@aglyn/aglyn 1.0.0-beta.143

package/src/lib/app-utils/plugin-bundle-checks.js

@@ -0,0 +1,989 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * Static plugin-bundle checks (AGL-426) — Strapi `strapi-plugin verify`
+ * parity, but ALSO enforced server-side: the publish API runs the same
+ * checks, so a bundle that fails locally fails there identically.
+ *
+ * The bundle is PARSED and the tree analysed (AGL-964). The checks used to
+ * match source text with regexes, which meant they could not see computed
+ * member access, could not follow a value into a call, and could not tell
+ * code from a comment — `g['ev'+'al'](…)` passed while the words `eval(`
+ * inside a comment failed. On a minified bundle, which every published
+ * artifact is, that is close to no signal at all.
+ *
+ * These are still cheap heuristics, NOT a sandbox: they catch honest build
+ * mistakes (leftover imports, missing entry exports, oversized bundles),
+ * flag the APIs the platform never wants in marketplace code, and surface
+ * the questions a reviewer should ask. A determined author can still hide
+ * intent from any static pass. The real security boundary stays the trust
+ * chain (sandbox iframe + per-manifest CSP / staff review + realm signing /
+ * sha pinning / the kill switch).
+ */ import { parse } from "acorn";
+const CHECK_LABELS = {
+    parse: 'Parses as an ES module',
+    entry: 'Exports an entry point',
+    'self-contained': 'Self-contained (no static imports)',
+    size: 'Within the size limit',
+    'code-execution': 'No eval / Function constructor',
+    globals: 'No computed access on a global',
+    storage: 'No direct storage or cookie access',
+    'dynamic-import': 'No dynamic import of unknown code',
+    network: 'Network calls match the manifest',
+    obfuscation: 'No obfuscation shapes',
+    contributions: 'Registrations match the declared contributions'
+};
+/** Check order as displayed — findings first would reorder on every bundle. */ const CHECK_ORDER = [
+    'parse',
+    'entry',
+    'self-contained',
+    'size',
+    'code-execution',
+    'globals',
+    'storage',
+    'dynamic-import',
+    'network',
+    'obfuscation',
+    'contributions'
+];
+export const MAX_PLUGIN_BUNDLE_BYTES = 1000000;
+/**
+ * Stamped onto a cached verdict (AGL-962) so a stored result outlives only
+ * the checker that produced it.
+ *
+ * `checkPluginBundle` is pure over immutable, content-addressed bytes, so a
+ * verdict for a given sha256 never changes — but the CHECKS do. **Bump this
+ * whenever a rule is added, removed or loosened**, and every stored verdict
+ * from the old checker is ignored and recomputed on next read. Forgetting to
+ * bump means a reviewer sees a verdict from a checker that no longer exists,
+ * which is the failure mode re-running the verifier was meant to prevent.
+ *
+ * 2 — AST analysis replaces the regex scan (AGL-964).
+ * 3 — per-check summary added to the verdict (AGL-1087).
+ * 4 — calls through an alias are resolved (AGL-1090).
+ * 5 — URLs held in a constant are resolved (AGL-1093).
+ * 6 — registrations are compared with the declared contributions (AGL-3116).
+ */ export const PLUGIN_VERIFIER_VERSION = 6;
+/**
+ * Whether a stored verdict may be served instead of re-running the checks.
+ *
+ * Fails closed on every mismatch: no verdict, a verdict for different bytes
+ * (a republished version keeps its version string but changes sha), or a
+ * verdict from a checker that has since changed. Any of those means
+ * download-and-recompute, which costs one page view rather than showing a
+ * reviewer a verdict that was never true of the bundle in front of them.
+ */ export function isStoredVerdictCurrent(stored, sha256) {
+    if (!stored || !sha256) return false;
+    return stored.sha256 === sha256 && Number(stored.verifierVersion) === PLUGIN_VERIFIER_VERSION;
+}
+/**
+ * Globals whose properties are the platform's business. Computed access on
+ * one of these is flagged as computed access rather than by trying to
+ * enumerate the property names an author might reach — `g[k]` hides its
+ * property from any static pass, so the ACCESS is the finding.
+ */ const GLOBAL_ROOTS = new Set([
+    'globalThis',
+    'window',
+    'self',
+    'top',
+    'parent',
+    'frames',
+    'document'
+]);
+/** Storage the platform never wants reached directly (use host-mediated data). */ const STORAGE_NAMES = new Set([
+    'localStorage',
+    'sessionStorage',
+    'indexedDB'
+]);
+/** Network entry points, by the name they are called/constructed under. */ const NETWORK_CALLS = new Set([
+    'fetch',
+    'sendBeacon'
+]);
+const NETWORK_CONSTRUCTORS = new Set([
+    'XMLHttpRequest',
+    'WebSocket',
+    'EventSource'
+]);
+/**
+ * Names worth following through an alias (AGL-1090).
+ *
+ * `const f = fetch; f(url)` used to pass every check, and the network row
+ * rendered a green "no network calls" rather than going quiet — a two-line
+ * indirection defeating the signal this whole verifier exists to produce.
+ * Aliasing a VALUE was the exact gap the project was created to close, and
+ * resolving global objects (`const g = globalThis`) never covered it.
+ *
+ * Reassignment, `arr[0]`, an object property and passing the function as an
+ * argument all stay out of reach. The bar is that the cheap form is not free.
+ */ const ALIASABLE_CALLABLES = new Set([
+    'eval',
+    'Function',
+    'fetch',
+    'sendBeacon',
+    'XMLHttpRequest',
+    'WebSocket',
+    'EventSource'
+]);
+/**
+ * Callees that legitimately take an absolute URL and reach nothing — so a URL
+ * literal passed to them is not a call the network check failed to follow.
+ * `createElementNS` matters most: an SVG namespace argument appears in a large
+ * share of real bundles.
+ */ const URL_TAKING_NON_CALLS = new Set([
+    'URL',
+    'URLSearchParams',
+    'createElementNS',
+    'createDocument'
+]);
+/** Beyond this, a single line is not source a reviewer can read. */ const MAX_READABLE_LINE = 100000;
+/** A base64 blob at least this long is worth decoding before approving. */ const MIN_SUSPICIOUS_BASE64 = 1024;
+/** How many `_0x…` names before the bundle counts as machine-obfuscated. */ const MIN_OBFUSCATED_NAMES = 5;
+/** Verdicts are stored on a version doc; keep them bounded. */ const MAX_PROBLEMS = 40;
+const OBFUSCATED_NAME = /^_0x[0-9a-f]{4,}$/i;
+const BASE64_BLOB = /^[A-Za-z0-9+/\r\n]+={0,2}$/;
+/**
+ * Child keys that are NOT expressions in the surrounding scope — a
+ * non-computed `.property`, an object literal key, a label. Walking into
+ * them would read `x.localStorage` on an unrelated object as a global
+ * storage access.
+ */ const skippedChild = (node, key)=>{
+    switch(node.type){
+        case 'MemberExpression':
+            return key === 'property' && !node['computed'];
+        case 'Property':
+        case 'PropertyDefinition':
+        case 'MethodDefinition':
+            return key === 'key' && !node['computed'];
+        case 'LabeledStatement':
+        case 'BreakStatement':
+        case 'ContinueStatement':
+            return key === 'label';
+        case 'ImportSpecifier':
+        case 'ExportSpecifier':
+            return true;
+        default:
+            return false;
+    }
+};
+/** Depth-first walk over every expression-position node in the tree. */ function walk(root, visit) {
+    const stack = [
+        root
+    ];
+    while(stack.length){
+        const node = stack.pop();
+        if (!node) continue;
+        visit(node);
+        for (const key of Object.keys(node)){
+            if (key === 'type' || key === 'start' || key === 'end') continue;
+            if (skippedChild(node, key)) continue;
+            const value = node[key];
+            if (Array.isArray(value)) {
+                for (const item of value){
+                    if (item && typeof item === 'object' && typeof item.type === 'string') stack.push(item);
+                }
+            } else if (value && typeof value === 'object' && typeof value.type === 'string') {
+                stack.push(value);
+            }
+        }
+    }
+}
+/**
+ * The string a node evaluates to, when that is knowable without running it.
+ * Covers the shapes used to hide a property name from a text scan: a
+ * string literal, a template with no interpolation, and literals added
+ * together (`'ev' + 'al'`).
+ */ function staticString(node, constants) {
+    var _constants_get;
+    if (!node) return null;
+    if (node.type === 'Literal') return typeof node['value'] === 'string' ? node['value'] : null;
+    // A name bound once to a constant string (AGL-1093). `const ENDPOINT =
+    // 'https://…'; fetch(ENDPOINT)` is the idiomatic way to write a request,
+    // and refusing to read it meant the network diff quietly did not run for
+    // the bundles most likely to be honest.
+    if (node.type === 'Identifier' && constants) return (_constants_get = constants.get(node['name'])) != null ? _constants_get : null;
+    if (node.type === 'TemplateLiteral') {
+        var _node_expressions, _node_quasis;
+        const expressions = (_node_expressions = node['expressions']) != null ? _node_expressions : [];
+        const quasis = (_node_quasis = node['quasis']) != null ? _node_quasis : [];
+        if (!expressions.length) {
+            var _ref;
+            var _quasis__value, _quasis_;
+            return quasis.length === 1 ? (_ref = (_quasis_ = quasis[0]) == null ? void 0 : (_quasis__value = _quasis_.value) == null ? void 0 : _quasis__value.cooked) != null ? _ref : null : null;
+        }
+        // `${BASE}/zen` — resolvable exactly when every hole is.
+        let out = '';
+        for(let index = 0; index < quasis.length; index += 1){
+            var _ref1;
+            var _quasis_index_value, _quasis_index;
+            out += (_ref1 = (_quasis_index = quasis[index]) == null ? void 0 : (_quasis_index_value = _quasis_index.value) == null ? void 0 : _quasis_index_value.cooked) != null ? _ref1 : '';
+            if (index < expressions.length) {
+                const filled = staticString(expressions[index], constants);
+                if (filled === null) return null;
+                out += filled;
+            }
+        }
+        return out;
+    }
+    if (node.type === 'BinaryExpression' && node['operator'] === '+') {
+        const left = staticString(node['left'], constants);
+        const right = staticString(node['right'], constants);
+        return left !== null && right !== null ? left + right : null;
+    }
+    return null;
+}
+/** The property name a member expression reads, computed or not. */ function propertyName(node, constants) {
+    const property = node['property'];
+    if (!node['computed']) return (property == null ? void 0 : property.type) === 'Identifier' ? property['name'] : null;
+    return staticString(property, constants);
+}
+/**
+ * The origin of a URL argument, when it is a knowable http(s) URL.
+ *
+ * Scheme-checked HERE, once (AGL-1094). An opaque origin — every `data:`,
+ * `blob:` and `javascript:` URL — makes `new URL(x).origin` the STRING
+ * `"null"`, and a caller that then re-parsed that string threw `Invalid URL`
+ * and took the whole checker down with it. Nothing downstream should have to
+ * know that, so nothing downstream gets the chance.
+ */ function literalOrigin(node, constants) {
+    const value = staticString(node, constants);
+    if (!value) return null;
+    try {
+        const url = new URL(value);
+        return /^https?:$/.test(url.protocol) ? url.origin : null;
+    } catch (unused) {
+        return null;
+    }
+}
+/** The detection result of a bundle no pass could read. */ const NOTHING_DETECTED = {
+    contributes: {},
+    unresolved: []
+};
+/**
+ * Registration calls whose argument says what a bundle contributes, by the
+ * name they are reached through: `h.aglyn.registerConsoleExtension(...)`,
+ * `registerConsoleExtension(...)` after the realm template's host mapping,
+ * `aglyn.components.registerComponent(...)`.
+ */ const REGISTRATION_CALLS = new Set([
+    'registerConsoleExtension',
+    'registerSiteRuntime',
+    'registerComponent',
+    'addDependency',
+    'defineUiFeatureBundle'
+]);
+/**
+ * Console extension fields the shell draws on every screen of a workspace:
+ * nav tabs, organization tabs, providers, staff pages and the dashboard and
+ * settings entries. A plugin registering any of them loads with the shell.
+ */ const SHELL_EXTENSION_FIELDS = [
+    'navItems',
+    'orgNavItems',
+    'providers',
+    'staffPages',
+    'dashboardCards',
+    'settingsSections'
+];
+/**
+ * What `register()` visibly registers (AGL-3116), read from the tree.
+ *
+ * A heuristic like every check here: it reads registration calls whose
+ * arguments are written out — an object literal, a string or a named slot —
+ * and reports every call it cannot read as `unresolved` rather than guessing.
+ * The declaration stays the contract; this is how a publisher learns theirs
+ * is incomplete before a published page fails to load the plugin.
+ */ function detectRegistrations(program, constants) {
+    const slots = new Set();
+    const routes = new Set();
+    const orgRoutes = new Set();
+    const components = new Set();
+    const features = new Set();
+    const unresolved = new Set();
+    let shell = false;
+    const objectProperty = (object, name)=>{
+        var _object_properties;
+        if ((object == null ? void 0 : object.type) !== 'ObjectExpression') return undefined;
+        for (const property of (_object_properties = object['properties']) != null ? _object_properties : []){
+            if (property.type !== 'Property') continue;
+            const key = property['key'];
+            const keyName = !property['computed'] && (key == null ? void 0 : key.type) === 'Identifier' ? key['name'] : staticString(key, constants);
+            if (keyName === name) return property['value'];
+        }
+        return undefined;
+    };
+    const listOf = (node)=>{
+        var _node_elements;
+        return (node == null ? void 0 : node.type) === 'ArrayExpression' ? (_node_elements = node['elements']) != null ? _node_elements : [] : null;
+    };
+    // A slot as a widget names it: a string, or a catalog entry
+    // (`CONSOLE_WIDGET_SLOTS.hostActivity`), whose property IS the slot id.
+    const slotName = (node)=>{
+        const literal = staticString(node, constants);
+        if (literal !== null) return literal;
+        return (node == null ? void 0 : node.type) === 'MemberExpression' ? propertyName(node, constants) : null;
+    };
+    walk(program, (node)=>{
+        var _node_arguments;
+        if (node.type !== 'CallExpression') return;
+        const callee = node['callee'];
+        const name = (callee == null ? void 0 : callee.type) === 'Identifier' ? callee['name'] : (callee == null ? void 0 : callee.type) === 'MemberExpression' ? propertyName(callee, constants) : null;
+        if (!name || !REGISTRATION_CALLS.has(name)) return;
+        const args = (_node_arguments = node['arguments']) != null ? _node_arguments : [];
+        if (name === 'registerConsoleExtension') {
+            const extension = args[0];
+            if ((extension == null ? void 0 : extension.type) !== 'ObjectExpression') {
+                unresolved.add('a console extension built at runtime');
+                return;
+            }
+            const widgets = objectProperty(extension, 'widgets');
+            if (widgets) {
+                const list = listOf(widgets);
+                if (!list) unresolved.add('a console widget list built at runtime');
+                for (const widget of list != null ? list : []){
+                    const slot = slotName(objectProperty(widget, 'slot'));
+                    if (slot) slots.add(slot);
+                    else unresolved.add('a console widget whose slot is built at runtime');
+                }
+            }
+            for (const field of SHELL_EXTENSION_FIELDS){
+                const value = objectProperty(extension, field);
+                if (!value) continue;
+                shell = true;
+                if (field !== 'navItems' && field !== 'orgNavItems') continue;
+                const into = field === 'navItems' ? routes : orgRoutes;
+                const list = listOf(value);
+                if (!list) unresolved.add(`console ${field} built at runtime`);
+                for (const item of list != null ? list : []){
+                    const href = staticString(objectProperty(item, 'href'), constants);
+                    if (href) into.add(href);
+                    else unresolved.add(`a console ${field} entry whose href is built at runtime`);
+                }
+            }
+            return;
+        }
+        if (name === 'registerSiteRuntime') {
+            const id = staticString(objectProperty(args[0], 'runtimeId'), constants);
+            if (id) features.add(id);
+            else unresolved.add('a site runtime whose runtimeId is built at runtime');
+            return;
+        }
+        if (name === 'registerComponent') {
+            const id = staticString(objectProperty(args[1], '$id'), constants);
+            if (id) components.add(id);
+            else unresolved.add('a canvas component whose $id is built at runtime');
+            return;
+        }
+        // `addDependency` / `defineUiFeatureBundle`: a component bundle whose
+        // entries register later, from a list this pass does not follow.
+        unresolved.add('a canvas component bundle');
+    });
+    const contributes = {};
+    if (components.size || features.size) {
+        contributes.site = _extends({}, components.size ? {
+            components: [
+                ...components
+            ].sort()
+        } : {}, features.size ? {
+            features: [
+                ...features
+            ].sort()
+        } : {});
+    }
+    if (slots.size || routes.size || orgRoutes.size || shell) {
+        contributes.console = _extends({}, slots.size ? {
+            slots: [
+                ...slots
+            ].sort()
+        } : {}, routes.size ? {
+            routes: [
+                ...routes
+            ].sort()
+        } : {}, orgRoutes.size ? {
+            orgRoutes: [
+                ...orgRoutes
+            ].sort()
+        } : {}, shell ? {
+            shell: true
+        } : {});
+    }
+    return {
+        contributes,
+        unresolved: [
+            ...unresolved
+        ].sort()
+    };
+}
+/** A declaration in the words a reviewer reads: `console slots hostActivity`. */ function describeContributions(contributes) {
+    var _contributes_site, _contributes_console;
+    var _site_components, _site_features, _shell_slots, _shell_routes, _shell_orgRoutes;
+    const parts = [];
+    const site = (_contributes_site = contributes.site) != null ? _contributes_site : {};
+    const shell = (_contributes_console = contributes.console) != null ? _contributes_console : {};
+    if ((_site_components = site.components) == null ? void 0 : _site_components.length) parts.push(`site components ${site.components.join(', ')}`);
+    if ((_site_features = site.features) == null ? void 0 : _site_features.length) parts.push(`site features ${site.features.join(', ')}`);
+    if ((_shell_slots = shell.slots) == null ? void 0 : _shell_slots.length) parts.push(`console slots ${shell.slots.join(', ')}`);
+    if ((_shell_routes = shell.routes) == null ? void 0 : _shell_routes.length) parts.push(`console routes ${shell.routes.join(', ')}`);
+    if ((_shell_orgRoutes = shell.orgRoutes) == null ? void 0 : _shell_orgRoutes.length) {
+        parts.push(`console organization routes ${shell.orgRoutes.join(', ')}`);
+    }
+    if (shell.shell) parts.push('the console shell');
+    return parts.join(' · ') || 'nothing';
+}
+/**
+ * The `contributions` area (AGL-3116): what the bundle registers against what
+ * its manifest declares.
+ *
+ * Every registration the tree shows must be declared, because the loaders
+ * read ONLY the declaration: a slot the manifest omits is a slot whose
+ * screens never load the plugin, and a component it omits is an element that
+ * renders empty on every published page that places it. A declared entry the
+ * bundle never registers is a warning — the plugin loads there for nothing.
+ */ function compareContributions(detected, options, add, details, markUnknown) {
+    var _found_site, _declared_site, _found_site1, _declared_site1, _found_console, _declared_console, _found_console1, _declared_console1, _found_console2, _declared_console2, _found_console3, _declared_console3, _declared_site2, _found_site2, _declared_site3, _found_site3, _declared_console4, _found_console4;
+    const found = detected.contributes;
+    const registers = describeContributions(found);
+    const registersSomething = Boolean(found.site || found.console) || detected.unresolved.length > 0;
+    const unreadable = detected.unresolved.length ? ` It also makes registrations the checker could not read: ${detected.unresolved.join('; ')}.` : '';
+    const declared = options == null ? void 0 : options.declaredContributions;
+    if (declared === undefined) {
+        // Nothing to compare against is `unknown`, never a pass — the same
+        // reading the network row gives a bundle checked without its manifest.
+        if (!registersSomething) {
+            details.set('contributions', 'registers nothing');
+            return;
+        }
+        markUnknown('contributions');
+        details.set('contributions', `registers ${registers} — no manifest was supplied, so nothing was compared`);
+        return;
+    }
+    if (declared === null) {
+        details.set('contributions', registersSomething ? `undeclared · registers ${registers}` : 'declares and registers nothing');
+        if (!registersSomething) return;
+        add((options == null ? void 0 : options.requireContributions) ? 'error' : 'warning', 'contributions', `the manifest declares no "contributes", and register() registers ` + `${registers}.${unreadable} Declare it — ` + `"contributes": ${JSON.stringify(found)} — because the loaders place ` + 'a plugin by its declaration alone. Undeclared, a published page ' + 'loads it only where its element is placed and the console loads it ' + 'with the shell.');
+        return;
+    }
+    details.set('contributions', `declares ${describeContributions(declared)}`);
+    const missing = (label, registered, listed, consequence)=>{
+        for (const id of registered != null ? registered : []){
+            if ((listed != null ? listed : []).includes(id)) continue;
+            add('error', 'contributions', `register() registers ${label} "${id}", which the manifest does not ` + `declare — ${consequence}`);
+        }
+    };
+    missing('the site component', (_found_site = found.site) == null ? void 0 : _found_site.components, (_declared_site = declared.site) == null ? void 0 : _declared_site.components, 'a published page that places it would never load the plugin');
+    missing('the site feature', (_found_site1 = found.site) == null ? void 0 : _found_site1.features, (_declared_site1 = declared.site) == null ? void 0 : _declared_site1.features, 'no published page would ever load the plugin to run it');
+    missing('a widget in the console slot', (_found_console = found.console) == null ? void 0 : _found_console.slots, (_declared_console = declared.console) == null ? void 0 : _declared_console.slots, 'a screen that renders the slot would never load the plugin');
+    missing('the console route', (_found_console1 = found.console) == null ? void 0 : _found_console1.routes, (_declared_console1 = declared.console) == null ? void 0 : _declared_console1.routes, 'the route would not find the plugin that serves it');
+    missing('the console organization route', (_found_console2 = found.console) == null ? void 0 : _found_console2.orgRoutes, (_declared_console2 = declared.console) == null ? void 0 : _declared_console2.orgRoutes, 'the route would not find the plugin that serves it');
+    if (((_found_console3 = found.console) == null ? void 0 : _found_console3.shell) && !((_declared_console3 = declared.console) == null ? void 0 : _declared_console3.shell)) {
+        add('error', 'contributions', 'register() adds a nav tab, a provider or another entry the console ' + 'shell draws on every screen, and the manifest does not declare ' + '"console": { "shell": true } — the shell would draw it only on ' + 'screens that happened to load the plugin for something else');
+    }
+    if (detected.unresolved.length) {
+        add('warning', 'contributions', `the checker could not read ${detected.unresolved.join('; ')} — ` + 'confirm the declaration covers what it registers');
+    }
+    const unused = (label, listed, registered)=>{
+        // Only when every registration of that kind was readable: an unreadable
+        // one may be exactly the entry that is declared.
+        if (detected.unresolved.length) return;
+        for (const id of listed != null ? listed : []){
+            if ((registered != null ? registered : []).includes(id)) continue;
+            add('warning', 'contributions', `the manifest declares ${label} "${id}", and register() never ` + 'registers it — the plugin would load there for nothing');
+        }
+    };
+    unused('the site component', (_declared_site2 = declared.site) == null ? void 0 : _declared_site2.components, (_found_site2 = found.site) == null ? void 0 : _found_site2.components);
+    unused('the site feature', (_declared_site3 = declared.site) == null ? void 0 : _declared_site3.features, (_found_site3 = found.site) == null ? void 0 : _found_site3.features);
+    unused('the console slot', (_declared_console4 = declared.console) == null ? void 0 : _declared_console4.slots, (_found_console4 = found.console) == null ? void 0 : _found_console4.slots);
+}
+function analyseBundle(source, options) {
+    var _ref;
+    const problems = [];
+    const seen = new Set();
+    // Every area starts as "ran, found nothing" and is downgraded by its own
+    // findings, so the summary cannot drift from the problem list (AGL-1087).
+    const status = new Map(CHECK_ORDER.map((id)=>[
+            id,
+            'pass'
+        ]));
+    const details = new Map();
+    const add = (level, check, message)=>{
+        if (level === 'error') status.set(check, 'fail');
+        else if (status.get(check) === 'pass') status.set(check, 'question');
+        if (seen.has(message) || seen.size >= MAX_PROBLEMS) return;
+        seen.add(message);
+        problems.push({
+            level,
+            message,
+            check
+        });
+    };
+    /** Mark the areas that never ran, so they cannot read as clean. */ const unknownFrom = (...ids)=>{
+        for (const id of ids)status.set(id, 'unknown');
+    };
+    const summarise = ()=>CHECK_ORDER.map((id)=>{
+            var _status_get;
+            return _extends({
+                id,
+                label: CHECK_LABELS[id],
+                status: (_status_get = status.get(id)) != null ? _status_get : 'unknown'
+            }, details.has(id) ? {
+                detail: details.get(id)
+            } : {});
+        });
+    const maxBytes = (_ref = options == null ? void 0 : options.maxBytes) != null ? _ref : MAX_PLUGIN_BUNDLE_BYTES;
+    const bytes = new TextEncoder().encode(source).byteLength;
+    details.set('size', `${bytes.toLocaleString('en-US')} bytes of ${maxBytes.toLocaleString('en-US')}`);
+    if (bytes === 0) {
+        add('error', 'size', 'bundle is empty');
+        unknownFrom('parse', 'entry', 'self-contained', 'code-execution', 'globals', 'storage', 'dynamic-import', 'network', 'obfuscation', 'contributions');
+        return {
+            ok: false,
+            problems,
+            checks: summarise(),
+            exports: {
+                register: false,
+                registerApi: false
+            },
+            contributions: NOTHING_DETECTED
+        };
+    }
+    if (bytes > maxBytes) {
+        add('error', 'size', `bundle is ${bytes} bytes (limit ${maxBytes})`);
+    }
+    const parseOptions = {
+        ecmaVersion: 'latest',
+        sourceType: 'module',
+        allowHashBang: true,
+        allowAwaitOutsideFunction: true
+    };
+    let program;
+    try {
+        program = parse(source, parseOptions);
+    } catch (error) {
+        // Unparseable means unanalysable, and the loader would fail on it too.
+        // Nothing else ran, and saying so is the whole point of `unknown`: a
+        // bundle nobody could read must not show nine green rows.
+        add('error', 'parse', `bundle does not parse as an ES module: ${error instanceof Error ? error.message : String(error)}`);
+        unknownFrom('entry', 'self-contained', 'code-execution', 'globals', 'storage', 'dynamic-import', 'network', 'obfuscation', 'contributions');
+        return {
+            ok: false,
+            problems,
+            checks: summarise(),
+            exports: {
+                register: false,
+                registerApi: false
+            },
+            contributions: NOTHING_DETECTED
+        };
+    }
+    // Names bound to a global, so `const g = globalThis; g['ev'+'al']` reads
+    // as access on a global rather than on some object we know nothing about.
+    const aliases = new Set();
+    const noteAlias = (name, init)=>{
+        if (typeof name !== 'string' || !init) return;
+        const roots = init.type === 'LogicalExpression' ? [
+            init['left'],
+            init['right']
+        ] : [
+            init
+        ];
+        for (const root of roots){
+            if ((root == null ? void 0 : root.type) === 'Identifier' && GLOBAL_ROOTS.has(root['name'])) {
+                aliases.add(name);
+            }
+        }
+    };
+    // Local name -> the constant string it holds (AGL-1093).
+    //
+    // A binding is only usable when the whole tree agrees on it: declared once,
+    // never assigned again, and never a parameter or another binder anywhere.
+    // Any of those means the value at a given call site is a GUESS, and a guess
+    // is how a checker starts making claims about code it did not read.
+    const constants = new Map();
+    {
+        const bound = new Map();
+        const poisoned = new Set();
+        const declared = new Set();
+        const poison = (name)=>{
+            if (typeof name === 'string') poisoned.add(name);
+        };
+        /** Every name a pattern binds — a parameter shadowing a constant is a
+     * different variable, and resolving it to the outer value would be a
+     * fabrication. */ const poisonPattern = (node)=>{
+            if (!node) return;
+            if (node.type === 'Identifier') return poison(node['name']);
+            for (const key of [
+                'left',
+                'argument',
+                'properties',
+                'elements',
+                'value'
+            ]){
+                const value = node[key];
+                if (Array.isArray(value)) value.forEach((item)=>poisonPattern(item));
+                else if (value) poisonPattern(value);
+            }
+        };
+        walk(program, (node)=>{
+            if (node.type === 'VariableDeclarator') {
+                const id = node['id'];
+                if ((id == null ? void 0 : id.type) === 'Identifier') {
+                    const name = id['name'];
+                    if (declared.has(name)) poison(name);
+                    declared.add(name);
+                    bound.set(name, node['init']);
+                } else {
+                    poisonPattern(id);
+                }
+            } else if (node.type === 'AssignmentExpression') {
+                poisonPattern(node['left']);
+            } else if (node.type === 'UpdateExpression') {
+                poisonPattern(node['argument']);
+            } else if (node.type === 'FunctionDeclaration' || node.type === 'FunctionExpression' || node.type === 'ArrowFunctionExpression') {
+                var _node_params;
+                var _node_id;
+                ;
+                ((_node_params = node['params']) != null ? _node_params : []).forEach(poisonPattern);
+                if (((_node_id = node['id']) == null ? void 0 : _node_id.type) === 'Identifier') poison(node['id']['name']);
+            } else if (node.type === 'CatchClause') {
+                poisonPattern(node['param']);
+            } else if (node.type === 'ClassDeclaration' || node.type === 'ClassExpression') {
+                var _node_id1;
+                if (((_node_id1 = node['id']) == null ? void 0 : _node_id1.type) === 'Identifier') poison(node['id']['name']);
+            }
+        });
+        // Two passes, so `const BASE = 'https://x'` then `BASE + '/y'` resolves.
+        // A third buys almost nothing and each is a full re-read of the bindings.
+        for(let pass = 0; pass < 2; pass += 1){
+            for (const [name, init] of bound){
+                if (poisoned.has(name) || constants.has(name)) continue;
+                const value = staticString(init, constants);
+                if (value !== null) constants.set(name, value);
+            }
+        }
+    }
+    // Local name -> the callable it stands for (AGL-1090). `const f = fetch`,
+    // `const d = globalThis.fetch`, `const {fetch: h} = globalThis`.
+    const callableAliases = new Map();
+    /** The aliasable callable an initializer denotes, if any. */ const callableFrom = (init)=>{
+        if (!init) return null;
+        if (init.type === 'Identifier' && ALIASABLE_CALLABLES.has(init['name'])) {
+            return init['name'];
+        }
+        // `globalThis.fetch` / `window['fe' + 'tch']` — the property is what the
+        // name will stand for, and only when the object is a global (an unknown
+        // object's `.fetch` is somebody else's method).
+        if (init.type === 'MemberExpression') {
+            const property = propertyName(init);
+            const object = init['object'];
+            if (property && ALIASABLE_CALLABLES.has(property) && (object == null ? void 0 : object.type) === 'Identifier' && (GLOBAL_ROOTS.has(object['name']) || aliases.has(object['name']))) {
+                return property;
+            }
+        }
+        return null;
+    };
+    const noteCallableAlias = (id, init)=>{
+        if (!id) return;
+        if (id.type === 'Identifier') {
+            const callable = callableFrom(init);
+            if (callable) callableAliases.set(id['name'], callable);
+            return;
+        }
+        // `const { fetch } = globalThis` and `const { fetch: h } = globalThis`.
+        if (id.type === 'ObjectPattern' && init) {
+            var _id_properties;
+            const fromGlobal = init.type === 'Identifier' && (GLOBAL_ROOTS.has(init['name']) || aliases.has(init['name']));
+            if (!fromGlobal) return;
+            for (const property of (_id_properties = id['properties']) != null ? _id_properties : []){
+                const key = property['key'];
+                const value = property['value'];
+                const name = (key == null ? void 0 : key.type) === 'Identifier' ? key['name'] : staticString(key);
+                if (name && ALIASABLE_CALLABLES.has(name) && (value == null ? void 0 : value.type) === 'Identifier') {
+                    callableAliases.set(value['name'], name);
+                }
+            }
+        }
+    };
+    // Global-object aliases first, as a complete pass: the callable pass below
+    // resolves `g.fetch` against them, and walk order is not source order.
+    walk(program, (node)=>{
+        if (node.type === 'VariableDeclarator') {
+            const id = node['id'];
+            if ((id == null ? void 0 : id.type) === 'Identifier') noteAlias(id['name'], node['init']);
+        } else if (node.type === 'AssignmentExpression' && node['operator'] === '=') {
+            const left = node['left'];
+            if ((left == null ? void 0 : left.type) === 'Identifier') noteAlias(left['name'], node['right']);
+        }
+    });
+    walk(program, (node)=>{
+        if (node.type === 'VariableDeclarator') {
+            noteCallableAlias(node['id'], node['init']);
+        } else if (node.type === 'AssignmentExpression' && node['operator'] === '=') {
+            noteCallableAlias(node['left'], node['right']);
+        }
+    });
+    const isGlobalRef = (node)=>!!node && node.type === 'Identifier' && (GLOBAL_ROOTS.has(node['name']) || aliases.has(node['name']));
+    const declared = options == null ? void 0 : options.declaredNetwork;
+    const allowlist = new Set((declared != null ? declared : []).map((origin)=>{
+        try {
+            return new URL(origin).origin;
+        } catch (unused) {
+            return origin;
+        }
+    }));
+    /** Level for a network finding: a claim only when we know what was declared. */ const networkLevel = declared ? 'error' : 'warning';
+    // What the bundle reaches for, so the summary row can SAY it (AGL-1087) —
+    // "calls https://api.stripe.com, declared" is the line a reviewer would
+    // otherwise open the bundle to get.
+    const networkApis = new Set();
+    const networkOrigins = new Set();
+    let runtimeUrls = 0;
+    /** Origins handed to a callee the checker could not resolve (AGL-1090). */ const unresolvedOrigins = new Set();
+    const noteNetwork = (api, urlArg)=>{
+        const origin = literalOrigin(urlArg, constants);
+        networkApis.add(api);
+        if (origin) networkOrigins.add(origin);
+        else runtimeUrls += 1;
+        if (!declared) {
+            add('warning', 'network', `bundle makes network calls (${api}) — check them against the ` + "manifest's declared network capability");
+            return;
+        }
+        if (!allowlist.size) {
+            add(networkLevel, 'network', `bundle calls ${api} but the manifest declares no network ` + 'capability — declare every origin under capabilities.network ' + '(the CSP blocks the rest at runtime)');
+            return;
+        }
+        if (!origin) {
+            add('warning', 'network', `${api} is called with a URL that is only known at runtime — it ` + 'cannot be checked against the declared origins');
+            return;
+        }
+        if (!allowlist.has(origin)) {
+            add(networkLevel, 'network', `${api} calls ${origin}, which the manifest does not declare ` + `(declared: ${[
+                ...allowlist
+            ].join(', ')})`);
+        }
+    };
+    /**
+   * A call the checker could not resolve, given an absolute URL.
+   *
+   * Reported as a QUESTION, never a refusal: most of these are helpers, and
+   * refusing every unrecognised call that mentions a URL would make the
+   * verifier useless. But leaving them silent is what let the network row
+   * claim "no network calls" over a bundle whose calls it simply could not
+   * follow — and a URL to an origin the manifest never declared is exactly
+   * what a reviewer should be pointed at.
+   */ const noteUnresolvedUrl = (name, urlArg)=>{
+        if (name && URL_TAKING_NON_CALLS.has(name)) return;
+        const origin = literalOrigin(urlArg, constants);
+        if (!origin) return;
+        // A declared origin is consistent with the manifest and permitted by the
+        // CSP, so there is no question to raise about it.
+        if (allowlist.has(origin)) return;
+        unresolvedOrigins.add(origin);
+        add('warning', 'network', `${name ? `${name}()` : 'a call'} is passed ${origin}, which the ` + 'manifest does not declare — the checker could not tell whether it ' + 'reaches the network, so read this call');
+    };
+    let exportsRegister = false;
+    let exportsRegisterApi = false;
+    const noteExport = (name)=>{
+        if (name === 'register') exportsRegister = true;
+        else if (name === 'registerApi') exportsRegisterApi = true;
+    };
+    let obfuscatedNames = 0;
+    walk(program, (node)=>{
+        switch(node.type){
+            // ---- entry exports + self-containment ----
+            case 'ImportDeclaration':
+                add('error', 'self-contained', 'bundle has static imports — realm bundles must be self-contained ' + '(react/@aglyn/aglyn come from the host ABI; see the realm rollup ' + 'template)');
+                break;
+            case 'ExportAllDeclaration':
+            case 'ExportNamedDeclaration':
+                {
+                    var _node_specifiers;
+                    if (node['source']) {
+                        add('error', 'self-contained', 'bundle re-exports from another module — realm bundles must be ' + 'self-contained (see the realm rollup template)');
+                    }
+                    const declaration = node['declaration'];
+                    if (declaration) {
+                        var _declaration_declarations;
+                        if (declaration['id']) noteExport(declaration['id']['name']);
+                        for (const declarator of (_declaration_declarations = declaration['declarations']) != null ? _declaration_declarations : []){
+                            const id = declarator['id'];
+                            if ((id == null ? void 0 : id.type) === 'Identifier') noteExport(id['name']);
+                        }
+                    }
+                    for (const specifier of (_node_specifiers = node['specifiers']) != null ? _node_specifiers : []){
+                        const exported = specifier['exported'];
+                        noteExport((exported == null ? void 0 : exported.type) === 'Identifier' ? exported['name'] : staticString(exported));
+                    }
+                    break;
+                }
+            // ---- dynamic import ----
+            case 'ImportExpression':
+                {
+                    const specifier = staticString(node['source'], constants);
+                    if (specifier === null) {
+                        add('error', 'dynamic-import', 'dynamic import with a specifier computed at runtime is not ' + 'allowed — the loader cannot know what would be fetched');
+                    } else if (/^https?:/i.test(specifier)) {
+                        add('error', 'dynamic-import', 'dynamic import of remote URLs is not allowed');
+                    }
+                    break;
+                }
+            // ---- calls ----
+            case 'CallExpression':
+            case 'NewExpression':
+                {
+                    var _node_arguments, _ref, _ref1;
+                    const callee = node['callee'];
+                    const args = (_node_arguments = node['arguments']) != null ? _node_arguments : [];
+                    const written = (callee == null ? void 0 : callee.type) === 'Identifier' ? callee['name'] : (callee == null ? void 0 : callee.type) === 'MemberExpression' ? propertyName(callee, constants) : null;
+                    // An alias resolves to what it stands for (AGL-1090), so `f(url)`
+                    // after `const f = fetch` is a fetch call.
+                    const name = (_ref = (_ref1 = written && callableAliases.get(written)) != null ? _ref1 : written) != null ? _ref : null;
+                    if (name === 'eval') add('error', 'code-execution', 'eval() is not allowed');
+                    if (name === 'Function') add('error', 'code-execution', 'the Function constructor is not allowed');
+                    // `(()=>{}).constructor('return 1')()` — the Function constructor
+                    // reached through any function value, which is why the CALL is the
+                    // finding rather than the name `Function`.
+                    if (name === 'constructor' && (callee == null ? void 0 : callee.type) === 'MemberExpression') add('error', 'code-execution', 'calling .constructor() is not allowed — it reaches the ' + 'Function constructor from any function value');
+                    if (name && NETWORK_CALLS.has(name)) noteNetwork(name, args[0]);
+                    else if (name && NETWORK_CONSTRUCTORS.has(name)) noteNetwork(name, node.type === 'NewExpression' ? args[0] : args[1]);
+                    else noteUnresolvedUrl(name, args[0]);
+                    break;
+                }
+            // ---- member access ----
+            case 'MemberExpression':
+                {
+                    const object = node['object'];
+                    const name = propertyName(node, constants);
+                    if (isGlobalRef(object) && name === null) {
+                        add('error', 'globals', `computed property access on ${object['name'] || 'a global'} is not allowed — a property chosen at runtime cannot be ` + 'reviewed');
+                        break;
+                    }
+                    // Property names only mean anything on a global: `response.cookie`
+                    // and `state.localStorage` are somebody else's object.
+                    if (name === 'cookie' && isGlobalRef(object)) add('error', 'storage', 'document.cookie access is not allowed');
+                    if (name && STORAGE_NAMES.has(name) && isGlobalRef(object)) add('error', 'storage', 'browser storage access is not allowed (use host-mediated data)');
+                    if (name === 'eval' && isGlobalRef(object)) add('error', 'code-execution', 'eval() is not allowed');
+                    break;
+                }
+            // ---- bare references ----
+            case 'Identifier':
+                {
+                    const name = node['name'];
+                    if (STORAGE_NAMES.has(name)) add('error', 'storage', 'browser storage access is not allowed (use host-mediated data)');
+                    if (OBFUSCATED_NAME.test(name)) obfuscatedNames += 1;
+                    break;
+                }
+            // ---- obfuscation ----
+            case 'Literal':
+                {
+                    const value = node['value'];
+                    if (typeof value === 'string' && value.length >= MIN_SUSPICIOUS_BASE64 && BASE64_BLOB.test(value)) {
+                        add('warning', 'obfuscation', `bundle embeds a ${value.length}-character base64 literal — ` + 'decode it before approving');
+                    }
+                    break;
+                }
+            default:
+                break;
+        }
+    });
+    if (!exportsRegister && !exportsRegisterApi) {
+        add('error', 'entry', 'bundle exports neither register(host) nor registerApi() — ' + 'nothing for the loader to call');
+    }
+    if (obfuscatedNames >= MIN_OBFUSCATED_NAMES) {
+        add('warning', 'obfuscation', `bundle uses ${obfuscatedNames} machine-obfuscated identifiers ` + '(_0x… naming) — minifiers do not produce these');
+    }
+    const longestLine = source.split('\n').reduce((longest, line)=>Math.max(longest, line.length), 0);
+    if (longestLine > MAX_READABLE_LINE) {
+        add('warning', 'obfuscation', `bundle has a single ${longestLine}-character line — nothing on it ` + 'can be read in review; ask for a readable build or a source map');
+    }
+    details.set('entry', [
+        exportsRegister ? 'register(host)' : null,
+        exportsRegisterApi ? 'registerApi()' : null
+    ].filter(Boolean).join(', ') || 'none');
+    // What the network check actually saw. Without the manifest it saw the
+    // calls but could not judge them, and that is `unknown`, not a pass — the
+    // row a reviewer must not read as "checked and fine".
+    if (!declared) {
+        if (networkApis.size) {
+            status.set('network', 'unknown');
+            details.set('network', `calls ${[
+                ...networkApis
+            ].join(', ')} — no declared origins were ` + 'supplied, so nothing was compared');
+        } else {
+            details.set('network', 'no network calls');
+        }
+    } else if (!networkApis.size) {
+        details.set('network', unresolvedOrigins.size ? `no resolved network calls, but ${[
+            ...unresolvedOrigins
+        ].join(', ')} ` + 'is passed to a call the checker could not follow' : 'no network calls');
+    } else {
+        const origins = networkOrigins.size ? [
+            ...networkOrigins
+        ].map((origin)=>allowlist.has(origin) ? `${origin} (declared)` : `${origin} (NOT declared)`).join(', ') : '';
+        details.set('network', [
+            `calls ${[
+                ...networkApis
+            ].join(', ')}`,
+            origins,
+            runtimeUrls ? `${runtimeUrls} call(s) with a URL only known at runtime` : ''
+        ].filter(Boolean).join(' · '));
+    }
+    const detected = detectRegistrations(program, constants);
+    compareContributions(detected, options, add, details, (check)=>status.set(check, 'unknown'));
+    return {
+        ok: !problems.some((problem)=>problem.level === 'error'),
+        problems,
+        checks: summarise(),
+        exports: {
+            register: exportsRegister,
+            registerApi: exportsRegisterApi
+        },
+        contributions: detected
+    };
+}
+/**
+ * Run the checks over a bundle. NEVER throws (AGL-1094).
+ *
+ * The publish route calls this directly, so an unexpected failure in here
+ * used to mean a 500 and no explanation for the publisher — and in the review
+ * sweep it looked exactly like a missing artifact, which sent the
+ * investigation to the storage bucket instead of to this file. A checker that
+ * cannot analyse a bundle has an answer: say so, in the verdict, as an error.
+ */ export function checkPluginBundle(source, options) {
+    try {
+        return analyseBundle(source, options);
+    } catch (error) {
+        return {
+            ok: false,
+            problems: [
+                {
+                    level: 'error',
+                    check: 'parse',
+                    message: 'the verifier failed on this bundle — treat it as unchecked and ' + `report it: ${error instanceof Error ? error.message : String(error)}`
+                }
+            ],
+            checks: CHECK_ORDER.map((id)=>({
+                    id,
+                    label: CHECK_LABELS[id],
+                    status: id === 'parse' ? 'fail' : 'unknown'
+                })),
+            exports: {
+                register: false,
+                registerApi: false
+            },
+            contributions: NOTHING_DETECTED
+        };
+    }
+}
+
+//# sourceMappingURL=plugin-bundle-checks.js.map