@aglyn/aglyn 1.0.0-beta.143

package/src/lib/app-utils/sanitize-svg.d.ts

@@ -0,0 +1,55 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/** What a sanitization pass took out, for the asset's audit trail. */
+export interface SvgSanitizeResult {
+    /** The sanitized document. Only meaningful when `changed`. */
+    svg: string;
+    /** Whether anything was removed at all. */
+    changed: boolean;
+    /** Distinct reasons, e.g. `['script', 'event handler']`. */
+    removed: string[];
+}
+/** The one content type that is a document wearing an `image/` label. */
+export declare function isSvgUploadType(contentType: string): boolean;
+/**
+ * A URL value the sanitizer will keep.
+ *
+ * Same-document fragments (`#gradient-1`, what `<use>` and `fill="url(#…)"`
+ * actually need) and raster data URIs. Everything else goes, including plain
+ * relative and `https:` references: AGL-1474 asks for external references to
+ * be stripped, and inside an `<img>`-embedded SVG — the way logos are used
+ * across this product — a browser refuses to load them anyway.
+ *
+ * `data:image/svg+xml` is NOT safe: it is another document, and nesting is how
+ * a sanitizer gets walked past.
+ */
+export declare function isSafeSvgUrl(raw: string): boolean;
+/** Strips the executable and external-reference surface from an SVG source. */
+export declare function sanitizeSvg(source: string): SvgSanitizeResult;
+/**
+ * Buffer form for the upload routes.
+ *
+ * When nothing was removed the ORIGINAL buffer comes back untouched — not a
+ * re-encode of the parsed source. That is deliberate: it means a legitimate
+ * SVG in some encoding this scanner does not model can never be corrupted by
+ * merely passing through, and it keeps the stored content hash stable.
+ */
+export declare function sanitizeSvgBuffer(buffer: Buffer): {
+    buffer: Buffer;
+    changed: boolean;
+    removed: string[];
+};

package/src/lib/app-utils/sanitize-svg.js

@@ -0,0 +1,460 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * SVG sanitization at the upload chokepoints (AGL-1474).
+ *
+ * An SVG is a DOCUMENT, not a picture. `image/*` has always been the one open
+ * family in the upload allowlist, the stored content type is whatever the
+ * client declared, and the CDN serves the bytes `inline` from the console's
+ * own origin — so `<script>alert(document.domain)</script>` inside an uploaded
+ * logo executes on `app.aglyn.com`, or on the customer's published domain,
+ * the moment the asset URL is opened top-level. Every editor could do it.
+ *
+ * **This file is the remediation, not the containment.** The containment is
+ * `mediaCdnContentSecurityPolicy` in `serve-media-cdn.ts`, which stamps a
+ * `sandbox` / `script-src 'none'` policy on the serve response and therefore
+ * covers every asset already in the bucket without touching a byte. This
+ * sanitizer is what keeps the STORED artifact clean — so the platform is not
+ * one header regression away from the same hole, and so an SVG handed to a
+ * customer through any other channel is not carrying a payload.
+ *
+ * Neither layer touches `<img src>`: a browser loading an SVG as an image
+ * never runs its script and never applies the response's CSP. The vector is
+ * top-level navigation (and `<object>`/`<iframe>` embedding), and that is
+ * exactly what both layers close.
+ *
+ * ## Why a scanner rather than a DOM
+ *
+ * `dompurify` is already a dependency, but only in `apps/docs` (mermaid) and
+ * only in a browser. Server-side it needs `jsdom`, which is a devDependency —
+ * promoting a full HTML engine into every serverless upload function to strip
+ * a handful of constructs is the wrong trade. So: a small XML-shaped scanner
+ * that keeps kept attributes VERBATIM (their raw source span, entities and
+ * all) and drops the rest. Nothing is re-encoded, so nothing can be mangled
+ * by a re-encode.
+ *
+ * ## What it removes
+ *
+ * - `<script>` and its content, at any nesting depth and under any namespace
+ *   prefix (`<html:script>` has local name `script`).
+ * - `<foreignObject>` and its subtree — the documented HTML escape hatch.
+ * - `<iframe>`, `<frame>`, `<frameset>`, `<embed>`, `<object>`, `<handler>`,
+ *   `<listener>`, `<animation>`, `<audio>`, `<video>` and their subtrees.
+ * - Every `on*` attribute (`onload`, `onclick`, `onbegin`, …).
+ * - Every URL-bearing attribute (`href`, `xlink:href`, `src`, `data`,
+ *   `action`, `formaction`, `poster`) whose value is not a same-document
+ *   `#fragment` or a raster `data:image/…` — which covers `javascript:`,
+ *   `data:text/html`, nested `data:image/svg+xml`, and plain external refs.
+ * - Animation elements (`<set>`, `<animate>`, …) that target a URL attribute,
+ *   because `<set attributeName="href" to="javascript:…">` reintroduces one.
+ * - `url(…)` references to anywhere but a `#fragment` inside `style=`,
+ *   presentation attributes (`fill`, `filter`, `mask`, `clip-path`, …) and
+ *   `<style>` text, plus `@import` and `expression(`.
+ * - `<?xml-stylesheet?>` and every other processing instruction — an external
+ *   XSLT is a script engine.
+ * - A DOCTYPE with an internal subset, whose `<!ENTITY>` definitions expand
+ *   into markup after every check here has run. A plain external-id DOCTYPE
+ *   is inert and kept, because Illustrator has emitted one for twenty years
+ *   and rewriting those files buys nothing.
+ *
+ * Scheme detection decodes numeric and named entities first and ignores
+ * control characters and whitespace, so `&#106;avascript:` and `java&#9;script:`
+ * resolve the same way the browser resolves them.
+ */ /** Elements dropped together with everything inside them. */ const REMOVED_ELEMENTS = new Set([
+    'script',
+    'foreignobject',
+    'iframe',
+    'frame',
+    'frameset',
+    'embed',
+    'object',
+    'handler',
+    'listener',
+    'animation',
+    'audio',
+    'video'
+]);
+/**
+ * Elements whose content is raw text rather than markup. Consumed to their
+ * close tag verbatim, so a `<` inside CSS or script source can never be
+ * mistaken for a tag and desynchronize the scan.
+ */ const RAW_TEXT_ELEMENTS = new Set([
+    'script',
+    'style'
+]);
+/** SMIL animation elements — safe unless they animate a URL attribute. */ const ANIMATION_ELEMENTS = new Set([
+    'set',
+    'animate',
+    'animatetransform',
+    'animatemotion',
+    'animatecolor'
+]);
+/** Attributes whose whole value is a URL. */ const URL_ATTRIBUTES = new Set([
+    'href',
+    'src',
+    'data',
+    'action',
+    'formaction',
+    'poster'
+]);
+const ENTITIES = {
+    amp: '&',
+    lt: '<',
+    gt: '>',
+    quot: '"',
+    apos: "'",
+    colon: ':',
+    tab: '\t',
+    newline: '\n',
+    sol: '/'
+};
+/** The one content type that is a document wearing an `image/` label. */ export function isSvgUploadType(contentType) {
+    const type = String(contentType != null ? contentType : '').split(';')[0].trim().toLowerCase();
+    return type === 'image/svg+xml' || type === 'image/svg';
+}
+function decodeEntities(value) {
+    let out = String(value != null ? value : '');
+    // Bounded, because `&amp;#106;` is a decode away from `&#106;` and an
+    // attacker gets to pick the depth. Three passes is past anything a browser
+    // will itself resolve.
+    for(let pass = 0; pass < 3; pass++){
+        const next = out.replace(/&#x([0-9a-f]+);?/gi, (match, hex)=>codePoint(parseInt(hex, 16), match)).replace(/&#(\d+);?/g, (match, decimal)=>codePoint(parseInt(decimal, 10), match)).replace(/&([a-z]+);/gi, (match, name)=>{
+            var _ENTITIES_String_toLowerCase;
+            return (_ENTITIES_String_toLowerCase = ENTITIES[String(name).toLowerCase()]) != null ? _ENTITIES_String_toLowerCase : match;
+        });
+        if (next === out) break;
+        out = next;
+    }
+    return out;
+}
+function codePoint(value, fallback) {
+    if (!Number.isFinite(value) || value < 0 || value > 0x10ffff) return fallback;
+    try {
+        return String.fromCodePoint(value);
+    } catch (unused) {
+        return fallback;
+    }
+}
+/**
+ * Drops every character a browser ignores while resolving a URL's scheme —
+ * control characters and whitespace — so `java\tscript:` and a leading NUL
+ * both collapse to `javascript:` before the check below sees them.
+ *
+ * Written as a code-point filter rather than a character class because a
+ * control-character range in a regex is exactly what `no-control-regex`
+ * exists to flag, and silencing that rule here would be the wrong signal.
+ */ function stripInsignificant(value) {
+    let out = '';
+    for (const character of value){
+        var _character_codePointAt;
+        const code = (_character_codePointAt = character.codePointAt(0)) != null ? _character_codePointAt : 0;
+        if (code > 0x20 && code !== 0x7f) out += character;
+    }
+    return out;
+}
+/**
+ * A URL value the sanitizer will keep.
+ *
+ * Same-document fragments (`#gradient-1`, what `<use>` and `fill="url(#…)"`
+ * actually need) and raster data URIs. Everything else goes, including plain
+ * relative and `https:` references: AGL-1474 asks for external references to
+ * be stripped, and inside an `<img>`-embedded SVG — the way logos are used
+ * across this product — a browser refuses to load them anyway.
+ *
+ * `data:image/svg+xml` is NOT safe: it is another document, and nesting is how
+ * a sanitizer gets walked past.
+ */ export function isSafeSvgUrl(raw) {
+    const value = stripInsignificant(decodeEntities(raw));
+    if (!value) return true;
+    if (value.startsWith('#')) return true;
+    const lower = value.toLowerCase();
+    if (lower.startsWith('data:image/') && !lower.startsWith('data:image/svg')) {
+        return true;
+    }
+    return false;
+}
+const URL_FUNCTION = /url\(\s*(['"]?)([^)'"]*)\1\s*\)/gi;
+/** `url(…)`, `javascript:` or `expression(` pointing anywhere but this document. */ function hasUnsafeUrlReference(value) {
+    const decoded = decodeEntities(value);
+    const tight = stripInsignificant(decoded);
+    if (/javascript:/i.test(tight)) return true;
+    if (/expression\(/i.test(tight)) return true;
+    URL_FUNCTION.lastIndex = 0;
+    let match;
+    while((match = URL_FUNCTION.exec(decoded)) !== null){
+        if (!isSafeSvgUrl(match[2])) return true;
+    }
+    return false;
+}
+/**
+ * `<style>` text. Kept rather than dropped — class-based styling is how every
+ * exported SVG carries its colours, and removing it would visibly break
+ * legitimate assets — with the escapes neutralized in place.
+ */ function sanitizeCss(css) {
+    let out = css.replace(/@import[^;}]*(;|(?=\}))/gi, '');
+    URL_FUNCTION.lastIndex = 0;
+    out = out.replace(URL_FUNCTION, (match, _quote, target)=>isSafeSvgUrl(String(target)) ? match : 'url(#)');
+    out = out.replace(/javascript:/gi, '');
+    out = out.replace(/expression\(/gi, '(');
+    return {
+        css: out,
+        changed: out !== css
+    };
+}
+function localNameOf(name) {
+    const lower = name.toLowerCase();
+    const colon = lower.lastIndexOf(':');
+    return colon >= 0 ? lower.slice(colon + 1) : lower;
+}
+const TAG_NAME = /^[A-Za-z_][A-Za-z0-9:._-]*/;
+const ATTRIBUTE_NAME = /^[^\s=/>]+/;
+const WHITESPACE = /\s/;
+/** Reads one tag starting at `from` (the `<`), or `null` if it is not one. */ function readTag(source, from) {
+    let i = from + 1;
+    const closing = source[i] === '/';
+    if (closing) i++;
+    const nameMatch = TAG_NAME.exec(source.slice(i));
+    if (!nameMatch) return null;
+    const name = nameMatch[0];
+    i += name.length;
+    const attributes = [];
+    const tag = (selfClosing, end)=>({
+            name,
+            localName: localNameOf(name),
+            closing,
+            selfClosing,
+            attributes,
+            end
+        });
+    while(i < source.length){
+        const spanStart = i;
+        while(i < source.length && WHITESPACE.test(source[i]))i++;
+        if (i >= source.length) break;
+        if (source[i] === '>') return tag(false, i + 1);
+        if (source[i] === '/' && source[i + 1] === '>') return tag(true, i + 2);
+        const attributeMatch = ATTRIBUTE_NAME.exec(source.slice(i));
+        if (!attributeMatch) {
+            i++;
+            continue;
+        }
+        const attributeName = attributeMatch[0];
+        let cursor = i + attributeName.length;
+        let after = cursor;
+        while(after < source.length && WHITESPACE.test(source[after]))after++;
+        let value = '';
+        if (source[after] === '=') {
+            after++;
+            while(after < source.length && WHITESPACE.test(source[after]))after++;
+            const quote = source[after];
+            if (quote === '"' || quote === "'") {
+                const close = source.indexOf(quote, after + 1);
+                value = source.slice(after + 1, close < 0 ? source.length : close);
+                cursor = close < 0 ? source.length : close + 1;
+            } else {
+                const unquoted = /^[^\s>]*/.exec(source.slice(after));
+                value = unquoted[0];
+                cursor = after + unquoted[0].length;
+            }
+        }
+        attributes.push({
+            raw: source.slice(spanStart, cursor),
+            name: attributeName,
+            localName: localNameOf(attributeName),
+            value
+        });
+        i = cursor;
+    }
+    return null;
+}
+/** Consumes an element's raw text content up to and including its close tag. */ function consumeRawText(source, from, name) {
+    const lower = source.toLowerCase();
+    const needle = `</${name.toLowerCase()}`;
+    let index = lower.indexOf(needle, from);
+    while(index >= 0){
+        const next = source[index + needle.length];
+        if (next === undefined || /[\s>/]/.test(next)) break;
+        index = lower.indexOf(needle, index + needle.length);
+    }
+    if (index < 0) return {
+        text: source.slice(from),
+        end: source.length
+    };
+    const gt = source.indexOf('>', index);
+    return {
+        text: source.slice(from, index),
+        end: gt < 0 ? source.length : gt + 1
+    };
+}
+function renderTag(tag, kept) {
+    return `<${tag.name}${kept.map((attribute)=>attribute.raw).join('')}${tag.selfClosing ? '/>' : '>'}`;
+}
+/** Strips the executable and external-reference surface from an SVG source. */ export function sanitizeSvg(source) {
+    const removed = new Set();
+    /** Stack of local names of removed subtrees; non-empty means "dropping". */ const skipping = [];
+    let out = '';
+    let i = 0;
+    const emit = (text)=>{
+        if (!skipping.length) out += text;
+    };
+    while(i < source.length){
+        const lt = source.indexOf('<', i);
+        if (lt < 0) {
+            emit(source.slice(i));
+            break;
+        }
+        emit(source.slice(i, lt));
+        if (source.startsWith('<!--', lt)) {
+            const end = source.indexOf('-->', lt + 4);
+            const stop = end < 0 ? source.length : end + 3;
+            emit(source.slice(lt, stop));
+            i = stop;
+            continue;
+        }
+        if (source.startsWith('<![CDATA[', lt)) {
+            const end = source.indexOf(']]>', lt + 9);
+            const stop = end < 0 ? source.length : end + 3;
+            emit(source.slice(lt, stop));
+            i = stop;
+            continue;
+        }
+        if (source.startsWith('<!', lt)) {
+            const bracket = source.indexOf('[', lt);
+            const close = source.indexOf('>', lt);
+            if (bracket >= 0 && close >= 0 && bracket < close) {
+                // Internal subset: `<!ENTITY payload "<script>…">` expands AFTER
+                // every check below. Drop the whole declaration.
+                const end = source.indexOf(']>', bracket);
+                removed.add('doctype entity subset');
+                i = end < 0 ? source.length : end + 2;
+                continue;
+            }
+            const stop = close < 0 ? source.length : close + 1;
+            emit(source.slice(lt, stop));
+            i = stop;
+            continue;
+        }
+        if (source.startsWith('<?', lt)) {
+            const end = source.indexOf('?>', lt + 2);
+            const stop = end < 0 ? source.length : end + 2;
+            const instruction = source.slice(lt, stop);
+            if (/^<\?xml[\s?]/i.test(instruction)) emit(instruction);
+            else removed.add('processing instruction');
+            i = stop;
+            continue;
+        }
+        const tag = readTag(source, lt);
+        if (!tag) {
+            emit('<');
+            i = lt + 1;
+            continue;
+        }
+        // Raw-text elements are consumed whole, in or out of a removed subtree —
+        // a `<` inside their content is content, not markup.
+        if (!tag.closing && !tag.selfClosing && RAW_TEXT_ELEMENTS.has(tag.localName)) {
+            const raw = consumeRawText(source, tag.end, tag.name);
+            if (skipping.length || REMOVED_ELEMENTS.has(tag.localName)) {
+                if (!skipping.length) removed.add(tag.localName);
+            } else {
+                const kept = tag.attributes.filter((attribute)=>keepAttribute(attribute, removed));
+                const styles = sanitizeCss(raw.text);
+                if (styles.changed) removed.add('external style reference');
+                emit(`${renderTag(tag, kept)}${styles.css}</${tag.name}>`);
+            }
+            i = raw.end;
+            continue;
+        }
+        if (tag.closing) {
+            if (skipping.length) {
+                if (skipping[skipping.length - 1] === tag.localName) skipping.pop();
+            } else {
+                emit(`</${tag.name}>`);
+            }
+            i = tag.end;
+            continue;
+        }
+        if (skipping.length) {
+            // Track same-name nesting so the matching close is the one that ends
+            // the removal, not the first one encountered.
+            if (!tag.selfClosing && skipping[skipping.length - 1] === tag.localName) {
+                skipping.push(tag.localName);
+            }
+            i = tag.end;
+            continue;
+        }
+        if (REMOVED_ELEMENTS.has(tag.localName)) {
+            removed.add(tag.localName);
+            if (!tag.selfClosing) skipping.push(tag.localName);
+            i = tag.end;
+            continue;
+        }
+        if (ANIMATION_ELEMENTS.has(tag.localName)) {
+            var _ref;
+            const target = tag.attributes.find((attribute)=>attribute.localName === 'attributename');
+            const animated = localNameOf(decodeEntities((_ref = target == null ? void 0 : target.value) != null ? _ref : '').trim());
+            if (target && (URL_ATTRIBUTES.has(animated) || animated === 'style')) {
+                removed.add('animated reference');
+                if (!tag.selfClosing) skipping.push(tag.localName);
+                i = tag.end;
+                continue;
+            }
+        }
+        emit(renderTag(tag, tag.attributes.filter((attribute)=>keepAttribute(attribute, removed))));
+        i = tag.end;
+    }
+    return {
+        svg: out,
+        changed: removed.size > 0,
+        removed: [
+            ...removed
+        ].sort()
+    };
+}
+function keepAttribute(attribute, removed) {
+    // No standard SVG attribute begins with `on` except the event handlers.
+    if (/^on/i.test(attribute.localName) || /^on/i.test(attribute.name)) {
+        removed.add('event handler');
+        return false;
+    }
+    if (URL_ATTRIBUTES.has(attribute.localName)) {
+        if (isSafeSvgUrl(attribute.value)) return true;
+        removed.add('external reference');
+        return false;
+    }
+    // `style=`, and the presentation attributes that take a paint server
+    // (`fill`, `stroke`, `filter`, `mask`, `clip-path`, `marker-*`).
+    if (hasUnsafeUrlReference(attribute.value)) {
+        removed.add(attribute.localName === 'style' ? 'external style reference' : 'external reference');
+        return false;
+    }
+    return true;
+}
+/**
+ * Buffer form for the upload routes.
+ *
+ * When nothing was removed the ORIGINAL buffer comes back untouched — not a
+ * re-encode of the parsed source. That is deliberate: it means a legitimate
+ * SVG in some encoding this scanner does not model can never be corrupted by
+ * merely passing through, and it keeps the stored content hash stable.
+ */ export function sanitizeSvgBuffer(buffer) {
+    const result = sanitizeSvg(buffer.toString('utf8'));
+    return {
+        buffer: result.changed ? Buffer.from(result.svg, 'utf8') : buffer,
+        changed: result.changed,
+        removed: result.removed
+    };
+}
+
+//# sourceMappingURL=sanitize-svg.js.map

package/src/lib/app-utils/sanitize-svg.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/sanitize-svg.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * SVG sanitization at the upload chokepoints (AGL-1474).\n *\n * An SVG is a DOCUMENT, not a picture. `image/*` has always been the one open\n * family in the upload allowlist, the stored content type is whatever the\n * client declared, and the CDN serves the bytes `inline` from the console's\n * own origin — so `<script>alert(document.domain)</script>` inside an uploaded\n * logo executes on `app.aglyn.com`, or on the customer's published domain,\n * the moment the asset URL is opened top-level. Every editor could do it.\n *\n * **This file is the remediation, not the containment.** The containment is\n * `mediaCdnContentSecurityPolicy` in `serve-media-cdn.ts`, which stamps a\n * `sandbox` / `script-src 'none'` policy on the serve response and therefore\n * covers every asset already in the bucket without touching a byte. This\n * sanitizer is what keeps the STORED artifact clean — so the platform is not\n * one header regression away from the same hole, and so an SVG handed to a\n * customer through any other channel is not carrying a payload.\n *\n * Neither layer touches `<img src>`: a browser loading an SVG as an image\n * never runs its script and never applies the response's CSP. The vector is\n * top-level navigation (and `<object>`/`<iframe>` embedding), and that is\n * exactly what both layers close.\n *\n * ## Why a scanner rather than a DOM\n *\n * `dompurify` is already a dependency, but only in `apps/docs` (mermaid) and\n * only in a browser. Server-side it needs `jsdom`, which is a devDependency —\n * promoting a full HTML engine into every serverless upload function to strip\n * a handful of constructs is the wrong trade. So: a small XML-shaped scanner\n * that keeps kept attributes VERBATIM (their raw source span, entities and\n * all) and drops the rest. Nothing is re-encoded, so nothing can be mangled\n * by a re-encode.\n *\n * ## What it removes\n *\n * - `<script>` and its content, at any nesting depth and under any namespace\n *   prefix (`<html:script>` has local name `script`).\n * - `<foreignObject>` and its subtree — the documented HTML escape hatch.\n * - `<iframe>`, `<frame>`, `<frameset>`, `<embed>`, `<object>`, `<handler>`,\n *   `<listener>`, `<animation>`, `<audio>`, `<video>` and their subtrees.\n * - Every `on*` attribute (`onload`, `onclick`, `onbegin`, …).\n * - Every URL-bearing attribute (`href`, `xlink:href`, `src`, `data`,\n *   `action`, `formaction`, `poster`) whose value is not a same-document\n *   `#fragment` or a raster `data:image/…` — which covers `javascript:`,\n *   `data:text/html`, nested `data:image/svg+xml`, and plain external refs.\n * - Animation elements (`<set>`, `<animate>`, …) that target a URL attribute,\n *   because `<set attributeName=\"href\" to=\"javascript:…\">` reintroduces one.\n * - `url(…)` references to anywhere but a `#fragment` inside `style=`,\n *   presentation attributes (`fill`, `filter`, `mask`, `clip-path`, …) and\n *   `<style>` text, plus `@import` and `expression(`.\n * - `<?xml-stylesheet?>` and every other processing instruction — an external\n *   XSLT is a script engine.\n * - A DOCTYPE with an internal subset, whose `<!ENTITY>` definitions expand\n *   into markup after every check here has run. A plain external-id DOCTYPE\n *   is inert and kept, because Illustrator has emitted one for twenty years\n *   and rewriting those files buys nothing.\n *\n * Scheme detection decodes numeric and named entities first and ignores\n * control characters and whitespace, so `&#106;avascript:` and `java&#9;script:`\n * resolve the same way the browser resolves them.\n */\n\n/** Elements dropped together with everything inside them. */\nconst REMOVED_ELEMENTS = new Set([\n  'script',\n  'foreignobject',\n  'iframe',\n  'frame',\n  'frameset',\n  'embed',\n  'object',\n  'handler',\n  'listener',\n  'animation',\n  'audio',\n  'video',\n])\n\n/**\n * Elements whose content is raw text rather than markup. Consumed to their\n * close tag verbatim, so a `<` inside CSS or script source can never be\n * mistaken for a tag and desynchronize the scan.\n */\nconst RAW_TEXT_ELEMENTS = new Set(['script', 'style'])\n\n/** SMIL animation elements — safe unless they animate a URL attribute. */\nconst ANIMATION_ELEMENTS = new Set([\n  'set',\n  'animate',\n  'animatetransform',\n  'animatemotion',\n  'animatecolor',\n])\n\n/** Attributes whose whole value is a URL. */\nconst URL_ATTRIBUTES = new Set([\n  'href',\n  'src',\n  'data',\n  'action',\n  'formaction',\n  'poster',\n])\n\nconst ENTITIES: Record<string, string> = {\n  amp: '&',\n  lt: '<',\n  gt: '>',\n  quot: '\"',\n  apos: \"'\",\n  colon: ':',\n  tab: '\\t',\n  newline: '\\n',\n  sol: '/',\n}\n\n/** What a sanitization pass took out, for the asset's audit trail. */\nexport interface SvgSanitizeResult {\n  /** The sanitized document. Only meaningful when `changed`. */\n  svg: string\n  /** Whether anything was removed at all. */\n  changed: boolean\n  /** Distinct reasons, e.g. `['script', 'event handler']`. */\n  removed: string[]\n}\n\n/** The one content type that is a document wearing an `image/` label. */\nexport function isSvgUploadType(contentType: string): boolean {\n  const type = String(contentType ?? '')\n    .split(';')[0]\n    .trim()\n    .toLowerCase()\n  return type === 'image/svg+xml' || type === 'image/svg'\n}\n\nfunction decodeEntities(value: string): string {\n  let out = String(value ?? '')\n  // Bounded, because `&amp;#106;` is a decode away from `&#106;` and an\n  // attacker gets to pick the depth. Three passes is past anything a browser\n  // will itself resolve.\n  for (let pass = 0; pass < 3; pass++) {\n    const next = out\n      .replace(/&#x([0-9a-f]+);?/gi, (match, hex) => codePoint(parseInt(hex, 16), match))\n      .replace(/&#(\\d+);?/g, (match, decimal) => codePoint(parseInt(decimal, 10), match))\n      .replace(/&([a-z]+);/gi, (match, name) => ENTITIES[String(name).toLowerCase()] ?? match)\n    if (next === out) break\n    out = next\n  }\n  return out\n}\n\nfunction codePoint(value: number, fallback: string): string {\n  if (!Number.isFinite(value) || value < 0 || value > 0x10ffff) return fallback\n  try {\n    return String.fromCodePoint(value)\n  } catch {\n    return fallback\n  }\n}\n\n/**\n * Drops every character a browser ignores while resolving a URL's scheme —\n * control characters and whitespace — so `java\\tscript:` and a leading NUL\n * both collapse to `javascript:` before the check below sees them.\n *\n * Written as a code-point filter rather than a character class because a\n * control-character range in a regex is exactly what `no-control-regex`\n * exists to flag, and silencing that rule here would be the wrong signal.\n */\nfunction stripInsignificant(value: string): string {\n  let out = ''\n  for (const character of value) {\n    const code = character.codePointAt(0) ?? 0\n    if (code > 0x20 && code !== 0x7f) out += character\n  }\n  return out\n}\n\n/**\n * A URL value the sanitizer will keep.\n *\n * Same-document fragments (`#gradient-1`, what `<use>` and `fill=\"url(#…)\"`\n * actually need) and raster data URIs. Everything else goes, including plain\n * relative and `https:` references: AGL-1474 asks for external references to\n * be stripped, and inside an `<img>`-embedded SVG — the way logos are used\n * across this product — a browser refuses to load them anyway.\n *\n * `data:image/svg+xml` is NOT safe: it is another document, and nesting is how\n * a sanitizer gets walked past.\n */\nexport function isSafeSvgUrl(raw: string): boolean {\n  const value = stripInsignificant(decodeEntities(raw))\n  if (!value) return true\n  if (value.startsWith('#')) return true\n  const lower = value.toLowerCase()\n  if (lower.startsWith('data:image/') && !lower.startsWith('data:image/svg')) {\n    return true\n  }\n  return false\n}\n\nconst URL_FUNCTION = /url\\(\\s*(['\"]?)([^)'\"]*)\\1\\s*\\)/gi\n\n/** `url(…)`, `javascript:` or `expression(` pointing anywhere but this document. */\nfunction hasUnsafeUrlReference(value: string): boolean {\n  const decoded = decodeEntities(value)\n  const tight = stripInsignificant(decoded)\n  if (/javascript:/i.test(tight)) return true\n  if (/expression\\(/i.test(tight)) return true\n  URL_FUNCTION.lastIndex = 0\n  let match: RegExpExecArray | null\n  while ((match = URL_FUNCTION.exec(decoded)) !== null) {\n    if (!isSafeSvgUrl(match[2])) return true\n  }\n  return false\n}\n\n/**\n * `<style>` text. Kept rather than dropped — class-based styling is how every\n * exported SVG carries its colours, and removing it would visibly break\n * legitimate assets — with the escapes neutralized in place.\n */\nfunction sanitizeCss(css: string): { css: string; changed: boolean } {\n  let out = css.replace(/@import[^;}]*(;|(?=\\}))/gi, '')\n  URL_FUNCTION.lastIndex = 0\n  out = out.replace(URL_FUNCTION, (match, _quote, target) =>\n    isSafeSvgUrl(String(target)) ? match : 'url(#)',\n  )\n  out = out.replace(/javascript:/gi, '')\n  out = out.replace(/expression\\(/gi, '(')\n  return { css: out, changed: out !== css }\n}\n\ninterface ParsedAttribute {\n  /** Raw source INCLUDING the leading whitespace run, so kept attributes\n   *  round-trip byte for byte. */\n  raw: string\n  name: string\n  /** Lower-cased, namespace prefix removed: `xlink:href` → `href`. */\n  localName: string\n  value: string\n}\n\ninterface ParsedTag {\n  name: string\n  localName: string\n  closing: boolean\n  selfClosing: boolean\n  attributes: ParsedAttribute[]\n  /** Index just past the tag's `>`. */\n  end: number\n}\n\nfunction localNameOf(name: string): string {\n  const lower = name.toLowerCase()\n  const colon = lower.lastIndexOf(':')\n  return colon >= 0 ? lower.slice(colon + 1) : lower\n}\n\nconst TAG_NAME = /^[A-Za-z_][A-Za-z0-9:._-]*/\nconst ATTRIBUTE_NAME = /^[^\\s=/>]+/\nconst WHITESPACE = /\\s/\n\n/** Reads one tag starting at `from` (the `<`), or `null` if it is not one. */\nfunction readTag(source: string, from: number): ParsedTag | null {\n  let i = from + 1\n  const closing = source[i] === '/'\n  if (closing) i++\n  const nameMatch = TAG_NAME.exec(source.slice(i))\n  if (!nameMatch) return null\n  const name = nameMatch[0]\n  i += name.length\n  const attributes: ParsedAttribute[] = []\n  const tag = (selfClosing: boolean, end: number): ParsedTag => ({\n    name,\n    localName: localNameOf(name),\n    closing,\n    selfClosing,\n    attributes,\n    end,\n  })\n  while (i < source.length) {\n    const spanStart = i\n    while (i < source.length && WHITESPACE.test(source[i])) i++\n    if (i >= source.length) break\n    if (source[i] === '>') return tag(false, i + 1)\n    if (source[i] === '/' && source[i + 1] === '>') return tag(true, i + 2)\n    const attributeMatch = ATTRIBUTE_NAME.exec(source.slice(i))\n    if (!attributeMatch) {\n      i++\n      continue\n    }\n    const attributeName = attributeMatch[0]\n    let cursor = i + attributeName.length\n    let after = cursor\n    while (after < source.length && WHITESPACE.test(source[after])) after++\n    let value = ''\n    if (source[after] === '=') {\n      after++\n      while (after < source.length && WHITESPACE.test(source[after])) after++\n      const quote = source[after]\n      if (quote === '\"' || quote === \"'\") {\n        const close = source.indexOf(quote, after + 1)\n        value = source.slice(after + 1, close < 0 ? source.length : close)\n        cursor = close < 0 ? source.length : close + 1\n      } else {\n        const unquoted = /^[^\\s>]*/.exec(source.slice(after)) as RegExpExecArray\n        value = unquoted[0]\n        cursor = after + unquoted[0].length\n      }\n    }\n    attributes.push({\n      raw: source.slice(spanStart, cursor),\n      name: attributeName,\n      localName: localNameOf(attributeName),\n      value,\n    })\n    i = cursor\n  }\n  return null\n}\n\n/** Consumes an element's raw text content up to and including its close tag. */\nfunction consumeRawText(\n  source: string,\n  from: number,\n  name: string,\n): { text: string; end: number } {\n  const lower = source.toLowerCase()\n  const needle = `</${name.toLowerCase()}`\n  let index = lower.indexOf(needle, from)\n  while (index >= 0) {\n    const next = source[index + needle.length]\n    if (next === undefined || /[\\s>/]/.test(next)) break\n    index = lower.indexOf(needle, index + needle.length)\n  }\n  if (index < 0) return { text: source.slice(from), end: source.length }\n  const gt = source.indexOf('>', index)\n  return {\n    text: source.slice(from, index),\n    end: gt < 0 ? source.length : gt + 1,\n  }\n}\n\nfunction renderTag(tag: ParsedTag, kept: ParsedAttribute[]): string {\n  return `<${tag.name}${kept.map((attribute) => attribute.raw).join('')}${\n    tag.selfClosing ? '/>' : '>'\n  }`\n}\n\n/** Strips the executable and external-reference surface from an SVG source. */\nexport function sanitizeSvg(source: string): SvgSanitizeResult {\n  const removed = new Set<string>()\n  /** Stack of local names of removed subtrees; non-empty means \"dropping\". */\n  const skipping: string[] = []\n  let out = ''\n  let i = 0\n  const emit = (text: string) => {\n    if (!skipping.length) out += text\n  }\n\n  while (i < source.length) {\n    const lt = source.indexOf('<', i)\n    if (lt < 0) {\n      emit(source.slice(i))\n      break\n    }\n    emit(source.slice(i, lt))\n\n    if (source.startsWith('<!--', lt)) {\n      const end = source.indexOf('-->', lt + 4)\n      const stop = end < 0 ? source.length : end + 3\n      emit(source.slice(lt, stop))\n      i = stop\n      continue\n    }\n    if (source.startsWith('<![CDATA[', lt)) {\n      const end = source.indexOf(']]>', lt + 9)\n      const stop = end < 0 ? source.length : end + 3\n      emit(source.slice(lt, stop))\n      i = stop\n      continue\n    }\n    if (source.startsWith('<!', lt)) {\n      const bracket = source.indexOf('[', lt)\n      const close = source.indexOf('>', lt)\n      if (bracket >= 0 && close >= 0 && bracket < close) {\n        // Internal subset: `<!ENTITY payload \"<script>…\">` expands AFTER\n        // every check below. Drop the whole declaration.\n        const end = source.indexOf(']>', bracket)\n        removed.add('doctype entity subset')\n        i = end < 0 ? source.length : end + 2\n        continue\n      }\n      const stop = close < 0 ? source.length : close + 1\n      emit(source.slice(lt, stop))\n      i = stop\n      continue\n    }\n    if (source.startsWith('<?', lt)) {\n      const end = source.indexOf('?>', lt + 2)\n      const stop = end < 0 ? source.length : end + 2\n      const instruction = source.slice(lt, stop)\n      if (/^<\\?xml[\\s?]/i.test(instruction)) emit(instruction)\n      else removed.add('processing instruction')\n      i = stop\n      continue\n    }\n\n    const tag = readTag(source, lt)\n    if (!tag) {\n      emit('<')\n      i = lt + 1\n      continue\n    }\n\n    // Raw-text elements are consumed whole, in or out of a removed subtree —\n    // a `<` inside their content is content, not markup.\n    if (!tag.closing && !tag.selfClosing && RAW_TEXT_ELEMENTS.has(tag.localName)) {\n      const raw = consumeRawText(source, tag.end, tag.name)\n      if (skipping.length || REMOVED_ELEMENTS.has(tag.localName)) {\n        if (!skipping.length) removed.add(tag.localName)\n      } else {\n        const kept = tag.attributes.filter((attribute) =>\n          keepAttribute(attribute, removed),\n        )\n        const styles = sanitizeCss(raw.text)\n        if (styles.changed) removed.add('external style reference')\n        emit(`${renderTag(tag, kept)}${styles.css}</${tag.name}>`)\n      }\n      i = raw.end\n      continue\n    }\n\n    if (tag.closing) {\n      if (skipping.length) {\n        if (skipping[skipping.length - 1] === tag.localName) skipping.pop()\n      } else {\n        emit(`</${tag.name}>`)\n      }\n      i = tag.end\n      continue\n    }\n\n    if (skipping.length) {\n      // Track same-name nesting so the matching close is the one that ends\n      // the removal, not the first one encountered.\n      if (!tag.selfClosing && skipping[skipping.length - 1] === tag.localName) {\n        skipping.push(tag.localName)\n      }\n      i = tag.end\n      continue\n    }\n\n    if (REMOVED_ELEMENTS.has(tag.localName)) {\n      removed.add(tag.localName)\n      if (!tag.selfClosing) skipping.push(tag.localName)\n      i = tag.end\n      continue\n    }\n\n    if (ANIMATION_ELEMENTS.has(tag.localName)) {\n      const target = tag.attributes.find(\n        (attribute) => attribute.localName === 'attributename',\n      )\n      const animated = localNameOf(decodeEntities(target?.value ?? '').trim())\n      if (target && (URL_ATTRIBUTES.has(animated) || animated === 'style')) {\n        removed.add('animated reference')\n        if (!tag.selfClosing) skipping.push(tag.localName)\n        i = tag.end\n        continue\n      }\n    }\n\n    emit(\n      renderTag(\n        tag,\n        tag.attributes.filter((attribute) => keepAttribute(attribute, removed)),\n      ),\n    )\n    i = tag.end\n  }\n\n  return { svg: out, changed: removed.size > 0, removed: [...removed].sort() }\n}\n\nfunction keepAttribute(\n  attribute: ParsedAttribute,\n  removed: Set<string>,\n): boolean {\n  // No standard SVG attribute begins with `on` except the event handlers.\n  if (/^on/i.test(attribute.localName) || /^on/i.test(attribute.name)) {\n    removed.add('event handler')\n    return false\n  }\n  if (URL_ATTRIBUTES.has(attribute.localName)) {\n    if (isSafeSvgUrl(attribute.value)) return true\n    removed.add('external reference')\n    return false\n  }\n  // `style=`, and the presentation attributes that take a paint server\n  // (`fill`, `stroke`, `filter`, `mask`, `clip-path`, `marker-*`).\n  if (hasUnsafeUrlReference(attribute.value)) {\n    removed.add(\n      attribute.localName === 'style'\n        ? 'external style reference'\n        : 'external reference',\n    )\n    return false\n  }\n  return true\n}\n\n/**\n * Buffer form for the upload routes.\n *\n * When nothing was removed the ORIGINAL buffer comes back untouched — not a\n * re-encode of the parsed source. That is deliberate: it means a legitimate\n * SVG in some encoding this scanner does not model can never be corrupted by\n * merely passing through, and it keeps the stored content hash stable.\n */\nexport function sanitizeSvgBuffer(buffer: Buffer): {\n  buffer: Buffer\n  changed: boolean\n  removed: string[]\n} {\n  const result = sanitizeSvg(buffer.toString('utf8'))\n  return {\n    buffer: result.changed ? Buffer.from(result.svg, 'utf8') : buffer,\n    changed: result.changed,\n    removed: result.removed,\n  }\n}\n"],"names":["REMOVED_ELEMENTS","Set","RAW_TEXT_ELEMENTS","ANIMATION_ELEMENTS","URL_ATTRIBUTES","ENTITIES","amp","lt","gt","quot","apos","colon","tab","newline","sol","isSvgUploadType","contentType","type","String","split","trim","toLowerCase","decodeEntities","value","out","pass","next","replace","match","hex","codePoint","parseInt","decimal","name","fallback","Number","isFinite","fromCodePoint","stripInsignificant","character","code","codePointAt","isSafeSvgUrl","raw","startsWith","lower","URL_FUNCTION","hasUnsafeUrlReference","decoded","tight","test","lastIndex","exec","sanitizeCss","css","_quote","target","changed","localNameOf","lastIndexOf","slice","TAG_NAME","ATTRIBUTE_NAME","WHITESPACE","readTag","source","from","i","closing","nameMatch","length","attributes","tag","selfClosing","end","localName","spanStart","attributeMatch","attributeName","cursor","after","quote","close","indexOf","unquoted","push","consumeRawText","needle","index","undefined","text","renderTag","kept","map","attribute","join","sanitizeSvg","removed","skipping","emit","stop","bracket","add","instruction","has","filter","keepAttribute","styles","pop","find","animated","svg","size","sort","sanitizeSvgBuffer","buffer","result","toString","Buffer"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4DC,GAED,2DAA2D,GAC3D,MAAMA,mBAAmB,IAAIC,IAAI;IAC/B;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD;AAED;;;;CAIC,GACD,MAAMC,oBAAoB,IAAID,IAAI;IAAC;IAAU;CAAQ;AAErD,wEAAwE,GACxE,MAAME,qBAAqB,IAAIF,IAAI;IACjC;IACA;IACA;IACA;IACA;CACD;AAED,2CAA2C,GAC3C,MAAMG,iBAAiB,IAAIH,IAAI;IAC7B;IACA;IACA;IACA;IACA;IACA;CACD;AAED,MAAMI,WAAmC;IACvCC,KAAK;IACLC,IAAI;IACJC,IAAI;IACJC,MAAM;IACNC,MAAM;IACNC,OAAO;IACPC,KAAK;IACLC,SAAS;IACTC,KAAK;AACP;AAYA,uEAAuE,GACvE,OAAO,SAASC,gBAAgBC,WAAmB;IACjD,MAAMC,OAAOC,OAAOF,sBAAAA,cAAe,IAChCG,KAAK,CAAC,IAAI,CAAC,EAAE,CACbC,IAAI,GACJC,WAAW;IACd,OAAOJ,SAAS,mBAAmBA,SAAS;AAC9C;AAEA,SAASK,eAAeC,KAAa;IACnC,IAAIC,MAAMN,OAAOK,gBAAAA,QAAS;IAC1B,sEAAsE;IACtE,2EAA2E;IAC3E,uBAAuB;IACvB,IAAK,IAAIE,OAAO,GAAGA,OAAO,GAAGA,OAAQ;QACnC,MAAMC,OAAOF,IACVG,OAAO,CAAC,sBAAsB,CAACC,OAAOC,MAAQC,UAAUC,SAASF,KAAK,KAAKD,QAC3ED,OAAO,CAAC,cAAc,CAACC,OAAOI,UAAYF,UAAUC,SAASC,SAAS,KAAKJ,QAC3ED,OAAO,CAAC,gBAAgB,CAACC,OAAOK;gBAAS5B;oBAAAA,+BAAAA,QAAQ,CAACa,OAAOe,MAAMZ,WAAW,GAAG,YAApChB,+BAAwCuB;;QACpF,IAAIF,SAASF,KAAK;QAClBA,MAAME;IACR;IACA,OAAOF;AACT;AAEA,SAASM,UAAUP,KAAa,EAAEW,QAAgB;IAChD,IAAI,CAACC,OAAOC,QAAQ,CAACb,UAAUA,QAAQ,KAAKA,QAAQ,UAAU,OAAOW;IACrE,IAAI;QACF,OAAOhB,OAAOmB,aAAa,CAACd;IAC9B,EAAE,eAAM;QACN,OAAOW;IACT;AACF;AAEA;;;;;;;;CAQC,GACD,SAASI,mBAAmBf,KAAa;IACvC,IAAIC,MAAM;IACV,KAAK,MAAMe,aAAahB,MAAO;YAChBgB;QAAb,MAAMC,QAAOD,yBAAAA,UAAUE,WAAW,CAAC,cAAtBF,yBAA4B;QACzC,IAAIC,OAAO,QAAQA,SAAS,MAAMhB,OAAOe;IAC3C;IACA,OAAOf;AACT;AAEA;;;;;;;;;;;CAWC,GACD,OAAO,SAASkB,aAAaC,GAAW;IACtC,MAAMpB,QAAQe,mBAAmBhB,eAAeqB;IAChD,IAAI,CAACpB,OAAO,OAAO;IACnB,IAAIA,MAAMqB,UAAU,CAAC,MAAM,OAAO;IAClC,MAAMC,QAAQtB,MAAMF,WAAW;IAC/B,IAAIwB,MAAMD,UAAU,CAAC,kBAAkB,CAACC,MAAMD,UAAU,CAAC,mBAAmB;QAC1E,OAAO;IACT;IACA,OAAO;AACT;AAEA,MAAME,eAAe;AAErB,kFAAkF,GAClF,SAASC,sBAAsBxB,KAAa;IAC1C,MAAMyB,UAAU1B,eAAeC;IAC/B,MAAM0B,QAAQX,mBAAmBU;IACjC,IAAI,eAAeE,IAAI,CAACD,QAAQ,OAAO;IACvC,IAAI,gBAAgBC,IAAI,CAACD,QAAQ,OAAO;IACxCH,aAAaK,SAAS,GAAG;IACzB,IAAIvB;IACJ,MAAO,AAACA,CAAAA,QAAQkB,aAAaM,IAAI,CAACJ,QAAO,MAAO,KAAM;QACpD,IAAI,CAACN,aAAad,KAAK,CAAC,EAAE,GAAG,OAAO;IACtC;IACA,OAAO;AACT;AAEA;;;;CAIC,GACD,SAASyB,YAAYC,GAAW;IAC9B,IAAI9B,MAAM8B,IAAI3B,OAAO,CAAC,6BAA6B;IACnDmB,aAAaK,SAAS,GAAG;IACzB3B,MAAMA,IAAIG,OAAO,CAACmB,cAAc,CAAClB,OAAO2B,QAAQC,SAC9Cd,aAAaxB,OAAOsC,WAAW5B,QAAQ;IAEzCJ,MAAMA,IAAIG,OAAO,CAAC,iBAAiB;IACnCH,MAAMA,IAAIG,OAAO,CAAC,kBAAkB;IACpC,OAAO;QAAE2B,KAAK9B;QAAKiC,SAASjC,QAAQ8B;IAAI;AAC1C;AAsBA,SAASI,YAAYzB,IAAY;IAC/B,MAAMY,QAAQZ,KAAKZ,WAAW;IAC9B,MAAMV,QAAQkC,MAAMc,WAAW,CAAC;IAChC,OAAOhD,SAAS,IAAIkC,MAAMe,KAAK,CAACjD,QAAQ,KAAKkC;AAC/C;AAEA,MAAMgB,WAAW;AACjB,MAAMC,iBAAiB;AACvB,MAAMC,aAAa;AAEnB,4EAA4E,GAC5E,SAASC,QAAQC,MAAc,EAAEC,IAAY;IAC3C,IAAIC,IAAID,OAAO;IACf,MAAME,UAAUH,MAAM,CAACE,EAAE,KAAK;IAC9B,IAAIC,SAASD;IACb,MAAME,YAAYR,SAAST,IAAI,CAACa,OAAOL,KAAK,CAACO;IAC7C,IAAI,CAACE,WAAW,OAAO;IACvB,MAAMpC,OAAOoC,SAAS,CAAC,EAAE;IACzBF,KAAKlC,KAAKqC,MAAM;IAChB,MAAMC,aAAgC,EAAE;IACxC,MAAMC,MAAM,CAACC,aAAsBC,MAA4B,CAAA;YAC7DzC;YACA0C,WAAWjB,YAAYzB;YACvBmC;YACAK;YACAF;YACAG;QACF,CAAA;IACA,MAAOP,IAAIF,OAAOK,MAAM,CAAE;QACxB,MAAMM,YAAYT;QAClB,MAAOA,IAAIF,OAAOK,MAAM,IAAIP,WAAWb,IAAI,CAACe,MAAM,CAACE,EAAE,EAAGA;QACxD,IAAIA,KAAKF,OAAOK,MAAM,EAAE;QACxB,IAAIL,MAAM,CAACE,EAAE,KAAK,KAAK,OAAOK,IAAI,OAAOL,IAAI;QAC7C,IAAIF,MAAM,CAACE,EAAE,KAAK,OAAOF,MAAM,CAACE,IAAI,EAAE,KAAK,KAAK,OAAOK,IAAI,MAAML,IAAI;QACrE,MAAMU,iBAAiBf,eAAeV,IAAI,CAACa,OAAOL,KAAK,CAACO;QACxD,IAAI,CAACU,gBAAgB;YACnBV;YACA;QACF;QACA,MAAMW,gBAAgBD,cAAc,CAAC,EAAE;QACvC,IAAIE,SAASZ,IAAIW,cAAcR,MAAM;QACrC,IAAIU,QAAQD;QACZ,MAAOC,QAAQf,OAAOK,MAAM,IAAIP,WAAWb,IAAI,CAACe,MAAM,CAACe,MAAM,EAAGA;QAChE,IAAIzD,QAAQ;QACZ,IAAI0C,MAAM,CAACe,MAAM,KAAK,KAAK;YACzBA;YACA,MAAOA,QAAQf,OAAOK,MAAM,IAAIP,WAAWb,IAAI,CAACe,MAAM,CAACe,MAAM,EAAGA;YAChE,MAAMC,QAAQhB,MAAM,CAACe,MAAM;YAC3B,IAAIC,UAAU,OAAOA,UAAU,KAAK;gBAClC,MAAMC,QAAQjB,OAAOkB,OAAO,CAACF,OAAOD,QAAQ;gBAC5CzD,QAAQ0C,OAAOL,KAAK,CAACoB,QAAQ,GAAGE,QAAQ,IAAIjB,OAAOK,MAAM,GAAGY;gBAC5DH,SAASG,QAAQ,IAAIjB,OAAOK,MAAM,GAAGY,QAAQ;YAC/C,OAAO;gBACL,MAAME,WAAW,WAAWhC,IAAI,CAACa,OAAOL,KAAK,CAACoB;gBAC9CzD,QAAQ6D,QAAQ,CAAC,EAAE;gBACnBL,SAASC,QAAQI,QAAQ,CAAC,EAAE,CAACd,MAAM;YACrC;QACF;QACAC,WAAWc,IAAI,CAAC;YACd1C,KAAKsB,OAAOL,KAAK,CAACgB,WAAWG;YAC7B9C,MAAM6C;YACNH,WAAWjB,YAAYoB;YACvBvD;QACF;QACA4C,IAAIY;IACN;IACA,OAAO;AACT;AAEA,8EAA8E,GAC9E,SAASO,eACPrB,MAAc,EACdC,IAAY,EACZjC,IAAY;IAEZ,MAAMY,QAAQoB,OAAO5C,WAAW;IAChC,MAAMkE,SAAS,CAAC,EAAE,EAAEtD,KAAKZ,WAAW,IAAI;IACxC,IAAImE,QAAQ3C,MAAMsC,OAAO,CAACI,QAAQrB;IAClC,MAAOsB,SAAS,EAAG;QACjB,MAAM9D,OAAOuC,MAAM,CAACuB,QAAQD,OAAOjB,MAAM,CAAC;QAC1C,IAAI5C,SAAS+D,aAAa,SAASvC,IAAI,CAACxB,OAAO;QAC/C8D,QAAQ3C,MAAMsC,OAAO,CAACI,QAAQC,QAAQD,OAAOjB,MAAM;IACrD;IACA,IAAIkB,QAAQ,GAAG,OAAO;QAAEE,MAAMzB,OAAOL,KAAK,CAACM;QAAOQ,KAAKT,OAAOK,MAAM;IAAC;IACrE,MAAM9D,KAAKyD,OAAOkB,OAAO,CAAC,KAAKK;IAC/B,OAAO;QACLE,MAAMzB,OAAOL,KAAK,CAACM,MAAMsB;QACzBd,KAAKlE,KAAK,IAAIyD,OAAOK,MAAM,GAAG9D,KAAK;IACrC;AACF;AAEA,SAASmF,UAAUnB,GAAc,EAAEoB,IAAuB;IACxD,OAAO,CAAC,CAAC,EAAEpB,IAAIvC,IAAI,GAAG2D,KAAKC,GAAG,CAAC,CAACC,YAAcA,UAAUnD,GAAG,EAAEoD,IAAI,CAAC,MAChEvB,IAAIC,WAAW,GAAG,OAAO,KACzB;AACJ;AAEA,6EAA6E,GAC7E,OAAO,SAASuB,YAAY/B,MAAc;IACxC,MAAMgC,UAAU,IAAIhG;IACpB,0EAA0E,GAC1E,MAAMiG,WAAqB,EAAE;IAC7B,IAAI1E,MAAM;IACV,IAAI2C,IAAI;IACR,MAAMgC,OAAO,CAACT;QACZ,IAAI,CAACQ,SAAS5B,MAAM,EAAE9C,OAAOkE;IAC/B;IAEA,MAAOvB,IAAIF,OAAOK,MAAM,CAAE;QACxB,MAAM/D,KAAK0D,OAAOkB,OAAO,CAAC,KAAKhB;QAC/B,IAAI5D,KAAK,GAAG;YACV4F,KAAKlC,OAAOL,KAAK,CAACO;YAClB;QACF;QACAgC,KAAKlC,OAAOL,KAAK,CAACO,GAAG5D;QAErB,IAAI0D,OAAOrB,UAAU,CAAC,QAAQrC,KAAK;YACjC,MAAMmE,MAAMT,OAAOkB,OAAO,CAAC,OAAO5E,KAAK;YACvC,MAAM6F,OAAO1B,MAAM,IAAIT,OAAOK,MAAM,GAAGI,MAAM;YAC7CyB,KAAKlC,OAAOL,KAAK,CAACrD,IAAI6F;YACtBjC,IAAIiC;YACJ;QACF;QACA,IAAInC,OAAOrB,UAAU,CAAC,aAAarC,KAAK;YACtC,MAAMmE,MAAMT,OAAOkB,OAAO,CAAC,OAAO5E,KAAK;YACvC,MAAM6F,OAAO1B,MAAM,IAAIT,OAAOK,MAAM,GAAGI,MAAM;YAC7CyB,KAAKlC,OAAOL,KAAK,CAACrD,IAAI6F;YACtBjC,IAAIiC;YACJ;QACF;QACA,IAAInC,OAAOrB,UAAU,CAAC,MAAMrC,KAAK;YAC/B,MAAM8F,UAAUpC,OAAOkB,OAAO,CAAC,KAAK5E;YACpC,MAAM2E,QAAQjB,OAAOkB,OAAO,CAAC,KAAK5E;YAClC,IAAI8F,WAAW,KAAKnB,SAAS,KAAKmB,UAAUnB,OAAO;gBACjD,iEAAiE;gBACjE,iDAAiD;gBACjD,MAAMR,MAAMT,OAAOkB,OAAO,CAAC,MAAMkB;gBACjCJ,QAAQK,GAAG,CAAC;gBACZnC,IAAIO,MAAM,IAAIT,OAAOK,MAAM,GAAGI,MAAM;gBACpC;YACF;YACA,MAAM0B,OAAOlB,QAAQ,IAAIjB,OAAOK,MAAM,GAAGY,QAAQ;YACjDiB,KAAKlC,OAAOL,KAAK,CAACrD,IAAI6F;YACtBjC,IAAIiC;YACJ;QACF;QACA,IAAInC,OAAOrB,UAAU,CAAC,MAAMrC,KAAK;YAC/B,MAAMmE,MAAMT,OAAOkB,OAAO,CAAC,MAAM5E,KAAK;YACtC,MAAM6F,OAAO1B,MAAM,IAAIT,OAAOK,MAAM,GAAGI,MAAM;YAC7C,MAAM6B,cAActC,OAAOL,KAAK,CAACrD,IAAI6F;YACrC,IAAI,gBAAgBlD,IAAI,CAACqD,cAAcJ,KAAKI;iBACvCN,QAAQK,GAAG,CAAC;YACjBnC,IAAIiC;YACJ;QACF;QAEA,MAAM5B,MAAMR,QAAQC,QAAQ1D;QAC5B,IAAI,CAACiE,KAAK;YACR2B,KAAK;YACLhC,IAAI5D,KAAK;YACT;QACF;QAEA,yEAAyE;QACzE,qDAAqD;QACrD,IAAI,CAACiE,IAAIJ,OAAO,IAAI,CAACI,IAAIC,WAAW,IAAIvE,kBAAkBsG,GAAG,CAAChC,IAAIG,SAAS,GAAG;YAC5E,MAAMhC,MAAM2C,eAAerB,QAAQO,IAAIE,GAAG,EAAEF,IAAIvC,IAAI;YACpD,IAAIiE,SAAS5B,MAAM,IAAItE,iBAAiBwG,GAAG,CAAChC,IAAIG,SAAS,GAAG;gBAC1D,IAAI,CAACuB,SAAS5B,MAAM,EAAE2B,QAAQK,GAAG,CAAC9B,IAAIG,SAAS;YACjD,OAAO;gBACL,MAAMiB,OAAOpB,IAAID,UAAU,CAACkC,MAAM,CAAC,CAACX,YAClCY,cAAcZ,WAAWG;gBAE3B,MAAMU,SAAStD,YAAYV,IAAI+C,IAAI;gBACnC,IAAIiB,OAAOlD,OAAO,EAAEwC,QAAQK,GAAG,CAAC;gBAChCH,KAAK,GAAGR,UAAUnB,KAAKoB,QAAQe,OAAOrD,GAAG,CAAC,EAAE,EAAEkB,IAAIvC,IAAI,CAAC,CAAC,CAAC;YAC3D;YACAkC,IAAIxB,IAAI+B,GAAG;YACX;QACF;QAEA,IAAIF,IAAIJ,OAAO,EAAE;YACf,IAAI8B,SAAS5B,MAAM,EAAE;gBACnB,IAAI4B,QAAQ,CAACA,SAAS5B,MAAM,GAAG,EAAE,KAAKE,IAAIG,SAAS,EAAEuB,SAASU,GAAG;YACnE,OAAO;gBACLT,KAAK,CAAC,EAAE,EAAE3B,IAAIvC,IAAI,CAAC,CAAC,CAAC;YACvB;YACAkC,IAAIK,IAAIE,GAAG;YACX;QACF;QAEA,IAAIwB,SAAS5B,MAAM,EAAE;YACnB,qEAAqE;YACrE,8CAA8C;YAC9C,IAAI,CAACE,IAAIC,WAAW,IAAIyB,QAAQ,CAACA,SAAS5B,MAAM,GAAG,EAAE,KAAKE,IAAIG,SAAS,EAAE;gBACvEuB,SAASb,IAAI,CAACb,IAAIG,SAAS;YAC7B;YACAR,IAAIK,IAAIE,GAAG;YACX;QACF;QAEA,IAAI1E,iBAAiBwG,GAAG,CAAChC,IAAIG,SAAS,GAAG;YACvCsB,QAAQK,GAAG,CAAC9B,IAAIG,SAAS;YACzB,IAAI,CAACH,IAAIC,WAAW,EAAEyB,SAASb,IAAI,CAACb,IAAIG,SAAS;YACjDR,IAAIK,IAAIE,GAAG;YACX;QACF;QAEA,IAAIvE,mBAAmBqG,GAAG,CAAChC,IAAIG,SAAS,GAAG;;YACzC,MAAMnB,SAASgB,IAAID,UAAU,CAACsC,IAAI,CAChC,CAACf,YAAcA,UAAUnB,SAAS,KAAK;YAEzC,MAAMmC,WAAWpD,YAAYpC,uBAAekC,0BAAAA,OAAQjC,KAAK,mBAAI,IAAIH,IAAI;YACrE,IAAIoC,UAAWpD,CAAAA,eAAeoG,GAAG,CAACM,aAAaA,aAAa,OAAM,GAAI;gBACpEb,QAAQK,GAAG,CAAC;gBACZ,IAAI,CAAC9B,IAAIC,WAAW,EAAEyB,SAASb,IAAI,CAACb,IAAIG,SAAS;gBACjDR,IAAIK,IAAIE,GAAG;gBACX;YACF;QACF;QAEAyB,KACER,UACEnB,KACAA,IAAID,UAAU,CAACkC,MAAM,CAAC,CAACX,YAAcY,cAAcZ,WAAWG;QAGlE9B,IAAIK,IAAIE,GAAG;IACb;IAEA,OAAO;QAAEqC,KAAKvF;QAAKiC,SAASwC,QAAQe,IAAI,GAAG;QAAGf,SAAS;eAAIA;SAAQ,CAACgB,IAAI;IAAG;AAC7E;AAEA,SAASP,cACPZ,SAA0B,EAC1BG,OAAoB;IAEpB,wEAAwE;IACxE,IAAI,OAAO/C,IAAI,CAAC4C,UAAUnB,SAAS,KAAK,OAAOzB,IAAI,CAAC4C,UAAU7D,IAAI,GAAG;QACnEgE,QAAQK,GAAG,CAAC;QACZ,OAAO;IACT;IACA,IAAIlG,eAAeoG,GAAG,CAACV,UAAUnB,SAAS,GAAG;QAC3C,IAAIjC,aAAaoD,UAAUvE,KAAK,GAAG,OAAO;QAC1C0E,QAAQK,GAAG,CAAC;QACZ,OAAO;IACT;IACA,qEAAqE;IACrE,iEAAiE;IACjE,IAAIvD,sBAAsB+C,UAAUvE,KAAK,GAAG;QAC1C0E,QAAQK,GAAG,CACTR,UAAUnB,SAAS,KAAK,UACpB,6BACA;QAEN,OAAO;IACT;IACA,OAAO;AACT;AAEA;;;;;;;CAOC,GACD,OAAO,SAASuC,kBAAkBC,MAAc;IAK9C,MAAMC,SAASpB,YAAYmB,OAAOE,QAAQ,CAAC;IAC3C,OAAO;QACLF,QAAQC,OAAO3D,OAAO,GAAG6D,OAAOpD,IAAI,CAACkD,OAAOL,GAAG,EAAE,UAAUI;QAC3D1D,SAAS2D,OAAO3D,OAAO;QACvBwC,SAASmB,OAAOnB,OAAO;IACzB;AACF"}