@hyperframes/core 0.8.66 → 0.8.68

package/dist/figma/sanitizeSvg.d.ts

@@ -1,18 +1,2 @@
-/**
- * Sanitize a figma-exported SVG before it touches disk (design spec §5).
- *
- * Threat model: figma-SHAPED exports, hardened against the cheap adversarial
- * variants (nesting, unquoted attrs, scheme smuggling). This is a lexical
- * pass, not a general-purpose HTML sanitizer — content from arbitrary
- * untrusted sources should go through a real sanitizer (DOMPurify) instead.
- * Strips:
- *  - <script> elements (with content) and <style> blocks (@import exfil)
- *  - <foreignObject> subtrees (arbitrary embedded HTML)
- *  - on* event-handler attributes (quoted and unquoted)
- *  - href/xlink:href values unless local fragment (#id) or data:image/
- *
- * Keeps local fragment refs (#id) and data:image embeds, which figma uses
- * for clip paths and embedded rasters.
- */
 export declare function sanitizeSvg(svg: string): string;
 //# sourceMappingURL=sanitizeSvg.d.ts.map

package/dist/figma/sanitizeSvg.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sanitizeSvg.d.ts","sourceRoot":"","sources":["../../src/figma/sanitizeSvg.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAaH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAwB/C"}
+{"version":3,"file":"sanitizeSvg.d.ts","sourceRoot":"","sources":["../../src/figma/sanitizeSvg.ts"],"names":[],"mappings":"AAqWA,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAoB/C"}

package/dist/figma/sanitizeSvg.js

@@ -1,52 +1,369 @@
-/**
- * Sanitize a figma-exported SVG before it touches disk (design spec §5).
- *
- * Threat model: figma-SHAPED exports, hardened against the cheap adversarial
- * variants (nesting, unquoted attrs, scheme smuggling). This is a lexical
- * pass, not a general-purpose HTML sanitizer — content from arbitrary
- * untrusted sources should go through a real sanitizer (DOMPurify) instead.
- * Strips:
- *  - <script> elements (with content) and <style> blocks (@import exfil)
- *  - <foreignObject> subtrees (arbitrary embedded HTML)
- *  - on* event-handler attributes (quoted and unquoted)
- *  - href/xlink:href values unless local fragment (#id) or data:image/
- *
- * Keeps local fragment refs (#id) and data:image embeds, which figma uses
- * for clip paths and embedded rasters.
+/** Sanitize a figma-exported SVG before it touches disk (design spec §5). DOM-walk allowlist
+ * (linkedom): unknown elements and attributes are dropped by default rather than pattern-matched
+ * as dangerous, so a new SVG feature can't reopen a class of bug the way regex denylisting did.
  */
-/** Apply a replacement until the output stops changing (defeats nesting). */
-function replaceStable(input, pattern, replacement) {
-    let out = input;
-    let prev;
-    do {
-        prev = out;
-        out = out.replace(pattern, replacement);
-    } while (out !== prev);
-    return out;
+import { DOMParser } from "linkedom";
+const SAFE_ELEMENTS = new Set([
+    "svg",
+    "g",
+    "defs",
+    "symbol",
+    "use",
+    "image",
+    "a",
+    "switch",
+    "rect",
+    "circle",
+    "ellipse",
+    "line",
+    "polyline",
+    "polygon",
+    "path",
+    "text",
+    "tspan",
+    "textPath",
+    "linearGradient",
+    "radialGradient",
+    "stop",
+    "pattern",
+    "mask",
+    "clipPath",
+    "marker",
+    "filter",
+    "feBlend",
+    "feColorMatrix",
+    "feComponentTransfer",
+    "feComposite",
+    "feConvolveMatrix",
+    "feDiffuseLighting",
+    "feDisplacementMap",
+    "feDistantLight",
+    "feDropShadow",
+    "feFlood",
+    "feFuncA",
+    "feFuncB",
+    "feFuncG",
+    "feFuncR",
+    "feGaussianBlur",
+    "feImage",
+    "feMerge",
+    "feMergeNode",
+    "feMorphology",
+    "feOffset",
+    "fePointLight",
+    "feSpecularLighting",
+    "feSpotLight",
+    "feTile",
+    "feTurbulence",
+    "title",
+    "desc",
+    "metadata",
+    "style",
+]);
+// Local names only — a namespace prefix (xlink:href, x:href, ...) is stripped before this
+// lookup, so it doesn't matter which prefix an attacker aliases onto a real or fake namespace.
+const SAFE_ATTRIBUTES = new Set([
+    "id",
+    "class",
+    "style",
+    "transform",
+    "viewBox",
+    "width",
+    "height",
+    "x",
+    "y",
+    "x1",
+    "y1",
+    "x2",
+    "y2",
+    "cx",
+    "cy",
+    "r",
+    "rx",
+    "ry",
+    "fx",
+    "fy",
+    "points",
+    "d",
+    "offset",
+    "enable-background",
+    "gradientUnits",
+    "gradientTransform",
+    "spreadMethod",
+    "patternUnits",
+    "patternContentUnits",
+    "patternTransform",
+    "maskUnits",
+    "maskContentUnits",
+    "clipPathUnits",
+    "clip-rule",
+    "filterUnits",
+    "primitiveUnits",
+    "preserveAspectRatio",
+    "space",
+    "lang",
+    "role",
+    "focusable",
+    "tabindex",
+    "version",
+    "baseProfile",
+    "fill",
+    "fill-opacity",
+    "fill-rule",
+    "stroke",
+    "stroke-width",
+    "stroke-opacity",
+    "stroke-linecap",
+    "stroke-linejoin",
+    "stroke-miterlimit",
+    "stroke-dasharray",
+    "stroke-dashoffset",
+    "opacity",
+    "color",
+    "stop-color",
+    "stop-opacity",
+    "font-family",
+    "font-size",
+    "font-weight",
+    "font-style",
+    "text-anchor",
+    "dominant-baseline",
+    "alignment-baseline",
+    "letter-spacing",
+    "word-spacing",
+    "text-decoration",
+    "clip-path",
+    "mask",
+    "filter",
+    "marker-start",
+    "marker-mid",
+    "marker-end",
+    "marker",
+    "cursor",
+    "pointer-events",
+    "visibility",
+    "display",
+    "overflow",
+    "vector-effect",
+    "paint-order",
+    "color-interpolation",
+    "color-interpolation-filters",
+    "isolation",
+    "mix-blend-mode",
+    "startOffset",
+    "method",
+    "spacing",
+    "side",
+    "textLength",
+    "lengthAdjust",
+    "in",
+    "in2",
+    "result",
+    "mode",
+    "type",
+    "values",
+    "dx",
+    "dy",
+    "stdDeviation",
+    "edgeMode",
+    "k1",
+    "k2",
+    "k3",
+    "k4",
+    "operator",
+    "radius",
+    "scale",
+    "xChannelSelector",
+    "yChannelSelector",
+    "baseFrequency",
+    "numOctaves",
+    "seed",
+    "stitchTiles",
+    "tableValues",
+    "slope",
+    "intercept",
+    "amplitude",
+    "exponent",
+    "order",
+    "divisor",
+    "bias",
+    "targetX",
+    "targetY",
+    "kernelMatrix",
+    "preserveAlpha",
+    "kernelUnitLength",
+    "surfaceScale",
+    "diffuseConstant",
+    "specularConstant",
+    "specularExponent",
+    "lighting-color",
+    "flood-color",
+    "flood-opacity",
+    "azimuth",
+    "elevation",
+    "pointsAtX",
+    "pointsAtY",
+    "pointsAtZ",
+    "limitingConeAngle",
+]);
+function localName(name) {
+    const i = name.lastIndexOf(":");
+    return i === -1 ? name : name.slice(i + 1);
+}
+/** href/xlink:href (any prefix): a same-document fragment always, `data:image/` only off `<a>`
+ * (an `<a>` navigates the top-level document on click; `<use>`/`<image>`/`<feImage>` only fetch
+ * it as an inert image resource). */
+function isAllowedHref(value, tagLocalName) {
+    const v = value.trim();
+    if (v.startsWith("#"))
+        return true;
+    return /^data:image\//i.test(v) && tagLocalName.toLowerCase() !== "a";
+}
+/** CSS loads a resource only through a function (`url()`, `image-set()`, `src()`, ...) or
+ * `@import`, so CSS text passes only if every function is on this compute-only list, every
+ * `url()` is a same-document fragment, and there is no `@import`. `""` is a bare `(...)` group. */
+const SAFE_CSS_FUNCTIONS = new Set([
+    "",
+    "url",
+    "rgb",
+    "rgba",
+    "hsl",
+    "hsla",
+    "hwb",
+    "lab",
+    "lch",
+    "oklab",
+    "oklch",
+    "color",
+    "color-mix",
+    "var",
+    "calc",
+    "min",
+    "max",
+    "clamp",
+    "matrix",
+    "matrix3d",
+    "translate",
+    "translatex",
+    "translatey",
+    "translatez",
+    "translate3d",
+    "scale",
+    "scalex",
+    "scaley",
+    "scalez",
+    "scale3d",
+    "rotate",
+    "rotatex",
+    "rotatey",
+    "rotatez",
+    "rotate3d",
+    "skew",
+    "skewx",
+    "skewy",
+    "perspective",
+    "cubic-bezier",
+    "steps",
+    "blur",
+    "brightness",
+    "contrast",
+    "drop-shadow",
+    "grayscale",
+    "hue-rotate",
+    "invert",
+    "opacity",
+    "saturate",
+    "sepia",
+]);
+function decodeCssEscape(hex, char) {
+    if (hex === undefined)
+        return char ?? "";
+    const cp = parseInt(hex, 16);
+    const invalid = cp === 0 || cp > 0x10ffff || (cp >= 0xd800 && cp <= 0xdfff);
+    return invalid ? "�" : String.fromCodePoint(cp);
+}
+// A browser reads `\75 rl(` as `url(`, so every check runs on escape-decoded, lowercased text.
+// Comments stay in: CSS never lets one join a function name or `@import`, only split tokens.
+function canonicalCss(text) {
+    return text
+        .replace(/\\([0-9a-f]{1,6})[ \t\n\r\f]?|\\([\s\S])/gi, (_, hex, char) => decodeCssEscape(hex, char))
+        .toLowerCase();
+}
+// The scans below are single-pass indexOf loops, not regexes: the input is attacker-controlled
+// and a backtracking regex here stalled the CLI for seconds on a few KB of padding.
+function isCssNameChar(c) {
+    return c !== undefined && /[-\w]/.test(c);
+}
+function functionNameBefore(css, paren) {
+    let start = paren;
+    while (isCssNameChar(css[start - 1]))
+        start--;
+    return css.slice(start, paren);
+}
+function everyFunctionIsSafe(css) {
+    for (let at = css.indexOf("("); at !== -1; at = css.indexOf("(", at + 1)) {
+        if (!SAFE_CSS_FUNCTIONS.has(functionNameBefore(css, at)))
+            return false;
+    }
+    return true;
+}
+// A value holding "(" is rejected, so no second url( can hide inside the one being checked.
+function isLocalUrlValue(raw) {
+    const value = raw.trim().replace(/^['"]/, "");
+    return value.startsWith("#") && !value.includes("(");
+}
+function everyUrlIsLocalFragment(css) {
+    for (let at = css.indexOf("url("); at !== -1;) {
+        const close = css.indexOf(")", at + 4);
+        if (close === -1 || !isLocalUrlValue(css.slice(at + 4, close)))
+            return false;
+        at = css.indexOf("url(", close + 1);
+    }
+    return true;
+}
+function isSafeCss(text) {
+    const css = canonicalCss(text);
+    return !css.includes("@import") && everyFunctionIsSafe(css) && everyUrlIsLocalFragment(css);
+}
+function isXmlnsAttribute(name) {
+    return name === "xmlns" || name.startsWith("xmlns:");
+}
+// aria-*/data-* are inert key/value pairs everywhere else; still CSS-checked below,
+// defensively, rather than trusted just because no browser reads CSS from them today.
+function isKnownAttribute(local) {
+    return SAFE_ATTRIBUTES.has(local) || local.startsWith("aria-") || local.startsWith("data-");
+}
+// Every kept value goes through isSafeCss (style= and presentation attributes are CSS); a
+// non-CSS value that merely looks like a call, e.g. id="XRP-(XRP)", is dropped: fails closed.
+function isSafeAttribute(tagLocalName, name, value) {
+    if (isXmlnsAttribute(name))
+        return true;
+    const local = localName(name);
+    if (local === "href")
+        return isAllowedHref(value, tagLocalName);
+    return isKnownAttribute(local) && isSafeCss(value);
 }
 export function sanitizeSvg(svg) {
-    let out = svg;
-    out = replaceStable(out, /<script\b[\s\S]*?<\/script\b[^>]*>/gi, "");
-    out = replaceStable(out, /<script\b[^>]*\/>/gi, "");
-    out = replaceStable(out, /<style\b[\s\S]*?<\/style\b[^>]*>/gi, "");
-    out = replaceStable(out, /<foreignObject\b[\s\S]*?<\/foreignObject\b[^>]*>/gi, "");
-    out = replaceStable(out, /<foreignObject\b[^>]*\/>/gi, "");
-    // Nesting leaves inert orphan close tags after the stable pass — drop them.
-    out = out.replace(/<\/(?:script|style|foreignObject)\b[^>]*>/gi, "");
-    // on* handler attributes: quoted and unquoted forms.
-    out = replaceStable(out, /\son[a-z]+\s*=\s*"[^"]*"/gi, "");
-    out = replaceStable(out, /\son[a-z]+\s*=\s*'[^']*'/gi, "");
-    out = replaceStable(out, /\son[a-z]+\s*=\s*[^\s>'"]+/gi, "");
-    // href-like attributes: POSITIVE allowlist — keep only local fragments and
-    // data:image embeds; drop everything else (javascript:, https?:, blob:,
-    // vbscript:, data:text/html, protocol-relative, …).
-    // xmlns declarations are attribute *names*, not href values — untouched.
-    out = out.replace(/\s(href|xlink:href)\s*=\s*"([^"]*)"/gi, (m, attr, value) => isAllowedHref(value) ? m : "");
-    out = out.replace(/\s(href|xlink:href)\s*=\s*'([^']*)'/gi, (m, attr, value) => isAllowedHref(value) ? m : "");
-    return out;
-}
-function isAllowedHref(value) {
-    const v = value.trim().toLowerCase();
-    return v.startsWith("#") || v.startsWith("data:image/");
+    const doc = new DOMParser().parseFromString(svg, "image/svg+xml");
+    const root = doc.documentElement;
+    if (!root)
+        return "";
+    for (const el of [...doc.querySelectorAll("*")]) {
+        if (!el.isConnected)
+            continue;
+        if (!SAFE_ELEMENTS.has(el.tagName)) {
+            el.remove();
+            continue;
+        }
+        if (el.tagName === "style" && !isSafeCss(el.textContent)) {
+            el.remove();
+            continue;
+        }
+        for (const attr of [...el.attributes]) {
+            if (!isSafeAttribute(el.tagName, attr.name, attr.value))
+                el.removeAttribute(attr.name);
+        }
+    }
+    return root.isConnected ? root.outerHTML : "";
 }
 //# sourceMappingURL=sanitizeSvg.js.map

package/dist/figma/sanitizeSvg.js.map

@@ -1 +1 @@
-{"version":3,"file":"sanitizeSvg.js","sourceRoot":"","sources":["../../src/figma/sanitizeSvg.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,6EAA6E;AAC7E,SAAS,aAAa,CAAC,KAAa,EAAE,OAAe,EAAE,WAAmB;IACxE,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,IAAI,IAAI,CAAC;IACT,GAAG,CAAC;QACF,IAAI,GAAG,GAAG,CAAC;QACX,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC1C,CAAC,QAAQ,GAAG,KAAK,IAAI,EAAE;IACvB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,IAAI,GAAG,GAAG,GAAG,CAAC;IACd,GAAG,GAAG,aAAa,CAAC,GAAG,EAAE,sCAAsC,EAAE,EAAE,CAAC,CAAC;IACrE,GAAG,GAAG,aAAa,CAAC,GAAG,EAAE,qBAAqB,EAAE,EAAE,CAAC,CAAC;IACpD,GAAG,GAAG,aAAa,CAAC,GAAG,EAAE,oCAAoC,EAAE,EAAE,CAAC,CAAC;IACnE,GAAG,GAAG,aAAa,CAAC,GAAG,EAAE,oDAAoD,EAAE,EAAE,CAAC,CAAC;IACnF,GAAG,GAAG,aAAa,CAAC,GAAG,EAAE,4BAA4B,EAAE,EAAE,CAAC,CAAC;IAC3D,4EAA4E;IAC5E,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,6CAA6C,EAAE,EAAE,CAAC,CAAC;IACrE,qDAAqD;IACrD,GAAG,GAAG,aAAa,CAAC,GAAG,EAAE,4BAA4B,EAAE,EAAE,CAAC,CAAC;IAC3D,GAAG,GAAG,aAAa,CAAC,GAAG,EAAE,4BAA4B,EAAE,EAAE,CAAC,CAAC;IAC3D,GAAG,GAAG,aAAa,CAAC,GAAG,EAAE,8BAA8B,EAAE,EAAE,CAAC,CAAC;IAC7D,2EAA2E;IAC3E,wEAAwE;IACxE,oDAAoD;IACpD,yEAAyE;IACzE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,uCAAuC,EAAE,CAAC,CAAC,EAAE,IAAY,EAAE,KAAa,EAAE,EAAE,CAC5F,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAC9B,CAAC;IACF,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,uCAAuC,EAAE,CAAC,CAAC,EAAE,IAAY,EAAE,KAAa,EAAE,EAAE,CAC5F,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAC9B,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAC1D,CAAC"}
+{"version":3,"file":"sanitizeSvg.js","sourceRoot":"","sources":["../../src/figma/sanitizeSvg.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAErC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,KAAK;IACL,GAAG;IACH,MAAM;IACN,QAAQ;IACR,KAAK;IACL,OAAO;IACP,GAAG;IACH,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,SAAS;IACT,MAAM;IACN,UAAU;IACV,SAAS;IACT,MAAM;IACN,MAAM;IACN,OAAO;IACP,UAAU;IACV,gBAAgB;IAChB,gBAAgB;IAChB,MAAM;IACN,SAAS;IACT,MAAM;IACN,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,eAAe;IACf,qBAAqB;IACrB,aAAa;IACb,kBAAkB;IAClB,mBAAmB;IACnB,mBAAmB;IACnB,gBAAgB;IAChB,cAAc;IACd,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,gBAAgB;IAChB,SAAS;IACT,SAAS;IACT,aAAa;IACb,cAAc;IACd,UAAU;IACV,cAAc;IACd,oBAAoB;IACpB,aAAa;IACb,QAAQ;IACR,cAAc;IACd,OAAO;IACP,MAAM;IACN,UAAU;IACV,OAAO;CACR,CAAC,CAAC;AAEH,0FAA0F;AAC1F,+FAA+F;AAC/F,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,IAAI;IACJ,OAAO;IACP,OAAO;IACP,WAAW;IACX,SAAS;IACT,OAAO;IACP,QAAQ;IACR,GAAG;IACH,GAAG;IACH,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,GAAG;IACH,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,QAAQ;IACR,GAAG;IACH,QAAQ;IACR,mBAAmB;IACnB,eAAe;IACf,mBAAmB;IACnB,cAAc;IACd,cAAc;IACd,qBAAqB;IACrB,kBAAkB;IAClB,WAAW;IACX,kBAAkB;IAClB,eAAe;IACf,WAAW;IACX,aAAa;IACb,gBAAgB;IAChB,qBAAqB;IACrB,OAAO;IACP,MAAM;IACN,MAAM;IACN,WAAW;IACX,UAAU;IACV,SAAS;IACT,aAAa;IACb,MAAM;IACN,cAAc;IACd,WAAW;IACX,QAAQ;IACR,cAAc;IACd,gBAAgB;IAChB,gBAAgB;IAChB,iBAAiB;IACjB,mBAAmB;IACnB,kBAAkB;IAClB,mBAAmB;IACnB,SAAS;IACT,OAAO;IACP,YAAY;IACZ,cAAc;IACd,aAAa;IACb,WAAW;IACX,aAAa;IACb,YAAY;IACZ,aAAa;IACb,mBAAmB;IACnB,oBAAoB;IACpB,gBAAgB;IAChB,cAAc;IACd,iBAAiB;IACjB,WAAW;IACX,MAAM;IACN,QAAQ;IACR,cAAc;IACd,YAAY;IACZ,YAAY;IACZ,QAAQ;IACR,QAAQ;IACR,gBAAgB;IAChB,YAAY;IACZ,SAAS;IACT,UAAU;IACV,eAAe;IACf,aAAa;IACb,qBAAqB;IACrB,6BAA6B;IAC7B,WAAW;IACX,gBAAgB;IAChB,aAAa;IACb,QAAQ;IACR,SAAS;IACT,MAAM;IACN,YAAY;IACZ,cAAc;IACd,IAAI;IACJ,KAAK;IACL,QAAQ;IACR,MAAM;IACN,MAAM;IACN,QAAQ;IACR,IAAI;IACJ,IAAI;IACJ,cAAc;IACd,UAAU;IACV,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,UAAU;IACV,QAAQ;IACR,OAAO;IACP,kBAAkB;IAClB,kBAAkB;IAClB,eAAe;IACf,YAAY;IACZ,MAAM;IACN,aAAa;IACb,aAAa;IACb,OAAO;IACP,WAAW;IACX,WAAW;IACX,UAAU;IACV,OAAO;IACP,SAAS;IACT,MAAM;IACN,SAAS;IACT,SAAS;IACT,cAAc;IACd,eAAe;IACf,kBAAkB;IAClB,cAAc;IACd,iBAAiB;IACjB,kBAAkB;IAClB,kBAAkB;IAClB,gBAAgB;IAChB,aAAa;IACb,eAAe;IACf,SAAS;IACT,WAAW;IACX,WAAW;IACX,WAAW;IACX,WAAW;IACX,mBAAmB;CACpB,CAAC,CAAC;AAEH,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED;;qCAEqC;AACrC,SAAS,aAAa,CAAC,KAAa,EAAE,YAAoB;IACxD,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACvB,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC;AACxE,CAAC;AAED;;mGAEmG;AACnG,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,EAAE;IACF,KAAK;IACL,KAAK;IACL,MAAM;IACN,KAAK;IACL,MAAM;IACN,KAAK;IACL,KAAK;IACL,KAAK;IACL,OAAO;IACP,OAAO;IACP,OAAO;IACP,WAAW;IACX,KAAK;IACL,MAAM;IACN,KAAK;IACL,KAAK;IACL,OAAO;IACP,QAAQ;IACR,UAAU;IACV,WAAW;IACX,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,aAAa;IACb,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,SAAS;IACT,SAAS;IACT,SAAS;IACT,UAAU;IACV,MAAM;IACN,OAAO;IACP,OAAO;IACP,aAAa;IACb,cAAc;IACd,OAAO;IACP,MAAM;IACN,YAAY;IACZ,UAAU;IACV,aAAa;IACb,WAAW;IACX,YAAY;IACZ,QAAQ;IACR,SAAS;IACT,UAAU;IACV,OAAO;CACR,CAAC,CAAC;AAEH,SAAS,eAAe,CAAC,GAAuB,EAAE,IAAwB;IACxE,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,IAAI,EAAE,CAAC;IACzC,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,QAAQ,IAAI,CAAC,EAAE,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,CAAC,CAAC;IAC5E,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,+FAA+F;AAC/F,6FAA6F;AAC7F,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,IAAI;SACR,OAAO,CAAC,4CAA4C,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CACtE,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAC3B;SACA,WAAW,EAAE,CAAC;AACnB,CAAC;AAED,+FAA+F;AAC/F,oFAAoF;AACpF,SAAS,aAAa,CAAC,CAAqB;IAC1C,OAAO,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW,EAAE,KAAa;IACpD,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,OAAO,aAAa,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAAE,KAAK,EAAE,CAAC;IAC9C,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAW;IACtC,KAAK,IAAI,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QACzE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,kBAAkB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACzE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4FAA4F;AAC5F,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC9C,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,uBAAuB,CAAC,GAAW;IAC1C,KAAK,IAAI,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,GAAI,CAAC;QAC/C,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QACvC,IAAI,KAAK,KAAK,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7E,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,uBAAuB,CAAC,GAAG,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;AACvD,CAAC;AAED,oFAAoF;AACpF,sFAAsF;AACtF,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AAC9F,CAAC;AAED,0FAA0F;AAC1F,8FAA8F;AAC9F,SAAS,eAAe,CAAC,YAAoB,EAAE,IAAY,EAAE,KAAa;IACxE,IAAI,gBAAgB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,aAAa,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IAChE,OAAO,gBAAgB,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,GAAG,GAAG,IAAI,SAAS,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,GAAG,CAAC,eAAe,CAAC;IACjC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IAErB,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,EAAE,CAAC,WAAW;YAAE,SAAS;QAC9B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,EAAE,CAAC,MAAM,EAAE,CAAC;YACZ,SAAS;QACX,CAAC;QACD,IAAI,EAAE,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;YACzD,EAAE,CAAC,MAAM,EAAE,CAAC;YACZ,SAAS;QACX,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;YACtC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC;gBAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hyperframes/core",
-  "version": "0.8.66",
+  "version": "0.8.68",
   "description": "",
   "repository": {
     "type": "git",
@@ -306,9 +306,9 @@
     "bpm-detective": "^2.0.5",
     "linkedom": "^0.18.12",
     "postcss": "^8.5.8",
-    "@hyperframes/lint": "0.8.66",
-    "@hyperframes/parsers": "0.8.66",
-    "@hyperframes/studio-server": "0.8.66"
+    "@hyperframes/lint": "0.8.68",
+    "@hyperframes/parsers": "0.8.68",
+    "@hyperframes/studio-server": "0.8.68"
   },
   "devDependencies": {
     "@types/jsdom": "^28.0.0",