@keithadler/frostjs 0.1.0 → 0.3.0

package/dist/extract/taint.js

@@ -0,0 +1,503 @@
+/**
+ * Bounded taint analysis: does untrusted input reach a dangerous sink?
+ *
+ * frostjs's recognizers say "this file can eval" or "this file reaches
+ * host X". Taint answers the harder question: does a value that came from
+ * an attacker-influenced source (a URL parameter, document.cookie, a
+ * postMessage payload) actually flow into eval, innerHTML, importScripts,
+ * a redirect, and so on. That is the difference between a capability and a
+ * vulnerability, and it is what the three.js/ECSY finding was underneath:
+ * `location.search` gated a path that eval'd relay data.
+ *
+ * The one rule that keeps this from crying wolf: **taint survives only
+ * through operations that provably preserve it** - string methods, URL
+ * decoding, JSON.parse, template concatenation, member access. Any other
+ * function call breaks the chain, so `el.innerHTML = DOMPurify.sanitize(x)`
+ * is not flagged while `el.innerHTML = x` is. Flow is followed within a
+ * function (with closure inheritance and message-handler seeding) and one
+ * hop across a call: a tainted argument to a local function whose parameter
+ * reaches a sink. A whole call graph is not walked, and that is stated as a
+ * limit rather than hidden.
+ */
+import { positionAt } from "./ast.js";
+import { analyzeScopes } from "./scope.js";
+import { FOLDED, FREE } from "./annotations.js";
+import { isIdentifier, memberName } from "./recognizers/resolve.js";
+/** The global objects a source can hang off. */
+const GLOBALS = new Set(["window", "globalThis", "self"]);
+/**
+ * location members that carry attacker-influenced text. Narrowed to the
+ * parts an attacker actually controls (the query, fragment, full URL and
+ * path); host/hostname/origin/protocol are the page's own identity and
+ * are rarely an injection vector, so they are left out to protect the
+ * zero-false-positive property.
+ */
+const LOCATION_PROPS = new Set(["search", "hash", "href", "pathname"]);
+/** document members that carry attacker-influenced text. */
+const DOCUMENT_PROPS = new Set(["URL", "documentURI", "referrer", "cookie", "baseURI"]);
+/** String and URL operations that preserve taint: `t.<method>(...)` stays tainted. */
+const PRESERVING_METHODS = new Set([
+    "replace",
+    "replaceAll",
+    "slice",
+    "substring",
+    "substr",
+    "trim",
+    "trimStart",
+    "trimEnd",
+    "toLowerCase",
+    "toUpperCase",
+    "toString",
+    "split",
+    "concat",
+    "padStart",
+    "padEnd",
+    "normalize",
+    "at",
+    "charAt",
+    "repeat",
+    "get",
+    "getAll",
+    "toJSON",
+]);
+/** Global functions that preserve taint on their first argument. */
+const PRESERVING_CALLS = new Set([
+    "decodeURIComponent",
+    "decodeURI",
+    "encodeURIComponent",
+    "encodeURI",
+    "atob",
+    "escape",
+    "unescape",
+    "String",
+]);
+const isNode = (v) => typeof v === "object" && v !== null && typeof v.type === "string";
+/** Strip TS value wrappers and parentheses. */
+function unwrap(n) {
+    let c = n;
+    while (c.type === "ParenthesizedExpression" ||
+        c.type === "TSAsExpression" ||
+        c.type === "TSNonNullExpression" ||
+        c.type === "TSSatisfiesExpression" ||
+        c.type === "TSTypeAssertion") {
+        c = c["expression"];
+    }
+    return c;
+}
+/** A free reference to one of `names`. */
+function freeGlobal(n, names) {
+    return isIdentifier(n) && names.has(n.name) && n[FREE] === true;
+}
+/** `location`, `window.location`, `document.location`, `self.location`. */
+function isLocation(n) {
+    n = unwrap(n);
+    if (freeGlobal(n, new Set(["location"])))
+        return true;
+    if (n.type === "MemberExpression" && memberName(n) === "location") {
+        const obj = unwrap(n["object"]);
+        return freeGlobal(obj, GLOBALS) || freeGlobal(obj, new Set(["document"]));
+    }
+    return false;
+}
+/** A member read that is itself an untrusted source; returns a label or null. */
+function sourceMember(n) {
+    if (n.type !== "MemberExpression")
+        return null;
+    const prop = memberName(n);
+    if (prop === null)
+        return null;
+    const obj = unwrap(n["object"]);
+    if (LOCATION_PROPS.has(prop) && isLocation(obj))
+        return `location.${prop}`;
+    if (DOCUMENT_PROPS.has(prop) && freeGlobal(obj, new Set(["document"])))
+        return `document.${prop}`;
+    if (prop === "name" && freeGlobal(obj, GLOBALS))
+        return "window.name";
+    return null;
+}
+/** Does `n` evaluate to a tainted value under the current scope? Also reports which source, when asked. */
+function taintSource(n, scope) {
+    n = unwrap(n);
+    switch (n.type) {
+        case "Identifier":
+            return scope.tainted.has(n.name) ? (scope.sources.get(n.name) ?? "untrusted input") : null;
+        case "MemberExpression": {
+            const direct = sourceMember(n);
+            if (direct)
+                return direct;
+            // t.foo / t[i]: a member of a tainted object is tainted.
+            return taintSource(n["object"], scope);
+        }
+        case "BinaryExpression":
+            return n["operator"] === "+"
+                ? (taintSource(n["left"], scope) ?? taintSource(n["right"], scope))
+                : null;
+        case "TemplateLiteral": {
+            for (const e of n["expressions"]) {
+                const s = taintSource(e, scope);
+                if (s)
+                    return s;
+            }
+            return null;
+        }
+        case "ConditionalExpression":
+            return taintSource(n["consequent"], scope) ?? taintSource(n["alternate"], scope);
+        case "AwaitExpression":
+        case "YieldExpression":
+            return n["argument"] ? taintSource(n["argument"], scope) : null;
+        case "AssignmentExpression":
+            return taintSource(n["right"], scope);
+        case "SequenceExpression": {
+            const exprs = n["expressions"];
+            return exprs.length ? taintSource(exprs[exprs.length - 1], scope) : null;
+        }
+        case "NewExpression":
+            // new URLSearchParams(tainted) / new URL(tainted) is a tainted object.
+            if (isIdentifier(n["callee"], "URLSearchParams") || isIdentifier(n["callee"], "URL")) {
+                for (const a of n["arguments"]) {
+                    const s = taintSource(a, scope);
+                    if (s)
+                        return s;
+                }
+            }
+            return null;
+        case "CallExpression": {
+            const callee = unwrap(n["callee"]);
+            const args = n["arguments"];
+            // preserving global call: decodeURIComponent(tainted), JSON.parse(tainted)
+            if (isIdentifier(callee) && PRESERVING_CALLS.has(callee.name))
+                return taintSource(args[0] ?? callee, scope);
+            if (callee.type === "MemberExpression") {
+                const method = memberName(callee);
+                const recv = callee["object"];
+                if (method === "parse" && isIdentifier(unwrap(recv), "JSON"))
+                    return taintSource(args[0] ?? callee, scope);
+                // preserving method on a tainted receiver: location.hash.slice(1), params.get('x')
+                if (method !== null && PRESERVING_METHODS.has(method))
+                    return taintSource(recv, scope);
+            }
+            return null;
+        }
+        default:
+            return null;
+    }
+}
+/** The sinks: a tainted value here is markup, code, a remote load, or a redirect. */
+function checkSinks(n, scope, add) {
+    // assignment sinks: el.innerHTML = tainted, location.href = tainted, setAttribute-less
+    if (n.type === "AssignmentExpression") {
+        const left = unwrap(n["left"]);
+        const right = n["right"];
+        if (left.type === "MemberExpression") {
+            const prop = memberName(left);
+            if (prop === "innerHTML" || prop === "outerHTML" || prop === "srcdoc") {
+                const s = taintSource(right, scope);
+                if (s)
+                    add(s, prop, n);
+            }
+            // location = tainted, location.href = tainted
+            if ((prop !== null && LOCATION_PROPS.has(prop) && isLocation(left["object"])) || isLocation(left)) {
+                const s = taintSource(right, scope);
+                if (s)
+                    add(s, "location (redirect)", n);
+            }
+        }
+    }
+    if (n.type === "CallExpression" || n.type === "NewExpression" || n.type === "ImportExpression") {
+        const args = n["arguments"] ?? [];
+        const src = n.type === "ImportExpression" ? n["source"] : undefined;
+        const callee = n.type === "ImportExpression" ? null : unwrap(n["callee"]);
+        const flag = (arg, sink) => {
+            if (!arg)
+                return;
+            const s = taintSource(arg, scope);
+            if (s)
+                add(s, sink, n);
+        };
+        if (n.type === "ImportExpression")
+            return flag(src, "import()");
+        if (callee === null)
+            return;
+        if (isIdentifier(callee, "eval"))
+            return flag(args[0], "eval");
+        if (isIdentifier(callee, "Function"))
+            return flag(args[args.length - 1], "Function");
+        if (isIdentifier(callee, "importScripts"))
+            return args.forEach((a) => flag(a, "importScripts"));
+        // A tainted first argument to a timer is a string, so it is the string-code
+        // form (setTimeout("...", n)); a function callback is never tainted.
+        if (isIdentifier(callee, "setTimeout") || isIdentifier(callee, "setInterval"))
+            return flag(args[0], callee.name);
+        if (callee.type === "MemberExpression") {
+            const method = memberName(callee);
+            const obj = callee["object"];
+            if (method === "eval")
+                return flag(args[0], "eval");
+            if ((method === "setTimeout" || method === "setInterval") && freeGlobal(unwrap(obj), GLOBALS))
+                return flag(args[0], method);
+            if (method === "importScripts")
+                return args.forEach((a) => flag(a, "importScripts"));
+            if (method === "insertAdjacentHTML")
+                return flag(args[1], "insertAdjacentHTML");
+            if (method === "write" || method === "writeln")
+                return flag(args[0], "document.write");
+            if (method === "setAttribute") {
+                const attr = args[0];
+                const name = attr?.type === "Literal" && typeof attr["value"] === "string" ? attr["value"].toLowerCase() : null;
+                if (name === "srcdoc" || (name !== null && /^on[a-z]+$/.test(name)))
+                    flag(args[1], `setAttribute("${name}")`);
+                return;
+            }
+            if ((method === "assign" || method === "replace") && isLocation(obj))
+                return flag(args[0], "location (redirect)");
+            if (method === "open" && freeGlobal(unwrap(obj), GLOBALS))
+                return flag(args[0], "window.open (redirect)");
+        }
+    }
+}
+/** Statements introduced by declarations/assignments that may add taint in this scope. */
+function propagate(node, scope) {
+    let changed = false;
+    const bind = (name, init) => {
+        if (!init)
+            return;
+        const s = taintSource(init, scope);
+        if (s && !scope.tainted.has(name)) {
+            scope.tainted.add(name);
+            scope.sources.set(name, s);
+            changed = true;
+        }
+    };
+    if (node.type === "VariableDeclarator" && node["id"].type === "Identifier") {
+        bind(node["id"]["name"], node["init"]);
+    }
+    else if (node.type === "AssignmentExpression" && node["left"].type === "Identifier") {
+        bind(node["left"]["name"], node["right"]);
+    }
+    return changed;
+}
+/** Collect every node in a function body, not descending into nested functions. */
+function ownNodes(root) {
+    const out = [];
+    const FN = new Set(["FunctionDeclaration", "FunctionExpression", "ArrowFunctionExpression"]);
+    const go = (n, top) => {
+        if (!top && FN.has(n.type))
+            return; // a nested function is its own scope
+        out.push(n);
+        for (const key of Object.keys(n)) {
+            if (key === "type" || key === "start" || key === "end")
+                continue;
+            const v = n[key];
+            if (Array.isArray(v)) {
+                for (const it of v)
+                    if (isNode(it))
+                        go(it, false);
+            }
+            else if (isNode(v))
+                go(v, false);
+        }
+    };
+    go(root, true);
+    return out;
+}
+const NO_SINK_FNS = new Map();
+function analyzeScope(body, inherited, findings, parsed, seedParam, sinkFns = NO_SINK_FNS) {
+    const scope = { tainted: new Set(inherited.tainted), sources: new Map(inherited.sources) };
+    if (seedParam) {
+        scope.tainted.add(seedParam.name);
+        scope.sources.set(seedParam.name, seedParam.source);
+    }
+    const nodes = ownNodes(body);
+    // Fixpoint: keep binding tainted variables until nothing changes.
+    for (let changed = true; changed;) {
+        changed = false;
+        for (const n of nodes)
+            if (propagate(n, scope))
+                changed = true;
+    }
+    const report = (source, sink, at) => {
+        const pos = positionAt(parsed.lines, at.start);
+        findings.push({
+            source,
+            sink,
+            file: parsed.file,
+            line: pos.line,
+            column: pos.column,
+            expression: parsed.source.slice(at.start, at.end).replace(/\s+/g, " ").slice(0, 120),
+        });
+    };
+    for (const n of nodes) {
+        checkSinks(n, scope, report);
+        // One-hop interprocedural: a tainted argument passed to a local function's sink parameter.
+        if (n.type === "CallExpression") {
+            const name = isIdentifier(n["callee"]) ? n["callee"]["name"] : null;
+            const summary = name !== null ? sinkFns.get(name) : undefined;
+            if (summary) {
+                const args = n["arguments"];
+                for (const [i, sink] of summary) {
+                    const s = args[i] ? taintSource(args[i], scope) : null;
+                    if (s)
+                        report(s, `${sink} (via ${name}())`, n);
+                }
+            }
+        }
+    }
+    // Recurse into nested functions, inheriting this scope's taint (closure).
+    for (const fn of nestedFunctions(body)) {
+        analyzeScope(fn["body"], scope, findings, parsed, messageSeed(fn), sinkFns);
+    }
+}
+/** Every function reachable by name: `function f(){}` and `const f = () => {}`. */
+function namedFunctions(program) {
+    const out = new Map();
+    const FN = new Set(["FunctionExpression", "ArrowFunctionExpression"]);
+    const walk = (n) => {
+        if (n.type === "FunctionDeclaration" && n["id"])
+            out.set(n["id"]["name"], n);
+        if (n.type === "VariableDeclarator" &&
+            n["id"].type === "Identifier" &&
+            n["init"] &&
+            FN.has(n["init"].type)) {
+            out.set(n["id"]["name"], n["init"]);
+        }
+        for (const key of Object.keys(n)) {
+            if (key === "type" || key === "start" || key === "end")
+                continue;
+            const v = n[key];
+            if (Array.isArray(v)) {
+                for (const it of v)
+                    if (isNode(it))
+                        walk(it);
+            }
+            else if (isNode(v))
+                walk(v);
+        }
+    };
+    walk(program);
+    return out;
+}
+/**
+ * For each named function, which parameters flow to a sink. Computed by
+ * seeding one parameter at a time as the only source and seeing whether any
+ * sink fires - so a parameter that is sanitized before the sink does not
+ * count. Direct only: a parameter that reaches a sink through another
+ * function is not summarized (a stated limit).
+ */
+function summarize(functions, parsed) {
+    const out = new Map();
+    for (const [name, fn] of functions) {
+        const params = fn["params"];
+        const sinkParams = new Map();
+        for (let i = 0; i < params.length; i++) {
+            const p = params[i];
+            if (p.type !== "Identifier")
+                continue;
+            const probe = [];
+            const scope = { tainted: new Set(), sources: new Map() };
+            analyzeScope(fn["body"], scope, probe, parsed, { name: p["name"], source: "@param" });
+            const hit = probe.find((f) => f.source === "@param");
+            if (hit)
+                sinkParams.set(i, hit.sink);
+        }
+        if (sinkParams.size > 0)
+            out.set(name, sinkParams);
+    }
+    return out;
+}
+/** Immediate nested functions of a body (not deeper - each recursion handles its own). */
+function nestedFunctions(root) {
+    const out = [];
+    const FN = new Set(["FunctionDeclaration", "FunctionExpression", "ArrowFunctionExpression"]);
+    const go = (n, top) => {
+        if (!top && FN.has(n.type)) {
+            out.push(n);
+            return;
+        }
+        for (const key of Object.keys(n)) {
+            if (key === "type" || key === "start" || key === "end")
+                continue;
+            const v = n[key];
+            if (Array.isArray(v)) {
+                for (const it of v)
+                    if (isNode(it))
+                        go(it, false);
+            }
+            else if (isNode(v))
+                go(v, false);
+        }
+    };
+    go(root, true);
+    return out;
+}
+/**
+ * If a function is the handler of a `window` message listener, its first
+ * parameter is a source ("postMessage data"). Only window, not self: a
+ * worker's messages come from its own creator (see message.ts).
+ */
+function messageSeed(fn) {
+    const p = fn["params"][0];
+    const name = p?.type === "Identifier" ? p["name"] : null;
+    if (name === null)
+        return null;
+    const listener = fn["$frostjsMessageHandler"];
+    return listener === true ? { name, source: "postMessage data" } : null;
+}
+/** Mark window message handlers so messageSeed can find them. */
+function markMessageHandlers(program) {
+    const walk = (n) => {
+        if (n.type === "CallExpression") {
+            const callee = n["callee"];
+            if (callee.type === "MemberExpression" &&
+                memberName(callee) === "addEventListener" &&
+                freeGlobal(callee["object"], new Set(["window"]))) {
+                const args = n["arguments"];
+                if (args[0]?.type === "Literal" && args[0]["value"] === "message" && args[1])
+                    args[1]["$frostjsMessageHandler"] = true;
+            }
+        }
+        if (n.type === "AssignmentExpression") {
+            const left = n["left"];
+            if (left.type === "MemberExpression" &&
+                memberName(left) === "onmessage" &&
+                freeGlobal(left["object"], new Set(["window"]))) {
+                n["right"]["$frostjsMessageHandler"] = true;
+            }
+        }
+        for (const key of Object.keys(n)) {
+            if (key === "type" || key === "start" || key === "end")
+                continue;
+            const v = n[key];
+            if (Array.isArray(v)) {
+                for (const it of v)
+                    if (isNode(it))
+                        walk(it);
+            }
+            else if (isNode(v))
+                walk(v);
+        }
+    };
+    walk(program);
+}
+/** Find every untrusted-source-to-dangerous-sink flow in the file. */
+export function taint(parsed) {
+    const info = analyzeScopes(parsed.program);
+    for (const n of info.free)
+        n[FREE] = true;
+    for (const [n, v] of info.constants)
+        n[FOLDED] = v;
+    markMessageHandlers(parsed.program);
+    const sinkFns = summarize(namedFunctions(parsed.program), parsed);
+    const findings = [];
+    const empty = { tainted: new Set(), sources: new Map() };
+    analyzeScope(parsed.program, empty, findings, parsed, null, sinkFns);
+    // Deduplicate by position and sink.
+    const seen = new Set();
+    return findings.filter((f) => {
+        const k = `${f.line}:${f.column}:${f.sink}`;
+        if (seen.has(k))
+            return false;
+        seen.add(k);
+        return true;
+    });
+}
+//# sourceMappingURL=taint.js.map

package/dist/extract/taint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"taint.js","sourceRoot":"","sources":["../../src/extract/taint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,UAAU,EAA4C,MAAM,UAAU,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAcpE,gDAAgD;AAChD,MAAM,OAAO,GAAwB,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;AAC/E;;;;;;GAMG;AACH,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AAC5F,4DAA4D;AAC5D,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AAE7G,sFAAsF;AACtF,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC;IACtD,SAAS;IACT,YAAY;IACZ,OAAO;IACP,WAAW;IACX,QAAQ;IACR,MAAM;IACN,WAAW;IACX,SAAS;IACT,aAAa;IACb,aAAa;IACb,UAAU;IACV,OAAO;IACP,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,WAAW;IACX,IAAI;IACJ,QAAQ;IACR,QAAQ;IACR,KAAK;IACL,QAAQ;IACR,QAAQ;CACT,CAAC,CAAC;AACH,oEAAoE;AACpE,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC;IACpD,oBAAoB;IACpB,WAAW;IACX,oBAAoB;IACpB,WAAW;IACX,MAAM;IACN,QAAQ;IACR,UAAU;IACV,QAAQ;CACT,CAAC,CAAC;AAIH,MAAM,MAAM,GAAG,CAAC,CAAU,EAAgB,EAAE,CAC1C,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,OAAQ,CAAwB,CAAC,IAAI,KAAK,QAAQ,CAAC;AAE5F,+CAA+C;AAC/C,SAAS,MAAM,CAAC,CAAU;IACxB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OACE,CAAC,CAAC,IAAI,KAAK,yBAAyB;QACpC,CAAC,CAAC,IAAI,KAAK,gBAAgB;QAC3B,CAAC,CAAC,IAAI,KAAK,qBAAqB;QAChC,CAAC,CAAC,IAAI,KAAK,uBAAuB;QAClC,CAAC,CAAC,IAAI,KAAK,iBAAiB,EAC5B,CAAC;QACD,CAAC,GAAG,CAAC,CAAC,YAAY,CAAY,CAAC;IACjC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,0CAA0C;AAC1C,SAAS,UAAU,CAAC,CAAU,EAAE,KAA0B;IACxD,OAAO,YAAY,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;AAClE,CAAC;AAED,2EAA2E;AAC3E,SAAS,UAAU,CAAC,CAAU;IAC5B,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACd,IAAI,UAAU,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;QAClE,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAY,CAAC,CAAC;QAC3C,OAAO,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,UAAU,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,iFAAiF;AACjF,SAAS,YAAY,CAAC,CAAU;IAC9B,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAY,CAAC,CAAC;IAC3C,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,YAAY,IAAI,EAAE,CAAC;IAC3E,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,YAAY,IAAI,EAAE,CAAC;IAClG,IAAI,IAAI,KAAK,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;QAAE,OAAO,aAAa,CAAC;IACtE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2GAA2G;AAC3G,SAAS,WAAW,CAAC,CAAU,EAAE,KAAY;IAC3C,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACd,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,YAAY;YACf,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7F,KAAK,kBAAkB,CAAC,CAAC,CAAC;YACxB,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;YAC/B,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;YAC1B,yDAAyD;YACzD,OAAO,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAY,EAAE,KAAK,CAAC,CAAC;QACpD,CAAC;QACD,KAAK,kBAAkB;YACrB,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,GAAG;gBAC1B,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAY,EAAE,KAAK,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,OAAO,CAAY,EAAE,KAAK,CAAC,CAAC;gBACzF,CAAC,CAAC,IAAI,CAAC;QACX,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,aAAa,CAAc,EAAE,CAAC;gBAC9C,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;gBAChC,IAAI,CAAC;oBAAE,OAAO,CAAC,CAAC;YAClB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,uBAAuB;YAC1B,OAAO,WAAW,CAAC,CAAC,CAAC,YAAY,CAAY,EAAE,KAAK,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,WAAW,CAAY,EAAE,KAAK,CAAC,CAAC;QACzG,KAAK,iBAAiB,CAAC;QACvB,KAAK,iBAAiB;YACpB,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAY,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7E,KAAK,sBAAsB;YACzB,OAAO,WAAW,CAAC,CAAC,CAAC,OAAO,CAAY,EAAE,KAAK,CAAC,CAAC;QACnD,KAAK,oBAAoB,CAAC,CAAC,CAAC;YAC1B,MAAM,KAAK,GAAG,CAAC,CAAC,aAAa,CAAc,CAAC;YAC5C,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5E,CAAC;QACD,KAAK,eAAe;YAClB,uEAAuE;YACvE,IAAI,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,iBAAiB,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;gBACrF,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,CAAc,EAAE,CAAC;oBAC5C,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;oBAChC,IAAI,CAAC;wBAAE,OAAO,CAAC,CAAC;gBAClB,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAY,CAAC,CAAC;YAC9C,MAAM,IAAI,GAAG,CAAC,CAAC,WAAW,CAAc,CAAC;YACzC,2EAA2E;YAC3E,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,KAAK,CAAC,CAAC;YAC5G,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBACvC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;gBAClC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAY,CAAC;gBACzC,IAAI,MAAM,KAAK,OAAO,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;oBAAE,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,KAAK,CAAC,CAAC;gBAC3G,mFAAmF;gBACnF,IAAI,MAAM,KAAK,IAAI,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC;oBAAE,OAAO,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACzF,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,SAAS,UAAU,CAAC,CAAU,EAAE,KAAY,EAAE,GAA0D;IACtG,uFAAuF;IACvF,IAAI,CAAC,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAY,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAY,CAAC;QACpC,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtE,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;gBACpC,IAAI,CAAC;oBAAE,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACzB,CAAC;YACD,8CAA8C;YAC9C,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAY,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7G,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;gBACpC,IAAI,CAAC;oBAAE,GAAG,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,gBAAgB,IAAI,CAAC,CAAC,IAAI,KAAK,eAAe,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAC/F,MAAM,IAAI,GAAI,CAAC,CAAC,WAAW,CAA2B,IAAI,EAAE,CAAC;QAC7D,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpE,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAY,CAAC,CAAC;QAErF,MAAM,IAAI,GAAG,CAAC,GAAwB,EAAE,IAAY,EAAQ,EAAE;YAC5D,IAAI,CAAC,GAAG;gBAAE,OAAO;YACjB,MAAM,CAAC,GAAG,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAClC,IAAI,CAAC;gBAAE,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACzB,CAAC,CAAC;QAEF,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB;YAAE,OAAO,IAAI,CAAC,GAAc,EAAE,UAAU,CAAC,CAAC;QAC3E,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO;QAE5B,IAAI,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC/D,IAAI,YAAY,CAAC,MAAM,EAAE,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QACrF,IAAI,YAAY,CAAC,MAAM,EAAE,eAAe,CAAC;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC;QAChG,4EAA4E;QAC5E,qEAAqE;QACrE,IAAI,YAAY,CAAC,MAAM,EAAE,YAAY,CAAC,IAAI,YAAY,CAAC,MAAM,EAAE,aAAa,CAAC;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAEjH,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;YAClC,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAY,CAAC;YACxC,IAAI,MAAM,KAAK,MAAM;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YACpD,IAAI,CAAC,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,aAAa,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;gBAC3F,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YAC/B,IAAI,MAAM,KAAK,eAAe;gBAAE,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC;YACrF,IAAI,MAAM,KAAK,oBAAoB;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC;YAChF,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;YACvF,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;gBAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBACrB,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;gBAChH,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,IAAI,IAAI,CAAC,CAAC;gBAC9G,OAAO;YACT,CAAC;YACD,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,SAAS,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;YAClH,IAAI,MAAM,KAAK,MAAM,IAAI,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC;QAC5G,CAAC;IACH,CAAC;AACH,CAAC;AAED,0FAA0F;AAC1F,SAAS,SAAS,CAAC,IAAa,EAAE,KAAY;IAC5C,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,IAAgC,EAAQ,EAAE;QACpE,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACxB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC3B,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;IACH,CAAC,CAAC;IACF,IAAI,IAAI,CAAC,IAAI,KAAK,oBAAoB,IAAK,IAAI,CAAC,IAAI,CAAa,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACxF,IAAI,CAAE,IAAI,CAAC,IAAI,CAAa,CAAC,MAAM,CAAW,EAAE,IAAI,CAAC,MAAM,CAAmB,CAAC,CAAC;IAClF,CAAC;SAAM,IAAI,IAAI,CAAC,IAAI,KAAK,sBAAsB,IAAK,IAAI,CAAC,MAAM,CAAa,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACnG,IAAI,CAAE,IAAI,CAAC,MAAM,CAAa,CAAC,MAAM,CAAW,EAAE,IAAI,CAAC,OAAO,CAAY,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,mFAAmF;AACnF,SAAS,QAAQ,CAAC,IAAa;IAC7B,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,CAAC,qBAAqB,EAAE,oBAAoB,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAC7F,MAAM,EAAE,GAAG,CAAC,CAAU,EAAE,GAAY,EAAQ,EAAE;QAC5C,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,qCAAqC;QACzE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACZ,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,KAAK;gBAAE,SAAS;YACjE,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;YACjB,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrB,KAAK,MAAM,EAAE,IAAI,CAAC;oBAAE,IAAI,MAAM,CAAC,EAAE,CAAC;wBAAE,EAAE,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YACpD,CAAC;iBAAM,IAAI,MAAM,CAAC,CAAC,CAAC;gBAAE,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACrC,CAAC;IACH,CAAC,CAAC;IACF,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACf,OAAO,GAAG,CAAC;AACb,CAAC;AAKD,MAAM,WAAW,GAAY,IAAI,GAAG,EAAE,CAAC;AAEvC,SAAS,YAAY,CACnB,IAAa,EACb,SAAgB,EAChB,QAAwB,EACxB,MAAkB,EAClB,SAAkD,EAClD,UAAmB,WAAW;IAE9B,MAAM,KAAK,GAAU,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;IAClG,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAClC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAE7B,kEAAkE;IAClE,KAAK,IAAI,OAAO,GAAG,IAAI,EAAE,OAAO,GAAG,CAAC;QAClC,OAAO,GAAG,KAAK,CAAC;QAChB,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,IAAI,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC;gBAAE,OAAO,GAAG,IAAI,CAAC;IACjE,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,IAAY,EAAE,EAAW,EAAQ,EAAE;QACjE,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QAC/C,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM;YACN,IAAI;YACJ,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SACrF,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,UAAU,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC7B,2FAA2F;QAC3F,IAAI,CAAC,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAY,CAAC,CAAC,CAAC,CAAG,CAAC,CAAC,QAAQ,CAAa,CAAC,MAAM,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;YACxG,MAAM,OAAO,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9D,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,IAAI,GAAG,CAAC,CAAC,WAAW,CAAc,CAAC;gBACzC,KAAK,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC;oBAChC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;oBACxD,IAAI,CAAC;wBAAE,MAAM,CAAC,CAAC,EAAE,GAAG,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;gBACjD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,KAAK,MAAM,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,YAAY,CAAC,EAAE,CAAC,MAAM,CAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IACzF,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,SAAS,cAAc,CAAC,OAAa;IACnC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAmB,CAAC;IACvC,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,CAAC,oBAAoB,EAAE,yBAAyB,CAAC,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,CAAC,CAAU,EAAQ,EAAE;QAChC,IAAI,CAAC,CAAC,IAAI,KAAK,qBAAqB,IAAI,CAAC,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,GAAG,CAAE,CAAC,CAAC,IAAI,CAAa,CAAC,MAAM,CAAW,EAAE,CAAC,CAAC,CAAC;QACpG,IACE,CAAC,CAAC,IAAI,KAAK,oBAAoB;YAC9B,CAAC,CAAC,IAAI,CAAa,CAAC,IAAI,KAAK,YAAY;YAC1C,CAAC,CAAC,MAAM,CAAC;YACT,EAAE,CAAC,GAAG,CAAE,CAAC,CAAC,MAAM,CAAa,CAAC,IAAI,CAAC,EACnC,CAAC;YACD,GAAG,CAAC,GAAG,CAAE,CAAC,CAAC,IAAI,CAAa,CAAC,MAAM,CAAW,EAAE,CAAC,CAAC,MAAM,CAAY,CAAC,CAAC;QACxE,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,KAAK;gBAAE,SAAS;YACjE,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;YACjB,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrB,KAAK,MAAM,EAAE,IAAI,CAAC;oBAAE,IAAI,MAAM,CAAC,EAAE,CAAC;wBAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/C,CAAC;iBAAM,IAAI,MAAM,CAAC,CAAC,CAAC;gBAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAChC,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,OAAkB,CAAC,CAAC;IACzB,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,SAAS,SAAS,CAAC,SAAuC,EAAE,MAAkB;IAC5E,MAAM,GAAG,GAAG,IAAI,GAAG,EAA+B,CAAC;IACnD,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,SAAS,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,EAAE,CAAC,QAAQ,CAAc,CAAC;QACzC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;YACrB,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY;gBAAE,SAAS;YACtC,MAAM,KAAK,GAAmB,EAAE,CAAC;YACjC,MAAM,KAAK,GAAU,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;YAChE,YAAY,CAAC,EAAE,CAAC,MAAM,CAAY,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC3G,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;YACrD,IAAI,GAAG;gBAAE,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,GAAG,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,0FAA0F;AAC1F,SAAS,eAAe,CAAC,IAAa;IACpC,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,CAAC,qBAAqB,EAAE,oBAAoB,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAC7F,MAAM,EAAE,GAAG,CAAC,CAAU,EAAE,GAAY,EAAQ,EAAE;QAC5C,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACZ,OAAO;QACT,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,KAAK;gBAAE,SAAS;YACjE,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;YACjB,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrB,KAAK,MAAM,EAAE,IAAI,CAAC;oBAAE,IAAI,MAAM,CAAC,EAAE,CAAC;wBAAE,EAAE,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YACpD,CAAC;iBAAM,IAAI,MAAM,CAAC,CAAC,CAAC;gBAAE,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACrC,CAAC;IACH,CAAC,CAAC;IACF,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACf,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,EAAW;IAC9B,MAAM,CAAC,GAAI,EAAE,CAAC,QAAQ,CAAe,CAAC,CAAC,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,CAAC,EAAE,IAAI,KAAK,YAAY,CAAC,CAAC,CAAE,CAAC,CAAC,MAAM,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,QAAQ,GAAG,EAAE,CAAC,wBAAwB,CAAC,CAAC;IAC9C,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACzE,CAAC;AAED,iEAAiE;AACjE,SAAS,mBAAmB,CAAC,OAAa;IACxC,MAAM,IAAI,GAAG,CAAC,CAAU,EAAQ,EAAE;QAChC,IAAI,CAAC,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAY,CAAC;YACtC,IACE,MAAM,CAAC,IAAI,KAAK,kBAAkB;gBAClC,UAAU,CAAC,MAAM,CAAC,KAAK,kBAAkB;gBACzC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAY,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAC5D,CAAC;gBACD,MAAM,IAAI,GAAG,CAAC,CAAC,WAAW,CAAc,CAAC;gBACzC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC;oBACzE,IAAI,CAAC,CAAC,CAAa,CAAC,wBAAwB,CAAC,GAAG,IAAI,CAAC;YAC1D,CAAC;QACH,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAY,CAAC;YAClC,IACE,IAAI,CAAC,IAAI,KAAK,kBAAkB;gBAChC,UAAU,CAAC,IAAI,CAAC,KAAK,WAAW;gBAChC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAY,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAC1D,CAAC;gBACA,CAAC,CAAC,OAAO,CAAa,CAAC,wBAAwB,CAAC,GAAG,IAAI,CAAC;YAC3D,CAAC;QACH,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,KAAK;gBAAE,SAAS;YACjE,MAAM,CAAC,GAAI,CAAa,CAAC,GAAG,CAAC,CAAC;YAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrB,KAAK,MAAM,EAAE,IAAI,CAAC;oBAAE,IAAI,MAAM,CAAC,EAAE,CAAC;wBAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/C,CAAC;iBAAM,IAAI,MAAM,CAAC,CAAC,CAAC;gBAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAChC,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,OAAkB,CAAC,CAAC;AAC3B,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,KAAK,CAAC,MAAkB;IACtC,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI;QAAG,CAAa,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACvD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS;QAAG,CAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChE,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAEpC,MAAM,OAAO,GAAG,SAAS,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,MAAM,KAAK,GAAU,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;IAChE,YAAY,CAAC,MAAM,CAAC,OAAkB,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAChF,oCAAoC;IACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/extract/target.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"target.d.ts","sourceRoot":"","sources":["../../src/extract/target.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAIxC,+DAA+D;AAC/D,eAAO,MAAM,WAAW,gBAAgB,CAAC;AAEzC,4FAA4F;AAC5F,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CA4BvF;AAKD;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,WAAW,CAAC;AAE7C;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,UAAO,EAAE,IAAI,GAAE,UAAkB,GAAG,MAAM,GAAG,IAAI,CAqBpG;AAED,kEAAkE;AAClE,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,SAAS,EAAE,IAAI,GAAE,UAAkB,GAAG,MAAM,GAAG,IAAI,CAKjG"}
+{"version":3,"file":"target.d.ts","sourceRoot":"","sources":["../../src/extract/target.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAIxC,+DAA+D;AAC/D,eAAO,MAAM,WAAW,gBAAgB,CAAC;AAEzC,4FAA4F;AAC5F,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CA4BvF;AAKD;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,WAAW,CAAC;AAE7C;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,UAAO,EAAE,IAAI,GAAE,UAAkB,GAAG,MAAM,GAAG,IAAI,CAqBpG;AAED,kEAAkE;AAClE,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,SAAS,EAAE,IAAI,GAAE,UAAkB,GAAG,MAAM,GAAG,IAAI,CAWjG"}

package/dist/extract/target.js

@@ -1,4 +1,4 @@
-import { FOLDED } from "./annotations.js";
+import { FOLDED, FREE } from "./annotations.js";
 import { unwrap } from "./typescript.js";
 /** The target of a relative URL: the document's own origin. */
 export const SAME_ORIGIN = "same-origin";
@@ -73,9 +73,31 @@ export function resolveTarget(text, complete = true, kind = "url") {
 export function resolveTargetOf(arg, kind = "url") {
     if (!arg)
         return null;
+    // new URL(path, "https://host/..."): the host comes from the base, whatever the (possibly dynamic) first arg.
+    if (arg.type === "NewExpression" && isUrlCtor(arg["callee"])) {
+        const args = arg["arguments"];
+        if (args.length >= 2)
+            return resolveTargetOf(args[1]);
+        return resolveTargetOf(args[0]); // new URL("https://host/...")
+    }
     const lit = leadingLiteral(arg);
     if (lit === null)
         return null;
     return resolveTarget(lit.text, lit.complete, kind);
 }
+/** True for the global `URL` constructor (bare or window.URL), not a local one. */
+function isUrlCtor(callee) {
+    if (callee.type === "Identifier")
+        return callee["name"] === "URL" && callee[FREE] === true;
+    if (callee.type === "MemberExpression" && callee["computed"] !== true) {
+        const prop = callee["property"];
+        const obj = callee["object"];
+        return (prop.type === "Identifier" &&
+            prop["name"] === "URL" &&
+            obj.type === "Identifier" &&
+            GLOBAL_OBJECT_NAMES.has(obj["name"]));
+    }
+    return false;
+}
+const GLOBAL_OBJECT_NAMES = new Set(["window", "globalThis", "self"]);
 //# sourceMappingURL=target.js.map

package/dist/extract/target.js.map

@@ -1 +1 @@
-{"version":3,"file":"target.js","sourceRoot":"","sources":["../../src/extract/target.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAEzC,+DAA+D;AAC/D,MAAM,CAAC,MAAM,WAAW,GAAG,aAAa,CAAC;AAEzC,4FAA4F;AAC5F,MAAM,UAAU,cAAc,CAAC,GAAY;IACzC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,SAAS;YACZ,OAAO,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5F,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,mEAAmE;YACnE,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;YACvB,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACpE,CAAC;QACD,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAc,CAAC;YAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAc,CAAC;YAC/C,MAAM,KAAK,GAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAqC,EAAE,MAAM,IAAI,EAAE,CAAC;YACtF,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvD,CAAC;QACD,KAAK,kBAAkB,CAAC,CAAC,CAAC;YACxB,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YAC1C,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAY,CAAC,CAAC;YACrD,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAChC,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAY,CAAC,CAAC;YACvD,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;YAChE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpE,CAAC;QACD;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,QAAQ,GAAG,wBAAwB,CAAC;AAC1C,MAAM,SAAS,GAAG,+EAA+E,CAAC;AAUlG;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,QAAQ,GAAG,IAAI,EAAE,OAAmB,KAAK;IACnF,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,CAAC,EAAE,CAAC;QACN,sGAAsG;QACtG,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QACnB,MAAM,MAAM,GAAG,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAClD,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,0CAA0C;IAC/E,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,YAAY;YAAE,OAAO,GAAG,CAAC,GAAG,CAAC;QACvE,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC,CAAC,kDAAkD;QACnG,OAAO,IAAI,CAAC,CAAC,oDAAoD;IACnE,CAAC;IACD,8BAA8B;IAC9B,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,WAAW,CAAC;IACvC,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;AAC/F,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,eAAe,CAAC,GAAwB,EAAE,OAAmB,KAAK;IAChF,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,OAAO,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AACrD,CAAC"}
+{"version":3,"file":"target.js","sourceRoot":"","sources":["../../src/extract/target.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAEzC,+DAA+D;AAC/D,MAAM,CAAC,MAAM,WAAW,GAAG,aAAa,CAAC;AAEzC,4FAA4F;AAC5F,MAAM,UAAU,cAAc,CAAC,GAAY;IACzC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,SAAS;YACZ,OAAO,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5F,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,mEAAmE;YACnE,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;YACvB,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACpE,CAAC;QACD,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAc,CAAC;YAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAc,CAAC;YAC/C,MAAM,KAAK,GAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAqC,EAAE,MAAM,IAAI,EAAE,CAAC;YACtF,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvD,CAAC;QACD,KAAK,kBAAkB,CAAC,CAAC,CAAC;YACxB,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YAC1C,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAY,CAAC,CAAC;YACrD,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAChC,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAY,CAAC,CAAC;YACvD,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;YAChE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpE,CAAC;QACD;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,QAAQ,GAAG,wBAAwB,CAAC;AAC1C,MAAM,SAAS,GAAG,+EAA+E,CAAC;AAUlG;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,QAAQ,GAAG,IAAI,EAAE,OAAmB,KAAK;IACnF,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,CAAC,EAAE,CAAC;QACN,sGAAsG;QACtG,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QACnB,MAAM,MAAM,GAAG,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAClD,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,0CAA0C;IAC/E,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,YAAY;YAAE,OAAO,GAAG,CAAC,GAAG,CAAC;QACvE,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC,CAAC,kDAAkD;QACnG,OAAO,IAAI,CAAC,CAAC,oDAAoD;IACnE,CAAC;IACD,8BAA8B;IAC9B,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,WAAW,CAAC;IACvC,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;AAC/F,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,eAAe,CAAC,GAAwB,EAAE,OAAmB,KAAK;IAChF,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,8GAA8G;IAC9G,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAY,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,CAAc,CAAC;QAC3C,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC;YAAE,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,8BAA8B;IACjE,CAAC;IACD,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,OAAO,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AACrD,CAAC;AAED,mFAAmF;AACnF,SAAS,SAAS,CAAC,MAAe;IAChC,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;IAC3F,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC;QACtE,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAY,CAAC;QAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAY,CAAC;QACxC,OAAO,CACL,IAAI,CAAC,IAAI,KAAK,YAAY;YAC1B,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK;YACtB,GAAG,CAAC,IAAI,KAAK,YAAY;YACzB,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAW,CAAC,CAC/C,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC"}

package/dist/policy/compile.d.ts

@@ -17,7 +17,7 @@ import { type ParsedPolicy, type Rule } from "./parse.js";
  * `decide()` for vendored files the registry does not know, never by
  * `compile()`.
  */
-export type Reason = "granted" | "forbidden" | "expired" | "not granted" | "unknown destination" | "unregistered";
+export type Reason = "granted" | "forbidden" | "expired" | "not granted" | "unknown destination" | "unregistered" | "tainted";
 export interface Evaluation {
     verdict: "allowed" | "denied";
     reason: Reason;
@@ -32,6 +32,8 @@ export interface Policy {
     rules: readonly Rule[];
     /** Globs of vendored files, relative to the policy directory. */
     vendored: readonly string[];
+    /** The policy asks frostjs check to gate on taint flows. */
+    taint: boolean;
     /** Globs of files not analyzed at all, relative to the policy directory. */
     ignore: readonly string[];
     /** Grants that expire within the warning window, as printable lines. */

package/dist/policy/compile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compile.d.ts","sourceRoot":"","sources":["../../src/policy/compile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EAAO,KAAK,YAAY,EAAE,KAAK,IAAI,EAAE,MAAM,YAAY,CAAC;AAE/D;;;;GAIG;AACH,MAAM,MAAM,MAAM,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,aAAa,GAAG,qBAAqB,GAAG,cAAc,CAAC;AAElH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,yEAAyE;IACzE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;CACnB;AAED,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,oGAAoG;IACpG,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC;IACvB,iEAAiE;IACjE,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,4EAA4E;IAC5E,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,wEAAwE;IACxE,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,kEAAkE;IAClE,QAAQ,CAAC,GAAG,EAAE,aAAa,GAAG,UAAU,CAAC;CAC1C;AAED,MAAM,WAAW,cAAc;IAC7B,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,yFAAyF;AACzF,wBAAgB,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED,oFAAoF;AACpF,wBAAgB,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,cAAc,GAAG,MAAM,CAsD1E;AAED,wFAAwF;AACxF,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAE9E;AAED,4GAA4G;AAC5G,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAGlE"}
+{"version":3,"file":"compile.d.ts","sourceRoot":"","sources":["../../src/policy/compile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EAAO,KAAK,YAAY,EAAE,KAAK,IAAI,EAAE,MAAM,YAAY,CAAC;AAE/D;;;;GAIG;AACH,MAAM,MAAM,MAAM,GAChB,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,aAAa,GAAG,qBAAqB,GAAG,cAAc,GAAG,SAAS,CAAC;AAE3G,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,yEAAyE;IACzE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;CACnB;AAED,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,oGAAoG;IACpG,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC;IACvB,iEAAiE;IACjE,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,4DAA4D;IAC5D,KAAK,EAAE,OAAO,CAAC;IACf,4EAA4E;IAC5E,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,wEAAwE;IACxE,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,kEAAkE;IAClE,QAAQ,CAAC,GAAG,EAAE,aAAa,GAAG,UAAU,CAAC;CAC1C;AAED,MAAM,WAAW,cAAc;IAC7B,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,yFAAyF;AACzF,wBAAgB,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED,oFAAoF;AACpF,wBAAgB,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,cAAc,GAAG,MAAM,CAuD1E;AAED,wFAAwF;AACxF,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAE9E;AAED,4GAA4G;AAC5G,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAGlE"}

package/dist/policy/compile.js

@@ -27,6 +27,7 @@ export function compile(parsed, opts) {
         today,
         rules: parsed.rules,
         vendored: parsed.vendored,
+        taint: parsed.taint,
         ignore: parsed.ignore,
         warnings,
         evaluate(use) {