@faicad/faijs 0.19.0 → 0.29.3

package/dist/lang/parse-error.d.ts

@@ -22,7 +22,13 @@ export type ParseErrorCode =
 /** 本机函数调用 ABI 违规（§3.6：位置实参超位 / args 对象键不在形参表） */
  | 'E_ARG'
 /** 安全门禁违规（SecurityScanner 命中：危险标识符 / 危险语法 / 自由标识符等） */
- | 'E_SECURITY';
+ | 'E_SECURITY'
+/** P6/D8: 有量纲位收到裸数字字面量（dimension pass） */
+ | 'E_DIM_BARE_NUMBER'
+/** P6/D8: 可判定量纲的两侧量纲不一致（dimension pass） */
+ | 'E_DIM_MISMATCH'
+/** P6/D8: 单位常量名不在表中（dimension pass 兖底） */
+ | 'E_DIM_UNKNOWN_UNIT';
 /**
  * An error raised while parsing faijs source, carrying the offending line
  * number and a diagnostic code the host can forward for precise feedback.

package/dist/lang/parse-error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parse-error.d.ts","sourceRoot":"","sources":["../../src/lang/parse-error.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,4DAA4D;AAC5D,MAAM,MAAM,cAAc;AACxB,qBAAqB;AACnB,UAAU;AACZ,wFAAwF;GACtF,gBAAgB;AAClB,uCAAuC;GACrC,aAAa;AACf,oCAAoC;GAClC,SAAS;AACX,2BAA2B;GACzB,UAAU;AACZ,gCAAgC;GAC9B,aAAa;AACf,iDAAiD;GAC/C,OAAO;AACT,uDAAuD;GACrD,YAAY,CAAA;AAEhB;;;GAGG;AACH,qBAAa,UAAW,SAAQ,KAAK;IACnC,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAA;IACZ,6DAA6D;IAC7D,IAAI,EAAE,cAAc,CAAA;IACpB,8FAA8F;IAC9F,MAAM,CAAC,EAAE,MAAM,CAAA;gBAEH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,cAA2B,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM;CAU/G"}
+{"version":3,"file":"parse-error.d.ts","sourceRoot":"","sources":["../../src/lang/parse-error.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,4DAA4D;AAC5D,MAAM,MAAM,cAAc;AACxB,qBAAqB;AACnB,UAAU;AACZ,wFAAwF;GACtF,gBAAgB;AAClB,uCAAuC;GACrC,aAAa;AACf,oCAAoC;GAClC,SAAS;AACX,2BAA2B;GACzB,UAAU;AACZ,gCAAgC;GAC9B,aAAa;AACf,iDAAiD;GAC/C,OAAO;AACT,uDAAuD;GACrD,YAAY;AACd,0CAA0C;GACxC,mBAAmB;AACrB,2CAA2C;GACzC,gBAAgB;AAClB,0CAA0C;GACxC,oBAAoB,CAAA;AAExB;;;GAGG;AACH,qBAAa,UAAW,SAAQ,KAAK;IACnC,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAA;IACZ,6DAA6D;IAC7D,IAAI,EAAE,cAAc,CAAA;IACpB,8FAA8F;IAC9F,MAAM,CAAC,EAAE,MAAM,CAAA;gBAEH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,cAA2B,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM;CAU/G"}

package/dist/lang/parse-error.js.map

@@ -1 +1 @@
-{"version":3,"file":"parse-error.js","sourceRoot":"","sources":["../../src/lang/parse-error.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAqBH;;;GAGG;AACH,MAAM,OAAO,UAAW,SAAQ,KAAK;IACnC,iEAAiE;IACjE,IAAI,CAAQ;IACZ,6DAA6D;IAC7D,IAAI,CAAgB;IACpB,8FAA8F;IAC9F,MAAM,CAAS;IAEf,YAAY,OAAe,EAAE,IAAY,EAAE,OAAuB,UAAU,EAAE,KAAe,EAAE,MAAe;QAC5G,KAAK,CACH,iBAAiB,IAAI,KAAK,OAAO,EAAE,EACnC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,EAAE,KAAK,EAA8B,CACzE,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,YAAY,CAAA;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IAChD,CAAC;CACF","sourcesContent":["/**\n * parse-error — 文本层解析错误的唯一归属（L0 零依赖）\n *\n * 无 IR 双通道方案（2026-09-06）后语义层删除，MetadataExtractor /\n * SyntaxGate 复用同一 ParseError（宿主面 analyzeCode/codeToArgs 抛错契约不变：\n * 含 line 与 code 字段）。本文件是 ParseError 的唯一家。\n */\n\n/** 解析诊断码（宿主 CadRuntime.check 透传给 CheckError，AI 可据此精确修正）。 */\nexport type ParseErrorCode =\n  /** 语法错误（acorn 闸门） */\n  | 'E_SYNTAX'\n  /** 控制流语句（if/for/while/do/switch/try/throw/break/continue/labeled/with + 动态 import()） */\n  | 'E_CONTROL_FLOW'\n  /** 不支持的语句形态（函数/类/export/new/eval 等） */\n  | 'E_STATEMENT'\n  /** 参数值表达式不合法（无法静态折叠 / 不支持的表达式节点） */\n  | 'E_VALUE'\n  /** import 声明位置/形态违规（F2） */\n  | 'E_IMPORT'\n  /** 引用错误（未知变量 / 未声明 receiver） */\n  | 'E_REFERENCE'\n  /** 本机函数调用 ABI 违规（§3.6：位置实参超位 / args 对象键不在形参表） */\n  | 'E_ARG'\n  /** 安全门禁违规（SecurityScanner 命中：危险标识符 / 危险语法 / 自由标识符等） */\n  | 'E_SECURITY'\n\n/**\n * An error raised while parsing faijs source, carrying the offending line\n * number and a diagnostic code the host can forward for precise feedback.\n */\nexport class ParseError extends Error {\n  /** The 1-based source line at which the parse error occurred. */\n  line: number\n  /** 诊断码（缺省 E_SYNTAX）。宿主 check() 透传；3d_editor 可据此给 AI 精确反馈。 */\n  code: ParseErrorCode\n  /** SecurityScanner 规则 ID（仅 code='E_SECURITY' 时有值；见 security-scanner.ts SecurityRuleId 枚举）。 */\n  ruleId?: string\n\n  constructor(message: string, line: number, code: ParseErrorCode = 'E_SYNTAX', cause?: unknown, ruleId?: string) {\n    super(\n      `[parser] line ${line}: ${message}`,\n      cause === undefined ? undefined : ({ cause } as unknown as ErrorOptions),\n    )\n    this.name = 'ParseError'\n    this.line = line\n    this.code = code\n    if (ruleId !== undefined) this.ruleId = ruleId\n  }\n}\n"]}
+{"version":3,"file":"parse-error.js","sourceRoot":"","sources":["../../src/lang/parse-error.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA2BH;;;GAGG;AACH,MAAM,OAAO,UAAW,SAAQ,KAAK;IACnC,iEAAiE;IACjE,IAAI,CAAQ;IACZ,6DAA6D;IAC7D,IAAI,CAAgB;IACpB,8FAA8F;IAC9F,MAAM,CAAS;IAEf,YAAY,OAAe,EAAE,IAAY,EAAE,OAAuB,UAAU,EAAE,KAAe,EAAE,MAAe;QAC5G,KAAK,CACH,iBAAiB,IAAI,KAAK,OAAO,EAAE,EACnC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,EAAE,KAAK,EAA8B,CACzE,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,YAAY,CAAA;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IAChD,CAAC;CACF","sourcesContent":["/**\n * parse-error — 文本层解析错误的唯一归属（L0 零依赖）\n *\n * 无 IR 双通道方案（2026-09-06）后语义层删除，MetadataExtractor /\n * SyntaxGate 复用同一 ParseError（宿主面 analyzeCode/codeToArgs 抛错契约不变：\n * 含 line 与 code 字段）。本文件是 ParseError 的唯一家。\n */\n\n/** 解析诊断码（宿主 CadRuntime.check 透传给 CheckError，AI 可据此精确修正）。 */\nexport type ParseErrorCode =\n  /** 语法错误（acorn 闸门） */\n  | 'E_SYNTAX'\n  /** 控制流语句（if/for/while/do/switch/try/throw/break/continue/labeled/with + 动态 import()） */\n  | 'E_CONTROL_FLOW'\n  /** 不支持的语句形态（函数/类/export/new/eval 等） */\n  | 'E_STATEMENT'\n  /** 参数值表达式不合法（无法静态折叠 / 不支持的表达式节点） */\n  | 'E_VALUE'\n  /** import 声明位置/形态违规（F2） */\n  | 'E_IMPORT'\n  /** 引用错误（未知变量 / 未声明 receiver） */\n  | 'E_REFERENCE'\n  /** 本机函数调用 ABI 违规（§3.6：位置实参超位 / args 对象键不在形参表） */\n  | 'E_ARG'\n  /** 安全门禁违规（SecurityScanner 命中：危险标识符 / 危险语法 / 自由标识符等） */\n  | 'E_SECURITY'\n  /** P6/D8: 有量纲位收到裸数字字面量（dimension pass） */\n  | 'E_DIM_BARE_NUMBER'\n  /** P6/D8: 可判定量纲的两侧量纲不一致（dimension pass） */\n  | 'E_DIM_MISMATCH'\n  /** P6/D8: 单位常量名不在表中（dimension pass 兖底） */\n  | 'E_DIM_UNKNOWN_UNIT'\n\n/**\n * An error raised while parsing faijs source, carrying the offending line\n * number and a diagnostic code the host can forward for precise feedback.\n */\nexport class ParseError extends Error {\n  /** The 1-based source line at which the parse error occurred. */\n  line: number\n  /** 诊断码（缺省 E_SYNTAX）。宿主 check() 透传；3d_editor 可据此给 AI 精确反馈。 */\n  code: ParseErrorCode\n  /** SecurityScanner 规则 ID（仅 code='E_SECURITY' 时有值；见 security-scanner.ts SecurityRuleId 枚举）。 */\n  ruleId?: string\n\n  constructor(message: string, line: number, code: ParseErrorCode = 'E_SYNTAX', cause?: unknown, ruleId?: string) {\n    super(\n      `[parser] line ${line}: ${message}`,\n      cause === undefined ? undefined : ({ cause } as unknown as ErrorOptions),\n    )\n    this.name = 'ParseError'\n    this.line = line\n    this.code = code\n    if (ruleId !== undefined) this.ruleId = ruleId\n  }\n}\n"]}

package/dist/lang/security-scanner.d.ts

@@ -19,7 +19,7 @@ import type { Program } from 'acorn';
 /** 安全策略档位。strict = 默认（全规则）；balanced = 本机 CLI；off = 受控调试。 */
 export type SecurityPolicy = 'strict' | 'balanced' | 'off';
 /** SecurityScanner 规则 ID（封闭集合，禁止自造；测试按此断言）。 */
-export type SecurityRuleId = 'SEC_IDENT' | 'SEC_SYNTAX' | 'SEC_MEMBER' | 'SEC_FREE_IDENT' | 'SEC_LIMIT' | 'SEC_NS_ASSIGN';
+export type SecurityRuleId = 'SEC_IDENT' | 'SEC_SYNTAX' | 'SEC_MEMBER' | 'SEC_FREE_IDENT' | 'SEC_LIMIT' | 'SEC_NS_ASSIGN' | 'SEC_RESERVED_ASSIGN';
 /** 违规条目。 */
 export interface SecurityViolation {
     /** 规则 ID（见 SecurityRuleId 枚举） */
@@ -69,6 +69,14 @@ export interface SecurityScanResult {
  * 导出供解释器后端（cad-runtime/interp/env.ts）做同序解析。
  */
 export declare const S4_SAFE_GLOBALS: Set<string>;
+/**
+ * P6/D7: Reserved unit constant names — cannot be used as declaration names
+ * (let/const/var/param/function) or assignment targets.
+ * This is a subset of S4_SAFE_GLOBALS (the unit constants only, not Math/Number/etc).
+ * SEC_RESERVED_ASSIGN prevents scripts from shadowing unit constants like
+ * `INCH = 999` or `let MM = 3`, which would silently corrupt geometry.
+ */
+export declare const RESERVED_UNIT_NAMES: Set<string>;
 /** S6 子模块装载深度上限（A3：ModuleRegistry 静态守卫）。 */
 export declare const S6_MAX_DEPTH = 16;
 /** S6 子模块装载总数上限（A3：ModuleRegistry 静态守卫）。 */

package/dist/lang/security-scanner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security-scanner.d.ts","sourceRoot":"","sources":["../../src/lang/security-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAA;AAKpC,4DAA4D;AAC5D,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,UAAU,GAAG,KAAK,CAAA;AAE1D,+CAA+C;AAC/C,MAAM,MAAM,cAAc,GACtB,WAAW,GACX,YAAY,GACZ,YAAY,GACZ,gBAAgB,GAChB,WAAW,GACX,eAAe,CAAA;AAEnB,YAAY;AACZ,MAAM,WAAW,iBAAiB;IAChC,iCAAiC;IACjC,MAAM,EAAE,cAAc,CAAA;IACtB,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAA;IACd,iCAAiC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,qBAAqB;IACrB,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,YAAY;AACZ,MAAM,WAAW,mBAAmB;IAClC;;OAEG;IACH,MAAM,EAAE,cAAc,CAAA;IACtB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,YAAY;AACZ,MAAM,WAAW,kBAAkB;IACjC,8BAA8B;IAC9B,EAAE,EAAE,OAAO,CAAA;IACX,yBAAyB;IACzB,UAAU,EAAE,iBAAiB,EAAE,CAAA;IAC/B,0BAA0B;IAC1B,QAAQ,EAAE,iBAAiB,EAAE,CAAA;CAC9B;AA2DD;;;;GAIG;AACH,eAAO,MAAM,eAAe,aAM1B,CAAA;AAUF,4CAA4C;AAC5C,eAAO,MAAM,YAAY,KAAK,CAAA;AAC9B,4CAA4C;AAC5C,eAAO,MAAM,cAAc,KAAK,CAAA;AA2ChC;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,kBAAkB,CA+BtF;AAED;;;;;;GAMG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,GAAG,kBAAkB,CA+kBnF;AAOD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,IAAI,CAY1E"}
+{"version":3,"file":"security-scanner.d.ts","sourceRoot":"","sources":["../../src/lang/security-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAA;AAKpC,4DAA4D;AAC5D,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,UAAU,GAAG,KAAK,CAAA;AAE1D,+CAA+C;AAC/C,MAAM,MAAM,cAAc,GACtB,WAAW,GACX,YAAY,GACZ,YAAY,GACZ,gBAAgB,GAChB,WAAW,GACX,eAAe,GACf,qBAAqB,CAAA;AAEzB,YAAY;AACZ,MAAM,WAAW,iBAAiB;IAChC,iCAAiC;IACjC,MAAM,EAAE,cAAc,CAAA;IACtB,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAA;IACd,iCAAiC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,qBAAqB;IACrB,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,YAAY;AACZ,MAAM,WAAW,mBAAmB;IAClC;;OAEG;IACH,MAAM,EAAE,cAAc,CAAA;IACtB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,YAAY;AACZ,MAAM,WAAW,kBAAkB;IACjC,8BAA8B;IAC9B,EAAE,EAAE,OAAO,CAAA;IACX,yBAAyB;IACzB,UAAU,EAAE,iBAAiB,EAAE,CAAA;IAC/B,0BAA0B;IAC1B,QAAQ,EAAE,iBAAiB,EAAE,CAAA;CAC9B;AA2DD;;;;GAIG;AACH,eAAO,MAAM,eAAe,aAc1B,CAAA;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,aAG9B,CAAA;AAUF,4CAA4C;AAC5C,eAAO,MAAM,YAAY,KAAK,CAAA;AAC9B,4CAA4C;AAC5C,eAAO,MAAM,cAAc,KAAK,CAAA;AA2ChC;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,kBAAkB,CA+BtF;AAED;;;;;;GAMG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,GAAG,kBAAkB,CAqmBnF;AAOD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,IAAI,CAY1E"}

package/dist/lang/security-scanner.js

@@ -80,6 +80,25 @@ export const S4_SAFE_GLOBALS = new Set([
     'Infinity', 'NaN', 'undefined',
     'parseInt', 'parseFloat', 'isNaN', 'isFinite',
     'console',
+    // P6/D7: script-side unit constants (MM, INCH, DEGREE, …) are read-only globals.
+    // Values registered on globalThis by the runtime; SEC_RESERVED_ASSIGN (P6) prevents
+    // shadowing. The name set lives in units.ts (SCRIPT_UNIT_NAMES) but the literal
+    // list is duplicated here because lang/ must not create a runtime dependency on
+    // units.ts (type-only import is fine, but S4_SAFE_GLOBALS is a runtime Set).
+    // Names are UPPERCASE to avoid collisions with user variable names.
+    'MM', 'CM', 'METER', 'MICRON', 'INCH', 'FOOT', 'YARD',
+    'DEGREE', 'RADIAN', 'GRAM', 'KILOGRAM', 'SECOND',
+]);
+/**
+ * P6/D7: Reserved unit constant names — cannot be used as declaration names
+ * (let/const/var/param/function) or assignment targets.
+ * This is a subset of S4_SAFE_GLOBALS (the unit constants only, not Math/Number/etc).
+ * SEC_RESERVED_ASSIGN prevents scripts from shadowing unit constants like
+ * `INCH = 999` or `let MM = 3`, which would silently corrupt geometry.
+ */
+export const RESERVED_UNIT_NAMES = new Set([
+    'MM', 'CM', 'METER', 'MICRON', 'INCH', 'FOOT', 'YARD',
+    'DEGREE', 'RADIAN', 'GRAM', 'KILOGRAM', 'SECOND',
 ]);
 // S5 结构上限
 const S5_MAX_SOURCE_LEN = 1 * 1024 * 1024; // 1 MiB
@@ -243,12 +262,17 @@ export function scanAst(ast, opts) {
     }
     /**
      * 从解构/标识符模式收集名字（用于作用域登记）。
+     * P6: If a pattern name is a reserved unit constant, emits SEC_RESERVED_ASSIGN.
      */
     function collectPatternNames(pattern, scope) {
         if (!pattern)
             return;
         switch (pattern.type) {
             case 'Identifier':
+                // P6/SEC_RESERVED_ASSIGN: reserved unit names cannot be declared
+                if (RESERVED_UNIT_NAMES.has(pattern.name)) {
+                    addViolation('SEC_RESERVED_ASSIGN', lineOf(pattern), pattern.name, `[security] SEC_RESERVED_ASSIGN line ${lineOf(pattern)}: cannot declare reserved unit name "${pattern.name}"`);
+                }
                 scope.names.add(pattern.name);
                 return;
             case 'ObjectPattern':
@@ -291,8 +315,13 @@ export function scanAst(ast, opts) {
                     break;
                 case 'FunctionDeclaration':
                 case 'ClassDeclaration':
-                    if (node.id?.type === 'Identifier')
+                    if (node.id?.type === 'Identifier') {
+                        // P6/SEC_RESERVED_ASSIGN: reserved unit names cannot be function/class names
+                        if (RESERVED_UNIT_NAMES.has(node.id.name)) {
+                            addViolation('SEC_RESERVED_ASSIGN', lineOf(node), node.id.name, `[security] SEC_RESERVED_ASSIGN line ${lineOf(node)}: cannot declare reserved unit name "${node.id.name}"`);
+                        }
                         scope.names.add(node.id.name);
+                    }
                     break;
                 default:
                     break;
@@ -339,6 +368,10 @@ export function scanAst(ast, opts) {
             case 'ArrowFunctionExpression': {
                 // 函数名在父作用域（FunctionDeclaration 提升到父层）
                 if (node.type === 'FunctionDeclaration' && node.id?.name && scope) {
+                    // P6/SEC_RESERVED_ASSIGN: reserved unit names cannot be function names
+                    if (RESERVED_UNIT_NAMES.has(node.id.name)) {
+                        addViolation('SEC_RESERVED_ASSIGN', lineOf(node), node.id.name, `[security] SEC_RESERVED_ASSIGN line ${lineOf(node)}: cannot declare reserved unit name "${node.id.name}"`);
+                    }
                     scope.names.add(node.id.name);
                 }
                 const fnScope = createScope(scope);
@@ -559,6 +592,10 @@ export function scanAst(ast, opts) {
                 if (target?.type === 'Identifier' && s7Names.has(target.name)) {
                     addViolation('SEC_NS_ASSIGN', lineOf(node), target.name, `[security] SEC_NS_ASSIGN line ${lineOf(node)}: cannot assign to namespace "${target.name}"`);
                 }
+                // P6: SEC_RESERVED_ASSIGN — cannot assign to reserved unit constant names
+                if (target?.type === 'Identifier' && RESERVED_UNIT_NAMES.has(target.name)) {
+                    addViolation('SEC_RESERVED_ASSIGN', lineOf(node), target.name, `[security] SEC_RESERVED_ASSIGN line ${lineOf(node)}: cannot assign to reserved unit name "${target.name}"`);
+                }
                 // MemberExpression 赋值：cad.box = ...
                 if (target?.type === 'MemberExpression' && target.object?.type === 'Identifier' && s7Names.has(target.object.name)) {
                     addViolation('SEC_NS_ASSIGN', lineOf(node), target.object.name, `[security] SEC_NS_ASSIGN line ${lineOf(node)}: cannot assign to member of namespace "${target.object.name}"`);

package/dist/lang/security-scanner.js.map

@@ -1 +1 @@
-{"version":3,"file":"security-scanner.js","sourceRoot":"","sources":["../../src/lang/security-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,KAAK,IAAI,UAAU,EAAE,MAAM,OAAO,CAAA;AAE3C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AA8D1C,4BAA4B;AAE5B;;;GAGG;AACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAS;IAChC,SAAS;IACT,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,mBAAmB,EAAE,wBAAwB;IAClF,OAAO;IACP,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ;IACzD,UAAU;IACV,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY;IACpE,KAAK;IACL,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY;IAChF,YAAY;IACZ,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ;IACzF,OAAO;IACP,eAAe,EAAE,QAAQ,EAAE,cAAc,EAAE,aAAa;IACxD,6BAA6B;IAC7B,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,uBAAuB;IACtF,uBAAuB;IACvB,SAAS,EAAE,OAAO,EAAE,QAAQ;CAC7B,CAAC,CAAA;AAEF,+BAA+B;AAC/B,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS;IACrC,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,uBAAuB;IACtF,SAAS,EAAE,OAAO,EAAE,QAAQ;CAC7B,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,SAAS,GAA4B;IACzC,gBAAgB,EAAE,KAAK,EAAQ,kCAAkC;IACjE,aAAa,EAAE,KAAK,EAAW,2BAA2B;IAC1D,iBAAiB,EAAE,KAAK,EAAO,+BAA+B;IAC9D,wBAAwB,EAAE,IAAI,EAAE,kBAAkB;IAClD,YAAY,EAAE,KAAK,EAAa,+CAA+C;CAChF,CAAA;AAED;;GAEG;AACH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS;IACjC,OAAO;IACP,WAAW,EAAE,aAAa,EAAE,WAAW;IACvC,mBAAmB;IACnB,kBAAkB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,kBAAkB;IAC9E,QAAQ;IACR,gBAAgB,EAAE,gBAAgB,EAAE,cAAc,EAAE,cAAc;IAClE,gBAAgB;IAChB,MAAM;CACP,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,GAAG,CAAS;IAC7C,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM;IACxE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO;IACpD,UAAU,EAAE,KAAK,EAAE,WAAW;IAC9B,UAAU,EAAE,YAAY,EAAE,OAAO,EAAE,UAAU;IAC7C,SAAS;CACV,CAAC,CAAA;AAEF,UAAU;AACV,MAAM,iBAAiB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA,CAAE,QAAQ;AACnD,MAAM,qBAAqB,GAAG,IAAI,CAAA;AAClC,MAAM,YAAY,GAAG,OAAO,CAAA;AAC5B,MAAM,YAAY,GAAG,GAAG,CAAA;AAExB,aAAa;AAEb,4CAA4C;AAC5C,MAAM,CAAC,MAAM,YAAY,GAAG,EAAE,CAAA;AAC9B,4CAA4C;AAC5C,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAA;AAWhC,SAAS,WAAW,CAAC,MAAoB;IACvC,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAU,EAAE,MAAM,EAAE,CAAA;AAC7C,CAAC;AAED,SAAS,QAAQ,CAAC,KAAmB,EAAE,IAAY;IACjD,IAAI,CAAC,GAAiB,KAAK,CAAA;IAC3B,OAAO,CAAC,EAAE,CAAC;QACT,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QAClC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;IACd,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,sBAAsB;AAEtB,oDAAoD;AACpD,SAAS,qBAAqB,CAAC,GAAY;IACzC,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,MAAM,IAAI,GAAI,GAAsC,CAAC,IAAI,CAAA;IACzD,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,IAAiD,CAAA;QAC3D,IAAI,CAAC,CAAC,IAAI,KAAK,mBAAmB;YAAE,SAAQ;QAC5C,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;YACtC,MAAM,CAAC,GAAG,IAAqC,CAAA;YAC/C,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC3C,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,aAAa;AAEb;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,IAAyB;IAChE,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IACnD,CAAC;IAED,2CAA2C;IAC3C,IAAI,IAAI,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;QACpC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,UAAU,EAAE,CAAC;oBACX,MAAM,EAAE,WAAW;oBACnB,MAAM,EAAE,CAAC;oBACT,OAAO,EAAE,oBAAoB,IAAI,CAAC,MAAM,MAAM,iBAAiB,SAAS;iBACzE,CAAC;YACF,QAAQ,EAAE,EAAE;SACb,CAAA;IACH,CAAC;IAED,IAAI,GAAY,CAAA;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE;YACrB,WAAW,EAAE,QAAQ;YACrB,UAAU,EAAE,QAAQ;YACpB,SAAS,EAAE,IAAI;SAChB,CAAuB,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,yDAAyD;QACzD,yCAAyC;QACzC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IACnD,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,OAAO,CAAC,GAAY,EAAE,IAAyB;IAC7D,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IACnD,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;IAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAA;IACzC,MAAM,UAAU,GAAwB,EAAE,CAAA;IAC1C,MAAM,QAAQ,GAAwB,EAAE,CAAA;IAExC,8BAA8B;IAC9B,MAAM,WAAW,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAA;IAC9C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,CAAC,SAAS,EAAE,GAAG,WAAW,CAAC,CAAC,CAAA;IAC/D,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,IAAI,EAAE;QAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IAExD,uDAAuD;IACvD,8CAA8C;IAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAA;IAEjE,oBAAoB;IACpB,MAAM,IAAI,GAAI,GAAsC,CAAC,IAAI,CAAA;IACzD,IAAI,IAAI,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;QACxC,UAAU,CAAC,IAAI,CAAC;YACd,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,kCAAkC,IAAI,CAAC,MAAM,MAAM,qBAAqB,GAAG;SACrF,CAAC,CAAA;IACJ,CAAC;IAED,oBAAoB;IACpB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAA;IAClC,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;QAC3B,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,MAAM,KAAK,QAAQ;YAAE,SAAQ;QAC3D,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAClB,CAAC;IAED,MAAM,QAAQ,GAA4B,EAAE,CAAA;IAC5C,KAAK,MAAM,CAAC,CAAC,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACxD,IAAI,UAAU,IAAI,MAAM,KAAK,QAAQ;YAAE,SAAQ;QAC/C,QAAQ,CAAC,CAAC,CAAC,GAAG,UAAU,CAAA;IAC1B,CAAC;IAED,IAAI,SAAS,GAAG,CAAC,CAAA;IAEjB,iDAAiD;IACjD,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;IACrC,KAAK,MAAM,CAAC,IAAI,WAAW;QAAE,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IAErD,SAAS;IACT,QAAQ,CAAC,GAAyB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAE5C,IAAI,SAAS,GAAG,YAAY,EAAE,CAAC;QAC7B,UAAU,CAAC,IAAI,CAAC;YACd,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,uBAAuB,SAAS,MAAM,YAAY,GAAG;SAC/D,CAAC,CAAA;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,UAAU,CAAC,MAAM,KAAK,CAAC;QAC3B,UAAU;QACV,QAAQ;KACT,CAAA;IAED,kBAAkB;IAElB,SAAS,MAAM,CAAC,IAAa;QAC3B,OAAO,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,CAAA;IACpC,CAAC;IAED,SAAS,YAAY,CAAC,MAAsB,EAAE,MAAc,EAAE,IAAY,EAAE,OAAe;QACzF,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;IACpD,CAAC;IAED;;OAEG;IACH,SAAS,iBAAiB,CAAC,MAAiB,EAAE,KAAY;QACxD,KAAK,MAAM,CAAC,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC;YAC7B,mBAAmB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC/B,CAAC;IACH,CAAC;IAED;;OAEG;IACH,SAAS,mBAAmB,CAAC,OAAgB,EAAE,KAAY;QACzD,IAAI,CAAC,OAAO;YAAE,OAAM;QACpB,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,YAAY;gBACf,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;gBAC7B,OAAM;YACR,KAAK,eAAe;gBAClB,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;oBAC5C,IAAI,IAAI,EAAE,IAAI,KAAK,UAAU;wBAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;yBAChE,IAAI,IAAI,EAAE,IAAI,KAAK,aAAa;wBAAE,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;gBAClF,CAAC;gBACD,OAAM;YACR,KAAK,cAAc;gBACjB,KAAK,MAAM,EAAE,IAAI,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;oBACxC,IAAI,EAAE;wBAAE,mBAAmB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;gBACxC,CAAC;gBACD,OAAM;YACR,KAAK,mBAAmB;gBACtB,mBAAmB,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;gBACxC,OAAM;YACR,KAAK,aAAa;gBAChB,mBAAmB,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;gBAC5C,OAAM;YACR;gBACE,OAAM;QACV,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,SAAS,mBAAmB,CAAC,IAAe,EAAE,KAAY;QACxD,KAAK,MAAM,IAAI,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI;gBAAE,SAAQ;YACnB,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;gBAClB,KAAK,qBAAqB;oBACxB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;wBAC3C,mBAAmB,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,CAAA;oBACtC,CAAC;oBACD,MAAK;gBACP,KAAK,qBAAqB,CAAC;gBAC3B,KAAK,kBAAkB;oBACrB,IAAI,IAAI,CAAC,EAAE,EAAE,IAAI,KAAK,YAAY;wBAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAA;oBACjE,MAAK;gBACP;oBACE,MAAK;YACT,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS,QAAQ,CAAC,IAAa,EAAE,KAAmB,EAAE,KAAa;QACjE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAM;QAE7C,SAAS,EAAE,CAAA;QACX,IAAI,KAAK,GAAG,YAAY,EAAE,CAAC;YACzB,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,SAAS,EAAE,6BAA6B,YAAY,EAAE,CAAC,CAAA;YAC5G,OAAM;QACR,CAAC;QAED,kBAAkB;QAClB,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACtC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,gCAAgC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;YAChG,0BAA0B;QAC5B,CAAC;QAED,UAAU;QACV,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,gBAAgB;YAChB,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,MAAM,WAAW,GAAG,IAAI,CAAC,IAAiB,CAAA;gBAC1C,mBAAmB,CAAC,WAAW,EAAE,KAAK,IAAI,WAAW,CAAC,CAAA;gBACtD,KAAK,MAAM,KAAK,IAAI,WAAW;oBAAE,QAAQ,CAAC,KAAK,EAAE,KAAK,IAAI,WAAW,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACjF,OAAM;YACR,CAAC;YAED,+BAA+B;YAC/B,KAAK,mBAAmB;gBACtB,OAAM;YAER,kBAAkB;YAClB,KAAK,0BAA0B;gBAC7B,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC5C,OAAM;YACR,KAAK,wBAAwB;gBAC3B,IAAI,IAAI,CAAC,WAAW;oBAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAClE,OAAM;YAER,aAAa;YACb,KAAK,qBAAqB,CAAC;YAC3B,KAAK,oBAAoB,CAAC;YAC1B,KAAK,yBAAyB,CAAC,CAAC,CAAC;gBAC/B,sCAAsC;gBACtC,IAAI,IAAI,CAAC,IAAI,KAAK,qBAAqB,IAAI,IAAI,CAAC,EAAE,EAAE,IAAI,IAAI,KAAK,EAAE,CAAC;oBAClE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAA;gBAC/B,CAAC;gBACD,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;gBAClC,iBAAiB,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,OAAO,CAAC,CAAA;gBAC7C,kBAAkB;gBAClB,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,gBAAgB,EAAE,CAAC;oBACzC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,OAAO,CAAC,CAAA;gBACpD,CAAC;gBACD,aAAa;gBACb,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE;oBAAE,QAAQ,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAClE,QAAQ;gBACR,IAAI,IAAI,CAAC,IAAI;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACtD,OAAM;YACR,CAAC;YAED,aAAa;YACb,KAAK,qBAAqB,CAAC,CAAC,CAAC;gBAC3B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;oBAC3C,+BAA+B;oBAC/B,IAAI,KAAK;wBAAE,mBAAmB,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,CAAA;oBAC/C,WAAW;oBACX,IAAI,IAAI,EAAE,IAAI;wBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;oBACrD,wBAAwB;oBACxB,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACzC,CAAC;gBACD,OAAM;YACR,CAAC;YAED,YAAY;YACZ,KAAK,gBAAgB,CAAC,CAAC,CAAC;gBACtB,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;gBACrC,mBAAmB,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,UAAU,CAAC,CAAA;gBAChD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE;oBAAE,QAAQ,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC3E,OAAM;YACR,CAAC;YAED,YAAY;YACZ,KAAK,aAAa;gBAChB,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACrC,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC3C,IAAI,IAAI,CAAC,SAAS;oBAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC9D,OAAM;YAER,KAAK,cAAc,CAAC,CAAC,CAAC;gBACpB,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;gBACnC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;oBACd,gCAAgC;oBAChC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;wBAC7C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;4BAChD,mBAAmB,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAA;4BACvC,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;wBACrC,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;oBAC1C,CAAC;gBACH,CAAC;gBACD,IAAI,IAAI,CAAC,IAAI;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACvD,IAAI,IAAI,CAAC,MAAM;oBAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC3D,aAAa;gBACb,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;oBAClD,QAAQ,CAAC,IAAI,CAAC;wBACZ,MAAM,EAAE,WAAW;wBACnB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC;wBACpB,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,mDAAmD;qBAC7D,CAAC,CAAA;gBACJ,CAAC;gBACD,IAAI,IAAI,CAAC,IAAI;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACvD,OAAM;YACR,CAAC;YAED,KAAK,gBAAgB,CAAC;YACtB,KAAK,gBAAgB,CAAC,CAAC,CAAC;gBACtB,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;gBACnC,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,qBAAqB,EAAE,CAAC;oBAC9C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;wBAChD,mBAAmB,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAA;wBACvC,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;oBACrC,CAAC;gBACH,CAAC;qBAAM,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,YAAY,EAAE,CAAC;oBAC5C,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBACpC,CAAC;gBACD,IAAI,IAAI,CAAC,KAAK;oBAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACzD,IAAI,IAAI,CAAC,IAAI;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACvD,OAAM;YACR,CAAC;YAED,KAAK,gBAAgB;gBACnB,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACrC,qBAAqB;gBACrB,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;oBAC9D,QAAQ,CAAC,IAAI,CAAC;wBACZ,MAAM,EAAE,WAAW;wBACnB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC;wBACpB,IAAI,EAAE,aAAa;wBACnB,OAAO,EAAE,uCAAuC;qBACjD,CAAC,CAAA;gBACJ,CAAC;gBACD,IAAI,IAAI,CAAC,IAAI;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACpD,OAAM;YAER,KAAK,kBAAkB;gBACrB,IAAI,IAAI,CAAC,IAAI;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACpD,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACrC,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;oBAC9D,QAAQ,CAAC,IAAI,CAAC;wBACZ,MAAM,EAAE,WAAW;wBACnB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC;wBACpB,IAAI,EAAE,kBAAkB;wBACxB,OAAO,EAAE,4CAA4C;qBACtD,CAAC,CAAA;gBACJ,CAAC;gBACD,OAAM;YAER,KAAK,iBAAiB,CAAC,CAAC,CAAC;gBACvB,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;gBAClC,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC7C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;oBACjC,IAAI,CAAC,CAAC,IAAI;wBAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;oBAChD,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,UAAU,IAAI,EAAE;wBAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC3E,CAAC;gBACD,OAAM;YACR,CAAC;YAED,KAAK,cAAc,CAAC,CAAC,CAAC;gBACpB,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACtC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;oBACjB,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;oBACvC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK;wBAAE,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,CAAA;oBAC7E,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK;wBAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;oBAC7E,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACtD,CAAC;gBACD,IAAI,IAAI,CAAC,SAAS;oBAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC9D,OAAM;YACR,CAAC;YAED,KAAK,aAAa,CAAC,CAAC,CAAC;gBACnB,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;gBACrC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;oBACf,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;oBAC3C,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC7C,CAAC;gBACD,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,UAAU,CAAC,CAAA;gBACtD,IAAI,IAAI,CAAC,IAAI;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACzD,OAAM;YACR,CAAC;YAED,yBAAyB;YACzB,KAAK,kBAAkB;gBACrB,IAAI,IAAI,CAAC,IAAI;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACpD,OAAM;YAER,uBAAuB;YACvB,KAAK,iBAAiB,CAAC;YACvB,KAAK,gBAAgB;gBACnB,IAAI,IAAI,CAAC,QAAQ;oBAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC5D,OAAM;YAER,4BAA4B;YAC5B,KAAK,qBAAqB;gBACxB,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC3C,OAAM;YAER,YAAY;YACZ,KAAK,YAAY,CAAC,CAAC,CAAC;gBAClB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;gBACtB,cAAc;gBACd,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACvB,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,6BAA6B,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,kBAAkB,CAAC,CAAA;oBACpH,OAAM;gBACR,CAAC;gBACD,gBAAgB;gBAChB,IAAI,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC/E,OAAM;gBACR,CAAC;gBACD,YAAY;gBACZ,YAAY,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kCAAkC,MAAM,CAAC,IAAI,CAAC,yBAAyB,IAAI,yCAAyC,CAAC,CAAA;gBACxK,OAAM;YACR,CAAC;YAED,KAAK,kBAAkB,CAAC,CAAC,CAAC;gBACxB,+CAA+C;gBAC/C,6DAA6D;gBAC7D,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACvC,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;oBACvD,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC3C,CAAC;gBACD,qCAAqC;gBACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI;oBACxE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;wBACjE,CAAC,CAAC,IAAI,CAAA;gBACR,IAAI,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACzC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,8BAA8B,MAAM,CAAC,IAAI,CAAC,uBAAuB,QAAQ,GAAG,CAAC,CAAA;gBAClI,CAAC;gBACD,OAAM;YACR,CAAC;YAED,KAAK,gBAAgB;gBACnB,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACvC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,IAAI,EAAE;oBAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACvE,OAAM;YAER,KAAK,eAAe;gBAClB,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACvC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,IAAI,EAAE;oBAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACvE,OAAM;YAER,KAAK,sBAAsB,CAAC,CAAC,CAAC;gBAC5B,gCAAgC;gBAChC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAA;gBACxB,IAAI,MAAM,EAAE,IAAI,KAAK,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9D,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,EAAE,iCAAiC,MAAM,CAAC,IAAI,CAAC,iCAAiC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAA;gBACxJ,CAAC;gBACD,oCAAoC;gBACpC,IAAI,MAAM,EAAE,IAAI,KAAK,kBAAkB,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,KAAK,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnH,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,iCAAiC,MAAM,CAAC,IAAI,CAAC,2CAA2C,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAA;gBAChL,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACrC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACtC,OAAM;YACR,CAAC;YAED,KAAK,kBAAkB,CAAC;YACxB,KAAK,mBAAmB;gBACtB,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACrC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACtC,OAAM;YAER,KAAK,iBAAiB,CAAC;YACvB,KAAK,kBAAkB;gBACrB,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACzC,OAAM;YAER,KAAK,uBAAuB;gBAC1B,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACrC,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC3C,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC1C,OAAM;YAER,KAAK,iBAAiB;gBACpB,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;oBACrC,IAAI,EAAE;wBAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACxC,CAAC;gBACD,OAAM;YAER,KAAK,kBAAkB;gBACrB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;oBACzC,IAAI,IAAI,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;wBAC9B,iDAAiD;wBACjD,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG;4BAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;wBACnE,IAAI,IAAI,CAAC,KAAK;4BAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;oBACxD,CAAC;yBAAM,CAAC;wBACN,kBAAkB;wBAClB,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;oBAClC,CAAC;gBACH,CAAC;gBACD,OAAM;YAER,KAAK,iBAAiB;gBACpB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,WAAW,IAAI,EAAE;oBAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC3E,OAAM;YAER,KAAK,0BAA0B;gBAC7B,4BAA4B;gBAC5B,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACpC,IAAI,IAAI,CAAC,KAAK;oBAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACtD,OAAM;YAER,KAAK,iBAAiB;gBACpB,IAAI,IAAI,CAAC,QAAQ;oBAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC5D,OAAM;YAER,KAAK,iBAAiB;gBACpB,IAAI,IAAI,CAAC,QAAQ;oBAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC5D,OAAM;YAER,KAAK,eAAe;gBAClB,IAAI,IAAI,CAAC,QAAQ;oBAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC5D,OAAM;YAER,KAAK,oBAAoB;gBACvB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,WAAW,IAAI,EAAE;oBAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC3E,OAAM;YAER,KAAK,yBAAyB;gBAC5B,IAAI,IAAI,CAAC,UAAU;oBAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAChE,OAAM;YAER,KAAK,iBAAiB;gBACpB,IAAI,IAAI,CAAC,UAAU;oBAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAChE,OAAM;YAER,KAAK,cAAc;gBACjB,sCAAsC;gBACtC,OAAM;YAER,KAAK,kBAAkB;gBACrB,yBAAyB;gBACzB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,IAAI,EAAE;oBAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACvE,OAAM;YAER,KAAK,kBAAkB,CAAC;YACxB,KAAK,iBAAiB,CAAC,CAAC,CAAC;gBACvB,IAAI,IAAI,CAAC,EAAE,EAAE,IAAI,IAAI,KAAK;oBAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAA;gBACzD,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;gBACnC,IAAI,IAAI,CAAC,UAAU;oBAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACnE,IAAI,IAAI,CAAC,IAAI;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACvD,OAAM;YACR,CAAC;YAED,KAAK,WAAW;gBACd,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;oBACrC,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACpC,CAAC;gBACD,OAAM;YAER,KAAK,kBAAkB,CAAC;YACxB,KAAK,oBAAoB;gBACvB,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,QAAQ;oBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACnE,IAAI,IAAI,CAAC,KAAK;oBAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACtD,OAAM;YAER,KAAK,eAAe;gBAClB,SAAS;gBACT,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACvC,IAAI,IAAI,CAAC,IAAI;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACpD,OAAM;YAER,KAAK,mBAAmB;gBACtB,SAAS;gBACT,OAAM;YAER,KAAK,mBAAmB,CAAC;YACzB,KAAK,gBAAgB;gBACnB,OAAM;YAER,KAAK,gBAAgB;gBACnB,OAAM;YAER,KAAK,SAAS;gBACZ,OAAM;YAER,KAAK,OAAO;gBACV,OAAM;YAER,KAAK,gBAAgB;gBACnB,OAAM;YAER,KAAK,iBAAiB,CAAC;YACvB,KAAK,wBAAwB,CAAC;YAC9B,KAAK,0BAA0B;gBAC7B,OAAM;YAER,KAAK,iBAAiB;gBACpB,OAAM;YAER;gBACE,gBAAgB;gBAChB,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;gBAChC,OAAM;QACV,CAAC;IACH,CAAC;IAED,SAAS,WAAW,CAAC,OAAgB,EAAE,KAAmB,EAAE,KAAa;QACvE,IAAI,CAAC,OAAO;YAAE,OAAM;QACpB,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,YAAY;gBACf,OAAM,CAAC,6BAA6B;YACtC,KAAK,eAAe;gBAClB,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;oBAC5C,IAAI,IAAI,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;wBAC9B,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG;4BAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;wBACnE,IAAI,IAAI,CAAC,KAAK;4BAAE,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;oBAC3D,CAAC;yBAAM,IAAI,IAAI,EAAE,IAAI,KAAK,aAAa,EAAE,CAAC;wBACxC,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;oBAC9C,CAAC;gBACH,CAAC;gBACD,OAAM;YACR,KAAK,cAAc;gBACjB,KAAK,MAAM,EAAE,IAAI,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;oBACxC,IAAI,EAAE;wBAAE,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC3C,CAAC;gBACD,OAAM;YACR,KAAK,mBAAmB;gBACtB,IAAI,OAAO,CAAC,KAAK;oBAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC5D,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC3C,OAAM;YACR,KAAK,aAAa;gBAChB,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC/C,OAAM;YACR;gBACE,OAAM;QACV,CAAC;IACH,CAAC;IAED,SAAS,YAAY,CAAC,IAAa,EAAE,KAAmB,EAAE,KAAa;QACrE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,MAAM;gBAAE,SAAQ;YACxH,MAAM,CAAC,GAAI,IAAgC,CAAC,GAAG,CAAC,CAAA;YAChD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrB,KAAK,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC;oBACrB,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;wBACvD,QAAQ,CAAC,IAAe,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;oBAC7C,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;gBACrD,QAAQ,CAAC,CAAY,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;YAC1C,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAKD,aAAa;AAEb;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,IAAyB;IAClE,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IACrC,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QAC9B,MAAM,IAAI,UAAU,CAClB,CAAC,CAAC,OAAO,EACT,CAAC,CAAC,MAAM,EACR,YAAY,EACZ,SAAS,EACT,CAAC,CAAC,MAAM,CACT,CAAA;IACH,CAAC;AACH,CAAC","sourcesContent":["/**\n * security-scanner — .fai.js 静态安全门禁（纵深防御第一层）\n *\n * 方案：docs/plans/2026-09-08-faijs-security-gate.md（§5）\n *\n * 定位：在 MetadataExtractor（UI 通道）与 DirectExecutor（执行通道）之前\n * 对源码做 **AST 全量递归遍历**，覆盖函数体、控制流块、嵌套函数——消除\n * 当前\"只扫顶层\"的盲区。规则表与功能代码解耦（R6）：新增 op / 新增语法\n * 形态不需要改扫描器，只有\"新增被禁能力\"才改规则表（数据）。\n *\n * 判定模型 = 能力黑名单（S1）+ 危险语法（S2）+ 危险成员名（S3）+\n * 自由标识符白名单（S4）+ 结构上限（S5）+ 命名空间保护（S7）。\n *\n * 诚实边界（D9）：静态门禁 ≠ 沙箱。无法拦截拼接属性名 `g['ev'+'al']`、\n * 字符串内代码、已获引用二次调用。本方案通过切断能力来源（S4）使残留\n * 失去立足点，但不宣称等价隔离。\n */\n\nimport { parse as acornParse } from 'acorn'\nimport type { Program } from 'acorn'\nimport { ParseError } from './parse-error'\n\n// ── 类型 ──\n\n/** 安全策略档位。strict = 默认（全规则）；balanced = 本机 CLI；off = 受控调试。 */\nexport type SecurityPolicy = 'strict' | 'balanced' | 'off'\n\n/** SecurityScanner 规则 ID（封闭集合，禁止自造；测试按此断言）。 */\nexport type SecurityRuleId =\n  | 'SEC_IDENT'\n  | 'SEC_SYNTAX'\n  | 'SEC_MEMBER'\n  | 'SEC_FREE_IDENT'\n  | 'SEC_LIMIT'\n  | 'SEC_NS_ASSIGN'\n\n/** 违规条目。 */\nexport interface SecurityViolation {\n  /** 规则 ID（见 SecurityRuleId 枚举） */\n  ruleId: SecurityRuleId\n  /** 1-based 行号，相对传入的原始源码文本（Scanner 不做任何包裹/偏移） */\n  lineNo: number\n  /** 命中的标识符名 / 属性名 / 节点类型（无则省略） */\n  name?: string\n  /** 人类可读消息（AI 自纠用） */\n  message: string\n}\n\n/** 扫描选项。 */\nexport interface SecurityScanOptions {\n  /**\n   * 策略档位。**必填**——不允许缺省，调用方必须显式声明（防止无意间关闭门禁）。\n   */\n  policy: SecurityPolicy\n  /**\n   * 额外合法名字（S4 判定用：不在 knownNames 也不在 S4_SAFE_GLOBALS → SEC_FREE_IDENT）。\n   * 调用方可不传——Scanner 始终自动收集：\n   * ① 源码内全部 `ImportDeclaration` 的本地绑定名（named / namespace / default）；\n   * ② `opts.defaultNs ?? 'cad'`。\n   * 本字段只用于补充\"源码里看不到的名字\"。\n   */\n  knownNames?: string[]\n  /**\n   * 命名空间保护名（S7 判定用：对此列表中的名字做赋值 → SEC_NS_ASSIGN）。\n   * 缺省 = knownNames（即所有 knownNames 都受 S7 保护）。\n   * 调用方在 append 场景中可传一个更小的集合（仅命名空间名，不含 ctx 普通变量）。\n   */\n  nsNames?: string[]\n  /** 默认命名空间名，缺省 'cad'（自动进入 knownNames） */\n  defaultNs?: string\n}\n\n/** 扫描结果。 */\nexport interface SecurityScanResult {\n  /** true 当且仅当 violations 为空 */\n  ok: boolean\n  /** 命中即拒的条目；非空 → 调用方拒绝 */\n  violations: SecurityViolation[]\n  /** 只告警不拒（目前只有 S5 无界循环） */\n  warnings: SecurityViolation[]\n}\n\n// ── 规则表（数据驱动，新增规则不改遍历器） ──\n\n/**\n * S1 危险标识符黑名单（引用即拒，不区分读写、不区分声明位置）。\n * S1 优先于一切：即使用户用这些名字声明了自己的变量，也照样拒绝。\n */\nconst S1_IDENTS = new Set<string>([\n  // 执行任意代码\n  'eval', 'Function', 'AsyncFunction', 'GeneratorFunction', 'AsyncGeneratorFunction',\n  // 全局逃逸\n  'globalThis', 'window', 'self', 'top', 'parent', 'frames',\n  // Node 宿主\n  'process', 'require', 'module', 'exports', '__dirname', '__filename',\n  // 网络\n  'fetch', 'XMLHttpRequest', 'WebSocket', 'EventSource', 'navigator', 'sendBeacon',\n  // 浏览器存储/DOM\n  'localStorage', 'sessionStorage', 'indexedDB', 'caches', 'document', 'location', 'cookie',\n  // 动态装载\n  'importScripts', 'Worker', 'SharedWorker', 'WebAssembly',\n  // 定时器/微任务（混淆与延时外发）——仅 strict\n  'setTimeout', 'setInterval', 'setImmediate', 'queueMicrotask', 'requestAnimationFrame',\n  // 元编程（原型污染族）——仅 strict\n  'Reflect', 'Proxy', 'crypto',\n])\n\n/** S1 中仅在 strict 档生效的标识符集合。 */\nconst S1_STRICT_ONLY = new Set<string>([\n  'setTimeout', 'setInterval', 'setImmediate', 'queueMicrotask', 'requestAnimationFrame',\n  'Reflect', 'Proxy', 'crypto',\n])\n\n/**\n * S2 危险语法节点黑名单。\n * key = AST node type；value = true 表示仅 strict 档生效。\n */\nconst S2_SYNTAX: Record<string, boolean> = {\n  ImportExpression: false,       // 动态 import() — strict + balanced\n  WithStatement: false,          // with — strict + balanced\n  DebuggerStatement: false,      // debugger — strict + balanced\n  TaggedTemplateExpression: true, // 标签模板 — 仅 strict\n  MetaProperty: false,            // import.meta / new.target — strict + balanced\n}\n\n/**\n * S3 危险成员属性名黑名单（MemberExpression.property 的名字命中即拒）。\n */\nconst S3_MEMBERS = new Set<string>([\n  // 原型污染\n  '__proto__', 'constructor', 'prototype',\n  // getter/setter 注入\n  '__defineGetter__', '__defineSetter__', '__lookupGetter__', '__lookupSetter__',\n  // 对象元编程\n  'setPrototypeOf', 'defineProperty', 'defineGetter', 'defineSetter',\n  // 求值（x.eval 形式）\n  'eval',\n])\n\n/**\n * S4 安全全局白名单（固定清单，strict 与 balanced 相同）。\n * 不在此名单且不在已声明/knownNames 中的标识符 → SEC_FREE_IDENT 拒绝。\n * 导出供解释器后端（cad-runtime/interp/env.ts）做同序解析。\n */\nexport const S4_SAFE_GLOBALS = new Set<string>([\n  'Math', 'Number', 'String', 'Boolean', 'Array', 'Object', 'JSON', 'Date',\n  'Map', 'Set', 'Promise', 'Symbol', 'RegExp', 'Error',\n  'Infinity', 'NaN', 'undefined',\n  'parseInt', 'parseFloat', 'isNaN', 'isFinite',\n  'console',\n])\n\n// S5 结构上限\nconst S5_MAX_SOURCE_LEN = 1 * 1024 * 1024  // 1 MiB\nconst S5_MAX_TOP_STATEMENTS = 5000\nconst S5_MAX_NODES = 200_000\nconst S5_MAX_DEPTH = 100\n\n// S6 子模块装载上限\n\n/** S6 子模块装载深度上限（A3：ModuleRegistry 静态守卫）。 */\nexport const S6_MAX_DEPTH = 16\n/** S6 子模块装载总数上限（A3：ModuleRegistry 静态守卫）。 */\nexport const S6_MAX_MODULES = 64\n\n// ── 作用域管理 ──\n\ninterface Scope {\n  /** 本层已声明的名字（var/let/const、函数参数、函数名、解构名、catch 参数、循环绑定） */\n  names: Set<string>\n  /** 子作用域 */\n  parent: Scope | null\n}\n\nfunction createScope(parent: Scope | null): Scope {\n  return { names: new Set<string>(), parent }\n}\n\nfunction scopeHas(scope: Scope | null, name: string): boolean {\n  let s: Scope | null = scope\n  while (s) {\n    if (s.names.has(name)) return true\n    s = s.parent\n  }\n  return false\n}\n\n// ── 收集 import 绑定名 ──\n\n/** 从 Program.body 收集全部 ImportDeclaration 的本地绑定名。 */\nfunction collectImportBindings(ast: Program): string[] {\n  const out: string[] = []\n  const body = (ast as unknown as { body: unknown[] }).body\n  for (const node of body) {\n    const n = node as { type?: string; specifiers?: unknown[] }\n    if (n.type !== 'ImportDeclaration') continue\n    for (const spec of n.specifiers ?? []) {\n      const s = spec as { local?: { name?: string } }\n      if (s.local?.name) out.push(s.local.name)\n    }\n  }\n  return out\n}\n\n// ── 主扫描器 ──\n\n/**\n * 全量扫描源码文本（返回全部违规）。\n * policy==='off' 时直接返回 `{ ok:true, violations:[], warnings:[] }`。\n * 解析失败时（acorn SyntaxError）不包装不抛——交给调用方的主 acornParse 路径\n * 包装为 E_SYNTAX（Scanner 不重复定义语法错误）。\n *\n * @param code - the .fai.js source text (raw, un-wrapped).\n * @param opts - scan options (policy is required).\n * @returns the full scan result (violations + warnings).\n */\nexport function scanSource(code: string, opts: SecurityScanOptions): SecurityScanResult {\n  if (opts.policy === 'off') {\n    return { ok: true, violations: [], warnings: [] }\n  }\n\n  // S5: source length check (before parsing)\n  if (code.length > S5_MAX_SOURCE_LEN) {\n    return {\n      ok: false,\n      violations: [{\n        ruleId: 'SEC_LIMIT',\n        lineNo: 1,\n        message: `source too long (${code.length} > ${S5_MAX_SOURCE_LEN} bytes)`,\n      }],\n      warnings: [],\n    }\n  }\n\n  let ast: Program\n  try {\n    ast = acornParse(code, {\n      ecmaVersion: 'latest',\n      sourceType: 'module',\n      locations: true,\n    }) as unknown as Program\n  } catch {\n    // acorn SyntaxError → 交给调用方的主 acornParse 路径包装为 E_SYNTAX。\n    // Scanner 返回 ok=true（无安全违规），让语法错误路径正常处理。\n    return { ok: true, violations: [], warnings: [] }\n  }\n  return scanAst(ast, opts)\n}\n\n/**\n * 复用已解析的 AST 进行扫描（避免二次解析）。语义与 scanSource 完全一致。\n *\n * @param ast - the pre-parsed Program AST (with locations enabled).\n * @param opts - scan options (policy is required).\n * @returns the full scan result (violations + warnings).\n */\nexport function scanAst(ast: Program, opts: SecurityScanOptions): SecurityScanResult {\n  if (opts.policy === 'off') {\n    return { ok: true, violations: [], warnings: [] }\n  }\n\n  const policy = opts.policy\n  const defaultNs = opts.defaultNs ?? 'cad'\n  const violations: SecurityViolation[] = []\n  const warnings: SecurityViolation[] = []\n\n  // 自动收集 import 绑定名 + defaultNs\n  const importNames = collectImportBindings(ast)\n  const knownNames = new Set<string>([defaultNs, ...importNames])\n  for (const n of opts.knownNames ?? []) knownNames.add(n)\n\n  // S7 命名空间保护名：缺省 = knownNames（即所有 knownNames 都受 S7 保护）；\n  // 调用方可通过 nsNames 指定更小的集合（仅命名空间名，不含 ctx 普通变量）。\n  const s7Names = opts.nsNames ? new Set(opts.nsNames) : knownNames\n\n  // S5 结构上限 —— 判定在遍历前\n  const body = (ast as unknown as { body: unknown[] }).body\n  if (body.length > S5_MAX_TOP_STATEMENTS) {\n    violations.push({\n      ruleId: 'SEC_LIMIT',\n      lineNo: 1,\n      message: `too many top-level statements (${body.length} > ${S5_MAX_TOP_STATEMENTS})`,\n    })\n  }\n\n  // 准备 strict-only 集合\n  const s1Idents = new Set<string>()\n  for (const id of S1_IDENTS) {\n    if (S1_STRICT_ONLY.has(id) && policy !== 'strict') continue\n    s1Idents.add(id)\n  }\n\n  const s2Syntax: Record<string, boolean> = {}\n  for (const [k, strictOnly] of Object.entries(S2_SYNTAX)) {\n    if (strictOnly && policy !== 'strict') continue\n    s2Syntax[k] = strictOnly\n  }\n\n  let nodeCount = 0\n\n  // 顶层作用域：收集 import 绑定名（已在 knownNames），以及 body 级声明\n  const globalScope = createScope(null)\n  for (const n of importNames) globalScope.names.add(n)\n\n  // 遍历 AST\n  walkNode(ast as unknown as ASTNode, null, 0)\n\n  if (nodeCount > S5_MAX_NODES) {\n    violations.push({\n      ruleId: 'SEC_LIMIT',\n      lineNo: 1,\n      message: `too many AST nodes (${nodeCount} > ${S5_MAX_NODES})`,\n    })\n  }\n\n  return {\n    ok: violations.length === 0,\n    violations,\n    warnings,\n  }\n\n  // ── 递归 walker ──\n\n  function lineOf(node: ASTNode): number {\n    return node?.loc?.start?.line ?? 1\n  }\n\n  function addViolation(ruleId: SecurityRuleId, lineNo: number, name: string, message: string): void {\n    violations.push({ ruleId, lineNo, name, message })\n  }\n\n  /**\n   * 收集函数参数中的声明名（含默认参数、解构）。\n   */\n  function collectParamNames(params: ASTNode[], scope: Scope): void {\n    for (const p of params ?? []) {\n      collectPatternNames(p, scope)\n    }\n  }\n\n  /**\n   * 从解构/标识符模式收集名字（用于作用域登记）。\n   */\n  function collectPatternNames(pattern: ASTNode, scope: Scope): void {\n    if (!pattern) return\n    switch (pattern.type) {\n      case 'Identifier':\n        scope.names.add(pattern.name)\n        return\n      case 'ObjectPattern':\n        for (const prop of pattern.properties ?? []) {\n          if (prop?.type === 'Property') collectPatternNames(prop.value, scope)\n          else if (prop?.type === 'RestElement') collectPatternNames(prop.argument, scope)\n        }\n        return\n      case 'ArrayPattern':\n        for (const el of pattern.elements ?? []) {\n          if (el) collectPatternNames(el, scope)\n        }\n        return\n      case 'AssignmentPattern':\n        collectPatternNames(pattern.left, scope)\n        return\n      case 'RestElement':\n        collectPatternNames(pattern.argument, scope)\n        return\n      default:\n        return\n    }\n  }\n\n  /**\n   * 收集一个节点体内全部声明名（VariableDeclarator + FunctionDeclaration 等）。\n   * 用于函数体 / 块体遍历前先登记声明（提升语义）。\n   */\n  function collectDeclarations(body: ASTNode[], scope: Scope): void {\n    for (const node of body ?? []) {\n      if (!node) continue\n      switch (node.type) {\n        case 'VariableDeclaration':\n          for (const decl of node.declarations ?? []) {\n            collectPatternNames(decl?.id, scope)\n          }\n          break\n        case 'FunctionDeclaration':\n        case 'ClassDeclaration':\n          if (node.id?.type === 'Identifier') scope.names.add(node.id.name)\n          break\n        default:\n          break\n      }\n    }\n  }\n\n  function walkNode(node: ASTNode, scope: Scope | null, depth: number): void {\n    if (!node || typeof node !== 'object') return\n\n    nodeCount++\n    if (depth > S5_MAX_DEPTH) {\n      addViolation('SEC_LIMIT', lineOf(node), node.type ?? 'unknown', `AST nesting depth exceeds ${S5_MAX_DEPTH}`)\n      return\n    }\n\n    // ── S2 危险语法节点 ──\n    if (s2Syntax[node.type] !== undefined) {\n      addViolation('SEC_SYNTAX', lineOf(node), node.type, `[security] dangerous syntax: ${node.type}`)\n      // 继续遍历子节点（可能内部有更多违规），但不中断\n    }\n\n    // 按节点类型处理\n    switch (node.type) {\n      // ── Program ──\n      case 'Program': {\n        const programBody = node.body as ASTNode[]\n        collectDeclarations(programBody, scope ?? globalScope)\n        for (const child of programBody) walkNode(child, scope ?? globalScope, depth + 1)\n        return\n      }\n\n      // ── Import 声明：不遍历（绑定已自动收集） ──\n      case 'ImportDeclaration':\n        return\n\n      // ── Export 声明 ──\n      case 'ExportDefaultDeclaration':\n        walkNode(node.declaration, scope, depth + 1)\n        return\n      case 'ExportNamedDeclaration':\n        if (node.declaration) walkNode(node.declaration, scope, depth + 1)\n        return\n\n      // ── 函数声明 ──\n      case 'FunctionDeclaration':\n      case 'FunctionExpression':\n      case 'ArrowFunctionExpression': {\n        // 函数名在父作用域（FunctionDeclaration 提升到父层）\n        if (node.type === 'FunctionDeclaration' && node.id?.name && scope) {\n          scope.names.add(node.id.name)\n        }\n        const fnScope = createScope(scope)\n        collectParamNames(node.params ?? [], fnScope)\n        // 函数体提升：先收集体内全部声明\n        if (node.body?.type === 'BlockStatement') {\n          collectDeclarations(node.body.body ?? [], fnScope)\n        }\n        // 遍历参数（含默认值）\n        for (const p of node.params ?? []) walkNode(p, fnScope, depth + 1)\n        // 遍历函数体\n        if (node.body) walkNode(node.body, fnScope, depth + 1)\n        return\n      }\n\n      // ── 变量声明 ──\n      case 'VariableDeclaration': {\n        for (const decl of node.declarations ?? []) {\n          // 声明名登记（pattern 里的名字入当前 scope）\n          if (scope) collectPatternNames(decl?.id, scope)\n          // 遍历初始化表达式\n          if (decl?.init) walkNode(decl.init, scope, depth + 1)\n          // 遍历 pattern 本身（解构默认值等）\n          walkPattern(decl?.id, scope, depth + 1)\n        }\n        return\n      }\n\n      // ── 块语句 ──\n      case 'BlockStatement': {\n        const blockScope = createScope(scope)\n        collectDeclarations(node.body ?? [], blockScope)\n        for (const child of node.body ?? []) walkNode(child, blockScope, depth + 1)\n        return\n      }\n\n      // ── 控制流 ──\n      case 'IfStatement':\n        walkNode(node.test, scope, depth + 1)\n        walkNode(node.consequent, scope, depth + 1)\n        if (node.alternate) walkNode(node.alternate, scope, depth + 1)\n        return\n\n      case 'ForStatement': {\n        const forScope = createScope(scope)\n        if (node.init) {\n          // for(let i=...) 的 i 入 forScope\n          if (node.init.type === 'VariableDeclaration') {\n            for (const decl of node.init.declarations ?? []) {\n              collectPatternNames(decl?.id, forScope)\n              walkNode(decl, forScope, depth + 1)\n            }\n          } else {\n            walkNode(node.init, forScope, depth + 1)\n          }\n        }\n        if (node.test) walkNode(node.test, forScope, depth + 1)\n        if (node.update) walkNode(node.update, forScope, depth + 1)\n        // S5: 无界循环告警\n        if (node.test === null || node.test === undefined) {\n          warnings.push({\n            ruleId: 'SEC_LIMIT',\n            lineNo: lineOf(node),\n            name: 'for(;;)',\n            message: 'unbounded for loop (no test condition) — may hang',\n          })\n        }\n        if (node.body) walkNode(node.body, forScope, depth + 1)\n        return\n      }\n\n      case 'ForInStatement':\n      case 'ForOfStatement': {\n        const forScope = createScope(scope)\n        if (node.left?.type === 'VariableDeclaration') {\n          for (const decl of node.left.declarations ?? []) {\n            collectPatternNames(decl?.id, forScope)\n            walkNode(decl, forScope, depth + 1)\n          }\n        } else if (node.left?.type === 'Identifier') {\n          forScope.names.add(node.left.name)\n        }\n        if (node.right) walkNode(node.right, forScope, depth + 1)\n        if (node.body) walkNode(node.body, forScope, depth + 1)\n        return\n      }\n\n      case 'WhileStatement':\n        walkNode(node.test, scope, depth + 1)\n        // S5: while(true) 告警\n        if (node.test?.type === 'Literal' && node.test.value === true) {\n          warnings.push({\n            ruleId: 'SEC_LIMIT',\n            lineNo: lineOf(node),\n            name: 'while(true)',\n            message: 'unbounded while(true) loop — may hang',\n          })\n        }\n        if (node.body) walkNode(node.body, scope, depth + 1)\n        return\n\n      case 'DoWhileStatement':\n        if (node.body) walkNode(node.body, scope, depth + 1)\n        walkNode(node.test, scope, depth + 1)\n        if (node.test?.type === 'Literal' && node.test.value === true) {\n          warnings.push({\n            ruleId: 'SEC_LIMIT',\n            lineNo: lineOf(node),\n            name: 'do...while(true)',\n            message: 'unbounded do...while(true) loop — may hang',\n          })\n        }\n        return\n\n      case 'SwitchStatement': {\n        const swScope = createScope(scope)\n        walkNode(node.discriminant, scope, depth + 1)\n        for (const c of node.cases ?? []) {\n          if (c.test) walkNode(c.test, swScope, depth + 1)\n          for (const stmt of c.consequent ?? []) walkNode(stmt, swScope, depth + 1)\n        }\n        return\n      }\n\n      case 'TryStatement': {\n        walkNode(node.block, scope, depth + 1)\n        if (node.handler) {\n          const handlerScope = createScope(scope)\n          if (node.handler.param) collectPatternNames(node.handler.param, handlerScope)\n          if (node.handler.param) walkNode(node.handler.param, handlerScope, depth + 1)\n          walkNode(node.handler.body, handlerScope, depth + 1)\n        }\n        if (node.finalizer) walkNode(node.finalizer, scope, depth + 1)\n        return\n      }\n\n      case 'CatchClause': {\n        const catchScope = createScope(scope)\n        if (node.param) {\n          collectPatternNames(node.param, catchScope)\n          walkNode(node.param, catchScope, depth + 1)\n        }\n        collectDeclarations(node.body?.body ?? [], catchScope)\n        if (node.body) walkNode(node.body, catchScope, depth + 1)\n        return\n      }\n\n      // ── LabeledStatement ──\n      case 'LabeledStatement':\n        if (node.body) walkNode(node.body, scope, depth + 1)\n        return\n\n      // ── Return / Throw ──\n      case 'ReturnStatement':\n      case 'ThrowStatement':\n        if (node.argument) walkNode(node.argument, scope, depth + 1)\n        return\n\n      // ── ExpressionStatement ──\n      case 'ExpressionStatement':\n        walkNode(node.expression, scope, depth + 1)\n        return\n\n      // ── 表达式 ──\n      case 'Identifier': {\n        const name = node.name\n        // S1 危险标识符黑名单\n        if (s1Idents.has(name)) {\n          addViolation('SEC_IDENT', lineOf(node), name, `[security] SEC_IDENT line ${lineOf(node)}: \"${name}\" is not allowed`)\n          return\n        }\n        // S4 自由标识符白名单判定\n        if (scopeHas(scope, name) || knownNames.has(name) || S4_SAFE_GLOBALS.has(name)) {\n          return\n        }\n        // 未声明的自由标识符\n        addViolation('SEC_FREE_IDENT', lineOf(node), name, `[security] SEC_FREE_IDENT line ${lineOf(node)}: unknown identifier \"${name}\" (not declared, not a known namespace)`)\n        return\n      }\n\n      case 'MemberExpression': {\n        // S1 优先于一切：先遍历 object（让 Identifier 先命中 S1/S4），\n        // 再检查 S3 危险成员名。这样 globalThis.eval 先命中 SEC_IDENT(globalThis)。\n        walkNode(node.object, scope, depth + 1)\n        if (node.computed && node.property?.type !== 'Literal') {\n          walkNode(node.property, scope, depth + 1)\n        }\n        // S3 危险成员名（在 object 遍历后检查，确保 S1 优先级）\n        const propName = node.property?.type === 'Identifier' ? node.property.name\n          : node.property?.type === 'Literal' ? String(node.property.value)\n          : null\n        if (propName && S3_MEMBERS.has(propName)) {\n          addViolation('SEC_MEMBER', lineOf(node), propName, `[security] SEC_MEMBER line ${lineOf(node)}: dangerous member \"${propName}\"`)\n        }\n        return\n      }\n\n      case 'CallExpression':\n        walkNode(node.callee, scope, depth + 1)\n        for (const arg of node.arguments ?? []) walkNode(arg, scope, depth + 1)\n        return\n\n      case 'NewExpression':\n        walkNode(node.callee, scope, depth + 1)\n        for (const arg of node.arguments ?? []) walkNode(arg, scope, depth + 1)\n        return\n\n      case 'AssignmentExpression': {\n        // S7 命名空间保护：禁止对 s7Names 中的名字做赋值\n        const target = node.left\n        if (target?.type === 'Identifier' && s7Names.has(target.name)) {\n          addViolation('SEC_NS_ASSIGN', lineOf(node), target.name, `[security] SEC_NS_ASSIGN line ${lineOf(node)}: cannot assign to namespace \"${target.name}\"`)\n        }\n        // MemberExpression 赋值：cad.box = ...\n        if (target?.type === 'MemberExpression' && target.object?.type === 'Identifier' && s7Names.has(target.object.name)) {\n          addViolation('SEC_NS_ASSIGN', lineOf(node), target.object.name, `[security] SEC_NS_ASSIGN line ${lineOf(node)}: cannot assign to member of namespace \"${target.object.name}\"`)\n        }\n        walkNode(node.left, scope, depth + 1)\n        walkNode(node.right, scope, depth + 1)\n        return\n      }\n\n      case 'BinaryExpression':\n      case 'LogicalExpression':\n        walkNode(node.left, scope, depth + 1)\n        walkNode(node.right, scope, depth + 1)\n        return\n\n      case 'UnaryExpression':\n      case 'UpdateExpression':\n        walkNode(node.argument, scope, depth + 1)\n        return\n\n      case 'ConditionalExpression':\n        walkNode(node.test, scope, depth + 1)\n        walkNode(node.consequent, scope, depth + 1)\n        walkNode(node.alternate, scope, depth + 1)\n        return\n\n      case 'ArrayExpression':\n        for (const el of node.elements ?? []) {\n          if (el) walkNode(el, scope, depth + 1)\n        }\n        return\n\n      case 'ObjectExpression':\n        for (const prop of node.properties ?? []) {\n          if (prop?.type === 'Property') {\n            // key 是标识符且非 computed → 不需要检查（对象字面量 key 不是标识符引用）\n            if (prop.computed && prop.key) walkNode(prop.key, scope, depth + 1)\n            if (prop.value) walkNode(prop.value, scope, depth + 1)\n          } else {\n            // SpreadElement 等\n            walkNode(prop, scope, depth + 1)\n          }\n        }\n        return\n\n      case 'TemplateLiteral':\n        for (const expr of node.expressions ?? []) walkNode(expr, scope, depth + 1)\n        return\n\n      case 'TaggedTemplateExpression':\n        // S2 已在上方判定；仍遍历 tag 与 quasi\n        walkNode(node.tag, scope, depth + 1)\n        if (node.quasi) walkNode(node.quasi, scope, depth + 1)\n        return\n\n      case 'AwaitExpression':\n        if (node.argument) walkNode(node.argument, scope, depth + 1)\n        return\n\n      case 'YieldExpression':\n        if (node.argument) walkNode(node.argument, scope, depth + 1)\n        return\n\n      case 'SpreadElement':\n        if (node.argument) walkNode(node.argument, scope, depth + 1)\n        return\n\n      case 'SequenceExpression':\n        for (const expr of node.expressions ?? []) walkNode(expr, scope, depth + 1)\n        return\n\n      case 'ParenthesizedExpression':\n        if (node.expression) walkNode(node.expression, scope, depth + 1)\n        return\n\n      case 'ChainExpression':\n        if (node.expression) walkNode(node.expression, scope, depth + 1)\n        return\n\n      case 'MetaProperty':\n        // S2 已在上方判定（import.meta / new.target）\n        return\n\n      case 'ImportExpression':\n        // S2 已在上方判定（动态 import()）\n        for (const arg of node.arguments ?? []) walkNode(arg, scope, depth + 1)\n        return\n\n      case 'ClassDeclaration':\n      case 'ClassExpression': {\n        if (node.id?.name && scope) scope.names.add(node.id.name)\n        const clsScope = createScope(scope)\n        if (node.superClass) walkNode(node.superClass, clsScope, depth + 1)\n        if (node.body) walkNode(node.body, clsScope, depth + 1)\n        return\n      }\n\n      case 'ClassBody':\n        for (const method of node.body ?? []) {\n          walkNode(method, scope, depth + 1)\n        }\n        return\n\n      case 'MethodDefinition':\n      case 'PropertyDefinition':\n        if (node.key && node.computed) walkNode(node.key, scope, depth + 1)\n        if (node.value) walkNode(node.value, scope, depth + 1)\n        return\n\n      case 'WithStatement':\n        // S2 已判定\n        walkNode(node.object, scope, depth + 1)\n        if (node.body) walkNode(node.body, scope, depth + 1)\n        return\n\n      case 'DebuggerStatement':\n        // S2 已判定\n        return\n\n      case 'ContinueStatement':\n      case 'BreakStatement':\n        return\n\n      case 'EmptyStatement':\n        return\n\n      case 'Literal':\n        return\n\n      case 'Super':\n        return\n\n      case 'ThisExpression':\n        return\n\n      case 'ImportSpecifier':\n      case 'ImportDefaultSpecifier':\n      case 'ImportNamespaceSpecifier':\n        return\n\n      case 'ExportSpecifier':\n        return\n\n      default:\n        // 未知节点：递归遍历其子属性\n        walkChildren(node, scope, depth)\n        return\n    }\n  }\n\n  function walkPattern(pattern: ASTNode, scope: Scope | null, depth: number): void {\n    if (!pattern) return\n    switch (pattern.type) {\n      case 'Identifier':\n        return // 已在 collectPatternNames 中登记\n      case 'ObjectPattern':\n        for (const prop of pattern.properties ?? []) {\n          if (prop?.type === 'Property') {\n            if (prop.computed && prop.key) walkNode(prop.key, scope, depth + 1)\n            if (prop.value) walkPattern(prop.value, scope, depth + 1)\n          } else if (prop?.type === 'RestElement') {\n            walkPattern(prop.argument, scope, depth + 1)\n          }\n        }\n        return\n      case 'ArrayPattern':\n        for (const el of pattern.elements ?? []) {\n          if (el) walkPattern(el, scope, depth + 1)\n        }\n        return\n      case 'AssignmentPattern':\n        if (pattern.right) walkNode(pattern.right, scope, depth + 1)\n        walkPattern(pattern.left, scope, depth + 1)\n        return\n      case 'RestElement':\n        walkPattern(pattern.argument, scope, depth + 1)\n        return\n      default:\n        return\n    }\n  }\n\n  function walkChildren(node: ASTNode, scope: Scope | null, depth: number): void {\n    for (const key of Object.keys(node)) {\n      if (key === 'loc' || key === 'start' || key === 'end' || key === 'range' || key === 'parent' || key === 'type') continue\n      const v = (node as Record<string, unknown>)[key]\n      if (Array.isArray(v)) {\n        for (const item of v) {\n          if (item && typeof item === 'object' && 'type' in item) {\n            walkNode(item as ASTNode, scope, depth + 1)\n          }\n        }\n      } else if (v && typeof v === 'object' && 'type' in v) {\n        walkNode(v as ASTNode, scope, depth + 1)\n      }\n    }\n  }\n}\n\n// ── 类型别名 ──\ntype ASTNode = any\n\n// ── 门禁断言 ──\n\n/**\n * 门禁断言：violations 非空则抛 ParseError（code='E_SECURITY'，ruleId 挂 ParseError.ruleId）。\n * 三处接入点（A1/A2/A3）统一用它。\n *\n * @param code - the .fai.js source text (raw, un-wrapped).\n * @param opts - scan options (policy is required).\n * @throws ParseError — when violations are non-empty (code='E_SECURITY').\n */\nexport function assertSecure(code: string, opts: SecurityScanOptions): void {\n  const result = scanSource(code, opts)\n  if (result.violations.length > 0) {\n    const v = result.violations[0]\n    throw new ParseError(\n      v.message,\n      v.lineNo,\n      'E_SECURITY',\n      undefined,\n      v.ruleId,\n    )\n  }\n}\n"]}
+{"version":3,"file":"security-scanner.js","sourceRoot":"","sources":["../../src/lang/security-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,KAAK,IAAI,UAAU,EAAE,MAAM,OAAO,CAAA;AAE3C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AA+D1C,4BAA4B;AAE5B;;;GAGG;AACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAS;IAChC,SAAS;IACT,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,mBAAmB,EAAE,wBAAwB;IAClF,OAAO;IACP,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ;IACzD,UAAU;IACV,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY;IACpE,KAAK;IACL,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY;IAChF,YAAY;IACZ,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ;IACzF,OAAO;IACP,eAAe,EAAE,QAAQ,EAAE,cAAc,EAAE,aAAa;IACxD,6BAA6B;IAC7B,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,uBAAuB;IACtF,uBAAuB;IACvB,SAAS,EAAE,OAAO,EAAE,QAAQ;CAC7B,CAAC,CAAA;AAEF,+BAA+B;AAC/B,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS;IACrC,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,uBAAuB;IACtF,SAAS,EAAE,OAAO,EAAE,QAAQ;CAC7B,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,SAAS,GAA4B;IACzC,gBAAgB,EAAE,KAAK,EAAQ,kCAAkC;IACjE,aAAa,EAAE,KAAK,EAAW,2BAA2B;IAC1D,iBAAiB,EAAE,KAAK,EAAO,+BAA+B;IAC9D,wBAAwB,EAAE,IAAI,EAAE,kBAAkB;IAClD,YAAY,EAAE,KAAK,EAAa,+CAA+C;CAChF,CAAA;AAED;;GAEG;AACH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS;IACjC,OAAO;IACP,WAAW,EAAE,aAAa,EAAE,WAAW;IACvC,mBAAmB;IACnB,kBAAkB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,kBAAkB;IAC9E,QAAQ;IACR,gBAAgB,EAAE,gBAAgB,EAAE,cAAc,EAAE,cAAc;IAClE,gBAAgB;IAChB,MAAM;CACP,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,GAAG,CAAS;IAC7C,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM;IACxE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO;IACpD,UAAU,EAAE,KAAK,EAAE,WAAW;IAC9B,UAAU,EAAE,YAAY,EAAE,OAAO,EAAE,UAAU;IAC7C,SAAS;IACT,iFAAiF;IACjF,oFAAoF;IACpF,gFAAgF;IAChF,gFAAgF;IAChF,6EAA6E;IAC7E,oEAAoE;IACpE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IACrD,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ;CACjD,CAAC,CAAA;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAS;IACjD,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IACrD,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ;CACjD,CAAC,CAAA;AAEF,UAAU;AACV,MAAM,iBAAiB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA,CAAE,QAAQ;AACnD,MAAM,qBAAqB,GAAG,IAAI,CAAA;AAClC,MAAM,YAAY,GAAG,OAAO,CAAA;AAC5B,MAAM,YAAY,GAAG,GAAG,CAAA;AAExB,aAAa;AAEb,4CAA4C;AAC5C,MAAM,CAAC,MAAM,YAAY,GAAG,EAAE,CAAA;AAC9B,4CAA4C;AAC5C,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAA;AAWhC,SAAS,WAAW,CAAC,MAAoB;IACvC,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAU,EAAE,MAAM,EAAE,CAAA;AAC7C,CAAC;AAED,SAAS,QAAQ,CAAC,KAAmB,EAAE,IAAY;IACjD,IAAI,CAAC,GAAiB,KAAK,CAAA;IAC3B,OAAO,CAAC,EAAE,CAAC;QACT,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QAClC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;IACd,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,sBAAsB;AAEtB,oDAAoD;AACpD,SAAS,qBAAqB,CAAC,GAAY;IACzC,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,MAAM,IAAI,GAAI,GAAsC,CAAC,IAAI,CAAA;IACzD,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,IAAiD,CAAA;QAC3D,IAAI,CAAC,CAAC,IAAI,KAAK,mBAAmB;YAAE,SAAQ;QAC5C,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;YACtC,MAAM,CAAC,GAAG,IAAqC,CAAA;YAC/C,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC3C,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,aAAa;AAEb;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,IAAyB;IAChE,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IACnD,CAAC;IAED,2CAA2C;IAC3C,IAAI,IAAI,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;QACpC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,UAAU,EAAE,CAAC;oBACX,MAAM,EAAE,WAAW;oBACnB,MAAM,EAAE,CAAC;oBACT,OAAO,EAAE,oBAAoB,IAAI,CAAC,MAAM,MAAM,iBAAiB,SAAS;iBACzE,CAAC;YACF,QAAQ,EAAE,EAAE;SACb,CAAA;IACH,CAAC;IAED,IAAI,GAAY,CAAA;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE;YACrB,WAAW,EAAE,QAAQ;YACrB,UAAU,EAAE,QAAQ;YACpB,SAAS,EAAE,IAAI;SAChB,CAAuB,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,yDAAyD;QACzD,yCAAyC;QACzC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IACnD,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,OAAO,CAAC,GAAY,EAAE,IAAyB;IAC7D,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IACnD,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;IAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAA;IACzC,MAAM,UAAU,GAAwB,EAAE,CAAA;IAC1C,MAAM,QAAQ,GAAwB,EAAE,CAAA;IAExC,8BAA8B;IAC9B,MAAM,WAAW,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAA;IAC9C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,CAAC,SAAS,EAAE,GAAG,WAAW,CAAC,CAAC,CAAA;IAC/D,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,IAAI,EAAE;QAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IAExD,uDAAuD;IACvD,8CAA8C;IAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAA;IAEjE,oBAAoB;IACpB,MAAM,IAAI,GAAI,GAAsC,CAAC,IAAI,CAAA;IACzD,IAAI,IAAI,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;QACxC,UAAU,CAAC,IAAI,CAAC;YACd,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,kCAAkC,IAAI,CAAC,MAAM,MAAM,qBAAqB,GAAG;SACrF,CAAC,CAAA;IACJ,CAAC;IAED,oBAAoB;IACpB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAA;IAClC,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;QAC3B,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,MAAM,KAAK,QAAQ;YAAE,SAAQ;QAC3D,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAClB,CAAC;IAED,MAAM,QAAQ,GAA4B,EAAE,CAAA;IAC5C,KAAK,MAAM,CAAC,CAAC,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACxD,IAAI,UAAU,IAAI,MAAM,KAAK,QAAQ;YAAE,SAAQ;QAC/C,QAAQ,CAAC,CAAC,CAAC,GAAG,UAAU,CAAA;IAC1B,CAAC;IAED,IAAI,SAAS,GAAG,CAAC,CAAA;IAEjB,iDAAiD;IACjD,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;IACrC,KAAK,MAAM,CAAC,IAAI,WAAW;QAAE,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IAErD,SAAS;IACT,QAAQ,CAAC,GAAyB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAE5C,IAAI,SAAS,GAAG,YAAY,EAAE,CAAC;QAC7B,UAAU,CAAC,IAAI,CAAC;YACd,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,uBAAuB,SAAS,MAAM,YAAY,GAAG;SAC/D,CAAC,CAAA;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,UAAU,CAAC,MAAM,KAAK,CAAC;QAC3B,UAAU;QACV,QAAQ;KACT,CAAA;IAED,kBAAkB;IAElB,SAAS,MAAM,CAAC,IAAa;QAC3B,OAAO,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,CAAA;IACpC,CAAC;IAED,SAAS,YAAY,CAAC,MAAsB,EAAE,MAAc,EAAE,IAAY,EAAE,OAAe;QACzF,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;IACpD,CAAC;IAED;;OAEG;IACH,SAAS,iBAAiB,CAAC,MAAiB,EAAE,KAAY;QACxD,KAAK,MAAM,CAAC,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC;YAC7B,mBAAmB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC/B,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,SAAS,mBAAmB,CAAC,OAAgB,EAAE,KAAY;QACzD,IAAI,CAAC,OAAO;YAAE,OAAM;QACpB,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,YAAY;gBACf,iEAAiE;gBACjE,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1C,YAAY,CAAC,qBAAqB,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,IAAI,EAC/D,uCAAuC,MAAM,CAAC,OAAO,CAAC,wCAAwC,OAAO,CAAC,IAAI,GAAG,CAAC,CAAA;gBAClH,CAAC;gBACD,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;gBAC7B,OAAM;YACR,KAAK,eAAe;gBAClB,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;oBAC5C,IAAI,IAAI,EAAE,IAAI,KAAK,UAAU;wBAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;yBAChE,IAAI,IAAI,EAAE,IAAI,KAAK,aAAa;wBAAE,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;gBAClF,CAAC;gBACD,OAAM;YACR,KAAK,cAAc;gBACjB,KAAK,MAAM,EAAE,IAAI,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;oBACxC,IAAI,EAAE;wBAAE,mBAAmB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;gBACxC,CAAC;gBACD,OAAM;YACR,KAAK,mBAAmB;gBACtB,mBAAmB,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;gBACxC,OAAM;YACR,KAAK,aAAa;gBAChB,mBAAmB,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;gBAC5C,OAAM;YACR;gBACE,OAAM;QACV,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,SAAS,mBAAmB,CAAC,IAAe,EAAE,KAAY;QACxD,KAAK,MAAM,IAAI,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI;gBAAE,SAAQ;YACnB,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;gBAClB,KAAK,qBAAqB;oBACxB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;wBAC3C,mBAAmB,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,CAAA;oBACtC,CAAC;oBACD,MAAK;gBACP,KAAK,qBAAqB,CAAC;gBAC3B,KAAK,kBAAkB;oBACrB,IAAI,IAAI,CAAC,EAAE,EAAE,IAAI,KAAK,YAAY,EAAE,CAAC;wBACnC,6EAA6E;wBAC7E,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;4BAC1C,YAAY,CAAC,qBAAqB,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,EAC5D,uCAAuC,MAAM,CAAC,IAAI,CAAC,wCAAwC,IAAI,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,CAAA;wBAC/G,CAAC;wBACD,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAA;oBAC/B,CAAC;oBACD,MAAK;gBACP;oBACE,MAAK;YACT,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS,QAAQ,CAAC,IAAa,EAAE,KAAmB,EAAE,KAAa;QACjE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAM;QAE7C,SAAS,EAAE,CAAA;QACX,IAAI,KAAK,GAAG,YAAY,EAAE,CAAC;YACzB,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,SAAS,EAAE,6BAA6B,YAAY,EAAE,CAAC,CAAA;YAC5G,OAAM;QACR,CAAC;QAED,kBAAkB;QAClB,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACtC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,gCAAgC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;YAChG,0BAA0B;QAC5B,CAAC;QAED,UAAU;QACV,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,gBAAgB;YAChB,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,MAAM,WAAW,GAAG,IAAI,CAAC,IAAiB,CAAA;gBAC1C,mBAAmB,CAAC,WAAW,EAAE,KAAK,IAAI,WAAW,CAAC,CAAA;gBACtD,KAAK,MAAM,KAAK,IAAI,WAAW;oBAAE,QAAQ,CAAC,KAAK,EAAE,KAAK,IAAI,WAAW,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACjF,OAAM;YACR,CAAC;YAED,+BAA+B;YAC/B,KAAK,mBAAmB;gBACtB,OAAM;YAER,kBAAkB;YAClB,KAAK,0BAA0B;gBAC7B,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC5C,OAAM;YACR,KAAK,wBAAwB;gBAC3B,IAAI,IAAI,CAAC,WAAW;oBAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAClE,OAAM;YAER,aAAa;YACb,KAAK,qBAAqB,CAAC;YAC3B,KAAK,oBAAoB,CAAC;YAC1B,KAAK,yBAAyB,CAAC,CAAC,CAAC;gBAC/B,sCAAsC;gBACtC,IAAI,IAAI,CAAC,IAAI,KAAK,qBAAqB,IAAI,IAAI,CAAC,EAAE,EAAE,IAAI,IAAI,KAAK,EAAE,CAAC;oBAClE,uEAAuE;oBACvE,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC1C,YAAY,CAAC,qBAAqB,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,EAC5D,uCAAuC,MAAM,CAAC,IAAI,CAAC,wCAAwC,IAAI,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,CAAA;oBAC/G,CAAC;oBACD,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAA;gBAC/B,CAAC;gBACD,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;gBAClC,iBAAiB,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,OAAO,CAAC,CAAA;gBAC7C,kBAAkB;gBAClB,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,gBAAgB,EAAE,CAAC;oBACzC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,OAAO,CAAC,CAAA;gBACpD,CAAC;gBACD,aAAa;gBACb,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE;oBAAE,QAAQ,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAClE,QAAQ;gBACR,IAAI,IAAI,CAAC,IAAI;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACtD,OAAM;YACR,CAAC;YAED,aAAa;YACb,KAAK,qBAAqB,CAAC,CAAC,CAAC;gBAC3B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;oBAC3C,+BAA+B;oBAC/B,IAAI,KAAK;wBAAE,mBAAmB,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,CAAA;oBAC/C,WAAW;oBACX,IAAI,IAAI,EAAE,IAAI;wBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;oBACrD,wBAAwB;oBACxB,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACzC,CAAC;gBACD,OAAM;YACR,CAAC;YAED,YAAY;YACZ,KAAK,gBAAgB,CAAC,CAAC,CAAC;gBACtB,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;gBACrC,mBAAmB,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,UAAU,CAAC,CAAA;gBAChD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE;oBAAE,QAAQ,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC3E,OAAM;YACR,CAAC;YAED,YAAY;YACZ,KAAK,aAAa;gBAChB,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACrC,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC3C,IAAI,IAAI,CAAC,SAAS;oBAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC9D,OAAM;YAER,KAAK,cAAc,CAAC,CAAC,CAAC;gBACpB,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;gBACnC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;oBACd,gCAAgC;oBAChC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;wBAC7C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;4BAChD,mBAAmB,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAA;4BACvC,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;wBACrC,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;oBAC1C,CAAC;gBACH,CAAC;gBACD,IAAI,IAAI,CAAC,IAAI;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACvD,IAAI,IAAI,CAAC,MAAM;oBAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC3D,aAAa;gBACb,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;oBAClD,QAAQ,CAAC,IAAI,CAAC;wBACZ,MAAM,EAAE,WAAW;wBACnB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC;wBACpB,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,mDAAmD;qBAC7D,CAAC,CAAA;gBACJ,CAAC;gBACD,IAAI,IAAI,CAAC,IAAI;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACvD,OAAM;YACR,CAAC;YAED,KAAK,gBAAgB,CAAC;YACtB,KAAK,gBAAgB,CAAC,CAAC,CAAC;gBACtB,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;gBACnC,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,qBAAqB,EAAE,CAAC;oBAC9C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;wBAChD,mBAAmB,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAA;wBACvC,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;oBACrC,CAAC;gBACH,CAAC;qBAAM,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,YAAY,EAAE,CAAC;oBAC5C,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBACpC,CAAC;gBACD,IAAI,IAAI,CAAC,KAAK;oBAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACzD,IAAI,IAAI,CAAC,IAAI;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACvD,OAAM;YACR,CAAC;YAED,KAAK,gBAAgB;gBACnB,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACrC,qBAAqB;gBACrB,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;oBAC9D,QAAQ,CAAC,IAAI,CAAC;wBACZ,MAAM,EAAE,WAAW;wBACnB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC;wBACpB,IAAI,EAAE,aAAa;wBACnB,OAAO,EAAE,uCAAuC;qBACjD,CAAC,CAAA;gBACJ,CAAC;gBACD,IAAI,IAAI,CAAC,IAAI;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACpD,OAAM;YAER,KAAK,kBAAkB;gBACrB,IAAI,IAAI,CAAC,IAAI;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACpD,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACrC,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;oBAC9D,QAAQ,CAAC,IAAI,CAAC;wBACZ,MAAM,EAAE,WAAW;wBACnB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC;wBACpB,IAAI,EAAE,kBAAkB;wBACxB,OAAO,EAAE,4CAA4C;qBACtD,CAAC,CAAA;gBACJ,CAAC;gBACD,OAAM;YAER,KAAK,iBAAiB,CAAC,CAAC,CAAC;gBACvB,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;gBAClC,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC7C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;oBACjC,IAAI,CAAC,CAAC,IAAI;wBAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;oBAChD,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,UAAU,IAAI,EAAE;wBAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC3E,CAAC;gBACD,OAAM;YACR,CAAC;YAED,KAAK,cAAc,CAAC,CAAC,CAAC;gBACpB,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACtC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;oBACjB,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;oBACvC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK;wBAAE,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,CAAA;oBAC7E,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK;wBAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;oBAC7E,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACtD,CAAC;gBACD,IAAI,IAAI,CAAC,SAAS;oBAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC9D,OAAM;YACR,CAAC;YAED,KAAK,aAAa,CAAC,CAAC,CAAC;gBACnB,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;gBACrC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;oBACf,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;oBAC3C,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC7C,CAAC;gBACD,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,UAAU,CAAC,CAAA;gBACtD,IAAI,IAAI,CAAC,IAAI;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACzD,OAAM;YACR,CAAC;YAED,yBAAyB;YACzB,KAAK,kBAAkB;gBACrB,IAAI,IAAI,CAAC,IAAI;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACpD,OAAM;YAER,uBAAuB;YACvB,KAAK,iBAAiB,CAAC;YACvB,KAAK,gBAAgB;gBACnB,IAAI,IAAI,CAAC,QAAQ;oBAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC5D,OAAM;YAER,4BAA4B;YAC5B,KAAK,qBAAqB;gBACxB,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC3C,OAAM;YAER,YAAY;YACZ,KAAK,YAAY,CAAC,CAAC,CAAC;gBAClB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;gBACtB,cAAc;gBACd,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACvB,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,6BAA6B,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,kBAAkB,CAAC,CAAA;oBACpH,OAAM;gBACR,CAAC;gBACD,gBAAgB;gBAChB,IAAI,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC/E,OAAM;gBACR,CAAC;gBACD,YAAY;gBACZ,YAAY,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kCAAkC,MAAM,CAAC,IAAI,CAAC,yBAAyB,IAAI,yCAAyC,CAAC,CAAA;gBACxK,OAAM;YACR,CAAC;YAED,KAAK,kBAAkB,CAAC,CAAC,CAAC;gBACxB,+CAA+C;gBAC/C,6DAA6D;gBAC7D,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACvC,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;oBACvD,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC3C,CAAC;gBACD,qCAAqC;gBACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI;oBACxE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;wBACjE,CAAC,CAAC,IAAI,CAAA;gBACR,IAAI,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACzC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,8BAA8B,MAAM,CAAC,IAAI,CAAC,uBAAuB,QAAQ,GAAG,CAAC,CAAA;gBAClI,CAAC;gBACD,OAAM;YACR,CAAC;YAED,KAAK,gBAAgB;gBACnB,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACvC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,IAAI,EAAE;oBAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACvE,OAAM;YAER,KAAK,eAAe;gBAClB,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACvC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,IAAI,EAAE;oBAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACvE,OAAM;YAER,KAAK,sBAAsB,CAAC,CAAC,CAAC;gBAC5B,gCAAgC;gBAChC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAA;gBACxB,IAAI,MAAM,EAAE,IAAI,KAAK,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9D,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,EAAE,iCAAiC,MAAM,CAAC,IAAI,CAAC,iCAAiC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAA;gBACxJ,CAAC;gBACD,0EAA0E;gBAC1E,IAAI,MAAM,EAAE,IAAI,KAAK,YAAY,IAAI,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1E,YAAY,CAAC,qBAAqB,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,EAAE,uCAAuC,MAAM,CAAC,IAAI,CAAC,0CAA0C,MAAM,CAAC,IAAI,GAAG,CAAC,CAAA;gBAC7K,CAAC;gBACD,oCAAoC;gBACpC,IAAI,MAAM,EAAE,IAAI,KAAK,kBAAkB,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,KAAK,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnH,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,iCAAiC,MAAM,CAAC,IAAI,CAAC,2CAA2C,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAA;gBAChL,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACrC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACtC,OAAM;YACR,CAAC;YAED,KAAK,kBAAkB,CAAC;YACxB,KAAK,mBAAmB;gBACtB,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACrC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACtC,OAAM;YAER,KAAK,iBAAiB,CAAC;YACvB,KAAK,kBAAkB;gBACrB,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACzC,OAAM;YAER,KAAK,uBAAuB;gBAC1B,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACrC,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC3C,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC1C,OAAM;YAER,KAAK,iBAAiB;gBACpB,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;oBACrC,IAAI,EAAE;wBAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACxC,CAAC;gBACD,OAAM;YAER,KAAK,kBAAkB;gBACrB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;oBACzC,IAAI,IAAI,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;wBAC9B,iDAAiD;wBACjD,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG;4BAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;wBACnE,IAAI,IAAI,CAAC,KAAK;4BAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;oBACxD,CAAC;yBAAM,CAAC;wBACN,kBAAkB;wBAClB,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;oBAClC,CAAC;gBACH,CAAC;gBACD,OAAM;YAER,KAAK,iBAAiB;gBACpB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,WAAW,IAAI,EAAE;oBAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC3E,OAAM;YAER,KAAK,0BAA0B;gBAC7B,4BAA4B;gBAC5B,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACpC,IAAI,IAAI,CAAC,KAAK;oBAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACtD,OAAM;YAER,KAAK,iBAAiB;gBACpB,IAAI,IAAI,CAAC,QAAQ;oBAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC5D,OAAM;YAER,KAAK,iBAAiB;gBACpB,IAAI,IAAI,CAAC,QAAQ;oBAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC5D,OAAM;YAER,KAAK,eAAe;gBAClB,IAAI,IAAI,CAAC,QAAQ;oBAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC5D,OAAM;YAER,KAAK,oBAAoB;gBACvB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,WAAW,IAAI,EAAE;oBAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC3E,OAAM;YAER,KAAK,yBAAyB;gBAC5B,IAAI,IAAI,CAAC,UAAU;oBAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAChE,OAAM;YAER,KAAK,iBAAiB;gBACpB,IAAI,IAAI,CAAC,UAAU;oBAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAChE,OAAM;YAER,KAAK,cAAc;gBACjB,sCAAsC;gBACtC,OAAM;YAER,KAAK,kBAAkB;gBACrB,yBAAyB;gBACzB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,IAAI,EAAE;oBAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACvE,OAAM;YAER,KAAK,kBAAkB,CAAC;YACxB,KAAK,iBAAiB,CAAC,CAAC,CAAC;gBACvB,IAAI,IAAI,CAAC,EAAE,EAAE,IAAI,IAAI,KAAK;oBAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAA;gBACzD,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;gBACnC,IAAI,IAAI,CAAC,UAAU;oBAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACnE,IAAI,IAAI,CAAC,IAAI;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACvD,OAAM;YACR,CAAC;YAED,KAAK,WAAW;gBACd,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;oBACrC,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACpC,CAAC;gBACD,OAAM;YAER,KAAK,kBAAkB,CAAC;YACxB,KAAK,oBAAoB;gBACvB,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,QAAQ;oBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACnE,IAAI,IAAI,CAAC,KAAK;oBAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACtD,OAAM;YAER,KAAK,eAAe;gBAClB,SAAS;gBACT,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACvC,IAAI,IAAI,CAAC,IAAI;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACpD,OAAM;YAER,KAAK,mBAAmB;gBACtB,SAAS;gBACT,OAAM;YAER,KAAK,mBAAmB,CAAC;YACzB,KAAK,gBAAgB;gBACnB,OAAM;YAER,KAAK,gBAAgB;gBACnB,OAAM;YAER,KAAK,SAAS;gBACZ,OAAM;YAER,KAAK,OAAO;gBACV,OAAM;YAER,KAAK,gBAAgB;gBACnB,OAAM;YAER,KAAK,iBAAiB,CAAC;YACvB,KAAK,wBAAwB,CAAC;YAC9B,KAAK,0BAA0B;gBAC7B,OAAM;YAER,KAAK,iBAAiB;gBACpB,OAAM;YAER;gBACE,gBAAgB;gBAChB,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;gBAChC,OAAM;QACV,CAAC;IACH,CAAC;IAED,SAAS,WAAW,CAAC,OAAgB,EAAE,KAAmB,EAAE,KAAa;QACvE,IAAI,CAAC,OAAO;YAAE,OAAM;QACpB,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,YAAY;gBACf,OAAM,CAAC,6BAA6B;YACtC,KAAK,eAAe;gBAClB,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;oBAC5C,IAAI,IAAI,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;wBAC9B,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG;4BAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;wBACnE,IAAI,IAAI,CAAC,KAAK;4BAAE,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;oBAC3D,CAAC;yBAAM,IAAI,IAAI,EAAE,IAAI,KAAK,aAAa,EAAE,CAAC;wBACxC,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;oBAC9C,CAAC;gBACH,CAAC;gBACD,OAAM;YACR,KAAK,cAAc;gBACjB,KAAK,MAAM,EAAE,IAAI,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;oBACxC,IAAI,EAAE;wBAAE,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC3C,CAAC;gBACD,OAAM;YACR,KAAK,mBAAmB;gBACtB,IAAI,OAAO,CAAC,KAAK;oBAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC5D,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC3C,OAAM;YACR,KAAK,aAAa;gBAChB,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBAC/C,OAAM;YACR;gBACE,OAAM;QACV,CAAC;IACH,CAAC;IAED,SAAS,YAAY,CAAC,IAAa,EAAE,KAAmB,EAAE,KAAa;QACrE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,MAAM;gBAAE,SAAQ;YACxH,MAAM,CAAC,GAAI,IAAgC,CAAC,GAAG,CAAC,CAAA;YAChD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrB,KAAK,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC;oBACrB,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;wBACvD,QAAQ,CAAC,IAAe,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;oBAC7C,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;gBACrD,QAAQ,CAAC,CAAY,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;YAC1C,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAKD,aAAa;AAEb;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,IAAyB;IAClE,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IACrC,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QAC9B,MAAM,IAAI,UAAU,CAClB,CAAC,CAAC,OAAO,EACT,CAAC,CAAC,MAAM,EACR,YAAY,EACZ,SAAS,EACT,CAAC,CAAC,MAAM,CACT,CAAA;IACH,CAAC;AACH,CAAC","sourcesContent":["/**\n * security-scanner — .fai.js 静态安全门禁（纵深防御第一层）\n *\n * 方案：docs/plans/2026-09-08-faijs-security-gate.md（§5）\n *\n * 定位：在 MetadataExtractor（UI 通道）与 DirectExecutor（执行通道）之前\n * 对源码做 **AST 全量递归遍历**，覆盖函数体、控制流块、嵌套函数——消除\n * 当前\"只扫顶层\"的盲区。规则表与功能代码解耦（R6）：新增 op / 新增语法\n * 形态不需要改扫描器，只有\"新增被禁能力\"才改规则表（数据）。\n *\n * 判定模型 = 能力黑名单（S1）+ 危险语法（S2）+ 危险成员名（S3）+\n * 自由标识符白名单（S4）+ 结构上限（S5）+ 命名空间保护（S7）。\n *\n * 诚实边界（D9）：静态门禁 ≠ 沙箱。无法拦截拼接属性名 `g['ev'+'al']`、\n * 字符串内代码、已获引用二次调用。本方案通过切断能力来源（S4）使残留\n * 失去立足点，但不宣称等价隔离。\n */\n\nimport { parse as acornParse } from 'acorn'\nimport type { Program } from 'acorn'\nimport { ParseError } from './parse-error'\n\n// ── 类型 ──\n\n/** 安全策略档位。strict = 默认（全规则）；balanced = 本机 CLI；off = 受控调试。 */\nexport type SecurityPolicy = 'strict' | 'balanced' | 'off'\n\n/** SecurityScanner 规则 ID（封闭集合，禁止自造；测试按此断言）。 */\nexport type SecurityRuleId =\n  | 'SEC_IDENT'\n  | 'SEC_SYNTAX'\n  | 'SEC_MEMBER'\n  | 'SEC_FREE_IDENT'\n  | 'SEC_LIMIT'\n  | 'SEC_NS_ASSIGN'\n  | 'SEC_RESERVED_ASSIGN'\n\n/** 违规条目。 */\nexport interface SecurityViolation {\n  /** 规则 ID（见 SecurityRuleId 枚举） */\n  ruleId: SecurityRuleId\n  /** 1-based 行号，相对传入的原始源码文本（Scanner 不做任何包裹/偏移） */\n  lineNo: number\n  /** 命中的标识符名 / 属性名 / 节点类型（无则省略） */\n  name?: string\n  /** 人类可读消息（AI 自纠用） */\n  message: string\n}\n\n/** 扫描选项。 */\nexport interface SecurityScanOptions {\n  /**\n   * 策略档位。**必填**——不允许缺省，调用方必须显式声明（防止无意间关闭门禁）。\n   */\n  policy: SecurityPolicy\n  /**\n   * 额外合法名字（S4 判定用：不在 knownNames 也不在 S4_SAFE_GLOBALS → SEC_FREE_IDENT）。\n   * 调用方可不传——Scanner 始终自动收集：\n   * ① 源码内全部 `ImportDeclaration` 的本地绑定名（named / namespace / default）；\n   * ② `opts.defaultNs ?? 'cad'`。\n   * 本字段只用于补充\"源码里看不到的名字\"。\n   */\n  knownNames?: string[]\n  /**\n   * 命名空间保护名（S7 判定用：对此列表中的名字做赋值 → SEC_NS_ASSIGN）。\n   * 缺省 = knownNames（即所有 knownNames 都受 S7 保护）。\n   * 调用方在 append 场景中可传一个更小的集合（仅命名空间名，不含 ctx 普通变量）。\n   */\n  nsNames?: string[]\n  /** 默认命名空间名，缺省 'cad'（自动进入 knownNames） */\n  defaultNs?: string\n}\n\n/** 扫描结果。 */\nexport interface SecurityScanResult {\n  /** true 当且仅当 violations 为空 */\n  ok: boolean\n  /** 命中即拒的条目；非空 → 调用方拒绝 */\n  violations: SecurityViolation[]\n  /** 只告警不拒（目前只有 S5 无界循环） */\n  warnings: SecurityViolation[]\n}\n\n// ── 规则表（数据驱动，新增规则不改遍历器） ──\n\n/**\n * S1 危险标识符黑名单（引用即拒，不区分读写、不区分声明位置）。\n * S1 优先于一切：即使用户用这些名字声明了自己的变量，也照样拒绝。\n */\nconst S1_IDENTS = new Set<string>([\n  // 执行任意代码\n  'eval', 'Function', 'AsyncFunction', 'GeneratorFunction', 'AsyncGeneratorFunction',\n  // 全局逃逸\n  'globalThis', 'window', 'self', 'top', 'parent', 'frames',\n  // Node 宿主\n  'process', 'require', 'module', 'exports', '__dirname', '__filename',\n  // 网络\n  'fetch', 'XMLHttpRequest', 'WebSocket', 'EventSource', 'navigator', 'sendBeacon',\n  // 浏览器存储/DOM\n  'localStorage', 'sessionStorage', 'indexedDB', 'caches', 'document', 'location', 'cookie',\n  // 动态装载\n  'importScripts', 'Worker', 'SharedWorker', 'WebAssembly',\n  // 定时器/微任务（混淆与延时外发）——仅 strict\n  'setTimeout', 'setInterval', 'setImmediate', 'queueMicrotask', 'requestAnimationFrame',\n  // 元编程（原型污染族）——仅 strict\n  'Reflect', 'Proxy', 'crypto',\n])\n\n/** S1 中仅在 strict 档生效的标识符集合。 */\nconst S1_STRICT_ONLY = new Set<string>([\n  'setTimeout', 'setInterval', 'setImmediate', 'queueMicrotask', 'requestAnimationFrame',\n  'Reflect', 'Proxy', 'crypto',\n])\n\n/**\n * S2 危险语法节点黑名单。\n * key = AST node type；value = true 表示仅 strict 档生效。\n */\nconst S2_SYNTAX: Record<string, boolean> = {\n  ImportExpression: false,       // 动态 import() — strict + balanced\n  WithStatement: false,          // with — strict + balanced\n  DebuggerStatement: false,      // debugger — strict + balanced\n  TaggedTemplateExpression: true, // 标签模板 — 仅 strict\n  MetaProperty: false,            // import.meta / new.target — strict + balanced\n}\n\n/**\n * S3 危险成员属性名黑名单（MemberExpression.property 的名字命中即拒）。\n */\nconst S3_MEMBERS = new Set<string>([\n  // 原型污染\n  '__proto__', 'constructor', 'prototype',\n  // getter/setter 注入\n  '__defineGetter__', '__defineSetter__', '__lookupGetter__', '__lookupSetter__',\n  // 对象元编程\n  'setPrototypeOf', 'defineProperty', 'defineGetter', 'defineSetter',\n  // 求值（x.eval 形式）\n  'eval',\n])\n\n/**\n * S4 安全全局白名单（固定清单，strict 与 balanced 相同）。\n * 不在此名单且不在已声明/knownNames 中的标识符 → SEC_FREE_IDENT 拒绝。\n * 导出供解释器后端（cad-runtime/interp/env.ts）做同序解析。\n */\nexport const S4_SAFE_GLOBALS = new Set<string>([\n  'Math', 'Number', 'String', 'Boolean', 'Array', 'Object', 'JSON', 'Date',\n  'Map', 'Set', 'Promise', 'Symbol', 'RegExp', 'Error',\n  'Infinity', 'NaN', 'undefined',\n  'parseInt', 'parseFloat', 'isNaN', 'isFinite',\n  'console',\n  // P6/D7: script-side unit constants (MM, INCH, DEGREE, …) are read-only globals.\n  // Values registered on globalThis by the runtime; SEC_RESERVED_ASSIGN (P6) prevents\n  // shadowing. The name set lives in units.ts (SCRIPT_UNIT_NAMES) but the literal\n  // list is duplicated here because lang/ must not create a runtime dependency on\n  // units.ts (type-only import is fine, but S4_SAFE_GLOBALS is a runtime Set).\n  // Names are UPPERCASE to avoid collisions with user variable names.\n  'MM', 'CM', 'METER', 'MICRON', 'INCH', 'FOOT', 'YARD',\n  'DEGREE', 'RADIAN', 'GRAM', 'KILOGRAM', 'SECOND',\n])\n\n/**\n * P6/D7: Reserved unit constant names — cannot be used as declaration names\n * (let/const/var/param/function) or assignment targets.\n * This is a subset of S4_SAFE_GLOBALS (the unit constants only, not Math/Number/etc).\n * SEC_RESERVED_ASSIGN prevents scripts from shadowing unit constants like\n * `INCH = 999` or `let MM = 3`, which would silently corrupt geometry.\n */\nexport const RESERVED_UNIT_NAMES = new Set<string>([\n  'MM', 'CM', 'METER', 'MICRON', 'INCH', 'FOOT', 'YARD',\n  'DEGREE', 'RADIAN', 'GRAM', 'KILOGRAM', 'SECOND',\n])\n\n// S5 结构上限\nconst S5_MAX_SOURCE_LEN = 1 * 1024 * 1024  // 1 MiB\nconst S5_MAX_TOP_STATEMENTS = 5000\nconst S5_MAX_NODES = 200_000\nconst S5_MAX_DEPTH = 100\n\n// S6 子模块装载上限\n\n/** S6 子模块装载深度上限（A3：ModuleRegistry 静态守卫）。 */\nexport const S6_MAX_DEPTH = 16\n/** S6 子模块装载总数上限（A3：ModuleRegistry 静态守卫）。 */\nexport const S6_MAX_MODULES = 64\n\n// ── 作用域管理 ──\n\ninterface Scope {\n  /** 本层已声明的名字（var/let/const、函数参数、函数名、解构名、catch 参数、循环绑定） */\n  names: Set<string>\n  /** 子作用域 */\n  parent: Scope | null\n}\n\nfunction createScope(parent: Scope | null): Scope {\n  return { names: new Set<string>(), parent }\n}\n\nfunction scopeHas(scope: Scope | null, name: string): boolean {\n  let s: Scope | null = scope\n  while (s) {\n    if (s.names.has(name)) return true\n    s = s.parent\n  }\n  return false\n}\n\n// ── 收集 import 绑定名 ──\n\n/** 从 Program.body 收集全部 ImportDeclaration 的本地绑定名。 */\nfunction collectImportBindings(ast: Program): string[] {\n  const out: string[] = []\n  const body = (ast as unknown as { body: unknown[] }).body\n  for (const node of body) {\n    const n = node as { type?: string; specifiers?: unknown[] }\n    if (n.type !== 'ImportDeclaration') continue\n    for (const spec of n.specifiers ?? []) {\n      const s = spec as { local?: { name?: string } }\n      if (s.local?.name) out.push(s.local.name)\n    }\n  }\n  return out\n}\n\n// ── 主扫描器 ──\n\n/**\n * 全量扫描源码文本（返回全部违规）。\n * policy==='off' 时直接返回 `{ ok:true, violations:[], warnings:[] }`。\n * 解析失败时（acorn SyntaxError）不包装不抛——交给调用方的主 acornParse 路径\n * 包装为 E_SYNTAX（Scanner 不重复定义语法错误）。\n *\n * @param code - the .fai.js source text (raw, un-wrapped).\n * @param opts - scan options (policy is required).\n * @returns the full scan result (violations + warnings).\n */\nexport function scanSource(code: string, opts: SecurityScanOptions): SecurityScanResult {\n  if (opts.policy === 'off') {\n    return { ok: true, violations: [], warnings: [] }\n  }\n\n  // S5: source length check (before parsing)\n  if (code.length > S5_MAX_SOURCE_LEN) {\n    return {\n      ok: false,\n      violations: [{\n        ruleId: 'SEC_LIMIT',\n        lineNo: 1,\n        message: `source too long (${code.length} > ${S5_MAX_SOURCE_LEN} bytes)`,\n      }],\n      warnings: [],\n    }\n  }\n\n  let ast: Program\n  try {\n    ast = acornParse(code, {\n      ecmaVersion: 'latest',\n      sourceType: 'module',\n      locations: true,\n    }) as unknown as Program\n  } catch {\n    // acorn SyntaxError → 交给调用方的主 acornParse 路径包装为 E_SYNTAX。\n    // Scanner 返回 ok=true（无安全违规），让语法错误路径正常处理。\n    return { ok: true, violations: [], warnings: [] }\n  }\n  return scanAst(ast, opts)\n}\n\n/**\n * 复用已解析的 AST 进行扫描（避免二次解析）。语义与 scanSource 完全一致。\n *\n * @param ast - the pre-parsed Program AST (with locations enabled).\n * @param opts - scan options (policy is required).\n * @returns the full scan result (violations + warnings).\n */\nexport function scanAst(ast: Program, opts: SecurityScanOptions): SecurityScanResult {\n  if (opts.policy === 'off') {\n    return { ok: true, violations: [], warnings: [] }\n  }\n\n  const policy = opts.policy\n  const defaultNs = opts.defaultNs ?? 'cad'\n  const violations: SecurityViolation[] = []\n  const warnings: SecurityViolation[] = []\n\n  // 自动收集 import 绑定名 + defaultNs\n  const importNames = collectImportBindings(ast)\n  const knownNames = new Set<string>([defaultNs, ...importNames])\n  for (const n of opts.knownNames ?? []) knownNames.add(n)\n\n  // S7 命名空间保护名：缺省 = knownNames（即所有 knownNames 都受 S7 保护）；\n  // 调用方可通过 nsNames 指定更小的集合（仅命名空间名，不含 ctx 普通变量）。\n  const s7Names = opts.nsNames ? new Set(opts.nsNames) : knownNames\n\n  // S5 结构上限 —— 判定在遍历前\n  const body = (ast as unknown as { body: unknown[] }).body\n  if (body.length > S5_MAX_TOP_STATEMENTS) {\n    violations.push({\n      ruleId: 'SEC_LIMIT',\n      lineNo: 1,\n      message: `too many top-level statements (${body.length} > ${S5_MAX_TOP_STATEMENTS})`,\n    })\n  }\n\n  // 准备 strict-only 集合\n  const s1Idents = new Set<string>()\n  for (const id of S1_IDENTS) {\n    if (S1_STRICT_ONLY.has(id) && policy !== 'strict') continue\n    s1Idents.add(id)\n  }\n\n  const s2Syntax: Record<string, boolean> = {}\n  for (const [k, strictOnly] of Object.entries(S2_SYNTAX)) {\n    if (strictOnly && policy !== 'strict') continue\n    s2Syntax[k] = strictOnly\n  }\n\n  let nodeCount = 0\n\n  // 顶层作用域：收集 import 绑定名（已在 knownNames），以及 body 级声明\n  const globalScope = createScope(null)\n  for (const n of importNames) globalScope.names.add(n)\n\n  // 遍历 AST\n  walkNode(ast as unknown as ASTNode, null, 0)\n\n  if (nodeCount > S5_MAX_NODES) {\n    violations.push({\n      ruleId: 'SEC_LIMIT',\n      lineNo: 1,\n      message: `too many AST nodes (${nodeCount} > ${S5_MAX_NODES})`,\n    })\n  }\n\n  return {\n    ok: violations.length === 0,\n    violations,\n    warnings,\n  }\n\n  // ── 递归 walker ──\n\n  function lineOf(node: ASTNode): number {\n    return node?.loc?.start?.line ?? 1\n  }\n\n  function addViolation(ruleId: SecurityRuleId, lineNo: number, name: string, message: string): void {\n    violations.push({ ruleId, lineNo, name, message })\n  }\n\n  /**\n   * 收集函数参数中的声明名（含默认参数、解构）。\n   */\n  function collectParamNames(params: ASTNode[], scope: Scope): void {\n    for (const p of params ?? []) {\n      collectPatternNames(p, scope)\n    }\n  }\n\n  /**\n   * 从解构/标识符模式收集名字（用于作用域登记）。\n   * P6: If a pattern name is a reserved unit constant, emits SEC_RESERVED_ASSIGN.\n   */\n  function collectPatternNames(pattern: ASTNode, scope: Scope): void {\n    if (!pattern) return\n    switch (pattern.type) {\n      case 'Identifier':\n        // P6/SEC_RESERVED_ASSIGN: reserved unit names cannot be declared\n        if (RESERVED_UNIT_NAMES.has(pattern.name)) {\n          addViolation('SEC_RESERVED_ASSIGN', lineOf(pattern), pattern.name,\n            `[security] SEC_RESERVED_ASSIGN line ${lineOf(pattern)}: cannot declare reserved unit name \"${pattern.name}\"`)\n        }\n        scope.names.add(pattern.name)\n        return\n      case 'ObjectPattern':\n        for (const prop of pattern.properties ?? []) {\n          if (prop?.type === 'Property') collectPatternNames(prop.value, scope)\n          else if (prop?.type === 'RestElement') collectPatternNames(prop.argument, scope)\n        }\n        return\n      case 'ArrayPattern':\n        for (const el of pattern.elements ?? []) {\n          if (el) collectPatternNames(el, scope)\n        }\n        return\n      case 'AssignmentPattern':\n        collectPatternNames(pattern.left, scope)\n        return\n      case 'RestElement':\n        collectPatternNames(pattern.argument, scope)\n        return\n      default:\n        return\n    }\n  }\n\n  /**\n   * 收集一个节点体内全部声明名（VariableDeclarator + FunctionDeclaration 等）。\n   * 用于函数体 / 块体遍历前先登记声明（提升语义）。\n   */\n  function collectDeclarations(body: ASTNode[], scope: Scope): void {\n    for (const node of body ?? []) {\n      if (!node) continue\n      switch (node.type) {\n        case 'VariableDeclaration':\n          for (const decl of node.declarations ?? []) {\n            collectPatternNames(decl?.id, scope)\n          }\n          break\n        case 'FunctionDeclaration':\n        case 'ClassDeclaration':\n          if (node.id?.type === 'Identifier') {\n            // P6/SEC_RESERVED_ASSIGN: reserved unit names cannot be function/class names\n            if (RESERVED_UNIT_NAMES.has(node.id.name)) {\n              addViolation('SEC_RESERVED_ASSIGN', lineOf(node), node.id.name,\n                `[security] SEC_RESERVED_ASSIGN line ${lineOf(node)}: cannot declare reserved unit name \"${node.id.name}\"`)\n            }\n            scope.names.add(node.id.name)\n          }\n          break\n        default:\n          break\n      }\n    }\n  }\n\n  function walkNode(node: ASTNode, scope: Scope | null, depth: number): void {\n    if (!node || typeof node !== 'object') return\n\n    nodeCount++\n    if (depth > S5_MAX_DEPTH) {\n      addViolation('SEC_LIMIT', lineOf(node), node.type ?? 'unknown', `AST nesting depth exceeds ${S5_MAX_DEPTH}`)\n      return\n    }\n\n    // ── S2 危险语法节点 ──\n    if (s2Syntax[node.type] !== undefined) {\n      addViolation('SEC_SYNTAX', lineOf(node), node.type, `[security] dangerous syntax: ${node.type}`)\n      // 继续遍历子节点（可能内部有更多违规），但不中断\n    }\n\n    // 按节点类型处理\n    switch (node.type) {\n      // ── Program ──\n      case 'Program': {\n        const programBody = node.body as ASTNode[]\n        collectDeclarations(programBody, scope ?? globalScope)\n        for (const child of programBody) walkNode(child, scope ?? globalScope, depth + 1)\n        return\n      }\n\n      // ── Import 声明：不遍历（绑定已自动收集） ──\n      case 'ImportDeclaration':\n        return\n\n      // ── Export 声明 ──\n      case 'ExportDefaultDeclaration':\n        walkNode(node.declaration, scope, depth + 1)\n        return\n      case 'ExportNamedDeclaration':\n        if (node.declaration) walkNode(node.declaration, scope, depth + 1)\n        return\n\n      // ── 函数声明 ──\n      case 'FunctionDeclaration':\n      case 'FunctionExpression':\n      case 'ArrowFunctionExpression': {\n        // 函数名在父作用域（FunctionDeclaration 提升到父层）\n        if (node.type === 'FunctionDeclaration' && node.id?.name && scope) {\n          // P6/SEC_RESERVED_ASSIGN: reserved unit names cannot be function names\n          if (RESERVED_UNIT_NAMES.has(node.id.name)) {\n            addViolation('SEC_RESERVED_ASSIGN', lineOf(node), node.id.name,\n              `[security] SEC_RESERVED_ASSIGN line ${lineOf(node)}: cannot declare reserved unit name \"${node.id.name}\"`)\n          }\n          scope.names.add(node.id.name)\n        }\n        const fnScope = createScope(scope)\n        collectParamNames(node.params ?? [], fnScope)\n        // 函数体提升：先收集体内全部声明\n        if (node.body?.type === 'BlockStatement') {\n          collectDeclarations(node.body.body ?? [], fnScope)\n        }\n        // 遍历参数（含默认值）\n        for (const p of node.params ?? []) walkNode(p, fnScope, depth + 1)\n        // 遍历函数体\n        if (node.body) walkNode(node.body, fnScope, depth + 1)\n        return\n      }\n\n      // ── 变量声明 ──\n      case 'VariableDeclaration': {\n        for (const decl of node.declarations ?? []) {\n          // 声明名登记（pattern 里的名字入当前 scope）\n          if (scope) collectPatternNames(decl?.id, scope)\n          // 遍历初始化表达式\n          if (decl?.init) walkNode(decl.init, scope, depth + 1)\n          // 遍历 pattern 本身（解构默认值等）\n          walkPattern(decl?.id, scope, depth + 1)\n        }\n        return\n      }\n\n      // ── 块语句 ──\n      case 'BlockStatement': {\n        const blockScope = createScope(scope)\n        collectDeclarations(node.body ?? [], blockScope)\n        for (const child of node.body ?? []) walkNode(child, blockScope, depth + 1)\n        return\n      }\n\n      // ── 控制流 ──\n      case 'IfStatement':\n        walkNode(node.test, scope, depth + 1)\n        walkNode(node.consequent, scope, depth + 1)\n        if (node.alternate) walkNode(node.alternate, scope, depth + 1)\n        return\n\n      case 'ForStatement': {\n        const forScope = createScope(scope)\n        if (node.init) {\n          // for(let i=...) 的 i 入 forScope\n          if (node.init.type === 'VariableDeclaration') {\n            for (const decl of node.init.declarations ?? []) {\n              collectPatternNames(decl?.id, forScope)\n              walkNode(decl, forScope, depth + 1)\n            }\n          } else {\n            walkNode(node.init, forScope, depth + 1)\n          }\n        }\n        if (node.test) walkNode(node.test, forScope, depth + 1)\n        if (node.update) walkNode(node.update, forScope, depth + 1)\n        // S5: 无界循环告警\n        if (node.test === null || node.test === undefined) {\n          warnings.push({\n            ruleId: 'SEC_LIMIT',\n            lineNo: lineOf(node),\n            name: 'for(;;)',\n            message: 'unbounded for loop (no test condition) — may hang',\n          })\n        }\n        if (node.body) walkNode(node.body, forScope, depth + 1)\n        return\n      }\n\n      case 'ForInStatement':\n      case 'ForOfStatement': {\n        const forScope = createScope(scope)\n        if (node.left?.type === 'VariableDeclaration') {\n          for (const decl of node.left.declarations ?? []) {\n            collectPatternNames(decl?.id, forScope)\n            walkNode(decl, forScope, depth + 1)\n          }\n        } else if (node.left?.type === 'Identifier') {\n          forScope.names.add(node.left.name)\n        }\n        if (node.right) walkNode(node.right, forScope, depth + 1)\n        if (node.body) walkNode(node.body, forScope, depth + 1)\n        return\n      }\n\n      case 'WhileStatement':\n        walkNode(node.test, scope, depth + 1)\n        // S5: while(true) 告警\n        if (node.test?.type === 'Literal' && node.test.value === true) {\n          warnings.push({\n            ruleId: 'SEC_LIMIT',\n            lineNo: lineOf(node),\n            name: 'while(true)',\n            message: 'unbounded while(true) loop — may hang',\n          })\n        }\n        if (node.body) walkNode(node.body, scope, depth + 1)\n        return\n\n      case 'DoWhileStatement':\n        if (node.body) walkNode(node.body, scope, depth + 1)\n        walkNode(node.test, scope, depth + 1)\n        if (node.test?.type === 'Literal' && node.test.value === true) {\n          warnings.push({\n            ruleId: 'SEC_LIMIT',\n            lineNo: lineOf(node),\n            name: 'do...while(true)',\n            message: 'unbounded do...while(true) loop — may hang',\n          })\n        }\n        return\n\n      case 'SwitchStatement': {\n        const swScope = createScope(scope)\n        walkNode(node.discriminant, scope, depth + 1)\n        for (const c of node.cases ?? []) {\n          if (c.test) walkNode(c.test, swScope, depth + 1)\n          for (const stmt of c.consequent ?? []) walkNode(stmt, swScope, depth + 1)\n        }\n        return\n      }\n\n      case 'TryStatement': {\n        walkNode(node.block, scope, depth + 1)\n        if (node.handler) {\n          const handlerScope = createScope(scope)\n          if (node.handler.param) collectPatternNames(node.handler.param, handlerScope)\n          if (node.handler.param) walkNode(node.handler.param, handlerScope, depth + 1)\n          walkNode(node.handler.body, handlerScope, depth + 1)\n        }\n        if (node.finalizer) walkNode(node.finalizer, scope, depth + 1)\n        return\n      }\n\n      case 'CatchClause': {\n        const catchScope = createScope(scope)\n        if (node.param) {\n          collectPatternNames(node.param, catchScope)\n          walkNode(node.param, catchScope, depth + 1)\n        }\n        collectDeclarations(node.body?.body ?? [], catchScope)\n        if (node.body) walkNode(node.body, catchScope, depth + 1)\n        return\n      }\n\n      // ── LabeledStatement ──\n      case 'LabeledStatement':\n        if (node.body) walkNode(node.body, scope, depth + 1)\n        return\n\n      // ── Return / Throw ──\n      case 'ReturnStatement':\n      case 'ThrowStatement':\n        if (node.argument) walkNode(node.argument, scope, depth + 1)\n        return\n\n      // ── ExpressionStatement ──\n      case 'ExpressionStatement':\n        walkNode(node.expression, scope, depth + 1)\n        return\n\n      // ── 表达式 ──\n      case 'Identifier': {\n        const name = node.name\n        // S1 危险标识符黑名单\n        if (s1Idents.has(name)) {\n          addViolation('SEC_IDENT', lineOf(node), name, `[security] SEC_IDENT line ${lineOf(node)}: \"${name}\" is not allowed`)\n          return\n        }\n        // S4 自由标识符白名单判定\n        if (scopeHas(scope, name) || knownNames.has(name) || S4_SAFE_GLOBALS.has(name)) {\n          return\n        }\n        // 未声明的自由标识符\n        addViolation('SEC_FREE_IDENT', lineOf(node), name, `[security] SEC_FREE_IDENT line ${lineOf(node)}: unknown identifier \"${name}\" (not declared, not a known namespace)`)\n        return\n      }\n\n      case 'MemberExpression': {\n        // S1 优先于一切：先遍历 object（让 Identifier 先命中 S1/S4），\n        // 再检查 S3 危险成员名。这样 globalThis.eval 先命中 SEC_IDENT(globalThis)。\n        walkNode(node.object, scope, depth + 1)\n        if (node.computed && node.property?.type !== 'Literal') {\n          walkNode(node.property, scope, depth + 1)\n        }\n        // S3 危险成员名（在 object 遍历后检查，确保 S1 优先级）\n        const propName = node.property?.type === 'Identifier' ? node.property.name\n          : node.property?.type === 'Literal' ? String(node.property.value)\n          : null\n        if (propName && S3_MEMBERS.has(propName)) {\n          addViolation('SEC_MEMBER', lineOf(node), propName, `[security] SEC_MEMBER line ${lineOf(node)}: dangerous member \"${propName}\"`)\n        }\n        return\n      }\n\n      case 'CallExpression':\n        walkNode(node.callee, scope, depth + 1)\n        for (const arg of node.arguments ?? []) walkNode(arg, scope, depth + 1)\n        return\n\n      case 'NewExpression':\n        walkNode(node.callee, scope, depth + 1)\n        for (const arg of node.arguments ?? []) walkNode(arg, scope, depth + 1)\n        return\n\n      case 'AssignmentExpression': {\n        // S7 命名空间保护：禁止对 s7Names 中的名字做赋值\n        const target = node.left\n        if (target?.type === 'Identifier' && s7Names.has(target.name)) {\n          addViolation('SEC_NS_ASSIGN', lineOf(node), target.name, `[security] SEC_NS_ASSIGN line ${lineOf(node)}: cannot assign to namespace \"${target.name}\"`)\n        }\n        // P6: SEC_RESERVED_ASSIGN — cannot assign to reserved unit constant names\n        if (target?.type === 'Identifier' && RESERVED_UNIT_NAMES.has(target.name)) {\n          addViolation('SEC_RESERVED_ASSIGN', lineOf(node), target.name, `[security] SEC_RESERVED_ASSIGN line ${lineOf(node)}: cannot assign to reserved unit name \"${target.name}\"`)\n        }\n        // MemberExpression 赋值：cad.box = ...\n        if (target?.type === 'MemberExpression' && target.object?.type === 'Identifier' && s7Names.has(target.object.name)) {\n          addViolation('SEC_NS_ASSIGN', lineOf(node), target.object.name, `[security] SEC_NS_ASSIGN line ${lineOf(node)}: cannot assign to member of namespace \"${target.object.name}\"`)\n        }\n        walkNode(node.left, scope, depth + 1)\n        walkNode(node.right, scope, depth + 1)\n        return\n      }\n\n      case 'BinaryExpression':\n      case 'LogicalExpression':\n        walkNode(node.left, scope, depth + 1)\n        walkNode(node.right, scope, depth + 1)\n        return\n\n      case 'UnaryExpression':\n      case 'UpdateExpression':\n        walkNode(node.argument, scope, depth + 1)\n        return\n\n      case 'ConditionalExpression':\n        walkNode(node.test, scope, depth + 1)\n        walkNode(node.consequent, scope, depth + 1)\n        walkNode(node.alternate, scope, depth + 1)\n        return\n\n      case 'ArrayExpression':\n        for (const el of node.elements ?? []) {\n          if (el) walkNode(el, scope, depth + 1)\n        }\n        return\n\n      case 'ObjectExpression':\n        for (const prop of node.properties ?? []) {\n          if (prop?.type === 'Property') {\n            // key 是标识符且非 computed → 不需要检查（对象字面量 key 不是标识符引用）\n            if (prop.computed && prop.key) walkNode(prop.key, scope, depth + 1)\n            if (prop.value) walkNode(prop.value, scope, depth + 1)\n          } else {\n            // SpreadElement 等\n            walkNode(prop, scope, depth + 1)\n          }\n        }\n        return\n\n      case 'TemplateLiteral':\n        for (const expr of node.expressions ?? []) walkNode(expr, scope, depth + 1)\n        return\n\n      case 'TaggedTemplateExpression':\n        // S2 已在上方判定；仍遍历 tag 与 quasi\n        walkNode(node.tag, scope, depth + 1)\n        if (node.quasi) walkNode(node.quasi, scope, depth + 1)\n        return\n\n      case 'AwaitExpression':\n        if (node.argument) walkNode(node.argument, scope, depth + 1)\n        return\n\n      case 'YieldExpression':\n        if (node.argument) walkNode(node.argument, scope, depth + 1)\n        return\n\n      case 'SpreadElement':\n        if (node.argument) walkNode(node.argument, scope, depth + 1)\n        return\n\n      case 'SequenceExpression':\n        for (const expr of node.expressions ?? []) walkNode(expr, scope, depth + 1)\n        return\n\n      case 'ParenthesizedExpression':\n        if (node.expression) walkNode(node.expression, scope, depth + 1)\n        return\n\n      case 'ChainExpression':\n        if (node.expression) walkNode(node.expression, scope, depth + 1)\n        return\n\n      case 'MetaProperty':\n        // S2 已在上方判定（import.meta / new.target）\n        return\n\n      case 'ImportExpression':\n        // S2 已在上方判定（动态 import()）\n        for (const arg of node.arguments ?? []) walkNode(arg, scope, depth + 1)\n        return\n\n      case 'ClassDeclaration':\n      case 'ClassExpression': {\n        if (node.id?.name && scope) scope.names.add(node.id.name)\n        const clsScope = createScope(scope)\n        if (node.superClass) walkNode(node.superClass, clsScope, depth + 1)\n        if (node.body) walkNode(node.body, clsScope, depth + 1)\n        return\n      }\n\n      case 'ClassBody':\n        for (const method of node.body ?? []) {\n          walkNode(method, scope, depth + 1)\n        }\n        return\n\n      case 'MethodDefinition':\n      case 'PropertyDefinition':\n        if (node.key && node.computed) walkNode(node.key, scope, depth + 1)\n        if (node.value) walkNode(node.value, scope, depth + 1)\n        return\n\n      case 'WithStatement':\n        // S2 已判定\n        walkNode(node.object, scope, depth + 1)\n        if (node.body) walkNode(node.body, scope, depth + 1)\n        return\n\n      case 'DebuggerStatement':\n        // S2 已判定\n        return\n\n      case 'ContinueStatement':\n      case 'BreakStatement':\n        return\n\n      case 'EmptyStatement':\n        return\n\n      case 'Literal':\n        return\n\n      case 'Super':\n        return\n\n      case 'ThisExpression':\n        return\n\n      case 'ImportSpecifier':\n      case 'ImportDefaultSpecifier':\n      case 'ImportNamespaceSpecifier':\n        return\n\n      case 'ExportSpecifier':\n        return\n\n      default:\n        // 未知节点：递归遍历其子属性\n        walkChildren(node, scope, depth)\n        return\n    }\n  }\n\n  function walkPattern(pattern: ASTNode, scope: Scope | null, depth: number): void {\n    if (!pattern) return\n    switch (pattern.type) {\n      case 'Identifier':\n        return // 已在 collectPatternNames 中登记\n      case 'ObjectPattern':\n        for (const prop of pattern.properties ?? []) {\n          if (prop?.type === 'Property') {\n            if (prop.computed && prop.key) walkNode(prop.key, scope, depth + 1)\n            if (prop.value) walkPattern(prop.value, scope, depth + 1)\n          } else if (prop?.type === 'RestElement') {\n            walkPattern(prop.argument, scope, depth + 1)\n          }\n        }\n        return\n      case 'ArrayPattern':\n        for (const el of pattern.elements ?? []) {\n          if (el) walkPattern(el, scope, depth + 1)\n        }\n        return\n      case 'AssignmentPattern':\n        if (pattern.right) walkNode(pattern.right, scope, depth + 1)\n        walkPattern(pattern.left, scope, depth + 1)\n        return\n      case 'RestElement':\n        walkPattern(pattern.argument, scope, depth + 1)\n        return\n      default:\n        return\n    }\n  }\n\n  function walkChildren(node: ASTNode, scope: Scope | null, depth: number): void {\n    for (const key of Object.keys(node)) {\n      if (key === 'loc' || key === 'start' || key === 'end' || key === 'range' || key === 'parent' || key === 'type') continue\n      const v = (node as Record<string, unknown>)[key]\n      if (Array.isArray(v)) {\n        for (const item of v) {\n          if (item && typeof item === 'object' && 'type' in item) {\n            walkNode(item as ASTNode, scope, depth + 1)\n          }\n        }\n      } else if (v && typeof v === 'object' && 'type' in v) {\n        walkNode(v as ASTNode, scope, depth + 1)\n      }\n    }\n  }\n}\n\n// ── 类型别名 ──\ntype ASTNode = any\n\n// ── 门禁断言 ──\n\n/**\n * 门禁断言：violations 非空则抛 ParseError（code='E_SECURITY'，ruleId 挂 ParseError.ruleId）。\n * 三处接入点（A1/A2/A3）统一用它。\n *\n * @param code - the .fai.js source text (raw, un-wrapped).\n * @param opts - scan options (policy is required).\n * @throws ParseError — when violations are non-empty (code='E_SECURITY').\n */\nexport function assertSecure(code: string, opts: SecurityScanOptions): void {\n  const result = scanSource(code, opts)\n  if (result.violations.length > 0) {\n    const v = result.violations[0]\n    throw new ParseError(\n      v.message,\n      v.lineNo,\n      'E_SECURITY',\n      undefined,\n      v.ruleId,\n    )\n  }\n}\n"]}

package/dist/lang/statement-summary.d.ts

@@ -1,7 +1,7 @@
 /**
  * statement-summary — 语句平铺摘要（宿主展示/编排用，非 IR 类型）
  *
- * See docs/syntax-design.md §3 (statement model ↔ StatementSummary mapping).
+ * See docs/language-design.md §3 (statement model ↔ StatementSummary mapping).
  *
  * `analyzeCode(code)` 是宿主消费语句信息的唯一形态（IR 已删除）。摘要只含展示/编排所需的标量字段：
  * Timeline 一行一节点、场景树分组推导、FeatureTree 识别、编辑回填定位。

package/dist/lang/statement-summary.js

@@ -1,7 +1,7 @@
 /**
  * statement-summary — 语句平铺摘要（宿主展示/编排用，非 IR 类型）
  *
- * See docs/syntax-design.md §3 (statement model ↔ StatementSummary mapping).
+ * See docs/language-design.md §3 (statement model ↔ StatementSummary mapping).
  *
  * `analyzeCode(code)` 是宿主消费语句信息的唯一形态（IR 已删除）。摘要只含展示/编排所需的标量字段：
  * Timeline 一行一节点、场景树分组推导、FeatureTree 识别、编辑回填定位。

package/dist/lang/statement-summary.js.map

@@ -1 +1 @@
-{"version":3,"file":"statement-summary.js","sourceRoot":"","sources":["../../src/lang/statement-summary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AA4DtD;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,CAAA;AACpC,CAAC","sourcesContent":["/**\n * statement-summary — 语句平铺摘要（宿主展示/编排用，非 IR 类型）\n *\n * See docs/syntax-design.md §3 (statement model ↔ StatementSummary mapping).\n *\n * `analyzeCode(code)` 是宿主消费语句信息的唯一形态（IR 已删除）。摘要只含展示/编排所需的标量字段：\n * Timeline 一行一节点、场景树分组推导、FeatureTree 识别、编辑回填定位。\n *\n * 无 IR 双通道方案（2026-09-06）后实现换 MetadataExtractor：lines 面直接\n * 产出 StatementSummary 原样（无投影层），与 MetadataExtractor 投影逐字相等\n * （A-16 对拍），仅 id = `'s' + lineNo` 语义变化（append 场景稳定，宿主按\n * 字符串使用不破裂）。\n */\n\nimport type { StmtId, PartName } from '../identity'\nimport type { HostArg } from './host-arg'\nimport { extractMetadata } from './metadata-extractor'\n\n/**\n * A flat scalar projection of one statement for host display and orchestration\n * (a non-IR type). Timeline rows, scene tree grouping, feature-tree\n * recognition, and edit-backfill navigation all consume this summary.\n */\nexport interface StatementSummary {\n  /** 语句 id（'s' + lineNo；append 场景行号稳定） */\n  id: StmtId\n  /** 调用名（<ns>.<callee> 或成员方法名） */\n  callee: string\n  /** 调用命名空间（F2：`mech.makeHeadstock(...)` → 'mech'；缺省 cad 时为 undefined） */\n  namespace?: string\n  /** 本机函数调用（§3.4）：callee 是脚本内函数名，namespace/packageName 缺省。\n   *  宿主据此渲染「本机函数」节点（只读编辑，函数体不透明）。 */\n  local?: boolean\n  /** 命名空间对应的包名（F2：由顶层 import specifier 推导；cad 时为 undefined）。\n   *  timeline「带包名」标识 / 宿主 getFeatureByOp(packageName, op) 的依据。 */\n  packageName?: string\n  /** 成员方法调用接收者变量（asm1.do_assemble() → 'asm1'） */\n  receiver?: PartName\n  /**\n   * 位置实参槽（HostArg 形态，纯数据无 IR）。\n   * 每个元素是 HostArg——字面量原样；var-ref/param-ref/call-ref/expr-ref\n   * 以 `{kind, ...}` 形态呈现。宿主用 `isHostVarRef` 等守卫判定形态。\n   */\n  positional: HostArg[]\n  /**\n   * 尾随选项对象（HostArg 形态，纯数据无 IR）。\n   * 键值经 HostArg 映射；无选项对象时为 `{}`。\n   */\n  args: Record<string, HostArg>\n  /** 产出变量名（split 解构 = 多个；void 语句 = []） */\n  outputs: PartName[]\n  /** 解构键（const {front: a, back: b} → ['front','back']） */\n  outputKeys?: string[]\n  /** 语句引用的变量名集合（parser 收集） */\n  refs?: string[]\n  /** 是否有赋值（const/let 声明 = true；裸重赋值/成员调用 = false） */\n  hasAssignment: boolean\n  /** 参数是否含计算表达式（F1：parser 折叠时置位）。\n   *  true → 宿主编辑面板降级为只读/代码编辑，禁止表单写回（防表达式丢失）。 */\n  hasComputedArgs: boolean\n  /**\n   * 装配相关语句标记（P2-f4）：`cad.assembly` / `asmN.do_assemble` / `asmN.solve`\n   * 行为语句。面板据此渲染装配节点；`assembly` 摘要字段只在 `cad.assembly`\n   * 语句上存在（do_assemble/solve 行只有本标记）。\n   */\n  isAssembly?: boolean\n  /** 装配语句摘要（仅 cad.assembly 语句；约束全文仍走 args 通道，此处只给类型名列表）。 */\n  assembly?: {\n    name?: string\n    memberCount: number\n    constraintTypes: string[]\n  }\n  /** 源码行号（1-based） */\n  line: number\n}\n\n/**\n * 解析代码文本，返回语句平铺摘要（非 IR 类型）。\n *\n * 实现：MetadataExtractor.lines 直接产出（无投影层），与 MetadataExtractor\n * 投影逐字相等（A-16 对拍），id 语义 = `'s' + lineNo`。\n *\n * @param code - the faijs source text to parse and summarize.\n * @returns a flat statement summary for every parsed statement.\n * @throws ParseError — 含行号\n */\nexport function analyzeCode(code: string): StatementSummary[] {\n  return extractMetadata(code).lines\n}\n"]}
+{"version":3,"file":"statement-summary.js","sourceRoot":"","sources":["../../src/lang/statement-summary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AA4DtD;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,CAAA;AACpC,CAAC","sourcesContent":["/**\n * statement-summary — 语句平铺摘要（宿主展示/编排用，非 IR 类型）\n *\n * See docs/language-design.md §3 (statement model ↔ StatementSummary mapping).\n *\n * `analyzeCode(code)` 是宿主消费语句信息的唯一形态（IR 已删除）。摘要只含展示/编排所需的标量字段：\n * Timeline 一行一节点、场景树分组推导、FeatureTree 识别、编辑回填定位。\n *\n * 无 IR 双通道方案（2026-09-06）后实现换 MetadataExtractor：lines 面直接\n * 产出 StatementSummary 原样（无投影层），与 MetadataExtractor 投影逐字相等\n * （A-16 对拍），仅 id = `'s' + lineNo` 语义变化（append 场景稳定，宿主按\n * 字符串使用不破裂）。\n */\n\nimport type { StmtId, PartName } from '../identity'\nimport type { HostArg } from './host-arg'\nimport { extractMetadata } from './metadata-extractor'\n\n/**\n * A flat scalar projection of one statement for host display and orchestration\n * (a non-IR type). Timeline rows, scene tree grouping, feature-tree\n * recognition, and edit-backfill navigation all consume this summary.\n */\nexport interface StatementSummary {\n  /** 语句 id（'s' + lineNo；append 场景行号稳定） */\n  id: StmtId\n  /** 调用名（<ns>.<callee> 或成员方法名） */\n  callee: string\n  /** 调用命名空间（F2：`mech.makeHeadstock(...)` → 'mech'；缺省 cad 时为 undefined） */\n  namespace?: string\n  /** 本机函数调用（§3.4）：callee 是脚本内函数名，namespace/packageName 缺省。\n   *  宿主据此渲染「本机函数」节点（只读编辑，函数体不透明）。 */\n  local?: boolean\n  /** 命名空间对应的包名（F2：由顶层 import specifier 推导；cad 时为 undefined）。\n   *  timeline「带包名」标识 / 宿主 getFeatureByOp(packageName, op) 的依据。 */\n  packageName?: string\n  /** 成员方法调用接收者变量（asm1.do_assemble() → 'asm1'） */\n  receiver?: PartName\n  /**\n   * 位置实参槽（HostArg 形态，纯数据无 IR）。\n   * 每个元素是 HostArg——字面量原样；var-ref/param-ref/call-ref/expr-ref\n   * 以 `{kind, ...}` 形态呈现。宿主用 `isHostVarRef` 等守卫判定形态。\n   */\n  positional: HostArg[]\n  /**\n   * 尾随选项对象（HostArg 形态，纯数据无 IR）。\n   * 键值经 HostArg 映射；无选项对象时为 `{}`。\n   */\n  args: Record<string, HostArg>\n  /** 产出变量名（split 解构 = 多个；void 语句 = []） */\n  outputs: PartName[]\n  /** 解构键（const {front: a, back: b} → ['front','back']） */\n  outputKeys?: string[]\n  /** 语句引用的变量名集合（parser 收集） */\n  refs?: string[]\n  /** 是否有赋值（const/let 声明 = true；裸重赋值/成员调用 = false） */\n  hasAssignment: boolean\n  /** 参数是否含计算表达式（F1：parser 折叠时置位）。\n   *  true → 宿主编辑面板降级为只读/代码编辑，禁止表单写回（防表达式丢失）。 */\n  hasComputedArgs: boolean\n  /**\n   * 装配相关语句标记（P2-f4）：`cad.assembly` / `asmN.do_assemble` / `asmN.solve`\n   * 行为语句。面板据此渲染装配节点；`assembly` 摘要字段只在 `cad.assembly`\n   * 语句上存在（do_assemble/solve 行只有本标记）。\n   */\n  isAssembly?: boolean\n  /** 装配语句摘要（仅 cad.assembly 语句；约束全文仍走 args 通道，此处只给类型名列表）。 */\n  assembly?: {\n    name?: string\n    memberCount: number\n    constraintTypes: string[]\n  }\n  /** 源码行号（1-based） */\n  line: number\n}\n\n/**\n * 解析代码文本，返回语句平铺摘要（非 IR 类型）。\n *\n * 实现：MetadataExtractor.lines 直接产出（无投影层），与 MetadataExtractor\n * 投影逐字相等（A-16 对拍），id 语义 = `'s' + lineNo`。\n *\n * @param code - the faijs source text to parse and summarize.\n * @returns a flat statement summary for every parsed statement.\n * @throws ParseError — 含行号\n */\nexport function analyzeCode(code: string): StatementSummary[] {\n  return extractMetadata(code).lines\n}\n"]}

package/dist/lang/types.d.ts

@@ -1,7 +1,7 @@
 /**
  * faijs 文本层类型定义 — 保留类型（L0 零依赖）
  *
- * 设计文档：docs/syntax-design.md §3.1
+ * 设计文档：docs/language-design.md §3.1
  *
  * 代码文本是唯一事实源。IR 已删除（T5），本文件只保留宿主消费的
  * 保留类型（ParamDef / TerminalShape / ScriptMetaIR / VarKind）和

package/dist/lang/types.js

@@ -1,7 +1,7 @@
 /**
  * faijs 文本层类型定义 — 保留类型（L0 零依赖）
  *
- * 设计文档：docs/syntax-design.md §3.1
+ * 设计文档：docs/language-design.md §3.1
  *
  * 代码文本是唯一事实源。IR 已删除（T5），本文件只保留宿主消费的
  * 保留类型（ParamDef / TerminalShape / ScriptMetaIR / VarKind）和

package/dist/lang/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/lang/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG","sourcesContent":["/**\n * faijs 文本层类型定义 — 保留类型（L0 零依赖）\n *\n * 设计文档：docs/syntax-design.md §3.1\n *\n * 代码文本是唯一事实源。IR 已删除（T5），本文件只保留宿主消费的\n * 保留类型（ParamDef / TerminalShape / ScriptMetaIR / VarKind）和\n * 基础值类型（Vec3 / JsonValue）。\n *\n * L0 边界：此文件仅依赖 TypeScript 内置类型 + identity（零依赖品牌模块）。\n */\n\nimport { type PartName } from '../identity'\n\n// ── 值与引用 ──\n\n/** A 3-component vector. */\nexport type Vec3 = [number, number, number]\n\n/** A JSON-serializable value, used for parameter literals and wire-shaped args. */\nexport type JsonValue =\n  | string\n  | number\n  | boolean\n  | null\n  | JsonValue[]\n  | { [k: string]: JsonValue }\n\n// ── 参数表 ──\n\n/**\n * A parameter declaration (`const name = <literal>`), with its value and\n * optional schema metadata.\n */\nexport interface ParamDef {\n  name: string\n  type: 'number' | 'vec3' | 'bool' | 'enum'\n  value: JsonValue\n  default: JsonValue\n  min?: number\n  max?: number\n  options?: string[]\n  label?: string\n}\n\n// ── Part 脚本 ──\n\n/**\n * Scene-level model metadata (name and appearance) carried by a script.\n */\nexport interface ScriptMetaIR {\n  name?: string\n  appearance?: { color?: string; metalness?: number; roughness?: number }\n}\n\n/** 终端变量类型（keep-syntax 设计 §6：运行时登记，缺省 'shape'）。 */\nexport type VarKind = 'shape' | 'compound' | 'value'\n\n/** 终端 shape：return 数组/DAG 叶子判定列出的最终输出（设计文档 §2.2 / §4.1） */\nexport interface TerminalShape {\n  /** 终端左值变量名（PartName，如 'part0'）——终端按变量名（outputs）标识，非语句 id */\n  id: PartName\n  /** 该终端 mesh 的独立 meta（name/appearance） */\n  meta?: ScriptMetaIR\n  /** 变量类型（'shape' | 'compound' | 'value'），运行时登记，缺省 'shape' */\n  kind?: VarKind\n  /** 保留但 canvas 不渲染（keep-syntax 设计 §6），缺省 undefined → 可见 */\n  hidden?: boolean\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/lang/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG","sourcesContent":["/**\n * faijs 文本层类型定义 — 保留类型（L0 零依赖）\n *\n * 设计文档：docs/language-design.md §3.1\n *\n * 代码文本是唯一事实源。IR 已删除（T5），本文件只保留宿主消费的\n * 保留类型（ParamDef / TerminalShape / ScriptMetaIR / VarKind）和\n * 基础值类型（Vec3 / JsonValue）。\n *\n * L0 边界：此文件仅依赖 TypeScript 内置类型 + identity（零依赖品牌模块）。\n */\n\nimport { type PartName } from '../identity'\n\n// ── 值与引用 ──\n\n/** A 3-component vector. */\nexport type Vec3 = [number, number, number]\n\n/** A JSON-serializable value, used for parameter literals and wire-shaped args. */\nexport type JsonValue =\n  | string\n  | number\n  | boolean\n  | null\n  | JsonValue[]\n  | { [k: string]: JsonValue }\n\n// ── 参数表 ──\n\n/**\n * A parameter declaration (`const name = <literal>`), with its value and\n * optional schema metadata.\n */\nexport interface ParamDef {\n  name: string\n  type: 'number' | 'vec3' | 'bool' | 'enum'\n  value: JsonValue\n  default: JsonValue\n  min?: number\n  max?: number\n  options?: string[]\n  label?: string\n}\n\n// ── Part 脚本 ──\n\n/**\n * Scene-level model metadata (name and appearance) carried by a script.\n */\nexport interface ScriptMetaIR {\n  name?: string\n  appearance?: { color?: string; metalness?: number; roughness?: number }\n}\n\n/** 终端变量类型（keep-syntax 设计 §6：运行时登记，缺省 'shape'）。 */\nexport type VarKind = 'shape' | 'compound' | 'value'\n\n/** 终端 shape：return 数组/DAG 叶子判定列出的最终输出（设计文档 §2.2 / §4.1） */\nexport interface TerminalShape {\n  /** 终端左值变量名（PartName，如 'part0'）——终端按变量名（outputs）标识，非语句 id */\n  id: PartName\n  /** 该终端 mesh 的独立 meta（name/appearance） */\n  meta?: ScriptMetaIR\n  /** 变量类型（'shape' | 'compound' | 'value'），运行时登记，缺省 'shape' */\n  kind?: VarKind\n  /** 保留但 canvas 不渲染（keep-syntax 设计 §6），缺省 undefined → 可见 */\n  hidden?: boolean\n}\n"]}

package/dist/mesh/index.d.ts

@@ -1,7 +1,7 @@
 /**
  * mesh — 纯数据几何 API 统一入口
  *
- * See docs/api-contract.md §1 (architecture layers) and §10 (stdlib function catalog).
+ * See docs/api-contract.md §1 (architecture layers) and §10 (api function catalog).
  *
  * 原则（§5.1）：
  * 1. 全部纯数据：输入输出是 Shape (ManifoldMeshData)，不碰 THREE 场景、不读 store
@@ -69,6 +69,7 @@ export declare const cad: {
     solidToShape: typeof brepOps.solidToShape;
 };
 export type { Shape, Vec3, BoundingBox, FaceDescriptor } from './types.js';
+export { guessStlUnit } from './stl-unit.js';
 export type { BoxParams, SphereParams, CylinderParams, ConeParams, WedgeParams, TextParams, SvgExtrudeParams, SdfParams, DrillParams, ExtrudeParams, EngraveParams, KnurlParams, SplitPlane, SplitResult, DovetailSplitParams, DowelSplitParams, TenonSplitParams, } from './types.js';
 export type { BrepChainState, DrillBrepParams, SplitBrepParams, SplitBrepResult, ExtrudeBrepParams, } from '../brep/index.js';
 export { createBrepChainState, initBrepChainState, releaseBrepChainState, solidToShape, isCadFormat, } from '../brep/index.js';

package/dist/mesh/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mesh/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,UAAU,MAAM,cAAc,CAAA;AAC1C,OAAO,KAAK,cAAc,MAAM,yBAAyB,CAAA;AACzD,OAAO,KAAK,OAAO,MAAM,SAAS,CAAA;AAClC,OAAO,KAAK,UAAU,MAAM,WAAW,CAAA;AACvC,OAAO,KAAK,UAAU,MAAM,WAAW,CAAA;AACvC,OAAO,KAAK,YAAY,MAAM,aAAa,CAAA;AAC3C,OAAO,KAAK,QAAQ,MAAM,SAAS,CAAA;AACnC,OAAO,KAAK,KAAK,MAAM,MAAM,CAAA;AAI7B;;;;;;;GAOG;AACH,eAAO,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0Df,CAAA;AAID,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AACvE,YAAY,EACV,SAAS,EAAE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAChE,UAAU,EAAE,gBAAgB,EAAE,SAAS,EACvC,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EACtD,UAAU,EAAE,WAAW,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,gBAAgB,GACjF,MAAM,SAAS,CAAA;AAGhB,YAAY,EACV,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EACjE,iBAAiB,GAClB,MAAM,SAAS,CAAA;AAChB,OAAO,EACL,oBAAoB,EAAE,kBAAkB,EAAE,qBAAqB,EAC/D,YAAY,EACZ,WAAW,GACZ,MAAM,SAAS,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mesh/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,UAAU,MAAM,cAAc,CAAA;AAC1C,OAAO,KAAK,cAAc,MAAM,yBAAyB,CAAA;AACzD,OAAO,KAAK,OAAO,MAAM,SAAS,CAAA;AAClC,OAAO,KAAK,UAAU,MAAM,WAAW,CAAA;AACvC,OAAO,KAAK,UAAU,MAAM,WAAW,CAAA;AACvC,OAAO,KAAK,YAAY,MAAM,aAAa,CAAA;AAC3C,OAAO,KAAK,QAAQ,MAAM,SAAS,CAAA;AACnC,OAAO,KAAK,KAAK,MAAM,MAAM,CAAA;AAI7B;;;;;;;GAOG;AACH,eAAO,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0Df,CAAA;AAID,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACzC,YAAY,EACV,SAAS,EAAE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAChE,UAAU,EAAE,gBAAgB,EAAE,SAAS,EACvC,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EACtD,UAAU,EAAE,WAAW,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,gBAAgB,GACjF,MAAM,SAAS,CAAA;AAGhB,YAAY,EACV,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EACjE,iBAAiB,GAClB,MAAM,SAAS,CAAA;AAChB,OAAO,EACL,oBAAoB,EAAE,kBAAkB,EAAE,qBAAqB,EAC/D,YAAY,EACZ,WAAW,GACZ,MAAM,SAAS,CAAA"}

package/dist/mesh/index.js

@@ -1,7 +1,7 @@
 /**
  * mesh — 纯数据几何 API 统一入口
  *
- * See docs/api-contract.md §1 (architecture layers) and §10 (stdlib function catalog).
+ * See docs/api-contract.md §1 (architecture layers) and §10 (api function catalog).
  *
  * 原则（§5.1）：
  * 1. 全部纯数据：输入输出是 Shape (ManifoldMeshData)，不碰 THREE 场景、不读 store
@@ -80,5 +80,6 @@ export const cad = {
     loadBrep: brepOps.loadBrep,
     solidToShape: brepOps.solidToShape,
 };
+export { guessStlUnit } from './stl-unit.js';
 export { createBrepChainState, initBrepChainState, releaseBrepChainState, solidToShape, isCadFormat, } from '../brep/index.js';
 //# sourceMappingURL=index.js.map