@safe-ugc-ui/validator 0.1.0

package/dist/index.js

@@ -0,0 +1,1870 @@
+// src/index.ts
+import { CARD_JSON_MAX_BYTES } from "@safe-ugc-ui/types";
+
+// src/result.ts
+function createError(code, message, path) {
+  return { code, message, path };
+}
+function validResult() {
+  return { valid: true, errors: [] };
+}
+function invalidResult(errors) {
+  return { valid: false, errors };
+}
+function toResult(errors) {
+  return {
+    valid: errors.length === 0,
+    errors
+  };
+}
+function merge(...results) {
+  const errors = [];
+  for (const r of results) {
+    errors.push(...r.errors);
+  }
+  return {
+    valid: errors.length === 0,
+    errors
+  };
+}
+
+// src/schema.ts
+import { ugcCardSchema } from "@safe-ugc-ui/types";
+function validateSchema(input) {
+  const errors = [];
+  if (typeof input !== "object" || input === null || Array.isArray(input)) {
+    errors.push(
+      createError("SCHEMA_ERROR", "Card must be a plain object.", "")
+    );
+    return toResult(errors);
+  }
+  const obj = input;
+  if (!obj.meta) {
+    errors.push(
+      createError("MISSING_FIELD", 'Card is missing required field "meta".', "meta")
+    );
+  }
+  if (!obj.views) {
+    errors.push(
+      createError("MISSING_FIELD", 'Card is missing required field "views".', "views")
+    );
+  }
+  if (errors.length > 0) {
+    return toResult(errors);
+  }
+  if (typeof obj.meta !== "object" || obj.meta === null) {
+    errors.push(
+      createError("INVALID_TYPE", '"meta" must be an object.', "meta")
+    );
+    return toResult(errors);
+  }
+  const meta = obj.meta;
+  if (typeof meta.name !== "string") {
+    errors.push(
+      createError("MISSING_FIELD", '"meta.name" is required and must be a string.', "meta.name")
+    );
+  }
+  if (typeof meta.version !== "string") {
+    errors.push(
+      createError("MISSING_FIELD", '"meta.version" is required and must be a string.', "meta.version")
+    );
+  }
+  if (typeof obj.views !== "object" || obj.views === null || Array.isArray(obj.views)) {
+    errors.push(
+      createError("INVALID_TYPE", '"views" must be an object.', "views")
+    );
+    return toResult(errors);
+  }
+  const views = obj.views;
+  if (Object.keys(views).length === 0) {
+    errors.push(
+      createError("MISSING_FIELD", '"views" must contain at least one view.', "views")
+    );
+  }
+  if (errors.length > 0) {
+    return toResult(errors);
+  }
+  const result = ugcCardSchema.safeParse(input);
+  if (!result.success) {
+    for (const issue of result.error.issues) {
+      const path = issue.path.join(".");
+      errors.push(
+        createError("SCHEMA_ERROR", issue.message, path)
+      );
+    }
+  }
+  return toResult(errors);
+}
+function parseCard(input) {
+  const result = ugcCardSchema.safeParse(input);
+  return result.success ? result.data : null;
+}
+
+// src/node-validator.ts
+import { ALL_COMPONENT_TYPES } from "@safe-ugc-ui/types";
+
+// src/traverse.ts
+function isForLoop(children) {
+  return typeof children === "object" && children !== null && "for" in children && "in" in children && "template" in children;
+}
+function hasOverflowAuto(style) {
+  return style?.overflow === "auto";
+}
+function traverseNode(node, context, visitor) {
+  const result = visitor(node, context);
+  if (result === false) {
+    return;
+  }
+  const children = node.children;
+  if (children == null) {
+    return;
+  }
+  const nextStackDepth = node.type === "Stack" ? context.stackDepth + 1 : context.stackDepth;
+  const nextOverflowAuto = context.overflowAutoAncestor || hasOverflowAuto(node.style);
+  if (isForLoop(children)) {
+    const childCtx = {
+      path: `${context.path}.children.template`,
+      depth: context.depth + 1,
+      parentType: node.type,
+      loopDepth: context.loopDepth + 1,
+      overflowAutoAncestor: nextOverflowAuto,
+      stackDepth: nextStackDepth
+    };
+    traverseNode(children.template, childCtx, visitor);
+  } else if (Array.isArray(children)) {
+    for (let i = 0; i < children.length; i++) {
+      const child = children[i];
+      if (child && typeof child === "object" && "type" in child) {
+        const childCtx = {
+          path: `${context.path}.children[${i}]`,
+          depth: context.depth + 1,
+          parentType: node.type,
+          loopDepth: context.loopDepth,
+          overflowAutoAncestor: nextOverflowAuto,
+          stackDepth: nextStackDepth
+        };
+        traverseNode(child, childCtx, visitor);
+      }
+    }
+  }
+}
+function traverseCard(views, visitor) {
+  for (const [viewName, rootNode] of Object.entries(views)) {
+    if (rootNode == null || typeof rootNode !== "object" || !("type" in rootNode)) {
+      continue;
+    }
+    const context = {
+      path: `views.${viewName}`,
+      depth: 0,
+      parentType: null,
+      loopDepth: 0,
+      overflowAutoAncestor: false,
+      stackDepth: 0
+    };
+    traverseNode(rootNode, context, visitor);
+  }
+}
+
+// src/node-validator.ts
+var REQUIRED_FIELDS = {
+  Text: ["content"],
+  Image: ["src"],
+  ProgressBar: ["value", "max"],
+  Avatar: ["src"],
+  Icon: ["name"],
+  Badge: ["label"],
+  Chip: ["label"],
+  Button: ["label", "action"],
+  Toggle: ["value", "onToggle"]
+};
+var KNOWN_TYPES = new Set(ALL_COMPONENT_TYPES);
+function looksLikeForLoop(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) && "for" in value && "in" in value && "template" in value;
+}
+function validateForLoop(children, path) {
+  const errors = [];
+  if (typeof children["for"] !== "string") {
+    errors.push(
+      createError(
+        "INVALID_VALUE",
+        'ForLoop "for" must be a string.',
+        `${path}.children.for`
+      )
+    );
+  }
+  const inValue = children["in"];
+  if (typeof inValue !== "string" || !inValue.startsWith("$")) {
+    errors.push(
+      createError(
+        "INVALID_VALUE",
+        'ForLoop "in" must be a string starting with "$".',
+        `${path}.children.in`
+      )
+    );
+  }
+  const template = children["template"];
+  if (typeof template !== "object" || template === null || !("type" in template)) {
+    errors.push(
+      createError(
+        "INVALID_VALUE",
+        'ForLoop "template" must be an object with a "type" property.',
+        `${path}.children.template`
+      )
+    );
+  }
+  return errors;
+}
+function validateNode(node, context) {
+  const errors = [];
+  const { path } = context;
+  if (!KNOWN_TYPES.has(node.type)) {
+    errors.push(
+      createError(
+        "UNKNOWN_NODE_TYPE",
+        `Unknown node type "${node.type}".`,
+        path
+      )
+    );
+    return errors;
+  }
+  const requiredFields = REQUIRED_FIELDS[node.type];
+  if (requiredFields && requiredFields.length > 0) {
+    for (const field of requiredFields) {
+      if (!(field in node) || node[field] === void 0) {
+        errors.push(
+          createError(
+            "MISSING_FIELD",
+            `"${node.type}" node is missing required field "${field}".`,
+            `${path}.${field}`
+          )
+        );
+      }
+    }
+  }
+  if (node.children != null && looksLikeForLoop(node.children)) {
+    errors.push(
+      ...validateForLoop(
+        node.children,
+        path
+      )
+    );
+  }
+  return errors;
+}
+function validateNodes(views) {
+  const errors = [];
+  traverseCard(views, (node, context) => {
+    errors.push(...validateNode(node, context));
+  });
+  return errors;
+}
+
+// src/value-types.ts
+import { isRef, isExpr } from "@safe-ugc-ui/types";
+var STATIC_ONLY_STYLE_PROPERTIES = /* @__PURE__ */ new Set([
+  // Position / layout
+  "position",
+  "top",
+  "right",
+  "bottom",
+  "left",
+  // Transform
+  "transform",
+  // Gradient
+  "backgroundGradient",
+  // Overflow
+  "overflow",
+  // Borders
+  "border",
+  "borderTop",
+  "borderRight",
+  "borderBottom",
+  "borderLeft",
+  // Shadow
+  "boxShadow",
+  // Stacking
+  "zIndex"
+]);
+function validateNodeFields(node, ctx, errors) {
+  const nodeType = node.type;
+  if (nodeType === "Image" || nodeType === "Avatar") {
+    const src = node.src;
+    if (src !== void 0 && isExpr(src)) {
+      errors.push(
+        createError(
+          "EXPR_NOT_ALLOWED",
+          `${nodeType}.src does not allow $expr bindings.`,
+          `${ctx.path}.src`
+        )
+      );
+    }
+  }
+  if (nodeType === "Icon") {
+    const name = node.name;
+    if (name !== void 0 && isRef(name)) {
+      errors.push(
+        createError(
+          "REF_NOT_ALLOWED",
+          "Icon.name does not allow $ref bindings.",
+          `${ctx.path}.name`
+        )
+      );
+    }
+    if (name !== void 0 && isExpr(name)) {
+      errors.push(
+        createError(
+          "EXPR_NOT_ALLOWED",
+          "Icon.name does not allow $expr bindings.",
+          `${ctx.path}.name`
+        )
+      );
+    }
+  }
+}
+function validateNodeStyle(node, ctx, errors) {
+  const style = node.style;
+  if (!style) {
+    return;
+  }
+  for (const [prop, value] of Object.entries(style)) {
+    if (value === void 0) {
+      continue;
+    }
+    if (STATIC_ONLY_STYLE_PROPERTIES.has(prop)) {
+      if (isRef(value) || isExpr(value)) {
+        errors.push(
+          createError(
+            "DYNAMIC_NOT_ALLOWED",
+            `Style property "${prop}" must be a static literal; $ref and $expr are not allowed.`,
+            `${ctx.path}.style.${prop}`
+          )
+        );
+      }
+    }
+  }
+}
+function validateValueTypes(views) {
+  const errors = [];
+  traverseCard(views, (node, ctx) => {
+    validateNodeFields(node, ctx, errors);
+    validateNodeStyle(node, ctx, errors);
+  });
+  return errors;
+}
+
+// src/style-validator.ts
+import {
+  FORBIDDEN_STYLE_PROPERTIES,
+  DANGEROUS_CSS_FUNCTIONS,
+  ZINDEX_MIN,
+  ZINDEX_MAX,
+  TRANSFORM_SCALE_MIN,
+  TRANSFORM_SCALE_MAX,
+  TRANSFORM_TRANSLATE_MIN,
+  TRANSFORM_TRANSLATE_MAX,
+  FONT_SIZE_MIN,
+  FONT_SIZE_MAX,
+  BOX_SHADOW_MAX_COUNT,
+  BOX_SHADOW_BLUR_MAX,
+  BOX_SHADOW_SPREAD_MAX,
+  BORDER_RADIUS_MAX,
+  LETTER_SPACING_MIN,
+  LETTER_SPACING_MAX,
+  OPACITY_MIN,
+  OPACITY_MAX,
+  CSS_NAMED_COLORS,
+  isRef as isRef2,
+  isExpr as isExpr2
+} from "@safe-ugc-ui/types";
+var COLOR_PROPERTIES = /* @__PURE__ */ new Set(["backgroundColor", "color"]);
+var LENGTH_PROPERTIES = /* @__PURE__ */ new Set([
+  "width",
+  "height",
+  "minWidth",
+  "maxWidth",
+  "minHeight",
+  "maxHeight",
+  "padding",
+  "paddingTop",
+  "paddingRight",
+  "paddingBottom",
+  "paddingLeft",
+  "margin",
+  "marginTop",
+  "marginRight",
+  "marginBottom",
+  "marginLeft",
+  "top",
+  "right",
+  "bottom",
+  "left",
+  "gap",
+  "lineHeight"
+]);
+var LENGTH_AUTO_ALLOWED = /* @__PURE__ */ new Set([
+  "width",
+  "height",
+  "minWidth",
+  "maxWidth",
+  "minHeight",
+  "maxHeight",
+  "margin",
+  "marginTop",
+  "marginRight",
+  "marginBottom",
+  "marginLeft"
+]);
+var RANGE_LENGTH_PROPERTIES = {
+  fontSize: { min: FONT_SIZE_MIN, max: FONT_SIZE_MAX },
+  letterSpacing: { min: LETTER_SPACING_MIN, max: LETTER_SPACING_MAX },
+  borderRadius: { min: 0, max: BORDER_RADIUS_MAX },
+  borderRadiusTopLeft: { min: 0, max: BORDER_RADIUS_MAX },
+  borderRadiusTopRight: { min: 0, max: BORDER_RADIUS_MAX },
+  borderRadiusBottomLeft: { min: 0, max: BORDER_RADIUS_MAX },
+  borderRadiusBottomRight: { min: 0, max: BORDER_RADIUS_MAX }
+};
+function isLiteralNumber(value) {
+  return typeof value === "number";
+}
+function isLiteralString(value) {
+  return typeof value === "string";
+}
+function isDynamic(value) {
+  return isRef2(value) || isExpr2(value);
+}
+function isValidColor(value) {
+  const lower = value.toLowerCase();
+  if (/^#([0-9a-f]{3}|[0-9a-f]{6}|[0-9a-f]{8})$/.test(lower)) {
+    return true;
+  }
+  if (lower.startsWith("rgb(") || lower.startsWith("rgba(") || lower.startsWith("hsl(") || lower.startsWith("hsla(")) {
+    return true;
+  }
+  if (CSS_NAMED_COLORS.has(lower)) {
+    return true;
+  }
+  if (lower === "transparent" || lower === "currentcolor") {
+    return true;
+  }
+  return false;
+}
+function isValidLength(value) {
+  return /^-?[0-9]+(\.[0-9]+)?(px|%|em|rem)?$/.test(value);
+}
+function parseLengthValue(value) {
+  const match = value.match(/^(-?[0-9]+(\.[0-9]+)?)(px|%|em|rem)?$/);
+  if (!match) {
+    return null;
+  }
+  return Number(match[1]);
+}
+function collectDangerousCssErrors(value, path, errors) {
+  if (typeof value === "string") {
+    const lower = value.toLowerCase();
+    for (const fn of DANGEROUS_CSS_FUNCTIONS) {
+      if (lower.includes(fn)) {
+        errors.push(
+          createError(
+            "FORBIDDEN_CSS_FUNCTION",
+            `Style value contains forbidden CSS function "${fn.slice(0, -1)}" at "${path}"`,
+            path
+          )
+        );
+        break;
+      }
+    }
+    return;
+  }
+  if (isRef2(value) || isExpr2(value)) {
+    return;
+  }
+  if (Array.isArray(value)) {
+    for (let i = 0; i < value.length; i++) {
+      collectDangerousCssErrors(value[i], `${path}[${i}]`, errors);
+    }
+    return;
+  }
+  if (typeof value === "object" && value !== null) {
+    for (const [key, child] of Object.entries(value)) {
+      collectDangerousCssErrors(child, `${path}.${key}`, errors);
+    }
+  }
+}
+function validateShadowObject(shadow, path, errors) {
+  if (isLiteralNumber(shadow.blur) && shadow.blur > BOX_SHADOW_BLUR_MAX) {
+    errors.push(
+      createError(
+        "STYLE_VALUE_OUT_OF_RANGE",
+        `boxShadow blur (${shadow.blur}) exceeds maximum of ${BOX_SHADOW_BLUR_MAX} at "${path}.blur"`,
+        `${path}.blur`
+      )
+    );
+  }
+  if (isLiteralNumber(shadow.spread) && shadow.spread > BOX_SHADOW_SPREAD_MAX) {
+    errors.push(
+      createError(
+        "STYLE_VALUE_OUT_OF_RANGE",
+        `boxShadow spread (${shadow.spread}) exceeds maximum of ${BOX_SHADOW_SPREAD_MAX} at "${path}.spread"`,
+        `${path}.spread`
+      )
+    );
+  }
+  if (isLiteralString(shadow.color) && !isValidColor(shadow.color)) {
+    errors.push(
+      createError(
+        "INVALID_COLOR",
+        `Invalid color "${shadow.color}" at "${path}.color"`,
+        `${path}.color`
+      )
+    );
+  }
+}
+var STYLE_NAME_PATTERN = /^[A-Za-z][A-Za-z0-9_-]*$/;
+function validateSingleStyle(style, stylePath, errors) {
+  for (const key of Object.keys(style)) {
+    if (FORBIDDEN_STYLE_PROPERTIES.includes(key)) {
+      errors.push(
+        createError(
+          "FORBIDDEN_STYLE_PROPERTY",
+          `Style property "${key}" is forbidden at "${stylePath}.${key}"`,
+          `${stylePath}.${key}`
+        )
+      );
+    }
+  }
+  if ("zIndex" in style && isLiteralNumber(style.zIndex)) {
+    const v = style.zIndex;
+    if (v < ZINDEX_MIN || v > ZINDEX_MAX) {
+      errors.push(
+        createError(
+          "STYLE_VALUE_OUT_OF_RANGE",
+          `zIndex (${v}) must be between ${ZINDEX_MIN} and ${ZINDEX_MAX} at "${stylePath}.zIndex"`,
+          `${stylePath}.zIndex`
+        )
+      );
+    }
+  }
+  if ("fontSize" in style && isLiteralNumber(style.fontSize)) {
+    const v = style.fontSize;
+    if (v < FONT_SIZE_MIN || v > FONT_SIZE_MAX) {
+      errors.push(
+        createError(
+          "STYLE_VALUE_OUT_OF_RANGE",
+          `fontSize (${v}) must be between ${FONT_SIZE_MIN} and ${FONT_SIZE_MAX} at "${stylePath}.fontSize"`,
+          `${stylePath}.fontSize`
+        )
+      );
+    }
+  }
+  if ("opacity" in style && isLiteralNumber(style.opacity)) {
+    const v = style.opacity;
+    if (v < OPACITY_MIN || v > OPACITY_MAX) {
+      errors.push(
+        createError(
+          "STYLE_VALUE_OUT_OF_RANGE",
+          `opacity (${v}) must be between ${OPACITY_MIN} and ${OPACITY_MAX} at "${stylePath}.opacity"`,
+          `${stylePath}.opacity`
+        )
+      );
+    }
+  }
+  if ("letterSpacing" in style && isLiteralNumber(style.letterSpacing)) {
+    const v = style.letterSpacing;
+    if (v < LETTER_SPACING_MIN || v > LETTER_SPACING_MAX) {
+      errors.push(
+        createError(
+          "STYLE_VALUE_OUT_OF_RANGE",
+          `letterSpacing (${v}) must be between ${LETTER_SPACING_MIN} and ${LETTER_SPACING_MAX} at "${stylePath}.letterSpacing"`,
+          `${stylePath}.letterSpacing`
+        )
+      );
+    }
+  }
+  for (const prop of [
+    "borderRadius",
+    "borderRadiusTopLeft",
+    "borderRadiusTopRight",
+    "borderRadiusBottomLeft",
+    "borderRadiusBottomRight"
+  ]) {
+    if (prop in style && isLiteralNumber(style[prop])) {
+      const v = style[prop];
+      if (v < 0 || v > BORDER_RADIUS_MAX) {
+        errors.push(
+          createError(
+            "STYLE_VALUE_OUT_OF_RANGE",
+            `${prop} (${v}) must be between 0 and ${BORDER_RADIUS_MAX} at "${stylePath}.${prop}"`,
+            `${stylePath}.${prop}`
+          )
+        );
+      }
+    }
+  }
+  if ("transform" in style && typeof style.transform === "object" && style.transform !== null && !isDynamic(style.transform)) {
+    const transform = style.transform;
+    const transformPath = `${stylePath}.transform`;
+    if ("scale" in transform && isLiteralNumber(transform.scale)) {
+      const v = transform.scale;
+      if (v < TRANSFORM_SCALE_MIN || v > TRANSFORM_SCALE_MAX) {
+        errors.push(
+          createError(
+            "STYLE_VALUE_OUT_OF_RANGE",
+            `transform.scale (${v}) must be between ${TRANSFORM_SCALE_MIN} and ${TRANSFORM_SCALE_MAX} at "${transformPath}.scale"`,
+            `${transformPath}.scale`
+          )
+        );
+      }
+    }
+    if ("translateX" in transform && isLiteralNumber(transform.translateX)) {
+      const v = transform.translateX;
+      if (v < TRANSFORM_TRANSLATE_MIN || v > TRANSFORM_TRANSLATE_MAX) {
+        errors.push(
+          createError(
+            "STYLE_VALUE_OUT_OF_RANGE",
+            `transform.translateX (${v}) must be between ${TRANSFORM_TRANSLATE_MIN} and ${TRANSFORM_TRANSLATE_MAX} at "${transformPath}.translateX"`,
+            `${transformPath}.translateX`
+          )
+        );
+      }
+    }
+    if ("translateY" in transform && isLiteralNumber(transform.translateY)) {
+      const v = transform.translateY;
+      if (v < TRANSFORM_TRANSLATE_MIN || v > TRANSFORM_TRANSLATE_MAX) {
+        errors.push(
+          createError(
+            "STYLE_VALUE_OUT_OF_RANGE",
+            `transform.translateY (${v}) must be between ${TRANSFORM_TRANSLATE_MIN} and ${TRANSFORM_TRANSLATE_MAX} at "${transformPath}.translateY"`,
+            `${transformPath}.translateY`
+          )
+        );
+      }
+    }
+    if ("skew" in transform) {
+      errors.push(
+        createError(
+          "TRANSFORM_SKEW_FORBIDDEN",
+          `transform.skew is forbidden at "${transformPath}.skew"`,
+          `${transformPath}.skew`
+        )
+      );
+    }
+  }
+  if ("boxShadow" in style && style.boxShadow != null) {
+    const boxShadow = style.boxShadow;
+    const boxShadowPath = `${stylePath}.boxShadow`;
+    if (Array.isArray(boxShadow)) {
+      if (boxShadow.length > BOX_SHADOW_MAX_COUNT) {
+        errors.push(
+          createError(
+            "STYLE_VALUE_OUT_OF_RANGE",
+            `boxShadow has ${boxShadow.length} entries, maximum is ${BOX_SHADOW_MAX_COUNT} at "${boxShadowPath}"`,
+            boxShadowPath
+          )
+        );
+      }
+      for (let i = 0; i < boxShadow.length; i++) {
+        const shadow = boxShadow[i];
+        if (typeof shadow === "object" && shadow !== null) {
+          validateShadowObject(
+            shadow,
+            `${boxShadowPath}[${i}]`,
+            errors
+          );
+        }
+      }
+    } else if (typeof boxShadow === "object" && boxShadow !== null) {
+      validateShadowObject(
+        boxShadow,
+        boxShadowPath,
+        errors
+      );
+    }
+  }
+  for (const [key, value] of Object.entries(style)) {
+    collectDangerousCssErrors(value, `${stylePath}.${key}`, errors);
+  }
+  if ("overflow" in style && style.overflow === "scroll") {
+    errors.push(
+      createError(
+        "FORBIDDEN_OVERFLOW_VALUE",
+        `overflow "scroll" is forbidden; use "visible", "hidden", or "auto" at "${stylePath}.overflow"`,
+        `${stylePath}.overflow`
+      )
+    );
+  }
+  for (const prop of COLOR_PROPERTIES) {
+    if (prop in style && isLiteralString(style[prop]) && !isDynamic(style[prop])) {
+      if (!isValidColor(style[prop])) {
+        errors.push(
+          createError(
+            "INVALID_COLOR",
+            `Invalid color "${style[prop]}" at "${stylePath}.${prop}"`,
+            `${stylePath}.${prop}`
+          )
+        );
+      }
+    }
+  }
+  for (const prop of LENGTH_PROPERTIES) {
+    if (prop in style && isLiteralString(style[prop]) && !isDynamic(style[prop])) {
+      const val = style[prop];
+      if (val === "auto") {
+        if (!LENGTH_AUTO_ALLOWED.has(prop)) {
+          errors.push(
+            createError(
+              "INVALID_LENGTH",
+              `"auto" is not allowed for "${prop}" at "${stylePath}.${prop}"`,
+              `${stylePath}.${prop}`
+            )
+          );
+        }
+      } else if (!isValidLength(val)) {
+        errors.push(
+          createError(
+            "INVALID_LENGTH",
+            `Invalid length "${val}" at "${stylePath}.${prop}"`,
+            `${stylePath}.${prop}`
+          )
+        );
+      }
+    }
+  }
+  for (const [prop, range] of Object.entries(RANGE_LENGTH_PROPERTIES)) {
+    if (prop in style && isLiteralString(style[prop]) && !isDynamic(style[prop])) {
+      const numericValue = parseLengthValue(style[prop]);
+      if (numericValue !== null) {
+        if (numericValue < range.min || numericValue > range.max) {
+          errors.push(
+            createError(
+              "STYLE_VALUE_OUT_OF_RANGE",
+              `${prop} (${style[prop]}) must be between ${range.min} and ${range.max} at "${stylePath}.${prop}"`,
+              `${stylePath}.${prop}`
+            )
+          );
+        }
+      }
+    }
+  }
+  const borderKeys = ["border", "borderTop", "borderRight", "borderBottom", "borderLeft"];
+  for (const borderKey of borderKeys) {
+    if (borderKey in style && typeof style[borderKey] === "object" && style[borderKey] !== null && !isDynamic(style[borderKey])) {
+      const border = style[borderKey];
+      const borderPath = `${stylePath}.${borderKey}`;
+      if (isLiteralString(border.color) && !isDynamic(border.color) && !isValidColor(border.color)) {
+        errors.push(
+          createError(
+            "INVALID_COLOR",
+            `Invalid color "${border.color}" at "${borderPath}.color"`,
+            `${borderPath}.color`
+          )
+        );
+      }
+    }
+  }
+  if ("backgroundGradient" in style && typeof style.backgroundGradient === "object" && style.backgroundGradient !== null && !isDynamic(style.backgroundGradient)) {
+    const gradient = style.backgroundGradient;
+    const gradientPath = `${stylePath}.backgroundGradient`;
+    if (Array.isArray(gradient.stops)) {
+      for (let i = 0; i < gradient.stops.length; i++) {
+        const stop = gradient.stops[i];
+        if (typeof stop === "object" && stop !== null && !isDynamic(stop)) {
+          const stopObj = stop;
+          if (isLiteralString(stopObj.color) && !isDynamic(stopObj.color) && !isValidColor(stopObj.color)) {
+            errors.push(
+              createError(
+                "INVALID_COLOR",
+                `Invalid color "${stopObj.color}" at "${gradientPath}.stops[${i}].color"`,
+                `${gradientPath}.stops[${i}].color`
+              )
+            );
+          }
+        }
+      }
+    }
+  }
+}
+function mergeStyleWithRef(cardStyleEntry, inlineStyle) {
+  const merged = { ...cardStyleEntry };
+  for (const [key, value] of Object.entries(inlineStyle)) {
+    if (key !== "$style") {
+      merged[key] = value;
+    }
+  }
+  return merged;
+}
+function validateStyles(views, cardStyles) {
+  const errors = [];
+  if (cardStyles) {
+    for (const [styleName, styleEntry] of Object.entries(cardStyles)) {
+      const entryPath = `styles.${styleName}`;
+      if (!STYLE_NAME_PATTERN.test(styleName)) {
+        errors.push(
+          createError(
+            "INVALID_STYLE_NAME",
+            `Style name "${styleName}" is invalid; must match /^[A-Za-z][A-Za-z0-9_-]*$/ at "${entryPath}"`,
+            entryPath
+          )
+        );
+      }
+      if ("$style" in styleEntry) {
+        errors.push(
+          createError(
+            "STYLE_CIRCULAR_REF",
+            `$style cannot be used inside card.styles definitions at "${entryPath}.$style"`,
+            `${entryPath}.$style`
+          )
+        );
+      }
+      validateSingleStyle(styleEntry, entryPath, errors);
+    }
+  }
+  traverseCard(views, (node, ctx) => {
+    const style = node.style;
+    if (style == null || typeof style !== "object") {
+      return;
+    }
+    const stylePath = `${ctx.path}.style`;
+    if ("$style" in style && typeof style.$style === "string") {
+      const rawRef = style.$style;
+      const trimmedRef = rawRef.trim();
+      if (!STYLE_NAME_PATTERN.test(trimmedRef)) {
+        errors.push(
+          createError(
+            "INVALID_STYLE_REF",
+            `$style value "${rawRef}" is invalid; must match /^[A-Za-z][A-Za-z0-9_-]*$/ at "${stylePath}.$style"`,
+            `${stylePath}.$style`
+          )
+        );
+        return;
+      }
+      if (!cardStyles || !(trimmedRef in cardStyles)) {
+        errors.push(
+          createError(
+            "STYLE_REF_NOT_FOUND",
+            `$style references "${trimmedRef}" which is not defined in card.styles at "${stylePath}.$style"`,
+            `${stylePath}.$style`
+          )
+        );
+        return;
+      }
+      const mergedStyle = mergeStyleWithRef(cardStyles[trimmedRef], style);
+      validateSingleStyle(mergedStyle, stylePath, errors);
+    } else {
+      validateSingleStyle(style, stylePath, errors);
+    }
+  });
+  return errors;
+}
+
+// src/security.ts
+import {
+  PROTOTYPE_POLLUTION_SEGMENTS,
+  isRef as isRef3
+} from "@safe-ugc-ui/types";
+var FORBIDDEN_URL_PREFIXES = [
+  "http://",
+  "https://",
+  "//",
+  "data:",
+  "javascript:"
+];
+function scanForRefs(obj, path, errors) {
+  if (obj === null || obj === void 0 || typeof obj !== "object") {
+    return;
+  }
+  if (isRef3(obj)) {
+    const refStr = obj.$ref;
+    const segments = refStr.split(/[.\[]/);
+    for (const segment of segments) {
+      const clean = segment.replace(/]$/, "");
+      if (PROTOTYPE_POLLUTION_SEGMENTS.includes(clean)) {
+        errors.push(
+          createError(
+            "PROTOTYPE_POLLUTION",
+            `$ref "${refStr}" contains forbidden prototype pollution segment "${clean}".`,
+            path
+          )
+        );
+        return;
+      }
+    }
+    return;
+  }
+  if (Array.isArray(obj)) {
+    for (let i = 0; i < obj.length; i++) {
+      scanForRefs(obj[i], `${path}[${i}]`, errors);
+    }
+    return;
+  }
+  for (const [key, value] of Object.entries(obj)) {
+    scanForRefs(value, `${path}.${key}`, errors);
+  }
+}
+function isForbiddenUrl(value) {
+  const lower = value.trim().toLowerCase();
+  return FORBIDDEN_URL_PREFIXES.some((prefix) => lower.startsWith(prefix));
+}
+function validateAssetPath(value) {
+  if (!value.startsWith("@assets/")) {
+    return "INVALID_ASSET_PATH";
+  }
+  if (value.includes("../")) {
+    return "ASSET_PATH_TRAVERSAL";
+  }
+  return null;
+}
+function resolveRefFromState(refPath, state) {
+  const path = refPath.startsWith("$") ? refPath.slice(1) : refPath;
+  const dotSegments = path.split(".");
+  const keys = [];
+  for (const dotSeg of dotSegments) {
+    const bracketPattern = /\[(\d+)\]/g;
+    const firstBracket = dotSeg.indexOf("[");
+    const baseName = firstBracket === -1 ? dotSeg : dotSeg.slice(0, firstBracket);
+    if (baseName) {
+      keys.push(baseName);
+    }
+    let match;
+    while ((match = bracketPattern.exec(dotSeg)) !== null) {
+      keys.push(match[1]);
+    }
+  }
+  for (const key of keys) {
+    if (PROTOTYPE_POLLUTION_SEGMENTS.includes(key)) {
+      return void 0;
+    }
+  }
+  let current = state;
+  for (const key of keys) {
+    if (current == null || typeof current !== "object") return void 0;
+    if (Array.isArray(current)) {
+      const index = Number(key);
+      if (!Number.isInteger(index) || index < 0) return void 0;
+      current = current[index];
+    } else {
+      current = current[key];
+    }
+  }
+  return current;
+}
+function checkSrcValue(resolved, type, errorPath, errors) {
+  if (isForbiddenUrl(resolved)) {
+    errors.push(
+      createError(
+        "EXTERNAL_URL",
+        `External URLs are not allowed in ${type}.src. Got "${resolved}".`,
+        errorPath
+      )
+    );
+  } else {
+    const assetError = validateAssetPath(resolved);
+    if (assetError === "ASSET_PATH_TRAVERSAL") {
+      errors.push(
+        createError(
+          "ASSET_PATH_TRAVERSAL",
+          `Asset path contains path traversal ("../"). Got "${resolved}".`,
+          errorPath
+        )
+      );
+    } else if (assetError === "INVALID_ASSET_PATH") {
+      errors.push(
+        createError(
+          "INVALID_ASSET_PATH",
+          `Asset path must start with "@assets/". Got "${resolved}".`,
+          errorPath
+        )
+      );
+    }
+  }
+}
+function validateSecurity(card) {
+  const errors = [];
+  const { views, state, cardAssets, cardStyles } = card;
+  if (cardAssets) {
+    for (const [key, value] of Object.entries(cardAssets)) {
+      const assetError = validateAssetPath(value);
+      if (assetError === "ASSET_PATH_TRAVERSAL") {
+        errors.push(
+          createError(
+            "ASSET_PATH_TRAVERSAL",
+            `Asset path contains path traversal ("../"). Got "${value}".`,
+            `assets.${key}`
+          )
+        );
+      } else if (assetError === "INVALID_ASSET_PATH") {
+        errors.push(
+          createError(
+            "INVALID_ASSET_PATH",
+            `Asset path must start with "@assets/". Got "${value}".`,
+            `assets.${key}`
+          )
+        );
+      }
+    }
+  }
+  traverseCard(views, (node, context) => {
+    const { path } = context;
+    const { style, type } = node;
+    const nodeFields = { ...node };
+    delete nodeFields.type;
+    delete nodeFields.style;
+    delete nodeFields.children;
+    delete nodeFields.condition;
+    if (type === "Image" || type === "Avatar") {
+      const src = node.src;
+      if (typeof src === "string") {
+        checkSrcValue(src, type, `${path}.src`, errors);
+      } else if (isRef3(src)) {
+        if (state) {
+          const resolved = resolveRefFromState(
+            src.$ref,
+            state
+          );
+          if (typeof resolved === "string") {
+            checkSrcValue(resolved, type, `${path}.src`, errors);
+          }
+        }
+      }
+    }
+    if (style) {
+      for (const [prop, value] of Object.entries(style)) {
+        if (typeof value === "string" && value.toLowerCase().includes("url(")) {
+          errors.push(
+            createError(
+              "FORBIDDEN_CSS_FUNCTION",
+              `CSS url() function is forbidden in style values. Found in "${prop}".`,
+              `${path}.style.${prop}`
+            )
+          );
+        }
+      }
+    }
+    let effectiveStyle = style;
+    if (style && typeof style.$style === "string" && cardStyles && style.$style.trim() in cardStyles) {
+      const refName = style.$style.trim();
+      const merged = { ...cardStyles[refName] };
+      for (const [key, value] of Object.entries(style)) {
+        if (key !== "$style") {
+          merged[key] = value;
+        }
+      }
+      effectiveStyle = merged;
+    }
+    if (effectiveStyle && typeof effectiveStyle.position === "string") {
+      const position = effectiveStyle.position;
+      if (position === "fixed") {
+        errors.push(
+          createError(
+            "POSITION_FIXED_FORBIDDEN",
+            'CSS position "fixed" is not allowed.',
+            `${path}.style.position`
+          )
+        );
+      } else if (position === "sticky") {
+        errors.push(
+          createError(
+            "POSITION_STICKY_FORBIDDEN",
+            'CSS position "sticky" is not allowed.',
+            `${path}.style.position`
+          )
+        );
+      } else if (position === "absolute") {
+        if (context.parentType !== "Stack") {
+          errors.push(
+            createError(
+              "POSITION_ABSOLUTE_NOT_IN_STACK",
+              'CSS position "absolute" is only allowed inside a Stack component.',
+              `${path}.style.position`
+            )
+          );
+        }
+      }
+    }
+    if (effectiveStyle && effectiveStyle.overflow === "auto" && context.overflowAutoAncestor) {
+      errors.push(
+        createError(
+          "OVERFLOW_AUTO_NESTED",
+          "Nested overflow:auto is not allowed. An ancestor already has overflow:auto.",
+          `${path}.style.overflow`
+        )
+      );
+    }
+    scanForRefs(nodeFields, path, errors);
+    if (style) {
+      scanForRefs(style, `${path}.style`, errors);
+    }
+  });
+  return errors;
+}
+
+// src/limits.ts
+import {
+  TEXT_CONTENT_TOTAL_MAX_BYTES,
+  STYLE_OBJECTS_TOTAL_MAX_BYTES,
+  MAX_NODE_COUNT,
+  MAX_LOOP_ITERATIONS,
+  MAX_NESTED_LOOPS,
+  MAX_OVERFLOW_AUTO_COUNT,
+  MAX_STACK_NESTING,
+  PROTOTYPE_POLLUTION_SEGMENTS as PROTOTYPE_POLLUTION_SEGMENTS2,
+  isRef as isRef4,
+  isExpr as isExpr3
+} from "@safe-ugc-ui/types";
+function utf8ByteLength(str) {
+  let bytes = 0;
+  for (let i = 0; i < str.length; i++) {
+    const code = str.charCodeAt(i);
+    if (code <= 127) {
+      bytes += 1;
+    } else if (code <= 2047) {
+      bytes += 2;
+    } else if (code >= 55296 && code <= 56319) {
+      bytes += 4;
+      i++;
+    } else {
+      bytes += 3;
+    }
+  }
+  return bytes;
+}
+function resolveRefFromState2(refPath, state) {
+  const path = refPath.startsWith("$") ? refPath.slice(1) : refPath;
+  const dotSegments = path.split(".");
+  const keys = [];
+  for (const dotSeg of dotSegments) {
+    const bracketPattern = /\[(\d+)\]/g;
+    const firstBracket = dotSeg.indexOf("[");
+    const baseName = firstBracket === -1 ? dotSeg : dotSeg.slice(0, firstBracket);
+    if (baseName) {
+      keys.push(baseName);
+    }
+    let match;
+    while ((match = bracketPattern.exec(dotSeg)) !== null) {
+      keys.push(match[1]);
+    }
+  }
+  for (const key of keys) {
+    if (PROTOTYPE_POLLUTION_SEGMENTS2.includes(key)) {
+      return void 0;
+    }
+  }
+  let current = state;
+  for (const key of keys) {
+    if (current == null || typeof current !== "object") return void 0;
+    if (Array.isArray(current)) {
+      const index = Number(key);
+      if (!Number.isInteger(index) || index < 0) return void 0;
+      current = current[index];
+    } else {
+      current = current[key];
+    }
+  }
+  return current;
+}
+function countTemplateMetrics(template, cardStyles) {
+  const result = { nodes: 0, textBytes: 0, styleBytes: 0, overflowAutoCount: 0 };
+  if (template == null || typeof template !== "object") return result;
+  const node = template;
+  if (!node.type) return result;
+  result.nodes = 1;
+  if (node.type === "Text") {
+    const content = node.content;
+    if (typeof content === "string" && !isRef4(content) && !isExpr3(content)) {
+      result.textBytes = utf8ByteLength(content);
+    }
+  }
+  if (node.style != null && typeof node.style === "object") {
+    const style = node.style;
+    let styleForBytes = style;
+    if (typeof style.$style === "string" && cardStyles && style.$style.trim() in cardStyles) {
+      const refName = style.$style.trim();
+      const merged = { ...cardStyles[refName] };
+      for (const [key, value] of Object.entries(style)) {
+        if (key !== "$style") merged[key] = value;
+      }
+      styleForBytes = merged;
+    }
+    result.styleBytes = utf8ByteLength(JSON.stringify(styleForBytes));
+    let effectiveOverflow = style.overflow;
+    if (typeof style.$style === "string" && cardStyles && style.$style.trim() in cardStyles) {
+      const refName = style.$style.trim();
+      if (!("overflow" in style) || style.overflow === void 0) {
+        effectiveOverflow = cardStyles[refName].overflow;
+      }
+    }
+    if (effectiveOverflow === "auto") {
+      result.overflowAutoCount = 1;
+    }
+  }
+  const children = node.children;
+  if (Array.isArray(children)) {
+    for (const child of children) {
+      const childMetrics = countTemplateMetrics(child, cardStyles);
+      result.nodes += childMetrics.nodes;
+      result.textBytes += childMetrics.textBytes;
+      result.styleBytes += childMetrics.styleBytes;
+      result.overflowAutoCount += childMetrics.overflowAutoCount;
+    }
+  } else if (children != null && typeof children === "object" && !Array.isArray(children) && "template" in children) {
+    const innerTemplate = children.template;
+    const innerMetrics = countTemplateMetrics(innerTemplate, cardStyles);
+    result.nodes += innerMetrics.nodes;
+    result.textBytes += innerMetrics.textBytes;
+    result.styleBytes += innerMetrics.styleBytes;
+    result.overflowAutoCount += innerMetrics.overflowAutoCount;
+  }
+  return result;
+}
+function validateLimits(card) {
+  const errors = [];
+  let nodeCount = 0;
+  let textContentBytes = 0;
+  let styleObjectsBytes = 0;
+  let overflowAutoCount = 0;
+  traverseCard(card.views, (node, context) => {
+    nodeCount++;
+    if (node.type === "Text") {
+      const content = node.content;
+      if (typeof content === "string" && !isRef4(content) && !isExpr3(content)) {
+        textContentBytes += utf8ByteLength(content);
+      }
+    }
+    if (node.style != null && typeof node.style === "object") {
+      let styleForBytes = node.style;
+      if (typeof node.style.$style === "string" && card.cardStyles && node.style.$style.trim() in card.cardStyles) {
+        const refName = node.style.$style.trim();
+        const merged = { ...card.cardStyles[refName] };
+        for (const [key, value] of Object.entries(node.style)) {
+          if (key !== "$style") {
+            merged[key] = value;
+          }
+        }
+        styleForBytes = merged;
+      }
+      const serialized = JSON.stringify(styleForBytes);
+      styleObjectsBytes += utf8ByteLength(serialized);
+    }
+    const children = node.children;
+    if (children != null && typeof children === "object" && !Array.isArray(children) && "for" in children && "in" in children && "template" in children) {
+      const forLoop = children;
+      const inValue = forLoop.in;
+      if (typeof inValue === "string" && inValue.startsWith("$")) {
+        if (card.state == null) {
+        } else {
+          const source = resolveRefFromState2(inValue, card.state);
+          if (source === void 0) {
+            const pathAfterDollar = inValue.slice(1);
+            if (!pathAfterDollar.includes(".") && context.loopDepth === 0) {
+              errors.push(
+                createError(
+                  "LOOP_SOURCE_MISSING",
+                  `Loop source "${inValue}" not found in card state`,
+                  `${context.path}.children`
+                )
+              );
+            }
+          } else if (!Array.isArray(source)) {
+            errors.push(
+              createError(
+                "LOOP_SOURCE_NOT_ARRAY",
+                `Loop source "${inValue}" is not an array`,
+                `${context.path}.children`
+              )
+            );
+          } else if (source.length > MAX_LOOP_ITERATIONS) {
+            errors.push(
+              createError(
+                "LOOP_ITERATIONS_EXCEEDED",
+                `Loop source "${inValue}" has ${source.length} items, max is ${MAX_LOOP_ITERATIONS}`,
+                `${context.path}.children`
+              )
+            );
+          } else if (source.length > 1) {
+            const tplMetrics = countTemplateMetrics(forLoop.template, card.cardStyles);
+            const multiplier = source.length - 1;
+            nodeCount += tplMetrics.nodes * multiplier;
+            textContentBytes += tplMetrics.textBytes * multiplier;
+            styleObjectsBytes += tplMetrics.styleBytes * multiplier;
+            overflowAutoCount += tplMetrics.overflowAutoCount * multiplier;
+          }
+        }
+      }
+      if (context.loopDepth >= MAX_NESTED_LOOPS) {
+        errors.push(
+          createError(
+            "NESTED_LOOPS_EXCEEDED",
+            `Loop nesting depth ${context.loopDepth + 1} exceeds maximum of ${MAX_NESTED_LOOPS}`,
+            `${context.path}.children`
+          )
+        );
+      }
+    }
+    {
+      let effectiveOverflow = node.style?.overflow;
+      if (node.style && typeof node.style.$style === "string" && card.cardStyles && node.style.$style.trim() in card.cardStyles) {
+        const refName = node.style.$style.trim();
+        if (!("overflow" in node.style) || node.style.overflow === void 0) {
+          effectiveOverflow = card.cardStyles[refName].overflow;
+        }
+      }
+      if (effectiveOverflow === "auto") {
+        overflowAutoCount++;
+      }
+    }
+    if (node.type === "Stack" && context.stackDepth >= MAX_STACK_NESTING) {
+      errors.push(
+        createError(
+          "STACK_NESTING_EXCEEDED",
+          `Stack nesting depth ${context.stackDepth + 1} exceeds maximum of ${MAX_STACK_NESTING}`,
+          context.path
+        )
+      );
+    }
+  });
+  if (nodeCount > MAX_NODE_COUNT) {
+    errors.push(
+      createError(
+        "NODE_COUNT_EXCEEDED",
+        `Card has ${nodeCount} nodes, max is ${MAX_NODE_COUNT}`,
+        "views"
+      )
+    );
+  }
+  if (textContentBytes > TEXT_CONTENT_TOTAL_MAX_BYTES) {
+    errors.push(
+      createError(
+        "TEXT_CONTENT_SIZE_EXCEEDED",
+        `Total text content is ${textContentBytes} bytes, max is ${TEXT_CONTENT_TOTAL_MAX_BYTES}`,
+        "views"
+      )
+    );
+  }
+  if (styleObjectsBytes > STYLE_OBJECTS_TOTAL_MAX_BYTES) {
+    errors.push(
+      createError(
+        "STYLE_SIZE_EXCEEDED",
+        `Total style objects size is ${styleObjectsBytes} bytes, max is ${STYLE_OBJECTS_TOTAL_MAX_BYTES}`,
+        "views"
+      )
+    );
+  }
+  if (overflowAutoCount > MAX_OVERFLOW_AUTO_COUNT) {
+    errors.push(
+      createError(
+        "OVERFLOW_AUTO_COUNT_EXCEEDED",
+        `Card has ${overflowAutoCount} elements with overflow:auto, max is ${MAX_OVERFLOW_AUTO_COUNT}`,
+        "views"
+      )
+    );
+  }
+  return errors;
+}
+
+// src/expr-constraints.ts
+import {
+  EXPR_MAX_LENGTH,
+  EXPR_MAX_TOKENS,
+  EXPR_MAX_NESTING,
+  EXPR_MAX_CONDITION_NESTING,
+  EXPR_MAX_REF_DEPTH,
+  EXPR_MAX_ARRAY_INDEX,
+  EXPR_MAX_STRING_LITERAL,
+  EXPR_MAX_FRACTIONAL_DIGITS,
+  isRef as isRef5,
+  isExpr as isExpr4
+} from "@safe-ugc-ui/types";
+var FORBIDDEN_KEYWORDS = [
+  "typeof",
+  "instanceof",
+  "new",
+  "delete",
+  "function",
+  "return",
+  "var",
+  "let",
+  "const"
+];
+var FORBIDDEN_KEYWORD_SET = new Set(FORBIDDEN_KEYWORDS);
+var PROTOTYPE_POLLUTION_SEGMENTS3 = /* @__PURE__ */ new Set([
+  "__proto__",
+  "constructor",
+  "prototype"
+]);
+function tokenize(expr, path) {
+  const tokens = [];
+  const errors = [];
+  let i = 0;
+  while (i < expr.length) {
+    if (/\s/.test(expr[i])) {
+      i++;
+      continue;
+    }
+    if (i + 2 < expr.length) {
+      const three = expr.slice(i, i + 3);
+      if (three === "===" || three === "!==") {
+        tokens.push({ type: "comparison", value: three, position: i });
+        i += 3;
+        continue;
+      }
+    }
+    if (i + 1 < expr.length) {
+      const two = expr.slice(i, i + 2);
+      if (two === "==" || two === "!=" || two === "<=" || two === ">=") {
+        tokens.push({ type: "comparison", value: two, position: i });
+        i += 2;
+        continue;
+      }
+      if (two === "&&" || two === "||") {
+        tokens.push({ type: "logic_keyword", value: two, position: i });
+        i += 2;
+        continue;
+      }
+    }
+    if (expr[i] === "'" || expr[i] === '"') {
+      const quote = expr[i];
+      let j = i + 1;
+      while (j < expr.length && expr[j] !== quote) {
+        if (expr[j] === "\\" && j + 1 < expr.length) {
+          j += 2;
+        } else {
+          j++;
+        }
+      }
+      const innerValue = expr.slice(i + 1, j);
+      tokens.push({ type: "string", value: innerValue, position: i });
+      i = j + 1;
+      continue;
+    }
+    if (/[0-9]/.test(expr[i]) || expr[i] === "-" && i + 1 < expr.length && /[0-9]/.test(expr[i + 1]) && isNegativeSign(tokens)) {
+      let j = i;
+      if (expr[j] === "-") j++;
+      while (j < expr.length && /[0-9]/.test(expr[j])) j++;
+      if (j < expr.length && expr[j] === ".") {
+        j++;
+        while (j < expr.length && /[0-9]/.test(expr[j])) j++;
+      }
+      const numStr = expr.slice(i, j);
+      const dotIdx = numStr.indexOf(".");
+      if (dotIdx !== -1) {
+        const fractionalPart = numStr.slice(dotIdx + 1);
+        if (fractionalPart.length > EXPR_MAX_FRACTIONAL_DIGITS) {
+          errors.push(
+            createError(
+              "EXPR_INVALID_TOKEN",
+              `Number literal "${numStr}" at position ${i} has ${fractionalPart.length} fractional digits, maximum is ${EXPR_MAX_FRACTIONAL_DIGITS}.`,
+              path
+            )
+          );
+        }
+      }
+      tokens.push({ type: "number", value: numStr, position: i });
+      i = j;
+      continue;
+    }
+    if (expr[i] === "$" || /[a-zA-Z_]/.test(expr[i])) {
+      let j = i;
+      if (expr[j] === "$") j++;
+      while (j < expr.length && /[\w]/.test(expr[j])) j++;
+      const word = expr.slice(i, j);
+      if (word === "true" || word === "false") {
+        tokens.push({ type: "boolean", value: word, position: i });
+      } else if (word === "and" || word === "or" || word === "not") {
+        tokens.push({ type: "logic_keyword", value: word, position: i });
+      } else if (word === "if" || word === "then" || word === "else") {
+        tokens.push({ type: "condition_keyword", value: word, position: i });
+      } else {
+        tokens.push({ type: "identifier", value: word, position: i });
+      }
+      i = j;
+      continue;
+    }
+    const ch = expr[i];
+    if ("+-*/%".includes(ch)) {
+      tokens.push({ type: "arithmetic", value: ch, position: i });
+      i++;
+      continue;
+    }
+    if (ch === "<" || ch === ">") {
+      tokens.push({ type: "comparison", value: ch, position: i });
+      i++;
+      continue;
+    }
+    if ("().[]".includes(ch)) {
+      tokens.push({ type: "separator", value: ch, position: i });
+      i++;
+      continue;
+    }
+    if (ch === "!") {
+      tokens.push({ type: "comparison", value: ch, position: i });
+      i++;
+      continue;
+    }
+    errors.push(
+      createError(
+        "EXPR_INVALID_TOKEN",
+        `Unrecognized character "${ch}" at position ${i} in expression.`,
+        path
+      )
+    );
+    i++;
+  }
+  for (let t = 0; t < tokens.length; t++) {
+    const tok = tokens[t];
+    if (tok.value === "===" || tok.value === "!==" || (tok.value === "&&" || tok.value === "||")) {
+      errors.push(
+        createError(
+          "EXPR_FORBIDDEN_TOKEN",
+          `Forbidden operator "${tok.value}" at position ${tok.position}. Use "==" / "!=" or "and" / "or" instead.`,
+          path
+        )
+      );
+    }
+    if (tok.value === "!") {
+      errors.push(
+        createError(
+          "EXPR_FORBIDDEN_TOKEN",
+          `Forbidden operator "!" at position ${tok.position}. Use "not" instead.`,
+          path
+        )
+      );
+    }
+    if (tok.type === "identifier" && FORBIDDEN_KEYWORD_SET.has(tok.value)) {
+      errors.push(
+        createError(
+          "EXPR_FORBIDDEN_TOKEN",
+          `Forbidden keyword "${tok.value}" at position ${tok.position}.`,
+          path
+        )
+      );
+    }
+    if (tok.type === "identifier" && !tok.value.startsWith("$") && !FORBIDDEN_KEYWORD_SET.has(tok.value)) {
+      errors.push(
+        createError(
+          "EXPR_FORBIDDEN_TOKEN",
+          `Identifier "${tok.value}" at position ${tok.position} must start with "$". Use "$${tok.value}" for variable references.`,
+          path
+        )
+      );
+    }
+    if (tok.type === "identifier") {
+      const next = tokens[t + 1];
+      if (next && next.type === "separator" && next.value === "(") {
+        errors.push(
+          createError(
+            "EXPR_FUNCTION_CALL",
+            `Function call pattern detected: "${tok.value}(" at position ${tok.position}. Function calls are not allowed.`,
+            path
+          )
+        );
+      }
+    }
+  }
+  return { tokens, errors };
+}
+function isNegativeSign(tokens) {
+  if (tokens.length === 0) return true;
+  const prev = tokens[tokens.length - 1];
+  if (prev.type === "arithmetic" || prev.type === "comparison" || prev.type === "logic_keyword" || prev.type === "condition_keyword") {
+    return true;
+  }
+  if (prev.type === "separator" && (prev.value === "(" || prev.value === "[")) {
+    return true;
+  }
+  return false;
+}
+function scanForDynamicValues(obj, basePath, callback) {
+  if (obj === null || obj === void 0 || typeof obj !== "object") {
+    return;
+  }
+  if (isRef5(obj) || isExpr4(obj)) {
+    callback(obj, basePath);
+    return;
+  }
+  if (Array.isArray(obj)) {
+    for (let i = 0; i < obj.length; i++) {
+      scanForDynamicValues(obj[i], `${basePath}[${i}]`, callback);
+    }
+  } else {
+    for (const [key, value] of Object.entries(obj)) {
+      scanForDynamicValues(value, `${basePath}.${key}`, callback);
+    }
+  }
+}
+function validateRef(refValue, path) {
+  const errors = [];
+  if (refValue.length > 500) {
+    errors.push(
+      createError(
+        "REF_TOO_LONG",
+        `$ref value exceeds maximum length of 500 characters (got ${refValue.length}).`,
+        path
+      )
+    );
+  }
+  const segments = refValue.split(".");
+  if (segments.length > EXPR_MAX_REF_DEPTH) {
+    errors.push(
+      createError(
+        "EXPR_REF_DEPTH_EXCEEDED",
+        `$ref path depth ${segments.length} exceeds maximum of ${EXPR_MAX_REF_DEPTH}.`,
+        path
+      )
+    );
+  }
+  const arrayIndexPattern = /\[(\d+)\]/g;
+  let match;
+  while ((match = arrayIndexPattern.exec(refValue)) !== null) {
+    const index = parseInt(match[1], 10);
+    if (index > EXPR_MAX_ARRAY_INDEX) {
+      errors.push(
+        createError(
+          "EXPR_ARRAY_INDEX_EXCEEDED",
+          `Array index ${index} in $ref exceeds maximum of ${EXPR_MAX_ARRAY_INDEX}.`,
+          path
+        )
+      );
+    }
+  }
+  for (const segment of segments) {
+    const cleanSegment = segment.replace(/\[\d+\]/g, "");
+    if (PROTOTYPE_POLLUTION_SEGMENTS3.has(cleanSegment)) {
+      errors.push(
+        createError(
+          "PROTOTYPE_POLLUTION",
+          `$ref path contains forbidden segment "${cleanSegment}".`,
+          path
+        )
+      );
+    }
+  }
+  return errors;
+}
+function validateExpr(exprValue, path) {
+  const errors = [];
+  if (exprValue.length > EXPR_MAX_LENGTH) {
+    errors.push(
+      createError(
+        "EXPR_TOO_LONG",
+        `Expression exceeds maximum length of ${EXPR_MAX_LENGTH} characters (got ${exprValue.length}).`,
+        path
+      )
+    );
+  }
+  const { tokens, errors: tokenErrors } = tokenize(exprValue, path);
+  errors.push(...tokenErrors);
+  if (tokens.length > EXPR_MAX_TOKENS) {
+    errors.push(
+      createError(
+        "EXPR_TOO_MANY_TOKENS",
+        `Expression has ${tokens.length} tokens, exceeding maximum of ${EXPR_MAX_TOKENS}.`,
+        path
+      )
+    );
+  }
+  for (const tok of tokens) {
+    if (tok.type === "string" && tok.value.length > EXPR_MAX_STRING_LITERAL) {
+      errors.push(
+        createError(
+          "EXPR_STRING_LITERAL_TOO_LONG",
+          `String literal at position ${tok.position} has ${tok.value.length} characters, exceeding maximum of ${EXPR_MAX_STRING_LITERAL}.`,
+          path
+        )
+      );
+    }
+  }
+  let parenDepth = 0;
+  let maxParenDepth = 0;
+  let ifCount = 0;
+  for (const tok of tokens) {
+    if (tok.type === "separator" && tok.value === "(") {
+      parenDepth++;
+      if (parenDepth > maxParenDepth) {
+        maxParenDepth = parenDepth;
+      }
+    } else if (tok.type === "separator" && tok.value === ")") {
+      parenDepth--;
+    } else if (tok.type === "condition_keyword" && tok.value === "if") {
+      ifCount++;
+    }
+  }
+  if (maxParenDepth > EXPR_MAX_NESTING) {
+    errors.push(
+      createError(
+        "EXPR_NESTING_TOO_DEEP",
+        `Expression parenthesis nesting depth ${maxParenDepth} exceeds maximum of ${EXPR_MAX_NESTING}.`,
+        path
+      )
+    );
+  }
+  if (ifCount > EXPR_MAX_CONDITION_NESTING) {
+    errors.push(
+      createError(
+        "EXPR_CONDITION_NESTING_TOO_DEEP",
+        `Expression has ${ifCount} nested if-conditions, exceeding maximum of ${EXPR_MAX_CONDITION_NESTING}.`,
+        path
+      )
+    );
+  }
+  for (let t = 0; t < tokens.length; t++) {
+    const tok = tokens[t];
+    if (tok.type === "identifier" && tok.value.startsWith("$")) {
+      let depth = 1;
+      let j = t + 1;
+      while (j + 1 < tokens.length) {
+        if (tokens[j].type === "separator" && tokens[j].value === "." && tokens[j + 1].type === "identifier") {
+          depth++;
+          j += 2;
+        } else {
+          break;
+        }
+      }
+      if (depth > EXPR_MAX_REF_DEPTH) {
+        errors.push(
+          createError(
+            "EXPR_REF_DEPTH_EXCEEDED",
+            `Variable reference "${tok.value}" has path depth ${depth}, exceeding maximum of ${EXPR_MAX_REF_DEPTH}.`,
+            path
+          )
+        );
+      }
+    }
+  }
+  for (let t = 0; t + 2 < tokens.length; t++) {
+    if (tokens[t].type === "separator" && tokens[t].value === "[" && tokens[t + 1].type === "number" && tokens[t + 2].type === "separator" && tokens[t + 2].value === "]") {
+      const indexValue = parseFloat(tokens[t + 1].value);
+      if (indexValue > EXPR_MAX_ARRAY_INDEX) {
+        errors.push(
+          createError(
+            "EXPR_ARRAY_INDEX_EXCEEDED",
+            `Array index ${indexValue} in expression exceeds maximum of ${EXPR_MAX_ARRAY_INDEX}.`,
+            path
+          )
+        );
+      }
+    }
+  }
+  return errors;
+}
+function validateExprConstraints(views) {
+  const errors = [];
+  traverseCard(views, (node, context) => {
+    const nodeFields = { ...node };
+    delete nodeFields.type;
+    delete nodeFields.style;
+    delete nodeFields.children;
+    delete nodeFields.condition;
+    scanForDynamicValues(nodeFields, context.path, (value, valuePath) => {
+      if (isRef5(value)) {
+        errors.push(...validateRef(value.$ref, valuePath));
+      } else if (isExpr4(value)) {
+        errors.push(...validateExpr(value.$expr, valuePath));
+      }
+    });
+    if (node.style) {
+      scanForDynamicValues(node.style, `${context.path}.style`, (value, valuePath) => {
+        if (isRef5(value)) {
+          errors.push(...validateRef(value.$ref, valuePath));
+        } else if (isExpr4(value)) {
+          errors.push(...validateExpr(value.$expr, valuePath));
+        }
+      });
+    }
+    if (node.condition !== void 0) {
+      scanForDynamicValues(node.condition, `${context.path}.condition`, (value, valuePath) => {
+        if (isRef5(value)) {
+          errors.push(...validateRef(value.$ref, valuePath));
+        } else if (isExpr4(value)) {
+          errors.push(...validateExpr(value.$expr, valuePath));
+        }
+      });
+    }
+  });
+  return errors;
+}
+
+// src/index.ts
+function utf8ByteLength2(str) {
+  let bytes = 0;
+  for (let i = 0; i < str.length; i++) {
+    const code = str.charCodeAt(i);
+    if (code <= 127) {
+      bytes += 1;
+    } else if (code <= 2047) {
+      bytes += 2;
+    } else if (code >= 55296 && code <= 56319) {
+      bytes += 4;
+      i++;
+    } else {
+      bytes += 3;
+    }
+  }
+  return bytes;
+}
+function runAllChecks(input) {
+  const obj = input;
+  const views = obj.views;
+  const cardStyles = obj.styles;
+  const errors = [];
+  errors.push(...validateNodes(views));
+  errors.push(...validateValueTypes(views));
+  errors.push(...validateStyles(views, cardStyles));
+  errors.push(...validateSecurity({
+    views,
+    state: obj.state,
+    cardAssets: obj.assets,
+    cardStyles
+  }));
+  errors.push(...validateLimits({ state: obj.state, views, cardStyles }));
+  errors.push(...validateExprConstraints(views));
+  return errors;
+}
+function validate(input) {
+  const schemaResult = validateSchema(input);
+  if (!schemaResult.valid) {
+    return schemaResult;
+  }
+  const errors = runAllChecks(input);
+  return toResult(errors);
+}
+function validateRaw(rawJson) {
+  const byteSize = utf8ByteLength2(rawJson);
+  if (byteSize > CARD_JSON_MAX_BYTES) {
+    return toResult([
+      createError(
+        "CARD_SIZE_EXCEEDED",
+        `Card JSON is ${byteSize} bytes, maximum is ${CARD_JSON_MAX_BYTES} bytes.`,
+        ""
+      )
+    ]);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(rawJson);
+  } catch (e) {
+    const message = e instanceof Error ? e.message : "Invalid JSON";
+    return toResult([
+      createError("INVALID_JSON", `Failed to parse JSON: ${message}`, "")
+    ]);
+  }
+  return validate(parsed);
+}
+export {
+  createError,
+  invalidResult,
+  merge,
+  parseCard,
+  toResult,
+  traverseCard,
+  traverseNode,
+  validResult,
+  validate,
+  validateExprConstraints,
+  validateLimits,
+  validateNodes,
+  validateRaw,
+  validateSchema,
+  validateSecurity,
+  validateStyles,
+  validateValueTypes
+};
+//# sourceMappingURL=index.js.map