@galacean/effects-plugin-dom-content 2.9.0

package/dist/index.mjs

@@ -0,0 +1,1704 @@
+/*!
+ * Name: @galacean/effects-plugin-dom-content
+ * Description: Galacean Effects plugin for rendering HTML/CSS DOM content as texture
+ * Author: Ant Group CO., Ltd.
+ * Contributors: 陈茉
+ * Version: v2.9.0
+ */
+
+import * as EFFECTS from '@galacean/effects';
+import { Plugin, logger, loadImage, loadBlob, effectsClass, math, MaskableGraphic, Texture, glContext, registerPlugin } from '@galacean/effects';
+
+function _set_prototype_of(o, p) {
+    _set_prototype_of = Object.setPrototypeOf || function setPrototypeOf(o, p) {
+        o.__proto__ = p;
+        return o;
+    };
+    return _set_prototype_of(o, p);
+}
+
+function _inherits(subClass, superClass) {
+    if (typeof superClass !== "function" && superClass !== null) {
+        throw new TypeError("Super expression must either be null or a function");
+    }
+    subClass.prototype = Object.create(superClass && superClass.prototype, {
+        constructor: {
+            value: subClass,
+            writable: true,
+            configurable: true
+        }
+    });
+    if (superClass) _set_prototype_of(subClass, superClass);
+}
+
+function _is_native_reflect_construct() {
+    // Since Reflect.construct can't be properly polyfilled, some
+    // implementations (e.g. core-js@2) don't set the correct internal slots.
+    // Those polyfills don't allow us to subclass built-ins, so we need to
+    // use our fallback implementation.
+    try {
+        // If the internal slots aren't set, this throws an error similar to
+        //   TypeError: this is not a Boolean object.
+        var result = !Boolean.prototype.valueOf.call(Reflect.construct(Boolean, [], function() {}));
+    } catch (_) {}
+    return (_is_native_reflect_construct = function _is_native_reflect_construct() {
+        return !!result;
+    })();
+}
+
+function _construct(Parent, args, Class) {
+    if (_is_native_reflect_construct()) _construct = Reflect.construct;
+    else {
+        _construct = function construct(Parent, args, Class) {
+            var a = [
+                null
+            ];
+            a.push.apply(a, args);
+            var Constructor = Function.bind.apply(Parent, a);
+            var instance = new Constructor();
+            if (Class) _set_prototype_of(instance, Class.prototype);
+            return instance;
+        };
+    }
+    return _construct.apply(null, arguments);
+}
+
+function _get_prototype_of(o) {
+    _get_prototype_of = Object.setPrototypeOf ? Object.getPrototypeOf : function getPrototypeOf(o) {
+        return o.__proto__ || Object.getPrototypeOf(o);
+    };
+    return _get_prototype_of(o);
+}
+
+function _is_native_function(fn) {
+    return Function.toString.call(fn).indexOf("[native code]") !== -1;
+}
+
+function _wrap_native_super(Class) {
+    var _cache = typeof Map === "function" ? new Map() : undefined;
+    _wrap_native_super = function _wrap_native_super(Class) {
+        if (Class === null || !_is_native_function(Class)) return Class;
+        if (typeof Class !== "function") throw new TypeError("Super expression must either be null or a function");
+        if (typeof _cache !== "undefined") {
+            if (_cache.has(Class)) return _cache.get(Class);
+            _cache.set(Class, Wrapper);
+        }
+        function Wrapper() {
+            return _construct(Class, arguments, _get_prototype_of(this).constructor);
+        }
+        Wrapper.prototype = Object.create(Class.prototype, {
+            constructor: {
+                value: Wrapper,
+                enumerable: false,
+                writable: true,
+                configurable: true
+            }
+        });
+        return _set_prototype_of(Wrapper, Class);
+    };
+    return _wrap_native_super(Class);
+}
+
+/**
+ * DOM Content 插件 Loader
+ * 当前为空壳实现，组件在运行时由开发手动挂载，无需 JSON 数据解析
+ */ var DomContentLoader = /*#__PURE__*/ function(Plugin) {
+    _inherits(DomContentLoader, Plugin);
+    function DomContentLoader() {
+        var _this;
+        _this = Plugin.apply(this, arguments) || this;
+        _this.name = "dom-content";
+        return _this;
+    }
+    return DomContentLoader;
+}(_wrap_native_super(Plugin));
+
+function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
+    }
+    if (info.done) resolve(value);
+    else Promise.resolve(value).then(_next, _throw);
+}
+function _async_to_generator(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
+}
+
+function _array_like_to_array(arr, len) {
+    if (len == null || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
+}
+
+function _unsupported_iterable_to_array(o, minLen) {
+    if (!o) return;
+    if (typeof o === "string") return _array_like_to_array(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if (n === "Object" && o.constructor) n = o.constructor.name;
+    if (n === "Map" || n === "Set") return Array.from(n);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array(o, minLen);
+}
+
+function _create_for_of_iterator_helper_loose(o, allowArrayLike) {
+    var it = typeof Symbol !== "undefined" && o[Symbol.iterator] || o["@@iterator"];
+    if (it) return (it = it.call(o)).next.bind(it);
+    // Fallback for engines without symbol support
+    if (Array.isArray(o) || (it = _unsupported_iterable_to_array(o)) || allowArrayLike && o && typeof o.length === "number") {
+        if (it) o = it;
+        var i = 0;
+        return function() {
+            if (i >= o.length) return {
+                done: true
+            };
+            return {
+                done: false,
+                value: o[i++]
+            };
+        };
+    }
+    throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+
+function __decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function __generator(thisArg, body) {
+    var _ = {
+        label: 0,
+        sent: function sent() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    }, f, y, t, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() {
+        return this;
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(g && (g = 0, op[0] && (_ = 0)), _)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
+    }
+}
+typeof SuppressedError === "function" ? SuppressedError : function _SuppressedError(error, suppressed, message) {
+    var e = new Error(message);
+    return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
+};
+
+function _extends() {
+    _extends = Object.assign || function assign(target) {
+        for(var i = 1; i < arguments.length; i++){
+            var source = arguments[i];
+            for(var key in source)if (Object.prototype.hasOwnProperty.call(source, key)) target[key] = source[key];
+        }
+        return target;
+    };
+    return _extends.apply(this, arguments);
+}
+
+var DEFAULT_RENDER_OPTIONS = {
+    inlineFonts: true,
+    inlineImages: true,
+    extractDefs: true
+};
+var SVG_DEF_TAGS = new Set([
+    "filter",
+    "clippath",
+    "mask",
+    "lineargradient",
+    "radialgradient",
+    "pattern",
+    "marker"
+]);
+var IMG_TAG_NAMES = new Set([
+    "img"
+]);
+var MEDIA_TAG_NAMES = new Set([
+    "video",
+    "source",
+    "input",
+    "audio"
+]);
+var CSS_URL_REGEX = /url\(\s*(?:"([^"]+)"|'([^']+)'|([^\s)"']+))\s*\)/gi;
+/**
+ * 安全提取 HTML 中指定标签名的指定属性值，使用字符级扫描避免 ReDoS。
+ * 仅扫描 `<tagName` 后的属性区域，不依赖回溯正则。
+ * tagNames 为 null 时匹配任意标签。
+ */ function extractTagAttributes(html, tagNames, attrNames, out) {
+    var i = 0;
+    var len = html.length;
+    while(i < len){
+        var lt = html.indexOf("<", i);
+        if (lt === -1) {
+            break;
+        }
+        var next = html.charCodeAt(lt + 1);
+        var isLetter = next >= 65 && next <= 90 || next >= 97 && next <= 122;
+        if (!isLetter) {
+            i = lt + 1;
+            continue;
+        }
+        var nameEnd = lt + 1;
+        while(nameEnd < len){
+            var c = html.charCodeAt(nameEnd);
+            if (c === 32 || c === 9 || c === 10 || c === 13 || c === 47 || c === 62) {
+                break;
+            }
+            nameEnd++;
+        }
+        var tagName = html.slice(lt + 1, nameEnd).toLowerCase();
+        if (tagNames !== null && !tagNames.has(tagName)) {
+            i = nameEnd;
+            continue;
+        }
+        // 找到本标签的结束 '>'，在引号内的 '>' 不算，避免 style="background:url(>)" 这类干扰
+        var tagLimit = Math.min(len, nameEnd + 16000);
+        var tagEnd = -1;
+        var inDq = false;
+        var inSq = false;
+        for(var p = nameEnd; p < tagLimit; p++){
+            var c1 = html.charCodeAt(p);
+            if (c1 === 34 && !inSq) {
+                inDq = !inDq;
+            } else if (c1 === 39 && !inDq) {
+                inSq = !inSq;
+            } else if (c1 === 62 && !inDq && !inSq) {
+                tagEnd = p;
+                break;
+            }
+        }
+        if (tagEnd === -1) {
+            i = nameEnd;
+            continue;
+        }
+        var attrSection = html.slice(nameEnd, tagEnd);
+        for(var _iterator = _create_for_of_iterator_helper_loose(attrNames), _step; !(_step = _iterator()).done;){
+            var attrName = _step.value;
+            extractAttrValueFromSection(attrSection, attrName, out);
+        }
+        i = tagEnd + 1;
+    }
+}
+/**
+ * 字符级扫描提取所有 <style>...</style> 块的 textContent。
+ * 完全不使用回溯正则，最坏线性时间。
+ */ function extractStyleBlocks(html, out) {
+    var lower = html.toLowerCase();
+    var i = 0;
+    var len = html.length;
+    while(i < len){
+        var start = lower.indexOf("<style", i);
+        if (start === -1) {
+            break;
+        }
+        var after = lower.charCodeAt(start + 6);
+        var isStyleTag = after === 32 || after === 9 || after === 10 || after === 13 || after === 62 || after === 47;
+        if (!isStyleTag) {
+            i = start + 6;
+            continue;
+        }
+        // 跳过开标签到 '>' 结束
+        var openEnd = lower.indexOf(">", start + 6);
+        if (openEnd === -1) {
+            break;
+        }
+        var contentStart = openEnd + 1;
+        var closeStart = lower.indexOf("</style", contentStart);
+        if (closeStart === -1) {
+            break;
+        }
+        out.push(html.slice(contentStart, closeStart));
+        var closeEnd = lower.indexOf(">", closeStart);
+        if (closeEnd === -1) {
+            break;
+        }
+        i = closeEnd + 1;
+    }
+}
+/** 从单个标签的属性区域提取指定属性值 */ function extractAttrValueFromSection(section, attrName, out) {
+    var lower = section.toLowerCase();
+    var target = attrName.toLowerCase();
+    var pos = 0;
+    while(pos < lower.length){
+        var idx = lower.indexOf(target, pos);
+        if (idx === -1) {
+            return;
+        }
+        var prevChar = idx === 0 ? 32 : lower.charCodeAt(idx - 1);
+        var isBoundary = prevChar === 32 || prevChar === 9 || prevChar === 10 || prevChar === 13;
+        if (!isBoundary) {
+            pos = idx + target.length;
+            continue;
+        }
+        var p = idx + target.length;
+        while(p < section.length && /\s/.test(section[p])){
+            p++;
+        }
+        if (section[p] !== "=") {
+            pos = idx + target.length;
+            continue;
+        }
+        p++;
+        while(p < section.length && /\s/.test(section[p])){
+            p++;
+        }
+        var value = "";
+        var quote = section[p];
+        if (quote === '"' || quote === "'") {
+            var end = section.indexOf(quote, p + 1);
+            if (end === -1) {
+                return;
+            }
+            value = section.slice(p + 1, end);
+        } else {
+            var end1 = p;
+            while(end1 < section.length && !/[\s>]/.test(section[end1])){
+                end1++;
+            }
+            value = section.slice(p, end1);
+        }
+        if (value) {
+            out.add(value);
+        }
+        return;
+    }
+}
+/** 安全提取 @font-face 块，避免 ReDoS 正则回溯问题 */ function extractFontFaces(html) {
+    var faces = [];
+    var regex = /@font-face\s*\{/gi;
+    var match;
+    while((match = regex.exec(html)) !== null){
+        var start = match.index + match[0].length;
+        // 从匹配位置往后找匹配的 }，最多检查 8000 字符
+        var braceCount = 1;
+        var end = start;
+        for(; end < html.length && end < start + 8000; end++){
+            if (html[end] === "{") {
+                braceCount++;
+            } else if (html[end] === "}") {
+                braceCount--;
+                if (braceCount === 0) {
+                    break;
+                }
+            }
+        }
+        faces.push(html.slice(match.index, end + 1));
+        // 继续搜索时需要将 lastIndex 设置到 end 之后
+        regex.lastIndex = end + 1;
+    }
+    return faces;
+}
+var FONT_URL_REGEX = /url\(\s*(?:"([^"]+)"|'([^']+)'|([^\s)"']+))\s*\)/gi;
+var CSS_SVG_REF_REGEX = /url\(\s*(?:"|')?#([a-zA-Z][\w.-]*)(?:"|')?\s*\)/g;
+var isInlineUrl = function(url) {
+    return url.startsWith("data:") || url.startsWith("blob:");
+};
+/** 安全移除 HTML 中所有内联 <svg>...</svg> 块，使用字符级扫描避免 ReDoS */ function stripInlineSVG(html) {
+    var result = "";
+    var i = 0;
+    var len = html.length;
+    var lowerHtml = html.toLowerCase();
+    while(i < len){
+        var start = lowerHtml.indexOf("<svg", i);
+        if (start === -1) {
+            result += html.slice(i);
+            break;
+        }
+        var after = lowerHtml.charCodeAt(start + 4);
+        var isSvgTag = after === 32 || after === 9 || after === 10 || after === 13 || after === 62 || after === 47;
+        if (!isSvgTag) {
+            result += html.slice(i, start + 4);
+            i = start + 4;
+            continue;
+        }
+        result += html.slice(i, start);
+        var closeIdx = lowerHtml.indexOf("</svg", start + 4);
+        if (closeIdx === -1) {
+            break;
+        }
+        var gt = lowerHtml.indexOf(">", closeIdx);
+        if (gt === -1) {
+            break;
+        }
+        i = gt + 1;
+    }
+    return result;
+}
+/** 将 HTML 渲染为 Image 对象，默认自动执行内联字体/图片/提取 SVG 定义 */ function renderDOMToImage(html, width, height) {
+    return _renderDOMToImage.apply(this, arguments);
+}
+function _renderDOMToImage() {
+    _renderDOMToImage = _async_to_generator(function(html, width, height, scale, options) {
+        var opts, processedHtml, svgDefs, svgWidth, svgHeight, xhtmlSafeHtml, defsBlock, svg;
+        return __generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    if (scale === void 0) scale = 1;
+                    if (!Number.isFinite(width) || !Number.isFinite(height) || !Number.isFinite(scale) || width <= 0 || height <= 0 || scale < 0) {
+                        throw new Error("renderDOMToImage: width and height must be positive, scale must be non-negative.");
+                    }
+                    // scale 为 0 时返回空结果，与 width/height=0 行为保持一致
+                    if (scale === 0) {
+                        logger.warn("renderDOMToImage: scale is 0, skipping render.");
+                        return [
+                            2,
+                            loadImage("data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7")
+                        ];
+                    }
+                    opts = _extends({}, DEFAULT_RENDER_OPTIONS, options);
+                    // 先清理危险标记，再内联资源，避免从不安全标记中发现/获取 URL
+                    processedHtml = sanitizeSVGContent(html);
+                    if (!opts.inlineFonts) return [
+                        3,
+                        2
+                    ];
+                    return [
+                        4,
+                        inlineFontSources(processedHtml)
+                    ];
+                case 1:
+                    processedHtml = _state.sent();
+                    _state.label = 2;
+                case 2:
+                    if (!opts.inlineImages) return [
+                        3,
+                        4
+                    ];
+                    return [
+                        4,
+                        inlineImageSources(processedHtml)
+                    ];
+                case 3:
+                    processedHtml = _state.sent();
+                    _state.label = 4;
+                case 4:
+                    svgDefs = opts.extractDefs ? extractSVGDefs(processedHtml) : "";
+                    svgWidth = width * scale;
+                    svgHeight = height * scale;
+                    // 将 HTML 转为合规 XHTML，避免未闭合的 void 标签和未转义实体导致 SVG/XML 解析失败
+                    xhtmlSafeHtml = convertToXHTML(injectSVGNamespace(processedHtml));
+                    defsBlock = svgDefs ? "<defs>" + svgDefs + "</defs>" : "";
+                    svg = '<svg xmlns="http://www.w3.org/2000/svg" width="' + svgWidth + '" height="' + svgHeight + '">' + defsBlock + ('<foreignObject width="' + width + '" height="' + height + '" transform="scale(' + scale + ')">') + xhtmlSafeHtml + "</foreignObject></svg>";
+                    return [
+                        2,
+                        loadImage("data:image/svg+xml;charset=utf-8," + encodeURIComponent(svg))
+                    ];
+            }
+        });
+    });
+    return _renderDOMToImage.apply(this, arguments);
+}
+/** 危险标签名集合（小写）：将这些标签的 < > 转义为 &lt; &gt;，保留内容防止布局错位 */ var DANGEROUS_TAG_NAMES = new Set([
+    "foreignobject",
+    "script",
+    "iframe",
+    "object",
+    "embed",
+    "link",
+    "base",
+    "meta",
+    "template",
+    "noscript"
+]);
+/** 需要进行 URL 协议安全检查的属性名（小写） */ var URL_ATTR_NAMES = new Set([
+    "href",
+    "src",
+    "action",
+    "formaction"
+]);
+/** 不允许的协议列表 */ var DISALLOWED_PROTOCOLS = [
+    "javascript",
+    "vbscript"
+];
+/** data: URL 中允许的安全 MIME 类型前缀 */ var SAFE_DATA_PREFIXES = [
+    "data:image/",
+    "data:font/",
+    "data:application/font",
+    "data:application/x-font"
+];
+/**
+ * 规范化 URL 属性值：解码 HTML 实体和百分号编码，
+ * 移除控制字符和空白，转小写后检查是否包含危险协议
+ */ function normalizeUrlAttr(value) {
+    var normalized = value;
+    // 解码 HTML 实体（数字和命名）
+    normalized = normalized.replace(/&#x([0-9a-fA-F]+);?/g, function(_, hex) {
+        return String.fromCharCode(parseInt(hex, 16));
+    });
+    normalized = normalized.replace(/&#(\d+);?/g, function(_, dec) {
+        return String.fromCharCode(parseInt(dec, 10));
+    });
+    normalized = normalized.replace(/&(amp|lt|gt|quot|apos);/gi, function(match, name) {
+        var map = {
+            amp: "&",
+            lt: "<",
+            gt: ">",
+            quot: '"',
+            apos: "'"
+        };
+        var _map_name_toLowerCase;
+        return (_map_name_toLowerCase = map[name.toLowerCase()]) != null ? _map_name_toLowerCase : match;
+    });
+    // 解码百分号编码
+    try {
+        normalized = decodeURIComponent(normalized);
+    } catch (e) {}
+    // 移除控制字符（U+0000-U+001F, U+007F）和空白
+    // eslint-disable-next-line no-control-regex
+    normalized = normalized.replace(/[\u0000-\u001f\u007f\s]+/g, "");
+    // 转小写
+    normalized = normalized.toLowerCase();
+    // 去除前导非字母字符（如 / 或 \）
+    normalized = normalized.replace(/^[^a-z]+/, "");
+    return normalized;
+}
+/** 检查规范化后的 URL 是否使用了危险协议 */ function isDangerousUrl(value) {
+    var normalized = normalizeUrlAttr(value);
+    // 检查 javascript:/vbscript: 等明确危险协议
+    if (DISALLOWED_PROTOCOLS.some(function(proto) {
+        return normalized.startsWith("" + proto + ":");
+    })) {
+        return true;
+    }
+    // 检查 data: URL —— 仅允许安全的 MIME 类型（image/font），其余视为危险
+    if (normalized.startsWith("data:")) {
+        return !SAFE_DATA_PREFIXES.some(function(prefix) {
+            return normalized.startsWith(prefix);
+        });
+    }
+    return false;
+}
+/**
+ * 清理 HTML：转义危险标签，移除事件处理器和危险协议 URL 属性。
+ * 使用字符级扫描代替回溯正则，避免 ReDoS 漏洞。
+ */ function sanitizeSVGContent(html) {
+    return scanAndSanitize(html);
+}
+/**
+ * 单遍字符级扫描：
+ * - 识别危险标签（DANGEROUS_TAG_NAMES），将其 < > 转义为 &lt; &gt;
+ * - 在普通标签的属性区域内：移除 on* 事件处理器属性，移除值为危险 URL 的 href/src/action/formaction 属性
+ */ function scanAndSanitize(html) {
+    var out = "";
+    var i = 0;
+    var len = html.length;
+    while(i < len){
+        var ch = html.charCodeAt(i);
+        if (ch !== 60 /* < */ ) {
+            out += html[i++];
+            continue;
+        }
+        var next = html.charCodeAt(i + 1);
+        var isLetter = next >= 65 && next <= 90 || next >= 97 && next <= 122;
+        var nextNext = html.charCodeAt(i + 2);
+        var isSlashLetter = next === 47 /* / */  && (nextNext >= 65 && nextNext <= 90 || nextNext >= 97 && nextNext <= 122);
+        if (!isLetter && !isSlashLetter) {
+            out += html[i++];
+            continue;
+        }
+        var isClose = isSlashLetter;
+        var nameStart = isClose ? i + 2 : i + 1;
+        var nameEnd = nameStart;
+        while(nameEnd < len){
+            var c = html.charCodeAt(nameEnd);
+            if (c === 32 || c === 9 || c === 10 || c === 13 || c === 47 || c === 62) {
+                break;
+            }
+            nameEnd++;
+        }
+        var tagName = html.slice(nameStart, nameEnd).toLowerCase();
+        // 找到标签的结束 '>'，识别引号区域避免误判 '>'
+        var tagLimit = Math.min(len, nameEnd + 16000);
+        var tagEnd = -1;
+        var inDoubleQuote = false;
+        var inSingleQuote = false;
+        for(var p = nameEnd; p < tagLimit; p++){
+            var c1 = html.charCodeAt(p);
+            if (c1 === 34 /* " */  && !inSingleQuote) {
+                inDoubleQuote = !inDoubleQuote;
+            } else if (c1 === 39 /* ' */  && !inDoubleQuote) {
+                inSingleQuote = !inSingleQuote;
+            } else if (c1 === 62 /* > */  && !inDoubleQuote && !inSingleQuote) {
+                tagEnd = p;
+                break;
+            }
+        }
+        if (tagEnd === -1) {
+            out += html[i++];
+            continue;
+        }
+        if (DANGEROUS_TAG_NAMES.has(tagName)) {
+            out += "&lt;" + html.slice(i + 1, tagEnd) + "&gt;";
+            i = tagEnd + 1;
+            continue;
+        }
+        var tagOpen = html.slice(i, nameEnd);
+        var attrSection = html.slice(nameEnd, tagEnd);
+        var cleanedAttrs = sanitizeAttrSection(attrSection);
+        out += tagOpen + cleanedAttrs + ">";
+        i = tagEnd + 1;
+    }
+    return out;
+}
+/**
+ * 清理标签的属性区域：
+ * - 移除 on* 事件处理器属性
+ * - 移除值为危险 URL 的 href/src/action/formaction 属性
+ */ function sanitizeAttrSection(section) {
+    var out = "";
+    var i = 0;
+    var len = section.length;
+    while(i < len){
+        var c = section.charCodeAt(i);
+        if (c === 32 || c === 9 || c === 10 || c === 13 || c === 47) {
+            out += section[i++];
+            continue;
+        }
+        var nameStart = i;
+        while(i < len){
+            var cc = section.charCodeAt(i);
+            if (cc === 61 /* = */  || cc === 32 || cc === 9 || cc === 10 || cc === 13 || cc === 47 || cc === 62) {
+                break;
+            }
+            i++;
+        }
+        if (i === nameStart) {
+            out += section[i++];
+            continue;
+        }
+        var attrName = section.slice(nameStart, i);
+        var lowerName = attrName.toLowerCase();
+        var p = i;
+        while(p < len && /\s/.test(section[p])){
+            p++;
+        }
+        var attrEnd = p;
+        var value = null;
+        var hasValue = false;
+        if (section[p] === "=") {
+            hasValue = true;
+            p++;
+            while(p < len && /\s/.test(section[p])){
+                p++;
+            }
+            var q = section[p];
+            if (q === '"' || q === "'") {
+                var end = section.indexOf(q, p + 1);
+                if (end === -1) {
+                    out += section.slice(nameStart);
+                    return out;
+                }
+                value = section.slice(p + 1, end);
+                attrEnd = end + 1;
+            } else {
+                var end1 = p;
+                while(end1 < len && !/[\s>]/.test(section[end1])){
+                    end1++;
+                }
+                value = section.slice(p, end1);
+                attrEnd = end1;
+            }
+        }
+        var isEventHandler = lowerName.length > 2 && lowerName.charCodeAt(0) === 111 /* o */  && lowerName.charCodeAt(1) === 110 /* n */ ;
+        var isDangerousUrlAttr = hasValue && value !== null && URL_ATTR_NAMES.has(lowerName) && isDangerousUrl(value);
+        if (isEventHandler || isDangerousUrlAttr) {
+            i = attrEnd;
+            continue;
+        }
+        out += section.slice(nameStart, attrEnd);
+        i = attrEnd;
+    }
+    return out;
+}
+/** 为缺少 xmlns 的内嵌 <svg> 自动注入命名空间，使用字符级扫描，线性时间且无回溯 */ function injectSVGNamespace(html) {
+    var out = "";
+    var i = 0;
+    var len = html.length;
+    var lower = html.toLowerCase();
+    while(i < len){
+        var start = lower.indexOf("<svg", i);
+        if (start === -1) {
+            out += html.slice(i);
+            break;
+        }
+        var after = lower.charCodeAt(start + 4);
+        var isSvgTag = after === 32 || after === 9 || after === 10 || after === 13 || after === 62 || after === 47;
+        if (!isSvgTag) {
+            out += html.slice(i, start + 4);
+            i = start + 4;
+            continue;
+        }
+        var tagEnd = lower.indexOf(">", start + 4);
+        if (tagEnd === -1) {
+            out += html.slice(i);
+            break;
+        }
+        var tagSlice = lower.slice(start, tagEnd);
+        // 严格判断是否已有 xmlns 属性（前面有空白边界，后接 = 或空白）
+        var hasXmlns = /[\s][\s]*xmlns\s*=/i.test(" " + tagSlice);
+        out += html.slice(i, start + 4);
+        if (!hasXmlns) {
+            out += ' xmlns="http://www.w3.org/2000/svg"';
+        }
+        out += html.slice(start + 4, tagEnd + 1);
+        i = tagEnd + 1;
+    }
+    return out;
+}
+/**
+ * 将 HTML 字符串转为合规 XHTML，确保 void 标签被正确闭合、实体被转义，
+ * 使其可安全嵌入 SVG foreignObject（image/svg+xml 要求严格 XML 格式）
+ */ function convertToXHTML(html) {
+    if (typeof document === "undefined") {
+        // 非浏览器环境回退：手动闭合常见 void 标签
+        return '<div xmlns="http://www.w3.org/1999/xhtml">' + html + "</div>";
+    }
+    var doc = document.implementation.createHTMLDocument("");
+    var container = doc.createElement("div");
+    container.innerHTML = html;
+    container.setAttribute("xmlns", "http://www.w3.org/1999/xhtml");
+    return new XMLSerializer().serializeToString(container);
+}
+/**
+ * 从 HTML 中提取 CSS 上下文的 URL：仅扫描 <style> 元素的 textContent 和元素的 style 属性，
+ * 避免从普通文本/注释中误提取 URL。在无 DOMParser 环境下回退到正则但限制扫描范围。
+ */ function collectCSSUrls(html, urlSet) {
+    var cssTexts = [];
+    if (typeof DOMParser !== "undefined") {
+        try {
+            // 直接解析输入 HTML（inert document），避免通过模板拼接构造新 HTML 文档字符串
+            var doc = new DOMParser().parseFromString(html, "text/html");
+            doc.querySelectorAll("style").forEach(function(styleEl) {
+                if (styleEl.textContent) {
+                    cssTexts.push(styleEl.textContent);
+                }
+            });
+            doc.querySelectorAll("[style]").forEach(function(el) {
+                var styleAttr = el.getAttribute("style");
+                if (styleAttr) {
+                    cssTexts.push(styleAttr);
+                }
+            });
+        } catch (e) {
+        /* 解析失败则回退到下方正则扫描 */ }
+    }
+    // 回退路径：使用字符级扫描提取 <style>...</style> 块和 style="..." 属性，避免 ReDoS
+    if (cssTexts.length === 0) {
+        extractStyleBlocks(html, cssTexts);
+        var styleAttrSet = new Set();
+        extractTagAttributes(html, null, [
+            "style"
+        ], styleAttrSet);
+        for(var _iterator = _create_for_of_iterator_helper_loose(styleAttrSet), _step; !(_step = _iterator()).done;){
+            var v = _step.value;
+            cssTexts.push(v);
+        }
+    }
+    for(var _iterator1 = _create_for_of_iterator_helper_loose(cssTexts), _step1; !(_step1 = _iterator1()).done;){
+        var text = _step1.value;
+        CSS_URL_REGEX.lastIndex = 0;
+        var match = void 0;
+        while((match = CSS_URL_REGEX.exec(text)) !== null){
+            var _match_, _ref;
+            var url = (_ref = (_match_ = match[1]) != null ? _match_ : match[2]) != null ? _ref : match[3];
+            if (url && !isInlineUrl(url) && !url.startsWith("#")) {
+                urlSet.add(url);
+            }
+        }
+    }
+}
+/**
+ * 将 HTML 中外部资源 URL 转为 base64 内联，失败时保留原 URL
+ */ function inlineImageSources(html) {
+    return _inlineImageSources.apply(this, arguments);
+}
+function _inlineImageSources() {
+    _inlineImageSources = _async_to_generator(function(html) {
+        var rawUrlSet, urlSet, _iterator, _step, url, urlToBase64, urls;
+        return __generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    rawUrlSet = new Set();
+                    // 使用安全的字符级解析提取 src/poster 属性，避免 ReDoS
+                    extractTagAttributes(html, IMG_TAG_NAMES, [
+                        "src"
+                    ], rawUrlSet);
+                    extractTagAttributes(html, MEDIA_TAG_NAMES, [
+                        "src",
+                        "poster"
+                    ], rawUrlSet);
+                    urlSet = new Set();
+                    for(_iterator = _create_for_of_iterator_helper_loose(rawUrlSet); !(_step = _iterator()).done;){
+                        url = _step.value;
+                        if (url && !isInlineUrl(url)) {
+                            urlSet.add(url);
+                        }
+                    }
+                    // 仅扫描真正的 CSS 上下文（<style> 内容和 style 属性），避免从文本/注释中误提取 URL
+                    collectCSSUrls(html, urlSet);
+                    if (urlSet.size === 0) {
+                        return [
+                            2,
+                            html
+                        ];
+                    }
+                    urlToBase64 = new Map();
+                    urls = [].concat(urlSet).slice(0, MAX_URLS);
+                    if (urlSet.size > MAX_URLS) {
+                        logger.warn("inlineImageSources: URL count (" + urlSet.size + ") exceeds limit (" + MAX_URLS + "), only processing first " + MAX_URLS + ".");
+                    }
+                    return [
+                        4,
+                        promisePool(urls.map(function(url) {
+                            return /*#__PURE__*/ _async_to_generator(function() {
+                                var _, _tmp, e;
+                                return __generator(this, function(_state) {
+                                    switch(_state.label){
+                                        case 0:
+                                            _state.trys.push([
+                                                0,
+                                                2,
+                                                ,
+                                                3
+                                            ]);
+                                            _ = urlToBase64.set;
+                                            _tmp = [
+                                                url
+                                            ];
+                                            return [
+                                                4,
+                                                fetchAsBase64(url)
+                                            ];
+                                        case 1:
+                                            _.apply(urlToBase64, _tmp.concat([
+                                                _state.sent()
+                                            ]));
+                                            return [
+                                                3,
+                                                3
+                                            ];
+                                        case 2:
+                                            e = _state.sent();
+                                            logger.warn('inlineImageSources: Failed to fetch "' + url + '".', e);
+                                            return [
+                                                3,
+                                                3
+                                            ];
+                                        case 3:
+                                            return [
+                                                2
+                                            ];
+                                    }
+                                });
+                            });
+                        }), MAX_FETCH_CONCURRENCY)
+                    ];
+                case 1:
+                    _state.sent();
+                    return [
+                        2,
+                        replaceUrls(html, urlToBase64)
+                    ];
+            }
+        });
+    });
+    return _inlineImageSources.apply(this, arguments);
+}
+/**
+ * 将 @font-face 中的外部字体 URL 转为 base64 内联
+ */ function inlineFontSources(html) {
+    return _inlineFontSources.apply(this, arguments);
+}
+function _inlineFontSources() {
+    _inlineFontSources = _async_to_generator(function(html) {
+        var urlSet, fontFaces, _iterator, _step, face, urlMatch, _urlMatch_, _ref, url, urlToBase64, urls;
+        return __generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    urlSet = new Set();
+                    // 使用安全的逐字符解析代替正则
+                    fontFaces = extractFontFaces(html);
+                    for(_iterator = _create_for_of_iterator_helper_loose(fontFaces); !(_step = _iterator()).done;){
+                        face = _step.value;
+                        FONT_URL_REGEX.lastIndex = 0;
+                        urlMatch = void 0;
+                        while((urlMatch = FONT_URL_REGEX.exec(face)) !== null){
+                            url = (_ref = (_urlMatch_ = urlMatch[1]) != null ? _urlMatch_ : urlMatch[2]) != null ? _ref : urlMatch[3];
+                            if (url && !isInlineUrl(url)) {
+                                urlSet.add(url);
+                            }
+                        }
+                    }
+                    if (urlSet.size === 0) {
+                        return [
+                            2,
+                            html
+                        ];
+                    }
+                    urlToBase64 = new Map();
+                    urls = [].concat(urlSet).slice(0, MAX_URLS);
+                    if (urlSet.size > MAX_URLS) {
+                        logger.warn("inlineFontSources: URL count (" + urlSet.size + ") exceeds limit (" + MAX_URLS + "), only processing first " + MAX_URLS + ".");
+                    }
+                    return [
+                        4,
+                        promisePool(urls.map(function(url) {
+                            return /*#__PURE__*/ _async_to_generator(function() {
+                                var _, _tmp, e;
+                                return __generator(this, function(_state) {
+                                    switch(_state.label){
+                                        case 0:
+                                            _state.trys.push([
+                                                0,
+                                                2,
+                                                ,
+                                                3
+                                            ]);
+                                            _ = urlToBase64.set;
+                                            _tmp = [
+                                                url
+                                            ];
+                                            return [
+                                                4,
+                                                fetchAsBase64(url)
+                                            ];
+                                        case 1:
+                                            _.apply(urlToBase64, _tmp.concat([
+                                                _state.sent()
+                                            ]));
+                                            return [
+                                                3,
+                                                3
+                                            ];
+                                        case 2:
+                                            e = _state.sent();
+                                            logger.warn('inlineFontSources: Failed to fetch font "' + url + '".', e);
+                                            return [
+                                                3,
+                                                3
+                                            ];
+                                        case 3:
+                                            return [
+                                                2
+                                            ];
+                                    }
+                                });
+                            });
+                        }), MAX_FETCH_CONCURRENCY)
+                    ];
+                case 1:
+                    _state.sent();
+                    return [
+                        2,
+                        replaceUrls(html, urlToBase64)
+                    ];
+            }
+        });
+    });
+    return _inlineFontSources.apply(this, arguments);
+}
+/**
+ * 替换 URL 为 base64：
+ *  - 标签属性（src/poster）使用字符级扫描定位后做精确字符串替换，避免回溯正则 ReDoS
+ *  - CSS url() 替换使用线性时间的简单正则（无嵌套量词、无回溯陷阱）
+ *  - 全程区分大小写匹配 URL，确保通过 Map 精准查找
+ */ function replaceUrls(html, urlToBase64) {
+    // 1) 替换 <img>/<video>/<source>/<input>/<audio> 的 src/poster 属性
+    var html1 = replaceTagAttrUrls(html, new Set([
+        "img",
+        "video",
+        "source",
+        "input",
+        "audio"
+    ]), [
+        "src",
+        "poster"
+    ], urlToBase64);
+    // 2) 替换 CSS url("...") / url('...')，正则不含嵌套量词，线性时间
+    var result = html1.replace(/url\(\s*(["'])([^"'\n\r)]*)\1\s*\)/g, function(match, quote, url) {
+        var base64 = urlToBase64.get(url);
+        return base64 ? "url(" + quote + base64 + quote + ")" : match;
+    });
+    // 3) 替换 CSS url(...) 不带引号的 URL，线性时间
+    result = result.replace(/url\(\s*([^\s)"'\n\r]+)\s*\)/g, function(match, url) {
+        var base64 = urlToBase64.get(url);
+        return base64 ? "url(" + base64 + ")" : match;
+    });
+    return result;
+}
+/**
+ * 字符级扫描定位指定标签的指定属性，并将属性值替换为 Map 中的 base64。
+ * 完全不使用回溯正则，最坏情况是线性时间。
+ */ function replaceTagAttrUrls(html, tagNames, attrNames, urlToBase64) {
+    if (urlToBase64.size === 0) {
+        return html;
+    }
+    var targetAttrs = attrNames.map(function(a) {
+        return a.toLowerCase();
+    });
+    var out = "";
+    var i = 0;
+    var len = html.length;
+    while(i < len){
+        var lt = html.indexOf("<", i);
+        if (lt === -1) {
+            out += html.slice(i);
+            break;
+        }
+        var next = html.charCodeAt(lt + 1);
+        var isLetter = next >= 65 && next <= 90 || next >= 97 && next <= 122;
+        if (!isLetter) {
+            out += html.slice(i, lt + 1);
+            i = lt + 1;
+            continue;
+        }
+        var nameEnd = lt + 1;
+        while(nameEnd < len){
+            var c = html.charCodeAt(nameEnd);
+            if (c === 32 || c === 9 || c === 10 || c === 13 || c === 47 || c === 62) {
+                break;
+            }
+            nameEnd++;
+        }
+        var tagName = html.slice(lt + 1, nameEnd).toLowerCase();
+        if (!tagNames.has(tagName)) {
+            out += html.slice(i, nameEnd);
+            i = nameEnd;
+            continue;
+        }
+        // 找到本标签的结束 '>'，在引号内的 '>' 不算
+        var tagLimit = Math.min(len, nameEnd + 16000);
+        var tagEnd = -1;
+        var inDq = false;
+        var inSq = false;
+        for(var p = nameEnd; p < tagLimit; p++){
+            var c1 = html.charCodeAt(p);
+            if (c1 === 34 && !inSq) {
+                inDq = !inDq;
+            } else if (c1 === 39 && !inDq) {
+                inSq = !inSq;
+            } else if (c1 === 62 && !inDq && !inSq) {
+                tagEnd = p;
+                break;
+            }
+        }
+        if (tagEnd === -1) {
+            out += html.slice(i, lt + 1);
+            i = lt + 1;
+            continue;
+        }
+        // 在 [nameEnd, tagEnd) 区间内，逐属性替换目标 src/poster
+        out += html.slice(i, nameEnd);
+        out += replaceAttrsInSection(html.slice(nameEnd, tagEnd), targetAttrs, urlToBase64);
+        out += ">";
+        i = tagEnd + 1;
+    }
+    return out;
+}
+/** 在单个标签的属性区域内，将匹配 targetAttrs 的属性值替换为 Map 中的 base64 */ function replaceAttrsInSection(section, targetAttrs, urlToBase64) {
+    var out = "";
+    var i = 0;
+    var len = section.length;
+    while(i < len){
+        var c = section.charCodeAt(i);
+        if (c === 32 || c === 9 || c === 10 || c === 13 || c === 47) {
+            out += section[i++];
+            continue;
+        }
+        var nameStart = i;
+        while(i < len){
+            var cc = section.charCodeAt(i);
+            if (cc === 61 /* = */  || cc === 32 || cc === 9 || cc === 10 || cc === 13 || cc === 47 || cc === 62) {
+                break;
+            }
+            i++;
+        }
+        if (i === nameStart) {
+            out += section[i++];
+            continue;
+        }
+        var lowerName = section.slice(nameStart, i).toLowerCase();
+        var p = i;
+        while(p < len && /\s/.test(section[p])){
+            p++;
+        }
+        if (section[p] !== "=") {
+            out += section.slice(nameStart, p);
+            i = p;
+            continue;
+        }
+        p++;
+        while(p < len && /\s/.test(section[p])){
+            p++;
+        }
+        var valueStart = p;
+        var valueEnd = p;
+        var attrEnd = p;
+        var quote = null;
+        if (section[p] === '"' || section[p] === "'") {
+            quote = section[p];
+            var end = section.indexOf(quote, p + 1);
+            if (end === -1) {
+                out += section.slice(nameStart);
+                return out;
+            }
+            valueStart = p + 1;
+            valueEnd = end;
+            attrEnd = end + 1;
+        } else {
+            var end1 = p;
+            while(end1 < len && !/[\s>]/.test(section[end1])){
+                end1++;
+            }
+            valueStart = p;
+            valueEnd = end1;
+            attrEnd = end1;
+        }
+        var value = section.slice(valueStart, valueEnd);
+        if (targetAttrs.includes(lowerName)) {
+            var base64 = urlToBase64.get(value);
+            if (base64) {
+                out += section.slice(nameStart, valueStart) + base64 + (quote != null ? quote : "") + section.slice(attrEnd, attrEnd);
+                // 上一行末尾追加的 '' 是为了清晰；attrEnd 之后的内容由外层循环继续处理
+                // 注意：当 quote 不为 null 时，前缀 section.slice(nameStart, valueStart) 已经包含开引号；
+                // 我们追加 base64 + 闭合引号 即可。
+                i = attrEnd;
+                continue;
+            }
+        }
+        out += section.slice(nameStart, attrEnd);
+        i = attrEnd;
+    }
+    return out;
+}
+/**
+ * 从宿主文档提取 CSS url(#id) 引用的 SVG 定义，支持 filter/clipPath/mask/gradient/pattern/marker
+ */ function extractSVGDefs(html) {
+    if (typeof document === "undefined") {
+        return "";
+    }
+    // 使用安全的字符级扫描移除内联 <svg> 块，避免 ReDoS
+    var htmlWithoutInlineSVG = stripInlineSVG(html);
+    var ids = new Set();
+    CSS_SVG_REF_REGEX.lastIndex = 0;
+    var match;
+    while((match = CSS_SVG_REF_REGEX.exec(htmlWithoutInlineSVG)) !== null){
+        ids.add(match[1]);
+    }
+    if (ids.size === 0) {
+        return "";
+    }
+    var serializer = new XMLSerializer();
+    var parts = [];
+    for(var _iterator = _create_for_of_iterator_helper_loose(ids), _step; !(_step = _iterator()).done;){
+        var id = _step.value;
+        var el = document.getElementById(id);
+        if (!el) {
+            logger.warn("extractSVGDefs: #" + id + " not found.");
+            continue;
+        }
+        if (!SVG_DEF_TAGS.has(el.tagName.toLowerCase())) {
+            logger.warn("extractSVGDefs: #" + id + " is not a supported SVG def element.");
+            continue;
+        }
+        parts.push(serializer.serializeToString(el));
+    }
+    return parts.join("");
+}
+var MAX_FETCH_CONCURRENCY = 6; // 最大并发获取数
+var MAX_RESOURCE_BYTES = 10 * 1024 * 1024; // 单个资源最大 10MB
+var MAX_URLS = 100; // 单次内联处理的最大 URL 数量
+function promisePool(tasks, concurrency) {
+    return _promisePool.apply(this, arguments);
+}
+function _promisePool() {
+    _promisePool = /** 有界并发执行异步任务 */ _async_to_generator(function(tasks, concurrency) {
+        var results, index, workers;
+        function worker() {
+            return _worker.apply(this, arguments);
+        }
+        function _worker() {
+            _worker = _async_to_generator(function() {
+                var i;
+                return __generator(this, function(_state) {
+                    switch(_state.label){
+                        case 0:
+                            if (!(index < tasks.length)) return [
+                                3,
+                                2
+                            ];
+                            i = index++;
+                            return [
+                                4,
+                                tasks[i]()
+                            ];
+                        case 1:
+                            results[i] = _state.sent();
+                            return [
+                                3,
+                                0
+                            ];
+                        case 2:
+                            return [
+                                2
+                            ];
+                    }
+                });
+            });
+            return _worker.apply(this, arguments);
+        }
+        return __generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    results = new Array(tasks.length);
+                    index = 0;
+                    workers = Array.from({
+                        length: Math.min(concurrency, tasks.length)
+                    }, function() {
+                        return worker();
+                    });
+                    return [
+                        4,
+                        Promise.all(workers)
+                    ];
+                case 1:
+                    _state.sent();
+                    return [
+                        2,
+                        results
+                    ];
+            }
+        });
+    });
+    return _promisePool.apply(this, arguments);
+}
+function fetchAsBase64(url) {
+    return _fetchAsBase64.apply(this, arguments);
+}
+function _fetchAsBase64() {
+    _fetchAsBase64 = _async_to_generator(function(url) {
+        var blob;
+        return __generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    return [
+                        4,
+                        loadBlob(url)
+                    ];
+                case 1:
+                    blob = _state.sent();
+                    if (blob.size > MAX_RESOURCE_BYTES) {
+                        throw new Error('fetchAsBase64: Resource "' + url + '" exceeds max size (' + MAX_RESOURCE_BYTES + " bytes), actual: " + blob.size + ".");
+                    }
+                    return [
+                        2,
+                        new Promise(function(resolve, reject) {
+                            var reader = new FileReader();
+                            reader.onloadend = function() {
+                                resolve(reader.result);
+                            };
+                            reader.onerror = function() {
+                                reject(new Error("FileReader failed."));
+                            };
+                            reader.readAsDataURL(blob);
+                        })
+                    ];
+            }
+        });
+    });
+    return _fetchAsBase64.apply(this, arguments);
+}
+
+var DATA_TYPE = "DomContentComponent";
+var MAX_TEXTURE_SIZE = 2048;
+/** 单次 setContent 接受的 HTML 最大字符数，避免攻击者传入超大字符串造成 OOM/CPU 耗尽 */ var MAX_HTML_LENGTH = 1024 * 1024; // 1M 字符
+/** alpha 修复用的极小值，避免 canvas 完全透明像素被某些浏览器优化为 0 */ var ALPHA_FIX_VALUE = 1 / 255;
+var DomContentComponent = /*#__PURE__*/ function(MaskableGraphic1) {
+    _inherits(DomContentComponent, MaskableGraphic1);
+    function DomContentComponent(engine) {
+        var _this;
+        _this = MaskableGraphic1.call(this, engine) || this;
+        _this.htmlContent = "";
+        _this.contentWidth = 300;
+        _this.contentHeight = 200;
+        _this.contentScale = 1;
+        _this.rendering = false;
+        /** 异步任务取消标记：onDestroy 后置为 true，用于让 await 中的 updateTexture 回到同步段时立刻退出，避免泄漏纹理或写已释放的 material。 */ _this.asyncCancelled = false;
+        _this.targetComponent = null;
+        /** 内容版本号：每次 setContent 自增，用于丢弃过期的异步渲染结果，防止慢请求覆盖快请求。 */ _this.renderVersion = 0;
+        /** 由本组件创建的纹理集合，仅这些纹理可被 dispose */ _this.ownedTextures = new Set();
+        /** 保存 target 组件的原始纹理，用于组件销毁时恢复 */ _this.originalTargetTexture = null;
+        _this.isDirty = false;
+        // 自建独占 canvas：本组件的 updateTexture 是异步的，且无短期归还需求，
+        // 不走 canvasPool 以免占用其全局复用槽位影响其他组件（如 TextComponent）。
+        _this.canvas = document.createElement("canvas");
+        _this.context = _this.canvas.getContext("2d", {
+            willReadFrequently: true
+        });
+        return _this;
+    }
+    var _proto = DomContentComponent.prototype;
+    _proto.setContent = function setContent(html, width, height, scale) {
+        if (typeof html !== "string") {
+            logger.warn("DomContentComponent.setContent: html must be a string, ignored.");
+            return;
+        }
+        if (html.length > MAX_HTML_LENGTH) {
+            logger.warn("DomContentComponent.setContent: html length (" + html.length + ") exceeds limit (" + MAX_HTML_LENGTH + "), truncated.");
+            this.htmlContent = html.slice(0, MAX_HTML_LENGTH);
+        } else {
+            this.htmlContent = html;
+        }
+        if (width !== undefined) {
+            this.contentWidth = Math.max(0, width);
+        }
+        if (height !== undefined) {
+            this.contentHeight = Math.max(0, height);
+        }
+        if (scale !== undefined) {
+            this.contentScale = Math.max(0, scale);
+        }
+        this.isDirty = true;
+        this.renderVersion++;
+    };
+    _proto.onAwake = function onAwake() {
+        this.material.setColor("_Color", new math.Color(1, 1, 1, 1));
+        if (this.item) {
+            for(var _iterator = _create_for_of_iterator_helper_loose(this.item.getComponents(MaskableGraphic)), _step; !(_step = _iterator()).done;){
+                var comp = _step.value;
+                if (comp !== this) {
+                    this.targetComponent = comp;
+                    logger.info("DomContentComponent: Bound to " + comp.constructor.name + ", overriding texture.");
+                    break;
+                }
+            }
+        }
+    };
+    _proto.onUpdate = function onUpdate(dt) {
+        MaskableGraphic1.prototype.onUpdate.call(this, dt);
+        if (this.isDirty && !this.rendering) {
+            this.isDirty = false;
+            this.updateTexture().catch(function(e) {
+                logger.error("DomContentComponent: Unhandled error in updateTexture.", e);
+            });
+        }
+    };
+    _proto.render = function render(renderer) {
+        if (this.targetComponent) {
+            return;
+        }
+        MaskableGraphic1.prototype.render.call(this, renderer);
+    };
+    _proto.onDestroy = function onDestroy() {
+        var _this_targetComponent;
+        MaskableGraphic1.prototype.onDestroy.call(this);
+        // 先取消异步任务，再做资源清理，避免 in-flight Promise resolve 后仍写入已释放的资源。
+        this.asyncCancelled = true;
+        this.disposeOwnTexture();
+        // 恢复 target 组件的原始纹理
+        if (((_this_targetComponent = this.targetComponent) == null ? void 0 : _this_targetComponent.renderer) && this.originalTargetTexture) {
+            void this.targetComponent.setTexture(this.originalTargetTexture);
+        }
+        // 仅 dispose 由本组件创建的纹理
+        for(var _iterator = _create_for_of_iterator_helper_loose(this.ownedTextures), _step; !(_step = _iterator()).done;){
+            var tex = _step.value;
+            tex.dispose();
+        }
+        this.ownedTextures.clear();
+        this.originalTargetTexture = null;
+        if (this.canvas) {
+            // 缩到 1x1 立即释放后端 ImageBuffer 显存，无需等待 GC。
+            this.canvas.width = 1;
+            this.canvas.height = 1;
+        }
+        this.targetComponent = null;
+    };
+    /**
+   * 释放当前 renderer 上挂载的纹理（白纹理是引擎共享资源，不应释放）。
+   */ _proto.disposeOwnTexture = function disposeOwnTexture() {
+        var texture = this.renderer.texture;
+        if (texture && texture !== this.engine.whiteTexture) {
+            texture.dispose();
+        }
+    };
+    /**
+   * 将一张 image 绘制到内部 canvas，并据此创建纹理写入到本组件 renderer / material。
+   *
+   * @param width - 纹理宽度（像素）
+   * @param height - 纹理高度（像素）
+   * @param flipY - 是否翻转 Y 轴；为 false 时通过 canvas 变换预先翻转
+   * @param drawCallback - 实际绘制回调，接收已重置变换并清空的 2D 上下文
+   */ _proto.renderImageToTexture = function renderImageToTexture(width, height, flipY, drawCallback) {
+        if (!this.context || !this.canvas) {
+            return;
+        }
+        var context = this.context;
+        context.save();
+        this.canvas.width = width;
+        this.canvas.height = height;
+        context.setTransform(1, 0, 0, 1, 0, 0);
+        if (!flipY) {
+            context.translate(0, height);
+            context.scale(1, -1);
+        }
+        context.clearRect(0, 0, width, height);
+        // 设置 alpha 修复用填充色（不实际输出像素，避免完全透明被某些浏览器优化）
+        context.fillStyle = "rgba(255, 255, 255, " + ALPHA_FIX_VALUE + ")";
+        drawCallback(context);
+        context.restore();
+        var imageData = context.getImageData(0, 0, width, height);
+        var texture = Texture.createWithData(this.engine, {
+            data: new Uint8Array(imageData.data),
+            width: imageData.width,
+            height: imageData.height
+        }, {
+            flipY: flipY,
+            magFilter: glContext.LINEAR,
+            minFilter: glContext.LINEAR,
+            wrapS: glContext.CLAMP_TO_EDGE,
+            wrapT: glContext.CLAMP_TO_EDGE
+        });
+        this.disposeOwnTexture();
+        this.renderer.texture = texture;
+        this.material.setTexture("_MainTex", texture);
+        this.ownedTextures.add(texture);
+    };
+    _proto.updateTexture = function updateTexture() {
+        var _this = this;
+        return _async_to_generator(function() {
+            var startVersion, htmlContent, contentWidth, contentHeight, contentScale, texWidth, texHeight, cappedScaleX, cappedScaleY, cappedScale, image, e, pending;
+            return __generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        startVersion = _this.renderVersion;
+                        htmlContent = _this.htmlContent, contentWidth = _this.contentWidth, contentHeight = _this.contentHeight, contentScale = _this.contentScale;
+                        if (!htmlContent || contentWidth <= 0 || contentHeight <= 0) {
+                            return [
+                                2
+                            ];
+                        }
+                        if (contentScale <= 0) {
+                            logger.warn("DomContentComponent: contentScale must be positive, skipping render.");
+                            return [
+                                2
+                            ];
+                        }
+                        texWidth = Math.min(Math.round(contentWidth * contentScale), MAX_TEXTURE_SIZE);
+                        texHeight = Math.min(Math.round(contentHeight * contentScale), MAX_TEXTURE_SIZE);
+                        // 计算调整后的 scale，确保 renderDOMToImage 生成的图片不超过 MAX_TEXTURE_SIZE
+                        cappedScaleX = texWidth / contentWidth;
+                        cappedScaleY = texHeight / contentHeight;
+                        cappedScale = Math.min(cappedScaleX, cappedScaleY);
+                        _this.rendering = true;
+                        _state.label = 1;
+                    case 1:
+                        _state.trys.push([
+                            1,
+                            3,
+                            4,
+                            5
+                        ]);
+                        return [
+                            4,
+                            renderDOMToImage(htmlContent, contentWidth, contentHeight, cappedScale)
+                        ];
+                    case 2:
+                        image = _state.sent();
+                        // 竞态防护：组件已销毁、或已有更新的 setContent 调用，则丢弃本次过期结果。
+                        if (_this.asyncCancelled || startVersion !== _this.renderVersion) {
+                            return [
+                                2
+                            ];
+                        }
+                        if (_this.targetComponent) {
+                            _this.updateTargetTexture(image, texWidth, texHeight);
+                        } else {
+                            _this.renderImageToTexture(texWidth, texHeight, true, function(ctx) {
+                                ctx.drawImage(image, 0, 0, texWidth, texHeight);
+                            });
+                        }
+                        return [
+                            3,
+                            5
+                        ];
+                    case 3:
+                        e = _state.sent();
+                        logger.error("DomContentComponent: Failed to render texture.", e);
+                        return [
+                            3,
+                            5
+                        ];
+                    case 4:
+                        _this.rendering = false;
+                        // 排空脏标记：渲染期间若有新的 setContent，触发再次更新；销毁后则不再启动。
+                        if (_this.isDirty && !_this.asyncCancelled) {
+                            pending = _this.isDirty;
+                            _this.isDirty = false;
+                            if (pending) {
+                                _this.updateTexture().catch(function(e) {
+                                    logger.error("DomContentComponent: Unhandled error in updateTexture.", e);
+                                });
+                            }
+                        }
+                        return [
+                            7
+                        ];
+                    case 5:
+                        return [
+                            2
+                        ];
+                }
+            });
+        })();
+    };
+    _proto.updateTargetTexture = function updateTargetTexture(image, width, height) {
+        if (!this.canvas || !this.context || !this.targetComponent) {
+            return;
+        }
+        var ctx = this.context;
+        var target = this.targetComponent;
+        // 检查 target 的 renderer 是否存在
+        if (!target.renderer) {
+            logger.warn("DomContentComponent: targetComponent.renderer is null, skipping texture update.");
+            return;
+        }
+        // 保存 target 的原始纹理（仅首次）
+        var currentTexture = target.renderer.texture;
+        if (this.originalTargetTexture === null) {
+            this.originalTargetTexture = currentTexture != null ? currentTexture : null;
+        }
+        // 仅 dispose 由本组件创建的纹理，不触碰原始/共享纹理
+        if (currentTexture && this.ownedTextures.has(currentTexture)) {
+            currentTexture.dispose();
+            this.ownedTextures.delete(currentTexture);
+        }
+        ctx.save();
+        this.canvas.width = width;
+        this.canvas.height = height;
+        ctx.setTransform(1, 0, 0, 1, 0, 0);
+        ctx.clearRect(0, 0, width, height);
+        ctx.drawImage(image, 0, 0, width, height);
+        ctx.restore();
+        var imageData = ctx.getImageData(0, 0, width, height);
+        var texture = Texture.createWithData(this.engine, {
+            data: new Uint8Array(imageData.data),
+            width: imageData.width,
+            height: imageData.height
+        }, {
+            flipY: true,
+            magFilter: glContext.LINEAR,
+            minFilter: glContext.LINEAR,
+            wrapS: glContext.CLAMP_TO_EDGE,
+            wrapT: glContext.CLAMP_TO_EDGE
+        });
+        // 将新创建的纹理标记为本组件所有
+        this.ownedTextures.add(texture);
+        void target.setTexture(texture);
+    };
+    return DomContentComponent;
+}(MaskableGraphic);
+DomContentComponent = __decorate([
+    effectsClass(DATA_TYPE)
+], DomContentComponent);
+
+var version = "2.9.0";
+registerPlugin("dom-content", DomContentLoader);
+logger.info("Plugin dom-content version: " + version + ".");
+if (version !== EFFECTS.version) {
+    console.error("注意：请统一 DomContent 插件与 Player 版本，不统一的版本混用会有不可预知的后果！", "\nAttention: Please ensure the DomContent plugin is synchronized with the Player version. Mixing and matching incompatible versions may result in unpredictable consequences!");
+}
+
+export { DomContentComponent, DomContentLoader, extractSVGDefs, inlineFontSources, inlineImageSources, renderDOMToImage, sanitizeSVGContent, version };
+//# sourceMappingURL=index.mjs.map