@thallylabs/migrate 0.2.39 → 0.2.41

package/dist/svg-policy.js

@@ -86,6 +86,10 @@ var ALLOWED_ATTRIBUTES = /* @__PURE__ */ new Set([
   "fill-rule",
   "stroke",
   "stroke-width",
+  // Some SVG exporters persist React spellings. These remain fixed static
+  // drawing attributes; accepting them never grants arbitrary JSX execution.
+  "fillrule",
+  "cliprule",
   "stroke-opacity",
   "stroke-linecap",
   "stroke-linejoin",
@@ -207,6 +211,8 @@ var ALLOWED_ATTRIBUTES = /* @__PURE__ */ new Set([
   "limitingconeangle",
   "aria-hidden",
   "aria-label",
+  "aria-labelledby",
+  "aria-describedby",
   "role",
   "focusable",
   // Validated below: only in-document fragment references.

package/dist/svg-policy.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/svg-policy.ts"],"sourcesContent":["/**\n * Allowlist policy for imported SVG files.\n *\n * An SVG served from the docs origin and opened directly is a full document:\n * script, event handlers, `javascript:` links, animations that rewrite\n * `href`, foreign HTML, and remote references all run or load there. Regular\n * expressions miss namespace prefixes and entity-encoded values, so the file\n * is parsed as XML with entities decoded. It passes only if every element and\n * attribute is on a fixed allowlist of static drawing primitives, and every\n * reference stays inside the document. Anything else, including a\n * DOCTYPE, CDATA, or a parser error, sends the file to review.\n */\n\nimport { Parser } from \"htmlparser2\";\n\nconst SVG_NAMESPACE = \"http://www.w3.org/2000/svg\";\nconst XLINK_NAMESPACE = \"http://www.w3.org/1999/xlink\";\n\n/** Static drawing elements; no script, style, animation, link, or image. */\nconst ALLOWED_ELEMENTS = new Set([\n  \"svg\", \"g\", \"defs\", \"symbol\", \"use\", \"title\", \"desc\",\n  \"path\", \"rect\", \"circle\", \"ellipse\", \"line\", \"polyline\", \"polygon\",\n  \"text\", \"tspan\", \"textpath\",\n  \"lineargradient\", \"radialgradient\", \"stop\",\n  \"clippath\", \"mask\", \"pattern\", \"marker\",\n  \"filter\", \"feblend\", \"fecolormatrix\", \"fecomponenttransfer\", \"fecomposite\",\n  \"feconvolvematrix\", \"fediffuselighting\", \"fedisplacementmap\",\n  \"fedistantlight\", \"fedropshadow\", \"feflood\", \"fefunca\", \"fefuncb\",\n  \"fefuncg\", \"fefuncr\", \"fegaussianblur\", \"femerge\", \"femergenode\",\n  \"femorphology\", \"feoffset\", \"fepointlight\", \"fespecularlighting\",\n  \"fespotlight\", \"fetile\", \"feturbulence\",\n]);\n\n/** Geometry, paint, text, gradient, and filter attributes (lowercased). */\nconst ALLOWED_ATTRIBUTES = new Set([\n  \"xmlns\", \"xmlns:xlink\", \"xml:space\", \"version\", \"baseprofile\",\n  \"id\", \"class\", \"viewbox\", \"preserveaspectratio\", \"width\", \"height\",\n  \"x\", \"y\", \"x1\", \"y1\", \"x2\", \"y2\", \"cx\", \"cy\", \"r\", \"rx\", \"ry\",\n  \"d\", \"points\", \"pathlength\", \"transform\", \"transform-origin\",\n  \"fill\", \"fill-opacity\", \"fill-rule\", \"stroke\", \"stroke-width\",\n  \"stroke-opacity\", \"stroke-linecap\", \"stroke-linejoin\",\n  \"stroke-miterlimit\", \"stroke-dasharray\", \"stroke-dashoffset\",\n  \"opacity\", \"color\", \"display\", \"visibility\", \"overflow\",\n  \"clip-path\", \"clip-rule\", \"clippathunits\", \"mask\", \"maskunits\",\n  \"maskcontentunits\", \"filter\", \"filterunits\", \"primitiveunits\",\n  \"marker-start\", \"marker-mid\", \"marker-end\", \"markerwidth\", \"markerheight\",\n  \"markerunits\", \"refx\", \"refy\", \"orient\",\n  \"patternunits\", \"patterncontentunits\", \"patterntransform\",\n  \"gradientunits\", \"gradienttransform\", \"spreadmethod\", \"fx\", \"fy\", \"fr\",\n  \"offset\", \"stop-color\", \"stop-opacity\",\n  \"font-family\", \"font-size\", \"font-weight\", \"font-style\", \"font-variant\",\n  \"letter-spacing\", \"word-spacing\", \"text-anchor\", \"dominant-baseline\",\n  \"alignment-baseline\", \"baseline-shift\", \"text-decoration\", \"dx\", \"dy\",\n  \"rotate\", \"textlength\", \"lengthadjust\", \"startoffset\", \"writing-mode\",\n  \"direction\", \"unicode-bidi\", \"shape-rendering\", \"text-rendering\",\n  \"image-rendering\", \"color-interpolation\", \"color-interpolation-filters\",\n  \"vector-effect\", \"paint-order\", \"mix-blend-mode\", \"isolation\",\n  \"in\", \"in2\", \"result\", \"stddeviation\", \"mode\", \"type\", \"values\",\n  \"tablevalues\", \"slope\", \"intercept\", \"amplitude\", \"exponent\",\n  \"operator\", \"k1\", \"k2\", \"k3\", \"k4\", \"radius\", \"scale\",\n  \"xchannelselector\", \"ychannelselector\", \"basefrequency\", \"numoctaves\",\n  \"seed\", \"stitchtiles\", \"flood-color\", \"flood-opacity\", \"lighting-color\",\n  \"surfacescale\", \"diffuseconstant\", \"specularconstant\",\n  \"specularexponent\", \"kernelmatrix\", \"kernelunitlength\", \"order\",\n  \"divisor\", \"bias\", \"targetx\", \"targety\", \"edgemode\", \"preservealpha\",\n  \"azimuth\", \"elevation\", \"z\", \"pointsatx\", \"pointsaty\", \"pointsatz\",\n  \"limitingconeangle\", \"aria-hidden\", \"aria-label\", \"role\", \"focusable\",\n  // Validated below: only in-document fragment references.\n  \"href\", \"xlink:href\",\n]);\n\n/** Paint and reference values may point only at in-document fragments. */\nfunction hasExternalReference(value: string): boolean {\n  // CSS escapes can spell url()/schemes without their literal bytes. Drawing\n  // attributes do not need escapes, so reject them rather than parse CSS twice.\n  if (value.includes(\"\\\\\")) return true;\n  const compact = value.replace(/[\\u0000- ]/gu, \"\").toLowerCase();\n  if (/(?:java|vb)script:|data:|expression\\(|@import|<|>/u.test(compact)) {\n    return true;\n  }\n  for (const match of compact.matchAll(/url\\(([^)]*)\\)/gu)) {\n    if (!/^[\"']?#[a-z0-9_.:-]+[\"']?$/u.test(match[1])) return true;\n  }\n  // CSS consumes an unterminated url() through EOF and browsers can still load\n  // it. A balanced-match loop alone therefore misses an external paint server.\n  return compact.replace(/url\\(([^)]*)\\)/gu, \"\").includes(\"url(\");\n}\n\n/**\n * Only UTF-8 is accepted: a UTF-16/32 byte order mark or a declared\n * non-UTF-8 encoding would make browsers read different markup than the\n * policy parsed.\n */\nfunction utf8SvgText(content: Buffer): string | null {\n  const hasUtf8Bom =\n    content[0] === 0xef && content[1] === 0xbb && content[2] === 0xbf;\n  const body = hasUtf8Bom ? content.subarray(3) : content;\n  if (\n    (body[0] === 0xfe && body[1] === 0xff) ||\n    (body[0] === 0xff && body[1] === 0xfe) ||\n    (body[0] === 0x00 && body[1] === 0x00) ||\n    body.includes(0x00)\n  ) {\n    return null;\n  }\n  const text = body.toString(\"utf8\");\n  if (text.includes(\"\\uFFFD\")) return null;\n  const declaration = /^<\\?xml\\b[^>]*\\?>/iu.exec(text);\n  if (declaration) {\n    const encoding = /\\bencoding\\s*=\\s*[\"']([^\"']*)[\"']/iu.exec(declaration[0]);\n    if (encoding && !/^utf-?8$/iu.test(encoding[1].trim())) return null;\n  } else if (/<\\?xml\\b/iu.test(text)) {\n    // A declaration anywhere but the very start is malformed XML.\n    return null;\n  }\n  return text;\n}\n\n/** True when an SVG uses only static, self-contained drawing features. */\nexport function isPassiveSvg(content: Uint8Array): boolean {\n  const text = utf8SvgText(Buffer.from(content.buffer, content.byteOffset, content.byteLength));\n  if (text === null) return false;\n  let isPassive = true;\n  let depth = 0;\n  let sawRoot = false;\n  // Start offsets of open elements: an implied close is legitimate only for\n  // a self-closing tag (same token); otherwise the markup is malformed.\n  const openStarts: Array<number> = [];\n  const fail = () => {\n    isPassive = false;\n  };\n  const parser = new Parser(\n    {\n      onopentag(name, attributes) {\n        const element = name.toLowerCase();\n        if (depth === 0) {\n          if (sawRoot || element !== \"svg\") fail();\n          sawRoot = true;\n        }\n        depth += 1;\n        openStarts.push(parser.startIndex);\n        // Prefixed names (`s:script`) are rejected outright: the allowlist\n        // is defined for the SVG namespace only.\n        if (element.includes(\":\") || !ALLOWED_ELEMENTS.has(element)) fail();\n        for (const [rawName, value] of Object.entries(attributes)) {\n          const attribute = rawName.toLowerCase();\n          if (!ALLOWED_ATTRIBUTES.has(attribute)) {\n            fail();\n            continue;\n          }\n          if (attribute === \"xmlns\" && value !== SVG_NAMESPACE) fail();\n          if (attribute === \"xmlns:xlink\" && value !== XLINK_NAMESPACE) fail();\n          if (\n            (attribute === \"href\" || attribute === \"xlink:href\") &&\n            !/^#[A-Za-z0-9_.:-]+$/u.test(value.trim())\n          ) {\n            fail();\n          }\n          if (hasExternalReference(value)) fail();\n        }\n      },\n      onclosetag(_name, isImplied) {\n        depth -= 1;\n        const start = openStarts.pop();\n        if (isImplied && start !== parser.startIndex) fail();\n      },\n      // DOCTYPE (and with it custom entities) or any other declaration other\n      // than the XML prolog.\n      onprocessinginstruction(name) {\n        if (name.toLowerCase() !== \"?xml\") fail();\n      },\n      oncdatastart: fail,\n      ontext(value) { if (depth === 0 && value.trim()) fail(); },\n      onerror: fail,\n    },\n    { xmlMode: true, decodeEntities: true, recognizeSelfClosing: true },\n  );\n  try {\n    parser.write(text);\n    parser.end();\n  } catch {\n    return false;\n  }\n  return isPassive && sawRoot && depth === 0;\n}\n"],"mappings":";AAaA,SAAS,cAAc;AAEvB,IAAM,gBAAgB;AACtB,IAAM,kBAAkB;AAGxB,IAAM,mBAAmB,oBAAI,IAAI;AAAA,EAC/B;AAAA,EAAO;AAAA,EAAK;AAAA,EAAQ;AAAA,EAAU;AAAA,EAAO;AAAA,EAAS;AAAA,EAC9C;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAU;AAAA,EAAW;AAAA,EAAQ;AAAA,EAAY;AAAA,EACzD;AAAA,EAAQ;AAAA,EAAS;AAAA,EACjB;AAAA,EAAkB;AAAA,EAAkB;AAAA,EACpC;AAAA,EAAY;AAAA,EAAQ;AAAA,EAAW;AAAA,EAC/B;AAAA,EAAU;AAAA,EAAW;AAAA,EAAiB;AAAA,EAAuB;AAAA,EAC7D;AAAA,EAAoB;AAAA,EAAqB;AAAA,EACzC;AAAA,EAAkB;AAAA,EAAgB;AAAA,EAAW;AAAA,EAAW;AAAA,EACxD;AAAA,EAAW;AAAA,EAAW;AAAA,EAAkB;AAAA,EAAW;AAAA,EACnD;AAAA,EAAgB;AAAA,EAAY;AAAA,EAAgB;AAAA,EAC5C;AAAA,EAAe;AAAA,EAAU;AAC3B,CAAC;AAGD,IAAM,qBAAqB,oBAAI,IAAI;AAAA,EACjC;AAAA,EAAS;AAAA,EAAe;AAAA,EAAa;AAAA,EAAW;AAAA,EAChD;AAAA,EAAM;AAAA,EAAS;AAAA,EAAW;AAAA,EAAuB;AAAA,EAAS;AAAA,EAC1D;AAAA,EAAK;AAAA,EAAK;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAK;AAAA,EAAM;AAAA,EACzD;AAAA,EAAK;AAAA,EAAU;AAAA,EAAc;AAAA,EAAa;AAAA,EAC1C;AAAA,EAAQ;AAAA,EAAgB;AAAA,EAAa;AAAA,EAAU;AAAA,EAC/C;AAAA,EAAkB;AAAA,EAAkB;AAAA,EACpC;AAAA,EAAqB;AAAA,EAAoB;AAAA,EACzC;AAAA,EAAW;AAAA,EAAS;AAAA,EAAW;AAAA,EAAc;AAAA,EAC7C;AAAA,EAAa;AAAA,EAAa;AAAA,EAAiB;AAAA,EAAQ;AAAA,EACnD;AAAA,EAAoB;AAAA,EAAU;AAAA,EAAe;AAAA,EAC7C;AAAA,EAAgB;AAAA,EAAc;AAAA,EAAc;AAAA,EAAe;AAAA,EAC3D;AAAA,EAAe;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAC/B;AAAA,EAAgB;AAAA,EAAuB;AAAA,EACvC;AAAA,EAAiB;AAAA,EAAqB;AAAA,EAAgB;AAAA,EAAM;AAAA,EAAM;AAAA,EAClE;AAAA,EAAU;AAAA,EAAc;AAAA,EACxB;AAAA,EAAe;AAAA,EAAa;AAAA,EAAe;AAAA,EAAc;AAAA,EACzD;AAAA,EAAkB;AAAA,EAAgB;AAAA,EAAe;AAAA,EACjD;AAAA,EAAsB;AAAA,EAAkB;AAAA,EAAmB;AAAA,EAAM;AAAA,EACjE;AAAA,EAAU;AAAA,EAAc;AAAA,EAAgB;AAAA,EAAe;AAAA,EACvD;AAAA,EAAa;AAAA,EAAgB;AAAA,EAAmB;AAAA,EAChD;AAAA,EAAmB;AAAA,EAAuB;AAAA,EAC1C;AAAA,EAAiB;AAAA,EAAe;AAAA,EAAkB;AAAA,EAClD;AAAA,EAAM;AAAA,EAAO;AAAA,EAAU;AAAA,EAAgB;AAAA,EAAQ;AAAA,EAAQ;AAAA,EACvD;AAAA,EAAe;AAAA,EAAS;AAAA,EAAa;AAAA,EAAa;AAAA,EAClD;AAAA,EAAY;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAU;AAAA,EAC9C;AAAA,EAAoB;AAAA,EAAoB;AAAA,EAAiB;AAAA,EACzD;AAAA,EAAQ;AAAA,EAAe;AAAA,EAAe;AAAA,EAAiB;AAAA,EACvD;AAAA,EAAgB;AAAA,EAAmB;AAAA,EACnC;AAAA,EAAoB;AAAA,EAAgB;AAAA,EAAoB;AAAA,EACxD;AAAA,EAAW;AAAA,EAAQ;AAAA,EAAW;AAAA,EAAW;AAAA,EAAY;AAAA,EACrD;AAAA,EAAW;AAAA,EAAa;AAAA,EAAK;AAAA,EAAa;AAAA,EAAa;AAAA,EACvD;AAAA,EAAqB;AAAA,EAAe;AAAA,EAAc;AAAA,EAAQ;AAAA;AAAA,EAE1D;AAAA,EAAQ;AACV,CAAC;AAGD,SAAS,qBAAqB,OAAwB;AAGpD,MAAI,MAAM,SAAS,IAAI,EAAG,QAAO;AACjC,QAAM,UAAU,MAAM,QAAQ,gBAAgB,EAAE,EAAE,YAAY;AAC9D,MAAI,qDAAqD,KAAK,OAAO,GAAG;AACtE,WAAO;AAAA,EACT;AACA,aAAW,SAAS,QAAQ,SAAS,kBAAkB,GAAG;AACxD,QAAI,CAAC,8BAA8B,KAAK,MAAM,CAAC,CAAC,EAAG,QAAO;AAAA,EAC5D;AAGA,SAAO,QAAQ,QAAQ,oBAAoB,EAAE,EAAE,SAAS,MAAM;AAChE;AAOA,SAAS,YAAY,SAAgC;AACnD,QAAM,aACJ,QAAQ,CAAC,MAAM,OAAQ,QAAQ,CAAC,MAAM,OAAQ,QAAQ,CAAC,MAAM;AAC/D,QAAM,OAAO,aAAa,QAAQ,SAAS,CAAC,IAAI;AAChD,MACG,KAAK,CAAC,MAAM,OAAQ,KAAK,CAAC,MAAM,OAChC,KAAK,CAAC,MAAM,OAAQ,KAAK,CAAC,MAAM,OAChC,KAAK,CAAC,MAAM,KAAQ,KAAK,CAAC,MAAM,KACjC,KAAK,SAAS,CAAI,GAClB;AACA,WAAO;AAAA,EACT;AACA,QAAM,OAAO,KAAK,SAAS,MAAM;AACjC,MAAI,KAAK,SAAS,QAAQ,EAAG,QAAO;AACpC,QAAM,cAAc,sBAAsB,KAAK,IAAI;AACnD,MAAI,aAAa;AACf,UAAM,WAAW,sCAAsC,KAAK,YAAY,CAAC,CAAC;AAC1E,QAAI,YAAY,CAAC,aAAa,KAAK,SAAS,CAAC,EAAE,KAAK,CAAC,EAAG,QAAO;AAAA,EACjE,WAAW,aAAa,KAAK,IAAI,GAAG;AAElC,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAGO,SAAS,aAAa,SAA8B;AACzD,QAAM,OAAO,YAAY,OAAO,KAAK,QAAQ,QAAQ,QAAQ,YAAY,QAAQ,UAAU,CAAC;AAC5F,MAAI,SAAS,KAAM,QAAO;AAC1B,MAAI,YAAY;AAChB,MAAI,QAAQ;AACZ,MAAI,UAAU;AAGd,QAAM,aAA4B,CAAC;AACnC,QAAM,OAAO,MAAM;AACjB,gBAAY;AAAA,EACd;AACA,QAAM,SAAS,IAAI;AAAA,IACjB;AAAA,MACE,UAAU,MAAM,YAAY;AAC1B,cAAM,UAAU,KAAK,YAAY;AACjC,YAAI,UAAU,GAAG;AACf,cAAI,WAAW,YAAY,MAAO,MAAK;AACvC,oBAAU;AAAA,QACZ;AACA,iBAAS;AACT,mBAAW,KAAK,OAAO,UAAU;AAGjC,YAAI,QAAQ,SAAS,GAAG,KAAK,CAAC,iBAAiB,IAAI,OAAO,EAAG,MAAK;AAClE,mBAAW,CAAC,SAAS,KAAK,KAAK,OAAO,QAAQ,UAAU,GAAG;AACzD,gBAAM,YAAY,QAAQ,YAAY;AACtC,cAAI,CAAC,mBAAmB,IAAI,SAAS,GAAG;AACtC,iBAAK;AACL;AAAA,UACF;AACA,cAAI,cAAc,WAAW,UAAU,cAAe,MAAK;AAC3D,cAAI,cAAc,iBAAiB,UAAU,gBAAiB,MAAK;AACnE,eACG,cAAc,UAAU,cAAc,iBACvC,CAAC,uBAAuB,KAAK,MAAM,KAAK,CAAC,GACzC;AACA,iBAAK;AAAA,UACP;AACA,cAAI,qBAAqB,KAAK,EAAG,MAAK;AAAA,QACxC;AAAA,MACF;AAAA,MACA,WAAW,OAAO,WAAW;AAC3B,iBAAS;AACT,cAAM,QAAQ,WAAW,IAAI;AAC7B,YAAI,aAAa,UAAU,OAAO,WAAY,MAAK;AAAA,MACrD;AAAA;AAAA;AAAA,MAGA,wBAAwB,MAAM;AAC5B,YAAI,KAAK,YAAY,MAAM,OAAQ,MAAK;AAAA,MAC1C;AAAA,MACA,cAAc;AAAA,MACd,OAAO,OAAO;AAAE,YAAI,UAAU,KAAK,MAAM,KAAK,EAAG,MAAK;AAAA,MAAG;AAAA,MACzD,SAAS;AAAA,IACX;AAAA,IACA,EAAE,SAAS,MAAM,gBAAgB,MAAM,sBAAsB,KAAK;AAAA,EACpE;AACA,MAAI;AACF,WAAO,MAAM,IAAI;AACjB,WAAO,IAAI;AAAA,EACb,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO,aAAa,WAAW,UAAU;AAC3C;","names":[]}
+{"version":3,"sources":["../src/svg-policy.ts"],"sourcesContent":["/**\n * Allowlist policy for imported SVG files.\n *\n * An SVG served from the docs origin and opened directly is a full document:\n * script, event handlers, `javascript:` links, animations that rewrite\n * `href`, foreign HTML, and remote references all run or load there. Regular\n * expressions miss namespace prefixes and entity-encoded values, so the file\n * is parsed as XML with entities decoded. It passes only if every element and\n * attribute is on a fixed allowlist of static drawing primitives, and every\n * reference stays inside the document. Anything else, including a\n * DOCTYPE, CDATA, or a parser error, sends the file to review.\n */\n\nimport { Parser } from \"htmlparser2\";\n\nconst SVG_NAMESPACE = \"http://www.w3.org/2000/svg\";\nconst XLINK_NAMESPACE = \"http://www.w3.org/1999/xlink\";\n\n/** Static drawing elements; no script, style, animation, link, or image. */\nconst ALLOWED_ELEMENTS = new Set([\n  \"svg\", \"g\", \"defs\", \"symbol\", \"use\", \"title\", \"desc\",\n  \"path\", \"rect\", \"circle\", \"ellipse\", \"line\", \"polyline\", \"polygon\",\n  \"text\", \"tspan\", \"textpath\",\n  \"lineargradient\", \"radialgradient\", \"stop\",\n  \"clippath\", \"mask\", \"pattern\", \"marker\",\n  \"filter\", \"feblend\", \"fecolormatrix\", \"fecomponenttransfer\", \"fecomposite\",\n  \"feconvolvematrix\", \"fediffuselighting\", \"fedisplacementmap\",\n  \"fedistantlight\", \"fedropshadow\", \"feflood\", \"fefunca\", \"fefuncb\",\n  \"fefuncg\", \"fefuncr\", \"fegaussianblur\", \"femerge\", \"femergenode\",\n  \"femorphology\", \"feoffset\", \"fepointlight\", \"fespecularlighting\",\n  \"fespotlight\", \"fetile\", \"feturbulence\",\n]);\n\n/** Geometry, paint, text, gradient, and filter attributes (lowercased). */\nconst ALLOWED_ATTRIBUTES = new Set([\n  \"xmlns\", \"xmlns:xlink\", \"xml:space\", \"version\", \"baseprofile\",\n  \"id\", \"class\", \"viewbox\", \"preserveaspectratio\", \"width\", \"height\",\n  \"x\", \"y\", \"x1\", \"y1\", \"x2\", \"y2\", \"cx\", \"cy\", \"r\", \"rx\", \"ry\",\n  \"d\", \"points\", \"pathlength\", \"transform\", \"transform-origin\",\n  \"fill\", \"fill-opacity\", \"fill-rule\", \"stroke\", \"stroke-width\",\n  // Some SVG exporters persist React spellings. These remain fixed static\n  // drawing attributes; accepting them never grants arbitrary JSX execution.\n  \"fillrule\", \"cliprule\",\n  \"stroke-opacity\", \"stroke-linecap\", \"stroke-linejoin\",\n  \"stroke-miterlimit\", \"stroke-dasharray\", \"stroke-dashoffset\",\n  \"opacity\", \"color\", \"display\", \"visibility\", \"overflow\",\n  \"clip-path\", \"clip-rule\", \"clippathunits\", \"mask\", \"maskunits\",\n  \"maskcontentunits\", \"filter\", \"filterunits\", \"primitiveunits\",\n  \"marker-start\", \"marker-mid\", \"marker-end\", \"markerwidth\", \"markerheight\",\n  \"markerunits\", \"refx\", \"refy\", \"orient\",\n  \"patternunits\", \"patterncontentunits\", \"patterntransform\",\n  \"gradientunits\", \"gradienttransform\", \"spreadmethod\", \"fx\", \"fy\", \"fr\",\n  \"offset\", \"stop-color\", \"stop-opacity\",\n  \"font-family\", \"font-size\", \"font-weight\", \"font-style\", \"font-variant\",\n  \"letter-spacing\", \"word-spacing\", \"text-anchor\", \"dominant-baseline\",\n  \"alignment-baseline\", \"baseline-shift\", \"text-decoration\", \"dx\", \"dy\",\n  \"rotate\", \"textlength\", \"lengthadjust\", \"startoffset\", \"writing-mode\",\n  \"direction\", \"unicode-bidi\", \"shape-rendering\", \"text-rendering\",\n  \"image-rendering\", \"color-interpolation\", \"color-interpolation-filters\",\n  \"vector-effect\", \"paint-order\", \"mix-blend-mode\", \"isolation\",\n  \"in\", \"in2\", \"result\", \"stddeviation\", \"mode\", \"type\", \"values\",\n  \"tablevalues\", \"slope\", \"intercept\", \"amplitude\", \"exponent\",\n  \"operator\", \"k1\", \"k2\", \"k3\", \"k4\", \"radius\", \"scale\",\n  \"xchannelselector\", \"ychannelselector\", \"basefrequency\", \"numoctaves\",\n  \"seed\", \"stitchtiles\", \"flood-color\", \"flood-opacity\", \"lighting-color\",\n  \"surfacescale\", \"diffuseconstant\", \"specularconstant\",\n  \"specularexponent\", \"kernelmatrix\", \"kernelunitlength\", \"order\",\n  \"divisor\", \"bias\", \"targetx\", \"targety\", \"edgemode\", \"preservealpha\",\n  \"azimuth\", \"elevation\", \"z\", \"pointsatx\", \"pointsaty\", \"pointsatz\",\n  \"limitingconeangle\", \"aria-hidden\", \"aria-label\", \"aria-labelledby\", \"aria-describedby\", \"role\", \"focusable\",\n  // Validated below: only in-document fragment references.\n  \"href\", \"xlink:href\",\n]);\n\n/** Paint and reference values may point only at in-document fragments. */\nfunction hasExternalReference(value: string): boolean {\n  // CSS escapes can spell url()/schemes without their literal bytes. Drawing\n  // attributes do not need escapes, so reject them rather than parse CSS twice.\n  if (value.includes(\"\\\\\")) return true;\n  const compact = value.replace(/[\\u0000- ]/gu, \"\").toLowerCase();\n  if (/(?:java|vb)script:|data:|expression\\(|@import|<|>/u.test(compact)) {\n    return true;\n  }\n  for (const match of compact.matchAll(/url\\(([^)]*)\\)/gu)) {\n    if (!/^[\"']?#[a-z0-9_.:-]+[\"']?$/u.test(match[1])) return true;\n  }\n  // CSS consumes an unterminated url() through EOF and browsers can still load\n  // it. A balanced-match loop alone therefore misses an external paint server.\n  return compact.replace(/url\\(([^)]*)\\)/gu, \"\").includes(\"url(\");\n}\n\n/**\n * Only UTF-8 is accepted: a UTF-16/32 byte order mark or a declared\n * non-UTF-8 encoding would make browsers read different markup than the\n * policy parsed.\n */\nfunction utf8SvgText(content: Buffer): string | null {\n  const hasUtf8Bom =\n    content[0] === 0xef && content[1] === 0xbb && content[2] === 0xbf;\n  const body = hasUtf8Bom ? content.subarray(3) : content;\n  if (\n    (body[0] === 0xfe && body[1] === 0xff) ||\n    (body[0] === 0xff && body[1] === 0xfe) ||\n    (body[0] === 0x00 && body[1] === 0x00) ||\n    body.includes(0x00)\n  ) {\n    return null;\n  }\n  const text = body.toString(\"utf8\");\n  if (text.includes(\"\\uFFFD\")) return null;\n  const declaration = /^<\\?xml\\b[^>]*\\?>/iu.exec(text);\n  if (declaration) {\n    const encoding = /\\bencoding\\s*=\\s*[\"']([^\"']*)[\"']/iu.exec(declaration[0]);\n    if (encoding && !/^utf-?8$/iu.test(encoding[1].trim())) return null;\n  } else if (/<\\?xml\\b/iu.test(text)) {\n    // A declaration anywhere but the very start is malformed XML.\n    return null;\n  }\n  return text;\n}\n\n/** True when an SVG uses only static, self-contained drawing features. */\nexport function isPassiveSvg(content: Uint8Array): boolean {\n  const text = utf8SvgText(Buffer.from(content.buffer, content.byteOffset, content.byteLength));\n  if (text === null) return false;\n  let isPassive = true;\n  let depth = 0;\n  let sawRoot = false;\n  // Start offsets of open elements: an implied close is legitimate only for\n  // a self-closing tag (same token); otherwise the markup is malformed.\n  const openStarts: Array<number> = [];\n  const fail = () => {\n    isPassive = false;\n  };\n  const parser = new Parser(\n    {\n      onopentag(name, attributes) {\n        const element = name.toLowerCase();\n        if (depth === 0) {\n          if (sawRoot || element !== \"svg\") fail();\n          sawRoot = true;\n        }\n        depth += 1;\n        openStarts.push(parser.startIndex);\n        // Prefixed names (`s:script`) are rejected outright: the allowlist\n        // is defined for the SVG namespace only.\n        if (element.includes(\":\") || !ALLOWED_ELEMENTS.has(element)) fail();\n        for (const [rawName, value] of Object.entries(attributes)) {\n          const attribute = rawName.toLowerCase();\n          if (!ALLOWED_ATTRIBUTES.has(attribute)) {\n            fail();\n            continue;\n          }\n          if (attribute === \"xmlns\" && value !== SVG_NAMESPACE) fail();\n          if (attribute === \"xmlns:xlink\" && value !== XLINK_NAMESPACE) fail();\n          if (\n            (attribute === \"href\" || attribute === \"xlink:href\") &&\n            !/^#[A-Za-z0-9_.:-]+$/u.test(value.trim())\n          ) {\n            fail();\n          }\n          if (hasExternalReference(value)) fail();\n        }\n      },\n      onclosetag(_name, isImplied) {\n        depth -= 1;\n        const start = openStarts.pop();\n        if (isImplied && start !== parser.startIndex) fail();\n      },\n      // DOCTYPE (and with it custom entities) or any other declaration other\n      // than the XML prolog.\n      onprocessinginstruction(name) {\n        if (name.toLowerCase() !== \"?xml\") fail();\n      },\n      oncdatastart: fail,\n      ontext(value) { if (depth === 0 && value.trim()) fail(); },\n      onerror: fail,\n    },\n    { xmlMode: true, decodeEntities: true, recognizeSelfClosing: true },\n  );\n  try {\n    parser.write(text);\n    parser.end();\n  } catch {\n    return false;\n  }\n  return isPassive && sawRoot && depth === 0;\n}\n"],"mappings":";AAaA,SAAS,cAAc;AAEvB,IAAM,gBAAgB;AACtB,IAAM,kBAAkB;AAGxB,IAAM,mBAAmB,oBAAI,IAAI;AAAA,EAC/B;AAAA,EAAO;AAAA,EAAK;AAAA,EAAQ;AAAA,EAAU;AAAA,EAAO;AAAA,EAAS;AAAA,EAC9C;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAU;AAAA,EAAW;AAAA,EAAQ;AAAA,EAAY;AAAA,EACzD;AAAA,EAAQ;AAAA,EAAS;AAAA,EACjB;AAAA,EAAkB;AAAA,EAAkB;AAAA,EACpC;AAAA,EAAY;AAAA,EAAQ;AAAA,EAAW;AAAA,EAC/B;AAAA,EAAU;AAAA,EAAW;AAAA,EAAiB;AAAA,EAAuB;AAAA,EAC7D;AAAA,EAAoB;AAAA,EAAqB;AAAA,EACzC;AAAA,EAAkB;AAAA,EAAgB;AAAA,EAAW;AAAA,EAAW;AAAA,EACxD;AAAA,EAAW;AAAA,EAAW;AAAA,EAAkB;AAAA,EAAW;AAAA,EACnD;AAAA,EAAgB;AAAA,EAAY;AAAA,EAAgB;AAAA,EAC5C;AAAA,EAAe;AAAA,EAAU;AAC3B,CAAC;AAGD,IAAM,qBAAqB,oBAAI,IAAI;AAAA,EACjC;AAAA,EAAS;AAAA,EAAe;AAAA,EAAa;AAAA,EAAW;AAAA,EAChD;AAAA,EAAM;AAAA,EAAS;AAAA,EAAW;AAAA,EAAuB;AAAA,EAAS;AAAA,EAC1D;AAAA,EAAK;AAAA,EAAK;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAK;AAAA,EAAM;AAAA,EACzD;AAAA,EAAK;AAAA,EAAU;AAAA,EAAc;AAAA,EAAa;AAAA,EAC1C;AAAA,EAAQ;AAAA,EAAgB;AAAA,EAAa;AAAA,EAAU;AAAA;AAAA;AAAA,EAG/C;AAAA,EAAY;AAAA,EACZ;AAAA,EAAkB;AAAA,EAAkB;AAAA,EACpC;AAAA,EAAqB;AAAA,EAAoB;AAAA,EACzC;AAAA,EAAW;AAAA,EAAS;AAAA,EAAW;AAAA,EAAc;AAAA,EAC7C;AAAA,EAAa;AAAA,EAAa;AAAA,EAAiB;AAAA,EAAQ;AAAA,EACnD;AAAA,EAAoB;AAAA,EAAU;AAAA,EAAe;AAAA,EAC7C;AAAA,EAAgB;AAAA,EAAc;AAAA,EAAc;AAAA,EAAe;AAAA,EAC3D;AAAA,EAAe;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAC/B;AAAA,EAAgB;AAAA,EAAuB;AAAA,EACvC;AAAA,EAAiB;AAAA,EAAqB;AAAA,EAAgB;AAAA,EAAM;AAAA,EAAM;AAAA,EAClE;AAAA,EAAU;AAAA,EAAc;AAAA,EACxB;AAAA,EAAe;AAAA,EAAa;AAAA,EAAe;AAAA,EAAc;AAAA,EACzD;AAAA,EAAkB;AAAA,EAAgB;AAAA,EAAe;AAAA,EACjD;AAAA,EAAsB;AAAA,EAAkB;AAAA,EAAmB;AAAA,EAAM;AAAA,EACjE;AAAA,EAAU;AAAA,EAAc;AAAA,EAAgB;AAAA,EAAe;AAAA,EACvD;AAAA,EAAa;AAAA,EAAgB;AAAA,EAAmB;AAAA,EAChD;AAAA,EAAmB;AAAA,EAAuB;AAAA,EAC1C;AAAA,EAAiB;AAAA,EAAe;AAAA,EAAkB;AAAA,EAClD;AAAA,EAAM;AAAA,EAAO;AAAA,EAAU;AAAA,EAAgB;AAAA,EAAQ;AAAA,EAAQ;AAAA,EACvD;AAAA,EAAe;AAAA,EAAS;AAAA,EAAa;AAAA,EAAa;AAAA,EAClD;AAAA,EAAY;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAU;AAAA,EAC9C;AAAA,EAAoB;AAAA,EAAoB;AAAA,EAAiB;AAAA,EACzD;AAAA,EAAQ;AAAA,EAAe;AAAA,EAAe;AAAA,EAAiB;AAAA,EACvD;AAAA,EAAgB;AAAA,EAAmB;AAAA,EACnC;AAAA,EAAoB;AAAA,EAAgB;AAAA,EAAoB;AAAA,EACxD;AAAA,EAAW;AAAA,EAAQ;AAAA,EAAW;AAAA,EAAW;AAAA,EAAY;AAAA,EACrD;AAAA,EAAW;AAAA,EAAa;AAAA,EAAK;AAAA,EAAa;AAAA,EAAa;AAAA,EACvD;AAAA,EAAqB;AAAA,EAAe;AAAA,EAAc;AAAA,EAAmB;AAAA,EAAoB;AAAA,EAAQ;AAAA;AAAA,EAEjG;AAAA,EAAQ;AACV,CAAC;AAGD,SAAS,qBAAqB,OAAwB;AAGpD,MAAI,MAAM,SAAS,IAAI,EAAG,QAAO;AACjC,QAAM,UAAU,MAAM,QAAQ,gBAAgB,EAAE,EAAE,YAAY;AAC9D,MAAI,qDAAqD,KAAK,OAAO,GAAG;AACtE,WAAO;AAAA,EACT;AACA,aAAW,SAAS,QAAQ,SAAS,kBAAkB,GAAG;AACxD,QAAI,CAAC,8BAA8B,KAAK,MAAM,CAAC,CAAC,EAAG,QAAO;AAAA,EAC5D;AAGA,SAAO,QAAQ,QAAQ,oBAAoB,EAAE,EAAE,SAAS,MAAM;AAChE;AAOA,SAAS,YAAY,SAAgC;AACnD,QAAM,aACJ,QAAQ,CAAC,MAAM,OAAQ,QAAQ,CAAC,MAAM,OAAQ,QAAQ,CAAC,MAAM;AAC/D,QAAM,OAAO,aAAa,QAAQ,SAAS,CAAC,IAAI;AAChD,MACG,KAAK,CAAC,MAAM,OAAQ,KAAK,CAAC,MAAM,OAChC,KAAK,CAAC,MAAM,OAAQ,KAAK,CAAC,MAAM,OAChC,KAAK,CAAC,MAAM,KAAQ,KAAK,CAAC,MAAM,KACjC,KAAK,SAAS,CAAI,GAClB;AACA,WAAO;AAAA,EACT;AACA,QAAM,OAAO,KAAK,SAAS,MAAM;AACjC,MAAI,KAAK,SAAS,QAAQ,EAAG,QAAO;AACpC,QAAM,cAAc,sBAAsB,KAAK,IAAI;AACnD,MAAI,aAAa;AACf,UAAM,WAAW,sCAAsC,KAAK,YAAY,CAAC,CAAC;AAC1E,QAAI,YAAY,CAAC,aAAa,KAAK,SAAS,CAAC,EAAE,KAAK,CAAC,EAAG,QAAO;AAAA,EACjE,WAAW,aAAa,KAAK,IAAI,GAAG;AAElC,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAGO,SAAS,aAAa,SAA8B;AACzD,QAAM,OAAO,YAAY,OAAO,KAAK,QAAQ,QAAQ,QAAQ,YAAY,QAAQ,UAAU,CAAC;AAC5F,MAAI,SAAS,KAAM,QAAO;AAC1B,MAAI,YAAY;AAChB,MAAI,QAAQ;AACZ,MAAI,UAAU;AAGd,QAAM,aAA4B,CAAC;AACnC,QAAM,OAAO,MAAM;AACjB,gBAAY;AAAA,EACd;AACA,QAAM,SAAS,IAAI;AAAA,IACjB;AAAA,MACE,UAAU,MAAM,YAAY;AAC1B,cAAM,UAAU,KAAK,YAAY;AACjC,YAAI,UAAU,GAAG;AACf,cAAI,WAAW,YAAY,MAAO,MAAK;AACvC,oBAAU;AAAA,QACZ;AACA,iBAAS;AACT,mBAAW,KAAK,OAAO,UAAU;AAGjC,YAAI,QAAQ,SAAS,GAAG,KAAK,CAAC,iBAAiB,IAAI,OAAO,EAAG,MAAK;AAClE,mBAAW,CAAC,SAAS,KAAK,KAAK,OAAO,QAAQ,UAAU,GAAG;AACzD,gBAAM,YAAY,QAAQ,YAAY;AACtC,cAAI,CAAC,mBAAmB,IAAI,SAAS,GAAG;AACtC,iBAAK;AACL;AAAA,UACF;AACA,cAAI,cAAc,WAAW,UAAU,cAAe,MAAK;AAC3D,cAAI,cAAc,iBAAiB,UAAU,gBAAiB,MAAK;AACnE,eACG,cAAc,UAAU,cAAc,iBACvC,CAAC,uBAAuB,KAAK,MAAM,KAAK,CAAC,GACzC;AACA,iBAAK;AAAA,UACP;AACA,cAAI,qBAAqB,KAAK,EAAG,MAAK;AAAA,QACxC;AAAA,MACF;AAAA,MACA,WAAW,OAAO,WAAW;AAC3B,iBAAS;AACT,cAAM,QAAQ,WAAW,IAAI;AAC7B,YAAI,aAAa,UAAU,OAAO,WAAY,MAAK;AAAA,MACrD;AAAA;AAAA;AAAA,MAGA,wBAAwB,MAAM;AAC5B,YAAI,KAAK,YAAY,MAAM,OAAQ,MAAK;AAAA,MAC1C;AAAA,MACA,cAAc;AAAA,MACd,OAAO,OAAO;AAAE,YAAI,UAAU,KAAK,MAAM,KAAK,EAAG,MAAK;AAAA,MAAG;AAAA,MACzD,SAAS;AAAA,IACX;AAAA,IACA,EAAE,SAAS,MAAM,gBAAgB,MAAM,sBAAsB,KAAK;AAAA,EACpE;AACA,MAAI;AACF,WAAO,MAAM,IAAI;AACjB,WAAO,IAAI;AAAA,EACb,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO,aAAa,WAAW,UAAU;AAC3C;","names":[]}

package/dist/url-migration.d.ts

@@ -1,5 +1,5 @@
-import { h as MigrationCapture } from './url-run-BOZvcGs1.js';
-export { a as MigrationAsset, f as MigrationBundle, i as MigrationCaptureProvider, j as MigrationCaptureState, k as MigrationCapturedAsset, g as MigrationDocsConfig, l as MigrationEvidence, m as MigrationFetchRequest, n as MigrationFetchResponse, d as MigrationFetcher, o as MigrationJournalAsset, b as MigrationNavigationGroup, p as MigrationNavigationOccurrence, q as MigrationNavigationTab, M as MigrationPage, e as MigrationPlatform, c as MigrationWarning, R as RenderedMigrationFile, U as UrlMigrationCheckpoint, r as UrlMigrationCheckpointDelta, s as UrlMigrationIssue, t as UrlMigrationRecord, u as UrlMigrationRun, v as UrlMigrationRunOptions, w as UrlMigrationValidation, x as classifyMigrationResponse, z as renderMigrationFiles, A as runUrlMigration, B as validateUrlMigration } from './url-run-BOZvcGs1.js';
+import { h as MigrationCapture } from './url-run-mSKFqHx_.js';
+export { a as MigrationAsset, f as MigrationBundle, i as MigrationCaptureProvider, j as MigrationCaptureState, k as MigrationCapturedAsset, g as MigrationDocsConfig, l as MigrationEvidence, m as MigrationFetchRequest, n as MigrationFetchResponse, d as MigrationFetcher, o as MigrationJournalAsset, b as MigrationNavigationGroup, p as MigrationNavigationOccurrence, q as MigrationNavigationTab, M as MigrationPage, e as MigrationPlatform, c as MigrationWarning, R as RenderedMigrationFile, U as UrlMigrationCheckpoint, r as UrlMigrationCheckpointDelta, s as UrlMigrationIssue, t as UrlMigrationRecord, u as UrlMigrationRun, v as UrlMigrationRunOptions, w as UrlMigrationValidation, x as classifyMigrationResponse, z as renderMigrationFiles, A as runUrlMigration, B as validateUrlMigration } from './url-run-mSKFqHx_.js';
 
 interface UrlMigrationScope {
     scopePath: string;