@kya-os/consent 0.1.13 → 0.1.15

package/dist/cjs/security/escape.js

@@ -0,0 +1,206 @@
+"use strict";
+/**
+ * HTML/JS Escape Utilities
+ *
+ * XSS prevention utilities for rendering user content safely.
+ *
+ * @module @kya-os/consent/security/escape
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.escapeHtml = escapeHtml;
+exports.escapeAttr = escapeAttr;
+exports.escapeJs = escapeJs;
+exports.escapeJsValue = escapeJsValue;
+exports.escapeUrl = escapeUrl;
+exports.safeHtml = safeHtml;
+exports.safeAttr = safeAttr;
+/**
+ * HTML entities to escape
+ */
+const HTML_ESCAPE_MAP = {
+    "&": "&",
+    "<": "&lt;",
+    ">": "&gt;",
+    '"': "&quot;",
+    "'": "&#x27;",
+};
+/**
+ * Additional characters to escape in attributes
+ */
+const ATTR_ESCAPE_MAP = {
+    ...HTML_ESCAPE_MAP,
+    "`": "&#x60;",
+    "=": "&#x3D;",
+};
+/**
+ * Escape HTML special characters to prevent XSS
+ *
+ * Converts characters that have special meaning in HTML to their
+ * entity equivalents, making them safe to insert into HTML content.
+ *
+ * @param text - The text to escape
+ * @returns HTML-safe string
+ *
+ * @example
+ * ```typescript
+ * escapeHtml('<script>alert("xss")</script>')
+ * // Returns: '&lt;script&gt;alert(&quot;xss&quot;)&lt;/script&gt;'
+ * ```
+ */
+function escapeHtml(text) {
+    if (!text)
+        return "";
+    return text.replace(/[&<>"']/g, (char) => HTML_ESCAPE_MAP[char] ?? char);
+}
+/**
+ * Escape text for use in HTML attributes
+ *
+ * More comprehensive escaping than escapeHtml, including backticks
+ * and equals signs which can be dangerous in attribute contexts.
+ *
+ * @param value - The value to escape
+ * @returns Attribute-safe string
+ *
+ * @example
+ * ```typescript
+ * escapeAttr('value" onclick="alert(1)')
+ * // Returns: 'value&quot; onclick&#x3D;&quot;alert(1)'
+ * ```
+ */
+function escapeAttr(value) {
+    if (!value)
+        return "";
+    return value.replace(/[&<>"'`=]/g, (char) => ATTR_ESCAPE_MAP[char] ?? char);
+}
+/**
+ * Escape text for use in JavaScript strings
+ *
+ * Uses JSON.stringify to properly escape all special characters
+ * that could break out of a JavaScript string context.
+ *
+ * @param text - The text to escape
+ * @returns JS-safe string (without surrounding quotes)
+ *
+ * @example
+ * ```typescript
+ * escapeJs('hello\nworld')
+ * // Returns: '"hello\\nworld"' (with quotes from JSON.stringify)
+ * ```
+ */
+function escapeJs(text) {
+    if (!text)
+        return '""';
+    return JSON.stringify(text);
+}
+/**
+ * Escape text for use in JavaScript, returning value without quotes
+ *
+ * @param text - The text to escape
+ * @returns JS-safe string content (without surrounding quotes)
+ *
+ * @example
+ * ```typescript
+ * escapeJsValue('hello\nworld')
+ * // Returns: 'hello\\nworld'
+ * ```
+ */
+function escapeJsValue(text) {
+    if (!text)
+        return "";
+    // JSON.stringify adds quotes, remove them
+    const escaped = JSON.stringify(text);
+    return escaped.slice(1, -1);
+}
+/**
+ * Escape URL for use in href or src attributes
+ *
+ * Only allows http, https, and mailto protocols. Returns empty
+ * string for dangerous protocols like javascript:.
+ *
+ * @param url - The URL to escape
+ * @returns Safe URL or empty string
+ *
+ * @example
+ * ```typescript
+ * escapeUrl('javascript:alert(1)')
+ * // Returns: ''
+ *
+ * escapeUrl('https://example.com/?q=test')
+ * // Returns: 'https://example.com/?q=test'
+ * ```
+ */
+function escapeUrl(url) {
+    if (!url)
+        return "";
+    // Check for dangerous protocols
+    const lowerUrl = url.toLowerCase().trim();
+    if (lowerUrl.startsWith("javascript:") ||
+        lowerUrl.startsWith("data:") ||
+        lowerUrl.startsWith("vbscript:") ||
+        lowerUrl.startsWith("file:")) {
+        return "";
+    }
+    // Try to parse as URL to validate
+    try {
+        const parsed = new URL(url);
+        if (!["http:", "https:", "mailto:"].includes(parsed.protocol)) {
+            return "";
+        }
+    }
+    catch {
+        // Block protocol-relative URLs (//evil.com) which bypass protocol checks
+        if (url.startsWith("//")) {
+            return "";
+        }
+        // If it's a relative URL (single slash, hash, or query), that's okay
+        if (!url.startsWith("/") && !url.startsWith("#") && !url.startsWith("?")) {
+            // Absolute URL that failed to parse - unsafe
+            return "";
+        }
+    }
+    // Escape any HTML characters in the URL (but not = or ` which are safe in URLs)
+    return escapeHtml(url);
+}
+/**
+ * Create a safe HTML string from template literals
+ *
+ * Automatically escapes interpolated values while preserving
+ * the template structure.
+ *
+ * @param strings - Template literal strings
+ * @param values - Interpolated values to escape
+ * @returns Safe HTML string
+ *
+ * @example
+ * ```typescript
+ * const userInput = '<script>alert("xss")</script>';
+ * const html = safeHtml`<div>${userInput}</div>`;
+ * // Returns: '<div>&lt;script&gt;alert(&quot;xss&quot;)&lt;/script&gt;</div>'
+ * ```
+ */
+function safeHtml(strings, ...values) {
+    let result = strings[0] ?? "";
+    for (let i = 0; i < values.length; i++) {
+        const value = values[i];
+        const escaped = value === null || value === undefined ? "" : escapeHtml(String(value));
+        result += escaped + (strings[i + 1] ?? "");
+    }
+    return result;
+}
+/**
+ * Create a safe attribute value from template literals
+ *
+ * @param strings - Template literal strings
+ * @param values - Interpolated values to escape
+ * @returns Safe attribute string
+ */
+function safeAttr(strings, ...values) {
+    let result = strings[0] ?? "";
+    for (let i = 0; i < values.length; i++) {
+        const value = values[i];
+        const escaped = value === null || value === undefined ? "" : escapeAttr(String(value));
+        result += escaped + (strings[i + 1] ?? "");
+    }
+    return result;
+}
+//# sourceMappingURL=escape.js.map

package/dist/cjs/security/escape.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"escape.js","sourceRoot":"","sources":["../../../src/security/escape.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAqCH,gCAGC;AAiBD,gCAGC;AAiBD,4BAGC;AAcD,sCAKC;AAoBD,8BAkCC;AAmBD,4BAYC;AASD,4BAYC;AA3MD;;GAEG;AACH,MAAM,eAAe,GAA2B;IAC9C,GAAG,EAAE,OAAO;IACZ,GAAG,EAAE,MAAM;IACX,GAAG,EAAE,MAAM;IACX,GAAG,EAAE,QAAQ;IACb,GAAG,EAAE,QAAQ;CACd,CAAC;AAEF;;GAEG;AACH,MAAM,eAAe,GAA2B;IAC9C,GAAG,eAAe;IAClB,GAAG,EAAE,QAAQ;IACb,GAAG,EAAE,QAAQ;CACd,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,SAAgB,UAAU,CAAC,IAAY;IACrC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAgB,UAAU,CAAC,KAAa;IACtC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,OAAO,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAgB,QAAQ,CAAC,IAAY;IACnC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAgB,aAAa,CAAC,IAAY;IACxC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,0CAA0C;IAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACrC,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,SAAS,CAAC,GAAuB;IAC/C,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IAEpB,gCAAgC;IAChC,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAC1C,IACE,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC;QAClC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAC5B,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC;QAChC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,EAC5B,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,kCAAkC;IAClC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9D,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,qEAAqE;QACrE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACzE,6CAA6C;YAC7C,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAgB,QAAQ,CACtB,OAA6B,EAC7B,GAAG,MAAiB;IAEpB,IAAI,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,OAAO,GACX,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACzE,MAAM,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,QAAQ,CACtB,OAA6B,EAC7B,GAAG,MAAiB;IAEpB,IAAI,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,OAAO,GACX,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACzE,MAAM,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/cjs/security/index.js

@@ -0,0 +1,26 @@
+"use strict";
+/**
+ * Consent Security Utilities
+ *
+ * XSS prevention and input validation utilities.
+ *
+ * @module @kya-os/consent/security
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./escape.js"), exports);
+__exportStar(require("./validators.js"), exports);
+//# sourceMappingURL=index.js.map

package/dist/cjs/security/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/security/index.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;;;;;;;;;;;;;;AAEH,8CAA4B;AAC5B,kDAAgC"}

package/dist/cjs/security/validators.js

@@ -0,0 +1,210 @@
+"use strict";
+/**
+ * Security Validators
+ *
+ * Input validation utilities for secure rendering.
+ *
+ * @module @kya-os/consent/security/validators
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateColor = validateColor;
+exports.validateUrl = validateUrl;
+exports.validateEmail = validateEmail;
+exports.validateDid = validateDid;
+exports.validateNoControlChars = validateNoControlChars;
+exports.sanitizeDisplayText = sanitizeDisplayText;
+exports.validateIdentifier = validateIdentifier;
+exports.isValidInteger = isValidInteger;
+exports.validateCSRFToken = validateCSRFToken;
+/**
+ * Validate that a string is a valid hex color
+ *
+ * Only accepts 6-digit hex colors with # prefix.
+ *
+ * @param color - Color string to validate
+ * @returns The color if valid, undefined otherwise
+ *
+ * @example
+ * ```typescript
+ * validateColor('#2563EB') // Returns '#2563EB'
+ * validateColor('2563EB')  // Returns undefined
+ * validateColor('#fff')    // Returns undefined (3-digit not allowed)
+ * ```
+ */
+function validateColor(color) {
+    if (!color)
+        return undefined;
+    const hex6Pattern = /^#[0-9A-Fa-f]{6}$/;
+    if (hex6Pattern.test(color)) {
+        return color;
+    }
+    return undefined;
+}
+/**
+ * Validate that a string is a valid URL
+ *
+ * Only accepts http and https protocols.
+ *
+ * @param url - URL string to validate
+ * @returns The URL if valid, undefined otherwise
+ *
+ * @example
+ * ```typescript
+ * validateUrl('https://example.com')    // Returns 'https://example.com'
+ * validateUrl('javascript:alert(1)')    // Returns undefined
+ * validateUrl('ftp://files.example.com') // Returns undefined
+ * ```
+ */
+function validateUrl(url) {
+    if (!url)
+        return undefined;
+    try {
+        const parsed = new URL(url);
+        if (parsed.protocol === "http:" || parsed.protocol === "https:") {
+            return url;
+        }
+    }
+    catch {
+        // Invalid URL
+    }
+    return undefined;
+}
+/**
+ * Validate that a string is a valid email address
+ *
+ * Uses a simple but effective email pattern.
+ *
+ * @param email - Email string to validate
+ * @returns The email if valid, undefined otherwise
+ */
+function validateEmail(email) {
+    if (!email)
+        return undefined;
+    // Simple email pattern - not exhaustive but catches most issues
+    const emailPattern = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+    if (emailPattern.test(email) && email.length <= 255) {
+        return email;
+    }
+    return undefined;
+}
+/**
+ * Validate that a string is a valid DID
+ *
+ * @param did - DID string to validate
+ * @returns The DID if valid, undefined otherwise
+ */
+function validateDid(did) {
+    if (!did)
+        return undefined;
+    // DID must start with did:
+    if (!did.startsWith("did:")) {
+        return undefined;
+    }
+    // Must have at least method and identifier (did:method:identifier)
+    const parts = did.split(":");
+    if (parts.length < 3) {
+        return undefined;
+    }
+    // Method must be alphanumeric
+    const method = parts[1];
+    if (!method || !/^[a-z0-9]+$/.test(method)) {
+        return undefined;
+    }
+    // Reasonable length limit
+    if (did.length > 500) {
+        return undefined;
+    }
+    return did;
+}
+/**
+ * Validate that a string contains no control characters
+ *
+ * @param text - Text to validate
+ * @returns The text if valid, undefined otherwise
+ */
+function validateNoControlChars(text) {
+    if (!text)
+        return undefined;
+    // Allow only printable ASCII and common whitespace
+    // eslint-disable-next-line no-control-regex
+    const controlPattern = /[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/;
+    if (controlPattern.test(text)) {
+        return undefined;
+    }
+    return text;
+}
+/**
+ * Validate and sanitize a string for display
+ *
+ * Removes control characters and trims whitespace.
+ *
+ * @param text - Text to sanitize
+ * @param maxLength - Maximum allowed length
+ * @returns Sanitized text or undefined if invalid
+ */
+function sanitizeDisplayText(text, maxLength = 500) {
+    if (!text)
+        return undefined;
+    // Remove control characters
+    // eslint-disable-next-line no-control-regex
+    const cleaned = text.replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, "");
+    // Trim and check length
+    const trimmed = cleaned.trim();
+    if (trimmed.length === 0 || trimmed.length > maxLength) {
+        return undefined;
+    }
+    return trimmed;
+}
+/**
+ * Validate that a string is alphanumeric with underscores only
+ *
+ * Useful for field names and identifiers.
+ *
+ * @param text - Text to validate
+ * @returns The text if valid, undefined otherwise
+ */
+function validateIdentifier(text) {
+    if (!text)
+        return undefined;
+    if (/^[a-zA-Z0-9_]+$/.test(text)) {
+        return text;
+    }
+    return undefined;
+}
+/**
+ * Check if a value is a safe integer within range
+ *
+ * @param value - Value to check
+ * @param min - Minimum value (inclusive)
+ * @param max - Maximum value (inclusive)
+ * @returns True if valid
+ */
+function isValidInteger(value, min = Number.MIN_SAFE_INTEGER, max = Number.MAX_SAFE_INTEGER) {
+    if (typeof value !== "number")
+        return false;
+    if (!Number.isFinite(value))
+        return false;
+    if (!Number.isInteger(value))
+        return false;
+    return value >= min && value <= max;
+}
+/**
+ * Validate a CSRF token format
+ *
+ * @param token - Token to validate
+ * @returns The token if valid, undefined otherwise
+ */
+function validateCSRFToken(token) {
+    if (!token)
+        return undefined;
+    // CSRF tokens should be reasonably long random strings
+    if (token.length < 16 || token.length > 256) {
+        return undefined;
+    }
+    // Should only contain safe characters
+    if (!/^[a-zA-Z0-9_-]+$/.test(token)) {
+        return undefined;
+    }
+    return token;
+}
+//# sourceMappingURL=validators.js.map

package/dist/cjs/security/validators.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validators.js","sourceRoot":"","sources":["../../../src/security/validators.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAiBH,sCASC;AAiBD,kCAaC;AAUD,sCAUC;AAQD,kCA0BC;AAQD,wDAWC;AAWD,kDAiBC;AAUD,gDAQC;AAUD,wCASC;AAQD,8CAcC;AAtND;;;;;;;;;;;;;;GAcG;AACH,SAAgB,aAAa,CAAC,KAAyB;IACrD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAE7B,MAAM,WAAW,GAAG,mBAAmB,CAAC;IACxC,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAgB,WAAW,CAAC,GAAuB;IACjD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAE3B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAChE,OAAO,GAAG,CAAC;QACb,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,aAAa,CAAC,KAAyB;IACrD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAE7B,gEAAgE;IAChE,MAAM,YAAY,GAAG,4BAA4B,CAAC;IAClD,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QACpD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,WAAW,CAAC,GAAuB;IACjD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAE3B,2BAA2B;IAC3B,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,mEAAmE;IACnE,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,8BAA8B;IAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,0BAA0B;IAC1B,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,SAAgB,sBAAsB,CAAC,IAAwB;IAC7D,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAE5B,mDAAmD;IACnD,4CAA4C;IAC5C,MAAM,cAAc,GAAG,kCAAkC,CAAC;IAC1D,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,mBAAmB,CACjC,IAAwB,EACxB,SAAS,GAAG,GAAG;IAEf,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAE5B,4BAA4B;IAC5B,4CAA4C;IAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;IAEtE,wBAAwB;IACxB,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QACvD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,kBAAkB,CAAC,IAAwB;IACzD,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAE5B,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,cAAc,CAC5B,KAAc,EACd,GAAG,GAAG,MAAM,CAAC,gBAAgB,EAC7B,GAAG,GAAG,MAAM,CAAC,gBAAgB;IAE7B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,OAAO,KAAK,IAAI,GAAG,IAAI,KAAK,IAAI,GAAG,CAAC;AACtC,CAAC;AAED;;;;;GAKG;AACH,SAAgB,iBAAiB,CAAC,KAAyB;IACzD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAE7B,uDAAuD;IACvD,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC5C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,sCAAsC;IACtC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/cjs/styles/css-variables.js

@@ -0,0 +1,129 @@
+"use strict";
+/**
+ * CSS Variable Generation
+ *
+ * Generates CSS custom properties for theming consent pages.
+ *
+ * @module @kya-os/consent/styles/css-variables
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CSS_VAR_NAMES = void 0;
+exports.hexToRgb = hexToRgb;
+exports.generateCSSVariables = generateCSSVariables;
+exports.generateCSSVariableString = generateCSSVariableString;
+exports.generateFullCSSVariables = generateFullCSSVariables;
+exports.generateStyleAttribute = generateStyleAttribute;
+exports.generateRootCSSBlock = generateRootCSSBlock;
+const colors_js_1 = require("../constants/colors.js");
+/**
+ * CSS variable names used in consent pages
+ */
+exports.CSS_VAR_NAMES = {
+    PRIMARY: "--consent-primary",
+    SECONDARY: "--consent-secondary",
+    PRIMARY_RGB: "--consent-primary-rgb",
+    SECONDARY_RGB: "--consent-secondary-rgb",
+    BACKGROUND: "--consent-background",
+    TEXT_PRIMARY: "--consent-text-primary",
+    TEXT_SECONDARY: "--consent-text-secondary",
+    BORDER: "--consent-border",
+};
+/**
+ * Convert hex color to RGB string
+ *
+ * @param hex - Hex color string (e.g., '#2563EB')
+ * @returns RGB string (e.g., '37, 99, 235')
+ */
+function hexToRgb(hex) {
+    // Remove # if present
+    const cleanHex = hex.replace(/^#/, '');
+    // Parse hex to RGB
+    const r = parseInt(cleanHex.slice(0, 2), 16);
+    const g = parseInt(cleanHex.slice(2, 4), 16);
+    const b = parseInt(cleanHex.slice(4, 6), 16);
+    return `${r}, ${g}, ${b}`;
+}
+/**
+ * Generate CSS variables from branding configuration
+ *
+ * @param branding - Branding config (optional fields)
+ * @returns CSS variable object with resolved values
+ */
+function generateCSSVariables(branding) {
+    const primary = branding?.primaryColor ?? colors_js_1.DEFAULT_COLORS.PRIMARY;
+    const secondary = branding?.secondaryColor ?? colors_js_1.DEFAULT_COLORS.SECONDARY;
+    return {
+        "--consent-primary": primary,
+        "--consent-secondary": secondary,
+        "--consent-primary-rgb": hexToRgb(primary),
+        "--consent-secondary-rgb": hexToRgb(secondary),
+    };
+}
+/**
+ * Generate CSS variable declarations as a style string
+ *
+ * @param branding - Branding config
+ * @returns CSS style string (e.g., "--consent-primary: #2563EB;")
+ */
+function generateCSSVariableString(branding) {
+    const vars = generateCSSVariables(branding);
+    return Object.entries(vars)
+        .map(([name, value]) => `${name}: ${value};`)
+        .join(" ");
+}
+/**
+ * Generate CSS variable declarations with all theme colors
+ *
+ * @param branding - Branding config
+ * @returns Complete CSS variable declarations including derived colors
+ */
+function generateFullCSSVariables(branding) {
+    const primary = branding?.primaryColor ?? colors_js_1.DEFAULT_COLORS.PRIMARY;
+    const secondary = branding?.secondaryColor ?? colors_js_1.DEFAULT_COLORS.SECONDARY;
+    return {
+        // Core branding colors
+        [exports.CSS_VAR_NAMES.PRIMARY]: primary,
+        [exports.CSS_VAR_NAMES.SECONDARY]: secondary,
+        // Additional theme colors
+        [exports.CSS_VAR_NAMES.BACKGROUND]: colors_js_1.DEFAULT_COLORS.BACKGROUND,
+        [exports.CSS_VAR_NAMES.TEXT_PRIMARY]: colors_js_1.DEFAULT_COLORS.TEXT_PRIMARY,
+        [exports.CSS_VAR_NAMES.TEXT_SECONDARY]: colors_js_1.DEFAULT_COLORS.TEXT_SECONDARY,
+        [exports.CSS_VAR_NAMES.BORDER]: colors_js_1.DEFAULT_COLORS.BORDER,
+    };
+}
+/**
+ * Generate a style attribute value with CSS variables
+ *
+ * @param branding - Branding config
+ * @returns Style attribute value for inline styling
+ *
+ * @example
+ * ```html
+ * <div style="${generateStyleAttribute(branding)}">...</div>
+ * ```
+ */
+function generateStyleAttribute(branding) {
+    return generateCSSVariableString(branding);
+}
+/**
+ * Generate a :root CSS block with all variables
+ *
+ * @param branding - Branding config
+ * @returns CSS :root block
+ *
+ * @example
+ * ```css
+ * :root {
+ *   --consent-primary: #2563EB;
+ *   --consent-secondary: #DBEAFE;
+ * }
+ * ```
+ */
+function generateRootCSSBlock(branding) {
+    const vars = generateFullCSSVariables(branding);
+    const declarations = Object.entries(vars)
+        .map(([name, value]) => `  ${name}: ${value};`)
+        .join("\n");
+    return `:root {\n${declarations}\n}`;
+}
+//# sourceMappingURL=css-variables.js.map

package/dist/cjs/styles/css-variables.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"css-variables.js","sourceRoot":"","sources":["../../../src/styles/css-variables.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AA2BH,4BAUC;AAQD,oDAUC;AAQD,8DAKC;AAQD,4DAcC;AAaD,wDAEC;AAgBD,oDAOC;AA9HD,sDAAwD;AAGxD;;GAEG;AACU,QAAA,aAAa,GAAG;IAC3B,OAAO,EAAE,mBAAmB;IAC5B,SAAS,EAAE,qBAAqB;IAChC,WAAW,EAAE,uBAAuB;IACpC,aAAa,EAAE,yBAAyB;IACxC,UAAU,EAAE,sBAAsB;IAClC,YAAY,EAAE,wBAAwB;IACtC,cAAc,EAAE,0BAA0B;IAC1C,MAAM,EAAE,kBAAkB;CAClB,CAAC;AAIX;;;;;GAKG;AACH,SAAgB,QAAQ,CAAC,GAAW;IAClC,sBAAsB;IACtB,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAEvC,mBAAmB;IACnB,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAE7C,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;GAKG;AACH,SAAgB,oBAAoB,CAAC,QAA0B;IAC7D,MAAM,OAAO,GAAG,QAAQ,EAAE,YAAY,IAAI,0BAAc,CAAC,OAAO,CAAC;IACjE,MAAM,SAAS,GAAG,QAAQ,EAAE,cAAc,IAAI,0BAAc,CAAC,SAAS,CAAC;IAEvE,OAAO;QACL,mBAAmB,EAAE,OAAO;QAC5B,qBAAqB,EAAE,SAAS;QAChC,uBAAuB,EAAE,QAAQ,CAAC,OAAO,CAAC;QAC1C,yBAAyB,EAAE,QAAQ,CAAC,SAAS,CAAC;KAC/C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,yBAAyB,CAAC,QAA0B;IAClE,MAAM,IAAI,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC5C,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;SACxB,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,KAAK,KAAK,GAAG,CAAC;SAC5C,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAgB,wBAAwB,CAAC,QAA0B;IACjE,MAAM,OAAO,GAAG,QAAQ,EAAE,YAAY,IAAI,0BAAc,CAAC,OAAO,CAAC;IACjE,MAAM,SAAS,GAAG,QAAQ,EAAE,cAAc,IAAI,0BAAc,CAAC,SAAS,CAAC;IAEvE,OAAO;QACL,uBAAuB;QACvB,CAAC,qBAAa,CAAC,OAAO,CAAC,EAAE,OAAO;QAChC,CAAC,qBAAa,CAAC,SAAS,CAAC,EAAE,SAAS;QACpC,0BAA0B;QAC1B,CAAC,qBAAa,CAAC,UAAU,CAAC,EAAE,0BAAc,CAAC,UAAU;QACrD,CAAC,qBAAa,CAAC,YAAY,CAAC,EAAE,0BAAc,CAAC,YAAY;QACzD,CAAC,qBAAa,CAAC,cAAc,CAAC,EAAE,0BAAc,CAAC,cAAc;QAC7D,CAAC,qBAAa,CAAC,MAAM,CAAC,EAAE,0BAAc,CAAC,MAAM;KAC9C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,sBAAsB,CAAC,QAA0B;IAC/D,OAAO,yBAAyB,CAAC,QAAQ,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAgB,oBAAoB,CAAC,QAA0B;IAC7D,MAAM,IAAI,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;SACtC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,KAAK,KAAK,GAAG,CAAC;SAC9C,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO,YAAY,YAAY,KAAK,CAAC;AACvC,CAAC"}

package/dist/cjs/styles/index.js

@@ -0,0 +1,28 @@
+"use strict";
+/**
+ * Consent Styles
+ *
+ * CSS tokens and generators for consent page styling.
+ * Matches AgentShield preview components exactly for pixel-perfect parity.
+ *
+ * @module @kya-os/consent/styles
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./tokens.js"), exports);
+__exportStar(require("./css-variables.js"), exports);
+__exportStar(require("./stylesheet.js"), exports);
+//# sourceMappingURL=index.js.map

package/dist/cjs/styles/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/styles/index.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;;;;;;;;;;;;;;AAEH,8CAA4B;AAC5B,qDAAmC;AACnC,kDAAgC"}