@aglyn/aglyn 1.0.0-beta.143

package/src/lib/app-utils/attribution-attribute.js

@@ -0,0 +1,34 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * The attribute that marks an element the attribution guard keeps visible.
+ *
+ * A module of its own so the PAGE can name the attribute without taking the
+ * guard with it (AGL-2706). The page renderer marks the credit badge and the
+ * abuse-report control with this on every render; the guard that repairs
+ * them runs from an effect, on the minority of sites that show them, and
+ * arrives through a dynamic `import()`.
+ *
+ * Splitting the constant out and leaving the guard statically imported was
+ * measured and came back HEAVIER — both modules shipped, plus a second
+ * module's overhead. It is the pair of changes that pays: the constant here,
+ * and `attribution-guard.component.tsx` reaching the installer lazily.
+ *
+ * `attribution-guard.ts` re-exports this, so `@aglyn/aglyn/server` still
+ * offers the whole surface under one name.
+ */ export const ATTRIBUTION_ATTRIBUTE = 'data-aglyn-attribution';
+
+//# sourceMappingURL=attribution-attribute.js.map

package/src/lib/app-utils/attribution-attribute.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/attribution-attribute.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * The attribute that marks an element the attribution guard keeps visible.\n *\n * A module of its own so the PAGE can name the attribute without taking the\n * guard with it (AGL-2706). The page renderer marks the credit badge and the\n * abuse-report control with this on every render; the guard that repairs\n * them runs from an effect, on the minority of sites that show them, and\n * arrives through a dynamic `import()`.\n *\n * Splitting the constant out and leaving the guard statically imported was\n * measured and came back HEAVIER — both modules shipped, plus a second\n * module's overhead. It is the pair of changes that pays: the constant here,\n * and `attribution-guard.component.tsx` reaching the installer lazily.\n *\n * `attribution-guard.ts` re-exports this, so `@aglyn/aglyn/server` still\n * offers the whole surface under one name.\n */\nexport const ATTRIBUTION_ATTRIBUTE = 'data-aglyn-attribution'\n"],"names":["ATTRIBUTION_ATTRIBUTE"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;CAgBC,GACD,OAAO,MAAMA,wBAAwB,yBAAwB"}

package/src/lib/app-utils/attribution-guard.d.ts

@@ -0,0 +1,130 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Keeps the credit badge and the abuse-report control on the page.
+ *
+ * Both render as ordinary elements in the published document, which means the
+ * site's own author can take them off it. Not by breaking anything — by using
+ * the product as sold: a tag manager container, a custom-code block, or three
+ * lines of theme CSS. `a[href="/api/report-abuse"] { display: none }` is the
+ * whole exploit, and the report control is precisely the thing a phishing
+ * site's author wants gone.
+ *
+ * ## What this can and cannot do
+ *
+ * It cannot make suppression impossible. The author controls the page: they
+ * can run script before this does, and at the limit they can put a proxy in
+ * front of the whole site. Anyone who promises otherwise is selling something.
+ *
+ * What it CAN do is move suppression out of reach of the tools people
+ * actually reach for, and make the attempt visible when it happens:
+ *
+ * - **Restore into a closed shadow root.** No selector crosses a shadow
+ *   boundary, so the CSS above stops matching, and `document.querySelector`
+ *   cannot find the contents to remove them. The mount element carries a
+ *   name minted per page load, so a stylesheet cannot name it either, and its
+ *   own layout properties are set inline `!important` — the highest
+ *   precedence an author-origin declaration has, which a stylesheet rule of
+ *   any specificity cannot beat.
+ * - **Put it back.** Removing the mount re-appends it; overwriting its styles
+ *   re-asserts them.
+ * - **Say so.** A suppression that had to be repaired is reported once per
+ *   page view, so the site becomes reviewable rather than quietly
+ *   unattributed. This is the part that actually matters: enforcement is a
+ *   policy decision made by a person, and it needs a signal to act on.
+ *
+ * ## Deliberately not pre-emptive
+ *
+ * The badge is left in the light DOM until something tries to suppress it.
+ * It is the platform's only organic acquisition surface — one crawlable link
+ * on every free site — and burying it in a closed shadow root on every page
+ * load to defend against a minority would cost that on all of them.
+ *
+ * ## Why not `MuiShadowDom` / `shadowDomRootFactory`
+ *
+ * Both existing shadow-root helpers are React components that `createPortal`
+ * their children into the root, and React has to own the contents. That is
+ * the one thing this cannot have.
+ *
+ * The job is to put back a node that foreign script deleted, and React does
+ * not react to its own output being removed — the reconciler answers to state
+ * changes, not to DOM deletion, so a portalled subtree whose mount is taken
+ * off `document.body` simply stays gone. The MutationObserver below would be
+ * needed either way, and it would then be re-appending an element React
+ * believes it is managing, which is the shape that produces "removeChild on a
+ * node that is not a child" the next time React touches it.
+ *
+ * Plain DOM also means the repair outlives React: an unmount, an error
+ * boundary tripping, or the author's own script tearing out the root does not
+ * take it with them. (Both helpers also default to `mode: 'open'` and carry
+ * SSR and adopted-stylesheet machinery built for the besigner canvas, none of
+ * which applies here.)
+ *
+ * Framework-free, like `error-beacon` beside it, and for the same reason: the
+ * install must be able to run before any effect. Deliberately NO 'use client'
+ * directive — inside this shared lib the directive forks the module graph
+ * (AGL-52), and every importer is already a client module.
+ *
+ * ## Reached through a dynamic `import()`
+ *
+ * Nothing on the tenant's eager path names this module. The renderer marks
+ * its elements with `ATTRIBUTION_ATTRIBUTE`, which lives in a module of its
+ * own for exactly that reason, and `attribution-guard.component.tsx` imports
+ * this one from inside its effect — so the sites that show no attribution,
+ * which is every paid site, never fetch it (AGL-2706). The element copies the
+ * repair rebuilds from are taken by the component BEFORE the chunk is asked
+ * for; see `shipped` below.
+ */
+export { ATTRIBUTION_ATTRIBUTE } from './attribution-attribute';
+/** Why a check failed. Reported verbatim, so keep these short and stable. */
+export type AttributionSuppression = 'removed' | 'display' | 'visibility' | 'opacity' | 'collapsed' | 'pointer-events' | 'offscreen' | 'covered';
+export interface AttributionGuardOptions {
+    /** Where a suppression is reported. Same-origin path, never a URL. */
+    endpoint?: string;
+    /** The site being checked, so the report names one without a lookup. */
+    hostId?: string;
+    /**
+     * What the page rendered, keyed by subject, captured before this module
+     * was even fetched.
+     *
+     * The caller takes these because the repair rebuilds a suppressed element
+     * from a copy of the original, and by the time one is missing there is
+     * nothing left to clone. This module arrives through a dynamic `import()`,
+     * so a capture taken here would be a capture taken a chunk fetch late.
+     *
+     * Omitted, the document is read directly — which is what a test does, and
+     * what any caller that is already on the page's critical path may do.
+     */
+    shipped?: ReadonlyMap<string, Element>;
+    /** Overridable for tests; the real one is `window`. */
+    view?: Window & typeof globalThis;
+}
+/**
+ * Whether an element is actually presented to the reader.
+ *
+ * Computed style first, because that is what CSS suppression changes, and
+ * hit-testing last, because that is what a full-page overlay does — an
+ * element can be perfectly visible by every style property and still sit
+ * under something with a higher `z-index`.
+ */
+export declare function inspectAttributionElement(element: Element | null | undefined, view: Window & typeof globalThis): AttributionSuppression | null;
+export declare function installAttributionGuard(options?: AttributionGuardOptions): void;
+/**
+ * Test seam: forgets the install so a second one takes effect, and stops the
+ * keepers it armed. Nothing in a browser calls this — see `keepers`.
+ */
+export declare function resetAttributionGuard(): void;

package/src/lib/app-utils/attribution-guard.js

@@ -0,0 +1,410 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * Keeps the credit badge and the abuse-report control on the page.
+ *
+ * Both render as ordinary elements in the published document, which means the
+ * site's own author can take them off it. Not by breaking anything — by using
+ * the product as sold: a tag manager container, a custom-code block, or three
+ * lines of theme CSS. `a[href="/api/report-abuse"] { display: none }` is the
+ * whole exploit, and the report control is precisely the thing a phishing
+ * site's author wants gone.
+ *
+ * ## What this can and cannot do
+ *
+ * It cannot make suppression impossible. The author controls the page: they
+ * can run script before this does, and at the limit they can put a proxy in
+ * front of the whole site. Anyone who promises otherwise is selling something.
+ *
+ * What it CAN do is move suppression out of reach of the tools people
+ * actually reach for, and make the attempt visible when it happens:
+ *
+ * - **Restore into a closed shadow root.** No selector crosses a shadow
+ *   boundary, so the CSS above stops matching, and `document.querySelector`
+ *   cannot find the contents to remove them. The mount element carries a
+ *   name minted per page load, so a stylesheet cannot name it either, and its
+ *   own layout properties are set inline `!important` — the highest
+ *   precedence an author-origin declaration has, which a stylesheet rule of
+ *   any specificity cannot beat.
+ * - **Put it back.** Removing the mount re-appends it; overwriting its styles
+ *   re-asserts them.
+ * - **Say so.** A suppression that had to be repaired is reported once per
+ *   page view, so the site becomes reviewable rather than quietly
+ *   unattributed. This is the part that actually matters: enforcement is a
+ *   policy decision made by a person, and it needs a signal to act on.
+ *
+ * ## Deliberately not pre-emptive
+ *
+ * The badge is left in the light DOM until something tries to suppress it.
+ * It is the platform's only organic acquisition surface — one crawlable link
+ * on every free site — and burying it in a closed shadow root on every page
+ * load to defend against a minority would cost that on all of them.
+ *
+ * ## Why not `MuiShadowDom` / `shadowDomRootFactory`
+ *
+ * Both existing shadow-root helpers are React components that `createPortal`
+ * their children into the root, and React has to own the contents. That is
+ * the one thing this cannot have.
+ *
+ * The job is to put back a node that foreign script deleted, and React does
+ * not react to its own output being removed — the reconciler answers to state
+ * changes, not to DOM deletion, so a portalled subtree whose mount is taken
+ * off `document.body` simply stays gone. The MutationObserver below would be
+ * needed either way, and it would then be re-appending an element React
+ * believes it is managing, which is the shape that produces "removeChild on a
+ * node that is not a child" the next time React touches it.
+ *
+ * Plain DOM also means the repair outlives React: an unmount, an error
+ * boundary tripping, or the author's own script tearing out the root does not
+ * take it with them. (Both helpers also default to `mode: 'open'` and carry
+ * SSR and adopted-stylesheet machinery built for the besigner canvas, none of
+ * which applies here.)
+ *
+ * Framework-free, like `error-beacon` beside it, and for the same reason: the
+ * install must be able to run before any effect. Deliberately NO 'use client'
+ * directive — inside this shared lib the directive forks the module graph
+ * (AGL-52), and every importer is already a client module.
+ *
+ * ## Reached through a dynamic `import()`
+ *
+ * Nothing on the tenant's eager path names this module. The renderer marks
+ * its elements with `ATTRIBUTION_ATTRIBUTE`, which lives in a module of its
+ * own for exactly that reason, and `attribution-guard.component.tsx` imports
+ * this one from inside its effect — so the sites that show no attribution,
+ * which is every paid site, never fetch it (AGL-2706). The element copies the
+ * repair rebuilds from are taken by the component BEFORE the chunk is asked
+ * for; see `shipped` below.
+ */ // The attribute the page marks its elements with. Re-exported so this module
+// still offers the whole surface under one name — the page itself takes it
+// from the leaf, which is what keeps this file off the eager path.
+export { ATTRIBUTION_ATTRIBUTE } from "./attribution-attribute.js";
+import { ATTRIBUTION_ATTRIBUTE } from "./attribution-attribute.js";
+const DEFAULT_ENDPOINT = '/api/attribution';
+/**
+ * When the checks run, in ms after install.
+ *
+ * Front-loaded because the interesting case is a tag manager that fires on
+ * load and removes the control before anyone sees it; the long tail catches
+ * a rule that only applies after an interaction, or a script that waits.
+ * Bounded rather than a forever-interval: a permanently-armed timer on every
+ * published page is a cost on every visitor to defend against one author.
+ */ const CHECK_SCHEDULE_MS = [
+    800,
+    2500,
+    6000,
+    15000,
+    40000
+];
+/** Below this, an element is not meaningfully on the page. */ const MIN_VISIBLE_PX = 4;
+const MIN_OPACITY = 0.15;
+let installed = false;
+/**
+ * The observers this guard has armed.
+ *
+ * Kept so a test can take them off the document again. In a browser they run
+ * for the life of the page, which is the point — a keeper that stops keeping
+ * is the same as no keeper — but a test document outlives the test, and an
+ * observer left watching `body` puts its mount back the moment the next test
+ * clears the page.
+ */ const keepers = [];
+/**
+ * Whether an element is actually presented to the reader.
+ *
+ * Computed style first, because that is what CSS suppression changes, and
+ * hit-testing last, because that is what a full-page overlay does — an
+ * element can be perfectly visible by every style property and still sit
+ * under something with a higher `z-index`.
+ */ export function inspectAttributionElement(element, view) {
+    var _element_ownerDocument;
+    if (!element || !element.isConnected) return 'removed';
+    const style = view.getComputedStyle(element);
+    if (style.display === 'none') return 'display';
+    if (style.visibility === 'hidden' || style.visibility === 'collapse') {
+        return 'visibility';
+    }
+    // An unreadable opacity is treated as fully opaque, not as zero. `opacity`
+    // has an initial value of 1 and every engine should report it, but a value
+    // this function cannot parse is a question it did not get an answer to —
+    // and the cost of guessing wrong is accusing a site of hiding something it
+    // is showing.
+    const opacity = Number.parseFloat(style.opacity);
+    if (Number.isFinite(opacity) && opacity < MIN_OPACITY) return 'opacity';
+    if (style.pointerEvents === 'none') return 'pointer-events';
+    const rect = element.getBoundingClientRect();
+    if (rect.width < MIN_VISIBLE_PX || rect.height < MIN_VISIBLE_PX) {
+        return 'collapsed';
+    }
+    // `position: fixed` with a large negative offset is the other classic —
+    // still rendered, still the right size, nowhere a reader will ever look.
+    const beyond = rect.right < 0 || rect.bottom < 0 || rect.left > view.innerWidth || rect.top > view.innerHeight;
+    if (beyond) return 'offscreen';
+    const x = Math.round(rect.left + rect.width / 2);
+    const y = Math.round(rect.top + rect.height / 2);
+    const hit = (_element_ownerDocument = element.ownerDocument) == null ? void 0 : _element_ownerDocument.elementFromPoint(x, y);
+    // A descendant is the element; an ancestor means nothing was drawn over it
+    // and the point landed on the parent's own box. Anything else is a cover.
+    if (hit && hit !== element && !element.contains(hit) && !hit.contains(element)) {
+        return 'covered';
+    }
+    return null;
+}
+/** A tag name no stylesheet written before this page load can name. */ function mintMountName(view) {
+    var _view_crypto;
+    const bytes = new Uint8Array(8);
+    if ((_view_crypto = view.crypto) == null ? void 0 : _view_crypto.getRandomValues) view.crypto.getRandomValues(bytes);
+    const suffix = Array.from(bytes, (byte)=>byte.toString(36).padStart(2, '0')).join('');
+    // Hyphenated, so the parser treats it as an unknown ELEMENT rather than
+    // trying to match a built-in, and it inherits nothing from a `div` rule.
+    return `a-${suffix}`.slice(0, 24);
+}
+/**
+ * The layout properties an author's CSS would have to win to hide this, set
+ * inline and important. Re-applied rather than set once: a script can
+ * overwrite `style` as easily as a stylesheet can lose to it.
+ *
+ * Writes only what is actually wrong. The observer that calls this watches
+ * the mount's `style` attribute, so an unconditional write is a mutation that
+ * schedules the observer that performs the write — the loop does not
+ * terminate, and it is not slow enough to look like anything but a hang.
+ */ function pinMountStyle(mount, corner) {
+    const pinned = [
+        [
+            'position',
+            'fixed'
+        ],
+        [
+            'bottom',
+            '12px'
+        ],
+        [
+            corner,
+            '12px'
+        ],
+        [
+            'z-index',
+            '2147483000'
+        ],
+        [
+            'display',
+            'block'
+        ],
+        [
+            'visibility',
+            'visible'
+        ],
+        [
+            'opacity',
+            '1'
+        ],
+        [
+            'pointer-events',
+            'auto'
+        ],
+        [
+            'transform',
+            'none'
+        ],
+        [
+            'clip-path',
+            'none'
+        ],
+        [
+            'filter',
+            'none'
+        ],
+        [
+            'width',
+            'auto'
+        ],
+        [
+            'height',
+            'auto'
+        ],
+        [
+            'max-width',
+            'none'
+        ],
+        [
+            'max-height',
+            'none'
+        ]
+    ];
+    for (const [property, value] of pinned){
+        if (mount.style.getPropertyValue(property) === value && mount.style.getPropertyPriority(property) === 'important') {
+            continue;
+        }
+        mount.style.setProperty(property, value, 'important');
+    }
+}
+export function installAttributionGuard(options = {}) {
+    var _options_view, _options_endpoint;
+    const view = (_options_view = options.view) != null ? _options_view : globalThis;
+    if (installed || typeof (view == null ? void 0 : view.document) === 'undefined') return;
+    installed = true;
+    const doc = view.document;
+    const endpoint = (_options_endpoint = options.endpoint) != null ? _options_endpoint : DEFAULT_ENDPOINT;
+    let reported = false;
+    const restored = new Set();
+    const report = (reason, subject)=>{
+        if (reported) return;
+        reported = true;
+        try {
+            var _options_hostId;
+            var _view_navigator;
+            const body = JSON.stringify({
+                hostId: (_options_hostId = options.hostId) != null ? _options_hostId : '',
+                reason,
+                subject,
+                // Origin + pathname only, like the error beacon: a query string on a
+                // published page carries search terms and campaign ids.
+                url: `${view.location.origin}${view.location.pathname}`
+            });
+            // `sendBeacon` survives the pagehide that a script removing the badge
+            // on the way out would otherwise win against; `fetch` with `keepalive`
+            // is the fallback where it is missing. Both are same-origin.
+            if ((_view_navigator = view.navigator) == null ? void 0 : _view_navigator.sendBeacon) {
+                view.navigator.sendBeacon(endpoint, body);
+            } else {
+                void fetch(endpoint, {
+                    method: 'POST',
+                    body,
+                    keepalive: true
+                }).catch(()=>undefined);
+            }
+        } catch (unused) {
+        // A guard that throws is worse than a guard that misses one report.
+        }
+    };
+    /**
+   * Rebuilds one element inside a closed shadow root and keeps it there.
+   *
+   * The original is left where it is. It may be perfectly fine and merely
+   * covered; removing it would take away a working link on the chance that it
+   * is not, and a duplicate that cannot be seen costs nothing.
+   */ const restore = (subject, original)=>{
+        if (restored.has(subject)) return;
+        restored.add(subject);
+        try {
+            const corner = subject === 'report' ? 'left' : 'right';
+            const mount = doc.createElement(mintMountName(view));
+            pinMountStyle(mount, corner);
+            const root = mount.attachShadow({
+                mode: 'closed'
+            });
+            const clone = original.cloneNode(true);
+            // The clone is positioned by its mount now, not by its own `fixed`
+            // coordinates, or the two would stack in the same corner.
+            clone.style.setProperty('position', 'static', 'important');
+            clone.style.setProperty('display', 'inline-flex', 'important');
+            root.appendChild(clone);
+            doc.body.appendChild(mount);
+            // Put it back if it is taken off, and re-pin the styles if they are
+            // overwritten. Watching the mount's own attributes as well as the body's
+            // children covers both moves with one observer.
+            const keeper = new MutationObserver(()=>{
+                try {
+                    if (!mount.isConnected) doc.body.appendChild(mount);
+                    pinMountStyle(mount, corner);
+                } catch (unused) {
+                // Ditto.
+                }
+            });
+            keeper.observe(doc.body, {
+                childList: true
+            });
+            keeper.observe(mount, {
+                attributes: true,
+                attributeFilter: [
+                    'style'
+                ]
+            });
+            keepers.push(keeper);
+        } catch (unused) {
+        // Ditto: a browser without shadow DOM keeps the original element and
+        // loses only the repair.
+        }
+    };
+    // What this page rendered, captured before anything has had a chance to
+    // take it away — the repair needs a copy of the element to rebuild, and by
+    // the time one is missing there is nothing left to clone. Supplied by the
+    // caller where it can be taken earlier than this module exists; see
+    // `shipped` on the options.
+    const templates = new Map();
+    try {
+        if (options.shipped) {
+            for (const [subject, element] of options.shipped){
+                if (subject) templates.set(subject, element);
+            }
+        } else {
+            for (const element of Array.from(doc.querySelectorAll(`[${ATTRIBUTION_ATTRIBUTE}]`))){
+                var _element_getAttribute;
+                const subject = (_element_getAttribute = element.getAttribute(ATTRIBUTION_ATTRIBUTE)) != null ? _element_getAttribute : '';
+                if (!subject || templates.has(subject)) continue;
+                templates.set(subject, element.cloneNode(true));
+            }
+        }
+    } catch (unused) {
+        return;
+    }
+    const shipped = [
+        ...templates.keys()
+    ];
+    if (!shipped.length) return;
+    const check = ()=>{
+        let elements;
+        try {
+            elements = Array.from(doc.querySelectorAll(`[${ATTRIBUTION_ATTRIBUTE}]`));
+        } catch (unused) {
+            return;
+        }
+        for (const element of elements){
+            var _element_getAttribute;
+            const subject = (_element_getAttribute = element.getAttribute(ATTRIBUTION_ATTRIBUTE)) != null ? _element_getAttribute : 'unknown';
+            if (restored.has(subject)) continue;
+            const suppression = inspectAttributionElement(element, view);
+            if (!suppression) continue;
+            restore(subject, element);
+            report(suppression, subject);
+        }
+        // A removed element has no node left to inspect, so the loop above cannot
+        // see it. The subjects this page shipped are the ones to account for.
+        for (const subject of shipped){
+            if (restored.has(subject)) continue;
+            if (doc.querySelector(`[${ATTRIBUTION_ATTRIBUTE}="${subject}"]`)) continue;
+            const template = templates.get(subject);
+            if (template) restore(subject, template);
+            report('removed', subject);
+        }
+    };
+    for (const delay of CHECK_SCHEDULE_MS){
+        view.setTimeout(()=>{
+            try {
+                check();
+            } catch (unused) {
+            // Ditto.
+            }
+        }, delay);
+    }
+}
+/**
+ * Test seam: forgets the install so a second one takes effect, and stops the
+ * keepers it armed. Nothing in a browser calls this — see `keepers`.
+ */ export function resetAttributionGuard() {
+    installed = false;
+    for (const keeper of keepers.splice(0))keeper.disconnect();
+}
+
+//# sourceMappingURL=attribution-guard.js.map

package/src/lib/app-utils/attribution-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/attribution-guard.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Keeps the credit badge and the abuse-report control on the page.\n *\n * Both render as ordinary elements in the published document, which means the\n * site's own author can take them off it. Not by breaking anything — by using\n * the product as sold: a tag manager container, a custom-code block, or three\n * lines of theme CSS. `a[href=\"/api/report-abuse\"] { display: none }` is the\n * whole exploit, and the report control is precisely the thing a phishing\n * site's author wants gone.\n *\n * ## What this can and cannot do\n *\n * It cannot make suppression impossible. The author controls the page: they\n * can run script before this does, and at the limit they can put a proxy in\n * front of the whole site. Anyone who promises otherwise is selling something.\n *\n * What it CAN do is move suppression out of reach of the tools people\n * actually reach for, and make the attempt visible when it happens:\n *\n * - **Restore into a closed shadow root.** No selector crosses a shadow\n *   boundary, so the CSS above stops matching, and `document.querySelector`\n *   cannot find the contents to remove them. The mount element carries a\n *   name minted per page load, so a stylesheet cannot name it either, and its\n *   own layout properties are set inline `!important` — the highest\n *   precedence an author-origin declaration has, which a stylesheet rule of\n *   any specificity cannot beat.\n * - **Put it back.** Removing the mount re-appends it; overwriting its styles\n *   re-asserts them.\n * - **Say so.** A suppression that had to be repaired is reported once per\n *   page view, so the site becomes reviewable rather than quietly\n *   unattributed. This is the part that actually matters: enforcement is a\n *   policy decision made by a person, and it needs a signal to act on.\n *\n * ## Deliberately not pre-emptive\n *\n * The badge is left in the light DOM until something tries to suppress it.\n * It is the platform's only organic acquisition surface — one crawlable link\n * on every free site — and burying it in a closed shadow root on every page\n * load to defend against a minority would cost that on all of them.\n *\n * ## Why not `MuiShadowDom` / `shadowDomRootFactory`\n *\n * Both existing shadow-root helpers are React components that `createPortal`\n * their children into the root, and React has to own the contents. That is\n * the one thing this cannot have.\n *\n * The job is to put back a node that foreign script deleted, and React does\n * not react to its own output being removed — the reconciler answers to state\n * changes, not to DOM deletion, so a portalled subtree whose mount is taken\n * off `document.body` simply stays gone. The MutationObserver below would be\n * needed either way, and it would then be re-appending an element React\n * believes it is managing, which is the shape that produces \"removeChild on a\n * node that is not a child\" the next time React touches it.\n *\n * Plain DOM also means the repair outlives React: an unmount, an error\n * boundary tripping, or the author's own script tearing out the root does not\n * take it with them. (Both helpers also default to `mode: 'open'` and carry\n * SSR and adopted-stylesheet machinery built for the besigner canvas, none of\n * which applies here.)\n *\n * Framework-free, like `error-beacon` beside it, and for the same reason: the\n * install must be able to run before any effect. Deliberately NO 'use client'\n * directive — inside this shared lib the directive forks the module graph\n * (AGL-52), and every importer is already a client module.\n *\n * ## Reached through a dynamic `import()`\n *\n * Nothing on the tenant's eager path names this module. The renderer marks\n * its elements with `ATTRIBUTION_ATTRIBUTE`, which lives in a module of its\n * own for exactly that reason, and `attribution-guard.component.tsx` imports\n * this one from inside its effect — so the sites that show no attribution,\n * which is every paid site, never fetch it (AGL-2706). The element copies the\n * repair rebuilds from are taken by the component BEFORE the chunk is asked\n * for; see `shipped` below.\n */\n\n// The attribute the page marks its elements with. Re-exported so this module\n// still offers the whole surface under one name — the page itself takes it\n// from the leaf, which is what keeps this file off the eager path.\nexport { ATTRIBUTION_ATTRIBUTE } from './attribution-attribute'\n\nimport { ATTRIBUTION_ATTRIBUTE } from './attribution-attribute'\n\n/** Why a check failed. Reported verbatim, so keep these short and stable. */\nexport type AttributionSuppression =\n  | 'removed'\n  | 'display'\n  | 'visibility'\n  | 'opacity'\n  | 'collapsed'\n  | 'pointer-events'\n  | 'offscreen'\n  | 'covered'\n\nexport interface AttributionGuardOptions {\n  /** Where a suppression is reported. Same-origin path, never a URL. */\n  endpoint?: string\n  /** The site being checked, so the report names one without a lookup. */\n  hostId?: string\n  /**\n   * What the page rendered, keyed by subject, captured before this module\n   * was even fetched.\n   *\n   * The caller takes these because the repair rebuilds a suppressed element\n   * from a copy of the original, and by the time one is missing there is\n   * nothing left to clone. This module arrives through a dynamic `import()`,\n   * so a capture taken here would be a capture taken a chunk fetch late.\n   *\n   * Omitted, the document is read directly — which is what a test does, and\n   * what any caller that is already on the page's critical path may do.\n   */\n  shipped?: ReadonlyMap<string, Element>\n  /** Overridable for tests; the real one is `window`. */\n  view?: Window & typeof globalThis\n}\n\nconst DEFAULT_ENDPOINT = '/api/attribution'\n\n/**\n * When the checks run, in ms after install.\n *\n * Front-loaded because the interesting case is a tag manager that fires on\n * load and removes the control before anyone sees it; the long tail catches\n * a rule that only applies after an interaction, or a script that waits.\n * Bounded rather than a forever-interval: a permanently-armed timer on every\n * published page is a cost on every visitor to defend against one author.\n */\nconst CHECK_SCHEDULE_MS = [800, 2_500, 6_000, 15_000, 40_000] as const\n\n/** Below this, an element is not meaningfully on the page. */\nconst MIN_VISIBLE_PX = 4\nconst MIN_OPACITY = 0.15\n\nlet installed = false\n\n/**\n * The observers this guard has armed.\n *\n * Kept so a test can take them off the document again. In a browser they run\n * for the life of the page, which is the point — a keeper that stops keeping\n * is the same as no keeper — but a test document outlives the test, and an\n * observer left watching `body` puts its mount back the moment the next test\n * clears the page.\n */\nconst keepers: MutationObserver[] = []\n\n/**\n * Whether an element is actually presented to the reader.\n *\n * Computed style first, because that is what CSS suppression changes, and\n * hit-testing last, because that is what a full-page overlay does — an\n * element can be perfectly visible by every style property and still sit\n * under something with a higher `z-index`.\n */\nexport function inspectAttributionElement(\n  element: Element | null | undefined,\n  view: Window & typeof globalThis,\n): AttributionSuppression | null {\n  if (!element || !element.isConnected) return 'removed'\n  const style = view.getComputedStyle(element)\n  if (style.display === 'none') return 'display'\n  if (style.visibility === 'hidden' || style.visibility === 'collapse') {\n    return 'visibility'\n  }\n  // An unreadable opacity is treated as fully opaque, not as zero. `opacity`\n  // has an initial value of 1 and every engine should report it, but a value\n  // this function cannot parse is a question it did not get an answer to —\n  // and the cost of guessing wrong is accusing a site of hiding something it\n  // is showing.\n  const opacity = Number.parseFloat(style.opacity)\n  if (Number.isFinite(opacity) && opacity < MIN_OPACITY) return 'opacity'\n  if (style.pointerEvents === 'none') return 'pointer-events'\n  const rect = element.getBoundingClientRect()\n  if (rect.width < MIN_VISIBLE_PX || rect.height < MIN_VISIBLE_PX) {\n    return 'collapsed'\n  }\n  // `position: fixed` with a large negative offset is the other classic —\n  // still rendered, still the right size, nowhere a reader will ever look.\n  const beyond =\n    rect.right < 0 ||\n    rect.bottom < 0 ||\n    rect.left > view.innerWidth ||\n    rect.top > view.innerHeight\n  if (beyond) return 'offscreen'\n  const x = Math.round(rect.left + rect.width / 2)\n  const y = Math.round(rect.top + rect.height / 2)\n  const hit = element.ownerDocument?.elementFromPoint(x, y)\n  // A descendant is the element; an ancestor means nothing was drawn over it\n  // and the point landed on the parent's own box. Anything else is a cover.\n  if (hit && hit !== element && !element.contains(hit) && !hit.contains(element)) {\n    return 'covered'\n  }\n  return null\n}\n\n/** A tag name no stylesheet written before this page load can name. */\nfunction mintMountName(view: Window & typeof globalThis): string {\n  const bytes = new Uint8Array(8)\n  if (view.crypto?.getRandomValues) view.crypto.getRandomValues(bytes)\n  const suffix = Array.from(bytes, (byte) =>\n    byte.toString(36).padStart(2, '0'),\n  ).join('')\n  // Hyphenated, so the parser treats it as an unknown ELEMENT rather than\n  // trying to match a built-in, and it inherits nothing from a `div` rule.\n  return `a-${suffix}`.slice(0, 24)\n}\n\n/**\n * The layout properties an author's CSS would have to win to hide this, set\n * inline and important. Re-applied rather than set once: a script can\n * overwrite `style` as easily as a stylesheet can lose to it.\n *\n * Writes only what is actually wrong. The observer that calls this watches\n * the mount's `style` attribute, so an unconditional write is a mutation that\n * schedules the observer that performs the write — the loop does not\n * terminate, and it is not slow enough to look like anything but a hang.\n */\nfunction pinMountStyle(mount: HTMLElement, corner: 'left' | 'right'): void {\n  const pinned: Array<[string, string]> = [\n    ['position', 'fixed'],\n    ['bottom', '12px'],\n    [corner, '12px'],\n    ['z-index', '2147483000'],\n    ['display', 'block'],\n    ['visibility', 'visible'],\n    ['opacity', '1'],\n    ['pointer-events', 'auto'],\n    ['transform', 'none'],\n    ['clip-path', 'none'],\n    ['filter', 'none'],\n    ['width', 'auto'],\n    ['height', 'auto'],\n    ['max-width', 'none'],\n    ['max-height', 'none'],\n  ]\n  for (const [property, value] of pinned) {\n    if (\n      mount.style.getPropertyValue(property) === value &&\n      mount.style.getPropertyPriority(property) === 'important'\n    ) {\n      continue\n    }\n    mount.style.setProperty(property, value, 'important')\n  }\n}\n\nexport function installAttributionGuard(\n  options: AttributionGuardOptions = {},\n): void {\n  const view = options.view ?? (globalThis as never as Window & typeof globalThis)\n  if (installed || typeof view?.document === 'undefined') return\n  installed = true\n  const doc = view.document\n  const endpoint = options.endpoint ?? DEFAULT_ENDPOINT\n\n  let reported = false\n  const restored = new Set<string>()\n\n  const report = (\n    reason: AttributionSuppression,\n    subject: string,\n  ): void => {\n    if (reported) return\n    reported = true\n    try {\n      const body = JSON.stringify({\n        hostId: options.hostId ?? '',\n        reason,\n        subject,\n        // Origin + pathname only, like the error beacon: a query string on a\n        // published page carries search terms and campaign ids.\n        url: `${view.location.origin}${view.location.pathname}`,\n      })\n      // `sendBeacon` survives the pagehide that a script removing the badge\n      // on the way out would otherwise win against; `fetch` with `keepalive`\n      // is the fallback where it is missing. Both are same-origin.\n      if (view.navigator?.sendBeacon) {\n        view.navigator.sendBeacon(endpoint, body)\n      } else {\n        void fetch(endpoint, { method: 'POST', body, keepalive: true }).catch(\n          (): void => undefined,\n        )\n      }\n    } catch {\n      // A guard that throws is worse than a guard that misses one report.\n    }\n  }\n\n  /**\n   * Rebuilds one element inside a closed shadow root and keeps it there.\n   *\n   * The original is left where it is. It may be perfectly fine and merely\n   * covered; removing it would take away a working link on the chance that it\n   * is not, and a duplicate that cannot be seen costs nothing.\n   */\n  const restore = (subject: string, original: Element): void => {\n    if (restored.has(subject)) return\n    restored.add(subject)\n    try {\n      const corner = subject === 'report' ? 'left' : 'right'\n      const mount = doc.createElement(mintMountName(view))\n      pinMountStyle(mount as HTMLElement, corner)\n      const root = mount.attachShadow({ mode: 'closed' })\n      const clone = original.cloneNode(true) as HTMLElement\n      // The clone is positioned by its mount now, not by its own `fixed`\n      // coordinates, or the two would stack in the same corner.\n      clone.style.setProperty('position', 'static', 'important')\n      clone.style.setProperty('display', 'inline-flex', 'important')\n      root.appendChild(clone)\n      doc.body.appendChild(mount)\n\n      // Put it back if it is taken off, and re-pin the styles if they are\n      // overwritten. Watching the mount's own attributes as well as the body's\n      // children covers both moves with one observer.\n      const keeper = new MutationObserver(() => {\n        try {\n          if (!mount.isConnected) doc.body.appendChild(mount)\n          pinMountStyle(mount as HTMLElement, corner)\n        } catch {\n          // Ditto.\n        }\n      })\n      keeper.observe(doc.body, { childList: true })\n      keeper.observe(mount, { attributes: true, attributeFilter: ['style'] })\n      keepers.push(keeper)\n    } catch {\n      // Ditto: a browser without shadow DOM keeps the original element and\n      // loses only the repair.\n    }\n  }\n\n  // What this page rendered, captured before anything has had a chance to\n  // take it away — the repair needs a copy of the element to rebuild, and by\n  // the time one is missing there is nothing left to clone. Supplied by the\n  // caller where it can be taken earlier than this module exists; see\n  // `shipped` on the options.\n  const templates = new Map<string, Element>()\n  try {\n    if (options.shipped) {\n      for (const [subject, element] of options.shipped) {\n        if (subject) templates.set(subject, element)\n      }\n    } else {\n      for (const element of Array.from(\n        doc.querySelectorAll(`[${ATTRIBUTION_ATTRIBUTE}]`),\n      )) {\n        const subject = element.getAttribute(ATTRIBUTION_ATTRIBUTE) ?? ''\n        if (!subject || templates.has(subject)) continue\n        templates.set(subject, element.cloneNode(true) as Element)\n      }\n    }\n  } catch {\n    return\n  }\n  const shipped = [...templates.keys()]\n  if (!shipped.length) return\n\n  const check = (): void => {\n    let elements: Element[]\n    try {\n      elements = Array.from(doc.querySelectorAll(`[${ATTRIBUTION_ATTRIBUTE}]`))\n    } catch {\n      return\n    }\n    for (const element of elements) {\n      const subject = element.getAttribute(ATTRIBUTION_ATTRIBUTE) ?? 'unknown'\n      if (restored.has(subject)) continue\n      const suppression = inspectAttributionElement(element, view)\n      if (!suppression) continue\n      restore(subject, element)\n      report(suppression, subject)\n    }\n    // A removed element has no node left to inspect, so the loop above cannot\n    // see it. The subjects this page shipped are the ones to account for.\n    for (const subject of shipped) {\n      if (restored.has(subject)) continue\n      if (doc.querySelector(`[${ATTRIBUTION_ATTRIBUTE}=\"${subject}\"]`)) continue\n      const template = templates.get(subject)\n      if (template) restore(subject, template)\n      report('removed', subject)\n    }\n  }\n\n  for (const delay of CHECK_SCHEDULE_MS) {\n    view.setTimeout(() => {\n      try {\n        check()\n      } catch {\n        // Ditto.\n      }\n    }, delay)\n  }\n}\n\n/**\n * Test seam: forgets the install so a second one takes effect, and stops the\n * keepers it armed. Nothing in a browser calls this — see `keepers`.\n */\nexport function resetAttributionGuard(): void {\n  installed = false\n  for (const keeper of keepers.splice(0)) keeper.disconnect()\n}\n"],"names":["ATTRIBUTION_ATTRIBUTE","DEFAULT_ENDPOINT","CHECK_SCHEDULE_MS","MIN_VISIBLE_PX","MIN_OPACITY","installed","keepers","inspectAttributionElement","element","view","isConnected","style","getComputedStyle","display","visibility","opacity","Number","parseFloat","isFinite","pointerEvents","rect","getBoundingClientRect","width","height","beyond","right","bottom","left","innerWidth","top","innerHeight","x","Math","round","y","hit","ownerDocument","elementFromPoint","contains","mintMountName","bytes","Uint8Array","crypto","getRandomValues","suffix","Array","from","byte","toString","padStart","join","slice","pinMountStyle","mount","corner","pinned","property","value","getPropertyValue","getPropertyPriority","setProperty","installAttributionGuard","options","globalThis","document","doc","endpoint","reported","restored","Set","report","reason","subject","body","JSON","stringify","hostId","url","location","origin","pathname","navigator","sendBeacon","fetch","method","keepalive","catch","undefined","restore","original","has","add","createElement","root","attachShadow","mode","clone","cloneNode","appendChild","keeper","MutationObserver","observe","childList","attributes","attributeFilter","push","templates","Map","shipped","set","querySelectorAll","getAttribute","keys","length","check","elements","suppression","querySelector","template","get","delay","setTimeout","resetAttributionGuard","splice","disconnect"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0EC,GAED,6EAA6E;AAC7E,2EAA2E;AAC3E,mEAAmE;AACnE,SAASA,qBAAqB,QAAQ,6BAAyB;AAE/D,SAASA,qBAAqB,QAAQ,6BAAyB;AAmC/D,MAAMC,mBAAmB;AAEzB;;;;;;;;CAQC,GACD,MAAMC,oBAAoB;IAAC;IAAK;IAAO;IAAO;IAAQ;CAAO;AAE7D,4DAA4D,GAC5D,MAAMC,iBAAiB;AACvB,MAAMC,cAAc;AAEpB,IAAIC,YAAY;AAEhB;;;;;;;;CAQC,GACD,MAAMC,UAA8B,EAAE;AAEtC;;;;;;;CAOC,GACD,OAAO,SAASC,0BACdC,OAAmC,EACnCC,IAAgC;QA8BpBD;IA5BZ,IAAI,CAACA,WAAW,CAACA,QAAQE,WAAW,EAAE,OAAO;IAC7C,MAAMC,QAAQF,KAAKG,gBAAgB,CAACJ;IACpC,IAAIG,MAAME,OAAO,KAAK,QAAQ,OAAO;IACrC,IAAIF,MAAMG,UAAU,KAAK,YAAYH,MAAMG,UAAU,KAAK,YAAY;QACpE,OAAO;IACT;IACA,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,cAAc;IACd,MAAMC,UAAUC,OAAOC,UAAU,CAACN,MAAMI,OAAO;IAC/C,IAAIC,OAAOE,QAAQ,CAACH,YAAYA,UAAUX,aAAa,OAAO;IAC9D,IAAIO,MAAMQ,aAAa,KAAK,QAAQ,OAAO;IAC3C,MAAMC,OAAOZ,QAAQa,qBAAqB;IAC1C,IAAID,KAAKE,KAAK,GAAGnB,kBAAkBiB,KAAKG,MAAM,GAAGpB,gBAAgB;QAC/D,OAAO;IACT;IACA,wEAAwE;IACxE,yEAAyE;IACzE,MAAMqB,SACJJ,KAAKK,KAAK,GAAG,KACbL,KAAKM,MAAM,GAAG,KACdN,KAAKO,IAAI,GAAGlB,KAAKmB,UAAU,IAC3BR,KAAKS,GAAG,GAAGpB,KAAKqB,WAAW;IAC7B,IAAIN,QAAQ,OAAO;IACnB,MAAMO,IAAIC,KAAKC,KAAK,CAACb,KAAKO,IAAI,GAAGP,KAAKE,KAAK,GAAG;IAC9C,MAAMY,IAAIF,KAAKC,KAAK,CAACb,KAAKS,GAAG,GAAGT,KAAKG,MAAM,GAAG;IAC9C,MAAMY,OAAM3B,yBAAAA,QAAQ4B,aAAa,qBAArB5B,uBAAuB6B,gBAAgB,CAACN,GAAGG;IACvD,2EAA2E;IAC3E,0EAA0E;IAC1E,IAAIC,OAAOA,QAAQ3B,WAAW,CAACA,QAAQ8B,QAAQ,CAACH,QAAQ,CAACA,IAAIG,QAAQ,CAAC9B,UAAU;QAC9E,OAAO;IACT;IACA,OAAO;AACT;AAEA,qEAAqE,GACrE,SAAS+B,cAAc9B,IAAgC;QAEjDA;IADJ,MAAM+B,QAAQ,IAAIC,WAAW;IAC7B,KAAIhC,eAAAA,KAAKiC,MAAM,qBAAXjC,aAAakC,eAAe,EAAElC,KAAKiC,MAAM,CAACC,eAAe,CAACH;IAC9D,MAAMI,SAASC,MAAMC,IAAI,CAACN,OAAO,CAACO,OAChCA,KAAKC,QAAQ,CAAC,IAAIC,QAAQ,CAAC,GAAG,MAC9BC,IAAI,CAAC;IACP,wEAAwE;IACxE,yEAAyE;IACzE,OAAO,CAAC,EAAE,EAAEN,QAAQ,CAACO,KAAK,CAAC,GAAG;AAChC;AAEA;;;;;;;;;CASC,GACD,SAASC,cAAcC,KAAkB,EAAEC,MAAwB;IACjE,MAAMC,SAAkC;QACtC;YAAC;YAAY;SAAQ;QACrB;YAAC;YAAU;SAAO;QAClB;YAACD;YAAQ;SAAO;QAChB;YAAC;YAAW;SAAa;QACzB;YAAC;YAAW;SAAQ;QACpB;YAAC;YAAc;SAAU;QACzB;YAAC;YAAW;SAAI;QAChB;YAAC;YAAkB;SAAO;QAC1B;YAAC;YAAa;SAAO;QACrB;YAAC;YAAa;SAAO;QACrB;YAAC;YAAU;SAAO;QAClB;YAAC;YAAS;SAAO;QACjB;YAAC;YAAU;SAAO;QAClB;YAAC;YAAa;SAAO;QACrB;YAAC;YAAc;SAAO;KACvB;IACD,KAAK,MAAM,CAACE,UAAUC,MAAM,IAAIF,OAAQ;QACtC,IACEF,MAAM1C,KAAK,CAAC+C,gBAAgB,CAACF,cAAcC,SAC3CJ,MAAM1C,KAAK,CAACgD,mBAAmB,CAACH,cAAc,aAC9C;YACA;QACF;QACAH,MAAM1C,KAAK,CAACiD,WAAW,CAACJ,UAAUC,OAAO;IAC3C;AACF;AAEA,OAAO,SAASI,wBACdC,UAAmC,CAAC,CAAC;QAExBA,eAIIA;IAJjB,MAAMrD,QAAOqD,gBAAAA,QAAQrD,IAAI,YAAZqD,gBAAiBC;IAC9B,IAAI1D,aAAa,QAAOI,wBAAAA,KAAMuD,QAAQ,MAAK,aAAa;IACxD3D,YAAY;IACZ,MAAM4D,MAAMxD,KAAKuD,QAAQ;IACzB,MAAME,YAAWJ,oBAAAA,QAAQI,QAAQ,YAAhBJ,oBAAoB7D;IAErC,IAAIkE,WAAW;IACf,MAAMC,WAAW,IAAIC;IAErB,MAAMC,SAAS,CACbC,QACAC;QAEA,IAAIL,UAAU;QACdA,WAAW;QACX,IAAI;gBAEQL;gBAUNrD;YAXJ,MAAMgE,OAAOC,KAAKC,SAAS,CAAC;gBAC1BC,MAAM,GAAEd,kBAAAA,QAAQc,MAAM,YAAdd,kBAAkB;gBAC1BS;gBACAC;gBACA,qEAAqE;gBACrE,wDAAwD;gBACxDK,KAAK,GAAGpE,KAAKqE,QAAQ,CAACC,MAAM,GAAGtE,KAAKqE,QAAQ,CAACE,QAAQ,EAAE;YACzD;YACA,sEAAsE;YACtE,uEAAuE;YACvE,6DAA6D;YAC7D,KAAIvE,kBAAAA,KAAKwE,SAAS,qBAAdxE,gBAAgByE,UAAU,EAAE;gBAC9BzE,KAAKwE,SAAS,CAACC,UAAU,CAAChB,UAAUO;YACtC,OAAO;gBACL,KAAKU,MAAMjB,UAAU;oBAAEkB,QAAQ;oBAAQX;oBAAMY,WAAW;gBAAK,GAAGC,KAAK,CACnE,IAAYC;YAEhB;QACF,EAAE,eAAM;QACN,oEAAoE;QACtE;IACF;IAEA;;;;;;GAMC,GACD,MAAMC,UAAU,CAAChB,SAAiBiB;QAChC,IAAIrB,SAASsB,GAAG,CAAClB,UAAU;QAC3BJ,SAASuB,GAAG,CAACnB;QACb,IAAI;YACF,MAAMlB,SAASkB,YAAY,WAAW,SAAS;YAC/C,MAAMnB,QAAQY,IAAI2B,aAAa,CAACrD,cAAc9B;YAC9C2C,cAAcC,OAAsBC;YACpC,MAAMuC,OAAOxC,MAAMyC,YAAY,CAAC;gBAAEC,MAAM;YAAS;YACjD,MAAMC,QAAQP,SAASQ,SAAS,CAAC;YACjC,mEAAmE;YACnE,0DAA0D;YAC1DD,MAAMrF,KAAK,CAACiD,WAAW,CAAC,YAAY,UAAU;YAC9CoC,MAAMrF,KAAK,CAACiD,WAAW,CAAC,WAAW,eAAe;YAClDiC,KAAKK,WAAW,CAACF;YACjB/B,IAAIQ,IAAI,CAACyB,WAAW,CAAC7C;YAErB,oEAAoE;YACpE,yEAAyE;YACzE,gDAAgD;YAChD,MAAM8C,SAAS,IAAIC,iBAAiB;gBAClC,IAAI;oBACF,IAAI,CAAC/C,MAAM3C,WAAW,EAAEuD,IAAIQ,IAAI,CAACyB,WAAW,CAAC7C;oBAC7CD,cAAcC,OAAsBC;gBACtC,EAAE,eAAM;gBACN,SAAS;gBACX;YACF;YACA6C,OAAOE,OAAO,CAACpC,IAAIQ,IAAI,EAAE;gBAAE6B,WAAW;YAAK;YAC3CH,OAAOE,OAAO,CAAChD,OAAO;gBAAEkD,YAAY;gBAAMC,iBAAiB;oBAAC;iBAAQ;YAAC;YACrElG,QAAQmG,IAAI,CAACN;QACf,EAAE,eAAM;QACN,qEAAqE;QACrE,yBAAyB;QAC3B;IACF;IAEA,wEAAwE;IACxE,2EAA2E;IAC3E,0EAA0E;IAC1E,oEAAoE;IACpE,4BAA4B;IAC5B,MAAMO,YAAY,IAAIC;IACtB,IAAI;QACF,IAAI7C,QAAQ8C,OAAO,EAAE;YACnB,KAAK,MAAM,CAACpC,SAAShE,QAAQ,IAAIsD,QAAQ8C,OAAO,CAAE;gBAChD,IAAIpC,SAASkC,UAAUG,GAAG,CAACrC,SAAShE;YACtC;QACF,OAAO;YACL,KAAK,MAAMA,WAAWqC,MAAMC,IAAI,CAC9BmB,IAAI6C,gBAAgB,CAAC,CAAC,CAAC,EAAE9G,sBAAsB,CAAC,CAAC,GAChD;oBACeQ;gBAAhB,MAAMgE,WAAUhE,wBAAAA,QAAQuG,YAAY,CAAC/G,kCAArBQ,wBAA+C;gBAC/D,IAAI,CAACgE,WAAWkC,UAAUhB,GAAG,CAAClB,UAAU;gBACxCkC,UAAUG,GAAG,CAACrC,SAAShE,QAAQyF,SAAS,CAAC;YAC3C;QACF;IACF,EAAE,eAAM;QACN;IACF;IACA,MAAMW,UAAU;WAAIF,UAAUM,IAAI;KAAG;IACrC,IAAI,CAACJ,QAAQK,MAAM,EAAE;IAErB,MAAMC,QAAQ;QACZ,IAAIC;QACJ,IAAI;YACFA,WAAWtE,MAAMC,IAAI,CAACmB,IAAI6C,gBAAgB,CAAC,CAAC,CAAC,EAAE9G,sBAAsB,CAAC,CAAC;QACzE,EAAE,eAAM;YACN;QACF;QACA,KAAK,MAAMQ,WAAW2G,SAAU;gBACd3G;YAAhB,MAAMgE,WAAUhE,wBAAAA,QAAQuG,YAAY,CAAC/G,kCAArBQ,wBAA+C;YAC/D,IAAI4D,SAASsB,GAAG,CAAClB,UAAU;YAC3B,MAAM4C,cAAc7G,0BAA0BC,SAASC;YACvD,IAAI,CAAC2G,aAAa;YAClB5B,QAAQhB,SAAShE;YACjB8D,OAAO8C,aAAa5C;QACtB;QACA,0EAA0E;QAC1E,sEAAsE;QACtE,KAAK,MAAMA,WAAWoC,QAAS;YAC7B,IAAIxC,SAASsB,GAAG,CAAClB,UAAU;YAC3B,IAAIP,IAAIoD,aAAa,CAAC,CAAC,CAAC,EAAErH,sBAAsB,EAAE,EAAEwE,QAAQ,EAAE,CAAC,GAAG;YAClE,MAAM8C,WAAWZ,UAAUa,GAAG,CAAC/C;YAC/B,IAAI8C,UAAU9B,QAAQhB,SAAS8C;YAC/BhD,OAAO,WAAWE;QACpB;IACF;IAEA,KAAK,MAAMgD,SAAStH,kBAAmB;QACrCO,KAAKgH,UAAU,CAAC;YACd,IAAI;gBACFP;YACF,EAAE,eAAM;YACN,SAAS;YACX;QACF,GAAGM;IACL;AACF;AAEA;;;CAGC,GACD,OAAO,SAASE;IACdrH,YAAY;IACZ,KAAK,MAAM8F,UAAU7F,QAAQqH,MAAM,CAAC,GAAIxB,OAAOyB,UAAU;AAC3D"}