@aglyn/shared-util-email 1.0.0-beta.218 → 1.0.0-beta.220

package/src/lib/hosted-page-screen.js

@@ -22,7 +22,7 @@
  * host one, and the incident's sibling site published a page at the
  * document-share path `/reviewfile`.
  *
- * Three shapes, one per requirement:
+ * Five shapes:
  *
  * 1. **A lookalike link or embed** (`lookalike-link`, STRONG) — any `href`,
  *    `src`, form action or URL in the page's authored content whose host
@@ -40,13 +40,36 @@
  *    whose text names a brand that is not the workspace's AND asks the reader
  *    to sign in, verify, confirm or open a document, on a page that links
  *    somewhere that is neither the workspace's, nor a brand's own, nor a
- *    common social or maps link. The same element, not the same page: a
- *    hotel that says "find us on Booking.com" in one place and "sign in" in
- *    another is two ordinary sentences.
+ *    common social or maps link.
+ * 4. **A brand's lure, page-wide** (`brand-lure-page`, SOFT, AGL-3447) — the
+ *    same brand and link anywhere on the page, beside an account or
+ *    document-share LURE anywhere on it ("Secure Document Access Portal"), or
+ *    a call to action that leaves the site worded as an action ("Continue to
+ *    Document"). The 2026-10-01 phishing page put Proofpoint's name in its
+ *    body, the lure in its heading and the action on its button: three
+ *    elements, none of which shape 3 reads on its own. What it does not count page-wide is
+ *    a bare "sign in" that stays on the site — a hotel that says "find us on
+ *    Booking.com" in one place and has a member sign-in in another is two
+ *    ordinary sentences.
+ * 5. **A call to action that leaves, beside a lure** (`offsite-action-page`,
+ *    SOFT, AGL-3447) — the page's only call to action, or one worded as an
+ *    account or document action, sends visitors to a host that is not the
+ *    site's own, a listed brand's or a common link, on a page that carries an
+ *    account or document-share lure. No brand needed: a "Secure Document
+ *    Access Portal" whose one button leaves for the kit is the shape whatever
+ *    name it wears.
+ *
+ * Shapes 3-5 are soft, so they hold only for a workspace in its first
+ * fortnight (`signalsThatHold`); an established workspace's page is held by
+ * shapes 1 and 2 alone.
+ *
+ * The same reading applies to a site REDIRECT ({@link screenSiteRedirect}):
+ * a rule that sends a path off the site is a page whose one call to action
+ * fires on arrival, and its path is the only text it has.
  *
  * Pure: the caller hands over the composed node tree and the workspace's own
  * names and hosts, and decides what a hold does.
- *=========================================*/ import { isWorkspaceOwnBrand, linkHostsIn, isBrandsOwnDomain, lookalikeBrandForHost, PHISHING_LURE_PATTERNS, PHISHING_SCREEN_BRANDS, registrableDomain, isAnyOfficialBrandDomain, isCommonLinkDomain, squashScreenText } from "./outbound-phishing-screen.js";
+ *=========================================*/ import { ACCOUNT_LURE_PATTERNS, DOCUMENT_SHARE_LURE_PATTERNS, isWorkspaceOwnBrand, linkHostsIn, isBrandsOwnDomain, lookalikeBrandForHost, PHISHING_LURE_PATTERNS, PHISHING_SCREEN_BRANDS, registrableDomain, isAnyOfficialBrandDomain, isCommonLinkDomain, squashScreenText, visibleTextOf } from "./outbound-phishing-screen.js";
 /** The most a page's text is read to, so a huge page costs a bounded scan. */ const MAX_PAGE_TEXT = 2000000;
 /** The most nodes the walk visits. */ const MAX_NODES = 20000;
 /** Props that describe a field the author defined, rather than content. */ const FIELD_PROP_KEYS = [
@@ -98,16 +121,39 @@
 ];
 /**
  * What an element asks its reader to DO with an account or a document —
- * counted only beside a brand in the SAME element. The email lure phrasing
- * counts too.
+ * counted beside a brand in the SAME element, or on a call to action that
+ * leaves the site. The email lure phrasing counts too.
  */ const PAGE_ACTION_PATTERNS = [
     /\b(?:sign|log)[\s-]?in\b/i,
     /\bverify\b/i,
     /\bconfirm\s+(?:your|the)\b/i,
     /\bunlock\b/i,
     /\benter\s+your\b/i,
-    /\b(?:view|review|open|download)\s+(?:the\s+|your\s+)?(?:shared\s+)?(?:file|document|invoice|statement)s?\b/i
+    /\b(?:view|review|open|download|access)\s+(?:the\s+|your\s+)?(?:shared\s+|secure\s+)?(?:file|document|invoice|statement)s?\b/i,
+    /\b(?:continue|proceed)\s+to\s+(?:the\s+|your\s+)?(?:document|file|account|sign[\s-]?in|log[\s-]?in)s?\b/i
 ];
+/**
+ * The lures a page is read for as a WHOLE (AGL-3447): account and
+ * document-share wording. Not the marketplace, booking and parcel lures,
+ * which a hotel's "guest reviews" and a shop's delivery page carry every day
+ * and which still count in one element beside a brand.
+ */ const PAGE_LURE_PATTERNS = [
+    ...ACCOUNT_LURE_PATTERNS,
+    ...DOCUMENT_SHARE_LURE_PATTERNS
+];
+/**
+ * A component that renders a call to action — a button or a link, however a
+ * plugin names it (`muiButton`, `muiScreenLink`, `muiLinkBox`). It is one
+ * when it carries a target: an `href`, or a `screenId` on the site itself.
+ */ const CALL_TO_ACTION_COMPONENT = /button|fab|cta|link/i;
+/** The props a call to action's visible words live in; the first found wins. */ const CALL_TO_ACTION_LABEL_KEYS = [
+    'children',
+    'label',
+    'text',
+    'title',
+    'html'
+];
+/** URLs in page text, so prose is read for a brand or a lure without them. */ const PROSE_URL_PATTERN = /(?:https?:)?\/\/[^\s"'<>]+|\bwww\.[^\s"'<>]+/gi;
 /** Every node in the tree, breadth-first in document order, bounded. */ function walkNodes(root) {
     const found = [];
     const seen = new Set();
@@ -275,29 +321,27 @@
             }
         }
     });
-    // 3. A brand's call to action, in one element, on a page that links away.
-    const foreign = linkHosts.find((host)=>{
+    const isElsewhere = (host)=>{
         if (isOwnHost(host)) return false;
         const registrable = registrableDomain(host);
         return !isAnyOfficialBrandDomain(registrable) && !isCommonLinkDomain(registrable);
-    });
+    };
+    const foreign = linkHosts.find(isElsewhere);
+    const actions = [
+        ...PAGE_ACTION_PATTERNS,
+        ...PHISHING_LURE_PATTERNS
+    ];
+    const named = new Set();
+    const isOthersBrand = (brand)=>!named.has(brand.id) && !isWorkspaceOwnBrand(brand, ownNames, ownRegistrables);
+    // 3. A brand's call to action, in one element, on a page that links away.
     if (foreign) {
-        const actions = [
-            ...PAGE_ACTION_PATTERNS,
-            ...PHISHING_LURE_PATTERNS
-        ];
-        const named = new Set();
         for (const strings of nodeStrings){
-            const text = strings.join(' ');
+            const text = proseOf(strings.join(' '));
             if (!text) continue;
-            const action = actions.map((pattern)=>{
-                var _text_match;
-                return (_text_match = text.match(pattern)) == null ? void 0 : _text_match[0];
-            }).find(Boolean);
+            const action = firstMatch(actions, text);
             if (!action) continue;
             for (const brand of PHISHING_SCREEN_BRANDS){
-                if (named.has(brand.id)) continue;
-                if (brand.mention.test(text) && !isWorkspaceOwnBrand(brand, ownNames, ownRegistrables)) {
+                if (isOthersBrand(brand) && brand.mention.test(text)) {
                     named.add(brand.id);
                     signals.push({
                         code: 'brand-action-page',
@@ -308,9 +352,170 @@
             }
         }
     }
+    const prose = proseOf(pageText);
+    const pageLure = firstMatch(PAGE_LURE_PATTERNS, prose);
+    const ctas = callsToAction(nodes);
+    const leaving = ctas.filter((cta)=>Boolean(cta.host && isElsewhere(cta.host)));
+    const wordedLeaving = leaving.find((cta)=>firstMatch(actions, cta.label));
+    // 4. A brand's lure, read over the page as a whole, on a page that links away.
+    const brandLure = pageLure != null ? pageLure : wordedLeaving ? firstMatch(actions, wordedLeaving.label) : undefined;
+    if (foreign && brandLure) {
+        var _ref;
+        var _this;
+        const host = (_ref = (_this = wordedLeaving != null ? wordedLeaving : leaving[0]) == null ? void 0 : _this.host) != null ? _ref : foreign;
+        for (const brand of PHISHING_SCREEN_BRANDS){
+            if (isOthersBrand(brand) && brand.mention.test(prose)) {
+                named.add(brand.id);
+                signals.push({
+                    code: 'brand-lure-page',
+                    brand: brand.id,
+                    lure: brandLure.slice(0, 120),
+                    host
+                });
+            }
+        }
+    }
+    // 5. The page's call to action leaves the site, beside a lure. Its only
+    //    one, or the one worded as an account or document action.
+    const primary = wordedLeaving != null ? wordedLeaving : ctas.length === 1 ? leaving[0] : undefined;
+    if (primary && pageLure) {
+        signals.push({
+            code: 'offsite-action-page',
+            action: (primary.label || primary.host).slice(0, 80),
+            lure: pageLure.slice(0, 120),
+            host: primary.host
+        });
+    }
     return {
         signals
     };
 }
+/**
+ * What a visitor reads in page text: its markup taken out the way the email
+ * screen takes it out ({@link visibleTextOf}), so a custom HTML block or a
+ * rich-text prop cannot split a brand or a lure letter by letter with tags
+ * (AGL-3453), and its bare URLs taken out too. Links are still read from
+ * the raw text, where an href lives.
+ */ function proseOf(text) {
+    return visibleTextOf(text).replace(PROSE_URL_PATTERN, ' ').replace(/\s+/g, ' ').trim();
+}
+/** The first pattern's match in the text, or undefined. */ function firstMatch(patterns, text) {
+    if (!text) return undefined;
+    for (const pattern of patterns){
+        var _text_match;
+        const found = (_text_match = text.match(pattern)) == null ? void 0 : _text_match[0];
+        if (found) return found;
+    }
+    return undefined;
+}
+/** The words a call to action shows, from its label prop, markup taken out. */ function callToActionLabel(props) {
+    for (const key of CALL_TO_ACTION_LABEL_KEYS){
+        const value = props[key];
+        if (typeof value === 'string' && value.trim()) {
+            return visibleTextOf(value).split('\n')[0];
+        }
+    }
+    return '';
+}
+/**
+ * Every call to action on the page: each button or link that carries a
+ * target. A `screenId` is a page of the site and takes precedence over an
+ * `href`, as the button renders it; a relative, `mailto:` or `tel:` href has
+ * no web host and stays too.
+ */ function callsToAction(nodes) {
+    const found = [];
+    for (const node of nodes){
+        var _linkHostsIn_;
+        if (!CALL_TO_ACTION_COMPONENT.test(node.componentId)) continue;
+        const screenId = typeof node.props['screenId'] === 'string' ? node.props['screenId'].trim() : '';
+        const href = typeof node.props['href'] === 'string' ? node.props['href'].trim() : '';
+        if (!screenId && !href) continue;
+        const absolute = href.startsWith('//') ? `https:${href}` : href;
+        found.push({
+            label: callToActionLabel(node.props),
+            host: screenId ? null : (_linkHostsIn_ = linkHostsIn(absolute)[0]) != null ? _linkHostsIn_ : null
+        });
+    }
+    return found;
+}
+/**
+ * Screen one site redirect (AGL-3447): a rule that sends a path off the site
+ * is a call to action that fires on arrival, so it is read with the page's
+ * rules over the one text it has, its path.
+ *
+ * - `lookalike-link` (STRONG) — the destination wears a brand it is not.
+ * - `offsite-redirect` (SOFT) — the destination is not the site's own, a
+ *   listed brand's or a common link, and the path reads as an account or
+ *   document-share lure (`/secure-document-access`).
+ * - `brand-lure-link` (SOFT) — the same, and the path names a brand that is
+ *   not the workspace's (`/paypal-verify-your-account`), the email screen's
+ *   three-part lure.
+ *
+ * The caller applies the tiers with `signalsThatHold`, with the workspace's
+ * age, and decides what a hold does.
+ */ export function screenSiteRedirect(input) {
+    var _input_destination, _input_ownNames, _input_ownDomains, _input_source;
+    const signals = [];
+    const destination = String((_input_destination = input.destination) != null ? _input_destination : '').trim();
+    const hosts = linkHostsIn(destination.startsWith('//') ? `https:${destination}` : destination);
+    if (!hosts.length) return {
+        signals
+    };
+    const ownNames = squashScreenText(((_input_ownNames = input.ownNames) != null ? _input_ownNames : []).filter(Boolean).join(' '));
+    const ownHosts = ((_input_ownDomains = input.ownDomains) != null ? _input_ownDomains : []).map((domain)=>String(domain != null ? domain : '').trim().toLowerCase().replace(/\.+$/, '')).filter((domain)=>domain.includes('.'));
+    const ownRegistrables = new Set(ownHosts.map(registrableDomain));
+    for (const host of hosts){
+        const brand = lookalikeBrandForHost(host);
+        if (brand && !isBrandsOwnDomain(brand, ownRegistrables)) {
+            signals.push({
+                code: 'lookalike-link',
+                brand: brand.id,
+                host
+            });
+        }
+    }
+    // The first host is where the browser goes; the rest is a userinfo disguise.
+    const host = hosts[0];
+    const registrable = registrableDomain(host);
+    const leaves = !ownHosts.some((own)=>host === own || host.endsWith(`.${own}`)) && !isAnyOfficialBrandDomain(registrable) && !isCommonLinkDomain(registrable);
+    if (!leaves) return {
+        signals
+    };
+    const source = String((_input_source = input.source) != null ? _input_source : '').trim();
+    const words = pathWords(source);
+    const lure = firstMatch(PAGE_LURE_PATTERNS, words);
+    if (lure) {
+        signals.push({
+            code: 'offsite-redirect',
+            source: source.slice(0, 120),
+            lure: lure.slice(0, 120),
+            host
+        });
+    }
+    const anyLure = lure != null ? lure : firstMatch(PHISHING_LURE_PATTERNS, words);
+    if (anyLure) {
+        const brand = PHISHING_SCREEN_BRANDS.find((candidate)=>candidate.mention.test(words) && !isWorkspaceOwnBrand(candidate, ownNames, ownRegistrables));
+        if (brand) {
+            signals.push({
+                code: 'brand-lure-link',
+                brand: brand.id,
+                lure: anyLure.slice(0, 120),
+                host
+            });
+        }
+    }
+    return {
+        signals
+    };
+}
+/** A path read as words: `/secure-document_access` → `secure document access`. */ function pathWords(path) {
+    let decoded = path;
+    try {
+        decoded = decodeURIComponent(path);
+    } catch (unused) {
+    // A malformed escape is read as typed.
+    }
+    return decoded.replace(/[^a-z0-9]+/gi, ' ').trim();
+}
 
 //# sourceMappingURL=hosted-page-screen.js.map

package/src/lib/hosted-page-screen.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/shared/util/email/src/lib/hosted-page-screen.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*==========================================\n * THE HOSTED PAGE SCREEN (AGL-3362).\n *\n * The outbound phishing screen, read over a PUBLISHED PAGE instead of an\n * email: the same brand list, the same lookalike logic, the same tiers\n * (`signalsThatHold`). A fraud actor who could not mail a lure could still\n * host one, and the incident's sibling site published a page at the\n * document-share path `/reviewfile`.\n *\n * Three shapes, one per requirement:\n *\n * 1. **A lookalike link or embed** (`lookalike-link`, STRONG) — any `href`,\n *    `src`, form action or URL in the page's authored content whose host\n *    wears a brand without being the brand's domain.\n * 2. **A credential field** (`credential-field`, STRONG) — a field the\n *    merchant AUTHORED that asks for a password, a card number or a\n *    one-time code: its type, its autocomplete token, or its label,\n *    placeholder or name. The platform's own sign-in, account and checkout\n *    elements render their inputs in code, not in stored props, so they are\n *    never read as a field here — which is exactly the sanctioned/unsanctioned\n *    line: what the platform collects through its own components is\n *    Aglyn's to protect, and what a page's author collects in a form of\n *    their own is not something a site may ask a stranger for.\n * 3. **A brand's call to action** (`brand-action-page`, SOFT) — one element\n *    whose text names a brand that is not the workspace's AND asks the reader\n *    to sign in, verify, confirm or open a document, on a page that links\n *    somewhere that is neither the workspace's, nor a brand's own, nor a\n *    common social or maps link. The same element, not the same page: a\n *    hotel that says \"find us on Booking.com\" in one place and \"sign in\" in\n *    another is two ordinary sentences.\n *\n * Pure: the caller hands over the composed node tree and the workspace's own\n * names and hosts, and decides what a hold does.\n *=========================================*/\n\nimport {\n  isWorkspaceOwnBrand,\n  linkHostsIn,\n  isBrandsOwnDomain,\n  lookalikeBrandForHost,\n  PHISHING_LURE_PATTERNS,\n  PHISHING_SCREEN_BRANDS,\n  type PhishingScreenSignal,\n  registrableDomain,\n  isAnyOfficialBrandDomain,\n  isCommonLinkDomain,\n  squashScreenText,\n} from './outbound-phishing-screen'\n\nexport interface HostedPageScreenInput {\n  /**\n   * The page as it will be served — the composed tree, or any object that\n   * holds nodes (`{ componentId, props }`) at any depth. Walked, never\n   * trusted to have one shape: a screen, a layout's chrome, a grafted\n   * component and a form all arrive together.\n   */\n  nodes: unknown\n  /** The workspace's own names, as `screenOutboundEmail` reads them. */\n  ownNames?: readonly (string | null | undefined)[]\n  /** The workspace's own hosts — a link to one is never \"elsewhere\". */\n  ownDomains?: readonly (string | null | undefined)[]\n}\n\nexport interface HostedPageScreenVerdict {\n  signals: PhishingScreenSignal[]\n}\n\n/** A node as the walk finds it. */\ninterface WalkedNode {\n  componentId: string\n  props: Record<string, unknown>\n}\n\n/** The most a page's text is read to, so a huge page costs a bounded scan. */\nconst MAX_PAGE_TEXT = 2_000_000\n/** The most nodes the walk visits. */\nconst MAX_NODES = 20_000\n\n/** Props that describe a field the author defined, rather than content. */\nconst FIELD_PROP_KEYS = ['fieldType', 'fieldName', 'inputType', 'autoComplete', 'autocomplete']\n\n/** Autocomplete tokens (WHATWG) that name a credential. */\nconst CREDENTIAL_AUTOCOMPLETE: Record<string, 'password' | 'card' | 'otp'> = {\n  'current-password': 'password',\n  'new-password': 'password',\n  'cc-number': 'card',\n  'cc-csc': 'card',\n  'cc-exp': 'card',\n  'one-time-code': 'otp',\n}\n\n/** Field wording that asks for a credential, by kind. */\nconst CREDENTIAL_LABELS: ReadonlyArray<{ field: 'password' | 'card' | 'otp'; pattern: RegExp }> = [\n  { field: 'password', pattern: /\\bpass\\s?(?:word|code|phrase)s?\\b|\\bpasswd\\b|\\bpin\\s*(?:code|number)?\\s*$/i },\n  {\n    field: 'card',\n    pattern:\n      /\\b(?:credit|debit)\\s*card\\b|\\bcard\\s*(?:number|no\\.?|#)|\\bcardnumber\\b|\\bcvv2?\\b|\\bcvc\\b|\\bcard\\s*security\\s*code\\b|\\bcard\\s*expir/i,\n  },\n  {\n    field: 'otp',\n    pattern:\n      /\\bone[-\\s]?time\\s*(?:pass\\s?code|password|code|pin)\\b|\\botp\\b|\\bverification\\s*code\\b|\\b2fa\\b|\\btwo[-\\s]?factor\\b|\\bauthenticat(?:ion|or)\\s*code\\b|\\bsms\\s*code\\b/i,\n  },\n]\n\n/** Raw HTML an author placed that holds a credential input. */\nconst HTML_CREDENTIAL_INPUTS: ReadonlyArray<{ field: 'password' | 'card' | 'otp'; pattern: RegExp }> = [\n  { field: 'password', pattern: /<input\\b[^>]*\\btype\\s*=\\s*[\"']?password/i },\n  { field: 'password', pattern: /<input\\b[^>]*\\b(?:name|autocomplete)\\s*=\\s*[\"']?(?:pass(?:word|wd)?|current-password|new-password)\\b/i },\n  { field: 'card', pattern: /<input\\b[^>]*\\b(?:name|autocomplete)\\s*=\\s*[\"']?(?:card_?number|cc-number|cc-csc|cvv|cvc)\\b/i },\n  { field: 'otp', pattern: /<input\\b[^>]*\\b(?:name|autocomplete)\\s*=\\s*[\"']?(?:otp|one-time-code|verification_?code)\\b/i },\n]\n\n/**\n * What an element asks its reader to DO with an account or a document —\n * counted only beside a brand in the SAME element. The email lure phrasing\n * counts too.\n */\nconst PAGE_ACTION_PATTERNS: readonly RegExp[] = [\n  /\\b(?:sign|log)[\\s-]?in\\b/i,\n  /\\bverify\\b/i,\n  /\\bconfirm\\s+(?:your|the)\\b/i,\n  /\\bunlock\\b/i,\n  /\\benter\\s+your\\b/i,\n  /\\b(?:view|review|open|download)\\s+(?:the\\s+|your\\s+)?(?:shared\\s+)?(?:file|document|invoice|statement)s?\\b/i,\n]\n\n/** Every node in the tree, breadth-first in document order, bounded. */\nfunction walkNodes(root: unknown): WalkedNode[] {\n  const found: WalkedNode[] = []\n  const seen = new Set<unknown>()\n  const stack: unknown[] = [root]\n  for (let head = 0; head < stack.length && found.length < MAX_NODES; head += 1) {\n    const value = stack[head]\n    if (!value || typeof value !== 'object' || seen.has(value)) continue\n    seen.add(value)\n    const record = value as Record<string, unknown>\n    if (typeof record['componentId'] === 'string') {\n      const props = record['props']\n      found.push({\n        componentId: record['componentId'] as string,\n        props: props && typeof props === 'object' ? (props as Record<string, unknown>) : {},\n      })\n    }\n    for (const child of Array.isArray(value) ? value : Object.values(record)) {\n      if (child && typeof child === 'object') stack.push(child)\n    }\n  }\n  return found\n}\n\n/** Every string a node's props hold, one level of arrays and objects deep. */\nfunction propStrings(props: Record<string, unknown>, skip: ReadonlySet<string> = new Set()): string[] {\n  const out: string[] = []\n  const visit = (value: unknown, depth: number) => {\n    if (typeof value === 'string') out.push(value)\n    else if (depth < 3 && value && typeof value === 'object') {\n      for (const entry of Array.isArray(value) ? value : Object.values(value as Record<string, unknown>)) {\n        visit(entry, depth + 1)\n      }\n    }\n  }\n  for (const [key, value] of Object.entries(props)) {\n    if (key === 'sx' || skip.has(key)) continue\n    visit(value, 0)\n  }\n  return out\n}\n\n/** Does this node describe a field its author defined? */\nfunction isAuthoredField(node: WalkedNode): boolean {\n  if (/field|input/i.test(node.componentId)) return true\n  return FIELD_PROP_KEYS.some((key) => node.props[key] !== undefined)\n}\n\n/** The credential a field asks for, or null. */\nfunction credentialOf(node: WalkedNode): { field: 'password' | 'card' | 'otp'; label: string } | null {\n  const text = (key: string) => (typeof node.props[key] === 'string' ? (node.props[key] as string) : '')\n  const type = [text('fieldType'), text('type'), text('inputType')].join(' ').toLowerCase()\n  const label = text('label') || text('placeholder') || text('fieldName') || text('name')\n  if (/\\bpassword\\b/.test(type)) return { field: 'password', label: label || 'password' }\n  const autocomplete = (text('autoComplete') || text('autocomplete')).toLowerCase().trim()\n  const byToken = CREDENTIAL_AUTOCOMPLETE[autocomplete]\n  if (byToken) return { field: byToken, label: label || autocomplete }\n  const wording = [text('label'), text('placeholder'), text('fieldName'), text('name'), text('helperText')]\n    .filter(Boolean)\n    .join(' ')\n  for (const { field, pattern } of CREDENTIAL_LABELS) {\n    if (pattern.test(wording)) return { field, label: (label || wording).slice(0, 80) }\n  }\n  return null\n}\n\n/**\n * The credential an input asks for, read from the two attributes that decide\n * it in the browser — its `type` and its `autocomplete` token — or null.\n * For code that builds inputs rather than storing them as page props: the\n * marketplace verifier reads a plugin bundle's `{ type: 'password' }` and\n * `setAttribute('autocomplete', 'cc-number')` with this (AGL-3362).\n */\nexport function credentialForInputAttribute(\n  attribute: string,\n  value: string,\n): 'password' | 'card' | 'otp' | null {\n  const name = String(attribute ?? '').toLowerCase()\n  const token = String(value ?? '').trim().toLowerCase()\n  if ((name === 'type' || name === 'inputtype') && token === 'password') return 'password'\n  if (name === 'autocomplete') return CREDENTIAL_AUTOCOMPLETE[token] ?? null\n  return null\n}\n\n/** The credential a piece of raw HTML asks for in an input of its own, or null. */\nexport function credentialInHtml(html: string): 'password' | 'card' | 'otp' | null {\n  const text = String(html ?? '')\n  if (!text.includes('<')) return null\n  return HTML_CREDENTIAL_INPUTS.find(({ pattern }) => pattern.test(text))?.field ?? null\n}\n\n/**\n * Does a submitted field's NAME ask for a credential — a password, a card\n * number or security code, a one-time code? The same wording the page\n * screen holds a field for, read over a name as a form posts it\n * (`card_number`, `cardNumber`, `one-time-code`).\n *\n * For the one path that does not pass a publish: a public form endpoint\n * takes whatever field names a request carries, so a page the screen never\n * saw (third-party code, a hand-built request) could still post a password\n * to it. The endpoint drops such a field rather than store it.\n */\nexport function isCredentialFieldName(name: string): boolean {\n  const words = String(name ?? '')\n    .replace(/([a-z0-9])([A-Z])/g, '$1 $2')\n    .replace(/[_\\-.[\\]]+/g, ' ')\n    .trim()\n  if (!words) return false\n  if (CREDENTIAL_AUTOCOMPLETE[words.toLowerCase().replace(/\\s+/g, '-')]) return true\n  if (/^(?:pass|pwd|ccnum|cc\\s?num|cc\\s?number|cvv2?|cvc|csc)$/i.test(words)) return true\n  return CREDENTIAL_LABELS.some(({ pattern }) => pattern.test(words))\n}\n\n/** URLs a page carries in a form Links-by-shape would miss: `//host/…`. */\nfunction protocolRelativeUrls(strings: readonly string[]): string {\n  return strings\n    .filter((value) => /^\\/\\/[a-z0-9-]+(?:\\.[a-z0-9-]+)+/i.test(value.trim()))\n    .map((value) => `https:${value.trim()}`)\n    .join('\\n')\n}\n\n/**\n * Screen one page as it will be served. The caller applies the tiers with\n * `signalsThatHold` and decides what a hold does.\n */\nexport function screenHostedPage(input: HostedPageScreenInput): HostedPageScreenVerdict {\n  const signals: PhishingScreenSignal[] = []\n  const nodes = walkNodes(input.nodes)\n  const ownNames = squashScreenText((input.ownNames ?? []).filter(Boolean).join(' '))\n  const ownHosts = (input.ownDomains ?? [])\n    .map((domain) => String(domain ?? '').trim().toLowerCase().replace(/\\.+$/, ''))\n    .filter((domain) => domain.includes('.'))\n  const ownRegistrables = new Set(ownHosts.map(registrableDomain))\n  const isOwnHost = (host: string) => ownHosts.some((own) => host === own || host.endsWith(`.${own}`))\n\n  const nodeStrings = nodes.map((node) => propStrings(node.props))\n  let pageText = nodeStrings.map((strings) => strings.join('\\n')).join('\\n')\n  pageText = `${pageText}\\n${protocolRelativeUrls(nodeStrings.flat())}`.slice(0, MAX_PAGE_TEXT)\n\n  // 1. A lookalike host anywhere the page links, embeds or posts to.\n  const linkHosts = linkHostsIn(pageText)\n  for (const host of linkHosts) {\n    const brand = lookalikeBrandForHost(host)\n    if (brand && !isBrandsOwnDomain(brand, ownRegistrables)) {\n      signals.push({ code: 'lookalike-link', brand: brand.id, host })\n    }\n  }\n\n  // 2. A credential field the page's author defined.\n  const credentialSeen = new Set<string>()\n  const noteCredential = (field: 'password' | 'card' | 'otp', label: string) => {\n    if (credentialSeen.has(field)) return\n    credentialSeen.add(field)\n    signals.push({ code: 'credential-field', field, label: label.slice(0, 80) })\n  }\n  nodes.forEach((node, index) => {\n    if (isAuthoredField(node)) {\n      const credential = credentialOf(node)\n      if (credential) noteCredential(credential.field, credential.label)\n    }\n    for (const html of nodeStrings[index]) {\n      if (!html.includes('<')) continue\n      for (const { field, pattern } of HTML_CREDENTIAL_INPUTS) {\n        if (pattern.test(html)) noteCredential(field, 'an input in the page’s own HTML')\n      }\n    }\n  })\n\n  // 3. A brand's call to action, in one element, on a page that links away.\n  const foreign = linkHosts.find((host) => {\n    if (isOwnHost(host)) return false\n    const registrable = registrableDomain(host)\n    return !isAnyOfficialBrandDomain(registrable) && !isCommonLinkDomain(registrable)\n  })\n  if (foreign) {\n    const actions = [...PAGE_ACTION_PATTERNS, ...PHISHING_LURE_PATTERNS]\n    const named = new Set<string>()\n    for (const strings of nodeStrings) {\n      const text = strings.join(' ')\n      if (!text) continue\n      const action = actions.map((pattern) => text.match(pattern)?.[0]).find(Boolean)\n      if (!action) continue\n      for (const brand of PHISHING_SCREEN_BRANDS) {\n        if (named.has(brand.id)) continue\n        if (brand.mention.test(text) && !isWorkspaceOwnBrand(brand, ownNames, ownRegistrables)) {\n          named.add(brand.id)\n          signals.push({ code: 'brand-action-page', brand: brand.id, action: action.slice(0, 80) })\n        }\n      }\n    }\n  }\n\n  return { signals }\n}\n"],"names":["isWorkspaceOwnBrand","linkHostsIn","isBrandsOwnDomain","lookalikeBrandForHost","PHISHING_LURE_PATTERNS","PHISHING_SCREEN_BRANDS","registrableDomain","isAnyOfficialBrandDomain","isCommonLinkDomain","squashScreenText","MAX_PAGE_TEXT","MAX_NODES","FIELD_PROP_KEYS","CREDENTIAL_AUTOCOMPLETE","CREDENTIAL_LABELS","field","pattern","HTML_CREDENTIAL_INPUTS","PAGE_ACTION_PATTERNS","walkNodes","root","found","seen","Set","stack","head","length","value","has","add","record","props","push","componentId","child","Array","isArray","Object","values","propStrings","skip","out","visit","depth","entry","key","entries","isAuthoredField","node","test","some","undefined","credentialOf","text","type","join","toLowerCase","label","autocomplete","trim","byToken","wording","filter","Boolean","slice","credentialForInputAttribute","attribute","name","String","token","credentialInHtml","html","includes","find","isCredentialFieldName","words","replace","protocolRelativeUrls","strings","map","screenHostedPage","input","signals","nodes","ownNames","ownHosts","ownDomains","domain","ownRegistrables","isOwnHost","host","own","endsWith","nodeStrings","pageText","flat","linkHosts","brand","code","id","credentialSeen","noteCredential","forEach","index","credential","foreign","registrable","actions","named","action","match","mention"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2CAiC2C,GAE3C,SACEA,mBAAmB,EACnBC,WAAW,EACXC,iBAAiB,EACjBC,qBAAqB,EACrBC,sBAAsB,EACtBC,sBAAsB,EAEtBC,iBAAiB,EACjBC,wBAAwB,EACxBC,kBAAkB,EAClBC,gBAAgB,QACX,gCAA4B;AA0BnC,4EAA4E,GAC5E,MAAMC,gBAAgB;AACtB,oCAAoC,GACpC,MAAMC,YAAY;AAElB,yEAAyE,GACzE,MAAMC,kBAAkB;IAAC;IAAa;IAAa;IAAa;IAAgB;CAAe;AAE/F,yDAAyD,GACzD,MAAMC,0BAAuE;IAC3E,oBAAoB;IACpB,gBAAgB;IAChB,aAAa;IACb,UAAU;IACV,UAAU;IACV,iBAAiB;AACnB;AAEA,uDAAuD,GACvD,MAAMC,oBAA4F;IAChG;QAAEC,OAAO;QAAYC,SAAS;IAA6E;IAC3G;QACED,OAAO;QACPC,SACE;IACJ;IACA;QACED,OAAO;QACPC,SACE;IACJ;CACD;AAED,6DAA6D,GAC7D,MAAMC,yBAAiG;IACrG;QAAEF,OAAO;QAAYC,SAAS;IAA2C;IACzE;QAAED,OAAO;QAAYC,SAAS;IAAwG;IACtI;QAAED,OAAO;QAAQC,SAAS;IAA+F;IACzH;QAAED,OAAO;QAAOC,SAAS;IAA8F;CACxH;AAED;;;;CAIC,GACD,MAAME,uBAA0C;IAC9C;IACA;IACA;IACA;IACA;IACA;CACD;AAED,sEAAsE,GACtE,SAASC,UAAUC,IAAa;IAC9B,MAAMC,QAAsB,EAAE;IAC9B,MAAMC,OAAO,IAAIC;IACjB,MAAMC,QAAmB;QAACJ;KAAK;IAC/B,IAAK,IAAIK,OAAO,GAAGA,OAAOD,MAAME,MAAM,IAAIL,MAAMK,MAAM,GAAGf,WAAWc,QAAQ,EAAG;QAC7E,MAAME,QAAQH,KAAK,CAACC,KAAK;QACzB,IAAI,CAACE,SAAS,OAAOA,UAAU,YAAYL,KAAKM,GAAG,CAACD,QAAQ;QAC5DL,KAAKO,GAAG,CAACF;QACT,MAAMG,SAASH;QACf,IAAI,OAAOG,MAAM,CAAC,cAAc,KAAK,UAAU;YAC7C,MAAMC,QAAQD,MAAM,CAAC,QAAQ;YAC7BT,MAAMW,IAAI,CAAC;gBACTC,aAAaH,MAAM,CAAC,cAAc;gBAClCC,OAAOA,SAAS,OAAOA,UAAU,WAAYA,QAAoC,CAAC;YACpF;QACF;QACA,KAAK,MAAMG,SAASC,MAAMC,OAAO,CAACT,SAASA,QAAQU,OAAOC,MAAM,CAACR,QAAS;YACxE,IAAII,SAAS,OAAOA,UAAU,UAAUV,MAAMQ,IAAI,CAACE;QACrD;IACF;IACA,OAAOb;AACT;AAEA,4EAA4E,GAC5E,SAASkB,YAAYR,KAA8B,EAAES,OAA4B,IAAIjB,KAAK;IACxF,MAAMkB,MAAgB,EAAE;IACxB,MAAMC,QAAQ,CAACf,OAAgBgB;QAC7B,IAAI,OAAOhB,UAAU,UAAUc,IAAIT,IAAI,CAACL;aACnC,IAAIgB,QAAQ,KAAKhB,SAAS,OAAOA,UAAU,UAAU;YACxD,KAAK,MAAMiB,SAAST,MAAMC,OAAO,CAACT,SAASA,QAAQU,OAAOC,MAAM,CAACX,OAAmC;gBAClGe,MAAME,OAAOD,QAAQ;YACvB;QACF;IACF;IACA,KAAK,MAAM,CAACE,KAAKlB,MAAM,IAAIU,OAAOS,OAAO,CAACf,OAAQ;QAChD,IAAIc,QAAQ,QAAQL,KAAKZ,GAAG,CAACiB,MAAM;QACnCH,MAAMf,OAAO;IACf;IACA,OAAOc;AACT;AAEA,wDAAwD,GACxD,SAASM,gBAAgBC,IAAgB;IACvC,IAAI,eAAeC,IAAI,CAACD,KAAKf,WAAW,GAAG,OAAO;IAClD,OAAOrB,gBAAgBsC,IAAI,CAAC,CAACL,MAAQG,KAAKjB,KAAK,CAACc,IAAI,KAAKM;AAC3D;AAEA,8CAA8C,GAC9C,SAASC,aAAaJ,IAAgB;IACpC,MAAMK,OAAO,CAACR,MAAiB,OAAOG,KAAKjB,KAAK,CAACc,IAAI,KAAK,WAAYG,KAAKjB,KAAK,CAACc,IAAI,GAAc;IACnG,MAAMS,OAAO;QAACD,KAAK;QAAcA,KAAK;QAASA,KAAK;KAAa,CAACE,IAAI,CAAC,KAAKC,WAAW;IACvF,MAAMC,QAAQJ,KAAK,YAAYA,KAAK,kBAAkBA,KAAK,gBAAgBA,KAAK;IAChF,IAAI,eAAeJ,IAAI,CAACK,OAAO,OAAO;QAAEvC,OAAO;QAAY0C,OAAOA,SAAS;IAAW;IACtF,MAAMC,eAAe,AAACL,CAAAA,KAAK,mBAAmBA,KAAK,eAAc,EAAGG,WAAW,GAAGG,IAAI;IACtF,MAAMC,UAAU/C,uBAAuB,CAAC6C,aAAa;IACrD,IAAIE,SAAS,OAAO;QAAE7C,OAAO6C;QAASH,OAAOA,SAASC;IAAa;IACnE,MAAMG,UAAU;QAACR,KAAK;QAAUA,KAAK;QAAgBA,KAAK;QAAcA,KAAK;QAASA,KAAK;KAAc,CACtGS,MAAM,CAACC,SACPR,IAAI,CAAC;IACR,KAAK,MAAM,EAAExC,KAAK,EAAEC,OAAO,EAAE,IAAIF,kBAAmB;QAClD,IAAIE,QAAQiC,IAAI,CAACY,UAAU,OAAO;YAAE9C;YAAO0C,OAAO,AAACA,CAAAA,SAASI,OAAM,EAAGG,KAAK,CAAC,GAAG;QAAI;IACpF;IACA,OAAO;AACT;AAEA;;;;;;CAMC,GACD,OAAO,SAASC,4BACdC,SAAiB,EACjBvC,KAAa;QAKuBd;IAHpC,MAAMsD,OAAOC,OAAOF,oBAAAA,YAAa,IAAIV,WAAW;IAChD,MAAMa,QAAQD,OAAOzC,gBAAAA,QAAS,IAAIgC,IAAI,GAAGH,WAAW;IACpD,IAAI,AAACW,CAAAA,SAAS,UAAUA,SAAS,WAAU,KAAME,UAAU,YAAY,OAAO;IAC9E,IAAIF,SAAS,gBAAgB,QAAOtD,iCAAAA,uBAAuB,CAACwD,MAAM,YAA9BxD,iCAAkC;IACtE,OAAO;AACT;AAEA,iFAAiF,GACjF,OAAO,SAASyD,iBAAiBC,IAAY;;QAGpCtD;IAFP,MAAMoC,OAAOe,OAAOG,eAAAA,OAAQ;IAC5B,IAAI,CAAClB,KAAKmB,QAAQ,CAAC,MAAM,OAAO;IAChC,gBAAOvD,+BAAAA,uBAAuBwD,IAAI,CAAC,CAAC,EAAEzD,OAAO,EAAE,GAAKA,QAAQiC,IAAI,CAACI,2BAA1DpC,6BAAkEF,KAAK,mBAAI;AACpF;AAEA;;;;;;;;;;CAUC,GACD,OAAO,SAAS2D,sBAAsBP,IAAY;IAChD,MAAMQ,QAAQP,OAAOD,eAAAA,OAAQ,IAC1BS,OAAO,CAAC,sBAAsB,SAC9BA,OAAO,CAAC,eAAe,KACvBjB,IAAI;IACP,IAAI,CAACgB,OAAO,OAAO;IACnB,IAAI9D,uBAAuB,CAAC8D,MAAMnB,WAAW,GAAGoB,OAAO,CAAC,QAAQ,KAAK,EAAE,OAAO;IAC9E,IAAI,2DAA2D3B,IAAI,CAAC0B,QAAQ,OAAO;IACnF,OAAO7D,kBAAkBoC,IAAI,CAAC,CAAC,EAAElC,OAAO,EAAE,GAAKA,QAAQiC,IAAI,CAAC0B;AAC9D;AAEA,yEAAyE,GACzE,SAASE,qBAAqBC,OAA0B;IACtD,OAAOA,QACJhB,MAAM,CAAC,CAACnC,QAAU,oCAAoCsB,IAAI,CAACtB,MAAMgC,IAAI,KACrEoB,GAAG,CAAC,CAACpD,QAAU,CAAC,MAAM,EAAEA,MAAMgC,IAAI,IAAI,EACtCJ,IAAI,CAAC;AACV;AAEA;;;CAGC,GACD,OAAO,SAASyB,iBAAiBC,KAA4B;QAGxBA,iBACjBA;IAHlB,MAAMC,UAAkC,EAAE;IAC1C,MAAMC,QAAQhE,UAAU8D,MAAME,KAAK;IACnC,MAAMC,WAAW3E,iBAAiB,EAACwE,kBAAAA,MAAMG,QAAQ,YAAdH,kBAAkB,EAAE,EAAEnB,MAAM,CAACC,SAASR,IAAI,CAAC;IAC9E,MAAM8B,WAAW,EAACJ,oBAAAA,MAAMK,UAAU,YAAhBL,oBAAoB,EAAE,EACrCF,GAAG,CAAC,CAACQ,SAAWnB,OAAOmB,iBAAAA,SAAU,IAAI5B,IAAI,GAAGH,WAAW,GAAGoB,OAAO,CAAC,QAAQ,KAC1Ed,MAAM,CAAC,CAACyB,SAAWA,OAAOf,QAAQ,CAAC;IACtC,MAAMgB,kBAAkB,IAAIjE,IAAI8D,SAASN,GAAG,CAACzE;IAC7C,MAAMmF,YAAY,CAACC,OAAiBL,SAASnC,IAAI,CAAC,CAACyC,MAAQD,SAASC,OAAOD,KAAKE,QAAQ,CAAC,CAAC,CAAC,EAAED,KAAK;IAElG,MAAME,cAAcV,MAAMJ,GAAG,CAAC,CAAC/B,OAAST,YAAYS,KAAKjB,KAAK;IAC9D,IAAI+D,WAAWD,YAAYd,GAAG,CAAC,CAACD,UAAYA,QAAQvB,IAAI,CAAC,OAAOA,IAAI,CAAC;IACrEuC,WAAW,GAAGA,SAAS,EAAE,EAAEjB,qBAAqBgB,YAAYE,IAAI,KAAK,CAAC/B,KAAK,CAAC,GAAGtD;IAE/E,mEAAmE;IACnE,MAAMsF,YAAY/F,YAAY6F;IAC9B,KAAK,MAAMJ,QAAQM,UAAW;QAC5B,MAAMC,QAAQ9F,sBAAsBuF;QACpC,IAAIO,SAAS,CAAC/F,kBAAkB+F,OAAOT,kBAAkB;YACvDN,QAAQlD,IAAI,CAAC;gBAAEkE,MAAM;gBAAkBD,OAAOA,MAAME,EAAE;gBAAET;YAAK;QAC/D;IACF;IAEA,mDAAmD;IACnD,MAAMU,iBAAiB,IAAI7E;IAC3B,MAAM8E,iBAAiB,CAACtF,OAAoC0C;QAC1D,IAAI2C,eAAexE,GAAG,CAACb,QAAQ;QAC/BqF,eAAevE,GAAG,CAACd;QACnBmE,QAAQlD,IAAI,CAAC;YAAEkE,MAAM;YAAoBnF;YAAO0C,OAAOA,MAAMO,KAAK,CAAC,GAAG;QAAI;IAC5E;IACAmB,MAAMmB,OAAO,CAAC,CAACtD,MAAMuD;QACnB,IAAIxD,gBAAgBC,OAAO;YACzB,MAAMwD,aAAapD,aAAaJ;YAChC,IAAIwD,YAAYH,eAAeG,WAAWzF,KAAK,EAAEyF,WAAW/C,KAAK;QACnE;QACA,KAAK,MAAMc,QAAQsB,WAAW,CAACU,MAAM,CAAE;YACrC,IAAI,CAAChC,KAAKC,QAAQ,CAAC,MAAM;YACzB,KAAK,MAAM,EAAEzD,KAAK,EAAEC,OAAO,EAAE,IAAIC,uBAAwB;gBACvD,IAAID,QAAQiC,IAAI,CAACsB,OAAO8B,eAAetF,OAAO;YAChD;QACF;IACF;IAEA,0EAA0E;IAC1E,MAAM0F,UAAUT,UAAUvB,IAAI,CAAC,CAACiB;QAC9B,IAAID,UAAUC,OAAO,OAAO;QAC5B,MAAMgB,cAAcpG,kBAAkBoF;QACtC,OAAO,CAACnF,yBAAyBmG,gBAAgB,CAAClG,mBAAmBkG;IACvE;IACA,IAAID,SAAS;QACX,MAAME,UAAU;eAAIzF;eAAyBd;SAAuB;QACpE,MAAMwG,QAAQ,IAAIrF;QAClB,KAAK,MAAMuD,WAAWe,YAAa;YACjC,MAAMxC,OAAOyB,QAAQvB,IAAI,CAAC;YAC1B,IAAI,CAACF,MAAM;YACX,MAAMwD,SAASF,QAAQ5B,GAAG,CAAC,CAAC/D;oBAAYqC;wBAAAA,cAAAA,KAAKyD,KAAK,CAAC9F,6BAAXqC,WAAqB,CAAC,EAAE;eAAEoB,IAAI,CAACV;YACvE,IAAI,CAAC8C,QAAQ;YACb,KAAK,MAAMZ,SAAS5F,uBAAwB;gBAC1C,IAAIuG,MAAMhF,GAAG,CAACqE,MAAME,EAAE,GAAG;gBACzB,IAAIF,MAAMc,OAAO,CAAC9D,IAAI,CAACI,SAAS,CAACrD,oBAAoBiG,OAAOb,UAAUI,kBAAkB;oBACtFoB,MAAM/E,GAAG,CAACoE,MAAME,EAAE;oBAClBjB,QAAQlD,IAAI,CAAC;wBAAEkE,MAAM;wBAAqBD,OAAOA,MAAME,EAAE;wBAAEU,QAAQA,OAAO7C,KAAK,CAAC,GAAG;oBAAI;gBACzF;YACF;QACF;IACF;IAEA,OAAO;QAAEkB;IAAQ;AACnB"}
+{"version":3,"sources":["../../../../../../../libs/shared/util/email/src/lib/hosted-page-screen.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*==========================================\n * THE HOSTED PAGE SCREEN (AGL-3362).\n *\n * The outbound phishing screen, read over a PUBLISHED PAGE instead of an\n * email: the same brand list, the same lookalike logic, the same tiers\n * (`signalsThatHold`). A fraud actor who could not mail a lure could still\n * host one, and the incident's sibling site published a page at the\n * document-share path `/reviewfile`.\n *\n * Five shapes:\n *\n * 1. **A lookalike link or embed** (`lookalike-link`, STRONG) — any `href`,\n *    `src`, form action or URL in the page's authored content whose host\n *    wears a brand without being the brand's domain.\n * 2. **A credential field** (`credential-field`, STRONG) — a field the\n *    merchant AUTHORED that asks for a password, a card number or a\n *    one-time code: its type, its autocomplete token, or its label,\n *    placeholder or name. The platform's own sign-in, account and checkout\n *    elements render their inputs in code, not in stored props, so they are\n *    never read as a field here — which is exactly the sanctioned/unsanctioned\n *    line: what the platform collects through its own components is\n *    Aglyn's to protect, and what a page's author collects in a form of\n *    their own is not something a site may ask a stranger for.\n * 3. **A brand's call to action** (`brand-action-page`, SOFT) — one element\n *    whose text names a brand that is not the workspace's AND asks the reader\n *    to sign in, verify, confirm or open a document, on a page that links\n *    somewhere that is neither the workspace's, nor a brand's own, nor a\n *    common social or maps link.\n * 4. **A brand's lure, page-wide** (`brand-lure-page`, SOFT, AGL-3447) — the\n *    same brand and link anywhere on the page, beside an account or\n *    document-share LURE anywhere on it (\"Secure Document Access Portal\"), or\n *    a call to action that leaves the site worded as an action (\"Continue to\n *    Document\"). The 2026-10-01 phishing page put Proofpoint's name in its\n *    body, the lure in its heading and the action on its button: three\n *    elements, none of which shape 3 reads on its own. What it does not count page-wide is\n *    a bare \"sign in\" that stays on the site — a hotel that says \"find us on\n *    Booking.com\" in one place and has a member sign-in in another is two\n *    ordinary sentences.\n * 5. **A call to action that leaves, beside a lure** (`offsite-action-page`,\n *    SOFT, AGL-3447) — the page's only call to action, or one worded as an\n *    account or document action, sends visitors to a host that is not the\n *    site's own, a listed brand's or a common link, on a page that carries an\n *    account or document-share lure. No brand needed: a \"Secure Document\n *    Access Portal\" whose one button leaves for the kit is the shape whatever\n *    name it wears.\n *\n * Shapes 3-5 are soft, so they hold only for a workspace in its first\n * fortnight (`signalsThatHold`); an established workspace's page is held by\n * shapes 1 and 2 alone.\n *\n * The same reading applies to a site REDIRECT ({@link screenSiteRedirect}):\n * a rule that sends a path off the site is a page whose one call to action\n * fires on arrival, and its path is the only text it has.\n *\n * Pure: the caller hands over the composed node tree and the workspace's own\n * names and hosts, and decides what a hold does.\n *=========================================*/\n\nimport {\n  ACCOUNT_LURE_PATTERNS,\n  DOCUMENT_SHARE_LURE_PATTERNS,\n  isWorkspaceOwnBrand,\n  linkHostsIn,\n  isBrandsOwnDomain,\n  lookalikeBrandForHost,\n  PHISHING_LURE_PATTERNS,\n  PHISHING_SCREEN_BRANDS,\n  type PhishingScreenBrand,\n  type PhishingScreenSignal,\n  registrableDomain,\n  isAnyOfficialBrandDomain,\n  isCommonLinkDomain,\n  squashScreenText,\n  visibleTextOf,\n} from './outbound-phishing-screen'\n\nexport interface HostedPageScreenInput {\n  /**\n   * The page as it will be served — the composed tree, or any object that\n   * holds nodes (`{ componentId, props }`) at any depth. Walked, never\n   * trusted to have one shape: a screen, a layout's chrome, a grafted\n   * component and a form all arrive together.\n   */\n  nodes: unknown\n  /** The workspace's own names, as `screenOutboundEmail` reads them. */\n  ownNames?: readonly (string | null | undefined)[]\n  /** The workspace's own hosts — a link to one is never \"elsewhere\". */\n  ownDomains?: readonly (string | null | undefined)[]\n}\n\nexport interface HostedPageScreenVerdict {\n  signals: PhishingScreenSignal[]\n}\n\n/** A node as the walk finds it. */\ninterface WalkedNode {\n  componentId: string\n  props: Record<string, unknown>\n}\n\n/** The most a page's text is read to, so a huge page costs a bounded scan. */\nconst MAX_PAGE_TEXT = 2_000_000\n/** The most nodes the walk visits. */\nconst MAX_NODES = 20_000\n\n/** Props that describe a field the author defined, rather than content. */\nconst FIELD_PROP_KEYS = ['fieldType', 'fieldName', 'inputType', 'autoComplete', 'autocomplete']\n\n/** Autocomplete tokens (WHATWG) that name a credential. */\nconst CREDENTIAL_AUTOCOMPLETE: Record<string, 'password' | 'card' | 'otp'> = {\n  'current-password': 'password',\n  'new-password': 'password',\n  'cc-number': 'card',\n  'cc-csc': 'card',\n  'cc-exp': 'card',\n  'one-time-code': 'otp',\n}\n\n/** Field wording that asks for a credential, by kind. */\nconst CREDENTIAL_LABELS: ReadonlyArray<{ field: 'password' | 'card' | 'otp'; pattern: RegExp }> = [\n  { field: 'password', pattern: /\\bpass\\s?(?:word|code|phrase)s?\\b|\\bpasswd\\b|\\bpin\\s*(?:code|number)?\\s*$/i },\n  {\n    field: 'card',\n    pattern:\n      /\\b(?:credit|debit)\\s*card\\b|\\bcard\\s*(?:number|no\\.?|#)|\\bcardnumber\\b|\\bcvv2?\\b|\\bcvc\\b|\\bcard\\s*security\\s*code\\b|\\bcard\\s*expir/i,\n  },\n  {\n    field: 'otp',\n    pattern:\n      /\\bone[-\\s]?time\\s*(?:pass\\s?code|password|code|pin)\\b|\\botp\\b|\\bverification\\s*code\\b|\\b2fa\\b|\\btwo[-\\s]?factor\\b|\\bauthenticat(?:ion|or)\\s*code\\b|\\bsms\\s*code\\b/i,\n  },\n]\n\n/** Raw HTML an author placed that holds a credential input. */\nconst HTML_CREDENTIAL_INPUTS: ReadonlyArray<{ field: 'password' | 'card' | 'otp'; pattern: RegExp }> = [\n  { field: 'password', pattern: /<input\\b[^>]*\\btype\\s*=\\s*[\"']?password/i },\n  { field: 'password', pattern: /<input\\b[^>]*\\b(?:name|autocomplete)\\s*=\\s*[\"']?(?:pass(?:word|wd)?|current-password|new-password)\\b/i },\n  { field: 'card', pattern: /<input\\b[^>]*\\b(?:name|autocomplete)\\s*=\\s*[\"']?(?:card_?number|cc-number|cc-csc|cvv|cvc)\\b/i },\n  { field: 'otp', pattern: /<input\\b[^>]*\\b(?:name|autocomplete)\\s*=\\s*[\"']?(?:otp|one-time-code|verification_?code)\\b/i },\n]\n\n/**\n * What an element asks its reader to DO with an account or a document —\n * counted beside a brand in the SAME element, or on a call to action that\n * leaves the site. The email lure phrasing counts too.\n */\nconst PAGE_ACTION_PATTERNS: readonly RegExp[] = [\n  /\\b(?:sign|log)[\\s-]?in\\b/i,\n  /\\bverify\\b/i,\n  /\\bconfirm\\s+(?:your|the)\\b/i,\n  /\\bunlock\\b/i,\n  /\\benter\\s+your\\b/i,\n  /\\b(?:view|review|open|download|access)\\s+(?:the\\s+|your\\s+)?(?:shared\\s+|secure\\s+)?(?:file|document|invoice|statement)s?\\b/i,\n  /\\b(?:continue|proceed)\\s+to\\s+(?:the\\s+|your\\s+)?(?:document|file|account|sign[\\s-]?in|log[\\s-]?in)s?\\b/i,\n]\n\n/**\n * The lures a page is read for as a WHOLE (AGL-3447): account and\n * document-share wording. Not the marketplace, booking and parcel lures,\n * which a hotel's \"guest reviews\" and a shop's delivery page carry every day\n * and which still count in one element beside a brand.\n */\nconst PAGE_LURE_PATTERNS: readonly RegExp[] = [...ACCOUNT_LURE_PATTERNS, ...DOCUMENT_SHARE_LURE_PATTERNS]\n\n/**\n * A component that renders a call to action — a button or a link, however a\n * plugin names it (`muiButton`, `muiScreenLink`, `muiLinkBox`). It is one\n * when it carries a target: an `href`, or a `screenId` on the site itself.\n */\nconst CALL_TO_ACTION_COMPONENT = /button|fab|cta|link/i\n\n/** The props a call to action's visible words live in; the first found wins. */\nconst CALL_TO_ACTION_LABEL_KEYS = ['children', 'label', 'text', 'title', 'html']\n\n/** URLs in page text, so prose is read for a brand or a lure without them. */\nconst PROSE_URL_PATTERN = /(?:https?:)?\\/\\/[^\\s\"'<>]+|\\bwww\\.[^\\s\"'<>]+/gi\n\n/** One call to action: what it says, and the host it leaves for (null: it stays). */\ninterface CallToAction {\n  label: string\n  host: string | null\n}\n\n/** Every node in the tree, breadth-first in document order, bounded. */\nfunction walkNodes(root: unknown): WalkedNode[] {\n  const found: WalkedNode[] = []\n  const seen = new Set<unknown>()\n  const stack: unknown[] = [root]\n  for (let head = 0; head < stack.length && found.length < MAX_NODES; head += 1) {\n    const value = stack[head]\n    if (!value || typeof value !== 'object' || seen.has(value)) continue\n    seen.add(value)\n    const record = value as Record<string, unknown>\n    if (typeof record['componentId'] === 'string') {\n      const props = record['props']\n      found.push({\n        componentId: record['componentId'] as string,\n        props: props && typeof props === 'object' ? (props as Record<string, unknown>) : {},\n      })\n    }\n    for (const child of Array.isArray(value) ? value : Object.values(record)) {\n      if (child && typeof child === 'object') stack.push(child)\n    }\n  }\n  return found\n}\n\n/** Every string a node's props hold, one level of arrays and objects deep. */\nfunction propStrings(props: Record<string, unknown>, skip: ReadonlySet<string> = new Set()): string[] {\n  const out: string[] = []\n  const visit = (value: unknown, depth: number) => {\n    if (typeof value === 'string') out.push(value)\n    else if (depth < 3 && value && typeof value === 'object') {\n      for (const entry of Array.isArray(value) ? value : Object.values(value as Record<string, unknown>)) {\n        visit(entry, depth + 1)\n      }\n    }\n  }\n  for (const [key, value] of Object.entries(props)) {\n    if (key === 'sx' || skip.has(key)) continue\n    visit(value, 0)\n  }\n  return out\n}\n\n/** Does this node describe a field its author defined? */\nfunction isAuthoredField(node: WalkedNode): boolean {\n  if (/field|input/i.test(node.componentId)) return true\n  return FIELD_PROP_KEYS.some((key) => node.props[key] !== undefined)\n}\n\n/** The credential a field asks for, or null. */\nfunction credentialOf(node: WalkedNode): { field: 'password' | 'card' | 'otp'; label: string } | null {\n  const text = (key: string) => (typeof node.props[key] === 'string' ? (node.props[key] as string) : '')\n  const type = [text('fieldType'), text('type'), text('inputType')].join(' ').toLowerCase()\n  const label = text('label') || text('placeholder') || text('fieldName') || text('name')\n  if (/\\bpassword\\b/.test(type)) return { field: 'password', label: label || 'password' }\n  const autocomplete = (text('autoComplete') || text('autocomplete')).toLowerCase().trim()\n  const byToken = CREDENTIAL_AUTOCOMPLETE[autocomplete]\n  if (byToken) return { field: byToken, label: label || autocomplete }\n  const wording = [text('label'), text('placeholder'), text('fieldName'), text('name'), text('helperText')]\n    .filter(Boolean)\n    .join(' ')\n  for (const { field, pattern } of CREDENTIAL_LABELS) {\n    if (pattern.test(wording)) return { field, label: (label || wording).slice(0, 80) }\n  }\n  return null\n}\n\n/**\n * The credential an input asks for, read from the two attributes that decide\n * it in the browser — its `type` and its `autocomplete` token — or null.\n * For code that builds inputs rather than storing them as page props: the\n * marketplace verifier reads a plugin bundle's `{ type: 'password' }` and\n * `setAttribute('autocomplete', 'cc-number')` with this (AGL-3362).\n */\nexport function credentialForInputAttribute(\n  attribute: string,\n  value: string,\n): 'password' | 'card' | 'otp' | null {\n  const name = String(attribute ?? '').toLowerCase()\n  const token = String(value ?? '').trim().toLowerCase()\n  if ((name === 'type' || name === 'inputtype') && token === 'password') return 'password'\n  if (name === 'autocomplete') return CREDENTIAL_AUTOCOMPLETE[token] ?? null\n  return null\n}\n\n/** The credential a piece of raw HTML asks for in an input of its own, or null. */\nexport function credentialInHtml(html: string): 'password' | 'card' | 'otp' | null {\n  const text = String(html ?? '')\n  if (!text.includes('<')) return null\n  return HTML_CREDENTIAL_INPUTS.find(({ pattern }) => pattern.test(text))?.field ?? null\n}\n\n/**\n * Does a submitted field's NAME ask for a credential — a password, a card\n * number or security code, a one-time code? The same wording the page\n * screen holds a field for, read over a name as a form posts it\n * (`card_number`, `cardNumber`, `one-time-code`).\n *\n * For the one path that does not pass a publish: a public form endpoint\n * takes whatever field names a request carries, so a page the screen never\n * saw (third-party code, a hand-built request) could still post a password\n * to it. The endpoint drops such a field rather than store it.\n */\nexport function isCredentialFieldName(name: string): boolean {\n  const words = String(name ?? '')\n    .replace(/([a-z0-9])([A-Z])/g, '$1 $2')\n    .replace(/[_\\-.[\\]]+/g, ' ')\n    .trim()\n  if (!words) return false\n  if (CREDENTIAL_AUTOCOMPLETE[words.toLowerCase().replace(/\\s+/g, '-')]) return true\n  if (/^(?:pass|pwd|ccnum|cc\\s?num|cc\\s?number|cvv2?|cvc|csc)$/i.test(words)) return true\n  return CREDENTIAL_LABELS.some(({ pattern }) => pattern.test(words))\n}\n\n/** URLs a page carries in a form Links-by-shape would miss: `//host/…`. */\nfunction protocolRelativeUrls(strings: readonly string[]): string {\n  return strings\n    .filter((value) => /^\\/\\/[a-z0-9-]+(?:\\.[a-z0-9-]+)+/i.test(value.trim()))\n    .map((value) => `https:${value.trim()}`)\n    .join('\\n')\n}\n\n/**\n * Screen one page as it will be served. The caller applies the tiers with\n * `signalsThatHold` and decides what a hold does.\n */\nexport function screenHostedPage(input: HostedPageScreenInput): HostedPageScreenVerdict {\n  const signals: PhishingScreenSignal[] = []\n  const nodes = walkNodes(input.nodes)\n  const ownNames = squashScreenText((input.ownNames ?? []).filter(Boolean).join(' '))\n  const ownHosts = (input.ownDomains ?? [])\n    .map((domain) => String(domain ?? '').trim().toLowerCase().replace(/\\.+$/, ''))\n    .filter((domain) => domain.includes('.'))\n  const ownRegistrables = new Set(ownHosts.map(registrableDomain))\n  const isOwnHost = (host: string) => ownHosts.some((own) => host === own || host.endsWith(`.${own}`))\n\n  const nodeStrings = nodes.map((node) => propStrings(node.props))\n  let pageText = nodeStrings.map((strings) => strings.join('\\n')).join('\\n')\n  pageText = `${pageText}\\n${protocolRelativeUrls(nodeStrings.flat())}`.slice(0, MAX_PAGE_TEXT)\n\n  // 1. A lookalike host anywhere the page links, embeds or posts to.\n  const linkHosts = linkHostsIn(pageText)\n  for (const host of linkHosts) {\n    const brand = lookalikeBrandForHost(host)\n    if (brand && !isBrandsOwnDomain(brand, ownRegistrables)) {\n      signals.push({ code: 'lookalike-link', brand: brand.id, host })\n    }\n  }\n\n  // 2. A credential field the page's author defined.\n  const credentialSeen = new Set<string>()\n  const noteCredential = (field: 'password' | 'card' | 'otp', label: string) => {\n    if (credentialSeen.has(field)) return\n    credentialSeen.add(field)\n    signals.push({ code: 'credential-field', field, label: label.slice(0, 80) })\n  }\n  nodes.forEach((node, index) => {\n    if (isAuthoredField(node)) {\n      const credential = credentialOf(node)\n      if (credential) noteCredential(credential.field, credential.label)\n    }\n    for (const html of nodeStrings[index]) {\n      if (!html.includes('<')) continue\n      for (const { field, pattern } of HTML_CREDENTIAL_INPUTS) {\n        if (pattern.test(html)) noteCredential(field, 'an input in the page’s own HTML')\n      }\n    }\n  })\n\n  const isElsewhere = (host: string) => {\n    if (isOwnHost(host)) return false\n    const registrable = registrableDomain(host)\n    return !isAnyOfficialBrandDomain(registrable) && !isCommonLinkDomain(registrable)\n  }\n  const foreign = linkHosts.find(isElsewhere)\n  const actions = [...PAGE_ACTION_PATTERNS, ...PHISHING_LURE_PATTERNS]\n  const named = new Set<string>()\n  const isOthersBrand = (brand: PhishingScreenBrand) =>\n    !named.has(brand.id) && !isWorkspaceOwnBrand(brand, ownNames, ownRegistrables)\n\n  // 3. A brand's call to action, in one element, on a page that links away.\n  if (foreign) {\n    for (const strings of nodeStrings) {\n      const text = proseOf(strings.join(' '))\n      if (!text) continue\n      const action = firstMatch(actions, text)\n      if (!action) continue\n      for (const brand of PHISHING_SCREEN_BRANDS) {\n        if (isOthersBrand(brand) && brand.mention.test(text)) {\n          named.add(brand.id)\n          signals.push({ code: 'brand-action-page', brand: brand.id, action: action.slice(0, 80) })\n        }\n      }\n    }\n  }\n\n  const prose = proseOf(pageText)\n  const pageLure = firstMatch(PAGE_LURE_PATTERNS, prose)\n  const ctas = callsToAction(nodes)\n  const leaving = ctas.filter((cta): cta is CallToAction & { host: string } =>\n    Boolean(cta.host && isElsewhere(cta.host)),\n  )\n  const wordedLeaving = leaving.find((cta) => firstMatch(actions, cta.label))\n\n  // 4. A brand's lure, read over the page as a whole, on a page that links away.\n  const brandLure = pageLure ?? (wordedLeaving ? firstMatch(actions, wordedLeaving.label) : undefined)\n  if (foreign && brandLure) {\n    const host = (wordedLeaving ?? leaving[0])?.host ?? foreign\n    for (const brand of PHISHING_SCREEN_BRANDS) {\n      if (isOthersBrand(brand) && brand.mention.test(prose)) {\n        named.add(brand.id)\n        signals.push({ code: 'brand-lure-page', brand: brand.id, lure: brandLure.slice(0, 120), host })\n      }\n    }\n  }\n\n  // 5. The page's call to action leaves the site, beside a lure. Its only\n  //    one, or the one worded as an account or document action.\n  const primary = wordedLeaving ?? (ctas.length === 1 ? leaving[0] : undefined)\n  if (primary && pageLure) {\n    signals.push({\n      code: 'offsite-action-page',\n      action: (primary.label || primary.host).slice(0, 80),\n      lure: pageLure.slice(0, 120),\n      host: primary.host,\n    })\n  }\n\n  return { signals }\n}\n\n/**\n * What a visitor reads in page text: its markup taken out the way the email\n * screen takes it out ({@link visibleTextOf}), so a custom HTML block or a\n * rich-text prop cannot split a brand or a lure letter by letter with tags\n * (AGL-3453), and its bare URLs taken out too. Links are still read from\n * the raw text, where an href lives.\n */\nfunction proseOf(text: string): string {\n  return visibleTextOf(text).replace(PROSE_URL_PATTERN, ' ').replace(/\\s+/g, ' ').trim()\n}\n\n/** The first pattern's match in the text, or undefined. */\nfunction firstMatch(patterns: readonly RegExp[], text: string): string | undefined {\n  if (!text) return undefined\n  for (const pattern of patterns) {\n    const found = text.match(pattern)?.[0]\n    if (found) return found\n  }\n  return undefined\n}\n\n/** The words a call to action shows, from its label prop, markup taken out. */\nfunction callToActionLabel(props: Record<string, unknown>): string {\n  for (const key of CALL_TO_ACTION_LABEL_KEYS) {\n    const value = props[key]\n    if (typeof value === 'string' && value.trim()) {\n      return visibleTextOf(value).split('\\n')[0]\n    }\n  }\n  return ''\n}\n\n/**\n * Every call to action on the page: each button or link that carries a\n * target. A `screenId` is a page of the site and takes precedence over an\n * `href`, as the button renders it; a relative, `mailto:` or `tel:` href has\n * no web host and stays too.\n */\nfunction callsToAction(nodes: readonly WalkedNode[]): CallToAction[] {\n  const found: CallToAction[] = []\n  for (const node of nodes) {\n    if (!CALL_TO_ACTION_COMPONENT.test(node.componentId)) continue\n    const screenId = typeof node.props['screenId'] === 'string' ? node.props['screenId'].trim() : ''\n    const href = typeof node.props['href'] === 'string' ? node.props['href'].trim() : ''\n    if (!screenId && !href) continue\n    const absolute = href.startsWith('//') ? `https:${href}` : href\n    found.push({\n      label: callToActionLabel(node.props),\n      host: screenId ? null : (linkHostsIn(absolute)[0] ?? null),\n    })\n  }\n  return found\n}\n\nexport interface SiteRedirectScreenInput {\n  /** The path the rule answers — `/secure-document` — or its pattern. */\n  source: string\n  /** Where it sends the visitor, after any `$n` substitution. */\n  destination: string\n  /** The workspace's own names, as `screenHostedPage` reads them. */\n  ownNames?: readonly (string | null | undefined)[]\n  /** The workspace's own hosts — a redirect to one never leaves. */\n  ownDomains?: readonly (string | null | undefined)[]\n}\n\n/**\n * Screen one site redirect (AGL-3447): a rule that sends a path off the site\n * is a call to action that fires on arrival, so it is read with the page's\n * rules over the one text it has, its path.\n *\n * - `lookalike-link` (STRONG) — the destination wears a brand it is not.\n * - `offsite-redirect` (SOFT) — the destination is not the site's own, a\n *   listed brand's or a common link, and the path reads as an account or\n *   document-share lure (`/secure-document-access`).\n * - `brand-lure-link` (SOFT) — the same, and the path names a brand that is\n *   not the workspace's (`/paypal-verify-your-account`), the email screen's\n *   three-part lure.\n *\n * The caller applies the tiers with `signalsThatHold`, with the workspace's\n * age, and decides what a hold does.\n */\nexport function screenSiteRedirect(input: SiteRedirectScreenInput): HostedPageScreenVerdict {\n  const signals: PhishingScreenSignal[] = []\n  const destination = String(input.destination ?? '').trim()\n  const hosts = linkHostsIn(destination.startsWith('//') ? `https:${destination}` : destination)\n  if (!hosts.length) return { signals }\n  const ownNames = squashScreenText((input.ownNames ?? []).filter(Boolean).join(' '))\n  const ownHosts = (input.ownDomains ?? [])\n    .map((domain) => String(domain ?? '').trim().toLowerCase().replace(/\\.+$/, ''))\n    .filter((domain) => domain.includes('.'))\n  const ownRegistrables = new Set(ownHosts.map(registrableDomain))\n\n  for (const host of hosts) {\n    const brand = lookalikeBrandForHost(host)\n    if (brand && !isBrandsOwnDomain(brand, ownRegistrables)) {\n      signals.push({ code: 'lookalike-link', brand: brand.id, host })\n    }\n  }\n\n  // The first host is where the browser goes; the rest is a userinfo disguise.\n  const host = hosts[0]\n  const registrable = registrableDomain(host)\n  const leaves =\n    !ownHosts.some((own) => host === own || host.endsWith(`.${own}`)) &&\n    !isAnyOfficialBrandDomain(registrable) &&\n    !isCommonLinkDomain(registrable)\n  if (!leaves) return { signals }\n\n  const source = String(input.source ?? '').trim()\n  const words = pathWords(source)\n  const lure = firstMatch(PAGE_LURE_PATTERNS, words)\n  if (lure) {\n    signals.push({ code: 'offsite-redirect', source: source.slice(0, 120), lure: lure.slice(0, 120), host })\n  }\n  const anyLure = lure ?? firstMatch(PHISHING_LURE_PATTERNS, words)\n  if (anyLure) {\n    const brand = PHISHING_SCREEN_BRANDS.find(\n      (candidate) =>\n        candidate.mention.test(words) && !isWorkspaceOwnBrand(candidate, ownNames, ownRegistrables),\n    )\n    if (brand) {\n      signals.push({ code: 'brand-lure-link', brand: brand.id, lure: anyLure.slice(0, 120), host })\n    }\n  }\n  return { signals }\n}\n\n/** A path read as words: `/secure-document_access` → `secure document access`. */\nfunction pathWords(path: string): string {\n  let decoded = path\n  try {\n    decoded = decodeURIComponent(path)\n  } catch {\n    // A malformed escape is read as typed.\n  }\n  return decoded.replace(/[^a-z0-9]+/gi, ' ').trim()\n}\n"],"names":["ACCOUNT_LURE_PATTERNS","DOCUMENT_SHARE_LURE_PATTERNS","isWorkspaceOwnBrand","linkHostsIn","isBrandsOwnDomain","lookalikeBrandForHost","PHISHING_LURE_PATTERNS","PHISHING_SCREEN_BRANDS","registrableDomain","isAnyOfficialBrandDomain","isCommonLinkDomain","squashScreenText","visibleTextOf","MAX_PAGE_TEXT","MAX_NODES","FIELD_PROP_KEYS","CREDENTIAL_AUTOCOMPLETE","CREDENTIAL_LABELS","field","pattern","HTML_CREDENTIAL_INPUTS","PAGE_ACTION_PATTERNS","PAGE_LURE_PATTERNS","CALL_TO_ACTION_COMPONENT","CALL_TO_ACTION_LABEL_KEYS","PROSE_URL_PATTERN","walkNodes","root","found","seen","Set","stack","head","length","value","has","add","record","props","push","componentId","child","Array","isArray","Object","values","propStrings","skip","out","visit","depth","entry","key","entries","isAuthoredField","node","test","some","undefined","credentialOf","text","type","join","toLowerCase","label","autocomplete","trim","byToken","wording","filter","Boolean","slice","credentialForInputAttribute","attribute","name","String","token","credentialInHtml","html","includes","find","isCredentialFieldName","words","replace","protocolRelativeUrls","strings","map","screenHostedPage","input","signals","nodes","ownNames","ownHosts","ownDomains","domain","ownRegistrables","isOwnHost","host","own","endsWith","nodeStrings","pageText","flat","linkHosts","brand","code","id","credentialSeen","noteCredential","forEach","index","credential","isElsewhere","registrable","foreign","actions","named","isOthersBrand","proseOf","action","firstMatch","mention","prose","pageLure","ctas","callsToAction","leaving","cta","wordedLeaving","brandLure","lure","primary","patterns","match","callToActionLabel","split","screenId","href","absolute","startsWith","screenSiteRedirect","destination","hosts","leaves","source","pathWords","anyLure","candidate","path","decoded","decodeURIComponent"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2CAwD2C,GAE3C,SACEA,qBAAqB,EACrBC,4BAA4B,EAC5BC,mBAAmB,EACnBC,WAAW,EACXC,iBAAiB,EACjBC,qBAAqB,EACrBC,sBAAsB,EACtBC,sBAAsB,EAGtBC,iBAAiB,EACjBC,wBAAwB,EACxBC,kBAAkB,EAClBC,gBAAgB,EAChBC,aAAa,QACR,gCAA4B;AA0BnC,4EAA4E,GAC5E,MAAMC,gBAAgB;AACtB,oCAAoC,GACpC,MAAMC,YAAY;AAElB,yEAAyE,GACzE,MAAMC,kBAAkB;IAAC;IAAa;IAAa;IAAa;IAAgB;CAAe;AAE/F,yDAAyD,GACzD,MAAMC,0BAAuE;IAC3E,oBAAoB;IACpB,gBAAgB;IAChB,aAAa;IACb,UAAU;IACV,UAAU;IACV,iBAAiB;AACnB;AAEA,uDAAuD,GACvD,MAAMC,oBAA4F;IAChG;QAAEC,OAAO;QAAYC,SAAS;IAA6E;IAC3G;QACED,OAAO;QACPC,SACE;IACJ;IACA;QACED,OAAO;QACPC,SACE;IACJ;CACD;AAED,6DAA6D,GAC7D,MAAMC,yBAAiG;IACrG;QAAEF,OAAO;QAAYC,SAAS;IAA2C;IACzE;QAAED,OAAO;QAAYC,SAAS;IAAwG;IACtI;QAAED,OAAO;QAAQC,SAAS;IAA+F;IACzH;QAAED,OAAO;QAAOC,SAAS;IAA8F;CACxH;AAED;;;;CAIC,GACD,MAAME,uBAA0C;IAC9C;IACA;IACA;IACA;IACA;IACA;IACA;CACD;AAED;;;;;CAKC,GACD,MAAMC,qBAAwC;OAAItB;OAA0BC;CAA6B;AAEzG;;;;CAIC,GACD,MAAMsB,2BAA2B;AAEjC,8EAA8E,GAC9E,MAAMC,4BAA4B;IAAC;IAAY;IAAS;IAAQ;IAAS;CAAO;AAEhF,4EAA4E,GAC5E,MAAMC,oBAAoB;AAQ1B,sEAAsE,GACtE,SAASC,UAAUC,IAAa;IAC9B,MAAMC,QAAsB,EAAE;IAC9B,MAAMC,OAAO,IAAIC;IACjB,MAAMC,QAAmB;QAACJ;KAAK;IAC/B,IAAK,IAAIK,OAAO,GAAGA,OAAOD,MAAME,MAAM,IAAIL,MAAMK,MAAM,GAAGnB,WAAWkB,QAAQ,EAAG;QAC7E,MAAME,QAAQH,KAAK,CAACC,KAAK;QACzB,IAAI,CAACE,SAAS,OAAOA,UAAU,YAAYL,KAAKM,GAAG,CAACD,QAAQ;QAC5DL,KAAKO,GAAG,CAACF;QACT,MAAMG,SAASH;QACf,IAAI,OAAOG,MAAM,CAAC,cAAc,KAAK,UAAU;YAC7C,MAAMC,QAAQD,MAAM,CAAC,QAAQ;YAC7BT,MAAMW,IAAI,CAAC;gBACTC,aAAaH,MAAM,CAAC,cAAc;gBAClCC,OAAOA,SAAS,OAAOA,UAAU,WAAYA,QAAoC,CAAC;YACpF;QACF;QACA,KAAK,MAAMG,SAASC,MAAMC,OAAO,CAACT,SAASA,QAAQU,OAAOC,MAAM,CAACR,QAAS;YACxE,IAAII,SAAS,OAAOA,UAAU,UAAUV,MAAMQ,IAAI,CAACE;QACrD;IACF;IACA,OAAOb;AACT;AAEA,4EAA4E,GAC5E,SAASkB,YAAYR,KAA8B,EAAES,OAA4B,IAAIjB,KAAK;IACxF,MAAMkB,MAAgB,EAAE;IACxB,MAAMC,QAAQ,CAACf,OAAgBgB;QAC7B,IAAI,OAAOhB,UAAU,UAAUc,IAAIT,IAAI,CAACL;aACnC,IAAIgB,QAAQ,KAAKhB,SAAS,OAAOA,UAAU,UAAU;YACxD,KAAK,MAAMiB,SAAST,MAAMC,OAAO,CAACT,SAASA,QAAQU,OAAOC,MAAM,CAACX,OAAmC;gBAClGe,MAAME,OAAOD,QAAQ;YACvB;QACF;IACF;IACA,KAAK,MAAM,CAACE,KAAKlB,MAAM,IAAIU,OAAOS,OAAO,CAACf,OAAQ;QAChD,IAAIc,QAAQ,QAAQL,KAAKZ,GAAG,CAACiB,MAAM;QACnCH,MAAMf,OAAO;IACf;IACA,OAAOc;AACT;AAEA,wDAAwD,GACxD,SAASM,gBAAgBC,IAAgB;IACvC,IAAI,eAAeC,IAAI,CAACD,KAAKf,WAAW,GAAG,OAAO;IAClD,OAAOzB,gBAAgB0C,IAAI,CAAC,CAACL,MAAQG,KAAKjB,KAAK,CAACc,IAAI,KAAKM;AAC3D;AAEA,8CAA8C,GAC9C,SAASC,aAAaJ,IAAgB;IACpC,MAAMK,OAAO,CAACR,MAAiB,OAAOG,KAAKjB,KAAK,CAACc,IAAI,KAAK,WAAYG,KAAKjB,KAAK,CAACc,IAAI,GAAc;IACnG,MAAMS,OAAO;QAACD,KAAK;QAAcA,KAAK;QAASA,KAAK;KAAa,CAACE,IAAI,CAAC,KAAKC,WAAW;IACvF,MAAMC,QAAQJ,KAAK,YAAYA,KAAK,kBAAkBA,KAAK,gBAAgBA,KAAK;IAChF,IAAI,eAAeJ,IAAI,CAACK,OAAO,OAAO;QAAE3C,OAAO;QAAY8C,OAAOA,SAAS;IAAW;IACtF,MAAMC,eAAe,AAACL,CAAAA,KAAK,mBAAmBA,KAAK,eAAc,EAAGG,WAAW,GAAGG,IAAI;IACtF,MAAMC,UAAUnD,uBAAuB,CAACiD,aAAa;IACrD,IAAIE,SAAS,OAAO;QAAEjD,OAAOiD;QAASH,OAAOA,SAASC;IAAa;IACnE,MAAMG,UAAU;QAACR,KAAK;QAAUA,KAAK;QAAgBA,KAAK;QAAcA,KAAK;QAASA,KAAK;KAAc,CACtGS,MAAM,CAACC,SACPR,IAAI,CAAC;IACR,KAAK,MAAM,EAAE5C,KAAK,EAAEC,OAAO,EAAE,IAAIF,kBAAmB;QAClD,IAAIE,QAAQqC,IAAI,CAACY,UAAU,OAAO;YAAElD;YAAO8C,OAAO,AAACA,CAAAA,SAASI,OAAM,EAAGG,KAAK,CAAC,GAAG;QAAI;IACpF;IACA,OAAO;AACT;AAEA;;;;;;CAMC,GACD,OAAO,SAASC,4BACdC,SAAiB,EACjBvC,KAAa;QAKuBlB;IAHpC,MAAM0D,OAAOC,OAAOF,oBAAAA,YAAa,IAAIV,WAAW;IAChD,MAAMa,QAAQD,OAAOzC,gBAAAA,QAAS,IAAIgC,IAAI,GAAGH,WAAW;IACpD,IAAI,AAACW,CAAAA,SAAS,UAAUA,SAAS,WAAU,KAAME,UAAU,YAAY,OAAO;IAC9E,IAAIF,SAAS,gBAAgB,QAAO1D,iCAAAA,uBAAuB,CAAC4D,MAAM,YAA9B5D,iCAAkC;IACtE,OAAO;AACT;AAEA,iFAAiF,GACjF,OAAO,SAAS6D,iBAAiBC,IAAY;;QAGpC1D;IAFP,MAAMwC,OAAOe,OAAOG,eAAAA,OAAQ;IAC5B,IAAI,CAAClB,KAAKmB,QAAQ,CAAC,MAAM,OAAO;IAChC,gBAAO3D,+BAAAA,uBAAuB4D,IAAI,CAAC,CAAC,EAAE7D,OAAO,EAAE,GAAKA,QAAQqC,IAAI,CAACI,2BAA1DxC,6BAAkEF,KAAK,mBAAI;AACpF;AAEA;;;;;;;;;;CAUC,GACD,OAAO,SAAS+D,sBAAsBP,IAAY;IAChD,MAAMQ,QAAQP,OAAOD,eAAAA,OAAQ,IAC1BS,OAAO,CAAC,sBAAsB,SAC9BA,OAAO,CAAC,eAAe,KACvBjB,IAAI;IACP,IAAI,CAACgB,OAAO,OAAO;IACnB,IAAIlE,uBAAuB,CAACkE,MAAMnB,WAAW,GAAGoB,OAAO,CAAC,QAAQ,KAAK,EAAE,OAAO;IAC9E,IAAI,2DAA2D3B,IAAI,CAAC0B,QAAQ,OAAO;IACnF,OAAOjE,kBAAkBwC,IAAI,CAAC,CAAC,EAAEtC,OAAO,EAAE,GAAKA,QAAQqC,IAAI,CAAC0B;AAC9D;AAEA,yEAAyE,GACzE,SAASE,qBAAqBC,OAA0B;IACtD,OAAOA,QACJhB,MAAM,CAAC,CAACnC,QAAU,oCAAoCsB,IAAI,CAACtB,MAAMgC,IAAI,KACrEoB,GAAG,CAAC,CAACpD,QAAU,CAAC,MAAM,EAAEA,MAAMgC,IAAI,IAAI,EACtCJ,IAAI,CAAC;AACV;AAEA;;;CAGC,GACD,OAAO,SAASyB,iBAAiBC,KAA4B;QAGxBA,iBACjBA;IAHlB,MAAMC,UAAkC,EAAE;IAC1C,MAAMC,QAAQhE,UAAU8D,MAAME,KAAK;IACnC,MAAMC,WAAWhF,iBAAiB,EAAC6E,kBAAAA,MAAMG,QAAQ,YAAdH,kBAAkB,EAAE,EAAEnB,MAAM,CAACC,SAASR,IAAI,CAAC;IAC9E,MAAM8B,WAAW,EAACJ,oBAAAA,MAAMK,UAAU,YAAhBL,oBAAoB,EAAE,EACrCF,GAAG,CAAC,CAACQ,SAAWnB,OAAOmB,iBAAAA,SAAU,IAAI5B,IAAI,GAAGH,WAAW,GAAGoB,OAAO,CAAC,QAAQ,KAC1Ed,MAAM,CAAC,CAACyB,SAAWA,OAAOf,QAAQ,CAAC;IACtC,MAAMgB,kBAAkB,IAAIjE,IAAI8D,SAASN,GAAG,CAAC9E;IAC7C,MAAMwF,YAAY,CAACC,OAAiBL,SAASnC,IAAI,CAAC,CAACyC,MAAQD,SAASC,OAAOD,KAAKE,QAAQ,CAAC,CAAC,CAAC,EAAED,KAAK;IAElG,MAAME,cAAcV,MAAMJ,GAAG,CAAC,CAAC/B,OAAST,YAAYS,KAAKjB,KAAK;IAC9D,IAAI+D,WAAWD,YAAYd,GAAG,CAAC,CAACD,UAAYA,QAAQvB,IAAI,CAAC,OAAOA,IAAI,CAAC;IACrEuC,WAAW,GAAGA,SAAS,EAAE,EAAEjB,qBAAqBgB,YAAYE,IAAI,KAAK,CAAC/B,KAAK,CAAC,GAAG1D;IAE/E,mEAAmE;IACnE,MAAM0F,YAAYpG,YAAYkG;IAC9B,KAAK,MAAMJ,QAAQM,UAAW;QAC5B,MAAMC,QAAQnG,sBAAsB4F;QACpC,IAAIO,SAAS,CAACpG,kBAAkBoG,OAAOT,kBAAkB;YACvDN,QAAQlD,IAAI,CAAC;gBAAEkE,MAAM;gBAAkBD,OAAOA,MAAME,EAAE;gBAAET;YAAK;QAC/D;IACF;IAEA,mDAAmD;IACnD,MAAMU,iBAAiB,IAAI7E;IAC3B,MAAM8E,iBAAiB,CAAC1F,OAAoC8C;QAC1D,IAAI2C,eAAexE,GAAG,CAACjB,QAAQ;QAC/ByF,eAAevE,GAAG,CAAClB;QACnBuE,QAAQlD,IAAI,CAAC;YAAEkE,MAAM;YAAoBvF;YAAO8C,OAAOA,MAAMO,KAAK,CAAC,GAAG;QAAI;IAC5E;IACAmB,MAAMmB,OAAO,CAAC,CAACtD,MAAMuD;QACnB,IAAIxD,gBAAgBC,OAAO;YACzB,MAAMwD,aAAapD,aAAaJ;YAChC,IAAIwD,YAAYH,eAAeG,WAAW7F,KAAK,EAAE6F,WAAW/C,KAAK;QACnE;QACA,KAAK,MAAMc,QAAQsB,WAAW,CAACU,MAAM,CAAE;YACrC,IAAI,CAAChC,KAAKC,QAAQ,CAAC,MAAM;YACzB,KAAK,MAAM,EAAE7D,KAAK,EAAEC,OAAO,EAAE,IAAIC,uBAAwB;gBACvD,IAAID,QAAQqC,IAAI,CAACsB,OAAO8B,eAAe1F,OAAO;YAChD;QACF;IACF;IAEA,MAAM8F,cAAc,CAACf;QACnB,IAAID,UAAUC,OAAO,OAAO;QAC5B,MAAMgB,cAAczG,kBAAkByF;QACtC,OAAO,CAACxF,yBAAyBwG,gBAAgB,CAACvG,mBAAmBuG;IACvE;IACA,MAAMC,UAAUX,UAAUvB,IAAI,CAACgC;IAC/B,MAAMG,UAAU;WAAI9F;WAAyBf;KAAuB;IACpE,MAAM8G,QAAQ,IAAItF;IAClB,MAAMuF,gBAAgB,CAACb,QACrB,CAACY,MAAMjF,GAAG,CAACqE,MAAME,EAAE,KAAK,CAACxG,oBAAoBsG,OAAOb,UAAUI;IAEhE,0EAA0E;IAC1E,IAAImB,SAAS;QACX,KAAK,MAAM7B,WAAWe,YAAa;YACjC,MAAMxC,OAAO0D,QAAQjC,QAAQvB,IAAI,CAAC;YAClC,IAAI,CAACF,MAAM;YACX,MAAM2D,SAASC,WAAWL,SAASvD;YACnC,IAAI,CAAC2D,QAAQ;YACb,KAAK,MAAMf,SAASjG,uBAAwB;gBAC1C,IAAI8G,cAAcb,UAAUA,MAAMiB,OAAO,CAACjE,IAAI,CAACI,OAAO;oBACpDwD,MAAMhF,GAAG,CAACoE,MAAME,EAAE;oBAClBjB,QAAQlD,IAAI,CAAC;wBAAEkE,MAAM;wBAAqBD,OAAOA,MAAME,EAAE;wBAAEa,QAAQA,OAAOhD,KAAK,CAAC,GAAG;oBAAI;gBACzF;YACF;QACF;IACF;IAEA,MAAMmD,QAAQJ,QAAQjB;IACtB,MAAMsB,WAAWH,WAAWlG,oBAAoBoG;IAChD,MAAME,OAAOC,cAAcnC;IAC3B,MAAMoC,UAAUF,KAAKvD,MAAM,CAAC,CAAC0D,MAC3BzD,QAAQyD,IAAI9B,IAAI,IAAIe,YAAYe,IAAI9B,IAAI;IAE1C,MAAM+B,gBAAgBF,QAAQ9C,IAAI,CAAC,CAAC+C,MAAQP,WAAWL,SAASY,IAAI/D,KAAK;IAEzE,+EAA+E;IAC/E,MAAMiE,YAAYN,mBAAAA,WAAaK,gBAAgBR,WAAWL,SAASa,cAAchE,KAAK,IAAIN;IAC1F,IAAIwD,WAAWe,WAAW;;YACVD;QAAd,MAAM/B,gBAAQ+B,QAAAA,wBAAAA,gBAAiBF,OAAO,CAAC,EAAE,qBAA5B,AAACE,MAA8B/B,IAAI,mBAAIiB;QACpD,KAAK,MAAMV,SAASjG,uBAAwB;YAC1C,IAAI8G,cAAcb,UAAUA,MAAMiB,OAAO,CAACjE,IAAI,CAACkE,QAAQ;gBACrDN,MAAMhF,GAAG,CAACoE,MAAME,EAAE;gBAClBjB,QAAQlD,IAAI,CAAC;oBAAEkE,MAAM;oBAAmBD,OAAOA,MAAME,EAAE;oBAAEwB,MAAMD,UAAU1D,KAAK,CAAC,GAAG;oBAAM0B;gBAAK;YAC/F;QACF;IACF;IAEA,wEAAwE;IACxE,8DAA8D;IAC9D,MAAMkC,UAAUH,wBAAAA,gBAAkBJ,KAAK3F,MAAM,KAAK,IAAI6F,OAAO,CAAC,EAAE,GAAGpE;IACnE,IAAIyE,WAAWR,UAAU;QACvBlC,QAAQlD,IAAI,CAAC;YACXkE,MAAM;YACNc,QAAQ,AAACY,CAAAA,QAAQnE,KAAK,IAAImE,QAAQlC,IAAI,AAAD,EAAG1B,KAAK,CAAC,GAAG;YACjD2D,MAAMP,SAASpD,KAAK,CAAC,GAAG;YACxB0B,MAAMkC,QAAQlC,IAAI;QACpB;IACF;IAEA,OAAO;QAAER;IAAQ;AACnB;AAEA;;;;;;CAMC,GACD,SAAS6B,QAAQ1D,IAAY;IAC3B,OAAOhD,cAAcgD,MAAMuB,OAAO,CAAC1D,mBAAmB,KAAK0D,OAAO,CAAC,QAAQ,KAAKjB,IAAI;AACtF;AAEA,yDAAyD,GACzD,SAASsD,WAAWY,QAA2B,EAAExE,IAAY;IAC3D,IAAI,CAACA,MAAM,OAAOF;IAClB,KAAK,MAAMvC,WAAWiH,SAAU;YAChBxE;QAAd,MAAMhC,SAAQgC,cAAAA,KAAKyE,KAAK,CAAClH,6BAAXyC,WAAqB,CAAC,EAAE;QACtC,IAAIhC,OAAO,OAAOA;IACpB;IACA,OAAO8B;AACT;AAEA,6EAA6E,GAC7E,SAAS4E,kBAAkBhG,KAA8B;IACvD,KAAK,MAAMc,OAAO5B,0BAA2B;QAC3C,MAAMU,QAAQI,KAAK,CAACc,IAAI;QACxB,IAAI,OAAOlB,UAAU,YAAYA,MAAMgC,IAAI,IAAI;YAC7C,OAAOtD,cAAcsB,OAAOqG,KAAK,CAAC,KAAK,CAAC,EAAE;QAC5C;IACF;IACA,OAAO;AACT;AAEA;;;;;CAKC,GACD,SAASV,cAAcnC,KAA4B;IACjD,MAAM9D,QAAwB,EAAE;IAChC,KAAK,MAAM2B,QAAQmC,MAAO;YAQGvF;QAP3B,IAAI,CAACoB,yBAAyBiC,IAAI,CAACD,KAAKf,WAAW,GAAG;QACtD,MAAMgG,WAAW,OAAOjF,KAAKjB,KAAK,CAAC,WAAW,KAAK,WAAWiB,KAAKjB,KAAK,CAAC,WAAW,CAAC4B,IAAI,KAAK;QAC9F,MAAMuE,OAAO,OAAOlF,KAAKjB,KAAK,CAAC,OAAO,KAAK,WAAWiB,KAAKjB,KAAK,CAAC,OAAO,CAAC4B,IAAI,KAAK;QAClF,IAAI,CAACsE,YAAY,CAACC,MAAM;QACxB,MAAMC,WAAWD,KAAKE,UAAU,CAAC,QAAQ,CAAC,MAAM,EAAEF,MAAM,GAAGA;QAC3D7G,MAAMW,IAAI,CAAC;YACTyB,OAAOsE,kBAAkB/E,KAAKjB,KAAK;YACnC2D,MAAMuC,WAAW,QAAQrI,gBAAAA,YAAYuI,SAAS,CAAC,EAAE,YAAxBvI,gBAA4B;QACvD;IACF;IACA,OAAOyB;AACT;AAaA;;;;;;;;;;;;;;;CAeC,GACD,OAAO,SAASgH,mBAAmBpD,KAA8B;QAEpCA,oBAGQA,iBACjBA,mBAqBIA;IA1BtB,MAAMC,UAAkC,EAAE;IAC1C,MAAMoD,cAAclE,QAAOa,qBAAAA,MAAMqD,WAAW,YAAjBrD,qBAAqB,IAAItB,IAAI;IACxD,MAAM4E,QAAQ3I,YAAY0I,YAAYF,UAAU,CAAC,QAAQ,CAAC,MAAM,EAAEE,aAAa,GAAGA;IAClF,IAAI,CAACC,MAAM7G,MAAM,EAAE,OAAO;QAAEwD;IAAQ;IACpC,MAAME,WAAWhF,iBAAiB,EAAC6E,kBAAAA,MAAMG,QAAQ,YAAdH,kBAAkB,EAAE,EAAEnB,MAAM,CAACC,SAASR,IAAI,CAAC;IAC9E,MAAM8B,WAAW,EAACJ,oBAAAA,MAAMK,UAAU,YAAhBL,oBAAoB,EAAE,EACrCF,GAAG,CAAC,CAACQ,SAAWnB,OAAOmB,iBAAAA,SAAU,IAAI5B,IAAI,GAAGH,WAAW,GAAGoB,OAAO,CAAC,QAAQ,KAC1Ed,MAAM,CAAC,CAACyB,SAAWA,OAAOf,QAAQ,CAAC;IACtC,MAAMgB,kBAAkB,IAAIjE,IAAI8D,SAASN,GAAG,CAAC9E;IAE7C,KAAK,MAAMyF,QAAQ6C,MAAO;QACxB,MAAMtC,QAAQnG,sBAAsB4F;QACpC,IAAIO,SAAS,CAACpG,kBAAkBoG,OAAOT,kBAAkB;YACvDN,QAAQlD,IAAI,CAAC;gBAAEkE,MAAM;gBAAkBD,OAAOA,MAAME,EAAE;gBAAET;YAAK;QAC/D;IACF;IAEA,6EAA6E;IAC7E,MAAMA,OAAO6C,KAAK,CAAC,EAAE;IACrB,MAAM7B,cAAczG,kBAAkByF;IACtC,MAAM8C,SACJ,CAACnD,SAASnC,IAAI,CAAC,CAACyC,MAAQD,SAASC,OAAOD,KAAKE,QAAQ,CAAC,CAAC,CAAC,EAAED,KAAK,MAC/D,CAACzF,yBAAyBwG,gBAC1B,CAACvG,mBAAmBuG;IACtB,IAAI,CAAC8B,QAAQ,OAAO;QAAEtD;IAAQ;IAE9B,MAAMuD,SAASrE,QAAOa,gBAAAA,MAAMwD,MAAM,YAAZxD,gBAAgB,IAAItB,IAAI;IAC9C,MAAMgB,QAAQ+D,UAAUD;IACxB,MAAMd,OAAOV,WAAWlG,oBAAoB4D;IAC5C,IAAIgD,MAAM;QACRzC,QAAQlD,IAAI,CAAC;YAAEkE,MAAM;YAAoBuC,QAAQA,OAAOzE,KAAK,CAAC,GAAG;YAAM2D,MAAMA,KAAK3D,KAAK,CAAC,GAAG;YAAM0B;QAAK;IACxG;IACA,MAAMiD,UAAUhB,eAAAA,OAAQV,WAAWlH,wBAAwB4E;IAC3D,IAAIgE,SAAS;QACX,MAAM1C,QAAQjG,uBAAuByE,IAAI,CACvC,CAACmE,YACCA,UAAU1B,OAAO,CAACjE,IAAI,CAAC0B,UAAU,CAAChF,oBAAoBiJ,WAAWxD,UAAUI;QAE/E,IAAIS,OAAO;YACTf,QAAQlD,IAAI,CAAC;gBAAEkE,MAAM;gBAAmBD,OAAOA,MAAME,EAAE;gBAAEwB,MAAMgB,QAAQ3E,KAAK,CAAC,GAAG;gBAAM0B;YAAK;QAC7F;IACF;IACA,OAAO;QAAER;IAAQ;AACnB;AAEA,gFAAgF,GAChF,SAASwD,UAAUG,IAAY;IAC7B,IAAIC,UAAUD;IACd,IAAI;QACFC,UAAUC,mBAAmBF;IAC/B,EAAE,eAAM;IACN,uCAAuC;IACzC;IACA,OAAOC,QAAQlE,OAAO,CAAC,gBAAgB,KAAKjB,IAAI;AAClD"}