@descryy/mcp 0.11.3 → 0.11.5

package/dist/browser/auth.js

@@ -1,233 +0,0 @@
-/**
- * Reading an authenticated session in from a file — B1 of
- * `documents/plans/browser-reliability.md`.
- *
- * ## What was already here, and what was missing
- *
- * `browser_start_session` already accepted an inline `storageState` (11.4-b)
- * and `driver.ts` already carries it. Two things were missing and both are
- * about *reuse*: a caller had no way to point at a file, and a session had no
- * way to write one. Without those, "seed an authenticated session" means the
- * caller has to produce the cookie values by hand every time, which in
- * practice means nobody does it.
- *
- * So this module is the file half: load a browser's own saved state blob and
- * narrow it to the same-origin shape the port carries, refusing anything that
- * reaches outside the consented origin.
- *
- * ## Why the narrowing refuses rather than filters
- *
- * A saved state is whatever the browser had. A developer who logs in to their
- * application and saves the state has a file with one origin in it; a
- * developer who reuses a personal profile has a file with everything they are
- * logged into. Loading the second one wholesale would put unrelated
- * production sessions inside a browser the developer approved for one local
- * application. Quietly keeping only the matching cookies is worse than
- * refusing: a caller who believes they seeded a session and did not gets a run
- * that silently tested the logged-out surface and reported it as a clean one.
- *
- * ## Secrets
- *
- * Nothing here formats a value, including in a refusal — every message names a
- * cookie, a host or a path. `storageStateSecrets` returns the literal values
- * for `@descryy/core`'s `redactSecretsInText`, which replaces literal
- * substrings and never interprets one as a pattern, for the reason that
- * redactor's own header gives.
- *
- * Rule 1: a cookie, a header and an origin are facts about HTTP. No language,
- * framework or file extension is named here.
- */
-import { readFileSync } from "node:fs";
-import { isAbsolute, join, relative, resolve } from "node:path";
-import { ToolInputError } from "../tools/kit.js";
-const SAME_SITE = ["Strict", "Lax", "None"];
-function hostOf(origin) {
-    try {
-        return new URL(origin).hostname;
-    }
-    catch {
-        return origin;
-    }
-}
-/**
- * Does `domain` name the consented host and nothing else?
- *
- * A leading dot is how a saved jar spells "this domain and its subdomains", so
- * `.localhost` for `localhost` is the same host written two ways. What is not
- * accepted is a domain that covers *more* than the consented host — a cookie
- * for a parent domain travels to every sibling application under it, and that
- * is the widening this check exists to stop happening by accident.
- */
-function namesConsentedHost(domain, host) {
-    const bare = (domain.startsWith(".") ? domain.slice(1) : domain).toLowerCase();
-    return bare === host.toLowerCase();
-}
-/**
- * Load a browser's saved storage state and narrow it to one origin.
- *
- * `path` is absolute or relative to the repository root. Throws
- * `ToolInputError` — every failure here is something the caller can fix by
- * changing an argument, and none of them is a bug in this server.
- */
-export function loadStorageStateFile(path, context) {
-    const resolved = isAbsolute(path) ? path : join(context.repoPath, path);
-    let text;
-    try {
-        text = readFileSync(resolved, "utf8");
-    }
-    catch (error) {
-        throw new ToolInputError(`Could not read the storage state at ${resolved}: ${error instanceof Error ? error.message : String(error)}. ` +
-            "A relative path is resolved against the repository root. The usual way to produce this file is to " +
-            "start a session with headless false and saveStorageStateTo, log in by hand, and close it.");
-    }
-    return parseStorageStateJson(text, resolved, context);
-}
-/**
- * The parse-and-narrow half of {@link loadStorageStateFile}, taken directly rather than read
- * from a file — `browser-start-session.ts`'s `storageStateCredential` calls this against text
- * retrieved from `Session.credentialStore` (RG-1(4), lane "signin"). `sourceLabel` replaces the
- * file path in every message this can throw, so a credential-sourced refusal reads
- * `credential "NAME"` rather than a nonexistent file path.
- */
-export function parseStorageStateJson(text, sourceLabel, context) {
-    let parsed;
-    try {
-        parsed = JSON.parse(text);
-    }
-    catch {
-        // The parser's own message quotes the text around the failure, and in this
-        // one file that text is credential material.
-        throw new ToolInputError(`The storage state at ${sourceLabel} is not valid JSON. Its contents are deliberately not quoted here.`);
-    }
-    return narrowToOrigin(parsed, sourceLabel, context);
-}
-function narrowToOrigin(raw, path, context) {
-    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
-        throw new ToolInputError(`The storage state at ${path} is not an object.`);
-    }
-    const fields = raw;
-    const rawCookies = fields["cookies"];
-    const rawOrigins = fields["origins"];
-    // Both keys required rather than defaulted to empty. A blob missing one is
-    // far more likely to be the wrong file than a deliberately empty jar, and
-    // loading it produces a session that looks seeded and is not.
-    if (!Array.isArray(rawCookies) || !Array.isArray(rawOrigins)) {
-        throw new ToolInputError(`${path} does not look like a saved browser storage state — it needs a "cookies" array and an "origins" ` +
-            "array. Nothing was loaded.");
-    }
-    const host = hostOf(context.consentedOrigin);
-    const strayHosts = new Set();
-    const cookies = [];
-    for (const [index, entry] of rawCookies.entries()) {
-        if (typeof entry !== "object" || entry === null || Array.isArray(entry)) {
-            throw new ToolInputError(`${path}: cookies[${index}] is not an object. Nothing was loaded.`);
-        }
-        const cookie = entry;
-        const name = cookie["name"];
-        const value = cookie["value"];
-        const domain = cookie["domain"];
-        if (typeof name !== "string" || typeof value !== "string") {
-            throw new ToolInputError(`${path}: cookies[${index}] needs a string "name" and "value". Nothing was loaded.`);
-        }
-        if (typeof domain !== "string" || !namesConsentedHost(domain, host)) {
-            strayHosts.add(typeof domain === "string" ? domain : "(no domain)");
-            continue;
-        }
-        const sameSite = cookie["sameSite"];
-        cookies.push({
-            name,
-            value,
-            // The domain is deliberately dropped rather than carried: the port's
-            // shape has no field for one, which is what makes a second origin
-            // unnameable rather than merely unaccepted.
-            ...(typeof cookie["path"] === "string" ? { path: cookie["path"] } : {}),
-            ...(typeof cookie["httpOnly"] === "boolean" ? { httpOnly: cookie["httpOnly"] } : {}),
-            ...(typeof cookie["secure"] === "boolean" ? { secure: cookie["secure"] } : {}),
-            ...(typeof sameSite === "string" && SAME_SITE.includes(sameSite)
-                ? { sameSite: sameSite }
-                : {}),
-        });
-    }
-    const strayOrigins = new Set();
-    const localStorage = {};
-    for (const [index, entry] of rawOrigins.entries()) {
-        if (typeof entry !== "object" || entry === null || Array.isArray(entry)) {
-            throw new ToolInputError(`${path}: origins[${index}] is not an object. Nothing was loaded.`);
-        }
-        const origin = entry["origin"];
-        if (typeof origin !== "string") {
-            throw new ToolInputError(`${path}: origins[${index}] needs a string "origin". Nothing was loaded.`);
-        }
-        if (origin !== context.consentedOrigin) {
-            strayOrigins.add(origin);
-            continue;
-        }
-        const items = entry["localStorage"];
-        if (items !== undefined && !Array.isArray(items)) {
-            throw new ToolInputError(`${path}: origins[${index}].localStorage is not an array. Nothing was loaded.`);
-        }
-        for (const item of items ?? []) {
-            if (typeof item !== "object" || item === null)
-                continue;
-            const { name, value } = item;
-            if (typeof name === "string" && typeof value === "string")
-                localStorage[name] = value;
-        }
-    }
-    if (strayHosts.size > 0 || strayOrigins.size > 0) {
-        const parts = [];
-        if (strayHosts.size > 0)
-            parts.push(`cookies for ${[...strayHosts].join(", ")}`);
-        if (strayOrigins.size > 0)
-            parts.push(`stored data for ${[...strayOrigins].join(", ")}`);
-        throw new ToolInputError(`${path} carries ${parts.join(" and ")}, which ${context.consentedOrigin} does not cover. This session's ` +
-            "consent is bound to one origin, and seeding credentials for other hosts would put sessions the " +
-            "developer never approved inside this browser. Nothing was loaded, and no value from the file is " +
-            "printed here. Save a state for this application alone — a session started with saveStorageStateTo " +
-            "writes exactly that.");
-    }
-    return {
-        ...(cookies.length === 0 ? {} : { cookies }),
-        ...(Object.keys(localStorage).length === 0 ? {} : { localStorage }),
-    };
-}
-/**
- * Where a saved state may be written.
- *
- * Inside the repository is refused. A storage state is a live credential in a
- * file, and the likeliest thing to happen to a file written into a working
- * tree is that it gets committed. Refusing costs the caller one argument; the
- * alternative costs them a session in their history.
- */
-export function resolveSavePath(raw, repoPath) {
-    const path = isAbsolute(raw) ? raw : resolve(join(repoPath, raw));
-    const within = relative(resolve(repoPath), path);
-    if (within !== "" && !within.startsWith("..") && !isAbsolute(within)) {
-        throw new ToolInputError(`"saveStorageStateTo" resolves to ${path}, which is inside the repository at ${repoPath}. A saved storage ` +
-            "state is a live credential in a file, and a credential written into a working tree is one `git add .` " +
-            "away from being committed. Give an absolute path outside the repository.");
-    }
-    return path;
-}
-/**
- * Every literal value a state carries. Names are deliberately absent — a
- * cookie called `session` is not a secret, and redacting the word would make
- * every reply that mentions a session unreadable.
- *
- * Values under four characters are dropped: one that short matches everywhere
- * and would redact a reply into noise, which is a worse outcome than leaving
- * a four-character credential in it.
- */
-export function storageStateSecrets(state) {
-    if (state === null)
-        return [];
-    const values = [...(state.cookies ?? []).map((cookie) => cookie.value), ...Object.values(state.localStorage ?? {})];
-    return [...new Set(values.filter((value) => value.length >= 4))];
-}
-/** The same, for header values. Separate because headers are not part of a storage state. */
-export function headerSecrets(headers) {
-    if (headers === null)
-        return [];
-    return [...new Set(Object.values(headers).filter((value) => value.length >= 4))];
-}
-//# sourceMappingURL=auth.js.map

package/dist/browser/auth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/browser/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEhE,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAUjD,MAAM,SAAS,GAA2C,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAEpF,SAAS,MAAM,CAAC,MAAc;IAC5B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,kBAAkB,CAAC,MAAc,EAAE,IAAY;IACtD,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/E,OAAO,IAAI,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,OAA4B;IAC7E,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAExE,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,cAAc,CACtB,uCAAuC,QAAQ,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI;YAC5G,oGAAoG;YACpG,2FAA2F,CAC9F,CAAC;IACJ,CAAC;IAED,OAAO,qBAAqB,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,WAAmB,EAAE,OAA4B;IACnG,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,6CAA6C;QAC7C,MAAM,IAAI,cAAc,CAAC,wBAAwB,WAAW,oEAAoE,CAAC,CAAC;IACpI,CAAC;IAED,OAAO,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,cAAc,CAAC,GAAY,EAAE,IAAY,EAAE,OAA4B;IAC9E,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,cAAc,CAAC,wBAAwB,IAAI,oBAAoB,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,MAAM,GAAG,GAA8B,CAAC;IAC9C,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAErC,2EAA2E;IAC3E,0EAA0E;IAC1E,8DAA8D;IAC9D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,cAAc,CACtB,GAAG,IAAI,kGAAkG;YACvG,4BAA4B,CAC/B,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,OAAO,GAAmB,EAAE,CAAC;IAEnC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;QAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,cAAc,CAAC,GAAG,IAAI,aAAa,KAAK,yCAAyC,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC1D,MAAM,IAAI,cAAc,CAAC,GAAG,IAAI,aAAa,KAAK,0DAA0D,CAAC,CAAC;QAChH,CAAC;QACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;YACpE,UAAU,CAAC,GAAG,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;YACpE,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC;YACX,IAAI;YACJ,KAAK;YACL,qEAAqE;YACrE,kEAAkE;YAClE,4CAA4C;YAC5C,GAAG,CAAC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,GAAG,CAAC,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpF,GAAG,CAAC,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,GAAG,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,SAAS,CAAC,QAAQ,CAAC,QAAqC,CAAC;gBAC3F,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAqC,EAAE;gBACrD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;IACL,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,MAAM,YAAY,GAA2B,EAAE,CAAC;IAChD,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;QAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,cAAc,CAAC,GAAG,IAAI,aAAa,KAAK,yCAAyC,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,MAAM,GAAI,KAAiC,CAAC,QAAQ,CAAC,CAAC;QAC5D,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,MAAM,IAAI,cAAc,CAAC,GAAG,IAAI,aAAa,KAAK,gDAAgD,CAAC,CAAC;QACtG,CAAC;QACD,IAAI,MAAM,KAAK,OAAO,CAAC,eAAe,EAAE,CAAC;YACvC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACzB,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAI,KAAiC,CAAC,cAAc,CAAC,CAAC;QACjE,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,cAAc,CAAC,GAAG,IAAI,aAAa,KAAK,qDAAqD,CAAC,CAAC;QAC3G,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;YAC/B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;gBAAE,SAAS;YACxD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,IAA+B,CAAC;YACxD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,YAAY,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACxF,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,IAAI,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACjD,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,UAAU,CAAC,IAAI,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjF,IAAI,YAAY,CAAC,IAAI,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzF,MAAM,IAAI,cAAc,CACtB,GAAG,IAAI,YAAY,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,OAAO,CAAC,eAAe,kCAAkC;YACxG,iGAAiG;YACjG,kGAAkG;YAClG,oGAAoG;YACpG,sBAAsB,CACzB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QAC5C,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;KACpE,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,QAAgB;IAC3D,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;IACjD,IAAI,MAAM,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,cAAc,CACtB,oCAAoC,IAAI,uCAAuC,QAAQ,oBAAoB;YACzG,wGAAwG;YACxG,0EAA0E,CAC7E,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAiC;IACnE,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;IACpH,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,aAAa,CAAC,OAAgD;IAC5E,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAChC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACnF,CAAC"}

package/dist/browser/capability-probe.d.ts

@@ -1,109 +0,0 @@
-/**
- * Fingerprint the application before driving it, and say up front how much of
- * it is likely reachable. §4.2.
- *
- * ## Why a probe is worth more than it looks
- *
- * The obvious value is expectation-setting: a run that opens by saying "this
- * page has a payment widget in a frame I cannot enter and a canvas I cannot
- * read" is a better run than one that discovers it at the end. The larger value
- * is the second-order one §4.2 names — **the distribution of these fingerprints
- * across real applications is the roadmap.** The corpus in
- * `fixtures/hostile-apps/` was drawn from imagination, which is exactly the
- * method §4 says does not scale. A risk kind counted across real sessions is
- * drawn from the field, and it ranks the work without anybody guessing.
- *
- * That is why `ReachRiskKind` is a small closed vocabulary and not free text.
- * A count is only a roadmap if the same shape lands in the same bucket every
- * time.
- *
- * ## The estimate is pessimistic in exactly one direction
- *
- * `full` requires **zero** named risks. Anything else is at best `partial`. An
- * estimate that reads high and then disappoints is the failure this exists to
- * remove, so the asymmetry is deliberate: a `partial` that turns out to be full
- * coverage costs a sentence of hedging, and a `full` that turns out to be 30%
- * costs the report's credibility.
- *
- * Nothing here names a language or a framework (rule 1) — every field is a
- * property of a rendered document.
- */
-/** How much of the application this page is likely to expose. Four values, ordered worst-last. */
-export declare const REACH_BANDS: readonly ["full", "partial", "low", "blocked"];
-export type ReachBand = (typeof REACH_BANDS)[number];
-/**
- * The closed vocabulary of reasons reach is at risk. Extend it only with a
- * shape seen in the field — a kind nobody counts is a kind that cannot rank
- * anything, and a kind that overlaps another makes both counts meaningless.
- */
-export declare const REACH_RISK_KINDS: readonly ["shadowRoot", "childFrame", "crossOriginFrame", "virtualizedRegion", "belowTheFold", "canvasRendered", "overlay", "inertSubtree", "authWall", "challenge", "clientSideRouting"];
-export type ReachRiskKind = (typeof REACH_RISK_KINDS)[number];
-export interface ReachRisk {
-    readonly kind: ReachRiskKind;
-    /** What was found, with the number that was found. */
-    readonly detail: string;
-    /** What it costs — stated as a consequence for this run, not as a category. */
-    readonly effect: string;
-}
-export interface ReachEstimate {
-    readonly band: ReachBand;
-    readonly risks: readonly ReachRisk[];
-}
-/**
- * What one probe of a page found. Counts, never verdicts: a fingerprint is
- * evidence, and `estimateReach` is the only thing that turns it into a claim.
- */
-export interface PageFingerprint {
-    readonly url: string;
-    /** Interactive elements the snapshot query matched, shadow roots included. */
-    readonly interactiveElements: number;
-    /** Open shadow roots found. Closed ones cannot be counted at all, which is disclosed rather than reported as zero. */
-    readonly openShadowRoots: number;
-    /** Of `interactiveElements`, how many live inside a shadow root. These are drivable and unsaveable. */
-    readonly shadowInteractiveElements: number;
-    readonly childFrames: number;
-    readonly crossOriginChildFrames: number;
-    /** Regions whose scrollable content exceeds their box — a paged, virtualized or otherwise windowed list. */
-    readonly scrollableRegions: number;
-    /** Largest canvas area as a share of the viewport, 0–1. */
-    readonly canvasViewportShare: number;
-    /** Largest canvas area in CSS pixels. Needed alongside the share because a
-     *  small viewport and a large one disagree about the same canvas. */
-    readonly largestCanvasArea: number;
-    /** Fixed-position elements covering a large part of the viewport — a consent
-     *  banner, a cookie wall, an interstitial. Counted because the app underneath
-     *  one is fully enumerable and completely unclickable, which is the single
-     *  most misleading state this probe can be in. */
-    readonly fixedOverlays: number;
-    /** Elements marked `inert`. Their descendants are in the DOM, are enumerated,
-     *  and are removed from hit-testing and focus entirely. */
-    readonly inertSubtrees: number;
-    /** Modal dialogs currently open. A modal makes the rest of the document
-     *  unreachable whether or not anyone marked it inert. */
-    readonly openModalDialogs: number;
-    readonly passwordFields: number;
-    /**
-     * Fields declaring `autocomplete="one-time-code"` — a second factor.
-     *
-     * Counted apart from `passwordFields` because a second-factor screen usually
-     * has no password on it, so a session that landed on one would otherwise look
-     * like an ordinary page with a text box. It is deliberately **not** a
-     * `challenge`: the code is a fact Descry does not have rather than a test it
-     * is refusing to sit, and the remedy — seed a session that is already past it
-     * — is the same one an auth wall has, so it is reported as the same risk with
-     * its own sentence. Matched on the standard attribute alone: a looser match
-     * would put a wall in front of an application that has none.
-     */
-    readonly oneTimeCodeFields: number;
-    /** Markers a human-verification challenge leaves behind, in plain words. Empty is a real "none found", not "did not look". */
-    readonly challengeMarkers: readonly string[];
-    /** The page changed history without a document navigation. **Null means not
-     *  probed** — a single static look cannot tell a routed application from a
-     *  server-rendered one, and `false` there would be a claim nothing supports. */
-    readonly clientSideRouting: boolean | null;
-    /** Document height over viewport height. 1 means everything is on screen. */
-    readonly documentHeightRatio: number;
-}
-export declare function estimateReach(fingerprint: PageFingerprint): ReachEstimate;
-export declare function reachEstimateNotes(estimate: ReachEstimate, notProbedRouting?: boolean): readonly string[];
-//# sourceMappingURL=capability-probe.d.ts.map

package/dist/browser/capability-probe.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"capability-probe.d.ts","sourceRoot":"","sources":["../../src/browser/capability-probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,kGAAkG;AAClG,eAAO,MAAM,WAAW,gDAAiD,CAAC;AAC1E,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAErD;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,2LAYnB,CAAC;AACX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,sDAAsD;IACtD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,+EAA+E;IAC/E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,CAAC;CACtC;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,sHAAsH;IACtH,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,uGAAuG;IACvG,QAAQ,CAAC,yBAAyB,EAAE,MAAM,CAAC;IAC3C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,4GAA4G;IAC5G,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,2DAA2D;IAC3D,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC;yEACqE;IACrE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC;;;sDAGkD;IAClD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;+DAC2D;IAC3D,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;6DACyD;IACzD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,8HAA8H;IAC9H,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C;;oFAEgF;IAChF,QAAQ,CAAC,iBAAiB,EAAE,OAAO,GAAG,IAAI,CAAC;IAC3C,6EAA6E;IAC7E,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;CACtC;AAgBD,wBAAgB,aAAa,CAAC,WAAW,EAAE,eAAe,GAAG,aAAa,CAiIzE;AAmBD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,aAAa,EAAE,gBAAgB,UAAQ,GAAG,SAAS,MAAM,EAAE,CAkBvG"}

package/dist/browser/capability-probe.js

@@ -1,201 +0,0 @@
-/**
- * Fingerprint the application before driving it, and say up front how much of
- * it is likely reachable. §4.2.
- *
- * ## Why a probe is worth more than it looks
- *
- * The obvious value is expectation-setting: a run that opens by saying "this
- * page has a payment widget in a frame I cannot enter and a canvas I cannot
- * read" is a better run than one that discovers it at the end. The larger value
- * is the second-order one §4.2 names — **the distribution of these fingerprints
- * across real applications is the roadmap.** The corpus in
- * `fixtures/hostile-apps/` was drawn from imagination, which is exactly the
- * method §4 says does not scale. A risk kind counted across real sessions is
- * drawn from the field, and it ranks the work without anybody guessing.
- *
- * That is why `ReachRiskKind` is a small closed vocabulary and not free text.
- * A count is only a roadmap if the same shape lands in the same bucket every
- * time.
- *
- * ## The estimate is pessimistic in exactly one direction
- *
- * `full` requires **zero** named risks. Anything else is at best `partial`. An
- * estimate that reads high and then disappoints is the failure this exists to
- * remove, so the asymmetry is deliberate: a `partial` that turns out to be full
- * coverage costs a sentence of hedging, and a `full` that turns out to be 30%
- * costs the report's credibility.
- *
- * Nothing here names a language or a framework (rule 1) — every field is a
- * property of a rendered document.
- */
-/** How much of the application this page is likely to expose. Four values, ordered worst-last. */
-export const REACH_BANDS = ["full", "partial", "low", "blocked"];
-/**
- * The closed vocabulary of reasons reach is at risk. Extend it only with a
- * shape seen in the field — a kind nobody counts is a kind that cannot rank
- * anything, and a kind that overlaps another makes both counts meaningless.
- */
-export const REACH_RISK_KINDS = [
-    "shadowRoot",
-    "childFrame",
-    "crossOriginFrame",
-    "virtualizedRegion",
-    "belowTheFold",
-    "canvasRendered",
-    "overlay",
-    "inertSubtree",
-    "authWall",
-    "challenge",
-    "clientSideRouting",
-];
-/** Above this share of the viewport, a canvas is the application rather than a chart in it. */
-const CANVAS_DOMINATES = 0.5;
-/**
- * A canvas can be the whole application and still be a quarter of a large
- * viewport — `fixtures/hostile-apps/` app 08 measured 0.25 on a 1280×720
- * window and the share rule alone called it `full` reach, which is the wrong
- * answer about an app with no DOM controls at all. So a large canvas on a page
- * with almost nothing to click also counts. Both numbers are starting values.
- */
-const CANVAS_LARGE_AREA = 50_000;
-const FEW_CONTROLS = 2;
-/** Below this, a taller-than-viewport document is ordinary rather than a long unvisited page. */
-const TALL_DOCUMENT = 2;
-export function estimateReach(fingerprint) {
-    const risks = [];
-    if (fingerprint.challengeMarkers.length > 0) {
-        risks.push({
-            kind: "challenge",
-            detail: `A human-verification challenge is present: ${fingerprint.challengeMarkers.join("; ")}.`,
-            effect: "Descry does not attempt to pass a challenge, by design. Everything behind this screen is not analysable, " +
-                "and reporting it as clean would be the more serious error.",
-        });
-    }
-    if (fingerprint.passwordFields > 0 || fingerprint.oneTimeCodeFields > 0) {
-        const parts = [];
-        if (fingerprint.passwordFields > 0) {
-            parts.push(`${fingerprint.passwordFields} password field${fingerprint.passwordFields === 1 ? "" : "s"}`);
-        }
-        if (fingerprint.oneTimeCodeFields > 0) {
-            parts.push(`${fingerprint.oneTimeCodeFields} one-time code field${fingerprint.oneTimeCodeFields === 1 ? "" : "s"} (a second factor)`);
-        }
-        risks.push({
-            kind: "authWall",
-            detail: `The entry screen has ${parts.join(" and ")}.`,
-            effect: "This looks like a sign-in step rather than the application. Without a seeded session, only this screen " +
-                "and whatever it links to without signing in can be reached. A second factor in particular is a value " +
-                "Descry does not hold and does not try to obtain — a session seeded from past it is the way through.",
-        });
-    }
-    if (fingerprint.fixedOverlays > 0) {
-        risks.push({
-            kind: "overlay",
-            detail: `${fingerprint.fixedOverlays} fixed element${fingerprint.fixedOverlays === 1 ? "" : "s"} cover${fingerprint.fixedOverlays === 1 ? "s" : ""} a large part of the viewport.`,
-            effect: "A consent banner or interstitial over the application leaves every control beneath it enumerable, " +
-                "counted and untouchable. Until it is dismissed, an element list of this page describes an app that " +
-                "cannot be operated.",
-        });
-    }
-    if (fingerprint.openModalDialogs > 0 || fingerprint.inertSubtrees > 0) {
-        risks.push({
-            kind: "inertSubtree",
-            detail: `${fingerprint.openModalDialogs} open modal dialog${fingerprint.openModalDialogs === 1 ? "" : "s"} and ` +
-                `${fingerprint.inertSubtrees} inert subtree${fingerprint.inertSubtrees === 1 ? "" : "s"} on the page.`,
-            effect: "Everything outside the modal is still in the document and still enumerated, but is out of the hit-testing " +
-                "and focus trees. A click on it does not time out slowly — it cannot land at all.",
-        });
-    }
-    if (fingerprint.canvasViewportShare >= CANVAS_DOMINATES ||
-        (fingerprint.largestCanvasArea >= CANVAS_LARGE_AREA && fingerprint.interactiveElements <= FEW_CONTROLS)) {
-        risks.push({
-            kind: "canvasRendered",
-            detail: `A canvas covers about ${Math.round(fingerprint.canvasViewportShare * 100)}% of the viewport (${Math.round(fingerprint.largestCanvasArea)} px²).`,
-            effect: "Controls drawn into a canvas have no element behind them. Nothing on that surface can be enumerated or " +
-                "clicked, and any element reported from inside it is fallback markup that is not on screen.",
-        });
-    }
-    if (fingerprint.openShadowRoots > 0) {
-        risks.push({
-            kind: "shadowRoot",
-            detail: `${fingerprint.openShadowRoots} open shadow root${fingerprint.openShadowRoots === 1 ? "" : "s"}, holding ${fingerprint.shadowInteractiveElements} interactive element${fingerprint.shadowInteractiveElements === 1 ? "" : "s"}.`,
-            effect: "These can be driven this session but cannot be given a stable selector, so none of them can be saved to a " +
-                "scenario and replayed.",
-        });
-    }
-    if (fingerprint.childFrames > fingerprint.crossOriginChildFrames) {
-        risks.push({
-            kind: "childFrame",
-            detail: `${fingerprint.childFrames - fingerprint.crossOriginChildFrames} same-origin frame${fingerprint.childFrames - fingerprint.crossOriginChildFrames === 1 ? "" : "s"} on the page.`,
-            effect: "Their contents are enumerated and drivable, but an element inside a frame is given no page-level " +
-                "selector — the scenario format has no field to name a frame — so a flow through one cannot be saved " +
-                "or replayed.",
-        });
-    }
-    if (fingerprint.crossOriginChildFrames > 0) {
-        risks.push({
-            kind: "crossOriginFrame",
-            detail: `${fingerprint.crossOriginChildFrames} frame${fingerprint.crossOriginChildFrames === 1 ? "" : "s"} from another origin.`,
-            effect: "An embedded third-party surface — payment, auth or chat, typically. It is outside the origin this session " +
-                "was consented for, so it is not entered even when it could be.",
-        });
-    }
-    if (fingerprint.scrollableRegions > 0) {
-        risks.push({
-            kind: "virtualizedRegion",
-            detail: `${fingerprint.scrollableRegions} region${fingerprint.scrollableRegions === 1 ? "" : "s"} scroll independently of the page.`,
-            effect: "A windowed list renders only what is in view and destroys what it leaves, so no single snapshot can ever " +
-                "contain all of it and a handle taken before a scroll may not survive one.",
-        });
-    }
-    if (fingerprint.documentHeightRatio >= TALL_DOCUMENT) {
-        risks.push({
-            kind: "belowTheFold",
-            detail: `The document is about ${fingerprint.documentHeightRatio.toFixed(1)}× the viewport height.`,
-            effect: "Most of the page was never scrolled to. What is below the fold is unvisited, not absent.",
-        });
-    }
-    if (fingerprint.clientSideRouting === true) {
-        risks.push({
-            kind: "clientSideRouting",
-            detail: "The page changes history without loading a document.",
-            effect: "Screens are reached by clicking rather than by URL, so a screen nobody clicked toward was never seen and " +
-                "does not appear as a missing page anywhere.",
-        });
-    }
-    return { band: bandFor(risks), risks };
-}
-function bandFor(risks) {
-    if (risks.length === 0)
-        return "full";
-    const kinds = new Set(risks.map((r) => r.kind));
-    if (kinds.has("challenge"))
-        return "blocked";
-    // A covered or modal-blocked app is `low`, not `partial`: unlike a shadow
-    // root or a frame, nothing on the page is operable while it holds.
-    if (kinds.has("canvasRendered") || kinds.has("authWall") || kinds.has("overlay") || kinds.has("inertSubtree"))
-        return "low";
-    return "partial";
-}
-const BAND_SENTENCE = {
-    full: "Nothing on this page was recognised as a barrier to reaching it. That is an estimate made before driving anything, not a measurement of what was reached.",
-    partial: "Parts of this application are expected to be out of reach. This is an estimate made before driving anything; the reachability report at the end of the session is the measurement.",
-    low: "Most of this application is expected to be out of reach. This is an estimate made before driving anything; the reachability report at the end of the session is the measurement.",
-    blocked: "This screen is behind a challenge Descry does not attempt to pass. Anything behind it is not analysable — which is a different statement from finding nothing wrong with it.",
-};
-export function reachEstimateNotes(estimate, notProbedRouting = false) {
-    const notes = [`Reach estimate: ${estimate.band}. ${BAND_SENTENCE[estimate.band]}`];
-    for (const risk of estimate.risks)
-        notes.push(`${risk.kind}: ${risk.detail} ${risk.effect}`);
-    if (notProbedRouting) {
-        notes.push("Whether this application routes on the client was not probed — one static look cannot tell that from a " +
-            "server-rendered page. If it does route on the client, screens are reached by clicking rather than by URL, " +
-            "and a screen nobody clicked toward is missing from every number here without appearing as a missing page.");
-    }
-    if (estimate.risks.some((r) => r.kind === "shadowRoot")) {
-        notes.push("Only open shadow roots are counted. A closed shadow root cannot be enumerated at all, so its contents are " +
-            "neither counted here nor reported as absent — if this application uses one, its controls are missing from " +
-            "every number in this session.");
-    }
-    return notes;
-}
-//# sourceMappingURL=capability-probe.js.map

package/dist/browser/capability-probe.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"capability-probe.js","sourceRoot":"","sources":["../../src/browser/capability-probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,kGAAkG;AAClG,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,CAAU,CAAC;AAG1E;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,YAAY;IACZ,YAAY;IACZ,kBAAkB;IAClB,mBAAmB;IACnB,cAAc;IACd,gBAAgB;IAChB,SAAS;IACT,cAAc;IACd,UAAU;IACV,WAAW;IACX,mBAAmB;CACX,CAAC;AAwEX,+FAA+F;AAC/F,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACjC,MAAM,YAAY,GAAG,CAAC,CAAC;AACvB,iGAAiG;AACjG,MAAM,aAAa,GAAG,CAAC,CAAC;AAExB,MAAM,UAAU,aAAa,CAAC,WAA4B;IACxD,MAAM,KAAK,GAAgB,EAAE,CAAC;IAE9B,IAAI,WAAW,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,8CAA8C,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YAChG,MAAM,EACJ,2GAA2G;gBAC3G,4DAA4D;SAC/D,CAAC,CAAC;IACL,CAAC;IAED,IAAI,WAAW,CAAC,cAAc,GAAG,CAAC,IAAI,WAAW,CAAC,iBAAiB,GAAG,CAAC,EAAE,CAAC;QACxE,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,WAAW,CAAC,cAAc,GAAG,CAAC,EAAE,CAAC;YACnC,KAAK,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,cAAc,kBAAkB,WAAW,CAAC,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3G,CAAC;QACD,IAAI,WAAW,CAAC,iBAAiB,GAAG,CAAC,EAAE,CAAC;YACtC,KAAK,CAAC,IAAI,CACR,GAAG,WAAW,CAAC,iBAAiB,uBAAuB,WAAW,CAAC,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,oBAAoB,CAC1H,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,wBAAwB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG;YACtD,MAAM,EACJ,yGAAyG;gBACzG,uGAAuG;gBACvG,qGAAqG;SACxG,CAAC,CAAC;IACL,CAAC;IAED,IAAI,WAAW,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,GAAG,WAAW,CAAC,aAAa,iBAAiB,WAAW,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,SAAS,WAAW,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,gCAAgC;YAClL,MAAM,EACJ,oGAAoG;gBACpG,qGAAqG;gBACrG,qBAAqB;SACxB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,WAAW,CAAC,gBAAgB,GAAG,CAAC,IAAI,WAAW,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;QACtE,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,cAAc;YACpB,MAAM,EACJ,GAAG,WAAW,CAAC,gBAAgB,qBAAqB,WAAW,CAAC,gBAAgB,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO;gBACxG,GAAG,WAAW,CAAC,aAAa,iBAAiB,WAAW,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,eAAe;YACxG,MAAM,EACJ,4GAA4G;gBAC5G,kFAAkF;SACrF,CAAC,CAAC;IACL,CAAC;IAED,IACE,WAAW,CAAC,mBAAmB,IAAI,gBAAgB;QACnD,CAAC,WAAW,CAAC,iBAAiB,IAAI,iBAAiB,IAAI,WAAW,CAAC,mBAAmB,IAAI,YAAY,CAAC,EACvG,CAAC;QACD,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE,yBAAyB,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,mBAAmB,GAAG,GAAG,CAAC,sBAAsB,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,iBAAiB,CAAC,QAAQ;YACzJ,MAAM,EACJ,yGAAyG;gBACzG,4FAA4F;SAC/F,CAAC,CAAC;IACL,CAAC;IAED,IAAI,WAAW,CAAC,eAAe,GAAG,CAAC,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,YAAY;YAClB,MAAM,EAAE,GAAG,WAAW,CAAC,eAAe,oBAAoB,WAAW,CAAC,eAAe,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,aAAa,WAAW,CAAC,yBAAyB,uBAAuB,WAAW,CAAC,yBAAyB,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG;YACxO,MAAM,EACJ,4GAA4G;gBAC5G,wBAAwB;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,IAAI,WAAW,CAAC,WAAW,GAAG,WAAW,CAAC,sBAAsB,EAAE,CAAC;QACjE,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,YAAY;YAClB,MAAM,EAAE,GAAG,WAAW,CAAC,WAAW,GAAG,WAAW,CAAC,sBAAsB,qBAAqB,WAAW,CAAC,WAAW,GAAG,WAAW,CAAC,sBAAsB,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,eAAe;YACxL,MAAM,EACJ,mGAAmG;gBACnG,sGAAsG;gBACtG,cAAc;SACjB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,WAAW,CAAC,sBAAsB,GAAG,CAAC,EAAE,CAAC;QAC3C,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,kBAAkB;YACxB,MAAM,EAAE,GAAG,WAAW,CAAC,sBAAsB,SAAS,WAAW,CAAC,sBAAsB,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,uBAAuB;YAChI,MAAM,EACJ,4GAA4G;gBAC5G,gEAAgE;SACnE,CAAC,CAAC;IACL,CAAC;IAED,IAAI,WAAW,CAAC,iBAAiB,GAAG,CAAC,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,GAAG,WAAW,CAAC,iBAAiB,UAAU,WAAW,CAAC,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,oCAAoC;YACpI,MAAM,EACJ,2GAA2G;gBAC3G,2EAA2E;SAC9E,CAAC,CAAC;IACL,CAAC;IAED,IAAI,WAAW,CAAC,mBAAmB,IAAI,aAAa,EAAE,CAAC;QACrD,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,yBAAyB,WAAW,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB;YACnG,MAAM,EAAE,0FAA0F;SACnG,CAAC,CAAC;IACL,CAAC;IAED,IAAI,WAAW,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC3C,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,sDAAsD;YAC9D,MAAM,EACJ,2GAA2G;gBAC3G,6CAA6C;SAChD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,OAAO,CAAC,KAA2B;IAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7C,0EAA0E;IAC1E,mEAAmE;IACnE,IAAI,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5H,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,aAAa,GAAwC;IACzD,IAAI,EAAE,2JAA2J;IACjK,OAAO,EAAE,oLAAoL;IAC7L,GAAG,EAAE,kLAAkL;IACvL,OAAO,EAAE,8KAA8K;CACxL,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAAC,QAAuB,EAAE,gBAAgB,GAAG,KAAK;IAClF,MAAM,KAAK,GAAG,CAAC,mBAAmB,QAAQ,CAAC,IAAI,KAAK,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpF,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7F,IAAI,gBAAgB,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CACR,yGAAyG;YACvG,4GAA4G;YAC5G,2GAA2G,CAC9G,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,EAAE,CAAC;QACxD,KAAK,CAAC,IAAI,CACR,4GAA4G;YAC1G,4GAA4G;YAC5G,+BAA+B,CAClC,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}