@faicad/faijs 0.18.3 → 0.22.2

package/dist/lang/parse-error.d.ts

@@ -22,7 +22,13 @@ export type ParseErrorCode =
 /** 本机函数调用 ABI 违规（§3.6：位置实参超位 / args 对象键不在形参表） */
  | 'E_ARG'
 /** 安全门禁违规（SecurityScanner 命中：危险标识符 / 危险语法 / 自由标识符等） */
- | 'E_SECURITY';
+ | 'E_SECURITY'
+/** P6/D8: 有量纲位收到裸数字字面量（dimension pass） */
+ | 'E_DIM_BARE_NUMBER'
+/** P6/D8: 可判定量纲的两侧量纲不一致（dimension pass） */
+ | 'E_DIM_MISMATCH'
+/** P6/D8: 单位常量名不在表中（dimension pass 兖底） */
+ | 'E_DIM_UNKNOWN_UNIT';
 /**
  * An error raised while parsing faijs source, carrying the offending line
  * number and a diagnostic code the host can forward for precise feedback.

package/dist/lang/parse-error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parse-error.d.ts","sourceRoot":"","sources":["../../src/lang/parse-error.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,4DAA4D;AAC5D,MAAM,MAAM,cAAc;AACxB,qBAAqB;AACnB,UAAU;AACZ,wFAAwF;GACtF,gBAAgB;AAClB,uCAAuC;GACrC,aAAa;AACf,oCAAoC;GAClC,SAAS;AACX,2BAA2B;GACzB,UAAU;AACZ,gCAAgC;GAC9B,aAAa;AACf,iDAAiD;GAC/C,OAAO;AACT,uDAAuD;GACrD,YAAY,CAAA;AAEhB;;;GAGG;AACH,qBAAa,UAAW,SAAQ,KAAK;IACnC,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAA;IACZ,6DAA6D;IAC7D,IAAI,EAAE,cAAc,CAAA;IACpB,8FAA8F;IAC9F,MAAM,CAAC,EAAE,MAAM,CAAA;gBAEH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,cAA2B,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM;CAU/G"}
+{"version":3,"file":"parse-error.d.ts","sourceRoot":"","sources":["../../src/lang/parse-error.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,4DAA4D;AAC5D,MAAM,MAAM,cAAc;AACxB,qBAAqB;AACnB,UAAU;AACZ,wFAAwF;GACtF,gBAAgB;AAClB,uCAAuC;GACrC,aAAa;AACf,oCAAoC;GAClC,SAAS;AACX,2BAA2B;GACzB,UAAU;AACZ,gCAAgC;GAC9B,aAAa;AACf,iDAAiD;GAC/C,OAAO;AACT,uDAAuD;GACrD,YAAY;AACd,0CAA0C;GACxC,mBAAmB;AACrB,2CAA2C;GACzC,gBAAgB;AAClB,0CAA0C;GACxC,oBAAoB,CAAA;AAExB;;;GAGG;AACH,qBAAa,UAAW,SAAQ,KAAK;IACnC,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAA;IACZ,6DAA6D;IAC7D,IAAI,EAAE,cAAc,CAAA;IACpB,8FAA8F;IAC9F,MAAM,CAAC,EAAE,MAAM,CAAA;gBAEH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,cAA2B,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM;CAU/G"}

package/dist/lang/parse-error.js.map

@@ -1 +1 @@
-{"version":3,"file":"parse-error.js","sourceRoot":"","sources":["../../src/lang/parse-error.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAqBH;;;GAGG;AACH,MAAM,OAAO,UAAW,SAAQ,KAAK;IACnC,iEAAiE;IACjE,IAAI,CAAQ;IACZ,6DAA6D;IAC7D,IAAI,CAAgB;IACpB,8FAA8F;IAC9F,MAAM,CAAS;IAEf,YAAY,OAAe,EAAE,IAAY,EAAE,OAAuB,UAAU,EAAE,KAAe,EAAE,MAAe;QAC5G,KAAK,CACH,iBAAiB,IAAI,KAAK,OAAO,EAAE,EACnC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,EAAE,KAAK,EAA8B,CACzE,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,YAAY,CAAA;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IAChD,CAAC;CACF","sourcesContent":["/**\n * parse-error — 文本层解析错误的唯一归属（L0 零依赖）\n *\n * 无 IR 双通道方案（2026-09-06）后语义层删除，MetadataExtractor /\n * SyntaxGate 复用同一 ParseError（宿主面 analyzeCode/codeToArgs 抛错契约不变：\n * 含 line 与 code 字段）。本文件是 ParseError 的唯一家。\n */\n\n/** 解析诊断码（宿主 CadRuntime.check 透传给 CheckError，AI 可据此精确修正）。 */\nexport type ParseErrorCode =\n  /** 语法错误（acorn 闸门） */\n  | 'E_SYNTAX'\n  /** 控制流语句（if/for/while/do/switch/try/throw/break/continue/labeled/with + 动态 import()） */\n  | 'E_CONTROL_FLOW'\n  /** 不支持的语句形态（函数/类/export/new/eval 等） */\n  | 'E_STATEMENT'\n  /** 参数值表达式不合法（无法静态折叠 / 不支持的表达式节点） */\n  | 'E_VALUE'\n  /** import 声明位置/形态违规（F2） */\n  | 'E_IMPORT'\n  /** 引用错误（未知变量 / 未声明 receiver） */\n  | 'E_REFERENCE'\n  /** 本机函数调用 ABI 违规（§3.6：位置实参超位 / args 对象键不在形参表） */\n  | 'E_ARG'\n  /** 安全门禁违规（SecurityScanner 命中：危险标识符 / 危险语法 / 自由标识符等） */\n  | 'E_SECURITY'\n\n/**\n * An error raised while parsing faijs source, carrying the offending line\n * number and a diagnostic code the host can forward for precise feedback.\n */\nexport class ParseError extends Error {\n  /** The 1-based source line at which the parse error occurred. */\n  line: number\n  /** 诊断码（缺省 E_SYNTAX）。宿主 check() 透传；3d_editor 可据此给 AI 精确反馈。 */\n  code: ParseErrorCode\n  /** SecurityScanner 规则 ID（仅 code='E_SECURITY' 时有值；见 security-scanner.ts SecurityRuleId 枚举）。 */\n  ruleId?: string\n\n  constructor(message: string, line: number, code: ParseErrorCode = 'E_SYNTAX', cause?: unknown, ruleId?: string) {\n    super(\n      `[parser] line ${line}: ${message}`,\n      cause === undefined ? undefined : ({ cause } as unknown as ErrorOptions),\n    )\n    this.name = 'ParseError'\n    this.line = line\n    this.code = code\n    if (ruleId !== undefined) this.ruleId = ruleId\n  }\n}\n"]}
+{"version":3,"file":"parse-error.js","sourceRoot":"","sources":["../../src/lang/parse-error.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA2BH;;;GAGG;AACH,MAAM,OAAO,UAAW,SAAQ,KAAK;IACnC,iEAAiE;IACjE,IAAI,CAAQ;IACZ,6DAA6D;IAC7D,IAAI,CAAgB;IACpB,8FAA8F;IAC9F,MAAM,CAAS;IAEf,YAAY,OAAe,EAAE,IAAY,EAAE,OAAuB,UAAU,EAAE,KAAe,EAAE,MAAe;QAC5G,KAAK,CACH,iBAAiB,IAAI,KAAK,OAAO,EAAE,EACnC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,EAAE,KAAK,EAA8B,CACzE,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,YAAY,CAAA;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IAChD,CAAC;CACF","sourcesContent":["/**\n * parse-error — 文本层解析错误的唯一归属（L0 零依赖）\n *\n * 无 IR 双通道方案（2026-09-06）后语义层删除，MetadataExtractor /\n * SyntaxGate 复用同一 ParseError（宿主面 analyzeCode/codeToArgs 抛错契约不变：\n * 含 line 与 code 字段）。本文件是 ParseError 的唯一家。\n */\n\n/** 解析诊断码（宿主 CadRuntime.check 透传给 CheckError，AI 可据此精确修正）。 */\nexport type ParseErrorCode =\n  /** 语法错误（acorn 闸门） */\n  | 'E_SYNTAX'\n  /** 控制流语句（if/for/while/do/switch/try/throw/break/continue/labeled/with + 动态 import()） */\n  | 'E_CONTROL_FLOW'\n  /** 不支持的语句形态（函数/类/export/new/eval 等） */\n  | 'E_STATEMENT'\n  /** 参数值表达式不合法（无法静态折叠 / 不支持的表达式节点） */\n  | 'E_VALUE'\n  /** import 声明位置/形态违规（F2） */\n  | 'E_IMPORT'\n  /** 引用错误（未知变量 / 未声明 receiver） */\n  | 'E_REFERENCE'\n  /** 本机函数调用 ABI 违规（§3.6：位置实参超位 / args 对象键不在形参表） */\n  | 'E_ARG'\n  /** 安全门禁违规（SecurityScanner 命中：危险标识符 / 危险语法 / 自由标识符等） */\n  | 'E_SECURITY'\n  /** P6/D8: 有量纲位收到裸数字字面量（dimension pass） */\n  | 'E_DIM_BARE_NUMBER'\n  /** P6/D8: 可判定量纲的两侧量纲不一致（dimension pass） */\n  | 'E_DIM_MISMATCH'\n  /** P6/D8: 单位常量名不在表中（dimension pass 兖底） */\n  | 'E_DIM_UNKNOWN_UNIT'\n\n/**\n * An error raised while parsing faijs source, carrying the offending line\n * number and a diagnostic code the host can forward for precise feedback.\n */\nexport class ParseError extends Error {\n  /** The 1-based source line at which the parse error occurred. */\n  line: number\n  /** 诊断码（缺省 E_SYNTAX）。宿主 check() 透传；3d_editor 可据此给 AI 精确反馈。 */\n  code: ParseErrorCode\n  /** SecurityScanner 规则 ID（仅 code='E_SECURITY' 时有值；见 security-scanner.ts SecurityRuleId 枚举）。 */\n  ruleId?: string\n\n  constructor(message: string, line: number, code: ParseErrorCode = 'E_SYNTAX', cause?: unknown, ruleId?: string) {\n    super(\n      `[parser] line ${line}: ${message}`,\n      cause === undefined ? undefined : ({ cause } as unknown as ErrorOptions),\n    )\n    this.name = 'ParseError'\n    this.line = line\n    this.code = code\n    if (ruleId !== undefined) this.ruleId = ruleId\n  }\n}\n"]}

package/dist/lang/security-scanner.d.ts

@@ -19,7 +19,7 @@ import type { Program } from 'acorn';
 /** 安全策略档位。strict = 默认（全规则）；balanced = 本机 CLI；off = 受控调试。 */
 export type SecurityPolicy = 'strict' | 'balanced' | 'off';
 /** SecurityScanner 规则 ID（封闭集合，禁止自造；测试按此断言）。 */
-export type SecurityRuleId = 'SEC_IDENT' | 'SEC_SYNTAX' | 'SEC_MEMBER' | 'SEC_FREE_IDENT' | 'SEC_LIMIT' | 'SEC_NS_ASSIGN';
+export type SecurityRuleId = 'SEC_IDENT' | 'SEC_SYNTAX' | 'SEC_MEMBER' | 'SEC_FREE_IDENT' | 'SEC_LIMIT' | 'SEC_NS_ASSIGN' | 'SEC_RESERVED_ASSIGN';
 /** 违规条目。 */
 export interface SecurityViolation {
     /** 规则 ID（见 SecurityRuleId 枚举） */
@@ -69,6 +69,14 @@ export interface SecurityScanResult {
  * 导出供解释器后端（cad-runtime/interp/env.ts）做同序解析。
  */
 export declare const S4_SAFE_GLOBALS: Set<string>;
+/**
+ * P6/D7: Reserved unit constant names — cannot be used as declaration names
+ * (let/const/var/param/function) or assignment targets.
+ * This is a subset of S4_SAFE_GLOBALS (the unit constants only, not Math/Number/etc).
+ * SEC_RESERVED_ASSIGN prevents scripts from shadowing unit constants like
+ * `INCH = 999` or `let MM = 3`, which would silently corrupt geometry.
+ */
+export declare const RESERVED_UNIT_NAMES: Set<string>;
 /** S6 子模块装载深度上限（A3：ModuleRegistry 静态守卫）。 */
 export declare const S6_MAX_DEPTH = 16;
 /** S6 子模块装载总数上限（A3：ModuleRegistry 静态守卫）。 */

package/dist/lang/security-scanner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security-scanner.d.ts","sourceRoot":"","sources":["../../src/lang/security-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAA;AAKpC,4DAA4D;AAC5D,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,UAAU,GAAG,KAAK,CAAA;AAE1D,+CAA+C;AAC/C,MAAM,MAAM,cAAc,GACtB,WAAW,GACX,YAAY,GACZ,YAAY,GACZ,gBAAgB,GAChB,WAAW,GACX,eAAe,CAAA;AAEnB,YAAY;AACZ,MAAM,WAAW,iBAAiB;IAChC,iCAAiC;IACjC,MAAM,EAAE,cAAc,CAAA;IACtB,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAA;IACd,iCAAiC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,qBAAqB;IACrB,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,YAAY;AACZ,MAAM,WAAW,mBAAmB;IAClC;;OAEG;IACH,MAAM,EAAE,cAAc,CAAA;IACtB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,YAAY;AACZ,MAAM,WAAW,kBAAkB;IACjC,8BAA8B;IAC9B,EAAE,EAAE,OAAO,CAAA;IACX,yBAAyB;IACzB,UAAU,EAAE,iBAAiB,EAAE,CAAA;IAC/B,0BAA0B;IAC1B,QAAQ,EAAE,iBAAiB,EAAE,CAAA;CAC9B;AA2DD;;;;GAIG;AACH,eAAO,MAAM,eAAe,aAM1B,CAAA;AAUF,4CAA4C;AAC5C,eAAO,MAAM,YAAY,KAAK,CAAA;AAC9B,4CAA4C;AAC5C,eAAO,MAAM,cAAc,KAAK,CAAA;AA2ChC;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,kBAAkB,CA+BtF;AAED;;;;;;GAMG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,GAAG,kBAAkB,CA+kBnF;AAOD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,IAAI,CAY1E"}
+{"version":3,"file":"security-scanner.d.ts","sourceRoot":"","sources":["../../src/lang/security-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAA;AAKpC,4DAA4D;AAC5D,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,UAAU,GAAG,KAAK,CAAA;AAE1D,+CAA+C;AAC/C,MAAM,MAAM,cAAc,GACtB,WAAW,GACX,YAAY,GACZ,YAAY,GACZ,gBAAgB,GAChB,WAAW,GACX,eAAe,GACf,qBAAqB,CAAA;AAEzB,YAAY;AACZ,MAAM,WAAW,iBAAiB;IAChC,iCAAiC;IACjC,MAAM,EAAE,cAAc,CAAA;IACtB,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAA;IACd,iCAAiC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,qBAAqB;IACrB,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,YAAY;AACZ,MAAM,WAAW,mBAAmB;IAClC;;OAEG;IACH,MAAM,EAAE,cAAc,CAAA;IACtB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,YAAY;AACZ,MAAM,WAAW,kBAAkB;IACjC,8BAA8B;IAC9B,EAAE,EAAE,OAAO,CAAA;IACX,yBAAyB;IACzB,UAAU,EAAE,iBAAiB,EAAE,CAAA;IAC/B,0BAA0B;IAC1B,QAAQ,EAAE,iBAAiB,EAAE,CAAA;CAC9B;AA2DD;;;;GAIG;AACH,eAAO,MAAM,eAAe,aAc1B,CAAA;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,aAG9B,CAAA;AAUF,4CAA4C;AAC5C,eAAO,MAAM,YAAY,KAAK,CAAA;AAC9B,4CAA4C;AAC5C,eAAO,MAAM,cAAc,KAAK,CAAA;AA2ChC;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,kBAAkB,CA+BtF;AAED;;;;;;GAMG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,GAAG,kBAAkB,CAqmBnF;AAOD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,IAAI,CAY1E"}

package/dist/lang/security-scanner.js

@@ -80,6 +80,25 @@ export const S4_SAFE_GLOBALS = new Set([
     'Infinity', 'NaN', 'undefined',
     'parseInt', 'parseFloat', 'isNaN', 'isFinite',
     'console',
+    // P6/D7: script-side unit constants (MM, INCH, DEGREE, …) are read-only globals.
+    // Values registered on globalThis by the runtime; SEC_RESERVED_ASSIGN (P6) prevents
+    // shadowing. The name set lives in units.ts (SCRIPT_UNIT_NAMES) but the literal
+    // list is duplicated here because lang/ must not create a runtime dependency on
+    // units.ts (type-only import is fine, but S4_SAFE_GLOBALS is a runtime Set).
+    // Names are UPPERCASE to avoid collisions with user variable names.
+    'MM', 'CM', 'METER', 'MICRON', 'INCH', 'FOOT', 'YARD',
+    'DEGREE', 'RADIAN', 'GRAM', 'KILOGRAM', 'SECOND',
+]);
+/**
+ * P6/D7: Reserved unit constant names — cannot be used as declaration names
+ * (let/const/var/param/function) or assignment targets.
+ * This is a subset of S4_SAFE_GLOBALS (the unit constants only, not Math/Number/etc).
+ * SEC_RESERVED_ASSIGN prevents scripts from shadowing unit constants like
+ * `INCH = 999` or `let MM = 3`, which would silently corrupt geometry.
+ */
+export const RESERVED_UNIT_NAMES = new Set([
+    'MM', 'CM', 'METER', 'MICRON', 'INCH', 'FOOT', 'YARD',
+    'DEGREE', 'RADIAN', 'GRAM', 'KILOGRAM', 'SECOND',
 ]);
 // S5 结构上限
 const S5_MAX_SOURCE_LEN = 1 * 1024 * 1024; // 1 MiB
@@ -243,12 +262,17 @@ export function scanAst(ast, opts) {
     }
     /**
      * 从解构/标识符模式收集名字（用于作用域登记）。
+     * P6: If a pattern name is a reserved unit constant, emits SEC_RESERVED_ASSIGN.
      */
     function collectPatternNames(pattern, scope) {
         if (!pattern)
             return;
         switch (pattern.type) {
             case 'Identifier':
+                // P6/SEC_RESERVED_ASSIGN: reserved unit names cannot be declared
+                if (RESERVED_UNIT_NAMES.has(pattern.name)) {
+                    addViolation('SEC_RESERVED_ASSIGN', lineOf(pattern), pattern.name, `[security] SEC_RESERVED_ASSIGN line ${lineOf(pattern)}: cannot declare reserved unit name "${pattern.name}"`);
+                }
                 scope.names.add(pattern.name);
                 return;
             case 'ObjectPattern':
@@ -291,8 +315,13 @@ export function scanAst(ast, opts) {
                     break;
                 case 'FunctionDeclaration':
                 case 'ClassDeclaration':
-                    if (node.id?.type === 'Identifier')
+                    if (node.id?.type === 'Identifier') {
+                        // P6/SEC_RESERVED_ASSIGN: reserved unit names cannot be function/class names
+                        if (RESERVED_UNIT_NAMES.has(node.id.name)) {
+                            addViolation('SEC_RESERVED_ASSIGN', lineOf(node), node.id.name, `[security] SEC_RESERVED_ASSIGN line ${lineOf(node)}: cannot declare reserved unit name "${node.id.name}"`);
+                        }
                         scope.names.add(node.id.name);
+                    }
                     break;
                 default:
                     break;
@@ -339,6 +368,10 @@ export function scanAst(ast, opts) {
             case 'ArrowFunctionExpression': {
                 // 函数名在父作用域（FunctionDeclaration 提升到父层）
                 if (node.type === 'FunctionDeclaration' && node.id?.name && scope) {
+                    // P6/SEC_RESERVED_ASSIGN: reserved unit names cannot be function names
+                    if (RESERVED_UNIT_NAMES.has(node.id.name)) {
+                        addViolation('SEC_RESERVED_ASSIGN', lineOf(node), node.id.name, `[security] SEC_RESERVED_ASSIGN line ${lineOf(node)}: cannot declare reserved unit name "${node.id.name}"`);
+                    }
                     scope.names.add(node.id.name);
                 }
                 const fnScope = createScope(scope);
@@ -559,6 +592,10 @@ export function scanAst(ast, opts) {
                 if (target?.type === 'Identifier' && s7Names.has(target.name)) {
                     addViolation('SEC_NS_ASSIGN', lineOf(node), target.name, `[security] SEC_NS_ASSIGN line ${lineOf(node)}: cannot assign to namespace "${target.name}"`);
                 }
+                // P6: SEC_RESERVED_ASSIGN — cannot assign to reserved unit constant names
+                if (target?.type === 'Identifier' && RESERVED_UNIT_NAMES.has(target.name)) {
+                    addViolation('SEC_RESERVED_ASSIGN', lineOf(node), target.name, `[security] SEC_RESERVED_ASSIGN line ${lineOf(node)}: cannot assign to reserved unit name "${target.name}"`);
+                }
                 // MemberExpression 赋值：cad.box = ...
                 if (target?.type === 'MemberExpression' && target.object?.type === 'Identifier' && s7Names.has(target.object.name)) {
                     addViolation('SEC_NS_ASSIGN', lineOf(node), target.object.name, `[security] SEC_NS_ASSIGN line ${lineOf(node)}: cannot assign to member of namespace "${target.object.name}"`);

package/dist/lang/security-scanner.js.map

@@ -1 +1 @@
-{"version":3,"file":"security-scanner.js","sourceRoot":"","sources":["../../src/lang/security-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,KAAK,IAAI,UAAU,EAAE,MAAM,OAAO,CAAA;AAE3C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AA8D1C,4BAA4B;AAE5B;;;GAGG;AACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAS;IAChC,SAAS;IACT,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,mBAAmB,EAAE,wBAAwB;IAClF,OAAO;IACP,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ;IACzD,UAAU;IACV,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY;IACpE,KAAK;IACL,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY;IAChF,YAAY;IACZ,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ;IACzF,OAAO;IACP,eAAe,EAAE,QAAQ,EAAE,cAAc,EAAE,aAAa;IACxD,6BAA6B;IAC7B,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,uBAAuB;IACtF,uBAAuB;IACvB,SAAS,EAAE,OAAO,EAAE,QAAQ;CAC7B,CAAC,CAAA;AAEF,+BAA+B;AAC/B,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS;IACrC,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,uBAAuB;IACtF,SAAS,EAAE,OAAO,EAAE,QAAQ;CAC7B,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,SAAS,GAA4B;IACzC,gBAAgB,EAAE,KAAK,EAAQ,kCAAkC;IACjE,aAAa,EAAE,KAAK,EAAW,2BAA2B;IAC1D,iBAAiB,EAAE,KAAK,EAAO,+BAA+B;IAC9D,wBAAwB,EAAE,IAAI,EAAE,kBAAkB;IAClD,YAAY,EAAE,KAAK,EAAa,+CAA+C;CAChF,CAAA;AAED;;GAEG;AACH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS;IACjC,OAAO;IACP,WAAW,EAAE,aAAa,EAAE,WAAW;IACvC,mBAAmB;IACnB,kBAAkB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,kBAAkB;IAC9E,QAAQ;IACR,gBAAgB,EAAE,gBAAgB,EAAE,cAAc,EAAE,cAAc;IAClE,gBAAgB;IAChB,MAAM;CACP,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,GAAG,CAAS;IAC7C,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM;IACxE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO;IACpD,UAAU,EAAE,KAAK,EAAE,WAAW;IAC9B,UAAU,EAAE,YAAY,EAAE,OAAO,EAAE,UAAU;IAC7C,SAAS;CACV,CAAC,CAAA;AAEF,UAAU;AACV,MAAM,iBAAiB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA,CAAE,QAAQ;AACnD,MAAM,qBAAqB,GAAG,IAAI,CAAA;AAClC,MAAM,YAAY,GAAG,OAAO,CAAA;AAC5B,MAAM,YAAY,GAAG,GAAG,CAAA;AAExB,aAAa;AAEb,4CAA4C;AAC5C,MAAM,CAAC,MAAM,YAAY,GAAG,EAAE,CAAA;AAC9B,4CAA4C;AAC5C,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAA;AAWhC,SAAS,WAAW,CAAC,MAAoB;IACvC,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAU,EAAE,MAAM,EAAE,CAAA;AAC7C,CAAC;AAED,SAAS,QAAQ,CAAC,KAAmB,EAAE,IAAY;IACjD,IAAI,CAAC,GAAiB,KAAK,CAAA;IAC3B,OAAO,CAAC,EAAE,CAAC;QACT,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QAClC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;IACd,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,sBAAsB;AAEtB,oDAAoD;AACpD,SAAS,qBAAqB,CAAC,GAAY;IACzC,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,MAAM,IAAI,GAAI,GAAsC,CAAC,IAAI,CAAA;IACzD,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,IAAiD,CAAA;QAC3D,IAAI,CAAC,CAAC,IAAI,KAAK,mBAAmB;YAAE,SAAQ;QAC5C,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;YACtC,MAAM,CAAC,GAAG,IAAqC,CAAA;YAC/C,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC3C,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,aAAa;AAEb;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,IAAyB;IAChE,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IACnD,CAAC;IAED,2CAA2C;IAC3C,IAAI,IAAI,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;QACpC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,UAAU,EAAE,CAAC;oBACX,MAAM,EAAE,WAAW;oBACnB,MAAM,EAAE,CAAC;oBACT,OAAO,EAAE,oBAAoB,IAAI,CAAC,MAAM,MAAM,iBAAiB,SAAS;iBACzE,CAAC;YACF,QAAQ,EAAE,EAAE;SACb,CAAA;IACH,CAAC;IAED,IAAI,GAAY,CAAA;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE;YACrB,WAAW,EAAE,QAAQ;YACrB,UAAU,EAAE,QAAQ;YACpB,SAAS,EAAE,IAAI;SAChB,CAAuB,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,yDAAyD;QACzD,yCAAyC;QACzC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IACnD,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,OAAO,CAAC,GAAY,EAAE,IAAyB;IAC7D,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IACnD,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;IAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAA;IACzC,MAAM,UAAU,GAAwB,EAAE,CAAA;IAC1C,MAAM,QAAQ,GAAwB,EAAE,CAAA;IAExC,8BAA8B;IAC9B,MAAM,WAAW,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAA;IAC9C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,CAAC,SAAS,EAAE,GAAG,WAAW,CAAC,CAAC,CAAA;IAC/D,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,IAAI,EAAE;QAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IAExD,uDAAuD;IACvD,8CAA8C;IAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAA;IAEjE,oBAAoB;IACpB,MAAM,IAAI,GAAI,GAAsC,CAAC,IAAI,CAAA;IACzD,IAAI,IAAI,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;QACxC,UAAU,CAAC,IAAI,CAAC;YACd,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,kCAAkC,IAAI,CAAC,MAAM,MAAM,qBAAqB,GAAG;SACrF,CAAC,CAAA;IACJ,CAAC;IAED,oBAAoB;IACpB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAA;IAClC,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;QAC3B,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,MAAM,KAAK,QAAQ;YAAE,SAAQ;QAC3D,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAClB,CAAC;IAED,MAAM,QAAQ,GAA4B,EAAE,CAAA;IAC5C,KAAK,MAAM,CAAC,CAAC,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACxD,IAAI,UAAU,IAAI,MAAM,KAAK,QAAQ;YAAE,SAAQ;QAC/C,QAAQ,CAAC,CAAC,CAAC,GAAG,UAAU,CAAA;IAC1B,CAAC;IAED,IAAI,SAAS,GAAG,CAAC,CAAA;IAEjB,iDAAiD;IACjD,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;IACrC,KAAK,MAAM,CAAC,IAAI,WAAW;QAAE,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IAErD,SAAS;IACT,QAAQ,CAAC,GAAyB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAE5C,IAAI,SAAS,GAAG,YAAY,EAAE,CAAC;QAC7B,UAAU,CAAC,IAAI,CAAC;YACd,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,uBAAuB,SAAS,MAAM,YAAY,GAAG;SAC/D,CAAC,CAAA;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,UAAU,CAAC,MAAM,KAAK,CAAC;QAC3B,UAAU;QACV,QAAQ;KACT,CAAA;IAED,kBAAkB;IAElB,SAAS,MAAM,CAAC,IAAa;QAC3B,OAAO,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,CAAA;IACpC,CAAC;IAED,SAAS,YAAY,CAAC,MAAsB,EAAE,MAAc,EAAE,IAAY,EAAE,OAAe;QACzF,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;IACpD,CAAC;IAED;;OAEG;IACH,SAAS,iBAAiB,CAAC,MAAiB,EAAE,KAAY;QACxD,KAAK,MAAM,CAAC,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC;YAC7B,mBAAmB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC/B,CAAC;IACH,CAAC;IAED;;OAEG;IACH,SAAS,mBAAmB,CAAC,OAAgB,EAAE,KAAY;QACzD,IAAI,CAAC,OAAO;YAAE,OAAM;QACpB,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,YAAY;gBACf,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;gBAC7B,OAAM;YACR,KAAK,eAAe;gBAClB,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;oBAC5C,IAAI,IAAI,EAAE,IAAI,KAAK,UAAU;wBAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;yBAChE,IAAI,IAAI,EAAE,IAAI,KAAK,aAAa;wBAAE,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;gBAClF,CAAC;gBACD,OAAM;YACR,KAAK,cAAc;gBACjB,KAAK,MAAM,EAAE,IAAI,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;oBACxC,IAAI,EAAE;wBAAE,mBAAmB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;gBACxC,CAAC;gBACD,OAAM;YACR,KAAK,mBAAmB;gBACtB,mBAAmB,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;gBACxC,OAAM;YACR,KAAK,aAAa;gBAChB,mBAAmB,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;gBAC5C,OAAM;YACR;gBACE,OAAM;QACV,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,SAAS,mBAAmB,CAAC,IAAe,EAAE,KAAY;QACxD,KAAK,MAAM,IAAI,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI;gBAAE,SAAQ;YACnB,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;gBAClB,KAAK,qBAAqB;oBACxB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;wBAC3C,mBAAmB,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,CAAA;oBACtC,CAAC;oBACD,MAAK;gBACP,KAAK,qBAAqB,CAAC;gBAC3B,KAAK,kBAAkB;oBACrB,IAAI,IAAI,CAAC,EAAE,EAAE,IAAI,KAAK,YAAY;wBAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAA;oBACjE,MAAK;gBACP;oBACE,MAAK;YACT,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS,QAAQ,CAAC,IAAa,EAAE,KAAmB,EAAE,KAAa;QACjE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAM;QAE7C,SAAS,EAAE,CAAA;QACX,IAAI,KAAK,GAAG,YAAY,EAAE,CAAC;YACzB,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,SAAS,EAAE,6BAA6B,YAAY,EAAE,CAAC,CAAA;YAC5G,OAAM;QACR,CAAC;QAED,kBAAkB;QAClB,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACtC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,gCAAgC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;YAChG,0BAA0B;QAC5B,CAAC;QAED,UAAU;QACV,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,gBAAgB;YAChB,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,MAAM,WAAW,GAAG,IAAI,CAAC,IAAiB,CAAA;gBAC1C,mBAAmB,CAAC,WAAW,EAAE,KAAK,IAAI,WAAW,CAAC,CAAA;gBACtD,KAAK,MAAM,KAAK,IAAI,WAAW;oBAAE,QAAQ,CAAC,KAAK,EAAE,KAAK,IAAI,WAAW,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACjF,OAAM;YACR,CAAC;YAED,+BAA+B;YAC/B,KAAK,mBAAmB;gBACtB,OAAM;YAER,kBAAkB;YAClB,KAAK,0BAA0B;gBAC7B,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC5C,OAAM;YACR,KAAK,wBAAwB;gBAC3B,IAAI,IAAI,CAAC,WAAW;oBAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAClE,OAAM;YAER,aAAa;YACb,KAAK,qBAAqB,CAAC;YAC3B,KAAK,oBAAoB,CAAC;YAC1B,KAAK,yBAAyB,CAAC,CAAC,CAAC;gBAC/B,sCAAsC;gBACtC,IAAI,IAAI,CAAC,IAAI,KAAK,qBAAqB,IAAI,IAAI,CAAC,EAAE,EAAE,IAAI,IAAI,KAAK,EAAE,CAAC;oBAClE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAA;gBAC/B,CAAC;gBACD,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;gBAClC,iBAAiB,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,OAAO,CAAC,CAAA;gBAC7C,kBAAkB;gBAClB,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,gBAAgB,EAAE,CAAC;oBACzC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,OAAO,CAAC,CAAA;gBACpD,CAAC;gBACD,aAAa;gBACb,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE;oBAAE,QAAQ,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAClE,QAAQ;gBACR,IAAI,IAAI,CAAC,IAAI;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACtD,OAAM;YACR,CAAC;YAED,aAAa;YACb,KAAK,qBAAqB,CAAC,CAAC,CAAC;gBAC3B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;oBAC3C,+BAA+B;oBAC/B,IAAI,KAAK;wBAAE,mBAAmB,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,CAAA;oBAC/C,WAAW;oBACX,IAAI,IAAI,EAAE,IAAI;wBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;oBACrD,wBAAwB;oBACxB,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACzC,CAAC;gBACD,OAAM;YACR,CAAC;YAED,YAAY;YACZ,KAAK,gBAAgB,CAAC,CAAC,CAAC;gBACtB,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;gBACrC,mBAAmB,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,UAAU,CAAC,CAAA;gBAChD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE;oBAAE,QAAQ,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC3E,OAAM;YACR,CAAC;YAED,YAAY;YACZ,KAAK,aAAa;gBAChB,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACrC,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC3C,IAAI,IAAI,CAAC,SAAS;oBAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC9D,OAAM;YAER,KAAK,cAAc,CAAC,CAAC,CAAC;gBACpB,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;gBACnC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;oBACd,gCAAgC;oBAChC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;wBAC7C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;4BAChD,mBAAmB,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAA;4BACvC,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;wBACrC,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;oBAC1C,CAAC;gBACH,CAAC;gBACD,IAAI,IAAI,CAAC,IAAI;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACvD,IAAI,IAAI,CAAC,MAAM;oBAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC3D,aAAa;gBACb,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;oBAClD,QAAQ,CAAC,IAAI,CAAC;wBACZ,MAAM,EAAE,WAAW;wBACnB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC;wBACpB,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,mDAAmD;qBAC7D,CAAC,CAAA;gBACJ,CAAC;gBACD,IAAI,IAAI,CAAC,IAAI;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACvD,OAAM;YACR,CAAC;YAED,KAAK,gBAAgB,CAAC;YACtB,KAAK,gBAAgB,CAAC,CAAC,CAAC;gBACtB,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;gBACnC,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,qBAAqB,EAAE,CAAC;oBAC9C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;wBAChD,mBAAmB,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAA;wBACvC,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;oBACrC,CAAC;gBACH,CAAC;qBAAM,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,YAAY,EAAE,CAAC;oBAC5C,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBACpC,CAAC;gBACD,IAAI,IAAI,CAAC,KAAK;oBAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACzD,IAAI,IAAI,CAAC,IAAI;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACvD,OAAM;YACR,CAAC;YAED,KAAK,gBAAgB;gBACnB,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACrC,qBAAqB;gBACrB,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;oBAC9D,QAAQ,CAAC,IAAI,CAAC;wBACZ,MAAM,EAAE,WAAW;wBACnB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC;wBACpB,IAAI,EAAE,aAAa;wBACnB,OAAO,EAAE,uCAAuC;qBACjD,CAAC,CAAA;gBACJ,CAAC;gBACD,IAAI,IAAI,CAAC,IAAI;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACpD,OAAM;YAER,KAAK,kBAAkB;gBACrB,IAAI,IAAI,CAAC,IAAI;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACpD,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACrC,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;oBAC9D,QAAQ,CAAC,IAAI,CAAC;wBACZ,MAAM,EAAE,WAAW;wBACnB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC;wBACpB,IAAI,EAAE,kBAAkB;wBACxB,OAAO,EAAE,4CAA4C;qBACtD,CAAC,CAAA;gBACJ,CAAC;gBACD,OAAM;YAER,KAAK,iBAAiB,CAAC,CAAC,CAAC;gBACvB,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;gBAClC,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC7C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;oBACjC,IAAI,CAAC,CAAC,IAAI;wBAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;oBAChD,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,UAAU,IAAI,EAAE;wBAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC3E,CAAC;gBACD,OAAM;YACR,CAAC;YAED,KAAK,cAAc,CAAC,CAAC,CAAC;gBACpB,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACtC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;oBACjB,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;oBACvC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK;wBAAE,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,CAAA;oBAC7E,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK;wBAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;oBAC7E,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACtD,CAAC;gBACD,IAAI,IAAI,CAAC,SAAS;oBAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC9D,OAAM;YACR,CAAC;YAED,KAAK,aAAa,CAAC,CAAC,CAAC;gBACnB,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;gBACrC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;oBACf,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;oBAC3C,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC7C,CAAC;gBACD,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,UAAU,CAAC,CAAA;gBACtD,IAAI,IAAI,CAAC,IAAI;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACzD,OAAM;YACR,CAAC;YAED,yBAAyB;YACzB,KAAK,kBAAkB;gBACrB,IAAI,IAAI,CAAC,IAAI;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACpD,OAAM;YAER,uBAAuB;YACvB,KAAK,iBAAiB,CAAC;YACvB,KAAK,gBAAgB;gBACnB,IAAI,IAAI,CAAC,QAAQ;oBAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC5D,OAAM;YAER,4BAA4B;YAC5B,KAAK,qBAAqB;gBACxB,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC3C,OAAM;YAER,YAAY;YACZ,KAAK,YAAY,CAAC,CAAC,CAAC;gBAClB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;gBACtB,cAAc;gBACd,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACvB,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,6BAA6B,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,kBAAkB,CAAC,CAAA;oBACpH,OAAM;gBACR,CAAC;gBACD,gBAAgB;gBAChB,IAAI,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC/E,OAAM;gBACR,CAAC;gBACD,YAAY;gBACZ,YAAY,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kCAAkC,MAAM,CAAC,IAAI,CAAC,yBAAyB,IAAI,yCAAyC,CAAC,CAAA;gBACxK,OAAM;YACR,CAAC;YAED,KAAK,kBAAkB,CAAC,CAAC,CAAC;gBACxB,+CAA+C;gBAC/C,6DAA6D;gBAC7D,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACvC,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;oBACvD,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC3C,CAAC;gBACD,qCAAqC;gBACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI;oBACxE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;wBACjE,CAAC,CAAC,IAAI,CAAA;gBACR,IAAI,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACzC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,8BAA8B,MAAM,CAAC,IAAI,CAAC,uBAAuB,QAAQ,GAAG,CAAC,CAAA;gBAClI,CAAC;gBACD,OAAM;YACR,CAAC;YAED,KAAK,gBAAgB;gBACnB,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACvC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,IAAI,EAAE;oBAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACvE,OAAM;YAER,KAAK,eAAe;gBAClB,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACvC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,IAAI,EAAE;oBAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACvE,OAAM;YAER,KAAK,sBAAsB,CAAC,CAAC,CAAC;gBAC5B,gCAAgC;gBAChC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAA;gBACxB,IAAI,MAAM,EAAE,IAAI,KAAK,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9D,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,EAAE,iCAAiC,MAAM,CAAC,IAAI,CAAC,iCAAiC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAA;gBACxJ,CAAC;gBACD,oCAAoC;gBACpC,IAAI,MAAM,EAAE,IAAI,KAAK,kBAAkB,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,KAAK,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnH,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,iCAAiC,MAAM,CAAC,IAAI,CAAC,2CAA2C,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAA;gBAChL,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACrC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACtC,OAAM;YACR,CAAC;YAED,KAAK,kBAAkB,CAAC;YACxB,KAAK,mBAAmB;gBACtB,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACrC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACtC,OAAM;YAER,KAAK,iBAAiB,CAAC;YACvB,KAAK,kBAAkB;gBACrB,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACzC,OAAM;YAER,KAAK,uBAAuB;gBAC1B,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACrC,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC3C,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC1C,OAAM;YAER,KAAK,iBAAiB;gBACpB,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;oBACrC,IAAI,EAAE;wBAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACxC,CAAC;gBACD,OAAM;YAER,KAAK,kBAAkB;gBACrB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;oBACzC,IAAI,IAAI,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;wBAC9B,iDAAiD;wBACjD,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG;4BAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;wBACnE,IAAI,IAAI,CAAC,KAAK;4BAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;oBACxD,CAAC;yBAAM,CAAC;wBACN,kBAAkB;wBAClB,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;oBAClC,CAAC;gBACH,CAAC;gBACD,OAAM;YAER,KAAK,iBAAiB;gBACpB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,WAAW,IAAI,EAAE;oBAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC3E,OAAM;YAER,KAAK,0BAA0B;gBAC7B,4BAA4B;gBAC5B,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACpC,IAAI,IAAI,CAAC,KAAK;oBAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACtD,OAAM;YAER,KAAK,iBAAiB;gBACpB,IAAI,IAAI,CAAC,QAAQ;oBAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC5D,OAAM;YAER,KAAK,iBAAiB;gBACpB,IAAI,IAAI,CAAC,QAAQ;oBAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC5D,OAAM;YAER,KAAK,eAAe;gBAClB,IAAI,IAAI,CAAC,QAAQ;oBAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC5D,OAAM;YAER,KAAK,oBAAoB;gBACvB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,WAAW,IAAI,EAAE;oBAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC3E,OAAM;YAER,KAAK,yBAAyB;gBAC5B,IAAI,IAAI,CAAC,UAAU;oBAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAChE,OAAM;YAER,KAAK,iBAAiB;gBACpB,IAAI,IAAI,CAAC,UAAU;oBAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAChE,OAAM;YAER,KAAK,cAAc;gBACjB,sCAAsC;gBACtC,OAAM;YAER,KAAK,kBAAkB;gBACrB,yBAAyB;gBACzB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,IAAI,EAAE;oBAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACvE,OAAM;YAER,KAAK,kBAAkB,CAAC;YACxB,KAAK,iBAAiB,CAAC,CAAC,CAAC;gBACvB,IAAI,IAAI,CAAC,EAAE,EAAE,IAAI,IAAI,KAAK;oBAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAA;gBACzD,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;gBACnC,IAAI,IAAI,CAAC,UAAU;oBAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACnE,IAAI,IAAI,CAAC,IAAI;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACvD,OAAM;YACR,CAAC;YAED,KAAK,WAAW;gBACd,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;oBACrC,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACpC,CAAC;gBACD,OAAM;YAER,KAAK,kBAAkB,CAAC;YACxB,KAAK,oBAAoB;gBACvB,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,QAAQ;oBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACnE,IAAI,IAAI,CAAC,KAAK;oBAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACtD,OAAM;YAER,KAAK,eAAe;gBAClB,SAAS;gBACT,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACvC,IAAI,IAAI,CAAC,IAAI;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACpD,OAAM;YAER,KAAK,mBAAmB;gBACtB,SAAS;gBACT,OAAM;YAER,KAAK,mBAAmB,CAAC;YACzB,KAAK,gBAAgB;gBACnB,OAAM;YAER,KAAK,gBAAgB;gBACnB,OAAM;YAER,KAAK,SAAS;gBACZ,OAAM;YAER,KAAK,OAAO;gBACV,OAAM;YAER,KAAK,gBAAgB;gBACnB,OAAM;YAER,KAAK,iBAAiB,CAAC;YACvB,KAAK,wBAAwB,CAAC;YAC9B,KAAK,0BAA0B;gBAC7B,OAAM;YAER,KAAK,iBAAiB;gBACpB,OAAM;YAER;gBACE,gBAAgB;gBAChB,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;gBAChC,OAAM;QACV,CAAC;IACH,CAAC;IAED,SAAS,WAAW,CAAC,OAAgB,EAAE,KAAmB,EAAE,KAAa;QACvE,IAAI,CAAC,OAAO;YAAE,OAAM;QACpB,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,YAAY;gBACf,OAAM,CAAC,6BAA6B;YACtC,KAAK,eAAe;gBAClB,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;oBAC5C,IAAI,IAAI,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;wBAC9B,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG;4BAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;wBACnE,IAAI,IAAI,CAAC,KAAK;4BAAE,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;oBAC3D,CAAC;yBAAM,IAAI,IAAI,EAAE,IAAI,KAAK,aAAa,EAAE,CAAC;wBACxC,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;oBAC9C,CAAC;gBACH,CAAC;gBACD,OAAM;YACR,KAAK,cAAc;gBACjB,KAAK,MAAM,EAAE,IAAI,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;oBACxC,IAAI,EAAE;wBAAE,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC3C,CAAC;gBACD,OAAM;YACR,KAAK,mBAAmB;gBACtB,IAAI,OAAO,CAAC,KAAK;oBAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC5D,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC3C,OAAM;YACR,KAAK,aAAa;gBAChB,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC/C,OAAM;YACR;gBACE,OAAM;QACV,CAAC;IACH,CAAC;IAED,SAAS,YAAY,CAAC,IAAa,EAAE,KAAmB,EAAE,KAAa;QACrE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,MAAM;gBAAE,SAAQ;YACxH,MAAM,CAAC,GAAI,IAAgC,CAAC,GAAG,CAAC,CAAA;YAChD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrB,KAAK,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC;oBACrB,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;wBACvD,QAAQ,CAAC,IAAe,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;oBAC7C,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;gBACrD,QAAQ,CAAC,CAAY,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;YAC1C,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAKD,aAAa;AAEb;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,IAAyB;IAClE,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IACrC,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QAC9B,MAAM,IAAI,UAAU,CAClB,CAAC,CAAC,OAAO,EACT,CAAC,CAAC,MAAM,EACR,YAAY,EACZ,SAAS,EACT,CAAC,CAAC,MAAM,CACT,CAAA;IACH,CAAC;AACH,CAAC","sourcesContent":["/**\n * security-scanner — .fai.js 静态安全门禁（纵深防御第一层）\n *\n * 方案：docs/plans/2026-09-08-faijs-security-gate.md（§5）\n *\n * 定位：在 MetadataExtractor（UI 通道）与 DirectExecutor（执行通道）之前\n * 对源码做 **AST 全量递归遍历**，覆盖函数体、控制流块、嵌套函数——消除\n * 当前\"只扫顶层\"的盲区。规则表与功能代码解耦（R6）：新增 op / 新增语法\n * 形态不需要改扫描器，只有\"新增被禁能力\"才改规则表（数据）。\n *\n * 判定模型 = 能力黑名单（S1）+ 危险语法（S2）+ 危险成员名（S3）+\n * 自由标识符白名单（S4）+ 结构上限（S5）+ 命名空间保护（S7）。\n *\n * 诚实边界（D9）：静态门禁 ≠ 沙箱。无法拦截拼接属性名 `g['ev'+'al']`、\n * 字符串内代码、已获引用二次调用。本方案通过切断能力来源（S4）使残留\n * 失去立足点，但不宣称等价隔离。\n */\n\nimport { parse as acornParse } from 'acorn'\nimport type { Program } from 'acorn'\nimport { ParseError } from './parse-error'\n\n// ── 类型 ──\n\n/** 安全策略档位。strict = 默认（全规则）；balanced = 本机 CLI；off = 受控调试。 */\nexport type SecurityPolicy = 'strict' | 'balanced' | 'off'\n\n/** SecurityScanner 规则 ID（封闭集合，禁止自造；测试按此断言）。 */\nexport type SecurityRuleId =\n  | 'SEC_IDENT'\n  | 'SEC_SYNTAX'\n  | 'SEC_MEMBER'\n  | 'SEC_FREE_IDENT'\n  | 'SEC_LIMIT'\n  | 'SEC_NS_ASSIGN'\n\n/** 违规条目。 */\nexport interface SecurityViolation {\n  /** 规则 ID（见 SecurityRuleId 枚举） */\n  ruleId: SecurityRuleId\n  /** 1-based 行号，相对传入的原始源码文本（Scanner 不做任何包裹/偏移） */\n  lineNo: number\n  /** 命中的标识符名 / 属性名 / 节点类型（无则省略） */\n  name?: string\n  /** 人类可读消息（AI 自纠用） */\n  message: string\n}\n\n/** 扫描选项。 */\nexport interface SecurityScanOptions {\n  /**\n   * 策略档位。**必填**——不允许缺省，调用方必须显式声明（防止无意间关闭门禁）。\n   */\n  policy: SecurityPolicy\n  /**\n   * 额外合法名字（S4 判定用：不在 knownNames 也不在 S4_SAFE_GLOBALS → SEC_FREE_IDENT）。\n   * 调用方可不传——Scanner 始终自动收集：\n   * ① 源码内全部 `ImportDeclaration` 的本地绑定名（named / namespace / default）；\n   * ② `opts.defaultNs ?? 'cad'`。\n   * 本字段只用于补充\"源码里看不到的名字\"。\n   */\n  knownNames?: string[]\n  /**\n   * 命名空间保护名（S7 判定用：对此列表中的名字做赋值 → SEC_NS_ASSIGN）。\n   * 缺省 = knownNames（即所有 knownNames 都受 S7 保护）。\n   * 调用方在 append 场景中可传一个更小的集合（仅命名空间名，不含 ctx 普通变量）。\n   */\n  nsNames?: string[]\n  /** 默认命名空间名，缺省 'cad'（自动进入 knownNames） */\n  defaultNs?: string\n}\n\n/** 扫描结果。 */\nexport interface SecurityScanResult {\n  /** true 当且仅当 violations 为空 */\n  ok: boolean\n  /** 命中即拒的条目；非空 → 调用方拒绝 */\n  violations: SecurityViolation[]\n  /** 只告警不拒（目前只有 S5 无界循环） */\n  warnings: SecurityViolation[]\n}\n\n// ── 规则表（数据驱动，新增规则不改遍历器） ──\n\n/**\n * S1 危险标识符黑名单（引用即拒，不区分读写、不区分声明位置）。\n * S1 优先于一切：即使用户用这些名字声明了自己的变量，也照样拒绝。\n */\nconst S1_IDENTS = new Set<string>([\n  // 执行任意代码\n  'eval', 'Function', 'AsyncFunction', 'GeneratorFunction', 'AsyncGeneratorFunction',\n  // 全局逃逸\n  'globalThis', 'window', 'self', 'top', 'parent', 'frames',\n  // Node 宿主\n  'process', 'require', 'module', 'exports', '__dirname', '__filename',\n  // 网络\n  'fetch', 'XMLHttpRequest', 'WebSocket', 'EventSource', 'navigator', 'sendBeacon',\n  // 浏览器存储/DOM\n  'localStorage', 'sessionStorage', 'indexedDB', 'caches', 'document', 'location', 'cookie',\n  // 动态装载\n  'importScripts', 'Worker', 'SharedWorker', 'WebAssembly',\n  // 定时器/微任务（混淆与延时外发）——仅 strict\n  'setTimeout', 'setInterval', 'setImmediate', 'queueMicrotask', 'requestAnimationFrame',\n  // 元编程（原型污染族）——仅 strict\n  'Reflect', 'Proxy', 'crypto',\n])\n\n/** S1 中仅在 strict 档生效的标识符集合。 */\nconst S1_STRICT_ONLY = new Set<string>([\n  'setTimeout', 'setInterval', 'setImmediate', 'queueMicrotask', 'requestAnimationFrame',\n  'Reflect', 'Proxy', 'crypto',\n])\n\n/**\n * S2 危险语法节点黑名单。\n * key = AST node type；value = true 表示仅 strict 档生效。\n */\nconst S2_SYNTAX: Record<string, boolean> = {\n  ImportExpression: false,       // 动态 import() — strict + balanced\n  WithStatement: false,          // with — strict + balanced\n  DebuggerStatement: false,      // debugger — strict + balanced\n  TaggedTemplateExpression: true, // 标签模板 — 仅 strict\n  MetaProperty: false,            // import.meta / new.target — strict + balanced\n}\n\n/**\n * S3 危险成员属性名黑名单（MemberExpression.property 的名字命中即拒）。\n */\nconst S3_MEMBERS = new Set<string>([\n  // 原型污染\n  '__proto__', 'constructor', 'prototype',\n  // getter/setter 注入\n  '__defineGetter__', '__defineSetter__', '__lookupGetter__', '__lookupSetter__',\n  // 对象元编程\n  'setPrototypeOf', 'defineProperty', 'defineGetter', 'defineSetter',\n  // 求值（x.eval 形式）\n  'eval',\n])\n\n/**\n * S4 安全全局白名单（固定清单，strict 与 balanced 相同）。\n * 不在此名单且不在已声明/knownNames 中的标识符 → SEC_FREE_IDENT 拒绝。\n * 导出供解释器后端（cad-runtime/interp/env.ts）做同序解析。\n */\nexport const S4_SAFE_GLOBALS = new Set<string>([\n  'Math', 'Number', 'String', 'Boolean', 'Array', 'Object', 'JSON', 'Date',\n  'Map', 'Set', 'Promise', 'Symbol', 'RegExp', 'Error',\n  'Infinity', 'NaN', 'undefined',\n  'parseInt', 'parseFloat', 'isNaN', 'isFinite',\n  'console',\n])\n\n// S5 结构上限\nconst S5_MAX_SOURCE_LEN = 1 * 1024 * 1024  // 1 MiB\nconst S5_MAX_TOP_STATEMENTS = 5000\nconst S5_MAX_NODES = 200_000\nconst S5_MAX_DEPTH = 100\n\n// S6 子模块装载上限\n\n/** S6 子模块装载深度上限（A3：ModuleRegistry 静态守卫）。 */\nexport const S6_MAX_DEPTH = 16\n/** S6 子模块装载总数上限（A3：ModuleRegistry 静态守卫）。 */\nexport const S6_MAX_MODULES = 64\n\n// ── 作用域管理 ──\n\ninterface Scope {\n  /** 本层已声明的名字（var/let/const、函数参数、函数名、解构名、catch 参数、循环绑定） */\n  names: Set<string>\n  /** 子作用域 */\n  parent: Scope | null\n}\n\nfunction createScope(parent: Scope | null): Scope {\n  return { names: new Set<string>(), parent }\n}\n\nfunction scopeHas(scope: Scope | null, name: string): boolean {\n  let s: Scope | null = scope\n  while (s) {\n    if (s.names.has(name)) return true\n    s = s.parent\n  }\n  return false\n}\n\n// ── 收集 import 绑定名 ──\n\n/** 从 Program.body 收集全部 ImportDeclaration 的本地绑定名。 */\nfunction collectImportBindings(ast: Program): string[] {\n  const out: string[] = []\n  const body = (ast as unknown as { body: unknown[] }).body\n  for (const node of body) {\n    const n = node as { type?: string; specifiers?: unknown[] }\n    if (n.type !== 'ImportDeclaration') continue\n    for (const spec of n.specifiers ?? []) {\n      const s = spec as { local?: { name?: string } }\n      if (s.local?.name) out.push(s.local.name)\n    }\n  }\n  return out\n}\n\n// ── 主扫描器 ──\n\n/**\n * 全量扫描源码文本（返回全部违规）。\n * policy==='off' 时直接返回 `{ ok:true, violations:[], warnings:[] }`。\n * 解析失败时（acorn SyntaxError）不包装不抛——交给调用方的主 acornParse 路径\n * 包装为 E_SYNTAX（Scanner 不重复定义语法错误）。\n *\n * @param code - the .fai.js source text (raw, un-wrapped).\n * @param opts - scan options (policy is required).\n * @returns the full scan result (violations + warnings).\n */\nexport function scanSource(code: string, opts: SecurityScanOptions): SecurityScanResult {\n  if (opts.policy === 'off') {\n    return { ok: true, violations: [], warnings: [] }\n  }\n\n  // S5: source length check (before parsing)\n  if (code.length > S5_MAX_SOURCE_LEN) {\n    return {\n      ok: false,\n      violations: [{\n        ruleId: 'SEC_LIMIT',\n        lineNo: 1,\n        message: `source too long (${code.length} > ${S5_MAX_SOURCE_LEN} bytes)`,\n      }],\n      warnings: [],\n    }\n  }\n\n  let ast: Program\n  try {\n    ast = acornParse(code, {\n      ecmaVersion: 'latest',\n      sourceType: 'module',\n      locations: true,\n    }) as unknown as Program\n  } catch {\n    // acorn SyntaxError → 交给调用方的主 acornParse 路径包装为 E_SYNTAX。\n    // Scanner 返回 ok=true（无安全违规），让语法错误路径正常处理。\n    return { ok: true, violations: [], warnings: [] }\n  }\n  return scanAst(ast, opts)\n}\n\n/**\n * 复用已解析的 AST 进行扫描（避免二次解析）。语义与 scanSource 完全一致。\n *\n * @param ast - the pre-parsed Program AST (with locations enabled).\n * @param opts - scan options (policy is required).\n * @returns the full scan result (violations + warnings).\n */\nexport function scanAst(ast: Program, opts: SecurityScanOptions): SecurityScanResult {\n  if (opts.policy === 'off') {\n    return { ok: true, violations: [], warnings: [] }\n  }\n\n  const policy = opts.policy\n  const defaultNs = opts.defaultNs ?? 'cad'\n  const violations: SecurityViolation[] = []\n  const warnings: SecurityViolation[] = []\n\n  // 自动收集 import 绑定名 + defaultNs\n  const importNames = collectImportBindings(ast)\n  const knownNames = new Set<string>([defaultNs, ...importNames])\n  for (const n of opts.knownNames ?? []) knownNames.add(n)\n\n  // S7 命名空间保护名：缺省 = knownNames（即所有 knownNames 都受 S7 保护）；\n  // 调用方可通过 nsNames 指定更小的集合（仅命名空间名，不含 ctx 普通变量）。\n  const s7Names = opts.nsNames ? new Set(opts.nsNames) : knownNames\n\n  // S5 结构上限 —— 判定在遍历前\n  const body = (ast as unknown as { body: unknown[] }).body\n  if (body.length > S5_MAX_TOP_STATEMENTS) {\n    violations.push({\n      ruleId: 'SEC_LIMIT',\n      lineNo: 1,\n      message: `too many top-level statements (${body.length} > ${S5_MAX_TOP_STATEMENTS})`,\n    })\n  }\n\n  // 准备 strict-only 集合\n  const s1Idents = new Set<string>()\n  for (const id of S1_IDENTS) {\n    if (S1_STRICT_ONLY.has(id) && policy !== 'strict') continue\n    s1Idents.add(id)\n  }\n\n  const s2Syntax: Record<string, boolean> = {}\n  for (const [k, strictOnly] of Object.entries(S2_SYNTAX)) {\n    if (strictOnly && policy !== 'strict') continue\n    s2Syntax[k] = strictOnly\n  }\n\n  let nodeCount = 0\n\n  // 顶层作用域：收集 import 绑定名（已在 knownNames），以及 body 级声明\n  const globalScope = createScope(null)\n  for (const n of importNames) globalScope.names.add(n)\n\n  // 遍历 AST\n  walkNode(ast as unknown as ASTNode, null, 0)\n\n  if (nodeCount > S5_MAX_NODES) {\n    violations.push({\n      ruleId: 'SEC_LIMIT',\n      lineNo: 1,\n      message: `too many AST nodes (${nodeCount} > ${S5_MAX_NODES})`,\n    })\n  }\n\n  return {\n    ok: violations.length === 0,\n    violations,\n    warnings,\n  }\n\n  // ── 递归 walker ──\n\n  function lineOf(node: ASTNode): number {\n    return node?.loc?.start?.line ?? 1\n  }\n\n  function addViolation(ruleId: SecurityRuleId, lineNo: number, name: string, message: string): void {\n    violations.push({ ruleId, lineNo, name, message })\n  }\n\n  /**\n   * 收集函数参数中的声明名（含默认参数、解构）。\n   */\n  function collectParamNames(params: ASTNode[], scope: Scope): void {\n    for (const p of params ?? []) {\n      collectPatternNames(p, scope)\n    }\n  }\n\n  /**\n   * 从解构/标识符模式收集名字（用于作用域登记）。\n   */\n  function collectPatternNames(pattern: ASTNode, scope: Scope): void {\n    if (!pattern) return\n    switch (pattern.type) {\n      case 'Identifier':\n        scope.names.add(pattern.name)\n        return\n      case 'ObjectPattern':\n        for (const prop of pattern.properties ?? []) {\n          if (prop?.type === 'Property') collectPatternNames(prop.value, scope)\n          else if (prop?.type === 'RestElement') collectPatternNames(prop.argument, scope)\n        }\n        return\n      case 'ArrayPattern':\n        for (const el of pattern.elements ?? []) {\n          if (el) collectPatternNames(el, scope)\n        }\n        return\n      case 'AssignmentPattern':\n        collectPatternNames(pattern.left, scope)\n        return\n      case 'RestElement':\n        collectPatternNames(pattern.argument, scope)\n        return\n      default:\n        return\n    }\n  }\n\n  /**\n   * 收集一个节点体内全部声明名（VariableDeclarator + FunctionDeclaration 等）。\n   * 用于函数体 / 块体遍历前先登记声明（提升语义）。\n   */\n  function collectDeclarations(body: ASTNode[], scope: Scope): void {\n    for (const node of body ?? []) {\n      if (!node) continue\n      switch (node.type) {\n        case 'VariableDeclaration':\n          for (const decl of node.declarations ?? []) {\n            collectPatternNames(decl?.id, scope)\n          }\n          break\n        case 'FunctionDeclaration':\n        case 'ClassDeclaration':\n          if (node.id?.type === 'Identifier') scope.names.add(node.id.name)\n          break\n        default:\n          break\n      }\n    }\n  }\n\n  function walkNode(node: ASTNode, scope: Scope | null, depth: number): void {\n    if (!node || typeof node !== 'object') return\n\n    nodeCount++\n    if (depth > S5_MAX_DEPTH) {\n      addViolation('SEC_LIMIT', lineOf(node), node.type ?? 'unknown', `AST nesting depth exceeds ${S5_MAX_DEPTH}`)\n      return\n    }\n\n    // ── S2 危险语法节点 ──\n    if (s2Syntax[node.type] !== undefined) {\n      addViolation('SEC_SYNTAX', lineOf(node), node.type, `[security] dangerous syntax: ${node.type}`)\n      // 继续遍历子节点（可能内部有更多违规），但不中断\n    }\n\n    // 按节点类型处理\n    switch (node.type) {\n      // ── Program ──\n      case 'Program': {\n        const programBody = node.body as ASTNode[]\n        collectDeclarations(programBody, scope ?? globalScope)\n        for (const child of programBody) walkNode(child, scope ?? globalScope, depth + 1)\n        return\n      }\n\n      // ── Import 声明：不遍历（绑定已自动收集） ──\n      case 'ImportDeclaration':\n        return\n\n      // ── Export 声明 ──\n      case 'ExportDefaultDeclaration':\n        walkNode(node.declaration, scope, depth + 1)\n        return\n      case 'ExportNamedDeclaration':\n        if (node.declaration) walkNode(node.declaration, scope, depth + 1)\n        return\n\n      // ── 函数声明 ──\n      case 'FunctionDeclaration':\n      case 'FunctionExpression':\n      case 'ArrowFunctionExpression': {\n        // 函数名在父作用域（FunctionDeclaration 提升到父层）\n        if (node.type === 'FunctionDeclaration' && node.id?.name && scope) {\n          scope.names.add(node.id.name)\n        }\n        const fnScope = createScope(scope)\n        collectParamNames(node.params ?? [], fnScope)\n        // 函数体提升：先收集体内全部声明\n        if (node.body?.type === 'BlockStatement') {\n          collectDeclarations(node.body.body ?? [], fnScope)\n        }\n        // 遍历参数（含默认值）\n        for (const p of node.params ?? []) walkNode(p, fnScope, depth + 1)\n        // 遍历函数体\n        if (node.body) walkNode(node.body, fnScope, depth + 1)\n        return\n      }\n\n      // ── 变量声明 ──\n      case 'VariableDeclaration': {\n        for (const decl of node.declarations ?? []) {\n          // 声明名登记（pattern 里的名字入当前 scope）\n          if (scope) collectPatternNames(decl?.id, scope)\n          // 遍历初始化表达式\n          if (decl?.init) walkNode(decl.init, scope, depth + 1)\n          // 遍历 pattern 本身（解构默认值等）\n          walkPattern(decl?.id, scope, depth + 1)\n        }\n        return\n      }\n\n      // ── 块语句 ──\n      case 'BlockStatement': {\n        const blockScope = createScope(scope)\n        collectDeclarations(node.body ?? [], blockScope)\n        for (const child of node.body ?? []) walkNode(child, blockScope, depth + 1)\n        return\n      }\n\n      // ── 控制流 ──\n      case 'IfStatement':\n        walkNode(node.test, scope, depth + 1)\n        walkNode(node.consequent, scope, depth + 1)\n        if (node.alternate) walkNode(node.alternate, scope, depth + 1)\n        return\n\n      case 'ForStatement': {\n        const forScope = createScope(scope)\n        if (node.init) {\n          // for(let i=...) 的 i 入 forScope\n          if (node.init.type === 'VariableDeclaration') {\n            for (const decl of node.init.declarations ?? []) {\n              collectPatternNames(decl?.id, forScope)\n              walkNode(decl, forScope, depth + 1)\n            }\n          } else {\n            walkNode(node.init, forScope, depth + 1)\n          }\n        }\n        if (node.test) walkNode(node.test, forScope, depth + 1)\n        if (node.update) walkNode(node.update, forScope, depth + 1)\n        // S5: 无界循环告警\n        if (node.test === null || node.test === undefined) {\n          warnings.push({\n            ruleId: 'SEC_LIMIT',\n            lineNo: lineOf(node),\n            name: 'for(;;)',\n            message: 'unbounded for loop (no test condition) — may hang',\n          })\n        }\n        if (node.body) walkNode(node.body, forScope, depth + 1)\n        return\n      }\n\n      case 'ForInStatement':\n      case 'ForOfStatement': {\n        const forScope = createScope(scope)\n        if (node.left?.type === 'VariableDeclaration') {\n          for (const decl of node.left.declarations ?? []) {\n            collectPatternNames(decl?.id, forScope)\n            walkNode(decl, forScope, depth + 1)\n          }\n        } else if (node.left?.type === 'Identifier') {\n          forScope.names.add(node.left.name)\n        }\n        if (node.right) walkNode(node.right, forScope, depth + 1)\n        if (node.body) walkNode(node.body, forScope, depth + 1)\n        return\n      }\n\n      case 'WhileStatement':\n        walkNode(node.test, scope, depth + 1)\n        // S5: while(true) 告警\n        if (node.test?.type === 'Literal' && node.test.value === true) {\n          warnings.push({\n            ruleId: 'SEC_LIMIT',\n            lineNo: lineOf(node),\n            name: 'while(true)',\n            message: 'unbounded while(true) loop — may hang',\n          })\n        }\n        if (node.body) walkNode(node.body, scope, depth + 1)\n        return\n\n      case 'DoWhileStatement':\n        if (node.body) walkNode(node.body, scope, depth + 1)\n        walkNode(node.test, scope, depth + 1)\n        if (node.test?.type === 'Literal' && node.test.value === true) {\n          warnings.push({\n            ruleId: 'SEC_LIMIT',\n            lineNo: lineOf(node),\n            name: 'do...while(true)',\n            message: 'unbounded do...while(true) loop — may hang',\n          })\n        }\n        return\n\n      case 'SwitchStatement': {\n        const swScope = createScope(scope)\n        walkNode(node.discriminant, scope, depth + 1)\n        for (const c of node.cases ?? []) {\n          if (c.test) walkNode(c.test, swScope, depth + 1)\n          for (const stmt of c.consequent ?? []) walkNode(stmt, swScope, depth + 1)\n        }\n        return\n      }\n\n      case 'TryStatement': {\n        walkNode(node.block, scope, depth + 1)\n        if (node.handler) {\n          const handlerScope = createScope(scope)\n          if (node.handler.param) collectPatternNames(node.handler.param, handlerScope)\n          if (node.handler.param) walkNode(node.handler.param, handlerScope, depth + 1)\n          walkNode(node.handler.body, handlerScope, depth + 1)\n        }\n        if (node.finalizer) walkNode(node.finalizer, scope, depth + 1)\n        return\n      }\n\n      case 'CatchClause': {\n        const catchScope = createScope(scope)\n        if (node.param) {\n          collectPatternNames(node.param, catchScope)\n          walkNode(node.param, catchScope, depth + 1)\n        }\n        collectDeclarations(node.body?.body ?? [], catchScope)\n        if (node.body) walkNode(node.body, catchScope, depth + 1)\n        return\n      }\n\n      // ── LabeledStatement ──\n      case 'LabeledStatement':\n        if (node.body) walkNode(node.body, scope, depth + 1)\n        return\n\n      // ── Return / Throw ──\n      case 'ReturnStatement':\n      case 'ThrowStatement':\n        if (node.argument) walkNode(node.argument, scope, depth + 1)\n        return\n\n      // ── ExpressionStatement ──\n      case 'ExpressionStatement':\n        walkNode(node.expression, scope, depth + 1)\n        return\n\n      // ── 表达式 ──\n      case 'Identifier': {\n        const name = node.name\n        // S1 危险标识符黑名单\n        if (s1Idents.has(name)) {\n          addViolation('SEC_IDENT', lineOf(node), name, `[security] SEC_IDENT line ${lineOf(node)}: \"${name}\" is not allowed`)\n          return\n        }\n        // S4 自由标识符白名单判定\n        if (scopeHas(scope, name) || knownNames.has(name) || S4_SAFE_GLOBALS.has(name)) {\n          return\n        }\n        // 未声明的自由标识符\n        addViolation('SEC_FREE_IDENT', lineOf(node), name, `[security] SEC_FREE_IDENT line ${lineOf(node)}: unknown identifier \"${name}\" (not declared, not a known namespace)`)\n        return\n      }\n\n      case 'MemberExpression': {\n        // S1 优先于一切：先遍历 object（让 Identifier 先命中 S1/S4），\n        // 再检查 S3 危险成员名。这样 globalThis.eval 先命中 SEC_IDENT(globalThis)。\n        walkNode(node.object, scope, depth + 1)\n        if (node.computed && node.property?.type !== 'Literal') {\n          walkNode(node.property, scope, depth + 1)\n        }\n        // S3 危险成员名（在 object 遍历后检查，确保 S1 优先级）\n        const propName = node.property?.type === 'Identifier' ? node.property.name\n          : node.property?.type === 'Literal' ? String(node.property.value)\n          : null\n        if (propName && S3_MEMBERS.has(propName)) {\n          addViolation('SEC_MEMBER', lineOf(node), propName, `[security] SEC_MEMBER line ${lineOf(node)}: dangerous member \"${propName}\"`)\n        }\n        return\n      }\n\n      case 'CallExpression':\n        walkNode(node.callee, scope, depth + 1)\n        for (const arg of node.arguments ?? []) walkNode(arg, scope, depth + 1)\n        return\n\n      case 'NewExpression':\n        walkNode(node.callee, scope, depth + 1)\n        for (const arg of node.arguments ?? []) walkNode(arg, scope, depth + 1)\n        return\n\n      case 'AssignmentExpression': {\n        // S7 命名空间保护：禁止对 s7Names 中的名字做赋值\n        const target = node.left\n        if (target?.type === 'Identifier' && s7Names.has(target.name)) {\n          addViolation('SEC_NS_ASSIGN', lineOf(node), target.name, `[security] SEC_NS_ASSIGN line ${lineOf(node)}: cannot assign to namespace \"${target.name}\"`)\n        }\n        // MemberExpression 赋值：cad.box = ...\n        if (target?.type === 'MemberExpression' && target.object?.type === 'Identifier' && s7Names.has(target.object.name)) {\n          addViolation('SEC_NS_ASSIGN', lineOf(node), target.object.name, `[security] SEC_NS_ASSIGN line ${lineOf(node)}: cannot assign to member of namespace \"${target.object.name}\"`)\n        }\n        walkNode(node.left, scope, depth + 1)\n        walkNode(node.right, scope, depth + 1)\n        return\n      }\n\n      case 'BinaryExpression':\n      case 'LogicalExpression':\n        walkNode(node.left, scope, depth + 1)\n        walkNode(node.right, scope, depth + 1)\n        return\n\n      case 'UnaryExpression':\n      case 'UpdateExpression':\n        walkNode(node.argument, scope, depth + 1)\n        return\n\n      case 'ConditionalExpression':\n        walkNode(node.test, scope, depth + 1)\n        walkNode(node.consequent, scope, depth + 1)\n        walkNode(node.alternate, scope, depth + 1)\n        return\n\n      case 'ArrayExpression':\n        for (const el of node.elements ?? []) {\n          if (el) walkNode(el, scope, depth + 1)\n        }\n        return\n\n      case 'ObjectExpression':\n        for (const prop of node.properties ?? []) {\n          if (prop?.type === 'Property') {\n            // key 是标识符且非 computed → 不需要检查（对象字面量 key 不是标识符引用）\n            if (prop.computed && prop.key) walkNode(prop.key, scope, depth + 1)\n            if (prop.value) walkNode(prop.value, scope, depth + 1)\n          } else {\n            // SpreadElement 等\n            walkNode(prop, scope, depth + 1)\n          }\n        }\n        return\n\n      case 'TemplateLiteral':\n        for (const expr of node.expressions ?? []) walkNode(expr, scope, depth + 1)\n        return\n\n      case 'TaggedTemplateExpression':\n        // S2 已在上方判定；仍遍历 tag 与 quasi\n        walkNode(node.tag, scope, depth + 1)\n        if (node.quasi) walkNode(node.quasi, scope, depth + 1)\n        return\n\n      case 'AwaitExpression':\n        if (node.argument) walkNode(node.argument, scope, depth + 1)\n        return\n\n      case 'YieldExpression':\n        if (node.argument) walkNode(node.argument, scope, depth + 1)\n        return\n\n      case 'SpreadElement':\n        if (node.argument) walkNode(node.argument, scope, depth + 1)\n        return\n\n      case 'SequenceExpression':\n        for (const expr of node.expressions ?? []) walkNode(expr, scope, depth + 1)\n        return\n\n      case 'ParenthesizedExpression':\n        if (node.expression) walkNode(node.expression, scope, depth + 1)\n        return\n\n      case 'ChainExpression':\n        if (node.expression) walkNode(node.expression, scope, depth + 1)\n        return\n\n      case 'MetaProperty':\n        // S2 已在上方判定（import.meta / new.target）\n        return\n\n      case 'ImportExpression':\n        // S2 已在上方判定（动态 import()）\n        for (const arg of node.arguments ?? []) walkNode(arg, scope, depth + 1)\n        return\n\n      case 'ClassDeclaration':\n      case 'ClassExpression': {\n        if (node.id?.name && scope) scope.names.add(node.id.name)\n        const clsScope = createScope(scope)\n        if (node.superClass) walkNode(node.superClass, clsScope, depth + 1)\n        if (node.body) walkNode(node.body, clsScope, depth + 1)\n        return\n      }\n\n      case 'ClassBody':\n        for (const method of node.body ?? []) {\n          walkNode(method, scope, depth + 1)\n        }\n        return\n\n      case 'MethodDefinition':\n      case 'PropertyDefinition':\n        if (node.key && node.computed) walkNode(node.key, scope, depth + 1)\n        if (node.value) walkNode(node.value, scope, depth + 1)\n        return\n\n      case 'WithStatement':\n        // S2 已判定\n        walkNode(node.object, scope, depth + 1)\n        if (node.body) walkNode(node.body, scope, depth + 1)\n        return\n\n      case 'DebuggerStatement':\n        // S2 已判定\n        return\n\n      case 'ContinueStatement':\n      case 'BreakStatement':\n        return\n\n      case 'EmptyStatement':\n        return\n\n      case 'Literal':\n        return\n\n      case 'Super':\n        return\n\n      case 'ThisExpression':\n        return\n\n      case 'ImportSpecifier':\n      case 'ImportDefaultSpecifier':\n      case 'ImportNamespaceSpecifier':\n        return\n\n      case 'ExportSpecifier':\n        return\n\n      default:\n        // 未知节点：递归遍历其子属性\n        walkChildren(node, scope, depth)\n        return\n    }\n  }\n\n  function walkPattern(pattern: ASTNode, scope: Scope | null, depth: number): void {\n    if (!pattern) return\n    switch (pattern.type) {\n      case 'Identifier':\n        return // 已在 collectPatternNames 中登记\n      case 'ObjectPattern':\n        for (const prop of pattern.properties ?? []) {\n          if (prop?.type === 'Property') {\n            if (prop.computed && prop.key) walkNode(prop.key, scope, depth + 1)\n            if (prop.value) walkPattern(prop.value, scope, depth + 1)\n          } else if (prop?.type === 'RestElement') {\n            walkPattern(prop.argument, scope, depth + 1)\n          }\n        }\n        return\n      case 'ArrayPattern':\n        for (const el of pattern.elements ?? []) {\n          if (el) walkPattern(el, scope, depth + 1)\n        }\n        return\n      case 'AssignmentPattern':\n        if (pattern.right) walkNode(pattern.right, scope, depth + 1)\n        walkPattern(pattern.left, scope, depth + 1)\n        return\n      case 'RestElement':\n        walkPattern(pattern.argument, scope, depth + 1)\n        return\n      default:\n        return\n    }\n  }\n\n  function walkChildren(node: ASTNode, scope: Scope | null, depth: number): void {\n    for (const key of Object.keys(node)) {\n      if (key === 'loc' || key === 'start' || key === 'end' || key === 'range' || key === 'parent' || key === 'type') continue\n      const v = (node as Record<string, unknown>)[key]\n      if (Array.isArray(v)) {\n        for (const item of v) {\n          if (item && typeof item === 'object' && 'type' in item) {\n            walkNode(item as ASTNode, scope, depth + 1)\n          }\n        }\n      } else if (v && typeof v === 'object' && 'type' in v) {\n        walkNode(v as ASTNode, scope, depth + 1)\n      }\n    }\n  }\n}\n\n// ── 类型别名 ──\ntype ASTNode = any\n\n// ── 门禁断言 ──\n\n/**\n * 门禁断言：violations 非空则抛 ParseError（code='E_SECURITY'，ruleId 挂 ParseError.ruleId）。\n * 三处接入点（A1/A2/A3）统一用它。\n *\n * @param code - the .fai.js source text (raw, un-wrapped).\n * @param opts - scan options (policy is required).\n * @throws ParseError — when violations are non-empty (code='E_SECURITY').\n */\nexport function assertSecure(code: string, opts: SecurityScanOptions): void {\n  const result = scanSource(code, opts)\n  if (result.violations.length > 0) {\n    const v = result.violations[0]\n    throw new ParseError(\n      v.message,\n      v.lineNo,\n      'E_SECURITY',\n      undefined,\n      v.ruleId,\n    )\n  }\n}\n"]}
+{"version":3,"file":"security-scanner.js","sourceRoot":"","sources":["../../src/lang/security-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,KAAK,IAAI,UAAU,EAAE,MAAM,OAAO,CAAA;AAE3C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AA+D1C,4BAA4B;AAE5B;;;GAGG;AACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAS;IAChC,SAAS;IACT,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,mBAAmB,EAAE,wBAAwB;IAClF,OAAO;IACP,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ;IACzD,UAAU;IACV,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY;IACpE,KAAK;IACL,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY;IAChF,YAAY;IACZ,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ;IACzF,OAAO;IACP,eAAe,EAAE,QAAQ,EAAE,cAAc,EAAE,aAAa;IACxD,6BAA6B;IAC7B,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,uBAAuB;IACtF,uBAAuB;IACvB,SAAS,EAAE,OAAO,EAAE,QAAQ;CAC7B,CAAC,CAAA;AAEF,+BAA+B;AAC/B,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS;IACrC,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,uBAAuB;IACtF,SAAS,EAAE,OAAO,EAAE,QAAQ;CAC7B,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,SAAS,GAA4B;IACzC,gBAAgB,EAAE,KAAK,EAAQ,kCAAkC;IACjE,aAAa,EAAE,KAAK,EAAW,2BAA2B;IAC1D,iBAAiB,EAAE,KAAK,EAAO,+BAA+B;IAC9D,wBAAwB,EAAE,IAAI,EAAE,kBAAkB;IAClD,YAAY,EAAE,KAAK,EAAa,+CAA+C;CAChF,CAAA;AAED;;GAEG;AACH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS;IACjC,OAAO;IACP,WAAW,EAAE,aAAa,EAAE,WAAW;IACvC,mBAAmB;IACnB,kBAAkB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,kBAAkB;IAC9E,QAAQ;IACR,gBAAgB,EAAE,gBAAgB,EAAE,cAAc,EAAE,cAAc;IAClE,gBAAgB;IAChB,MAAM;CACP,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,GAAG,CAAS;IAC7C,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM;IACxE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO;IACpD,UAAU,EAAE,KAAK,EAAE,WAAW;IAC9B,UAAU,EAAE,YAAY,EAAE,OAAO,EAAE,UAAU;IAC7C,SAAS;IACT,iFAAiF;IACjF,oFAAoF;IACpF,gFAAgF;IAChF,gFAAgF;IAChF,6EAA6E;IAC7E,oEAAoE;IACpE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IACrD,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ;CACjD,CAAC,CAAA;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAS;IACjD,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IACrD,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ;CACjD,CAAC,CAAA;AAEF,UAAU;AACV,MAAM,iBAAiB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA,CAAE,QAAQ;AACnD,MAAM,qBAAqB,GAAG,IAAI,CAAA;AAClC,MAAM,YAAY,GAAG,OAAO,CAAA;AAC5B,MAAM,YAAY,GAAG,GAAG,CAAA;AAExB,aAAa;AAEb,4CAA4C;AAC5C,MAAM,CAAC,MAAM,YAAY,GAAG,EAAE,CAAA;AAC9B,4CAA4C;AAC5C,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAA;AAWhC,SAAS,WAAW,CAAC,MAAoB;IACvC,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAU,EAAE,MAAM,EAAE,CAAA;AAC7C,CAAC;AAED,SAAS,QAAQ,CAAC,KAAmB,EAAE,IAAY;IACjD,IAAI,CAAC,GAAiB,KAAK,CAAA;IAC3B,OAAO,CAAC,EAAE,CAAC;QACT,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QAClC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;IACd,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,sBAAsB;AAEtB,oDAAoD;AACpD,SAAS,qBAAqB,CAAC,GAAY;IACzC,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,MAAM,IAAI,GAAI,GAAsC,CAAC,IAAI,CAAA;IACzD,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,IAAiD,CAAA;QAC3D,IAAI,CAAC,CAAC,IAAI,KAAK,mBAAmB;YAAE,SAAQ;QAC5C,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;YACtC,MAAM,CAAC,GAAG,IAAqC,CAAA;YAC/C,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC3C,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,aAAa;AAEb;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,IAAyB;IAChE,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IACnD,CAAC;IAED,2CAA2C;IAC3C,IAAI,IAAI,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;QACpC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,UAAU,EAAE,CAAC;oBACX,MAAM,EAAE,WAAW;oBACnB,MAAM,EAAE,CAAC;oBACT,OAAO,EAAE,oBAAoB,IAAI,CAAC,MAAM,MAAM,iBAAiB,SAAS;iBACzE,CAAC;YACF,QAAQ,EAAE,EAAE;SACb,CAAA;IACH,CAAC;IAED,IAAI,GAAY,CAAA;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE;YACrB,WAAW,EAAE,QAAQ;YACrB,UAAU,EAAE,QAAQ;YACpB,SAAS,EAAE,IAAI;SAChB,CAAuB,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,yDAAyD;QACzD,yCAAyC;QACzC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IACnD,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,OAAO,CAAC,GAAY,EAAE,IAAyB;IAC7D,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IACnD,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;IAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAA;IACzC,MAAM,UAAU,GAAwB,EAAE,CAAA;IAC1C,MAAM,QAAQ,GAAwB,EAAE,CAAA;IAExC,8BAA8B;IAC9B,MAAM,WAAW,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAA;IAC9C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,CAAC,SAAS,EAAE,GAAG,WAAW,CAAC,CAAC,CAAA;IAC/D,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,IAAI,EAAE;QAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IAExD,uDAAuD;IACvD,8CAA8C;IAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAA;IAEjE,oBAAoB;IACpB,MAAM,IAAI,GAAI,GAAsC,CAAC,IAAI,CAAA;IACzD,IAAI,IAAI,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;QACxC,UAAU,CAAC,IAAI,CAAC;YACd,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,kCAAkC,IAAI,CAAC,MAAM,MAAM,qBAAqB,GAAG;SACrF,CAAC,CAAA;IACJ,CAAC;IAED,oBAAoB;IACpB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAA;IAClC,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;QAC3B,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,MAAM,KAAK,QAAQ;YAAE,SAAQ;QAC3D,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAClB,CAAC;IAED,MAAM,QAAQ,GAA4B,EAAE,CAAA;IAC5C,KAAK,MAAM,CAAC,CAAC,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACxD,IAAI,UAAU,IAAI,MAAM,KAAK,QAAQ;YAAE,SAAQ;QAC/C,QAAQ,CAAC,CAAC,CAAC,GAAG,UAAU,CAAA;IAC1B,CAAC;IAED,IAAI,SAAS,GAAG,CAAC,CAAA;IAEjB,iDAAiD;IACjD,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;IACrC,KAAK,MAAM,CAAC,IAAI,WAAW;QAAE,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IAErD,SAAS;IACT,QAAQ,CAAC,GAAyB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAE5C,IAAI,SAAS,GAAG,YAAY,EAAE,CAAC;QAC7B,UAAU,CAAC,IAAI,CAAC;YACd,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,uBAAuB,SAAS,MAAM,YAAY,GAAG;SAC/D,CAAC,CAAA;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,UAAU,CAAC,MAAM,KAAK,CAAC;QAC3B,UAAU;QACV,QAAQ;KACT,CAAA;IAED,kBAAkB;IAElB,SAAS,MAAM,CAAC,IAAa;QAC3B,OAAO,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,CAAA;IACpC,CAAC;IAED,SAAS,YAAY,CAAC,MAAsB,EAAE,MAAc,EAAE,IAAY,EAAE,OAAe;QACzF,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;IACpD,CAAC;IAED;;OAEG;IACH,SAAS,iBAAiB,CAAC,MAAiB,EAAE,KAAY;QACxD,KAAK,MAAM,CAAC,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC;YAC7B,mBAAmB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC/B,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,SAAS,mBAAmB,CAAC,OAAgB,EAAE,KAAY;QACzD,IAAI,CAAC,OAAO;YAAE,OAAM;QACpB,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,YAAY;gBACf,iEAAiE;gBACjE,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1C,YAAY,CAAC,qBAAqB,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,IAAI,EAC/D,uCAAuC,MAAM,CAAC,OAAO,CAAC,wCAAwC,OAAO,CAAC,IAAI,GAAG,CAAC,CAAA;gBAClH,CAAC;gBACD,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;gBAC7B,OAAM;YACR,KAAK,eAAe;gBAClB,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;oBAC5C,IAAI,IAAI,EAAE,IAAI,KAAK,UAAU;wBAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;yBAChE,IAAI,IAAI,EAAE,IAAI,KAAK,aAAa;wBAAE,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;gBAClF,CAAC;gBACD,OAAM;YACR,KAAK,cAAc;gBACjB,KAAK,MAAM,EAAE,IAAI,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;oBACxC,IAAI,EAAE;wBAAE,mBAAmB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;gBACxC,CAAC;gBACD,OAAM;YACR,KAAK,mBAAmB;gBACtB,mBAAmB,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;gBACxC,OAAM;YACR,KAAK,aAAa;gBAChB,mBAAmB,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;gBAC5C,OAAM;YACR;gBACE,OAAM;QACV,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,SAAS,mBAAmB,CAAC,IAAe,EAAE,KAAY;QACxD,KAAK,MAAM,IAAI,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI;gBAAE,SAAQ;YACnB,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;gBAClB,KAAK,qBAAqB;oBACxB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;wBAC3C,mBAAmB,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,CAAA;oBACtC,CAAC;oBACD,MAAK;gBACP,KAAK,qBAAqB,CAAC;gBAC3B,KAAK,kBAAkB;oBACrB,IAAI,IAAI,CAAC,EAAE,EAAE,IAAI,KAAK,YAAY,EAAE,CAAC;wBACnC,6EAA6E;wBAC7E,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;4BAC1C,YAAY,CAAC,qBAAqB,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,EAC5D,uCAAuC,MAAM,CAAC,IAAI,CAAC,wCAAwC,IAAI,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,CAAA;wBAC/G,CAAC;wBACD,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAA;oBAC/B,CAAC;oBACD,MAAK;gBACP;oBACE,MAAK;YACT,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS,QAAQ,CAAC,IAAa,EAAE,KAAmB,EAAE,KAAa;QACjE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAM;QAE7C,SAAS,EAAE,CAAA;QACX,IAAI,KAAK,GAAG,YAAY,EAAE,CAAC;YACzB,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,SAAS,EAAE,6BAA6B,YAAY,EAAE,CAAC,CAAA;YAC5G,OAAM;QACR,CAAC;QAED,kBAAkB;QAClB,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACtC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,gCAAgC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;YAChG,0BAA0B;QAC5B,CAAC;QAED,UAAU;QACV,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,gBAAgB;YAChB,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,MAAM,WAAW,GAAG,IAAI,CAAC,IAAiB,CAAA;gBAC1C,mBAAmB,CAAC,WAAW,EAAE,KAAK,IAAI,WAAW,CAAC,CAAA;gBACtD,KAAK,MAAM,KAAK,IAAI,WAAW;oBAAE,QAAQ,CAAC,KAAK,EAAE,KAAK,IAAI,WAAW,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACjF,OAAM;YACR,CAAC;YAED,+BAA+B;YAC/B,KAAK,mBAAmB;gBACtB,OAAM;YAER,kBAAkB;YAClB,KAAK,0BAA0B;gBAC7B,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC5C,OAAM;YACR,KAAK,wBAAwB;gBAC3B,IAAI,IAAI,CAAC,WAAW;oBAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAClE,OAAM;YAER,aAAa;YACb,KAAK,qBAAqB,CAAC;YAC3B,KAAK,oBAAoB,CAAC;YAC1B,KAAK,yBAAyB,CAAC,CAAC,CAAC;gBAC/B,sCAAsC;gBACtC,IAAI,IAAI,CAAC,IAAI,KAAK,qBAAqB,IAAI,IAAI,CAAC,EAAE,EAAE,IAAI,IAAI,KAAK,EAAE,CAAC;oBAClE,uEAAuE;oBACvE,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC1C,YAAY,CAAC,qBAAqB,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,EAC5D,uCAAuC,MAAM,CAAC,IAAI,CAAC,wCAAwC,IAAI,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,CAAA;oBAC/G,CAAC;oBACD,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAA;gBAC/B,CAAC;gBACD,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;gBAClC,iBAAiB,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,OAAO,CAAC,CAAA;gBAC7C,kBAAkB;gBAClB,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,gBAAgB,EAAE,CAAC;oBACzC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,OAAO,CAAC,CAAA;gBACpD,CAAC;gBACD,aAAa;gBACb,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE;oBAAE,QAAQ,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAClE,QAAQ;gBACR,IAAI,IAAI,CAAC,IAAI;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACtD,OAAM;YACR,CAAC;YAED,aAAa;YACb,KAAK,qBAAqB,CAAC,CAAC,CAAC;gBAC3B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;oBAC3C,+BAA+B;oBAC/B,IAAI,KAAK;wBAAE,mBAAmB,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,CAAA;oBAC/C,WAAW;oBACX,IAAI,IAAI,EAAE,IAAI;wBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;oBACrD,wBAAwB;oBACxB,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACzC,CAAC;gBACD,OAAM;YACR,CAAC;YAED,YAAY;YACZ,KAAK,gBAAgB,CAAC,CAAC,CAAC;gBACtB,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;gBACrC,mBAAmB,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,UAAU,CAAC,CAAA;gBAChD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE;oBAAE,QAAQ,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC3E,OAAM;YACR,CAAC;YAED,YAAY;YACZ,KAAK,aAAa;gBAChB,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACrC,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC3C,IAAI,IAAI,CAAC,SAAS;oBAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC9D,OAAM;YAER,KAAK,cAAc,CAAC,CAAC,CAAC;gBACpB,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;gBACnC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;oBACd,gCAAgC;oBAChC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;wBAC7C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;4BAChD,mBAAmB,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAA;4BACvC,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;wBACrC,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;oBAC1C,CAAC;gBACH,CAAC;gBACD,IAAI,IAAI,CAAC,IAAI;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACvD,IAAI,IAAI,CAAC,MAAM;oBAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC3D,aAAa;gBACb,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;oBAClD,QAAQ,CAAC,IAAI,CAAC;wBACZ,MAAM,EAAE,WAAW;wBACnB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC;wBACpB,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,mDAAmD;qBAC7D,CAAC,CAAA;gBACJ,CAAC;gBACD,IAAI,IAAI,CAAC,IAAI;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACvD,OAAM;YACR,CAAC;YAED,KAAK,gBAAgB,CAAC;YACtB,KAAK,gBAAgB,CAAC,CAAC,CAAC;gBACtB,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;gBACnC,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,qBAAqB,EAAE,CAAC;oBAC9C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;wBAChD,mBAAmB,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAA;wBACvC,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;oBACrC,CAAC;gBACH,CAAC;qBAAM,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,YAAY,EAAE,CAAC;oBAC5C,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBACpC,CAAC;gBACD,IAAI,IAAI,CAAC,KAAK;oBAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACzD,IAAI,IAAI,CAAC,IAAI;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACvD,OAAM;YACR,CAAC;YAED,KAAK,gBAAgB;gBACnB,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACrC,qBAAqB;gBACrB,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;oBAC9D,QAAQ,CAAC,IAAI,CAAC;wBACZ,MAAM,EAAE,WAAW;wBACnB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC;wBACpB,IAAI,EAAE,aAAa;wBACnB,OAAO,EAAE,uCAAuC;qBACjD,CAAC,CAAA;gBACJ,CAAC;gBACD,IAAI,IAAI,CAAC,IAAI;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACpD,OAAM;YAER,KAAK,kBAAkB;gBACrB,IAAI,IAAI,CAAC,IAAI;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACpD,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACrC,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;oBAC9D,QAAQ,CAAC,IAAI,CAAC;wBACZ,MAAM,EAAE,WAAW;wBACnB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC;wBACpB,IAAI,EAAE,kBAAkB;wBACxB,OAAO,EAAE,4CAA4C;qBACtD,CAAC,CAAA;gBACJ,CAAC;gBACD,OAAM;YAER,KAAK,iBAAiB,CAAC,CAAC,CAAC;gBACvB,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;gBAClC,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC7C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;oBACjC,IAAI,CAAC,CAAC,IAAI;wBAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;oBAChD,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,UAAU,IAAI,EAAE;wBAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC3E,CAAC;gBACD,OAAM;YACR,CAAC;YAED,KAAK,cAAc,CAAC,CAAC,CAAC;gBACpB,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACtC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;oBACjB,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;oBACvC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK;wBAAE,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,CAAA;oBAC7E,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK;wBAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;oBAC7E,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACtD,CAAC;gBACD,IAAI,IAAI,CAAC,SAAS;oBAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC9D,OAAM;YACR,CAAC;YAED,KAAK,aAAa,CAAC,CAAC,CAAC;gBACnB,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;gBACrC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;oBACf,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;oBAC3C,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC7C,CAAC;gBACD,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,UAAU,CAAC,CAAA;gBACtD,IAAI,IAAI,CAAC,IAAI;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACzD,OAAM;YACR,CAAC;YAED,yBAAyB;YACzB,KAAK,kBAAkB;gBACrB,IAAI,IAAI,CAAC,IAAI;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACpD,OAAM;YAER,uBAAuB;YACvB,KAAK,iBAAiB,CAAC;YACvB,KAAK,gBAAgB;gBACnB,IAAI,IAAI,CAAC,QAAQ;oBAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC5D,OAAM;YAER,4BAA4B;YAC5B,KAAK,qBAAqB;gBACxB,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC3C,OAAM;YAER,YAAY;YACZ,KAAK,YAAY,CAAC,CAAC,CAAC;gBAClB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;gBACtB,cAAc;gBACd,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACvB,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,6BAA6B,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,kBAAkB,CAAC,CAAA;oBACpH,OAAM;gBACR,CAAC;gBACD,gBAAgB;gBAChB,IAAI,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC/E,OAAM;gBACR,CAAC;gBACD,YAAY;gBACZ,YAAY,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kCAAkC,MAAM,CAAC,IAAI,CAAC,yBAAyB,IAAI,yCAAyC,CAAC,CAAA;gBACxK,OAAM;YACR,CAAC;YAED,KAAK,kBAAkB,CAAC,CAAC,CAAC;gBACxB,+CAA+C;gBAC/C,6DAA6D;gBAC7D,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACvC,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;oBACvD,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC3C,CAAC;gBACD,qCAAqC;gBACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI;oBACxE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;wBACjE,CAAC,CAAC,IAAI,CAAA;gBACR,IAAI,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACzC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,8BAA8B,MAAM,CAAC,IAAI,CAAC,uBAAuB,QAAQ,GAAG,CAAC,CAAA;gBAClI,CAAC;gBACD,OAAM;YACR,CAAC;YAED,KAAK,gBAAgB;gBACnB,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACvC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,IAAI,EAAE;oBAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACvE,OAAM;YAER,KAAK,eAAe;gBAClB,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACvC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,IAAI,EAAE;oBAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACvE,OAAM;YAER,KAAK,sBAAsB,CAAC,CAAC,CAAC;gBAC5B,gCAAgC;gBAChC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAA;gBACxB,IAAI,MAAM,EAAE,IAAI,KAAK,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9D,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,EAAE,iCAAiC,MAAM,CAAC,IAAI,CAAC,iCAAiC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAA;gBACxJ,CAAC;gBACD,0EAA0E;gBAC1E,IAAI,MAAM,EAAE,IAAI,KAAK,YAAY,IAAI,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1E,YAAY,CAAC,qBAAqB,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,EAAE,uCAAuC,MAAM,CAAC,IAAI,CAAC,0CAA0C,MAAM,CAAC,IAAI,GAAG,CAAC,CAAA;gBAC7K,CAAC;gBACD,oCAAoC;gBACpC,IAAI,MAAM,EAAE,IAAI,KAAK,kBAAkB,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,KAAK,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnH,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,iCAAiC,MAAM,CAAC,IAAI,CAAC,2CAA2C,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAA;gBAChL,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACrC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACtC,OAAM;YACR,CAAC;YAED,KAAK,kBAAkB,CAAC;YACxB,KAAK,mBAAmB;gBACtB,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACrC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACtC,OAAM;YAER,KAAK,iBAAiB,CAAC;YACvB,KAAK,kBAAkB;gBACrB,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACzC,OAAM;YAER,KAAK,uBAAuB;gBAC1B,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACrC,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC3C,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC1C,OAAM;YAER,KAAK,iBAAiB;gBACpB,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;oBACrC,IAAI,EAAE;wBAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACxC,CAAC;gBACD,OAAM;YAER,KAAK,kBAAkB;gBACrB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;oBACzC,IAAI,IAAI,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;wBAC9B,iDAAiD;wBACjD,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG;4BAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;wBACnE,IAAI,IAAI,CAAC,KAAK;4BAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;oBACxD,CAAC;yBAAM,CAAC;wBACN,kBAAkB;wBAClB,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;oBAClC,CAAC;gBACH,CAAC;gBACD,OAAM;YAER,KAAK,iBAAiB;gBACpB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,WAAW,IAAI,EAAE;oBAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC3E,OAAM;YAER,KAAK,0BAA0B;gBAC7B,4BAA4B;gBAC5B,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACpC,IAAI,IAAI,CAAC,KAAK;oBAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACtD,OAAM;YAER,KAAK,iBAAiB;gBACpB,IAAI,IAAI,CAAC,QAAQ;oBAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC5D,OAAM;YAER,KAAK,iBAAiB;gBACpB,IAAI,IAAI,CAAC,QAAQ;oBAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC5D,OAAM;YAER,KAAK,eAAe;gBAClB,IAAI,IAAI,CAAC,QAAQ;oBAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC5D,OAAM;YAER,KAAK,oBAAoB;gBACvB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,WAAW,IAAI,EAAE;oBAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC3E,OAAM;YAER,KAAK,yBAAyB;gBAC5B,IAAI,IAAI,CAAC,UAAU;oBAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAChE,OAAM;YAER,KAAK,iBAAiB;gBACpB,IAAI,IAAI,CAAC,UAAU;oBAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAChE,OAAM;YAER,KAAK,cAAc;gBACjB,sCAAsC;gBACtC,OAAM;YAER,KAAK,kBAAkB;gBACrB,yBAAyB;gBACzB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,IAAI,EAAE;oBAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACvE,OAAM;YAER,KAAK,kBAAkB,CAAC;YACxB,KAAK,iBAAiB,CAAC,CAAC,CAAC;gBACvB,IAAI,IAAI,CAAC,EAAE,EAAE,IAAI,IAAI,KAAK;oBAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAA;gBACzD,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;gBACnC,IAAI,IAAI,CAAC,UAAU;oBAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACnE,IAAI,IAAI,CAAC,IAAI;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACvD,OAAM;YACR,CAAC;YAED,KAAK,WAAW;gBACd,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;oBACrC,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACpC,CAAC;gBACD,OAAM;YAER,KAAK,kBAAkB,CAAC;YACxB,KAAK,oBAAoB;gBACvB,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,QAAQ;oBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACnE,IAAI,IAAI,CAAC,KAAK;oBAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACtD,OAAM;YAER,KAAK,eAAe;gBAClB,SAAS;gBACT,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACvC,IAAI,IAAI,CAAC,IAAI;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACpD,OAAM;YAER,KAAK,mBAAmB;gBACtB,SAAS;gBACT,OAAM;YAER,KAAK,mBAAmB,CAAC;YACzB,KAAK,gBAAgB;gBACnB,OAAM;YAER,KAAK,gBAAgB;gBACnB,OAAM;YAER,KAAK,SAAS;gBACZ,OAAM;YAER,KAAK,OAAO;gBACV,OAAM;YAER,KAAK,gBAAgB;gBACnB,OAAM;YAER,KAAK,iBAAiB,CAAC;YACvB,KAAK,wBAAwB,CAAC;YAC9B,KAAK,0BAA0B;gBAC7B,OAAM;YAER,KAAK,iBAAiB;gBACpB,OAAM;YAER;gBACE,gBAAgB;gBAChB,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;gBAChC,OAAM;QACV,CAAC;IACH,CAAC;IAED,SAAS,WAAW,CAAC,OAAgB,EAAE,KAAmB,EAAE,KAAa;QACvE,IAAI,CAAC,OAAO;YAAE,OAAM;QACpB,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,YAAY;gBACf,OAAM,CAAC,6BAA6B;YACtC,KAAK,eAAe;gBAClB,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;oBAC5C,IAAI,IAAI,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;wBAC9B,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG;4BAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;wBACnE,IAAI,IAAI,CAAC,KAAK;4BAAE,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;oBAC3D,CAAC;yBAAM,IAAI,IAAI,EAAE,IAAI,KAAK,aAAa,EAAE,CAAC;wBACxC,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;oBAC9C,CAAC;gBACH,CAAC;gBACD,OAAM;YACR,KAAK,cAAc;gBACjB,KAAK,MAAM,EAAE,IAAI,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;oBACxC,IAAI,EAAE;wBAAE,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC3C,CAAC;gBACD,OAAM;YACR,KAAK,mBAAmB;gBACtB,IAAI,OAAO,CAAC,KAAK;oBAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC5D,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC3C,OAAM;YACR,KAAK,aAAa;gBAChB,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC/C,OAAM;YACR;gBACE,OAAM;QACV,CAAC;IACH,CAAC;IAED,SAAS,YAAY,CAAC,IAAa,EAAE,KAAmB,EAAE,KAAa;QACrE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,MAAM;gBAAE,SAAQ;YACxH,MAAM,CAAC,GAAI,IAAgC,CAAC,GAAG,CAAC,CAAA;YAChD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrB,KAAK,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC;oBACrB,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;wBACvD,QAAQ,CAAC,IAAe,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;oBAC7C,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;gBACrD,QAAQ,CAAC,CAAY,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;YAC1C,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAKD,aAAa;AAEb;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,IAAyB;IAClE,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IACrC,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QAC9B,MAAM,IAAI,UAAU,CAClB,CAAC,CAAC,OAAO,EACT,CAAC,CAAC,MAAM,EACR,YAAY,EACZ,SAAS,EACT,CAAC,CAAC,MAAM,CACT,CAAA;IACH,CAAC;AACH,CAAC","sourcesContent":["/**\n * security-scanner — .fai.js 静态安全门禁（纵深防御第一层）\n *\n * 方案：docs/plans/2026-09-08-faijs-security-gate.md（§5）\n *\n * 定位：在 MetadataExtractor（UI 通道）与 DirectExecutor（执行通道）之前\n * 对源码做 **AST 全量递归遍历**，覆盖函数体、控制流块、嵌套函数——消除\n * 当前\"只扫顶层\"的盲区。规则表与功能代码解耦（R6）：新增 op / 新增语法\n * 形态不需要改扫描器，只有\"新增被禁能力\"才改规则表（数据）。\n *\n * 判定模型 = 能力黑名单（S1）+ 危险语法（S2）+ 危险成员名（S3）+\n * 自由标识符白名单（S4）+ 结构上限（S5）+ 命名空间保护（S7）。\n *\n * 诚实边界（D9）：静态门禁 ≠ 沙箱。无法拦截拼接属性名 `g['ev'+'al']`、\n * 字符串内代码、已获引用二次调用。本方案通过切断能力来源（S4）使残留\n * 失去立足点，但不宣称等价隔离。\n */\n\nimport { parse as acornParse } from 'acorn'\nimport type { Program } from 'acorn'\nimport { ParseError } from './parse-error'\n\n// ── 类型 ──\n\n/** 安全策略档位。strict = 默认（全规则）；balanced = 本机 CLI；off = 受控调试。 */\nexport type SecurityPolicy = 'strict' | 'balanced' | 'off'\n\n/** SecurityScanner 规则 ID（封闭集合，禁止自造；测试按此断言）。 */\nexport type SecurityRuleId =\n  | 'SEC_IDENT'\n  | 'SEC_SYNTAX'\n  | 'SEC_MEMBER'\n  | 'SEC_FREE_IDENT'\n  | 'SEC_LIMIT'\n  | 'SEC_NS_ASSIGN'\n  | 'SEC_RESERVED_ASSIGN'\n\n/** 违规条目。 */\nexport interface SecurityViolation {\n  /** 规则 ID（见 SecurityRuleId 枚举） */\n  ruleId: SecurityRuleId\n  /** 1-based 行号，相对传入的原始源码文本（Scanner 不做任何包裹/偏移） */\n  lineNo: number\n  /** 命中的标识符名 / 属性名 / 节点类型（无则省略） */\n  name?: string\n  /** 人类可读消息（AI 自纠用） */\n  message: string\n}\n\n/** 扫描选项。 */\nexport interface SecurityScanOptions {\n  /**\n   * 策略档位。**必填**——不允许缺省，调用方必须显式声明（防止无意间关闭门禁）。\n   */\n  policy: SecurityPolicy\n  /**\n   * 额外合法名字（S4 判定用：不在 knownNames 也不在 S4_SAFE_GLOBALS → SEC_FREE_IDENT）。\n   * 调用方可不传——Scanner 始终自动收集：\n   * ① 源码内全部 `ImportDeclaration` 的本地绑定名（named / namespace / default）；\n   * ② `opts.defaultNs ?? 'cad'`。\n   * 本字段只用于补充\"源码里看不到的名字\"。\n   */\n  knownNames?: string[]\n  /**\n   * 命名空间保护名（S7 判定用：对此列表中的名字做赋值 → SEC_NS_ASSIGN）。\n   * 缺省 = knownNames（即所有 knownNames 都受 S7 保护）。\n   * 调用方在 append 场景中可传一个更小的集合（仅命名空间名，不含 ctx 普通变量）。\n   */\n  nsNames?: string[]\n  /** 默认命名空间名，缺省 'cad'（自动进入 knownNames） */\n  defaultNs?: string\n}\n\n/** 扫描结果。 */\nexport interface SecurityScanResult {\n  /** true 当且仅当 violations 为空 */\n  ok: boolean\n  /** 命中即拒的条目；非空 → 调用方拒绝 */\n  violations: SecurityViolation[]\n  /** 只告警不拒（目前只有 S5 无界循环） */\n  warnings: SecurityViolation[]\n}\n\n// ── 规则表（数据驱动，新增规则不改遍历器） ──\n\n/**\n * S1 危险标识符黑名单（引用即拒，不区分读写、不区分声明位置）。\n * S1 优先于一切：即使用户用这些名字声明了自己的变量，也照样拒绝。\n */\nconst S1_IDENTS = new Set<string>([\n  // 执行任意代码\n  'eval', 'Function', 'AsyncFunction', 'GeneratorFunction', 'AsyncGeneratorFunction',\n  // 全局逃逸\n  'globalThis', 'window', 'self', 'top', 'parent', 'frames',\n  // Node 宿主\n  'process', 'require', 'module', 'exports', '__dirname', '__filename',\n  // 网络\n  'fetch', 'XMLHttpRequest', 'WebSocket', 'EventSource', 'navigator', 'sendBeacon',\n  // 浏览器存储/DOM\n  'localStorage', 'sessionStorage', 'indexedDB', 'caches', 'document', 'location', 'cookie',\n  // 动态装载\n  'importScripts', 'Worker', 'SharedWorker', 'WebAssembly',\n  // 定时器/微任务（混淆与延时外发）——仅 strict\n  'setTimeout', 'setInterval', 'setImmediate', 'queueMicrotask', 'requestAnimationFrame',\n  // 元编程（原型污染族）——仅 strict\n  'Reflect', 'Proxy', 'crypto',\n])\n\n/** S1 中仅在 strict 档生效的标识符集合。 */\nconst S1_STRICT_ONLY = new Set<string>([\n  'setTimeout', 'setInterval', 'setImmediate', 'queueMicrotask', 'requestAnimationFrame',\n  'Reflect', 'Proxy', 'crypto',\n])\n\n/**\n * S2 危险语法节点黑名单。\n * key = AST node type；value = true 表示仅 strict 档生效。\n */\nconst S2_SYNTAX: Record<string, boolean> = {\n  ImportExpression: false,       // 动态 import() — strict + balanced\n  WithStatement: false,          // with — strict + balanced\n  DebuggerStatement: false,      // debugger — strict + balanced\n  TaggedTemplateExpression: true, // 标签模板 — 仅 strict\n  MetaProperty: false,            // import.meta / new.target — strict + balanced\n}\n\n/**\n * S3 危险成员属性名黑名单（MemberExpression.property 的名字命中即拒）。\n */\nconst S3_MEMBERS = new Set<string>([\n  // 原型污染\n  '__proto__', 'constructor', 'prototype',\n  // getter/setter 注入\n  '__defineGetter__', '__defineSetter__', '__lookupGetter__', '__lookupSetter__',\n  // 对象元编程\n  'setPrototypeOf', 'defineProperty', 'defineGetter', 'defineSetter',\n  // 求值（x.eval 形式）\n  'eval',\n])\n\n/**\n * S4 安全全局白名单（固定清单，strict 与 balanced 相同）。\n * 不在此名单且不在已声明/knownNames 中的标识符 → SEC_FREE_IDENT 拒绝。\n * 导出供解释器后端（cad-runtime/interp/env.ts）做同序解析。\n */\nexport const S4_SAFE_GLOBALS = new Set<string>([\n  'Math', 'Number', 'String', 'Boolean', 'Array', 'Object', 'JSON', 'Date',\n  'Map', 'Set', 'Promise', 'Symbol', 'RegExp', 'Error',\n  'Infinity', 'NaN', 'undefined',\n  'parseInt', 'parseFloat', 'isNaN', 'isFinite',\n  'console',\n  // P6/D7: script-side unit constants (MM, INCH, DEGREE, …) are read-only globals.\n  // Values registered on globalThis by the runtime; SEC_RESERVED_ASSIGN (P6) prevents\n  // shadowing. The name set lives in units.ts (SCRIPT_UNIT_NAMES) but the literal\n  // list is duplicated here because lang/ must not create a runtime dependency on\n  // units.ts (type-only import is fine, but S4_SAFE_GLOBALS is a runtime Set).\n  // Names are UPPERCASE to avoid collisions with user variable names.\n  'MM', 'CM', 'METER', 'MICRON', 'INCH', 'FOOT', 'YARD',\n  'DEGREE', 'RADIAN', 'GRAM', 'KILOGRAM', 'SECOND',\n])\n\n/**\n * P6/D7: Reserved unit constant names — cannot be used as declaration names\n * (let/const/var/param/function) or assignment targets.\n * This is a subset of S4_SAFE_GLOBALS (the unit constants only, not Math/Number/etc).\n * SEC_RESERVED_ASSIGN prevents scripts from shadowing unit constants like\n * `INCH = 999` or `let MM = 3`, which would silently corrupt geometry.\n */\nexport const RESERVED_UNIT_NAMES = new Set<string>([\n  'MM', 'CM', 'METER', 'MICRON', 'INCH', 'FOOT', 'YARD',\n  'DEGREE', 'RADIAN', 'GRAM', 'KILOGRAM', 'SECOND',\n])\n\n// S5 结构上限\nconst S5_MAX_SOURCE_LEN = 1 * 1024 * 1024  // 1 MiB\nconst S5_MAX_TOP_STATEMENTS = 5000\nconst S5_MAX_NODES = 200_000\nconst S5_MAX_DEPTH = 100\n\n// S6 子模块装载上限\n\n/** S6 子模块装载深度上限（A3：ModuleRegistry 静态守卫）。 */\nexport const S6_MAX_DEPTH = 16\n/** S6 子模块装载总数上限（A3：ModuleRegistry 静态守卫）。 */\nexport const S6_MAX_MODULES = 64\n\n// ── 作用域管理 ──\n\ninterface Scope {\n  /** 本层已声明的名字（var/let/const、函数参数、函数名、解构名、catch 参数、循环绑定） */\n  names: Set<string>\n  /** 子作用域 */\n  parent: Scope | null\n}\n\nfunction createScope(parent: Scope | null): Scope {\n  return { names: new Set<string>(), parent }\n}\n\nfunction scopeHas(scope: Scope | null, name: string): boolean {\n  let s: Scope | null = scope\n  while (s) {\n    if (s.names.has(name)) return true\n    s = s.parent\n  }\n  return false\n}\n\n// ── 收集 import 绑定名 ──\n\n/** 从 Program.body 收集全部 ImportDeclaration 的本地绑定名。 */\nfunction collectImportBindings(ast: Program): string[] {\n  const out: string[] = []\n  const body = (ast as unknown as { body: unknown[] }).body\n  for (const node of body) {\n    const n = node as { type?: string; specifiers?: unknown[] }\n    if (n.type !== 'ImportDeclaration') continue\n    for (const spec of n.specifiers ?? []) {\n      const s = spec as { local?: { name?: string } }\n      if (s.local?.name) out.push(s.local.name)\n    }\n  }\n  return out\n}\n\n// ── 主扫描器 ──\n\n/**\n * 全量扫描源码文本（返回全部违规）。\n * policy==='off' 时直接返回 `{ ok:true, violations:[], warnings:[] }`。\n * 解析失败时（acorn SyntaxError）不包装不抛——交给调用方的主 acornParse 路径\n * 包装为 E_SYNTAX（Scanner 不重复定义语法错误）。\n *\n * @param code - the .fai.js source text (raw, un-wrapped).\n * @param opts - scan options (policy is required).\n * @returns the full scan result (violations + warnings).\n */\nexport function scanSource(code: string, opts: SecurityScanOptions): SecurityScanResult {\n  if (opts.policy === 'off') {\n    return { ok: true, violations: [], warnings: [] }\n  }\n\n  // S5: source length check (before parsing)\n  if (code.length > S5_MAX_SOURCE_LEN) {\n    return {\n      ok: false,\n      violations: [{\n        ruleId: 'SEC_LIMIT',\n        lineNo: 1,\n        message: `source too long (${code.length} > ${S5_MAX_SOURCE_LEN} bytes)`,\n      }],\n      warnings: [],\n    }\n  }\n\n  let ast: Program\n  try {\n    ast = acornParse(code, {\n      ecmaVersion: 'latest',\n      sourceType: 'module',\n      locations: true,\n    }) as unknown as Program\n  } catch {\n    // acorn SyntaxError → 交给调用方的主 acornParse 路径包装为 E_SYNTAX。\n    // Scanner 返回 ok=true（无安全违规），让语法错误路径正常处理。\n    return { ok: true, violations: [], warnings: [] }\n  }\n  return scanAst(ast, opts)\n}\n\n/**\n * 复用已解析的 AST 进行扫描（避免二次解析）。语义与 scanSource 完全一致。\n *\n * @param ast - the pre-parsed Program AST (with locations enabled).\n * @param opts - scan options (policy is required).\n * @returns the full scan result (violations + warnings).\n */\nexport function scanAst(ast: Program, opts: SecurityScanOptions): SecurityScanResult {\n  if (opts.policy === 'off') {\n    return { ok: true, violations: [], warnings: [] }\n  }\n\n  const policy = opts.policy\n  const defaultNs = opts.defaultNs ?? 'cad'\n  const violations: SecurityViolation[] = []\n  const warnings: SecurityViolation[] = []\n\n  // 自动收集 import 绑定名 + defaultNs\n  const importNames = collectImportBindings(ast)\n  const knownNames = new Set<string>([defaultNs, ...importNames])\n  for (const n of opts.knownNames ?? []) knownNames.add(n)\n\n  // S7 命名空间保护名：缺省 = knownNames（即所有 knownNames 都受 S7 保护）；\n  // 调用方可通过 nsNames 指定更小的集合（仅命名空间名，不含 ctx 普通变量）。\n  const s7Names = opts.nsNames ? new Set(opts.nsNames) : knownNames\n\n  // S5 结构上限 —— 判定在遍历前\n  const body = (ast as unknown as { body: unknown[] }).body\n  if (body.length > S5_MAX_TOP_STATEMENTS) {\n    violations.push({\n      ruleId: 'SEC_LIMIT',\n      lineNo: 1,\n      message: `too many top-level statements (${body.length} > ${S5_MAX_TOP_STATEMENTS})`,\n    })\n  }\n\n  // 准备 strict-only 集合\n  const s1Idents = new Set<string>()\n  for (const id of S1_IDENTS) {\n    if (S1_STRICT_ONLY.has(id) && policy !== 'strict') continue\n    s1Idents.add(id)\n  }\n\n  const s2Syntax: Record<string, boolean> = {}\n  for (const [k, strictOnly] of Object.entries(S2_SYNTAX)) {\n    if (strictOnly && policy !== 'strict') continue\n    s2Syntax[k] = strictOnly\n  }\n\n  let nodeCount = 0\n\n  // 顶层作用域：收集 import 绑定名（已在 knownNames），以及 body 级声明\n  const globalScope = createScope(null)\n  for (const n of importNames) globalScope.names.add(n)\n\n  // 遍历 AST\n  walkNode(ast as unknown as ASTNode, null, 0)\n\n  if (nodeCount > S5_MAX_NODES) {\n    violations.push({\n      ruleId: 'SEC_LIMIT',\n      lineNo: 1,\n      message: `too many AST nodes (${nodeCount} > ${S5_MAX_NODES})`,\n    })\n  }\n\n  return {\n    ok: violations.length === 0,\n    violations,\n    warnings,\n  }\n\n  // ── 递归 walker ──\n\n  function lineOf(node: ASTNode): number {\n    return node?.loc?.start?.line ?? 1\n  }\n\n  function addViolation(ruleId: SecurityRuleId, lineNo: number, name: string, message: string): void {\n    violations.push({ ruleId, lineNo, name, message })\n  }\n\n  /**\n   * 收集函数参数中的声明名（含默认参数、解构）。\n   */\n  function collectParamNames(params: ASTNode[], scope: Scope): void {\n    for (const p of params ?? []) {\n      collectPatternNames(p, scope)\n    }\n  }\n\n  /**\n   * 从解构/标识符模式收集名字（用于作用域登记）。\n   * P6: If a pattern name is a reserved unit constant, emits SEC_RESERVED_ASSIGN.\n   */\n  function collectPatternNames(pattern: ASTNode, scope: Scope): void {\n    if (!pattern) return\n    switch (pattern.type) {\n      case 'Identifier':\n        // P6/SEC_RESERVED_ASSIGN: reserved unit names cannot be declared\n        if (RESERVED_UNIT_NAMES.has(pattern.name)) {\n          addViolation('SEC_RESERVED_ASSIGN', lineOf(pattern), pattern.name,\n            `[security] SEC_RESERVED_ASSIGN line ${lineOf(pattern)}: cannot declare reserved unit name \"${pattern.name}\"`)\n        }\n        scope.names.add(pattern.name)\n        return\n      case 'ObjectPattern':\n        for (const prop of pattern.properties ?? []) {\n          if (prop?.type === 'Property') collectPatternNames(prop.value, scope)\n          else if (prop?.type === 'RestElement') collectPatternNames(prop.argument, scope)\n        }\n        return\n      case 'ArrayPattern':\n        for (const el of pattern.elements ?? []) {\n          if (el) collectPatternNames(el, scope)\n        }\n        return\n      case 'AssignmentPattern':\n        collectPatternNames(pattern.left, scope)\n        return\n      case 'RestElement':\n        collectPatternNames(pattern.argument, scope)\n        return\n      default:\n        return\n    }\n  }\n\n  /**\n   * 收集一个节点体内全部声明名（VariableDeclarator + FunctionDeclaration 等）。\n   * 用于函数体 / 块体遍历前先登记声明（提升语义）。\n   */\n  function collectDeclarations(body: ASTNode[], scope: Scope): void {\n    for (const node of body ?? []) {\n      if (!node) continue\n      switch (node.type) {\n        case 'VariableDeclaration':\n          for (const decl of node.declarations ?? []) {\n            collectPatternNames(decl?.id, scope)\n          }\n          break\n        case 'FunctionDeclaration':\n        case 'ClassDeclaration':\n          if (node.id?.type === 'Identifier') {\n            // P6/SEC_RESERVED_ASSIGN: reserved unit names cannot be function/class names\n            if (RESERVED_UNIT_NAMES.has(node.id.name)) {\n              addViolation('SEC_RESERVED_ASSIGN', lineOf(node), node.id.name,\n                `[security] SEC_RESERVED_ASSIGN line ${lineOf(node)}: cannot declare reserved unit name \"${node.id.name}\"`)\n            }\n            scope.names.add(node.id.name)\n          }\n          break\n        default:\n          break\n      }\n    }\n  }\n\n  function walkNode(node: ASTNode, scope: Scope | null, depth: number): void {\n    if (!node || typeof node !== 'object') return\n\n    nodeCount++\n    if (depth > S5_MAX_DEPTH) {\n      addViolation('SEC_LIMIT', lineOf(node), node.type ?? 'unknown', `AST nesting depth exceeds ${S5_MAX_DEPTH}`)\n      return\n    }\n\n    // ── S2 危险语法节点 ──\n    if (s2Syntax[node.type] !== undefined) {\n      addViolation('SEC_SYNTAX', lineOf(node), node.type, `[security] dangerous syntax: ${node.type}`)\n      // 继续遍历子节点（可能内部有更多违规），但不中断\n    }\n\n    // 按节点类型处理\n    switch (node.type) {\n      // ── Program ──\n      case 'Program': {\n        const programBody = node.body as ASTNode[]\n        collectDeclarations(programBody, scope ?? globalScope)\n        for (const child of programBody) walkNode(child, scope ?? globalScope, depth + 1)\n        return\n      }\n\n      // ── Import 声明：不遍历（绑定已自动收集） ──\n      case 'ImportDeclaration':\n        return\n\n      // ── Export 声明 ──\n      case 'ExportDefaultDeclaration':\n        walkNode(node.declaration, scope, depth + 1)\n        return\n      case 'ExportNamedDeclaration':\n        if (node.declaration) walkNode(node.declaration, scope, depth + 1)\n        return\n\n      // ── 函数声明 ──\n      case 'FunctionDeclaration':\n      case 'FunctionExpression':\n      case 'ArrowFunctionExpression': {\n        // 函数名在父作用域（FunctionDeclaration 提升到父层）\n        if (node.type === 'FunctionDeclaration' && node.id?.name && scope) {\n          // P6/SEC_RESERVED_ASSIGN: reserved unit names cannot be function names\n          if (RESERVED_UNIT_NAMES.has(node.id.name)) {\n            addViolation('SEC_RESERVED_ASSIGN', lineOf(node), node.id.name,\n              `[security] SEC_RESERVED_ASSIGN line ${lineOf(node)}: cannot declare reserved unit name \"${node.id.name}\"`)\n          }\n          scope.names.add(node.id.name)\n        }\n        const fnScope = createScope(scope)\n        collectParamNames(node.params ?? [], fnScope)\n        // 函数体提升：先收集体内全部声明\n        if (node.body?.type === 'BlockStatement') {\n          collectDeclarations(node.body.body ?? [], fnScope)\n        }\n        // 遍历参数（含默认值）\n        for (const p of node.params ?? []) walkNode(p, fnScope, depth + 1)\n        // 遍历函数体\n        if (node.body) walkNode(node.body, fnScope, depth + 1)\n        return\n      }\n\n      // ── 变量声明 ──\n      case 'VariableDeclaration': {\n        for (const decl of node.declarations ?? []) {\n          // 声明名登记（pattern 里的名字入当前 scope）\n          if (scope) collectPatternNames(decl?.id, scope)\n          // 遍历初始化表达式\n          if (decl?.init) walkNode(decl.init, scope, depth + 1)\n          // 遍历 pattern 本身（解构默认值等）\n          walkPattern(decl?.id, scope, depth + 1)\n        }\n        return\n      }\n\n      // ── 块语句 ──\n      case 'BlockStatement': {\n        const blockScope = createScope(scope)\n        collectDeclarations(node.body ?? [], blockScope)\n        for (const child of node.body ?? []) walkNode(child, blockScope, depth + 1)\n        return\n      }\n\n      // ── 控制流 ──\n      case 'IfStatement':\n        walkNode(node.test, scope, depth + 1)\n        walkNode(node.consequent, scope, depth + 1)\n        if (node.alternate) walkNode(node.alternate, scope, depth + 1)\n        return\n\n      case 'ForStatement': {\n        const forScope = createScope(scope)\n        if (node.init) {\n          // for(let i=...) 的 i 入 forScope\n          if (node.init.type === 'VariableDeclaration') {\n            for (const decl of node.init.declarations ?? []) {\n              collectPatternNames(decl?.id, forScope)\n              walkNode(decl, forScope, depth + 1)\n            }\n          } else {\n            walkNode(node.init, forScope, depth + 1)\n          }\n        }\n        if (node.test) walkNode(node.test, forScope, depth + 1)\n        if (node.update) walkNode(node.update, forScope, depth + 1)\n        // S5: 无界循环告警\n        if (node.test === null || node.test === undefined) {\n          warnings.push({\n            ruleId: 'SEC_LIMIT',\n            lineNo: lineOf(node),\n            name: 'for(;;)',\n            message: 'unbounded for loop (no test condition) — may hang',\n          })\n        }\n        if (node.body) walkNode(node.body, forScope, depth + 1)\n        return\n      }\n\n      case 'ForInStatement':\n      case 'ForOfStatement': {\n        const forScope = createScope(scope)\n        if (node.left?.type === 'VariableDeclaration') {\n          for (const decl of node.left.declarations ?? []) {\n            collectPatternNames(decl?.id, forScope)\n            walkNode(decl, forScope, depth + 1)\n          }\n        } else if (node.left?.type === 'Identifier') {\n          forScope.names.add(node.left.name)\n        }\n        if (node.right) walkNode(node.right, forScope, depth + 1)\n        if (node.body) walkNode(node.body, forScope, depth + 1)\n        return\n      }\n\n      case 'WhileStatement':\n        walkNode(node.test, scope, depth + 1)\n        // S5: while(true) 告警\n        if (node.test?.type === 'Literal' && node.test.value === true) {\n          warnings.push({\n            ruleId: 'SEC_LIMIT',\n            lineNo: lineOf(node),\n            name: 'while(true)',\n            message: 'unbounded while(true) loop — may hang',\n          })\n        }\n        if (node.body) walkNode(node.body, scope, depth + 1)\n        return\n\n      case 'DoWhileStatement':\n        if (node.body) walkNode(node.body, scope, depth + 1)\n        walkNode(node.test, scope, depth + 1)\n        if (node.test?.type === 'Literal' && node.test.value === true) {\n          warnings.push({\n            ruleId: 'SEC_LIMIT',\n            lineNo: lineOf(node),\n            name: 'do...while(true)',\n            message: 'unbounded do...while(true) loop — may hang',\n          })\n        }\n        return\n\n      case 'SwitchStatement': {\n        const swScope = createScope(scope)\n        walkNode(node.discriminant, scope, depth + 1)\n        for (const c of node.cases ?? []) {\n          if (c.test) walkNode(c.test, swScope, depth + 1)\n          for (const stmt of c.consequent ?? []) walkNode(stmt, swScope, depth + 1)\n        }\n        return\n      }\n\n      case 'TryStatement': {\n        walkNode(node.block, scope, depth + 1)\n        if (node.handler) {\n          const handlerScope = createScope(scope)\n          if (node.handler.param) collectPatternNames(node.handler.param, handlerScope)\n          if (node.handler.param) walkNode(node.handler.param, handlerScope, depth + 1)\n          walkNode(node.handler.body, handlerScope, depth + 1)\n        }\n        if (node.finalizer) walkNode(node.finalizer, scope, depth + 1)\n        return\n      }\n\n      case 'CatchClause': {\n        const catchScope = createScope(scope)\n        if (node.param) {\n          collectPatternNames(node.param, catchScope)\n          walkNode(node.param, catchScope, depth + 1)\n        }\n        collectDeclarations(node.body?.body ?? [], catchScope)\n        if (node.body) walkNode(node.body, catchScope, depth + 1)\n        return\n      }\n\n      // ── LabeledStatement ──\n      case 'LabeledStatement':\n        if (node.body) walkNode(node.body, scope, depth + 1)\n        return\n\n      // ── Return / Throw ──\n      case 'ReturnStatement':\n      case 'ThrowStatement':\n        if (node.argument) walkNode(node.argument, scope, depth + 1)\n        return\n\n      // ── ExpressionStatement ──\n      case 'ExpressionStatement':\n        walkNode(node.expression, scope, depth + 1)\n        return\n\n      // ── 表达式 ──\n      case 'Identifier': {\n        const name = node.name\n        // S1 危险标识符黑名单\n        if (s1Idents.has(name)) {\n          addViolation('SEC_IDENT', lineOf(node), name, `[security] SEC_IDENT line ${lineOf(node)}: \"${name}\" is not allowed`)\n          return\n        }\n        // S4 自由标识符白名单判定\n        if (scopeHas(scope, name) || knownNames.has(name) || S4_SAFE_GLOBALS.has(name)) {\n          return\n        }\n        // 未声明的自由标识符\n        addViolation('SEC_FREE_IDENT', lineOf(node), name, `[security] SEC_FREE_IDENT line ${lineOf(node)}: unknown identifier \"${name}\" (not declared, not a known namespace)`)\n        return\n      }\n\n      case 'MemberExpression': {\n        // S1 优先于一切：先遍历 object（让 Identifier 先命中 S1/S4），\n        // 再检查 S3 危险成员名。这样 globalThis.eval 先命中 SEC_IDENT(globalThis)。\n        walkNode(node.object, scope, depth + 1)\n        if (node.computed && node.property?.type !== 'Literal') {\n          walkNode(node.property, scope, depth + 1)\n        }\n        // S3 危险成员名（在 object 遍历后检查，确保 S1 优先级）\n        const propName = node.property?.type === 'Identifier' ? node.property.name\n          : node.property?.type === 'Literal' ? String(node.property.value)\n          : null\n        if (propName && S3_MEMBERS.has(propName)) {\n          addViolation('SEC_MEMBER', lineOf(node), propName, `[security] SEC_MEMBER line ${lineOf(node)}: dangerous member \"${propName}\"`)\n        }\n        return\n      }\n\n      case 'CallExpression':\n        walkNode(node.callee, scope, depth + 1)\n        for (const arg of node.arguments ?? []) walkNode(arg, scope, depth + 1)\n        return\n\n      case 'NewExpression':\n        walkNode(node.callee, scope, depth + 1)\n        for (const arg of node.arguments ?? []) walkNode(arg, scope, depth + 1)\n        return\n\n      case 'AssignmentExpression': {\n        // S7 命名空间保护：禁止对 s7Names 中的名字做赋值\n        const target = node.left\n        if (target?.type === 'Identifier' && s7Names.has(target.name)) {\n          addViolation('SEC_NS_ASSIGN', lineOf(node), target.name, `[security] SEC_NS_ASSIGN line ${lineOf(node)}: cannot assign to namespace \"${target.name}\"`)\n        }\n        // P6: SEC_RESERVED_ASSIGN — cannot assign to reserved unit constant names\n        if (target?.type === 'Identifier' && RESERVED_UNIT_NAMES.has(target.name)) {\n          addViolation('SEC_RESERVED_ASSIGN', lineOf(node), target.name, `[security] SEC_RESERVED_ASSIGN line ${lineOf(node)}: cannot assign to reserved unit name \"${target.name}\"`)\n        }\n        // MemberExpression 赋值：cad.box = ...\n        if (target?.type === 'MemberExpression' && target.object?.type === 'Identifier' && s7Names.has(target.object.name)) {\n          addViolation('SEC_NS_ASSIGN', lineOf(node), target.object.name, `[security] SEC_NS_ASSIGN line ${lineOf(node)}: cannot assign to member of namespace \"${target.object.name}\"`)\n        }\n        walkNode(node.left, scope, depth + 1)\n        walkNode(node.right, scope, depth + 1)\n        return\n      }\n\n      case 'BinaryExpression':\n      case 'LogicalExpression':\n        walkNode(node.left, scope, depth + 1)\n        walkNode(node.right, scope, depth + 1)\n        return\n\n      case 'UnaryExpression':\n      case 'UpdateExpression':\n        walkNode(node.argument, scope, depth + 1)\n        return\n\n      case 'ConditionalExpression':\n        walkNode(node.test, scope, depth + 1)\n        walkNode(node.consequent, scope, depth + 1)\n        walkNode(node.alternate, scope, depth + 1)\n        return\n\n      case 'ArrayExpression':\n        for (const el of node.elements ?? []) {\n          if (el) walkNode(el, scope, depth + 1)\n        }\n        return\n\n      case 'ObjectExpression':\n        for (const prop of node.properties ?? []) {\n          if (prop?.type === 'Property') {\n            // key 是标识符且非 computed → 不需要检查（对象字面量 key 不是标识符引用）\n            if (prop.computed && prop.key) walkNode(prop.key, scope, depth + 1)\n            if (prop.value) walkNode(prop.value, scope, depth + 1)\n          } else {\n            // SpreadElement 等\n            walkNode(prop, scope, depth + 1)\n          }\n        }\n        return\n\n      case 'TemplateLiteral':\n        for (const expr of node.expressions ?? []) walkNode(expr, scope, depth + 1)\n        return\n\n      case 'TaggedTemplateExpression':\n        // S2 已在上方判定；仍遍历 tag 与 quasi\n        walkNode(node.tag, scope, depth + 1)\n        if (node.quasi) walkNode(node.quasi, scope, depth + 1)\n        return\n\n      case 'AwaitExpression':\n        if (node.argument) walkNode(node.argument, scope, depth + 1)\n        return\n\n      case 'YieldExpression':\n        if (node.argument) walkNode(node.argument, scope, depth + 1)\n        return\n\n      case 'SpreadElement':\n        if (node.argument) walkNode(node.argument, scope, depth + 1)\n        return\n\n      case 'SequenceExpression':\n        for (const expr of node.expressions ?? []) walkNode(expr, scope, depth + 1)\n        return\n\n      case 'ParenthesizedExpression':\n        if (node.expression) walkNode(node.expression, scope, depth + 1)\n        return\n\n      case 'ChainExpression':\n        if (node.expression) walkNode(node.expression, scope, depth + 1)\n        return\n\n      case 'MetaProperty':\n        // S2 已在上方判定（import.meta / new.target）\n        return\n\n      case 'ImportExpression':\n        // S2 已在上方判定（动态 import()）\n        for (const arg of node.arguments ?? []) walkNode(arg, scope, depth + 1)\n        return\n\n      case 'ClassDeclaration':\n      case 'ClassExpression': {\n        if (node.id?.name && scope) scope.names.add(node.id.name)\n        const clsScope = createScope(scope)\n        if (node.superClass) walkNode(node.superClass, clsScope, depth + 1)\n        if (node.body) walkNode(node.body, clsScope, depth + 1)\n        return\n      }\n\n      case 'ClassBody':\n        for (const method of node.body ?? []) {\n          walkNode(method, scope, depth + 1)\n        }\n        return\n\n      case 'MethodDefinition':\n      case 'PropertyDefinition':\n        if (node.key && node.computed) walkNode(node.key, scope, depth + 1)\n        if (node.value) walkNode(node.value, scope, depth + 1)\n        return\n\n      case 'WithStatement':\n        // S2 已判定\n        walkNode(node.object, scope, depth + 1)\n        if (node.body) walkNode(node.body, scope, depth + 1)\n        return\n\n      case 'DebuggerStatement':\n        // S2 已判定\n        return\n\n      case 'ContinueStatement':\n      case 'BreakStatement':\n        return\n\n      case 'EmptyStatement':\n        return\n\n      case 'Literal':\n        return\n\n      case 'Super':\n        return\n\n      case 'ThisExpression':\n        return\n\n      case 'ImportSpecifier':\n      case 'ImportDefaultSpecifier':\n      case 'ImportNamespaceSpecifier':\n        return\n\n      case 'ExportSpecifier':\n        return\n\n      default:\n        // 未知节点：递归遍历其子属性\n        walkChildren(node, scope, depth)\n        return\n    }\n  }\n\n  function walkPattern(pattern: ASTNode, scope: Scope | null, depth: number): void {\n    if (!pattern) return\n    switch (pattern.type) {\n      case 'Identifier':\n        return // 已在 collectPatternNames 中登记\n      case 'ObjectPattern':\n        for (const prop of pattern.properties ?? []) {\n          if (prop?.type === 'Property') {\n            if (prop.computed && prop.key) walkNode(prop.key, scope, depth + 1)\n            if (prop.value) walkPattern(prop.value, scope, depth + 1)\n          } else if (prop?.type === 'RestElement') {\n            walkPattern(prop.argument, scope, depth + 1)\n          }\n        }\n        return\n      case 'ArrayPattern':\n        for (const el of pattern.elements ?? []) {\n          if (el) walkPattern(el, scope, depth + 1)\n        }\n        return\n      case 'AssignmentPattern':\n        if (pattern.right) walkNode(pattern.right, scope, depth + 1)\n        walkPattern(pattern.left, scope, depth + 1)\n        return\n      case 'RestElement':\n        walkPattern(pattern.argument, scope, depth + 1)\n        return\n      default:\n        return\n    }\n  }\n\n  function walkChildren(node: ASTNode, scope: Scope | null, depth: number): void {\n    for (const key of Object.keys(node)) {\n      if (key === 'loc' || key === 'start' || key === 'end' || key === 'range' || key === 'parent' || key === 'type') continue\n      const v = (node as Record<string, unknown>)[key]\n      if (Array.isArray(v)) {\n        for (const item of v) {\n          if (item && typeof item === 'object' && 'type' in item) {\n            walkNode(item as ASTNode, scope, depth + 1)\n          }\n        }\n      } else if (v && typeof v === 'object' && 'type' in v) {\n        walkNode(v as ASTNode, scope, depth + 1)\n      }\n    }\n  }\n}\n\n// ── 类型别名 ──\ntype ASTNode = any\n\n// ── 门禁断言 ──\n\n/**\n * 门禁断言：violations 非空则抛 ParseError（code='E_SECURITY'，ruleId 挂 ParseError.ruleId）。\n * 三处接入点（A1/A2/A3）统一用它。\n *\n * @param code - the .fai.js source text (raw, un-wrapped).\n * @param opts - scan options (policy is required).\n * @throws ParseError — when violations are non-empty (code='E_SECURITY').\n */\nexport function assertSecure(code: string, opts: SecurityScanOptions): void {\n  const result = scanSource(code, opts)\n  if (result.violations.length > 0) {\n    const v = result.violations[0]\n    throw new ParseError(\n      v.message,\n      v.lineNo,\n      'E_SECURITY',\n      undefined,\n      v.ruleId,\n    )\n  }\n}\n"]}

package/dist/lang/symbol-table.generated.d.ts

@@ -12,6 +12,9 @@ declare const _default: {
     wedge: {};
     screw: {};
     profile: {};
+    sketchOnPlane: {};
+    sketchOnFace: {};
+    punchHole: {};
     wire: {};
     helix: {};
     sdf: {};

package/dist/lang/symbol-table.generated.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"symbol-table.generated.d.ts","sourceRoot":"","sources":["../../src/lang/symbol-table.generated.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACH,wBA6FC"}
+{"version":3,"file":"symbol-table.generated.d.ts","sourceRoot":"","sources":["../../src/lang/symbol-table.generated.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACH,wBAgGC"}

package/dist/lang/symbol-table.generated.js

@@ -12,6 +12,9 @@ export default {
     "wedge": {},
     "screw": {},
     "profile": {},
+    "sketchOnPlane": {},
+    "sketchOnFace": {},
+    "punchHole": {},
     "wire": {},
     "helix": {},
     "sdf": {},

package/dist/lang/symbol-table.generated.js.map

@@ -1 +1 @@
-{"version":3,"file":"symbol-table.generated.js","sourceRoot":"","sources":["../../src/lang/symbol-table.generated.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAe;IACb,KAAK,EAAE,EAAE;IACT,QAAQ,EAAE,EAAE;IACZ,UAAU,EAAE,EAAE;IACd,MAAM,EAAE,EAAE;IACV,OAAO,EAAE,EAAE;IACX,OAAO,EAAE,EAAE;IACX,SAAS,EAAE,EAAE;IACb,MAAM,EAAE,EAAE;IACV,OAAO,EAAE,EAAE;IACX,KAAK,EAAE,EAAE;IACT,WAAW,EAAE,EAAE;IACf,cAAc,EAAE,EAAE;IAClB,OAAO,EAAE,EAAE;IACX,SAAS,EAAE,EAAE;IACb,SAAS,EAAE,EAAE;IACb,SAAS,EAAE,EAAE;IACb,QAAQ,EAAE,EAAE;IACZ,OAAO,EAAE,EAAE;IACX,OAAO,EAAE,EAAE;IACX,OAAO,EAAE,EAAE;IACX,SAAS,EAAE,EAAE;IACb,gBAAgB,EAAE,EAAE;IACpB,cAAc,EAAE,EAAE;IAClB,gBAAgB,EAAE,EAAE;IACpB,WAAW,EAAE,EAAE;IACf,cAAc,EAAE,EAAE;IAClB,iBAAiB,EAAE,EAAE;IACrB,KAAK,EAAE,EAAE;IACT,gBAAgB,EAAE,EAAE;IACpB,qBAAqB,EAAE,EAAE;IACzB,OAAO,EAAE,EAAE;IACX,UAAU,EAAE,EAAE;IACd,WAAW,EAAE,EAAE;IACf,SAAS,EAAE,EAAE;IACb,SAAS,EAAE,EAAE;IACb,OAAO,EAAE,EAAE;IACX,MAAM,EAAE,EAAE;IACV,YAAY,EAAE,EAAE;IAChB,YAAY,EAAE,EAAE;IAChB,SAAS,EAAE,EAAE;IACb,SAAS,EAAE,EAAE;IACb,SAAS,EAAE,EAAE;IACb,SAAS,EAAE,EAAE;IACb,iBAAiB,EAAE,EAAE;IACrB,mBAAmB,EAAE,EAAE;IACvB,cAAc,EAAE,EAAE;IAClB,OAAO,EAAE,EAAE;IACX,aAAa,EAAE,EAAE;IACjB,aAAa,EAAE,EAAE;IACjB,UAAU,EAAE,EAAE;IACd,OAAO,EAAE,EAAE;IACX,KAAK,EAAE,EAAE;IACT,OAAO,EAAE,EAAE;IACX,eAAe,EAAE,EAAE;IACnB,iBAAiB,EAAE,EAAE;IACrB,aAAa,EAAE,EAAE;IACjB,oBAAoB,EAAE,EAAE;IACxB,YAAY,EAAE,EAAE;IAChB,QAAQ,EAAE,EAAE;IACZ,OAAO,EAAE,EAAE;IACX,OAAO,EAAE,EAAE;IACX,MAAM,EAAE,EAAE;IACV,kBAAkB,EAAE,EAAE;IACtB,MAAM,EAAE,EAAE;IACV,QAAQ,EAAE,EAAE;IACZ,QAAQ,EAAE,EAAE;IACZ,cAAc,EAAE,EAAE;IAClB,YAAY,EAAE,EAAE;IAChB,aAAa,EAAE,EAAE;IACjB,cAAc,EAAE,EAAE;IAClB,gBAAgB,EAAE,EAAE;IACpB,cAAc,EAAE,EAAE;IAClB,MAAM,EAAE,EAAE;IACV,OAAO,EAAE,EAAE;IACX,QAAQ,EAAE,EAAE;IACZ,MAAM,EAAE,EAAE;IACV,QAAQ,EAAE,EAAE;IACZ,YAAY,EAAE,EAAE;IAChB,aAAa,EAAE,EAAE;IACjB,WAAW,EAAE,EAAE;IACf,QAAQ,EAAE,EAAE;IACZ,aAAa,EAAE,EAAE;IACjB,QAAQ,EAAE,EAAE;IACZ,QAAQ,EAAE,EAAE;IACZ,MAAM,EAAE,EAAE;IACV,UAAU,EAAE,EAAE;IACd,SAAS,EAAE,EAAE;IACb,aAAa,EAAE,EAAE;IACjB,UAAU,EAAE,EAAE;IACd,UAAU,EAAE,EAAE;IACd,WAAW,EAAE,EAAE;IACf,qBAAqB,EAAE,EAAE;CAC1B,CAAA","sourcesContent":["/**\n * symbol-table 生成文件 — 禁手改。\n * 由 scripts/gen-symbol-table.ts 从 api-namespace 的 cad 命名空间生成（键存在性）。\n * keep-syntax P1 后符号表只承载 check() 符号检查（\"函数不存在\"判定）；\n * 保留语义由 keep 声明表达，不再有 readonly 标注。\n */\nexport default {\n  \"box\": {},\n  \"sphere\": {},\n  \"cylinder\": {},\n  \"cone\": {},\n  \"wedge\": {},\n  \"screw\": {},\n  \"profile\": {},\n  \"wire\": {},\n  \"helix\": {},\n  \"sdf\": {},\n  \"translate\": {},\n  \"rotate_euler\": {},\n  \"scale\": {},\n  \"scale3d\": {},\n  \"engrave\": {},\n  \"chamfer\": {},\n  \"fillet\": {},\n  \"knurl\": {},\n  \"shell\": {},\n  \"draft\": {},\n  \"thicken\": {},\n  \"filletVariable\": {},\n  \"splitByPlane\": {},\n  \"sectionByPlane\": {},\n  \"defeature\": {},\n  \"reverseShape\": {},\n  \"unifySameDomain\": {},\n  \"sew\": {},\n  \"sewAndSolidify\": {},\n  \"removeHolesFromFace\": {},\n  \"union\": {},\n  \"subtract\": {},\n  \"intersect\": {},\n  \"extrude\": {},\n  \"revolve\": {},\n  \"sweep\": {},\n  \"loft\": {},\n  \"faceNormal\": {},\n  \"bboxCenter\": {},\n  \"bboxMin\": {},\n  \"bboxMax\": {},\n  \"edgeRef\": {},\n  \"faceRef\": {},\n  \"jointTrajectory\": {},\n  \"inverseKinematics\": {},\n  \"mechanismDOF\": {},\n  \"asset\": {},\n  \"import_brep\": {},\n  \"import_step\": {},\n  \"compound\": {},\n  \"place\": {},\n  \"cut\": {},\n  \"split\": {},\n  \"linearPattern\": {},\n  \"circularPattern\": {},\n  \"gridPattern\": {},\n  \"rectangularPattern\": {},\n  \"mirrorJoin\": {},\n  \"mirror\": {},\n  \"clone\": {},\n  \"torus\": {},\n  \"fuse\": {},\n  \"inspectMassProps\": {},\n  \"area\": {},\n  \"length\": {},\n  \"volume\": {},\n  \"centerOfMass\": {},\n  \"viewCamera\": {},\n  \"projectView\": {},\n  \"projectSheet\": {},\n  \"complexExtrude\": {},\n  \"twistExtrude\": {},\n  \"roof\": {},\n  \"drill\": {},\n  \"pocket\": {},\n  \"boss\": {},\n  \"thread\": {},\n  \"convexHull\": {},\n  \"makeBaseBox\": {},\n  \"ellipsoid\": {},\n  \"rotate\": {},\n  \"applyMatrix\": {},\n  \"locate\": {},\n  \"offset\": {},\n  \"heal\": {},\n  \"simplify\": {},\n  \"isValid\": {},\n  \"isSameShape\": {},\n  \"autoHeal\": {},\n  \"fixShape\": {},\n  \"healSolid\": {},\n  \"fixSelfIntersection\": {}\n}\n"]}
+{"version":3,"file":"symbol-table.generated.js","sourceRoot":"","sources":["../../src/lang/symbol-table.generated.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAe;IACb,KAAK,EAAE,EAAE;IACT,QAAQ,EAAE,EAAE;IACZ,UAAU,EAAE,EAAE;IACd,MAAM,EAAE,EAAE;IACV,OAAO,EAAE,EAAE;IACX,OAAO,EAAE,EAAE;IACX,SAAS,EAAE,EAAE;IACb,eAAe,EAAE,EAAE;IACnB,cAAc,EAAE,EAAE;IAClB,WAAW,EAAE,EAAE;IACf,MAAM,EAAE,EAAE;IACV,OAAO,EAAE,EAAE;IACX,KAAK,EAAE,EAAE;IACT,WAAW,EAAE,EAAE;IACf,cAAc,EAAE,EAAE;IAClB,OAAO,EAAE,EAAE;IACX,SAAS,EAAE,EAAE;IACb,SAAS,EAAE,EAAE;IACb,SAAS,EAAE,EAAE;IACb,QAAQ,EAAE,EAAE;IACZ,OAAO,EAAE,EAAE;IACX,OAAO,EAAE,EAAE;IACX,OAAO,EAAE,EAAE;IACX,SAAS,EAAE,EAAE;IACb,gBAAgB,EAAE,EAAE;IACpB,cAAc,EAAE,EAAE;IAClB,gBAAgB,EAAE,EAAE;IACpB,WAAW,EAAE,EAAE;IACf,cAAc,EAAE,EAAE;IAClB,iBAAiB,EAAE,EAAE;IACrB,KAAK,EAAE,EAAE;IACT,gBAAgB,EAAE,EAAE;IACpB,qBAAqB,EAAE,EAAE;IACzB,OAAO,EAAE,EAAE;IACX,UAAU,EAAE,EAAE;IACd,WAAW,EAAE,EAAE;IACf,SAAS,EAAE,EAAE;IACb,SAAS,EAAE,EAAE;IACb,OAAO,EAAE,EAAE;IACX,MAAM,EAAE,EAAE;IACV,YAAY,EAAE,EAAE;IAChB,YAAY,EAAE,EAAE;IAChB,SAAS,EAAE,EAAE;IACb,SAAS,EAAE,EAAE;IACb,SAAS,EAAE,EAAE;IACb,SAAS,EAAE,EAAE;IACb,iBAAiB,EAAE,EAAE;IACrB,mBAAmB,EAAE,EAAE;IACvB,cAAc,EAAE,EAAE;IAClB,OAAO,EAAE,EAAE;IACX,aAAa,EAAE,EAAE;IACjB,aAAa,EAAE,EAAE;IACjB,UAAU,EAAE,EAAE;IACd,OAAO,EAAE,EAAE;IACX,KAAK,EAAE,EAAE;IACT,OAAO,EAAE,EAAE;IACX,eAAe,EAAE,EAAE;IACnB,iBAAiB,EAAE,EAAE;IACrB,aAAa,EAAE,EAAE;IACjB,oBAAoB,EAAE,EAAE;IACxB,YAAY,EAAE,EAAE;IAChB,QAAQ,EAAE,EAAE;IACZ,OAAO,EAAE,EAAE;IACX,OAAO,EAAE,EAAE;IACX,MAAM,EAAE,EAAE;IACV,kBAAkB,EAAE,EAAE;IACtB,MAAM,EAAE,EAAE;IACV,QAAQ,EAAE,EAAE;IACZ,QAAQ,EAAE,EAAE;IACZ,cAAc,EAAE,EAAE;IAClB,YAAY,EAAE,EAAE;IAChB,aAAa,EAAE,EAAE;IACjB,cAAc,EAAE,EAAE;IAClB,gBAAgB,EAAE,EAAE;IACpB,cAAc,EAAE,EAAE;IAClB,MAAM,EAAE,EAAE;IACV,OAAO,EAAE,EAAE;IACX,QAAQ,EAAE,EAAE;IACZ,MAAM,EAAE,EAAE;IACV,QAAQ,EAAE,EAAE;IACZ,YAAY,EAAE,EAAE;IAChB,aAAa,EAAE,EAAE;IACjB,WAAW,EAAE,EAAE;IACf,QAAQ,EAAE,EAAE;IACZ,aAAa,EAAE,EAAE;IACjB,QAAQ,EAAE,EAAE;IACZ,QAAQ,EAAE,EAAE;IACZ,MAAM,EAAE,EAAE;IACV,UAAU,EAAE,EAAE;IACd,SAAS,EAAE,EAAE;IACb,aAAa,EAAE,EAAE;IACjB,UAAU,EAAE,EAAE;IACd,UAAU,EAAE,EAAE;IACd,WAAW,EAAE,EAAE;IACf,qBAAqB,EAAE,EAAE;CAC1B,CAAA","sourcesContent":["/**\n * symbol-table 生成文件 — 禁手改。\n * 由 scripts/gen-symbol-table.ts 从 api-namespace 的 cad 命名空间生成（键存在性）。\n * keep-syntax P1 后符号表只承载 check() 符号检查（\"函数不存在\"判定）；\n * 保留语义由 keep 声明表达，不再有 readonly 标注。\n */\nexport default {\n  \"box\": {},\n  \"sphere\": {},\n  \"cylinder\": {},\n  \"cone\": {},\n  \"wedge\": {},\n  \"screw\": {},\n  \"profile\": {},\n  \"sketchOnPlane\": {},\n  \"sketchOnFace\": {},\n  \"punchHole\": {},\n  \"wire\": {},\n  \"helix\": {},\n  \"sdf\": {},\n  \"translate\": {},\n  \"rotate_euler\": {},\n  \"scale\": {},\n  \"scale3d\": {},\n  \"engrave\": {},\n  \"chamfer\": {},\n  \"fillet\": {},\n  \"knurl\": {},\n  \"shell\": {},\n  \"draft\": {},\n  \"thicken\": {},\n  \"filletVariable\": {},\n  \"splitByPlane\": {},\n  \"sectionByPlane\": {},\n  \"defeature\": {},\n  \"reverseShape\": {},\n  \"unifySameDomain\": {},\n  \"sew\": {},\n  \"sewAndSolidify\": {},\n  \"removeHolesFromFace\": {},\n  \"union\": {},\n  \"subtract\": {},\n  \"intersect\": {},\n  \"extrude\": {},\n  \"revolve\": {},\n  \"sweep\": {},\n  \"loft\": {},\n  \"faceNormal\": {},\n  \"bboxCenter\": {},\n  \"bboxMin\": {},\n  \"bboxMax\": {},\n  \"edgeRef\": {},\n  \"faceRef\": {},\n  \"jointTrajectory\": {},\n  \"inverseKinematics\": {},\n  \"mechanismDOF\": {},\n  \"asset\": {},\n  \"import_brep\": {},\n  \"import_step\": {},\n  \"compound\": {},\n  \"place\": {},\n  \"cut\": {},\n  \"split\": {},\n  \"linearPattern\": {},\n  \"circularPattern\": {},\n  \"gridPattern\": {},\n  \"rectangularPattern\": {},\n  \"mirrorJoin\": {},\n  \"mirror\": {},\n  \"clone\": {},\n  \"torus\": {},\n  \"fuse\": {},\n  \"inspectMassProps\": {},\n  \"area\": {},\n  \"length\": {},\n  \"volume\": {},\n  \"centerOfMass\": {},\n  \"viewCamera\": {},\n  \"projectView\": {},\n  \"projectSheet\": {},\n  \"complexExtrude\": {},\n  \"twistExtrude\": {},\n  \"roof\": {},\n  \"drill\": {},\n  \"pocket\": {},\n  \"boss\": {},\n  \"thread\": {},\n  \"convexHull\": {},\n  \"makeBaseBox\": {},\n  \"ellipsoid\": {},\n  \"rotate\": {},\n  \"applyMatrix\": {},\n  \"locate\": {},\n  \"offset\": {},\n  \"heal\": {},\n  \"simplify\": {},\n  \"isValid\": {},\n  \"isSameShape\": {},\n  \"autoHeal\": {},\n  \"fixShape\": {},\n  \"healSolid\": {},\n  \"fixSelfIntersection\": {}\n}\n"]}

package/dist/mesh/io.d.ts

@@ -1,18 +1,71 @@
 /**
  * mesh IO API — headless 文件加载
  *
- * 替代浏览器版的 io.ts（依赖 fileBlobStore / formatLoaders / model-store）。
- * STL 由 core 自持的 `mesh/stl-loader.ts` 解析（零 three addons——`three/examples`
- * 不在 three 的版本兼容承诺内，且会把不可控模块带进每个消费方，含小程序 worker）。
+ * STL 由 core 自持的 `mesh/stl-loader.ts` 解析（零 three addons）；3MF 由
+ * `mesh/threemf-loader.ts` 解析（ZIP 解压 + XML，单位换算到 mm 基准）。
+ * 坐标永远以 faijs 基准长度单位（mm）存储 — Shape 不贴 unit 标签（D3）。
+ *
+ * 单位换算边界（unit-system §5.2）：
+ * - STL 无单位元数据 → 由 `opts.unit` 显式声明，缺省 mm，不做启发式猜测。
+ * - 3MF `<model unit>` 由解析器读取并换算（micron/mm/cm/inch/foot/meter）。
+ *
+ * 返回契约（unit-system §10.6）：`importFile` 返回 `{ shape, unit }` — `unit`
+ * 是文件**自己声明的单位**（3MF `<model unit>`、STEP 单位实体），无声明格式
+ * （STL）为 null（此时 `opts.unit` 决定刻度）。坐标恒为基准值 — `unit` 只作
+ * 元数据（sourceUnit 记录、导出目标判定），绝不参与几何缩放（读入折算已由
+ * 内核/解析器完成，二次缩放 = 双重换算）。
  */
+import { type UnitName, type ValueWithUnits } from '../units.js';
 import type { Shape } from './types.js';
+/** Result of a unit-aware file import. */
+export interface ImportFileResult {
+    shape: Shape;
+    /**
+     * The unit the file itself declares (3MF `<model unit>`, STEP unit entities).
+     * null for declaration-less formats (STL) — the caller's opts.unit decided.
+     */
+    unit: UnitName | null;
+}
+/**
+ * Bounded scan window for `detectStepUnit`. Unit entities sit at the front of
+ * the DATA section (right after the product/context blocks); 256 KiB covers
+ * every real-world header+context preamble observed so far. Recomputable
+ * constant — raise if a fixture ever misses.
+ */
+export declare const STEP_UNIT_SCAN_PREFIX: number;
+/**
+ * Parse the declared length unit from STEP text (unit-system §10.4).
+ *
+ * Unit entities live in the DATA section (not HEADER — ISO 10303-21 reserves
+ * HEADER for FILE_DESCRIPTION/FILE_NAME/FILE_SCHEMA), near its start. We scan
+ * a bounded prefix; the justification is "unit entities sit at the front of
+ * the DATA section", not "top of file".
+ *
+ * Recognized forms, both attached to a LENGTH_UNIT():
+ * - `SI_UNIT(<prefix>, .METRE.)` — prefix `.MILLI.`/`.CENTI.`/`.MICRO.` or `$`.
+ * - `CONVERSION_BASED_UNIT('<NAME>', #n)` — inch/foot/etc.
+ *
+ * Metadata only — NEVER used to scale geometry (OCCT already normalizes on
+ * read; re-scaling = double conversion).
+ *
+ * @param stepText - the full STEP file text to scan (only a bounded prefix is read).
+ * @returns the faijs UnitName, or null when no length-unit declaration is found
+ *   (STEP permits omitting it; caller falls back to the base unit).
+ */
+export declare function detectStepUnit(stepText: string): UnitName | null;
 /**
- * Load geometry from raw file bytes (headless variant). STL is parsed
- * directly; unsupported formats fall back to STL parsing.
+ * Load geometry from raw file bytes (headless variant).
  *
- * @param buffer - the raw file bytes to parse.
- * @param format - format identifier such as 'stl' (defaults to 'stl').
- * @returns the loaded shape.
+ * @param buffer - the raw file bytes to parse (already decompressed; stpz
+ *   unzipping is the caller's job — faijs never unzips implicitly).
+ * @param format - format identifier such as 'stl', '3mf'/'threemf' or 'step'
+ *   (defaults to 'stl').
+ * @param opts - optional settings; `unit` declares the source unit for
+ *   formats without unit metadata (e.g. STL). Defaults to mm.
+ * @returns the shape with base-unit coordinates plus the file's own declared
+ *   unit (`unit`, metadata only; null when the format has no declaration).
  */
-export declare function importFile(buffer: ArrayBuffer, format?: string): Promise<Shape>;
+export declare function importFile(buffer: ArrayBuffer, format?: string, opts?: {
+    unit?: ValueWithUnits;
+}): Promise<ImportFileResult>;
 //# sourceMappingURL=io.d.ts.map

package/dist/mesh/io.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"io.d.ts","sourceRoot":"","sources":["../../src/mesh/io.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAEpC;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,WAAW,EACnB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,KAAK,CAAC,CAahB"}
+{"version":3,"file":"io.d.ts","sourceRoot":"","sources":["../../src/mesh/io.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAMH,OAAO,EAAM,KAAK,QAAQ,EAAE,KAAK,cAAc,EAAE,MAAM,UAAU,CAAA;AACjE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAEpC,0CAA0C;AAC1C,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,KAAK,CAAA;IACZ;;;OAGG;IACH,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAA;CACtB;AAuBD;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,QAAa,CAAA;AAE/C;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAqBhE;AAeD;;;;;;;;;;;GAWG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,WAAW,EACnB,MAAM,CAAC,EAAE,MAAM,EACf,IAAI,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,cAAc,CAAA;CAAE,GAC/B,OAAO,CAAC,gBAAgB,CAAC,CA0B3B"}