@aglyn/shared-util-email 1.0.0-beta.256 → 1.0.0-beta.257

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aglyn/shared-util-email",
-  "version": "1.0.0-beta.256",
+  "version": "1.0.0-beta.257",
   "license": "Apache-2.0",
   "homepage": "https://aglyn.com",
   "repository": {
@@ -25,8 +25,8 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@aglyn/shared-data-enums": "1.0.0-beta.256",
-    "@aglyn/shared-util-http": "1.0.0-beta.256",
+    "@aglyn/shared-data-enums": "1.0.0-beta.257",
+    "@aglyn/shared-util-http": "1.0.0-beta.257",
     "@msgpack/msgpack": "^3.1.3",
     "@swc/helpers": "0.5.23"
   },

package/src/lib/hosted-page-screen.js

@@ -84,7 +84,9 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
     'muiCheckbox',
     'muiRadioGroup',
     'muiRadio',
-    'muiRating'
+    'muiRating',
+    'muiDatePicker',
+    'muiTimePicker'
 ]);
 const FORM_CONTROL_COMPONENT = 'muiFormControl';
 const FORM_LABEL_COMPONENT = 'muiFormLabel';

package/src/lib/hosted-page-screen.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/shared/util/email/src/lib/hosted-page-screen.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*==========================================\n * THE HOSTED PAGE SCREEN (AGL-3362).\n *\n * The outbound phishing screen, read over a PUBLISHED PAGE instead of an\n * email: the same brand list, the same lookalike logic, the same tiers\n * (`signalsThatHold`). A fraud actor who could not mail a lure could still\n * host one, and the incident's sibling site published a page at the\n * document-share path `/reviewfile`.\n *\n * Five shapes:\n *\n * 1. **A lookalike link or embed** (`lookalike-link`, STRONG) — any `href`,\n *    `src`, form action or URL in the page's authored content whose host\n *    wears a brand without being the brand's domain.\n * 2. **A credential field** (`credential-field`, STRONG) — a field the\n *    merchant AUTHORED that asks for a password, a card number or a\n *    one-time code: its type, its autocomplete token, or its label,\n *    placeholder or name. The platform's own sign-in, account and checkout\n *    elements render their inputs in code, not in stored props, so they are\n *    never read as a field here — which is exactly the sanctioned/unsanctioned\n *    line: what the platform collects through its own components is\n *    Aglyn's to protect, and what a page's author collects in a form of\n *    their own is not something a site may ask a stranger for.\n * 3. **A brand's call to action** (`brand-action-page`, SOFT) — one element\n *    whose text names a brand that is not the workspace's AND asks the reader\n *    to sign in, verify, confirm or open a document, on a page that links\n *    somewhere that is neither the workspace's, nor a brand's own, nor a\n *    common social or maps link.\n * 4. **A brand's lure, page-wide** (`brand-lure-page`, SOFT, AGL-3447) — the\n *    same brand and link anywhere on the page, beside an account or\n *    document-share LURE anywhere on it (\"Secure Document Access Portal\"), or\n *    a call to action that leaves the site worded as an action (\"Continue to\n *    Document\"). The 2026-10-01 phishing page put Proofpoint's name in its\n *    body, the lure in its heading and the action on its button: three\n *    elements, none of which shape 3 reads on its own. What it does not count page-wide is\n *    a bare \"sign in\" that stays on the site — a hotel that says \"find us on\n *    Booking.com\" in one place and has a member sign-in in another is two\n *    ordinary sentences.\n * 5. **A call to action that leaves, beside a lure** (`offsite-action-page`,\n *    SOFT, AGL-3447) — the page's only call to action, or one worded as an\n *    account or document action, sends visitors to a host that is not the\n *    site's own, a listed brand's or a common link, on a page that carries an\n *    account or document-share lure. No brand needed: a \"Secure Document\n *    Access Portal\" whose one button leaves for the kit is the shape whatever\n *    name it wears.\n *\n * Shapes 3-5 are soft, so they hold only for a workspace in its first\n * fortnight (`signalsThatHold`); an established workspace's page is held by\n * shapes 1 and 2 alone.\n *\n * The same reading applies to a site REDIRECT ({@link screenSiteRedirect}):\n * a rule that sends a path off the site is a page whose one call to action\n * fires on arrival, and its path is the only text it has.\n *\n * Pure: the caller hands over the composed node tree and the workspace's own\n * names and hosts, and decides what a hold does.\n *=========================================*/\n\nimport {\n  ACCOUNT_LURE_PATTERNS,\n  DOCUMENT_SHARE_LURE_PATTERNS,\n  isWorkspaceOwnBrand,\n  linkHostsIn,\n  linkUrlsIn,\n  isBrandsOwnDomain,\n  lookalikeBrandForHost,\n  PHISHING_LURE_PATTERNS,\n  PHISHING_SCREEN_BRANDS,\n  type PhishingScreenBrand,\n  type PhishingScreenSignal,\n  registrableDomain,\n  isAnyOfficialBrandDomain,\n  isCommonLinkDomain,\n  squashScreenText,\n  visibleTextOf,\n} from './outbound-phishing-screen'\n\nexport interface HostedPageScreenInput {\n  /**\n   * The page as it will be served — the composed tree, or any object that\n   * holds nodes (`{ componentId, props }`) at any depth. Walked, never\n   * trusted to have one shape: a screen, a layout's chrome, a grafted\n   * component and a form all arrive together.\n   */\n  nodes: unknown\n  /** The workspace's own names, as `screenOutboundEmail` reads them. */\n  ownNames?: readonly (string | null | undefined)[]\n  /** The workspace's own hosts — a link to one is never \"elsewhere\". */\n  ownDomains?: readonly (string | null | undefined)[]\n}\n\nexport interface HostedPageScreenVerdict {\n  signals: PhishingScreenSignal[]\n  /**\n   * Every host the page (or the redirect) links, embeds or posts to, lowercased — what the\n   * link reputation lookup reads (AGL-3451), so the page is walked once.\n   */\n  linkHosts: string[]\n  /**\n   * The same links whole, as written (`linkUrlsIn`), for the lookup's\n   * `'url'` mode (AGL-3459). Query strings are still on them:\n   * `foreignLinksForReputation` drops them before anything is looked up or\n   * stored.\n   */\n  linkUrls: string[]\n}\n\n/** A node as the walk finds it. */\ninterface WalkedNode {\n  componentId: string\n  props: Record<string, unknown>\n  /** Its stored `$id`, when it has one. */\n  id?: string\n  /** Its stored `parentId`, when it has one (a flat node map). */\n  parentId?: string\n  /** The nearest node it is NESTED in, by walk index (a nested tree). */\n  parentIndex?: number\n}\n\n/** The most a page's text is read to, so a huge page costs a bounded scan. */\nconst MAX_PAGE_TEXT = 2_000_000\n/** The most nodes the walk visits. */\nconst MAX_NODES = 20_000\n\n/**\n * MUI's separate form elements that take an answer (`libs/plugins/mui`\n * form-controls.tsx). Each is a field the author defined, and none carries\n * its own words: those sit BESIDE it, in a Form Label inside the same Form\n * Control or in the Choice Label holding a Checkbox or Radio.\n */\nconst FIELD_ELEMENT_COMPONENTS = new Set([\n  'muiInput',\n  'muiSelect',\n  'muiCheckbox',\n  'muiRadioGroup',\n  'muiRadio',\n  'muiRating',\n])\nconst FORM_CONTROL_COMPONENT = 'muiFormControl'\nconst FORM_LABEL_COMPONENT = 'muiFormLabel'\nconst CHOICE_LABEL_COMPONENT = 'muiFormControlLabel'\n\n/** Props that describe a field the author defined, rather than content. */\nconst FIELD_PROP_KEYS = ['fieldType', 'fieldName', 'inputType', 'autoComplete', 'autocomplete']\n\n/** Autocomplete tokens (WHATWG) that name a credential. */\nconst CREDENTIAL_AUTOCOMPLETE: Record<string, 'password' | 'card' | 'otp'> = {\n  'current-password': 'password',\n  'new-password': 'password',\n  'cc-number': 'card',\n  'cc-csc': 'card',\n  'cc-exp': 'card',\n  'one-time-code': 'otp',\n}\n\n/** Field wording that asks for a credential, by kind. */\nconst CREDENTIAL_LABELS: ReadonlyArray<{ field: 'password' | 'card' | 'otp'; pattern: RegExp }> = [\n  { field: 'password', pattern: /\\bpass\\s?(?:word|code|phrase)s?\\b|\\bpasswd\\b|\\bpin\\s*(?:code|number)?\\s*$/i },\n  {\n    field: 'card',\n    pattern:\n      /\\b(?:credit|debit)\\s*card\\b|\\bcard\\s*(?:number|no\\.?|#)|\\bcardnumber\\b|\\bcvv2?\\b|\\bcvc\\b|\\bcard\\s*security\\s*code\\b|\\bcard\\s*expir/i,\n  },\n  {\n    field: 'otp',\n    pattern:\n      /\\bone[-\\s]?time\\s*(?:pass\\s?code|password|code|pin)\\b|\\botp\\b|\\bverification\\s*code\\b|\\b2fa\\b|\\btwo[-\\s]?factor\\b|\\bauthenticat(?:ion|or)\\s*code\\b|\\bsms\\s*code\\b/i,\n  },\n]\n\n/** Raw HTML an author placed that holds a credential input. */\nconst HTML_CREDENTIAL_INPUTS: ReadonlyArray<{ field: 'password' | 'card' | 'otp'; pattern: RegExp }> = [\n  { field: 'password', pattern: /<input\\b[^>]*\\btype\\s*=\\s*[\"']?password/i },\n  { field: 'password', pattern: /<input\\b[^>]*\\b(?:name|autocomplete)\\s*=\\s*[\"']?(?:pass(?:word|wd)?|current-password|new-password)\\b/i },\n  { field: 'card', pattern: /<input\\b[^>]*\\b(?:name|autocomplete)\\s*=\\s*[\"']?(?:card_?number|cc-number|cc-csc|cvv|cvc)\\b/i },\n  { field: 'otp', pattern: /<input\\b[^>]*\\b(?:name|autocomplete)\\s*=\\s*[\"']?(?:otp|one-time-code|verification_?code)\\b/i },\n]\n\n/**\n * What an element asks its reader to DO with an account or a document —\n * counted beside a brand in the SAME element, or on a call to action that\n * leaves the site. The email lure phrasing counts too.\n */\nconst PAGE_ACTION_PATTERNS: readonly RegExp[] = [\n  /\\b(?:sign|log)[\\s-]?in\\b/i,\n  /\\bverify\\b/i,\n  /\\bconfirm\\s+(?:your|the)\\b/i,\n  /\\bunlock\\b/i,\n  /\\benter\\s+your\\b/i,\n  /\\b(?:view|review|open|download|access)\\s+(?:the\\s+|your\\s+)?(?:shared\\s+|secure\\s+)?(?:file|document|invoice|statement)s?\\b/i,\n  /\\b(?:continue|proceed)\\s+to\\s+(?:the\\s+|your\\s+)?(?:document|file|account|sign[\\s-]?in|log[\\s-]?in)s?\\b/i,\n]\n\n/**\n * The lures a page is read for as a WHOLE (AGL-3447): account and\n * document-share wording. Not the marketplace, booking and parcel lures,\n * which a hotel's \"guest reviews\" and a shop's delivery page carry every day\n * and which still count in one element beside a brand.\n */\nconst PAGE_LURE_PATTERNS: readonly RegExp[] = [...ACCOUNT_LURE_PATTERNS, ...DOCUMENT_SHARE_LURE_PATTERNS]\n\n/**\n * A component that renders a call to action — a button or a link, however a\n * plugin names it (`muiButton`, `muiScreenLink`, `muiLinkBox`). It is one\n * when it carries a target: an `href`, or a `screenId` on the site itself.\n */\nconst CALL_TO_ACTION_COMPONENT = /button|fab|cta|link/i\n\n/** The props a call to action's visible words live in; the first found wins. */\nconst CALL_TO_ACTION_LABEL_KEYS = ['children', 'label', 'text', 'title', 'html']\n\n/** URLs in page text, so prose is read for a brand or a lure without them. */\nconst PROSE_URL_PATTERN = /(?:https?:)?\\/\\/[^\\s\"'<>]+|\\bwww\\.[^\\s\"'<>]+/gi\n\n/** One call to action: what it says, and the host it leaves for (null: it stays). */\ninterface CallToAction {\n  label: string\n  host: string | null\n}\n\n/** Every node in the tree, breadth-first in document order, bounded. */\nfunction walkNodes(root: unknown): WalkedNode[] {\n  const found: WalkedNode[] = []\n  const seen = new Set<unknown>()\n  // Each queued value carries the walk index of the node it is nested in, so\n  // a nested tree knows its parents without stored ids.\n  const stack: Array<{ value: unknown; parentIndex?: number }> = [{ value: root }]\n  for (let head = 0; head < stack.length && found.length < MAX_NODES; head += 1) {\n    const { value, parentIndex } = stack[head] as { value: unknown; parentIndex?: number }\n    if (!value || typeof value !== 'object' || seen.has(value)) continue\n    seen.add(value)\n    const record = value as Record<string, unknown>\n    let enclosing = parentIndex\n    if (typeof record['componentId'] === 'string') {\n      const props = record['props']\n      enclosing = found.length\n      found.push({\n        componentId: record['componentId'] as string,\n        props: props && typeof props === 'object' ? (props as Record<string, unknown>) : {},\n        ...(typeof record['$id'] === 'string' ? { id: record['$id'] } : {}),\n        ...(typeof record['parentId'] === 'string' ? { parentId: record['parentId'] } : {}),\n        ...(parentIndex !== undefined ? { parentIndex } : {}),\n      })\n    }\n    for (const child of Array.isArray(value) ? value : Object.values(record)) {\n      if (child && typeof child === 'object') stack.push({ value: child, parentIndex: enclosing })\n    }\n  }\n  return found\n}\n\n/** Every string a node's props hold, one level of arrays and objects deep. */\nfunction propStrings(props: Record<string, unknown>, skip: ReadonlySet<string> = new Set()): string[] {\n  const out: string[] = []\n  const visit = (value: unknown, depth: number) => {\n    if (typeof value === 'string') out.push(value)\n    else if (depth < 3 && value && typeof value === 'object') {\n      for (const entry of Array.isArray(value) ? value : Object.values(value as Record<string, unknown>)) {\n        visit(entry, depth + 1)\n      }\n    }\n  }\n  for (const [key, value] of Object.entries(props)) {\n    if (key === 'sx' || skip.has(key)) continue\n    visit(value, 0)\n  }\n  return out\n}\n\n/** Does this node describe a field its author defined? */\nfunction isAuthoredField(node: WalkedNode): boolean {\n  if (FIELD_ELEMENT_COMPONENTS.has(node.componentId)) return true\n  if (/field|input/i.test(node.componentId)) return true\n  return FIELD_PROP_KEYS.some((key) => node.props[key] !== undefined)\n}\n\n/**\n * The words BESIDE one of MUI's separate form elements, which carries none of\n * its own: the Choice Label holding a Checkbox or Radio, and the Form Label in\n * the Form Control around it. Read through stored `parentId`s (a flat node\n * map) or through nesting (a tree), whichever the page has.\n */\nfunction siblingLabelOf(nodes: readonly WalkedNode[], index: number): string {\n  const node = nodes[index]\n  if (!node || !FIELD_ELEMENT_COMPONENTS.has(node.componentId)) return ''\n  const byId = new Map<string, number>()\n  nodes.forEach((one, at) => {\n    if (one.id && !byId.has(one.id)) byId.set(one.id, at)\n  })\n  const parentOf = (at: number): number | undefined => {\n    const one = nodes[at]\n    const stored = one?.parentId !== undefined ? byId.get(one.parentId) : undefined\n    return stored !== undefined && stored !== at ? stored : one?.parentIndex\n  }\n  const textOf = (one: WalkedNode | undefined, key: string) =>\n    typeof one?.props[key] === 'string' ? (one.props[key] as string).trim() : ''\n  const words: string[] = []\n  let at = parentOf(index)\n  for (let depth = 0; at !== undefined && depth < 8; depth += 1) {\n    const ancestor = nodes[at]\n    if (ancestor?.componentId === CHOICE_LABEL_COMPONENT && textOf(ancestor, 'label')) {\n      words.push(textOf(ancestor, 'label'))\n    }\n    if (ancestor?.componentId === FORM_CONTROL_COMPONENT) {\n      const control = at\n      const formLabel = nodes.find(\n        (one, oneAt) => one.componentId === FORM_LABEL_COMPONENT && parentOf(oneAt) === control,\n      )\n      if (textOf(formLabel, 'children')) words.unshift(textOf(formLabel, 'children'))\n      break\n    }\n    at = parentOf(at)\n  }\n  return words.join(' ')\n}\n\n/** The credential a field asks for, or null. */\nfunction credentialOf(\n  node: WalkedNode,\n  besideLabel = '',\n): { field: 'password' | 'card' | 'otp'; label: string } | null {\n  const text = (key: string) => (typeof node.props[key] === 'string' ? (node.props[key] as string) : '')\n  const type = [text('fieldType'), text('type'), text('inputType')].join(' ').toLowerCase()\n  const label =\n    text('label') || besideLabel || text('ariaLabel') || text('placeholder') || text('fieldName') || text('name')\n  if (/\\bpassword\\b/.test(type)) return { field: 'password', label: label || 'password' }\n  const autocomplete = (text('autoComplete') || text('autocomplete')).toLowerCase().trim()\n  const byToken = CREDENTIAL_AUTOCOMPLETE[autocomplete]\n  if (byToken) return { field: byToken, label: label || autocomplete }\n  const wording = [\n    text('label'),\n    besideLabel,\n    text('ariaLabel'),\n    text('placeholder'),\n    text('fieldName'),\n    text('name'),\n    text('helperText'),\n  ]\n    .filter(Boolean)\n    .join(' ')\n  for (const { field, pattern } of CREDENTIAL_LABELS) {\n    if (pattern.test(wording)) return { field, label: (label || wording).slice(0, 80) }\n  }\n  return null\n}\n\n/**\n * The credential an input asks for, read from the two attributes that decide\n * it in the browser — its `type` and its `autocomplete` token — or null.\n * For code that builds inputs rather than storing them as page props: the\n * marketplace verifier reads a plugin bundle's `{ type: 'password' }` and\n * `setAttribute('autocomplete', 'cc-number')` with this (AGL-3362).\n */\nexport function credentialForInputAttribute(\n  attribute: string,\n  value: string,\n): 'password' | 'card' | 'otp' | null {\n  const name = String(attribute ?? '').toLowerCase()\n  const token = String(value ?? '').trim().toLowerCase()\n  if ((name === 'type' || name === 'inputtype') && token === 'password') return 'password'\n  if (name === 'autocomplete') return CREDENTIAL_AUTOCOMPLETE[token] ?? null\n  return null\n}\n\n/** The credential a piece of raw HTML asks for in an input of its own, or null. */\nexport function credentialInHtml(html: string): 'password' | 'card' | 'otp' | null {\n  const text = String(html ?? '')\n  if (!text.includes('<')) return null\n  return HTML_CREDENTIAL_INPUTS.find(({ pattern }) => pattern.test(text))?.field ?? null\n}\n\n/**\n * Does a submitted field's NAME ask for a credential — a password, a card\n * number or security code, a one-time code? The same wording the page\n * screen holds a field for, read over a name as a form posts it\n * (`card_number`, `cardNumber`, `one-time-code`).\n *\n * For the one path that does not pass a publish: a public form endpoint\n * takes whatever field names a request carries, so a page the screen never\n * saw (third-party code, a hand-built request) could still post a password\n * to it. The endpoint drops such a field rather than store it.\n */\nexport function isCredentialFieldName(name: string): boolean {\n  const words = String(name ?? '')\n    .replace(/([a-z0-9])([A-Z])/g, '$1 $2')\n    .replace(/[_\\-.[\\]]+/g, ' ')\n    .trim()\n  if (!words) return false\n  if (CREDENTIAL_AUTOCOMPLETE[words.toLowerCase().replace(/\\s+/g, '-')]) return true\n  if (/^(?:pass|pwd|ccnum|cc\\s?num|cc\\s?number|cvv2?|cvc|csc)$/i.test(words)) return true\n  return CREDENTIAL_LABELS.some(({ pattern }) => pattern.test(words))\n}\n\n/** URLs a page carries in a form Links-by-shape would miss: `//host/…`. */\nfunction protocolRelativeUrls(strings: readonly string[]): string {\n  return strings\n    .filter((value) => /^\\/\\/[a-z0-9-]+(?:\\.[a-z0-9-]+)+/i.test(value.trim()))\n    .map((value) => `https:${value.trim()}`)\n    .join('\\n')\n}\n\n/**\n * Screen one page as it will be served. The caller applies the tiers with\n * `signalsThatHold` and decides what a hold does.\n */\nexport function screenHostedPage(input: HostedPageScreenInput): HostedPageScreenVerdict {\n  const signals: PhishingScreenSignal[] = []\n  const nodes = walkNodes(input.nodes)\n  const ownNames = squashScreenText((input.ownNames ?? []).filter(Boolean).join(' '))\n  const ownHosts = (input.ownDomains ?? [])\n    .map((domain) => String(domain ?? '').trim().toLowerCase().replace(/\\.+$/, ''))\n    .filter((domain) => domain.includes('.'))\n  const ownRegistrables = new Set(ownHosts.map(registrableDomain))\n  const isOwnHost = (host: string) => ownHosts.some((own) => host === own || host.endsWith(`.${own}`))\n\n  const nodeStrings = nodes.map((node) => propStrings(node.props))\n  let pageText = nodeStrings.map((strings) => strings.join('\\n')).join('\\n')\n  pageText = `${pageText}\\n${protocolRelativeUrls(nodeStrings.flat())}`.slice(0, MAX_PAGE_TEXT)\n\n  // 1. A lookalike host anywhere the page links, embeds or posts to.\n  const linkHosts = linkHostsIn(pageText)\n  for (const host of linkHosts) {\n    const brand = lookalikeBrandForHost(host)\n    if (brand && !isBrandsOwnDomain(brand, ownRegistrables)) {\n      signals.push({ code: 'lookalike-link', brand: brand.id, host })\n    }\n  }\n\n  // 2. A credential field the page's author defined.\n  const credentialSeen = new Set<string>()\n  const noteCredential = (field: 'password' | 'card' | 'otp', label: string) => {\n    if (credentialSeen.has(field)) return\n    credentialSeen.add(field)\n    signals.push({ code: 'credential-field', field, label: label.slice(0, 80) })\n  }\n  nodes.forEach((node, index) => {\n    if (isAuthoredField(node)) {\n      const credential = credentialOf(node, siblingLabelOf(nodes, index))\n      if (credential) noteCredential(credential.field, credential.label)\n    }\n    for (const html of nodeStrings[index]) {\n      if (!html.includes('<')) continue\n      for (const { field, pattern } of HTML_CREDENTIAL_INPUTS) {\n        if (pattern.test(html)) noteCredential(field, 'an input in the page’s own HTML')\n      }\n    }\n  })\n\n  const isElsewhere = (host: string) => {\n    if (isOwnHost(host)) return false\n    const registrable = registrableDomain(host)\n    return !isAnyOfficialBrandDomain(registrable) && !isCommonLinkDomain(registrable)\n  }\n  const foreign = linkHosts.find(isElsewhere)\n  const actions = [...PAGE_ACTION_PATTERNS, ...PHISHING_LURE_PATTERNS]\n  const named = new Set<string>()\n  const isOthersBrand = (brand: PhishingScreenBrand) =>\n    !named.has(brand.id) && !isWorkspaceOwnBrand(brand, ownNames, ownRegistrables)\n\n  // 3. A brand's call to action, in one element, on a page that links away.\n  if (foreign) {\n    for (const strings of nodeStrings) {\n      const text = proseOf(strings.join(' '))\n      if (!text) continue\n      const action = firstMatch(actions, text)\n      if (!action) continue\n      for (const brand of PHISHING_SCREEN_BRANDS) {\n        if (isOthersBrand(brand) && brand.mention.test(text)) {\n          named.add(brand.id)\n          signals.push({ code: 'brand-action-page', brand: brand.id, action: action.slice(0, 80) })\n        }\n      }\n    }\n  }\n\n  const prose = proseOf(pageText)\n  const pageLure = firstMatch(PAGE_LURE_PATTERNS, prose)\n  const ctas = callsToAction(nodes)\n  const leaving = ctas.filter((cta): cta is CallToAction & { host: string } =>\n    Boolean(cta.host && isElsewhere(cta.host)),\n  )\n  const wordedLeaving = leaving.find((cta) => firstMatch(actions, cta.label))\n\n  // 4. A brand's lure, read over the page as a whole, on a page that links away.\n  const brandLure = pageLure ?? (wordedLeaving ? firstMatch(actions, wordedLeaving.label) : undefined)\n  if (foreign && brandLure) {\n    const host = (wordedLeaving ?? leaving[0])?.host ?? foreign\n    for (const brand of PHISHING_SCREEN_BRANDS) {\n      if (isOthersBrand(brand) && brand.mention.test(prose)) {\n        named.add(brand.id)\n        signals.push({ code: 'brand-lure-page', brand: brand.id, lure: brandLure.slice(0, 120), host })\n      }\n    }\n  }\n\n  // 5. The page's call to action leaves the site, beside a lure. Its only\n  //    one, or the one worded as an account or document action.\n  const primary = wordedLeaving ?? (ctas.length === 1 ? leaving[0] : undefined)\n  if (primary && pageLure) {\n    signals.push({\n      code: 'offsite-action-page',\n      action: (primary.label || primary.host).slice(0, 80),\n      lure: pageLure.slice(0, 120),\n      host: primary.host,\n    })\n  }\n\n  return { signals, linkHosts, linkUrls: linkUrlsIn(pageText) }\n}\n\n/**\n * What a visitor reads in page text: its markup taken out the way the email\n * screen takes it out ({@link visibleTextOf}), so a custom HTML block or a\n * rich-text prop cannot split a brand or a lure letter by letter with tags\n * (AGL-3453), and its bare URLs taken out too. Links are still read from\n * the raw text, where an href lives.\n */\nfunction proseOf(text: string): string {\n  return visibleTextOf(text).replace(PROSE_URL_PATTERN, ' ').replace(/\\s+/g, ' ').trim()\n}\n\n/** The first pattern's match in the text, or undefined. */\nfunction firstMatch(patterns: readonly RegExp[], text: string): string | undefined {\n  if (!text) return undefined\n  for (const pattern of patterns) {\n    const found = text.match(pattern)?.[0]\n    if (found) return found\n  }\n  return undefined\n}\n\n/** The words a call to action shows, from its label prop, markup taken out. */\nfunction callToActionLabel(props: Record<string, unknown>): string {\n  for (const key of CALL_TO_ACTION_LABEL_KEYS) {\n    const value = props[key]\n    if (typeof value === 'string' && value.trim()) {\n      return visibleTextOf(value).split('\\n')[0]\n    }\n  }\n  return ''\n}\n\n/**\n * Every call to action on the page: each button or link that carries a\n * target. A `screenId` is a page of the site and takes precedence over an\n * `href`, as the button renders it; a relative, `mailto:` or `tel:` href has\n * no web host and stays too.\n */\nfunction callsToAction(nodes: readonly WalkedNode[]): CallToAction[] {\n  const found: CallToAction[] = []\n  for (const node of nodes) {\n    if (!CALL_TO_ACTION_COMPONENT.test(node.componentId)) continue\n    const screenId = typeof node.props['screenId'] === 'string' ? node.props['screenId'].trim() : ''\n    const href = typeof node.props['href'] === 'string' ? node.props['href'].trim() : ''\n    if (!screenId && !href) continue\n    const absolute = href.startsWith('//') ? `https:${href}` : href\n    found.push({\n      label: callToActionLabel(node.props),\n      host: screenId ? null : (linkHostsIn(absolute)[0] ?? null),\n    })\n  }\n  return found\n}\n\nexport interface SiteRedirectScreenInput {\n  /** The path the rule answers — `/secure-document` — or its pattern. */\n  source: string\n  /** Where it sends the visitor, after any `$n` substitution. */\n  destination: string\n  /** The workspace's own names, as `screenHostedPage` reads them. */\n  ownNames?: readonly (string | null | undefined)[]\n  /** The workspace's own hosts — a redirect to one never leaves. */\n  ownDomains?: readonly (string | null | undefined)[]\n}\n\n/**\n * Screen one site redirect (AGL-3447): a rule that sends a path off the site\n * is a call to action that fires on arrival, so it is read with the page's\n * rules over the one text it has, its path.\n *\n * - `lookalike-link` (STRONG) — the destination wears a brand it is not.\n * - `offsite-redirect` (SOFT) — the destination is not the site's own, a\n *   listed brand's or a common link, and the path reads as an account or\n *   document-share lure (`/secure-document-access`).\n * - `brand-lure-link` (SOFT) — the same, and the path names a brand that is\n *   not the workspace's (`/paypal-verify-your-account`), the email screen's\n *   three-part lure.\n *\n * The caller applies the tiers with `signalsThatHold`, with the workspace's\n * age, and decides what a hold does.\n */\nexport function screenSiteRedirect(input: SiteRedirectScreenInput): HostedPageScreenVerdict {\n  const signals: PhishingScreenSignal[] = []\n  const destination = String(input.destination ?? '').trim()\n  const absolute = destination.startsWith('//') ? `https:${destination}` : destination\n  const hosts = linkHostsIn(absolute)\n  const linkUrls = linkUrlsIn(absolute)\n  if (!hosts.length) return { signals, linkHosts: hosts, linkUrls }\n  const ownNames = squashScreenText((input.ownNames ?? []).filter(Boolean).join(' '))\n  const ownHosts = (input.ownDomains ?? [])\n    .map((domain) => String(domain ?? '').trim().toLowerCase().replace(/\\.+$/, ''))\n    .filter((domain) => domain.includes('.'))\n  const ownRegistrables = new Set(ownHosts.map(registrableDomain))\n\n  for (const host of hosts) {\n    const brand = lookalikeBrandForHost(host)\n    if (brand && !isBrandsOwnDomain(brand, ownRegistrables)) {\n      signals.push({ code: 'lookalike-link', brand: brand.id, host })\n    }\n  }\n\n  // The first host is where the browser goes; the rest is a userinfo disguise.\n  const host = hosts[0]\n  const registrable = registrableDomain(host)\n  const leaves =\n    !ownHosts.some((own) => host === own || host.endsWith(`.${own}`)) &&\n    !isAnyOfficialBrandDomain(registrable) &&\n    !isCommonLinkDomain(registrable)\n  if (!leaves) return { signals, linkHosts: hosts, linkUrls }\n\n  const source = String(input.source ?? '').trim()\n  const words = pathWords(source)\n  const lure = firstMatch(PAGE_LURE_PATTERNS, words)\n  if (lure) {\n    signals.push({ code: 'offsite-redirect', source: source.slice(0, 120), lure: lure.slice(0, 120), host })\n  }\n  const anyLure = lure ?? firstMatch(PHISHING_LURE_PATTERNS, words)\n  if (anyLure) {\n    const brand = PHISHING_SCREEN_BRANDS.find(\n      (candidate) =>\n        candidate.mention.test(words) && !isWorkspaceOwnBrand(candidate, ownNames, ownRegistrables),\n    )\n    if (brand) {\n      signals.push({ code: 'brand-lure-link', brand: brand.id, lure: anyLure.slice(0, 120), host })\n    }\n  }\n  return { signals, linkHosts: hosts, linkUrls }\n}\n\n/** A path read as words: `/secure-document_access` → `secure document access`. */\nfunction pathWords(path: string): string {\n  let decoded = path\n  try {\n    decoded = decodeURIComponent(path)\n  } catch {\n    // A malformed escape is read as typed.\n  }\n  return decoded.replace(/[^a-z0-9]+/gi, ' ').trim()\n}\n"],"names":["ACCOUNT_LURE_PATTERNS","DOCUMENT_SHARE_LURE_PATTERNS","isWorkspaceOwnBrand","linkHostsIn","linkUrlsIn","isBrandsOwnDomain","lookalikeBrandForHost","PHISHING_LURE_PATTERNS","PHISHING_SCREEN_BRANDS","registrableDomain","isAnyOfficialBrandDomain","isCommonLinkDomain","squashScreenText","visibleTextOf","MAX_PAGE_TEXT","MAX_NODES","FIELD_ELEMENT_COMPONENTS","Set","FORM_CONTROL_COMPONENT","FORM_LABEL_COMPONENT","CHOICE_LABEL_COMPONENT","FIELD_PROP_KEYS","CREDENTIAL_AUTOCOMPLETE","CREDENTIAL_LABELS","field","pattern","HTML_CREDENTIAL_INPUTS","PAGE_ACTION_PATTERNS","PAGE_LURE_PATTERNS","CALL_TO_ACTION_COMPONENT","CALL_TO_ACTION_LABEL_KEYS","PROSE_URL_PATTERN","walkNodes","root","found","seen","stack","value","head","length","parentIndex","has","add","record","enclosing","props","push","componentId","id","parentId","undefined","child","Array","isArray","Object","values","propStrings","skip","out","visit","depth","entry","key","entries","isAuthoredField","node","test","some","siblingLabelOf","nodes","index","byId","Map","forEach","one","at","set","parentOf","stored","get","textOf","trim","words","ancestor","control","formLabel","find","oneAt","unshift","join","credentialOf","besideLabel","text","type","toLowerCase","label","autocomplete","byToken","wording","filter","Boolean","slice","credentialForInputAttribute","attribute","name","String","token","credentialInHtml","html","includes","isCredentialFieldName","replace","protocolRelativeUrls","strings","map","screenHostedPage","input","signals","ownNames","ownHosts","ownDomains","domain","ownRegistrables","isOwnHost","host","own","endsWith","nodeStrings","pageText","flat","linkHosts","brand","code","credentialSeen","noteCredential","credential","isElsewhere","registrable","foreign","actions","named","isOthersBrand","proseOf","action","firstMatch","mention","prose","pageLure","ctas","callsToAction","leaving","cta","wordedLeaving","brandLure","lure","primary","linkUrls","patterns","match","callToActionLabel","split","screenId","href","absolute","startsWith","screenSiteRedirect","destination","hosts","leaves","source","pathWords","anyLure","candidate","path","decoded","decodeURIComponent"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2CAwD2C,GAE3C,SACEA,qBAAqB,EACrBC,4BAA4B,EAC5BC,mBAAmB,EACnBC,WAAW,EACXC,UAAU,EACVC,iBAAiB,EACjBC,qBAAqB,EACrBC,sBAAsB,EACtBC,sBAAsB,EAGtBC,iBAAiB,EACjBC,wBAAwB,EACxBC,kBAAkB,EAClBC,gBAAgB,EAChBC,aAAa,QACR,gCAA4B;AA4CnC,4EAA4E,GAC5E,MAAMC,gBAAgB;AACtB,oCAAoC,GACpC,MAAMC,YAAY;AAElB;;;;;CAKC,GACD,MAAMC,2BAA2B,IAAIC,IAAI;IACvC;IACA;IACA;IACA;IACA;IACA;CACD;AACD,MAAMC,yBAAyB;AAC/B,MAAMC,uBAAuB;AAC7B,MAAMC,yBAAyB;AAE/B,yEAAyE,GACzE,MAAMC,kBAAkB;IAAC;IAAa;IAAa;IAAa;IAAgB;CAAe;AAE/F,yDAAyD,GACzD,MAAMC,0BAAuE;IAC3E,oBAAoB;IACpB,gBAAgB;IAChB,aAAa;IACb,UAAU;IACV,UAAU;IACV,iBAAiB;AACnB;AAEA,uDAAuD,GACvD,MAAMC,oBAA4F;IAChG;QAAEC,OAAO;QAAYC,SAAS;IAA6E;IAC3G;QACED,OAAO;QACPC,SACE;IACJ;IACA;QACED,OAAO;QACPC,SACE;IACJ;CACD;AAED,6DAA6D,GAC7D,MAAMC,yBAAiG;IACrG;QAAEF,OAAO;QAAYC,SAAS;IAA2C;IACzE;QAAED,OAAO;QAAYC,SAAS;IAAwG;IACtI;QAAED,OAAO;QAAQC,SAAS;IAA+F;IACzH;QAAED,OAAO;QAAOC,SAAS;IAA8F;CACxH;AAED;;;;CAIC,GACD,MAAME,uBAA0C;IAC9C;IACA;IACA;IACA;IACA;IACA;IACA;CACD;AAED;;;;;CAKC,GACD,MAAMC,qBAAwC;OAAI5B;OAA0BC;CAA6B;AAEzG;;;;CAIC,GACD,MAAM4B,2BAA2B;AAEjC,8EAA8E,GAC9E,MAAMC,4BAA4B;IAAC;IAAY;IAAS;IAAQ;IAAS;CAAO;AAEhF,4EAA4E,GAC5E,MAAMC,oBAAoB;AAQ1B,sEAAsE,GACtE,SAASC,UAAUC,IAAa;IAC9B,MAAMC,QAAsB,EAAE;IAC9B,MAAMC,OAAO,IAAIlB;IACjB,2EAA2E;IAC3E,sDAAsD;IACtD,MAAMmB,QAAyD;QAAC;YAAEC,OAAOJ;QAAK;KAAE;IAChF,IAAK,IAAIK,OAAO,GAAGA,OAAOF,MAAMG,MAAM,IAAIL,MAAMK,MAAM,GAAGxB,WAAWuB,QAAQ,EAAG;QAC7E,MAAM,EAAED,KAAK,EAAEG,WAAW,EAAE,GAAGJ,KAAK,CAACE,KAAK;QAC1C,IAAI,CAACD,SAAS,OAAOA,UAAU,YAAYF,KAAKM,GAAG,CAACJ,QAAQ;QAC5DF,KAAKO,GAAG,CAACL;QACT,MAAMM,SAASN;QACf,IAAIO,YAAYJ;QAChB,IAAI,OAAOG,MAAM,CAAC,cAAc,KAAK,UAAU;YAC7C,MAAME,QAAQF,MAAM,CAAC,QAAQ;YAC7BC,YAAYV,MAAMK,MAAM;YACxBL,MAAMY,IAAI,CAAC;gBACTC,aAAaJ,MAAM,CAAC,cAAc;gBAClCE,OAAOA,SAAS,OAAOA,UAAU,WAAYA,QAAoC,CAAC;eAC9E,OAAOF,MAAM,CAAC,MAAM,KAAK,WAAW;gBAAEK,IAAIL,MAAM,CAAC,MAAM;YAAC,IAAI,CAAC,GAC7D,OAAOA,MAAM,CAAC,WAAW,KAAK,WAAW;gBAAEM,UAAUN,MAAM,CAAC,WAAW;YAAC,IAAI,CAAC,GAC7EH,gBAAgBU,YAAY;gBAAEV;YAAY,IAAI,CAAC;QAEvD;QACA,KAAK,MAAMW,SAASC,MAAMC,OAAO,CAAChB,SAASA,QAAQiB,OAAOC,MAAM,CAACZ,QAAS;YACxE,IAAIQ,SAAS,OAAOA,UAAU,UAAUf,MAAMU,IAAI,CAAC;gBAAET,OAAOc;gBAAOX,aAAaI;YAAU;QAC5F;IACF;IACA,OAAOV;AACT;AAEA,4EAA4E,GAC5E,SAASsB,YAAYX,KAA8B,EAAEY,OAA4B,IAAIxC,KAAK;IACxF,MAAMyC,MAAgB,EAAE;IACxB,MAAMC,QAAQ,CAACtB,OAAgBuB;QAC7B,IAAI,OAAOvB,UAAU,UAAUqB,IAAIZ,IAAI,CAACT;aACnC,IAAIuB,QAAQ,KAAKvB,SAAS,OAAOA,UAAU,UAAU;YACxD,KAAK,MAAMwB,SAAST,MAAMC,OAAO,CAAChB,SAASA,QAAQiB,OAAOC,MAAM,CAAClB,OAAmC;gBAClGsB,MAAME,OAAOD,QAAQ;YACvB;QACF;IACF;IACA,KAAK,MAAM,CAACE,KAAKzB,MAAM,IAAIiB,OAAOS,OAAO,CAAClB,OAAQ;QAChD,IAAIiB,QAAQ,QAAQL,KAAKhB,GAAG,CAACqB,MAAM;QACnCH,MAAMtB,OAAO;IACf;IACA,OAAOqB;AACT;AAEA,wDAAwD,GACxD,SAASM,gBAAgBC,IAAgB;IACvC,IAAIjD,yBAAyByB,GAAG,CAACwB,KAAKlB,WAAW,GAAG,OAAO;IAC3D,IAAI,eAAemB,IAAI,CAACD,KAAKlB,WAAW,GAAG,OAAO;IAClD,OAAO1B,gBAAgB8C,IAAI,CAAC,CAACL,MAAQG,KAAKpB,KAAK,CAACiB,IAAI,KAAKZ;AAC3D;AAEA;;;;;CAKC,GACD,SAASkB,eAAeC,KAA4B,EAAEC,KAAa;IACjE,MAAML,OAAOI,KAAK,CAACC,MAAM;IACzB,IAAI,CAACL,QAAQ,CAACjD,yBAAyByB,GAAG,CAACwB,KAAKlB,WAAW,GAAG,OAAO;IACrE,MAAMwB,OAAO,IAAIC;IACjBH,MAAMI,OAAO,CAAC,CAACC,KAAKC;QAClB,IAAID,IAAI1B,EAAE,IAAI,CAACuB,KAAK9B,GAAG,CAACiC,IAAI1B,EAAE,GAAGuB,KAAKK,GAAG,CAACF,IAAI1B,EAAE,EAAE2B;IACpD;IACA,MAAME,WAAW,CAACF;QAChB,MAAMD,MAAML,KAAK,CAACM,GAAG;QACrB,MAAMG,SAASJ,CAAAA,uBAAAA,IAAKzB,QAAQ,MAAKC,YAAYqB,KAAKQ,GAAG,CAACL,IAAIzB,QAAQ,IAAIC;QACtE,OAAO4B,WAAW5B,aAAa4B,WAAWH,KAAKG,SAASJ,uBAAAA,IAAKlC,WAAW;IAC1E;IACA,MAAMwC,SAAS,CAACN,KAA6BZ,MAC3C,QAAOY,uBAAAA,IAAK7B,KAAK,CAACiB,IAAI,MAAK,WAAW,AAACY,IAAI7B,KAAK,CAACiB,IAAI,CAAYmB,IAAI,KAAK;IAC5E,MAAMC,QAAkB,EAAE;IAC1B,IAAIP,KAAKE,SAASP;IAClB,IAAK,IAAIV,QAAQ,GAAGe,OAAOzB,aAAaU,QAAQ,GAAGA,SAAS,EAAG;QAC7D,MAAMuB,WAAWd,KAAK,CAACM,GAAG;QAC1B,IAAIQ,CAAAA,4BAAAA,SAAUpC,WAAW,MAAK3B,0BAA0B4D,OAAOG,UAAU,UAAU;YACjFD,MAAMpC,IAAI,CAACkC,OAAOG,UAAU;QAC9B;QACA,IAAIA,CAAAA,4BAAAA,SAAUpC,WAAW,MAAK7B,wBAAwB;YACpD,MAAMkE,UAAUT;YAChB,MAAMU,YAAYhB,MAAMiB,IAAI,CAC1B,CAACZ,KAAKa,QAAUb,IAAI3B,WAAW,KAAK5B,wBAAwB0D,SAASU,WAAWH;YAElF,IAAIJ,OAAOK,WAAW,aAAaH,MAAMM,OAAO,CAACR,OAAOK,WAAW;YACnE;QACF;QACAV,KAAKE,SAASF;IAChB;IACA,OAAOO,MAAMO,IAAI,CAAC;AACpB;AAEA,8CAA8C,GAC9C,SAASC,aACPzB,IAAgB,EAChB0B,cAAc,EAAE;IAEhB,MAAMC,OAAO,CAAC9B,MAAiB,OAAOG,KAAKpB,KAAK,CAACiB,IAAI,KAAK,WAAYG,KAAKpB,KAAK,CAACiB,IAAI,GAAc;IACnG,MAAM+B,OAAO;QAACD,KAAK;QAAcA,KAAK;QAASA,KAAK;KAAa,CAACH,IAAI,CAAC,KAAKK,WAAW;IACvF,MAAMC,QACJH,KAAK,YAAYD,eAAeC,KAAK,gBAAgBA,KAAK,kBAAkBA,KAAK,gBAAgBA,KAAK;IACxG,IAAI,eAAe1B,IAAI,CAAC2B,OAAO,OAAO;QAAErE,OAAO;QAAYuE,OAAOA,SAAS;IAAW;IACtF,MAAMC,eAAe,AAACJ,CAAAA,KAAK,mBAAmBA,KAAK,eAAc,EAAGE,WAAW,GAAGb,IAAI;IACtF,MAAMgB,UAAU3E,uBAAuB,CAAC0E,aAAa;IACrD,IAAIC,SAAS,OAAO;QAAEzE,OAAOyE;QAASF,OAAOA,SAASC;IAAa;IACnE,MAAME,UAAU;QACdN,KAAK;QACLD;QACAC,KAAK;QACLA,KAAK;QACLA,KAAK;QACLA,KAAK;QACLA,KAAK;KACN,CACEO,MAAM,CAACC,SACPX,IAAI,CAAC;IACR,KAAK,MAAM,EAAEjE,KAAK,EAAEC,OAAO,EAAE,IAAIF,kBAAmB;QAClD,IAAIE,QAAQyC,IAAI,CAACgC,UAAU,OAAO;YAAE1E;YAAOuE,OAAO,AAACA,CAAAA,SAASG,OAAM,EAAGG,KAAK,CAAC,GAAG;QAAI;IACpF;IACA,OAAO;AACT;AAEA;;;;;;CAMC,GACD,OAAO,SAASC,4BACdC,SAAiB,EACjBlE,KAAa;QAKuBf;IAHpC,MAAMkF,OAAOC,OAAOF,oBAAAA,YAAa,IAAIT,WAAW;IAChD,MAAMY,QAAQD,OAAOpE,gBAAAA,QAAS,IAAI4C,IAAI,GAAGa,WAAW;IACpD,IAAI,AAACU,CAAAA,SAAS,UAAUA,SAAS,WAAU,KAAME,UAAU,YAAY,OAAO;IAC9E,IAAIF,SAAS,gBAAgB,QAAOlF,iCAAAA,uBAAuB,CAACoF,MAAM,YAA9BpF,iCAAkC;IACtE,OAAO;AACT;AAEA,iFAAiF,GACjF,OAAO,SAASqF,iBAAiBC,IAAY;;QAGpClF;IAFP,MAAMkE,OAAOa,OAAOG,eAAAA,OAAQ;IAC5B,IAAI,CAAChB,KAAKiB,QAAQ,CAAC,MAAM,OAAO;IAChC,gBAAOnF,+BAAAA,uBAAuB4D,IAAI,CAAC,CAAC,EAAE7D,OAAO,EAAE,GAAKA,QAAQyC,IAAI,CAAC0B,2BAA1DlE,6BAAkEF,KAAK,mBAAI;AACpF;AAEA;;;;;;;;;;CAUC,GACD,OAAO,SAASsF,sBAAsBN,IAAY;IAChD,MAAMtB,QAAQuB,OAAOD,eAAAA,OAAQ,IAC1BO,OAAO,CAAC,sBAAsB,SAC9BA,OAAO,CAAC,eAAe,KACvB9B,IAAI;IACP,IAAI,CAACC,OAAO,OAAO;IACnB,IAAI5D,uBAAuB,CAAC4D,MAAMY,WAAW,GAAGiB,OAAO,CAAC,QAAQ,KAAK,EAAE,OAAO;IAC9E,IAAI,2DAA2D7C,IAAI,CAACgB,QAAQ,OAAO;IACnF,OAAO3D,kBAAkB4C,IAAI,CAAC,CAAC,EAAE1C,OAAO,EAAE,GAAKA,QAAQyC,IAAI,CAACgB;AAC9D;AAEA,yEAAyE,GACzE,SAAS8B,qBAAqBC,OAA0B;IACtD,OAAOA,QACJd,MAAM,CAAC,CAAC9D,QAAU,oCAAoC6B,IAAI,CAAC7B,MAAM4C,IAAI,KACrEiC,GAAG,CAAC,CAAC7E,QAAU,CAAC,MAAM,EAAEA,MAAM4C,IAAI,IAAI,EACtCQ,IAAI,CAAC;AACV;AAEA;;;CAGC,GACD,OAAO,SAAS0B,iBAAiBC,KAA4B;QAGxBA,iBACjBA;IAHlB,MAAMC,UAAkC,EAAE;IAC1C,MAAMhD,QAAQrC,UAAUoF,MAAM/C,KAAK;IACnC,MAAMiD,WAAW1G,iBAAiB,EAACwG,kBAAAA,MAAME,QAAQ,YAAdF,kBAAkB,EAAE,EAAEjB,MAAM,CAACC,SAASX,IAAI,CAAC;IAC9E,MAAM8B,WAAW,EAACH,oBAAAA,MAAMI,UAAU,YAAhBJ,oBAAoB,EAAE,EACrCF,GAAG,CAAC,CAACO,SAAWhB,OAAOgB,iBAAAA,SAAU,IAAIxC,IAAI,GAAGa,WAAW,GAAGiB,OAAO,CAAC,QAAQ,KAC1EZ,MAAM,CAAC,CAACsB,SAAWA,OAAOZ,QAAQ,CAAC;IACtC,MAAMa,kBAAkB,IAAIzG,IAAIsG,SAASL,GAAG,CAACzG;IAC7C,MAAMkH,YAAY,CAACC,OAAiBL,SAASpD,IAAI,CAAC,CAAC0D,MAAQD,SAASC,OAAOD,KAAKE,QAAQ,CAAC,CAAC,CAAC,EAAED,KAAK;IAElG,MAAME,cAAc1D,MAAM6C,GAAG,CAAC,CAACjD,OAAST,YAAYS,KAAKpB,KAAK;IAC9D,IAAImF,WAAWD,YAAYb,GAAG,CAAC,CAACD,UAAYA,QAAQxB,IAAI,CAAC,OAAOA,IAAI,CAAC;IACrEuC,WAAW,GAAGA,SAAS,EAAE,EAAEhB,qBAAqBe,YAAYE,IAAI,KAAK,CAAC5B,KAAK,CAAC,GAAGvF;IAE/E,mEAAmE;IACnE,MAAMoH,YAAY/H,YAAY6H;IAC9B,KAAK,MAAMJ,QAAQM,UAAW;QAC5B,MAAMC,QAAQ7H,sBAAsBsH;QACpC,IAAIO,SAAS,CAAC9H,kBAAkB8H,OAAOT,kBAAkB;YACvDL,QAAQvE,IAAI,CAAC;gBAAEsF,MAAM;gBAAkBD,OAAOA,MAAMnF,EAAE;gBAAE4E;YAAK;QAC/D;IACF;IAEA,mDAAmD;IACnD,MAAMS,iBAAiB,IAAIpH;IAC3B,MAAMqH,iBAAiB,CAAC9G,OAAoCuE;QAC1D,IAAIsC,eAAe5F,GAAG,CAACjB,QAAQ;QAC/B6G,eAAe3F,GAAG,CAAClB;QACnB6F,QAAQvE,IAAI,CAAC;YAAEsF,MAAM;YAAoB5G;YAAOuE,OAAOA,MAAMM,KAAK,CAAC,GAAG;QAAI;IAC5E;IACAhC,MAAMI,OAAO,CAAC,CAACR,MAAMK;QACnB,IAAIN,gBAAgBC,OAAO;YACzB,MAAMsE,aAAa7C,aAAazB,MAAMG,eAAeC,OAAOC;YAC5D,IAAIiE,YAAYD,eAAeC,WAAW/G,KAAK,EAAE+G,WAAWxC,KAAK;QACnE;QACA,KAAK,MAAMa,QAAQmB,WAAW,CAACzD,MAAM,CAAE;YACrC,IAAI,CAACsC,KAAKC,QAAQ,CAAC,MAAM;YACzB,KAAK,MAAM,EAAErF,KAAK,EAAEC,OAAO,EAAE,IAAIC,uBAAwB;gBACvD,IAAID,QAAQyC,IAAI,CAAC0C,OAAO0B,eAAe9G,OAAO;YAChD;QACF;IACF;IAEA,MAAMgH,cAAc,CAACZ;QACnB,IAAID,UAAUC,OAAO,OAAO;QAC5B,MAAMa,cAAchI,kBAAkBmH;QACtC,OAAO,CAAClH,yBAAyB+H,gBAAgB,CAAC9H,mBAAmB8H;IACvE;IACA,MAAMC,UAAUR,UAAU5C,IAAI,CAACkD;IAC/B,MAAMG,UAAU;WAAIhH;WAAyBpB;KAAuB;IACpE,MAAMqI,QAAQ,IAAI3H;IAClB,MAAM4H,gBAAgB,CAACV,QACrB,CAACS,MAAMnG,GAAG,CAAC0F,MAAMnF,EAAE,KAAK,CAAC9C,oBAAoBiI,OAAOb,UAAUI;IAEhE,0EAA0E;IAC1E,IAAIgB,SAAS;QACX,KAAK,MAAMzB,WAAWc,YAAa;YACjC,MAAMnC,OAAOkD,QAAQ7B,QAAQxB,IAAI,CAAC;YAClC,IAAI,CAACG,MAAM;YACX,MAAMmD,SAASC,WAAWL,SAAS/C;YACnC,IAAI,CAACmD,QAAQ;YACb,KAAK,MAAMZ,SAAS3H,uBAAwB;gBAC1C,IAAIqI,cAAcV,UAAUA,MAAMc,OAAO,CAAC/E,IAAI,CAAC0B,OAAO;oBACpDgD,MAAMlG,GAAG,CAACyF,MAAMnF,EAAE;oBAClBqE,QAAQvE,IAAI,CAAC;wBAAEsF,MAAM;wBAAqBD,OAAOA,MAAMnF,EAAE;wBAAE+F,QAAQA,OAAO1C,KAAK,CAAC,GAAG;oBAAI;gBACzF;YACF;QACF;IACF;IAEA,MAAM6C,QAAQJ,QAAQd;IACtB,MAAMmB,WAAWH,WAAWpH,oBAAoBsH;IAChD,MAAME,OAAOC,cAAchF;IAC3B,MAAMiF,UAAUF,KAAKjD,MAAM,CAAC,CAACoD,MAC3BnD,QAAQmD,IAAI3B,IAAI,IAAIY,YAAYe,IAAI3B,IAAI;IAE1C,MAAM4B,gBAAgBF,QAAQhE,IAAI,CAAC,CAACiE,MAAQP,WAAWL,SAASY,IAAIxD,KAAK;IAEzE,+EAA+E;IAC/E,MAAM0D,YAAYN,mBAAAA,WAAaK,gBAAgBR,WAAWL,SAASa,cAAczD,KAAK,IAAI7C;IAC1F,IAAIwF,WAAWe,WAAW;;YACVD;QAAd,MAAM5B,gBAAQ4B,QAAAA,wBAAAA,gBAAiBF,OAAO,CAAC,EAAE,qBAA5B,AAACE,MAA8B5B,IAAI,mBAAIc;QACpD,KAAK,MAAMP,SAAS3H,uBAAwB;YAC1C,IAAIqI,cAAcV,UAAUA,MAAMc,OAAO,CAAC/E,IAAI,CAACgF,QAAQ;gBACrDN,MAAMlG,GAAG,CAACyF,MAAMnF,EAAE;gBAClBqE,QAAQvE,IAAI,CAAC;oBAAEsF,MAAM;oBAAmBD,OAAOA,MAAMnF,EAAE;oBAAE0G,MAAMD,UAAUpD,KAAK,CAAC,GAAG;oBAAMuB;gBAAK;YAC/F;QACF;IACF;IAEA,wEAAwE;IACxE,8DAA8D;IAC9D,MAAM+B,UAAUH,wBAAAA,gBAAkBJ,KAAK7G,MAAM,KAAK,IAAI+G,OAAO,CAAC,EAAE,GAAGpG;IACnE,IAAIyG,WAAWR,UAAU;QACvB9B,QAAQvE,IAAI,CAAC;YACXsF,MAAM;YACNW,QAAQ,AAACY,CAAAA,QAAQ5D,KAAK,IAAI4D,QAAQ/B,IAAI,AAAD,EAAGvB,KAAK,CAAC,GAAG;YACjDqD,MAAMP,SAAS9C,KAAK,CAAC,GAAG;YACxBuB,MAAM+B,QAAQ/B,IAAI;QACpB;IACF;IAEA,OAAO;QAAEP;QAASa;QAAW0B,UAAUxJ,WAAW4H;IAAU;AAC9D;AAEA;;;;;;CAMC,GACD,SAASc,QAAQlD,IAAY;IAC3B,OAAO/E,cAAc+E,MAAMmB,OAAO,CAAChF,mBAAmB,KAAKgF,OAAO,CAAC,QAAQ,KAAK9B,IAAI;AACtF;AAEA,yDAAyD,GACzD,SAAS+D,WAAWa,QAA2B,EAAEjE,IAAY;IAC3D,IAAI,CAACA,MAAM,OAAO1C;IAClB,KAAK,MAAMzB,WAAWoI,SAAU;YAChBjE;QAAd,MAAM1D,SAAQ0D,cAAAA,KAAKkE,KAAK,CAACrI,6BAAXmE,WAAqB,CAAC,EAAE;QACtC,IAAI1D,OAAO,OAAOA;IACpB;IACA,OAAOgB;AACT;AAEA,6EAA6E,GAC7E,SAAS6G,kBAAkBlH,KAA8B;IACvD,KAAK,MAAMiB,OAAOhC,0BAA2B;QAC3C,MAAMO,QAAQQ,KAAK,CAACiB,IAAI;QACxB,IAAI,OAAOzB,UAAU,YAAYA,MAAM4C,IAAI,IAAI;YAC7C,OAAOpE,cAAcwB,OAAO2H,KAAK,CAAC,KAAK,CAAC,EAAE;QAC5C;IACF;IACA,OAAO;AACT;AAEA;;;;;CAKC,GACD,SAASX,cAAchF,KAA4B;IACjD,MAAMnC,QAAwB,EAAE;IAChC,KAAK,MAAM+B,QAAQI,MAAO;YAQGlE;QAP3B,IAAI,CAAC0B,yBAAyBqC,IAAI,CAACD,KAAKlB,WAAW,GAAG;QACtD,MAAMkH,WAAW,OAAOhG,KAAKpB,KAAK,CAAC,WAAW,KAAK,WAAWoB,KAAKpB,KAAK,CAAC,WAAW,CAACoC,IAAI,KAAK;QAC9F,MAAMiF,OAAO,OAAOjG,KAAKpB,KAAK,CAAC,OAAO,KAAK,WAAWoB,KAAKpB,KAAK,CAAC,OAAO,CAACoC,IAAI,KAAK;QAClF,IAAI,CAACgF,YAAY,CAACC,MAAM;QACxB,MAAMC,WAAWD,KAAKE,UAAU,CAAC,QAAQ,CAAC,MAAM,EAAEF,MAAM,GAAGA;QAC3DhI,MAAMY,IAAI,CAAC;YACTiD,OAAOgE,kBAAkB9F,KAAKpB,KAAK;YACnC+E,MAAMqC,WAAW,QAAQ9J,gBAAAA,YAAYgK,SAAS,CAAC,EAAE,YAAxBhK,gBAA4B;QACvD;IACF;IACA,OAAO+B;AACT;AAaA;;;;;;;;;;;;;;;CAeC,GACD,OAAO,SAASmI,mBAAmBjD,KAA8B;QAEpCA,oBAKQA,iBACjBA,mBAqBIA;IA5BtB,MAAMC,UAAkC,EAAE;IAC1C,MAAMiD,cAAc7D,QAAOW,qBAAAA,MAAMkD,WAAW,YAAjBlD,qBAAqB,IAAInC,IAAI;IACxD,MAAMkF,WAAWG,YAAYF,UAAU,CAAC,QAAQ,CAAC,MAAM,EAAEE,aAAa,GAAGA;IACzE,MAAMC,QAAQpK,YAAYgK;IAC1B,MAAMP,WAAWxJ,WAAW+J;IAC5B,IAAI,CAACI,MAAMhI,MAAM,EAAE,OAAO;QAAE8E;QAASa,WAAWqC;QAAOX;IAAS;IAChE,MAAMtC,WAAW1G,iBAAiB,EAACwG,kBAAAA,MAAME,QAAQ,YAAdF,kBAAkB,EAAE,EAAEjB,MAAM,CAACC,SAASX,IAAI,CAAC;IAC9E,MAAM8B,WAAW,EAACH,oBAAAA,MAAMI,UAAU,YAAhBJ,oBAAoB,EAAE,EACrCF,GAAG,CAAC,CAACO,SAAWhB,OAAOgB,iBAAAA,SAAU,IAAIxC,IAAI,GAAGa,WAAW,GAAGiB,OAAO,CAAC,QAAQ,KAC1EZ,MAAM,CAAC,CAACsB,SAAWA,OAAOZ,QAAQ,CAAC;IACtC,MAAMa,kBAAkB,IAAIzG,IAAIsG,SAASL,GAAG,CAACzG;IAE7C,KAAK,MAAMmH,QAAQ2C,MAAO;QACxB,MAAMpC,QAAQ7H,sBAAsBsH;QACpC,IAAIO,SAAS,CAAC9H,kBAAkB8H,OAAOT,kBAAkB;YACvDL,QAAQvE,IAAI,CAAC;gBAAEsF,MAAM;gBAAkBD,OAAOA,MAAMnF,EAAE;gBAAE4E;YAAK;QAC/D;IACF;IAEA,6EAA6E;IAC7E,MAAMA,OAAO2C,KAAK,CAAC,EAAE;IACrB,MAAM9B,cAAchI,kBAAkBmH;IACtC,MAAM4C,SACJ,CAACjD,SAASpD,IAAI,CAAC,CAAC0D,MAAQD,SAASC,OAAOD,KAAKE,QAAQ,CAAC,CAAC,CAAC,EAAED,KAAK,MAC/D,CAACnH,yBAAyB+H,gBAC1B,CAAC9H,mBAAmB8H;IACtB,IAAI,CAAC+B,QAAQ,OAAO;QAAEnD;QAASa,WAAWqC;QAAOX;IAAS;IAE1D,MAAMa,SAAShE,QAAOW,gBAAAA,MAAMqD,MAAM,YAAZrD,gBAAgB,IAAInC,IAAI;IAC9C,MAAMC,QAAQwF,UAAUD;IACxB,MAAMf,OAAOV,WAAWpH,oBAAoBsD;IAC5C,IAAIwE,MAAM;QACRrC,QAAQvE,IAAI,CAAC;YAAEsF,MAAM;YAAoBqC,QAAQA,OAAOpE,KAAK,CAAC,GAAG;YAAMqD,MAAMA,KAAKrD,KAAK,CAAC,GAAG;YAAMuB;QAAK;IACxG;IACA,MAAM+C,UAAUjB,eAAAA,OAAQV,WAAWzI,wBAAwB2E;IAC3D,IAAIyF,SAAS;QACX,MAAMxC,QAAQ3H,uBAAuB8E,IAAI,CACvC,CAACsF,YACCA,UAAU3B,OAAO,CAAC/E,IAAI,CAACgB,UAAU,CAAChF,oBAAoB0K,WAAWtD,UAAUI;QAE/E,IAAIS,OAAO;YACTd,QAAQvE,IAAI,CAAC;gBAAEsF,MAAM;gBAAmBD,OAAOA,MAAMnF,EAAE;gBAAE0G,MAAMiB,QAAQtE,KAAK,CAAC,GAAG;gBAAMuB;YAAK;QAC7F;IACF;IACA,OAAO;QAAEP;QAASa,WAAWqC;QAAOX;IAAS;AAC/C;AAEA,gFAAgF,GAChF,SAASc,UAAUG,IAAY;IAC7B,IAAIC,UAAUD;IACd,IAAI;QACFC,UAAUC,mBAAmBF;IAC/B,EAAE,eAAM;IACN,uCAAuC;IACzC;IACA,OAAOC,QAAQ/D,OAAO,CAAC,gBAAgB,KAAK9B,IAAI;AAClD"}
+{"version":3,"sources":["../../../../../../../libs/shared/util/email/src/lib/hosted-page-screen.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*==========================================\n * THE HOSTED PAGE SCREEN (AGL-3362).\n *\n * The outbound phishing screen, read over a PUBLISHED PAGE instead of an\n * email: the same brand list, the same lookalike logic, the same tiers\n * (`signalsThatHold`). A fraud actor who could not mail a lure could still\n * host one, and the incident's sibling site published a page at the\n * document-share path `/reviewfile`.\n *\n * Five shapes:\n *\n * 1. **A lookalike link or embed** (`lookalike-link`, STRONG) — any `href`,\n *    `src`, form action or URL in the page's authored content whose host\n *    wears a brand without being the brand's domain.\n * 2. **A credential field** (`credential-field`, STRONG) — a field the\n *    merchant AUTHORED that asks for a password, a card number or a\n *    one-time code: its type, its autocomplete token, or its label,\n *    placeholder or name. The platform's own sign-in, account and checkout\n *    elements render their inputs in code, not in stored props, so they are\n *    never read as a field here — which is exactly the sanctioned/unsanctioned\n *    line: what the platform collects through its own components is\n *    Aglyn's to protect, and what a page's author collects in a form of\n *    their own is not something a site may ask a stranger for.\n * 3. **A brand's call to action** (`brand-action-page`, SOFT) — one element\n *    whose text names a brand that is not the workspace's AND asks the reader\n *    to sign in, verify, confirm or open a document, on a page that links\n *    somewhere that is neither the workspace's, nor a brand's own, nor a\n *    common social or maps link.\n * 4. **A brand's lure, page-wide** (`brand-lure-page`, SOFT, AGL-3447) — the\n *    same brand and link anywhere on the page, beside an account or\n *    document-share LURE anywhere on it (\"Secure Document Access Portal\"), or\n *    a call to action that leaves the site worded as an action (\"Continue to\n *    Document\"). The 2026-10-01 phishing page put Proofpoint's name in its\n *    body, the lure in its heading and the action on its button: three\n *    elements, none of which shape 3 reads on its own. What it does not count page-wide is\n *    a bare \"sign in\" that stays on the site — a hotel that says \"find us on\n *    Booking.com\" in one place and has a member sign-in in another is two\n *    ordinary sentences.\n * 5. **A call to action that leaves, beside a lure** (`offsite-action-page`,\n *    SOFT, AGL-3447) — the page's only call to action, or one worded as an\n *    account or document action, sends visitors to a host that is not the\n *    site's own, a listed brand's or a common link, on a page that carries an\n *    account or document-share lure. No brand needed: a \"Secure Document\n *    Access Portal\" whose one button leaves for the kit is the shape whatever\n *    name it wears.\n *\n * Shapes 3-5 are soft, so they hold only for a workspace in its first\n * fortnight (`signalsThatHold`); an established workspace's page is held by\n * shapes 1 and 2 alone.\n *\n * The same reading applies to a site REDIRECT ({@link screenSiteRedirect}):\n * a rule that sends a path off the site is a page whose one call to action\n * fires on arrival, and its path is the only text it has.\n *\n * Pure: the caller hands over the composed node tree and the workspace's own\n * names and hosts, and decides what a hold does.\n *=========================================*/\n\nimport {\n  ACCOUNT_LURE_PATTERNS,\n  DOCUMENT_SHARE_LURE_PATTERNS,\n  isWorkspaceOwnBrand,\n  linkHostsIn,\n  linkUrlsIn,\n  isBrandsOwnDomain,\n  lookalikeBrandForHost,\n  PHISHING_LURE_PATTERNS,\n  PHISHING_SCREEN_BRANDS,\n  type PhishingScreenBrand,\n  type PhishingScreenSignal,\n  registrableDomain,\n  isAnyOfficialBrandDomain,\n  isCommonLinkDomain,\n  squashScreenText,\n  visibleTextOf,\n} from './outbound-phishing-screen'\n\nexport interface HostedPageScreenInput {\n  /**\n   * The page as it will be served — the composed tree, or any object that\n   * holds nodes (`{ componentId, props }`) at any depth. Walked, never\n   * trusted to have one shape: a screen, a layout's chrome, a grafted\n   * component and a form all arrive together.\n   */\n  nodes: unknown\n  /** The workspace's own names, as `screenOutboundEmail` reads them. */\n  ownNames?: readonly (string | null | undefined)[]\n  /** The workspace's own hosts — a link to one is never \"elsewhere\". */\n  ownDomains?: readonly (string | null | undefined)[]\n}\n\nexport interface HostedPageScreenVerdict {\n  signals: PhishingScreenSignal[]\n  /**\n   * Every host the page (or the redirect) links, embeds or posts to, lowercased — what the\n   * link reputation lookup reads (AGL-3451), so the page is walked once.\n   */\n  linkHosts: string[]\n  /**\n   * The same links whole, as written (`linkUrlsIn`), for the lookup's\n   * `'url'` mode (AGL-3459). Query strings are still on them:\n   * `foreignLinksForReputation` drops them before anything is looked up or\n   * stored.\n   */\n  linkUrls: string[]\n}\n\n/** A node as the walk finds it. */\ninterface WalkedNode {\n  componentId: string\n  props: Record<string, unknown>\n  /** Its stored `$id`, when it has one. */\n  id?: string\n  /** Its stored `parentId`, when it has one (a flat node map). */\n  parentId?: string\n  /** The nearest node it is NESTED in, by walk index (a nested tree). */\n  parentIndex?: number\n}\n\n/** The most a page's text is read to, so a huge page costs a bounded scan. */\nconst MAX_PAGE_TEXT = 2_000_000\n/** The most nodes the walk visits. */\nconst MAX_NODES = 20_000\n\n/**\n * MUI's separate form elements that take an answer (`libs/plugins/mui`\n * form-controls.tsx). Each is a field the author defined, and none carries\n * its own words: those sit BESIDE it, in a Form Label inside the same Form\n * Control or in the Choice Label holding a Checkbox or Radio.\n */\nconst FIELD_ELEMENT_COMPONENTS = new Set([\n  'muiInput',\n  'muiSelect',\n  'muiCheckbox',\n  'muiRadioGroup',\n  'muiRadio',\n  'muiRating',\n  'muiDatePicker',\n  'muiTimePicker',\n])\nconst FORM_CONTROL_COMPONENT = 'muiFormControl'\nconst FORM_LABEL_COMPONENT = 'muiFormLabel'\nconst CHOICE_LABEL_COMPONENT = 'muiFormControlLabel'\n\n/** Props that describe a field the author defined, rather than content. */\nconst FIELD_PROP_KEYS = ['fieldType', 'fieldName', 'inputType', 'autoComplete', 'autocomplete']\n\n/** Autocomplete tokens (WHATWG) that name a credential. */\nconst CREDENTIAL_AUTOCOMPLETE: Record<string, 'password' | 'card' | 'otp'> = {\n  'current-password': 'password',\n  'new-password': 'password',\n  'cc-number': 'card',\n  'cc-csc': 'card',\n  'cc-exp': 'card',\n  'one-time-code': 'otp',\n}\n\n/** Field wording that asks for a credential, by kind. */\nconst CREDENTIAL_LABELS: ReadonlyArray<{ field: 'password' | 'card' | 'otp'; pattern: RegExp }> = [\n  { field: 'password', pattern: /\\bpass\\s?(?:word|code|phrase)s?\\b|\\bpasswd\\b|\\bpin\\s*(?:code|number)?\\s*$/i },\n  {\n    field: 'card',\n    pattern:\n      /\\b(?:credit|debit)\\s*card\\b|\\bcard\\s*(?:number|no\\.?|#)|\\bcardnumber\\b|\\bcvv2?\\b|\\bcvc\\b|\\bcard\\s*security\\s*code\\b|\\bcard\\s*expir/i,\n  },\n  {\n    field: 'otp',\n    pattern:\n      /\\bone[-\\s]?time\\s*(?:pass\\s?code|password|code|pin)\\b|\\botp\\b|\\bverification\\s*code\\b|\\b2fa\\b|\\btwo[-\\s]?factor\\b|\\bauthenticat(?:ion|or)\\s*code\\b|\\bsms\\s*code\\b/i,\n  },\n]\n\n/** Raw HTML an author placed that holds a credential input. */\nconst HTML_CREDENTIAL_INPUTS: ReadonlyArray<{ field: 'password' | 'card' | 'otp'; pattern: RegExp }> = [\n  { field: 'password', pattern: /<input\\b[^>]*\\btype\\s*=\\s*[\"']?password/i },\n  { field: 'password', pattern: /<input\\b[^>]*\\b(?:name|autocomplete)\\s*=\\s*[\"']?(?:pass(?:word|wd)?|current-password|new-password)\\b/i },\n  { field: 'card', pattern: /<input\\b[^>]*\\b(?:name|autocomplete)\\s*=\\s*[\"']?(?:card_?number|cc-number|cc-csc|cvv|cvc)\\b/i },\n  { field: 'otp', pattern: /<input\\b[^>]*\\b(?:name|autocomplete)\\s*=\\s*[\"']?(?:otp|one-time-code|verification_?code)\\b/i },\n]\n\n/**\n * What an element asks its reader to DO with an account or a document —\n * counted beside a brand in the SAME element, or on a call to action that\n * leaves the site. The email lure phrasing counts too.\n */\nconst PAGE_ACTION_PATTERNS: readonly RegExp[] = [\n  /\\b(?:sign|log)[\\s-]?in\\b/i,\n  /\\bverify\\b/i,\n  /\\bconfirm\\s+(?:your|the)\\b/i,\n  /\\bunlock\\b/i,\n  /\\benter\\s+your\\b/i,\n  /\\b(?:view|review|open|download|access)\\s+(?:the\\s+|your\\s+)?(?:shared\\s+|secure\\s+)?(?:file|document|invoice|statement)s?\\b/i,\n  /\\b(?:continue|proceed)\\s+to\\s+(?:the\\s+|your\\s+)?(?:document|file|account|sign[\\s-]?in|log[\\s-]?in)s?\\b/i,\n]\n\n/**\n * The lures a page is read for as a WHOLE (AGL-3447): account and\n * document-share wording. Not the marketplace, booking and parcel lures,\n * which a hotel's \"guest reviews\" and a shop's delivery page carry every day\n * and which still count in one element beside a brand.\n */\nconst PAGE_LURE_PATTERNS: readonly RegExp[] = [...ACCOUNT_LURE_PATTERNS, ...DOCUMENT_SHARE_LURE_PATTERNS]\n\n/**\n * A component that renders a call to action — a button or a link, however a\n * plugin names it (`muiButton`, `muiScreenLink`, `muiLinkBox`). It is one\n * when it carries a target: an `href`, or a `screenId` on the site itself.\n */\nconst CALL_TO_ACTION_COMPONENT = /button|fab|cta|link/i\n\n/** The props a call to action's visible words live in; the first found wins. */\nconst CALL_TO_ACTION_LABEL_KEYS = ['children', 'label', 'text', 'title', 'html']\n\n/** URLs in page text, so prose is read for a brand or a lure without them. */\nconst PROSE_URL_PATTERN = /(?:https?:)?\\/\\/[^\\s\"'<>]+|\\bwww\\.[^\\s\"'<>]+/gi\n\n/** One call to action: what it says, and the host it leaves for (null: it stays). */\ninterface CallToAction {\n  label: string\n  host: string | null\n}\n\n/** Every node in the tree, breadth-first in document order, bounded. */\nfunction walkNodes(root: unknown): WalkedNode[] {\n  const found: WalkedNode[] = []\n  const seen = new Set<unknown>()\n  // Each queued value carries the walk index of the node it is nested in, so\n  // a nested tree knows its parents without stored ids.\n  const stack: Array<{ value: unknown; parentIndex?: number }> = [{ value: root }]\n  for (let head = 0; head < stack.length && found.length < MAX_NODES; head += 1) {\n    const { value, parentIndex } = stack[head] as { value: unknown; parentIndex?: number }\n    if (!value || typeof value !== 'object' || seen.has(value)) continue\n    seen.add(value)\n    const record = value as Record<string, unknown>\n    let enclosing = parentIndex\n    if (typeof record['componentId'] === 'string') {\n      const props = record['props']\n      enclosing = found.length\n      found.push({\n        componentId: record['componentId'] as string,\n        props: props && typeof props === 'object' ? (props as Record<string, unknown>) : {},\n        ...(typeof record['$id'] === 'string' ? { id: record['$id'] } : {}),\n        ...(typeof record['parentId'] === 'string' ? { parentId: record['parentId'] } : {}),\n        ...(parentIndex !== undefined ? { parentIndex } : {}),\n      })\n    }\n    for (const child of Array.isArray(value) ? value : Object.values(record)) {\n      if (child && typeof child === 'object') stack.push({ value: child, parentIndex: enclosing })\n    }\n  }\n  return found\n}\n\n/** Every string a node's props hold, one level of arrays and objects deep. */\nfunction propStrings(props: Record<string, unknown>, skip: ReadonlySet<string> = new Set()): string[] {\n  const out: string[] = []\n  const visit = (value: unknown, depth: number) => {\n    if (typeof value === 'string') out.push(value)\n    else if (depth < 3 && value && typeof value === 'object') {\n      for (const entry of Array.isArray(value) ? value : Object.values(value as Record<string, unknown>)) {\n        visit(entry, depth + 1)\n      }\n    }\n  }\n  for (const [key, value] of Object.entries(props)) {\n    if (key === 'sx' || skip.has(key)) continue\n    visit(value, 0)\n  }\n  return out\n}\n\n/** Does this node describe a field its author defined? */\nfunction isAuthoredField(node: WalkedNode): boolean {\n  if (FIELD_ELEMENT_COMPONENTS.has(node.componentId)) return true\n  if (/field|input/i.test(node.componentId)) return true\n  return FIELD_PROP_KEYS.some((key) => node.props[key] !== undefined)\n}\n\n/**\n * The words BESIDE one of MUI's separate form elements, which carries none of\n * its own: the Choice Label holding a Checkbox or Radio, and the Form Label in\n * the Form Control around it. Read through stored `parentId`s (a flat node\n * map) or through nesting (a tree), whichever the page has.\n */\nfunction siblingLabelOf(nodes: readonly WalkedNode[], index: number): string {\n  const node = nodes[index]\n  if (!node || !FIELD_ELEMENT_COMPONENTS.has(node.componentId)) return ''\n  const byId = new Map<string, number>()\n  nodes.forEach((one, at) => {\n    if (one.id && !byId.has(one.id)) byId.set(one.id, at)\n  })\n  const parentOf = (at: number): number | undefined => {\n    const one = nodes[at]\n    const stored = one?.parentId !== undefined ? byId.get(one.parentId) : undefined\n    return stored !== undefined && stored !== at ? stored : one?.parentIndex\n  }\n  const textOf = (one: WalkedNode | undefined, key: string) =>\n    typeof one?.props[key] === 'string' ? (one.props[key] as string).trim() : ''\n  const words: string[] = []\n  let at = parentOf(index)\n  for (let depth = 0; at !== undefined && depth < 8; depth += 1) {\n    const ancestor = nodes[at]\n    if (ancestor?.componentId === CHOICE_LABEL_COMPONENT && textOf(ancestor, 'label')) {\n      words.push(textOf(ancestor, 'label'))\n    }\n    if (ancestor?.componentId === FORM_CONTROL_COMPONENT) {\n      const control = at\n      const formLabel = nodes.find(\n        (one, oneAt) => one.componentId === FORM_LABEL_COMPONENT && parentOf(oneAt) === control,\n      )\n      if (textOf(formLabel, 'children')) words.unshift(textOf(formLabel, 'children'))\n      break\n    }\n    at = parentOf(at)\n  }\n  return words.join(' ')\n}\n\n/** The credential a field asks for, or null. */\nfunction credentialOf(\n  node: WalkedNode,\n  besideLabel = '',\n): { field: 'password' | 'card' | 'otp'; label: string } | null {\n  const text = (key: string) => (typeof node.props[key] === 'string' ? (node.props[key] as string) : '')\n  const type = [text('fieldType'), text('type'), text('inputType')].join(' ').toLowerCase()\n  const label =\n    text('label') || besideLabel || text('ariaLabel') || text('placeholder') || text('fieldName') || text('name')\n  if (/\\bpassword\\b/.test(type)) return { field: 'password', label: label || 'password' }\n  const autocomplete = (text('autoComplete') || text('autocomplete')).toLowerCase().trim()\n  const byToken = CREDENTIAL_AUTOCOMPLETE[autocomplete]\n  if (byToken) return { field: byToken, label: label || autocomplete }\n  const wording = [\n    text('label'),\n    besideLabel,\n    text('ariaLabel'),\n    text('placeholder'),\n    text('fieldName'),\n    text('name'),\n    text('helperText'),\n  ]\n    .filter(Boolean)\n    .join(' ')\n  for (const { field, pattern } of CREDENTIAL_LABELS) {\n    if (pattern.test(wording)) return { field, label: (label || wording).slice(0, 80) }\n  }\n  return null\n}\n\n/**\n * The credential an input asks for, read from the two attributes that decide\n * it in the browser — its `type` and its `autocomplete` token — or null.\n * For code that builds inputs rather than storing them as page props: the\n * marketplace verifier reads a plugin bundle's `{ type: 'password' }` and\n * `setAttribute('autocomplete', 'cc-number')` with this (AGL-3362).\n */\nexport function credentialForInputAttribute(\n  attribute: string,\n  value: string,\n): 'password' | 'card' | 'otp' | null {\n  const name = String(attribute ?? '').toLowerCase()\n  const token = String(value ?? '').trim().toLowerCase()\n  if ((name === 'type' || name === 'inputtype') && token === 'password') return 'password'\n  if (name === 'autocomplete') return CREDENTIAL_AUTOCOMPLETE[token] ?? null\n  return null\n}\n\n/** The credential a piece of raw HTML asks for in an input of its own, or null. */\nexport function credentialInHtml(html: string): 'password' | 'card' | 'otp' | null {\n  const text = String(html ?? '')\n  if (!text.includes('<')) return null\n  return HTML_CREDENTIAL_INPUTS.find(({ pattern }) => pattern.test(text))?.field ?? null\n}\n\n/**\n * Does a submitted field's NAME ask for a credential — a password, a card\n * number or security code, a one-time code? The same wording the page\n * screen holds a field for, read over a name as a form posts it\n * (`card_number`, `cardNumber`, `one-time-code`).\n *\n * For the one path that does not pass a publish: a public form endpoint\n * takes whatever field names a request carries, so a page the screen never\n * saw (third-party code, a hand-built request) could still post a password\n * to it. The endpoint drops such a field rather than store it.\n */\nexport function isCredentialFieldName(name: string): boolean {\n  const words = String(name ?? '')\n    .replace(/([a-z0-9])([A-Z])/g, '$1 $2')\n    .replace(/[_\\-.[\\]]+/g, ' ')\n    .trim()\n  if (!words) return false\n  if (CREDENTIAL_AUTOCOMPLETE[words.toLowerCase().replace(/\\s+/g, '-')]) return true\n  if (/^(?:pass|pwd|ccnum|cc\\s?num|cc\\s?number|cvv2?|cvc|csc)$/i.test(words)) return true\n  return CREDENTIAL_LABELS.some(({ pattern }) => pattern.test(words))\n}\n\n/** URLs a page carries in a form Links-by-shape would miss: `//host/…`. */\nfunction protocolRelativeUrls(strings: readonly string[]): string {\n  return strings\n    .filter((value) => /^\\/\\/[a-z0-9-]+(?:\\.[a-z0-9-]+)+/i.test(value.trim()))\n    .map((value) => `https:${value.trim()}`)\n    .join('\\n')\n}\n\n/**\n * Screen one page as it will be served. The caller applies the tiers with\n * `signalsThatHold` and decides what a hold does.\n */\nexport function screenHostedPage(input: HostedPageScreenInput): HostedPageScreenVerdict {\n  const signals: PhishingScreenSignal[] = []\n  const nodes = walkNodes(input.nodes)\n  const ownNames = squashScreenText((input.ownNames ?? []).filter(Boolean).join(' '))\n  const ownHosts = (input.ownDomains ?? [])\n    .map((domain) => String(domain ?? '').trim().toLowerCase().replace(/\\.+$/, ''))\n    .filter((domain) => domain.includes('.'))\n  const ownRegistrables = new Set(ownHosts.map(registrableDomain))\n  const isOwnHost = (host: string) => ownHosts.some((own) => host === own || host.endsWith(`.${own}`))\n\n  const nodeStrings = nodes.map((node) => propStrings(node.props))\n  let pageText = nodeStrings.map((strings) => strings.join('\\n')).join('\\n')\n  pageText = `${pageText}\\n${protocolRelativeUrls(nodeStrings.flat())}`.slice(0, MAX_PAGE_TEXT)\n\n  // 1. A lookalike host anywhere the page links, embeds or posts to.\n  const linkHosts = linkHostsIn(pageText)\n  for (const host of linkHosts) {\n    const brand = lookalikeBrandForHost(host)\n    if (brand && !isBrandsOwnDomain(brand, ownRegistrables)) {\n      signals.push({ code: 'lookalike-link', brand: brand.id, host })\n    }\n  }\n\n  // 2. A credential field the page's author defined.\n  const credentialSeen = new Set<string>()\n  const noteCredential = (field: 'password' | 'card' | 'otp', label: string) => {\n    if (credentialSeen.has(field)) return\n    credentialSeen.add(field)\n    signals.push({ code: 'credential-field', field, label: label.slice(0, 80) })\n  }\n  nodes.forEach((node, index) => {\n    if (isAuthoredField(node)) {\n      const credential = credentialOf(node, siblingLabelOf(nodes, index))\n      if (credential) noteCredential(credential.field, credential.label)\n    }\n    for (const html of nodeStrings[index]) {\n      if (!html.includes('<')) continue\n      for (const { field, pattern } of HTML_CREDENTIAL_INPUTS) {\n        if (pattern.test(html)) noteCredential(field, 'an input in the page’s own HTML')\n      }\n    }\n  })\n\n  const isElsewhere = (host: string) => {\n    if (isOwnHost(host)) return false\n    const registrable = registrableDomain(host)\n    return !isAnyOfficialBrandDomain(registrable) && !isCommonLinkDomain(registrable)\n  }\n  const foreign = linkHosts.find(isElsewhere)\n  const actions = [...PAGE_ACTION_PATTERNS, ...PHISHING_LURE_PATTERNS]\n  const named = new Set<string>()\n  const isOthersBrand = (brand: PhishingScreenBrand) =>\n    !named.has(brand.id) && !isWorkspaceOwnBrand(brand, ownNames, ownRegistrables)\n\n  // 3. A brand's call to action, in one element, on a page that links away.\n  if (foreign) {\n    for (const strings of nodeStrings) {\n      const text = proseOf(strings.join(' '))\n      if (!text) continue\n      const action = firstMatch(actions, text)\n      if (!action) continue\n      for (const brand of PHISHING_SCREEN_BRANDS) {\n        if (isOthersBrand(brand) && brand.mention.test(text)) {\n          named.add(brand.id)\n          signals.push({ code: 'brand-action-page', brand: brand.id, action: action.slice(0, 80) })\n        }\n      }\n    }\n  }\n\n  const prose = proseOf(pageText)\n  const pageLure = firstMatch(PAGE_LURE_PATTERNS, prose)\n  const ctas = callsToAction(nodes)\n  const leaving = ctas.filter((cta): cta is CallToAction & { host: string } =>\n    Boolean(cta.host && isElsewhere(cta.host)),\n  )\n  const wordedLeaving = leaving.find((cta) => firstMatch(actions, cta.label))\n\n  // 4. A brand's lure, read over the page as a whole, on a page that links away.\n  const brandLure = pageLure ?? (wordedLeaving ? firstMatch(actions, wordedLeaving.label) : undefined)\n  if (foreign && brandLure) {\n    const host = (wordedLeaving ?? leaving[0])?.host ?? foreign\n    for (const brand of PHISHING_SCREEN_BRANDS) {\n      if (isOthersBrand(brand) && brand.mention.test(prose)) {\n        named.add(brand.id)\n        signals.push({ code: 'brand-lure-page', brand: brand.id, lure: brandLure.slice(0, 120), host })\n      }\n    }\n  }\n\n  // 5. The page's call to action leaves the site, beside a lure. Its only\n  //    one, or the one worded as an account or document action.\n  const primary = wordedLeaving ?? (ctas.length === 1 ? leaving[0] : undefined)\n  if (primary && pageLure) {\n    signals.push({\n      code: 'offsite-action-page',\n      action: (primary.label || primary.host).slice(0, 80),\n      lure: pageLure.slice(0, 120),\n      host: primary.host,\n    })\n  }\n\n  return { signals, linkHosts, linkUrls: linkUrlsIn(pageText) }\n}\n\n/**\n * What a visitor reads in page text: its markup taken out the way the email\n * screen takes it out ({@link visibleTextOf}), so a custom HTML block or a\n * rich-text prop cannot split a brand or a lure letter by letter with tags\n * (AGL-3453), and its bare URLs taken out too. Links are still read from\n * the raw text, where an href lives.\n */\nfunction proseOf(text: string): string {\n  return visibleTextOf(text).replace(PROSE_URL_PATTERN, ' ').replace(/\\s+/g, ' ').trim()\n}\n\n/** The first pattern's match in the text, or undefined. */\nfunction firstMatch(patterns: readonly RegExp[], text: string): string | undefined {\n  if (!text) return undefined\n  for (const pattern of patterns) {\n    const found = text.match(pattern)?.[0]\n    if (found) return found\n  }\n  return undefined\n}\n\n/** The words a call to action shows, from its label prop, markup taken out. */\nfunction callToActionLabel(props: Record<string, unknown>): string {\n  for (const key of CALL_TO_ACTION_LABEL_KEYS) {\n    const value = props[key]\n    if (typeof value === 'string' && value.trim()) {\n      return visibleTextOf(value).split('\\n')[0]\n    }\n  }\n  return ''\n}\n\n/**\n * Every call to action on the page: each button or link that carries a\n * target. A `screenId` is a page of the site and takes precedence over an\n * `href`, as the button renders it; a relative, `mailto:` or `tel:` href has\n * no web host and stays too.\n */\nfunction callsToAction(nodes: readonly WalkedNode[]): CallToAction[] {\n  const found: CallToAction[] = []\n  for (const node of nodes) {\n    if (!CALL_TO_ACTION_COMPONENT.test(node.componentId)) continue\n    const screenId = typeof node.props['screenId'] === 'string' ? node.props['screenId'].trim() : ''\n    const href = typeof node.props['href'] === 'string' ? node.props['href'].trim() : ''\n    if (!screenId && !href) continue\n    const absolute = href.startsWith('//') ? `https:${href}` : href\n    found.push({\n      label: callToActionLabel(node.props),\n      host: screenId ? null : (linkHostsIn(absolute)[0] ?? null),\n    })\n  }\n  return found\n}\n\nexport interface SiteRedirectScreenInput {\n  /** The path the rule answers — `/secure-document` — or its pattern. */\n  source: string\n  /** Where it sends the visitor, after any `$n` substitution. */\n  destination: string\n  /** The workspace's own names, as `screenHostedPage` reads them. */\n  ownNames?: readonly (string | null | undefined)[]\n  /** The workspace's own hosts — a redirect to one never leaves. */\n  ownDomains?: readonly (string | null | undefined)[]\n}\n\n/**\n * Screen one site redirect (AGL-3447): a rule that sends a path off the site\n * is a call to action that fires on arrival, so it is read with the page's\n * rules over the one text it has, its path.\n *\n * - `lookalike-link` (STRONG) — the destination wears a brand it is not.\n * - `offsite-redirect` (SOFT) — the destination is not the site's own, a\n *   listed brand's or a common link, and the path reads as an account or\n *   document-share lure (`/secure-document-access`).\n * - `brand-lure-link` (SOFT) — the same, and the path names a brand that is\n *   not the workspace's (`/paypal-verify-your-account`), the email screen's\n *   three-part lure.\n *\n * The caller applies the tiers with `signalsThatHold`, with the workspace's\n * age, and decides what a hold does.\n */\nexport function screenSiteRedirect(input: SiteRedirectScreenInput): HostedPageScreenVerdict {\n  const signals: PhishingScreenSignal[] = []\n  const destination = String(input.destination ?? '').trim()\n  const absolute = destination.startsWith('//') ? `https:${destination}` : destination\n  const hosts = linkHostsIn(absolute)\n  const linkUrls = linkUrlsIn(absolute)\n  if (!hosts.length) return { signals, linkHosts: hosts, linkUrls }\n  const ownNames = squashScreenText((input.ownNames ?? []).filter(Boolean).join(' '))\n  const ownHosts = (input.ownDomains ?? [])\n    .map((domain) => String(domain ?? '').trim().toLowerCase().replace(/\\.+$/, ''))\n    .filter((domain) => domain.includes('.'))\n  const ownRegistrables = new Set(ownHosts.map(registrableDomain))\n\n  for (const host of hosts) {\n    const brand = lookalikeBrandForHost(host)\n    if (brand && !isBrandsOwnDomain(brand, ownRegistrables)) {\n      signals.push({ code: 'lookalike-link', brand: brand.id, host })\n    }\n  }\n\n  // The first host is where the browser goes; the rest is a userinfo disguise.\n  const host = hosts[0]\n  const registrable = registrableDomain(host)\n  const leaves =\n    !ownHosts.some((own) => host === own || host.endsWith(`.${own}`)) &&\n    !isAnyOfficialBrandDomain(registrable) &&\n    !isCommonLinkDomain(registrable)\n  if (!leaves) return { signals, linkHosts: hosts, linkUrls }\n\n  const source = String(input.source ?? '').trim()\n  const words = pathWords(source)\n  const lure = firstMatch(PAGE_LURE_PATTERNS, words)\n  if (lure) {\n    signals.push({ code: 'offsite-redirect', source: source.slice(0, 120), lure: lure.slice(0, 120), host })\n  }\n  const anyLure = lure ?? firstMatch(PHISHING_LURE_PATTERNS, words)\n  if (anyLure) {\n    const brand = PHISHING_SCREEN_BRANDS.find(\n      (candidate) =>\n        candidate.mention.test(words) && !isWorkspaceOwnBrand(candidate, ownNames, ownRegistrables),\n    )\n    if (brand) {\n      signals.push({ code: 'brand-lure-link', brand: brand.id, lure: anyLure.slice(0, 120), host })\n    }\n  }\n  return { signals, linkHosts: hosts, linkUrls }\n}\n\n/** A path read as words: `/secure-document_access` → `secure document access`. */\nfunction pathWords(path: string): string {\n  let decoded = path\n  try {\n    decoded = decodeURIComponent(path)\n  } catch {\n    // A malformed escape is read as typed.\n  }\n  return decoded.replace(/[^a-z0-9]+/gi, ' ').trim()\n}\n"],"names":["ACCOUNT_LURE_PATTERNS","DOCUMENT_SHARE_LURE_PATTERNS","isWorkspaceOwnBrand","linkHostsIn","linkUrlsIn","isBrandsOwnDomain","lookalikeBrandForHost","PHISHING_LURE_PATTERNS","PHISHING_SCREEN_BRANDS","registrableDomain","isAnyOfficialBrandDomain","isCommonLinkDomain","squashScreenText","visibleTextOf","MAX_PAGE_TEXT","MAX_NODES","FIELD_ELEMENT_COMPONENTS","Set","FORM_CONTROL_COMPONENT","FORM_LABEL_COMPONENT","CHOICE_LABEL_COMPONENT","FIELD_PROP_KEYS","CREDENTIAL_AUTOCOMPLETE","CREDENTIAL_LABELS","field","pattern","HTML_CREDENTIAL_INPUTS","PAGE_ACTION_PATTERNS","PAGE_LURE_PATTERNS","CALL_TO_ACTION_COMPONENT","CALL_TO_ACTION_LABEL_KEYS","PROSE_URL_PATTERN","walkNodes","root","found","seen","stack","value","head","length","parentIndex","has","add","record","enclosing","props","push","componentId","id","parentId","undefined","child","Array","isArray","Object","values","propStrings","skip","out","visit","depth","entry","key","entries","isAuthoredField","node","test","some","siblingLabelOf","nodes","index","byId","Map","forEach","one","at","set","parentOf","stored","get","textOf","trim","words","ancestor","control","formLabel","find","oneAt","unshift","join","credentialOf","besideLabel","text","type","toLowerCase","label","autocomplete","byToken","wording","filter","Boolean","slice","credentialForInputAttribute","attribute","name","String","token","credentialInHtml","html","includes","isCredentialFieldName","replace","protocolRelativeUrls","strings","map","screenHostedPage","input","signals","ownNames","ownHosts","ownDomains","domain","ownRegistrables","isOwnHost","host","own","endsWith","nodeStrings","pageText","flat","linkHosts","brand","code","credentialSeen","noteCredential","credential","isElsewhere","registrable","foreign","actions","named","isOthersBrand","proseOf","action","firstMatch","mention","prose","pageLure","ctas","callsToAction","leaving","cta","wordedLeaving","brandLure","lure","primary","linkUrls","patterns","match","callToActionLabel","split","screenId","href","absolute","startsWith","screenSiteRedirect","destination","hosts","leaves","source","pathWords","anyLure","candidate","path","decoded","decodeURIComponent"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2CAwD2C,GAE3C,SACEA,qBAAqB,EACrBC,4BAA4B,EAC5BC,mBAAmB,EACnBC,WAAW,EACXC,UAAU,EACVC,iBAAiB,EACjBC,qBAAqB,EACrBC,sBAAsB,EACtBC,sBAAsB,EAGtBC,iBAAiB,EACjBC,wBAAwB,EACxBC,kBAAkB,EAClBC,gBAAgB,EAChBC,aAAa,QACR,gCAA4B;AA4CnC,4EAA4E,GAC5E,MAAMC,gBAAgB;AACtB,oCAAoC,GACpC,MAAMC,YAAY;AAElB;;;;;CAKC,GACD,MAAMC,2BAA2B,IAAIC,IAAI;IACvC;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD;AACD,MAAMC,yBAAyB;AAC/B,MAAMC,uBAAuB;AAC7B,MAAMC,yBAAyB;AAE/B,yEAAyE,GACzE,MAAMC,kBAAkB;IAAC;IAAa;IAAa;IAAa;IAAgB;CAAe;AAE/F,yDAAyD,GACzD,MAAMC,0BAAuE;IAC3E,oBAAoB;IACpB,gBAAgB;IAChB,aAAa;IACb,UAAU;IACV,UAAU;IACV,iBAAiB;AACnB;AAEA,uDAAuD,GACvD,MAAMC,oBAA4F;IAChG;QAAEC,OAAO;QAAYC,SAAS;IAA6E;IAC3G;QACED,OAAO;QACPC,SACE;IACJ;IACA;QACED,OAAO;QACPC,SACE;IACJ;CACD;AAED,6DAA6D,GAC7D,MAAMC,yBAAiG;IACrG;QAAEF,OAAO;QAAYC,SAAS;IAA2C;IACzE;QAAED,OAAO;QAAYC,SAAS;IAAwG;IACtI;QAAED,OAAO;QAAQC,SAAS;IAA+F;IACzH;QAAED,OAAO;QAAOC,SAAS;IAA8F;CACxH;AAED;;;;CAIC,GACD,MAAME,uBAA0C;IAC9C;IACA;IACA;IACA;IACA;IACA;IACA;CACD;AAED;;;;;CAKC,GACD,MAAMC,qBAAwC;OAAI5B;OAA0BC;CAA6B;AAEzG;;;;CAIC,GACD,MAAM4B,2BAA2B;AAEjC,8EAA8E,GAC9E,MAAMC,4BAA4B;IAAC;IAAY;IAAS;IAAQ;IAAS;CAAO;AAEhF,4EAA4E,GAC5E,MAAMC,oBAAoB;AAQ1B,sEAAsE,GACtE,SAASC,UAAUC,IAAa;IAC9B,MAAMC,QAAsB,EAAE;IAC9B,MAAMC,OAAO,IAAIlB;IACjB,2EAA2E;IAC3E,sDAAsD;IACtD,MAAMmB,QAAyD;QAAC;YAAEC,OAAOJ;QAAK;KAAE;IAChF,IAAK,IAAIK,OAAO,GAAGA,OAAOF,MAAMG,MAAM,IAAIL,MAAMK,MAAM,GAAGxB,WAAWuB,QAAQ,EAAG;QAC7E,MAAM,EAAED,KAAK,EAAEG,WAAW,EAAE,GAAGJ,KAAK,CAACE,KAAK;QAC1C,IAAI,CAACD,SAAS,OAAOA,UAAU,YAAYF,KAAKM,GAAG,CAACJ,QAAQ;QAC5DF,KAAKO,GAAG,CAACL;QACT,MAAMM,SAASN;QACf,IAAIO,YAAYJ;QAChB,IAAI,OAAOG,MAAM,CAAC,cAAc,KAAK,UAAU;YAC7C,MAAME,QAAQF,MAAM,CAAC,QAAQ;YAC7BC,YAAYV,MAAMK,MAAM;YACxBL,MAAMY,IAAI,CAAC;gBACTC,aAAaJ,MAAM,CAAC,cAAc;gBAClCE,OAAOA,SAAS,OAAOA,UAAU,WAAYA,QAAoC,CAAC;eAC9E,OAAOF,MAAM,CAAC,MAAM,KAAK,WAAW;gBAAEK,IAAIL,MAAM,CAAC,MAAM;YAAC,IAAI,CAAC,GAC7D,OAAOA,MAAM,CAAC,WAAW,KAAK,WAAW;gBAAEM,UAAUN,MAAM,CAAC,WAAW;YAAC,IAAI,CAAC,GAC7EH,gBAAgBU,YAAY;gBAAEV;YAAY,IAAI,CAAC;QAEvD;QACA,KAAK,MAAMW,SAASC,MAAMC,OAAO,CAAChB,SAASA,QAAQiB,OAAOC,MAAM,CAACZ,QAAS;YACxE,IAAIQ,SAAS,OAAOA,UAAU,UAAUf,MAAMU,IAAI,CAAC;gBAAET,OAAOc;gBAAOX,aAAaI;YAAU;QAC5F;IACF;IACA,OAAOV;AACT;AAEA,4EAA4E,GAC5E,SAASsB,YAAYX,KAA8B,EAAEY,OAA4B,IAAIxC,KAAK;IACxF,MAAMyC,MAAgB,EAAE;IACxB,MAAMC,QAAQ,CAACtB,OAAgBuB;QAC7B,IAAI,OAAOvB,UAAU,UAAUqB,IAAIZ,IAAI,CAACT;aACnC,IAAIuB,QAAQ,KAAKvB,SAAS,OAAOA,UAAU,UAAU;YACxD,KAAK,MAAMwB,SAAST,MAAMC,OAAO,CAAChB,SAASA,QAAQiB,OAAOC,MAAM,CAAClB,OAAmC;gBAClGsB,MAAME,OAAOD,QAAQ;YACvB;QACF;IACF;IACA,KAAK,MAAM,CAACE,KAAKzB,MAAM,IAAIiB,OAAOS,OAAO,CAAClB,OAAQ;QAChD,IAAIiB,QAAQ,QAAQL,KAAKhB,GAAG,CAACqB,MAAM;QACnCH,MAAMtB,OAAO;IACf;IACA,OAAOqB;AACT;AAEA,wDAAwD,GACxD,SAASM,gBAAgBC,IAAgB;IACvC,IAAIjD,yBAAyByB,GAAG,CAACwB,KAAKlB,WAAW,GAAG,OAAO;IAC3D,IAAI,eAAemB,IAAI,CAACD,KAAKlB,WAAW,GAAG,OAAO;IAClD,OAAO1B,gBAAgB8C,IAAI,CAAC,CAACL,MAAQG,KAAKpB,KAAK,CAACiB,IAAI,KAAKZ;AAC3D;AAEA;;;;;CAKC,GACD,SAASkB,eAAeC,KAA4B,EAAEC,KAAa;IACjE,MAAML,OAAOI,KAAK,CAACC,MAAM;IACzB,IAAI,CAACL,QAAQ,CAACjD,yBAAyByB,GAAG,CAACwB,KAAKlB,WAAW,GAAG,OAAO;IACrE,MAAMwB,OAAO,IAAIC;IACjBH,MAAMI,OAAO,CAAC,CAACC,KAAKC;QAClB,IAAID,IAAI1B,EAAE,IAAI,CAACuB,KAAK9B,GAAG,CAACiC,IAAI1B,EAAE,GAAGuB,KAAKK,GAAG,CAACF,IAAI1B,EAAE,EAAE2B;IACpD;IACA,MAAME,WAAW,CAACF;QAChB,MAAMD,MAAML,KAAK,CAACM,GAAG;QACrB,MAAMG,SAASJ,CAAAA,uBAAAA,IAAKzB,QAAQ,MAAKC,YAAYqB,KAAKQ,GAAG,CAACL,IAAIzB,QAAQ,IAAIC;QACtE,OAAO4B,WAAW5B,aAAa4B,WAAWH,KAAKG,SAASJ,uBAAAA,IAAKlC,WAAW;IAC1E;IACA,MAAMwC,SAAS,CAACN,KAA6BZ,MAC3C,QAAOY,uBAAAA,IAAK7B,KAAK,CAACiB,IAAI,MAAK,WAAW,AAACY,IAAI7B,KAAK,CAACiB,IAAI,CAAYmB,IAAI,KAAK;IAC5E,MAAMC,QAAkB,EAAE;IAC1B,IAAIP,KAAKE,SAASP;IAClB,IAAK,IAAIV,QAAQ,GAAGe,OAAOzB,aAAaU,QAAQ,GAAGA,SAAS,EAAG;QAC7D,MAAMuB,WAAWd,KAAK,CAACM,GAAG;QAC1B,IAAIQ,CAAAA,4BAAAA,SAAUpC,WAAW,MAAK3B,0BAA0B4D,OAAOG,UAAU,UAAU;YACjFD,MAAMpC,IAAI,CAACkC,OAAOG,UAAU;QAC9B;QACA,IAAIA,CAAAA,4BAAAA,SAAUpC,WAAW,MAAK7B,wBAAwB;YACpD,MAAMkE,UAAUT;YAChB,MAAMU,YAAYhB,MAAMiB,IAAI,CAC1B,CAACZ,KAAKa,QAAUb,IAAI3B,WAAW,KAAK5B,wBAAwB0D,SAASU,WAAWH;YAElF,IAAIJ,OAAOK,WAAW,aAAaH,MAAMM,OAAO,CAACR,OAAOK,WAAW;YACnE;QACF;QACAV,KAAKE,SAASF;IAChB;IACA,OAAOO,MAAMO,IAAI,CAAC;AACpB;AAEA,8CAA8C,GAC9C,SAASC,aACPzB,IAAgB,EAChB0B,cAAc,EAAE;IAEhB,MAAMC,OAAO,CAAC9B,MAAiB,OAAOG,KAAKpB,KAAK,CAACiB,IAAI,KAAK,WAAYG,KAAKpB,KAAK,CAACiB,IAAI,GAAc;IACnG,MAAM+B,OAAO;QAACD,KAAK;QAAcA,KAAK;QAASA,KAAK;KAAa,CAACH,IAAI,CAAC,KAAKK,WAAW;IACvF,MAAMC,QACJH,KAAK,YAAYD,eAAeC,KAAK,gBAAgBA,KAAK,kBAAkBA,KAAK,gBAAgBA,KAAK;IACxG,IAAI,eAAe1B,IAAI,CAAC2B,OAAO,OAAO;QAAErE,OAAO;QAAYuE,OAAOA,SAAS;IAAW;IACtF,MAAMC,eAAe,AAACJ,CAAAA,KAAK,mBAAmBA,KAAK,eAAc,EAAGE,WAAW,GAAGb,IAAI;IACtF,MAAMgB,UAAU3E,uBAAuB,CAAC0E,aAAa;IACrD,IAAIC,SAAS,OAAO;QAAEzE,OAAOyE;QAASF,OAAOA,SAASC;IAAa;IACnE,MAAME,UAAU;QACdN,KAAK;QACLD;QACAC,KAAK;QACLA,KAAK;QACLA,KAAK;QACLA,KAAK;QACLA,KAAK;KACN,CACEO,MAAM,CAACC,SACPX,IAAI,CAAC;IACR,KAAK,MAAM,EAAEjE,KAAK,EAAEC,OAAO,EAAE,IAAIF,kBAAmB;QAClD,IAAIE,QAAQyC,IAAI,CAACgC,UAAU,OAAO;YAAE1E;YAAOuE,OAAO,AAACA,CAAAA,SAASG,OAAM,EAAGG,KAAK,CAAC,GAAG;QAAI;IACpF;IACA,OAAO;AACT;AAEA;;;;;;CAMC,GACD,OAAO,SAASC,4BACdC,SAAiB,EACjBlE,KAAa;QAKuBf;IAHpC,MAAMkF,OAAOC,OAAOF,oBAAAA,YAAa,IAAIT,WAAW;IAChD,MAAMY,QAAQD,OAAOpE,gBAAAA,QAAS,IAAI4C,IAAI,GAAGa,WAAW;IACpD,IAAI,AAACU,CAAAA,SAAS,UAAUA,SAAS,WAAU,KAAME,UAAU,YAAY,OAAO;IAC9E,IAAIF,SAAS,gBAAgB,QAAOlF,iCAAAA,uBAAuB,CAACoF,MAAM,YAA9BpF,iCAAkC;IACtE,OAAO;AACT;AAEA,iFAAiF,GACjF,OAAO,SAASqF,iBAAiBC,IAAY;;QAGpClF;IAFP,MAAMkE,OAAOa,OAAOG,eAAAA,OAAQ;IAC5B,IAAI,CAAChB,KAAKiB,QAAQ,CAAC,MAAM,OAAO;IAChC,gBAAOnF,+BAAAA,uBAAuB4D,IAAI,CAAC,CAAC,EAAE7D,OAAO,EAAE,GAAKA,QAAQyC,IAAI,CAAC0B,2BAA1DlE,6BAAkEF,KAAK,mBAAI;AACpF;AAEA;;;;;;;;;;CAUC,GACD,OAAO,SAASsF,sBAAsBN,IAAY;IAChD,MAAMtB,QAAQuB,OAAOD,eAAAA,OAAQ,IAC1BO,OAAO,CAAC,sBAAsB,SAC9BA,OAAO,CAAC,eAAe,KACvB9B,IAAI;IACP,IAAI,CAACC,OAAO,OAAO;IACnB,IAAI5D,uBAAuB,CAAC4D,MAAMY,WAAW,GAAGiB,OAAO,CAAC,QAAQ,KAAK,EAAE,OAAO;IAC9E,IAAI,2DAA2D7C,IAAI,CAACgB,QAAQ,OAAO;IACnF,OAAO3D,kBAAkB4C,IAAI,CAAC,CAAC,EAAE1C,OAAO,EAAE,GAAKA,QAAQyC,IAAI,CAACgB;AAC9D;AAEA,yEAAyE,GACzE,SAAS8B,qBAAqBC,OAA0B;IACtD,OAAOA,QACJd,MAAM,CAAC,CAAC9D,QAAU,oCAAoC6B,IAAI,CAAC7B,MAAM4C,IAAI,KACrEiC,GAAG,CAAC,CAAC7E,QAAU,CAAC,MAAM,EAAEA,MAAM4C,IAAI,IAAI,EACtCQ,IAAI,CAAC;AACV;AAEA;;;CAGC,GACD,OAAO,SAAS0B,iBAAiBC,KAA4B;QAGxBA,iBACjBA;IAHlB,MAAMC,UAAkC,EAAE;IAC1C,MAAMhD,QAAQrC,UAAUoF,MAAM/C,KAAK;IACnC,MAAMiD,WAAW1G,iBAAiB,EAACwG,kBAAAA,MAAME,QAAQ,YAAdF,kBAAkB,EAAE,EAAEjB,MAAM,CAACC,SAASX,IAAI,CAAC;IAC9E,MAAM8B,WAAW,EAACH,oBAAAA,MAAMI,UAAU,YAAhBJ,oBAAoB,EAAE,EACrCF,GAAG,CAAC,CAACO,SAAWhB,OAAOgB,iBAAAA,SAAU,IAAIxC,IAAI,GAAGa,WAAW,GAAGiB,OAAO,CAAC,QAAQ,KAC1EZ,MAAM,CAAC,CAACsB,SAAWA,OAAOZ,QAAQ,CAAC;IACtC,MAAMa,kBAAkB,IAAIzG,IAAIsG,SAASL,GAAG,CAACzG;IAC7C,MAAMkH,YAAY,CAACC,OAAiBL,SAASpD,IAAI,CAAC,CAAC0D,MAAQD,SAASC,OAAOD,KAAKE,QAAQ,CAAC,CAAC,CAAC,EAAED,KAAK;IAElG,MAAME,cAAc1D,MAAM6C,GAAG,CAAC,CAACjD,OAAST,YAAYS,KAAKpB,KAAK;IAC9D,IAAImF,WAAWD,YAAYb,GAAG,CAAC,CAACD,UAAYA,QAAQxB,IAAI,CAAC,OAAOA,IAAI,CAAC;IACrEuC,WAAW,GAAGA,SAAS,EAAE,EAAEhB,qBAAqBe,YAAYE,IAAI,KAAK,CAAC5B,KAAK,CAAC,GAAGvF;IAE/E,mEAAmE;IACnE,MAAMoH,YAAY/H,YAAY6H;IAC9B,KAAK,MAAMJ,QAAQM,UAAW;QAC5B,MAAMC,QAAQ7H,sBAAsBsH;QACpC,IAAIO,SAAS,CAAC9H,kBAAkB8H,OAAOT,kBAAkB;YACvDL,QAAQvE,IAAI,CAAC;gBAAEsF,MAAM;gBAAkBD,OAAOA,MAAMnF,EAAE;gBAAE4E;YAAK;QAC/D;IACF;IAEA,mDAAmD;IACnD,MAAMS,iBAAiB,IAAIpH;IAC3B,MAAMqH,iBAAiB,CAAC9G,OAAoCuE;QAC1D,IAAIsC,eAAe5F,GAAG,CAACjB,QAAQ;QAC/B6G,eAAe3F,GAAG,CAAClB;QACnB6F,QAAQvE,IAAI,CAAC;YAAEsF,MAAM;YAAoB5G;YAAOuE,OAAOA,MAAMM,KAAK,CAAC,GAAG;QAAI;IAC5E;IACAhC,MAAMI,OAAO,CAAC,CAACR,MAAMK;QACnB,IAAIN,gBAAgBC,OAAO;YACzB,MAAMsE,aAAa7C,aAAazB,MAAMG,eAAeC,OAAOC;YAC5D,IAAIiE,YAAYD,eAAeC,WAAW/G,KAAK,EAAE+G,WAAWxC,KAAK;QACnE;QACA,KAAK,MAAMa,QAAQmB,WAAW,CAACzD,MAAM,CAAE;YACrC,IAAI,CAACsC,KAAKC,QAAQ,CAAC,MAAM;YACzB,KAAK,MAAM,EAAErF,KAAK,EAAEC,OAAO,EAAE,IAAIC,uBAAwB;gBACvD,IAAID,QAAQyC,IAAI,CAAC0C,OAAO0B,eAAe9G,OAAO;YAChD;QACF;IACF;IAEA,MAAMgH,cAAc,CAACZ;QACnB,IAAID,UAAUC,OAAO,OAAO;QAC5B,MAAMa,cAAchI,kBAAkBmH;QACtC,OAAO,CAAClH,yBAAyB+H,gBAAgB,CAAC9H,mBAAmB8H;IACvE;IACA,MAAMC,UAAUR,UAAU5C,IAAI,CAACkD;IAC/B,MAAMG,UAAU;WAAIhH;WAAyBpB;KAAuB;IACpE,MAAMqI,QAAQ,IAAI3H;IAClB,MAAM4H,gBAAgB,CAACV,QACrB,CAACS,MAAMnG,GAAG,CAAC0F,MAAMnF,EAAE,KAAK,CAAC9C,oBAAoBiI,OAAOb,UAAUI;IAEhE,0EAA0E;IAC1E,IAAIgB,SAAS;QACX,KAAK,MAAMzB,WAAWc,YAAa;YACjC,MAAMnC,OAAOkD,QAAQ7B,QAAQxB,IAAI,CAAC;YAClC,IAAI,CAACG,MAAM;YACX,MAAMmD,SAASC,WAAWL,SAAS/C;YACnC,IAAI,CAACmD,QAAQ;YACb,KAAK,MAAMZ,SAAS3H,uBAAwB;gBAC1C,IAAIqI,cAAcV,UAAUA,MAAMc,OAAO,CAAC/E,IAAI,CAAC0B,OAAO;oBACpDgD,MAAMlG,GAAG,CAACyF,MAAMnF,EAAE;oBAClBqE,QAAQvE,IAAI,CAAC;wBAAEsF,MAAM;wBAAqBD,OAAOA,MAAMnF,EAAE;wBAAE+F,QAAQA,OAAO1C,KAAK,CAAC,GAAG;oBAAI;gBACzF;YACF;QACF;IACF;IAEA,MAAM6C,QAAQJ,QAAQd;IACtB,MAAMmB,WAAWH,WAAWpH,oBAAoBsH;IAChD,MAAME,OAAOC,cAAchF;IAC3B,MAAMiF,UAAUF,KAAKjD,MAAM,CAAC,CAACoD,MAC3BnD,QAAQmD,IAAI3B,IAAI,IAAIY,YAAYe,IAAI3B,IAAI;IAE1C,MAAM4B,gBAAgBF,QAAQhE,IAAI,CAAC,CAACiE,MAAQP,WAAWL,SAASY,IAAIxD,KAAK;IAEzE,+EAA+E;IAC/E,MAAM0D,YAAYN,mBAAAA,WAAaK,gBAAgBR,WAAWL,SAASa,cAAczD,KAAK,IAAI7C;IAC1F,IAAIwF,WAAWe,WAAW;;YACVD;QAAd,MAAM5B,gBAAQ4B,QAAAA,wBAAAA,gBAAiBF,OAAO,CAAC,EAAE,qBAA5B,AAACE,MAA8B5B,IAAI,mBAAIc;QACpD,KAAK,MAAMP,SAAS3H,uBAAwB;YAC1C,IAAIqI,cAAcV,UAAUA,MAAMc,OAAO,CAAC/E,IAAI,CAACgF,QAAQ;gBACrDN,MAAMlG,GAAG,CAACyF,MAAMnF,EAAE;gBAClBqE,QAAQvE,IAAI,CAAC;oBAAEsF,MAAM;oBAAmBD,OAAOA,MAAMnF,EAAE;oBAAE0G,MAAMD,UAAUpD,KAAK,CAAC,GAAG;oBAAMuB;gBAAK;YAC/F;QACF;IACF;IAEA,wEAAwE;IACxE,8DAA8D;IAC9D,MAAM+B,UAAUH,wBAAAA,gBAAkBJ,KAAK7G,MAAM,KAAK,IAAI+G,OAAO,CAAC,EAAE,GAAGpG;IACnE,IAAIyG,WAAWR,UAAU;QACvB9B,QAAQvE,IAAI,CAAC;YACXsF,MAAM;YACNW,QAAQ,AAACY,CAAAA,QAAQ5D,KAAK,IAAI4D,QAAQ/B,IAAI,AAAD,EAAGvB,KAAK,CAAC,GAAG;YACjDqD,MAAMP,SAAS9C,KAAK,CAAC,GAAG;YACxBuB,MAAM+B,QAAQ/B,IAAI;QACpB;IACF;IAEA,OAAO;QAAEP;QAASa;QAAW0B,UAAUxJ,WAAW4H;IAAU;AAC9D;AAEA;;;;;;CAMC,GACD,SAASc,QAAQlD,IAAY;IAC3B,OAAO/E,cAAc+E,MAAMmB,OAAO,CAAChF,mBAAmB,KAAKgF,OAAO,CAAC,QAAQ,KAAK9B,IAAI;AACtF;AAEA,yDAAyD,GACzD,SAAS+D,WAAWa,QAA2B,EAAEjE,IAAY;IAC3D,IAAI,CAACA,MAAM,OAAO1C;IAClB,KAAK,MAAMzB,WAAWoI,SAAU;YAChBjE;QAAd,MAAM1D,SAAQ0D,cAAAA,KAAKkE,KAAK,CAACrI,6BAAXmE,WAAqB,CAAC,EAAE;QACtC,IAAI1D,OAAO,OAAOA;IACpB;IACA,OAAOgB;AACT;AAEA,6EAA6E,GAC7E,SAAS6G,kBAAkBlH,KAA8B;IACvD,KAAK,MAAMiB,OAAOhC,0BAA2B;QAC3C,MAAMO,QAAQQ,KAAK,CAACiB,IAAI;QACxB,IAAI,OAAOzB,UAAU,YAAYA,MAAM4C,IAAI,IAAI;YAC7C,OAAOpE,cAAcwB,OAAO2H,KAAK,CAAC,KAAK,CAAC,EAAE;QAC5C;IACF;IACA,OAAO;AACT;AAEA;;;;;CAKC,GACD,SAASX,cAAchF,KAA4B;IACjD,MAAMnC,QAAwB,EAAE;IAChC,KAAK,MAAM+B,QAAQI,MAAO;YAQGlE;QAP3B,IAAI,CAAC0B,yBAAyBqC,IAAI,CAACD,KAAKlB,WAAW,GAAG;QACtD,MAAMkH,WAAW,OAAOhG,KAAKpB,KAAK,CAAC,WAAW,KAAK,WAAWoB,KAAKpB,KAAK,CAAC,WAAW,CAACoC,IAAI,KAAK;QAC9F,MAAMiF,OAAO,OAAOjG,KAAKpB,KAAK,CAAC,OAAO,KAAK,WAAWoB,KAAKpB,KAAK,CAAC,OAAO,CAACoC,IAAI,KAAK;QAClF,IAAI,CAACgF,YAAY,CAACC,MAAM;QACxB,MAAMC,WAAWD,KAAKE,UAAU,CAAC,QAAQ,CAAC,MAAM,EAAEF,MAAM,GAAGA;QAC3DhI,MAAMY,IAAI,CAAC;YACTiD,OAAOgE,kBAAkB9F,KAAKpB,KAAK;YACnC+E,MAAMqC,WAAW,QAAQ9J,gBAAAA,YAAYgK,SAAS,CAAC,EAAE,YAAxBhK,gBAA4B;QACvD;IACF;IACA,OAAO+B;AACT;AAaA;;;;;;;;;;;;;;;CAeC,GACD,OAAO,SAASmI,mBAAmBjD,KAA8B;QAEpCA,oBAKQA,iBACjBA,mBAqBIA;IA5BtB,MAAMC,UAAkC,EAAE;IAC1C,MAAMiD,cAAc7D,QAAOW,qBAAAA,MAAMkD,WAAW,YAAjBlD,qBAAqB,IAAInC,IAAI;IACxD,MAAMkF,WAAWG,YAAYF,UAAU,CAAC,QAAQ,CAAC,MAAM,EAAEE,aAAa,GAAGA;IACzE,MAAMC,QAAQpK,YAAYgK;IAC1B,MAAMP,WAAWxJ,WAAW+J;IAC5B,IAAI,CAACI,MAAMhI,MAAM,EAAE,OAAO;QAAE8E;QAASa,WAAWqC;QAAOX;IAAS;IAChE,MAAMtC,WAAW1G,iBAAiB,EAACwG,kBAAAA,MAAME,QAAQ,YAAdF,kBAAkB,EAAE,EAAEjB,MAAM,CAACC,SAASX,IAAI,CAAC;IAC9E,MAAM8B,WAAW,EAACH,oBAAAA,MAAMI,UAAU,YAAhBJ,oBAAoB,EAAE,EACrCF,GAAG,CAAC,CAACO,SAAWhB,OAAOgB,iBAAAA,SAAU,IAAIxC,IAAI,GAAGa,WAAW,GAAGiB,OAAO,CAAC,QAAQ,KAC1EZ,MAAM,CAAC,CAACsB,SAAWA,OAAOZ,QAAQ,CAAC;IACtC,MAAMa,kBAAkB,IAAIzG,IAAIsG,SAASL,GAAG,CAACzG;IAE7C,KAAK,MAAMmH,QAAQ2C,MAAO;QACxB,MAAMpC,QAAQ7H,sBAAsBsH;QACpC,IAAIO,SAAS,CAAC9H,kBAAkB8H,OAAOT,kBAAkB;YACvDL,QAAQvE,IAAI,CAAC;gBAAEsF,MAAM;gBAAkBD,OAAOA,MAAMnF,EAAE;gBAAE4E;YAAK;QAC/D;IACF;IAEA,6EAA6E;IAC7E,MAAMA,OAAO2C,KAAK,CAAC,EAAE;IACrB,MAAM9B,cAAchI,kBAAkBmH;IACtC,MAAM4C,SACJ,CAACjD,SAASpD,IAAI,CAAC,CAAC0D,MAAQD,SAASC,OAAOD,KAAKE,QAAQ,CAAC,CAAC,CAAC,EAAED,KAAK,MAC/D,CAACnH,yBAAyB+H,gBAC1B,CAAC9H,mBAAmB8H;IACtB,IAAI,CAAC+B,QAAQ,OAAO;QAAEnD;QAASa,WAAWqC;QAAOX;IAAS;IAE1D,MAAMa,SAAShE,QAAOW,gBAAAA,MAAMqD,MAAM,YAAZrD,gBAAgB,IAAInC,IAAI;IAC9C,MAAMC,QAAQwF,UAAUD;IACxB,MAAMf,OAAOV,WAAWpH,oBAAoBsD;IAC5C,IAAIwE,MAAM;QACRrC,QAAQvE,IAAI,CAAC;YAAEsF,MAAM;YAAoBqC,QAAQA,OAAOpE,KAAK,CAAC,GAAG;YAAMqD,MAAMA,KAAKrD,KAAK,CAAC,GAAG;YAAMuB;QAAK;IACxG;IACA,MAAM+C,UAAUjB,eAAAA,OAAQV,WAAWzI,wBAAwB2E;IAC3D,IAAIyF,SAAS;QACX,MAAMxC,QAAQ3H,uBAAuB8E,IAAI,CACvC,CAACsF,YACCA,UAAU3B,OAAO,CAAC/E,IAAI,CAACgB,UAAU,CAAChF,oBAAoB0K,WAAWtD,UAAUI;QAE/E,IAAIS,OAAO;YACTd,QAAQvE,IAAI,CAAC;gBAAEsF,MAAM;gBAAmBD,OAAOA,MAAMnF,EAAE;gBAAE0G,MAAMiB,QAAQtE,KAAK,CAAC,GAAG;gBAAMuB;YAAK;QAC7F;IACF;IACA,OAAO;QAAEP;QAASa,WAAWqC;QAAOX;IAAS;AAC/C;AAEA,gFAAgF,GAChF,SAASc,UAAUG,IAAY;IAC7B,IAAIC,UAAUD;IACd,IAAI;QACFC,UAAUC,mBAAmBF;IAC/B,EAAE,eAAM;IACN,uCAAuC;IACzC;IACA,OAAOC,QAAQ/D,OAAO,CAAC,gBAAgB,KAAK9B,IAAI;AAClD"}