@openfairygui/functions 0.2.0-alpha.35 → 0.2.0-alpha.36

package/dist/index.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_publish = require("./publish-Bv7E2fZE.cjs");
-const require_restore = require("./restore-iTgeWr7-.cjs");
+const require_publish = require("./publish-CykUJfVa.cjs");
+const require_restore = require("./restore-CEywQUHz.cjs");
 const require_uam_transaction = require("./uam-transaction.cjs");
 //#region src/inspect.ts
 function mapResource(resource) {

package/dist/index.js

@@ -1,5 +1,5 @@
-import { a as decodeText, g as createTransform, h as atlas, i as buildCodegenClasses, l as resolvePackageCodegenPlan, n as resolvePublishOptions, o as encodeText, r as AUTO_GENERATED_CODE_MARK, s as publishCodeGeneration, t as publish } from "./publish--8vagaSA.js";
-import { t as restore } from "./restore-CknfGMJM.js";
+import { a as decodeText, g as createTransform, h as atlas, i as buildCodegenClasses, l as resolvePackageCodegenPlan, n as resolvePublishOptions, o as encodeText, r as AUTO_GENERATED_CODE_MARK, s as publishCodeGeneration, t as publish } from "./publish-DXoaC1Nl.js";
+import { t as restore } from "./restore-BQp01WY3.js";
 import { applyUamTransactionApp, applyUamTransactionAppAsync } from "./uam-transaction.js";
 //#region src/inspect.ts
 function mapResource(resource) {

package/dist/node.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_publish = require("./publish-Bv7E2fZE.cjs");
-const require_restore = require("./restore-iTgeWr7-.cjs");
+const require_publish = require("./publish-CykUJfVa.cjs");
+const require_restore = require("./restore-CEywQUHz.cjs");
 //#region src/adapters/node/plugins.ts
 const importNative$2 = new Function("id", "return import(id)");
 async function loadPlugins(doc, pluginsDir) {

package/dist/node.js

@@ -1,5 +1,5 @@
-import { m as formatPluginError, t as publish, u as resolveProjectBasePath } from "./publish--8vagaSA.js";
-import { t as restore } from "./restore-CknfGMJM.js";
+import { m as formatPluginError, t as publish, u as resolveProjectBasePath } from "./publish-DXoaC1Nl.js";
+import { t as restore } from "./restore-BQp01WY3.js";
 //#region src/adapters/node/plugins.ts
 const importNative$2 = new Function("id", "return import(id)");
 async function loadPlugins(doc, pluginsDir) {

package/dist/{publish-Bv7E2fZE.cjs → publish-CykUJfVa.cjs}

@@ -786,8 +786,11 @@ async function collectImage(resource, pkg, inputs, encoder, options, doTrim, log
 				}).png().toBuffer();
 				sourceHasAlpha = true;
 			}
-		} catch {
-			if (options.strictOutput) throw new Error(`atlas: Could not read image "${filePath}".`);
+		} catch (error) {
+			if (options.strictOutput) {
+				const detail = error instanceof Error && error.message.startsWith("publishBrowser:") ? ` ${error.message}` : "";
+				throw new Error(`atlas: Could not read image "${filePath}".${detail}`);
+			}
 			if (origW === 0 || origH === 0) {
 				logger.warn(`atlas: Could not read image "${filePath}", skipping.`);
 				return;

package/dist/{publish--8vagaSA.js → publish-DXoaC1Nl.js}

@@ -786,8 +786,11 @@ async function collectImage(resource, pkg, inputs, encoder, options, doTrim, log
 				}).png().toBuffer();
 				sourceHasAlpha = true;
 			}
-		} catch {
-			if (options.strictOutput) throw new Error(`atlas: Could not read image "${filePath}".`);
+		} catch (error) {
+			if (options.strictOutput) {
+				const detail = error instanceof Error && error.message.startsWith("publishBrowser:") ? ` ${error.message}` : "";
+				throw new Error(`atlas: Could not read image "${filePath}".${detail}`);
+			}
 			if (origW === 0 || origH === 0) {
 				logger.warn(`atlas: Could not read image "${filePath}", skipping.`);
 				return;

package/dist/{restore-CknfGMJM.js → restore-BQp01WY3.js}

@@ -1,4 +1,4 @@
-import { d as basename, f as normalizeComparablePath, p as trimTrailingSlashes } from "./publish--8vagaSA.js";
+import { d as basename, f as normalizeComparablePath, p as trimTrailingSlashes } from "./publish-DXoaC1Nl.js";
 import { BinaryReader, ProjectType, ProjectWriter, generateId } from "@openfairygui/core";
 //#region src/restore-internals/output-transaction.ts
 function isPathWithin(root, candidate) {

package/dist/{restore-iTgeWr7-.cjs → restore-CEywQUHz.cjs}

@@ -1,4 +1,4 @@
-const require_publish = require("./publish-Bv7E2fZE.cjs");
+const require_publish = require("./publish-CykUJfVa.cjs");
 let _openfairygui_core = require("@openfairygui/core");
 //#region src/restore-internals/output-transaction.ts
 function isPathWithin(root, candidate) {

package/dist/web.cjs

@@ -1,7 +1,116 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_publish = require("./publish-Bv7E2fZE.cjs");
+const require_publish = require("./publish-CykUJfVa.cjs");
 let _openfairygui_core = require("@openfairygui/core");
+let fast_xml_parser = require("fast-xml-parser");
 //#region src/adapters/web/raster.ts
+const MAX_SVG_SOURCE_BYTES = 8 * 1024 * 1024;
+const MAX_SVG_DIMENSION = 16384;
+const MAX_SVG_PIXELS = 64 * 1024 * 1024;
+const MAX_SVG_NODES = 5e4;
+const UNSAFE_SVG_ELEMENTS = new Set([
+	"a",
+	"animate",
+	"animatecolor",
+	"animatemotion",
+	"animatetransform",
+	"audio",
+	"canvas",
+	"discard",
+	"embed",
+	"feimage",
+	"foreignobject",
+	"iframe",
+	"image",
+	"object",
+	"script",
+	"set",
+	"style",
+	"video"
+]);
+function unsafeSvg(message) {
+	throw new Error(`publishBrowser: unsafe SVG input (${message}).`);
+}
+function svgLocalName(name) {
+	return name.split(":").at(-1).toLowerCase();
+}
+function parseSvgLength(value, name) {
+	if (value === void 0) return void 0;
+	const match = String(value).match(/^\s*(?:\d+(?:\.\d+)?|\.\d+)(?:px)?\s*$/iu);
+	if (!match) unsafeSvg(`${name} must use a finite pixel value`);
+	const parsed = Number.parseFloat(match[0]);
+	if (!Number.isFinite(parsed) || parsed <= 0 || parsed > MAX_SVG_DIMENSION) unsafeSvg(`${name} exceeds the supported dimensions`);
+	return parsed;
+}
+function validateSvgAttribute(name, value) {
+	const normalizedName = name.toLowerCase();
+	if (normalizedName === "xmlns" || normalizedName.startsWith("xmlns:")) return;
+	const localName = svgLocalName(name);
+	const text = String(value);
+	if (localName.startsWith("on")) unsafeSvg(`event attribute "${name}" is not allowed`);
+	if (localName === "style" || localName === "src") unsafeSvg(`attribute "${name}" is not allowed`);
+	if (localName === "href" && !/^#[A-Za-z_][\w:.-]*$/u.test(text)) unsafeSvg(`external reference in "${name}" is not allowed`);
+	if (/(?:^|[\s("'=])(?:https?:|file:|javascript:|data:|\/\/)/iu.test(text)) unsafeSvg(`external URL in "${name}" is not allowed`);
+	for (const match of text.matchAll(/url\s*\(([^)]*)\)/giu)) {
+		const reference = (match[1] ?? "").trim().replace(/^(['"])(.*)\1$/u, "$2");
+		if (!/^#[A-Za-z_][\w:.-]*$/u.test(reference)) unsafeSvg(`external url() in "${name}" is not allowed`);
+	}
+}
+function visitSvgEntry(entry) {
+	const pending = [entry];
+	let nodeCount = 0;
+	while (pending.length > 0) {
+		const current = pending.pop();
+		for (const [name, value] of Object.entries(current)) {
+			if (name === ":@" || name.startsWith("#") || name.startsWith("?")) continue;
+			if (++nodeCount > MAX_SVG_NODES) unsafeSvg("node count exceeds the supported limit");
+			const localName = svgLocalName(name);
+			if (UNSAFE_SVG_ELEMENTS.has(localName)) unsafeSvg(`element <${name}> is not allowed`);
+			for (const [attributeName, attributeValue] of Object.entries(current[":@"] ?? {})) validateSvgAttribute(attributeName, attributeValue);
+			if (Array.isArray(value)) {
+				for (const child of value) if (child && typeof child === "object" && !Array.isArray(child)) pending.push(child);
+			}
+		}
+	}
+}
+function validateSvg(bytes) {
+	if (bytes.byteLength === 0 || bytes.byteLength > MAX_SVG_SOURCE_BYTES) unsafeSvg("source size is unsupported");
+	let source;
+	try {
+		source = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+	} catch {
+		unsafeSvg("source is not valid UTF-8");
+	}
+	if (/<!\s*(?:doctype|entity)\b|<\?xml-stylesheet\b/iu.test(source)) unsafeSvg("DTD, entities, and stylesheets are not allowed");
+	if (fast_xml_parser.XMLValidator.validate(source, { allowBooleanAttributes: false }) !== true) unsafeSvg("source is not well-formed XML");
+	const roots = new fast_xml_parser.XMLParser({
+		preserveOrder: true,
+		ignoreAttributes: false,
+		attributeNamePrefix: "",
+		parseAttributeValue: false,
+		parseTagValue: false,
+		processEntities: false,
+		trimValues: false
+	}).parse(source).flatMap((entry) => Object.keys(entry).filter((name) => name !== ":@" && !name.startsWith("#") && !name.startsWith("?")).map((name) => ({
+		entry,
+		name
+	})));
+	if (roots.length !== 1 || svgLocalName(roots[0].name) !== "svg") unsafeSvg("a single <svg> root is required");
+	const root = roots[0].entry;
+	visitSvgEntry(root);
+	const attributes = root[":@"] ?? {};
+	const width = parseSvgLength(attributes.width, "width");
+	const height = parseSvgLength(attributes.height, "height");
+	let viewBoxWidth;
+	let viewBoxHeight;
+	if (attributes.viewBox !== void 0) {
+		const viewBox = String(attributes.viewBox).trim().split(/[\s,]+/u).map(Number);
+		if (viewBox.length !== 4 || viewBox.some((value) => !Number.isFinite(value)) || viewBox[2] <= 0 || viewBox[3] <= 0) unsafeSvg("viewBox must contain four finite values with positive dimensions");
+		viewBoxWidth = viewBox[2];
+		viewBoxHeight = viewBox[3];
+		if (viewBoxWidth > MAX_SVG_DIMENSION || viewBoxHeight > MAX_SVG_DIMENSION) unsafeSvg("viewBox exceeds the supported dimensions");
+	}
+	if ((width ?? viewBoxWidth ?? 300) * (height ?? viewBoxHeight ?? 150) > MAX_SVG_PIXELS) unsafeSvg("pixel count exceeds the supported limit");
+}
 function getBrowserContext(canvas) {
 	const context = canvas.getContext("2d");
 	if (!context) throw new Error("publishBrowser: a 2D canvas context is unavailable.");
@@ -60,7 +169,15 @@ async function canvasToPng(canvas) {
 async function decodeRaster(bytes, mimeType) {
 	if (typeof createImageBitmap !== "function") throw new Error("publishBrowser: createImageBitmap is required for atlas PNG generation.");
 	const copy = bytes.slice();
-	const bitmap = await createImageBitmap(new Blob([copy.buffer], { type: mimeType }));
+	if (mimeType === "image/svg+xml") validateSvg(copy);
+	const blob = new Blob([copy.buffer], { type: mimeType });
+	let bitmap;
+	try {
+		bitmap = await createImageBitmap(blob);
+	} catch (error) {
+		if (mimeType !== "image/svg+xml") throw error;
+		return decodeSvgWithDom(blob);
+	}
 	try {
 		const raster = createRaster(bitmap.width, bitmap.height);
 		getBrowserContext(raster.canvas).drawImage(bitmap, 0, 0);
@@ -69,6 +186,26 @@ async function decodeRaster(bytes, mimeType) {
 		bitmap.close();
 	}
 }
+async function decodeSvgWithDom(blob) {
+	if (typeof globalThis.Image !== "function" || typeof globalThis.URL?.createObjectURL !== "function" || typeof globalThis.URL?.revokeObjectURL !== "function") throw new Error("publishBrowser: createImageBitmap rejected SVG and DOM image decoding is unavailable.");
+	const url = globalThis.URL.createObjectURL(blob);
+	try {
+		const image = new globalThis.Image();
+		await new Promise((resolve, reject) => {
+			image.onload = () => resolve();
+			image.onerror = () => reject(/* @__PURE__ */ new Error("publishBrowser: DOM image decoding failed for SVG."));
+			image.src = url;
+		});
+		const width = image.naturalWidth || image.width;
+		const height = image.naturalHeight || image.height;
+		if (!Number.isFinite(width) || !Number.isFinite(height) || width <= 0 || height <= 0 || width > MAX_SVG_DIMENSION || height > MAX_SVG_DIMENSION || width * height > MAX_SVG_PIXELS) unsafeSvg("decoded dimensions exceed the supported limit");
+		const raster = createRaster(width, height);
+		getBrowserContext(raster.canvas).drawImage(image, 0, 0);
+		return raster;
+	} finally {
+		globalThis.URL.revokeObjectURL(url);
+	}
+}
 var BrowserImagePipeline = class {
 	rawOutput = false;
 	constructor(raster, decode, write) {

package/dist/web.js

@@ -1,6 +1,115 @@
-import { c as resolveCodeGenerationSettings, n as resolvePublishOptions, t as publish } from "./publish--8vagaSA.js";
+import { c as resolveCodeGenerationSettings, n as resolvePublishOptions, t as publish } from "./publish-DXoaC1Nl.js";
 import { ProjectType } from "@openfairygui/core";
+import { XMLParser, XMLValidator } from "fast-xml-parser";
 //#region src/adapters/web/raster.ts
+const MAX_SVG_SOURCE_BYTES = 8 * 1024 * 1024;
+const MAX_SVG_DIMENSION = 16384;
+const MAX_SVG_PIXELS = 64 * 1024 * 1024;
+const MAX_SVG_NODES = 5e4;
+const UNSAFE_SVG_ELEMENTS = new Set([
+	"a",
+	"animate",
+	"animatecolor",
+	"animatemotion",
+	"animatetransform",
+	"audio",
+	"canvas",
+	"discard",
+	"embed",
+	"feimage",
+	"foreignobject",
+	"iframe",
+	"image",
+	"object",
+	"script",
+	"set",
+	"style",
+	"video"
+]);
+function unsafeSvg(message) {
+	throw new Error(`publishBrowser: unsafe SVG input (${message}).`);
+}
+function svgLocalName(name) {
+	return name.split(":").at(-1).toLowerCase();
+}
+function parseSvgLength(value, name) {
+	if (value === void 0) return void 0;
+	const match = String(value).match(/^\s*(?:\d+(?:\.\d+)?|\.\d+)(?:px)?\s*$/iu);
+	if (!match) unsafeSvg(`${name} must use a finite pixel value`);
+	const parsed = Number.parseFloat(match[0]);
+	if (!Number.isFinite(parsed) || parsed <= 0 || parsed > MAX_SVG_DIMENSION) unsafeSvg(`${name} exceeds the supported dimensions`);
+	return parsed;
+}
+function validateSvgAttribute(name, value) {
+	const normalizedName = name.toLowerCase();
+	if (normalizedName === "xmlns" || normalizedName.startsWith("xmlns:")) return;
+	const localName = svgLocalName(name);
+	const text = String(value);
+	if (localName.startsWith("on")) unsafeSvg(`event attribute "${name}" is not allowed`);
+	if (localName === "style" || localName === "src") unsafeSvg(`attribute "${name}" is not allowed`);
+	if (localName === "href" && !/^#[A-Za-z_][\w:.-]*$/u.test(text)) unsafeSvg(`external reference in "${name}" is not allowed`);
+	if (/(?:^|[\s("'=])(?:https?:|file:|javascript:|data:|\/\/)/iu.test(text)) unsafeSvg(`external URL in "${name}" is not allowed`);
+	for (const match of text.matchAll(/url\s*\(([^)]*)\)/giu)) {
+		const reference = (match[1] ?? "").trim().replace(/^(['"])(.*)\1$/u, "$2");
+		if (!/^#[A-Za-z_][\w:.-]*$/u.test(reference)) unsafeSvg(`external url() in "${name}" is not allowed`);
+	}
+}
+function visitSvgEntry(entry) {
+	const pending = [entry];
+	let nodeCount = 0;
+	while (pending.length > 0) {
+		const current = pending.pop();
+		for (const [name, value] of Object.entries(current)) {
+			if (name === ":@" || name.startsWith("#") || name.startsWith("?")) continue;
+			if (++nodeCount > MAX_SVG_NODES) unsafeSvg("node count exceeds the supported limit");
+			const localName = svgLocalName(name);
+			if (UNSAFE_SVG_ELEMENTS.has(localName)) unsafeSvg(`element <${name}> is not allowed`);
+			for (const [attributeName, attributeValue] of Object.entries(current[":@"] ?? {})) validateSvgAttribute(attributeName, attributeValue);
+			if (Array.isArray(value)) {
+				for (const child of value) if (child && typeof child === "object" && !Array.isArray(child)) pending.push(child);
+			}
+		}
+	}
+}
+function validateSvg(bytes) {
+	if (bytes.byteLength === 0 || bytes.byteLength > MAX_SVG_SOURCE_BYTES) unsafeSvg("source size is unsupported");
+	let source;
+	try {
+		source = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+	} catch {
+		unsafeSvg("source is not valid UTF-8");
+	}
+	if (/<!\s*(?:doctype|entity)\b|<\?xml-stylesheet\b/iu.test(source)) unsafeSvg("DTD, entities, and stylesheets are not allowed");
+	if (XMLValidator.validate(source, { allowBooleanAttributes: false }) !== true) unsafeSvg("source is not well-formed XML");
+	const roots = new XMLParser({
+		preserveOrder: true,
+		ignoreAttributes: false,
+		attributeNamePrefix: "",
+		parseAttributeValue: false,
+		parseTagValue: false,
+		processEntities: false,
+		trimValues: false
+	}).parse(source).flatMap((entry) => Object.keys(entry).filter((name) => name !== ":@" && !name.startsWith("#") && !name.startsWith("?")).map((name) => ({
+		entry,
+		name
+	})));
+	if (roots.length !== 1 || svgLocalName(roots[0].name) !== "svg") unsafeSvg("a single <svg> root is required");
+	const root = roots[0].entry;
+	visitSvgEntry(root);
+	const attributes = root[":@"] ?? {};
+	const width = parseSvgLength(attributes.width, "width");
+	const height = parseSvgLength(attributes.height, "height");
+	let viewBoxWidth;
+	let viewBoxHeight;
+	if (attributes.viewBox !== void 0) {
+		const viewBox = String(attributes.viewBox).trim().split(/[\s,]+/u).map(Number);
+		if (viewBox.length !== 4 || viewBox.some((value) => !Number.isFinite(value)) || viewBox[2] <= 0 || viewBox[3] <= 0) unsafeSvg("viewBox must contain four finite values with positive dimensions");
+		viewBoxWidth = viewBox[2];
+		viewBoxHeight = viewBox[3];
+		if (viewBoxWidth > MAX_SVG_DIMENSION || viewBoxHeight > MAX_SVG_DIMENSION) unsafeSvg("viewBox exceeds the supported dimensions");
+	}
+	if ((width ?? viewBoxWidth ?? 300) * (height ?? viewBoxHeight ?? 150) > MAX_SVG_PIXELS) unsafeSvg("pixel count exceeds the supported limit");
+}
 function getBrowserContext(canvas) {
 	const context = canvas.getContext("2d");
 	if (!context) throw new Error("publishBrowser: a 2D canvas context is unavailable.");
@@ -59,7 +168,15 @@ async function canvasToPng(canvas) {
 async function decodeRaster(bytes, mimeType) {
 	if (typeof createImageBitmap !== "function") throw new Error("publishBrowser: createImageBitmap is required for atlas PNG generation.");
 	const copy = bytes.slice();
-	const bitmap = await createImageBitmap(new Blob([copy.buffer], { type: mimeType }));
+	if (mimeType === "image/svg+xml") validateSvg(copy);
+	const blob = new Blob([copy.buffer], { type: mimeType });
+	let bitmap;
+	try {
+		bitmap = await createImageBitmap(blob);
+	} catch (error) {
+		if (mimeType !== "image/svg+xml") throw error;
+		return decodeSvgWithDom(blob);
+	}
 	try {
 		const raster = createRaster(bitmap.width, bitmap.height);
 		getBrowserContext(raster.canvas).drawImage(bitmap, 0, 0);
@@ -68,6 +185,26 @@ async function decodeRaster(bytes, mimeType) {
 		bitmap.close();
 	}
 }
+async function decodeSvgWithDom(blob) {
+	if (typeof globalThis.Image !== "function" || typeof globalThis.URL?.createObjectURL !== "function" || typeof globalThis.URL?.revokeObjectURL !== "function") throw new Error("publishBrowser: createImageBitmap rejected SVG and DOM image decoding is unavailable.");
+	const url = globalThis.URL.createObjectURL(blob);
+	try {
+		const image = new globalThis.Image();
+		await new Promise((resolve, reject) => {
+			image.onload = () => resolve();
+			image.onerror = () => reject(/* @__PURE__ */ new Error("publishBrowser: DOM image decoding failed for SVG."));
+			image.src = url;
+		});
+		const width = image.naturalWidth || image.width;
+		const height = image.naturalHeight || image.height;
+		if (!Number.isFinite(width) || !Number.isFinite(height) || width <= 0 || height <= 0 || width > MAX_SVG_DIMENSION || height > MAX_SVG_DIMENSION || width * height > MAX_SVG_PIXELS) unsafeSvg("decoded dimensions exceed the supported limit");
+		const raster = createRaster(width, height);
+		getBrowserContext(raster.canvas).drawImage(image, 0, 0);
+		return raster;
+	} finally {
+		globalThis.URL.revokeObjectURL(url);
+	}
+}
 var BrowserImagePipeline = class {
 	rawOutput = false;
 	constructor(raster, decode, write) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openfairygui/functions",
-  "version": "0.2.0-alpha.35",
+  "version": "0.2.0-alpha.36",
   "description": "FairyGUI Headless Authoring SDK — composable transform functions.",
   "author": "OpenFairyGUI Contributors",
   "license": "MIT",
@@ -73,8 +73,9 @@
     "publish"
   ],
   "dependencies": {
+    "fast-xml-parser": "^5.0.0",
     "jiti": "^2.6.1",
-    "@openfairygui/core": "0.2.0-alpha.35"
+    "@openfairygui/core": "0.2.0-alpha.36"
   },
   "optionalDependencies": {
     "sharp": ">=0.33.0"

package/src/adapters/web/raster.ts

@@ -6,6 +6,7 @@ import type {
 	PublishFileSystem,
 	PublishSourceFileSystem,
 } from '../../publish/contracts.js';
+import { XMLParser, XMLValidator } from 'fast-xml-parser';
 
 type BrowserCanvas = OffscreenCanvas | HTMLCanvasElement;
 
@@ -39,6 +40,137 @@ interface BrowserRaster {
 	height: number;
 }
 
+const MAX_SVG_SOURCE_BYTES = 8 * 1024 * 1024;
+const MAX_SVG_DIMENSION = 16_384;
+const MAX_SVG_PIXELS = 64 * 1024 * 1024;
+const MAX_SVG_NODES = 50_000;
+const UNSAFE_SVG_ELEMENTS = new Set([
+	'a',
+	'animate',
+	'animatecolor',
+	'animatemotion',
+	'animatetransform',
+	'audio',
+	'canvas',
+	'discard',
+	'embed',
+	'feimage',
+	'foreignobject',
+	'iframe',
+	'image',
+	'object',
+	'script',
+	'set',
+	'style',
+	'video',
+]);
+
+type ParsedSvgEntry = Record<string, unknown> & { ':@'?: Record<string, unknown> };
+
+function unsafeSvg(message: string): never {
+	throw new Error(`publishBrowser: unsafe SVG input (${message}).`);
+}
+
+function svgLocalName(name: string): string {
+	return name.split(':').at(-1)!.toLowerCase();
+}
+
+function parseSvgLength(value: unknown, name: string): number | undefined {
+	if (value === undefined) return undefined;
+	const match = String(value).match(/^\s*(?:\d+(?:\.\d+)?|\.\d+)(?:px)?\s*$/iu);
+	if (!match) unsafeSvg(`${name} must use a finite pixel value`);
+	const parsed = Number.parseFloat(match[0]);
+	if (!Number.isFinite(parsed) || parsed <= 0 || parsed > MAX_SVG_DIMENSION) {
+		unsafeSvg(`${name} exceeds the supported dimensions`);
+	}
+	return parsed;
+}
+
+function validateSvgAttribute(name: string, value: unknown): void {
+	const normalizedName = name.toLowerCase();
+	if (normalizedName === 'xmlns' || normalizedName.startsWith('xmlns:')) return;
+	const localName = svgLocalName(name);
+	const text = String(value);
+	if (localName.startsWith('on')) unsafeSvg(`event attribute "${name}" is not allowed`);
+	if (localName === 'style' || localName === 'src') unsafeSvg(`attribute "${name}" is not allowed`);
+	if (localName === 'href' && !/^#[A-Za-z_][\w:.-]*$/u.test(text)) {
+		unsafeSvg(`external reference in "${name}" is not allowed`);
+	}
+	if (/(?:^|[\s("'=])(?:https?:|file:|javascript:|data:|\/\/)/iu.test(text)) {
+		unsafeSvg(`external URL in "${name}" is not allowed`);
+	}
+	for (const match of text.matchAll(/url\s*\(([^)]*)\)/giu)) {
+		const reference = (match[1] ?? '').trim().replace(/^(['"])(.*)\1$/u, '$2');
+		if (!/^#[A-Za-z_][\w:.-]*$/u.test(reference)) unsafeSvg(`external url() in "${name}" is not allowed`);
+	}
+}
+
+function visitSvgEntry(entry: ParsedSvgEntry): void {
+	const pending = [entry];
+	let nodeCount = 0;
+	while (pending.length > 0) {
+		const current = pending.pop()!;
+		for (const [name, value] of Object.entries(current)) {
+			if (name === ':@' || name.startsWith('#') || name.startsWith('?')) continue;
+			if (++nodeCount > MAX_SVG_NODES) unsafeSvg('node count exceeds the supported limit');
+			const localName = svgLocalName(name);
+			if (UNSAFE_SVG_ELEMENTS.has(localName)) unsafeSvg(`element <${name}> is not allowed`);
+			for (const [attributeName, attributeValue] of Object.entries(current[':@'] ?? {})) {
+				validateSvgAttribute(attributeName, attributeValue);
+			}
+			if (Array.isArray(value)) {
+				for (const child of value) {
+					if (child && typeof child === 'object' && !Array.isArray(child)) pending.push(child as ParsedSvgEntry);
+				}
+			}
+		}
+	}
+}
+
+function validateSvg(bytes: Uint8Array): void {
+	if (bytes.byteLength === 0 || bytes.byteLength > MAX_SVG_SOURCE_BYTES) unsafeSvg('source size is unsupported');
+	let source: string;
+	try {
+		source = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+	} catch {
+		unsafeSvg('source is not valid UTF-8');
+	}
+	if (/<!\s*(?:doctype|entity)\b|<\?xml-stylesheet\b/iu.test(source)) unsafeSvg('DTD, entities, and stylesheets are not allowed');
+	if (XMLValidator.validate(source, { allowBooleanAttributes: false }) !== true) unsafeSvg('source is not well-formed XML');
+	const parsed = new XMLParser({
+		preserveOrder: true,
+		ignoreAttributes: false,
+		attributeNamePrefix: '',
+		parseAttributeValue: false,
+		parseTagValue: false,
+		processEntities: false,
+		trimValues: false,
+	}).parse(source) as ParsedSvgEntry[];
+	const roots = parsed.flatMap((entry) => Object.keys(entry)
+		.filter((name) => name !== ':@' && !name.startsWith('#') && !name.startsWith('?'))
+		.map((name) => ({ entry, name })));
+	if (roots.length !== 1 || svgLocalName(roots[0]!.name) !== 'svg') unsafeSvg('a single <svg> root is required');
+	const root = roots[0]!.entry;
+	visitSvgEntry(root);
+	const attributes = root[':@'] ?? {};
+	const width = parseSvgLength(attributes.width, 'width');
+	const height = parseSvgLength(attributes.height, 'height');
+	let viewBoxWidth: number | undefined;
+	let viewBoxHeight: number | undefined;
+	if (attributes.viewBox !== undefined) {
+		const viewBox = String(attributes.viewBox).trim().split(/[\s,]+/u).map(Number);
+		if (viewBox.length !== 4 || viewBox.some((value) => !Number.isFinite(value)) || viewBox[2]! <= 0 || viewBox[3]! <= 0) {
+			unsafeSvg('viewBox must contain four finite values with positive dimensions');
+		}
+		viewBoxWidth = viewBox[2];
+		viewBoxHeight = viewBox[3];
+		if (viewBoxWidth > MAX_SVG_DIMENSION || viewBoxHeight > MAX_SVG_DIMENSION) unsafeSvg('viewBox exceeds the supported dimensions');
+	}
+	const rasterWidth = width ?? viewBoxWidth ?? 300;
+	const rasterHeight = height ?? viewBoxHeight ?? 150;
+	if (rasterWidth * rasterHeight > MAX_SVG_PIXELS) unsafeSvg('pixel count exceeds the supported limit');
+}
+
 function getBrowserContext(canvas: BrowserCanvas): BrowserContext {
 	const context = canvas.getContext('2d');
 	if (!context) throw new Error('publishBrowser: a 2D canvas context is unavailable.');
@@ -115,7 +247,15 @@ async function decodeRaster(bytes: Uint8Array, mimeType: string): Promise<Browse
 		throw new Error('publishBrowser: createImageBitmap is required for atlas PNG generation.');
 	}
 	const copy = bytes.slice();
-	const bitmap = await createImageBitmap(new Blob([copy.buffer as ArrayBuffer], { type: mimeType }));
+	if (mimeType === 'image/svg+xml') validateSvg(copy);
+	const blob = new Blob([copy.buffer as ArrayBuffer], { type: mimeType });
+	let bitmap: ImageBitmap;
+	try {
+		bitmap = await createImageBitmap(blob);
+	} catch (error) {
+		if (mimeType !== 'image/svg+xml') throw error;
+		return decodeSvgWithDom(blob);
+	}
 	try {
 		const raster = createRaster(bitmap.width, bitmap.height);
 		getBrowserContext(raster.canvas).drawImage(bitmap, 0, 0);
@@ -125,6 +265,36 @@ async function decodeRaster(bytes: Uint8Array, mimeType: string): Promise<Browse
 	}
 }
 
+async function decodeSvgWithDom(blob: Blob): Promise<BrowserRaster> {
+	if (typeof globalThis.Image !== 'function'
+		|| typeof globalThis.URL?.createObjectURL !== 'function'
+		|| typeof globalThis.URL?.revokeObjectURL !== 'function'
+	) {
+		throw new Error('publishBrowser: createImageBitmap rejected SVG and DOM image decoding is unavailable.');
+	}
+	const url = globalThis.URL.createObjectURL(blob);
+	try {
+		const image = new globalThis.Image();
+		await new Promise<void>((resolve, reject) => {
+			image.onload = () => resolve();
+			image.onerror = () => reject(new Error('publishBrowser: DOM image decoding failed for SVG.'));
+			image.src = url;
+		});
+		const width = image.naturalWidth || image.width;
+		const height = image.naturalHeight || image.height;
+		if (!Number.isFinite(width) || !Number.isFinite(height)
+			|| width <= 0 || height <= 0
+			|| width > MAX_SVG_DIMENSION || height > MAX_SVG_DIMENSION
+			|| width * height > MAX_SVG_PIXELS
+		) unsafeSvg('decoded dimensions exceed the supported limit');
+		const raster = createRaster(width, height);
+		getBrowserContext(raster.canvas).drawImage(image, 0, 0);
+		return raster;
+	} finally {
+		globalThis.URL.revokeObjectURL(url);
+	}
+}
+
 class BrowserImagePipeline implements AtlasRasterPipeline {
 	private rawOutput = false;
 

package/src/atlas/inputs.ts

@@ -246,9 +246,12 @@ export async function collectImage(
 					.toBuffer();
 				sourceHasAlpha = true;
 			}
-		} catch {
+		} catch (error) {
 			if (options.strictOutput) {
-				throw new Error(`atlas: Could not read image "${filePath}".`);
+				const detail = error instanceof Error && error.message.startsWith('publishBrowser:')
+					? ` ${error.message}`
+					: '';
+				throw new Error(`atlas: Could not read image "${filePath}".${detail}`);
 			}
 			if (origW === 0 || origH === 0) {
 				logger.warn(`atlas: Could not read image "${filePath}", skipping.`);