@skrr-ai/cli 0.1.101 → 0.1.103

package/dist/lib/widgetStaticScan.js

@@ -0,0 +1,833 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.lexJs = lexJs;
+exports.maskJsComments = maskJsComments;
+exports.maskCssComments = maskCssComments;
+exports.maskHtmlComments = maskHtmlComments;
+exports.classifyUrl = classifyUrl;
+exports.scanWidgetSource = scanWidgetSource;
+const OPEN_LINK = 'window.skrr.openLink(url)';
+// ── small text helpers ──────────────────────────────────────────────────────
+/** ASCII-only lowercase: the same length as the input, so offsets stay valid. */
+function asciiLower(value) {
+    let out = '';
+    let last = 0;
+    for (let i = 0; i < value.length; i += 1) {
+        const c = value.charCodeAt(i);
+        if (c >= 65 && c <= 90) {
+            out += value.slice(last, i) + String.fromCharCode(c + 32);
+            last = i + 1;
+        }
+    }
+    return last === 0 ? value : out + value.slice(last);
+}
+function lineStarts(text) {
+    const starts = [0];
+    let i = text.indexOf('\n');
+    while (i !== -1) {
+        starts.push(i + 1);
+        i = text.indexOf('\n', i + 1);
+    }
+    return starts;
+}
+function lineAt(starts, index) {
+    let lo = 0;
+    let hi = starts.length - 1;
+    while (lo < hi) {
+        const mid = (lo + hi + 1) >> 1;
+        if (starts[mid] <= index) {
+            lo = mid;
+        }
+        else {
+            hi = mid - 1;
+        }
+    }
+    return lo + 1;
+}
+function isSpace(c) {
+    return c === 32 || c === 9 || c === 10 || c === 13 || c === 12;
+}
+function isAsciiLetter(c) {
+    return (c >= 65 && c <= 90) || (c >= 97 && c <= 122);
+}
+// ── comment masking ─────────────────────────────────────────────────────────
+/** Replace `from..to` with spaces, keeping line breaks so line numbers stay valid. */
+function blank(chars, from, to) {
+    for (let k = from; k < to; k += 1) {
+        if (chars[k] !== '\n') {
+            chars[k] = ' ';
+        }
+    }
+}
+const REGEX_PRECEDING_WORDS = new Set([
+    'return',
+    'typeof',
+    'instanceof',
+    'case',
+    'in',
+    'of',
+    'delete',
+    'void',
+    'throw',
+    'new',
+    'else',
+    'do',
+    'yield',
+    'await',
+]);
+const isIdentChar = (c) => /[A-Za-z0-9_$]/.test(c) || c > '\u007f';
+/**
+ * Read a script once. Total and linear: it never throws, every loop advances, and
+ * a misread costs a missed or an extra finding, never a hang. It is a heuristic
+ * where JavaScript is ambiguous (a `/` after `)` is read as division; an unclosed
+ * quote ends at the line break), and picks the reading that leaves the rest of the
+ * text lexable.
+ */
+function lexJs(src) {
+    const n = src.length;
+    const code = src.split('');
+    const commentless = src.split('');
+    const literals = [];
+    const templateDepths = [];
+    let depth = 0;
+    let regexAllowed = true;
+    /** A `/` scan that reached the end of its line without closing is not repeated on that line. */
+    let regexBlockedUntil = -1;
+    let i = 0;
+    const keep = (kind, open, start, end) => {
+        literals.push({ kind, open, start, value: src.slice(start, end) });
+        blank(code, start, end);
+    };
+    /** Template text from `from` to a closing backtick or a `${`; returns the next offset to read. */
+    const readTemplate = (from, open) => {
+        let j = from;
+        while (j < n) {
+            const c = src.charAt(j);
+            if (c === '\\') {
+                j += 2;
+            }
+            else if (c === '`') {
+                keep('template', open, from, j);
+                regexAllowed = false;
+                return j + 1;
+            }
+            else if (c === '$' && src.charAt(j + 1) === '{') {
+                keep('template', open, from, j);
+                templateDepths.push(depth);
+                depth += 1;
+                regexAllowed = true;
+                return j + 2;
+            }
+            else {
+                j += 1;
+            }
+        }
+        keep('template', open, from, n);
+        return n;
+    };
+    while (i < n) {
+        const c = src.charAt(i);
+        const d = src.charAt(i + 1);
+        if (c === '/' && d === '/') {
+            const end = src.indexOf('\n', i);
+            const to = end === -1 ? n : end;
+            blank(code, i, to);
+            blank(commentless, i, to);
+            i = to;
+        }
+        else if (c === '/' && d === '*') {
+            const end = src.indexOf('*/', i + 2);
+            const to = end === -1 ? n : end + 2;
+            blank(code, i, to);
+            blank(commentless, i, to);
+            i = to;
+        }
+        else if (c === '"' || c === "'") {
+            let j = i + 1;
+            while (j < n && src.charAt(j) !== c && src.charAt(j) !== '\n') {
+                j += src.charAt(j) === '\\' ? 2 : 1;
+            }
+            keep('string', i, i + 1, Math.min(j, n));
+            i = j < n && src.charAt(j) === c ? j + 1 : Math.min(j, n);
+            regexAllowed = false;
+        }
+        else if (c === '`') {
+            i = readTemplate(i + 1, i);
+        }
+        else if (c === '}' &&
+            templateDepths.length > 0 &&
+            templateDepths[templateDepths.length - 1] === depth - 1) {
+            templateDepths.pop();
+            depth -= 1;
+            i = readTemplate(i + 1, i);
+        }
+        else if (c === '/') {
+            let closed = -1;
+            if (regexAllowed && i > regexBlockedUntil) {
+                let j = i + 1;
+                let inClass = false;
+                while (j < n && src.charAt(j) !== '\n') {
+                    const e = src.charAt(j);
+                    if (e === '\\') {
+                        j += 2;
+                        continue;
+                    }
+                    if (e === '[') {
+                        inClass = true;
+                    }
+                    else if (e === ']') {
+                        inClass = false;
+                    }
+                    else if (e === '/' && !inClass) {
+                        closed = j;
+                        break;
+                    }
+                    j += 1;
+                }
+                if (closed === -1) {
+                    regexBlockedUntil = Math.min(j, n);
+                }
+            }
+            if (closed !== -1) {
+                keep('regex', i, i + 1, closed);
+                i = closed + 1;
+                while (i < n && /[a-z]/i.test(src.charAt(i))) {
+                    i += 1;
+                }
+                regexAllowed = false;
+            }
+            else {
+                i += 1;
+                regexAllowed = true;
+            }
+        }
+        else if (/[A-Za-z_$]/.test(c) || c > '\u007f') {
+            let j = i + 1;
+            while (j < n && isIdentChar(src.charAt(j))) {
+                j += 1;
+            }
+            regexAllowed = REGEX_PRECEDING_WORDS.has(src.slice(i, j));
+            i = j;
+        }
+        else if (c >= '0' && c <= '9') {
+            let j = i + 1;
+            while (j < n && /[0-9A-Za-z_.]/.test(src.charAt(j))) {
+                j += 1;
+            }
+            regexAllowed = false;
+            i = j;
+        }
+        else {
+            // Whitespace says nothing about whether a `/` divides or starts a regular expression.
+            if (!isSpace(src.charCodeAt(i))) {
+                if (c === '{') {
+                    depth += 1;
+                }
+                else if (c === '}') {
+                    depth -= 1;
+                }
+                regexAllowed = !(c === ')' || c === ']' || c === '}');
+            }
+            i += 1;
+        }
+    }
+    return { code: code.join(''), commentless: commentless.join(''), literals };
+}
+/**
+ * Blank the comments of JavaScript, leaving strings, template text and regular
+ * expressions untouched (the URLs a script uses live in strings). Strings end at
+ * a line break, so one unbalanced quote cannot swallow the rest of the file; the
+ * cost of a misread is a missed finding, never a false one.
+ */
+function maskJsComments(src) {
+    return lexJs(src).commentless;
+}
+/** Blank the block comments of CSS, stepping over quoted strings. */
+function maskCssComments(src) {
+    const chars = src.split('');
+    const n = src.length;
+    let i = 0;
+    while (i < n) {
+        const c = src.charAt(i);
+        if (c === '/' && src.charAt(i + 1) === '*') {
+            const end = src.indexOf('*/', i + 2);
+            const to = end === -1 ? n : end + 2;
+            blank(chars, i, to);
+            i = to;
+        }
+        else if (c === '"' || c === "'") {
+            i += 1;
+            while (i < n && src.charAt(i) !== c && src.charAt(i) !== '\n') {
+                i += src.charAt(i) === '\\' ? 2 : 1;
+            }
+            i += 1;
+        }
+        else {
+            i += 1;
+        }
+    }
+    return chars.join('');
+}
+/** Blank `<!-- … -->` comments of HTML. */
+function maskHtmlComments(src) {
+    const chars = src.split('');
+    let i = src.indexOf('<!--');
+    while (i !== -1) {
+        const end = src.indexOf('-->', i + 4);
+        const to = end === -1 ? src.length : end + 3;
+        blank(chars, i, to);
+        i = src.indexOf('<!--', to);
+    }
+    return chars.join('');
+}
+/** A URL the frame cannot fetch from, a self-contained one, or one with no base to resolve against. */
+function classifyUrl(raw) {
+    const value = raw.trim();
+    if (value === '') {
+        return 'empty';
+    }
+    const lower = asciiLower(value);
+    if (lower.startsWith('data:') ||
+        lower.startsWith('blob:') ||
+        lower.startsWith('#') ||
+        lower.startsWith('javascript:') ||
+        lower.startsWith('about:') ||
+        lower.startsWith('mailto:') ||
+        lower.startsWith('tel:')) {
+        return 'inline';
+    }
+    if (lower.startsWith('//') || /^[a-z][a-z0-9+.-]*:/.test(lower)) {
+        return 'external';
+    }
+    return 'relative';
+}
+/** XML namespace identifiers look like URLs and load nothing. */
+function isNamespaceUrl(url) {
+    return /^https?:\/\/www\.w3\.org\//i.test(url);
+}
+// ── collector ───────────────────────────────────────────────────────────────
+class Collector {
+    section;
+    findings = [];
+    constructor(section) {
+        this.section = section;
+    }
+    add(severity, code, line, message, fix) {
+        this.findings.push({
+            severity,
+            code,
+            section: this.section,
+            line,
+            message,
+            ...(fix ? { fix } : {}),
+        });
+    }
+}
+// ── CSS ─────────────────────────────────────────────────────────────────────
+function scanCssInto(source, baseLine, out) {
+    const masked = maskCssComments(source);
+    const lower = asciiLower(masked);
+    const starts = lineStarts(source);
+    const lineOf = (index) => baseLine + lineAt(starts, index) - 1;
+    let i = lower.indexOf('@import');
+    while (i !== -1) {
+        const end = lower.indexOf(';', i);
+        const statement = masked.slice(i, end === -1 ? undefined : end);
+        const target = /@import\s+(?:url\(\s*)?['"]?([^'")\s;]+)/i.exec(statement);
+        const kind = target ? classifyUrl(target[1]) : 'relative';
+        if (kind === 'external') {
+            out.add('error', 'external-resource', lineOf(i), '@import of a URL: the frame allows no stylesheet from a URL, so the rules never load.', 'Write the rules inline in this section; there are no web fonts or remote stylesheets.');
+        }
+        else if (kind !== 'inline') {
+            out.add('warn', 'relative-url', lineOf(i), '@import has nothing to resolve against inside the frame, so it loads nothing.', 'Write the rules inline.');
+        }
+        i = lower.indexOf('@import', i + 7);
+    }
+    let u = lower.indexOf('url(');
+    while (u !== -1) {
+        const close = masked.indexOf(')', u + 4);
+        const inner = masked.slice(u + 4, close === -1 ? undefined : close).trim();
+        const value = inner.replace(/^['"]|['"]$/g, '');
+        const kind = classifyUrl(value);
+        if (kind === 'external') {
+            out.add('error', 'external-resource', lineOf(u), 'url() of an external address: img-src and font-src allow only data: and blob: URLs here, so it is blocked.', 'Use inline SVG, a gradient, or a data: URI.');
+        }
+        else if (kind === 'relative') {
+            out.add('warn', 'relative-url', lineOf(u), 'url() of a relative path has nothing to resolve against inside the frame.', 'Use a data: URI or inline SVG.');
+        }
+        u = lower.indexOf('url(', u + 4);
+    }
+    if (lower.includes('</style')) {
+        out.add('warn', 'element-close', lineOf(lower.indexOf('</style')), 'The text contains a closing style tag, which can end the stylesheet early depending on how the frame embeds it.', 'Remove it from the CSS.');
+    }
+}
+const NETWORK_FIX = 'Compute the data in the script or inline it in the markup; the frame cannot send or fetch anything.';
+/** `location` as the frame's own, never a variable or a property that happens to be called that. */
+const FRAME_LOCATION = String.raw `(?:\b(?:window|document|self|top|parent)\s*\.\s*|(?<![\w$.]))(?<!\b(?:const|let|var)\s+)location`;
+const JS_RULES = [
+    {
+        pattern: /\bfetch\s*\(/g,
+        severity: 'error',
+        code: 'network-api',
+        message: 'Looks like a fetch() call: connect-src is none, so the request is blocked.',
+        fix: NETWORK_FIX,
+    },
+    {
+        pattern: /\bXMLHttpRequest\b/g,
+        severity: 'error',
+        code: 'network-api',
+        message: 'XMLHttpRequest: connect-src is none, so the request is blocked.',
+        fix: NETWORK_FIX,
+    },
+    {
+        pattern: /\b(?:WebSocket|EventSource)\b/g,
+        severity: 'error',
+        code: 'network-api',
+        message: 'WebSocket or EventSource: connect-src is none, so the connection is blocked.',
+        fix: NETWORK_FIX,
+    },
+    {
+        pattern: /\bsendBeacon\b/g,
+        severity: 'error',
+        code: 'network-api',
+        message: 'navigator.sendBeacon: connect-src is none, so the beacon is blocked.',
+        fix: NETWORK_FIX,
+    },
+    {
+        pattern: /\bnew\s+(?:Shared)?Worker\b|\bimportScripts\s*\(|\bserviceWorker\b/g,
+        severity: 'error',
+        code: 'worker',
+        message: 'Worker, importScripts or serviceWorker: worker-src is none, so none can start.',
+        fix: 'Run the work on the main thread, in small steps (requestAnimationFrame or setTimeout).',
+    },
+    {
+        pattern: /\bRTCPeerConnection\b/g,
+        severity: 'warn',
+        code: 'webrtc',
+        message: 'RTCPeerConnection: widgets have no network access and this is not a supported channel.',
+        fix: 'Remove it.',
+    },
+    {
+        pattern: /\beval\s*\(/g,
+        severity: 'error',
+        code: 'dynamic-code',
+        message: 'eval(): the frame has no unsafe-eval, so it throws.',
+        fix: 'Parse data with JSON.parse and write the logic as ordinary functions.',
+    },
+    {
+        pattern: /\bnew\s+Function\b|(?<![.\w$])Function\s*\(/g,
+        severity: 'error',
+        code: 'dynamic-code',
+        message: 'new Function(): the frame has no unsafe-eval, so it throws.',
+        fix: 'Write the logic as ordinary functions.',
+    },
+    {
+        pattern: /\b(?:setTimeout|setInterval)\s*\(\s*['"`]/g,
+        severity: 'error',
+        code: 'dynamic-code',
+        message: 'setTimeout or setInterval with a string is eval in disguise: it throws here.',
+        fix: 'Pass a function instead of a string.',
+    },
+    {
+        pattern: /\b(?:localStorage|sessionStorage|indexedDB)\b|\bdocument\s*\.\s*cookie\b/g,
+        severity: 'error',
+        code: 'storage',
+        message: 'Storage or cookies: the frame has an opaque origin, so access throws SecurityError (unless the script catches it).',
+        fix: 'Keep state in variables; nothing persists after a reload.',
+    },
+    {
+        pattern: /\b(?:window|self|globalThis)\s*\.\s*(?:parent|top|opener)\s*\.\s*(?!postMessage\b)[A-Za-z_$]/g,
+        severity: 'error',
+        code: 'host-access',
+        message: 'Reaches into the page that hosts the frame: that is cross-origin, so it throws.',
+        fix: 'Use window.skrr (requestPrompt, openLink, navigate) to talk to the app.',
+    },
+    {
+        pattern: /\b(?:window|self|globalThis)\s*\.\s*(?:parent|top|opener)\b/g,
+        severity: 'warn',
+        code: 'host-access',
+        message: 'References the hosting page: the host ignores messages that do not come over its bridge.',
+        fix: 'Use window.skrr (requestPrompt, openLink, navigate).',
+    },
+    {
+        pattern: /(?<![.\w$])(?:top|parent)\s*\./g,
+        severity: 'warn',
+        code: 'host-access',
+        message: 'top. or parent. as a bare name: if this is the browsing context, it is cross-origin and throws; ignore if it is your own variable.',
+        fix: 'Use window.skrr (requestPrompt, openLink, navigate) to talk to the app.',
+    },
+    {
+        pattern: /\b(?:window|self|globalThis)\s*\.\s*open\s*\(/g,
+        severity: 'error',
+        code: 'popup',
+        message: 'window.open(): the sandbox has no allow-popups, so nothing opens.',
+        fix: `Use ${OPEN_LINK} for an https link.`,
+    },
+    {
+        // `location` as the frame's own: reached through window/document/self/top/parent, or
+        // bare. NOT a declaration (`const location = {...}` is a local that shares the name)
+        // and not a member of something else (`p.location = x`).
+        pattern: new RegExp(`${FRAME_LOCATION}\\s*(?:\\.\\s*href\\s*)?=(?!=)|${FRAME_LOCATION}\\s*\\.\\s*(?:assign|replace|reload)\\s*\\(`, 'g'),
+        severity: 'error',
+        code: 'navigation',
+        message: 'Navigates the frame itself: the host allows one load and removes the widget on the second.',
+        fix: `Use ${OPEN_LINK} to open a link, or window.skrr.navigate(path) for an in-app path.`,
+    },
+];
+/** What a string SAYS, as opposed to what the code does: a URL at the start of one, or one inside markup it holds. */
+const URL_IN_STRING = /(?:^|['"`])\s*(https?:\/\/[^\s'"`]+|\/\/[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)+(?:\/[^\s'"`]*)?)/g;
+const URL_START = /^\s*(?:https?:|\/\/)/;
+/** Rules over the TEXT of string and template literals (never over code, where none of this can occur). */
+const STRING_RULES = [
+    {
+        pattern: /\b(?:src|srcset|poster|data|background)\s*=\s*\\?['"]\s*(?:https?:|\/\/)/g,
+        message: 'Markup in a string loads a resource from a URL, which the frame blocks.',
+        fix: 'Use inline SVG, canvas, or a data: URI.',
+    },
+    {
+        pattern: /\burl\(\s*['"]?\s*(?:https?:|\/\/)/g,
+        message: 'url() of an external address in a string: the frame blocks it.',
+        fix: 'Use a gradient, inline SVG or a data: URI.',
+    },
+];
+const STRING_ARGUMENT_RULES = [
+    {
+        lead: /\bimport\s*\(\s*['"`]/g,
+        message: 'import() of a URL: script-src allows only inline code and the platform libraries.',
+        fix: "Import a library by its bare name, for example await import('d3'), inside an async function.",
+    },
+    {
+        lead: /\.\s*(?:src|srcset|poster)\s*=\s*['"`]/g,
+        message: 'Sets src to a URL: img-src and script-src allow only data: and blob: here.',
+        fix: 'Use inline SVG, canvas, or a data: URI.',
+    },
+];
+function scanJsInto(source, baseLine, out) {
+    const { code, commentless, literals } = lexJs(source);
+    const starts = lineStarts(source);
+    const lineOf = (index) => baseLine + lineAt(starts, index) - 1;
+    const codeLines = code.split('\n');
+    const textual = literals.filter((literal) => literal.kind !== 'regex');
+    const byOpen = new Map(textual.map((literal) => [literal.open, literal]));
+    // What the code does: names and calls, over the code view, where a word inside a
+    // string, a template's text or a regular expression is not a call.
+    for (const rule of JS_RULES) {
+        for (const match of code.matchAll(rule.pattern)) {
+            out.add(rule.severity, rule.code, lineOf(match.index ?? 0), rule.message, rule.fix);
+        }
+    }
+    // A call or assignment whose argument is a literal that names a URL.
+    for (const rule of STRING_ARGUMENT_RULES) {
+        for (const match of code.matchAll(rule.lead)) {
+            const open = (match.index ?? 0) + match[0].length - 1;
+            const literal = byOpen.get(open);
+            if (literal && URL_START.test(literal.value)) {
+                out.add('error', 'external-resource', lineOf(match.index ?? 0), rule.message, rule.fix);
+            }
+        }
+    }
+    // What a string says.
+    for (const literal of textual) {
+        for (const rule of STRING_RULES) {
+            for (const match of literal.value.matchAll(rule.pattern)) {
+                out.add('error', 'external-resource', lineOf(literal.start + (match.index ?? 0)), rule.message, rule.fix);
+            }
+        }
+        for (const match of literal.value.matchAll(URL_IN_STRING)) {
+            const url = match[1];
+            const index = literal.start + (match.index ?? 0);
+            const text = codeLines[lineAt(starts, index) - 1] ?? '';
+            if (isNamespaceUrl(url) || /\bopenLink\b/.test(text)) {
+                continue;
+            }
+            out.add('warn', 'external-url', lineOf(index), `A URL string (${url.length > 60 ? `${url.slice(0, 57)}...` : url}): the frame can load nothing from a URL.`, `If it is a link, pass it to ${OPEN_LINK}; if it is data or an image, inline it.`);
+        }
+    }
+    // The one rule that reads the text as the HTML parser would, and so reads strings too.
+    if (/<\/script/i.test(commentless)) {
+        const at = asciiLower(commentless).indexOf('</script');
+        out.add('warn', 'element-close', lineOf(at), 'The text contains a closing script tag, which can end the script early depending on how the frame embeds it.', 'Write it as <\\/script> inside a string.');
+    }
+}
+const RAW_TEXT_ELEMENTS = new Set(['script', 'style', 'textarea', 'title']);
+function attr(tag, name) {
+    for (const a of tag.attrs) {
+        if (a.name === name) {
+            return a.value;
+        }
+    }
+    return undefined;
+}
+/** Walk the markup with indexOf: tags, their attributes, and the text of raw-text elements. */
+function walkHtml(html) {
+    const lower = asciiLower(html);
+    const tags = [];
+    const raws = [];
+    const n = html.length;
+    let i = 0;
+    while (i < n) {
+        const lt = html.indexOf('<', i);
+        if (lt === -1) {
+            break;
+        }
+        const next = html.charCodeAt(lt + 1);
+        if (html.startsWith('<!--', lt)) {
+            const end = html.indexOf('-->', lt + 4);
+            i = end === -1 ? n : end + 3;
+            continue;
+        }
+        if (next === 33 || next === 63 || next === 47) {
+            const end = html.indexOf('>', lt + 2);
+            i = end === -1 ? n : end + 1;
+            continue;
+        }
+        if (!isAsciiLetter(next)) {
+            i = lt + 1;
+            continue;
+        }
+        let p = lt + 1;
+        while (p < n && !isSpace(html.charCodeAt(p)) && html[p] !== '>' && html[p] !== '/') {
+            p += 1;
+        }
+        const tag = { name: lower.slice(lt + 1, p), index: lt, attrs: [] };
+        while (p < n) {
+            while (p < n && (isSpace(html.charCodeAt(p)) || html[p] === '/')) {
+                p += 1;
+            }
+            if (p >= n) {
+                break;
+            }
+            if (html[p] === '>') {
+                p += 1;
+                break;
+            }
+            const nameStart = p;
+            while (p < n && !isSpace(html.charCodeAt(p)) && !'=>/'.includes(html.charAt(p))) {
+                p += 1;
+            }
+            const name = lower.slice(nameStart, p);
+            while (p < n && isSpace(html.charCodeAt(p))) {
+                p += 1;
+            }
+            let value = '';
+            if (html[p] === '=') {
+                p += 1;
+                while (p < n && isSpace(html.charCodeAt(p))) {
+                    p += 1;
+                }
+                const quote = html.charAt(p);
+                if (quote === '"' || quote === "'") {
+                    const end = html.indexOf(quote, p + 1);
+                    value = html.slice(p + 1, end === -1 ? n : end);
+                    p = end === -1 ? n : end + 1;
+                }
+                else {
+                    const valueStart = p;
+                    while (p < n && !isSpace(html.charCodeAt(p)) && html[p] !== '>') {
+                        p += 1;
+                    }
+                    value = html.slice(valueStart, p);
+                }
+            }
+            if (name) {
+                tag.attrs.push({ name, value });
+            }
+            else if (p === nameStart) {
+                p += 1;
+            }
+        }
+        tags.push(tag);
+        i = p;
+        if (RAW_TEXT_ELEMENTS.has(tag.name)) {
+            const close = lower.indexOf(`</${tag.name}`, p);
+            const end = close === -1 ? n : close;
+            raws.push({ tag, content: html.slice(p, end), contentIndex: p });
+            i = end;
+        }
+    }
+    return { tags, raws };
+}
+const RESOURCE_ATTRIBUTES = ['src', 'srcset', 'poster', 'data', 'background', 'xlink:href', 'href'];
+/** The first URL of each `srcset` candidate. */
+function srcsetUrls(value) {
+    return value
+        .split(',')
+        .map((candidate) => candidate.trim().split(/\s+/)[0])
+        .filter(Boolean);
+}
+const STYLESHEET_LIKE_REL = /\b(?:stylesheet|preload|modulepreload|prefetch|icon|manifest)\b/i;
+function scanTag(tag, line, out) {
+    const name = tag.name;
+    if (name === 'base') {
+        out.add('error', 'base-element', line, 'The base element is blocked: base-uri is none in the frame.', 'Remove it; use absolute data: URIs or none at all.');
+        return;
+    }
+    if (name === 'meta') {
+        const equiv = asciiLower(attr(tag, 'http-equiv') ?? '').trim();
+        if (equiv === 'refresh') {
+            out.add('error', 'navigation', line, 'A meta refresh navigates the frame itself: the host allows one load and removes the widget on the second.', 'Remove it; update the page with script instead.');
+        }
+        return;
+    }
+    if (name === 'form') {
+        const action = attr(tag, 'action');
+        if (action !== undefined && action.trim() !== '') {
+            out.add('error', 'form-action', line, 'A form with an action: form-action is none in the frame, so submitting is blocked.', 'Drop the action and handle the input and change events in script.');
+        }
+    }
+    if (name === 'object' || name === 'embed' || name === 'applet') {
+        out.add('error', 'plugin-element', line, `<${name}>: object-src is none in the frame, so it does not load.`, 'Use inline SVG, canvas or markup.');
+        return;
+    }
+    if (name === 'iframe' || name === 'frame') {
+        const src = attr(tag, 'src') ?? '';
+        const external = classifyUrl(src) === 'external';
+        out.add(external ? 'error' : 'warn', 'nested-frame', line, external
+            ? `<${name}> of a URL: frame-src is none in the frame, so it is blocked.`
+            : `<${name}>: frame-src is none in the frame; nested frames are not supported.`, 'Render the content directly in this widget.');
+        return;
+    }
+    const formaction = attr(tag, 'formaction');
+    if (formaction !== undefined && formaction.trim() !== '') {
+        out.add('error', 'form-action', line, 'formaction: form-action is none in the frame, so submitting is blocked.', 'Handle the click in script.');
+    }
+    if (name === 'a' || name === 'area') {
+        const href = attr(tag, 'href');
+        if (href !== undefined && classifyUrl(href) === 'external') {
+            out.add('warn', 'external-link', line, 'A link to a URL: following it would navigate the frame itself, and the host removes the widget on that second load.', `Use a button that calls ${OPEN_LINK}.`);
+        }
+        const target = asciiLower(attr(tag, 'target') ?? '').trim();
+        if (target === '_blank' || target === '_top' || target === '_parent') {
+            out.add('warn', 'popup', line, `target="${target}": the sandbox has no allow-popups or top navigation, so nothing opens.`, `Use ${OPEN_LINK}.`);
+        }
+        return;
+    }
+    const rel = attr(tag, 'rel') ?? '';
+    for (const attribute of RESOURCE_ATTRIBUTES) {
+        const value = attr(tag, attribute);
+        if (value === undefined) {
+            continue;
+        }
+        if (attribute === 'href' && name === 'link' && !STYLESHEET_LIKE_REL.test(rel)) {
+            continue;
+        }
+        if (attribute === 'data' && name !== 'object') {
+            continue;
+        }
+        for (const url of attribute === 'srcset' ? srcsetUrls(value) : [value]) {
+            const kind = classifyUrl(url);
+            if (kind === 'external' && !isNamespaceUrl(url)) {
+                out.add('error', 'external-resource', line, `<${name} ${attribute}> loads from a URL: the frame allows no script, stylesheet, image or font from a URL.`, 'Inline it: markup, inline SVG, canvas, or a data: URI. Libraries come only by bare name through a dynamic import.');
+            }
+            else if (kind === 'relative' && name !== 'a' && attribute !== 'href') {
+                out.add('warn', 'relative-url', line, `<${name} ${attribute}> is a relative path, which has nothing to resolve against inside the frame.`, 'Inline it or use a data: URI.');
+            }
+        }
+    }
+}
+function isClassicScript(tag) {
+    const type = asciiLower(attr(tag, 'type') ?? '')
+        .trim()
+        .split(';')[0];
+    return (type === '' ||
+        type === 'text/javascript' ||
+        type === 'application/javascript' ||
+        type === 'text/ecmascript' ||
+        type === 'application/ecmascript');
+}
+function isScannableScript(tag) {
+    return isClassicScript(tag) || asciiLower(attr(tag, 'type') ?? '').trim() === 'module';
+}
+function scanHtmlInto(html, out) {
+    const masked = maskHtmlComments(html);
+    const starts = lineStarts(html);
+    const { tags, raws } = walkHtml(masked);
+    const inlineScripts = [];
+    for (const tag of tags) {
+        scanTag(tag, lineAt(starts, tag.index), out);
+        const style = attr(tag, 'style');
+        if (style) {
+            scanCssInto(style, lineAt(starts, tag.index), out);
+        }
+    }
+    for (const raw of raws) {
+        const line = lineAt(starts, raw.contentIndex);
+        if (raw.tag.name === 'style') {
+            scanCssInto(raw.content, line, out);
+        }
+        else if (raw.tag.name === 'script' && isScannableScript(raw.tag)) {
+            scanJsInto(raw.content, line, out);
+            if (isClassicScript(raw.tag) && raw.content.trim() !== '') {
+                inlineScripts.push({ content: raw.content, line });
+            }
+        }
+    }
+    return inlineScripts;
+}
+// ── entry point ─────────────────────────────────────────────────────────────
+/** Findings per (section, code) before the rest collapse into one line. */
+const MAX_PER_CODE = 5;
+const SEVERITY_RANK = { error: 2, warn: 1 };
+function tidy(findings) {
+    // One finding per (section, line, code), the most severe kept: two rules that
+    // recognise the same call must not report it twice.
+    const best = new Map();
+    for (const f of findings) {
+        const key = `${f.section}:${f.line}:${f.code}`;
+        const held = best.get(key);
+        if (!held || SEVERITY_RANK[f.severity] > SEVERITY_RANK[held.severity]) {
+            best.set(key, f);
+        }
+    }
+    // A generic URL warning on a line that already has the specific error is noise.
+    const resourceLines = new Set([...best.values()]
+        .filter((f) => f.code === 'external-resource')
+        .map((f) => `${f.section}:${f.line}`));
+    const kept = [...best.values()].filter((f) => !(f.code === 'external-url' && resourceLines.has(`${f.section}:${f.line}`)));
+    kept.sort((a, b) => a.section.localeCompare(b.section) || a.line - b.line);
+    const seen = new Map();
+    const out = [];
+    const dropped = new Map();
+    for (const f of kept) {
+        const key = `${f.section}:${f.code}`;
+        const count = (seen.get(key) ?? 0) + 1;
+        seen.set(key, count);
+        if (count <= MAX_PER_CODE) {
+            out.push(f);
+        }
+        else {
+            const entry = dropped.get(key);
+            if (entry) {
+                entry.count += 1;
+                if (SEVERITY_RANK[f.severity] > SEVERITY_RANK[entry.severity]) {
+                    entry.severity = f.severity;
+                }
+            }
+            else {
+                dropped.set(key, { ...f, count: 1 });
+            }
+        }
+    }
+    for (const entry of dropped.values()) {
+        const { count, ...rest } = entry;
+        out.push({ ...rest, message: `...and ${count} more of the same kind in ${rest.section}.` });
+    }
+    return out;
+}
+/**
+ * Scan one widget's three sections. Pure and total: it never throws and reads
+ * only the strings it is given; the cost is linear in their length, which the
+ * caller has already bounded by the widget limits.
+ */
+function scanWidgetSource(source) {
+    const css = new Collector('css');
+    const html = new Collector('html');
+    const js = new Collector('js');
+    scanCssInto(source.css, 1, css);
+    const inlineScripts = scanHtmlInto(source.html, html);
+    scanJsInto(source.js, 1, js);
+    return {
+        findings: tidy([...css.findings, ...html.findings, ...js.findings]),
+        inlineScripts,
+    };
+}