{"version":3,"file":"security-sandbox.mjs","sources":["../../../src/lib/vdom/security-sandbox.ts"],"sourcesContent":["/**\n * @file Security Sandbox\n * @module vdom/security-sandbox\n * @description Comprehensive security layer for module boundaries providing\n * CSP integration, XSS prevention, sanitized hydration, and secure cross-module\n * communication. Implements defense-in-depth security strategies.\n *\n * @author Agent 5 - PhD Virtual DOM Expert\n * @version 1.0.0\n */\n\nimport {\n type ModuleId,\n type SecurityNonce,\n type ModuleSecurityConfig,\n type SecurityContext,\n type SecurityViolation,\n type CSPDirectives,\n type HydrationData,\n DEFAULT_SECURITY_CONFIG,\n createSecurityNonce,\n} from './types';\nimport { devWarn } from '@/lib/core/config/env-helper';\n\n// ============================================================================\n// Constants\n// ============================================================================\n\n/**\n * Dangerous HTML patterns to sanitize.\n */\nconst DANGEROUS_PATTERNS: RegExp[] = [\n /)<[^<]*)*<\\/script>/gi,\n /javascript:/gi,\n /on\\w+\\s*=/gi,\n /data:/gi,\n /]*>/gi,\n /]*>/gi,\n /]*>/gi,\n /]*>/gi,\n /expression\\s*\\(/gi,\n /url\\s*\\(/gi,\n];\n\n/**\n * Safe HTML tags whitelist.\n */\nconst SAFE_TAGS = new Set([\n 'a',\n 'abbr',\n 'b',\n 'blockquote',\n 'br',\n 'code',\n 'dd',\n 'div',\n 'dl',\n 'dt',\n 'em',\n 'h1',\n 'h2',\n 'h3',\n 'h4',\n 'h5',\n 'h6',\n 'hr',\n 'i',\n 'img',\n 'li',\n 'ol',\n 'p',\n 'pre',\n 'q',\n 's',\n 'small',\n 'span',\n 'strong',\n 'sub',\n 'sup',\n 'table',\n 'tbody',\n 'td',\n 'tfoot',\n 'th',\n 'thead',\n 'tr',\n 'u',\n 'ul',\n]);\n\n/**\n * Safe attributes whitelist.\n */\nconst SAFE_ATTRIBUTES = new Set([\n 'alt',\n 'class',\n 'dir',\n 'height',\n 'href',\n 'id',\n 'lang',\n 'name',\n 'rel',\n 'src',\n 'style',\n 'target',\n 'title',\n 'type',\n 'width',\n]);\n\n/**\n * URL schemes whitelist.\n */\nconst SAFE_URL_SCHEMES = new Set(['http:', 'https:', 'mailto:', 'tel:']);\n\n/**\n * Safe CSS properties whitelist.\n *\n * SECURITY: Only these CSS properties are allowed in style attributes.\n * This is a defense-in-depth measure against CSS injection attacks that\n * could lead to data exfiltration or UI manipulation.\n *\n * Properties are categorized for maintainability:\n * - Layout: display, position, overflow, visibility\n * - Sizing: width, height, margin, padding\n * - Typography: font-*, text-*, line-height, letter-spacing\n * - Colors: color, background-color, border-color, opacity\n * - Borders: border-*, border-radius\n * - Flexbox: flex-*, justify-*, align-*\n * - Grid: grid-* (basic)\n * - Effects: box-shadow (without url), transform (limited)\n */\nconst SAFE_CSS_PROPERTIES = new Set([\n // Layout\n 'display',\n 'position',\n 'top',\n 'right',\n 'bottom',\n 'left',\n 'float',\n 'clear',\n 'visibility',\n 'overflow',\n 'overflow-x',\n 'overflow-y',\n 'z-index',\n // Sizing\n 'width',\n 'height',\n 'min-width',\n 'max-width',\n 'min-height',\n 'max-height',\n 'margin',\n 'margin-top',\n 'margin-right',\n 'margin-bottom',\n 'margin-left',\n 'padding',\n 'padding-top',\n 'padding-right',\n 'padding-bottom',\n 'padding-left',\n 'box-sizing',\n // Typography\n 'font',\n 'font-family',\n 'font-size',\n 'font-weight',\n 'font-style',\n 'font-variant',\n 'line-height',\n 'letter-spacing',\n 'word-spacing',\n 'text-align',\n 'text-decoration',\n 'text-transform',\n 'text-indent',\n 'white-space',\n 'word-wrap',\n 'word-break',\n 'vertical-align',\n // Colors\n 'color',\n 'background',\n 'background-color',\n 'background-position',\n 'background-repeat',\n 'background-size',\n 'border-color',\n 'opacity',\n // Borders\n 'border',\n 'border-width',\n 'border-style',\n 'border-color',\n 'border-top',\n 'border-right',\n 'border-bottom',\n 'border-left',\n 'border-top-width',\n 'border-right-width',\n 'border-bottom-width',\n 'border-left-width',\n 'border-top-style',\n 'border-right-style',\n 'border-bottom-style',\n 'border-left-style',\n 'border-top-color',\n 'border-right-color',\n 'border-bottom-color',\n 'border-left-color',\n 'border-radius',\n 'border-top-left-radius',\n 'border-top-right-radius',\n 'border-bottom-left-radius',\n 'border-bottom-right-radius',\n 'outline',\n 'outline-width',\n 'outline-style',\n 'outline-color',\n // Flexbox\n 'flex',\n 'flex-direction',\n 'flex-wrap',\n 'flex-flow',\n 'flex-grow',\n 'flex-shrink',\n 'flex-basis',\n 'justify-content',\n 'align-items',\n 'align-self',\n 'align-content',\n 'order',\n 'gap',\n 'row-gap',\n 'column-gap',\n // Grid (basic)\n 'grid-template-columns',\n 'grid-template-rows',\n 'grid-column',\n 'grid-row',\n 'grid-gap',\n // Table\n 'table-layout',\n 'border-collapse',\n 'border-spacing',\n // Misc safe properties\n 'cursor',\n 'list-style',\n 'list-style-type',\n 'list-style-position',\n 'pointer-events',\n 'user-select',\n]);\n\n/**\n * Dangerous patterns in CSS values that should block the property.\n *\n * SECURITY: These patterns in CSS values can lead to XSS or data exfiltration:\n * - url() - Can load external resources or execute javascript:\n * - expression() - IE-specific CSS expressions (execute JavaScript)\n * - javascript: - Direct JavaScript execution\n * - behavior: - IE-specific HTC behaviors\n * - -moz-binding: - Firefox XBL binding\n * - @import - Can load external stylesheets\n * - var() with untrusted content - CSS variable injection\n */\nconst DANGEROUS_CSS_VALUE_PATTERNS = [\n /url\\s*\\(/i,\n /expression\\s*\\(/i,\n /javascript\\s*:/i,\n /behavior\\s*:/i,\n /-moz-binding\\s*:/i,\n /@import/i,\n /\\\\[0-9a-f]/i, // Encoded characters\n];\n\n// ============================================================================\n// Utility Functions\n// ============================================================================\n\n/**\n * Generates a cryptographically secure nonce.\n * @returns Security nonce\n */\nfunction generateNonce(): SecurityNonce {\n const array = new Uint8Array(16);\n crypto.getRandomValues(array);\n const nonce = Array.from(array, (byte) =>\n byte.toString(16).padStart(2, '0')\n ).join('');\n return createSecurityNonce(nonce);\n}\n\n/**\n * Escapes HTML special characters.\n * @param str - String to escape\n * @returns Escaped string\n */\nfunction escapeHtml(str: string): string {\n const htmlEscapes: Record = {\n '&': '&',\n '<': '<',\n '>': '>',\n '\"': '"',\n \"'\": ''',\n '/': '/',\n '`': '`',\n '=': '=',\n };\n\n return str.replace(/[&<>\"'`=/]/g, (char) => htmlEscapes[char] ?? char);\n}\n\n/**\n * Validates a URL against safe schemes.\n * @param url - URL to validate\n * @returns Whether URL is safe\n */\nfunction isUrlSafe(url: string): boolean {\n try {\n const parsed = new URL(url, window.location.origin);\n return SAFE_URL_SCHEMES.has(parsed.protocol);\n } catch {\n return false;\n }\n}\n\n/**\n * Computes a checksum for data integrity.\n * @param data - Data to checksum\n * @returns Checksum string\n */\nasync function computeChecksum(data: string): Promise {\n const encoder = new TextEncoder();\n const dataBuffer = encoder.encode(data);\n const hashBuffer = await crypto.subtle.digest('SHA-256', dataBuffer);\n const hashArray = Array.from(new Uint8Array(hashBuffer));\n return hashArray.map((b) => b.toString(16).padStart(2, '0')).join('');\n}\n\n// ============================================================================\n// ContentSanitizer Class\n// ============================================================================\n\n/**\n * Sanitizes HTML content to prevent XSS attacks.\n */\nexport class ContentSanitizer {\n /** Custom safe tags */\n private readonly customSafeTags: Set;\n\n /** Custom safe attributes */\n private readonly customSafeAttributes: Set;\n\n /**\n * Creates a new ContentSanitizer.\n * @param options - Sanitizer options\n */\n constructor(\n options: {\n additionalTags?: string[];\n additionalAttributes?: string[];\n } = {}\n ) {\n this.customSafeTags = new Set([\n ...SAFE_TAGS,\n ...(options.additionalTags ?? []),\n ]);\n this.customSafeAttributes = new Set([\n ...SAFE_ATTRIBUTES,\n ...(options.additionalAttributes ?? []),\n ]);\n }\n\n /**\n * Sanitizes HTML content.\n * @param html - HTML to sanitize\n * @returns Sanitized HTML\n */\n sanitize(html: string): string {\n // First pass: Remove dangerous patterns\n let sanitized = html;\n for (const pattern of DANGEROUS_PATTERNS) {\n sanitized = sanitized.replace(pattern, '');\n }\n\n // Use DOMParser for structured sanitization if available\n if (typeof DOMParser !== 'undefined') {\n sanitized = this.sanitizeWithDOM(sanitized);\n }\n\n return sanitized;\n }\n\n /**\n * Sanitizes plain text (escape HTML).\n * @param text - Text to sanitize\n * @returns Escaped text\n */\n sanitizeText(text: string): string {\n return escapeHtml(text);\n }\n\n /**\n * Validates content against dangerous patterns.\n * @param content - Content to validate\n * @returns Whether content is safe\n */\n validate(content: string): boolean {\n for (const pattern of DANGEROUS_PATTERNS) {\n if (pattern.test(content)) {\n return false;\n }\n }\n return true;\n }\n\n /**\n * Sanitizes HTML using DOM parsing.\n * @param html - HTML to sanitize\n * @returns Sanitized HTML\n */\n private sanitizeWithDOM(html: string): string {\n const parser = new DOMParser();\n const doc = parser.parseFromString(html, 'text/html');\n this.sanitizeNode(doc.body);\n return doc.body.innerHTML;\n }\n\n /**\n * Recursively sanitizes a DOM node.\n * @param node - Node to sanitize\n */\n private sanitizeNode(node: Node): void {\n const nodesToRemove: Node[] = [];\n\n for (const child of Array.from(node.childNodes)) {\n if (child.nodeType === Node.ELEMENT_NODE) {\n const element = child as Element;\n const tagName = element.tagName.toLowerCase();\n\n // Remove unsafe tags\n if (!this.customSafeTags.has(tagName)) {\n nodesToRemove.push(child);\n continue;\n }\n\n // Sanitize attributes\n for (const attr of Array.from(element.attributes)) {\n if (!this.customSafeAttributes.has(attr.name.toLowerCase())) {\n element.removeAttribute(attr.name);\n continue;\n }\n\n // Validate URLs\n if (\n (attr.name === 'href' || attr.name === 'src') &&\n !isUrlSafe(attr.value)\n ) {\n element.removeAttribute(attr.name);\n }\n\n // Validate style attribute\n if (attr.name === 'style') {\n element.setAttribute('style', this.sanitizeStyle(attr.value));\n }\n }\n\n // Recurse into children\n this.sanitizeNode(element);\n } else if (child.nodeType === Node.COMMENT_NODE) {\n // Remove comments\n nodesToRemove.push(child);\n }\n }\n\n // Remove marked nodes\n for (const nodeToRemove of nodesToRemove) {\n node.removeChild(nodeToRemove);\n }\n }\n\n /**\n * Sanitizes CSS style content using allowlist approach.\n *\n * SECURITY: Uses an allowlist of safe CSS properties rather than a blocklist.\n * This is significantly more secure because:\n * - Blocklists can be bypassed with encoding tricks, browser quirks, or new attack vectors\n * - Allowlists only permit known-safe properties, blocking unknown/dangerous ones by default\n *\n * Each CSS property is validated:\n * 1. Property name must be in the SAFE_CSS_PROPERTIES allowlist\n * 2. Property value must not contain dangerous patterns (url(), expression(), etc.)\n *\n * @param style - Style string to sanitize\n * @returns Sanitized style string with only safe properties\n */\n private sanitizeStyle(style: string): string {\n if (!style) {\n return '';\n }\n\n // Parse style declarations\n const declarations = style.split(';');\n const sanitizedDeclarations: string[] = [];\n\n for (const declaration of declarations) {\n const trimmed = declaration.trim();\n if (!trimmed) continue;\n\n // Split into property and value\n const colonIndex = trimmed.indexOf(':');\n if (colonIndex === -1) continue;\n\n const property = trimmed.substring(0, colonIndex).trim().toLowerCase();\n const value = trimmed.substring(colonIndex + 1).trim();\n\n // Skip if property is empty or value is empty\n if (!property || !value) continue;\n\n // SECURITY: Only allow properties in the safe list (allowlist approach)\n if (!SAFE_CSS_PROPERTIES.has(property)) {\n continue; // Skip unknown/dangerous properties\n }\n\n // SECURITY: Check value for dangerous patterns\n if (this.containsDangerousCSSValue(value)) {\n continue; // Skip properties with dangerous values\n }\n\n sanitizedDeclarations.push(`${property}: ${value}`);\n }\n\n return sanitizedDeclarations.join('; ');\n }\n\n /**\n * Checks if a CSS value contains dangerous patterns.\n *\n * SECURITY: Defense-in-depth check for values that could execute code\n * or exfiltrate data, even within allowed properties.\n *\n * @param value - CSS value to check\n * @returns true if value contains dangerous patterns\n */\n private containsDangerousCSSValue(value: string): boolean {\n const lowerValue = value.toLowerCase();\n\n // Check against all dangerous patterns\n for (const pattern of DANGEROUS_CSS_VALUE_PATTERNS) {\n if (pattern.test(lowerValue)) {\n return true;\n }\n }\n\n // Additional checks for common XSS vectors in CSS\n // Check for data: URIs (can be used for script injection)\n if (/data\\s*:/i.test(lowerValue)) {\n return true;\n }\n\n // Check for vbscript: (IE-specific)\n if (/vbscript\\s*:/i.test(lowerValue)) {\n return true;\n }\n\n // Check for -o-link (Opera-specific, can execute JavaScript)\n return /-o-link/i.test(lowerValue);\n\n\n }\n}\n\n// ============================================================================\n// CSPManager Class\n// ============================================================================\n\n/**\n * Manages Content Security Policy for modules.\n */\nexport class CSPManager {\n /** CSP directives */\n private readonly directives: CSPDirectives;\n\n /** Generated nonce */\n private readonly nonce: SecurityNonce;\n\n /**\n * Creates a new CSPManager.\n * @param directives - CSP directives\n */\n constructor(directives: CSPDirectives = {}) {\n this.directives = directives;\n this.nonce = generateNonce();\n }\n\n /**\n * Gets the current nonce.\n */\n getNonce(): SecurityNonce {\n return this.nonce;\n }\n\n /**\n * Generates CSP header value.\n * @returns CSP header string\n */\n generateHeader(): string {\n const parts: string[] = [];\n\n const directiveNames = Object.keys(this.directives) as Array<\n keyof CSPDirectives\n >;\n\n for (const directive of directiveNames) {\n const values = this.directives[directive];\n if (values && values.length > 0) {\n // Add nonce to script-src and style-src\n if (directive === 'script-src' || directive === 'style-src') {\n parts.push(`${directive} 'nonce-${this.nonce}' ${values.join(' ')}`);\n } else {\n parts.push(`${directive} ${values.join(' ')}`);\n }\n }\n }\n\n return parts.join('; ');\n }\n\n /**\n * Validates content against CSP directives.\n * @param type - Content type\n * @param source - Content source\n * @returns Whether content is allowed\n */\n validateSource(\n type: keyof CSPDirectives,\n source: string\n ): boolean {\n const allowedSources = this.directives[type];\n if (!allowedSources || allowedSources.length === 0) {\n // Fall back to default-src\n const defaultSrc = this.directives['default-src'];\n if (!defaultSrc || defaultSrc.length === 0) {\n return true; // No restriction\n }\n return this.matchesSource(source, defaultSrc);\n }\n\n return this.matchesSource(source, allowedSources);\n }\n\n /**\n * Applies CSP meta tag to document.\n */\n applyMetaTag(): void {\n const existing = document.querySelector('meta[http-equiv=\"Content-Security-Policy\"]');\n if (existing) {\n existing.remove();\n }\n\n const meta = document.createElement('meta');\n meta.httpEquiv = 'Content-Security-Policy';\n meta.content = this.generateHeader();\n document.head.appendChild(meta);\n }\n\n /**\n * Checks if a source matches allowed sources.\n * @param source - Source to check\n * @param allowedSources - Allowed source patterns\n * @returns Whether source matches\n */\n private matchesSource(\n source: string,\n allowedSources: ReadonlyArray\n ): boolean {\n for (const allowed of allowedSources) {\n if (allowed === \"'self'\") {\n if (source.startsWith(window.location.origin)) {\n return true;\n }\n } else if (allowed === \"'unsafe-inline'\") {\n return true; // Inline is allowed\n } else if (allowed === \"'unsafe-eval'\") {\n return true; // Eval is allowed\n } else if (allowed === '*') {\n return true; // All sources allowed\n } else if (allowed.startsWith('*.')) {\n // Wildcard subdomain\n const domain = allowed.substring(2);\n try {\n const url = new URL(source);\n if (url.hostname.endsWith(domain)) {\n return true;\n }\n } catch {\n // Invalid URL\n }\n } else if (source.startsWith(allowed)) {\n return true;\n }\n }\n\n return false;\n }\n}\n\n// ============================================================================\n// EventValidator Class\n// ============================================================================\n\n/**\n * Validates cross-module events against security policies.\n */\nexport class EventValidator {\n /** Allowed event patterns */\n private readonly allowedPatterns: Array;\n\n /** Blocked event patterns */\n private readonly blockedPatterns: Array;\n\n /** Maximum message size */\n private readonly maxMessageSize: number;\n\n /**\n * Creates a new EventValidator.\n * @param config - Security configuration\n */\n constructor(config: ModuleSecurityConfig) {\n this.allowedPatterns = config.allowedEvents\n ? [...config.allowedEvents]\n : [];\n this.blockedPatterns = config.blockedEvents\n ? [...config.blockedEvents]\n : [];\n this.maxMessageSize = config.maxMessageSize ?? 1024 * 1024;\n }\n\n /**\n * Validates an event name.\n * @param eventName - Event name to validate\n * @returns Whether event is allowed\n */\n isEventAllowed(eventName: string): boolean {\n // Check blocked patterns first\n for (const pattern of this.blockedPatterns) {\n if (typeof pattern === 'string') {\n if (eventName === pattern) {\n return false;\n }\n } else if (pattern.test(eventName)) {\n return false;\n }\n }\n\n // If allowed patterns are specified, check them\n if (this.allowedPatterns.length > 0) {\n for (const pattern of this.allowedPatterns) {\n if (typeof pattern === 'string') {\n if (eventName === pattern) {\n return true;\n }\n } else if (pattern.test(eventName)) {\n return true;\n }\n }\n return false;\n }\n\n // If no allowed patterns, allow by default\n return true;\n }\n\n /**\n * Validates message payload size.\n * @param payload - Message payload\n * @returns Whether size is valid\n */\n isPayloadSizeValid(payload: unknown): boolean {\n try {\n const { size } = new Blob([JSON.stringify(payload)]);\n return size <= this.maxMessageSize;\n } catch {\n return false;\n }\n }\n\n /**\n * Validates origin for cross-module messages.\n * @param sourceModuleId - Source module ID\n * @param _targetModuleId\n * @param allowedOrigins - Allowed module origins\n * @returns Whether origin is valid\n */\n isOriginValid(\n sourceModuleId: ModuleId,\n _targetModuleId: ModuleId,\n allowedOrigins?: ModuleId[]\n ): boolean {\n if (!allowedOrigins || allowedOrigins.length === 0) {\n return true; // No restriction\n }\n\n return allowedOrigins.includes(sourceModuleId);\n }\n}\n\n// ============================================================================\n// SecuritySandbox Class\n// ============================================================================\n\n/**\n * Comprehensive security sandbox for module boundaries.\n * Provides CSP integration, XSS prevention, and secure communication.\n *\n * @example\n * ```typescript\n * const sandbox = new SecuritySandbox(moduleId, {\n * csp: {\n * 'default-src': [\"'self'\"],\n * 'script-src': [\"'self'\", 'cdn.example.com'],\n * },\n * sanitizeHydration: true,\n * });\n *\n * // Validate content\n * const isSafe = sandbox.validateContent('');\n *\n * // Sanitize content\n * const safe = sandbox.sanitize('
Hello
');\n * ```\n */\nexport class SecuritySandbox {\n /** Module ID */\n private readonly moduleId: ModuleId;\n\n /** Security configuration */\n private readonly config: ModuleSecurityConfig;\n\n /** Content sanitizer */\n private readonly sanitizer: ContentSanitizer;\n\n /** CSP manager */\n private readonly cspManager: CSPManager;\n\n /** Event validator */\n private readonly eventValidator: EventValidator;\n\n /** Security violations */\n private readonly violations: SecurityViolation[] = [];\n\n /** Violation limit before alerting */\n private readonly violationLimit: number = 100;\n\n /**\n * Creates a new SecuritySandbox.\n * @param moduleId - Module ID\n * @param config - Security configuration\n */\n constructor(moduleId: ModuleId, config: Partial = {}) {\n this.moduleId = moduleId;\n this.config = { ...DEFAULT_SECURITY_CONFIG, ...config };\n this.sanitizer = new ContentSanitizer();\n this.cspManager = new CSPManager(this.config.csp);\n this.eventValidator = new EventValidator(this.config);\n }\n\n // ==========================================================================\n // Content Validation\n // ==========================================================================\n\n /**\n * Validates content against security policies.\n * @param content - Content to validate\n * @returns Whether content is safe\n */\n validateContent(content: string): boolean {\n const isValid = this.sanitizer.validate(content);\n\n if (!isValid) {\n this.reportViolation({\n type: 'xss',\n message: 'Potentially dangerous content detected',\n moduleId: this.moduleId,\n blockedContent: content.substring(0, 100),\n });\n }\n\n return isValid;\n }\n\n /**\n * Sanitizes content to make it safe.\n * @param content - Content to sanitize\n * @returns Sanitized content\n */\n sanitize(content: string): string {\n return this.sanitizer.sanitize(content);\n }\n\n /**\n * Sanitizes text (escape HTML).\n * @param text - Text to sanitize\n * @returns Escaped text\n */\n sanitizeText(text: string): string {\n return this.sanitizer.sanitizeText(text);\n }\n\n // ==========================================================================\n // Hydration Security\n // ==========================================================================\n\n /**\n * Sanitizes hydration data for secure server-to-client transfer.\n * @param data - Raw hydration data\n * @returns Sanitized hydration data\n */\n async sanitizeHydrationData(\n data: Omit\n ): Promise {\n if (this.config.sanitizeHydration !== true) {\n return {\n ...data,\n sanitized: false,\n checksum: '',\n };\n }\n\n // Deep sanitize state\n const sanitizedState = this.sanitizeValue(data.state);\n\n // Compute checksum\n const checksum = await computeChecksum(JSON.stringify(sanitizedState));\n\n return {\n ...data,\n state: sanitizedState,\n sanitized: true,\n checksum,\n };\n }\n\n /**\n * Validates hydration data integrity.\n * @param data - Hydration data to validate\n * @returns Whether data is valid\n */\n async validateHydrationData(data: HydrationData): Promise {\n if (!data.sanitized) {\n this.reportViolation({\n type: 'injection',\n message: 'Unsanitized hydration data detected',\n moduleId: this.moduleId,\n });\n return false;\n }\n\n // Verify checksum\n const expectedChecksum = await computeChecksum(JSON.stringify(data.state));\n\n if (expectedChecksum !== data.checksum) {\n this.reportViolation({\n type: 'injection',\n message: 'Hydration data integrity check failed',\n moduleId: this.moduleId,\n });\n return false;\n }\n\n return true;\n }\n\n /**\n * Checks if an event is allowed.\n * @param eventName - Event name\n * @returns Whether event is allowed\n */\n isEventAllowed(eventName: string): boolean {\n const allowed = this.eventValidator.isEventAllowed(eventName);\n\n if (!allowed) {\n this.reportViolation({\n type: 'origin',\n message: `Event not allowed: ${eventName}`,\n moduleId: this.moduleId,\n });\n }\n\n return allowed;\n }\n\n // ==========================================================================\n // Event Security\n // ==========================================================================\n\n /**\n * Validates a cross-module message.\n * @param sourceModuleId - Source module\n * @param eventName - Event name\n * @param payload - Message payload\n * @returns Whether message is valid\n */\n validateMessage(\n sourceModuleId: ModuleId,\n eventName: string,\n payload: unknown\n ): boolean {\n // Validate event name\n if (!this.isEventAllowed(eventName)) {\n return false;\n }\n\n // Validate payload size\n if (!this.eventValidator.isPayloadSizeValid(payload)) {\n this.reportViolation({\n type: 'size',\n message: 'Message payload exceeds size limit',\n moduleId: this.moduleId,\n source: sourceModuleId,\n });\n return false;\n }\n\n return true;\n }\n\n /**\n * Gets the current security nonce.\n */\n getNonce(): SecurityNonce {\n return this.cspManager.getNonce();\n }\n\n // ==========================================================================\n // CSP Management\n // ==========================================================================\n\n /**\n * Generates CSP header.\n * @returns CSP header string\n */\n generateCSPHeader(): string {\n return this.cspManager.generateHeader();\n }\n\n /**\n * Validates a source against CSP.\n * @param type - Directive type\n * @param source - Source to validate\n * @returns Whether source is allowed\n */\n validateCSPSource(type: keyof CSPDirectives, source: string): boolean {\n const allowed = this.cspManager.validateSource(type, source);\n\n if (!allowed) {\n this.reportViolation({\n type: 'csp',\n message: `CSP violation: ${type} source not allowed`,\n moduleId: this.moduleId,\n source,\n });\n }\n\n return allowed;\n }\n\n /**\n * Reports a security violation.\n * @param violation - Violation details\n */\n reportViolation(\n violation: Omit\n ): void {\n const fullViolation: SecurityViolation = {\n ...violation,\n timestamp: Date.now(),\n };\n\n this.violations.push(fullViolation);\n\n // Trim old violations if exceeding limit\n if (this.violations.length > this.violationLimit) {\n this.violations.shift();\n }\n\n // Log in development\n devWarn('[Security Violation]', fullViolation);\n }\n\n // ==========================================================================\n // Violation Management\n // ==========================================================================\n\n /**\n * Gets all recorded violations.\n * @returns Array of violations\n */\n getViolations(): ReadonlyArray {\n return [...this.violations];\n }\n\n /**\n * Clears recorded violations.\n */\n clearViolations(): void {\n this.violations.length = 0;\n }\n\n /**\n * Creates a security context for the module.\n * @returns Security context\n */\n createContext(): SecurityContext {\n return {\n config: this.config,\n nonce: this.getNonce(),\n isSecure: this.violations.length === 0,\n violations: this.getViolations(),\n validateContent: (content: string) => this.validateContent(content),\n sanitize: (content: string) => this.sanitize(content),\n isEventAllowed: (eventName: string) => this.isEventAllowed(eventName),\n };\n }\n\n // ==========================================================================\n // Security Context\n // ==========================================================================\n\n /**\n * Recursively sanitizes a value.\n * @param value - Value to sanitize\n * @returns Sanitized value\n */\n private sanitizeValue(value: unknown): unknown {\n if (value === null || value === undefined) {\n return value;\n }\n\n if (typeof value === 'string') {\n return this.sanitize(value);\n }\n\n if (Array.isArray(value)) {\n return value.map((item) => this.sanitizeValue(item));\n }\n\n if (typeof value === 'object') {\n const sanitized: Record = {};\n for (const [key, val] of Object.entries(value)) {\n // Sanitize both key and value\n const sanitizedKey = this.sanitizeText(key);\n sanitized[sanitizedKey] = this.sanitizeValue(val);\n }\n return sanitized;\n }\n\n return value;\n }\n}\n\n// ============================================================================\n// Factory Functions\n// ============================================================================\n\n/**\n * Creates a new security sandbox.\n * @param moduleId - Module ID\n * @param config - Security configuration\n * @returns Security sandbox instance\n */\nexport function createSecuritySandbox(\n moduleId: ModuleId,\n config?: Partial\n): SecuritySandbox {\n return new SecuritySandbox(moduleId, config);\n}\n\n/**\n * Creates a strict security configuration.\n * @returns Strict security config\n */\nexport function createStrictSecurityConfig(): ModuleSecurityConfig {\n return {\n csp: {\n 'default-src': [\"'self'\"],\n 'script-src': [\"'self'\"],\n 'style-src': [\"'self'\", \"'unsafe-inline'\"],\n 'img-src': [\"'self'\", 'data:', 'https:'],\n 'font-src': [\"'self'\"],\n 'connect-src': [\"'self'\"],\n 'frame-src': [\"'none'\"],\n 'object-src': [\"'none'\"],\n 'base-uri': [\"'self'\"],\n 'form-action': [\"'self'\"],\n },\n sandbox: true,\n sanitizeHydration: true,\n maxMessageSize: 512 * 1024, // 512KB\n validateOrigins: true,\n };\n}\n\n/**\n * Creates a relaxed security configuration for development.\n * @returns Relaxed security config\n */\nexport function createRelaxedSecurityConfig(): ModuleSecurityConfig {\n return {\n csp: {\n 'default-src': [\"'self'\", \"'unsafe-inline'\", \"'unsafe-eval'\"],\n },\n sandbox: false,\n sanitizeHydration: false,\n maxMessageSize: 10 * 1024 * 1024, // 10MB\n validateOrigins: false,\n };\n}\n"],"names":["DANGEROUS_PATTERNS","SAFE_TAGS","SAFE_ATTRIBUTES","SAFE_URL_SCHEMES","SAFE_CSS_PROPERTIES","DANGEROUS_CSS_VALUE_PATTERNS","generateNonce","array","nonce","byte","createSecurityNonce","escapeHtml","str","htmlEscapes","char","isUrlSafe","url","parsed","computeChecksum","data","dataBuffer","hashBuffer","b","ContentSanitizer","options","html","sanitized","pattern","text","content","doc","node","nodesToRemove","child","element","tagName","attr","nodeToRemove","style","declarations","sanitizedDeclarations","declaration","trimmed","colonIndex","property","value","lowerValue","CSPManager","directives","parts","directiveNames","directive","values","type","source","allowedSources","defaultSrc","existing","meta","allowed","domain","EventValidator","config","eventName","payload","size","sourceModuleId","_targetModuleId","allowedOrigins","SecuritySandbox","moduleId","DEFAULT_SECURITY_CONFIG","isValid","sanitizedState","checksum","violation","fullViolation","devWarn","item","key","val","sanitizedKey","createSecuritySandbox","createStrictSecurityConfig","createRelaxedSecurityConfig"],"mappings":";;AA+BA,MAAMA,IAA+B;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAKMC,wBAAgB,IAAI;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC,GAKKC,wBAAsB,IAAI;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC,GAKKC,wBAAuB,IAAI,CAAC,SAAS,UAAU,WAAW,MAAM,CAAC,GAmBjEC,wBAA0B,IAAI;AAAA;AAAA,EAElC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC,GAcKC,IAA+B;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AACF;AAUA,SAASC,IAA+B;AACtC,QAAMC,IAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgBA,CAAK;AAC5B,QAAMC,IAAQ,MAAM;AAAA,IAAKD;AAAA,IAAO,CAACE,MAC/BA,EAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AAAA,EAAA,EACjC,KAAK,EAAE;AACT,SAAOC,EAAoBF,CAAK;AAClC;AAOA,SAASG,EAAWC,GAAqB;AACvC,QAAMC,IAAsC;AAAA,IAC1C,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,EAAA;AAGP,SAAOD,EAAI,QAAQ,eAAe,CAACE,MAASD,EAAYC,CAAI,KAAKA,CAAI;AACvE;AAOA,SAASC,EAAUC,GAAsB;AACvC,MAAI;AACF,UAAMC,IAAS,IAAI,IAAID,GAAK,OAAO,SAAS,MAAM;AAClD,WAAOb,EAAiB,IAAIc,EAAO,QAAQ;AAAA,EAC7C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAOA,eAAeC,EAAgBC,GAA+B;AAE5D,QAAMC,IADU,IAAI,YAAA,EACO,OAAOD,CAAI,GAChCE,IAAa,MAAM,OAAO,OAAO,OAAO,WAAWD,CAAU;AAEnE,SADkB,MAAM,KAAK,IAAI,WAAWC,CAAU,CAAC,EACtC,IAAI,CAACC,MAAMA,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AACtE;AASO,MAAMC,EAAiB;AAAA;AAAA,EAEX;AAAA;AAAA,EAGA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMjB,YACEC,IAGI,IACJ;AACA,SAAK,qCAAqB,IAAI;AAAA,MAC5B,GAAGvB;AAAA,MACH,GAAIuB,EAAQ,kBAAkB,CAAA;AAAA,IAAC,CAChC,GACD,KAAK,2CAA2B,IAAI;AAAA,MAClC,GAAGtB;AAAA,MACH,GAAIsB,EAAQ,wBAAwB,CAAA;AAAA,IAAC,CACtC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,SAASC,GAAsB;AAE7B,QAAIC,IAAYD;AAChB,eAAWE,KAAW3B;AACpB,MAAA0B,IAAYA,EAAU,QAAQC,GAAS,EAAE;AAI3C,WAAI,OAAO,YAAc,QACvBD,IAAY,KAAK,gBAAgBA,CAAS,IAGrCA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,aAAaE,GAAsB;AACjC,WAAOjB,EAAWiB,CAAI;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,SAASC,GAA0B;AACjC,eAAWF,KAAW3B;AACpB,UAAI2B,EAAQ,KAAKE,CAAO;AACtB,eAAO;AAGX,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,gBAAgBJ,GAAsB;AAE5C,UAAMK,IADS,IAAI,UAAA,EACA,gBAAgBL,GAAM,WAAW;AACpD,gBAAK,aAAaK,EAAI,IAAI,GACnBA,EAAI,KAAK;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,aAAaC,GAAkB;AACrC,UAAMC,IAAwB,CAAA;AAE9B,eAAWC,KAAS,MAAM,KAAKF,EAAK,UAAU;AAC5C,UAAIE,EAAM,aAAa,KAAK,cAAc;AACxC,cAAMC,IAAUD,GACVE,IAAUD,EAAQ,QAAQ,YAAA;AAGhC,YAAI,CAAC,KAAK,eAAe,IAAIC,CAAO,GAAG;AACrC,UAAAH,EAAc,KAAKC,CAAK;AACxB;AAAA,QACF;AAGA,mBAAWG,KAAQ,MAAM,KAAKF,EAAQ,UAAU,GAAG;AACjD,cAAI,CAAC,KAAK,qBAAqB,IAAIE,EAAK,KAAK,YAAA,CAAa,GAAG;AAC3D,YAAAF,EAAQ,gBAAgBE,EAAK,IAAI;AACjC;AAAA,UACF;AAGA,WACGA,EAAK,SAAS,UAAUA,EAAK,SAAS,UACvC,CAACrB,EAAUqB,EAAK,KAAK,KAErBF,EAAQ,gBAAgBE,EAAK,IAAI,GAI/BA,EAAK,SAAS,WAChBF,EAAQ,aAAa,SAAS,KAAK,cAAcE,EAAK,KAAK,CAAC;AAAA,QAEhE;AAGA,aAAK,aAAaF,CAAO;AAAA,MAC3B,MAAA,CAAWD,EAAM,aAAa,KAAK,gBAEjCD,EAAc,KAAKC,CAAK;AAK5B,eAAWI,KAAgBL;AACzB,MAAAD,EAAK,YAAYM,CAAY;AAAA,EAEjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBQ,cAAcC,GAAuB;AAC3C,QAAI,CAACA;AACH,aAAO;AAIT,UAAMC,IAAeD,EAAM,MAAM,GAAG,GAC9BE,IAAkC,CAAA;AAExC,eAAWC,KAAeF,GAAc;AACtC,YAAMG,IAAUD,EAAY,KAAA;AAC5B,UAAI,CAACC,EAAS;AAGd,YAAMC,IAAaD,EAAQ,QAAQ,GAAG;AACtC,UAAIC,MAAe,GAAI;AAEvB,YAAMC,IAAWF,EAAQ,UAAU,GAAGC,CAAU,EAAE,KAAA,EAAO,YAAA,GACnDE,IAAQH,EAAQ,UAAUC,IAAa,CAAC,EAAE,KAAA;AAGhD,MAAI,CAACC,KAAY,CAACC,KAGbzC,EAAoB,IAAIwC,CAAQ,MAKjC,KAAK,0BAA0BC,CAAK,KAIxCL,EAAsB,KAAK,GAAGI,CAAQ,KAAKC,CAAK,EAAE;AAAA,IACpD;AAEA,WAAOL,EAAsB,KAAK,IAAI;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWQ,0BAA0BK,GAAwB;AACxD,UAAMC,IAAaD,EAAM,YAAA;AAGzB,eAAWlB,KAAWtB;AACpB,UAAIsB,EAAQ,KAAKmB,CAAU;AACzB,eAAO;AAWX,WALI,YAAY,KAAKA,CAAU,KAK3B,gBAAgB,KAAKA,CAAU,IAC1B,KAIF,WAAW,KAAKA,CAAU;AAAA,EAGnC;AACF;AASO,MAAMC,EAAW;AAAA;AAAA,EAEL;AAAA;AAAA,EAGA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMjB,YAAYC,IAA4B,IAAI;AAC1C,SAAK,aAAaA,GAClB,KAAK,QAAQ1C,EAAA;AAAA,EACf;AAAA;AAAA;AAAA;AAAA,EAKA,WAA0B;AACxB,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,iBAAyB;AACvB,UAAM2C,IAAkB,CAAA,GAElBC,IAAiB,OAAO,KAAK,KAAK,UAAU;AAIlD,eAAWC,KAAaD,GAAgB;AACtC,YAAME,IAAS,KAAK,WAAWD,CAAS;AACxC,MAAIC,KAAUA,EAAO,SAAS,MAExBD,MAAc,gBAAgBA,MAAc,cAC9CF,EAAM,KAAK,GAAGE,CAAS,WAAW,KAAK,KAAK,KAAKC,EAAO,KAAK,GAAG,CAAC,EAAE,IAEnEH,EAAM,KAAK,GAAGE,CAAS,IAAIC,EAAO,KAAK,GAAG,CAAC,EAAE;AAAA,IAGnD;AAEA,WAAOH,EAAM,KAAK,IAAI;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,eACEI,GACAC,GACS;AACT,UAAMC,IAAiB,KAAK,WAAWF,CAAI;AAC3C,QAAI,CAACE,KAAkBA,EAAe,WAAW,GAAG;AAElD,YAAMC,IAAa,KAAK,WAAW,aAAa;AAChD,aAAI,CAACA,KAAcA,EAAW,WAAW,IAChC,KAEF,KAAK,cAAcF,GAAQE,CAAU;AAAA,IAC9C;AAEA,WAAO,KAAK,cAAcF,GAAQC,CAAc;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA,EAKA,eAAqB;AACnB,UAAME,IAAW,SAAS,cAAc,4CAA4C;AACpF,IAAIA,KACFA,EAAS,OAAA;AAGX,UAAMC,IAAO,SAAS,cAAc,MAAM;AAC1C,IAAAA,EAAK,YAAY,2BACjBA,EAAK,UAAU,KAAK,eAAA,GACpB,SAAS,KAAK,YAAYA,CAAI;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,cACNJ,GACAC,GACS;AACT,eAAWI,KAAWJ;AACpB,UAAII,MAAY;AACd,YAAIL,EAAO,WAAW,OAAO,SAAS,MAAM;AAC1C,iBAAO;AAAA,aAEX;AAAA,YAAWK,MAAY;AACrB,iBAAO;AACT,YAAWA,MAAY;AACrB,iBAAO;AACT,YAAWA,MAAY;AACrB,iBAAO;AACT,YAAWA,EAAQ,WAAW,IAAI,GAAG;AAEnC,gBAAMC,IAASD,EAAQ,UAAU,CAAC;AAClC,cAAI;AAEF,gBADY,IAAI,IAAIL,CAAM,EAClB,SAAS,SAASM,CAAM;AAC9B,qBAAO;AAAA,UAEX,QAAQ;AAAA,UAER;AAAA,QACF,WAAWN,EAAO,WAAWK,CAAO;AAClC,iBAAO;AAAA;AAIX,WAAO;AAAA,EACT;AACF;AASO,MAAME,EAAe;AAAA;AAAA,EAET;AAAA;AAAA,EAGA;AAAA;AAAA,EAGA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMjB,YAAYC,GAA8B;AACxC,SAAK,kBAAkBA,EAAO,gBAC1B,CAAC,GAAGA,EAAO,aAAa,IACxB,CAAA,GACJ,KAAK,kBAAkBA,EAAO,gBAC1B,CAAC,GAAGA,EAAO,aAAa,IACxB,CAAA,GACJ,KAAK,iBAAiBA,EAAO,kBAAkB,OAAO;AAAA,EACxD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,eAAeC,GAA4B;AAEzC,eAAWpC,KAAW,KAAK;AACzB,UAAI,OAAOA,KAAY;AACrB,YAAIoC,MAAcpC;AAChB,iBAAO;AAAA,iBAEAA,EAAQ,KAAKoC,CAAS;AAC/B,eAAO;AAKX,QAAI,KAAK,gBAAgB,SAAS,GAAG;AACnC,iBAAWpC,KAAW,KAAK;AACzB,YAAI,OAAOA,KAAY;AACrB,cAAIoC,MAAcpC;AAChB,mBAAO;AAAA,mBAEAA,EAAQ,KAAKoC,CAAS;AAC/B,iBAAO;AAGX,aAAO;AAAA,IACT;AAGA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,mBAAmBC,GAA2B;AAC5C,QAAI;AACF,YAAM,EAAE,MAAAC,EAAA,IAAS,IAAI,KAAK,CAAC,KAAK,UAAUD,CAAO,CAAC,CAAC;AACnD,aAAOC,KAAQ,KAAK;AAAA,IACtB,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,cACEC,GACAC,GACAC,GACS;AACT,WAAI,CAACA,KAAkBA,EAAe,WAAW,IACxC,KAGFA,EAAe,SAASF,CAAc;AAAA,EAC/C;AACF;AA2BO,MAAMG,EAAgB;AAAA;AAAA,EAEV;AAAA;AAAA,EAGA;AAAA;AAAA,EAGA;AAAA;AAAA,EAGA;AAAA;AAAA,EAGA;AAAA;AAAA,EAGA,aAAkC,CAAA;AAAA;AAAA,EAGlC,iBAAyB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO1C,YAAYC,GAAoBR,IAAwC,IAAI;AAC1E,SAAK,WAAWQ,GAChB,KAAK,SAAS,EAAE,GAAGC,GAAyB,GAAGT,EAAA,GAC/C,KAAK,YAAY,IAAIvC,EAAA,GACrB,KAAK,aAAa,IAAIwB,EAAW,KAAK,OAAO,GAAG,GAChD,KAAK,iBAAiB,IAAIc,EAAe,KAAK,MAAM;AAAA,EACtD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,gBAAgBhC,GAA0B;AACxC,UAAM2C,IAAU,KAAK,UAAU,SAAS3C,CAAO;AAE/C,WAAK2C,KACH,KAAK,gBAAgB;AAAA,MACnB,MAAM;AAAA,MACN,SAAS;AAAA,MACT,UAAU,KAAK;AAAA,MACf,gBAAgB3C,EAAQ,UAAU,GAAG,GAAG;AAAA,IAAA,CACzC,GAGI2C;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,SAAS3C,GAAyB;AAChC,WAAO,KAAK,UAAU,SAASA,CAAO;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,aAAaD,GAAsB;AACjC,WAAO,KAAK,UAAU,aAAaA,CAAI;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,sBACJT,GACwB;AACxB,QAAI,KAAK,OAAO,sBAAsB;AACpC,aAAO;AAAA,QACL,GAAGA;AAAA,QACH,WAAW;AAAA,QACX,UAAU;AAAA,MAAA;AAKd,UAAMsD,IAAiB,KAAK,cAActD,EAAK,KAAK,GAG9CuD,IAAW,MAAMxD,EAAgB,KAAK,UAAUuD,CAAc,CAAC;AAErE,WAAO;AAAA,MACL,GAAGtD;AAAA,MACH,OAAOsD;AAAA,MACP,WAAW;AAAA,MACX,UAAAC;AAAA,IAAA;AAAA,EAEJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,sBAAsBvD,GAAuC;AACjE,WAAKA,EAAK,YAUe,MAAMD,EAAgB,KAAK,UAAUC,EAAK,KAAK,CAAC,MAEhDA,EAAK,YAC5B,KAAK,gBAAgB;AAAA,MACnB,MAAM;AAAA,MACN,SAAS;AAAA,MACT,UAAU,KAAK;AAAA,IAAA,CAChB,GACM,MAGF,MApBL,KAAK,gBAAgB;AAAA,MACnB,MAAM;AAAA,MACN,SAAS;AAAA,MACT,UAAU,KAAK;AAAA,IAAA,CAChB,GACM;AAAA,EAgBX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,eAAe4C,GAA4B;AACzC,UAAMJ,IAAU,KAAK,eAAe,eAAeI,CAAS;AAE5D,WAAKJ,KACH,KAAK,gBAAgB;AAAA,MACnB,MAAM;AAAA,MACN,SAAS,sBAAsBI,CAAS;AAAA,MACxC,UAAU,KAAK;AAAA,IAAA,CAChB,GAGIJ;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,gBACEO,GACAH,GACAC,GACS;AAET,WAAK,KAAK,eAAeD,CAAS,IAK7B,KAAK,eAAe,mBAAmBC,CAAO,IAU5C,MATL,KAAK,gBAAgB;AAAA,MACnB,MAAM;AAAA,MACN,SAAS;AAAA,MACT,UAAU,KAAK;AAAA,MACf,QAAQE;AAAA,IAAA,CACT,GACM,MAXA;AAAA,EAeX;AAAA;AAAA;AAAA;AAAA,EAKA,WAA0B;AACxB,WAAO,KAAK,WAAW,SAAA;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,oBAA4B;AAC1B,WAAO,KAAK,WAAW,eAAA;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,kBAAkBb,GAA2BC,GAAyB;AACpE,UAAMK,IAAU,KAAK,WAAW,eAAeN,GAAMC,CAAM;AAE3D,WAAKK,KACH,KAAK,gBAAgB;AAAA,MACnB,MAAM;AAAA,MACN,SAAS,kBAAkBN,CAAI;AAAA,MAC/B,UAAU,KAAK;AAAA,MACf,QAAAC;AAAA,IAAA,CACD,GAGIK;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,gBACEgB,GACM;AACN,UAAMC,IAAmC;AAAA,MACvC,GAAGD;AAAA,MACH,WAAW,KAAK,IAAA;AAAA,IAAI;AAGtB,SAAK,WAAW,KAAKC,CAAa,GAG9B,KAAK,WAAW,SAAS,KAAK,kBAChC,KAAK,WAAW,MAAA,GAIlBC,EAAQ,wBAAwBD,CAAa;AAAA,EAC/C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,gBAAkD;AAChD,WAAO,CAAC,GAAG,KAAK,UAAU;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA,EAKA,kBAAwB;AACtB,SAAK,WAAW,SAAS;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,gBAAiC;AAC/B,WAAO;AAAA,MACL,QAAQ,KAAK;AAAA,MACb,OAAO,KAAK,SAAA;AAAA,MACZ,UAAU,KAAK,WAAW,WAAW;AAAA,MACrC,YAAY,KAAK,cAAA;AAAA,MACjB,iBAAiB,CAAC/C,MAAoB,KAAK,gBAAgBA,CAAO;AAAA,MAClE,UAAU,CAACA,MAAoB,KAAK,SAASA,CAAO;AAAA,MACpD,gBAAgB,CAACkC,MAAsB,KAAK,eAAeA,CAAS;AAAA,IAAA;AAAA,EAExE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWQ,cAAclB,GAAyB;AAC7C,QAAIA,KAAU;AACZ,aAAOA;AAGT,QAAI,OAAOA,KAAU;AACnB,aAAO,KAAK,SAASA,CAAK;AAG5B,QAAI,MAAM,QAAQA,CAAK;AACrB,aAAOA,EAAM,IAAI,CAACiC,MAAS,KAAK,cAAcA,CAAI,CAAC;AAGrD,QAAI,OAAOjC,KAAU,UAAU;AAC7B,YAAMnB,IAAqC,CAAA;AAC3C,iBAAW,CAACqD,GAAKC,CAAG,KAAK,OAAO,QAAQnC,CAAK,GAAG;AAE9C,cAAMoC,IAAe,KAAK,aAAaF,CAAG;AAC1C,QAAArD,EAAUuD,CAAY,IAAI,KAAK,cAAcD,CAAG;AAAA,MAClD;AACA,aAAOtD;AAAA,IACT;AAEA,WAAOmB;AAAA,EACT;AACF;AAYO,SAASqC,EACdZ,GACAR,GACiB;AACjB,SAAO,IAAIO,EAAgBC,GAAUR,CAAM;AAC7C;AAMO,SAASqB,IAAmD;AACjE,SAAO;AAAA,IACL,KAAK;AAAA,MACH,eAAe,CAAC,QAAQ;AAAA,MACxB,cAAc,CAAC,QAAQ;AAAA,MACvB,aAAa,CAAC,UAAU,iBAAiB;AAAA,MACzC,WAAW,CAAC,UAAU,SAAS,QAAQ;AAAA,MACvC,YAAY,CAAC,QAAQ;AAAA,MACrB,eAAe,CAAC,QAAQ;AAAA,MACxB,aAAa,CAAC,QAAQ;AAAA,MACtB,cAAc,CAAC,QAAQ;AAAA,MACvB,YAAY,CAAC,QAAQ;AAAA,MACrB,eAAe,CAAC,QAAQ;AAAA,IAAA;AAAA,IAE1B,SAAS;AAAA,IACT,mBAAmB;AAAA,IACnB,gBAAgB,MAAM;AAAA;AAAA,IACtB,iBAAiB;AAAA,EAAA;AAErB;AAMO,SAASC,IAAoD;AAClE,SAAO;AAAA,IACL,KAAK;AAAA,MACH,eAAe,CAAC,UAAU,mBAAmB,eAAe;AAAA,IAAA;AAAA,IAE9D,SAAS;AAAA,IACT,mBAAmB;AAAA,IACnB,gBAAgB,KAAK,OAAO;AAAA;AAAA,IAC5B,iBAAiB;AAAA,EAAA;AAErB;"}