@aglyn/aglyn 1.0.0-beta.217 → 1.0.0-beta.219

package/src/lib/app-utils/plugin-bundle-checks.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/plugin-bundle-checks.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Static plugin-bundle checks (AGL-426) — Strapi `strapi-plugin verify`\n * parity, but ALSO enforced server-side: the publish API runs the same\n * checks, so a bundle that fails locally fails there identically.\n *\n * The bundle is PARSED and the tree analysed (AGL-964). The checks used to\n * match source text with regexes, which meant they could not see computed\n * member access, could not follow a value into a call, and could not tell\n * code from a comment — `g['ev'+'al'](…)` passed while the words `eval(`\n * inside a comment failed. On a minified bundle, which every published\n * artifact is, that is close to no signal at all.\n *\n * These are still cheap heuristics, NOT a sandbox: they catch honest build\n * mistakes (leftover imports, missing entry exports, oversized bundles),\n * flag the APIs the platform never wants in marketplace code, and surface\n * the questions a reviewer should ask. A determined author can still hide\n * intent from any static pass. The real security boundary stays the trust\n * chain (sandbox iframe + per-manifest CSP / staff review + realm signing /\n * sha pinning / the kill switch).\n */\n\nimport { parse, type Node, type Options } from 'acorn'\n// The leaf, not the barrel: the phishing screen's own reading of an input's\n// type, autocomplete token and raw HTML (AGL-3362).\nimport {\n  credentialForInputAttribute,\n  credentialInHtml,\n} from '@aglyn/shared-util-email/hosted-page-screen'\nimport { lookalikeBrandForHost } from '@aglyn/shared-util-email/outbound-phishing-screen'\nimport type { PluginContributions } from '../plugin-manager/plugin-contributions'\nimport {\n  PLUGIN_HOST_ABI_KEYS,\n  PLUGIN_HOST_GLOBAL,\n  PLUGIN_HOST_MODULE_KEYS,\n} from './plugin-host-abi'\nimport { REALM_HOST_SURFACE_NAMES } from './realm-host-surface.generated'\n\n/** The areas the verifier reports on, in the order a reviewer reads them. */\nexport type BundleCheckId =\n  | 'parse'\n  | 'entry'\n  | 'self-contained'\n  | 'host-abi'\n  | 'size'\n  | 'code-execution'\n  | 'globals'\n  | 'storage'\n  | 'dynamic-import'\n  | 'network'\n  | 'obfuscation'\n  | 'contributions'\n  | 'credentials'\n\nexport interface BundleCheckProblem {\n  level: 'error' | 'warning'\n  message: string\n  /**\n   * Which check produced this. Optional so a verdict stored by an older\n   * checker still reads — those findings render on their own rather than\n   * under a check row.\n   */\n  check?: BundleCheckId\n}\n\n/**\n * `unknown` is the one that earns its keep (AGL-1087). A check that could\n * not run — the network diff with no manifest supplied, everything at all\n * when the parse failed — must not render as green, or the page tells a\n * reviewer something was verified when nothing looked at it.\n */\nexport type BundleCheckStatus = 'pass' | 'fail' | 'question' | 'unknown'\n\nexport interface BundleCheckSummary {\n  id: BundleCheckId\n  /** Reviewer-facing name of the area. */\n  label: string\n  status: BundleCheckStatus\n  /** What the check actually saw, when that is worth stating on its own. */\n  detail?: string\n}\n\nexport interface BundleCheckResult {\n  ok: boolean\n  problems: BundleCheckProblem[]\n  /** Every area, including the ones that found nothing (AGL-1087). */\n  checks: BundleCheckSummary[]\n  /** Which entry exports the source declares. */\n  exports: { register: boolean; registerApi: boolean }\n  /** What `register()` visibly registers (AGL-3116). */\n  contributions: DetectedContributions\n}\n\n/**\n * What a bundle's `register()` visibly registers (AGL-3116): the declaration\n * its registration calls imply, read from the tree.\n */\nexport interface DetectedContributions {\n  contributes: PluginContributions\n  /**\n   * Registrations the checker saw and could not read — an argument built at\n   * runtime. What they contribute is unknown, so a declaration cannot be\n   * checked against them and a reviewer has to read them.\n   */\n  unresolved: string[]\n}\n\nconst CHECK_LABELS: Record<BundleCheckId, string> = {\n  parse: 'Parses as an ES module',\n  entry: 'Exports an entry point',\n  'self-contained': 'Self-contained (no static imports)',\n  'host-abi': 'Reads only what the host provides',\n  size: 'Within the size limit',\n  'code-execution': 'No eval / Function constructor',\n  globals: 'No computed access on a global',\n  storage: 'No direct storage or cookie access',\n  'dynamic-import': 'No dynamic import of unknown code',\n  network: 'Network calls match the manifest',\n  obfuscation: 'No obfuscation shapes',\n  contributions: 'Registrations match the declared contributions',\n  credentials: 'No password, card or one-time-code inputs',\n}\n\n/** Check order as displayed — findings first would reorder on every bundle. */\nconst CHECK_ORDER: BundleCheckId[] = [\n  'parse',\n  'entry',\n  'self-contained',\n  'host-abi',\n  'size',\n  'code-execution',\n  'globals',\n  'storage',\n  'dynamic-import',\n  'network',\n  'obfuscation',\n  'contributions',\n  'credentials',\n]\n\nexport const MAX_PLUGIN_BUNDLE_BYTES = 1_000_000\n\n/**\n * Stamped onto a cached verdict (AGL-962) so a stored result outlives only\n * the checker that produced it.\n *\n * `checkPluginBundle` is pure over immutable, content-addressed bytes, so a\n * verdict for a given sha256 never changes — but the CHECKS do. **Bump this\n * whenever a rule is added, removed or loosened**, and every stored verdict\n * from the old checker is ignored and recomputed on next read. Forgetting to\n * bump means a reviewer sees a verdict from a checker that no longer exists,\n * which is the failure mode re-running the verifier was meant to prevent.\n *\n * 2 — AST analysis replaces the regex scan (AGL-964).\n * 3 — per-check summary added to the verdict (AGL-1087).\n * 4 — calls through an alias are resolved (AGL-1090).\n * 5 — URLs held in a constant are resolved (AGL-1093).\n * 6 — registrations are compared with the declared contributions (AGL-3116).\n * 7 — inputs that collect a password, card or one-time code (AGL-3362).\n * 8 — declared network origins that are a brand's lookalike (AGL-3365).\n * 9 — lookups on the host ABI name only keys a host provides (AGL-3392).\n */\nexport const PLUGIN_VERIFIER_VERSION = 10\n\n/** A verdict as stored on a `pluginVersions` doc (AGL-962). */\nexport interface StoredBundleVerdict {\n  ok?: boolean\n  problems?: BundleCheckProblem[]\n  /** Present from verifier 3 on (AGL-1087). */\n  checks?: BundleCheckSummary[]\n  sha256?: string\n  verifierVersion?: number\n}\n\n/**\n * Whether a stored verdict may be served instead of re-running the checks.\n *\n * Fails closed on every mismatch: no verdict, a verdict for different bytes\n * (a republished version keeps its version string but changes sha), or a\n * verdict from a checker that has since changed. Any of those means\n * download-and-recompute, which costs one page view rather than showing a\n * reviewer a verdict that was never true of the bundle in front of them.\n */\nexport function isStoredVerdictCurrent(\n  stored: StoredBundleVerdict | null | undefined,\n  sha256: string,\n): boolean {\n  if (!stored || !sha256) return false\n  return (\n    stored.sha256 === sha256 &&\n    Number(stored.verifierVersion) === PLUGIN_VERIFIER_VERSION\n  )\n}\n\n/**\n * Globals whose properties are the platform's business. Computed access on\n * one of these is flagged as computed access rather than by trying to\n * enumerate the property names an author might reach — `g[k]` hides its\n * property from any static pass, so the ACCESS is the finding.\n */\nconst GLOBAL_ROOTS = new Set([\n  'globalThis',\n  'window',\n  'self',\n  'top',\n  'parent',\n  'frames',\n  'document',\n])\n\n/** Storage the platform never wants reached directly (use host-mediated data). */\nconst STORAGE_NAMES = new Set(['localStorage', 'sessionStorage', 'indexedDB'])\n\n/** Network entry points, by the name they are called/constructed under. */\nconst NETWORK_CALLS = new Set(['fetch', 'sendBeacon'])\nconst NETWORK_CONSTRUCTORS = new Set([\n  'XMLHttpRequest',\n  'WebSocket',\n  'EventSource',\n])\n\n/**\n * Names worth following through an alias (AGL-1090).\n *\n * `const f = fetch; f(url)` used to pass every check, and the network row\n * rendered a green \"no network calls\" rather than going quiet — a two-line\n * indirection defeating the signal this whole verifier exists to produce.\n * Aliasing a VALUE was the exact gap the project was created to close, and\n * resolving global objects (`const g = globalThis`) never covered it.\n *\n * Reassignment, `arr[0]`, an object property and passing the function as an\n * argument all stay out of reach. The bar is that the cheap form is not free.\n */\nconst ALIASABLE_CALLABLES = new Set([\n  'eval',\n  'Function',\n  'fetch',\n  'sendBeacon',\n  'XMLHttpRequest',\n  'WebSocket',\n  'EventSource',\n])\n\n/**\n * Callees that legitimately take an absolute URL and reach nothing — so a URL\n * literal passed to them is not a call the network check failed to follow.\n * `createElementNS` matters most: an SVG namespace argument appears in a large\n * share of real bundles.\n */\nconst URL_TAKING_NON_CALLS = new Set([\n  'URL',\n  'URLSearchParams',\n  'createElementNS',\n  'createDocument',\n])\n\n/** Beyond this, a single line is not source a reviewer can read. */\nconst MAX_READABLE_LINE = 100_000\n/** A base64 blob at least this long is worth decoding before approving. */\nconst MIN_SUSPICIOUS_BASE64 = 1024\n/** How many `_0x…` names before the bundle counts as machine-obfuscated. */\nconst MIN_OBFUSCATED_NAMES = 5\n/** Verdicts are stored on a version doc; keep them bounded. */\nconst MAX_PROBLEMS = 40\n\nconst OBFUSCATED_NAME = /^_0x[0-9a-f]{4,}$/i\nconst BASE64_BLOB = /^[A-Za-z0-9+/\\r\\n]+={0,2}$/\n\ntype AnyNode = Node & Record<string, unknown>\n\n/**\n * Child keys that are NOT expressions in the surrounding scope — a\n * non-computed `.property`, an object literal key, a label. Walking into\n * them would read `x.localStorage` on an unrelated object as a global\n * storage access.\n */\nconst skippedChild = (node: AnyNode, key: string): boolean => {\n  switch (node.type) {\n    case 'MemberExpression':\n      return key === 'property' && !node['computed']\n    case 'Property':\n    case 'PropertyDefinition':\n    case 'MethodDefinition':\n      return key === 'key' && !node['computed']\n    case 'LabeledStatement':\n    case 'BreakStatement':\n    case 'ContinueStatement':\n      return key === 'label'\n    case 'ImportSpecifier':\n    case 'ExportSpecifier':\n      return true\n    default:\n      return false\n  }\n}\n\n/** Depth-first walk over every expression-position node in the tree. */\nfunction walk(root: AnyNode, visit: (node: AnyNode) => void): void {\n  const stack: AnyNode[] = [root]\n  while (stack.length) {\n    const node = stack.pop()\n    if (!node) continue\n    visit(node)\n    for (const key of Object.keys(node)) {\n      if (key === 'type' || key === 'start' || key === 'end') continue\n      if (skippedChild(node, key)) continue\n      const value = node[key]\n      if (Array.isArray(value)) {\n        for (const item of value) {\n          if (item && typeof item === 'object' && typeof item.type === 'string')\n            stack.push(item as AnyNode)\n        }\n      } else if (\n        value &&\n        typeof value === 'object' &&\n        typeof (value as AnyNode).type === 'string'\n      ) {\n        stack.push(value as AnyNode)\n      }\n    }\n  }\n}\n\n/**\n * The string a node evaluates to, when that is knowable without running it.\n * Covers the shapes used to hide a property name from a text scan: a\n * string literal, a template with no interpolation, and literals added\n * together (`'ev' + 'al'`).\n */\nfunction staticString(\n  node: AnyNode | null | undefined,\n  constants?: ReadonlyMap<string, string>,\n): string | null {\n  if (!node) return null\n  if (node.type === 'Literal')\n    return typeof node['value'] === 'string' ? (node['value'] as string) : null\n  // A name bound once to a constant string (AGL-1093). `const ENDPOINT =\n  // 'https://…'; fetch(ENDPOINT)` is the idiomatic way to write a request,\n  // and refusing to read it meant the network diff quietly did not run for\n  // the bundles most likely to be honest.\n  if (node.type === 'Identifier' && constants)\n    return constants.get(node['name'] as string) ?? null\n  if (node.type === 'TemplateLiteral') {\n    const expressions = (node['expressions'] ?? []) as AnyNode[]\n    const quasis = (node['quasis'] ?? []) as Array<{\n      value: { cooked?: string }\n    }>\n    if (!expressions.length) {\n      return quasis.length === 1 ? quasis[0]?.value?.cooked ?? null : null\n    }\n    // `${BASE}/zen` — resolvable exactly when every hole is.\n    let out = ''\n    for (let index = 0; index < quasis.length; index += 1) {\n      out += quasis[index]?.value?.cooked ?? ''\n      if (index < expressions.length) {\n        const filled = staticString(expressions[index], constants)\n        if (filled === null) return null\n        out += filled\n      }\n    }\n    return out\n  }\n  if (node.type === 'BinaryExpression' && node['operator'] === '+') {\n    const left = staticString(node['left'] as AnyNode, constants)\n    const right = staticString(node['right'] as AnyNode, constants)\n    return left !== null && right !== null ? left + right : null\n  }\n  return null\n}\n\n/** The property name a member expression reads, computed or not. */\nfunction propertyName(\n  node: AnyNode,\n  constants?: ReadonlyMap<string, string>,\n): string | null {\n  const property = node['property'] as AnyNode\n  if (!node['computed'])\n    return property?.type === 'Identifier'\n      ? (property['name'] as string)\n      : null\n  return staticString(property, constants)\n}\n\n/**\n * The origin of a URL argument, when it is a knowable http(s) URL.\n *\n * Scheme-checked HERE, once (AGL-1094). An opaque origin — every `data:`,\n * `blob:` and `javascript:` URL — makes `new URL(x).origin` the STRING\n * `\"null\"`, and a caller that then re-parsed that string threw `Invalid URL`\n * and took the whole checker down with it. Nothing downstream should have to\n * know that, so nothing downstream gets the chance.\n */\nfunction literalOrigin(\n  node: AnyNode | undefined,\n  constants?: ReadonlyMap<string, string>,\n): string | null {\n  const value = staticString(node, constants)\n  if (!value) return null\n  try {\n    const url = new URL(value)\n    return /^https?:$/.test(url.protocol) ? url.origin : null\n  } catch {\n    return null\n  }\n}\n\ninterface CheckOptions {\n  maxBytes?: number\n  /**\n   * The origins the manifest declares under `capabilities.network`. A\n   * network call the manifest does not account for is the single most\n   * useful signal the tree makes available — and the per-manifest CSP\n   * would block it at runtime anyway, so the bundle and its manifest\n   * disagreeing is a bug the publisher wants to hear about at publish\n   * time, not a mystery in production. Undefined = \"not supplied\", which\n   * downgrades those findings to warnings, because a checker that was\n   * never told what was declared cannot claim anything was undeclared.\n   */\n  declaredNetwork?: string[]\n  /**\n   * The manifest's `contributes` block (AGL-3116): `null` when the manifest\n   * declares none, `undefined` when no manifest was supplied — which leaves\n   * the comparison `unknown`, as the network diff is without its manifest.\n   */\n  declaredContributions?: PluginContributions | null\n  /**\n   * Refuse a bundle that registers something while its manifest declares no\n   * contributions at all. Set where a NEW version is judged — the publish\n   * pipeline and the local verifier that mirrors it. The review page and the\n   * re-verification sweep judge versions published before the contract,\n   * which load under its default, and a rule they were never held to must\n   * not turn them red after the fact.\n   */\n  requireContributions?: boolean\n}\n\n/** The detection result of a bundle no pass could read. */\nconst NOTHING_DETECTED: DetectedContributions = { contributes: {}, unresolved: [] }\n\n/**\n * Registration calls whose argument says what a bundle contributes, by the\n * name they are reached through: `h.aglyn.registerConsoleExtension(...)`,\n * `registerConsoleExtension(...)` after the realm template's host mapping,\n * `aglyn.components.registerComponent(...)`.\n */\nconst REGISTRATION_CALLS = new Set([\n  'registerConsoleExtension',\n  'registerSiteRuntime',\n  'registerComponent',\n  'addDependency',\n  'defineUiFeatureBundle',\n])\n\n/**\n * Console extension fields the shell draws on every screen of a workspace:\n * nav tabs, organization tabs, providers, staff pages and the dashboard and\n * settings entries. A plugin registering any of them loads with the shell.\n */\nconst SHELL_EXTENSION_FIELDS = [\n  'navItems',\n  'orgNavItems',\n  'providers',\n  'staffPages',\n  'dashboardCards',\n  'settingsSections',\n]\n\n/**\n * What `register()` visibly registers (AGL-3116), read from the tree.\n *\n * A heuristic like every check here: it reads registration calls whose\n * arguments are written out — an object literal, a string or a named slot —\n * and reports every call it cannot read as `unresolved` rather than guessing.\n * The declaration stays the contract; this is how a publisher learns theirs\n * is incomplete before a published page fails to load the plugin.\n */\nfunction detectRegistrations(\n  program: AnyNode,\n  constants: ReadonlyMap<string, string>,\n): DetectedContributions {\n  const slots = new Set<string>()\n  const routes = new Set<string>()\n  const orgRoutes = new Set<string>()\n  const components = new Set<string>()\n  const features = new Set<string>()\n  const unresolved = new Set<string>()\n  let shell = false\n\n  const objectProperty = (\n    object: AnyNode | undefined,\n    name: string,\n  ): AnyNode | undefined => {\n    if (object?.type !== 'ObjectExpression') return undefined\n    for (const property of (object['properties'] ?? []) as AnyNode[]) {\n      if (property.type !== 'Property') continue\n      const key = property['key'] as AnyNode\n      const keyName =\n        !property['computed'] && key?.type === 'Identifier'\n          ? (key['name'] as string)\n          : staticString(key, constants)\n      if (keyName === name) return property['value'] as AnyNode\n    }\n    return undefined\n  }\n  const listOf = (node: AnyNode | undefined): AnyNode[] | null =>\n    node?.type === 'ArrayExpression' ? ((node['elements'] ?? []) as AnyNode[]) : null\n  // A slot as a widget names it: a string, or a catalog entry\n  // (`CONSOLE_WIDGET_SLOTS.hostActivity`), whose property IS the slot id.\n  const slotName = (node: AnyNode | undefined): string | null => {\n    const literal = staticString(node, constants)\n    if (literal !== null) return literal\n    return node?.type === 'MemberExpression' ? propertyName(node, constants) : null\n  }\n\n  walk(program, (node) => {\n    if (node.type !== 'CallExpression') return\n    const callee = node['callee'] as AnyNode\n    const name =\n      callee?.type === 'Identifier'\n        ? (callee['name'] as string)\n        : callee?.type === 'MemberExpression'\n          ? propertyName(callee, constants)\n          : null\n    if (!name || !REGISTRATION_CALLS.has(name)) return\n    const args = (node['arguments'] ?? []) as AnyNode[]\n    if (name === 'registerConsoleExtension') {\n      const extension = args[0]\n      if (extension?.type !== 'ObjectExpression') {\n        unresolved.add('a console extension built at runtime')\n        return\n      }\n      const widgets = objectProperty(extension, 'widgets')\n      if (widgets) {\n        const list = listOf(widgets)\n        if (!list) unresolved.add('a console widget list built at runtime')\n        for (const widget of list ?? []) {\n          const slot = slotName(objectProperty(widget, 'slot'))\n          if (slot) slots.add(slot)\n          else unresolved.add('a console widget whose slot is built at runtime')\n        }\n      }\n      for (const field of SHELL_EXTENSION_FIELDS) {\n        const value = objectProperty(extension, field)\n        if (!value) continue\n        shell = true\n        if (field !== 'navItems' && field !== 'orgNavItems') continue\n        const into = field === 'navItems' ? routes : orgRoutes\n        const list = listOf(value)\n        if (!list) unresolved.add(`console ${field} built at runtime`)\n        for (const item of list ?? []) {\n          const href = staticString(objectProperty(item, 'href'), constants)\n          if (href) into.add(href)\n          else unresolved.add(`a console ${field} entry whose href is built at runtime`)\n        }\n      }\n      return\n    }\n    if (name === 'registerSiteRuntime') {\n      const id = staticString(objectProperty(args[0], 'runtimeId'), constants)\n      if (id) features.add(id)\n      else unresolved.add('a site runtime whose runtimeId is built at runtime')\n      return\n    }\n    if (name === 'registerComponent') {\n      const id = staticString(objectProperty(args[1], '$id'), constants)\n      if (id) components.add(id)\n      else unresolved.add('a canvas component whose $id is built at runtime')\n      return\n    }\n    // `addDependency` / `defineUiFeatureBundle`: a component bundle whose\n    // entries register later, from a list this pass does not follow.\n    unresolved.add('a canvas component bundle')\n  })\n\n  const contributes: PluginContributions = {}\n  if (components.size || features.size) {\n    contributes.site = {\n      ...(components.size ? { components: [...components].sort() } : {}),\n      ...(features.size ? { features: [...features].sort() } : {}),\n    }\n  }\n  if (slots.size || routes.size || orgRoutes.size || shell) {\n    contributes.console = {\n      ...(slots.size ? { slots: [...slots].sort() } : {}),\n      ...(routes.size ? { routes: [...routes].sort() } : {}),\n      ...(orgRoutes.size ? { orgRoutes: [...orgRoutes].sort() } : {}),\n      ...(shell ? { shell: true } : {}),\n    }\n  }\n  return { contributes, unresolved: [...unresolved].sort() }\n}\n\n/** A declaration in the words a reviewer reads: `console slots hostActivity`. */\nfunction describeContributions(contributes: PluginContributions): string {\n  const parts: string[] = []\n  const site = contributes.site ?? {}\n  const shell = contributes.console ?? {}\n  if (site.components?.length) parts.push(`site components ${site.components.join(', ')}`)\n  if (site.features?.length) parts.push(`site features ${site.features.join(', ')}`)\n  if (shell.slots?.length) parts.push(`console slots ${shell.slots.join(', ')}`)\n  if (shell.routes?.length) parts.push(`console routes ${shell.routes.join(', ')}`)\n  if (shell.orgRoutes?.length) {\n    parts.push(`console organization routes ${shell.orgRoutes.join(', ')}`)\n  }\n  if (shell.shell) parts.push('the console shell')\n  return parts.join(' · ') || 'nothing'\n}\n\n/**\n * The `contributions` area (AGL-3116): what the bundle registers against what\n * its manifest declares.\n *\n * Every registration the tree shows must be declared, because the loaders\n * read ONLY the declaration: a slot the manifest omits is a slot whose\n * screens never load the plugin, and a component it omits is an element that\n * renders empty on every published page that places it. A declared entry the\n * bundle never registers is a warning — the plugin loads there for nothing.\n */\nfunction compareContributions(\n  detected: DetectedContributions,\n  options: CheckOptions | undefined,\n  add: (\n    level: BundleCheckProblem['level'],\n    check: BundleCheckId,\n    message: string,\n  ) => void,\n  details: Map<BundleCheckId, string>,\n  markUnknown: (check: BundleCheckId) => void,\n): void {\n  const found = detected.contributes\n  const registers = describeContributions(found)\n  const registersSomething =\n    Boolean(found.site || found.console) || detected.unresolved.length > 0\n  const unreadable = detected.unresolved.length\n    ? ` It also makes registrations the checker could not read: ${detected.unresolved.join('; ')}.`\n    : ''\n  const declared = options?.declaredContributions\n  if (declared === undefined) {\n    // Nothing to compare against is `unknown`, never a pass — the same\n    // reading the network row gives a bundle checked without its manifest.\n    if (!registersSomething) {\n      details.set('contributions', 'registers nothing')\n      return\n    }\n    markUnknown('contributions')\n    details.set(\n      'contributions',\n      `registers ${registers} — no manifest was supplied, so nothing was compared`,\n    )\n    return\n  }\n  if (declared === null) {\n    details.set(\n      'contributions',\n      registersSomething ? `undeclared · registers ${registers}` : 'declares and registers nothing',\n    )\n    if (!registersSomething) return\n    add(\n      options?.requireContributions ? 'error' : 'warning',\n      'contributions',\n      `the manifest declares no \"contributes\", and register() registers ` +\n        `${registers}.${unreadable} Declare it — ` +\n        `\"contributes\": ${JSON.stringify(found)} — because the loaders place ` +\n        'a plugin by its declaration alone. Undeclared, a published page ' +\n        'loads it only where its element is placed and the console loads it ' +\n        'with the shell.',\n    )\n    return\n  }\n\n  details.set('contributions', `declares ${describeContributions(declared)}`)\n  const missing = (\n    label: string,\n    registered: readonly string[] | undefined,\n    listed: readonly string[] | undefined,\n    consequence: string,\n  ) => {\n    for (const id of registered ?? []) {\n      if ((listed ?? []).includes(id)) continue\n      add(\n        'error',\n        'contributions',\n        `register() registers ${label} \"${id}\", which the manifest does not ` +\n          `declare — ${consequence}`,\n      )\n    }\n  }\n  missing(\n    'the site component',\n    found.site?.components,\n    declared.site?.components,\n    'a published page that places it would never load the plugin',\n  )\n  missing(\n    'the site feature',\n    found.site?.features,\n    declared.site?.features,\n    'no published page would ever load the plugin to run it',\n  )\n  missing(\n    'a widget in the console slot',\n    found.console?.slots,\n    declared.console?.slots,\n    'a screen that renders the slot would never load the plugin',\n  )\n  missing(\n    'the console route',\n    found.console?.routes,\n    declared.console?.routes,\n    'the route would not find the plugin that serves it',\n  )\n  missing(\n    'the console organization route',\n    found.console?.orgRoutes,\n    declared.console?.orgRoutes,\n    'the route would not find the plugin that serves it',\n  )\n  if (found.console?.shell && !declared.console?.shell) {\n    add(\n      'error',\n      'contributions',\n      'register() adds a nav tab, a provider or another entry the console ' +\n        'shell draws on every screen, and the manifest does not declare ' +\n        '\"console\": { \"shell\": true } — the shell would draw it only on ' +\n        'screens that happened to load the plugin for something else',\n    )\n  }\n  if (detected.unresolved.length) {\n    add(\n      'warning',\n      'contributions',\n      `the checker could not read ${detected.unresolved.join('; ')} — ` +\n        'confirm the declaration covers what it registers',\n    )\n  }\n  const unused = (\n    label: string,\n    listed: readonly string[] | undefined,\n    registered: readonly string[] | undefined,\n  ) => {\n    // Only when every registration of that kind was readable: an unreadable\n    // one may be exactly the entry that is declared.\n    if (detected.unresolved.length) return\n    for (const id of listed ?? []) {\n      if ((registered ?? []).includes(id)) continue\n      add(\n        'warning',\n        'contributions',\n        `the manifest declares ${label} \"${id}\", and register() never ` +\n          'registers it — the plugin would load there for nothing',\n      )\n    }\n  }\n  unused('the site component', declared.site?.components, found.site?.components)\n  unused('the site feature', declared.site?.features, found.site?.features)\n  unused('the console slot', declared.console?.slots, found.console?.slots)\n}\n\n/**\n * Inputs a bundle builds that collect a password, a card number or a\n * one-time code (AGL-3362) — a reviewer's QUESTION, never a failure.\n *\n * The phishing screen holds a published page whose author defined such a\n * field, but a plugin renders its own inputs from code the page screen never\n * reads. So the same reading is applied here, to the bundle, at review: an\n * input's `type` or `autocomplete` in an object literal (`createElement`\n * props, a JSX runtime call, a DOM `Object.assign`), in `setAttribute`, and\n * in any HTML string. A warning rather than an error because a legitimate\n * plugin can own a sign-in (a members-only area, a booking account); what the\n * reviewer asks is whether its credentials go anywhere but its declared\n * origins. The sandbox tier cannot post a native form at all — its frame\n * has no `allow-forms` and its CSP says `form-action 'none'` — so the\n * question is about `connect-src`, which the network check already lists.\n */\nfunction credentialInputsIn(\n  program: AnyNode,\n  constants: ReadonlyMap<string, string>,\n): string[] {\n  const found = new Set<'password' | 'card' | 'otp'>()\n  const keyOf = (node: AnyNode): string | null => {\n    const key = node['key'] as AnyNode\n    if (!key) return null\n    if (!node['computed'] && key.type === 'Identifier') return key['name'] as string\n    return staticString(key, constants)\n  }\n  walk(program, (node) => {\n    if (node.type === 'Property') {\n      const key = keyOf(node)\n      const value = staticString(node['value'] as AnyNode, constants)\n      const field = key && value !== null ? credentialForInputAttribute(key, value) : null\n      if (field) found.add(field)\n    } else if (node.type === 'CallExpression') {\n      const callee = node['callee'] as AnyNode\n      const args = (node['arguments'] ?? []) as AnyNode[]\n      if (callee?.type === 'MemberExpression' && propertyName(callee, constants) === 'setAttribute') {\n        const name = staticString(args[0], constants)\n        const value = staticString(args[1], constants)\n        const field = name !== null && value !== null ? credentialForInputAttribute(name, value) : null\n        if (field) found.add(field)\n      }\n    } else if (node.type === 'Literal' && typeof node['value'] === 'string') {\n      const field = credentialInHtml(node['value'] as string)\n      if (field) found.add(field)\n    } else if (node.type === 'TemplateLiteral') {\n      const text = ((node['quasis'] ?? []) as AnyNode[])\n        .map((quasi) => String((quasi['value'] as { cooked?: string } | undefined)?.cooked ?? ''))\n        .join('')\n      const field = credentialInHtml(text)\n      if (field) found.add(field)\n    }\n  })\n  const words = { password: 'a password', card: 'a card number or security code', otp: 'a one-time code' }\n  return [...found].map(\n    (field) =>\n      `builds an input that collects ${words[field]} — confirm what it is for, and that ` +\n      'it is sent only to the origins the manifest declares',\n  )\n}\n\n/**\n * Declared network origins that wear a brand without being the brand's\n * (AGL-3365) — a reviewer's QUESTION, read with the phishing screen's own\n * lookalike rule (`lookalikeBrandForHost`), the one that holds a link in an\n * email or on a page.\n *\n * The manifest's origins are what the loader stamps into the plugin frame's\n * `connect-src`, so they are exactly where a plugin's data and a visitor's\n * input can go. A plugin that integrates with PayPal declares\n * `https://api-m.paypal.com`, which is PayPal's own domain and passes; one that\n * declares `https://paypal-verify.net` or `https://aglyn-billing.com` is\n * sending somewhere dressed as somebody else. A warning rather than an error\n * because every plugin version is reviewed before it installs, and the\n * reviewer is the one who can ask whose domain it is.\n */\nfunction lookalikeDeclaredOrigins(declared: readonly string[]): string[] {\n  const messages: string[] = []\n  for (const origin of declared) {\n    let host: string\n    try {\n      host = new URL(origin).hostname\n    } catch {\n      continue\n    }\n    const brand = lookalikeBrandForHost(host)\n    if (brand) {\n      messages.push(\n        `the manifest declares ${origin}, which wears the ${brand.label} name ` +\n          `but is not ${brand.label}'s domain — confirm whose it is before approving`,\n      )\n    }\n  }\n  return messages\n}\n\n/**\n * Walks every expression-position node with its parent, by the same rules as\n * {@link walk}.\n */\nfunction walkWithParents(\n  root: AnyNode,\n  visit: (node: AnyNode, parent: AnyNode | null) => void,\n): void {\n  const stack: Array<[AnyNode, AnyNode | null]> = [[root, null]]\n  while (stack.length) {\n    const entry = stack.pop()\n    if (!entry) continue\n    const [node, parent] = entry\n    visit(node, parent)\n    for (const key of Object.keys(node)) {\n      if (key === 'type' || key === 'start' || key === 'end') continue\n      if (skippedChild(node, key)) continue\n      const value = node[key]\n      const children = Array.isArray(value) ? value : [value]\n      for (const child of children) {\n        if (\n          child &&\n          typeof child === 'object' &&\n          typeof (child as AnyNode).type === 'string'\n        ) {\n          stack.push([child as AnyNode, node])\n        }\n      }\n    }\n  }\n}\n\nconst FUNCTION_TYPES = new Set([\n  'FunctionDeclaration',\n  'FunctionExpression',\n  'ArrowFunctionExpression',\n])\n\n/** Nodes that open a scope a name can be declared in. */\nconst SCOPE_TYPES = new Set([\n  'Program',\n  ...FUNCTION_TYPES,\n  'BlockStatement',\n  'StaticBlock',\n  'SwitchStatement',\n  'CatchClause',\n  'ForStatement',\n  'ForInStatement',\n  'ForOfStatement',\n  'ClassExpression',\n])\n\n/** The names a binding pattern declares: `a`, `{ a, b: c }`, `[a, ...b]`, `a = 1`. */\nfunction patternNames(pattern: AnyNode | null | undefined, into: Set<string>): void {\n  if (!pattern) return\n  switch (pattern.type) {\n    case 'Identifier':\n      into.add(pattern['name'] as string)\n      return\n    case 'AssignmentPattern':\n      return patternNames(pattern['left'] as AnyNode, into)\n    case 'RestElement':\n      return patternNames(pattern['argument'] as AnyNode, into)\n    case 'ArrayPattern':\n      for (const element of (pattern['elements'] ?? []) as AnyNode[]) patternNames(element, into)\n      return\n    case 'ObjectPattern':\n      for (const property of (pattern['properties'] ?? []) as AnyNode[]) {\n        patternNames(\n          (property.type === 'RestElement' ? property : property['value']) as AnyNode,\n          into,\n        )\n      }\n      return\n  }\n}\n\n/** The declarations a statement list makes itself: `let`/`const`/`class`/`function`. */\nfunction lexicalNames(statements: readonly AnyNode[], into: Set<string>): void {\n  for (const statement of statements) {\n    if (statement?.type === 'VariableDeclaration' && statement['kind'] !== 'var') {\n      for (const declarator of (statement['declarations'] ?? []) as AnyNode[]) {\n        patternNames(declarator['id'] as AnyNode, into)\n      }\n    }\n    if (\n      (statement?.type === 'FunctionDeclaration' || statement?.type === 'ClassDeclaration') &&\n      statement['id']\n    ) {\n      into.add((statement['id'] as AnyNode)['name'] as string)\n    }\n  }\n}\n\n/** Every `var` a function body declares, however deep, short of a nested function. */\nfunction varNames(node: AnyNode | null | undefined, into: Set<string>): void {\n  if (!node || typeof node !== 'object') return\n  if (FUNCTION_TYPES.has(node.type)) return\n  if (node.type === 'VariableDeclaration' && node['kind'] === 'var') {\n    for (const declarator of (node['declarations'] ?? []) as AnyNode[]) {\n      patternNames(declarator['id'] as AnyNode, into)\n    }\n  }\n  for (const [field, value] of Object.entries(node)) {\n    if (field === 'type' || !value || typeof value !== 'object') continue\n    if (Array.isArray(value)) for (const child of value) varNames(child as AnyNode, into)\n    else if ('type' in (value as object)) varNames(value as AnyNode, into)\n  }\n}\n\n/** The names a scope node declares for its own body. */\nfunction declaredNames(scope: AnyNode): Set<string> {\n  const names = new Set<string>()\n  if (FUNCTION_TYPES.has(scope.type)) {\n    for (const param of (scope['params'] ?? []) as AnyNode[]) patternNames(param, names)\n    if (scope.type === 'FunctionExpression' && scope['id']) {\n      names.add((scope['id'] as AnyNode)['name'] as string)\n    }\n    const body = scope['body'] as AnyNode\n    if (body?.type === 'BlockStatement') {\n      for (const statement of (body['body'] ?? []) as AnyNode[]) varNames(statement, names)\n      lexicalNames((body['body'] ?? []) as AnyNode[], names)\n    }\n    return names\n  }\n  switch (scope.type) {\n    case 'Program':\n    case 'BlockStatement':\n    case 'StaticBlock':\n      lexicalNames((scope['body'] ?? []) as AnyNode[], names)\n      break\n    case 'SwitchStatement':\n      for (const branch of (scope['cases'] ?? []) as AnyNode[]) {\n        lexicalNames((branch['consequent'] ?? []) as AnyNode[], names)\n      }\n      break\n    case 'CatchClause':\n      patternNames(scope['param'] as AnyNode, names)\n      break\n    case 'ForStatement':\n    case 'ForInStatement':\n    case 'ForOfStatement': {\n      const head = (scope['init'] ?? scope['left']) as AnyNode | null\n      if (head?.type === 'VariableDeclaration' && head['kind'] !== 'var') lexicalNames([head], names)\n      break\n    }\n    case 'ClassExpression':\n      if (scope['id']) names.add((scope['id'] as AnyNode)['name'] as string)\n      break\n  }\n  return names\n}\n\n/**\n * Whether an identifier refers to a variable, rather than naming a property,\n * a key or a label.\n */\nfunction isReference(node: AnyNode, parent: AnyNode | null | undefined): boolean {\n  if (!parent) return true\n  switch (parent.type) {\n    case 'MemberExpression':\n      return parent['object'] === node || parent['computed'] === true\n    case 'Property':\n      if (parent['key'] === node && parent['computed'] !== true) {\n        return parent['shorthand'] === true && parent['value'] === node\n      }\n      return true\n    case 'MethodDefinition':\n    case 'PropertyDefinition':\n      return parent['key'] !== node || parent['computed'] === true\n    case 'LabeledStatement':\n    case 'BreakStatement':\n    case 'ContinueStatement':\n      return false\n    case 'ExportSpecifier':\n      return parent['local'] === node\n    case 'ImportSpecifier':\n    case 'ImportDefaultSpecifier':\n    case 'ImportNamespaceSpecifier':\n      return false\n    default:\n      return true\n  }\n}\n\n/**\n * What a bundle reads from the host ABI (AGL-3392), read off the bytes.\n *\n * The realm Rollup configs compile each host import into\n * `const host = globalThis.__AGLYN_PLUGIN_HOST__; … host[\"mui\"]`, and each use\n * of an import into a member read on that: `_aglynHost_mui.Button`. So:\n *\n * - `read` / `unknown` / `computed` are the KEYS a bundle reads off the host\n *   object. A key outside `PLUGIN_HOST_ABI_KEYS` is undefined on every host\n *   and the bundle fails where it is used; a key chosen at runtime cannot be\n *   reviewed at all.\n * - `imports` is what it reads from each host MODULE, by name, so each name\n *   can be checked against what the host holds. A module handed around as a\n *   value (`import * as M`, a spread, a computed read) cannot be narrowed and\n *   records `'*'`.\n *\n * The host is reached through `globalThis.__AGLYN_PLUGIN_HOST__`, a name bound\n * to it, or the parameter of the exported `register(host)` — the last only\n * inside `register` itself, since the same name elsewhere is another variable.\n * A bad key on that parameter is a warning rather than a refusal: bundles\n * written before this check read it freely, and refusing them would report a\n * regression on bytes that are already installed.\n */\nfunction hostAbiReads(\n  program: AnyNode,\n  constants: ReadonlyMap<string, string>,\n  isGlobalRef: (node: AnyNode | null | undefined) => boolean,\n): {\n  read: Set<string>\n  unknown: Set<string>\n  /** Read off `register`'s parameter, which could be a bundle's own mistake. */\n  unknownOnParam: Set<string>\n  computed: number\n  computedOnParam: number\n  imports: Partial<Record<string, readonly string[] | '*'>>\n} {\n  const parents = new Map<AnyNode, AnyNode | null>()\n  const identifiers = new Map<string, AnyNode[]>()\n  walkWithParents(program, (node, parent) => {\n    parents.set(node, parent)\n    if (node.type === 'Identifier') {\n      const name = node['name'] as string\n      const list = identifiers.get(name)\n      if (list) list.push(node)\n      else identifiers.set(name, [node])\n    }\n  })\n  // Scope (AGL-3394). A minifier names the host alias `e`, and names every\n  // other function's first parameter `e` too, so a name only resolves to the\n  // host where no nearer scope declares it again.\n  const scopeNames = new Map<AnyNode, Set<string>>()\n  const namesOf = (scope: AnyNode): Set<string> => {\n    let found = scopeNames.get(scope)\n    if (!found) {\n      found = declaredNames(scope)\n      scopeNames.set(scope, found)\n    }\n    return found\n  }\n  /** The scope a declarator's name belongs to: its function for `var`, else its block. */\n  const bindingScope = (declarator: AnyNode): AnyNode | null => {\n    const declaration = parents.get(declarator)\n    const functionScoped = declaration?.['kind'] === 'var'\n    for (let at = parents.get(declaration as AnyNode); at; at = parents.get(at)) {\n      if (functionScoped ? FUNCTION_TYPES.has(at.type) || at.type === 'Program' : SCOPE_TYPES.has(at.type)) {\n        return at\n      }\n    }\n    return null\n  }\n  /** Whether `ref` means the binding `name` declared in `scope`. */\n  const resolvesTo = (ref: AnyNode, name: string, scope: AnyNode | null): boolean => {\n    if (!isReference(ref, parents.get(ref))) return false\n    for (let at = parents.get(ref); at; at = parents.get(at)) {\n      if (at === scope) return true\n      if (SCOPE_TYPES.has(at.type) && namesOf(at).has(name)) return false\n    }\n    return scope === null\n  }\n\n  const isHostGlobal = (node: AnyNode | null | undefined): boolean =>\n    (node?.type === 'Identifier' && node['name'] === PLUGIN_HOST_GLOBAL) ||\n    (node?.type === 'MemberExpression' &&\n      isGlobalRef(node['object'] as AnyNode) &&\n      propertyName(node) === PLUGIN_HOST_GLOBAL)\n\n  // Names bound to the host object, each with the scope it is declared in:\n  // a declarator's block or function, or the `register(host)` function for its\n  // parameter.\n  const hostNames = new Map<string, { scope: AnyNode | null; param: boolean }>()\n  walk(program, (node) => {\n    if (node.type === 'VariableDeclarator') {\n      const id = node['id'] as AnyNode\n      const init = node['init'] as AnyNode | null\n      const roots =\n        init?.type === 'LogicalExpression'\n          ? [init['left'] as AnyNode, init['right'] as AnyNode]\n          : [init]\n      if (id?.type === 'Identifier' && roots.some(isHostGlobal)) {\n        hostNames.set(id['name'] as string, { scope: bindingScope(node), param: false })\n      }\n    }\n    if (\n      node.type === 'FunctionDeclaration' &&\n      (node['id'] as AnyNode | null)?.['name'] === 'register'\n    ) {\n      const param = ((node['params'] ?? []) as AnyNode[])[0]\n      if (param?.type === 'Identifier' && !hostNames.has(param['name'] as string)) {\n        hostNames.set(param['name'] as string, { scope: node, param: true })\n      }\n    }\n  })\n  /** `'global'` for the host reached by name, `'param'` for `register(host)`. */\n  const hostRef = (\n    node: AnyNode | null | undefined,\n  ): 'global' | 'param' | null => {\n    if (isHostGlobal(node)) return 'global'\n    if (node?.type !== 'Identifier') return null\n    const name = node['name'] as string\n    const binding = hostNames.get(name)\n    if (!binding || !resolvesTo(node, name, binding.scope)) return null\n    return binding.param ? 'param' : 'global'\n  }\n\n  const modules = new Set<string>(PLUGIN_HOST_MODULE_KEYS)\n  const allowed = new Set<string>(PLUGIN_HOST_ABI_KEYS)\n  const read = new Set<string>()\n  const unknown = new Set<string>()\n  const unknownOnParam = new Set<string>()\n  let computed = 0\n  let computedOnParam = 0\n  const names = new Map<string, Set<string> | '*'>()\n  const whole = (key: string): void => {\n    names.set(key, '*')\n  }\n  const note = (key: string, name: string | null): void => {\n    if (name === null) return whole(key)\n    const current = names.get(key)\n    if (current === '*') return\n    if (current) current.add(name)\n    else names.set(key, new Set([name]))\n  }\n  const seenAliases = new Set<AnyNode>()\n\n  /** Records how one reference to a lazy key's module is used. */\n  const useOf = (key: string, ref: AnyNode): void => {\n    const parent = parents.get(ref)\n    // A presence check reads no name from the module: `if (!h.aglyn) return`\n    // is how a bundle stays inert on a host without the key, and every\n    // example plugin does it.\n    if (\n      (parent?.type === 'UnaryExpression' &&\n        (parent['operator'] === '!' || parent['operator'] === 'typeof')) ||\n      ((parent?.type === 'IfStatement' || parent?.type === 'ConditionalExpression') &&\n        parent['test'] === ref)\n    ) {\n      return\n    }\n    if (parent?.type === 'MemberExpression' && parent['object'] === ref) {\n      return note(key, propertyName(parent, constants))\n    }\n    if (parent?.type === 'VariableDeclarator' && parent['init'] === ref) {\n      const id = parent['id'] as AnyNode\n      if (id?.type === 'Identifier') {\n        const alias = id['name'] as string\n        if (seenAliases.has(parent)) return\n        seenAliases.add(parent)\n        const scope = bindingScope(parent)\n        for (const use of identifiers.get(alias) ?? []) {\n          if (use !== id && resolvesTo(use, alias, scope)) useOf(key, use)\n        }\n        return\n      }\n      if (id?.type === 'ObjectPattern') {\n        for (const property of (id['properties'] ?? []) as AnyNode[]) {\n          if (property.type !== 'Property' || property['computed']) {\n            return whole(key)\n          }\n          const propertyKey = property['key'] as AnyNode\n          const name =\n            propertyKey?.type === 'Identifier'\n              ? (propertyKey['name'] as string)\n              : staticString(propertyKey)\n          note(key, name)\n        }\n        return\n      }\n    }\n    whole(key)\n  }\n\n  walk(program, (node) => {\n    if (node.type !== 'MemberExpression') return\n    const via = hostRef(node['object'] as AnyNode)\n    if (!via) return\n    const key = propertyName(node, constants)\n    if (key === null) {\n      if (via === 'param') computedOnParam += 1\n      else computed += 1\n    } else if (!allowed.has(key)) {\n      ;(via === 'param' ? unknownOnParam : unknown).add(key)\n    } else {\n      read.add(key)\n      if (modules.has(key)) useOf(key, node)\n    }\n  })\n\n  const imports: Record<string, readonly string[] | '*'> = {}\n  for (const [key, value] of names) {\n    imports[key] = value === '*' ? '*' : [...value].sort()\n  }\n  return {\n    read,\n    unknown,\n    unknownOnParam,\n    computed,\n    computedOnParam,\n    imports,\n  }\n}\n\nfunction analyseBundle(\n  source: string,\n  options?: CheckOptions,\n): BundleCheckResult {\n  const problems: BundleCheckProblem[] = []\n  const seen = new Set<string>()\n  // Every area starts as \"ran, found nothing\" and is downgraded by its own\n  // findings, so the summary cannot drift from the problem list (AGL-1087).\n  const status = new Map<BundleCheckId, BundleCheckStatus>(\n    CHECK_ORDER.map((id) => [id, 'pass']),\n  )\n  const details = new Map<BundleCheckId, string>()\n  const add = (\n    level: BundleCheckProblem['level'],\n    check: BundleCheckId,\n    message: string,\n  ) => {\n    if (level === 'error') status.set(check, 'fail')\n    else if (status.get(check) === 'pass') status.set(check, 'question')\n    if (seen.has(message) || seen.size >= MAX_PROBLEMS) return\n    seen.add(message)\n    problems.push({ level, message, check })\n  }\n  /** Mark the areas that never ran, so they cannot read as clean. */\n  const unknownFrom = (...ids: BundleCheckId[]) => {\n    for (const id of ids) status.set(id, 'unknown')\n  }\n  const summarise = (): BundleCheckSummary[] =>\n    CHECK_ORDER.map((id) => ({\n      id,\n      label: CHECK_LABELS[id],\n      status: status.get(id) ?? 'unknown',\n      ...(details.has(id) ? { detail: details.get(id) } : {}),\n    }))\n\n  const maxBytes = options?.maxBytes ?? MAX_PLUGIN_BUNDLE_BYTES\n  const bytes = new TextEncoder().encode(source).byteLength\n  details.set('size', `${bytes.toLocaleString('en-US')} bytes of ${maxBytes.toLocaleString('en-US')}`)\n  if (bytes === 0) {\n    add('error', 'size', 'bundle is empty')\n    unknownFrom(\n      'parse',\n      'entry',\n      'self-contained',\n      'host-abi',\n      'code-execution',\n      'globals',\n      'storage',\n      'dynamic-import',\n      'network',\n      'obfuscation',\n      'contributions',\n      'credentials',\n    )\n    return {\n      ok: false,\n      problems,\n      checks: summarise(),\n      exports: { register: false, registerApi: false },\n      contributions: NOTHING_DETECTED,\n    }\n  }\n  if (bytes > maxBytes) {\n    add('error', 'size', `bundle is ${bytes} bytes (limit ${maxBytes})`)\n  }\n\n  const parseOptions: Options = {\n    ecmaVersion: 'latest',\n    sourceType: 'module',\n    allowHashBang: true,\n    allowAwaitOutsideFunction: true,\n  }\n  let program: AnyNode\n  try {\n    program = parse(source, parseOptions) as unknown as AnyNode\n  } catch (error) {\n    // Unparseable means unanalysable, and the loader would fail on it too.\n    // Nothing else ran, and saying so is the whole point of `unknown`: a\n    // bundle nobody could read must not show nine green rows.\n    add(\n      'error',\n      'parse',\n      `bundle does not parse as an ES module: ${\n        error instanceof Error ? error.message : String(error)\n      }`,\n    )\n    unknownFrom(\n      'entry',\n      'self-contained',\n      'host-abi',\n      'code-execution',\n      'globals',\n      'storage',\n      'dynamic-import',\n      'network',\n      'obfuscation',\n      'contributions',\n      'credentials',\n    )\n    return {\n      ok: false,\n      problems,\n      checks: summarise(),\n      exports: { register: false, registerApi: false },\n      contributions: NOTHING_DETECTED,\n    }\n  }\n\n  // Names bound to a global, so `const g = globalThis; g['ev'+'al']` reads\n  // as access on a global rather than on some object we know nothing about.\n  const aliases = new Set<string>()\n  const noteAlias = (name: unknown, init: AnyNode | null | undefined) => {\n    if (typeof name !== 'string' || !init) return\n    const roots: AnyNode[] =\n      init.type === 'LogicalExpression'\n        ? [init['left'] as AnyNode, init['right'] as AnyNode]\n        : [init]\n    for (const root of roots) {\n      if (\n        root?.type === 'Identifier' &&\n        GLOBAL_ROOTS.has(root['name'] as string)\n      ) {\n        aliases.add(name)\n      }\n    }\n  }\n  // Local name -> the constant string it holds (AGL-1093).\n  //\n  // A binding is only usable when the whole tree agrees on it: declared once,\n  // never assigned again, and never a parameter or another binder anywhere.\n  // Any of those means the value at a given call site is a GUESS, and a guess\n  // is how a checker starts making claims about code it did not read.\n  const constants = new Map<string, string>()\n  {\n    const bound = new Map<string, AnyNode>()\n    const poisoned = new Set<string>()\n    const declared = new Set<string>()\n    const poison = (name: unknown) => {\n      if (typeof name === 'string') poisoned.add(name)\n    }\n    /** Every name a pattern binds — a parameter shadowing a constant is a\n     * different variable, and resolving it to the outer value would be a\n     * fabrication. */\n    const poisonPattern = (node: AnyNode | null | undefined) => {\n      if (!node) return\n      if (node.type === 'Identifier') return poison(node['name'])\n      for (const key of [\n        'left',\n        'argument',\n        'properties',\n        'elements',\n        'value',\n      ]) {\n        const value = node[key]\n        if (Array.isArray(value))\n          value.forEach((item) => poisonPattern(item as AnyNode))\n        else if (value) poisonPattern(value as AnyNode)\n      }\n    }\n    walk(program, (node) => {\n      if (node.type === 'VariableDeclarator') {\n        const id = node['id'] as AnyNode\n        if (id?.type === 'Identifier') {\n          const name = id['name'] as string\n          if (declared.has(name)) poison(name)\n          declared.add(name)\n          bound.set(name, node['init'] as AnyNode)\n        } else {\n          poisonPattern(id)\n        }\n      } else if (node.type === 'AssignmentExpression') {\n        poisonPattern(node['left'] as AnyNode)\n      } else if (node.type === 'UpdateExpression') {\n        poisonPattern(node['argument'] as AnyNode)\n      } else if (\n        node.type === 'FunctionDeclaration' ||\n        node.type === 'FunctionExpression' ||\n        node.type === 'ArrowFunctionExpression'\n      ) {\n        ;((node['params'] ?? []) as AnyNode[]).forEach(poisonPattern)\n        if ((node['id'] as AnyNode)?.type === 'Identifier')\n          poison((node['id'] as AnyNode)['name'])\n      } else if (node.type === 'CatchClause') {\n        poisonPattern(node['param'] as AnyNode)\n      } else if (\n        node.type === 'ClassDeclaration' ||\n        node.type === 'ClassExpression'\n      ) {\n        if ((node['id'] as AnyNode)?.type === 'Identifier')\n          poison((node['id'] as AnyNode)['name'])\n      }\n    })\n    // Two passes, so `const BASE = 'https://x'` then `BASE + '/y'` resolves.\n    // A third buys almost nothing and each is a full re-read of the bindings.\n    for (let pass = 0; pass < 2; pass += 1) {\n      for (const [name, init] of bound) {\n        if (poisoned.has(name) || constants.has(name)) continue\n        const value = staticString(init, constants)\n        if (value !== null) constants.set(name, value)\n      }\n    }\n  }\n\n  // Local name -> the callable it stands for (AGL-1090). `const f = fetch`,\n  // `const d = globalThis.fetch`, `const {fetch: h} = globalThis`.\n  const callableAliases = new Map<string, string>()\n  /** The aliasable callable an initializer denotes, if any. */\n  const callableFrom = (init: AnyNode | null | undefined): string | null => {\n    if (!init) return null\n    if (\n      init.type === 'Identifier' &&\n      ALIASABLE_CALLABLES.has(init['name'] as string)\n    ) {\n      return init['name'] as string\n    }\n    // `globalThis.fetch` / `window['fe' + 'tch']` — the property is what the\n    // name will stand for, and only when the object is a global (an unknown\n    // object's `.fetch` is somebody else's method).\n    if (init.type === 'MemberExpression') {\n      const property = propertyName(init)\n      const object = init['object'] as AnyNode\n      if (\n        property &&\n        ALIASABLE_CALLABLES.has(property) &&\n        object?.type === 'Identifier' &&\n        (GLOBAL_ROOTS.has(object['name'] as string) ||\n          aliases.has(object['name'] as string))\n      ) {\n        return property\n      }\n    }\n    return null\n  }\n  const noteCallableAlias = (\n    id: AnyNode | null | undefined,\n    init: AnyNode | null | undefined,\n  ) => {\n    if (!id) return\n    if (id.type === 'Identifier') {\n      const callable = callableFrom(init)\n      if (callable) callableAliases.set(id['name'] as string, callable)\n      return\n    }\n    // `const { fetch } = globalThis` and `const { fetch: h } = globalThis`.\n    if (id.type === 'ObjectPattern' && init) {\n      const fromGlobal =\n        init.type === 'Identifier' &&\n        (GLOBAL_ROOTS.has(init['name'] as string) ||\n          aliases.has(init['name'] as string))\n      if (!fromGlobal) return\n      for (const property of (id['properties'] ?? []) as AnyNode[]) {\n        const key = property['key'] as AnyNode\n        const value = property['value'] as AnyNode\n        const name =\n          key?.type === 'Identifier' ? (key['name'] as string) : staticString(key)\n        if (\n          name &&\n          ALIASABLE_CALLABLES.has(name) &&\n          value?.type === 'Identifier'\n        ) {\n          callableAliases.set(value['name'] as string, name)\n        }\n      }\n    }\n  }\n\n  // Global-object aliases first, as a complete pass: the callable pass below\n  // resolves `g.fetch` against them, and walk order is not source order.\n  walk(program, (node) => {\n    if (node.type === 'VariableDeclarator') {\n      const id = node['id'] as AnyNode\n      if (id?.type === 'Identifier')\n        noteAlias(id['name'], node['init'] as AnyNode)\n    } else if (\n      node.type === 'AssignmentExpression' &&\n      node['operator'] === '='\n    ) {\n      const left = node['left'] as AnyNode\n      if (left?.type === 'Identifier')\n        noteAlias(left['name'], node['right'] as AnyNode)\n    }\n  })\n  walk(program, (node) => {\n    if (node.type === 'VariableDeclarator') {\n      noteCallableAlias(node['id'] as AnyNode, node['init'] as AnyNode)\n    } else if (\n      node.type === 'AssignmentExpression' &&\n      node['operator'] === '='\n    ) {\n      noteCallableAlias(node['left'] as AnyNode, node['right'] as AnyNode)\n    }\n  })\n\n  const isGlobalRef = (node: AnyNode | null | undefined): boolean =>\n    !!node &&\n    node.type === 'Identifier' &&\n    (GLOBAL_ROOTS.has(node['name'] as string) ||\n      aliases.has(node['name'] as string))\n\n  const declared = options?.declaredNetwork\n  const allowlist = new Set(\n    (declared ?? []).map((origin) => {\n      try {\n        return new URL(origin).origin\n      } catch {\n        return origin\n      }\n    }),\n  )\n  for (const message of lookalikeDeclaredOrigins(declared ?? [])) {\n    add('warning', 'network', message)\n  }\n  /** Level for a network finding: a claim only when we know what was declared. */\n  const networkLevel: BundleCheckProblem['level'] = declared\n    ? 'error'\n    : 'warning'\n  // What the bundle reaches for, so the summary row can SAY it (AGL-1087) —\n  // \"calls https://api.stripe.com, declared\" is the line a reviewer would\n  // otherwise open the bundle to get.\n  const networkApis = new Set<string>()\n  const networkOrigins = new Set<string>()\n  let runtimeUrls = 0\n  /** Origins handed to a callee the checker could not resolve (AGL-1090). */\n  const unresolvedOrigins = new Set<string>()\n  const noteNetwork = (api: string, urlArg: AnyNode | undefined) => {\n    const origin = literalOrigin(urlArg, constants)\n    networkApis.add(api)\n    if (origin) networkOrigins.add(origin)\n    else runtimeUrls += 1\n    if (!declared) {\n      add(\n        'warning',\n        'network',\n        `bundle makes network calls (${api}) — check them against the ` +\n          \"manifest's declared network capability\",\n      )\n      return\n    }\n    if (!allowlist.size) {\n      add(\n        networkLevel,\n        'network',\n        `bundle calls ${api} but the manifest declares no network ` +\n          'capability — declare every origin under capabilities.network ' +\n          '(the CSP blocks the rest at runtime)',\n      )\n      return\n    }\n    if (!origin) {\n      add(\n        'warning',\n        'network',\n        `${api} is called with a URL that is only known at runtime — it ` +\n          'cannot be checked against the declared origins',\n      )\n      return\n    }\n    if (!allowlist.has(origin)) {\n      add(\n        networkLevel,\n        'network',\n        `${api} calls ${origin}, which the manifest does not declare ` +\n          `(declared: ${[...allowlist].join(', ')})`,\n      )\n    }\n  }\n\n  /**\n   * A call the checker could not resolve, given an absolute URL.\n   *\n   * Reported as a QUESTION, never a refusal: most of these are helpers, and\n   * refusing every unrecognised call that mentions a URL would make the\n   * verifier useless. But leaving them silent is what let the network row\n   * claim \"no network calls\" over a bundle whose calls it simply could not\n   * follow — and a URL to an origin the manifest never declared is exactly\n   * what a reviewer should be pointed at.\n   */\n  const noteUnresolvedUrl = (\n    name: string | null,\n    urlArg: AnyNode | undefined,\n  ) => {\n    if (name && URL_TAKING_NON_CALLS.has(name)) return\n    const origin = literalOrigin(urlArg, constants)\n    if (!origin) return\n    // A declared origin is consistent with the manifest and permitted by the\n    // CSP, so there is no question to raise about it.\n    if (allowlist.has(origin)) return\n    unresolvedOrigins.add(origin)\n    add(\n      'warning',\n      'network',\n      `${name ? `${name}()` : 'a call'} is passed ${origin}, which the ` +\n        'manifest does not declare — the checker could not tell whether it ' +\n        'reaches the network, so read this call',\n    )\n  }\n\n  let exportsRegister = false\n  let exportsRegisterApi = false\n  const noteExport = (name: unknown) => {\n    if (name === 'register') exportsRegister = true\n    else if (name === 'registerApi') exportsRegisterApi = true\n  }\n\n  let obfuscatedNames = 0\n\n  walk(program, (node) => {\n    switch (node.type) {\n      // ---- entry exports + self-containment ----\n      case 'ImportDeclaration':\n        add(\n          'error',\n          'self-contained',\n          'bundle has static imports — realm bundles must be self-contained ' +\n            '(react/@aglyn/aglyn come from the host ABI; see the realm rollup ' +\n            'template)',\n        )\n        break\n      case 'ExportAllDeclaration':\n      case 'ExportNamedDeclaration': {\n        if (node['source']) {\n          add(\n            'error',\n            'self-contained',\n            'bundle re-exports from another module — realm bundles must be ' +\n              'self-contained (see the realm rollup template)',\n          )\n        }\n        const declaration = node['declaration'] as AnyNode | null\n        if (declaration) {\n          if (declaration['id'])\n            noteExport((declaration['id'] as AnyNode)['name'])\n          for (const declarator of (declaration['declarations'] ??\n            []) as AnyNode[]) {\n            const id = declarator['id'] as AnyNode\n            if (id?.type === 'Identifier') noteExport(id['name'])\n          }\n        }\n        for (const specifier of (node['specifiers'] ?? []) as AnyNode[]) {\n          const exported = specifier['exported'] as AnyNode\n          noteExport(\n            exported?.type === 'Identifier'\n              ? exported['name']\n              : staticString(exported),\n          )\n        }\n        break\n      }\n\n      // ---- dynamic import ----\n      case 'ImportExpression': {\n        const specifier = staticString(node['source'] as AnyNode, constants)\n        if (specifier === null) {\n          add(\n            'error',\n            'dynamic-import',\n            'dynamic import with a specifier computed at runtime is not ' +\n              'allowed — the loader cannot know what would be fetched',\n          )\n        } else if (/^https?:/i.test(specifier)) {\n          add(\n            'error',\n            'dynamic-import',\n            'dynamic import of remote URLs is not allowed',\n          )\n        }\n        break\n      }\n\n      // ---- calls ----\n      case 'CallExpression':\n      case 'NewExpression': {\n        const callee = node['callee'] as AnyNode\n        const args = (node['arguments'] ?? []) as AnyNode[]\n        const written =\n          callee?.type === 'Identifier'\n            ? (callee['name'] as string)\n            : callee?.type === 'MemberExpression'\n              ? propertyName(callee, constants)\n              : null\n        // An alias resolves to what it stands for (AGL-1090), so `f(url)`\n        // after `const f = fetch` is a fetch call.\n        const name =\n          (written && callableAliases.get(written)) ?? written ?? null\n\n        if (name === 'eval')\n          add('error', 'code-execution', 'eval() is not allowed')\n        if (name === 'Function')\n          add(\n            'error',\n            'code-execution',\n            'the Function constructor is not allowed',\n          )\n        // `(()=>{}).constructor('return 1')()` — the Function constructor\n        // reached through any function value, which is why the CALL is the\n        // finding rather than the name `Function`.\n        if (name === 'constructor' && callee?.type === 'MemberExpression')\n          add(\n            'error',\n            'code-execution',\n            'calling .constructor() is not allowed — it reaches the ' +\n              'Function constructor from any function value',\n          )\n        if (name && NETWORK_CALLS.has(name)) noteNetwork(name, args[0])\n        else if (name && NETWORK_CONSTRUCTORS.has(name))\n          noteNetwork(name, node.type === 'NewExpression' ? args[0] : args[1])\n        // Something we could not follow, handed an absolute URL (AGL-1090).\n        // Not a refusal — it may be a helper, a logger, or a link — but the\n        // network row must stop rendering \"no network calls\" over it.\n        else noteUnresolvedUrl(name, args[0])\n        break\n      }\n\n      // ---- member access ----\n      case 'MemberExpression': {\n        const object = node['object'] as AnyNode\n        const name = propertyName(node, constants)\n        if (isGlobalRef(object) && name === null) {\n          add(\n            'error',\n            'globals',\n            `computed property access on ${\n              (object['name'] as string) || 'a global'\n            } is not allowed — a property chosen at runtime cannot be ` +\n              'reviewed',\n          )\n          break\n        }\n        // Property names only mean anything on a global: `response.cookie`\n        // and `state.localStorage` are somebody else's object.\n        if (name === 'cookie' && isGlobalRef(object))\n          add('error', 'storage', 'document.cookie access is not allowed')\n        if (name && STORAGE_NAMES.has(name) && isGlobalRef(object))\n          add(\n            'error',\n            'storage',\n            'browser storage access is not allowed (use host-mediated data)',\n          )\n        if (name === 'eval' && isGlobalRef(object))\n          add('error', 'code-execution', 'eval() is not allowed')\n        break\n      }\n\n      // ---- bare references ----\n      case 'Identifier': {\n        const name = node['name'] as string\n        if (STORAGE_NAMES.has(name))\n          add(\n            'error',\n            'storage',\n            'browser storage access is not allowed (use host-mediated data)',\n          )\n        if (OBFUSCATED_NAME.test(name)) obfuscatedNames += 1\n        break\n      }\n\n      // ---- obfuscation ----\n      case 'Literal': {\n        const value = node['value']\n        if (\n          typeof value === 'string' &&\n          value.length >= MIN_SUSPICIOUS_BASE64 &&\n          BASE64_BLOB.test(value)\n        ) {\n          add(\n            'warning',\n            'obfuscation',\n            `bundle embeds a ${value.length}-character base64 literal — ` +\n              'decode it before approving',\n          )\n        }\n        break\n      }\n      default:\n        break\n    }\n  })\n\n  if (!exportsRegister && !exportsRegisterApi) {\n    add(\n      'error',\n      'entry',\n      'bundle exports neither register(host) nor registerApi() — ' +\n        'nothing for the loader to call',\n    )\n  }\n\n  if (obfuscatedNames >= MIN_OBFUSCATED_NAMES) {\n    add(\n      'warning',\n      'obfuscation',\n      `bundle uses ${obfuscatedNames} machine-obfuscated identifiers ` +\n        '(_0x… naming) — minifiers do not produce these',\n    )\n  }\n  const longestLine = source\n    .split('\\n')\n    .reduce((longest, line) => Math.max(longest, line.length), 0)\n  if (longestLine > MAX_READABLE_LINE) {\n    add(\n      'warning',\n      'obfuscation',\n      `bundle has a single ${longestLine}-character line — nothing on it ` +\n        'can be read in review; ask for a readable build or a source map',\n    )\n  }\n\n  details.set(\n    'entry',\n    [\n      exportsRegister ? 'register(host)' : null,\n      exportsRegisterApi ? 'registerApi()' : null,\n    ]\n      .filter(Boolean)\n      .join(', ') || 'none',\n  )\n\n  // What the network check actually saw. Without the manifest it saw the\n  // calls but could not judge them, and that is `unknown`, not a pass — the\n  // row a reviewer must not read as \"checked and fine\".\n  if (!declared) {\n    if (networkApis.size) {\n      status.set('network', 'unknown')\n      details.set(\n        'network',\n        `calls ${[...networkApis].join(', ')} — no declared origins were ` +\n          'supplied, so nothing was compared',\n      )\n    } else {\n      details.set('network', 'no network calls')\n    }\n  } else if (!networkApis.size) {\n    details.set(\n      'network',\n      unresolvedOrigins.size\n        ? `no resolved network calls, but ${[...unresolvedOrigins].join(', ')} ` +\n            'is passed to a call the checker could not follow'\n        : 'no network calls',\n    )\n  } else {\n    const origins = networkOrigins.size\n      ? [...networkOrigins]\n          .map((origin) =>\n            allowlist.has(origin) ? `${origin} (declared)` : `${origin} (NOT declared)`,\n          )\n          .join(', ')\n      : ''\n    details.set(\n      'network',\n      [\n        `calls ${[...networkApis].join(', ')}`,\n        origins,\n        runtimeUrls\n          ? `${runtimeUrls} call(s) with a URL only known at runtime`\n          : '',\n      ]\n        .filter(Boolean)\n        .join(' · '),\n    )\n  }\n\n  const abi = hostAbiReads(program, constants, isGlobalRef)\n  for (const key of abi.unknown) {\n    add(\n      'error',\n      'host-abi',\n      `bundle reads \"${key}\" from the host, which provides only ` +\n        `${PLUGIN_HOST_ABI_KEYS.join(', ')} — it would be undefined on every site`,\n    )\n  }\n  for (const key of abi.unknownOnParam) {\n    add(\n      'warning',\n      'host-abi',\n      `register() reads \"${key}\" from its host argument, which provides only ` +\n        `${PLUGIN_HOST_ABI_KEYS.join(', ')} — it will be undefined`,\n    )\n  }\n  if (abi.computedOnParam) {\n    add(\n      'warning',\n      'host-abi',\n      `register() reads its host argument by a key chosen at runtime ` +\n        `(${abi.computedOnParam}×)`,\n    )\n  }\n  if (abi.computed) {\n    add(\n      'error',\n      'host-abi',\n      `bundle reads the host by a key chosen at runtime (${abi.computed}×) — ` +\n        'a lookup that cannot be named cannot be reviewed',\n    )\n  }\n  // Each name the bundle reads from a host module must be one the host holds\n  // (AGL-3392): core's realm plugin surface, or the whole of the others.\n  for (const key of PLUGIN_HOST_MODULE_KEYS) {\n    const read = abi.imports[key]\n    if (!read) continue\n    const holds = REALM_HOST_SURFACE_NAMES[key]\n    if (read === '*') {\n      if (key === 'aglyn') {\n        add(\n          'warning',\n          'host-abi',\n          'uses @aglyn/aglyn as a namespace value — only the realm plugin ' +\n            'surface is on the host, so any other name read through it is ' +\n            'undefined; import what you use by name',\n        )\n      }\n      continue\n    }\n    const missing = read.filter((name) => !holds.has(name))\n    if (missing.length) {\n      add(\n        'error',\n        'host-abi',\n        `reads ${missing.join(', ')} from the host's ${key}, which does not ` +\n          `hold ${missing.length === 1 ? 'it' : 'them'}` +\n          (key === 'aglyn'\n            ? ' — only the realm plugin surface of @aglyn/aglyn is on the host'\n            : ''),\n      )\n    }\n  }\n  details.set(\n    'host-abi',\n    abi.read.size ? `reads ${[...abi.read].sort().join(', ')}` : 'reads nothing by name',\n  )\n\n  const detected = detectRegistrations(program, constants)\n  for (const message of credentialInputsIn(program, constants)) {\n    add('warning', 'credentials', message)\n  }\n  compareContributions(detected, options, add, details, (check) =>\n    status.set(check, 'unknown'),\n  )\n\n  return {\n    ok: !problems.some((problem) => problem.level === 'error'),\n    problems,\n    checks: summarise(),\n    exports: { register: exportsRegister, registerApi: exportsRegisterApi },\n    contributions: detected,\n  }\n}\n\n/**\n * Run the checks over a bundle. NEVER throws (AGL-1094).\n *\n * The publish route calls this directly, so an unexpected failure in here\n * used to mean a 500 and no explanation for the publisher — and in the review\n * sweep it looked exactly like a missing artifact, which sent the\n * investigation to the storage bucket instead of to this file. A checker that\n * cannot analyse a bundle has an answer: say so, in the verdict, as an error.\n */\nexport function checkPluginBundle(\n  source: string,\n  options?: CheckOptions,\n): BundleCheckResult {\n  try {\n    return analyseBundle(source, options)\n  } catch (error) {\n    return {\n      ok: false,\n      problems: [\n        {\n          level: 'error',\n          check: 'parse',\n          message:\n            'the verifier failed on this bundle — treat it as unchecked and ' +\n            `report it: ${\n              error instanceof Error ? error.message : String(error)\n            }`,\n        },\n      ],\n      checks: CHECK_ORDER.map((id) => ({\n        id,\n        label: CHECK_LABELS[id],\n        status: id === 'parse' ? 'fail' : 'unknown',\n      })),\n      exports: { register: false, registerApi: false },\n      contributions: NOTHING_DETECTED,\n    }\n  }\n}\n"],"names":["parse","credentialForInputAttribute","credentialInHtml","lookalikeBrandForHost","PLUGIN_HOST_ABI_KEYS","PLUGIN_HOST_GLOBAL","PLUGIN_HOST_MODULE_KEYS","REALM_HOST_SURFACE_NAMES","CHECK_LABELS","entry","size","globals","storage","network","obfuscation","contributions","credentials","CHECK_ORDER","MAX_PLUGIN_BUNDLE_BYTES","PLUGIN_VERIFIER_VERSION","isStoredVerdictCurrent","stored","sha256","Number","verifierVersion","GLOBAL_ROOTS","Set","STORAGE_NAMES","NETWORK_CALLS","NETWORK_CONSTRUCTORS","ALIASABLE_CALLABLES","URL_TAKING_NON_CALLS","MAX_READABLE_LINE","MIN_SUSPICIOUS_BASE64","MIN_OBFUSCATED_NAMES","MAX_PROBLEMS","OBFUSCATED_NAME","BASE64_BLOB","skippedChild","node","key","type","walk","root","visit","stack","length","pop","Object","keys","value","Array","isArray","item","push","staticString","constants","get","expressions","quasis","cooked","out","index","filled","left","right","propertyName","property","literalOrigin","url","URL","test","protocol","origin","NOTHING_DETECTED","contributes","unresolved","REGISTRATION_CALLS","SHELL_EXTENSION_FIELDS","detectRegistrations","program","slots","routes","orgRoutes","components","features","shell","objectProperty","object","name","undefined","keyName","listOf","slotName","literal","callee","has","args","extension","add","widgets","list","widget","slot","field","into","href","id","site","sort","console","describeContributions","parts","join","compareContributions","detected","options","details","markUnknown","found","declared","registers","registersSomething","Boolean","unreadable","declaredContributions","set","requireContributions","JSON","stringify","missing","label","registered","listed","consequence","includes","unused","credentialInputsIn","keyOf","text","map","quasi","String","words","password","card","otp","lookalikeDeclaredOrigins","messages","host","hostname","brand","walkWithParents","parent","children","child","FUNCTION_TYPES","SCOPE_TYPES","patternNames","pattern","element","lexicalNames","statements","statement","declarator","varNames","entries","declaredNames","scope","names","param","body","branch","head","isReference","hostAbiReads","isGlobalRef","parents","Map","identifiers","scopeNames","namesOf","bindingScope","declaration","functionScoped","at","resolvesTo","ref","isHostGlobal","hostNames","init","roots","some","hostRef","binding","modules","allowed","read","unknown","unknownOnParam","computed","computedOnParam","whole","note","current","seenAliases","useOf","alias","use","propertyKey","via","imports","analyseBundle","source","problems","seen","status","level","check","message","unknownFrom","ids","summarise","detail","maxBytes","bytes","TextEncoder","encode","byteLength","toLocaleString","ok","checks","exports","register","registerApi","parseOptions","ecmaVersion","sourceType","allowHashBang","allowAwaitOutsideFunction","error","Error","aliases","noteAlias","bound","poisoned","poison","poisonPattern","forEach","pass","callableAliases","callableFrom","noteCallableAlias","callable","fromGlobal","declaredNetwork","allowlist","networkLevel","networkApis","networkOrigins","runtimeUrls","unresolvedOrigins","noteNetwork","api","urlArg","noteUnresolvedUrl","exportsRegister","exportsRegisterApi","noteExport","obfuscatedNames","specifier","exported","written","longestLine","split","reduce","longest","line","Math","max","filter","origins","abi","holds","problem","checkPluginBundle"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;CAmBC,GAED,SAASA,KAAK,QAAiC,QAAO;AACtD,4EAA4E;AAC5E,oDAAoD;AACpD,SACEC,2BAA2B,EAC3BC,gBAAgB,QACX,8CAA6C;AACpD,SAASC,qBAAqB,QAAQ,oDAAmD;AAEzF,SACEC,oBAAoB,EACpBC,kBAAkB,EAClBC,uBAAuB,QAClB,uBAAmB;AAC1B,SAASC,wBAAwB,QAAQ,oCAAgC;AAuEzE,MAAMC,eAA8C;IAClDR,OAAO;IACPS,OAAO;IACP,kBAAkB;IAClB,YAAY;IACZC,MAAM;IACN,kBAAkB;IAClBC,SAAS;IACTC,SAAS;IACT,kBAAkB;IAClBC,SAAS;IACTC,aAAa;IACbC,eAAe;IACfC,aAAa;AACf;AAEA,6EAA6E,GAC7E,MAAMC,cAA+B;IACnC;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD;AAED,OAAO,MAAMC,0BAA0B,QAAS;AAEhD;;;;;;;;;;;;;;;;;;;CAmBC,GACD,OAAO,MAAMC,0BAA0B,GAAE;AAYzC;;;;;;;;CAQC,GACD,OAAO,SAASC,uBACdC,MAA8C,EAC9CC,MAAc;IAEd,IAAI,CAACD,UAAU,CAACC,QAAQ,OAAO;IAC/B,OACED,OAAOC,MAAM,KAAKA,UAClBC,OAAOF,OAAOG,eAAe,MAAML;AAEvC;AAEA;;;;;CAKC,GACD,MAAMM,eAAe,IAAIC,IAAI;IAC3B;IACA;IACA;IACA;IACA;IACA;IACA;CACD;AAED,gFAAgF,GAChF,MAAMC,gBAAgB,IAAID,IAAI;IAAC;IAAgB;IAAkB;CAAY;AAE7E,yEAAyE,GACzE,MAAME,gBAAgB,IAAIF,IAAI;IAAC;IAAS;CAAa;AACrD,MAAMG,uBAAuB,IAAIH,IAAI;IACnC;IACA;IACA;CACD;AAED;;;;;;;;;;;CAWC,GACD,MAAMI,sBAAsB,IAAIJ,IAAI;IAClC;IACA;IACA;IACA;IACA;IACA;IACA;CACD;AAED;;;;;CAKC,GACD,MAAMK,uBAAuB,IAAIL,IAAI;IACnC;IACA;IACA;IACA;CACD;AAED,kEAAkE,GAClE,MAAMM,oBAAoB;AAC1B,yEAAyE,GACzE,MAAMC,wBAAwB;AAC9B,0EAA0E,GAC1E,MAAMC,uBAAuB;AAC7B,6DAA6D,GAC7D,MAAMC,eAAe;AAErB,MAAMC,kBAAkB;AACxB,MAAMC,cAAc;AAIpB;;;;;CAKC,GACD,MAAMC,eAAe,CAACC,MAAeC;IACnC,OAAQD,KAAKE,IAAI;QACf,KAAK;YACH,OAAOD,QAAQ,cAAc,CAACD,IAAI,CAAC,WAAW;QAChD,KAAK;QACL,KAAK;QACL,KAAK;YACH,OAAOC,QAAQ,SAAS,CAACD,IAAI,CAAC,WAAW;QAC3C,KAAK;QACL,KAAK;QACL,KAAK;YACH,OAAOC,QAAQ;QACjB,KAAK;QACL,KAAK;YACH,OAAO;QACT;YACE,OAAO;IACX;AACF;AAEA,sEAAsE,GACtE,SAASE,KAAKC,IAAa,EAAEC,KAA8B;IACzD,MAAMC,QAAmB;QAACF;KAAK;IAC/B,MAAOE,MAAMC,MAAM,CAAE;QACnB,MAAMP,OAAOM,MAAME,GAAG;QACtB,IAAI,CAACR,MAAM;QACXK,MAAML;QACN,KAAK,MAAMC,OAAOQ,OAAOC,IAAI,CAACV,MAAO;YACnC,IAAIC,QAAQ,UAAUA,QAAQ,WAAWA,QAAQ,OAAO;YACxD,IAAIF,aAAaC,MAAMC,MAAM;YAC7B,MAAMU,QAAQX,IAAI,CAACC,IAAI;YACvB,IAAIW,MAAMC,OAAO,CAACF,QAAQ;gBACxB,KAAK,MAAMG,QAAQH,MAAO;oBACxB,IAAIG,QAAQ,OAAOA,SAAS,YAAY,OAAOA,KAAKZ,IAAI,KAAK,UAC3DI,MAAMS,IAAI,CAACD;gBACf;YACF,OAAO,IACLH,SACA,OAAOA,UAAU,YACjB,OAAO,AAACA,MAAkBT,IAAI,KAAK,UACnC;gBACAI,MAAMS,IAAI,CAACJ;YACb;QACF;IACF;AACF;AAEA;;;;;CAKC,GACD,SAASK,aACPhB,IAAgC,EAChCiB,SAAuC;QAU9BA;IART,IAAI,CAACjB,MAAM,OAAO;IAClB,IAAIA,KAAKE,IAAI,KAAK,WAChB,OAAO,OAAOF,IAAI,CAAC,QAAQ,KAAK,WAAYA,IAAI,CAAC,QAAQ,GAAc;IACzE,uEAAuE;IACvE,yEAAyE;IACzE,yEAAyE;IACzE,wCAAwC;IACxC,IAAIA,KAAKE,IAAI,KAAK,gBAAgBe,WAChC,QAAOA,iBAAAA,UAAUC,GAAG,CAAClB,IAAI,CAAC,OAAO,aAA1BiB,iBAAyC;IAClD,IAAIjB,KAAKE,IAAI,KAAK,mBAAmB;YACdF,mBACLA;QADhB,MAAMmB,eAAenB,oBAAAA,IAAI,CAAC,cAAc,YAAnBA,oBAAuB,EAAE;QAC9C,MAAMoB,UAAUpB,eAAAA,IAAI,CAAC,SAAS,YAAdA,eAAkB,EAAE;QAGpC,IAAI,CAACmB,YAAYZ,MAAM,EAAE;;gBACMa,gBAAAA;YAA7B,OAAOA,OAAOb,MAAM,KAAK,aAAIa,WAAAA,MAAM,CAAC,EAAE,sBAATA,iBAAAA,SAAWT,KAAK,qBAAhBS,eAAkBC,MAAM,mBAAI,OAAO;QAClE;QACA,yDAAyD;QACzD,IAAIC,MAAM;QACV,IAAK,IAAIC,QAAQ,GAAGA,QAAQH,OAAOb,MAAM,EAAEgB,SAAS,EAAG;;gBAC9CH,qBAAAA;YAAPE,iBAAOF,gBAAAA,MAAM,CAACG,MAAM,sBAAbH,sBAAAA,cAAeT,KAAK,qBAApBS,oBAAsBC,MAAM,oBAAI;YACvC,IAAIE,QAAQJ,YAAYZ,MAAM,EAAE;gBAC9B,MAAMiB,SAASR,aAAaG,WAAW,CAACI,MAAM,EAAEN;gBAChD,IAAIO,WAAW,MAAM,OAAO;gBAC5BF,OAAOE;YACT;QACF;QACA,OAAOF;IACT;IACA,IAAItB,KAAKE,IAAI,KAAK,sBAAsBF,IAAI,CAAC,WAAW,KAAK,KAAK;QAChE,MAAMyB,OAAOT,aAAahB,IAAI,CAAC,OAAO,EAAaiB;QACnD,MAAMS,QAAQV,aAAahB,IAAI,CAAC,QAAQ,EAAaiB;QACrD,OAAOQ,SAAS,QAAQC,UAAU,OAAOD,OAAOC,QAAQ;IAC1D;IACA,OAAO;AACT;AAEA,kEAAkE,GAClE,SAASC,aACP3B,IAAa,EACbiB,SAAuC;IAEvC,MAAMW,WAAW5B,IAAI,CAAC,WAAW;IACjC,IAAI,CAACA,IAAI,CAAC,WAAW,EACnB,OAAO4B,CAAAA,4BAAAA,SAAU1B,IAAI,MAAK,eACrB0B,QAAQ,CAAC,OAAO,GACjB;IACN,OAAOZ,aAAaY,UAAUX;AAChC;AAEA;;;;;;;;CAQC,GACD,SAASY,cACP7B,IAAyB,EACzBiB,SAAuC;IAEvC,MAAMN,QAAQK,aAAahB,MAAMiB;IACjC,IAAI,CAACN,OAAO,OAAO;IACnB,IAAI;QACF,MAAMmB,MAAM,IAAIC,IAAIpB;QACpB,OAAO,YAAYqB,IAAI,CAACF,IAAIG,QAAQ,IAAIH,IAAII,MAAM,GAAG;IACvD,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAgCA,yDAAyD,GACzD,MAAMC,mBAA0C;IAAEC,aAAa,CAAC;IAAGC,YAAY,EAAE;AAAC;AAElF;;;;;CAKC,GACD,MAAMC,qBAAqB,IAAInD,IAAI;IACjC;IACA;IACA;IACA;IACA;CACD;AAED;;;;CAIC,GACD,MAAMoD,yBAAyB;IAC7B;IACA;IACA;IACA;IACA;IACA;CACD;AAED;;;;;;;;CAQC,GACD,SAASC,oBACPC,OAAgB,EAChBxB,SAAsC;IAEtC,MAAMyB,QAAQ,IAAIvD;IAClB,MAAMwD,SAAS,IAAIxD;IACnB,MAAMyD,YAAY,IAAIzD;IACtB,MAAM0D,aAAa,IAAI1D;IACvB,MAAM2D,WAAW,IAAI3D;IACrB,MAAMkD,aAAa,IAAIlD;IACvB,IAAI4D,QAAQ;IAEZ,MAAMC,iBAAiB,CACrBC,QACAC;YAGwBD;QADxB,IAAIA,CAAAA,0BAAAA,OAAQ/C,IAAI,MAAK,oBAAoB,OAAOiD;QAChD,KAAK,MAAMvB,aAAaqB,qBAAAA,MAAM,CAAC,aAAa,YAApBA,qBAAwB,EAAE,CAAgB;YAChE,IAAIrB,SAAS1B,IAAI,KAAK,YAAY;YAClC,MAAMD,MAAM2B,QAAQ,CAAC,MAAM;YAC3B,MAAMwB,UACJ,CAACxB,QAAQ,CAAC,WAAW,IAAI3B,CAAAA,uBAAAA,IAAKC,IAAI,MAAK,eAClCD,GAAG,CAAC,OAAO,GACZe,aAAaf,KAAKgB;YACxB,IAAImC,YAAYF,MAAM,OAAOtB,QAAQ,CAAC,QAAQ;QAChD;QACA,OAAOuB;IACT;IACA,MAAME,SAAS,CAACrD;YACuBA;eAArCA,CAAAA,wBAAAA,KAAME,IAAI,MAAK,qBAAsBF,iBAAAA,IAAI,CAAC,WAAW,YAAhBA,iBAAoB,EAAE,GAAkB;;IAC/E,4DAA4D;IAC5D,wEAAwE;IACxE,MAAMsD,WAAW,CAACtD;QAChB,MAAMuD,UAAUvC,aAAahB,MAAMiB;QACnC,IAAIsC,YAAY,MAAM,OAAOA;QAC7B,OAAOvD,CAAAA,wBAAAA,KAAME,IAAI,MAAK,qBAAqByB,aAAa3B,MAAMiB,aAAa;IAC7E;IAEAd,KAAKsC,SAAS,CAACzC;YAUCA;QATd,IAAIA,KAAKE,IAAI,KAAK,kBAAkB;QACpC,MAAMsD,SAASxD,IAAI,CAAC,SAAS;QAC7B,MAAMkD,OACJM,CAAAA,0BAAAA,OAAQtD,IAAI,MAAK,eACZsD,MAAM,CAAC,OAAO,GACfA,CAAAA,0BAAAA,OAAQtD,IAAI,MAAK,qBACfyB,aAAa6B,QAAQvC,aACrB;QACR,IAAI,CAACiC,QAAQ,CAACZ,mBAAmBmB,GAAG,CAACP,OAAO;QAC5C,MAAMQ,QAAQ1D,kBAAAA,IAAI,CAAC,YAAY,YAAjBA,kBAAqB,EAAE;QACrC,IAAIkD,SAAS,4BAA4B;YACvC,MAAMS,YAAYD,IAAI,CAAC,EAAE;YACzB,IAAIC,CAAAA,6BAAAA,UAAWzD,IAAI,MAAK,oBAAoB;gBAC1CmC,WAAWuB,GAAG,CAAC;gBACf;YACF;YACA,MAAMC,UAAUb,eAAeW,WAAW;YAC1C,IAAIE,SAAS;gBACX,MAAMC,OAAOT,OAAOQ;gBACpB,IAAI,CAACC,MAAMzB,WAAWuB,GAAG,CAAC;gBAC1B,KAAK,MAAMG,UAAUD,eAAAA,OAAQ,EAAE,CAAE;oBAC/B,MAAME,OAAOV,SAASN,eAAee,QAAQ;oBAC7C,IAAIC,MAAMtB,MAAMkB,GAAG,CAACI;yBACf3B,WAAWuB,GAAG,CAAC;gBACtB;YACF;YACA,KAAK,MAAMK,SAAS1B,uBAAwB;gBAC1C,MAAM5B,QAAQqC,eAAeW,WAAWM;gBACxC,IAAI,CAACtD,OAAO;gBACZoC,QAAQ;gBACR,IAAIkB,UAAU,cAAcA,UAAU,eAAe;gBACrD,MAAMC,OAAOD,UAAU,aAAatB,SAASC;gBAC7C,MAAMkB,OAAOT,OAAO1C;gBACpB,IAAI,CAACmD,MAAMzB,WAAWuB,GAAG,CAAC,CAAC,QAAQ,EAAEK,MAAM,iBAAiB,CAAC;gBAC7D,KAAK,MAAMnD,QAAQgD,eAAAA,OAAQ,EAAE,CAAE;oBAC7B,MAAMK,OAAOnD,aAAagC,eAAelC,MAAM,SAASG;oBACxD,IAAIkD,MAAMD,KAAKN,GAAG,CAACO;yBACd9B,WAAWuB,GAAG,CAAC,CAAC,UAAU,EAAEK,MAAM,qCAAqC,CAAC;gBAC/E;YACF;YACA;QACF;QACA,IAAIf,SAAS,uBAAuB;YAClC,MAAMkB,KAAKpD,aAAagC,eAAeU,IAAI,CAAC,EAAE,EAAE,cAAczC;YAC9D,IAAImD,IAAItB,SAASc,GAAG,CAACQ;iBAChB/B,WAAWuB,GAAG,CAAC;YACpB;QACF;QACA,IAAIV,SAAS,qBAAqB;YAChC,MAAMkB,KAAKpD,aAAagC,eAAeU,IAAI,CAAC,EAAE,EAAE,QAAQzC;YACxD,IAAImD,IAAIvB,WAAWe,GAAG,CAACQ;iBAClB/B,WAAWuB,GAAG,CAAC;YACpB;QACF;QACA,sEAAsE;QACtE,iEAAiE;QACjEvB,WAAWuB,GAAG,CAAC;IACjB;IAEA,MAAMxB,cAAmC,CAAC;IAC1C,IAAIS,WAAW1E,IAAI,IAAI2E,SAAS3E,IAAI,EAAE;QACpCiE,YAAYiC,IAAI,GAAG,aACbxB,WAAW1E,IAAI,GAAG;YAAE0E,YAAY;mBAAIA;aAAW,CAACyB,IAAI;QAAG,IAAI,CAAC,GAC5DxB,SAAS3E,IAAI,GAAG;YAAE2E,UAAU;mBAAIA;aAAS,CAACwB,IAAI;QAAG,IAAI,CAAC;IAE9D;IACA,IAAI5B,MAAMvE,IAAI,IAAIwE,OAAOxE,IAAI,IAAIyE,UAAUzE,IAAI,IAAI4E,OAAO;QACxDX,YAAYmC,OAAO,GAAG,aAChB7B,MAAMvE,IAAI,GAAG;YAAEuE,OAAO;mBAAIA;aAAM,CAAC4B,IAAI;QAAG,IAAI,CAAC,GAC7C3B,OAAOxE,IAAI,GAAG;YAAEwE,QAAQ;mBAAIA;aAAO,CAAC2B,IAAI;QAAG,IAAI,CAAC,GAChD1B,UAAUzE,IAAI,GAAG;YAAEyE,WAAW;mBAAIA;aAAU,CAAC0B,IAAI;QAAG,IAAI,CAAC,GACzDvB,QAAQ;YAAEA,OAAO;QAAK,IAAI,CAAC;IAEnC;IACA,OAAO;QAAEX;QAAaC,YAAY;eAAIA;SAAW,CAACiC,IAAI;IAAG;AAC3D;AAEA,+EAA+E,GAC/E,SAASE,sBAAsBpC,WAAgC;QAEhDA,mBACCA;QACViC,kBACAA,gBACAtB,cACAA,eACAA;IAPJ,MAAM0B,QAAkB,EAAE;IAC1B,MAAMJ,QAAOjC,oBAAAA,YAAYiC,IAAI,YAAhBjC,oBAAoB,CAAC;IAClC,MAAMW,SAAQX,uBAAAA,YAAYmC,OAAO,YAAnBnC,uBAAuB,CAAC;IACtC,KAAIiC,mBAAAA,KAAKxB,UAAU,qBAAfwB,iBAAiB9D,MAAM,EAAEkE,MAAM1D,IAAI,CAAC,CAAC,gBAAgB,EAAEsD,KAAKxB,UAAU,CAAC6B,IAAI,CAAC,OAAO;IACvF,KAAIL,iBAAAA,KAAKvB,QAAQ,qBAAbuB,eAAe9D,MAAM,EAAEkE,MAAM1D,IAAI,CAAC,CAAC,cAAc,EAAEsD,KAAKvB,QAAQ,CAAC4B,IAAI,CAAC,OAAO;IACjF,KAAI3B,eAAAA,MAAML,KAAK,qBAAXK,aAAaxC,MAAM,EAAEkE,MAAM1D,IAAI,CAAC,CAAC,cAAc,EAAEgC,MAAML,KAAK,CAACgC,IAAI,CAAC,OAAO;IAC7E,KAAI3B,gBAAAA,MAAMJ,MAAM,qBAAZI,cAAcxC,MAAM,EAAEkE,MAAM1D,IAAI,CAAC,CAAC,eAAe,EAAEgC,MAAMJ,MAAM,CAAC+B,IAAI,CAAC,OAAO;IAChF,KAAI3B,mBAAAA,MAAMH,SAAS,qBAAfG,iBAAiBxC,MAAM,EAAE;QAC3BkE,MAAM1D,IAAI,CAAC,CAAC,4BAA4B,EAAEgC,MAAMH,SAAS,CAAC8B,IAAI,CAAC,OAAO;IACxE;IACA,IAAI3B,MAAMA,KAAK,EAAE0B,MAAM1D,IAAI,CAAC;IAC5B,OAAO0D,MAAMC,IAAI,CAAC,UAAU;AAC9B;AAEA;;;;;;;;;CASC,GACD,SAASC,qBACPC,QAA+B,EAC/BC,OAAiC,EACjCjB,GAIS,EACTkB,OAAmC,EACnCC,WAA2C;QA8DzCC,aACAC,gBAKAD,cACAC,iBAKAD,gBACAC,mBAKAD,iBACAC,oBAKAD,iBACAC,oBAGED,iBAAyBC,oBAoCAA,iBAA2BD,cAC7BC,iBAAyBD,cACzBC,oBAAyBD;IA9HpD,MAAMA,QAAQJ,SAASxC,WAAW;IAClC,MAAM8C,YAAYV,sBAAsBQ;IACxC,MAAMG,qBACJC,QAAQJ,MAAMX,IAAI,IAAIW,MAAMT,OAAO,KAAKK,SAASvC,UAAU,CAAC9B,MAAM,GAAG;IACvE,MAAM8E,aAAaT,SAASvC,UAAU,CAAC9B,MAAM,GACzC,CAAC,yDAAyD,EAAEqE,SAASvC,UAAU,CAACqC,IAAI,CAAC,MAAM,CAAC,CAAC,GAC7F;IACJ,MAAMO,WAAWJ,2BAAAA,QAASS,qBAAqB;IAC/C,IAAIL,aAAa9B,WAAW;QAC1B,mEAAmE;QACnE,uEAAuE;QACvE,IAAI,CAACgC,oBAAoB;YACvBL,QAAQS,GAAG,CAAC,iBAAiB;YAC7B;QACF;QACAR,YAAY;QACZD,QAAQS,GAAG,CACT,iBACA,CAAC,UAAU,EAAEL,UAAU,oDAAoD,CAAC;QAE9E;IACF;IACA,IAAID,aAAa,MAAM;QACrBH,QAAQS,GAAG,CACT,iBACAJ,qBAAqB,CAAC,uBAAuB,EAAED,WAAW,GAAG;QAE/D,IAAI,CAACC,oBAAoB;QACzBvB,IACEiB,CAAAA,2BAAAA,QAASW,oBAAoB,IAAG,UAAU,WAC1C,iBACA,CAAC,iEAAiE,CAAC,GACjE,GAAGN,UAAU,CAAC,EAAEG,WAAW,cAAc,CAAC,GAC1C,CAAC,eAAe,EAAEI,KAAKC,SAAS,CAACV,OAAO,6BAA6B,CAAC,GACtE,qEACA,wEACA;QAEJ;IACF;IAEAF,QAAQS,GAAG,CAAC,iBAAiB,CAAC,SAAS,EAAEf,sBAAsBS,WAAW;IAC1E,MAAMU,UAAU,CACdC,OACAC,YACAC,QACAC;QAEA,KAAK,MAAM3B,MAAMyB,qBAAAA,aAAc,EAAE,CAAE;YACjC,IAAI,CAACC,iBAAAA,SAAU,EAAE,EAAEE,QAAQ,CAAC5B,KAAK;YACjCR,IACE,SACA,iBACA,CAAC,qBAAqB,EAAEgC,MAAM,EAAE,EAAExB,GAAG,+BAA+B,CAAC,GACnE,CAAC,UAAU,EAAE2B,aAAa;QAEhC;IACF;IACAJ,QACE,uBACAX,cAAAA,MAAMX,IAAI,qBAAVW,YAAYnC,UAAU,GACtBoC,iBAAAA,SAASZ,IAAI,qBAAbY,eAAepC,UAAU,EACzB;IAEF8C,QACE,qBACAX,eAAAA,MAAMX,IAAI,qBAAVW,aAAYlC,QAAQ,GACpBmC,kBAAAA,SAASZ,IAAI,qBAAbY,gBAAenC,QAAQ,EACvB;IAEF6C,QACE,iCACAX,iBAAAA,MAAMT,OAAO,qBAAbS,eAAetC,KAAK,GACpBuC,oBAAAA,SAASV,OAAO,qBAAhBU,kBAAkBvC,KAAK,EACvB;IAEFiD,QACE,sBACAX,kBAAAA,MAAMT,OAAO,qBAAbS,gBAAerC,MAAM,GACrBsC,qBAAAA,SAASV,OAAO,qBAAhBU,mBAAkBtC,MAAM,EACxB;IAEFgD,QACE,mCACAX,kBAAAA,MAAMT,OAAO,qBAAbS,gBAAepC,SAAS,GACxBqC,qBAAAA,SAASV,OAAO,qBAAhBU,mBAAkBrC,SAAS,EAC3B;IAEF,IAAIoC,EAAAA,kBAAAA,MAAMT,OAAO,qBAAbS,gBAAejC,KAAK,KAAI,GAACkC,qBAAAA,SAASV,OAAO,qBAAhBU,mBAAkBlC,KAAK,GAAE;QACpDa,IACE,SACA,iBACA,wEACE,oEACA,oEACA;IAEN;IACA,IAAIgB,SAASvC,UAAU,CAAC9B,MAAM,EAAE;QAC9BqD,IACE,WACA,iBACA,CAAC,2BAA2B,EAAEgB,SAASvC,UAAU,CAACqC,IAAI,CAAC,MAAM,GAAG,CAAC,GAC/D;IAEN;IACA,MAAMuB,SAAS,CACbL,OACAE,QACAD;QAEA,wEAAwE;QACxE,iDAAiD;QACjD,IAAIjB,SAASvC,UAAU,CAAC9B,MAAM,EAAE;QAChC,KAAK,MAAM6D,MAAM0B,iBAAAA,SAAU,EAAE,CAAE;YAC7B,IAAI,CAACD,qBAAAA,aAAc,EAAE,EAAEG,QAAQ,CAAC5B,KAAK;YACrCR,IACE,WACA,iBACA,CAAC,sBAAsB,EAAEgC,MAAM,EAAE,EAAExB,GAAG,wBAAwB,CAAC,GAC7D;QAEN;IACF;IACA6B,OAAO,uBAAsBhB,kBAAAA,SAASZ,IAAI,qBAAbY,gBAAepC,UAAU,GAAEmC,eAAAA,MAAMX,IAAI,qBAAVW,aAAYnC,UAAU;IAC9EoD,OAAO,qBAAoBhB,kBAAAA,SAASZ,IAAI,qBAAbY,gBAAenC,QAAQ,GAAEkC,eAAAA,MAAMX,IAAI,qBAAVW,aAAYlC,QAAQ;IACxEmD,OAAO,qBAAoBhB,qBAAAA,SAASV,OAAO,qBAAhBU,mBAAkBvC,KAAK,GAAEsC,kBAAAA,MAAMT,OAAO,qBAAbS,gBAAetC,KAAK;AAC1E;AAEA;;;;;;;;;;;;;;;CAeC,GACD,SAASwD,mBACPzD,OAAgB,EAChBxB,SAAsC;IAEtC,MAAM+D,QAAQ,IAAI7F;IAClB,MAAMgH,QAAQ,CAACnG;QACb,MAAMC,MAAMD,IAAI,CAAC,MAAM;QACvB,IAAI,CAACC,KAAK,OAAO;QACjB,IAAI,CAACD,IAAI,CAAC,WAAW,IAAIC,IAAIC,IAAI,KAAK,cAAc,OAAOD,GAAG,CAAC,OAAO;QACtE,OAAOe,aAAaf,KAAKgB;IAC3B;IACAd,KAAKsC,SAAS,CAACzC;QACb,IAAIA,KAAKE,IAAI,KAAK,YAAY;YAC5B,MAAMD,MAAMkG,MAAMnG;YAClB,MAAMW,QAAQK,aAAahB,IAAI,CAAC,QAAQ,EAAaiB;YACrD,MAAMgD,QAAQhE,OAAOU,UAAU,OAAOjD,4BAA4BuC,KAAKU,SAAS;YAChF,IAAIsD,OAAOe,MAAMpB,GAAG,CAACK;QACvB,OAAO,IAAIjE,KAAKE,IAAI,KAAK,kBAAkB;gBAE3BF;YADd,MAAMwD,SAASxD,IAAI,CAAC,SAAS;YAC7B,MAAM0D,QAAQ1D,kBAAAA,IAAI,CAAC,YAAY,YAAjBA,kBAAqB,EAAE;YACrC,IAAIwD,CAAAA,0BAAAA,OAAQtD,IAAI,MAAK,sBAAsByB,aAAa6B,QAAQvC,eAAe,gBAAgB;gBAC7F,MAAMiC,OAAOlC,aAAa0C,IAAI,CAAC,EAAE,EAAEzC;gBACnC,MAAMN,QAAQK,aAAa0C,IAAI,CAAC,EAAE,EAAEzC;gBACpC,MAAMgD,QAAQf,SAAS,QAAQvC,UAAU,OAAOjD,4BAA4BwF,MAAMvC,SAAS;gBAC3F,IAAIsD,OAAOe,MAAMpB,GAAG,CAACK;YACvB;QACF,OAAO,IAAIjE,KAAKE,IAAI,KAAK,aAAa,OAAOF,IAAI,CAAC,QAAQ,KAAK,UAAU;YACvE,MAAMiE,QAAQtG,iBAAiBqC,IAAI,CAAC,QAAQ;YAC5C,IAAIiE,OAAOe,MAAMpB,GAAG,CAACK;QACvB,OAAO,IAAIjE,KAAKE,IAAI,KAAK,mBAAmB;gBAC3BF;YAAf,MAAMoG,OAAO,EAAEpG,eAAAA,IAAI,CAAC,SAAS,YAAdA,eAAkB,EAAE,EAChCqG,GAAG,CAAC,CAACC;;oBAAkBA;uBAARC,gBAAQD,eAAAA,KAAK,CAAC,QAAQ,qBAAf,AAACA,aAAoDjF,MAAM,mBAAI;eACrFqD,IAAI,CAAC;YACR,MAAMT,QAAQtG,iBAAiByI;YAC/B,IAAInC,OAAOe,MAAMpB,GAAG,CAACK;QACvB;IACF;IACA,MAAMuC,QAAQ;QAAEC,UAAU;QAAcC,MAAM;QAAkCC,KAAK;IAAkB;IACvG,OAAO;WAAI3B;KAAM,CAACqB,GAAG,CACnB,CAACpC,QACC,CAAC,8BAA8B,EAAEuC,KAAK,CAACvC,MAAM,CAAC,oCAAoC,CAAC,GACnF;AAEN;AAEA;;;;;;;;;;;;;;CAcC,GACD,SAAS2C,yBAAyB3B,QAA2B;IAC3D,MAAM4B,WAAqB,EAAE;IAC7B,KAAK,MAAM3E,UAAU+C,SAAU;QAC7B,IAAI6B;QACJ,IAAI;YACFA,OAAO,IAAI/E,IAAIG,QAAQ6E,QAAQ;QACjC,EAAE,eAAM;YACN;QACF;QACA,MAAMC,QAAQpJ,sBAAsBkJ;QACpC,IAAIE,OAAO;YACTH,SAAS9F,IAAI,CACX,CAAC,sBAAsB,EAAEmB,OAAO,kBAAkB,EAAE8E,MAAMpB,KAAK,CAAC,MAAM,CAAC,GACrE,CAAC,WAAW,EAAEoB,MAAMpB,KAAK,CAAC,gDAAgD,CAAC;QAEjF;IACF;IACA,OAAOiB;AACT;AAEA;;;CAGC,GACD,SAASI,gBACP7G,IAAa,EACbC,KAAsD;IAEtD,MAAMC,QAA0C;QAAC;YAACF;YAAM;SAAK;KAAC;IAC9D,MAAOE,MAAMC,MAAM,CAAE;QACnB,MAAMrC,QAAQoC,MAAME,GAAG;QACvB,IAAI,CAACtC,OAAO;QACZ,MAAM,CAAC8B,MAAMkH,OAAO,GAAGhJ;QACvBmC,MAAML,MAAMkH;QACZ,KAAK,MAAMjH,OAAOQ,OAAOC,IAAI,CAACV,MAAO;YACnC,IAAIC,QAAQ,UAAUA,QAAQ,WAAWA,QAAQ,OAAO;YACxD,IAAIF,aAAaC,MAAMC,MAAM;YAC7B,MAAMU,QAAQX,IAAI,CAACC,IAAI;YACvB,MAAMkH,WAAWvG,MAAMC,OAAO,CAACF,SAASA,QAAQ;gBAACA;aAAM;YACvD,KAAK,MAAMyG,SAASD,SAAU;gBAC5B,IACEC,SACA,OAAOA,UAAU,YACjB,OAAO,AAACA,MAAkBlH,IAAI,KAAK,UACnC;oBACAI,MAAMS,IAAI,CAAC;wBAACqG;wBAAkBpH;qBAAK;gBACrC;YACF;QACF;IACF;AACF;AAEA,MAAMqH,iBAAiB,IAAIlI,IAAI;IAC7B;IACA;IACA;CACD;AAED,uDAAuD,GACvD,MAAMmI,cAAc,IAAInI,IAAI;IAC1B;OACGkI;IACH;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD;AAED,oFAAoF,GACpF,SAASE,aAAaC,OAAmC,EAAEtD,IAAiB;IAC1E,IAAI,CAACsD,SAAS;IACd,OAAQA,QAAQtH,IAAI;QAClB,KAAK;YACHgE,KAAKN,GAAG,CAAC4D,OAAO,CAAC,OAAO;YACxB;QACF,KAAK;YACH,OAAOD,aAAaC,OAAO,CAAC,OAAO,EAAatD;QAClD,KAAK;YACH,OAAOqD,aAAaC,OAAO,CAAC,WAAW,EAAatD;QACtD,KAAK;gBACoBsD;YAAvB,KAAK,MAAMC,YAAYD,oBAAAA,OAAO,CAAC,WAAW,YAAnBA,oBAAuB,EAAE,CAAgBD,aAAaE,SAASvD;YACtF;QACF,KAAK;gBACqBsD;YAAxB,KAAK,MAAM5F,aAAa4F,sBAAAA,OAAO,CAAC,aAAa,YAArBA,sBAAyB,EAAE,CAAgB;gBACjED,aACG3F,SAAS1B,IAAI,KAAK,gBAAgB0B,WAAWA,QAAQ,CAAC,QAAQ,EAC/DsC;YAEJ;YACA;IACJ;AACF;AAEA,sFAAsF,GACtF,SAASwD,aAAaC,UAA8B,EAAEzD,IAAiB;IACrE,KAAK,MAAM0D,aAAaD,WAAY;QAClC,IAAIC,CAAAA,6BAAAA,UAAW1H,IAAI,MAAK,yBAAyB0H,SAAS,CAAC,OAAO,KAAK,OAAO;gBAClDA;YAA1B,KAAK,MAAMC,eAAeD,0BAAAA,SAAS,CAAC,eAAe,YAAzBA,0BAA6B,EAAE,CAAgB;gBACvEL,aAAaM,UAAU,CAAC,KAAK,EAAa3D;YAC5C;QACF;QACA,IACE,AAAC0D,CAAAA,CAAAA,6BAAAA,UAAW1H,IAAI,MAAK,yBAAyB0H,CAAAA,6BAAAA,UAAW1H,IAAI,MAAK,kBAAiB,KACnF0H,SAAS,CAAC,KAAK,EACf;YACA1D,KAAKN,GAAG,CAAC,AAACgE,SAAS,CAAC,KAAK,AAAY,CAAC,OAAO;QAC/C;IACF;AACF;AAEA,oFAAoF,GACpF,SAASE,SAAS9H,IAAgC,EAAEkE,IAAiB;IACnE,IAAI,CAAClE,QAAQ,OAAOA,SAAS,UAAU;IACvC,IAAIqH,eAAe5D,GAAG,CAACzD,KAAKE,IAAI,GAAG;IACnC,IAAIF,KAAKE,IAAI,KAAK,yBAAyBF,IAAI,CAAC,OAAO,KAAK,OAAO;YACvCA;QAA1B,KAAK,MAAM6H,eAAe7H,qBAAAA,IAAI,CAAC,eAAe,YAApBA,qBAAwB,EAAE,CAAgB;YAClEuH,aAAaM,UAAU,CAAC,KAAK,EAAa3D;QAC5C;IACF;IACA,KAAK,MAAM,CAACD,OAAOtD,MAAM,IAAIF,OAAOsH,OAAO,CAAC/H,MAAO;QACjD,IAAIiE,UAAU,UAAU,CAACtD,SAAS,OAAOA,UAAU,UAAU;QAC7D,IAAIC,MAAMC,OAAO,CAACF,QAAQ,KAAK,MAAMyG,SAASzG,MAAOmH,SAASV,OAAkBlD;aAC3E,IAAI,UAAWvD,OAAkBmH,SAASnH,OAAkBuD;IACnE;AACF;AAEA,sDAAsD,GACtD,SAAS8D,cAAcC,KAAc;IACnC,MAAMC,QAAQ,IAAI/I;IAClB,IAAIkI,eAAe5D,GAAG,CAACwE,MAAM/H,IAAI,GAAG;YACb+H;QAArB,KAAK,MAAME,UAAUF,gBAAAA,KAAK,CAAC,SAAS,YAAfA,gBAAmB,EAAE,CAAgBV,aAAaY,OAAOD;QAC9E,IAAID,MAAM/H,IAAI,KAAK,wBAAwB+H,KAAK,CAAC,KAAK,EAAE;YACtDC,MAAMtE,GAAG,CAAC,AAACqE,KAAK,CAAC,KAAK,AAAY,CAAC,OAAO;QAC5C;QACA,MAAMG,OAAOH,KAAK,CAAC,OAAO;QAC1B,IAAIG,CAAAA,wBAAAA,KAAMlI,IAAI,MAAK,kBAAkB;gBACVkI,YACXA;YADd,KAAK,MAAMR,cAAcQ,aAAAA,IAAI,CAAC,OAAO,YAAZA,aAAgB,EAAE,CAAgBN,SAASF,WAAWM;YAC/ER,cAAcU,cAAAA,IAAI,CAAC,OAAO,YAAZA,cAAgB,EAAE,EAAgBF;QAClD;QACA,OAAOA;IACT;IACA,OAAQD,MAAM/H,IAAI;QAChB,KAAK;QACL,KAAK;QACL,KAAK;gBACW+H;YAAdP,cAAcO,cAAAA,KAAK,CAAC,OAAO,YAAbA,cAAiB,EAAE,EAAgBC;YACjD;QACF,KAAK;gBACmBD;YAAtB,KAAK,MAAMI,WAAWJ,eAAAA,KAAK,CAAC,QAAQ,YAAdA,eAAkB,EAAE,CAAgB;oBAC1CI;gBAAdX,cAAcW,qBAAAA,MAAM,CAAC,aAAa,YAApBA,qBAAwB,EAAE,EAAgBH;YAC1D;YACA;QACF,KAAK;YACHX,aAAaU,KAAK,CAAC,QAAQ,EAAaC;YACxC;QACF,KAAK;QACL,KAAK;QACL,KAAK;YAAkB;oBACPD;gBAAd,MAAMK,QAAQL,cAAAA,KAAK,CAAC,OAAO,YAAbA,cAAiBA,KAAK,CAAC,OAAO;gBAC5C,IAAIK,CAAAA,wBAAAA,KAAMpI,IAAI,MAAK,yBAAyBoI,IAAI,CAAC,OAAO,KAAK,OAAOZ,aAAa;oBAACY;iBAAK,EAAEJ;gBACzF;YACF;QACA,KAAK;YACH,IAAID,KAAK,CAAC,KAAK,EAAEC,MAAMtE,GAAG,CAAC,AAACqE,KAAK,CAAC,KAAK,AAAY,CAAC,OAAO;YAC3D;IACJ;IACA,OAAOC;AACT;AAEA;;;CAGC,GACD,SAASK,YAAYvI,IAAa,EAAEkH,MAAkC;IACpE,IAAI,CAACA,QAAQ,OAAO;IACpB,OAAQA,OAAOhH,IAAI;QACjB,KAAK;YACH,OAAOgH,MAAM,CAAC,SAAS,KAAKlH,QAAQkH,MAAM,CAAC,WAAW,KAAK;QAC7D,KAAK;YACH,IAAIA,MAAM,CAAC,MAAM,KAAKlH,QAAQkH,MAAM,CAAC,WAAW,KAAK,MAAM;gBACzD,OAAOA,MAAM,CAAC,YAAY,KAAK,QAAQA,MAAM,CAAC,QAAQ,KAAKlH;YAC7D;YACA,OAAO;QACT,KAAK;QACL,KAAK;YACH,OAAOkH,MAAM,CAAC,MAAM,KAAKlH,QAAQkH,MAAM,CAAC,WAAW,KAAK;QAC1D,KAAK;QACL,KAAK;QACL,KAAK;YACH,OAAO;QACT,KAAK;YACH,OAAOA,MAAM,CAAC,QAAQ,KAAKlH;QAC7B,KAAK;QACL,KAAK;QACL,KAAK;YACH,OAAO;QACT;YACE,OAAO;IACX;AACF;AAEA;;;;;;;;;;;;;;;;;;;;;;CAsBC,GACD,SAASwI,aACP/F,OAAgB,EAChBxB,SAAsC,EACtCwH,WAA0D;IAU1D,MAAMC,UAAU,IAAIC;IACpB,MAAMC,cAAc,IAAID;IACxB1B,gBAAgBxE,SAAS,CAACzC,MAAMkH;QAC9BwB,QAAQnD,GAAG,CAACvF,MAAMkH;QAClB,IAAIlH,KAAKE,IAAI,KAAK,cAAc;YAC9B,MAAMgD,OAAOlD,IAAI,CAAC,OAAO;YACzB,MAAM8D,OAAO8E,YAAY1H,GAAG,CAACgC;YAC7B,IAAIY,MAAMA,KAAK/C,IAAI,CAACf;iBACf4I,YAAYrD,GAAG,CAACrC,MAAM;gBAAClD;aAAK;QACnC;IACF;IACA,yEAAyE;IACzE,2EAA2E;IAC3E,gDAAgD;IAChD,MAAM6I,aAAa,IAAIF;IACvB,MAAMG,UAAU,CAACb;QACf,IAAIjD,QAAQ6D,WAAW3H,GAAG,CAAC+G;QAC3B,IAAI,CAACjD,OAAO;YACVA,QAAQgD,cAAcC;YACtBY,WAAWtD,GAAG,CAAC0C,OAAOjD;QACxB;QACA,OAAOA;IACT;IACA,sFAAsF,GACtF,MAAM+D,eAAe,CAAClB;QACpB,MAAMmB,cAAcN,QAAQxH,GAAG,CAAC2G;QAChC,MAAMoB,iBAAiBD,CAAAA,+BAAAA,WAAa,CAAC,OAAO,MAAK;QACjD,IAAK,IAAIE,KAAKR,QAAQxH,GAAG,CAAC8H,cAAyBE,IAAIA,KAAKR,QAAQxH,GAAG,CAACgI,IAAK;YAC3E,IAAID,iBAAiB5B,eAAe5D,GAAG,CAACyF,GAAGhJ,IAAI,KAAKgJ,GAAGhJ,IAAI,KAAK,YAAYoH,YAAY7D,GAAG,CAACyF,GAAGhJ,IAAI,GAAG;gBACpG,OAAOgJ;YACT;QACF;QACA,OAAO;IACT;IACA,gEAAgE,GAChE,MAAMC,aAAa,CAACC,KAAclG,MAAc+E;QAC9C,IAAI,CAACM,YAAYa,KAAKV,QAAQxH,GAAG,CAACkI,OAAO,OAAO;QAChD,IAAK,IAAIF,KAAKR,QAAQxH,GAAG,CAACkI,MAAMF,IAAIA,KAAKR,QAAQxH,GAAG,CAACgI,IAAK;YACxD,IAAIA,OAAOjB,OAAO,OAAO;YACzB,IAAIX,YAAY7D,GAAG,CAACyF,GAAGhJ,IAAI,KAAK4I,QAAQI,IAAIzF,GAAG,CAACP,OAAO,OAAO;QAChE;QACA,OAAO+E,UAAU;IACnB;IAEA,MAAMoB,eAAe,CAACrJ,OACpB,CAACA,wBAAAA,KAAME,IAAI,MAAK,gBAAgBF,IAAI,CAAC,OAAO,KAAKlC,sBAChDkC,CAAAA,wBAAAA,KAAME,IAAI,MAAK,sBACduI,YAAYzI,IAAI,CAAC,SAAS,KAC1B2B,aAAa3B,UAAUlC;IAE3B,yEAAyE;IACzE,6EAA6E;IAC7E,aAAa;IACb,MAAMwL,YAAY,IAAIX;IACtBxI,KAAKsC,SAAS,CAACzC;YAcVA;QAbH,IAAIA,KAAKE,IAAI,KAAK,sBAAsB;YACtC,MAAMkE,KAAKpE,IAAI,CAAC,KAAK;YACrB,MAAMuJ,OAAOvJ,IAAI,CAAC,OAAO;YACzB,MAAMwJ,QACJD,CAAAA,wBAAAA,KAAMrJ,IAAI,MAAK,sBACX;gBAACqJ,IAAI,CAAC,OAAO;gBAAaA,IAAI,CAAC,QAAQ;aAAY,GACnD;gBAACA;aAAK;YACZ,IAAInF,CAAAA,sBAAAA,GAAIlE,IAAI,MAAK,gBAAgBsJ,MAAMC,IAAI,CAACJ,eAAe;gBACzDC,UAAU/D,GAAG,CAACnB,EAAE,CAAC,OAAO,EAAY;oBAAE6D,OAAOc,aAAa/I;oBAAOmI,OAAO;gBAAM;YAChF;QACF;QACA,IACEnI,KAAKE,IAAI,KAAK,yBACd,EAACF,WAAAA,IAAI,CAAC,KAAK,qBAAX,AAACA,QAA+B,CAAC,OAAO,MAAK,YAC7C;gBACgBA;YAAhB,MAAMmI,QAAQ,EAAEnI,eAAAA,IAAI,CAAC,SAAS,YAAdA,eAAkB,EAAE,CAAe,CAAC,EAAE;YACtD,IAAImI,CAAAA,yBAAAA,MAAOjI,IAAI,MAAK,gBAAgB,CAACoJ,UAAU7F,GAAG,CAAC0E,KAAK,CAAC,OAAO,GAAa;gBAC3EmB,UAAU/D,GAAG,CAAC4C,KAAK,CAAC,OAAO,EAAY;oBAAEF,OAAOjI;oBAAMmI,OAAO;gBAAK;YACpE;QACF;IACF;IACA,6EAA6E,GAC7E,MAAMuB,UAAU,CACd1J;QAEA,IAAIqJ,aAAarJ,OAAO,OAAO;QAC/B,IAAIA,CAAAA,wBAAAA,KAAME,IAAI,MAAK,cAAc,OAAO;QACxC,MAAMgD,OAAOlD,IAAI,CAAC,OAAO;QACzB,MAAM2J,UAAUL,UAAUpI,GAAG,CAACgC;QAC9B,IAAI,CAACyG,WAAW,CAACR,WAAWnJ,MAAMkD,MAAMyG,QAAQ1B,KAAK,GAAG,OAAO;QAC/D,OAAO0B,QAAQxB,KAAK,GAAG,UAAU;IACnC;IAEA,MAAMyB,UAAU,IAAIzK,IAAYpB;IAChC,MAAM8L,UAAU,IAAI1K,IAAYtB;IAChC,MAAMiM,OAAO,IAAI3K;IACjB,MAAM4K,UAAU,IAAI5K;IACpB,MAAM6K,iBAAiB,IAAI7K;IAC3B,IAAI8K,WAAW;IACf,IAAIC,kBAAkB;IACtB,MAAMhC,QAAQ,IAAIS;IAClB,MAAMwB,QAAQ,CAAClK;QACbiI,MAAM3C,GAAG,CAACtF,KAAK;IACjB;IACA,MAAMmK,OAAO,CAACnK,KAAaiD;QACzB,IAAIA,SAAS,MAAM,OAAOiH,MAAMlK;QAChC,MAAMoK,UAAUnC,MAAMhH,GAAG,CAACjB;QAC1B,IAAIoK,YAAY,KAAK;QACrB,IAAIA,SAASA,QAAQzG,GAAG,CAACV;aACpBgF,MAAM3C,GAAG,CAACtF,KAAK,IAAId,IAAI;YAAC+D;SAAK;IACpC;IACA,MAAMoH,cAAc,IAAInL;IAExB,8DAA8D,GAC9D,MAAMoL,QAAQ,CAACtK,KAAamJ;QAC1B,MAAMlC,SAASwB,QAAQxH,GAAG,CAACkI;QAC3B,yEAAyE;QACzE,mEAAmE;QACnE,0BAA0B;QAC1B,IACE,CAAClC,0BAAAA,OAAQhH,IAAI,MAAK,qBACfgH,CAAAA,MAAM,CAAC,WAAW,KAAK,OAAOA,MAAM,CAAC,WAAW,KAAK,QAAO,KAC9D,AAACA,CAAAA,CAAAA,0BAAAA,OAAQhH,IAAI,MAAK,iBAAiBgH,CAAAA,0BAAAA,OAAQhH,IAAI,MAAK,uBAAsB,KACzEgH,MAAM,CAAC,OAAO,KAAKkC,KACrB;YACA;QACF;QACA,IAAIlC,CAAAA,0BAAAA,OAAQhH,IAAI,MAAK,sBAAsBgH,MAAM,CAAC,SAAS,KAAKkC,KAAK;YACnE,OAAOgB,KAAKnK,KAAK0B,aAAauF,QAAQjG;QACxC;QACA,IAAIiG,CAAAA,0BAAAA,OAAQhH,IAAI,MAAK,wBAAwBgH,MAAM,CAAC,OAAO,KAAKkC,KAAK;YACnE,MAAMhF,KAAK8C,MAAM,CAAC,KAAK;YACvB,IAAI9C,CAAAA,sBAAAA,GAAIlE,IAAI,MAAK,cAAc;oBAKX0I;gBAJlB,MAAM4B,QAAQpG,EAAE,CAAC,OAAO;gBACxB,IAAIkG,YAAY7G,GAAG,CAACyD,SAAS;gBAC7BoD,YAAY1G,GAAG,CAACsD;gBAChB,MAAMe,QAAQc,aAAa7B;gBAC3B,KAAK,MAAMuD,QAAO7B,mBAAAA,YAAY1H,GAAG,CAACsJ,kBAAhB5B,mBAA0B,EAAE,CAAE;oBAC9C,IAAI6B,QAAQrG,MAAM+E,WAAWsB,KAAKD,OAAOvC,QAAQsC,MAAMtK,KAAKwK;gBAC9D;gBACA;YACF;YACA,IAAIrG,CAAAA,sBAAAA,GAAIlE,IAAI,MAAK,iBAAiB;oBACRkE;gBAAxB,KAAK,MAAMxC,aAAawC,iBAAAA,EAAE,CAAC,aAAa,YAAhBA,iBAAoB,EAAE,CAAgB;oBAC5D,IAAIxC,SAAS1B,IAAI,KAAK,cAAc0B,QAAQ,CAAC,WAAW,EAAE;wBACxD,OAAOuI,MAAMlK;oBACf;oBACA,MAAMyK,cAAc9I,QAAQ,CAAC,MAAM;oBACnC,MAAMsB,OACJwH,CAAAA,+BAAAA,YAAaxK,IAAI,MAAK,eACjBwK,WAAW,CAAC,OAAO,GACpB1J,aAAa0J;oBACnBN,KAAKnK,KAAKiD;gBACZ;gBACA;YACF;QACF;QACAiH,MAAMlK;IACR;IAEAE,KAAKsC,SAAS,CAACzC;QACb,IAAIA,KAAKE,IAAI,KAAK,oBAAoB;QACtC,MAAMyK,MAAMjB,QAAQ1J,IAAI,CAAC,SAAS;QAClC,IAAI,CAAC2K,KAAK;QACV,MAAM1K,MAAM0B,aAAa3B,MAAMiB;QAC/B,IAAIhB,QAAQ,MAAM;YAChB,IAAI0K,QAAQ,SAAST,mBAAmB;iBACnCD,YAAY;QACnB,OAAO,IAAI,CAACJ,QAAQpG,GAAG,CAACxD,MAAM;;YAC1B0K,CAAAA,QAAQ,UAAUX,iBAAiBD,OAAM,EAAGnG,GAAG,CAAC3D;QACpD,OAAO;YACL6J,KAAKlG,GAAG,CAAC3D;YACT,IAAI2J,QAAQnG,GAAG,CAACxD,MAAMsK,MAAMtK,KAAKD;QACnC;IACF;IAEA,MAAM4K,UAAmD,CAAC;IAC1D,KAAK,MAAM,CAAC3K,KAAKU,MAAM,IAAIuH,MAAO;QAChC0C,OAAO,CAAC3K,IAAI,GAAGU,UAAU,MAAM,MAAM;eAAIA;SAAM,CAAC2D,IAAI;IACtD;IACA,OAAO;QACLwF;QACAC;QACAC;QACAC;QACAC;QACAU;IACF;AACF;AAEA,SAASC,cACPC,MAAc,EACdjG,OAAsB;;IAEtB,MAAMkG,WAAiC,EAAE;IACzC,MAAMC,OAAO,IAAI7L;IACjB,yEAAyE;IACzE,0EAA0E;IAC1E,MAAM8L,SAAS,IAAItC,IACjBjK,YAAY2H,GAAG,CAAC,CAACjC,KAAO;YAACA;YAAI;SAAO;IAEtC,MAAMU,UAAU,IAAI6D;IACpB,MAAM/E,MAAM,CACVsH,OACAC,OACAC;QAEA,IAAIF,UAAU,SAASD,OAAO1F,GAAG,CAAC4F,OAAO;aACpC,IAAIF,OAAO/J,GAAG,CAACiK,WAAW,QAAQF,OAAO1F,GAAG,CAAC4F,OAAO;QACzD,IAAIH,KAAKvH,GAAG,CAAC2H,YAAYJ,KAAK7M,IAAI,IAAIyB,cAAc;QACpDoL,KAAKpH,GAAG,CAACwH;QACTL,SAAShK,IAAI,CAAC;YAAEmK;YAAOE;YAASD;QAAM;IACxC;IACA,iEAAiE,GACjE,MAAME,cAAc,CAAC,GAAGC;QACtB,KAAK,MAAMlH,MAAMkH,IAAKL,OAAO1F,GAAG,CAACnB,IAAI;IACvC;IACA,MAAMmH,YAAY,IAChB7M,YAAY2H,GAAG,CAAC,CAACjC;gBAGP6G;mBAHe;gBACvB7G;gBACAwB,OAAO3H,YAAY,CAACmG,GAAG;gBACvB6G,MAAM,GAAEA,cAAAA,OAAO/J,GAAG,CAACkD,eAAX6G,cAAkB;eACtBnG,QAAQrB,GAAG,CAACW,MAAM;gBAAEoH,QAAQ1G,QAAQ5D,GAAG,CAACkD;YAAI,IAAI,CAAC;;IAGzD,MAAMqH,mBAAW5G,2BAAAA,QAAS4G,QAAQ,mBAAI9M;IACtC,MAAM+M,QAAQ,IAAIC,cAAcC,MAAM,CAACd,QAAQe,UAAU;IACzD/G,QAAQS,GAAG,CAAC,QAAQ,GAAGmG,MAAMI,cAAc,CAAC,SAAS,UAAU,EAAEL,SAASK,cAAc,CAAC,UAAU;IACnG,IAAIJ,UAAU,GAAG;QACf9H,IAAI,SAAS,QAAQ;QACrByH,YACE,SACA,SACA,kBACA,YACA,kBACA,WACA,WACA,kBACA,WACA,eACA,iBACA;QAEF,OAAO;YACLU,IAAI;YACJhB;YACAiB,QAAQT;YACRU,SAAS;gBAAEC,UAAU;gBAAOC,aAAa;YAAM;YAC/C3N,eAAe2D;QACjB;IACF;IACA,IAAIuJ,QAAQD,UAAU;QACpB7H,IAAI,SAAS,QAAQ,CAAC,UAAU,EAAE8H,MAAM,cAAc,EAAED,SAAS,CAAC,CAAC;IACrE;IAEA,MAAMW,eAAwB;QAC5BC,aAAa;QACbC,YAAY;QACZC,eAAe;QACfC,2BAA2B;IAC7B;IACA,IAAI/J;IACJ,IAAI;QACFA,UAAUhF,MAAMqN,QAAQsB;IAC1B,EAAE,OAAOK,OAAO;QACd,uEAAuE;QACvE,qEAAqE;QACrE,0DAA0D;QAC1D7I,IACE,SACA,SACA,CAAC,uCAAuC,EACtC6I,iBAAiBC,QAAQD,MAAMrB,OAAO,GAAG7E,OAAOkG,QAChD;QAEJpB,YACE,SACA,kBACA,YACA,kBACA,WACA,WACA,kBACA,WACA,eACA,iBACA;QAEF,OAAO;YACLU,IAAI;YACJhB;YACAiB,QAAQT;YACRU,SAAS;gBAAEC,UAAU;gBAAOC,aAAa;YAAM;YAC/C3N,eAAe2D;QACjB;IACF;IAEA,yEAAyE;IACzE,0EAA0E;IAC1E,MAAMwK,UAAU,IAAIxN;IACpB,MAAMyN,YAAY,CAAC1J,MAAeqG;QAChC,IAAI,OAAOrG,SAAS,YAAY,CAACqG,MAAM;QACvC,MAAMC,QACJD,KAAKrJ,IAAI,KAAK,sBACV;YAACqJ,IAAI,CAAC,OAAO;YAAaA,IAAI,CAAC,QAAQ;SAAY,GACnD;YAACA;SAAK;QACZ,KAAK,MAAMnJ,QAAQoJ,MAAO;YACxB,IACEpJ,CAAAA,wBAAAA,KAAMF,IAAI,MAAK,gBACfhB,aAAauE,GAAG,CAACrD,IAAI,CAAC,OAAO,GAC7B;gBACAuM,QAAQ/I,GAAG,CAACV;YACd;QACF;IACF;IACA,yDAAyD;IACzD,EAAE;IACF,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,oEAAoE;IACpE,MAAMjC,YAAY,IAAI0H;IACtB;QACE,MAAMkE,QAAQ,IAAIlE;QAClB,MAAMmE,WAAW,IAAI3N;QACrB,MAAM8F,WAAW,IAAI9F;QACrB,MAAM4N,SAAS,CAAC7J;YACd,IAAI,OAAOA,SAAS,UAAU4J,SAASlJ,GAAG,CAACV;QAC7C;QACA;;oBAEgB,GAChB,MAAM8J,gBAAgB,CAAChN;YACrB,IAAI,CAACA,MAAM;YACX,IAAIA,KAAKE,IAAI,KAAK,cAAc,OAAO6M,OAAO/M,IAAI,CAAC,OAAO;YAC1D,KAAK,MAAMC,OAAO;gBAChB;gBACA;gBACA;gBACA;gBACA;aACD,CAAE;gBACD,MAAMU,QAAQX,IAAI,CAACC,IAAI;gBACvB,IAAIW,MAAMC,OAAO,CAACF,QAChBA,MAAMsM,OAAO,CAAC,CAACnM,OAASkM,cAAclM;qBACnC,IAAIH,OAAOqM,cAAcrM;YAChC;QACF;QACAR,KAAKsC,SAAS,CAACzC;YACb,IAAIA,KAAKE,IAAI,KAAK,sBAAsB;gBACtC,MAAMkE,KAAKpE,IAAI,CAAC,KAAK;gBACrB,IAAIoE,CAAAA,sBAAAA,GAAIlE,IAAI,MAAK,cAAc;oBAC7B,MAAMgD,OAAOkB,EAAE,CAAC,OAAO;oBACvB,IAAIa,SAASxB,GAAG,CAACP,OAAO6J,OAAO7J;oBAC/B+B,SAASrB,GAAG,CAACV;oBACb2J,MAAMtH,GAAG,CAACrC,MAAMlD,IAAI,CAAC,OAAO;gBAC9B,OAAO;oBACLgN,cAAc5I;gBAChB;YACF,OAAO,IAAIpE,KAAKE,IAAI,KAAK,wBAAwB;gBAC/C8M,cAAchN,IAAI,CAAC,OAAO;YAC5B,OAAO,IAAIA,KAAKE,IAAI,KAAK,oBAAoB;gBAC3C8M,cAAchN,IAAI,CAAC,WAAW;YAChC,OAAO,IACLA,KAAKE,IAAI,KAAK,yBACdF,KAAKE,IAAI,KAAK,wBACdF,KAAKE,IAAI,KAAK,2BACd;oBACGF;oBACEA;;gBADJ,EAAEA,eAAAA,IAAI,CAAC,SAAS,YAAdA,eAAkB,EAAE,EAAgBiN,OAAO,CAACD;gBAC/C,IAAI,EAAChN,WAAAA,IAAI,CAAC,KAAK,qBAAX,AAACA,SAAwBE,IAAI,MAAK,cACpC6M,OAAO,AAAC/M,IAAI,CAAC,KAAK,AAAY,CAAC,OAAO;YAC1C,OAAO,IAAIA,KAAKE,IAAI,KAAK,eAAe;gBACtC8M,cAAchN,IAAI,CAAC,QAAQ;YAC7B,OAAO,IACLA,KAAKE,IAAI,KAAK,sBACdF,KAAKE,IAAI,KAAK,mBACd;oBACKF;gBAAL,IAAI,EAACA,YAAAA,IAAI,CAAC,KAAK,qBAAX,AAACA,UAAwBE,IAAI,MAAK,cACpC6M,OAAO,AAAC/M,IAAI,CAAC,KAAK,AAAY,CAAC,OAAO;YAC1C;QACF;QACA,yEAAyE;QACzE,0EAA0E;QAC1E,IAAK,IAAIkN,OAAO,GAAGA,OAAO,GAAGA,QAAQ,EAAG;YACtC,KAAK,MAAM,CAAChK,MAAMqG,KAAK,IAAIsD,MAAO;gBAChC,IAAIC,SAASrJ,GAAG,CAACP,SAASjC,UAAUwC,GAAG,CAACP,OAAO;gBAC/C,MAAMvC,QAAQK,aAAauI,MAAMtI;gBACjC,IAAIN,UAAU,MAAMM,UAAUsE,GAAG,CAACrC,MAAMvC;YAC1C;QACF;IACF;IAEA,0EAA0E;IAC1E,iEAAiE;IACjE,MAAMwM,kBAAkB,IAAIxE;IAC5B,2DAA2D,GAC3D,MAAMyE,eAAe,CAAC7D;QACpB,IAAI,CAACA,MAAM,OAAO;QAClB,IACEA,KAAKrJ,IAAI,KAAK,gBACdX,oBAAoBkE,GAAG,CAAC8F,IAAI,CAAC,OAAO,GACpC;YACA,OAAOA,IAAI,CAAC,OAAO;QACrB;QACA,yEAAyE;QACzE,wEAAwE;QACxE,gDAAgD;QAChD,IAAIA,KAAKrJ,IAAI,KAAK,oBAAoB;YACpC,MAAM0B,WAAWD,aAAa4H;YAC9B,MAAMtG,SAASsG,IAAI,CAAC,SAAS;YAC7B,IACE3H,YACArC,oBAAoBkE,GAAG,CAAC7B,aACxBqB,CAAAA,0BAAAA,OAAQ/C,IAAI,MAAK,gBAChBhB,CAAAA,aAAauE,GAAG,CAACR,MAAM,CAAC,OAAO,KAC9B0J,QAAQlJ,GAAG,CAACR,MAAM,CAAC,OAAO,CAAU,GACtC;gBACA,OAAOrB;YACT;QACF;QACA,OAAO;IACT;IACA,MAAMyL,oBAAoB,CACxBjJ,IACAmF;QAEA,IAAI,CAACnF,IAAI;QACT,IAAIA,GAAGlE,IAAI,KAAK,cAAc;YAC5B,MAAMoN,WAAWF,aAAa7D;YAC9B,IAAI+D,UAAUH,gBAAgB5H,GAAG,CAACnB,EAAE,CAAC,OAAO,EAAYkJ;YACxD;QACF;QACA,wEAAwE;QACxE,IAAIlJ,GAAGlE,IAAI,KAAK,mBAAmBqJ,MAAM;gBAMfnF;YALxB,MAAMmJ,aACJhE,KAAKrJ,IAAI,KAAK,gBACbhB,CAAAA,aAAauE,GAAG,CAAC8F,IAAI,CAAC,OAAO,KAC5BoD,QAAQlJ,GAAG,CAAC8F,IAAI,CAAC,OAAO,CAAU;YACtC,IAAI,CAACgE,YAAY;YACjB,KAAK,MAAM3L,aAAawC,iBAAAA,EAAE,CAAC,aAAa,YAAhBA,iBAAoB,EAAE,CAAgB;gBAC5D,MAAMnE,MAAM2B,QAAQ,CAAC,MAAM;gBAC3B,MAAMjB,QAAQiB,QAAQ,CAAC,QAAQ;gBAC/B,MAAMsB,OACJjD,CAAAA,uBAAAA,IAAKC,IAAI,MAAK,eAAgBD,GAAG,CAAC,OAAO,GAAce,aAAaf;gBACtE,IACEiD,QACA3D,oBAAoBkE,GAAG,CAACP,SACxBvC,CAAAA,yBAAAA,MAAOT,IAAI,MAAK,cAChB;oBACAiN,gBAAgB5H,GAAG,CAAC5E,KAAK,CAAC,OAAO,EAAYuC;gBAC/C;YACF;QACF;IACF;IAEA,2EAA2E;IAC3E,uEAAuE;IACvE/C,KAAKsC,SAAS,CAACzC;QACb,IAAIA,KAAKE,IAAI,KAAK,sBAAsB;YACtC,MAAMkE,KAAKpE,IAAI,CAAC,KAAK;YACrB,IAAIoE,CAAAA,sBAAAA,GAAIlE,IAAI,MAAK,cACf0M,UAAUxI,EAAE,CAAC,OAAO,EAAEpE,IAAI,CAAC,OAAO;QACtC,OAAO,IACLA,KAAKE,IAAI,KAAK,0BACdF,IAAI,CAAC,WAAW,KAAK,KACrB;YACA,MAAMyB,OAAOzB,IAAI,CAAC,OAAO;YACzB,IAAIyB,CAAAA,wBAAAA,KAAMvB,IAAI,MAAK,cACjB0M,UAAUnL,IAAI,CAAC,OAAO,EAAEzB,IAAI,CAAC,QAAQ;QACzC;IACF;IACAG,KAAKsC,SAAS,CAACzC;QACb,IAAIA,KAAKE,IAAI,KAAK,sBAAsB;YACtCmN,kBAAkBrN,IAAI,CAAC,KAAK,EAAaA,IAAI,CAAC,OAAO;QACvD,OAAO,IACLA,KAAKE,IAAI,KAAK,0BACdF,IAAI,CAAC,WAAW,KAAK,KACrB;YACAqN,kBAAkBrN,IAAI,CAAC,OAAO,EAAaA,IAAI,CAAC,QAAQ;QAC1D;IACF;IAEA,MAAMyI,cAAc,CAACzI,OACnB,CAAC,CAACA,QACFA,KAAKE,IAAI,KAAK,gBACbhB,CAAAA,aAAauE,GAAG,CAACzD,IAAI,CAAC,OAAO,KAC5B2M,QAAQlJ,GAAG,CAACzD,IAAI,CAAC,OAAO,CAAU;IAEtC,MAAMiF,WAAWJ,2BAAAA,QAAS2I,eAAe;IACzC,MAAMC,YAAY,IAAItO,IACpB,CAAC8F,mBAAAA,WAAY,EAAE,EAAEoB,GAAG,CAAC,CAACnE;QACpB,IAAI;YACF,OAAO,IAAIH,IAAIG,QAAQA,MAAM;QAC/B,EAAE,eAAM;YACN,OAAOA;QACT;IACF;IAEF,KAAK,MAAMkJ,WAAWxE,yBAAyB3B,mBAAAA,WAAY,EAAE,EAAG;QAC9DrB,IAAI,WAAW,WAAWwH;IAC5B;IACA,8EAA8E,GAC9E,MAAMsC,eAA4CzI,WAC9C,UACA;IACJ,0EAA0E;IAC1E,wEAAwE;IACxE,oCAAoC;IACpC,MAAM0I,cAAc,IAAIxO;IACxB,MAAMyO,iBAAiB,IAAIzO;IAC3B,IAAI0O,cAAc;IAClB,yEAAyE,GACzE,MAAMC,oBAAoB,IAAI3O;IAC9B,MAAM4O,cAAc,CAACC,KAAaC;QAChC,MAAM/L,SAASL,cAAcoM,QAAQhN;QACrC0M,YAAY/J,GAAG,CAACoK;QAChB,IAAI9L,QAAQ0L,eAAehK,GAAG,CAAC1B;aAC1B2L,eAAe;QACpB,IAAI,CAAC5I,UAAU;YACbrB,IACE,WACA,WACA,CAAC,4BAA4B,EAAEoK,IAAI,2BAA2B,CAAC,GAC7D;YAEJ;QACF;QACA,IAAI,CAACP,UAAUtP,IAAI,EAAE;YACnByF,IACE8J,cACA,WACA,CAAC,aAAa,EAAEM,IAAI,sCAAsC,CAAC,GACzD,kEACA;YAEJ;QACF;QACA,IAAI,CAAC9L,QAAQ;YACX0B,IACE,WACA,WACA,GAAGoK,IAAI,yDAAyD,CAAC,GAC/D;YAEJ;QACF;QACA,IAAI,CAACP,UAAUhK,GAAG,CAACvB,SAAS;YAC1B0B,IACE8J,cACA,WACA,GAAGM,IAAI,OAAO,EAAE9L,OAAO,sCAAsC,CAAC,GAC5D,CAAC,WAAW,EAAE;mBAAIuL;aAAU,CAAC/I,IAAI,CAAC,MAAM,CAAC,CAAC;QAEhD;IACF;IAEA;;;;;;;;;GASC,GACD,MAAMwJ,oBAAoB,CACxBhL,MACA+K;QAEA,IAAI/K,QAAQ1D,qBAAqBiE,GAAG,CAACP,OAAO;QAC5C,MAAMhB,SAASL,cAAcoM,QAAQhN;QACrC,IAAI,CAACiB,QAAQ;QACb,yEAAyE;QACzE,kDAAkD;QAClD,IAAIuL,UAAUhK,GAAG,CAACvB,SAAS;QAC3B4L,kBAAkBlK,GAAG,CAAC1B;QACtB0B,IACE,WACA,WACA,GAAGV,OAAO,GAAGA,KAAK,EAAE,CAAC,GAAG,SAAS,WAAW,EAAEhB,OAAO,YAAY,CAAC,GAChE,uEACA;IAEN;IAEA,IAAIiM,kBAAkB;IACtB,IAAIC,qBAAqB;IACzB,MAAMC,aAAa,CAACnL;QAClB,IAAIA,SAAS,YAAYiL,kBAAkB;aACtC,IAAIjL,SAAS,eAAekL,qBAAqB;IACxD;IAEA,IAAIE,kBAAkB;IAEtBnO,KAAKsC,SAAS,CAACzC;QACb,OAAQA,KAAKE,IAAI;YACf,6CAA6C;YAC7C,KAAK;gBACH0D,IACE,SACA,kBACA,sEACE,sEACA;gBAEJ;YACF,KAAK;YACL,KAAK;gBAA0B;wBAmBJ5D;oBAlBzB,IAAIA,IAAI,CAAC,SAAS,EAAE;wBAClB4D,IACE,SACA,kBACA,mEACE;oBAEN;oBACA,MAAMoF,cAAchJ,IAAI,CAAC,cAAc;oBACvC,IAAIgJ,aAAa;4BAGWA;wBAF1B,IAAIA,WAAW,CAAC,KAAK,EACnBqF,WAAW,AAACrF,WAAW,CAAC,KAAK,AAAY,CAAC,OAAO;wBACnD,KAAK,MAAMnB,eAAemB,4BAAAA,WAAW,CAAC,eAAe,YAA3BA,4BACxB,EAAE,CAAgB;4BAClB,MAAM5E,KAAKyD,UAAU,CAAC,KAAK;4BAC3B,IAAIzD,CAAAA,sBAAAA,GAAIlE,IAAI,MAAK,cAAcmO,WAAWjK,EAAE,CAAC,OAAO;wBACtD;oBACF;oBACA,KAAK,MAAMmK,cAAcvO,mBAAAA,IAAI,CAAC,aAAa,YAAlBA,mBAAsB,EAAE,CAAgB;wBAC/D,MAAMwO,WAAWD,SAAS,CAAC,WAAW;wBACtCF,WACEG,CAAAA,4BAAAA,SAAUtO,IAAI,MAAK,eACfsO,QAAQ,CAAC,OAAO,GAChBxN,aAAawN;oBAErB;oBACA;gBACF;YAEA,2BAA2B;YAC3B,KAAK;gBAAoB;oBACvB,MAAMD,YAAYvN,aAAahB,IAAI,CAAC,SAAS,EAAaiB;oBAC1D,IAAIsN,cAAc,MAAM;wBACtB3K,IACE,SACA,kBACA,gEACE;oBAEN,OAAO,IAAI,YAAY5B,IAAI,CAACuM,YAAY;wBACtC3K,IACE,SACA,kBACA;oBAEJ;oBACA;gBACF;YAEA,kBAAkB;YAClB,KAAK;YACL,KAAK;gBAAiB;wBAEN5D,iBAUZ,MAACyO;oBAXH,MAAMjL,SAASxD,IAAI,CAAC,SAAS;oBAC7B,MAAM0D,QAAQ1D,kBAAAA,IAAI,CAAC,YAAY,YAAjBA,kBAAqB,EAAE;oBACrC,MAAMyO,UACJjL,CAAAA,0BAAAA,OAAQtD,IAAI,MAAK,eACZsD,MAAM,CAAC,OAAO,GACfA,CAAAA,0BAAAA,OAAQtD,IAAI,MAAK,qBACfyB,aAAa6B,QAAQvC,aACrB;oBACR,kEAAkE;oBAClE,2CAA2C;oBAC3C,MAAMiC,QACJ,QAACuL,QAAAA,WAAWtB,gBAAgBjM,GAAG,CAACuN,oBAA/BA,QAA4CA,mBAA7C,OAAwD;oBAE1D,IAAIvL,SAAS,QACXU,IAAI,SAAS,kBAAkB;oBACjC,IAAIV,SAAS,YACXU,IACE,SACA,kBACA;oBAEJ,kEAAkE;oBAClE,mEAAmE;oBACnE,2CAA2C;oBAC3C,IAAIV,SAAS,iBAAiBM,CAAAA,0BAAAA,OAAQtD,IAAI,MAAK,oBAC7C0D,IACE,SACA,kBACA,4DACE;oBAEN,IAAIV,QAAQ7D,cAAcoE,GAAG,CAACP,OAAO6K,YAAY7K,MAAMQ,IAAI,CAAC,EAAE;yBACzD,IAAIR,QAAQ5D,qBAAqBmE,GAAG,CAACP,OACxC6K,YAAY7K,MAAMlD,KAAKE,IAAI,KAAK,kBAAkBwD,IAAI,CAAC,EAAE,GAAGA,IAAI,CAAC,EAAE;yBAIhEwK,kBAAkBhL,MAAMQ,IAAI,CAAC,EAAE;oBACpC;gBACF;YAEA,0BAA0B;YAC1B,KAAK;gBAAoB;oBACvB,MAAMT,SAASjD,IAAI,CAAC,SAAS;oBAC7B,MAAMkD,OAAOvB,aAAa3B,MAAMiB;oBAChC,IAAIwH,YAAYxF,WAAWC,SAAS,MAAM;wBACxCU,IACE,SACA,WACA,CAAC,4BAA4B,EAC3B,AAACX,MAAM,CAAC,OAAO,IAAe,WAC/B,yDAAyD,CAAC,GACzD;wBAEJ;oBACF;oBACA,mEAAmE;oBACnE,uDAAuD;oBACvD,IAAIC,SAAS,YAAYuF,YAAYxF,SACnCW,IAAI,SAAS,WAAW;oBAC1B,IAAIV,QAAQ9D,cAAcqE,GAAG,CAACP,SAASuF,YAAYxF,SACjDW,IACE,SACA,WACA;oBAEJ,IAAIV,SAAS,UAAUuF,YAAYxF,SACjCW,IAAI,SAAS,kBAAkB;oBACjC;gBACF;YAEA,4BAA4B;YAC5B,KAAK;gBAAc;oBACjB,MAAMV,OAAOlD,IAAI,CAAC,OAAO;oBACzB,IAAIZ,cAAcqE,GAAG,CAACP,OACpBU,IACE,SACA,WACA;oBAEJ,IAAI/D,gBAAgBmC,IAAI,CAACkB,OAAOoL,mBAAmB;oBACnD;gBACF;YAEA,wBAAwB;YACxB,KAAK;gBAAW;oBACd,MAAM3N,QAAQX,IAAI,CAAC,QAAQ;oBAC3B,IACE,OAAOW,UAAU,YACjBA,MAAMJ,MAAM,IAAIb,yBAChBI,YAAYkC,IAAI,CAACrB,QACjB;wBACAiD,IACE,WACA,eACA,CAAC,gBAAgB,EAAEjD,MAAMJ,MAAM,CAAC,4BAA4B,CAAC,GAC3D;oBAEN;oBACA;gBACF;YACA;gBACE;QACJ;IACF;IAEA,IAAI,CAAC4N,mBAAmB,CAACC,oBAAoB;QAC3CxK,IACE,SACA,SACA,+DACE;IAEN;IAEA,IAAI0K,mBAAmB3O,sBAAsB;QAC3CiE,IACE,WACA,eACA,CAAC,YAAY,EAAE0K,gBAAgB,gCAAgC,CAAC,GAC9D;IAEN;IACA,MAAMI,cAAc5D,OACjB6D,KAAK,CAAC,MACNC,MAAM,CAAC,CAACC,SAASC,OAASC,KAAKC,GAAG,CAACH,SAASC,KAAKvO,MAAM,GAAG;IAC7D,IAAImO,cAAcjP,mBAAmB;QACnCmE,IACE,WACA,eACA,CAAC,oBAAoB,EAAE8K,YAAY,gCAAgC,CAAC,GAClE;IAEN;IAEA5J,QAAQS,GAAG,CACT,SACA;QACE4I,kBAAkB,mBAAmB;QACrCC,qBAAqB,kBAAkB;KACxC,CACEa,MAAM,CAAC7J,SACPV,IAAI,CAAC,SAAS;IAGnB,uEAAuE;IACvE,0EAA0E;IAC1E,sDAAsD;IACtD,IAAI,CAACO,UAAU;QACb,IAAI0I,YAAYxP,IAAI,EAAE;YACpB8M,OAAO1F,GAAG,CAAC,WAAW;YACtBT,QAAQS,GAAG,CACT,WACA,CAAC,MAAM,EAAE;mBAAIoI;aAAY,CAACjJ,IAAI,CAAC,MAAM,4BAA4B,CAAC,GAChE;QAEN,OAAO;YACLI,QAAQS,GAAG,CAAC,WAAW;QACzB;IACF,OAAO,IAAI,CAACoI,YAAYxP,IAAI,EAAE;QAC5B2G,QAAQS,GAAG,CACT,WACAuI,kBAAkB3P,IAAI,GAClB,CAAC,+BAA+B,EAAE;eAAI2P;SAAkB,CAACpJ,IAAI,CAAC,MAAM,CAAC,CAAC,GACpE,qDACF;IAER,OAAO;QACL,MAAMwK,UAAUtB,eAAezP,IAAI,GAC/B;eAAIyP;SAAe,CAChBvH,GAAG,CAAC,CAACnE,SACJuL,UAAUhK,GAAG,CAACvB,UAAU,GAAGA,OAAO,WAAW,CAAC,GAAG,GAAGA,OAAO,eAAe,CAAC,EAE5EwC,IAAI,CAAC,QACR;QACJI,QAAQS,GAAG,CACT,WACA;YACE,CAAC,MAAM,EAAE;mBAAIoI;aAAY,CAACjJ,IAAI,CAAC,OAAO;YACtCwK;YACArB,cACI,GAAGA,YAAY,yCAAyC,CAAC,GACzD;SACL,CACEoB,MAAM,CAAC7J,SACPV,IAAI,CAAC;IAEZ;IAEA,MAAMyK,MAAM3G,aAAa/F,SAASxB,WAAWwH;IAC7C,KAAK,MAAMxI,OAAOkP,IAAIpF,OAAO,CAAE;QAC7BnG,IACE,SACA,YACA,CAAC,cAAc,EAAE3D,IAAI,qCAAqC,CAAC,GACzD,GAAGpC,qBAAqB6G,IAAI,CAAC,MAAM,sCAAsC,CAAC;IAEhF;IACA,KAAK,MAAMzE,OAAOkP,IAAInF,cAAc,CAAE;QACpCpG,IACE,WACA,YACA,CAAC,kBAAkB,EAAE3D,IAAI,8CAA8C,CAAC,GACtE,GAAGpC,qBAAqB6G,IAAI,CAAC,MAAM,uBAAuB,CAAC;IAEjE;IACA,IAAIyK,IAAIjF,eAAe,EAAE;QACvBtG,IACE,WACA,YACA,CAAC,8DAA8D,CAAC,GAC9D,CAAC,CAAC,EAAEuL,IAAIjF,eAAe,CAAC,EAAE,CAAC;IAEjC;IACA,IAAIiF,IAAIlF,QAAQ,EAAE;QAChBrG,IACE,SACA,YACA,CAAC,kDAAkD,EAAEuL,IAAIlF,QAAQ,CAAC,KAAK,CAAC,GACtE;IAEN;IACA,2EAA2E;IAC3E,uEAAuE;IACvE,KAAK,MAAMhK,OAAOlC,wBAAyB;QACzC,MAAM+L,OAAOqF,IAAIvE,OAAO,CAAC3K,IAAI;QAC7B,IAAI,CAAC6J,MAAM;QACX,MAAMsF,QAAQpR,wBAAwB,CAACiC,IAAI;QAC3C,IAAI6J,SAAS,KAAK;YAChB,IAAI7J,QAAQ,SAAS;gBACnB2D,IACE,WACA,YACA,oEACE,kEACA;YAEN;YACA;QACF;QACA,MAAM+B,UAAUmE,KAAKmF,MAAM,CAAC,CAAC/L,OAAS,CAACkM,MAAM3L,GAAG,CAACP;QACjD,IAAIyC,QAAQpF,MAAM,EAAE;YAClBqD,IACE,SACA,YACA,CAAC,MAAM,EAAE+B,QAAQjB,IAAI,CAAC,MAAM,iBAAiB,EAAEzE,IAAI,iBAAiB,CAAC,GACnE,CAAC,KAAK,EAAE0F,QAAQpF,MAAM,KAAK,IAAI,OAAO,QAAQ,GAC7CN,CAAAA,QAAQ,UACL,oEACA,EAAC;QAEX;IACF;IACA6E,QAAQS,GAAG,CACT,YACA4J,IAAIrF,IAAI,CAAC3L,IAAI,GAAG,CAAC,MAAM,EAAE;WAAIgR,IAAIrF,IAAI;KAAC,CAACxF,IAAI,GAAGI,IAAI,CAAC,OAAO,GAAG;IAG/D,MAAME,WAAWpC,oBAAoBC,SAASxB;IAC9C,KAAK,MAAMmK,WAAWlF,mBAAmBzD,SAASxB,WAAY;QAC5D2C,IAAI,WAAW,eAAewH;IAChC;IACAzG,qBAAqBC,UAAUC,SAASjB,KAAKkB,SAAS,CAACqG,QACrDF,OAAO1F,GAAG,CAAC4F,OAAO;IAGpB,OAAO;QACLY,IAAI,CAAChB,SAAStB,IAAI,CAAC,CAAC4F,UAAYA,QAAQnE,KAAK,KAAK;QAClDH;QACAiB,QAAQT;QACRU,SAAS;YAAEC,UAAUiC;YAAiBhC,aAAaiC;QAAmB;QACtE5P,eAAeoG;IACjB;AACF;AAEA;;;;;;;;CAQC,GACD,OAAO,SAAS0K,kBACdxE,MAAc,EACdjG,OAAsB;IAEtB,IAAI;QACF,OAAOgG,cAAcC,QAAQjG;IAC/B,EAAE,OAAO4H,OAAO;QACd,OAAO;YACLV,IAAI;YACJhB,UAAU;gBACR;oBACEG,OAAO;oBACPC,OAAO;oBACPC,SACE,oEACA,CAAC,WAAW,EACVqB,iBAAiBC,QAAQD,MAAMrB,OAAO,GAAG7E,OAAOkG,QAChD;gBACN;aACD;YACDT,QAAQtN,YAAY2H,GAAG,CAAC,CAACjC,KAAQ,CAAA;oBAC/BA;oBACAwB,OAAO3H,YAAY,CAACmG,GAAG;oBACvB6G,QAAQ7G,OAAO,UAAU,SAAS;gBACpC,CAAA;YACA6H,SAAS;gBAAEC,UAAU;gBAAOC,aAAa;YAAM;YAC/C3N,eAAe2D;QACjB;IACF;AACF"}
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/plugin-bundle-checks.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Static plugin-bundle checks (AGL-426) — Strapi `strapi-plugin verify`\n * parity, but ALSO enforced server-side: the publish API runs the same\n * checks, so a bundle that fails locally fails there identically.\n *\n * The bundle is PARSED and the tree analysed (AGL-964). The checks used to\n * match source text with regexes, which meant they could not see computed\n * member access, could not follow a value into a call, and could not tell\n * code from a comment — `g['ev'+'al'](…)` passed while the words `eval(`\n * inside a comment failed. On a minified bundle, which every published\n * artifact is, that is close to no signal at all.\n *\n * These are still cheap heuristics, NOT a sandbox: they catch honest build\n * mistakes (leftover imports, missing entry exports, oversized bundles),\n * flag the APIs the platform never wants in marketplace code, and surface\n * the questions a reviewer should ask. A determined author can still hide\n * intent from any static pass. The real security boundary stays the trust\n * chain (sandbox iframe + per-manifest CSP / staff review + realm signing /\n * sha pinning / the kill switch).\n */\n\nimport { parse, type Node, type Options } from 'acorn'\n// The leaf, not the barrel: the phishing screen's own reading of an input's\n// type, autocomplete token and raw HTML (AGL-3362).\nimport {\n  credentialForInputAttribute,\n  credentialInHtml,\n} from '@aglyn/shared-util-email/hosted-page-screen'\nimport { lookalikeBrandForHost } from '@aglyn/shared-util-email/outbound-phishing-screen'\nimport type { PluginContributions } from '../plugin-manager/plugin-contributions'\nimport {\n  PLUGIN_HOST_ABI_KEYS,\n  PLUGIN_HOST_GLOBAL,\n  PLUGIN_HOST_MODULE_KEYS,\n} from './plugin-host-abi'\nimport { REALM_HOST_SURFACE_NAMES } from './realm-host-surface.generated'\n\n/** The areas the verifier reports on, in the order a reviewer reads them. */\nexport type BundleCheckId =\n  | 'parse'\n  | 'entry'\n  | 'self-contained'\n  | 'host-abi'\n  | 'size'\n  | 'code-execution'\n  | 'globals'\n  | 'storage'\n  | 'dynamic-import'\n  | 'network'\n  | 'obfuscation'\n  | 'contributions'\n  | 'credentials'\n\nexport interface BundleCheckProblem {\n  level: 'error' | 'warning'\n  message: string\n  /**\n   * Which check produced this. Optional so a verdict stored by an older\n   * checker still reads — those findings render on their own rather than\n   * under a check row.\n   */\n  check?: BundleCheckId\n}\n\n/**\n * `unknown` is the one that earns its keep (AGL-1087). A check that could\n * not run — the network diff with no manifest supplied, everything at all\n * when the parse failed — must not render as green, or the page tells a\n * reviewer something was verified when nothing looked at it.\n */\nexport type BundleCheckStatus = 'pass' | 'fail' | 'question' | 'unknown'\n\nexport interface BundleCheckSummary {\n  id: BundleCheckId\n  /** Reviewer-facing name of the area. */\n  label: string\n  status: BundleCheckStatus\n  /** What the check actually saw, when that is worth stating on its own. */\n  detail?: string\n}\n\nexport interface BundleCheckResult {\n  ok: boolean\n  problems: BundleCheckProblem[]\n  /** Every area, including the ones that found nothing (AGL-1087). */\n  checks: BundleCheckSummary[]\n  /** Which entry exports the source declares. */\n  exports: { register: boolean; registerApi: boolean }\n  /** What `register()` visibly registers (AGL-3116). */\n  contributions: DetectedContributions\n}\n\n/**\n * What a bundle's `register()` visibly registers (AGL-3116): the declaration\n * its registration calls imply, read from the tree.\n */\nexport interface DetectedContributions {\n  contributes: PluginContributions\n  /**\n   * Registrations the checker saw and could not read — an argument built at\n   * runtime. What they contribute is unknown, so a declaration cannot be\n   * checked against them and a reviewer has to read them.\n   */\n  unresolved: string[]\n}\n\nconst CHECK_LABELS: Record<BundleCheckId, string> = {\n  parse: 'Parses as an ES module',\n  entry: 'Exports an entry point',\n  'self-contained': 'Self-contained (no static imports)',\n  'host-abi': 'Reads only what the host provides',\n  size: 'Within the size limit',\n  'code-execution': 'No eval / Function constructor',\n  globals: 'No computed access on a global',\n  storage: 'No direct storage or cookie access',\n  'dynamic-import': 'No dynamic import of unknown code',\n  network: 'Network calls match the manifest',\n  obfuscation: 'No obfuscation shapes',\n  contributions: 'Registrations match the declared contributions',\n  credentials: 'No password, card or one-time-code inputs',\n}\n\n/** Check order as displayed — findings first would reorder on every bundle. */\nconst CHECK_ORDER: BundleCheckId[] = [\n  'parse',\n  'entry',\n  'self-contained',\n  'host-abi',\n  'size',\n  'code-execution',\n  'globals',\n  'storage',\n  'dynamic-import',\n  'network',\n  'obfuscation',\n  'contributions',\n  'credentials',\n]\n\nexport const MAX_PLUGIN_BUNDLE_BYTES = 1_000_000\n\n/**\n * Stamped onto a cached verdict (AGL-962) so a stored result outlives only\n * the checker that produced it.\n *\n * `checkPluginBundle` is pure over immutable, content-addressed bytes, so a\n * verdict for a given sha256 never changes — but the CHECKS do. **Bump this\n * whenever a rule is added, removed or loosened**, and every stored verdict\n * from the old checker is ignored and recomputed on next read. Forgetting to\n * bump means a reviewer sees a verdict from a checker that no longer exists,\n * which is the failure mode re-running the verifier was meant to prevent.\n *\n * 2 — AST analysis replaces the regex scan (AGL-964).\n * 3 — per-check summary added to the verdict (AGL-1087).\n * 4 — calls through an alias are resolved (AGL-1090).\n * 5 — URLs held in a constant are resolved (AGL-1093).\n * 6 — registrations are compared with the declared contributions (AGL-3116).\n * 7 — inputs that collect a password, card or one-time code (AGL-3362).\n * 8 — declared network origins that are a brand's lookalike (AGL-3365).\n * 9 — lookups on the host ABI name only keys a host provides (AGL-3392).\n */\nexport const PLUGIN_VERIFIER_VERSION = 10\n\n/** A verdict as stored on a `pluginVersions` doc (AGL-962). */\nexport interface StoredBundleVerdict {\n  ok?: boolean\n  problems?: BundleCheckProblem[]\n  /** Present from verifier 3 on (AGL-1087). */\n  checks?: BundleCheckSummary[]\n  sha256?: string\n  verifierVersion?: number\n}\n\n/**\n * Whether a stored verdict may be served instead of re-running the checks.\n *\n * Fails closed on every mismatch: no verdict, a verdict for different bytes\n * (a republished version keeps its version string but changes sha), or a\n * verdict from a checker that has since changed. Any of those means\n * download-and-recompute, which costs one page view rather than showing a\n * reviewer a verdict that was never true of the bundle in front of them.\n */\nexport function isStoredVerdictCurrent(\n  stored: StoredBundleVerdict | null | undefined,\n  sha256: string,\n): boolean {\n  if (!stored || !sha256) return false\n  return (\n    stored.sha256 === sha256 &&\n    Number(stored.verifierVersion) === PLUGIN_VERIFIER_VERSION\n  )\n}\n\n/**\n * Globals whose properties are the platform's business. Computed access on\n * one of these is flagged as computed access rather than by trying to\n * enumerate the property names an author might reach — `g[k]` hides its\n * property from any static pass, so the ACCESS is the finding.\n */\nconst GLOBAL_ROOTS = new Set([\n  'globalThis',\n  'window',\n  'self',\n  'top',\n  'parent',\n  'frames',\n  'document',\n])\n\n/** Storage the platform never wants reached directly (use host-mediated data). */\nconst STORAGE_NAMES = new Set(['localStorage', 'sessionStorage', 'indexedDB'])\n\n/** Network entry points, by the name they are called/constructed under. */\nconst NETWORK_CALLS = new Set(['fetch', 'sendBeacon'])\nconst NETWORK_CONSTRUCTORS = new Set([\n  'XMLHttpRequest',\n  'WebSocket',\n  'EventSource',\n])\n\n/**\n * Names worth following through an alias (AGL-1090).\n *\n * `const f = fetch; f(url)` used to pass every check, and the network row\n * rendered a green \"no network calls\" rather than going quiet — a two-line\n * indirection defeating the signal this whole verifier exists to produce.\n * Aliasing a VALUE was the exact gap the project was created to close, and\n * resolving global objects (`const g = globalThis`) never covered it.\n *\n * Reassignment, `arr[0]`, an object property and passing the function as an\n * argument all stay out of reach. The bar is that the cheap form is not free.\n */\nconst ALIASABLE_CALLABLES = new Set([\n  'eval',\n  'Function',\n  'fetch',\n  'sendBeacon',\n  'XMLHttpRequest',\n  'WebSocket',\n  'EventSource',\n])\n\n/**\n * Callees that legitimately take an absolute URL and reach nothing — so a URL\n * literal passed to them is not a call the network check failed to follow.\n * `createElementNS` matters most: an SVG namespace argument appears in a large\n * share of real bundles.\n */\nconst URL_TAKING_NON_CALLS = new Set([\n  'URL',\n  'URLSearchParams',\n  'createElementNS',\n  'createDocument',\n])\n\n/** Beyond this, a single line is not source a reviewer can read. */\nconst MAX_READABLE_LINE = 100_000\n/** A base64 blob at least this long is worth decoding before approving. */\nconst MIN_SUSPICIOUS_BASE64 = 1024\n/** How many `_0x…` names before the bundle counts as machine-obfuscated. */\nconst MIN_OBFUSCATED_NAMES = 5\n/** Verdicts are stored on a version doc; keep them bounded. */\nconst MAX_PROBLEMS = 40\n\nconst OBFUSCATED_NAME = /^_0x[0-9a-f]{4,}$/i\nconst BASE64_BLOB = /^[A-Za-z0-9+/\\r\\n]+={0,2}$/\n\ntype AnyNode = Node & Record<string, unknown>\n\n/**\n * Child keys that are NOT expressions in the surrounding scope — a\n * non-computed `.property`, an object literal key, a label. Walking into\n * them would read `x.localStorage` on an unrelated object as a global\n * storage access.\n */\nconst skippedChild = (node: AnyNode, key: string): boolean => {\n  switch (node.type) {\n    case 'MemberExpression':\n      return key === 'property' && !node['computed']\n    case 'Property':\n    case 'PropertyDefinition':\n    case 'MethodDefinition':\n      return key === 'key' && !node['computed']\n    case 'LabeledStatement':\n    case 'BreakStatement':\n    case 'ContinueStatement':\n      return key === 'label'\n    case 'ImportSpecifier':\n    case 'ExportSpecifier':\n      return true\n    default:\n      return false\n  }\n}\n\n/** Depth-first walk over every expression-position node in the tree. */\nfunction walk(root: AnyNode, visit: (node: AnyNode) => void): void {\n  const stack: AnyNode[] = [root]\n  while (stack.length) {\n    const node = stack.pop()\n    if (!node) continue\n    visit(node)\n    for (const key of Object.keys(node)) {\n      if (key === 'type' || key === 'start' || key === 'end') continue\n      if (skippedChild(node, key)) continue\n      const value = node[key]\n      if (Array.isArray(value)) {\n        for (const item of value) {\n          if (item && typeof item === 'object' && typeof item.type === 'string')\n            stack.push(item as AnyNode)\n        }\n      } else if (\n        value &&\n        typeof value === 'object' &&\n        typeof (value as AnyNode).type === 'string'\n      ) {\n        stack.push(value as AnyNode)\n      }\n    }\n  }\n}\n\n/**\n * The string a node evaluates to, when that is knowable without running it.\n * Covers the shapes used to hide a property name from a text scan: a\n * string literal, a template with no interpolation, and literals added\n * together (`'ev' + 'al'`).\n */\nfunction staticString(\n  node: AnyNode | null | undefined,\n  constants?: ReadonlyMap<string, string>,\n): string | null {\n  if (!node) return null\n  if (node.type === 'Literal')\n    return typeof node['value'] === 'string' ? (node['value'] as string) : null\n  // A name bound once to a constant string (AGL-1093). `const ENDPOINT =\n  // 'https://…'; fetch(ENDPOINT)` is the idiomatic way to write a request,\n  // and refusing to read it meant the network diff quietly did not run for\n  // the bundles most likely to be honest.\n  if (node.type === 'Identifier' && constants)\n    return constants.get(node['name'] as string) ?? null\n  if (node.type === 'TemplateLiteral') {\n    const expressions = (node['expressions'] ?? []) as AnyNode[]\n    const quasis = (node['quasis'] ?? []) as Array<{\n      value: { cooked?: string }\n    }>\n    if (!expressions.length) {\n      return quasis.length === 1 ? quasis[0]?.value?.cooked ?? null : null\n    }\n    // `${BASE}/zen` — resolvable exactly when every hole is.\n    let out = ''\n    for (let index = 0; index < quasis.length; index += 1) {\n      out += quasis[index]?.value?.cooked ?? ''\n      if (index < expressions.length) {\n        const filled = staticString(expressions[index], constants)\n        if (filled === null) return null\n        out += filled\n      }\n    }\n    return out\n  }\n  if (node.type === 'BinaryExpression' && node['operator'] === '+') {\n    const left = staticString(node['left'] as AnyNode, constants)\n    const right = staticString(node['right'] as AnyNode, constants)\n    return left !== null && right !== null ? left + right : null\n  }\n  return null\n}\n\n/** The property name a member expression reads, computed or not. */\nfunction propertyName(\n  node: AnyNode,\n  constants?: ReadonlyMap<string, string>,\n): string | null {\n  const property = node['property'] as AnyNode\n  if (!node['computed'])\n    return property?.type === 'Identifier'\n      ? (property['name'] as string)\n      : null\n  return staticString(property, constants)\n}\n\n/**\n * The origin of a URL argument, when it is a knowable http(s) URL.\n *\n * Scheme-checked HERE, once (AGL-1094). An opaque origin — every `data:`,\n * `blob:` and `javascript:` URL — makes `new URL(x).origin` the STRING\n * `\"null\"`, and a caller that then re-parsed that string threw `Invalid URL`\n * and took the whole checker down with it. Nothing downstream should have to\n * know that, so nothing downstream gets the chance.\n */\nfunction literalOrigin(\n  node: AnyNode | undefined,\n  constants?: ReadonlyMap<string, string>,\n): string | null {\n  const value = staticString(node, constants)\n  if (!value) return null\n  try {\n    const url = new URL(value)\n    return /^https?:$/.test(url.protocol) ? url.origin : null\n  } catch {\n    return null\n  }\n}\n\ninterface CheckOptions {\n  maxBytes?: number\n  /**\n   * The origins the manifest declares under `capabilities.network`. A\n   * network call the manifest does not account for is the single most\n   * useful signal the tree makes available — and the per-manifest CSP\n   * would block it at runtime anyway, so the bundle and its manifest\n   * disagreeing is a bug the publisher wants to hear about at publish\n   * time, not a mystery in production. Undefined = \"not supplied\", which\n   * downgrades those findings to warnings, because a checker that was\n   * never told what was declared cannot claim anything was undeclared.\n   */\n  declaredNetwork?: string[]\n  /**\n   * The manifest's `contributes` block (AGL-3116): `null` when the manifest\n   * declares none, `undefined` when no manifest was supplied — which leaves\n   * the comparison `unknown`, as the network diff is without its manifest.\n   */\n  declaredContributions?: PluginContributions | null\n  /**\n   * Refuse a bundle that registers something while its manifest declares no\n   * contributions at all. Set where a NEW version is judged — the publish\n   * pipeline and the local verifier that mirrors it. The review page and the\n   * re-verification sweep judge versions published before the contract,\n   * which load under its default, and a rule they were never held to must\n   * not turn them red after the fact.\n   */\n  requireContributions?: boolean\n}\n\n/** The detection result of a bundle no pass could read. */\nconst NOTHING_DETECTED: DetectedContributions = { contributes: {}, unresolved: [] }\n\n/**\n * Registration calls whose argument says what a bundle contributes, by the\n * name they are reached through: `h.aglyn.registerConsoleExtension(...)`,\n * `registerConsoleExtension(...)` after the realm template's host mapping,\n * `aglyn.components.registerComponent(...)`.\n */\nconst REGISTRATION_CALLS = new Set([\n  'registerConsoleExtension',\n  'registerSiteRuntime',\n  'registerComponent',\n  'addDependency',\n  'defineUiFeatureBundle',\n])\n\n/**\n * Console extension fields the shell draws on every screen of a workspace:\n * nav tabs, organization tabs, providers, staff pages and the dashboard and\n * settings entries. A plugin registering any of them loads with the shell.\n */\nconst SHELL_EXTENSION_FIELDS = [\n  'navItems',\n  'orgNavItems',\n  'providers',\n  'staffPages',\n  'dashboardCards',\n  'settingsSections',\n]\n\n/**\n * What `register()` visibly registers (AGL-3116), read from the tree.\n *\n * A heuristic like every check here: it reads registration calls whose\n * arguments are written out — an object literal, a string or a named slot —\n * and reports every call it cannot read as `unresolved` rather than guessing.\n * The declaration stays the contract; this is how a publisher learns theirs\n * is incomplete before a published page fails to load the plugin.\n */\nfunction detectRegistrations(\n  program: AnyNode,\n  constants: ReadonlyMap<string, string>,\n): DetectedContributions {\n  const slots = new Set<string>()\n  const routes = new Set<string>()\n  const orgRoutes = new Set<string>()\n  const components = new Set<string>()\n  const features = new Set<string>()\n  const unresolved = new Set<string>()\n  let shell = false\n\n  const objectProperty = (\n    object: AnyNode | undefined,\n    name: string,\n  ): AnyNode | undefined => {\n    if (object?.type !== 'ObjectExpression') return undefined\n    for (const property of (object['properties'] ?? []) as AnyNode[]) {\n      if (property.type !== 'Property') continue\n      const key = property['key'] as AnyNode\n      const keyName =\n        !property['computed'] && key?.type === 'Identifier'\n          ? (key['name'] as string)\n          : staticString(key, constants)\n      if (keyName === name) return property['value'] as AnyNode\n    }\n    return undefined\n  }\n  const listOf = (node: AnyNode | undefined): AnyNode[] | null =>\n    node?.type === 'ArrayExpression' ? ((node['elements'] ?? []) as AnyNode[]) : null\n  // A slot as a widget names it: a string, or a catalog entry\n  // (`CONSOLE_WIDGET_SLOTS.hostActivity`), whose property IS the slot id.\n  const slotName = (node: AnyNode | undefined): string | null => {\n    const literal = staticString(node, constants)\n    if (literal !== null) return literal\n    return node?.type === 'MemberExpression' ? propertyName(node, constants) : null\n  }\n\n  walk(program, (node) => {\n    if (node.type !== 'CallExpression') return\n    const callee = node['callee'] as AnyNode\n    const name =\n      callee?.type === 'Identifier'\n        ? (callee['name'] as string)\n        : callee?.type === 'MemberExpression'\n          ? propertyName(callee, constants)\n          : null\n    if (!name || !REGISTRATION_CALLS.has(name)) return\n    const args = (node['arguments'] ?? []) as AnyNode[]\n    if (name === 'registerConsoleExtension') {\n      const extension = args[0]\n      if (extension?.type !== 'ObjectExpression') {\n        unresolved.add('a console extension built at runtime')\n        return\n      }\n      const widgets = objectProperty(extension, 'widgets')\n      if (widgets) {\n        const list = listOf(widgets)\n        if (!list) unresolved.add('a console widget list built at runtime')\n        for (const widget of list ?? []) {\n          const slot = slotName(objectProperty(widget, 'slot'))\n          if (slot) slots.add(slot)\n          else unresolved.add('a console widget whose slot is built at runtime')\n        }\n      }\n      for (const field of SHELL_EXTENSION_FIELDS) {\n        const value = objectProperty(extension, field)\n        if (!value) continue\n        shell = true\n        if (field !== 'navItems' && field !== 'orgNavItems') continue\n        const into = field === 'navItems' ? routes : orgRoutes\n        const list = listOf(value)\n        if (!list) unresolved.add(`console ${field} built at runtime`)\n        for (const item of list ?? []) {\n          const href = staticString(objectProperty(item, 'href'), constants)\n          if (href) into.add(href)\n          else unresolved.add(`a console ${field} entry whose href is built at runtime`)\n        }\n      }\n      return\n    }\n    if (name === 'registerSiteRuntime') {\n      const id = staticString(objectProperty(args[0], 'runtimeId'), constants)\n      if (id) features.add(id)\n      else unresolved.add('a site runtime whose runtimeId is built at runtime')\n      return\n    }\n    if (name === 'registerComponent') {\n      const id = staticString(objectProperty(args[1], '$id'), constants)\n      if (id) components.add(id)\n      else unresolved.add('a canvas component whose $id is built at runtime')\n      return\n    }\n    // `addDependency` / `defineUiFeatureBundle`: a component bundle whose\n    // entries register later, from a list this pass does not follow.\n    unresolved.add('a canvas component bundle')\n  })\n\n  const contributes: PluginContributions = {}\n  if (components.size || features.size) {\n    contributes.site = {\n      ...(components.size ? { components: [...components].sort() } : {}),\n      ...(features.size ? { features: [...features].sort() } : {}),\n    }\n  }\n  if (slots.size || routes.size || orgRoutes.size || shell) {\n    contributes.console = {\n      ...(slots.size ? { slots: [...slots].sort() } : {}),\n      ...(routes.size ? { routes: [...routes].sort() } : {}),\n      ...(orgRoutes.size ? { orgRoutes: [...orgRoutes].sort() } : {}),\n      ...(shell ? { shell: true } : {}),\n    }\n  }\n  return { contributes, unresolved: [...unresolved].sort() }\n}\n\n/** A declaration in the words a reviewer reads: `console slots hostActivity`. */\nfunction describeContributions(contributes: PluginContributions): string {\n  const parts: string[] = []\n  const site = contributes.site ?? {}\n  const shell = contributes.console ?? {}\n  if (site.components?.length) parts.push(`site components ${site.components.join(', ')}`)\n  if (site.features?.length) parts.push(`site features ${site.features.join(', ')}`)\n  if (shell.slots?.length) parts.push(`console slots ${shell.slots.join(', ')}`)\n  if (shell.routes?.length) parts.push(`console routes ${shell.routes.join(', ')}`)\n  if (shell.orgRoutes?.length) {\n    parts.push(`console organization routes ${shell.orgRoutes.join(', ')}`)\n  }\n  if (shell.shell) parts.push('the console shell')\n  return parts.join(' · ') || 'nothing'\n}\n\n/**\n * The `contributions` area (AGL-3116): what the bundle registers against what\n * its manifest declares.\n *\n * Every registration the tree shows must be declared, because the loaders\n * read ONLY the declaration: a slot the manifest omits is a slot whose\n * screens never load the plugin, and a component it omits is an element that\n * renders empty on every published page that places it. A declared entry the\n * bundle never registers is a warning — the plugin loads there for nothing.\n */\nfunction compareContributions(\n  detected: DetectedContributions,\n  options: CheckOptions | undefined,\n  add: (\n    level: BundleCheckProblem['level'],\n    check: BundleCheckId,\n    message: string,\n  ) => void,\n  details: Map<BundleCheckId, string>,\n  markUnknown: (check: BundleCheckId) => void,\n): void {\n  const found = detected.contributes\n  const registers = describeContributions(found)\n  const registersSomething =\n    Boolean(found.site || found.console) || detected.unresolved.length > 0\n  const unreadable = detected.unresolved.length\n    ? ` It also makes registrations the checker could not read: ${detected.unresolved.join('; ')}.`\n    : ''\n  const declared = options?.declaredContributions\n  if (declared === undefined) {\n    // Nothing to compare against is `unknown`, never a pass — the same\n    // reading the network row gives a bundle checked without its manifest.\n    if (!registersSomething) {\n      details.set('contributions', 'registers nothing')\n      return\n    }\n    markUnknown('contributions')\n    details.set(\n      'contributions',\n      `registers ${registers} — no manifest was supplied, so nothing was compared`,\n    )\n    return\n  }\n  if (declared === null) {\n    details.set(\n      'contributions',\n      registersSomething ? `undeclared · registers ${registers}` : 'declares and registers nothing',\n    )\n    if (!registersSomething) return\n    add(\n      options?.requireContributions ? 'error' : 'warning',\n      'contributions',\n      `the manifest declares no \"contributes\", and register() registers ` +\n        `${registers}.${unreadable} Declare it — ` +\n        `\"contributes\": ${JSON.stringify(found)} — because the loaders place ` +\n        'a plugin by its declaration alone. Undeclared, a published page ' +\n        'loads it only where its element is placed and the console loads it ' +\n        'with the shell.',\n    )\n    return\n  }\n\n  details.set('contributions', `declares ${describeContributions(declared)}`)\n  const missing = (\n    label: string,\n    registered: readonly string[] | undefined,\n    listed: readonly string[] | undefined,\n    consequence: string,\n  ) => {\n    for (const id of registered ?? []) {\n      if ((listed ?? []).includes(id)) continue\n      add(\n        'error',\n        'contributions',\n        `register() registers ${label} \"${id}\", which the manifest does not ` +\n          `declare — ${consequence}`,\n      )\n    }\n  }\n  missing(\n    'the site component',\n    found.site?.components,\n    declared.site?.components,\n    'a published page that places it would never load the plugin',\n  )\n  missing(\n    'the site feature',\n    found.site?.features,\n    declared.site?.features,\n    'no published page would ever load the plugin to run it',\n  )\n  missing(\n    'a widget in the console slot',\n    found.console?.slots,\n    declared.console?.slots,\n    'a console page that renders the slot would never load the plugin',\n  )\n  missing(\n    'the console route',\n    found.console?.routes,\n    declared.console?.routes,\n    'the route would not find the plugin that serves it',\n  )\n  missing(\n    'the console organization route',\n    found.console?.orgRoutes,\n    declared.console?.orgRoutes,\n    'the route would not find the plugin that serves it',\n  )\n  if (found.console?.shell && !declared.console?.shell) {\n    add(\n      'error',\n      'contributions',\n      'register() adds a nav tab, a provider or another entry the console ' +\n        'shell draws on every page, and the manifest does not declare ' +\n        '\"console\": { \"shell\": true } — the shell would draw it only on ' +\n        'pages that happened to load the plugin for something else',\n    )\n  }\n  if (detected.unresolved.length) {\n    add(\n      'warning',\n      'contributions',\n      `the checker could not read ${detected.unresolved.join('; ')} — ` +\n        'confirm the declaration covers what it registers',\n    )\n  }\n  const unused = (\n    label: string,\n    listed: readonly string[] | undefined,\n    registered: readonly string[] | undefined,\n  ) => {\n    // Only when every registration of that kind was readable: an unreadable\n    // one may be exactly the entry that is declared.\n    if (detected.unresolved.length) return\n    for (const id of listed ?? []) {\n      if ((registered ?? []).includes(id)) continue\n      add(\n        'warning',\n        'contributions',\n        `the manifest declares ${label} \"${id}\", and register() never ` +\n          'registers it — the plugin would load there for nothing',\n      )\n    }\n  }\n  unused('the site component', declared.site?.components, found.site?.components)\n  unused('the site feature', declared.site?.features, found.site?.features)\n  unused('the console slot', declared.console?.slots, found.console?.slots)\n}\n\n/**\n * Inputs a bundle builds that collect a password, a card number or a\n * one-time code (AGL-3362) — a reviewer's QUESTION, never a failure.\n *\n * The phishing screen holds a published page whose author defined such a\n * field, but a plugin renders its own inputs from code the page screen never\n * reads. So the same reading is applied here, to the bundle, at review: an\n * input's `type` or `autocomplete` in an object literal (`createElement`\n * props, a JSX runtime call, a DOM `Object.assign`), in `setAttribute`, and\n * in any HTML string. A warning rather than an error because a legitimate\n * plugin can own a sign-in (a members-only area, a booking account); what the\n * reviewer asks is whether its credentials go anywhere but its declared\n * origins. The sandbox tier cannot post a native form at all — its frame\n * has no `allow-forms` and its CSP says `form-action 'none'` — so the\n * question is about `connect-src`, which the network check already lists.\n */\nfunction credentialInputsIn(\n  program: AnyNode,\n  constants: ReadonlyMap<string, string>,\n): string[] {\n  const found = new Set<'password' | 'card' | 'otp'>()\n  const keyOf = (node: AnyNode): string | null => {\n    const key = node['key'] as AnyNode\n    if (!key) return null\n    if (!node['computed'] && key.type === 'Identifier') return key['name'] as string\n    return staticString(key, constants)\n  }\n  walk(program, (node) => {\n    if (node.type === 'Property') {\n      const key = keyOf(node)\n      const value = staticString(node['value'] as AnyNode, constants)\n      const field = key && value !== null ? credentialForInputAttribute(key, value) : null\n      if (field) found.add(field)\n    } else if (node.type === 'CallExpression') {\n      const callee = node['callee'] as AnyNode\n      const args = (node['arguments'] ?? []) as AnyNode[]\n      if (callee?.type === 'MemberExpression' && propertyName(callee, constants) === 'setAttribute') {\n        const name = staticString(args[0], constants)\n        const value = staticString(args[1], constants)\n        const field = name !== null && value !== null ? credentialForInputAttribute(name, value) : null\n        if (field) found.add(field)\n      }\n    } else if (node.type === 'Literal' && typeof node['value'] === 'string') {\n      const field = credentialInHtml(node['value'] as string)\n      if (field) found.add(field)\n    } else if (node.type === 'TemplateLiteral') {\n      const text = ((node['quasis'] ?? []) as AnyNode[])\n        .map((quasi) => String((quasi['value'] as { cooked?: string } | undefined)?.cooked ?? ''))\n        .join('')\n      const field = credentialInHtml(text)\n      if (field) found.add(field)\n    }\n  })\n  const words = { password: 'a password', card: 'a card number or security code', otp: 'a one-time code' }\n  return [...found].map(\n    (field) =>\n      `builds an input that collects ${words[field]} — confirm what it is for, and that ` +\n      'it is sent only to the origins the manifest declares',\n  )\n}\n\n/**\n * Declared network origins that wear a brand without being the brand's\n * (AGL-3365) — a reviewer's QUESTION, read with the phishing screen's own\n * lookalike rule (`lookalikeBrandForHost`), the one that holds a link in an\n * email or on a page.\n *\n * The manifest's origins are what the loader stamps into the plugin frame's\n * `connect-src`, so they are exactly where a plugin's data and a visitor's\n * input can go. A plugin that integrates with PayPal declares\n * `https://api-m.paypal.com`, which is PayPal's own domain and passes; one that\n * declares `https://paypal-verify.net` or `https://aglyn-billing.com` is\n * sending somewhere dressed as somebody else. A warning rather than an error\n * because every plugin version is reviewed before it installs, and the\n * reviewer is the one who can ask whose domain it is.\n */\nfunction lookalikeDeclaredOrigins(declared: readonly string[]): string[] {\n  const messages: string[] = []\n  for (const origin of declared) {\n    let host: string\n    try {\n      host = new URL(origin).hostname\n    } catch {\n      continue\n    }\n    const brand = lookalikeBrandForHost(host)\n    if (brand) {\n      messages.push(\n        `the manifest declares ${origin}, which wears the ${brand.label} name ` +\n          `but is not ${brand.label}'s domain — confirm whose it is before approving`,\n      )\n    }\n  }\n  return messages\n}\n\n/**\n * Walks every expression-position node with its parent, by the same rules as\n * {@link walk}.\n */\nfunction walkWithParents(\n  root: AnyNode,\n  visit: (node: AnyNode, parent: AnyNode | null) => void,\n): void {\n  const stack: Array<[AnyNode, AnyNode | null]> = [[root, null]]\n  while (stack.length) {\n    const entry = stack.pop()\n    if (!entry) continue\n    const [node, parent] = entry\n    visit(node, parent)\n    for (const key of Object.keys(node)) {\n      if (key === 'type' || key === 'start' || key === 'end') continue\n      if (skippedChild(node, key)) continue\n      const value = node[key]\n      const children = Array.isArray(value) ? value : [value]\n      for (const child of children) {\n        if (\n          child &&\n          typeof child === 'object' &&\n          typeof (child as AnyNode).type === 'string'\n        ) {\n          stack.push([child as AnyNode, node])\n        }\n      }\n    }\n  }\n}\n\nconst FUNCTION_TYPES = new Set([\n  'FunctionDeclaration',\n  'FunctionExpression',\n  'ArrowFunctionExpression',\n])\n\n/** Nodes that open a scope a name can be declared in. */\nconst SCOPE_TYPES = new Set([\n  'Program',\n  ...FUNCTION_TYPES,\n  'BlockStatement',\n  'StaticBlock',\n  'SwitchStatement',\n  'CatchClause',\n  'ForStatement',\n  'ForInStatement',\n  'ForOfStatement',\n  'ClassExpression',\n])\n\n/** The names a binding pattern declares: `a`, `{ a, b: c }`, `[a, ...b]`, `a = 1`. */\nfunction patternNames(pattern: AnyNode | null | undefined, into: Set<string>): void {\n  if (!pattern) return\n  switch (pattern.type) {\n    case 'Identifier':\n      into.add(pattern['name'] as string)\n      return\n    case 'AssignmentPattern':\n      return patternNames(pattern['left'] as AnyNode, into)\n    case 'RestElement':\n      return patternNames(pattern['argument'] as AnyNode, into)\n    case 'ArrayPattern':\n      for (const element of (pattern['elements'] ?? []) as AnyNode[]) patternNames(element, into)\n      return\n    case 'ObjectPattern':\n      for (const property of (pattern['properties'] ?? []) as AnyNode[]) {\n        patternNames(\n          (property.type === 'RestElement' ? property : property['value']) as AnyNode,\n          into,\n        )\n      }\n      return\n  }\n}\n\n/** The declarations a statement list makes itself: `let`/`const`/`class`/`function`. */\nfunction lexicalNames(statements: readonly AnyNode[], into: Set<string>): void {\n  for (const statement of statements) {\n    if (statement?.type === 'VariableDeclaration' && statement['kind'] !== 'var') {\n      for (const declarator of (statement['declarations'] ?? []) as AnyNode[]) {\n        patternNames(declarator['id'] as AnyNode, into)\n      }\n    }\n    if (\n      (statement?.type === 'FunctionDeclaration' || statement?.type === 'ClassDeclaration') &&\n      statement['id']\n    ) {\n      into.add((statement['id'] as AnyNode)['name'] as string)\n    }\n  }\n}\n\n/** Every `var` a function body declares, however deep, short of a nested function. */\nfunction varNames(node: AnyNode | null | undefined, into: Set<string>): void {\n  if (!node || typeof node !== 'object') return\n  if (FUNCTION_TYPES.has(node.type)) return\n  if (node.type === 'VariableDeclaration' && node['kind'] === 'var') {\n    for (const declarator of (node['declarations'] ?? []) as AnyNode[]) {\n      patternNames(declarator['id'] as AnyNode, into)\n    }\n  }\n  for (const [field, value] of Object.entries(node)) {\n    if (field === 'type' || !value || typeof value !== 'object') continue\n    if (Array.isArray(value)) for (const child of value) varNames(child as AnyNode, into)\n    else if ('type' in (value as object)) varNames(value as AnyNode, into)\n  }\n}\n\n/** The names a scope node declares for its own body. */\nfunction declaredNames(scope: AnyNode): Set<string> {\n  const names = new Set<string>()\n  if (FUNCTION_TYPES.has(scope.type)) {\n    for (const param of (scope['params'] ?? []) as AnyNode[]) patternNames(param, names)\n    if (scope.type === 'FunctionExpression' && scope['id']) {\n      names.add((scope['id'] as AnyNode)['name'] as string)\n    }\n    const body = scope['body'] as AnyNode\n    if (body?.type === 'BlockStatement') {\n      for (const statement of (body['body'] ?? []) as AnyNode[]) varNames(statement, names)\n      lexicalNames((body['body'] ?? []) as AnyNode[], names)\n    }\n    return names\n  }\n  switch (scope.type) {\n    case 'Program':\n    case 'BlockStatement':\n    case 'StaticBlock':\n      lexicalNames((scope['body'] ?? []) as AnyNode[], names)\n      break\n    case 'SwitchStatement':\n      for (const branch of (scope['cases'] ?? []) as AnyNode[]) {\n        lexicalNames((branch['consequent'] ?? []) as AnyNode[], names)\n      }\n      break\n    case 'CatchClause':\n      patternNames(scope['param'] as AnyNode, names)\n      break\n    case 'ForStatement':\n    case 'ForInStatement':\n    case 'ForOfStatement': {\n      const head = (scope['init'] ?? scope['left']) as AnyNode | null\n      if (head?.type === 'VariableDeclaration' && head['kind'] !== 'var') lexicalNames([head], names)\n      break\n    }\n    case 'ClassExpression':\n      if (scope['id']) names.add((scope['id'] as AnyNode)['name'] as string)\n      break\n  }\n  return names\n}\n\n/**\n * Whether an identifier refers to a variable, rather than naming a property,\n * a key or a label.\n */\nfunction isReference(node: AnyNode, parent: AnyNode | null | undefined): boolean {\n  if (!parent) return true\n  switch (parent.type) {\n    case 'MemberExpression':\n      return parent['object'] === node || parent['computed'] === true\n    case 'Property':\n      if (parent['key'] === node && parent['computed'] !== true) {\n        return parent['shorthand'] === true && parent['value'] === node\n      }\n      return true\n    case 'MethodDefinition':\n    case 'PropertyDefinition':\n      return parent['key'] !== node || parent['computed'] === true\n    case 'LabeledStatement':\n    case 'BreakStatement':\n    case 'ContinueStatement':\n      return false\n    case 'ExportSpecifier':\n      return parent['local'] === node\n    case 'ImportSpecifier':\n    case 'ImportDefaultSpecifier':\n    case 'ImportNamespaceSpecifier':\n      return false\n    default:\n      return true\n  }\n}\n\n/**\n * What a bundle reads from the host ABI (AGL-3392), read off the bytes.\n *\n * The realm Rollup configs compile each host import into\n * `const host = globalThis.__AGLYN_PLUGIN_HOST__; … host[\"mui\"]`, and each use\n * of an import into a member read on that: `_aglynHost_mui.Button`. So:\n *\n * - `read` / `unknown` / `computed` are the KEYS a bundle reads off the host\n *   object. A key outside `PLUGIN_HOST_ABI_KEYS` is undefined on every host\n *   and the bundle fails where it is used; a key chosen at runtime cannot be\n *   reviewed at all.\n * - `imports` is what it reads from each host MODULE, by name, so each name\n *   can be checked against what the host holds. A module handed around as a\n *   value (`import * as M`, a spread, a computed read) cannot be narrowed and\n *   records `'*'`.\n *\n * The host is reached through `globalThis.__AGLYN_PLUGIN_HOST__`, a name bound\n * to it, or the parameter of the exported `register(host)` — the last only\n * inside `register` itself, since the same name elsewhere is another variable.\n * A bad key on that parameter is a warning rather than a refusal: bundles\n * written before this check read it freely, and refusing them would report a\n * regression on bytes that are already installed.\n */\nfunction hostAbiReads(\n  program: AnyNode,\n  constants: ReadonlyMap<string, string>,\n  isGlobalRef: (node: AnyNode | null | undefined) => boolean,\n): {\n  read: Set<string>\n  unknown: Set<string>\n  /** Read off `register`'s parameter, which could be a bundle's own mistake. */\n  unknownOnParam: Set<string>\n  computed: number\n  computedOnParam: number\n  imports: Partial<Record<string, readonly string[] | '*'>>\n} {\n  const parents = new Map<AnyNode, AnyNode | null>()\n  const identifiers = new Map<string, AnyNode[]>()\n  walkWithParents(program, (node, parent) => {\n    parents.set(node, parent)\n    if (node.type === 'Identifier') {\n      const name = node['name'] as string\n      const list = identifiers.get(name)\n      if (list) list.push(node)\n      else identifiers.set(name, [node])\n    }\n  })\n  // Scope (AGL-3394). A minifier names the host alias `e`, and names every\n  // other function's first parameter `e` too, so a name only resolves to the\n  // host where no nearer scope declares it again.\n  const scopeNames = new Map<AnyNode, Set<string>>()\n  const namesOf = (scope: AnyNode): Set<string> => {\n    let found = scopeNames.get(scope)\n    if (!found) {\n      found = declaredNames(scope)\n      scopeNames.set(scope, found)\n    }\n    return found\n  }\n  /** The scope a declarator's name belongs to: its function for `var`, else its block. */\n  const bindingScope = (declarator: AnyNode): AnyNode | null => {\n    const declaration = parents.get(declarator)\n    const functionScoped = declaration?.['kind'] === 'var'\n    for (let at = parents.get(declaration as AnyNode); at; at = parents.get(at)) {\n      if (functionScoped ? FUNCTION_TYPES.has(at.type) || at.type === 'Program' : SCOPE_TYPES.has(at.type)) {\n        return at\n      }\n    }\n    return null\n  }\n  /** Whether `ref` means the binding `name` declared in `scope`. */\n  const resolvesTo = (ref: AnyNode, name: string, scope: AnyNode | null): boolean => {\n    if (!isReference(ref, parents.get(ref))) return false\n    for (let at = parents.get(ref); at; at = parents.get(at)) {\n      if (at === scope) return true\n      if (SCOPE_TYPES.has(at.type) && namesOf(at).has(name)) return false\n    }\n    return scope === null\n  }\n\n  const isHostGlobal = (node: AnyNode | null | undefined): boolean =>\n    (node?.type === 'Identifier' && node['name'] === PLUGIN_HOST_GLOBAL) ||\n    (node?.type === 'MemberExpression' &&\n      isGlobalRef(node['object'] as AnyNode) &&\n      propertyName(node) === PLUGIN_HOST_GLOBAL)\n\n  // Names bound to the host object, each with the scope it is declared in:\n  // a declarator's block or function, or the `register(host)` function for its\n  // parameter.\n  const hostNames = new Map<string, { scope: AnyNode | null; param: boolean }>()\n  walk(program, (node) => {\n    if (node.type === 'VariableDeclarator') {\n      const id = node['id'] as AnyNode\n      const init = node['init'] as AnyNode | null\n      const roots =\n        init?.type === 'LogicalExpression'\n          ? [init['left'] as AnyNode, init['right'] as AnyNode]\n          : [init]\n      if (id?.type === 'Identifier' && roots.some(isHostGlobal)) {\n        hostNames.set(id['name'] as string, { scope: bindingScope(node), param: false })\n      }\n    }\n    if (\n      node.type === 'FunctionDeclaration' &&\n      (node['id'] as AnyNode | null)?.['name'] === 'register'\n    ) {\n      const param = ((node['params'] ?? []) as AnyNode[])[0]\n      if (param?.type === 'Identifier' && !hostNames.has(param['name'] as string)) {\n        hostNames.set(param['name'] as string, { scope: node, param: true })\n      }\n    }\n  })\n  /** `'global'` for the host reached by name, `'param'` for `register(host)`. */\n  const hostRef = (\n    node: AnyNode | null | undefined,\n  ): 'global' | 'param' | null => {\n    if (isHostGlobal(node)) return 'global'\n    if (node?.type !== 'Identifier') return null\n    const name = node['name'] as string\n    const binding = hostNames.get(name)\n    if (!binding || !resolvesTo(node, name, binding.scope)) return null\n    return binding.param ? 'param' : 'global'\n  }\n\n  const modules = new Set<string>(PLUGIN_HOST_MODULE_KEYS)\n  const allowed = new Set<string>(PLUGIN_HOST_ABI_KEYS)\n  const read = new Set<string>()\n  const unknown = new Set<string>()\n  const unknownOnParam = new Set<string>()\n  let computed = 0\n  let computedOnParam = 0\n  const names = new Map<string, Set<string> | '*'>()\n  const whole = (key: string): void => {\n    names.set(key, '*')\n  }\n  const note = (key: string, name: string | null): void => {\n    if (name === null) return whole(key)\n    const current = names.get(key)\n    if (current === '*') return\n    if (current) current.add(name)\n    else names.set(key, new Set([name]))\n  }\n  const seenAliases = new Set<AnyNode>()\n\n  /** Records how one reference to a lazy key's module is used. */\n  const useOf = (key: string, ref: AnyNode): void => {\n    const parent = parents.get(ref)\n    // A presence check reads no name from the module: `if (!h.aglyn) return`\n    // is how a bundle stays inert on a host without the key, and every\n    // example plugin does it.\n    if (\n      (parent?.type === 'UnaryExpression' &&\n        (parent['operator'] === '!' || parent['operator'] === 'typeof')) ||\n      ((parent?.type === 'IfStatement' || parent?.type === 'ConditionalExpression') &&\n        parent['test'] === ref)\n    ) {\n      return\n    }\n    if (parent?.type === 'MemberExpression' && parent['object'] === ref) {\n      return note(key, propertyName(parent, constants))\n    }\n    if (parent?.type === 'VariableDeclarator' && parent['init'] === ref) {\n      const id = parent['id'] as AnyNode\n      if (id?.type === 'Identifier') {\n        const alias = id['name'] as string\n        if (seenAliases.has(parent)) return\n        seenAliases.add(parent)\n        const scope = bindingScope(parent)\n        for (const use of identifiers.get(alias) ?? []) {\n          if (use !== id && resolvesTo(use, alias, scope)) useOf(key, use)\n        }\n        return\n      }\n      if (id?.type === 'ObjectPattern') {\n        for (const property of (id['properties'] ?? []) as AnyNode[]) {\n          if (property.type !== 'Property' || property['computed']) {\n            return whole(key)\n          }\n          const propertyKey = property['key'] as AnyNode\n          const name =\n            propertyKey?.type === 'Identifier'\n              ? (propertyKey['name'] as string)\n              : staticString(propertyKey)\n          note(key, name)\n        }\n        return\n      }\n    }\n    whole(key)\n  }\n\n  walk(program, (node) => {\n    if (node.type !== 'MemberExpression') return\n    const via = hostRef(node['object'] as AnyNode)\n    if (!via) return\n    const key = propertyName(node, constants)\n    if (key === null) {\n      if (via === 'param') computedOnParam += 1\n      else computed += 1\n    } else if (!allowed.has(key)) {\n      ;(via === 'param' ? unknownOnParam : unknown).add(key)\n    } else {\n      read.add(key)\n      if (modules.has(key)) useOf(key, node)\n    }\n  })\n\n  const imports: Record<string, readonly string[] | '*'> = {}\n  for (const [key, value] of names) {\n    imports[key] = value === '*' ? '*' : [...value].sort()\n  }\n  return {\n    read,\n    unknown,\n    unknownOnParam,\n    computed,\n    computedOnParam,\n    imports,\n  }\n}\n\nfunction analyseBundle(\n  source: string,\n  options?: CheckOptions,\n): BundleCheckResult {\n  const problems: BundleCheckProblem[] = []\n  const seen = new Set<string>()\n  // Every area starts as \"ran, found nothing\" and is downgraded by its own\n  // findings, so the summary cannot drift from the problem list (AGL-1087).\n  const status = new Map<BundleCheckId, BundleCheckStatus>(\n    CHECK_ORDER.map((id) => [id, 'pass']),\n  )\n  const details = new Map<BundleCheckId, string>()\n  const add = (\n    level: BundleCheckProblem['level'],\n    check: BundleCheckId,\n    message: string,\n  ) => {\n    if (level === 'error') status.set(check, 'fail')\n    else if (status.get(check) === 'pass') status.set(check, 'question')\n    if (seen.has(message) || seen.size >= MAX_PROBLEMS) return\n    seen.add(message)\n    problems.push({ level, message, check })\n  }\n  /** Mark the areas that never ran, so they cannot read as clean. */\n  const unknownFrom = (...ids: BundleCheckId[]) => {\n    for (const id of ids) status.set(id, 'unknown')\n  }\n  const summarise = (): BundleCheckSummary[] =>\n    CHECK_ORDER.map((id) => ({\n      id,\n      label: CHECK_LABELS[id],\n      status: status.get(id) ?? 'unknown',\n      ...(details.has(id) ? { detail: details.get(id) } : {}),\n    }))\n\n  const maxBytes = options?.maxBytes ?? MAX_PLUGIN_BUNDLE_BYTES\n  const bytes = new TextEncoder().encode(source).byteLength\n  details.set('size', `${bytes.toLocaleString('en-US')} bytes of ${maxBytes.toLocaleString('en-US')}`)\n  if (bytes === 0) {\n    add('error', 'size', 'bundle is empty')\n    unknownFrom(\n      'parse',\n      'entry',\n      'self-contained',\n      'host-abi',\n      'code-execution',\n      'globals',\n      'storage',\n      'dynamic-import',\n      'network',\n      'obfuscation',\n      'contributions',\n      'credentials',\n    )\n    return {\n      ok: false,\n      problems,\n      checks: summarise(),\n      exports: { register: false, registerApi: false },\n      contributions: NOTHING_DETECTED,\n    }\n  }\n  if (bytes > maxBytes) {\n    add('error', 'size', `bundle is ${bytes} bytes (limit ${maxBytes})`)\n  }\n\n  const parseOptions: Options = {\n    ecmaVersion: 'latest',\n    sourceType: 'module',\n    allowHashBang: true,\n    allowAwaitOutsideFunction: true,\n  }\n  let program: AnyNode\n  try {\n    program = parse(source, parseOptions) as unknown as AnyNode\n  } catch (error) {\n    // Unparseable means unanalysable, and the loader would fail on it too.\n    // Nothing else ran, and saying so is the whole point of `unknown`: a\n    // bundle nobody could read must not show nine green rows.\n    add(\n      'error',\n      'parse',\n      `bundle does not parse as an ES module: ${\n        error instanceof Error ? error.message : String(error)\n      }`,\n    )\n    unknownFrom(\n      'entry',\n      'self-contained',\n      'host-abi',\n      'code-execution',\n      'globals',\n      'storage',\n      'dynamic-import',\n      'network',\n      'obfuscation',\n      'contributions',\n      'credentials',\n    )\n    return {\n      ok: false,\n      problems,\n      checks: summarise(),\n      exports: { register: false, registerApi: false },\n      contributions: NOTHING_DETECTED,\n    }\n  }\n\n  // Names bound to a global, so `const g = globalThis; g['ev'+'al']` reads\n  // as access on a global rather than on some object we know nothing about.\n  const aliases = new Set<string>()\n  const noteAlias = (name: unknown, init: AnyNode | null | undefined) => {\n    if (typeof name !== 'string' || !init) return\n    const roots: AnyNode[] =\n      init.type === 'LogicalExpression'\n        ? [init['left'] as AnyNode, init['right'] as AnyNode]\n        : [init]\n    for (const root of roots) {\n      if (\n        root?.type === 'Identifier' &&\n        GLOBAL_ROOTS.has(root['name'] as string)\n      ) {\n        aliases.add(name)\n      }\n    }\n  }\n  // Local name -> the constant string it holds (AGL-1093).\n  //\n  // A binding is only usable when the whole tree agrees on it: declared once,\n  // never assigned again, and never a parameter or another binder anywhere.\n  // Any of those means the value at a given call site is a GUESS, and a guess\n  // is how a checker starts making claims about code it did not read.\n  const constants = new Map<string, string>()\n  {\n    const bound = new Map<string, AnyNode>()\n    const poisoned = new Set<string>()\n    const declared = new Set<string>()\n    const poison = (name: unknown) => {\n      if (typeof name === 'string') poisoned.add(name)\n    }\n    /** Every name a pattern binds — a parameter shadowing a constant is a\n     * different variable, and resolving it to the outer value would be a\n     * fabrication. */\n    const poisonPattern = (node: AnyNode | null | undefined) => {\n      if (!node) return\n      if (node.type === 'Identifier') return poison(node['name'])\n      for (const key of [\n        'left',\n        'argument',\n        'properties',\n        'elements',\n        'value',\n      ]) {\n        const value = node[key]\n        if (Array.isArray(value))\n          value.forEach((item) => poisonPattern(item as AnyNode))\n        else if (value) poisonPattern(value as AnyNode)\n      }\n    }\n    walk(program, (node) => {\n      if (node.type === 'VariableDeclarator') {\n        const id = node['id'] as AnyNode\n        if (id?.type === 'Identifier') {\n          const name = id['name'] as string\n          if (declared.has(name)) poison(name)\n          declared.add(name)\n          bound.set(name, node['init'] as AnyNode)\n        } else {\n          poisonPattern(id)\n        }\n      } else if (node.type === 'AssignmentExpression') {\n        poisonPattern(node['left'] as AnyNode)\n      } else if (node.type === 'UpdateExpression') {\n        poisonPattern(node['argument'] as AnyNode)\n      } else if (\n        node.type === 'FunctionDeclaration' ||\n        node.type === 'FunctionExpression' ||\n        node.type === 'ArrowFunctionExpression'\n      ) {\n        ;((node['params'] ?? []) as AnyNode[]).forEach(poisonPattern)\n        if ((node['id'] as AnyNode)?.type === 'Identifier')\n          poison((node['id'] as AnyNode)['name'])\n      } else if (node.type === 'CatchClause') {\n        poisonPattern(node['param'] as AnyNode)\n      } else if (\n        node.type === 'ClassDeclaration' ||\n        node.type === 'ClassExpression'\n      ) {\n        if ((node['id'] as AnyNode)?.type === 'Identifier')\n          poison((node['id'] as AnyNode)['name'])\n      }\n    })\n    // Two passes, so `const BASE = 'https://x'` then `BASE + '/y'` resolves.\n    // A third buys almost nothing and each is a full re-read of the bindings.\n    for (let pass = 0; pass < 2; pass += 1) {\n      for (const [name, init] of bound) {\n        if (poisoned.has(name) || constants.has(name)) continue\n        const value = staticString(init, constants)\n        if (value !== null) constants.set(name, value)\n      }\n    }\n  }\n\n  // Local name -> the callable it stands for (AGL-1090). `const f = fetch`,\n  // `const d = globalThis.fetch`, `const {fetch: h} = globalThis`.\n  const callableAliases = new Map<string, string>()\n  /** The aliasable callable an initializer denotes, if any. */\n  const callableFrom = (init: AnyNode | null | undefined): string | null => {\n    if (!init) return null\n    if (\n      init.type === 'Identifier' &&\n      ALIASABLE_CALLABLES.has(init['name'] as string)\n    ) {\n      return init['name'] as string\n    }\n    // `globalThis.fetch` / `window['fe' + 'tch']` — the property is what the\n    // name will stand for, and only when the object is a global (an unknown\n    // object's `.fetch` is somebody else's method).\n    if (init.type === 'MemberExpression') {\n      const property = propertyName(init)\n      const object = init['object'] as AnyNode\n      if (\n        property &&\n        ALIASABLE_CALLABLES.has(property) &&\n        object?.type === 'Identifier' &&\n        (GLOBAL_ROOTS.has(object['name'] as string) ||\n          aliases.has(object['name'] as string))\n      ) {\n        return property\n      }\n    }\n    return null\n  }\n  const noteCallableAlias = (\n    id: AnyNode | null | undefined,\n    init: AnyNode | null | undefined,\n  ) => {\n    if (!id) return\n    if (id.type === 'Identifier') {\n      const callable = callableFrom(init)\n      if (callable) callableAliases.set(id['name'] as string, callable)\n      return\n    }\n    // `const { fetch } = globalThis` and `const { fetch: h } = globalThis`.\n    if (id.type === 'ObjectPattern' && init) {\n      const fromGlobal =\n        init.type === 'Identifier' &&\n        (GLOBAL_ROOTS.has(init['name'] as string) ||\n          aliases.has(init['name'] as string))\n      if (!fromGlobal) return\n      for (const property of (id['properties'] ?? []) as AnyNode[]) {\n        const key = property['key'] as AnyNode\n        const value = property['value'] as AnyNode\n        const name =\n          key?.type === 'Identifier' ? (key['name'] as string) : staticString(key)\n        if (\n          name &&\n          ALIASABLE_CALLABLES.has(name) &&\n          value?.type === 'Identifier'\n        ) {\n          callableAliases.set(value['name'] as string, name)\n        }\n      }\n    }\n  }\n\n  // Global-object aliases first, as a complete pass: the callable pass below\n  // resolves `g.fetch` against them, and walk order is not source order.\n  walk(program, (node) => {\n    if (node.type === 'VariableDeclarator') {\n      const id = node['id'] as AnyNode\n      if (id?.type === 'Identifier')\n        noteAlias(id['name'], node['init'] as AnyNode)\n    } else if (\n      node.type === 'AssignmentExpression' &&\n      node['operator'] === '='\n    ) {\n      const left = node['left'] as AnyNode\n      if (left?.type === 'Identifier')\n        noteAlias(left['name'], node['right'] as AnyNode)\n    }\n  })\n  walk(program, (node) => {\n    if (node.type === 'VariableDeclarator') {\n      noteCallableAlias(node['id'] as AnyNode, node['init'] as AnyNode)\n    } else if (\n      node.type === 'AssignmentExpression' &&\n      node['operator'] === '='\n    ) {\n      noteCallableAlias(node['left'] as AnyNode, node['right'] as AnyNode)\n    }\n  })\n\n  const isGlobalRef = (node: AnyNode | null | undefined): boolean =>\n    !!node &&\n    node.type === 'Identifier' &&\n    (GLOBAL_ROOTS.has(node['name'] as string) ||\n      aliases.has(node['name'] as string))\n\n  const declared = options?.declaredNetwork\n  const allowlist = new Set(\n    (declared ?? []).map((origin) => {\n      try {\n        return new URL(origin).origin\n      } catch {\n        return origin\n      }\n    }),\n  )\n  for (const message of lookalikeDeclaredOrigins(declared ?? [])) {\n    add('warning', 'network', message)\n  }\n  /** Level for a network finding: a claim only when we know what was declared. */\n  const networkLevel: BundleCheckProblem['level'] = declared\n    ? 'error'\n    : 'warning'\n  // What the bundle reaches for, so the summary row can SAY it (AGL-1087) —\n  // \"calls https://api.stripe.com, declared\" is the line a reviewer would\n  // otherwise open the bundle to get.\n  const networkApis = new Set<string>()\n  const networkOrigins = new Set<string>()\n  let runtimeUrls = 0\n  /** Origins handed to a callee the checker could not resolve (AGL-1090). */\n  const unresolvedOrigins = new Set<string>()\n  const noteNetwork = (api: string, urlArg: AnyNode | undefined) => {\n    const origin = literalOrigin(urlArg, constants)\n    networkApis.add(api)\n    if (origin) networkOrigins.add(origin)\n    else runtimeUrls += 1\n    if (!declared) {\n      add(\n        'warning',\n        'network',\n        `bundle makes network calls (${api}) — check them against the ` +\n          \"manifest's declared network capability\",\n      )\n      return\n    }\n    if (!allowlist.size) {\n      add(\n        networkLevel,\n        'network',\n        `bundle calls ${api} but the manifest declares no network ` +\n          'capability — declare every origin under capabilities.network ' +\n          '(the CSP blocks the rest at runtime)',\n      )\n      return\n    }\n    if (!origin) {\n      add(\n        'warning',\n        'network',\n        `${api} is called with a URL that is only known at runtime — it ` +\n          'cannot be checked against the declared origins',\n      )\n      return\n    }\n    if (!allowlist.has(origin)) {\n      add(\n        networkLevel,\n        'network',\n        `${api} calls ${origin}, which the manifest does not declare ` +\n          `(declared: ${[...allowlist].join(', ')})`,\n      )\n    }\n  }\n\n  /**\n   * A call the checker could not resolve, given an absolute URL.\n   *\n   * Reported as a QUESTION, never a refusal: most of these are helpers, and\n   * refusing every unrecognised call that mentions a URL would make the\n   * verifier useless. But leaving them silent is what let the network row\n   * claim \"no network calls\" over a bundle whose calls it simply could not\n   * follow — and a URL to an origin the manifest never declared is exactly\n   * what a reviewer should be pointed at.\n   */\n  const noteUnresolvedUrl = (\n    name: string | null,\n    urlArg: AnyNode | undefined,\n  ) => {\n    if (name && URL_TAKING_NON_CALLS.has(name)) return\n    const origin = literalOrigin(urlArg, constants)\n    if (!origin) return\n    // A declared origin is consistent with the manifest and permitted by the\n    // CSP, so there is no question to raise about it.\n    if (allowlist.has(origin)) return\n    unresolvedOrigins.add(origin)\n    add(\n      'warning',\n      'network',\n      `${name ? `${name}()` : 'a call'} is passed ${origin}, which the ` +\n        'manifest does not declare — the checker could not tell whether it ' +\n        'reaches the network, so read this call',\n    )\n  }\n\n  let exportsRegister = false\n  let exportsRegisterApi = false\n  const noteExport = (name: unknown) => {\n    if (name === 'register') exportsRegister = true\n    else if (name === 'registerApi') exportsRegisterApi = true\n  }\n\n  let obfuscatedNames = 0\n\n  walk(program, (node) => {\n    switch (node.type) {\n      // ---- entry exports + self-containment ----\n      case 'ImportDeclaration':\n        add(\n          'error',\n          'self-contained',\n          'bundle has static imports — realm bundles must be self-contained ' +\n            '(react/@aglyn/aglyn come from the host ABI; see the realm rollup ' +\n            'template)',\n        )\n        break\n      case 'ExportAllDeclaration':\n      case 'ExportNamedDeclaration': {\n        if (node['source']) {\n          add(\n            'error',\n            'self-contained',\n            'bundle re-exports from another module — realm bundles must be ' +\n              'self-contained (see the realm rollup template)',\n          )\n        }\n        const declaration = node['declaration'] as AnyNode | null\n        if (declaration) {\n          if (declaration['id'])\n            noteExport((declaration['id'] as AnyNode)['name'])\n          for (const declarator of (declaration['declarations'] ??\n            []) as AnyNode[]) {\n            const id = declarator['id'] as AnyNode\n            if (id?.type === 'Identifier') noteExport(id['name'])\n          }\n        }\n        for (const specifier of (node['specifiers'] ?? []) as AnyNode[]) {\n          const exported = specifier['exported'] as AnyNode\n          noteExport(\n            exported?.type === 'Identifier'\n              ? exported['name']\n              : staticString(exported),\n          )\n        }\n        break\n      }\n\n      // ---- dynamic import ----\n      case 'ImportExpression': {\n        const specifier = staticString(node['source'] as AnyNode, constants)\n        if (specifier === null) {\n          add(\n            'error',\n            'dynamic-import',\n            'dynamic import with a specifier computed at runtime is not ' +\n              'allowed — the loader cannot know what would be fetched',\n          )\n        } else if (/^https?:/i.test(specifier)) {\n          add(\n            'error',\n            'dynamic-import',\n            'dynamic import of remote URLs is not allowed',\n          )\n        }\n        break\n      }\n\n      // ---- calls ----\n      case 'CallExpression':\n      case 'NewExpression': {\n        const callee = node['callee'] as AnyNode\n        const args = (node['arguments'] ?? []) as AnyNode[]\n        const written =\n          callee?.type === 'Identifier'\n            ? (callee['name'] as string)\n            : callee?.type === 'MemberExpression'\n              ? propertyName(callee, constants)\n              : null\n        // An alias resolves to what it stands for (AGL-1090), so `f(url)`\n        // after `const f = fetch` is a fetch call.\n        const name =\n          (written && callableAliases.get(written)) ?? written ?? null\n\n        if (name === 'eval')\n          add('error', 'code-execution', 'eval() is not allowed')\n        if (name === 'Function')\n          add(\n            'error',\n            'code-execution',\n            'the Function constructor is not allowed',\n          )\n        // `(()=>{}).constructor('return 1')()` — the Function constructor\n        // reached through any function value, which is why the CALL is the\n        // finding rather than the name `Function`.\n        if (name === 'constructor' && callee?.type === 'MemberExpression')\n          add(\n            'error',\n            'code-execution',\n            'calling .constructor() is not allowed — it reaches the ' +\n              'Function constructor from any function value',\n          )\n        if (name && NETWORK_CALLS.has(name)) noteNetwork(name, args[0])\n        else if (name && NETWORK_CONSTRUCTORS.has(name))\n          noteNetwork(name, node.type === 'NewExpression' ? args[0] : args[1])\n        // Something we could not follow, handed an absolute URL (AGL-1090).\n        // Not a refusal — it may be a helper, a logger, or a link — but the\n        // network row must stop rendering \"no network calls\" over it.\n        else noteUnresolvedUrl(name, args[0])\n        break\n      }\n\n      // ---- member access ----\n      case 'MemberExpression': {\n        const object = node['object'] as AnyNode\n        const name = propertyName(node, constants)\n        if (isGlobalRef(object) && name === null) {\n          add(\n            'error',\n            'globals',\n            `computed property access on ${\n              (object['name'] as string) || 'a global'\n            } is not allowed — a property chosen at runtime cannot be ` +\n              'reviewed',\n          )\n          break\n        }\n        // Property names only mean anything on a global: `response.cookie`\n        // and `state.localStorage` are somebody else's object.\n        if (name === 'cookie' && isGlobalRef(object))\n          add('error', 'storage', 'document.cookie access is not allowed')\n        if (name && STORAGE_NAMES.has(name) && isGlobalRef(object))\n          add(\n            'error',\n            'storage',\n            'browser storage access is not allowed (use host-mediated data)',\n          )\n        if (name === 'eval' && isGlobalRef(object))\n          add('error', 'code-execution', 'eval() is not allowed')\n        break\n      }\n\n      // ---- bare references ----\n      case 'Identifier': {\n        const name = node['name'] as string\n        if (STORAGE_NAMES.has(name))\n          add(\n            'error',\n            'storage',\n            'browser storage access is not allowed (use host-mediated data)',\n          )\n        if (OBFUSCATED_NAME.test(name)) obfuscatedNames += 1\n        break\n      }\n\n      // ---- obfuscation ----\n      case 'Literal': {\n        const value = node['value']\n        if (\n          typeof value === 'string' &&\n          value.length >= MIN_SUSPICIOUS_BASE64 &&\n          BASE64_BLOB.test(value)\n        ) {\n          add(\n            'warning',\n            'obfuscation',\n            `bundle embeds a ${value.length}-character base64 literal — ` +\n              'decode it before approving',\n          )\n        }\n        break\n      }\n      default:\n        break\n    }\n  })\n\n  if (!exportsRegister && !exportsRegisterApi) {\n    add(\n      'error',\n      'entry',\n      'bundle exports neither register(host) nor registerApi() — ' +\n        'nothing for the loader to call',\n    )\n  }\n\n  if (obfuscatedNames >= MIN_OBFUSCATED_NAMES) {\n    add(\n      'warning',\n      'obfuscation',\n      `bundle uses ${obfuscatedNames} machine-obfuscated identifiers ` +\n        '(_0x… naming) — minifiers do not produce these',\n    )\n  }\n  const longestLine = source\n    .split('\\n')\n    .reduce((longest, line) => Math.max(longest, line.length), 0)\n  if (longestLine > MAX_READABLE_LINE) {\n    add(\n      'warning',\n      'obfuscation',\n      `bundle has a single ${longestLine}-character line — nothing on it ` +\n        'can be read in review; ask for a readable build or a source map',\n    )\n  }\n\n  details.set(\n    'entry',\n    [\n      exportsRegister ? 'register(host)' : null,\n      exportsRegisterApi ? 'registerApi()' : null,\n    ]\n      .filter(Boolean)\n      .join(', ') || 'none',\n  )\n\n  // What the network check actually saw. Without the manifest it saw the\n  // calls but could not judge them, and that is `unknown`, not a pass — the\n  // row a reviewer must not read as \"checked and fine\".\n  if (!declared) {\n    if (networkApis.size) {\n      status.set('network', 'unknown')\n      details.set(\n        'network',\n        `calls ${[...networkApis].join(', ')} — no declared origins were ` +\n          'supplied, so nothing was compared',\n      )\n    } else {\n      details.set('network', 'no network calls')\n    }\n  } else if (!networkApis.size) {\n    details.set(\n      'network',\n      unresolvedOrigins.size\n        ? `no resolved network calls, but ${[...unresolvedOrigins].join(', ')} ` +\n            'is passed to a call the checker could not follow'\n        : 'no network calls',\n    )\n  } else {\n    const origins = networkOrigins.size\n      ? [...networkOrigins]\n          .map((origin) =>\n            allowlist.has(origin) ? `${origin} (declared)` : `${origin} (NOT declared)`,\n          )\n          .join(', ')\n      : ''\n    details.set(\n      'network',\n      [\n        `calls ${[...networkApis].join(', ')}`,\n        origins,\n        runtimeUrls\n          ? `${runtimeUrls} call(s) with a URL only known at runtime`\n          : '',\n      ]\n        .filter(Boolean)\n        .join(' · '),\n    )\n  }\n\n  const abi = hostAbiReads(program, constants, isGlobalRef)\n  for (const key of abi.unknown) {\n    add(\n      'error',\n      'host-abi',\n      `bundle reads \"${key}\" from the host, which provides only ` +\n        `${PLUGIN_HOST_ABI_KEYS.join(', ')} — it would be undefined on every site`,\n    )\n  }\n  for (const key of abi.unknownOnParam) {\n    add(\n      'warning',\n      'host-abi',\n      `register() reads \"${key}\" from its host argument, which provides only ` +\n        `${PLUGIN_HOST_ABI_KEYS.join(', ')} — it will be undefined`,\n    )\n  }\n  if (abi.computedOnParam) {\n    add(\n      'warning',\n      'host-abi',\n      `register() reads its host argument by a key chosen at runtime ` +\n        `(${abi.computedOnParam}×)`,\n    )\n  }\n  if (abi.computed) {\n    add(\n      'error',\n      'host-abi',\n      `bundle reads the host by a key chosen at runtime (${abi.computed}×) — ` +\n        'a lookup that cannot be named cannot be reviewed',\n    )\n  }\n  // Each name the bundle reads from a host module must be one the host holds\n  // (AGL-3392): core's realm plugin surface, or the whole of the others.\n  for (const key of PLUGIN_HOST_MODULE_KEYS) {\n    const read = abi.imports[key]\n    if (!read) continue\n    const holds = REALM_HOST_SURFACE_NAMES[key]\n    if (read === '*') {\n      if (key === 'aglyn') {\n        add(\n          'warning',\n          'host-abi',\n          'uses @aglyn/aglyn as a namespace value — only the realm plugin ' +\n            'surface is on the host, so any other name read through it is ' +\n            'undefined; import what you use by name',\n        )\n      }\n      continue\n    }\n    const missing = read.filter((name) => !holds.has(name))\n    if (missing.length) {\n      add(\n        'error',\n        'host-abi',\n        `reads ${missing.join(', ')} from the host's ${key}, which does not ` +\n          `hold ${missing.length === 1 ? 'it' : 'them'}` +\n          (key === 'aglyn'\n            ? ' — only the realm plugin surface of @aglyn/aglyn is on the host'\n            : ''),\n      )\n    }\n  }\n  details.set(\n    'host-abi',\n    abi.read.size ? `reads ${[...abi.read].sort().join(', ')}` : 'reads nothing by name',\n  )\n\n  const detected = detectRegistrations(program, constants)\n  for (const message of credentialInputsIn(program, constants)) {\n    add('warning', 'credentials', message)\n  }\n  compareContributions(detected, options, add, details, (check) =>\n    status.set(check, 'unknown'),\n  )\n\n  return {\n    ok: !problems.some((problem) => problem.level === 'error'),\n    problems,\n    checks: summarise(),\n    exports: { register: exportsRegister, registerApi: exportsRegisterApi },\n    contributions: detected,\n  }\n}\n\n/**\n * Run the checks over a bundle. NEVER throws (AGL-1094).\n *\n * The publish route calls this directly, so an unexpected failure in here\n * used to mean a 500 and no explanation for the publisher — and in the review\n * sweep it looked exactly like a missing artifact, which sent the\n * investigation to the storage bucket instead of to this file. A checker that\n * cannot analyse a bundle has an answer: say so, in the verdict, as an error.\n */\nexport function checkPluginBundle(\n  source: string,\n  options?: CheckOptions,\n): BundleCheckResult {\n  try {\n    return analyseBundle(source, options)\n  } catch (error) {\n    return {\n      ok: false,\n      problems: [\n        {\n          level: 'error',\n          check: 'parse',\n          message:\n            'the verifier failed on this bundle — treat it as unchecked and ' +\n            `report it: ${\n              error instanceof Error ? error.message : String(error)\n            }`,\n        },\n      ],\n      checks: CHECK_ORDER.map((id) => ({\n        id,\n        label: CHECK_LABELS[id],\n        status: id === 'parse' ? 'fail' : 'unknown',\n      })),\n      exports: { register: false, registerApi: false },\n      contributions: NOTHING_DETECTED,\n    }\n  }\n}\n"],"names":["parse","credentialForInputAttribute","credentialInHtml","lookalikeBrandForHost","PLUGIN_HOST_ABI_KEYS","PLUGIN_HOST_GLOBAL","PLUGIN_HOST_MODULE_KEYS","REALM_HOST_SURFACE_NAMES","CHECK_LABELS","entry","size","globals","storage","network","obfuscation","contributions","credentials","CHECK_ORDER","MAX_PLUGIN_BUNDLE_BYTES","PLUGIN_VERIFIER_VERSION","isStoredVerdictCurrent","stored","sha256","Number","verifierVersion","GLOBAL_ROOTS","Set","STORAGE_NAMES","NETWORK_CALLS","NETWORK_CONSTRUCTORS","ALIASABLE_CALLABLES","URL_TAKING_NON_CALLS","MAX_READABLE_LINE","MIN_SUSPICIOUS_BASE64","MIN_OBFUSCATED_NAMES","MAX_PROBLEMS","OBFUSCATED_NAME","BASE64_BLOB","skippedChild","node","key","type","walk","root","visit","stack","length","pop","Object","keys","value","Array","isArray","item","push","staticString","constants","get","expressions","quasis","cooked","out","index","filled","left","right","propertyName","property","literalOrigin","url","URL","test","protocol","origin","NOTHING_DETECTED","contributes","unresolved","REGISTRATION_CALLS","SHELL_EXTENSION_FIELDS","detectRegistrations","program","slots","routes","orgRoutes","components","features","shell","objectProperty","object","name","undefined","keyName","listOf","slotName","literal","callee","has","args","extension","add","widgets","list","widget","slot","field","into","href","id","site","sort","console","describeContributions","parts","join","compareContributions","detected","options","details","markUnknown","found","declared","registers","registersSomething","Boolean","unreadable","declaredContributions","set","requireContributions","JSON","stringify","missing","label","registered","listed","consequence","includes","unused","credentialInputsIn","keyOf","text","map","quasi","String","words","password","card","otp","lookalikeDeclaredOrigins","messages","host","hostname","brand","walkWithParents","parent","children","child","FUNCTION_TYPES","SCOPE_TYPES","patternNames","pattern","element","lexicalNames","statements","statement","declarator","varNames","entries","declaredNames","scope","names","param","body","branch","head","isReference","hostAbiReads","isGlobalRef","parents","Map","identifiers","scopeNames","namesOf","bindingScope","declaration","functionScoped","at","resolvesTo","ref","isHostGlobal","hostNames","init","roots","some","hostRef","binding","modules","allowed","read","unknown","unknownOnParam","computed","computedOnParam","whole","note","current","seenAliases","useOf","alias","use","propertyKey","via","imports","analyseBundle","source","problems","seen","status","level","check","message","unknownFrom","ids","summarise","detail","maxBytes","bytes","TextEncoder","encode","byteLength","toLocaleString","ok","checks","exports","register","registerApi","parseOptions","ecmaVersion","sourceType","allowHashBang","allowAwaitOutsideFunction","error","Error","aliases","noteAlias","bound","poisoned","poison","poisonPattern","forEach","pass","callableAliases","callableFrom","noteCallableAlias","callable","fromGlobal","declaredNetwork","allowlist","networkLevel","networkApis","networkOrigins","runtimeUrls","unresolvedOrigins","noteNetwork","api","urlArg","noteUnresolvedUrl","exportsRegister","exportsRegisterApi","noteExport","obfuscatedNames","specifier","exported","written","longestLine","split","reduce","longest","line","Math","max","filter","origins","abi","holds","problem","checkPluginBundle"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;CAmBC,GAED,SAASA,KAAK,QAAiC,QAAO;AACtD,4EAA4E;AAC5E,oDAAoD;AACpD,SACEC,2BAA2B,EAC3BC,gBAAgB,QACX,8CAA6C;AACpD,SAASC,qBAAqB,QAAQ,oDAAmD;AAEzF,SACEC,oBAAoB,EACpBC,kBAAkB,EAClBC,uBAAuB,QAClB,uBAAmB;AAC1B,SAASC,wBAAwB,QAAQ,oCAAgC;AAuEzE,MAAMC,eAA8C;IAClDR,OAAO;IACPS,OAAO;IACP,kBAAkB;IAClB,YAAY;IACZC,MAAM;IACN,kBAAkB;IAClBC,SAAS;IACTC,SAAS;IACT,kBAAkB;IAClBC,SAAS;IACTC,aAAa;IACbC,eAAe;IACfC,aAAa;AACf;AAEA,6EAA6E,GAC7E,MAAMC,cAA+B;IACnC;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD;AAED,OAAO,MAAMC,0BAA0B,QAAS;AAEhD;;;;;;;;;;;;;;;;;;;CAmBC,GACD,OAAO,MAAMC,0BAA0B,GAAE;AAYzC;;;;;;;;CAQC,GACD,OAAO,SAASC,uBACdC,MAA8C,EAC9CC,MAAc;IAEd,IAAI,CAACD,UAAU,CAACC,QAAQ,OAAO;IAC/B,OACED,OAAOC,MAAM,KAAKA,UAClBC,OAAOF,OAAOG,eAAe,MAAML;AAEvC;AAEA;;;;;CAKC,GACD,MAAMM,eAAe,IAAIC,IAAI;IAC3B;IACA;IACA;IACA;IACA;IACA;IACA;CACD;AAED,gFAAgF,GAChF,MAAMC,gBAAgB,IAAID,IAAI;IAAC;IAAgB;IAAkB;CAAY;AAE7E,yEAAyE,GACzE,MAAME,gBAAgB,IAAIF,IAAI;IAAC;IAAS;CAAa;AACrD,MAAMG,uBAAuB,IAAIH,IAAI;IACnC;IACA;IACA;CACD;AAED;;;;;;;;;;;CAWC,GACD,MAAMI,sBAAsB,IAAIJ,IAAI;IAClC;IACA;IACA;IACA;IACA;IACA;IACA;CACD;AAED;;;;;CAKC,GACD,MAAMK,uBAAuB,IAAIL,IAAI;IACnC;IACA;IACA;IACA;CACD;AAED,kEAAkE,GAClE,MAAMM,oBAAoB;AAC1B,yEAAyE,GACzE,MAAMC,wBAAwB;AAC9B,0EAA0E,GAC1E,MAAMC,uBAAuB;AAC7B,6DAA6D,GAC7D,MAAMC,eAAe;AAErB,MAAMC,kBAAkB;AACxB,MAAMC,cAAc;AAIpB;;;;;CAKC,GACD,MAAMC,eAAe,CAACC,MAAeC;IACnC,OAAQD,KAAKE,IAAI;QACf,KAAK;YACH,OAAOD,QAAQ,cAAc,CAACD,IAAI,CAAC,WAAW;QAChD,KAAK;QACL,KAAK;QACL,KAAK;YACH,OAAOC,QAAQ,SAAS,CAACD,IAAI,CAAC,WAAW;QAC3C,KAAK;QACL,KAAK;QACL,KAAK;YACH,OAAOC,QAAQ;QACjB,KAAK;QACL,KAAK;YACH,OAAO;QACT;YACE,OAAO;IACX;AACF;AAEA,sEAAsE,GACtE,SAASE,KAAKC,IAAa,EAAEC,KAA8B;IACzD,MAAMC,QAAmB;QAACF;KAAK;IAC/B,MAAOE,MAAMC,MAAM,CAAE;QACnB,MAAMP,OAAOM,MAAME,GAAG;QACtB,IAAI,CAACR,MAAM;QACXK,MAAML;QACN,KAAK,MAAMC,OAAOQ,OAAOC,IAAI,CAACV,MAAO;YACnC,IAAIC,QAAQ,UAAUA,QAAQ,WAAWA,QAAQ,OAAO;YACxD,IAAIF,aAAaC,MAAMC,MAAM;YAC7B,MAAMU,QAAQX,IAAI,CAACC,IAAI;YACvB,IAAIW,MAAMC,OAAO,CAACF,QAAQ;gBACxB,KAAK,MAAMG,QAAQH,MAAO;oBACxB,IAAIG,QAAQ,OAAOA,SAAS,YAAY,OAAOA,KAAKZ,IAAI,KAAK,UAC3DI,MAAMS,IAAI,CAACD;gBACf;YACF,OAAO,IACLH,SACA,OAAOA,UAAU,YACjB,OAAO,AAACA,MAAkBT,IAAI,KAAK,UACnC;gBACAI,MAAMS,IAAI,CAACJ;YACb;QACF;IACF;AACF;AAEA;;;;;CAKC,GACD,SAASK,aACPhB,IAAgC,EAChCiB,SAAuC;QAU9BA;IART,IAAI,CAACjB,MAAM,OAAO;IAClB,IAAIA,KAAKE,IAAI,KAAK,WAChB,OAAO,OAAOF,IAAI,CAAC,QAAQ,KAAK,WAAYA,IAAI,CAAC,QAAQ,GAAc;IACzE,uEAAuE;IACvE,yEAAyE;IACzE,yEAAyE;IACzE,wCAAwC;IACxC,IAAIA,KAAKE,IAAI,KAAK,gBAAgBe,WAChC,QAAOA,iBAAAA,UAAUC,GAAG,CAAClB,IAAI,CAAC,OAAO,aAA1BiB,iBAAyC;IAClD,IAAIjB,KAAKE,IAAI,KAAK,mBAAmB;YACdF,mBACLA;QADhB,MAAMmB,eAAenB,oBAAAA,IAAI,CAAC,cAAc,YAAnBA,oBAAuB,EAAE;QAC9C,MAAMoB,UAAUpB,eAAAA,IAAI,CAAC,SAAS,YAAdA,eAAkB,EAAE;QAGpC,IAAI,CAACmB,YAAYZ,MAAM,EAAE;;gBACMa,gBAAAA;YAA7B,OAAOA,OAAOb,MAAM,KAAK,aAAIa,WAAAA,MAAM,CAAC,EAAE,sBAATA,iBAAAA,SAAWT,KAAK,qBAAhBS,eAAkBC,MAAM,mBAAI,OAAO;QAClE;QACA,yDAAyD;QACzD,IAAIC,MAAM;QACV,IAAK,IAAIC,QAAQ,GAAGA,QAAQH,OAAOb,MAAM,EAAEgB,SAAS,EAAG;;gBAC9CH,qBAAAA;YAAPE,iBAAOF,gBAAAA,MAAM,CAACG,MAAM,sBAAbH,sBAAAA,cAAeT,KAAK,qBAApBS,oBAAsBC,MAAM,oBAAI;YACvC,IAAIE,QAAQJ,YAAYZ,MAAM,EAAE;gBAC9B,MAAMiB,SAASR,aAAaG,WAAW,CAACI,MAAM,EAAEN;gBAChD,IAAIO,WAAW,MAAM,OAAO;gBAC5BF,OAAOE;YACT;QACF;QACA,OAAOF;IACT;IACA,IAAItB,KAAKE,IAAI,KAAK,sBAAsBF,IAAI,CAAC,WAAW,KAAK,KAAK;QAChE,MAAMyB,OAAOT,aAAahB,IAAI,CAAC,OAAO,EAAaiB;QACnD,MAAMS,QAAQV,aAAahB,IAAI,CAAC,QAAQ,EAAaiB;QACrD,OAAOQ,SAAS,QAAQC,UAAU,OAAOD,OAAOC,QAAQ;IAC1D;IACA,OAAO;AACT;AAEA,kEAAkE,GAClE,SAASC,aACP3B,IAAa,EACbiB,SAAuC;IAEvC,MAAMW,WAAW5B,IAAI,CAAC,WAAW;IACjC,IAAI,CAACA,IAAI,CAAC,WAAW,EACnB,OAAO4B,CAAAA,4BAAAA,SAAU1B,IAAI,MAAK,eACrB0B,QAAQ,CAAC,OAAO,GACjB;IACN,OAAOZ,aAAaY,UAAUX;AAChC;AAEA;;;;;;;;CAQC,GACD,SAASY,cACP7B,IAAyB,EACzBiB,SAAuC;IAEvC,MAAMN,QAAQK,aAAahB,MAAMiB;IACjC,IAAI,CAACN,OAAO,OAAO;IACnB,IAAI;QACF,MAAMmB,MAAM,IAAIC,IAAIpB;QACpB,OAAO,YAAYqB,IAAI,CAACF,IAAIG,QAAQ,IAAIH,IAAII,MAAM,GAAG;IACvD,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAgCA,yDAAyD,GACzD,MAAMC,mBAA0C;IAAEC,aAAa,CAAC;IAAGC,YAAY,EAAE;AAAC;AAElF;;;;;CAKC,GACD,MAAMC,qBAAqB,IAAInD,IAAI;IACjC;IACA;IACA;IACA;IACA;CACD;AAED;;;;CAIC,GACD,MAAMoD,yBAAyB;IAC7B;IACA;IACA;IACA;IACA;IACA;CACD;AAED;;;;;;;;CAQC,GACD,SAASC,oBACPC,OAAgB,EAChBxB,SAAsC;IAEtC,MAAMyB,QAAQ,IAAIvD;IAClB,MAAMwD,SAAS,IAAIxD;IACnB,MAAMyD,YAAY,IAAIzD;IACtB,MAAM0D,aAAa,IAAI1D;IACvB,MAAM2D,WAAW,IAAI3D;IACrB,MAAMkD,aAAa,IAAIlD;IACvB,IAAI4D,QAAQ;IAEZ,MAAMC,iBAAiB,CACrBC,QACAC;YAGwBD;QADxB,IAAIA,CAAAA,0BAAAA,OAAQ/C,IAAI,MAAK,oBAAoB,OAAOiD;QAChD,KAAK,MAAMvB,aAAaqB,qBAAAA,MAAM,CAAC,aAAa,YAApBA,qBAAwB,EAAE,CAAgB;YAChE,IAAIrB,SAAS1B,IAAI,KAAK,YAAY;YAClC,MAAMD,MAAM2B,QAAQ,CAAC,MAAM;YAC3B,MAAMwB,UACJ,CAACxB,QAAQ,CAAC,WAAW,IAAI3B,CAAAA,uBAAAA,IAAKC,IAAI,MAAK,eAClCD,GAAG,CAAC,OAAO,GACZe,aAAaf,KAAKgB;YACxB,IAAImC,YAAYF,MAAM,OAAOtB,QAAQ,CAAC,QAAQ;QAChD;QACA,OAAOuB;IACT;IACA,MAAME,SAAS,CAACrD;YACuBA;eAArCA,CAAAA,wBAAAA,KAAME,IAAI,MAAK,qBAAsBF,iBAAAA,IAAI,CAAC,WAAW,YAAhBA,iBAAoB,EAAE,GAAkB;;IAC/E,4DAA4D;IAC5D,wEAAwE;IACxE,MAAMsD,WAAW,CAACtD;QAChB,MAAMuD,UAAUvC,aAAahB,MAAMiB;QACnC,IAAIsC,YAAY,MAAM,OAAOA;QAC7B,OAAOvD,CAAAA,wBAAAA,KAAME,IAAI,MAAK,qBAAqByB,aAAa3B,MAAMiB,aAAa;IAC7E;IAEAd,KAAKsC,SAAS,CAACzC;YAUCA;QATd,IAAIA,KAAKE,IAAI,KAAK,kBAAkB;QACpC,MAAMsD,SAASxD,IAAI,CAAC,SAAS;QAC7B,MAAMkD,OACJM,CAAAA,0BAAAA,OAAQtD,IAAI,MAAK,eACZsD,MAAM,CAAC,OAAO,GACfA,CAAAA,0BAAAA,OAAQtD,IAAI,MAAK,qBACfyB,aAAa6B,QAAQvC,aACrB;QACR,IAAI,CAACiC,QAAQ,CAACZ,mBAAmBmB,GAAG,CAACP,OAAO;QAC5C,MAAMQ,QAAQ1D,kBAAAA,IAAI,CAAC,YAAY,YAAjBA,kBAAqB,EAAE;QACrC,IAAIkD,SAAS,4BAA4B;YACvC,MAAMS,YAAYD,IAAI,CAAC,EAAE;YACzB,IAAIC,CAAAA,6BAAAA,UAAWzD,IAAI,MAAK,oBAAoB;gBAC1CmC,WAAWuB,GAAG,CAAC;gBACf;YACF;YACA,MAAMC,UAAUb,eAAeW,WAAW;YAC1C,IAAIE,SAAS;gBACX,MAAMC,OAAOT,OAAOQ;gBACpB,IAAI,CAACC,MAAMzB,WAAWuB,GAAG,CAAC;gBAC1B,KAAK,MAAMG,UAAUD,eAAAA,OAAQ,EAAE,CAAE;oBAC/B,MAAME,OAAOV,SAASN,eAAee,QAAQ;oBAC7C,IAAIC,MAAMtB,MAAMkB,GAAG,CAACI;yBACf3B,WAAWuB,GAAG,CAAC;gBACtB;YACF;YACA,KAAK,MAAMK,SAAS1B,uBAAwB;gBAC1C,MAAM5B,QAAQqC,eAAeW,WAAWM;gBACxC,IAAI,CAACtD,OAAO;gBACZoC,QAAQ;gBACR,IAAIkB,UAAU,cAAcA,UAAU,eAAe;gBACrD,MAAMC,OAAOD,UAAU,aAAatB,SAASC;gBAC7C,MAAMkB,OAAOT,OAAO1C;gBACpB,IAAI,CAACmD,MAAMzB,WAAWuB,GAAG,CAAC,CAAC,QAAQ,EAAEK,MAAM,iBAAiB,CAAC;gBAC7D,KAAK,MAAMnD,QAAQgD,eAAAA,OAAQ,EAAE,CAAE;oBAC7B,MAAMK,OAAOnD,aAAagC,eAAelC,MAAM,SAASG;oBACxD,IAAIkD,MAAMD,KAAKN,GAAG,CAACO;yBACd9B,WAAWuB,GAAG,CAAC,CAAC,UAAU,EAAEK,MAAM,qCAAqC,CAAC;gBAC/E;YACF;YACA;QACF;QACA,IAAIf,SAAS,uBAAuB;YAClC,MAAMkB,KAAKpD,aAAagC,eAAeU,IAAI,CAAC,EAAE,EAAE,cAAczC;YAC9D,IAAImD,IAAItB,SAASc,GAAG,CAACQ;iBAChB/B,WAAWuB,GAAG,CAAC;YACpB;QACF;QACA,IAAIV,SAAS,qBAAqB;YAChC,MAAMkB,KAAKpD,aAAagC,eAAeU,IAAI,CAAC,EAAE,EAAE,QAAQzC;YACxD,IAAImD,IAAIvB,WAAWe,GAAG,CAACQ;iBAClB/B,WAAWuB,GAAG,CAAC;YACpB;QACF;QACA,sEAAsE;QACtE,iEAAiE;QACjEvB,WAAWuB,GAAG,CAAC;IACjB;IAEA,MAAMxB,cAAmC,CAAC;IAC1C,IAAIS,WAAW1E,IAAI,IAAI2E,SAAS3E,IAAI,EAAE;QACpCiE,YAAYiC,IAAI,GAAG,aACbxB,WAAW1E,IAAI,GAAG;YAAE0E,YAAY;mBAAIA;aAAW,CAACyB,IAAI;QAAG,IAAI,CAAC,GAC5DxB,SAAS3E,IAAI,GAAG;YAAE2E,UAAU;mBAAIA;aAAS,CAACwB,IAAI;QAAG,IAAI,CAAC;IAE9D;IACA,IAAI5B,MAAMvE,IAAI,IAAIwE,OAAOxE,IAAI,IAAIyE,UAAUzE,IAAI,IAAI4E,OAAO;QACxDX,YAAYmC,OAAO,GAAG,aAChB7B,MAAMvE,IAAI,GAAG;YAAEuE,OAAO;mBAAIA;aAAM,CAAC4B,IAAI;QAAG,IAAI,CAAC,GAC7C3B,OAAOxE,IAAI,GAAG;YAAEwE,QAAQ;mBAAIA;aAAO,CAAC2B,IAAI;QAAG,IAAI,CAAC,GAChD1B,UAAUzE,IAAI,GAAG;YAAEyE,WAAW;mBAAIA;aAAU,CAAC0B,IAAI;QAAG,IAAI,CAAC,GACzDvB,QAAQ;YAAEA,OAAO;QAAK,IAAI,CAAC;IAEnC;IACA,OAAO;QAAEX;QAAaC,YAAY;eAAIA;SAAW,CAACiC,IAAI;IAAG;AAC3D;AAEA,+EAA+E,GAC/E,SAASE,sBAAsBpC,WAAgC;QAEhDA,mBACCA;QACViC,kBACAA,gBACAtB,cACAA,eACAA;IAPJ,MAAM0B,QAAkB,EAAE;IAC1B,MAAMJ,QAAOjC,oBAAAA,YAAYiC,IAAI,YAAhBjC,oBAAoB,CAAC;IAClC,MAAMW,SAAQX,uBAAAA,YAAYmC,OAAO,YAAnBnC,uBAAuB,CAAC;IACtC,KAAIiC,mBAAAA,KAAKxB,UAAU,qBAAfwB,iBAAiB9D,MAAM,EAAEkE,MAAM1D,IAAI,CAAC,CAAC,gBAAgB,EAAEsD,KAAKxB,UAAU,CAAC6B,IAAI,CAAC,OAAO;IACvF,KAAIL,iBAAAA,KAAKvB,QAAQ,qBAAbuB,eAAe9D,MAAM,EAAEkE,MAAM1D,IAAI,CAAC,CAAC,cAAc,EAAEsD,KAAKvB,QAAQ,CAAC4B,IAAI,CAAC,OAAO;IACjF,KAAI3B,eAAAA,MAAML,KAAK,qBAAXK,aAAaxC,MAAM,EAAEkE,MAAM1D,IAAI,CAAC,CAAC,cAAc,EAAEgC,MAAML,KAAK,CAACgC,IAAI,CAAC,OAAO;IAC7E,KAAI3B,gBAAAA,MAAMJ,MAAM,qBAAZI,cAAcxC,MAAM,EAAEkE,MAAM1D,IAAI,CAAC,CAAC,eAAe,EAAEgC,MAAMJ,MAAM,CAAC+B,IAAI,CAAC,OAAO;IAChF,KAAI3B,mBAAAA,MAAMH,SAAS,qBAAfG,iBAAiBxC,MAAM,EAAE;QAC3BkE,MAAM1D,IAAI,CAAC,CAAC,4BAA4B,EAAEgC,MAAMH,SAAS,CAAC8B,IAAI,CAAC,OAAO;IACxE;IACA,IAAI3B,MAAMA,KAAK,EAAE0B,MAAM1D,IAAI,CAAC;IAC5B,OAAO0D,MAAMC,IAAI,CAAC,UAAU;AAC9B;AAEA;;;;;;;;;CASC,GACD,SAASC,qBACPC,QAA+B,EAC/BC,OAAiC,EACjCjB,GAIS,EACTkB,OAAmC,EACnCC,WAA2C;QA8DzCC,aACAC,gBAKAD,cACAC,iBAKAD,gBACAC,mBAKAD,iBACAC,oBAKAD,iBACAC,oBAGED,iBAAyBC,oBAoCAA,iBAA2BD,cAC7BC,iBAAyBD,cACzBC,oBAAyBD;IA9HpD,MAAMA,QAAQJ,SAASxC,WAAW;IAClC,MAAM8C,YAAYV,sBAAsBQ;IACxC,MAAMG,qBACJC,QAAQJ,MAAMX,IAAI,IAAIW,MAAMT,OAAO,KAAKK,SAASvC,UAAU,CAAC9B,MAAM,GAAG;IACvE,MAAM8E,aAAaT,SAASvC,UAAU,CAAC9B,MAAM,GACzC,CAAC,yDAAyD,EAAEqE,SAASvC,UAAU,CAACqC,IAAI,CAAC,MAAM,CAAC,CAAC,GAC7F;IACJ,MAAMO,WAAWJ,2BAAAA,QAASS,qBAAqB;IAC/C,IAAIL,aAAa9B,WAAW;QAC1B,mEAAmE;QACnE,uEAAuE;QACvE,IAAI,CAACgC,oBAAoB;YACvBL,QAAQS,GAAG,CAAC,iBAAiB;YAC7B;QACF;QACAR,YAAY;QACZD,QAAQS,GAAG,CACT,iBACA,CAAC,UAAU,EAAEL,UAAU,oDAAoD,CAAC;QAE9E;IACF;IACA,IAAID,aAAa,MAAM;QACrBH,QAAQS,GAAG,CACT,iBACAJ,qBAAqB,CAAC,uBAAuB,EAAED,WAAW,GAAG;QAE/D,IAAI,CAACC,oBAAoB;QACzBvB,IACEiB,CAAAA,2BAAAA,QAASW,oBAAoB,IAAG,UAAU,WAC1C,iBACA,CAAC,iEAAiE,CAAC,GACjE,GAAGN,UAAU,CAAC,EAAEG,WAAW,cAAc,CAAC,GAC1C,CAAC,eAAe,EAAEI,KAAKC,SAAS,CAACV,OAAO,6BAA6B,CAAC,GACtE,qEACA,wEACA;QAEJ;IACF;IAEAF,QAAQS,GAAG,CAAC,iBAAiB,CAAC,SAAS,EAAEf,sBAAsBS,WAAW;IAC1E,MAAMU,UAAU,CACdC,OACAC,YACAC,QACAC;QAEA,KAAK,MAAM3B,MAAMyB,qBAAAA,aAAc,EAAE,CAAE;YACjC,IAAI,CAACC,iBAAAA,SAAU,EAAE,EAAEE,QAAQ,CAAC5B,KAAK;YACjCR,IACE,SACA,iBACA,CAAC,qBAAqB,EAAEgC,MAAM,EAAE,EAAExB,GAAG,+BAA+B,CAAC,GACnE,CAAC,UAAU,EAAE2B,aAAa;QAEhC;IACF;IACAJ,QACE,uBACAX,cAAAA,MAAMX,IAAI,qBAAVW,YAAYnC,UAAU,GACtBoC,iBAAAA,SAASZ,IAAI,qBAAbY,eAAepC,UAAU,EACzB;IAEF8C,QACE,qBACAX,eAAAA,MAAMX,IAAI,qBAAVW,aAAYlC,QAAQ,GACpBmC,kBAAAA,SAASZ,IAAI,qBAAbY,gBAAenC,QAAQ,EACvB;IAEF6C,QACE,iCACAX,iBAAAA,MAAMT,OAAO,qBAAbS,eAAetC,KAAK,GACpBuC,oBAAAA,SAASV,OAAO,qBAAhBU,kBAAkBvC,KAAK,EACvB;IAEFiD,QACE,sBACAX,kBAAAA,MAAMT,OAAO,qBAAbS,gBAAerC,MAAM,GACrBsC,qBAAAA,SAASV,OAAO,qBAAhBU,mBAAkBtC,MAAM,EACxB;IAEFgD,QACE,mCACAX,kBAAAA,MAAMT,OAAO,qBAAbS,gBAAepC,SAAS,GACxBqC,qBAAAA,SAASV,OAAO,qBAAhBU,mBAAkBrC,SAAS,EAC3B;IAEF,IAAIoC,EAAAA,kBAAAA,MAAMT,OAAO,qBAAbS,gBAAejC,KAAK,KAAI,GAACkC,qBAAAA,SAASV,OAAO,qBAAhBU,mBAAkBlC,KAAK,GAAE;QACpDa,IACE,SACA,iBACA,wEACE,kEACA,oEACA;IAEN;IACA,IAAIgB,SAASvC,UAAU,CAAC9B,MAAM,EAAE;QAC9BqD,IACE,WACA,iBACA,CAAC,2BAA2B,EAAEgB,SAASvC,UAAU,CAACqC,IAAI,CAAC,MAAM,GAAG,CAAC,GAC/D;IAEN;IACA,MAAMuB,SAAS,CACbL,OACAE,QACAD;QAEA,wEAAwE;QACxE,iDAAiD;QACjD,IAAIjB,SAASvC,UAAU,CAAC9B,MAAM,EAAE;QAChC,KAAK,MAAM6D,MAAM0B,iBAAAA,SAAU,EAAE,CAAE;YAC7B,IAAI,CAACD,qBAAAA,aAAc,EAAE,EAAEG,QAAQ,CAAC5B,KAAK;YACrCR,IACE,WACA,iBACA,CAAC,sBAAsB,EAAEgC,MAAM,EAAE,EAAExB,GAAG,wBAAwB,CAAC,GAC7D;QAEN;IACF;IACA6B,OAAO,uBAAsBhB,kBAAAA,SAASZ,IAAI,qBAAbY,gBAAepC,UAAU,GAAEmC,eAAAA,MAAMX,IAAI,qBAAVW,aAAYnC,UAAU;IAC9EoD,OAAO,qBAAoBhB,kBAAAA,SAASZ,IAAI,qBAAbY,gBAAenC,QAAQ,GAAEkC,eAAAA,MAAMX,IAAI,qBAAVW,aAAYlC,QAAQ;IACxEmD,OAAO,qBAAoBhB,qBAAAA,SAASV,OAAO,qBAAhBU,mBAAkBvC,KAAK,GAAEsC,kBAAAA,MAAMT,OAAO,qBAAbS,gBAAetC,KAAK;AAC1E;AAEA;;;;;;;;;;;;;;;CAeC,GACD,SAASwD,mBACPzD,OAAgB,EAChBxB,SAAsC;IAEtC,MAAM+D,QAAQ,IAAI7F;IAClB,MAAMgH,QAAQ,CAACnG;QACb,MAAMC,MAAMD,IAAI,CAAC,MAAM;QACvB,IAAI,CAACC,KAAK,OAAO;QACjB,IAAI,CAACD,IAAI,CAAC,WAAW,IAAIC,IAAIC,IAAI,KAAK,cAAc,OAAOD,GAAG,CAAC,OAAO;QACtE,OAAOe,aAAaf,KAAKgB;IAC3B;IACAd,KAAKsC,SAAS,CAACzC;QACb,IAAIA,KAAKE,IAAI,KAAK,YAAY;YAC5B,MAAMD,MAAMkG,MAAMnG;YAClB,MAAMW,QAAQK,aAAahB,IAAI,CAAC,QAAQ,EAAaiB;YACrD,MAAMgD,QAAQhE,OAAOU,UAAU,OAAOjD,4BAA4BuC,KAAKU,SAAS;YAChF,IAAIsD,OAAOe,MAAMpB,GAAG,CAACK;QACvB,OAAO,IAAIjE,KAAKE,IAAI,KAAK,kBAAkB;gBAE3BF;YADd,MAAMwD,SAASxD,IAAI,CAAC,SAAS;YAC7B,MAAM0D,QAAQ1D,kBAAAA,IAAI,CAAC,YAAY,YAAjBA,kBAAqB,EAAE;YACrC,IAAIwD,CAAAA,0BAAAA,OAAQtD,IAAI,MAAK,sBAAsByB,aAAa6B,QAAQvC,eAAe,gBAAgB;gBAC7F,MAAMiC,OAAOlC,aAAa0C,IAAI,CAAC,EAAE,EAAEzC;gBACnC,MAAMN,QAAQK,aAAa0C,IAAI,CAAC,EAAE,EAAEzC;gBACpC,MAAMgD,QAAQf,SAAS,QAAQvC,UAAU,OAAOjD,4BAA4BwF,MAAMvC,SAAS;gBAC3F,IAAIsD,OAAOe,MAAMpB,GAAG,CAACK;YACvB;QACF,OAAO,IAAIjE,KAAKE,IAAI,KAAK,aAAa,OAAOF,IAAI,CAAC,QAAQ,KAAK,UAAU;YACvE,MAAMiE,QAAQtG,iBAAiBqC,IAAI,CAAC,QAAQ;YAC5C,IAAIiE,OAAOe,MAAMpB,GAAG,CAACK;QACvB,OAAO,IAAIjE,KAAKE,IAAI,KAAK,mBAAmB;gBAC3BF;YAAf,MAAMoG,OAAO,EAAEpG,eAAAA,IAAI,CAAC,SAAS,YAAdA,eAAkB,EAAE,EAChCqG,GAAG,CAAC,CAACC;;oBAAkBA;uBAARC,gBAAQD,eAAAA,KAAK,CAAC,QAAQ,qBAAf,AAACA,aAAoDjF,MAAM,mBAAI;eACrFqD,IAAI,CAAC;YACR,MAAMT,QAAQtG,iBAAiByI;YAC/B,IAAInC,OAAOe,MAAMpB,GAAG,CAACK;QACvB;IACF;IACA,MAAMuC,QAAQ;QAAEC,UAAU;QAAcC,MAAM;QAAkCC,KAAK;IAAkB;IACvG,OAAO;WAAI3B;KAAM,CAACqB,GAAG,CACnB,CAACpC,QACC,CAAC,8BAA8B,EAAEuC,KAAK,CAACvC,MAAM,CAAC,oCAAoC,CAAC,GACnF;AAEN;AAEA;;;;;;;;;;;;;;CAcC,GACD,SAAS2C,yBAAyB3B,QAA2B;IAC3D,MAAM4B,WAAqB,EAAE;IAC7B,KAAK,MAAM3E,UAAU+C,SAAU;QAC7B,IAAI6B;QACJ,IAAI;YACFA,OAAO,IAAI/E,IAAIG,QAAQ6E,QAAQ;QACjC,EAAE,eAAM;YACN;QACF;QACA,MAAMC,QAAQpJ,sBAAsBkJ;QACpC,IAAIE,OAAO;YACTH,SAAS9F,IAAI,CACX,CAAC,sBAAsB,EAAEmB,OAAO,kBAAkB,EAAE8E,MAAMpB,KAAK,CAAC,MAAM,CAAC,GACrE,CAAC,WAAW,EAAEoB,MAAMpB,KAAK,CAAC,gDAAgD,CAAC;QAEjF;IACF;IACA,OAAOiB;AACT;AAEA;;;CAGC,GACD,SAASI,gBACP7G,IAAa,EACbC,KAAsD;IAEtD,MAAMC,QAA0C;QAAC;YAACF;YAAM;SAAK;KAAC;IAC9D,MAAOE,MAAMC,MAAM,CAAE;QACnB,MAAMrC,QAAQoC,MAAME,GAAG;QACvB,IAAI,CAACtC,OAAO;QACZ,MAAM,CAAC8B,MAAMkH,OAAO,GAAGhJ;QACvBmC,MAAML,MAAMkH;QACZ,KAAK,MAAMjH,OAAOQ,OAAOC,IAAI,CAACV,MAAO;YACnC,IAAIC,QAAQ,UAAUA,QAAQ,WAAWA,QAAQ,OAAO;YACxD,IAAIF,aAAaC,MAAMC,MAAM;YAC7B,MAAMU,QAAQX,IAAI,CAACC,IAAI;YACvB,MAAMkH,WAAWvG,MAAMC,OAAO,CAACF,SAASA,QAAQ;gBAACA;aAAM;YACvD,KAAK,MAAMyG,SAASD,SAAU;gBAC5B,IACEC,SACA,OAAOA,UAAU,YACjB,OAAO,AAACA,MAAkBlH,IAAI,KAAK,UACnC;oBACAI,MAAMS,IAAI,CAAC;wBAACqG;wBAAkBpH;qBAAK;gBACrC;YACF;QACF;IACF;AACF;AAEA,MAAMqH,iBAAiB,IAAIlI,IAAI;IAC7B;IACA;IACA;CACD;AAED,uDAAuD,GACvD,MAAMmI,cAAc,IAAInI,IAAI;IAC1B;OACGkI;IACH;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD;AAED,oFAAoF,GACpF,SAASE,aAAaC,OAAmC,EAAEtD,IAAiB;IAC1E,IAAI,CAACsD,SAAS;IACd,OAAQA,QAAQtH,IAAI;QAClB,KAAK;YACHgE,KAAKN,GAAG,CAAC4D,OAAO,CAAC,OAAO;YACxB;QACF,KAAK;YACH,OAAOD,aAAaC,OAAO,CAAC,OAAO,EAAatD;QAClD,KAAK;YACH,OAAOqD,aAAaC,OAAO,CAAC,WAAW,EAAatD;QACtD,KAAK;gBACoBsD;YAAvB,KAAK,MAAMC,YAAYD,oBAAAA,OAAO,CAAC,WAAW,YAAnBA,oBAAuB,EAAE,CAAgBD,aAAaE,SAASvD;YACtF;QACF,KAAK;gBACqBsD;YAAxB,KAAK,MAAM5F,aAAa4F,sBAAAA,OAAO,CAAC,aAAa,YAArBA,sBAAyB,EAAE,CAAgB;gBACjED,aACG3F,SAAS1B,IAAI,KAAK,gBAAgB0B,WAAWA,QAAQ,CAAC,QAAQ,EAC/DsC;YAEJ;YACA;IACJ;AACF;AAEA,sFAAsF,GACtF,SAASwD,aAAaC,UAA8B,EAAEzD,IAAiB;IACrE,KAAK,MAAM0D,aAAaD,WAAY;QAClC,IAAIC,CAAAA,6BAAAA,UAAW1H,IAAI,MAAK,yBAAyB0H,SAAS,CAAC,OAAO,KAAK,OAAO;gBAClDA;YAA1B,KAAK,MAAMC,eAAeD,0BAAAA,SAAS,CAAC,eAAe,YAAzBA,0BAA6B,EAAE,CAAgB;gBACvEL,aAAaM,UAAU,CAAC,KAAK,EAAa3D;YAC5C;QACF;QACA,IACE,AAAC0D,CAAAA,CAAAA,6BAAAA,UAAW1H,IAAI,MAAK,yBAAyB0H,CAAAA,6BAAAA,UAAW1H,IAAI,MAAK,kBAAiB,KACnF0H,SAAS,CAAC,KAAK,EACf;YACA1D,KAAKN,GAAG,CAAC,AAACgE,SAAS,CAAC,KAAK,AAAY,CAAC,OAAO;QAC/C;IACF;AACF;AAEA,oFAAoF,GACpF,SAASE,SAAS9H,IAAgC,EAAEkE,IAAiB;IACnE,IAAI,CAAClE,QAAQ,OAAOA,SAAS,UAAU;IACvC,IAAIqH,eAAe5D,GAAG,CAACzD,KAAKE,IAAI,GAAG;IACnC,IAAIF,KAAKE,IAAI,KAAK,yBAAyBF,IAAI,CAAC,OAAO,KAAK,OAAO;YACvCA;QAA1B,KAAK,MAAM6H,eAAe7H,qBAAAA,IAAI,CAAC,eAAe,YAApBA,qBAAwB,EAAE,CAAgB;YAClEuH,aAAaM,UAAU,CAAC,KAAK,EAAa3D;QAC5C;IACF;IACA,KAAK,MAAM,CAACD,OAAOtD,MAAM,IAAIF,OAAOsH,OAAO,CAAC/H,MAAO;QACjD,IAAIiE,UAAU,UAAU,CAACtD,SAAS,OAAOA,UAAU,UAAU;QAC7D,IAAIC,MAAMC,OAAO,CAACF,QAAQ,KAAK,MAAMyG,SAASzG,MAAOmH,SAASV,OAAkBlD;aAC3E,IAAI,UAAWvD,OAAkBmH,SAASnH,OAAkBuD;IACnE;AACF;AAEA,sDAAsD,GACtD,SAAS8D,cAAcC,KAAc;IACnC,MAAMC,QAAQ,IAAI/I;IAClB,IAAIkI,eAAe5D,GAAG,CAACwE,MAAM/H,IAAI,GAAG;YACb+H;QAArB,KAAK,MAAME,UAAUF,gBAAAA,KAAK,CAAC,SAAS,YAAfA,gBAAmB,EAAE,CAAgBV,aAAaY,OAAOD;QAC9E,IAAID,MAAM/H,IAAI,KAAK,wBAAwB+H,KAAK,CAAC,KAAK,EAAE;YACtDC,MAAMtE,GAAG,CAAC,AAACqE,KAAK,CAAC,KAAK,AAAY,CAAC,OAAO;QAC5C;QACA,MAAMG,OAAOH,KAAK,CAAC,OAAO;QAC1B,IAAIG,CAAAA,wBAAAA,KAAMlI,IAAI,MAAK,kBAAkB;gBACVkI,YACXA;YADd,KAAK,MAAMR,cAAcQ,aAAAA,IAAI,CAAC,OAAO,YAAZA,aAAgB,EAAE,CAAgBN,SAASF,WAAWM;YAC/ER,cAAcU,cAAAA,IAAI,CAAC,OAAO,YAAZA,cAAgB,EAAE,EAAgBF;QAClD;QACA,OAAOA;IACT;IACA,OAAQD,MAAM/H,IAAI;QAChB,KAAK;QACL,KAAK;QACL,KAAK;gBACW+H;YAAdP,cAAcO,cAAAA,KAAK,CAAC,OAAO,YAAbA,cAAiB,EAAE,EAAgBC;YACjD;QACF,KAAK;gBACmBD;YAAtB,KAAK,MAAMI,WAAWJ,eAAAA,KAAK,CAAC,QAAQ,YAAdA,eAAkB,EAAE,CAAgB;oBAC1CI;gBAAdX,cAAcW,qBAAAA,MAAM,CAAC,aAAa,YAApBA,qBAAwB,EAAE,EAAgBH;YAC1D;YACA;QACF,KAAK;YACHX,aAAaU,KAAK,CAAC,QAAQ,EAAaC;YACxC;QACF,KAAK;QACL,KAAK;QACL,KAAK;YAAkB;oBACPD;gBAAd,MAAMK,QAAQL,cAAAA,KAAK,CAAC,OAAO,YAAbA,cAAiBA,KAAK,CAAC,OAAO;gBAC5C,IAAIK,CAAAA,wBAAAA,KAAMpI,IAAI,MAAK,yBAAyBoI,IAAI,CAAC,OAAO,KAAK,OAAOZ,aAAa;oBAACY;iBAAK,EAAEJ;gBACzF;YACF;QACA,KAAK;YACH,IAAID,KAAK,CAAC,KAAK,EAAEC,MAAMtE,GAAG,CAAC,AAACqE,KAAK,CAAC,KAAK,AAAY,CAAC,OAAO;YAC3D;IACJ;IACA,OAAOC;AACT;AAEA;;;CAGC,GACD,SAASK,YAAYvI,IAAa,EAAEkH,MAAkC;IACpE,IAAI,CAACA,QAAQ,OAAO;IACpB,OAAQA,OAAOhH,IAAI;QACjB,KAAK;YACH,OAAOgH,MAAM,CAAC,SAAS,KAAKlH,QAAQkH,MAAM,CAAC,WAAW,KAAK;QAC7D,KAAK;YACH,IAAIA,MAAM,CAAC,MAAM,KAAKlH,QAAQkH,MAAM,CAAC,WAAW,KAAK,MAAM;gBACzD,OAAOA,MAAM,CAAC,YAAY,KAAK,QAAQA,MAAM,CAAC,QAAQ,KAAKlH;YAC7D;YACA,OAAO;QACT,KAAK;QACL,KAAK;YACH,OAAOkH,MAAM,CAAC,MAAM,KAAKlH,QAAQkH,MAAM,CAAC,WAAW,KAAK;QAC1D,KAAK;QACL,KAAK;QACL,KAAK;YACH,OAAO;QACT,KAAK;YACH,OAAOA,MAAM,CAAC,QAAQ,KAAKlH;QAC7B,KAAK;QACL,KAAK;QACL,KAAK;YACH,OAAO;QACT;YACE,OAAO;IACX;AACF;AAEA;;;;;;;;;;;;;;;;;;;;;;CAsBC,GACD,SAASwI,aACP/F,OAAgB,EAChBxB,SAAsC,EACtCwH,WAA0D;IAU1D,MAAMC,UAAU,IAAIC;IACpB,MAAMC,cAAc,IAAID;IACxB1B,gBAAgBxE,SAAS,CAACzC,MAAMkH;QAC9BwB,QAAQnD,GAAG,CAACvF,MAAMkH;QAClB,IAAIlH,KAAKE,IAAI,KAAK,cAAc;YAC9B,MAAMgD,OAAOlD,IAAI,CAAC,OAAO;YACzB,MAAM8D,OAAO8E,YAAY1H,GAAG,CAACgC;YAC7B,IAAIY,MAAMA,KAAK/C,IAAI,CAACf;iBACf4I,YAAYrD,GAAG,CAACrC,MAAM;gBAAClD;aAAK;QACnC;IACF;IACA,yEAAyE;IACzE,2EAA2E;IAC3E,gDAAgD;IAChD,MAAM6I,aAAa,IAAIF;IACvB,MAAMG,UAAU,CAACb;QACf,IAAIjD,QAAQ6D,WAAW3H,GAAG,CAAC+G;QAC3B,IAAI,CAACjD,OAAO;YACVA,QAAQgD,cAAcC;YACtBY,WAAWtD,GAAG,CAAC0C,OAAOjD;QACxB;QACA,OAAOA;IACT;IACA,sFAAsF,GACtF,MAAM+D,eAAe,CAAClB;QACpB,MAAMmB,cAAcN,QAAQxH,GAAG,CAAC2G;QAChC,MAAMoB,iBAAiBD,CAAAA,+BAAAA,WAAa,CAAC,OAAO,MAAK;QACjD,IAAK,IAAIE,KAAKR,QAAQxH,GAAG,CAAC8H,cAAyBE,IAAIA,KAAKR,QAAQxH,GAAG,CAACgI,IAAK;YAC3E,IAAID,iBAAiB5B,eAAe5D,GAAG,CAACyF,GAAGhJ,IAAI,KAAKgJ,GAAGhJ,IAAI,KAAK,YAAYoH,YAAY7D,GAAG,CAACyF,GAAGhJ,IAAI,GAAG;gBACpG,OAAOgJ;YACT;QACF;QACA,OAAO;IACT;IACA,gEAAgE,GAChE,MAAMC,aAAa,CAACC,KAAclG,MAAc+E;QAC9C,IAAI,CAACM,YAAYa,KAAKV,QAAQxH,GAAG,CAACkI,OAAO,OAAO;QAChD,IAAK,IAAIF,KAAKR,QAAQxH,GAAG,CAACkI,MAAMF,IAAIA,KAAKR,QAAQxH,GAAG,CAACgI,IAAK;YACxD,IAAIA,OAAOjB,OAAO,OAAO;YACzB,IAAIX,YAAY7D,GAAG,CAACyF,GAAGhJ,IAAI,KAAK4I,QAAQI,IAAIzF,GAAG,CAACP,OAAO,OAAO;QAChE;QACA,OAAO+E,UAAU;IACnB;IAEA,MAAMoB,eAAe,CAACrJ,OACpB,CAACA,wBAAAA,KAAME,IAAI,MAAK,gBAAgBF,IAAI,CAAC,OAAO,KAAKlC,sBAChDkC,CAAAA,wBAAAA,KAAME,IAAI,MAAK,sBACduI,YAAYzI,IAAI,CAAC,SAAS,KAC1B2B,aAAa3B,UAAUlC;IAE3B,yEAAyE;IACzE,6EAA6E;IAC7E,aAAa;IACb,MAAMwL,YAAY,IAAIX;IACtBxI,KAAKsC,SAAS,CAACzC;YAcVA;QAbH,IAAIA,KAAKE,IAAI,KAAK,sBAAsB;YACtC,MAAMkE,KAAKpE,IAAI,CAAC,KAAK;YACrB,MAAMuJ,OAAOvJ,IAAI,CAAC,OAAO;YACzB,MAAMwJ,QACJD,CAAAA,wBAAAA,KAAMrJ,IAAI,MAAK,sBACX;gBAACqJ,IAAI,CAAC,OAAO;gBAAaA,IAAI,CAAC,QAAQ;aAAY,GACnD;gBAACA;aAAK;YACZ,IAAInF,CAAAA,sBAAAA,GAAIlE,IAAI,MAAK,gBAAgBsJ,MAAMC,IAAI,CAACJ,eAAe;gBACzDC,UAAU/D,GAAG,CAACnB,EAAE,CAAC,OAAO,EAAY;oBAAE6D,OAAOc,aAAa/I;oBAAOmI,OAAO;gBAAM;YAChF;QACF;QACA,IACEnI,KAAKE,IAAI,KAAK,yBACd,EAACF,WAAAA,IAAI,CAAC,KAAK,qBAAX,AAACA,QAA+B,CAAC,OAAO,MAAK,YAC7C;gBACgBA;YAAhB,MAAMmI,QAAQ,EAAEnI,eAAAA,IAAI,CAAC,SAAS,YAAdA,eAAkB,EAAE,CAAe,CAAC,EAAE;YACtD,IAAImI,CAAAA,yBAAAA,MAAOjI,IAAI,MAAK,gBAAgB,CAACoJ,UAAU7F,GAAG,CAAC0E,KAAK,CAAC,OAAO,GAAa;gBAC3EmB,UAAU/D,GAAG,CAAC4C,KAAK,CAAC,OAAO,EAAY;oBAAEF,OAAOjI;oBAAMmI,OAAO;gBAAK;YACpE;QACF;IACF;IACA,6EAA6E,GAC7E,MAAMuB,UAAU,CACd1J;QAEA,IAAIqJ,aAAarJ,OAAO,OAAO;QAC/B,IAAIA,CAAAA,wBAAAA,KAAME,IAAI,MAAK,cAAc,OAAO;QACxC,MAAMgD,OAAOlD,IAAI,CAAC,OAAO;QACzB,MAAM2J,UAAUL,UAAUpI,GAAG,CAACgC;QAC9B,IAAI,CAACyG,WAAW,CAACR,WAAWnJ,MAAMkD,MAAMyG,QAAQ1B,KAAK,GAAG,OAAO;QAC/D,OAAO0B,QAAQxB,KAAK,GAAG,UAAU;IACnC;IAEA,MAAMyB,UAAU,IAAIzK,IAAYpB;IAChC,MAAM8L,UAAU,IAAI1K,IAAYtB;IAChC,MAAMiM,OAAO,IAAI3K;IACjB,MAAM4K,UAAU,IAAI5K;IACpB,MAAM6K,iBAAiB,IAAI7K;IAC3B,IAAI8K,WAAW;IACf,IAAIC,kBAAkB;IACtB,MAAMhC,QAAQ,IAAIS;IAClB,MAAMwB,QAAQ,CAAClK;QACbiI,MAAM3C,GAAG,CAACtF,KAAK;IACjB;IACA,MAAMmK,OAAO,CAACnK,KAAaiD;QACzB,IAAIA,SAAS,MAAM,OAAOiH,MAAMlK;QAChC,MAAMoK,UAAUnC,MAAMhH,GAAG,CAACjB;QAC1B,IAAIoK,YAAY,KAAK;QACrB,IAAIA,SAASA,QAAQzG,GAAG,CAACV;aACpBgF,MAAM3C,GAAG,CAACtF,KAAK,IAAId,IAAI;YAAC+D;SAAK;IACpC;IACA,MAAMoH,cAAc,IAAInL;IAExB,8DAA8D,GAC9D,MAAMoL,QAAQ,CAACtK,KAAamJ;QAC1B,MAAMlC,SAASwB,QAAQxH,GAAG,CAACkI;QAC3B,yEAAyE;QACzE,mEAAmE;QACnE,0BAA0B;QAC1B,IACE,CAAClC,0BAAAA,OAAQhH,IAAI,MAAK,qBACfgH,CAAAA,MAAM,CAAC,WAAW,KAAK,OAAOA,MAAM,CAAC,WAAW,KAAK,QAAO,KAC9D,AAACA,CAAAA,CAAAA,0BAAAA,OAAQhH,IAAI,MAAK,iBAAiBgH,CAAAA,0BAAAA,OAAQhH,IAAI,MAAK,uBAAsB,KACzEgH,MAAM,CAAC,OAAO,KAAKkC,KACrB;YACA;QACF;QACA,IAAIlC,CAAAA,0BAAAA,OAAQhH,IAAI,MAAK,sBAAsBgH,MAAM,CAAC,SAAS,KAAKkC,KAAK;YACnE,OAAOgB,KAAKnK,KAAK0B,aAAauF,QAAQjG;QACxC;QACA,IAAIiG,CAAAA,0BAAAA,OAAQhH,IAAI,MAAK,wBAAwBgH,MAAM,CAAC,OAAO,KAAKkC,KAAK;YACnE,MAAMhF,KAAK8C,MAAM,CAAC,KAAK;YACvB,IAAI9C,CAAAA,sBAAAA,GAAIlE,IAAI,MAAK,cAAc;oBAKX0I;gBAJlB,MAAM4B,QAAQpG,EAAE,CAAC,OAAO;gBACxB,IAAIkG,YAAY7G,GAAG,CAACyD,SAAS;gBAC7BoD,YAAY1G,GAAG,CAACsD;gBAChB,MAAMe,QAAQc,aAAa7B;gBAC3B,KAAK,MAAMuD,QAAO7B,mBAAAA,YAAY1H,GAAG,CAACsJ,kBAAhB5B,mBAA0B,EAAE,CAAE;oBAC9C,IAAI6B,QAAQrG,MAAM+E,WAAWsB,KAAKD,OAAOvC,QAAQsC,MAAMtK,KAAKwK;gBAC9D;gBACA;YACF;YACA,IAAIrG,CAAAA,sBAAAA,GAAIlE,IAAI,MAAK,iBAAiB;oBACRkE;gBAAxB,KAAK,MAAMxC,aAAawC,iBAAAA,EAAE,CAAC,aAAa,YAAhBA,iBAAoB,EAAE,CAAgB;oBAC5D,IAAIxC,SAAS1B,IAAI,KAAK,cAAc0B,QAAQ,CAAC,WAAW,EAAE;wBACxD,OAAOuI,MAAMlK;oBACf;oBACA,MAAMyK,cAAc9I,QAAQ,CAAC,MAAM;oBACnC,MAAMsB,OACJwH,CAAAA,+BAAAA,YAAaxK,IAAI,MAAK,eACjBwK,WAAW,CAAC,OAAO,GACpB1J,aAAa0J;oBACnBN,KAAKnK,KAAKiD;gBACZ;gBACA;YACF;QACF;QACAiH,MAAMlK;IACR;IAEAE,KAAKsC,SAAS,CAACzC;QACb,IAAIA,KAAKE,IAAI,KAAK,oBAAoB;QACtC,MAAMyK,MAAMjB,QAAQ1J,IAAI,CAAC,SAAS;QAClC,IAAI,CAAC2K,KAAK;QACV,MAAM1K,MAAM0B,aAAa3B,MAAMiB;QAC/B,IAAIhB,QAAQ,MAAM;YAChB,IAAI0K,QAAQ,SAAST,mBAAmB;iBACnCD,YAAY;QACnB,OAAO,IAAI,CAACJ,QAAQpG,GAAG,CAACxD,MAAM;;YAC1B0K,CAAAA,QAAQ,UAAUX,iBAAiBD,OAAM,EAAGnG,GAAG,CAAC3D;QACpD,OAAO;YACL6J,KAAKlG,GAAG,CAAC3D;YACT,IAAI2J,QAAQnG,GAAG,CAACxD,MAAMsK,MAAMtK,KAAKD;QACnC;IACF;IAEA,MAAM4K,UAAmD,CAAC;IAC1D,KAAK,MAAM,CAAC3K,KAAKU,MAAM,IAAIuH,MAAO;QAChC0C,OAAO,CAAC3K,IAAI,GAAGU,UAAU,MAAM,MAAM;eAAIA;SAAM,CAAC2D,IAAI;IACtD;IACA,OAAO;QACLwF;QACAC;QACAC;QACAC;QACAC;QACAU;IACF;AACF;AAEA,SAASC,cACPC,MAAc,EACdjG,OAAsB;;IAEtB,MAAMkG,WAAiC,EAAE;IACzC,MAAMC,OAAO,IAAI7L;IACjB,yEAAyE;IACzE,0EAA0E;IAC1E,MAAM8L,SAAS,IAAItC,IACjBjK,YAAY2H,GAAG,CAAC,CAACjC,KAAO;YAACA;YAAI;SAAO;IAEtC,MAAMU,UAAU,IAAI6D;IACpB,MAAM/E,MAAM,CACVsH,OACAC,OACAC;QAEA,IAAIF,UAAU,SAASD,OAAO1F,GAAG,CAAC4F,OAAO;aACpC,IAAIF,OAAO/J,GAAG,CAACiK,WAAW,QAAQF,OAAO1F,GAAG,CAAC4F,OAAO;QACzD,IAAIH,KAAKvH,GAAG,CAAC2H,YAAYJ,KAAK7M,IAAI,IAAIyB,cAAc;QACpDoL,KAAKpH,GAAG,CAACwH;QACTL,SAAShK,IAAI,CAAC;YAAEmK;YAAOE;YAASD;QAAM;IACxC;IACA,iEAAiE,GACjE,MAAME,cAAc,CAAC,GAAGC;QACtB,KAAK,MAAMlH,MAAMkH,IAAKL,OAAO1F,GAAG,CAACnB,IAAI;IACvC;IACA,MAAMmH,YAAY,IAChB7M,YAAY2H,GAAG,CAAC,CAACjC;gBAGP6G;mBAHe;gBACvB7G;gBACAwB,OAAO3H,YAAY,CAACmG,GAAG;gBACvB6G,MAAM,GAAEA,cAAAA,OAAO/J,GAAG,CAACkD,eAAX6G,cAAkB;eACtBnG,QAAQrB,GAAG,CAACW,MAAM;gBAAEoH,QAAQ1G,QAAQ5D,GAAG,CAACkD;YAAI,IAAI,CAAC;;IAGzD,MAAMqH,mBAAW5G,2BAAAA,QAAS4G,QAAQ,mBAAI9M;IACtC,MAAM+M,QAAQ,IAAIC,cAAcC,MAAM,CAACd,QAAQe,UAAU;IACzD/G,QAAQS,GAAG,CAAC,QAAQ,GAAGmG,MAAMI,cAAc,CAAC,SAAS,UAAU,EAAEL,SAASK,cAAc,CAAC,UAAU;IACnG,IAAIJ,UAAU,GAAG;QACf9H,IAAI,SAAS,QAAQ;QACrByH,YACE,SACA,SACA,kBACA,YACA,kBACA,WACA,WACA,kBACA,WACA,eACA,iBACA;QAEF,OAAO;YACLU,IAAI;YACJhB;YACAiB,QAAQT;YACRU,SAAS;gBAAEC,UAAU;gBAAOC,aAAa;YAAM;YAC/C3N,eAAe2D;QACjB;IACF;IACA,IAAIuJ,QAAQD,UAAU;QACpB7H,IAAI,SAAS,QAAQ,CAAC,UAAU,EAAE8H,MAAM,cAAc,EAAED,SAAS,CAAC,CAAC;IACrE;IAEA,MAAMW,eAAwB;QAC5BC,aAAa;QACbC,YAAY;QACZC,eAAe;QACfC,2BAA2B;IAC7B;IACA,IAAI/J;IACJ,IAAI;QACFA,UAAUhF,MAAMqN,QAAQsB;IAC1B,EAAE,OAAOK,OAAO;QACd,uEAAuE;QACvE,qEAAqE;QACrE,0DAA0D;QAC1D7I,IACE,SACA,SACA,CAAC,uCAAuC,EACtC6I,iBAAiBC,QAAQD,MAAMrB,OAAO,GAAG7E,OAAOkG,QAChD;QAEJpB,YACE,SACA,kBACA,YACA,kBACA,WACA,WACA,kBACA,WACA,eACA,iBACA;QAEF,OAAO;YACLU,IAAI;YACJhB;YACAiB,QAAQT;YACRU,SAAS;gBAAEC,UAAU;gBAAOC,aAAa;YAAM;YAC/C3N,eAAe2D;QACjB;IACF;IAEA,yEAAyE;IACzE,0EAA0E;IAC1E,MAAMwK,UAAU,IAAIxN;IACpB,MAAMyN,YAAY,CAAC1J,MAAeqG;QAChC,IAAI,OAAOrG,SAAS,YAAY,CAACqG,MAAM;QACvC,MAAMC,QACJD,KAAKrJ,IAAI,KAAK,sBACV;YAACqJ,IAAI,CAAC,OAAO;YAAaA,IAAI,CAAC,QAAQ;SAAY,GACnD;YAACA;SAAK;QACZ,KAAK,MAAMnJ,QAAQoJ,MAAO;YACxB,IACEpJ,CAAAA,wBAAAA,KAAMF,IAAI,MAAK,gBACfhB,aAAauE,GAAG,CAACrD,IAAI,CAAC,OAAO,GAC7B;gBACAuM,QAAQ/I,GAAG,CAACV;YACd;QACF;IACF;IACA,yDAAyD;IACzD,EAAE;IACF,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,oEAAoE;IACpE,MAAMjC,YAAY,IAAI0H;IACtB;QACE,MAAMkE,QAAQ,IAAIlE;QAClB,MAAMmE,WAAW,IAAI3N;QACrB,MAAM8F,WAAW,IAAI9F;QACrB,MAAM4N,SAAS,CAAC7J;YACd,IAAI,OAAOA,SAAS,UAAU4J,SAASlJ,GAAG,CAACV;QAC7C;QACA;;oBAEgB,GAChB,MAAM8J,gBAAgB,CAAChN;YACrB,IAAI,CAACA,MAAM;YACX,IAAIA,KAAKE,IAAI,KAAK,cAAc,OAAO6M,OAAO/M,IAAI,CAAC,OAAO;YAC1D,KAAK,MAAMC,OAAO;gBAChB;gBACA;gBACA;gBACA;gBACA;aACD,CAAE;gBACD,MAAMU,QAAQX,IAAI,CAACC,IAAI;gBACvB,IAAIW,MAAMC,OAAO,CAACF,QAChBA,MAAMsM,OAAO,CAAC,CAACnM,OAASkM,cAAclM;qBACnC,IAAIH,OAAOqM,cAAcrM;YAChC;QACF;QACAR,KAAKsC,SAAS,CAACzC;YACb,IAAIA,KAAKE,IAAI,KAAK,sBAAsB;gBACtC,MAAMkE,KAAKpE,IAAI,CAAC,KAAK;gBACrB,IAAIoE,CAAAA,sBAAAA,GAAIlE,IAAI,MAAK,cAAc;oBAC7B,MAAMgD,OAAOkB,EAAE,CAAC,OAAO;oBACvB,IAAIa,SAASxB,GAAG,CAACP,OAAO6J,OAAO7J;oBAC/B+B,SAASrB,GAAG,CAACV;oBACb2J,MAAMtH,GAAG,CAACrC,MAAMlD,IAAI,CAAC,OAAO;gBAC9B,OAAO;oBACLgN,cAAc5I;gBAChB;YACF,OAAO,IAAIpE,KAAKE,IAAI,KAAK,wBAAwB;gBAC/C8M,cAAchN,IAAI,CAAC,OAAO;YAC5B,OAAO,IAAIA,KAAKE,IAAI,KAAK,oBAAoB;gBAC3C8M,cAAchN,IAAI,CAAC,WAAW;YAChC,OAAO,IACLA,KAAKE,IAAI,KAAK,yBACdF,KAAKE,IAAI,KAAK,wBACdF,KAAKE,IAAI,KAAK,2BACd;oBACGF;oBACEA;;gBADJ,EAAEA,eAAAA,IAAI,CAAC,SAAS,YAAdA,eAAkB,EAAE,EAAgBiN,OAAO,CAACD;gBAC/C,IAAI,EAAChN,WAAAA,IAAI,CAAC,KAAK,qBAAX,AAACA,SAAwBE,IAAI,MAAK,cACpC6M,OAAO,AAAC/M,IAAI,CAAC,KAAK,AAAY,CAAC,OAAO;YAC1C,OAAO,IAAIA,KAAKE,IAAI,KAAK,eAAe;gBACtC8M,cAAchN,IAAI,CAAC,QAAQ;YAC7B,OAAO,IACLA,KAAKE,IAAI,KAAK,sBACdF,KAAKE,IAAI,KAAK,mBACd;oBACKF;gBAAL,IAAI,EAACA,YAAAA,IAAI,CAAC,KAAK,qBAAX,AAACA,UAAwBE,IAAI,MAAK,cACpC6M,OAAO,AAAC/M,IAAI,CAAC,KAAK,AAAY,CAAC,OAAO;YAC1C;QACF;QACA,yEAAyE;QACzE,0EAA0E;QAC1E,IAAK,IAAIkN,OAAO,GAAGA,OAAO,GAAGA,QAAQ,EAAG;YACtC,KAAK,MAAM,CAAChK,MAAMqG,KAAK,IAAIsD,MAAO;gBAChC,IAAIC,SAASrJ,GAAG,CAACP,SAASjC,UAAUwC,GAAG,CAACP,OAAO;gBAC/C,MAAMvC,QAAQK,aAAauI,MAAMtI;gBACjC,IAAIN,UAAU,MAAMM,UAAUsE,GAAG,CAACrC,MAAMvC;YAC1C;QACF;IACF;IAEA,0EAA0E;IAC1E,iEAAiE;IACjE,MAAMwM,kBAAkB,IAAIxE;IAC5B,2DAA2D,GAC3D,MAAMyE,eAAe,CAAC7D;QACpB,IAAI,CAACA,MAAM,OAAO;QAClB,IACEA,KAAKrJ,IAAI,KAAK,gBACdX,oBAAoBkE,GAAG,CAAC8F,IAAI,CAAC,OAAO,GACpC;YACA,OAAOA,IAAI,CAAC,OAAO;QACrB;QACA,yEAAyE;QACzE,wEAAwE;QACxE,gDAAgD;QAChD,IAAIA,KAAKrJ,IAAI,KAAK,oBAAoB;YACpC,MAAM0B,WAAWD,aAAa4H;YAC9B,MAAMtG,SAASsG,IAAI,CAAC,SAAS;YAC7B,IACE3H,YACArC,oBAAoBkE,GAAG,CAAC7B,aACxBqB,CAAAA,0BAAAA,OAAQ/C,IAAI,MAAK,gBAChBhB,CAAAA,aAAauE,GAAG,CAACR,MAAM,CAAC,OAAO,KAC9B0J,QAAQlJ,GAAG,CAACR,MAAM,CAAC,OAAO,CAAU,GACtC;gBACA,OAAOrB;YACT;QACF;QACA,OAAO;IACT;IACA,MAAMyL,oBAAoB,CACxBjJ,IACAmF;QAEA,IAAI,CAACnF,IAAI;QACT,IAAIA,GAAGlE,IAAI,KAAK,cAAc;YAC5B,MAAMoN,WAAWF,aAAa7D;YAC9B,IAAI+D,UAAUH,gBAAgB5H,GAAG,CAACnB,EAAE,CAAC,OAAO,EAAYkJ;YACxD;QACF;QACA,wEAAwE;QACxE,IAAIlJ,GAAGlE,IAAI,KAAK,mBAAmBqJ,MAAM;gBAMfnF;YALxB,MAAMmJ,aACJhE,KAAKrJ,IAAI,KAAK,gBACbhB,CAAAA,aAAauE,GAAG,CAAC8F,IAAI,CAAC,OAAO,KAC5BoD,QAAQlJ,GAAG,CAAC8F,IAAI,CAAC,OAAO,CAAU;YACtC,IAAI,CAACgE,YAAY;YACjB,KAAK,MAAM3L,aAAawC,iBAAAA,EAAE,CAAC,aAAa,YAAhBA,iBAAoB,EAAE,CAAgB;gBAC5D,MAAMnE,MAAM2B,QAAQ,CAAC,MAAM;gBAC3B,MAAMjB,QAAQiB,QAAQ,CAAC,QAAQ;gBAC/B,MAAMsB,OACJjD,CAAAA,uBAAAA,IAAKC,IAAI,MAAK,eAAgBD,GAAG,CAAC,OAAO,GAAce,aAAaf;gBACtE,IACEiD,QACA3D,oBAAoBkE,GAAG,CAACP,SACxBvC,CAAAA,yBAAAA,MAAOT,IAAI,MAAK,cAChB;oBACAiN,gBAAgB5H,GAAG,CAAC5E,KAAK,CAAC,OAAO,EAAYuC;gBAC/C;YACF;QACF;IACF;IAEA,2EAA2E;IAC3E,uEAAuE;IACvE/C,KAAKsC,SAAS,CAACzC;QACb,IAAIA,KAAKE,IAAI,KAAK,sBAAsB;YACtC,MAAMkE,KAAKpE,IAAI,CAAC,KAAK;YACrB,IAAIoE,CAAAA,sBAAAA,GAAIlE,IAAI,MAAK,cACf0M,UAAUxI,EAAE,CAAC,OAAO,EAAEpE,IAAI,CAAC,OAAO;QACtC,OAAO,IACLA,KAAKE,IAAI,KAAK,0BACdF,IAAI,CAAC,WAAW,KAAK,KACrB;YACA,MAAMyB,OAAOzB,IAAI,CAAC,OAAO;YACzB,IAAIyB,CAAAA,wBAAAA,KAAMvB,IAAI,MAAK,cACjB0M,UAAUnL,IAAI,CAAC,OAAO,EAAEzB,IAAI,CAAC,QAAQ;QACzC;IACF;IACAG,KAAKsC,SAAS,CAACzC;QACb,IAAIA,KAAKE,IAAI,KAAK,sBAAsB;YACtCmN,kBAAkBrN,IAAI,CAAC,KAAK,EAAaA,IAAI,CAAC,OAAO;QACvD,OAAO,IACLA,KAAKE,IAAI,KAAK,0BACdF,IAAI,CAAC,WAAW,KAAK,KACrB;YACAqN,kBAAkBrN,IAAI,CAAC,OAAO,EAAaA,IAAI,CAAC,QAAQ;QAC1D;IACF;IAEA,MAAMyI,cAAc,CAACzI,OACnB,CAAC,CAACA,QACFA,KAAKE,IAAI,KAAK,gBACbhB,CAAAA,aAAauE,GAAG,CAACzD,IAAI,CAAC,OAAO,KAC5B2M,QAAQlJ,GAAG,CAACzD,IAAI,CAAC,OAAO,CAAU;IAEtC,MAAMiF,WAAWJ,2BAAAA,QAAS2I,eAAe;IACzC,MAAMC,YAAY,IAAItO,IACpB,CAAC8F,mBAAAA,WAAY,EAAE,EAAEoB,GAAG,CAAC,CAACnE;QACpB,IAAI;YACF,OAAO,IAAIH,IAAIG,QAAQA,MAAM;QAC/B,EAAE,eAAM;YACN,OAAOA;QACT;IACF;IAEF,KAAK,MAAMkJ,WAAWxE,yBAAyB3B,mBAAAA,WAAY,EAAE,EAAG;QAC9DrB,IAAI,WAAW,WAAWwH;IAC5B;IACA,8EAA8E,GAC9E,MAAMsC,eAA4CzI,WAC9C,UACA;IACJ,0EAA0E;IAC1E,wEAAwE;IACxE,oCAAoC;IACpC,MAAM0I,cAAc,IAAIxO;IACxB,MAAMyO,iBAAiB,IAAIzO;IAC3B,IAAI0O,cAAc;IAClB,yEAAyE,GACzE,MAAMC,oBAAoB,IAAI3O;IAC9B,MAAM4O,cAAc,CAACC,KAAaC;QAChC,MAAM/L,SAASL,cAAcoM,QAAQhN;QACrC0M,YAAY/J,GAAG,CAACoK;QAChB,IAAI9L,QAAQ0L,eAAehK,GAAG,CAAC1B;aAC1B2L,eAAe;QACpB,IAAI,CAAC5I,UAAU;YACbrB,IACE,WACA,WACA,CAAC,4BAA4B,EAAEoK,IAAI,2BAA2B,CAAC,GAC7D;YAEJ;QACF;QACA,IAAI,CAACP,UAAUtP,IAAI,EAAE;YACnByF,IACE8J,cACA,WACA,CAAC,aAAa,EAAEM,IAAI,sCAAsC,CAAC,GACzD,kEACA;YAEJ;QACF;QACA,IAAI,CAAC9L,QAAQ;YACX0B,IACE,WACA,WACA,GAAGoK,IAAI,yDAAyD,CAAC,GAC/D;YAEJ;QACF;QACA,IAAI,CAACP,UAAUhK,GAAG,CAACvB,SAAS;YAC1B0B,IACE8J,cACA,WACA,GAAGM,IAAI,OAAO,EAAE9L,OAAO,sCAAsC,CAAC,GAC5D,CAAC,WAAW,EAAE;mBAAIuL;aAAU,CAAC/I,IAAI,CAAC,MAAM,CAAC,CAAC;QAEhD;IACF;IAEA;;;;;;;;;GASC,GACD,MAAMwJ,oBAAoB,CACxBhL,MACA+K;QAEA,IAAI/K,QAAQ1D,qBAAqBiE,GAAG,CAACP,OAAO;QAC5C,MAAMhB,SAASL,cAAcoM,QAAQhN;QACrC,IAAI,CAACiB,QAAQ;QACb,yEAAyE;QACzE,kDAAkD;QAClD,IAAIuL,UAAUhK,GAAG,CAACvB,SAAS;QAC3B4L,kBAAkBlK,GAAG,CAAC1B;QACtB0B,IACE,WACA,WACA,GAAGV,OAAO,GAAGA,KAAK,EAAE,CAAC,GAAG,SAAS,WAAW,EAAEhB,OAAO,YAAY,CAAC,GAChE,uEACA;IAEN;IAEA,IAAIiM,kBAAkB;IACtB,IAAIC,qBAAqB;IACzB,MAAMC,aAAa,CAACnL;QAClB,IAAIA,SAAS,YAAYiL,kBAAkB;aACtC,IAAIjL,SAAS,eAAekL,qBAAqB;IACxD;IAEA,IAAIE,kBAAkB;IAEtBnO,KAAKsC,SAAS,CAACzC;QACb,OAAQA,KAAKE,IAAI;YACf,6CAA6C;YAC7C,KAAK;gBACH0D,IACE,SACA,kBACA,sEACE,sEACA;gBAEJ;YACF,KAAK;YACL,KAAK;gBAA0B;wBAmBJ5D;oBAlBzB,IAAIA,IAAI,CAAC,SAAS,EAAE;wBAClB4D,IACE,SACA,kBACA,mEACE;oBAEN;oBACA,MAAMoF,cAAchJ,IAAI,CAAC,cAAc;oBACvC,IAAIgJ,aAAa;4BAGWA;wBAF1B,IAAIA,WAAW,CAAC,KAAK,EACnBqF,WAAW,AAACrF,WAAW,CAAC,KAAK,AAAY,CAAC,OAAO;wBACnD,KAAK,MAAMnB,eAAemB,4BAAAA,WAAW,CAAC,eAAe,YAA3BA,4BACxB,EAAE,CAAgB;4BAClB,MAAM5E,KAAKyD,UAAU,CAAC,KAAK;4BAC3B,IAAIzD,CAAAA,sBAAAA,GAAIlE,IAAI,MAAK,cAAcmO,WAAWjK,EAAE,CAAC,OAAO;wBACtD;oBACF;oBACA,KAAK,MAAMmK,cAAcvO,mBAAAA,IAAI,CAAC,aAAa,YAAlBA,mBAAsB,EAAE,CAAgB;wBAC/D,MAAMwO,WAAWD,SAAS,CAAC,WAAW;wBACtCF,WACEG,CAAAA,4BAAAA,SAAUtO,IAAI,MAAK,eACfsO,QAAQ,CAAC,OAAO,GAChBxN,aAAawN;oBAErB;oBACA;gBACF;YAEA,2BAA2B;YAC3B,KAAK;gBAAoB;oBACvB,MAAMD,YAAYvN,aAAahB,IAAI,CAAC,SAAS,EAAaiB;oBAC1D,IAAIsN,cAAc,MAAM;wBACtB3K,IACE,SACA,kBACA,gEACE;oBAEN,OAAO,IAAI,YAAY5B,IAAI,CAACuM,YAAY;wBACtC3K,IACE,SACA,kBACA;oBAEJ;oBACA;gBACF;YAEA,kBAAkB;YAClB,KAAK;YACL,KAAK;gBAAiB;wBAEN5D,iBAUZ,MAACyO;oBAXH,MAAMjL,SAASxD,IAAI,CAAC,SAAS;oBAC7B,MAAM0D,QAAQ1D,kBAAAA,IAAI,CAAC,YAAY,YAAjBA,kBAAqB,EAAE;oBACrC,MAAMyO,UACJjL,CAAAA,0BAAAA,OAAQtD,IAAI,MAAK,eACZsD,MAAM,CAAC,OAAO,GACfA,CAAAA,0BAAAA,OAAQtD,IAAI,MAAK,qBACfyB,aAAa6B,QAAQvC,aACrB;oBACR,kEAAkE;oBAClE,2CAA2C;oBAC3C,MAAMiC,QACJ,QAACuL,QAAAA,WAAWtB,gBAAgBjM,GAAG,CAACuN,oBAA/BA,QAA4CA,mBAA7C,OAAwD;oBAE1D,IAAIvL,SAAS,QACXU,IAAI,SAAS,kBAAkB;oBACjC,IAAIV,SAAS,YACXU,IACE,SACA,kBACA;oBAEJ,kEAAkE;oBAClE,mEAAmE;oBACnE,2CAA2C;oBAC3C,IAAIV,SAAS,iBAAiBM,CAAAA,0BAAAA,OAAQtD,IAAI,MAAK,oBAC7C0D,IACE,SACA,kBACA,4DACE;oBAEN,IAAIV,QAAQ7D,cAAcoE,GAAG,CAACP,OAAO6K,YAAY7K,MAAMQ,IAAI,CAAC,EAAE;yBACzD,IAAIR,QAAQ5D,qBAAqBmE,GAAG,CAACP,OACxC6K,YAAY7K,MAAMlD,KAAKE,IAAI,KAAK,kBAAkBwD,IAAI,CAAC,EAAE,GAAGA,IAAI,CAAC,EAAE;yBAIhEwK,kBAAkBhL,MAAMQ,IAAI,CAAC,EAAE;oBACpC;gBACF;YAEA,0BAA0B;YAC1B,KAAK;gBAAoB;oBACvB,MAAMT,SAASjD,IAAI,CAAC,SAAS;oBAC7B,MAAMkD,OAAOvB,aAAa3B,MAAMiB;oBAChC,IAAIwH,YAAYxF,WAAWC,SAAS,MAAM;wBACxCU,IACE,SACA,WACA,CAAC,4BAA4B,EAC3B,AAACX,MAAM,CAAC,OAAO,IAAe,WAC/B,yDAAyD,CAAC,GACzD;wBAEJ;oBACF;oBACA,mEAAmE;oBACnE,uDAAuD;oBACvD,IAAIC,SAAS,YAAYuF,YAAYxF,SACnCW,IAAI,SAAS,WAAW;oBAC1B,IAAIV,QAAQ9D,cAAcqE,GAAG,CAACP,SAASuF,YAAYxF,SACjDW,IACE,SACA,WACA;oBAEJ,IAAIV,SAAS,UAAUuF,YAAYxF,SACjCW,IAAI,SAAS,kBAAkB;oBACjC;gBACF;YAEA,4BAA4B;YAC5B,KAAK;gBAAc;oBACjB,MAAMV,OAAOlD,IAAI,CAAC,OAAO;oBACzB,IAAIZ,cAAcqE,GAAG,CAACP,OACpBU,IACE,SACA,WACA;oBAEJ,IAAI/D,gBAAgBmC,IAAI,CAACkB,OAAOoL,mBAAmB;oBACnD;gBACF;YAEA,wBAAwB;YACxB,KAAK;gBAAW;oBACd,MAAM3N,QAAQX,IAAI,CAAC,QAAQ;oBAC3B,IACE,OAAOW,UAAU,YACjBA,MAAMJ,MAAM,IAAIb,yBAChBI,YAAYkC,IAAI,CAACrB,QACjB;wBACAiD,IACE,WACA,eACA,CAAC,gBAAgB,EAAEjD,MAAMJ,MAAM,CAAC,4BAA4B,CAAC,GAC3D;oBAEN;oBACA;gBACF;YACA;gBACE;QACJ;IACF;IAEA,IAAI,CAAC4N,mBAAmB,CAACC,oBAAoB;QAC3CxK,IACE,SACA,SACA,+DACE;IAEN;IAEA,IAAI0K,mBAAmB3O,sBAAsB;QAC3CiE,IACE,WACA,eACA,CAAC,YAAY,EAAE0K,gBAAgB,gCAAgC,CAAC,GAC9D;IAEN;IACA,MAAMI,cAAc5D,OACjB6D,KAAK,CAAC,MACNC,MAAM,CAAC,CAACC,SAASC,OAASC,KAAKC,GAAG,CAACH,SAASC,KAAKvO,MAAM,GAAG;IAC7D,IAAImO,cAAcjP,mBAAmB;QACnCmE,IACE,WACA,eACA,CAAC,oBAAoB,EAAE8K,YAAY,gCAAgC,CAAC,GAClE;IAEN;IAEA5J,QAAQS,GAAG,CACT,SACA;QACE4I,kBAAkB,mBAAmB;QACrCC,qBAAqB,kBAAkB;KACxC,CACEa,MAAM,CAAC7J,SACPV,IAAI,CAAC,SAAS;IAGnB,uEAAuE;IACvE,0EAA0E;IAC1E,sDAAsD;IACtD,IAAI,CAACO,UAAU;QACb,IAAI0I,YAAYxP,IAAI,EAAE;YACpB8M,OAAO1F,GAAG,CAAC,WAAW;YACtBT,QAAQS,GAAG,CACT,WACA,CAAC,MAAM,EAAE;mBAAIoI;aAAY,CAACjJ,IAAI,CAAC,MAAM,4BAA4B,CAAC,GAChE;QAEN,OAAO;YACLI,QAAQS,GAAG,CAAC,WAAW;QACzB;IACF,OAAO,IAAI,CAACoI,YAAYxP,IAAI,EAAE;QAC5B2G,QAAQS,GAAG,CACT,WACAuI,kBAAkB3P,IAAI,GAClB,CAAC,+BAA+B,EAAE;eAAI2P;SAAkB,CAACpJ,IAAI,CAAC,MAAM,CAAC,CAAC,GACpE,qDACF;IAER,OAAO;QACL,MAAMwK,UAAUtB,eAAezP,IAAI,GAC/B;eAAIyP;SAAe,CAChBvH,GAAG,CAAC,CAACnE,SACJuL,UAAUhK,GAAG,CAACvB,UAAU,GAAGA,OAAO,WAAW,CAAC,GAAG,GAAGA,OAAO,eAAe,CAAC,EAE5EwC,IAAI,CAAC,QACR;QACJI,QAAQS,GAAG,CACT,WACA;YACE,CAAC,MAAM,EAAE;mBAAIoI;aAAY,CAACjJ,IAAI,CAAC,OAAO;YACtCwK;YACArB,cACI,GAAGA,YAAY,yCAAyC,CAAC,GACzD;SACL,CACEoB,MAAM,CAAC7J,SACPV,IAAI,CAAC;IAEZ;IAEA,MAAMyK,MAAM3G,aAAa/F,SAASxB,WAAWwH;IAC7C,KAAK,MAAMxI,OAAOkP,IAAIpF,OAAO,CAAE;QAC7BnG,IACE,SACA,YACA,CAAC,cAAc,EAAE3D,IAAI,qCAAqC,CAAC,GACzD,GAAGpC,qBAAqB6G,IAAI,CAAC,MAAM,sCAAsC,CAAC;IAEhF;IACA,KAAK,MAAMzE,OAAOkP,IAAInF,cAAc,CAAE;QACpCpG,IACE,WACA,YACA,CAAC,kBAAkB,EAAE3D,IAAI,8CAA8C,CAAC,GACtE,GAAGpC,qBAAqB6G,IAAI,CAAC,MAAM,uBAAuB,CAAC;IAEjE;IACA,IAAIyK,IAAIjF,eAAe,EAAE;QACvBtG,IACE,WACA,YACA,CAAC,8DAA8D,CAAC,GAC9D,CAAC,CAAC,EAAEuL,IAAIjF,eAAe,CAAC,EAAE,CAAC;IAEjC;IACA,IAAIiF,IAAIlF,QAAQ,EAAE;QAChBrG,IACE,SACA,YACA,CAAC,kDAAkD,EAAEuL,IAAIlF,QAAQ,CAAC,KAAK,CAAC,GACtE;IAEN;IACA,2EAA2E;IAC3E,uEAAuE;IACvE,KAAK,MAAMhK,OAAOlC,wBAAyB;QACzC,MAAM+L,OAAOqF,IAAIvE,OAAO,CAAC3K,IAAI;QAC7B,IAAI,CAAC6J,MAAM;QACX,MAAMsF,QAAQpR,wBAAwB,CAACiC,IAAI;QAC3C,IAAI6J,SAAS,KAAK;YAChB,IAAI7J,QAAQ,SAAS;gBACnB2D,IACE,WACA,YACA,oEACE,kEACA;YAEN;YACA;QACF;QACA,MAAM+B,UAAUmE,KAAKmF,MAAM,CAAC,CAAC/L,OAAS,CAACkM,MAAM3L,GAAG,CAACP;QACjD,IAAIyC,QAAQpF,MAAM,EAAE;YAClBqD,IACE,SACA,YACA,CAAC,MAAM,EAAE+B,QAAQjB,IAAI,CAAC,MAAM,iBAAiB,EAAEzE,IAAI,iBAAiB,CAAC,GACnE,CAAC,KAAK,EAAE0F,QAAQpF,MAAM,KAAK,IAAI,OAAO,QAAQ,GAC7CN,CAAAA,QAAQ,UACL,oEACA,EAAC;QAEX;IACF;IACA6E,QAAQS,GAAG,CACT,YACA4J,IAAIrF,IAAI,CAAC3L,IAAI,GAAG,CAAC,MAAM,EAAE;WAAIgR,IAAIrF,IAAI;KAAC,CAACxF,IAAI,GAAGI,IAAI,CAAC,OAAO,GAAG;IAG/D,MAAME,WAAWpC,oBAAoBC,SAASxB;IAC9C,KAAK,MAAMmK,WAAWlF,mBAAmBzD,SAASxB,WAAY;QAC5D2C,IAAI,WAAW,eAAewH;IAChC;IACAzG,qBAAqBC,UAAUC,SAASjB,KAAKkB,SAAS,CAACqG,QACrDF,OAAO1F,GAAG,CAAC4F,OAAO;IAGpB,OAAO;QACLY,IAAI,CAAChB,SAAStB,IAAI,CAAC,CAAC4F,UAAYA,QAAQnE,KAAK,KAAK;QAClDH;QACAiB,QAAQT;QACRU,SAAS;YAAEC,UAAUiC;YAAiBhC,aAAaiC;QAAmB;QACtE5P,eAAeoG;IACjB;AACF;AAEA;;;;;;;;CAQC,GACD,OAAO,SAAS0K,kBACdxE,MAAc,EACdjG,OAAsB;IAEtB,IAAI;QACF,OAAOgG,cAAcC,QAAQjG;IAC/B,EAAE,OAAO4H,OAAO;QACd,OAAO;YACLV,IAAI;YACJhB,UAAU;gBACR;oBACEG,OAAO;oBACPC,OAAO;oBACPC,SACE,oEACA,CAAC,WAAW,EACVqB,iBAAiBC,QAAQD,MAAMrB,OAAO,GAAG7E,OAAOkG,QAChD;gBACN;aACD;YACDT,QAAQtN,YAAY2H,GAAG,CAAC,CAACjC,KAAQ,CAAA;oBAC/BA;oBACAwB,OAAO3H,YAAY,CAACmG,GAAG;oBACvB6G,QAAQ7G,OAAO,UAAU,SAAS;gBACpC,CAAA;YACA6H,SAAS;gBAAEC,UAAU;gBAAOC,aAAa;YAAM;YAC/C3N,eAAe2D;QACjB;IACF;AACF"}