAQ,CACxB,IAAMjB,EAAQiB,EAAOlB,CAAG,EACpBxC,EAASyC,CAAK,GAChBgB,EAAU,IAAIjB,EAAKC,CAAK,CAE5B,CACF,MACEgB,EAAU,IAAI,QAAS,EAAK,EAE9B,OAAO,OAAO,YAAYA,CAAS,CACrC,CAMA,OAAQ,CACN,MAAM,MAAM,EACZ,KAAKnE,GAAQ,EACb,KAAKC,GAAS,MAAM,CACtB,CACF,EAKA,IAAMoE,EAAe,IAAIC,EAaZC,GAAc,MAAOC,EAAKC,EAAM,CAC3C,MAAO,CAAC,EACR,KAAM,CAAC,EACP,KAAM,CAAC,EACP,cAAe,GACf,MAAO,GACP,YAAa,QACf,IAAM,CACJ,IAAMC,EAAU,CAAC,CAACD,GAAK,MACjBE,EAAc,OAAO,UAAUF,GAAK,WAAW,GAAKA,EAAI,YAAc,EACxEA,EAAI,YACJ,SACAG,EACJ,GAAIJ,GAAOK,EAASL,CAAG,EAAG,CACxB,IAAIM,EACJ,GAAI,CACF,GAAM,CAAE,SAAAC,CAAS,EAAI,IAAI,IAAIP,CAAG,EAChCM,EAASC,EAAS,QAAQ,KAAM,EAAE,CACpC,OAASC,EAAG,CACVC,EAASP,EAAS,6BAA6BF,CAAG,GAAIQ,CAAC,CACzD,CACA,GAAIF,IAAW,OAAQ,CACrB,GAAM,CAAE,MAAAI,EAAO,KAAAC,EAAM,KAAAC,CAAK,EAAIX,EAC9B,GAAK,MAAM,QAAQS,CAAK,GAAKA,EAAM,SAAS,MAAM,GAC7C,EAAE,MAAM,QAAQC,CAAI,GAAKA,EAAK,SAAS,MAAM,IAC7C,MAAM,QAAQC,CAAI,GAAKA,EAAK,SAAS,MAAM,EAAI,CAClD,IAAIC,EACJ,GAAI,CACFA,EAAO,MAAM,MAAMb,CAAG,EACnB,KAAKc,GAAKA,EAAE,KAAK,CAAC,EAClB,KAAKC,GAAKC,GAAsBD,EAAGZ,CAAW,CAAC,CACpD,OAASK,EAAG,CACV,IAAMS,EAAM,yCAAyCjB,CAAG,GACxDS,EAASP,EAASe,EAAKT,CAAC,CAC1B,CACA,GAAIK,EAAM,CACR,GAAI,MAAM,QAAQD,CAAI,EACfA,EAAK,SAAS,MAAM,GACvBA,EAAK,KAAK,MAAM,UAET,MAAM,QAAQF,CAAK,IACvBA,EAAM,SAAS,MAAM,GACxBA,EAAM,KAAK,MAAM,EAEf,MAAM,QAAQC,CAAI,GAAKA,EAAK,SAAS,MAAM,GAAG,CAChD,IAAMO,EAAIP,EAAK,QAAQ,MAAM,EAC7BA,EAAK,OAAOO,EAAG,CAAC,CAClB,CAEFd,EAAMP,EAAa,SAASgB,EAAMZ,CAAG,CACvC,CACF,CACA,IAAI,gBAAgBD,CAAG,CACzB,MAAWM,GAAUL,EAAI,iBACvBG,EAAMP,EAAa,SAASG,EAAKC,CAAG,EAExC,CACA,OAAOG,GAAO,IAChB,EAaae,GAAkB,CAACnB,EAAKC,IAAQ,CAC3C,IAAIG,EACJ,GAAIJ,GAAOK,EAASL,CAAG,EAAG,CACxB,IAAIM,EACJ,GAAI,CACF,GAAM,CAAE,SAAAC,CAAS,EAAI,IAAI,IAAIP,CAAG,EAChCM,EAASC,EAAS,QAAQ,KAAM,EAAE,CACpC,OAASC,EAAG,CACV,IAAMS,EAAM,wBAAwBjB,CAAG,GACvCS,EAASR,GAAK,MAAOgB,EAAKT,CAAC,CAC7B,CACIF,IAAW,OACb,IAAI,gBAAgBN,CAAG,GACdM,GAAUL,GAAK,iBACxBG,EAAMP,EAAa,SAASG,EAAKC,CAAG,EAExC,CACA,OAAOG,GAAO,IAChB,EAOagB,GAAW,MAAMpB,GAChBH,EAAa,MAAMG,CAAG,EASvBqB,GAAerB,GAAOH,EAAa,MAAMG,CAAG,EAO5CsB,GAAQ,MAAMC,GACb1B,EAAa,OAAO0B,CAAG,EASxBC,GAAYD,GAAO1B,EAAa,OAAO0B,CAAG,EAGhDE,GAAQ5B",
+  "names": ["domPurify", "args", "msg", "REG_B64", "REG_DATA_URL", "REG_DATA_URL_B64", "REG_DATA_URL_G", "REG_NUM_REF", "REG_MIME_DOM", "REG_SCHEME", "REG_SCHEME_EXT", "REG_SCRIPT", "REG_SCRIPT_BLOB", "REG_TAG_QUOT", "REG_URL_ENC", "getType", "o", "isString", "text_chars_default", "uri_schemes_default", "FileReader", "getURLEncodedString", "str", "isString", "getType", "chars", "ch", "escapeURLEncodedHTMLChars", "REG_URL_ENC", "amp", "num", "lt", "gt", "quot", "apos", "escapedChar", "parseBase64", "data", "REG_B64", "bin", "uint8arr", "c", "textCharCodes", "text_chars_default", "parsedData", "parseURLEncodedNumCharRef", "nest", "res", "items", "REG_NUM_REF", "item", "numCharRef", "value", "index", "preNum", "postNum", "createDataURLFromBlob", "blob", "maxBlobSize", "resolve", "reject", "reader", "FileReader", "URISchemes", "#schemes", "uri_schemes_default", "scheme", "REG_SCRIPT", "REG_SCHEME", "uri", "protocol", "schemeParts", "REG_SCHEME_EXT", "s", "logDebug", "isDebug", "message", "error", "URLSanitizer", "URISchemes", "#nest", "#recurse", "#registerScheme", "item", "listName", "ctx", "REG_SCRIPT_BLOB", "e", "msg", "data", "isString", "getType", "replacedData", "REG_DATA_URL", "items", "REG_DATA_URL_G", "dataUrl", "REG_DATA_URL_B64", "parsedDataUrl", "index", "preDataUrl", "postDataUrl", "dom", "decodedDom", "purifiedDom", "domPurify", "url", "opt", "allow", "deny", "only", "allowRelative", "debug", "schemeMap", "tempScheme", "restrictScheme", "schemes", "sanitizedUrl", "isVerified", "isRelative", "hostname", "protocol", "hash", "href", "pathname", "search", "scheme", "schemeParts", "bool", "s", "key", "value", "isDataUrl", "urlToSanitize", "mediaType", "dataParts", "mediaTypes", "isBase64", "parsedData", "parseBase64", "decodedData", "parseURLEncodedNumCharRef", "dataScheme", "containsDataUrl", "REG_MIME_DOM", "REG_TAG_QUOT", "escapeURLEncodedHTMLChars", "parsedUrl", "urlObj", "urlSanitizer", "URLSanitizer", "sanitizeURL", "url", "opt", "isDebug", "maxBlobSize", "res", "isString", "scheme", "protocol", "e", "logDebug", "allow", "deny", "only", "data", "r", "b", "createDataURLFromBlob", "msg", "i", "sanitizeURLSync", "parseURL", "parseURLSync", "isURI", "uri", "isURISync", "sanitizer_default"]
 }