hbengine 0.2.3

package/engine-conformance/analyse.mjs

@@ -0,0 +1,4458 @@
+/**
+ * The upload's code analyser: every script of a bundle parsed (acorn, vendored
+ * under vendor/acorn/) and walked, so what a game's JavaScript reaches is read
+ * from its syntax rather than matched by a pattern that `window['ev'+'al']`
+ * defeats. scan.mjs runs it on a worker thread with a deadline (bundle.mjs
+ * reads the bundle as one) and turns what it finds into the report's
+ * findings; this file knows nothing of files.
+ *
+ * Two kinds of finding. A refusal (`fail`) is a way to run code or reach an
+ * API that a reader of the bundle would not see: eval and the Function
+ * constructor in any of their spellings, the global object indexed by a
+ * computed name, names decoded or concatenated at run time, strings handed to
+ * timers, `with`, document.write and other markup-from-text, a <script> built
+ * at run time, code in attributes, dynamic import of anything but a path, an
+ * enumerated global, obfuscation, and — at a markup or URL sink — a value of
+ * which nothing is written down. A warning names, with file and line, what
+ * review must look at: the clock, the time zone, the language, the browser's
+ * identity, long and computed timers, state kept on the device, text fields,
+ * credential words, browser randomness, requests built at run time, frames, a
+ * computed part where a tag or an attribute name goes.
+ *
+ * Soundness, stated plainly. Names are resolved through scopes, so a local
+ * `self` or `parent` is not the window. A name bound to a global — the global
+ * object, document, navigator, WebAssembly, eval, any of them — is that global
+ * wherever it is used: through declarations, later assignments, `||`,
+ * destructuring, a for…of over a written list, an element of a literal, an
+ * IIFE's parameters, a function returning `this` or the global object however
+ * it is called, an element method handing it on (`[window].pop()`,
+ * `Array.of(window)[0]`, `Object.values({ w: window })[0]`), a Map or a
+ * property it was written to, `await`, an export of another file, a global
+ * another classic script set. `this` in a function that is not a method may be
+ * the global object and is judged as such (a direct `this[k] = v` write is
+ * allowed). A frame's window is the global object of another realm of the same
+ * origin; `document.location` is `location`. A method is judged however it is
+ * called: directly, bare (`insertAdjacentHTML(…)`), through `.call`, `.apply`,
+ * `Reflect.apply`, `Function.prototype.call.call`, or through its property
+ * descriptor (`Object.getOwnPropertyDescriptor(Element.prototype,
+ * 'innerHTML').set.call(el, v)` is `el.innerHTML = v`); one kept in a name,
+ * bound or taken as a descriptor is refused, since what it is later called
+ * with is not read. A host object (navigator, location, screen, crypto,
+ * performance, Intl, navigation) by a computed name, also through
+ * Reflect.get, is refused unless every name the key may be is written.
+ *
+ * Strings are read as what their written-down pieces make: a concatenation, a
+ * template, a `.join`, a literal `.replace`, `.split('').reverse()`, `atob` of
+ * a literal are evaluated exactly, wherever they stand (a constant spelled
+ * across pieces in a helper is judged there, as a literal is), and markup, an
+ * attribute name or a URL spelled across pieces is judged as the whole.
+ *
+ * At a markup or URL sink (innerHTML and its kin, href, src, action,
+ * protocol, location, open, setAttribute of a URL) a value is followed to
+ * where it is written (the resolver): through the names it was bound to,
+ * objects and lists written down, the game's own functions (what they return,
+ * their parameters bound to the arguments at their call sites in whatever
+ * file, when every reference to the function is a call), properties and
+ * attributes written and read back, destructuring, imports (the exports of
+ * the file named, a JSON module), globals of other classic scripts, and the
+ * page's own elements (an attribute as written in the page, together with
+ * every write to it the bundle makes). What comes from outside the code is
+ * refused: text decoded or rewritten at run time, a response body, storage,
+ * a cookie, a message's data (addEventListener('message', …) in every
+ * spelling, onmessage), typed text, a field's value, the window's name, the
+ * address (location.*, document.URL, URLSearchParams: the game can write it
+ * and read it back decoded). A value none of whose alternatives is written
+ * down anywhere the analyser reads is refused (markup-source); one written is
+ * read as written, and an alternative not written beside it (`ART[s] || s`, a
+ * call site handing a value the analyser cannot place) stands as a computed
+ * part, named for review. As a URL, the written start of each alternative
+ * fixes its scheme: a start that could still spell javascript: ('java' + x),
+ * a data: document of a type not written, or nothing written at the start is
+ * refused; the page's own address (location.origin + path, location.pathname
+ * …) keeps the page's scheme; `URL.createObjectURL` is a blob: URL; a media
+ * element the code made (new Image(), createElement('img')) loads a resource
+ * and runs nothing. `new URL(rel, base).href` with `rel` written and relative
+ * is on the base's origin; with `rel` not written down it is refused, since
+ * `new URL('javascript:…', base)` keeps its own scheme, base or no base. A
+ * Blob, File or Response typed text/html is read as a page,
+ * application/xhtml+xml and any +xml type as XML (prefixes dropped, a DTD
+ * subset refused); its options followed to where they are written (options
+ * not written down may type anything: refused); a protocol set to javascript
+ * makes a link run.
+ *
+ * Bounds fail closed. The resolver is bounded in depth, steps, nesting,
+ * alternatives and returns; what a bound cuts short is a cut leaf, never
+ * nothing: at a sink it is unread (refused), and where the global object is
+ * asked about, a value cut short is the global object whenever the
+ * expression, or anything its names were given, mentions one
+ * (globalMentioned). A name that once held a global keeps it among its
+ * values whatever it is later given (`let w = window; if (c) w = {}; w[k]`
+ * is refused), and an object whose prototype is the global object
+ * (Object.create(window), { __proto__: window }, setPrototypeOf) is the
+ * global object.
+ *
+ * What the analyser does not follow, stated as limits: the source (fetched,
+ * decoded) of what the game's own functions return — `t(key)` of fetched
+ * i18n inside a template is read by its shape (every text file of the bundle
+ * is walked as data instead), and a decoded or rewritten value reached only
+ * through a return is a computed part; a computed part of a markup string in
+ * text position (`'<b>' + name + '</b>'`), which stands in as a word; an
+ * element the code makes at run time, which no lookup of the page finds (a
+ * write to it reaches reads through its own name only); what a function
+ * handed to code the analyser does not see (an argument, an event handler) is
+ * called with. What it cannot follow it cannot refuse, which is why the
+ * play-tests, the review and the browser's own policy stand behind it.
+ */
+import { parse } from './vendor/acorn/acorn.mjs';
+
+export const LIMITS = Object.freeze({
+    // Names of one or two letters are a minifier's. Measured on what we have:
+    // hand-written games (Bad Cat, Kraken, every template) keep 0–72% of their
+    // names that short (Kraken's art.js, dense Pixi drawing code, is the 72%);
+    // esbuild, terser, Pixi's and lodash's builds are at 98–100%. Line length
+    // is not a signal: Bad Cat is hand-written code with 300–500-character
+    // lines, and identifier entropy does not separate the two populations.
+    shortNameRatio: 0.9,
+    // Below this many names a file is small enough to read whatever its style.
+    minNames: 20,
+    // javascript-obfuscator names everything `_0x<hex>`; three such names is not an accident.
+    hexNames: 3,
+    // Printable ASCII written as `\x..` or `\u....` escapes hides a word from a
+    // reader and does nothing else; eight such strings in one file is a tool's work.
+    escapedStrings: 8,
+    // A timer past this is a delay a play-test does not wait for.
+    longTimerMs: 60 * 1000,
+});
+
+// What each rule means, once; scan.mjs prints the text with the locations.
+export const RULES = Object.freeze({
+    syntax: { level: 'fail', text: 'does not parse as JavaScript (as a module or a script): the analyser cannot read it, and a browser would refuse it' },
+    eval: { level: 'fail', text: 'reaches eval: runs code built from strings' },
+    'function-constructor': { level: 'fail', text: 'reaches the Function constructor (Function, or the .constructor of a function, called, passed on, kept in a name or constructed with arguments): runs code built from strings' },
+    'computed-global': { level: 'fail', text: 'reaches the global object (window, globalThis, self, top, parent, frames, document, or `this` in a function that is not a method) by a name computed at run time, or enumerates it (for…in, Object.keys, { ...window }, { ...rest } = window): what it reaches cannot be read' },
+    'hidden-name': { level: 'fail', text: 'spells a property name at run time (decoded, concatenated, reversed or written in escapes) where a plain name would do: hides what the code reaches' },
+    'string-timer': { level: 'fail', text: 'hands a string to setTimeout or setInterval: code built from strings' },
+    with: { level: 'fail', text: 'uses a with statement: the names inside it resolve at run time' },
+    'document-write': { level: 'fail', text: 'writes markup into a document at run time (document.write): code the analyser never read' },
+    'script-element': { level: 'fail', text: 'builds a <script> at run time (createElement, or a <script> tag in text): its text would run as code the analyser never read; load scripts with <script src> in the page or import() of a path' },
+    'inline-handler': { level: 'fail', text: 'code in an attribute (onclick=…, javascript:, setAttribute("on…")): runs under the page\'s inline allowance where no reader looks; attach handlers from a script' },
+    'hidden-markup': { level: 'fail', text: 'builds markup or a URL from text the analyser cannot read exactly (decoded at run time, rewritten by a pattern, fetched (response.text(), .json()), read from storage, a cookie, the address, a message or a field): what the browser parses the analyser never read; write the markup down, or put text in the page with textContent' },
+    'markup-source': { level: 'fail', text: 'puts text of which nothing is written down into the page, or follows it as an address (innerHTML = x, insertAdjacentHTML(…, x), el.href = x, with x not written anywhere the analyser reads: not a literal, a written object or list, a function of the game returning one, an export of another file, an attribute of the page): what the browser parses the analyser never read; write the markup down, or put text in the page with textContent' },
+    'data-file': { level: 'fail', text: 'a data file the analyser cannot read as the page would: a .json that does not parse, or a file of more than a million values; fix the JSON, or split the file' },
+    'attribute-name': { level: 'fail', text: 'sets or creates an attribute whose name is computed at run time (setAttribute(name, …), toggleAttribute, createAttribute): a handler could be set where no reader looks; write the name down (a for…of over a list of written names is read)' },
+    'method-reference': { level: 'fail', text: 'keeps or binds a method that sets attributes or builds elements or markup (el.setAttribute.bind(el), const f = el.insertAdjacentHTML, document.createElement passed on): what it is later called with is not read; call it where it is used' },
+    'blob-source': { level: 'fail', text: 'builds code or a document from text not written down (new Blob([code], { type: "text/javascript" }) with code computed): code the analyser never read; put a worker in a .js file' },
+    websocket: { level: 'fail', text: 'opens a socket; the game has no network of its own' },
+    webrtc: { level: 'fail', text: 'opens a peer connection (WebRTC); the game has no network of its own' },
+    'service-worker': { level: 'fail', text: 'reaches the service worker registry: a game has no worker that outlives its page' },
+    'import-url': { level: 'fail', text: 'imports code from a URL (http, data, blob): everything a game runs ships in its bundle as a file' },
+    'import-dynamic': { level: 'fail', text: 'imports code from an address built at run time: the analyser cannot read what loads; import a literal path' },
+    'own-server': { level: 'fail', text: 'calls a server of its own (/api/…); saved data goes through engine.state' },
+    'report-path': { level: 'fail', text: "names the policy's report path (/csp-report): only the browser posts there, on a refusal" },
+    'meta-csp': { level: 'fail', text: 'sets its own CSP' },
+    navigation: { level: 'fail', text: 'rewrites where the page points (base, refresh, object/embed, srcdoc)' },
+    'import-map': { level: 'fail', text: 'ships an import map: it redirects module names to addresses the analyser does not follow; import by path' },
+    'data-url-code': { level: 'fail', text: 'loads a script or a frame from a data: or blob: URL, or writes a data: URL whose document the analyser cannot read or that holds a script or a handler: code that is not a file of the bundle' },
+    'svg-script': { level: 'fail', text: 'an SVG or XML document with a <script> (under any namespace prefix): it runs as a page when framed; keep scripts in .js files' },
+    'xml-markup': { level: 'fail', text: 'an XML document the analyser does not read as the browser renders it: an internal DTD subset (<!DOCTYPE … [ … ]>), an <!ENTITY> or <!ATTLIST> declaration (entities and attribute defaults become markup), or an <?xml-stylesheet?>; export the art as plain SVG without a DTD' },
+    minified: { level: 'fail', text: 'minified or obfuscated (nine in ten names are one or two letters) with no source map in the bundle: a reviewer cannot read it; ship readable code, or the .map with sourcesContent beside it' },
+    obfuscated: { level: 'fail', text: 'obfuscated: names or strings written to defeat a reader' },
+    'wasm-source': { level: 'fail', text: 'WebAssembly: a module the analyser cannot read; only a known library\'s released module (by content hash) run by that library\'s own code is accepted (GUIDE §3.6)' },
+    analyser: { level: 'fail', text: 'the code could not be analysed in time' },
+    clock: { level: 'warn', text: 'reads the date or time (Date, Temporal, performance.timeOrigin): review checks nothing depends on the day' },
+    timezone: { level: 'warn', text: 'reads the time zone, or formats by locale (getTimezoneOffset, Intl.DateTimeFormat, toLocale…)' },
+    locale: { level: 'warn', text: "reads the language outside the SDK (navigator.language, Intl): engine.config.locale is the player's language" },
+    fingerprint: { level: 'warn', text: "reads the browser's identity (userAgent, platform, hardware, screen depth, webdriver): review checks no behaviour depends on it" },
+    timer: { level: 'warn', text: 'a timer past 60 s, or with a delay computed at run time: review checks what fires then' },
+    'local-storage': { level: 'warn', text: 'keeps state on the device (localStorage, sessionStorage, indexedDB, cookies): per device only, and a counter kept there can fire after N rounds; anything a player keeps across devices goes through engine.state' },
+    'input-element': { level: 'warn', text: 'creates a text field or a form: a game takes nothing typed but the stake; review checks it asks for no login, password or key' },
+    'element-name': { level: 'warn', text: 'creates an element named at run time (createElement(name)): could be a script or a field; review checks the names' },
+    'markup-parts': { level: 'warn', text: 'builds markup with a computed part where a tag or an attribute name goes, or as an unquoted attribute value (`<${tag}>`, `<img ${attrs}>`, `src=${u}`), or puts a value into the page one of whose alternatives is not written down (`ART[s] || s`): a part carrying an attribute would run; review checks what each part can be' },
+    'credential-words': { level: 'warn', text: 'its text names a password, key or code: review checks the player is asked for none' },
+    'browser-rng': { level: 'warn', text: 'browser randomness (Math.random, crypto.getRandomValues): allowed for visuals only; review checks no outcome comes from it' },
+    network: { level: 'warn', text: "a request whose address is built at run time, or XMLHttpRequest, EventSource, sendBeacon: the policy keeps it on the bundle's origin; review checks what it fetches" },
+    'blob-code': { level: 'warn', text: 'code from a blob (a Worker on a built URL, URL.createObjectURL, a JavaScript Blob): the policy allows blob: workers; review reads what goes in' },
+    'frame-reach': { level: 'warn', text: 'reaches the parent or top frame (parent, top, frames, opener, postMessage to a frame): the shell listens to the SDK only' },
+    navigate: { level: 'warn', text: "moves the page or opens a window (location, document.location, Reflect.set(window, 'location'), navigation.navigate, window.open): the shell's policy blocks it; review checks why it tries" },
+});
+
+const GLOBAL_OBJECTS = new Set(['window', 'globalThis', 'self', 'top', 'parent', 'frames', 'opener']);
+const FRAME_NAMES = new Set(['top', 'parent', 'frames', 'opener']);
+// A Map, not an object: the name looked up is the file's (`window.hasOwnProperty`,
+// a bare `toString()`), and on an object every Object.prototype key is found.
+const NETWORK_CLASSES = new Map(Object.entries({ WebSocket: 'websocket', RTCPeerConnection: 'webrtc', webkitRTCPeerConnection: 'webrtc', mozRTCPeerConnection: 'webrtc', RTCDataChannel: 'webrtc' }));
+const DECODERS = new Set(['atob', 'unescape', 'decodeURIComponent', 'decodeURI']);
+const FINGERPRINT_NAV = new Set(['userAgent', 'userAgentData', 'platform', 'hardwareConcurrency', 'deviceMemory', 'vendor', 'vendorSub', 'productSub', 'appVersion', 'oscpu', 'cpuClass', 'plugins', 'mimeTypes', 'doNotTrack', 'maxTouchPoints', 'connection', 'webdriver', 'getBattery', 'bluetooth', 'usb', 'mediaDevices', 'keyboard', 'pdfViewerEnabled', 'buildID']);
+const FINGERPRINT_SCREEN = new Set(['colorDepth', 'pixelDepth', 'availWidth', 'availHeight', 'availLeft', 'availTop', 'orientation', 'isExtended']);
+const TIMEZONE_METHODS = new Set(['getTimezoneOffset', 'toLocaleDateString', 'toLocaleTimeString', 'toLocaleString', 'resolvedOptions']);
+const ENUMERATORS = new Set(['keys', 'values', 'entries', 'getOwnPropertyNames', 'getOwnPropertyDescriptors', 'getOwnPropertySymbols']);
+const DESCRIPTOR_READERS = new Set(['get', 'getOwnPropertyDescriptor', 'has', 'set', 'deleteProperty', 'defineProperty']);
+const INPUT_TAGS = new Set(['input', 'textarea', 'form', 'select']);
+// How many values an expression may take and still be read one by one
+// (a conditional of conditionals), and how long a chain of pieces is read.
+const EXACT_VALUES = 64;
+const EXACT_PIECES = 4096;
+// How many nodes a walk over one value reads before the value is refused as
+// too large to read (hiddenSource, outside); a hand-written expression is
+// far smaller, and a walk that stopped short would pass what it had not seen.
+const WALK_STEPS = 100000;
+// How many nodes one reading of what a cut value mentions (globalMentioned) visits before what is left is taken
+// to mention anything; a hostile depth is found within a few hundred.
+const MENTION_STEPS = 100000;
+// How many steps the resolver spends on one judged node (the names, members,
+// calls and files a value is followed through) before what is left is a cut;
+// how many alternatives a name may hold; how many returns a function may have;
+// how deep a chain of followed values goes (names and calls: a chain of member
+// reads is read link by link, however long); how many writes a file records;
+// how many elements a page or a file's markup strings may hold before lookups
+// in them are unknown. Past any of them what is left is a cut leaf: unread at
+// a sink (refused), and the global object where it is asked about when what
+// was left mentions one (globalOfLeaves, globalMentioned) — never passed.
+const QUERY_STEPS = 200000;
+const VALUE_NODES = 32;
+const RETURNS = 64;
+const RESOLVE_DEPTH = 96;
+// How deep the resolver's calls may nest in all (resolve, exact, spelled, a
+// function's returns, a list's elements, one calling another): past it a value
+// is unknown. The stack is the bound the depth bounds above cannot give when
+// they compose.
+const NESTING = 320;
+const WRITES = 5000;
+const ELEMENTS = 100000;
+// A data file of more than this many values is not read: refused.
+export const DATA_VALUES = 1000000;
+// A property named .constructor is Function when the object is a function, and
+// the analyser cannot tell a function from a class instance. Reading a static
+// property off it (`this.constructor.DEFAULTS`, `.constructor.name`) reaches
+// nothing that runs code, so any written-down property is allowed but these,
+// which call Function or hand it on; a computed property, a call, `new` with
+// arguments, or keeping it in a name is refused.
+const CONSTRUCTOR_DENIED = new Set(['call', 'apply', 'bind', 'constructor', 'valueOf', '__proto__']);
+// The globals whose members, calls and constructions the rules below judge. A
+// name assigned one of these with no declaration (`w = navigator` in a classic
+// script) is tracked as that global; an assignment of anything else to an
+// undeclared name says nothing (`location = url` stays the real location).
+// The interfaces whose prototype holds a host object's methods and getters: `Document.prototype.write` is document.write.
+const INTERFACE_HOSTS = new Map(Object.entries({ Window: 'window', Document: 'document', HTMLDocument: 'document', Navigator: 'navigator', Location: 'location', Screen: 'screen', Performance: 'performance', Navigation: 'navigation' }));
+const HOST_NAMES = new Set([...GLOBAL_OBJECTS, 'document', 'navigator', 'location', 'navigation', 'screen', 'Intl', 'WebAssembly', 'Math', 'crypto', 'performance', 'URL', 'URLSearchParams', 'Reflect', 'Object', 'String', 'JSON', 'Array', 'Promise', ...DECODERS, 'eval', 'Function', 'Date', 'Temporal', 'localStorage', 'sessionStorage', 'indexedDB', 'caches', 'XMLHttpRequest', 'EventSource', 'open', 'prompt', ...NETWORK_CLASSES.keys(), 'setTimeout', 'setInterval', 'fetch', 'importScripts', 'Worker', 'SharedWorker', 'Blob', 'File', 'Proxy']);
+// Text that comes from outside the code at run time, by the call or the member
+// that reads it: a response body, a storage item, a cookie, the address, a
+// field's value, a message, typed text. Markup or a URL built from it is markup
+// the analyser never read (hidden-markup), however the game names it.
+const BODY_READERS = new Set(['text', 'json', 'arrayBuffer', 'blob', 'formData', 'bytes', 'readText']);
+const OUTSIDE_MEMBERS = new Map(Object.entries({ responseText: 'a response', response: 'a response', value: "a field's value" }));
+const STORAGE_NAMES = new Set(['localStorage', 'sessionStorage']);
+// Calls that hand their argument's text on as their value: JSON.parse(t), String(t), Object.values(o) …
+const PASS_THROUGH = new Map(Object.entries({ JSON: ['parse'], Object: ['values', 'entries', 'keys', 'assign', 'fromEntries', 'freeze', 'create'], Array: ['from', 'of'], Promise: ['resolve', 'all', 'allSettled', 'race', 'any'] }));
+// String methods whose result is made of their receiver's text (and concat's arguments).
+const STRING_METHODS = new Set(['trim', 'trimStart', 'trimEnd', 'replace', 'replaceAll', 'slice', 'substring', 'substr', 'at', 'charAt', 'toString', 'valueOf', 'toLowerCase', 'toUpperCase', 'toLocaleLowerCase', 'toLocaleUpperCase', 'normalize', 'repeat', 'padStart', 'padEnd', 'concat', 'join', 'split', 'reverse', 'sort', 'filter', 'flat', 'then', 'catch', 'finally']);
+// Names a game has no reason to spell at run time. An exact match of what the
+// literal fragments spell (forwards or reversed) is refused; the shorter list
+// is also refused as a word inside a longer spelled string.
+const SENSITIVE_TOKENS = new Set(['eval', 'Function', 'constructor', 'WebAssembly', 'XMLHttpRequest', 'WebSocket', 'RTCPeerConnection', 'RTCDataChannel', 'importScripts', '__proto__', 'getPrototypeOf', 'setPrototypeOf', 'defineProperty', 'getOwnPropertyDescriptor', 'serviceWorker', 'sendBeacon', 'insertAdjacentHTML', 'createContextualFragment', 'innerHTML', 'outerHTML', 'srcdoc', 'writeln', 'cookie', 'localStorage', 'sessionStorage', 'indexedDB', 'globalThis', 'postMessage', 'setTimeout', 'setInterval', 'atob', 'fetch', 'Blob', 'Worker', 'SharedWorker', 'EventSource', 'Reflect', 'Proxy', 'Date', 'Intl', 'navigator', 'crypto', 'document', 'location', 'createElement', 'setAttribute', 'userAgent', 'platform']);
+const SENSITIVE_EXACT = new Set([...SENSITIVE_TOKENS, 'open', 'top', 'self', 'parent', 'window', 'write', 'frames', 'opener', 'import', 'prototype', 'screen', 'apply', 'call', 'bind']);
+
+// The methods whose arguments the rules judge (an attribute's name, markup, a
+// tag): called directly, through .call/.apply/Reflect.apply they are read;
+// kept in a name, bound or passed on they are refused, since what they are
+// later called with is not read.
+const JUDGED_METHODS = new Set(['setAttribute', 'setAttributeNS', 'toggleAttribute', 'createAttribute', 'createAttributeNS', 'insertAdjacentHTML', 'setHTMLUnsafe', 'parseHTMLUnsafe', 'createContextualFragment', 'parseFromString', 'createElement', 'createElementNS']);
+// Properties whose value the page parses as markup, and those whose value is a URL.
+const MARKUP_PROPS = new Set(['innerHTML', 'outerHTML']);
+const URL_PROPS = new Set(['href', 'src', 'action', 'formAction', 'data', 'poster', 'ping']);
+// Array methods that hand each written element to a callback's first parameter.
+const EACH_METHODS = new Set(['forEach', 'map', 'some', 'every', 'filter', 'find', 'findIndex', 'flatMap']);
+// Nodes whose `test` reads a value as true or false.
+const TESTED = new Set(['IfStatement', 'ConditionalExpression', 'WhileStatement', 'DoWhileStatement', 'ForStatement']);
+// MIME types a Blob, a Response or a data: URL is a document or a script under.
+// An XHTML document is XML: read as the browser renders XML (prefixes dropped,
+// a DTD subset refused), not as HTML.
+const JS_MIME = /^\s*(?:text|application)\/(?:x-)?(?:java|ecma)script\b/i;
+const PAGE_MIME = /^\s*text\/html\s*(?:;|$)/i;
+const XML_MIME = /^\s*(?:image\/svg\+xml|text\/xml|application\/xml|application\/xhtml\+xml|[\w.-]+\/[\w.-]+\+xml)\s*(?:;|$)/i;
+// Elements whose src is a resource the browser fetches and never runs: an
+// address not written down there is a stated limit, not code. Only an element
+// made by the code itself is known to be one (new Image(), createElement('img')).
+const MEDIA_TAGS = new Set(['img', 'picture', 'source', 'video', 'audio', 'track']);
+// The written start of a URL the page's address gives: a scheme of the page's
+// (http or https), a path from the root. The rest is computed.
+const ADDRESS_HEADS = new Map(Object.entries({ href: 'http:///', origin: 'http://', protocol: 'http:', pathname: '/', host: '', hostname: '', port: '', search: '', hash: '', username: '', password: '' }));
+const DOCUMENT_ADDRESS = new Map(Object.entries({ URL: 'href', documentURI: 'href', baseURI: 'href', referrer: 'host' }));
+// Element properties that mirror an attribute: a write to one is read back by the other.
+const ATTR_PROPS = new Map(Object.entries({ id: 'id', src: 'src', href: 'href', action: 'action', formAction: 'formaction', title: 'title', alt: 'alt', className: 'class', name: 'name', type: 'type', lang: 'lang', dir: 'dir', rel: 'rel', target: 'target', download: 'download', poster: 'poster', data: 'data', value: 'value', srcdoc: 'srcdoc', innerHTML: 'innerHTML', outerHTML: 'outerHTML', textContent: 'textContent', innerText: 'textContent', text: 'textContent' }));
+// Methods that find elements of the page by id, selector or tag.
+const DOM_LOOKUPS = new Set(['getElementById', 'querySelector', 'querySelectorAll', 'closest', 'getElementsByTagName', 'getElementsByClassName', 'getElementsByName']);
+// Array methods whose result is a list of the receiver's elements (or of a callback's returns).
+const LIST_METHODS = new Set(['filter', 'slice', 'concat', 'reverse', 'sort', 'flat', 'toSorted', 'toReversed', 'toSpliced', 'with', 'splice', 'map', 'flatMap']);
+const ELEMENT_METHODS = new Set(['pop', 'shift', 'at', 'find', 'findLast']);
+// String methods whose result is made of substrings of the receiver (what they
+// cut out stays contiguous, so a handler in the result was a handler in the
+// receiver); any other method (replace, sort, normalize, repeat, padStart …)
+// may spell a word the receiver did not and is a computed part when not exact.
+const SUBSTRING_METHODS = new Set(['trim', 'trimStart', 'trimEnd', 'slice', 'substring', 'substr', 'toString', 'valueOf']);
+// A data: URL: its MIME type, its parameters (;base64 among them) and its body.
+const DATA_URL = /^\s*data:([^,;]*)((?:;[^,;]*)*),([\s\S]*)$/i;
+// Where a computed part of a markup string stands, so the tag walk tells it
+// from a word written down: a private-use character no file writes.
+const MARKER = '';
+const MARKERS = /[\u0000]/g;
+// Where a copy of markup the page already holds stands (el.innerHTML read
+// back): written, judged where it was written, nothing of it to walk here.
+const COPY = '\uE001';
+const COPIES = /\uE001/g;
+
+const IDENTIFIER = /^[A-Za-z_$][\w$]*$/;
+const SCHEME = /^[a-z][a-z0-9+.-]*:/i;
+// A javascript: URL as the browser reads one: tabs and newlines dropped anywhere
+// in it, leading C0 controls and spaces stripped (`\u0001javascript:` runs).
+const isJavascriptUrl = (v) => /^javascript:/i.test(v.replace(/[\t\n\r]/g, '').replace(/^[\u0000- ]+/, ''));
+// A <script> under any namespace prefix: in an XML document `<svg:script>` is
+// a script; a closing `</script>` on its own ends one the page opened.
+const SCRIPT_TAG = /<\/?(?:[\w.-]+:)?script\b/i;
+// A string that holds a tag: walked as markup (analyseHtml), since what it
+// builds through innerHTML and its kin runs as the page's own.
+const MARKUP_IN_TEXT = /<[a-z]/i;
+// Markup rules that read a tag under any namespace prefix (an XHTML document's <h:base>).
+const META_CSP = /<(?:[\w.-]+:)?meta[^>]+http-equiv\s*=\s*["']?content-security-policy/i;
+const NAVIGATION = /<(?:[\w.-]+:)?base\b|<(?:[\w.-]+:)?meta[^>]+http-equiv\s*=\s*["']?refresh|<(?:[\w.-]+:)?(?:object|embed)\b|\bsrcdoc\s*=/i;
+const INPUT_TAG = /<(input|textarea|form|select)\b([^>]*)|\bcontenteditable\b/i;
+const PLAIN_INPUT_TYPES = /\btype\s*=\s*["']?(?:range|checkbox|radio|button|hidden|submit|reset|color|file|image)\b/i;
+const CREDENTIAL_WORDS = /\b(?:password|passcode|passphrase|seed phrase|recovery phrase|private key|secret key|2fa|two-factor|one-time (?:code|password)|verification code|log ?in|sign ?in)\b/i;
+const HEX_NAME = /^_0x[0-9a-f]{4,}$/i;
+const ESCAPE = /\\(?:x[0-9a-fA-F]{2}|u[0-9a-fA-F]{4}|u\{[0-9a-fA-F]+\})/g;
+
+// ---- scopes -----------------------------------------------------------------
+
+class Scope {
+    constructor(parent, fn, thisGlobal, analysis) {
+        this.parent = parent;
+        this.fn = fn; // a `var` declared below lands here
+        this.thisGlobal = thisGlobal; // `this` here may be the global object (a script's top level; a function that is not a method, called bare)
+        this.analysis = analysis ?? parent?.analysis ?? null; // the file this scope belongs to (a value followed into another file is read in that file's scopes)
+        this.dynamic = parent?.dynamic ?? false; // a call's scope (parameters bound at one call site): never cached
+        // name → what the name is bound to, as far as syntax tells:
+        //   { alias: 'name', name }                        a global, by its name ('window' for the global object under any of its names)
+        //   { alias: 'string', spelled, built, decoded, many } a string: what its literal fragments spell; built when not one plain literal
+        //   { alias: 'number', value }                       a number written in literals
+        //   { alias: 'strings', values }                     a list of written strings
+        //   { alias: 'fn', node }                            a function written here (followed for what it returns)
+        //   { alias: 'value', nodes: [{ node, scope }] }     anything else written: the expressions the name was given, read lazily (resolve)
+        //   { alias: 'import', from, name }                  an import: the export of that name from the module `from` names
+        //   { alias: 'module', from }                        a namespace import (import * as ns)
+        //   {}                                               nothing is known
+        // Any of them may carry `hidden`: why the value is text the analyser
+        // never read (decoded, rewritten, fetched, read from storage …), which
+        // refuses it at a markup or URL sink wherever the name is used; and a
+        // parameter carries `param: { fn, index }`, read from the function's
+        // call sites when every reference to the function is a call.
+        this.names = new Map();
+    }
+    declare(name, info) { if (!this.names.has(name)) this.names.set(name, info || {}); }
+    resolve(name) { for (let s = this; s; s = s.parent) { const b = s.names.get(name); if (b) return b; } return null; }
+    fnScope() { let s = this; while (!s.fn) s = s.parent; return s; }
+    root() { let s = this; while (s.parent) s = s.parent; return s; }
+}
+
+const SCOPE_KINDS = new Set(['Program', 'FunctionDeclaration', 'FunctionExpression', 'ArrowFunctionExpression', 'BlockStatement', 'ForStatement', 'ForInStatement', 'ForOfStatement', 'SwitchStatement', 'CatchClause', 'StaticBlock', 'ClassDeclaration', 'ClassExpression']);
+const FUNCTIONS = new Set(['FunctionDeclaration', 'FunctionExpression', 'ArrowFunctionExpression']);
+
+// The names a binding pattern introduces, without recursion (a pattern can be
+// nested as deep as a hostile file likes).
+function patternNames(pattern, out = []) {
+    const stack = [pattern];
+    while (stack.length) {
+        const p = stack.pop();
+        if (!p) continue;
+        switch (p.type) {
+            case 'Identifier': out.push(p); break;
+            case 'ObjectPattern': for (const prop of p.properties) stack.push(prop.type === 'RestElement' ? prop.argument : prop.value); break;
+            case 'ArrayPattern': for (const e of p.elements) stack.push(e); break;
+            case 'AssignmentPattern': stack.push(p.left); break;
+            case 'RestElement': stack.push(p.argument); break;
+            default: break; // a MemberExpression target in a destructuring assignment binds nothing
+        }
+    }
+    return out;
+}
+
+// Which children of a node are expressions, which bind names, which are
+// nothing (a static property name, a label).
+function childCtx(parent, key, ctx) {
+    switch (parent.type) {
+        case 'MemberExpression': return key === 'property' && !parent.computed ? 'skip' : 'expr';
+        case 'Property': return key === 'key' ? (parent.computed ? 'expr' : 'skip') : ctx;
+        case 'MethodDefinition': case 'PropertyDefinition': return key === 'key' && !parent.computed ? 'skip' : 'expr';
+        case 'LabeledStatement': case 'BreakStatement': case 'ContinueStatement': return key === 'label' ? 'skip' : 'expr';
+        case 'ImportSpecifier': case 'ImportDefaultSpecifier': case 'ImportNamespaceSpecifier': return 'skip';
+        case 'ExportSpecifier': return key === 'exported' ? 'skip' : 'expr';
+        case 'MetaProperty': return 'skip';
+        case 'VariableDeclarator': return key === 'id' ? 'bind' : 'expr';
+        case 'FunctionDeclaration': case 'FunctionExpression': case 'ArrowFunctionExpression': return key === 'id' ? 'skip' : key === 'params' ? 'bind' : 'expr';
+        case 'ClassDeclaration': case 'ClassExpression': return key === 'id' ? 'skip' : 'expr';
+        case 'CatchClause': return key === 'param' ? 'bind' : 'expr';
+        case 'AssignmentPattern': return key === 'right' ? 'expr' : ctx;
+        case 'RestElement': case 'ArrayPattern': case 'ObjectPattern': return ctx;
+        default: return 'expr';
+    }
+}
+
+const SKIP_KEYS = new Set(['type', 'start', 'end', 'loc', 'range', 'raw']);
+function* children(node) {
+    for (const key in node) {
+        if (SKIP_KEYS.has(key)) continue;
+        const v = node[key];
+        if (Array.isArray(v)) { for (const c of v) if (c && typeof c.type === 'string') yield [key, c]; }
+        else if (v && typeof v.type === 'string') yield [key, v];
+    }
+}
+
+// ---- expression helpers -----------------------------------------------------
+
+// The expression an optional chain wraps; and the value of `a = x`, which is x,
+// so `(a = window)[k]` indexes the window and `a = b = window` binds both.
+// (A compound assignment's value depends on what the target held: it is read
+// where its operator is known, in globalName, isStringy and spelled.)
+const unchain = (n) => {
+    while (n && (n.type === 'ChainExpression' || (n.type === 'AssignmentExpression' && n.operator === '='))) n = n.type === 'ChainExpression' ? n.expression : n.right;
+    return n;
+};
+
+// The string a literal expression is, or null: a string literal, or a template
+// with no expressions in it.
+function literalString(n) {
+    n = unchain(n);
+    if (!n) return null;
+    if (n.type === 'Literal' && typeof n.value === 'string') return n.value;
+    if (n.type === 'TemplateLiteral' && n.expressions.length === 0) return n.quasis.map((q) => q.value.cooked ?? '').join('');
+    return null;
+}
+
+// A member's property name when it is written down: `.name`, `['name']`,
+// `[0]`, a template with no expressions. null when it is computed at run time.
+function staticKey(member) {
+    if (!member.computed) return member.property.type === 'Identifier' ? member.property.name : null; // a #private name is nobody's global
+    const p = member.property;
+    if (p.type === 'Literal' && (typeof p.value === 'string' || typeof p.value === 'number')) return String(p.value);
+    return literalString(p);
+}
+
+// The member a destructuring property reads: `{ eval: e } = window` reads
+// window.eval, `{ 'eval': e }` and `{ [k]: e }` read it by a computed key (a
+// literal key is read as the literal, like `window['eval']`). The node stands
+// where the property does, so a finding names its line.
+function memberOf(object, prop) {
+    const computed = prop.computed || prop.key.type !== 'Identifier';
+    return { type: 'MemberExpression', object, property: prop.key, computed, optional: false, loc: prop.loc, start: prop.start, end: prop.end };
+}
+
+// A string literal whose source spells an identifier with escapes: `'\x65val'`.
+function escapedIdentifier(n) {
+    return n && n.type === 'Literal' && typeof n.value === 'string' && typeof n.raw === 'string' && n.raw.includes('\\') && IDENTIFIER.test(n.value);
+}
+
+function decodeBase64(s) { try { return Buffer.from(s, 'base64').toString('latin1'); } catch { return null; } }
+
+function fromCharCodes(args) {
+    let out = '';
+    for (const a of args) {
+        if (a.type !== 'Literal' || typeof a.value !== 'number') return null;
+        try { out += String.fromCodePoint(a.value); } catch { return null; }
+    }
+    return out;
+}
+
+// The operands of a chain of `+`, in source order, without recursion: acorn
+// nests `a + b + c + …` to the left, as deep as a file has pieces.
+function plusChain(n) {
+    const out = [];
+    while (n && n.type === 'BinaryExpression' && n.operator === '+') { out.push(n.right); n = n.left; }
+    out.push(n);
+    return out.reverse();
+}
+
+// The elements of an array written down, or null (a spread, or not an array).
+function elementsOf(n) {
+    n = unchain(n);
+    if (!n || n.type !== 'ArrayExpression' || n.elements.some((e) => !e || e.type === 'SpreadElement')) return null;
+    return n.elements;
+}
+
+// Every string of a set joined with every string of another, bounded.
+function product(a, b) {
+    if (!a || !b || a.length * b.length > EXACT_VALUES) return null;
+    const out = [];
+    for (const x of a) for (const y of b) out.push(x + y);
+    return out;
+}
+
+const PERCENT = /%([0-9a-f]{2})/gi;
+function unescapeString(s) { return s.replace(/%u([0-9a-f]{4})/gi, (_, h) => String.fromCharCode(parseInt(h, 16))).replace(PERCENT, (_, h) => String.fromCharCode(parseInt(h, 16))); }
+
+// ---- synthetic nodes ---------------------------------------------------------
+// Values the resolver makes that no parser does: an element of a list, an
+// element of the page, its dataset, the page's own markup, a parsed JSON file,
+// a piece of a string (one of what split or match cut), a literal it made up.
+// Each takes the position of the node it stands for, so a finding has a line.
+const at = (node) => ({ loc: node?.loc, start: node?.start, end: node?.end });
+const literalNode = (value, node) => ({ type: 'Literal', value, raw: null, ...at(node) });
+const elementOf = (list, scope, index, node) => ({ type: 'ElementOf', list, scope, index: index ?? null, ...at(node ?? list) });
+const pieceOf = (of, scope, node) => ({ type: 'Piece', of, scope, ...at(node ?? of) });
+const jsonValue = (value, node) => ({ type: 'JsonValue', value, ...at(node) });
+const pageMarkup = (node) => ({ type: 'PageMarkup', ...at(node) });
+const datasetOf = (element, node) => ({ type: 'Dataset', element, ...at(node) });
+// The leaf an unresolved value is: the node itself in its scope.
+const leaf = (node, scope) => ({ node, scope });
+// The leaf a value the resolver could not read to the end is: a bound (depth,
+// steps, nesting, alternatives, returns) cut it short. A cut is never
+// nothing: at a sink it is unread (refused), and where the global object is
+// asked about it is the global object whenever the expression, or anything
+// its names were given, mentions one (globalMentioned): what was not read
+// may be it. Fail closed, never pass unread.
+const cutLeaf = (node, scope) => ({ node, scope: staticOf(scope), cut: true });
+// The scope a node is read in when asked about again: its own, not a call's (a parameter there is every call
+// site's argument, which holds this call's), so what a cut mentions is read once, whatever call it was cut in.
+const staticOf = (scope) => { let s = scope; while (s && s.dynamic) s = s.parent; return s ?? scope; };
+const CUT_NODE = Object.freeze({ type: 'Cut' });
+const kebab = (s) => s.replace(/[A-Z]/g, (c) => '-' + c.toLowerCase());
+// The leftmost name a member chain stands on (`a.b.c` → 'a'), or '*' for `this`, a call or anything unnamed.
+// A position path: where a value is read — a member by key ({ m: key }, null when computed) or a call ({ c: true }),
+// innermost first, as a list with its memo key and length kept on each link; null is the value itself.
+const posMember = (k, next = null) => ({ m: k, c: false, next, len: (next?.len ?? 0) + 1, key: 'm:' + (k ?? '*') + (next ? '|' + next.key : '') });
+const posCall = (next = null) => ({ m: null, c: true, next, len: (next?.len ?? 0) + 1, key: 'c' + (next ? '|' + next.key : '') });
+const posKey = (pos) => pos?.key ?? '';
+const hasCall = (pos) => { for (let p = pos; p; p = p.next) if (p.c) return true; return false; };
+const baseName = (n) => { let x = unchain(n); while (x && x.type === 'MemberExpression') x = unchain(x.object); return x && x.type === 'Identifier' ? x.name : '*'; };
+// A fresh object the code makes: nothing written to the page's elements reaches it.
+const FRESH = new Set(['ObjectExpression', 'ArrayExpression', 'NewExpression', 'Literal', 'TemplateLiteral', 'BinaryExpression', 'FunctionExpression', 'ArrowFunctionExpression', 'ClassExpression', 'JsonValue']);
+
+// ---- the analysis -----------------------------------------------------------
+
+class Analysis {
+    constructor(lineOffset) {
+        this.lineOffset = lineOffset;
+        this.findings = [];
+        this.wasm = [];
+        this.names = 0; this.short = 0; this.hexNames = 0; this.escapedStrings = 0;
+        this.scopes = new Map();
+        this.paramStrings = new Map(); // a callback → the written strings its first parameter takes
+        this.paramLists = new Map(); // a callback → the list whose elements its first parameter takes ({ list, scope })
+        this.paramHidden = new Map(); // a callback → why its first parameter is text from outside the code (a .then of a fetched body, a message handler)
+        this.thenRead = new WeakSet(); // the .then links of a chain already read from its base
+        this.seen = new Set();
+        // Pass 1 records, read at the end of it: every call (a function's call
+        // sites), every reference to a name (a function referenced otherwise than
+        // called has call sites the analyser cannot see), every write to a
+        // property or an attribute (read back where the same thing is read),
+        // every message handler and .then callback given by name.
+        this.calls = []; this.refs = []; this.writes = []; this.handlers = []; this.handed = []; this.open = new Set();
+        this.sites = new Map(); // a function node → [{ args, scope }]
+        this.escaped = new Set(); // function nodes referenced otherwise than as a callee
+        this.returns = new Map(); // a function node → the expressions it returns
+        this.exports = new Map(); // an exported name → { local } | { from, name }
+        this.stars = []; // `export * from` sources
+        this.imports = []; // the module specifiers imported
+        this.mode = null;
+        // What the resolver may read beyond this file, given by the scan
+        // (analyse-worker) before pass 2: the other modules by specifier, the
+        // pool of the bundle's globals and writes, the pages this code runs in.
+        this.modules = null; // (specifier) → { analysis } | { json } | null
+        this.pool = null; // { globals: Map name → [{ binding, scope }], writes: Map key → [write], written: [PageElement] }
+        this.pages = null; // [{ elements: [PageElement], overflow }]
+        this.written = []; // elements the code writes into the page as markup strings (for the pool)
+        this.writtenOverflow = false;
+        this.resolving = new Set(); // nodes being resolved (a cycle adds nothing)
+        this.fallback = new Set(); // nodes re-entered in a call's scope, being read in their own scope (resolveStatic)
+        this.spreading = new Set(); // object literals being read for their members (a spread of itself adds nothing)
+        this.cache = new Map(); // node → leaves, for a node read in its own scope
+        this.mentioned = new Map(); // node → Map(position → the global its syntax (and its names' values) mentions, or null) (globalMentioned)
+        this.bases = new Map(); // a member chain's node → the name it stands on (baseName, kept: a chain as long as a file is asked at every link)
+        this.globalNames = new Map(); // node → what globalName answered, in its own scope, once the scopes are built
+        this.hopsCut = 0; // how often globalName stopped at its bound (an answer given under one is not kept)
+        this.methodOf = new Map(); // a function node → the object literal it is a method of ({ node, scope }): its `this`
+        this.paramValues = new Map(); // a callback → the expression its first parameter takes ({ node, scope }): a .then's receiver
+        this.steps = 0; // the resolver's budget for the node being judged
+        this.nesting = 0; // how deep the resolver's calls are nested right now
+    }
+    // The resolver's budget: one node judged spends at most QUERY_STEPS steps
+    // following names, members, calls and files; past it nothing is claimed.
+    spend() { return --this.steps < 0; }
+    begin() { this.steps = QUERY_STEPS; }
+    // One more level of the resolver's nesting; false past the cap (the caller gives up).
+    enter() { if (this.nesting >= NESTING) return false; this.nesting++; return true; }
+    leave() { this.nesting--; }
+    // One finding per rule, line and text: a literal walked on its own and
+    // again as a piece of the markup it is joined into is named once.
+    add(rule, node, what) {
+        const line = (node?.loc?.start.line ?? 1) + this.lineOffset;
+        const id = `${rule}\0${line}\0${what}`;
+        if (this.seen.has(id)) return;
+        this.seen.add(id);
+        this.findings.push({ level: RULES[rule].level, rule, line, what });
+    }
+
+    // ---- the resolver -----------------------------------------------------------
+    // The expressions a value can be, as far as syntax tells: through the names
+    // it was bound to (in any of their forms), an import (the export of another
+    // file of the bundle), a global another classic script set, a member of a
+    // written object or list (or of a parsed JSON file, or of an element of the
+    // page: its attributes), a call of a function written here (what it
+    // returns, its parameters bound to the call's arguments), a method of a
+    // written object, an element taken from a list (find, pop, at, for…of, a
+    // callback's parameter), a property or attribute written somewhere and read
+    // back. Returns leaves, { node, scope }: a leaf is a literal, a template, a
+    // concatenation, a function, a host object's member, an element of the
+    // page, a parsed JSON value — or the node itself when nothing further is
+    // read (a value the analyser cannot place). Bounded in steps, depth and
+    // alternatives; a cycle adds nothing; past a bound nothing is claimed.
+    resolve(n, scope, depth = 0) {
+        n = unchain(n);
+        if (!n) return [];
+        if (depth > RESOLVE_DEPTH || this.spend() || !this.enter()) return [cutLeaf(n, scope)];
+        try { return this.resolveIn(n, scope, depth); } finally { this.leave(); }
+    }
+    resolveIn(n, scope, depth) {
+        const cacheable = !scope.dynamic && scope.analysis === this && (n.type === 'Identifier' || n.type === 'MemberExpression' || n.type === 'CallExpression');
+        if (cacheable && this.cache.has(n)) return this.cache.get(n);
+        // (A node asked about again while it is being read is a cycle. In its own scope it adds nothing: `let a =
+        // b, b = a` has no value. In a call's scope the same node is another question each time — `return x` of a
+        // function called inside its own argument, id(id(window)), a function calling itself — and is not read
+        // again in that scope (a recursion would be read to the depth bound, branching at every level): it is read
+        // once in its own scope instead, where a parameter is the argument of every call site, which holds what
+        // this call's does; what that cannot read is a cut: unread, and the global object when what is bound here
+        // mentions one.)
+        if (this.resolving.has(n)) return scope.dynamic ? this.resolveStatic(n, scope, depth) : [];
+        this.resolving.add(n);
+        let out;
+        try { out = this.resolveSwitch(n, scope, depth); } finally { this.resolving.delete(n); }
+        // (Kept even when a bound cut it short: a chain as long as a file is then read once; the node left unread
+        // itself is never kept, and is read afresh when a cut value is read again (globalOfLeaves).)
+        if (cacheable && this.steps > 0) this.cache.set(n, out);
+        return out;
+    }
+    // A node re-entered in a call's scope, read in its own scope (the function's), once.
+    resolveStatic(n, scope, depth) {
+        if (this.fallback.has(n)) return [];
+        let st = scope;
+        while (st && st.dynamic) st = st.parent;
+        if (!st) return [cutLeaf(n, scope)];
+        this.fallback.add(n);
+        let out;
+        try { out = this.resolveSwitch(n, st, depth); } finally { this.fallback.delete(n); }
+        // (A name read as nothing in its own scope — a parameter of a function called from where the analyser does not
+        // see — may hold what this call bound it to: a cut, read from its binding here. Anything else unread in its own
+        // scope — a call of a callee not followed, a member of an object not read into — is as unread here.)
+        return this.unread(out, n) && n.type === 'Identifier' ? [cutLeaf(n, scope)] : out;
+    }
+    resolveSwitch(n, scope, depth) {
+        {
+            switch (n.type) {
+                case 'Identifier': return this.resolveName(n, scope, depth);
+                case 'MemberExpression': case 'CallExpression': return this.resolveChain(n, scope, depth);
+                case 'LogicalExpression': return this.union(this.resolve(n.left, scope, depth + 1), this.resolve(n.right, scope, depth + 1));
+                case 'ConditionalExpression': return this.union(this.resolve(n.consequent, scope, depth + 1), this.resolve(n.alternate, scope, depth + 1));
+                case 'SequenceExpression': return this.resolve(n.expressions[n.expressions.length - 1], scope, depth + 1);
+                case 'AwaitExpression': return this.resolve(n.argument, scope, depth + 1);
+                case 'AssignmentExpression': return n.operator === '=' ? this.resolve(n.right, scope, depth + 1) : [leaf(n, scope)];
+                case 'ElementOf': return this.elementsOf(n.list, n.scope, depth + 1, n.index, n);
+                // `this` in a method of an object literal is that literal (its properties are read through it).
+                case 'ThisExpression': { const m = this.literalOfThis(scope); return m ? [leaf(m.node, m.scope)] : [leaf(n, scope)]; }
+                default: return [leaf(n, scope)];
+            }
+        }
+    }
+    union(...lists) {
+        const seen = new Set(), out = [];
+        let cut = false;
+        for (const list of lists) for (const l of list) {
+            if (l.cut) { if (!cut) { cut = true; out.push(l); } continue; }
+            if (seen.has(l.node)) continue;
+            seen.add(l.node);
+            if (out.length <= EXACT_VALUES * 4) { out.push(l); continue; }
+            // Past the bound the rest is dropped: a leaf left out only makes a value less written, never more —
+            // unless it is, or may resolve to, the global object (a global by name, `this`, a member or a call
+            // not followed): that one is kept, or the value is cut, so nothing dropped passes as not the global.
+            const x = l.node;
+            if (x.type === 'Identifier' || x.type === 'ThisExpression') { if (this.globalOfLeaves([l], null, 0, 0, null) != null) out.push(l); }
+            else if (!cut && (x.type === 'MemberExpression' || x.type === 'CallExpression' || x.type === 'ElementOf' || x.type === 'ObjectExpression' || x.type === 'AwaitExpression')) { cut = true; out.push(cutLeaf(CUT_NODE, null)); }
+        }
+        return out;
+    }
+    // Is this leaf the node itself, unread? (A cut leaf is not unread: it is what was not read, and may be anything.)
+    unread(leaves, n) { return leaves.length === 1 && leaves[0].node === n && !leaves[0].cut; }
+    // The object literal whose method this scope is in: `this` there. An arrow's this is its surroundings'.
+    literalOfThis(scope) {
+        for (let s = scope; s; s = s.parent) {
+            if (!s.fn) continue;
+            const fn = s.node;
+            if (!fn) return null;
+            if (fn.type === 'ArrowFunctionExpression') continue;
+            return (s.analysis ?? this).methodOf.get(fn) ?? null;
+        }
+        return null;
+    }
+
+    resolveName(n, scope, depth) {
+        const b = scope.resolve(n.name);
+        if (!b) {
+            if (n.name === 'undefined') return [leaf(n, scope)];
+            const pool = this.globalsNamed(n.name, scope);
+            return pool.length ? this.union(...pool.map((p) => this.resolveBinding(p.binding, p.scope, n, depth))) : [leaf(n, scope)];
+        }
+        return this.resolveBinding(b, scope, n, depth);
+    }
+    // The bundle's globals of a name: what other classic scripts (or a module's
+    // window.X = …) bound it to, each with the scope it was written in.
+    globalsNamed(name, scope) {
+        const pool = (scope.analysis ?? this).pool;
+        return pool?.globals?.get(name) ?? [];
+    }
+    resolveBinding(b, scope, n, depth) {
+        switch (b.alias) {
+            // (A name given more expressions than are kept (cut) holds, besides them, what was not read.)
+            case 'value': { const out = this.union(...b.nodes.map((v) => this.resolve(v.node, v.scope, depth + 1))); return b.cut ? this.union(out, [cutLeaf(n, scope)]) : out; }
+            case 'fn': return [leaf(b.node, b.scope ?? scope)];
+            // `arguments` of a function: the arguments written at each of its call sites, as a list; unknown
+            // when the function is called from where the analyser does not see (escaped).
+            case 'arguments': {
+                const a = scope.analysis ?? this;
+                const sites = a.sites.get(b.fn);
+                if (!sites || a.escaped.has(b.fn) || (a.open.has(b.fn) && !a.pool)) return [leaf(n, scope)];
+                return this.union(...sites.map((s) => [leaf({ type: 'ArrayExpression', elements: s.args, ...at(n) }, s.scope)]));
+            }
+            case 'import': {
+                const t = this.followExport(b.from, b.name, scope, depth);
+                if (!t) return [leaf(n, scope)];
+                if (t.json !== undefined) return [leaf(jsonValue(t.json, n), scope)];
+                if (t.module) return [leaf({ type: 'Namespace', module: t.module, ...at(n) }, scope)];
+                return t.binding ? this.resolveBinding(t.binding, t.scope, { type: 'Identifier', name: t.local, ...at(n) }, depth + 1) : [];
+            }
+            case 'module': { const m = this.moduleNamed(b.from, scope); return m ? [leaf({ type: 'Namespace', module: m, ...at(n) }, scope)] : [leaf(n, scope)]; }
+            case 'name': {
+                // (The global by its own name, marked as such, at the root: never the identifier asked about, which would read as unread.)
+                if (GLOBAL_OBJECTS.has(b.name) || HOST_NAMES.has(b.name)) return [leaf({ type: 'Identifier', name: b.name, global: true, ...at(n) }, scope.root())];
+                const pool = this.globalsNamed(b.name, scope);
+                return pool.length ? this.union(...pool.map((p) => this.resolveBinding(p.binding, p.scope, n, depth))) : [leaf(n, scope)];
+            }
+            // (A plain string or number another file bound the name to is read as the literal it spells; one built from
+            // pieces, or a list, is read where the name stands — exact() and spelled() read a file's own strings directly.)
+            case 'string': return b.spelled != null && !b.built && !b.many && scope.analysis !== this ? [leaf(literalNode(b.spelled, n), scope)] : [leaf(n, scope)];
+            case 'number': return scope.analysis !== this ? [leaf(literalNode(b.value, n), scope)] : [leaf(n, scope)];
+            case 'strings': return [leaf(n, scope)];
+            default: {
+                if (b.param) return this.resolveParam(b.param, scope, n, depth);
+                return [leaf(n, scope)];
+            }
+        }
+    }
+    // A parameter of a function every reference to which is a call: one of the
+    // arguments written at those calls (or its default when none is given).
+    // A function referenced otherwise (passed on, exported, a method, kept in a
+    // name read elsewhere) is called from where the analyser does not see.
+    resolveParam({ fn, index, pattern, id }, scope, n, depth) {
+        const a = scope.analysis ?? this;
+        const sites = a.sites.get(fn);
+        if (!sites || a.escaped.has(fn) || (a.open.has(fn) && !a.pool)) return [leaf(n, scope)];
+        const fnScope = a.scopes.get(fn) ?? scope;
+        const p = fn.params[index];
+        const out = [];
+        for (const s of sites) {
+            if (s.args.slice(0, index + 1).some((x) => x.type === 'SpreadElement')) return [leaf(n, scope)];
+            const arg = s.args[index];
+            const isUndefined = arg && unchain(arg).type === 'Identifier' && unchain(arg).name === 'undefined';
+            if (pattern) {
+                // `function f({ a, b: [c] })`: what the pattern reads for this name off the argument written there.
+                if (!arg) { out.push(leaf(n, scope)); continue; }
+                const entry = this.patternAliases(pattern, arg, s.scope).find(([pid]) => pid === id);
+                if (!entry || (!entry[1].alias && !entry[1].hidden)) out.push(leaf(n, scope)); else out.push(...this.resolveBinding(entry[1], s.scope, n, depth + 1));
+            }
+            else if ((!arg || isUndefined) && p?.type === 'AssignmentPattern') out.push(...this.resolve(p.right, fnScope, depth + 1));
+            else if (!arg) out.push(leaf(literalNode(undefined, n), scope));
+            else out.push(...this.resolve(arg, s.scope, depth + 1));
+            // (Past the bound union keeps what may be the global object and drops the rest.)
+            if (out.length > EXACT_VALUES * 8) break;
+        }
+        return this.union(out);
+    }
+    moduleNamed(from, scope) { const a = scope.analysis ?? this; return a.modules ? a.modules(from) : null; }
+    // The binding an export of another module names: { binding, scope }, a
+    // namespace re-export { module }, a JSON module { json }, or null when the
+    // module is not in the bundle or has no such export.
+    followExport(from, name, scope, depth, seen = new Set()) {
+        const m = this.moduleNamed(from, scope);
+        if (!m || depth > RESOLVE_DEPTH) return null;
+        if (m.json !== undefined) return name === 'default' ? { json: m.json } : null;
+        const a = m.analysis;
+        if (!a || seen.has(a)) return null;
+        seen.add(a);
+        const e = a.exports.get(name);
+        if (e) {
+            if (e.local != null) { const b = a.root.names.get(e.local); return b ? { binding: b, scope: a.root, local: e.local } : null; }
+            if (e.name === '*') { const inner = this.moduleNamed(e.from, a.root); return inner ? { module: inner } : null; }
+            return this.followExport(e.from, e.name, a.root, depth + 1, seen);
+        }
+        if (name === 'default') return null;
+        for (const star of a.stars) { const t = this.followExport(star, name, a.root, depth + 1, seen); if (t) return t; }
+        return null;
+    }
+    // Every export of a namespace, as leaves.
+    namespaceMembers(module, scope, depth, seen = new Set()) {
+        const a = module.analysis;
+        if (!a || seen.has(a) || depth > RESOLVE_DEPTH) return [];
+        seen.add(a);
+        const out = [];
+        for (const [, e] of a.exports) {
+            if (out.length > EXACT_VALUES * 8) break;
+            if (e.local != null) { const b = a.root.names.get(e.local); if (b) out.push(...this.resolveBinding(b, a.root, { type: 'Identifier', name: e.local }, depth + 1)); }
+            else { const t = this.followExport(e.from, e.name, a.root, depth + 1); if (t?.binding) out.push(...this.resolveBinding(t.binding, t.scope, { type: 'Identifier', name: t.local }, depth + 1)); }
+        }
+        for (const star of a.stars) { const inner = this.moduleNamed(star, a.root); if (inner?.analysis) out.push(...this.namespaceMembers(inner, a.root, depth + 1, seen)); }
+        return this.union(out);
+    }
+
+    resolveChain(n, scope, depth) {
+        // A chain of member reads and method calls (`a.b.c.d`, `[[window]][0][0]`, `f().g().g()`, `p.then(f).then(g)`) is
+        // read from its base up, link by link, without recursing (acorn nests it as deep as the file is long, and the
+        // depth bound is for values followed through names and calls, not for syntax): the base once, then each link's
+        // members, or its call's value, of what the link below gave. Each link read whole is kept, so a chain is read
+        // once however often its links are asked about.
+        const cacheable = !scope.dynamic && scope.analysis === this;
+        const chain = [];
+        let x = n, kept = null;
+        // (Down to the base, or to the first link already read and kept: a chain is walked once, from whichever
+        // end it is asked — the calls of a file are gathered innermost first.)
+        for (;;) {
+            if (x !== n && cacheable && this.cache.has(x)) { kept = this.cache.get(x); break; }
+            if (x.type === 'MemberExpression') { chain.push(x); x = unchain(x.object); continue; }
+            if (x.type === 'CallExpression') { const c = unchain(x.callee); if (c.type === 'MemberExpression') { chain.push(x); x = unchain(c.object); continue; } }
+            break;
+        }
+        chain.reverse();
+        // (The base: a call of a function by name or of a function expression is read as the call it is; anything
+        // else — a name, a literal, `this`, an element — as a value.)
+        let objects = kept ?? (x.type === 'CallExpression' ? this.resolveCalled(x, scope, depth) : this.resolve(x, scope, depth + 1));
+        for (const m of chain) {
+            if (this.spend()) { objects = [cutLeaf(m, scope)]; break; }
+            objects = m.type === 'MemberExpression' ? this.memberStep(m, objects, scope, depth) : this.resolveCalled(m, scope, depth, objects);
+            if (m !== n && cacheable && this.steps > 0) this.cache.set(m, objects);
+        }
+        return objects;
+    }
+    // The global object (or document, location) as a leaf, marked as such.
+    globalLeaf(name, scope, n) { return [leaf({ type: 'Identifier', name, global: true, ...at(n) }, scope.root())]; }
+    // One member read, given what its object resolves to.
+    memberStep(n, objects, scope, depth) {
+        const k = this.key(n, scope);
+        const obj = unchain(n.object);
+        // window.X is the global X.
+        const g = this.globalName(obj, scope, depth + 1);
+        if (g != null && GLOBAL_OBJECTS.has(g)) {
+            // (The object the global object by a cut's over-approximation — a value read short that mentions one — is
+            // not known to be it: its member is cut too, never the global X read as nothing.)
+            const objCut = obj.type !== 'Identifier' && obj.type !== 'ThisExpression' && objects.some((l) => l.cut);
+            if (k == null) return [objCut ? cutLeaf(n, scope) : leaf(n, scope)];
+            // window.self, window.top, frames[0]: the global object itself (of this or another realm of the origin); window.document the document.
+            if (GLOBAL_OBJECTS.has(k) || /^\d+$/.test(k)) return this.globalLeaf('window', scope, n);
+            if (k === 'document') return this.globalLeaf('document', scope, n);
+            const root = scope.root();
+            const b = root.names.get(k);
+            const own = b ? this.resolveBinding(b, root, n, depth) : [];
+            const pool = this.globalsNamed(k, scope).map((p) => this.resolveBinding(p.binding, p.scope, n, depth));
+            const reads = this.readsOf(n, scope).map((w) => this.resolve(w.value, w.scope, depth + 1));
+            const out = this.union(own, ...pool, ...reads, objCut ? [cutLeaf(n, scope)] : []);
+            return out.length ? out : [leaf(n, scope)];
+        }
+        // document.defaultView is the window; document.location the location; a frame's window and document theirs.
+        if (g === 'document' && k === 'defaultView') return this.globalLeaf('window', scope, n);
+        if (g === 'document' && k === 'location') return this.globalLeaf('location', scope, n);
+        if (k === 'contentWindow') return this.globalLeaf('window', scope, n);
+        if (k === 'contentDocument' || k === 'ownerDocument') return this.globalLeaf('document', scope, n);
+        const out = [];
+        for (const w of this.readsOf(n, scope)) out.push(...this.resolve(w.value, w.scope, depth + 1));
+        // An element read (`L[0]`, `L[i]`) reads what was pushed onto the list too.
+        if (k == null || /^\d+$/.test(k)) for (const w of this.elementWrites(obj, scope)) out.push(...this.resolve(w.value, w.scope, depth + 1));
+        let unknown = false;
+        for (const o of objects) {
+            // (A receiver read short: the member is as unread, and the cut — the expression left unread — is kept as it is.)
+            if (o.cut) { out.push({ ...o, pos: posMember(k, o.pos ?? null) }); continue; }
+            const m = this.membersOf(o, k, n, scope, depth);
+            if (m === null) unknown = true; else out.push(...m);
+        }
+        if (unknown || (!objects.length && !out.length)) out.push(leaf(n, scope));
+        return this.union(out);
+    }
+    // The values a member of a leaf can be; null when the leaf is something the
+    // analyser does not read into (the member stands as itself); a cut leaf
+    // when a bound stopped the reading.
+    membersOf(o, k, n, scope, depth) {
+        // (Bounded as resolve is: an object spreading itself, `{ ...T, a }` bound to T, would be read without end.)
+        if (depth > RESOLVE_DEPTH || this.spend() || !this.enter()) return [cutLeaf(n, scope)];
+        try { return this.membersIn(o, k, n, scope, depth); } finally { this.leave(); }
+    }
+    membersIn(o, k, n, scope, depth) {
+        const x = o.node;
+        // (An object read for its members while it is being read for them — `{ ...T, a }` bound to T, read through
+        // its own spread — is a cycle: it adds nothing, and is not read to the depth bound.)
+        if (x.type === 'ObjectExpression') { if (this.spreading.has(x)) return []; this.spreading.add(x); try { return this.membersInObject(x, o, k, n, scope, depth); } finally { this.spreading.delete(x); } }
+        switch (x.type) {
+
+            case 'ArrayExpression': {
+                if (k === 'length') return [];
+                if (k != null && !/^\d+$/.test(k)) return [];
+                return this.elementsOf(x, o.scope, depth + 1, k == null ? null : +k);
+            }
+            case 'Namespace': {
+                if (k == null) return this.namespaceMembers(x.module, scope, depth + 1);
+                const t = this.exportOf(x.module, k, scope, depth);
+                if (!t) return [];
+                if (t.json !== undefined) return [leaf(jsonValue(t.json, n), scope)];
+                if (t.module) return [leaf({ type: 'Namespace', module: t.module, ...at(n) }, scope)];
+                return t.binding ? this.resolveBinding(t.binding, t.scope, { type: 'Identifier', name: t.local, ...at(n) }, depth + 1) : [];
+            }
+            case 'JsonValue': {
+                const v = x.value;
+                if (v === null || typeof v !== 'object') return [];
+                if (k == null) return (Array.isArray(v) ? v : Object.values(v)).slice(0, EXACT_VALUES * 4).map((c) => leaf(jsonValue(c, n), scope));
+                if (Array.isArray(v)) return /^\d+$/.test(k) && +k < v.length ? [leaf(jsonValue(v[+k], n), scope)] : [];
+                return Object.prototype.hasOwnProperty.call(v, k) ? [leaf(jsonValue(v[k], n), scope)] : [];
+            }
+            case 'PageElement': return this.elementMember(x, k, n, scope);
+            case 'Identifier': {
+                // A list of written strings, by index.
+                const b = o.scope.resolve(x.name);
+                if (b?.alias !== 'strings') return null;
+                if (k == null) return b.values.map((v) => leaf(literalNode(v, n), scope));
+                if (/^\d+$/.test(k)) return +k < b.values.length ? [leaf(literalNode(b.values[+k], n), scope)] : [];
+                return k === 'length' ? [] : null;
+            }
+            case 'Dataset': {
+                if (k == null) return [...x.element.attrs].filter(([a]) => a.startsWith('data-')).map(([, v]) => leaf(literalNode(v, n), scope));
+                const v = x.element.attrs.get('data-' + kebab(k));
+                return v == null ? [] : [leaf(literalNode(v, n), scope)];
+            }
+            case 'CallExpression': {
+                const c = unchain(x.callee);
+                if (c.type !== 'MemberExpression') return null;
+                const ok = this.key(c, o.scope), oo = this.globalName(c.object, o.scope, depth + 1);
+                if (oo === 'Object' && ok === 'fromEntries') {
+                    const out = [];
+                    for (const pair of this.elementsOf(x.arguments[0], o.scope, depth + 1, null)) {
+                        if (pair.node.type !== 'ArrayExpression') { out.push(leaf(n, scope)); continue; }
+                        const [key, value] = pair.node.elements;
+                        if (!value || value.type === 'SpreadElement') { out.push(leaf(n, scope)); continue; }
+                        if (k != null && key) { const kv = this.exact(key, pair.scope); if (kv && !kv.includes(k)) continue; }
+                        out.push(...this.resolve(value, pair.scope, depth + 1));
+                    }
+                    return out;
+                }
+                if (oo === 'Object' && ['assign', 'freeze', 'seal', 'preventExtensions', 'create'].includes(ok)) {
+                    const out = [];
+                    for (const a of x.arguments.slice(0, ok === 'assign' ? undefined : 1)) for (const s of this.resolve(a, o.scope, depth + 1)) { const m = this.membersOf(s, k, n, scope, depth + 1); if (m === null) out.push(leaf(n, scope)); else out.push(...m); }
+                    return out;
+                }
+                if (oo === 'JSON' && ok === 'parse') {
+                    const s = this.exact(x.arguments[0], o.scope);
+                    if (!s || s.length !== 1) return null;
+                    try { return this.membersOf(leaf(jsonValue(JSON.parse(s[0]), n), scope), k, n, scope, depth + 1); } catch { return []; }
+                }
+                // A list (Array.of(window)[0], Object.values(o)[0], list.filter(f)[i]): its elements.
+                if ((k == null || /^\d+$/.test(k)) && ((oo === 'Array' && (ok === 'from' || ok === 'of')) || (oo === 'Object' && (ok === 'values' || ok === 'keys' || ok === 'entries')) || (oo === 'Promise' && ok === 'all') || LIST_METHODS.has(ok) || ok === 'split' || ok === 'querySelectorAll' || ok === 'getElementsByTagName' || ok === 'getElementsByClassName')) {
+                    const els = this.elementsOf(x, o.scope, depth + 1, k == null ? null : +k);
+                    return els.length === 1 && els[0].node.type === 'ElementOf' && els[0].node.list === x && !els[0].cut ? null : els;
+                }
+                return null;
+            }
+            default: return null;
+        }
+    }
+    membersInObject(x, o, k, n, scope, depth) {
+        // The members under this key, in source order: a later property of the same written name
+        // overrides what came before it (a spread among them); a spread of an object not read into
+        // (unknown) makes the member unknown beside what is written, unless a property of that name
+        // follows it. Bounded in leaves (union cuts past the bound).
+        let out = [], unknown = false;
+        const take = (list) => { for (const l of list) out.push(l); return out.length <= EXACT_VALUES * 8; };
+        for (const p of x.properties) {
+            if (out.length > EXACT_VALUES * 8) break;
+            if (p.type === 'SpreadElement') {
+                for (const s of this.resolve(p.argument, o.scope, depth + 1)) {
+                    if (s.cut) { out.push({ ...s, pos: posMember(k, s.pos ?? null) }); continue; }
+                    const m = this.membersOf(s, k, n, scope, depth + 1);
+                    if (m === null) unknown = true; else take(m);
+                }
+                continue;
+            }
+            if (p.type !== 'Property') continue;
+            const name = p.computed ? (() => { const v = this.exact(p.key, o.scope); return v && v.length === 1 ? v[0] : null; })() : p.key.type === 'Identifier' ? p.key.name : String(p.key.value);
+            // `{ __proto__: base }`: the members of base are read through this object (`{ __proto__: window }[k]` is judged by globalName).
+            if (name === '__proto__' && !p.computed && !p.shorthand && p.kind === 'init' && k !== '__proto__') {
+                for (const s of this.resolve(p.value, o.scope, depth + 1)) {
+                    if (s.cut) { out.push({ ...s, pos: posMember(k, s.pos ?? null) }); continue; }
+                    const m = this.membersOf(s, k, n, scope, depth + 1);
+                    if (m === null) unknown = true; else take(m);
+                }
+                continue;
+            }
+            if (k != null && name != null && name !== k) continue;
+            if (p.kind === 'set') continue;
+            // (A property of exactly the name read, written here, is the value from here on: what came before is overridden.)
+            if (k != null && name === k && p.kind === 'init') { out = []; unknown = false; }
+            if (p.kind === 'get') take(this.callReturns(p.value, [], o.scope, depth + 1, o.scope.analysis));
+            else take(this.resolve(p.value, o.scope, depth + 1));
+        }
+        if (unknown) out.push(leaf(n, scope));
+        return this.union(out);
+    }
+    exportOf(module, name, scope, depth) {
+        const a = module.analysis;
+        if (!a) return module.json !== undefined && name === 'default' ? { json: module.json } : null;
+        const e = a.exports.get(name);
+        if (e) {
+            if (e.local != null) { const b = a.root.names.get(e.local); return b ? { binding: b, scope: a.root, local: e.local } : null; }
+            if (e.name === '*') { const inner = this.moduleNamed(e.from, a.root); return inner ? { module: inner } : null; }
+            return this.followExport(e.from, e.name, a.root, depth + 1);
+        }
+        for (const star of a.stars) { const t = this.followExport(star, name, a.root, depth + 1); if (t) return t; }
+        return null;
+    }
+    // An element of the page read by a property: its attribute as written in
+    // the page (a write to it elsewhere is read by readsOf); its dataset; its
+    // markup (the page's own, judged as the page); anything else unknown.
+    elementMember(el, k, n, scope) {
+        if (k == null) return null;
+        if (k === 'dataset') return [leaf(datasetOf(el, n), scope)];
+        if (k === 'innerHTML' || k === 'outerHTML') return [leaf(pageMarkup(n), scope)];
+        const attr = ATTR_PROPS.get(k);
+        if (attr == null || attr === 'textContent') return null;
+        const v = el.attrs.get(attr);
+        return [leaf(literalNode(v ?? '', n), scope)];
+    }
+
+    resolveCalled(n, scope, depth, receiver = null) {
+        const c = unchain(n.callee), args = n.arguments;
+        if (FUNCTIONS.has(c.type)) return this.callReturns(c, args, scope, depth);
+        if (c.type === 'Identifier') {
+            const g = this.globalName(c, scope, depth + 1);
+            if (g != null && (HOST_NAMES.has(g) || g === 'String' || g === 'structuredClone')) return g === 'structuredClone' && args[0] ? this.resolve(args[0], scope, depth + 1) : [leaf(n, scope)];
+            const leaves = this.resolve(c, scope, depth + 1);
+            if (this.unread(leaves, c)) return [leaf(n, scope)];
+            const out = [];
+            for (const l of leaves) { if (FUNCTIONS.has(l.node.type)) out.push(...this.callReturns(l.node, args, scope, depth, l.scope.analysis)); else if (l.cut) out.push({ ...l, pos: posCall(l.pos ?? null) }); else out.push(leaf(n, scope)); }
+            return this.union(out);
+        }
+        if (c.type !== 'MemberExpression') return [leaf(n, scope)];
+        const k = this.key(c, scope), o = this.globalName(c.object, scope, depth + 1);
+        // Object.values/keys/entries, Array.from/of, Promise.resolve/all: lists and pass-throughs (elementsOf reads the lists).
+        if (o === 'Promise' && (k === 'resolve' || k === 'reject') && args[0]) return this.resolve(args[0], scope, depth + 1);
+        if (o === 'Object' && (k === 'values' || k === 'keys' || k === 'entries' || k === 'fromEntries' || k === 'assign' || k === 'freeze' || k === 'create')) return [leaf(n, scope)];
+        if (o === 'JSON' && k === 'parse') { const s = this.exact(args[0], scope); if (s && s.length === 1) { try { return [leaf(jsonValue(JSON.parse(s[0]), n), scope)]; } catch { return []; } } return [leaf(n, scope)]; }
+        // (A lookup of one element is the element; one of several is a list, read by elementsOf.)
+        if (o === 'document' && DOM_LOOKUPS.has(k)) return k === 'querySelectorAll' || k.startsWith('getElementsBy') ? [leaf(n, scope)] : this.lookups(n, k, args, scope, depth);
+        if (o != null && HOST_NAMES.has(o)) return [leaf(n, scope)];
+        if (k == null) return [leaf(n, scope)];
+        // p.then(cb): what the callback returns (its parameter the chain's value); the chain itself is not descended twice.
+        if (k === 'then' || k === 'catch' || k === 'finally') {
+            const cb = args[0] && unchain(args[0]);
+            if (k === 'then' && cb && FUNCTIONS.has(cb.type)) return this.callReturns(cb, [c.object], scope, depth);
+            return [leaf(n, scope)];
+        }
+        // A method of a written object: what it returns. An element of a list: pop, shift, at, find.
+        const objects = receiver ?? this.resolve(c.object, scope, depth + 1);
+        const out = [];
+        let unknown = this.unread(objects, unchain(c.object)) || !objects.length;
+        const cuts = [];
+        if (!unknown) for (const ob of objects) {
+            if (ob.cut) { cuts.push({ ...ob, pos: posMember(k, posCall(ob.pos ?? null)) }); continue; }
+            // Only a written object (or a namespace) has methods of its own; a list, a string, an element has the runtime's.
+            if (ob.node.type !== 'ObjectExpression' && ob.node.type !== 'Namespace' && !(ob.node.type === 'CallExpression' && this.membersOf(ob, k, n, scope, depth) !== null)) { unknown = true; continue; }
+            const m = this.membersOf(ob, k, n, scope, depth);
+            if (m === null) { unknown = true; continue; }
+            if (!m.length) continue;
+            for (const l of m) { if (FUNCTIONS.has(l.node.type)) out.push(...this.callReturns(l.node, args, scope, depth, l.scope.analysis)); else if (l.cut) cuts.push(l); else unknown = true; }
+        }
+        // (A receiver read short may be anything, a written object among it: its method's value is as unread, the cut kept.)
+        out.push(...cuts);
+        if (!unknown) return this.union(out);
+        // The receiver is not a written object: the method is the runtime's.
+        if (ELEMENT_METHODS.has(k)) { const i = k === 'at' && args[0] ? this.fold(args[0], scope) : null; return this.union(out, this.elementsOf(c.object, scope, depth + 1, i != null && i >= 0 ? i : null)); }
+        if (k === 'get' || k === 'getAttribute' || k === 'getItem') {
+            const reads = this.readsOf(n, scope).map((w) => this.resolve(w.value, w.scope, depth + 1));
+            // new Map([[k, v]]).get(k): the entry written.
+            const entries = [];
+            if (k === 'get') for (const ob of objects) if (ob.node.type === 'NewExpression' && this.globalName(ob.node.callee, ob.scope) === 'Map' && ob.node.arguments[0]) {
+                for (const pair of this.elementsOf(ob.node.arguments[0], ob.scope, depth + 1, null)) {
+                    if (pair.node.type !== 'ArrayExpression' || !pair.node.elements[1] || pair.node.elements[1].type === 'SpreadElement') { entries.push(leaf(n, scope)); continue; }
+                    const want = args[0] ? this.exact(args[0], scope) : null, have = this.exact(pair.node.elements[0], pair.scope);
+                    if (want && have && !want.some((w) => have.includes(w))) continue;
+                    entries.push(...this.resolve(pair.node.elements[1], pair.scope, depth + 1));
+                }
+            }
+            if (k === 'getAttribute') { const name = this.exact(args[0], scope); for (const ob of objects) if (ob.node.type === 'PageElement' && name) for (const a of name) entries.push(leaf(literalNode(ob.node.attrs.get(a.toLowerCase()) ?? '', n), scope)); }
+            const all = this.union(out, ...reads, entries);
+            return all.length ? all : [leaf(n, scope)];
+        }
+        if (DOM_LOOKUPS.has(k)) return k === 'querySelectorAll' || k.startsWith('getElementsBy') ? this.union(out, [leaf(n, scope)]) : this.union(out, this.lookups(n, k, args, scope, depth));
+        return this.union(out, [leaf(n, scope)]);
+    }
+    // What a function written here returns when called with these arguments:
+    // each of its return expressions, read in a scope of its own where the
+    // parameters are the arguments (a missing one its default). A function
+    // whose scope the analyser has not built yet (a hoisted declaration, in
+    // pass 1) returns nothing it can read. A function calling itself adds
+    // nothing on the second visit: what it returns is made of what the first
+    // visit reads.
+    callReturns(fn, args, callerScope, depth, owner = null) {
+        if (depth > RESOLVE_DEPTH || this.spend() || !this.enter()) return [{ ...cutLeaf(fn, callerScope), pos: posCall() }];
+        try { return this.callReturnsIn(fn, args, callerScope, depth, owner); } finally { this.leave(); }
+    }
+    callReturnsIn(fn, args, callerScope, depth, owner) {
+        owner = owner && owner.scopes.has(fn) ? owner : this.ownerOf(fn, callerScope);
+        const fnScope = owner?.scopes.get(fn);
+        if (!fnScope) return [{ ...cutLeaf(fn, callerScope), pos: posCall() }];
+        // (Under the body's block, where the function's own declarations live; the parameters re-declared here shadow the function's.)
+        const bodyScope = fn.body?.type === 'BlockStatement' ? owner.scopes.get(fn.body) ?? fnScope : fnScope;
+        const cs = new Scope(bodyScope, false, fnScope.thisGlobal, owner);
+        cs.dynamic = true;
+        // `arguments` of this call: the arguments written here, as a list (an arrow's is its surroundings').
+        if (fn.type !== 'ArrowFunctionExpression') cs.declare('arguments', { alias: 'value', nodes: [{ node: { type: 'ArrayExpression', elements: args, ...at(fn) }, scope: callerScope }] });
+        let spread = false;
+        fn.params.forEach((p, i) => {
+            const arg = spread ? null : args[i];
+            if (arg && arg.type === 'SpreadElement') spread = true;
+            const missing = !arg || spread || (unchain(arg).type === 'Identifier' && unchain(arg).name === 'undefined' && !callerScope.resolve('undefined'));
+            const value = (node, s) => ({ alias: 'value', nodes: [{ node, scope: s }] });
+            if (p.type === 'Identifier') cs.declare(p.name, spread ? {} : value(missing ? literalNode(undefined, p) : arg, callerScope));
+            else if (p.type === 'AssignmentPattern' && p.left.type === 'Identifier') cs.declare(p.left.name, spread ? {} : missing ? value(p.right, cs) : value(arg, callerScope));
+            else if (p.type === 'RestElement' && p.argument.type === 'Identifier') cs.declare(p.argument.name, spread ? {} : value({ type: 'ArrayExpression', elements: args.slice(i), ...at(p) }, callerScope));
+            else if (!spread && arg) for (const [id, info] of this.patternAliases(p, arg, callerScope)) cs.declare(id.name, info);
+            else for (const id of patternNames(p)) cs.declare(id.name, {});
+        });
+        const out = [];
+        const returns = this.returnsOf(fn, owner);
+        for (const r of returns) out.push(...this.resolve(r, cs, depth + 1));
+        // (A function of more returns than are read returns, besides them, what was not read.)
+        if (returns.cut) out.push({ ...cutLeaf(fn, callerScope), pos: posCall() });
+        return this.union(out);
+    }
+    // The file a function belongs to: the one whose scopes hold it (its leaf's file, the caller's, this one).
+    ownerOf(fn, scope) { const a = scope.analysis ?? this; return a.scopes.has(fn) ? a : this.scopes.has(fn) ? this : a; }
+    // The expressions a function returns: an arrow's body, the argument of
+    // every return statement in its body (not those of functions inside it).
+    returnsOf(fn, owner = this) {
+        if (owner.returns.has(fn)) return owner.returns.get(fn);
+        const out = [];
+        if (fn.type === 'ArrowFunctionExpression' && fn.expression) out.push(fn.body);
+        else {
+            const stack = [fn.body];
+            let steps = 0;
+            while (stack.length && steps++ < WALK_STEPS && out.length <= RETURNS) {
+                const x = stack.pop();
+                if (!x || FUNCTIONS.has(x.type)) continue;
+                if (x.type === 'ReturnStatement') { if (x.argument) out.push(x.argument); continue; }
+                for (const [, child] of children(x)) stack.push(child);
+            }
+            // Past the bound (too many returns, a body too large to walk) the rest is not read: the first
+            // returns are kept, and the function is marked as returning more than was read (a cut).
+            if (out.length > RETURNS || stack.length) { out.length = Math.min(out.length, RETURNS); out.cut = true; }
+        }
+        owner.returns.set(fn, out);
+        return out;
+    }
+    // The elements a list can hold (the one at `index` when given): of an array
+    // written down (spreads flattened), of a list of written strings, of a parsed
+    // JSON array, of a list method's result (filter, slice, map's callback
+    // returns …), of Object.values/keys/entries, Array.from/of, Promise.all,
+    // of the page's elements a selector finds, of a string split (a Piece of
+    // it). An unknown list has an unknown element.
+    elementsOf(list, scope, depth, index, self = null) {
+        // (The unknown element is one node, however often it is asked for: a leaf that is itself, unread.)
+        const unknown = self ?? elementOf(list, scope, index);
+        const unknownElement = () => [leaf(unknown, scope)];
+        if (!list) return unknownElement();
+        if (depth > RESOLVE_DEPTH || this.spend() || !this.enter()) return [cutLeaf(unknown, scope)];
+        try { return this.elementsIn(list, scope, depth, index, unknownElement, unknown); } finally { this.leave(); }
+    }
+    elementsIn(list, scope, depth, index, unknownElement, unknown) {
+        const leaves = this.resolve(list, scope, depth + 1);
+        const out = [];
+        // What was pushed onto the list (push, unshift, add; `L[i] = v`) is an element of it, at any index.
+        for (const w of this.elementWrites(list, scope)) out.push(...this.resolve(w.value, w.scope, depth + 1));
+        for (const l of leaves) {
+            const x = l.node;
+            // (A list read short holds, besides what was read, elements not read: the cut kept.)
+            if (l.cut) { out.push({ ...l, pos: posMember(index == null ? null : String(index), l.pos ?? null) }); continue; }
+            switch (x.type) {
+                case 'ArrayExpression': {
+                    if (index == null) { for (const e of x.elements) { if (!e) continue; if (e.type === 'SpreadElement') out.push(...this.elementsOf(e.argument, l.scope, depth + 1, null)); else out.push(...this.resolve(e, l.scope, depth + 1)); } break; }
+                    let i = 0, found = false;
+                    for (const e of x.elements) {
+                        if (e && e.type === 'SpreadElement') {
+                            const inner = unchain(e.argument);
+                            if (inner?.type === 'ArrayExpression' && inner.elements.every((y) => y && y.type !== 'SpreadElement')) { if (index < i + inner.elements.length) { out.push(...this.resolve(inner.elements[index - i], l.scope, depth + 1)); found = true; break; } i += inner.elements.length; continue; }
+                            // A spread of unknown length: the element at the index is any of what follows, or of the spread.
+                            out.push(...this.elementsOf(e.argument, l.scope, depth + 1, null));
+                            for (const rest of x.elements.slice(x.elements.indexOf(e) + 1)) { if (!rest) continue; if (rest.type === 'SpreadElement') out.push(...this.elementsOf(rest.argument, l.scope, depth + 1, null)); else out.push(...this.resolve(rest, l.scope, depth + 1)); }
+                            found = true; break;
+                        }
+                        if (i === index) { if (e) out.push(...this.resolve(e, l.scope, depth + 1)); found = true; break; }
+                        i++;
+                    }
+                    if (!found) out.push(leaf(literalNode(undefined, list), scope));
+                    break;
+                }
+                case 'Identifier': {
+                    const b = l.scope.resolve(x.name);
+                    if (b && b.alias === 'strings') { const vs = index == null ? b.values : [b.values[index]]; for (const v of vs) if (v != null) out.push(leaf(literalNode(v, list), scope)); break; }
+                    out.push(...unknownElement());
+                    break;
+                }
+                case 'JsonValue': {
+                    const v = x.value;
+                    if (!Array.isArray(v)) { out.push(...unknownElement()); break; }
+                    const items = index == null ? v.slice(0, EXACT_VALUES * 4) : index < v.length ? [v[index]] : [];
+                    for (const c of items) out.push(leaf(jsonValue(c, list), scope));
+                    break;
+                }
+                case 'CallExpression': {
+                    const c = unchain(x.callee);
+                    if (c.type !== 'MemberExpression') { out.push(...unknownElement()); break; }
+                    const k = this.key(c, l.scope), o = this.globalName(c.object, l.scope, depth + 1);
+                    if (o === 'Object' && k === 'values') { for (const ob of this.resolve(x.arguments[0], l.scope, depth + 1)) { const m = this.membersOf(ob, null, x, l.scope, depth + 1); if (m === null) out.push(...unknownElement()); else out.push(...m); } break; }
+                    if (o === 'Object' && k === 'keys') { for (const ob of this.resolve(x.arguments[0], l.scope, depth + 1)) { if (ob.node.type === 'ObjectExpression' && ob.node.properties.every((p) => p.type === 'Property' && !p.computed)) for (const p of ob.node.properties) out.push(leaf(literalNode(p.key.type === 'Identifier' ? p.key.name : String(p.key.value), x), scope)); else if (ob.node.type === 'JsonValue' && ob.node.value && typeof ob.node.value === 'object') for (const key of Object.keys(ob.node.value)) out.push(leaf(literalNode(key, x), scope)); else out.push(...unknownElement()); } break; }
+                    if (o === 'Object' && k === 'entries') { for (const ob of this.resolve(x.arguments[0], l.scope, depth + 1)) { if (ob.node.type === 'ObjectExpression' && ob.node.properties.every((p) => p.type === 'Property' && !p.computed && p.kind === 'init')) for (const p of ob.node.properties) out.push(leaf({ type: 'ArrayExpression', elements: [literalNode(p.key.type === 'Identifier' ? p.key.name : String(p.key.value), p.key), p.value], ...at(p) }, ob.scope)); else out.push(...unknownElement()); } break; }
+                    if (o === 'Array' && k === 'from') { if (x.arguments[1] && FUNCTIONS.has(unchain(x.arguments[1]).type)) out.push(...this.callReturns(unchain(x.arguments[1]), [elementOf(x.arguments[0], l.scope, null)], l.scope, depth + 1, l.scope.analysis)); else out.push(...this.elementsOf(x.arguments[0], l.scope, depth + 1, index)); break; }
+                    if (o === 'Array' && k === 'of') { for (const a of x.arguments) out.push(...this.resolve(a, l.scope, depth + 1)); break; }
+                    if (o === 'Promise' && (k === 'all' || k === 'allSettled')) { out.push(...this.elementsOf(x.arguments[0], l.scope, depth + 1, index)); break; }
+                    if (o === 'document' && (k === 'querySelectorAll' || k === 'getElementsByTagName' || k === 'getElementsByClassName' || k === 'getElementsByName')) { out.push(...this.lookups(x, k, x.arguments, l.scope, depth)); break; }
+                    if (o != null && HOST_NAMES.has(o)) { out.push(...unknownElement()); break; }
+                    if (k === 'map' || k === 'flatMap') {
+                        const cb = x.arguments[0] && unchain(x.arguments[0]);
+                        if (!cb || !FUNCTIONS.has(cb.type)) { out.push(...unknownElement()); break; }
+                        const rs = this.callReturns(cb, [elementOf(c.object, l.scope, null), literalNode(undefined, x)], l.scope, depth + 1, l.scope.analysis);
+                        if (k === 'flatMap') for (const r of rs) { if (r.node.type === 'ArrayExpression') out.push(...this.elementsOf(r.node, r.scope, depth + 1, null)); else out.push(r); } else out.push(...rs);
+                        break;
+                    }
+                    if (LIST_METHODS.has(k)) { out.push(...this.elementsOf(c.object, l.scope, depth + 1, k === 'slice' || k === 'filter' || k === 'reverse' || k === 'sort' ? null : index)); if (k === 'concat') for (const a of x.arguments) out.push(...this.elementsOf(a, l.scope, depth + 1, null)); break; }
+                    if (k === 'split' || k === 'match' || k === 'matchAll' || k === 'exec') { out.push(leaf(pieceOf(x, l.scope, list), scope)); break; }
+                    if (k === 'querySelectorAll' || k === 'getElementsByTagName' || k === 'getElementsByClassName') { out.push(...this.lookups(x, k, x.arguments, l.scope, depth)); break; }
+                    out.push(...unknownElement());
+                    break;
+                }
+                case 'NewExpression': {
+                    const g = this.globalName(x.callee, l.scope, depth + 1);
+                    if ((g === 'Set' || g === 'Array') && x.arguments[0] && x.arguments.length === 1) { out.push(...this.elementsOf(x.arguments[0], l.scope, depth + 1, index)); break; }
+                    out.push(...unknownElement());
+                    break;
+                }
+                default: out.push(...unknownElement());
+            }
+            if (out.length > EXACT_VALUES * 8) break;
+        }
+        return this.union(out);
+    }
+    // The writes that put an element onto the thing a list read reads: `L.push(v)`,
+    // `L.unshift(v)`, `S.add(v)`, `L[i] = v` with i not written, on the same name
+    // (the same binding or the same global). A write by a written key is a
+    // property, not an element.
+    elementWrites(list, scope) {
+        const x = unchain(list);
+        if (!x || x.type !== 'Identifier') return [];
+        const a = scope.analysis ?? this;
+        const b = scope.resolve(x.name);
+        const global = b ? (b.alias === 'name' && (GLOBAL_OBJECTS.has(b.name) || HOST_NAMES.has(b.name)) ? b.name : null) : x.name;
+        if (!b && !global) return [];
+        const out = [];
+        for (const w of [...(this.writeIndex(a).get('*') ?? []), ...(global != null ? a.pool?.writes?.get('*') ?? [] : [])]) {
+            const wt = this.targetOf(w);
+            if (!wt || wt.path.length || wt.key != null) continue;
+            if ((b && wt.binding === b) || (global != null && wt.global === global)) out.push({ value: w.value, scope: w.scope });
+            if (out.length > EXACT_VALUES * 4) break;
+        }
+        return out;
+    }
+    // This file's writes by key ('*' for a computed key or an element), indexed once.
+    writeIndex(a) {
+        if (!a.writesByKey) { a.writesByKey = new Map(); for (const w of a.writes) { if (!this.targetOf(w)) continue; const key = w.key ?? '*'; if (!a.writesByKey.has(key)) a.writesByKey.set(key, []); a.writesByKey.get(key).push(w); } }
+        return a.writesByKey;
+    }
+    // The elements of the page a lookup finds: by id, by selector (its last
+    // compound), by tag or class. The pages this code runs in are the scan's
+    // (none for a one-file analysis, which knows nothing of them); the
+    // elements the bundle's code writes as markup strings count too, since a
+    // selector finds them once written. Unknown when no page is known, a
+    // page or the written markup overflowed, or the argument is not written.
+    lookups(n, k, args, scope, depth) {
+        const a = scope.analysis ?? this;
+        const unknown = [leaf(n, scope)];
+        if (!a.pages || !a.pages.length || a.pages.some((p) => p.overflow) || a.pool?.writtenOverflow) return unknown;
+        const arg = args[0] ? this.exact(args[0], scope) : null;
+        if (!arg || !arg.length) return unknown;
+        // (The pages' elements indexed once per file; each lookup found once.)
+        if (!a.pageIndex) {
+            const all = [...a.pages.flatMap((p) => p.elements), ...(a.pool?.written ?? [])];
+            const byId = new Map(), marked = [];
+            for (const e of all) { const id = e.attrs.get('id'); if (id == null) continue; if (e.written && id.includes(MARKER)) marked.push(e); else { if (!byId.has(id)) byId.set(id, []); byId.get(id).push(e); } }
+            a.pageIndex = { all, byId, marked, found: new Map() };
+        }
+        const { all, byId, marked, found: cache } = a.pageIndex;
+        const out = [];
+        for (const v of arg) {
+            const key = `${k}\0${v}`;
+            let found = cache.get(key);
+            if (found === undefined) {
+                if (k === 'getElementById') found = [...(byId.get(v) ?? []), ...marked];
+                else if (k === 'getElementsByTagName') found = v === '*' ? all : all.filter((e) => e.tag === v.toLowerCase());
+                else if (k === 'getElementsByClassName') found = all.filter((e) => (e.attrs.get('class') ?? '').split(/\s+/).includes(v) || (e.written && (e.attrs.get('class') ?? '').includes(MARKER)));
+                else if (k === 'getElementsByName') found = all.filter((e) => e.attrs.get('name') === v || (e.written && e.attrs.get('name')?.includes(MARKER)));
+                else found = matchSelector(all, v);
+                cache.set(key, found);
+            }
+            if (found == null) return unknown;
+            // getElementById and querySelector return the first match; the
+            // analyser reads them all (which one is first is the page's business).
+            for (const e of found.slice(0, EXACT_VALUES * 4)) out.push(leaf(e, scope));
+        }
+        // A lookup that finds nothing in the pages: the element is made at run time, unknown.
+        return out.length ? this.union(out) : unknown;
+    }
+
+    // ---- writes read back ----------------------------------------------------
+    // What was written to the thing a member read reads: `o.k = v` / `o.k`,
+    // `el.dataset.x = v` / `el.dataset.x`, `el.setAttribute('x', v)` /
+    // `el.getAttribute('x')`, `m.set(k, v)` / `m.get(k)`, `arr.push(v)` /
+    // `arr[i]`, `history.replaceState(s)` / `history.state`, `window.name = v`
+    // / `name`. A write reaches a read when both are on the same name (the
+    // same binding, or the same global), or when both are on elements of the
+    // page that may be the same element (the same static element, or either
+    // found at run time by a lookup the analyser could not place), with the
+    // same key. A write on a fresh object of the code (new Image(), a literal)
+    // reaches only reads through the same name.
+    readsOf(n, scope) {
+        const read = this.target(n, scope);
+        if (!read) return [];
+        const a = scope.analysis ?? this;
+        const candidates = [];
+        // A read by a computed key reads only what the same name was given (any key); a read by a
+        // written key reads every write of that key, in this file and (the pool) the others.
+        this.writeIndex(a);
+        // (A push, unshift or add writes an element, which an element read (no key) reads; a property read never does.)
+        if (read.key != null) candidates.push(...(a.writesByKey.get(read.key) ?? []));
+        else if (read.binding) for (const list of a.writesByKey.values()) for (const w of list) if (w.target.binding === read.binding) candidates.push(w);
+        if (a.pool?.writes && read.key != null) candidates.push(...(a.pool.writes.get(read.key) ?? []));
+        const out = [];
+        const seen = new Set();
+        // (The read's place is found once; a write's once ever, kept on the write.)
+        read.elements = candidates.length ? this.staticElements(read) : null;
+        for (const w of candidates) {
+            if (seen.has(w) || out.length > EXACT_VALUES * 4) continue;
+            seen.add(w);
+            if (this.reaches(w, read, scope)) out.push({ value: w.value, scope: w.scope });
+        }
+        return out;
+    }
+    // Where a member read or write lands: its root (a binding, a global name,
+    // a DOM lookup or an unknown object) and its key (the last property, an
+    // attribute's name, or null when computed).
+    target(n, scope) {
+        let path = [];
+        let x = unchain(n);
+        let key = null;
+        if (x.type === 'CallExpression') {
+            const c = unchain(x.callee), k = this.key(c, scope);
+            if (c.type !== 'MemberExpression') return null;
+            if (k === 'getAttribute' || k === 'setAttribute' || k === 'getItem' || k === 'setItem') { const v = this.exact(x.arguments[0], scope); key = v && v.length === 1 ? (k.endsWith('Attribute') ? v[0].toLowerCase() : v[0]) : null; }
+            else if (k === 'get' || k === 'set') { const v = this.exact(x.arguments[0], scope); key = v && v.length === 1 ? v[0] : null; }
+            else if (k === 'push' || k === 'unshift' || k === 'add') key = null;
+            else if (k === 'replaceState' || k === 'pushState') key = 'state';
+            else return null;
+            x = unchain(c.object);
+        } else if (x.type === 'MemberExpression') {
+            key = this.key(x, scope);
+            x = unchain(x.object);
+            if (x.type === 'MemberExpression' && this.key(x, scope) === 'dataset') { key = key == null ? null : 'data-' + kebab(key); x = unchain(x.object); }
+            else if (key != null && ATTR_PROPS.has(key)) key = ATTR_PROPS.get(key);
+        } else return null;
+        while (x.type === 'MemberExpression') { if (path.length > 8) return null; path.unshift(this.key(x, scope)); x = unchain(x.object); }
+        // window.X.… is the global X's.
+        if (x.type === 'Identifier' && path.length && GLOBAL_OBJECTS.has(this.globalName(x, scope))) { const name = path.shift(); if (name == null) return { root: null, binding: null, global: null, path, key, scope }; x = { type: 'Identifier', name, ...at(x) }; }
+        if (x.type === 'ThisExpression') return { root: x, binding: null, global: null, path, key, scope, unknown: true };
+        if (x.type === 'Identifier') {
+            const b = scope.resolve(x.name);
+            if (b && (b.alias === 'name' && (GLOBAL_OBJECTS.has(b.name) || HOST_NAMES.has(b.name)))) return { root: x, binding: null, global: b.name, path, key, scope };
+            if (b) return { root: x, binding: b, global: null, path, key, scope };
+            return { root: x, binding: null, global: x.name, path, key, scope };
+        }
+        return { root: x, binding: null, global: null, path, key, scope, unknown: x.type !== 'CallExpression' && x.type !== 'NewExpression' };
+    }
+    reaches(w, read, scope) {
+        const wt = this.targetOf(w);
+        if (!wt) return false;
+        if (w.key != null && read.key != null && w.key !== read.key) return false;
+        if (wt.path.length !== read.path.length || wt.path.some((p, i) => p != null && read.path[i] != null && p !== read.path[i])) return false;
+        if (wt.binding && read.binding && wt.binding === read.binding) return true;
+        if (wt.global != null || read.global != null) return wt.global != null && wt.global === read.global;
+        // Both on things the analyser can place (elements of the page, objects made at one place in the code): they
+        // meet when they share one; two names for the same new Image() meet, two different elements never do.
+        if (w.elements === undefined) w.elements = this.staticElements(wt);
+        const we = w.elements, re = read.elements;
+        if (we && re) return [...we].some((e) => re.has(e));
+        if (wt.binding && read.binding) return false;
+        // Elements of the page: the same element, or either unknown.
+        if (wt.binding || read.binding) {
+            const b = wt.binding ?? read.binding, other = wt.binding ? read : wt;
+            if (!other.unknown && other.root?.type !== 'CallExpression' && other.root?.type !== 'MemberExpression') return false;
+            const leaves = this.resolveBinding(b, wt.binding ? wt.scope : read.scope, wt.binding ? wt.root : read.root, 0);
+            if (leaves.every((l) => FRESH.has(l.node.type) || this.freshCall(l))) return false;
+            return true;
+        }
+        return this.domLike(wt, scope) && this.domLike(read, scope);
+    }
+    // The elements of the page a target stands on, when every leaf is one; null when any is not (unknown, or not an element).
+    staticElements(t) {
+        if (t.unknown || !t.root) return null;
+        const leaves = t.binding ? this.resolveBinding(t.binding, t.scope, t.root, 0) : this.resolve(t.root, t.scope, 0);
+        if (!leaves.length || !leaves.every((l) => l.node.type === 'PageElement' || l.node.type === 'NewExpression' || l.node.type === 'ObjectExpression' || l.node.type === 'ArrayExpression' || this.freshCall(l))) return null;
+        return new Set(leaves.map((l) => l.node));
+    }
+    // A call that makes a fresh element or object: createElement, Object.create, structuredClone.
+    freshCall(l) {
+        if (l.node.type !== 'CallExpression') return false;
+        const c = unchain(l.node.callee);
+        const k = c.type === 'MemberExpression' ? this.key(c, l.scope) : null;
+        return k === 'createElement' || k === 'createElementNS' || k === 'createTextNode' || k === 'createDocumentFragment' || k === 'cloneNode' || k === 'create';
+    }
+    domLike(t, scope) {
+        if (t.unknown) return true;
+        if (t.domLike !== undefined) return t.domLike;
+        const leaves = this.resolve(t.root, t.scope ?? scope, 0);
+        t.domLike = leaves.some((l) => !FRESH.has(l.node.type) && !this.freshCall(l) && l.node.type !== 'Namespace');
+        return t.domLike;
+    }
+
+    // The strings an expression can be, exactly, when every piece is written
+    // down: a literal, a template, a concatenation, a conditional (both
+    // branches), a const bound to a literal or to a list of literals, a
+    // `.join` of written strings, `.split('').reverse()`, a literal `.replace`,
+    // `.toLowerCase`, `atob`/`decodeURIComponent`/`String.fromCharCode` of
+    // literals, a number written in literals. null when any piece is computed.
+    // Bounded in values (EXACT_VALUES) and pieces (EXACT_PIECES); past either
+    // bound the expression is computed, which refuses.
+    exact(n, scope, depth = 0) {
+        n = unchain(n);
+        if (!n) return null;
+        // (A literal is read whatever the budget: it costs nothing to read.)
+        if (n.type === 'Literal') return typeof n.value === 'string' ? [n.value] : typeof n.value === 'number' || typeof n.value === 'boolean' || n.value === null ? [String(n.value)] : n.value === undefined && n.raw === null ? ['undefined'] : null;
+        if (n.type === 'TemplateLiteral' && n.expressions.length === 0) return [n.quasis.map((q) => q.value.cooked ?? '').join('')];
+        if (depth > 64 || this.spend() || !this.enter()) return null;
+        try { return this.exactIn(n, scope, depth); } finally { this.leave(); }
+    }
+    exactIn(n, scope, depth) {
+        switch (n.type) {
+            case 'MemberExpression': case 'AwaitExpression': case 'ElementOf': case 'JsonValue': return this.exactLeaves(n, scope, depth);
+            case 'Piece': case 'PageMarkup': case 'PageElement': case 'Dataset': case 'Namespace': return null;
+            case 'TemplateLiteral': {
+                let out = [''];
+                for (let i = 0; i < n.quasis.length; i++) {
+                    out = product(out, [n.quasis[i].value.cooked ?? '']);
+                    if (i < n.expressions.length) out = product(out, this.exact(n.expressions[i], scope, depth + 1));
+                    if (!out) return null;
+                }
+                return out;
+            }
+            case 'BinaryExpression': {
+                if (n.operator !== '+') return null;
+                const pieces = plusChain(n);
+                if (pieces.length > EXACT_PIECES) return null;
+                let out = [''];
+                for (const p of pieces) { out = product(out, this.exact(p, scope, depth + 1)); if (!out) return null; }
+                return out;
+            }
+            case 'ConditionalExpression': { const a = this.exact(n.consequent, scope, depth + 1), b = this.exact(n.alternate, scope, depth + 1); return a && b && a.length + b.length <= EXACT_VALUES ? [...a, ...b] : null; }
+            case 'LogicalExpression': { const a = this.exact(n.left, scope, depth + 1), b = this.exact(n.right, scope, depth + 1); return a && b && a.length + b.length <= EXACT_VALUES ? [...a, ...b] : null; }
+            case 'SequenceExpression': return this.exact(n.expressions[n.expressions.length - 1], scope, depth + 1);
+            case 'UnaryExpression': case 'Identifier': {
+                if (n.type === 'Identifier') {
+                    const b = scope.resolve(n.name);
+                    if (!b && n.name === 'undefined') return ['undefined'];
+                    if (b && b.alias === 'string' && !b.built && b.spelled != null) return b.spelled.split('\u0000');
+                    if (b && b.alias === 'number') return [String(b.value)];
+                    if (b && (b.alias === 'string' || b.alias === 'strings' || b.alias === 'fn')) return null;
+                    return this.exactLeaves(n, scope, depth);
+                }
+                const v = this.fold(n, scope);
+                return v == null ? null : [String(v)];
+            }
+            case 'CallExpression': return this.exactCall(n, scope, depth) ?? this.exactLeaves(n, scope, depth);
+            default: return null;
+        }
+    }
+    // The exact values of what a value resolves to (resolve), when every
+    // alternative is written down and the alternatives are few.
+    exactLeaves(n, scope, depth) {
+        const leaves = this.resolve(n, scope);
+        if (this.unread(leaves, n)) return n.type === 'ElementOf' ? this.exactElement(n, scope, depth) : null;
+        const out = [];
+        for (const l of leaves) {
+            const v = this.exactLeaf(l.node, l.scope, depth + 1);
+            if (!v) return null;
+            out.push(...v);
+            if (out.length > EXACT_VALUES) return null;
+        }
+        return [...new Set(out)];
+    }
+    exactLeaf(x, s, depth) {
+        switch (x.type) {
+            case 'JsonValue': return typeof x.value === 'string' ? [x.value] : typeof x.value === 'number' || typeof x.value === 'boolean' || x.value === null ? [String(x.value)] : null;
+            case 'ElementOf': return this.exactElement(x, s, depth);
+            case 'Identifier': {
+                const b = s.resolve(x.name);
+                if (!b) return x.name === 'undefined' ? ['undefined'] : null;
+                if (b.alias === 'string' && !b.built && b.spelled != null) return b.spelled.split('\u0000');
+                if (b.alias === 'number') return [String(b.value)];
+                return null;
+            }
+            case 'CallExpression': return this.exactCall(x, s, depth);
+            case 'MemberExpression': case 'Piece': case 'PageMarkup': case 'PageElement': case 'Dataset': case 'Namespace': case 'AwaitExpression': return null;
+            default: return this.exact(x, s, depth);
+        }
+    }
+    exactElement(n, scope, depth) {
+        const list = this.exactList(n.list, n.scope, depth + 1);
+        if (!list) return null;
+        if (n.index != null) return n.index < list.length ? [list[n.index]] : ['undefined'];
+        return list.length && list.length <= EXACT_VALUES ? [...new Set(list)] : null;
+    }
+    // A call of a string function, evaluated exactly; null when it is no such
+    // call (a function of the game's, read by exactLeaves) or not exact.
+    exactCall(n, scope, depth) {
+        {
+            {
+                const c = unchain(n.callee), args = n.arguments;
+                if (args.some((a) => a.type === 'SpreadElement')) return null;
+                if (c.type === 'Identifier') {
+                    const g = this.globalName(c, scope), a = args[0] ? this.exact(args[0], scope, depth + 1) : null;
+                    if (g === 'String') return args[0] ? a : [''];
+                    if (!a || a.length !== 1) return null;
+                    if (g === 'atob') { const d = decodeBase64(a[0]); return d == null ? null : [d]; }
+                    if (g === 'decodeURIComponent' || g === 'decodeURI') { try { return [decodeURIComponent(a[0])]; } catch { return null; } }
+                    if (g === 'unescape') return [unescapeString(a[0])];
+                    return null;
+                }
+                if (c.type !== 'MemberExpression') return null;
+                const k = this.key(c, scope);
+                if (this.globalName(c.object, scope) === 'String' && (k === 'fromCharCode' || k === 'fromCodePoint')) { const s = fromCharCodes(args); return s == null ? null : [s]; }
+                if (k === 'join') {
+                    const list = this.exactList(c.object, scope, depth + 1);
+                    const sep = args[0] ? this.exact(args[0], scope, depth + 1) : [','];
+                    if (!list || !sep || sep.length !== 1) return null;
+                    return [list.join(sep[0])];
+                }
+                const recv = this.exact(c.object, scope, depth + 1);
+                if (!recv) return null;
+                const lit = (i) => { const v = args[i] ? this.exact(args[i], scope, depth + 1) : null; return v && v.length === 1 ? v[0] : null; };
+                const num = (i) => { if (!args[i]) return undefined; const v = this.fold(args[i], scope); return v == null ? null : v; };
+                switch (k) {
+                    case 'toLowerCase': case 'toLocaleLowerCase': return recv.map((s) => s.toLowerCase());
+                    case 'toUpperCase': case 'toLocaleUpperCase': return recv.map((s) => s.toUpperCase());
+                    case 'trim': return recv.map((s) => s.trim());
+                    case 'trimStart': case 'trimEnd': return recv.map((s) => s[k]());
+                    case 'toString': case 'valueOf': return args.length === 0 ? recv : null;
+                    case 'normalize': return args.length === 0 ? recv.map((s) => s.normalize()) : null;
+                    case 'concat': { let out = recv; for (const a of args) { out = product(out, this.exact(a, scope, depth + 1)); if (!out) return null; } return out; }
+                    case 'repeat': { const t = num(0); return t == null || t < 0 || t > 64 ? null : recv.map((s) => s.repeat(t)); }
+                    case 'slice': case 'substring': case 'substr': { const a = num(0), b = num(1); if (a === null || b === null) return null; return recv.map((s) => (b === undefined ? s[k](a ?? 0) : s[k](a ?? 0, b))); }
+                    case 'padStart': case 'padEnd': { const t = num(0), f = args[1] ? lit(1) : ' '; return t == null || t > 4096 || f == null ? null : recv.map((s) => s[k](t, f)); }
+                    case 'replace': case 'replaceAll': {
+                        // A written string replaced by a written string with no `$` pattern is exact; a RegExp is not simulated.
+                        const from = lit(0), to = lit(1);
+                        if (from == null || to == null || to.includes('$') || (args[0] && unchain(args[0]).type !== 'Literal' && this.exact(args[0], scope, depth + 1) == null)) return null;
+                        if (unchain(args[0]).type === 'Literal' && unchain(args[0]).regex) return null;
+                        return recv.map((s) => (k === 'replaceAll' ? s.split(from).join(to) : s.replace(from, to)));
+                    }
+                    default: return null;
+                }
+            }
+        }
+    }
+    // The written elements of an array expression, after `.split(written)`
+    // and `.reverse()` applied to written strings: ['a', 'b'], 'ab'.split(''),
+    // 'ba'.split('').reverse(). Each element one exact string; else null. A
+    // list that is not written here is read through what it resolves to.
+    exactList(n, scope, depth) {
+        n = unchain(n);
+        if (!n || depth > 64 || this.spend()) return null;
+        if (n.type === 'ArrayExpression') {
+            const out = [];
+            for (const e of n.elements) { if (!e || e.type === 'SpreadElement') return this.exactListLeaves(n, scope, depth); const v = this.exact(e, scope, depth + 1); if (!v || v.length !== 1) return null; out.push(v[0]); }
+            return out;
+        }
+        if (n.type === 'Identifier') { const b = scope.resolve(n.name); if (b && b.alias === 'strings') return [...b.values]; if (b && (b.alias === 'string' || b.alias === 'number' || b.alias === 'fn')) return null; return this.exactListLeaves(n, scope, depth); }
+        if (n.type === 'MemberExpression' || n.type === 'AwaitExpression') return this.exactListLeaves(n, scope, depth);
+        if (n.type !== 'CallExpression') return null;
+        const c = unchain(n.callee);
+        if (c.type !== 'MemberExpression') return this.exactListLeaves(n, scope, depth);
+        const k = staticKey(c);
+        if (k === 'reverse' && n.arguments.length === 0) { const l = this.exactList(c.object, scope, depth + 1); return l ? l.reverse() : null; }
+        if (k === 'split') {
+            const recv = this.exact(c.object, scope, depth + 1), sep = n.arguments[0] ? this.exact(n.arguments[0], scope, depth + 1) : null;
+            if (!recv || recv.length !== 1 || !sep || sep.length !== 1 || n.arguments.length > 1) return null;
+            const parts = recv[0].split(sep[0]);
+            return parts.length > EXACT_PIECES ? null : parts;
+        }
+        if (k === 'concat') { let l = this.exactList(c.object, scope, depth + 1); for (const a of n.arguments) { const m = this.exactList(a, scope, depth + 1); if (!l || !m) return null; l = l.concat(m); } return l; }
+        if (k === 'slice' || k === 'filter' || k === 'sort' || k === 'flat' || k === 'map' || k === 'toSorted' || k === 'toReversed' || k === 'values' || k === 'keys' || k === 'from' || k === 'of' || k === 'all') return this.exactListLeaves(n, scope, depth);
+        return null;
+    }
+    // The exact strings of every element a list resolves to (elementsOf), in
+    // the order the analyser reads them, when each is one written string.
+    exactListLeaves(n, scope, depth) {
+        const elements = this.elementsOf(n, scope, 0, null);
+        if (elements.some((l) => l.node.type === 'ElementOf' && l.node.list === n)) return null;
+        const out = [];
+        for (const l of elements) {
+            const v = this.exactLeaf(l.node, l.scope, depth + 1);
+            if (!v || v.length !== 1) return null;
+            out.push(v[0]);
+            if (out.length > EXACT_PIECES) return null;
+        }
+        return out;
+    }
+
+    // Why a markup or URL value cannot be read exactly, when it is built from
+    // text decoded at run time (atob, decodeURI, String.fromCharCode, a
+    // TextDecoder, of something not written down) or from markup rewritten by
+    // a pattern (a RegExp or computed `.replace`, `.sort`, `.map`, `.filter`,
+    // a computed `.slice` of text that holds a tag). null when neither.
+    hiddenSource(n, scope, opts = {}) {
+        return this.rewritten(n, scope) ?? this.outside(n, scope, 0, opts);
+    }
+    // The decoder or pattern rewrite part of hiddenSource, on the expression's own shape.
+    rewritten(n, scope) {
+        const stack = [n];
+        let steps = 0;
+        while (stack.length) {
+            if (steps++ > WALK_STEPS) return 'an expression of too many parts to read';
+            const x = unchain(stack.pop());
+            if (!x || FUNCTIONS.has(x.type)) continue;
+            if (x.type === 'CallExpression') {
+                const c = unchain(x.callee);
+                if (this.isDecoder(x, scope) && this.exact(x, scope) == null) return 'text decoded at run time';
+                if (c.type === 'MemberExpression') {
+                    const k = staticKey(c);
+                    // (A substring, a split, a filter keep the pieces as written: no new word can appear. A map's or sort's callback
+                    // written here is read for what it returns; one not written down may spell anything.)
+                    const rewrites = ['replace', 'replaceAll', 'sort', 'toSorted', 'splice', 'reverse', 'toReversed', 'with', 'normalize'].includes(k) || (['map', 'flatMap', 'filter', 'reduce'].includes(k) && !this.callbackOf(x.arguments[0], scope));
+                    if (rewrites && this.exact(x, scope) == null && this.exactList(x, scope, 0) == null) {
+                        const held = this.spelled(c.object, scope);
+                        // (The page's own markup read back, el.innerHTML.replace(…), is markup too.)
+                        const markupRead = unchain(c.object).type === 'MemberExpression' && MARKUP_PROPS.has(this.key(unchain(c.object), scope));
+                        if (markupRead || (held != null && (MARKUP_IN_TEXT.test(held) || /script|javascript|on[a-z]+\s*=/i.test(held)))) return 'markup rewritten at run time';
+                    }
+                }
+            }
+            for (const [, child] of children(x)) stack.push(child);
+        }
+        return null;
+    }
+
+    // Why a markup or URL value is text from outside the code, when it is: the
+    // value itself, a piece of it, or a name it was bound to is a response body
+    // (`.text()`, `.json()`, `.arrayBuffer()`, `responseText`), a storage item,
+    // a cookie, a field's value, a message's data, typed text (`prompt`). (The
+    // page's address is not: what the game writes there is judged as a URL
+    // sink, and the shell sets the rest.) Read along the value's own shape
+    // (pieces, template parts, branches, `await`, member reads, string methods,
+    // `.then` chains, the calls that hand their argument on), never into a call
+    // of the game's own functions: `t(key)` and `art(sym)` are the game's, and
+    // what they return is a stated limit. null when nothing of the kind.
+    outside(n, scope, depth = 0, opts = {}) {
+        if (depth > 32) return 'an expression nested too deep to read';
+        const stack = [{ node: n, scope }];
+        const push = (list, s) => { for (const e of list) stack.push({ node: e, scope: s }); };
+        const seen = new Set();
+        let steps = 0;
+        while (stack.length) {
+            // An expression too large to read is one the analyser did not read.
+            if (steps++ > WALK_STEPS) return 'an expression of too many parts to read';
+            const { node, scope: s } = stack.pop();
+            const x = unchain(node);
+            if (!x || seen.has(x)) continue;
+            seen.add(x);
+            switch (x.type) {
+                case 'Identifier': {
+                    const b = s.resolve(x.name);
+                    const why = (binding) => (binding.hidden && !(opts.url && binding.addressOnly) ? binding.hidden : null);
+                    if (b && why(b)) return why(b);
+                    if (!b) { for (const p of this.globalsNamed(x.name, s)) { if (why(p.binding)) return why(p.binding); if (p.binding.alias === 'value') for (const v of p.binding.nodes) stack.push(v); } break; }
+                    if (b.alias === 'value' || (b.alias === 'string' && b.addressOnly)) for (const v of b.nodes ?? []) stack.push(v);
+                    else if (b.alias === 'import') { const t = this.followExport(b.from, b.name, s, depth); if (t?.binding) { if (why(t.binding)) return why(t.binding); if (t.binding.alias === 'value') for (const v of t.binding.nodes) stack.push(v); } }
+                    else if (b.param) {
+                        // The arguments written at the call sites: decoded text there is decoded text here.
+                        const a = s.analysis ?? this; const sites = a.sites.get(b.param.fn);
+                        if (sites && !a.escaped.has(b.param.fn) && !(a.open.has(b.param.fn) && !a.pool)) for (const site of sites) { const arg = site.args[b.param.index]; if (!arg) continue; const r = this.rewritten(arg, site.scope); if (r) return r; stack.push({ node: arg, scope: site.scope }); }
+                    }
+                    break;
+                }
+                case 'ElementOf': stack.push({ node: x.list, scope: x.scope }); break;
+                case 'Piece': stack.push({ node: x.of, scope: x.scope }); break;
+                case 'AwaitExpression': case 'UnaryExpression': case 'SpreadElement': stack.push({ node: x.argument, scope: s }); break;
+                case 'BinaryExpression': if (x.operator === '+') push(plusChain(x), s); break;
+                case 'TemplateLiteral': push(x.expressions, s); break;
+                case 'ConditionalExpression': push([x.consequent, x.alternate], s); break;
+                case 'LogicalExpression': push([x.left, x.right], s); break;
+                case 'SequenceExpression': stack.push({ node: x.expressions[x.expressions.length - 1], scope: s }); break;
+                case 'AssignmentExpression': stack.push({ node: x.right, scope: s }); break; // a compound assignment's value holds its right side
+                case 'ArrayExpression': push(x.elements, s); break;
+                case 'ObjectExpression': for (const p of x.properties) stack.push({ node: p.type === 'Property' ? p.value : p.argument, scope: s }); break;
+                case 'MemberExpression': {
+                    const k = this.key(x, s), o = this.globalName(x.object, s);
+                    if (o === 'document' && k === 'cookie') return 'a cookie';
+                    if (o != null && STORAGE_NAMES.has(o)) return 'device storage';
+                    if (k != null && OUTSIDE_MEMBERS.has(k) && !(o != null && (GLOBAL_OBJECTS.has(o) || o === 'document'))) return OUTSIDE_MEMBERS.get(k);
+                    // The address: the game can write it (location.hash =, history.replaceState, a link's fragment) and read it back; what
+                    // it holds is not written in the code. At a URL sink the page's own address keeps its scheme (its shape says so, spelled).
+                    if (o === 'location' && k != null && !opts.url) return "the page's address";
+                    if (o === 'document' && k != null && DOCUMENT_ADDRESS.has(k) && (!opts.url || k === 'referrer')) return k === 'referrer' ? 'the referrer' : "the page's address";
+                    if (k === 'name' && o != null && GLOBAL_OBJECTS.has(o)) return "the window's name";
+                    if (k === 'searchParams') return "the page's address, decoded";
+                    for (const w of this.readsOf(x, s)) { const r = this.rewritten(w.value, w.scope); if (r) return r; stack.push({ node: w.value, scope: w.scope }); }
+                    stack.push({ node: x.object, scope: s });
+                    break;
+                }
+                case 'NewExpression': {
+                    const g = this.globalName(x.callee, s);
+                    if (g === 'URLSearchParams' || g === 'URL') { push(x.arguments, s); break; }
+                    push(x.arguments, s); break; // new Map(Object.entries(fetched)), new String(t)
+                }
+                case 'CallExpression': {
+                    const c = unchain(x.callee);
+                    if (FUNCTIONS.has(c.type)) { for (const r of this.returnsOf(c)) stack.push({ node: r, scope: this.scopes.get(c) ?? s }); break; }
+                    if (c.type === 'Identifier') {
+                        const g = this.globalName(c, s);
+                        if (g === 'prompt') return 'typed text';
+                        if (g === 'String' || g === 'structuredClone') push(x.arguments, s);
+                        break;
+                    }
+                    if (c.type !== 'MemberExpression') break;
+                    const k = this.key(c, s), o = this.globalName(c.object, s);
+                    if (k != null && BODY_READERS.has(k) && x.arguments.length === 0) return 'text fetched or read at run time';
+                    if (o != null && STORAGE_NAMES.has(o)) return 'device storage';
+                    // URLSearchParams.get(), url.searchParams.get(): the address, percent-decoded.
+                    if ((k === 'get' || k === 'getAll' || k === 'entries' || k === 'values' || k === 'forEach') && this.isSearchParams(c.object, s)) return "the page's address, decoded";
+                    // list.map(fn), Array.from(list, fn), list.reduce(fn, init): the value is what the callback returns (its
+                    // parameter is an element of the list, hidden when the list is: read where the parameter is used).
+                    if (k === 'map' || k === 'flatMap' || k === 'reduce' || (o === 'Array' && k === 'from' && x.arguments[1])) {
+                        const cb = this.callbackOf(k === 'from' ? x.arguments[1] : x.arguments[0], s);
+                        if (cb) { const owner = cb.scope.analysis ?? this; for (const r of this.returnsOf(cb.node, owner)) stack.push({ node: r, scope: owner.scopes.get(cb.node) ?? s }); }
+                        else stack.push({ node: c.object, scope: s });
+                        if (k === 'reduce' && x.arguments[1]) stack.push({ node: x.arguments[1], scope: s });
+                        break;
+                    }
+                    if (o != null && PASS_THROUGH.get(o)?.includes(k)) { push(x.arguments, s); break; }
+                    if (k === 'get' || k === 'getAll' || k === 'at' || k === 'getAttribute' || k === 'getItem') { for (const w of this.readsOf(x, s)) { const r = this.rewritten(w.value, w.scope); if (r) return r; stack.push({ node: w.value, scope: w.scope }); } stack.push({ node: c.object, scope: s }); break; } // a Map or a list of fetched values
+                    if (ELEMENT_METHODS.has(k) || LIST_METHODS.has(k) || k === 'match' || k === 'matchAll' || k === 'exec') { stack.push({ node: c.object, scope: s }); if (k === 'concat') push(x.arguments, s); break; }
+                    if (k != null && STRING_METHODS.has(k)) {
+                        stack.push({ node: c.object, scope: s });
+                        if (k === 'concat') push(x.arguments, s);
+                        // fetch(u).then((r) => r.text()): the chain's value is what the callback returns.
+                        if (k === 'then' || k === 'finally') { const cb = x.arguments[0] && this.callbackOf(x.arguments[0], s); if (cb) for (const r of this.returnsOf(cb.node, cb.scope.analysis ?? this)) stack.push({ node: r, scope: (cb.scope.analysis ?? this).scopes.get(cb.node) ?? s }); }
+                    }
+                    break;
+                }
+                default: break;
+            }
+        }
+        return null;
+    }
+    // Is this a URLSearchParams: constructed, a URL's searchParams, or a name bound to one?
+    isSearchParams(n, scope) {
+        for (const l of this.resolve(n, scope)) {
+            const x = l.node;
+            if (x.type === 'NewExpression' && this.globalName(x.callee, l.scope) === 'URLSearchParams') return true;
+            if (x.type === 'MemberExpression' && this.key(x, l.scope) === 'searchParams') return true;
+        }
+        return false;
+    }
+    // A callback given inline, or by a name bound to a function: { node, scope }.
+    callbackOf(arg, scope) {
+        const a = unchain(arg);
+        if (!a) return null;
+        if (FUNCTIONS.has(a.type)) return { node: a, scope };
+        if (a.type === 'Identifier') { const b = scope.resolve(a.name); if (b?.alias === 'fn') return { node: b.node, scope: b.scope ?? scope }; }
+        return null;
+    }
+
+    // The expression a function returns when that is one expression: an
+    // arrow's body, or the argument of the one return statement of a block.
+    returned(fn) {
+        if (fn.type === 'ArrowFunctionExpression' && fn.expression) return fn.body;
+        const returns = fn.body.type === 'BlockStatement' ? fn.body.body.filter((s) => s.type === 'ReturnStatement') : [];
+        return returns.length === 1 && returns[0].argument ? returns[0].argument : null;
+    }
+
+    // The ways a markup or URL expression can read, for the tag walk: its
+    // exact values when every piece is written down, else what its pieces
+    // spell with each computed part standing in as a MARKER, one string per
+    // conditional branch. [] when nothing is written down.
+    shapes(n, scope) {
+        return this.alternatives(n, scope).texts;
+    }
+    // Every alternative a markup or URL value can be: `texts` are the written
+    // ones (exact, or spelled with MARKERs for computed parts), `placed` counts
+    // alternatives of which something is written (a written empty string, a
+    // copy of the page's own markup among them), `unwritten` those of which
+    // nothing is: a value the analyser could not place at all.
+    alternatives(n, scope) {
+        const values = this.exact(n, scope);
+        if (values) return { texts: values, placed: values.length, unwritten: 0 };
+        const s = this.spelled(n, scope);
+        if (s == null) return { texts: [], placed: 0, unwritten: 1 };
+        const out = { texts: [], placed: 0, unwritten: 0 };
+        for (const part of s.split('\u0000')) {
+            const plain = part.replace(MARKERS, '');
+            // An alternative with nothing written: a computed part. One that is a
+            // written empty string is nothing either way (`x || ''` writes no
+            // markup down); a copy of the page's own markup counts as written.
+            if (plain === '' && part.includes(MARKER)) out.unwritten++;
+            else if (plain === '' && !part.includes(COPY)) continue;
+            else { out.placed++; const text = part.replace(COPIES, ''); if (text !== '') out.texts.push(text); }
+        }
+        return out;
+    }
+
+    // A member's property name when it is written down, here or in the const
+    // the key is bound to: `obj[KEY]` with `const KEY = 'constructor'` is
+    // obj.constructor, readable and judged as such. A name assigned several
+    // plain literals (`many`) is no one key: null, and keyNames() has them all.
+    key(member, scope) {
+        const k = staticKey(member);
+        if (k != null || !member.computed) return k;
+        const p = unchain(member.property);
+        if (p?.type !== 'Identifier') return null;
+        const b = scope.resolve(p.name);
+        return b && b.alias === 'string' && !b.built && !b.many && b.spelled != null ? b.spelled : null;
+    }
+
+    // Every plain literal a computed key's name was assigned (`let k = 'a'; k = 'b'`).
+    keyNames(member, scope) {
+        if (!member.computed) return [];
+        const p = unchain(member.property);
+        if (p?.type !== 'Identifier') return [];
+        const b = scope.resolve(p.name);
+        return b && b.alias === 'string' && !b.built && b.many && b.spelled != null ? b.spelled.split('\u0000') : [];
+    }
+
+    // Does this expression name the global object, `document`, or a global by
+    // name? Returns the global's name ('window' for the object itself, whichever
+    // of its names was used), or null for anything local or unknown.
+    globalName(n, scope, depth = 0, hops = 0) {
+        n = unchain(n);
+        // acorn reads a.b.c… chains in a loop, so one can be as long as a file;
+        // no global is reached through more than a few steps. (Past the bound
+        // the chain's object is read by the resolver below, which cuts and asks
+        // what the expression mentions.)
+        if (!n) return null;
+        if (hops > 32) { this.hopsCut++; return null; }
+        // (Kept per node once the scopes are built, for a node in its own scope, when no bound cut the answer short.)
+        const keep = !this.pass1 && !scope.dynamic && scope.analysis === this && (n.type === 'MemberExpression' || n.type === 'CallExpression' || n.type === 'Identifier');
+        if (keep && this.globalNames.has(n)) return this.globalNames.get(n);
+        const cuts = this.hopsCut, steps = this.steps;
+        const g = this.globalNameIn(n, scope, depth, hops);
+        if (keep && this.hopsCut === cuts && steps > 0 && this.steps > 0) this.globalNames.set(n, g);
+        return g;
+    }
+    globalNameIn(n, scope, depth, hops) {
+        switch (n.type) {
+            case 'Identifier': {
+                const b = scope.resolve(n.name);
+                if (!b) { const pool = this.globalsNamed(n.name, scope); return pool.length ? this.globalOfLeaves(this.resolve(n, scope, depth + 1), n, depth, hops + 1, scope) ?? n.name : n.name; }
+                if (b.alias === 'name') return b.name;
+                if (b.alias === 'value' || b.alias === 'import' || b.alias === 'arguments' || b.param) return this.globalOfLeaves(this.resolve(n, scope, depth + 1), n, depth, hops + 1, scope);
+                return null;
+            }
+            case 'ThisExpression': return scope.thisGlobal ? 'window' : this.globalOfLeaves(this.resolve(n, scope, depth + 1), n, depth, hops + 1, scope);
+            case 'MemberExpression': {
+                const k = this.key(n, scope);
+                // A frame's window is a window of the bundle's own origin (the
+                // policy allows no other frame): the global object of another
+                // realm, whatever holds the frame. A frame's document, and the
+                // document any node belongs to, are documents of that origin.
+                if (k === 'contentWindow') return 'window';
+                if (k === 'contentDocument' || k === 'ownerDocument') return 'document';
+                // Document.prototype[k].call(document, …), Navigator.prototype[k]: the interface's prototype holds the host
+                // object's methods and getters; a member of it is judged as the host object's (write, serviceWorker, a computed name).
+                if (k === 'prototype' && unchain(n.object).type === 'Identifier' && !scope.resolve(unchain(n.object).name) && INTERFACE_HOSTS.has(unchain(n.object).name)) return INTERFACE_HOSTS.get(unchain(n.object).name);
+                const o = this.globalName(n.object, scope, depth, hops + 1);
+                // The object the global object by a cut's over-approximation (a value read short that mentions one):
+                // its member is as unread, and the global object whenever this expression mentions one.
+                if (o != null && GLOBAL_OBJECTS.has(o) && unchain(n.object).type !== 'Identifier' && unchain(n.object).type !== 'ThisExpression' && this.resolve(n.object, scope, depth + 1).some((l) => l.cut)) { const g = this.globalMentioned(n, scope); if (g != null) return g; }
+                if (o != null && k != null) {
+                    // frames[0] and window[0] are those frames' windows.
+                    if (GLOBAL_OBJECTS.has(o)) return /^\d+$/.test(k) ? 'window' : k;
+                    if (o === 'document' && k === 'defaultView') return 'window';
+                    if (o === 'document' && k === 'location') return 'location';
+                }
+                if (o != null && HOST_NAMES.has(o)) return null;
+                // [window][0], { w: window }.w, o.w with o written, m.get('w') after m.set('w', window), an export of another file: the element written there (a getter's value is what it returns; a property under a computed key, or read by one, may be any of the values written, which refuses).
+                return this.globalOfLeaves(this.resolve(n, scope, depth + 1), n, depth, hops + 1, scope);
+            }
+            case 'SequenceExpression': return this.globalName(n.expressions[n.expressions.length - 1], scope, depth, hops + 1);
+            case 'ConditionalExpression': return this.eitherGlobal(n.consequent, n.alternate, scope, depth, hops + 1);
+            case 'LogicalExpression': return this.eitherGlobal(n.left, n.right, scope, depth, hops + 1);
+            case 'AwaitExpression': return this.globalName(n.argument, scope, depth, hops + 1);
+            // `a ||= window` is a || window (a plain `=` is looked through by unchain).
+            case 'AssignmentExpression': return ['||=', '??=', '&&='].includes(n.operator) ? this.eitherGlobal(n.left, n.right, scope, depth, hops + 1) : null;
+            case 'ElementOf': return this.globalOfLeaves(this.resolve(n, scope, depth + 1), n, depth, hops + 1, scope);
+            // An object whose prototype is the global object reads every global through the chain: `{ __proto__: window }[k]`.
+            case 'ObjectExpression': {
+                const proto = n.properties.find((p) => p.type === 'Property' && !p.computed && !p.shorthand && p.kind === 'init' && (p.key.type === 'Identifier' ? p.key.name : String(p.key.value)) === '__proto__');
+                if (!proto) return null;
+                const g = this.globalName(proto.value, scope, depth, hops + 1);
+                return g != null && (GLOBAL_OBJECTS.has(g) || g === 'document') ? (g === 'document' ? 'document' : 'window') : null;
+            }
+            case 'CallExpression': {
+                // (function () { return this })() is the global object in sloppy
+                // code; so is (() => this)() where `this` is, and so is a
+                // function returning `this` called with .call(window).
+                const c = unchain(n.callee);
+                if (this.returnsThis(c, scope)) return 'window';
+                // .call(window), and .call(), .call(null), .apply(undefined): a
+                // sloppy function's this is the global object for each of them.
+                const receiver = n.arguments[0] ? unchain(n.arguments[0]) : null;
+                const nullish = !receiver || (receiver.type === 'Literal' && receiver.value === null) || (receiver.type === 'Identifier' && receiver.name === 'undefined' && !scope.resolve('undefined')) || (receiver.type === 'UnaryExpression' && receiver.operator === 'void');
+                if (c.type === 'MemberExpression' && ['call', 'apply'].includes(staticKey(c)) && this.returnsThis(unchain(c.object), scope) && (nullish || this.isGlobalObject(n.arguments[0], scope))) return 'window';
+                // Reflect.apply(f, window, []) is f.call(window).
+                if (c.type === 'MemberExpression' && staticKey(c) === 'apply' && this.globalName(c.object, scope, depth, hops + 1) === 'Reflect' && n.arguments[0] && this.returnsThis(unchain(n.arguments[0]), scope) && (!n.arguments[1] || this.isGlobalObject(n.arguments[1], scope) || ['Literal', 'UnaryExpression'].includes(unchain(n.arguments[1]).type))) return 'window';
+                // Reflect.get(window, 'name') is window.name written long.
+                const target = this.reflectRead(n, scope, depth, hops + 1);
+                if (target && target.key != null) return target.key === 'document' ? 'document' : target.key;
+                // Object.create(window), Object.setPrototypeOf(o, window), Reflect.setPrototypeOf(o, window): an
+                // object whose prototype is the global object reads every global through the chain.
+                if (c.type === 'MemberExpression') {
+                    const ck = staticKey(c), co = this.globalName(c.object, scope, depth, hops + 1);
+                    const protoArg = co === 'Object' && ck === 'create' ? n.arguments[0] : (co === 'Object' || co === 'Reflect') && ck === 'setPrototypeOf' ? n.arguments[1] : null;
+                    if (protoArg) { const g = this.globalName(protoArg, scope, depth, hops + 1); if (g != null && (GLOBAL_OBJECTS.has(g) || g === 'document')) return g === 'document' ? 'document' : 'window'; }
+                }
+                // A function written here returning the global object (by any of its
+                // returns, its parameters bound to the call's arguments), an element
+                // method handing it on ([window].pop(), Array.of(window)[0],
+                // Object.values({ w: window })[0], await Promise.resolve(window)),
+                // x.valueOf(): what the call resolves to.
+                if (c.type === 'MemberExpression' && ['valueOf', 'toString'].includes(staticKey(c)) && n.arguments.length === 0) { const g = this.globalName(c.object, scope, depth, hops + 1); if (g != null && GLOBAL_OBJECTS.has(g)) return 'window'; }
+                return this.globalOfLeaves(this.resolve(n, scope, depth + 1), n, depth, hops + 1, scope);
+            }
+            default: return null;
+        }
+    }
+    // The global object among what a value resolves to, if any of its leaves
+    // is one (the over-approximation that refuses); else a host global any
+    // leaf is (the same over-approximation: a name that may hold navigator is
+    // judged as navigator); else null. A value read short (a cut leaf among
+    // them) is the global object whenever the expression, or anything its
+    // names were given, mentions one: what was not read may be it.
+    globalOfLeaves(leaves, n, depth = 0, hops = 0, scope = null, rounds = 0) {
+        // A cut leaf is the expression left unread, in its scope, with the reads the resolver was making of it
+        // (its position). It is read again from there, with the depth to spare (the cut was the depth running
+        // out along one path; from where it stopped the resolver reads on, precisely and once per node), the
+        // position's member reads applied to what it gives; when that too is cut, or the
+        // position holds a call, what the expression mentions decides (globalMentioned). In pass 1 nothing is
+        // claimed of a cut: the name is bound lazily and pass 2 asks again.
+        for (const l of leaves) {
+            if (!l.cut) continue;
+            if (this.pass1) return null;
+            if (rounds < 1 && l.node.type !== 'Cut' && l.scope && !hasCall(l.pos)) {
+                // (The node left unread was never kept — a cut returns before anything is kept — so it is read afresh here.)
+                const again = this.applyPos(this.resolve(l.node, l.scope), l.pos ?? null, l.node, l.scope);
+                const g = this.globalOfLeaves(again, l.node, depth, hops, l.scope, rounds + 1);
+                if (g != null) return g;
+                if (!again.some((a) => a.cut)) continue; // (read through: not the global object)
+            }
+            const g = this.globalMentioned(l.node, l.scope ?? scope, l.pos ?? null);
+            if (g != null) return g;
+        }
+        if (this.unread(leaves, n) || hops > 32) return null;
+        let host = null;
+        for (const l of leaves) {
+            const x = l.node;
+            let g = null;
+            if (x.type === 'Identifier') { if (x.global) g = x.name; else { const b = l.scope.resolve(x.name); g = !b ? x.name : b.alias === 'name' ? b.name : null; } }
+            else if (x.type === 'ThisExpression') g = l.scope.thisGlobal ? 'window' : null;
+            else if (x.type === 'MemberExpression' || x.type === 'CallExpression' || x.type === 'ObjectExpression') { if (x !== n) g = this.globalName(x, l.scope, depth, hops + 1); }
+            if (g != null && GLOBAL_OBJECTS.has(g)) return 'window';
+            if (g != null && HOST_NAMES.has(g) && (host == null || g === 'document')) host = g;
+        }
+        return host;
+    }
+    // The member reads of a position applied to leaves: `.state` of each (a cut leaf keeps the reads still to
+    // make); for globalOfLeaves, which reads a cut value again from where the resolver stopped.
+    applyPos(leaves, pos, n, scope) {
+        const steps = [];
+        for (let p = pos; p; p = p.next) steps.push(p);
+        for (let i = steps.length - 1; i >= 0; i--) {
+            const k = steps[i].m;
+            const out = [];
+            for (const l of leaves) {
+                if (l.cut) { out.push({ ...l, pos: posMember(k, l.pos ?? null) }); continue; }
+                const m = this.membersOf(l, k, n, scope, 0);
+                if (m === null) out.push(leaf(n, scope)); else out.push(...m);
+            }
+            leaves = this.union(out);
+        }
+        return leaves;
+    }
+    // The global the syntax of an expression mentions, or the syntax of what
+    // its names were given (their values, a function's body, an import, a
+    // call site's argument, a write read back): 'window' for the global
+    // object under any of its names (also `this` where it may be the global,
+    // `window[0]`, a frame's window), a host object's name, or null. What a
+    // cut value may be: read when the resolver could not finish, so that a
+    // value it did not read to the end never passes as not the global object.
+    // `window.X` with X written is the global X, not the window: judged as X.
+    //
+    // `pos` is where the value is read: [] for the value itself, else the path
+    // of reads the resolver was making of it when it cut — a member by key
+    // ({ m: key }, key null when computed), a call ({ c: true }) — innermost
+    // first. A literal object read for a key gives that property; read as a
+    // value it is itself, whatever it holds (`outbox = { player: window.PLAYER
+    // }` is not the window, and `outbox.request` reads only `request`); a
+    // function called gives what it returns, in the call's position.
+    //
+    // Evaluated once per node and position over the whole analysis, in post
+    // order with an explicit stack (an answer is kept per node and position),
+    // so the many cuts a large file's resolution makes cost its size once, not
+    // a walk each. A node in a call's scope (a parameter bound at one call
+    // site) is read each time, in that scope. A cycle adds nothing; an answer
+    // that leaned on a node still being read is not kept.
+    globalMentioned(n, scope, pos = null) {
+        n = unchain(n);
+        if (!n || !scope) return 'window';
+        if (this.pass1) return null;
+        const key = posKey(pos);
+        if (!scope.dynamic) { const m = this.mentioned.get(n); if (m && m.has(key)) return m.get(key); }
+        // (The evaluation asks the resolver nothing, so it never re-enters; were it to, what it has not read may be anything.)
+        if (this.mentioning) return 'window';
+        this.mentioning = true;
+        try { return this.globalMentionedIn(n, scope, pos); } finally { this.mentioning = false; }
+    }
+    globalMentionedIn(root, rootScope, rootPos) {
+        const memoGet = (x, k) => this.mentioned.get(x)?.get(k);
+        // (Kept for the shorter paths only: a long path is one of a chain the resolver cuts anyway, asked once.)
+        const memoSet = (x, k, v, len) => { if (len > 8) return; let m = this.mentioned.get(x); if (!m) this.mentioned.set(x, (m = new Map())); if (m.size < 64) m.set(k, v); };
+        const stack = [{ node: root, scope: rootScope, pos: rootPos, key: posKey(rootPos), i: -1, succ: null, result: null, tainted: false }];
+        const active = new Map(); // node → Set of position keys being read
+        const leaned = []; // answers of nothing that leaned on a node still being read: kept once the whole reading finds nothing
+        let steps = 0, final = null;
+        const finish = (f) => {
+            stack.pop();
+            if (f.i >= 0) {
+                active.get(f.node)?.delete(f.key);
+                if (!f.scope.dynamic && (f.result === 'window' || !f.tainted)) memoSet(f.node, f.key, f.result, f.pos?.len ?? 0);
+                else if (!f.scope.dynamic && f.result == null) leaned.push(f);
+            }
+            const p = stack[stack.length - 1];
+            if (!p) { final = f.result; return; }
+            if (f.result === 'window') p.result = 'window';
+            else if (f.result != null && p.result == null) p.result = f.result;
+            if (f.tainted) p.tainted = true;
+        };
+        while (stack.length) {
+            // (Not read to the end: what is left may mention anything. Nothing is kept of it.)
+            if (steps++ > MENTION_STEPS) return 'window';
+            const f = stack[stack.length - 1];
+            if (f.i < 0) {
+                const x = f.node;
+                const known = f.scope.dynamic ? undefined : memoGet(x, f.key);
+                if (known !== undefined) { f.result = known; finish(f); continue; }
+                // (A cycle: the node again, at the same position or at one that reads it further and then as before —
+                // `X = X.map(f)` read for `.map` of `.map` of … — adds nothing new.)
+                if (active.has(x) && [...active.get(x)].some((k) => f.key === k || (f.key.endsWith(k) && (k === '' || f.key.charCodeAt(f.key.length - k.length - 1) === 124)))) { f.tainted = true; finish(f); continue; }
+                if (!active.has(x)) active.set(x, new Set());
+                active.get(x).add(f.key);
+                // (A position path past the resolver's own depth is one it would have cut: what is read there may be anything.)
+                const own = (f.pos?.len ?? 0) > RESOLVE_DEPTH ? { hit: 'window', succ: [] } : this.mentionsOwn(x, f.scope, f.pos);
+                f.result = own.hit;
+                f.succ = own.hit === 'window' ? [] : own.succ;
+                f.i = 0;
+                continue;
+            }
+            if (f.result === 'window' || f.i >= f.succ.length) { finish(f); continue; }
+            const s = f.succ[f.i++];
+            stack.push({ node: s.node, scope: s.scope, pos: s.pos, key: posKey(s.pos), i: -1, succ: null, result: null, tainted: false });
+        }
+        // (The whole reading found nothing: every node it read, cycles and all, reaches nothing. Had it found the
+        // global object, a node that leaned on one still being read might reach it: those are not kept.)
+        if (final == null) for (const f of leaned) memoSet(f.node, f.key, null, f.pos?.len ?? 0);
+        return final;
+    }
+    // What one node says of itself in a position (`hit`: 'window', a host
+    // object's name, or null) and what it is read through next (`succ`: nodes
+    // with their scope and position), by the rules in globalMentioned.
+    mentionsOwn(x, s, pos) {
+        const succ = [];
+        let hit = null;
+        const head = pos, rest = pos?.next ?? null;
+        const hostOf = (name) => { if (GLOBAL_OBJECTS.has(name)) return 'window'; if (HOST_NAMES.has(name)) return name; return null; };
+        const take = (g) => { if (g === 'window') hit = 'window'; else if (g != null && hit == null) hit = g; };
+        // (A node is read in its own scope when it opens one — a block's, a function's — else in its parent's.)
+        const push = (node, sc, p) => { if (node && typeof node.type === 'string' && sc) succ.push({ node, scope: (sc.analysis ?? this).scopes.get(node) ?? sc, pos: p }); };
+        const pushBinding = (b, bscope, p) => {
+            switch (b.alias) {
+                case 'value': for (const v of b.nodes) push(v.node, v.scope, p); for (const v of b.dropped ?? []) push(v.node, v.scope, p); break;
+                case 'fn': push(b.node, b.scope ?? bscope, p); break;
+                case 'import': { const t = this.followExport(b.from, b.name, bscope, 0); if (t?.binding) pushBinding(t.binding, t.scope, p); break; }
+                case 'arguments': { const a = bscope.analysis ?? this; for (const site of a.sites.get(b.fn) ?? []) push({ type: 'ArrayExpression', elements: site.args }, site.scope, p); break; }
+                default: break;
+            }
+            if (b.param) { const a = bscope.analysis ?? this; for (const site of a.sites.get(b.param.fn) ?? []) { const arg = site.args[b.param.index]; if (arg) push(arg, site.scope, p); } }
+        };
+        // A global by name, read in a position: the object itself, or `window.k` the global k (its pool bindings), `window[0]` a frame's window.
+        const global = (name, p) => {
+            if (!p) { take(hostOf(name)); return; }
+            const h = p;
+            if (h.c) return; // (the global object is not called; a host function's value the resolver reads as unread)
+            if (!GLOBAL_OBJECTS.has(name)) { if (name === 'document' && (h.m === 'defaultView' || h.m == null)) take('window'); else if (name === 'document' && h.m === 'location') take('location'); return; }
+            const k = h.m, r = p.next;
+            if (k == null || /^\d+$/.test(k)) { take('window'); return; }
+            if (k === 'document' || hostOf(k) != null) { global(k === 'document' ? 'document' : hostOf(k) === 'window' ? 'window' : k, r); return; }
+            for (const g of this.globalsNamed(k, s)) pushBinding(g.binding, g.scope, r);
+        };
+        switch (x.type) {
+            case 'Cut': take('window'); break;
+            case 'ThisExpression': { if (s.thisGlobal) take('window'); else { const m = this.literalOfThis(s); if (m) push(m.node, m.scope, pos); } break; }
+            case 'Identifier': {
+                if (x.global) { global(x.name, pos); break; }
+                const b = s.resolve(x.name);
+                if (!b) { global(x.name, pos); for (const g of this.globalsNamed(x.name, s)) pushBinding(g.binding, g.scope, pos); break; }
+                if (b.alias === 'name') { global(b.name, pos); for (const g of this.globalsNamed(b.name, s)) pushBinding(g.binding, g.scope, pos); break; }
+                pushBinding(b, s, pos);
+                break;
+            }
+            case 'MemberExpression': {
+                const k = this.key(x, s);
+                const obj = unchain(x.object);
+                if (k === 'contentWindow') { global('window', pos); break; }
+                if (k === 'contentDocument' || k === 'ownerDocument') { global('document', pos); break; }
+                // A property read: what was written under that key, anywhere, by the writes' syntax alone — values in
+                // this member's position — and the object, read for this key, then as this member is.
+                const { writes, exhausted } = this.writesNamed(s.analysis ?? this, k, obj, s);
+                if (exhausted) { take('window'); break; }
+                for (const w of writes) push(w.value, w.scope, pos);
+                push(x.object, s, posMember(k, pos));
+                break;
+            }
+            case 'FunctionDeclaration': case 'FunctionExpression': case 'ArrowFunctionExpression': {
+                // (A function called gives what it returns, read in the call's position; as a value or a member's object it is itself.)
+                if (!head?.c) break;
+                const owner = s.analysis ?? this;
+                const inner = owner.scopes.get(x) ?? s;
+                push(x.body, inner, rest);
+                break;
+            }
+            case 'ObjectExpression': {
+                if (!head || head.c) break;
+                for (const p of x.properties) {
+                    if (p.type === 'SpreadElement') { push(p.argument, s, pos); continue; }
+                    if (p.type !== 'Property' || p.kind === 'set') continue;
+                    const name = p.computed ? null : p.key.type === 'Identifier' ? p.key.name : String(p.key.value);
+                    if (name === '__proto__' && !p.computed && !p.shorthand) { push(p.value, s, pos); continue; }
+                    if (head.m != null && name != null && name !== head.m) continue;
+                    if (p.kind === 'get') push(p.value, s, posCall(rest)); else push(p.value, s, rest);
+                }
+                break;
+            }
+            case 'ArrayExpression': {
+                // (An element by index, or any; a method of the runtime's that hands elements on (pop, find, filter, map …),
+                // called: its elements, as the call's value; any other member of a list is the runtime's: nothing.)
+                if (!head || head.c) break;
+                let at = rest;
+                if (head.m != null && !/^\d+$/.test(head.m)) { if (!rest?.c || !(ELEMENT_METHODS.has(head.m) || LIST_METHODS.has(head.m) || head.m === 'reduce' || head.m === 'values' || head.m === 'entries')) break; at = rest.next; }
+                for (const e of x.elements) { if (!e) continue; if (e.type === 'SpreadElement') push(e.argument, s, pos); else push(e, s, at); }
+                break;
+            }
+            // Statements, walked for what a function returns: a return's value, in the function's position; the
+            // statements inside a block, a branch, a loop, a try; nothing of an expression statement, a declaration,
+            // a test or a throw (not the value returned — their names are reached through the returns that read them).
+            case 'ReturnStatement': push(x.argument, s, pos); break;
+            case 'BlockStatement': case 'StaticBlock': for (const st of x.body) push(st, s, pos); break;
+            case 'IfStatement': push(x.consequent, s, pos); push(x.alternate, s, pos); break;
+            case 'ForStatement': case 'ForInStatement': case 'ForOfStatement': case 'WhileStatement': case 'DoWhileStatement': case 'LabeledStatement': case 'WithStatement': push(x.body, s, pos); break;
+            case 'SwitchStatement': for (const c of x.cases) for (const st of c.consequent) push(st, s, pos); break;
+            case 'TryStatement': push(x.block, s, pos); push(x.handler?.body, s, pos); push(x.finalizer, s, pos); break;
+            case 'ExpressionStatement': case 'VariableDeclaration': case 'ThrowStatement': case 'BreakStatement': case 'ContinueStatement': case 'EmptyStatement': case 'DebuggerStatement': case 'ImportDeclaration': case 'ExportNamedDeclaration': case 'ExportDefaultDeclaration': case 'ExportAllDeclaration': case 'ClassDeclaration':
+                break;
+            case 'NewExpression': case 'ClassExpression':
+                // (An instance read into: what went into it may come out; as a value it is itself.)
+                if (!head) break;
+                for (const [key, child] of children(x)) { if (childCtx(x, key, 'expr') === 'skip') continue; push(child, s, posMember(null)); }
+                break;
+            case 'Literal': case 'TemplateLiteral': case 'TaggedTemplateExpression': case 'BinaryExpression': case 'UnaryExpression': case 'UpdateExpression':
+                break; // (a primitive, whatever it is made of)
+            case 'CallExpression': {
+                // (The callee is read for what it returns, in this call's position. The arguments flow into its parameters,
+                // and are reached through them where a return reads one: pushed here they would make every call's value
+                // mention whatever any argument does. A host function has no body to read: its arguments may be its
+                // value, as they are or read into — Promise.resolve(window), Object.values({ w: window })[0], Array.of(w).)
+                push(x.callee, s, posCall(pos));
+                const c = unchain(x.callee);
+                const hostName = (id) => id.type === 'Identifier' && (!s.resolve(id.name) || s.resolve(id.name).alias === 'name') ? (s.resolve(id.name)?.name ?? id.name) : null;
+                const passes = c.type === 'Identifier' ? hostName(c) === 'structuredClone' : c.type === 'MemberExpression' && hostName(unchain(c.object)) != null && (PASS_THROUGH.get(hostName(unchain(c.object))) ?? []).includes(staticKey(c)) && hostName(unchain(c.object)) !== 'JSON';
+                if (passes) for (const a of x.arguments) { push(a, s, pos); push(a, s, posMember(null, pos)); }
+                break;
+            }
+            case 'ElementOf': push(x.list, x.scope, posMember(x.index == null ? null : String(x.index), pos)); break;
+            case 'Piece': push(x.of, x.scope, pos); break;
+            case 'JsonValue': case 'PageMarkup': case 'PageElement': case 'Dataset': case 'Namespace': break;
+            default: {
+                for (const [key, child] of children(x)) { if (childCtx(x, key, 'expr') === 'skip') continue; if (child.type === 'Identifier' && x.type === 'VariableDeclarator' && key === 'id') continue; push(child, s, pos); }
+            }
+        }
+        return { hit, succ };
+    }
+    // The writes that may land on a member read, by their syntax alone (no
+    // value followed): by a written key, every write of that key on anything,
+    // and every write by a computed key on the same base name (or on `this`,
+    // a call, anything unnamed); by a computed key, every write on the same
+    // base name; this file's and (the pool) the others'. For globalMentioned,
+    // which must not ask the resolver. Bounded: `exhausted` when there are too
+    // many to walk.
+    writesNamed(a, k, obj, scope) {
+        const index = this.syntaxIndex(a);
+        const ds = obj.type === 'MemberExpression' && this.key(obj, scope) === 'dataset';
+        const key = k == null ? null : ds ? 'data-' + kebab(k) : ATTR_PROPS.get(k) ?? k;
+        const base = this.baseOf(obj);
+        const pool = a.pool?.writes ? this.poolIndex(a.pool) : null;
+        const writes = [];
+        let exhausted = false;
+        const take = (list) => { if (!list) return; if (writes.length + list.length > WRITES * 4) { exhausted = true; return; } for (const w of list) writes.push(w); };
+        if (key == null) {
+            take(index.byBase.get(base));
+            if (pool) take(pool.byBase.get(base));
+        } else {
+            take(index.byKey.get(key));
+            take(index.computedByBase.get(base));
+            if (base !== '*') take(index.computedByBase.get('*'));
+            if (pool) {
+                take(a.pool.writes.get(key));
+                take(pool.computedByBase.get(base));
+                if (base !== '*') take(pool.computedByBase.get('*'));
+            }
+        }
+        return { writes, exhausted };
+    }
+    // This file's writes by their syntactic key (every write of a written key, under that key), by the base name
+    // they are on ('*' for `this` or an object not named), and those by a computed key by base, built once.
+    syntaxIndex(a) {
+        if (a.writesBySyntax) return a.writesBySyntax;
+        const byKey = new Map(), byBase = new Map(), computedByBase = new Map();
+        const put = (map, key, w) => { if (!map.has(key)) map.set(key, []); map.get(key).push(w); };
+        for (const w of a.writes) {
+            let key = null, target, element = false;
+            if (w.node.type === 'AssignmentExpression') {
+                const left = unchain(w.node.left);
+                const lk = this.key(left, w.scope);
+                const dsk = unchain(left.object).type === 'MemberExpression' && this.key(unchain(left.object), w.scope) === 'dataset';
+                if (lk != null) key = dsk ? 'data-' + kebab(lk) : ATTR_PROPS.get(lk) ?? lk;
+                target = left.object;
+            } else {
+                const c = unchain(w.node.callee), m = staticKey(c), arg = literalString(w.node.arguments[0]);
+                if (m === 'replaceState' || m === 'pushState') key = 'state';
+                else if ((m === 'set' || m === 'setAttribute' || m === 'setItem') && arg != null) key = m === 'setAttribute' ? arg.toLowerCase() : arg;
+                else if (m === 'push' || m === 'unshift' || m === 'add') element = true;
+                target = c.object;
+            }
+            const base = baseName(target);
+            if (key != null) put(byKey, key, w); else if (!element) put(computedByBase, base, w);
+            put(byBase, base, w);
+        }
+        a.writesBySyntax = { byKey, byBase, computedByBase };
+        return a.writesBySyntax;
+    }
+    // The pool's writes by the base name they are on, and those by a computed key (not an element pushed) by base,
+    // built once from the targets the wiring read.
+    poolIndex(pool) {
+        if (pool.index) return pool.index;
+        const byBase = new Map(), computedByBase = new Map();
+        const put = (map, key, w) => { if (!map.has(key)) map.set(key, []); map.get(key).push(w); };
+        for (const list of pool.writes.values()) for (const w of list) {
+            const t = this.targetOf(w);
+            if (!t) continue;
+            const base = t.root?.type === 'Identifier' ? t.root.name : '*';
+            put(byBase, base, w);
+            if (w.key == null && (w.node.type === 'AssignmentExpression' || !['push', 'unshift', 'add'].includes(staticKey(unchain(w.node.callee))))) put(computedByBase, base, w);
+        }
+        pool.index = { byBase, computedByBase };
+        return pool.index;
+    }
+    // The leftmost name a member chain stands on, kept per link (see baseName).
+    baseOf(n) {
+        n = unchain(n);
+        const path = [];
+        let x = n;
+        while (x && x.type === 'MemberExpression' && !this.bases.has(x)) { path.push(x); x = unchain(x.object); }
+        const base = x && x.type === 'MemberExpression' ? this.bases.get(x) : x && x.type === 'Identifier' ? x.name : '*';
+        for (const m of path) this.bases.set(m, base);
+        return base;
+    }
+    // What a binding was given, for globalMentioned to walk: its expressions, its function, its import, its call sites' arguments.
+    pushBinding(b, bscope, from, push, d) {
+        switch (b.alias) {
+            case 'value': for (const v of b.nodes) push(v.node, v.scope, from, d); break;
+            case 'fn': push(b.node, b.scope ?? bscope, from, d); break;
+            case 'import': { const t = this.followExport(b.from, b.name, bscope, 0); if (t?.binding) this.pushBinding(t.binding, t.scope, from, push, d); break; }
+            case 'arguments': { const a = bscope.analysis ?? this; for (const site of a.sites.get(b.fn) ?? []) for (const arg of site.args) push(arg, site.scope, from, d); break; }
+            default: break;
+        }
+        if (b.param) {
+            const a = bscope.analysis ?? this;
+            for (const site of a.sites.get(b.param.fn) ?? []) { const arg = site.args[b.param.index]; if (arg) push(arg, site.scope, from, d); }
+        }
+    }
+    // A function whose body is, or returns, `this`: the global object when
+    // called bare in sloppy code (a FunctionExpression), or when `this` at the
+    // arrow's definition is the global object.
+    returnsThis(fn, scope, depth = 0) {
+        if (!fn || depth > 8) return false;
+        if (fn.type === 'FunctionExpression' || fn.type === 'FunctionDeclaration') return fn.body.body.some((s) => s.type === 'ReturnStatement' && unchain(s.argument)?.type === 'ThisExpression');
+        if (fn.type === 'ArrowFunctionExpression') {
+            const inner = this.scopes.get(fn);
+            if (!(inner ? inner.thisGlobal : scope.thisGlobal)) return false;
+            return fn.expression ? unchain(fn.body).type === 'ThisExpression' : fn.body.body.some((s) => s.type === 'ReturnStatement' && unchain(s.argument)?.type === 'ThisExpression');
+        }
+        // A function kept in a name (`function g() { return this }`, `const g = function …`), or the last of a sequence (`(0, function …)()`).
+        if (fn.type === 'Identifier') { const b = scope.resolve(fn.name); return !!(b && b.alias === 'fn' && this.returnsThis(b.node, scope, depth + 1)); }
+        if (fn.type === 'SequenceExpression') return this.returnsThis(unchain(fn.expressions[fn.expressions.length - 1]), scope, depth + 1);
+        return false;
+    }
+    eitherGlobal(a, b, scope, depth, hops = 0) {
+        const x = this.globalName(a, scope, depth, hops), y = this.globalName(b, scope, depth, hops);
+        if (GLOBAL_OBJECTS.has(x)) return x;
+        if (GLOBAL_OBJECTS.has(y)) return y;
+        return null;
+    }
+    isGlobalObject(n, scope) { const g = this.globalName(n, scope); return g != null && (GLOBAL_OBJECTS.has(g) || g === 'document'); }
+
+    // Reflect.get(G, k) / Object.getOwnPropertyDescriptor(G, k) on the global
+    // object: { key } when k is written down, { key: null } when computed; null
+    // when the call is something else.
+    reflectRead(call, scope, depth = 0, hops = 0) {
+        const c = unchain(call.callee);
+        if (c.type !== 'MemberExpression') return null;
+        // (The method's name first: only Reflect's and Object's readers are read, so a chain of other calls is not descended.)
+        const k = this.key(c, scope);
+        if (!DESCRIPTOR_READERS.has(k) && k !== 'getOwnPropertyDescriptor' && k !== 'defineProperty') return null;
+        // (The depth is the caller's: a chain of calls is one chain, however it is read.)
+        const o = this.globalName(c.object, scope, depth + 1, hops + 1);
+        const reads = (o === 'Reflect' && DESCRIPTOR_READERS.has(k)) || (o === 'Object' && (k === 'getOwnPropertyDescriptor' || k === 'defineProperty'));
+        if (!reads || !call.arguments[0] || !this.isGlobalObject(call.arguments[0], scope)) return null;
+        const prop = call.arguments[1];
+        return { key: prop ? literalString(prop) : null };
+    }
+
+    // Is this expression a string at run time, as far as syntax tells? For the
+    // timer rule: a literal, a template, a concatenation with a literal in it,
+    // a decoder's or a string method's result, a name bound to one of those.
+    isStringy(n, scope, depth = 0) {
+        n = unchain(n);
+        if (!n || depth > 32) return false;
+        switch (n.type) {
+            case 'Literal': return typeof n.value === 'string';
+            case 'TemplateLiteral': case 'TaggedTemplateExpression': return true;
+            case 'BinaryExpression': return n.operator === '+' && (this.isStringy(n.left, scope, depth + 1) || this.isStringy(n.right, scope, depth + 1));
+            case 'ConditionalExpression': return this.isStringy(n.consequent, scope, depth + 1) || this.isStringy(n.alternate, scope, depth + 1);
+            case 'LogicalExpression': return this.isStringy(n.left, scope, depth + 1) || this.isStringy(n.right, scope, depth + 1);
+            case 'SequenceExpression': return this.isStringy(n.expressions[n.expressions.length - 1], scope, depth + 1);
+            case 'AssignmentExpression': return n.operator === '+=' && (this.isStringy(n.left, scope, depth + 1) || this.isStringy(n.right, scope, depth + 1)); // `s += 'x'` is a concatenation; `=` is looked through by unchain
+            case 'Identifier': { const b = scope.resolve(n.name); return !!(b && b.alias === 'string'); }
+            case 'CallExpression': {
+                if (this.isDecoder(n, scope)) return true;
+                const c = unchain(n.callee);
+                if (c.type === 'Identifier' && this.globalName(c, scope) === 'String') return true;
+                if (c.type === 'MemberExpression') { const k = staticKey(c); return ['join', 'concat', 'replace', 'replaceAll', 'toString', 'trim', 'slice', 'substring', 'substr', 'toLowerCase', 'toUpperCase', 'stringify', 'repeat', 'padStart', 'padEnd', 'normalize'].includes(k) || (k === 'raw' && this.globalName(c.object, scope) === 'String') || (k === 'createObjectURL' && this.globalName(c.object, scope) === 'URL'); }
+                return false;
+            }
+            default: return false;
+        }
+    }
+
+    // atob(...), unescape(...), decodeURIComponent(...), String.fromCharCode(...), x.decode(...)
+    isDecoder(n, scope) {
+        n = unchain(n);
+        if (!n || n.type !== 'CallExpression') return false;
+        const c = unchain(n.callee);
+        if (c.type === 'Identifier') return DECODERS.has(this.globalName(c, scope));
+        if (c.type === 'MemberExpression') {
+            const k = this.key(c, scope), o = this.globalName(c.object, scope);
+            if (o === 'String' && (k === 'fromCharCode' || k === 'fromCodePoint')) return true;
+            if (DECODERS.has(k) && GLOBAL_OBJECTS.has(o)) return true;
+            return k === 'decode';
+        }
+        return false;
+    }
+
+    // What the literal fragments of a string expression spell, with whatever is
+    // computed left out: 'ev' + x + 'al' spells "eval"; ['c','onstructor'].join('')
+    // spells "constructor"; atob('ZXZhbA==') spells "eval". null when nothing
+    // is written down.
+    // A computed part stands as a MARKER in its place (`'ev' + x + 'al'` spells
+    // "eval"), so a tag walk sees where a word is missing; readers that
+    // judge a name strip the markers (hiddenName: it spells "eval").
+    spelled(n, scope, depth = 0) {
+        n = unchain(n);
+        if (!n) return null;
+        if (n.type === 'Literal') return typeof n.value === 'string' ? n.value : typeof n.value === 'number' ? String(n.value) : n.value === undefined && n.raw === null ? 'undefined' : null;
+        if (depth > 64 || this.spend() || !this.enter()) return null;
+        try { return this.spelledIn(n, scope, depth); } finally { this.leave(); }
+    }
+    spelledIn(n, scope, depth) {
+        switch (n.type) {
+            case 'TemplateLiteral': {
+                let out = '', any = false;
+                for (let i = 0; i < n.quasis.length; i++) {
+                    out += n.quasis[i].value.cooked ?? '';
+                    if (i < n.expressions.length) { const e = this.spelled(n.expressions[i], scope, depth + 1); if (e != null) any = true; out += e ?? MARKER; }
+                }
+                return out.replace(MARKERS, '') === '' && !any && n.expressions.length ? null : out;
+            }
+            case 'TaggedTemplateExpression': return n.quasi.quasis.map((q) => q.value.raw).join(MARKER);
+            case 'BinaryExpression': {
+                if (n.operator !== '+') return null;
+                const pieces = plusChain(n);
+                if (pieces.length > EXACT_PIECES) return null;
+                let out = '', any = false;
+                for (const p of pieces) { const s = this.spelled(p, scope, depth + 1); if (s != null) any = true; out += s ?? MARKER; }
+                return any ? out : null;
+            }
+            // Either branch: an alternative of which nothing is written stands as a computed part.
+            case 'ConditionalExpression': { const a = this.spelled(n.consequent, scope, depth + 1), b = this.spelled(n.alternate, scope, depth + 1); return a == null && b == null ? null : `${a ?? MARKER}\u0000${b ?? MARKER}`; }
+            case 'LogicalExpression': { const a = this.spelled(n.left, scope, depth + 1), b = this.spelled(n.right, scope, depth + 1); return a == null && b == null ? null : `${a ?? MARKER}\u0000${b ?? MARKER}`; }
+            case 'SequenceExpression': return this.spelled(n.expressions[n.expressions.length - 1], scope, depth + 1);
+            case 'AwaitExpression': return this.spelled(n.argument, scope, depth + 1);
+            case 'AssignmentExpression': {
+                // `obj[s += 'al']`: pass 1 joined the right side onto what the
+                // name spelled, so the name is the whole; a member target spells
+                // its right side only. A plain `=` is looked through by unchain.
+                if (n.operator !== '+=') return null;
+                return this.spelled(n.left, scope, depth + 1) ?? this.spelled(n.right, scope, depth + 1);
+            }
+            case 'ArrayExpression': { const parts = n.elements.map((e) => this.spelled(e?.type === 'SpreadElement' ? e.argument : e, scope, depth + 1)); return parts.every((p) => p == null) ? null : parts.map((p) => p ?? MARKER).join('\u0000'); }
+            case 'Identifier': case 'MemberExpression': case 'CallExpression': {
+                const d = this.spelledDirect(n, scope, depth);
+                return d === undefined ? this.spelledLeaves(n, scope, depth) : d;
+            }
+            case 'NewExpression': return this.globalName(n.callee, scope) === 'URL' ? this.spelledUrl(n, 'href', scope, depth) : null;
+            case 'ElementOf': return this.spelledLeaves(n, scope, depth);
+            case 'JsonValue': return typeof n.value === 'string' ? n.value : typeof n.value === 'number' || typeof n.value === 'boolean' || n.value === null ? String(n.value) : null;
+            case 'PageMarkup': return COPY;
+            case 'Piece': { const inner = this.spelled(n.of, n.scope, depth + 1); return inner == null ? null : MARKER + inner; }
+            default: return null;
+        }
+    }
+    // What a name, a member or a call spells on its own, before it is followed
+    // (resolve): a string bound to the name; the page's address (its scheme
+    // and root are the page's, the rest computed: `location.pathname` spells
+    // "/" and a computed part); a URL object's parts; a decoder or a string
+    // method of written pieces; `URL.createObjectURL` (a blob: URL). undefined
+    // when it has no reading of its own and is followed instead; null when it
+    // spells nothing (a host object's member, a method that may spell a word
+    // its receiver did not — replace by a pattern, sort, normalize, repeat,
+    // pad, a case change — when not exact: a computed part).
+    spelledDirect(n, scope, depth) {
+        switch (n.type) {
+            case 'Identifier': {
+                const b = scope.resolve(n.name);
+                if (b && b.alias === 'string') return b.spelled ?? null;
+                if (b && b.alias === 'number') return String(b.value);
+                if (b && (b.alias === 'strings' || b.alias === 'fn' || b.alias === 'module')) return null;
+                if (!b && n.name === 'undefined') return 'undefined';
+                if (!b && !this.globalsNamed(n.name, scope).length) return null;
+                return undefined;
+            }
+            case 'MemberExpression': {
+                const k = this.key(n, scope), o = this.globalName(n.object, scope);
+                if (o === 'location' && k != null) return ADDRESS_HEADS.get(k) ?? null;
+                if (o === 'document' && k != null && DOCUMENT_ADDRESS.has(k)) return ADDRESS_HEADS.get(DOCUMENT_ADDRESS.get(k));
+                const obj = unchain(n.object);
+                if (k === 'url' && obj.type === 'MetaProperty') return ADDRESS_HEADS.get('href');
+                if (obj.type === 'NewExpression' && this.globalName(obj.callee, scope) === 'URL' && k != null) return this.spelledUrl(obj, k, scope, depth);
+                if (o != null && (HOST_NAMES.has(o) || GLOBAL_OBJECTS.has(o)) && !(GLOBAL_OBJECTS.has(o) && k != null && this.globalsNamed(k, scope).length)) return null;
+                // A copy of markup the page already holds (el.innerHTML = other.innerHTML): judged where it was written; nothing of it to walk here.
+                if (k != null && MARKUP_PROPS.has(k) && this.unread(this.resolve(n, scope), n)) return COPY;
+                return undefined;
+            }
+            case 'CallExpression': {
+                const c = unchain(n.callee);
+                if (c.type === 'Identifier') {
+                    const g = this.globalName(c, scope), a = n.arguments[0] && literalString(n.arguments[0]);
+                    if (g === 'atob' && a != null) return decodeBase64(a);
+                    if ((g === 'decodeURIComponent' || g === 'decodeURI') && a != null) { try { return decodeURIComponent(a); } catch { return a; } }
+                    if (g === 'unescape' && a != null) return a.replace(/%([0-9a-f]{2})/gi, (_, h) => String.fromCharCode(parseInt(h, 16)));
+                    if (g === 'String') return this.spelled(n.arguments[0], scope, depth + 1);
+                    if (g != null && (DECODERS.has(g) || HOST_NAMES.has(g) || GLOBAL_OBJECTS.has(g))) return null;
+                    return undefined;
+                }
+                if (c.type !== 'MemberExpression') return null;
+                const k = this.key(c, scope), o = this.globalName(c.object, scope);
+                if (o === 'String' && (k === 'fromCharCode' || k === 'fromCodePoint')) return fromCharCodes(n.arguments);
+                if (o === 'URL' && k === 'createObjectURL') return 'blob:' + MARKER;
+                if (o === 'JSON' && k === 'stringify') return null;
+                // A list's elements, each a piece (Object.values(o), items.map(f), list.filter(f), Array.from(…), s.split(…)).
+                if ((o === 'Object' && (k === 'values' || k === 'keys' || k === 'entries')) || (o === 'Array' && (k === 'from' || k === 'of')) || (o === 'Promise' && k === 'all')) return this.spelledList(n, scope, depth);
+                if (o != null && (HOST_NAMES.has(o) || GLOBAL_OBJECTS.has(o))) return null;
+                if (k === 'join') {
+                    const inner = this.spelled(c.object, scope, depth + 1);
+                    if (inner == null) return null;
+                    const sep = n.arguments[0] ? literalString(n.arguments[0]) ?? '' : ',';
+                    return inner.split('\u0000').join(sep);
+                }
+                if (k === 'map' || k === 'flatMap' || k === 'filter' || k === 'flat' || k === 'split' || k === 'match' || k === 'matchAll') return this.spelledList(n, scope, depth);
+                if (k === 'reverse' || k === 'sort' || k === 'toSorted' || k === 'toReversed') { const l = this.exactList(n, scope, 0); return l ? l.join('\u0000') : this.spelled(c.object, scope, depth + 1); }
+                if (k === 'slice' && n.arguments.length && this.exact(c.object, scope) == null) {
+                    // A string's slice keeps its pieces contiguous; a list's slice keeps whole elements.
+                    return this.spelled(c.object, scope, depth + 1);
+                }
+                if (k === 'replace' || k === 'replaceAll') {
+                    // A written string replaced by a written string: the pieces with the replacement made (the first occurrence may be in a computed part: both ways); a pattern not written is a computed part.
+                    const inner = this.spelled(c.object, scope, depth + 1);
+                    if (inner == null) return null;
+                    const from = n.arguments[0] && literalString(n.arguments[0]), to = n.arguments[1] && literalString(n.arguments[1]);
+                    if (from == null || to == null || to.includes('$') || unchain(n.arguments[0]).regex) return null;
+                    const replaced = inner.split('\u0000').map((part) => (k === 'replaceAll' ? part.split(from).join(to) : part.replace(from, to))).join('\u0000');
+                    return inner.includes(MARKER) && k === 'replace' ? `${inner}\u0000${replaced}` : replaced;
+                }
+                if (k === 'concat') {
+                    const inner = this.spelled(c.object, scope, depth + 1);
+                    const extra = n.arguments.map((a) => this.spelled(a, scope, depth + 1) ?? MARKER).join('');
+                    return inner == null && !extra ? null : (inner ?? '') + extra;
+                }
+                if (k != null && SUBSTRING_METHODS.has(k)) return this.spelled(c.object, scope, depth + 1);
+                if (['repeat', 'padStart', 'padEnd', 'normalize', 'toLowerCase', 'toUpperCase', 'toLocaleLowerCase', 'toLocaleUpperCase', 'at', 'charAt', 'splice', 'with', 'toSpliced', 'stringify'].includes(k)) { const v = this.exact(n, scope); return v ? v.join('\u0000') : null; }
+                return undefined;
+            }
+            default: return undefined;
+        }
+    }
+    // What a value spells through what it resolves to: each alternative a
+    // branch, a computed part for one of which nothing is written.
+    spelledLeaves(n, scope, depth) {
+        const leaves = this.resolve(n, scope);
+        if (this.unread(leaves, n)) return null;
+        if (!leaves.length) return 'undefined';
+        return leaves.map((l) => this.spelledLeaf(l.node, l.scope, depth + 1) ?? MARKER).join('\u0000');
+    }
+    spelledLeaf(x, s, depth) {
+        if (x.type === 'Identifier' || x.type === 'MemberExpression' || x.type === 'CallExpression') { const d = this.spelledDirect(x, s, depth); return d === undefined ? null : d; }
+        return this.spelled(x, s, depth);
+    }
+    // A list's elements as pieces (branches), each what it spells.
+    spelledList(n, scope, depth) {
+        const elements = this.elementsOf(n, scope, 0, null);
+        if (elements.some((l) => l.node.type === 'ElementOf' && l.node.list === n)) return null;
+        if (!elements.length) return '';
+        return elements.map((l) => this.spelledLeaf(l.node, l.scope, depth + 1) ?? MARKER).join('\u0000');
+    }
+    // A URL object's part, as a written head: `new URL(rel, base).href` is on
+    // the base's origin (a relative address against any base is hierarchical:
+    // never javascript: or data:, which have no base), its pathname starts at
+    // the root; an absolute written address is itself; a part of an address
+    // not written down is computed.
+    spelledUrl(url, k, scope, depth) {
+        const [u] = url.arguments;
+        const us = u ? this.spelled(u, scope, depth + 1) : null;
+        if (us == null) return null;
+        const heads = us.split('\u0000').map((part) => part.split(MARKER)[0].replace(/^[\u0000- ]+/, ''));
+        const relative = heads.every((h) => h !== '' && !SCHEME.test(h) && !h.startsWith('//'));
+        const absolute = heads.every((h) => /^https?:/i.test(h));
+        if (k === 'href' || k === 'toString' || k === 'toJSON') return relative ? ADDRESS_HEADS.get('href') : absolute ? us : null;
+        if (k === 'pathname') return relative || absolute ? ADDRESS_HEADS.get('pathname') : null;
+        if (k === 'origin' || k === 'protocol' || k === 'host' || k === 'hostname' || k === 'port') return relative || absolute ? ADDRESS_HEADS.get(k) : null;
+        return null;
+    }
+
+    // A property name computed at run time that spells one of the names a game
+    // has no reason to hide: refused. `obj[key]` with a plain variable is not.
+    hiddenName(prop, scope) {
+        prop = unchain(prop);
+        if (!prop) return null;
+        if (escapedIdentifier(prop)) return `'${prop.raw.slice(1, -1)}' spells ${prop.value} in escapes`;
+        if (this.isDecoder(prop, scope)) return 'a name decoded at run time';
+        if (prop.type === 'Identifier') {
+            // A name bound to a plain literal (`const tag = '[object Function]'`)
+            // is readable; one bound to a built string is not.
+            const b = scope.resolve(prop.name);
+            if (!b || b.alias !== 'string' || !b.built) return null;
+            if (b.decoded) return `${prop.name}, a name decoded at run time`;
+        }
+        const s = this.spelled(prop, scope);
+        if (s == null || literalString(prop) != null) return null;
+        // \u0000 separates the branches of a conditional or the values of a
+        // reassigned name, MARKER stands where a part is computed: judged
+        // joined and one by one.
+        const whole = s.replace(MARKERS, ''), reversed = [...whole].reverse().join('');
+        if (SENSITIVE_EXACT.has(whole)) return `spells ${whole}`;
+        if (SENSITIVE_EXACT.has(reversed)) return `spells ${reversed} backwards`;
+        for (const part of s.split('\u0000')) if (SENSITIVE_EXACT.has(part)) return `spells ${part}`;
+        for (const token of (whole + '\u0000' + reversed).split(/[^\w$]+/)) if (SENSITIVE_TOKENS.has(token)) return `spells ${token}`;
+        return null;
+    }
+
+    // A number an expression is at run time when it is written in literals:
+    // 1000 * 60 * 60, 36e5, a const bound to one of those.
+    fold(n, scope, depth = 0) {
+        n = unchain(n);
+        if (!n || depth > 12) return null;
+        switch (n.type) {
+            case 'Literal': return typeof n.value === 'number' ? n.value : null;
+            case 'UnaryExpression': { const v = this.fold(n.argument, scope, depth + 1); return v == null ? null : n.operator === '-' ? -v : n.operator === '+' ? v : null; }
+            case 'BinaryExpression': {
+                const l = this.fold(n.left, scope, depth + 1), r = this.fold(n.right, scope, depth + 1);
+                if (l == null || r == null) return null;
+                switch (n.operator) { case '+': return l + r; case '-': return l - r; case '*': return l * r; case '/': return l / r; case '%': return l % r; case '**': return l ** r; default: return null; }
+            }
+            case 'Identifier': { const b = scope.resolve(n.name); return b && b.alias === 'number' ? b.value : null; }
+            case 'SequenceExpression': return this.fold(n.expressions[n.expressions.length - 1], scope, depth + 1);
+            default: return null;
+        }
+    }
+
+    // What a declaration's initialiser makes the name: a global by its name
+    // (the global object under any of its names is 'window'), a spelled
+    // string, a number.
+    aliasInfo(init, scope) {
+        if (!init) return {};
+        const g = this.globalName(init, scope);
+        if (g != null && (GLOBAL_OBJECTS.has(g) || HOST_NAMES.has(g) || unchain(init).type === 'Identifier' || unchain(init).type === 'MemberExpression')) return { alias: 'name', name: GLOBAL_OBJECTS.has(g) ? 'window' : g };
+        const fn = unchain(init);
+        if (fn && FUNCTIONS.has(fn.type)) return { alias: 'fn', node: fn, scope };
+        // Why the value is text the analyser never read, carried with the name
+        // to every markup or URL sink it reaches.
+        const hidden = this.hiddenSource(init, scope);
+        // (The address is outside text at a markup sink and a head of the page's scheme at a URL sink: a name holding it says which.)
+        const addressOnly = hidden != null && this.hiddenSource(init, scope, { url: true }) == null;
+        const with_ = (info) => (hidden ? { ...info, hidden, ...(addressOnly ? { addressOnly: true } : {}) } : info);
+        if (this.isStringy(init, scope)) return with_({ alias: 'string', spelled: this.spelled(init, scope), decoded: this.isDecoder(init, scope), built: literalString(init) == null });
+        const v = this.fold(init, scope);
+        if (v != null) return { alias: 'number', value: v };
+        // A list of written strings (`const attributes = ['title', 'alt']`): a
+        // for…of or a forEach over it reads each name.
+        const list = this.exactList(init, scope, 0);
+        if (list && list.length && list.length <= EXACT_VALUES && unchain(init).type === 'ArrayExpression') return { alias: 'strings', values: list };
+        // Anything else written: read lazily, where the name is used (resolve).
+        if (fn && !['ThisExpression', 'UpdateExpression', 'UnaryExpression', 'ClassExpression'].includes(fn.type)) return with_({ alias: 'value', nodes: [{ node: fn, scope }] });
+        return with_({});
+    }
+    // What a name takes from each element of a list of written strings: one
+    // of them, read wherever the name is used (`many`, as a name assigned one
+    // literal after another is).
+    eachOf(values) {
+        return values.length === 1 ? { alias: 'string', spelled: values[0], built: false } : { alias: 'string', spelled: values.join('\u0000'), built: false, many: true };
+    }
+
+    // The names a binding pattern introduces with what each is bound to, read
+    // off the initialiser: `const { eval: e } = window` binds e to window.eval,
+    // `const [d] = [Date]` binds d to Date. A nested pattern reads through the
+    // member it destructures; a rest element, a default, a pattern on anything
+    // but an array literal bind names the analyser knows nothing about.
+    patternAliases(pattern, init, scope) {
+        const out = [];
+        const stack = [[pattern, init]];
+        while (stack.length) {
+            const [p, from] = stack.pop();
+            if (!p) continue;
+            switch (p.type) {
+                case 'Identifier': out.push([p, from ? this.aliasInfo(from, scope) : {}]); break;
+                // `{ a = window } = {}`: the default is the value when the source yields undefined; a source
+                // the analyser reads as a global, a string or a function is taken as is, any other source
+                // and the default are both what the name may hold.
+                case 'AssignmentPattern': {
+                    const read = from ? this.aliasInfo(from, scope) : {};
+                    if (!from || (!read.alias && !read.hidden)) { stack.push([p.left, p.right]); break; }
+                    if (read.alias && read.alias !== 'value') { stack.push([p.left, from]); break; }
+                    if (p.left.type !== 'Identifier') { stack.push([p.left, from]); break; }
+                    const dflt = this.aliasInfo(p.right, scope);
+                    const nodes = [...(read.alias === 'value' ? read.nodes : [{ node: from, scope }]), ...(dflt.alias === 'value' ? dflt.nodes : [{ node: p.right, scope }])];
+                    const hidden = read.hidden || dflt.hidden;
+                    out.push([p.left, { alias: 'value', nodes, ...(hidden ? { hidden } : {}) }]);
+                    break;
+                }
+                case 'RestElement': stack.push([p.argument, null]); break;
+                case 'ObjectPattern': for (const prop of p.properties) stack.push(prop.type === 'RestElement' ? [prop.argument, null] : [prop.value, from && memberOf(from, prop)]); break;
+                case 'ArrayPattern': {
+                    // `const [a] = [window]`, and `const [m, i] = await Promise.all([…])`: the elements written there;
+                    // `const [a] = t.split('|')`, `[x] = list`: the element the list resolves to, read lazily.
+                    const list = this.listOf(from);
+                    p.elements.forEach((e, i) => { if (!e) return; if (e.type === 'RestElement') stack.push([e.argument, null]); else stack.push([e, list && list[i]?.type !== 'SpreadElement' ? list[i] : from ? elementOf(from, scope, i, e) : null]); });
+                    break;
+                }
+                default: break; // a MemberExpression target in a destructuring assignment binds nothing
+            }
+        }
+        return out;
+    }
+
+    // An assignment seen in pass 1: the target takes what it is assigned, so
+    // `let w; w = window; w[k]` is the global object indexed, as `const w =
+    // window` is. A global is taken whatever the target held before (the
+    // over-approximation that refuses); a string joins what the name already
+    // spelled (one plain literal after another is `many`, one of them read
+    // as the key wherever the name is used; anything built marks the whole
+    // as built). A target with no declaration is a property of the global
+    // object: tracked in the function and at the root when it is given one
+    // of the globals the rules judge, left alone otherwise.
+    assigned(left, right, operator, scope) {
+        const info = this.aliasInfo(right, scope);
+        if (operator === '+=' || operator === '||=' || operator === '??=' || operator === '&&=') {
+            if (operator !== '+=' && !info.alias && !info.hidden) return;
+        } else if (operator !== '=') return;
+        if (operator === '+=') {
+            const b = scope.resolve(left.name);
+            if (b && (b.alias === 'string' || this.isStringy(right, scope))) {
+                const was = b.alias === 'string' ? b.spelled : null, decoded = !!(b.decoded || info.decoded), hidden = b.hidden || info.hidden;
+                for (const k of Object.keys(b)) delete b[k];
+                Object.assign(b, { alias: 'string', spelled: (was ?? '') + (this.spelled(right, scope) ?? MARKER), built: true, decoded, ...(hidden ? { hidden } : {}) });
+            }
+            return;
+        }
+        this.bind(left.name, info, scope, right);
+    }
+    // A name takes what it is given (`info`, as aliasInfo reads it; `node` the
+    // expression, when there is one) wherever it was declared; one with no
+    // declaration is a property of the global object, tracked in the function
+    // and at the root when given one of the globals the rules judge.
+    bind(name, info, scope, node = null) {
+        const b = scope.resolve(name);
+        if (!b) {
+            // No declaration: a property of the global object, which other scripts
+            // read (the pool). A host object's name (`location = url` moves the page,
+            // `name = …` sets the window's) stays what it is unless given a global.
+            if (!info.alias && !info.hidden) return;
+            // `x = y` with y a name nobody binds says nothing of x.
+            if (info.alias === 'name' && !HOST_NAMES.has(info.name) && !GLOBAL_OBJECTS.has(info.name) && !this.globalsNamed(info.name, scope).length) return;
+            if ((HOST_NAMES.has(name) || GLOBAL_OBJECTS.has(name) || name === 'name' || name === 'history') && info.alias !== 'name') return;
+            for (const s of new Set([scope.fnScope(), scope.root()])) s.declare(name, { ...info, global: true });
+            return;
+        }
+        if (info.alias === 'name' && !HOST_NAMES.has(info.name) && !this.globalsNamed(info.name, scope).length && b.alias) return;
+        if (!info.alias && !info.hidden) return;
+        const param = b.param;
+        // A name that holds a global (the global object, document, navigator, a global another script set) keeps
+        // it whatever it is later given: `let w = window; if (c) w = {}; w[k]` indexes the window on one path, and
+        // the analyser cannot tell which is taken. The global stays one of the name's values, read with the rest.
+        if (b.alias === 'name' && info.alias !== 'name' && (GLOBAL_OBJECTS.has(b.name) || HOST_NAMES.has(b.name) || this.globalsNamed(b.name, scope).length)) {
+            const kept = { node: { type: 'Identifier', name: b.name, global: GLOBAL_OBJECTS.has(b.name) || HOST_NAMES.has(b.name), ...at(node) }, scope: scope.root() };
+            const nodes = [kept, ...(info.alias === 'value' ? info.nodes : info.alias === 'fn' ? [{ node: info.node, scope: info.scope ?? scope }] : node ? [{ node, scope }] : [])];
+            const hidden = b.hidden || info.hidden;
+            for (const k of Object.keys(b)) delete b[k];
+            Object.assign(b, { alias: 'value', nodes });
+            if (hidden) b.hidden = hidden;
+            if (param) b.param = param;
+            return;
+        }
+        if (!b.alias || info.alias === 'name' || info.alias === 'fn' || (b.alias === 'name' && !GLOBAL_OBJECTS.has(b.name))) { const hidden = b.hidden, addressOnly = b.addressOnly, cut = b.cut, dropped = b.dropped; for (const k of Object.keys(b)) delete b[k]; Object.assign(b, info); if (hidden && !b.hidden) { b.hidden = hidden; if (addressOnly) b.addressOnly = true; } else if (b.hidden && !info.addressOnly) delete b.addressOnly; if (param) b.param = param; if (cut) { b.cut = true; if (dropped) b.dropped = dropped; } return; }
+        if (b.alias === 'string' && info.alias === 'string') {
+            const plain = !b.built && !info.built;
+            const spelled = b.spelled == null ? info.spelled : info.spelled == null ? b.spelled : `${b.spelled}\u0000${info.spelled}`;
+            Object.assign(b, { spelled, built: !plain, many: plain, decoded: !!(b.decoded || info.decoded) });
+        } else if (b.alias === 'value' && info.alias === 'value') {
+            // One more expression the name may hold; past the bound the rest is not read: the name is marked
+            // cut (unread at a sink), and holds the global object when any expression dropped mentions one.
+            if (b.nodes.length >= VALUE_NODES) { b.cut = true; b.dropped = b.dropped ?? []; if (b.dropped.length < VALUE_NODES * 2) b.dropped.push(...info.nodes); }
+            else b.nodes.push(...info.nodes);
+        } else if (b.alias === 'value' || info.alias === 'value' || b.alias !== info.alias) {
+            // A string then an object, a number then a list: the name holds either, read lazily.
+            const nodes = [...(b.alias === 'value' ? b.nodes : b.nodes_ ?? []), ...(info.alias === 'value' ? info.nodes : [])];
+            const hidden = b.hidden || info.hidden;
+            if (b.alias !== 'value' && b.alias !== 'name') nodes.push(...(b.node ? [{ node: b.node, scope }] : []));
+            for (const k of Object.keys(b)) delete b[k];
+            Object.assign(b, nodes.length ? { alias: 'value', nodes } : {});
+            if (hidden) b.hidden = hidden;
+            if (param) b.param = param;
+            return;
+        }
+        if (info.hidden && !b.hidden) { b.hidden = info.hidden; if (info.addressOnly) b.addressOnly = true; }
+        else if (info.hidden && b.addressOnly && !info.addressOnly) { b.hidden = info.hidden; delete b.addressOnly; }
+    }
+    // The elements an expression lists, for a pattern to read: an array
+    // written down, or `await Promise.all([…])` (each element's settled value).
+    listOf(from) {
+        let n = unchain(from);
+        if (n?.type === 'AwaitExpression') n = unchain(n.argument);
+        if (n?.type === 'CallExpression') {
+            const c = unchain(n.callee);
+            if (c.type === 'MemberExpression' && ['all', 'allSettled'].includes(staticKey(c)) && this.globalName(c.object, this.root) === 'Promise') n = unchain(n.arguments[0]);
+            else return null;
+        }
+        return n?.type === 'ArrayExpression' ? n.elements : null;
+    }
+
+    // ---- pass 1: scopes and declarations, so pass 2 can resolve every name ----
+
+    buildScopes(ast) {
+        this.pass1 = true;
+        const root = new Scope(null, true, true, this);
+        this.scopes.set(ast, root);
+        this.root = root;
+        const stack = [{ node: ast, parent: null, scope: root, ctx: 'expr' }];
+        while (stack.length) {
+            const frame = stack.pop();
+            const { node, parent, scope, ctx } = frame;
+            // (Each node read with the resolver's budget of its own.)
+            this.begin();
+            // A declaration or an assignment is recorded after its children:
+            // `a = (b = window, b)` binds b first, then reads it for a.
+            if (frame.after) { this.record(node, scope); continue; }
+            let inner = scope;
+            switch (node.type) {
+                case 'Program': inner = root; this.hoist(node.body, root); break;
+                case 'Identifier':
+                    // A name read: a function read otherwise than as a callee is called from where the analyser does not see.
+                    if (ctx === 'expr' && !(parent?.type === 'AssignmentExpression' && parent.left === node && parent.operator === '=')) this.refs.push({ node, parent, grand: frame.grand, scope });
+                    break;
+                case 'ObjectExpression':
+                    // An object handed to a function (an argument) may have its methods called from where the analyser does not see.
+                    if (parent && ((parent.type === 'CallExpression' || parent.type === 'NewExpression') && parent.arguments.includes(node) || parent.type === 'SpreadElement')) this.handed.push({ node, scope });
+                    break;
+                // Markup the code writes as a string: its elements are elements of the page once written (a lookup finds them, the pool holds them).
+                case 'Literal': if (typeof node.value === 'string' && MARKUP_IN_TEXT.test(node.value)) this.collectWritten(node.value); break;
+                case 'TemplateLiteral': { if (node.expressions.length) { const t = node.quasis.map((q) => q.value.cooked ?? '').join(MARKER); if (MARKUP_IN_TEXT.test(t)) this.collectWritten(t); } break; }
+                case 'FunctionDeclaration': case 'FunctionExpression': case 'ArrowFunctionExpression': {
+                    const arrow = node.type === 'ArrowFunctionExpression';
+                    // An arrow's this is its surroundings'. A method's this is its
+                    // object (a class member, an object literal's property, a
+                    // function assigned to a property such as X.prototype.m, one
+                    // given a receiver by .call/.apply/.bind). Any other function
+                    // (a declaration, an IIFE, a callback, a constructor) may be
+                    // called bare, and in a classic script its this is then the
+                    // global object: judged as such (the over-approximation that
+                    // refuses; in a module it would be undefined).
+                    inner = new Scope(scope, true, arrow ? scope.thisGlobal : !this.isMethod(node, parent), this);
+                    inner.node = node;
+                    this.scopes.set(node, inner);
+                    // A method of an object literal: its `this` is the literal (resolved as such).
+                    if (!arrow && parent?.type === 'Property' && parent.value === node && frame.grand?.type === 'ObjectExpression') this.methodOf.set(node, { node: frame.grand, scope });
+                    // `arguments` of a function that is not an arrow: the arguments written at its call sites.
+                    if (!arrow) inner.declare('arguments', { alias: 'arguments', fn: node });
+                    if (node.id) (node.type === 'FunctionDeclaration' ? scope : inner).declare(node.id.name, node.type === 'FunctionDeclaration' ? { alias: 'fn', node, scope } : {});
+                    // (function (root) { … })(window): the parameter is the window inside.
+                    const iife = parent && parent.type === 'CallExpression' && parent.callee === node;
+                    // ['title', 'alt'].forEach((name) => …): the first parameter is one of the names; list.forEach((item) => …): an element of the list.
+                    const each = this.paramStrings.get(node), list = this.paramLists.get(node);
+                    // fetch(u).then((r) => r.text()).then((t) => …), addEventListener('message', (e) => …): the first parameter is text from outside.
+                    const hidden = this.paramHidden.get(node);
+                    // p.then((v) => …): the first parameter is the chain's value (read lazily: what the receiver resolves to).
+                    const given = this.paramValues.get(node);
+                    node.params.forEach((p, i) => {
+                        const param = { fn: node, index: i };
+                        if (i === 0 && each && p.type === 'Identifier') { inner.declare(p.name, { ...this.eachOf(each), param }); this.countName(p.name); return; }
+                        if (i === 0 && hidden && p.type === 'Identifier') { inner.declare(p.name, { hidden, param }); this.countName(p.name); return; }
+                        if (list && i === (list.index ?? 0) && p.type === 'Identifier') { inner.declare(p.name, { ...this.aliasInfo(elementOf(list.list, list.scope, null, p), list.scope), param }); this.countName(p.name); return; }
+                        if (i === 0 && given && p.type === 'Identifier') { inner.declare(p.name, { alias: 'value', nodes: [{ node: given.node, scope: given.scope }], param }); this.countName(p.name); return; }
+                        const from = iife ? parent.arguments[i] : list && i === (list.index ?? 0) ? elementOf(list.list, list.scope, null, p) : given && i === 0 ? given.node : null;
+                        for (const [id, info] of this.patternAliases(p, from, iife ? scope : list ? list.scope : given && i === 0 ? given.scope : scope)) {
+                            const plain = p.type === 'Identifier' || (p.type === 'AssignmentPattern' && p.left === id);
+                            const declared = info.alias === 'name' ? { alias: 'name', name: info.name } : info.hidden ? { hidden: info.hidden } : {};
+                            if (info.alias && info.alias !== 'name' && from) Object.assign(declared, info);
+                            // (A destructured parameter is read from each call site's argument through its pattern.)
+                            declared.param = plain ? param : { ...param, pattern: p, id };
+                            if (i === 0 && hidden) declared.hidden = hidden;
+                            inner.declare(id.name, declared);
+                            this.countName(id.name);
+                        }
+                    });
+                    break;
+                }
+                case 'ForOfStatement': {
+                    // for (const name of ['title', 'alt']), or of a const bound to such a list: the name is one of them.
+                    // for (const w of [window]): the name is a global written in the list (the first; refuses).
+                    // for (const p of parts): an element of the list, read lazily.
+                    inner = new Scope(scope, false, scope.thisGlobal, this); this.scopes.set(node, inner);
+                    const list = unchain(node.right)?.type === 'ArrayExpression' || unchain(node.right)?.type === 'Identifier' ? this.exactList(node.right, scope, 0) : null;
+                    const elements = unchain(node.right)?.type === 'ArrayExpression' ? unchain(node.right).elements.filter((e) => e && e.type !== 'SpreadElement') : [];
+                    const global = elements.map((e) => this.globalName(e, scope)).find((g) => g != null && (GLOBAL_OBJECTS.has(g) || HOST_NAMES.has(g)));
+                    const info = list && list.length && list.length <= EXACT_VALUES ? this.eachOf(list) : global ? { alias: 'name', name: GLOBAL_OBJECTS.has(global) ? 'window' : global } : this.aliasInfo(elementOf(node.right, scope, null, node.left), scope);
+                    if (node.left.type === 'VariableDeclaration' && node.left.declarations.length === 1) {
+                        const id = node.left.declarations[0].id;
+                        const target = node.left.kind === 'var' ? scope.fnScope() : inner;
+                        if (id.type === 'Identifier') { target.declare(id.name, info); this.countName(id.name); }
+                        else for (const [pid, pinfo] of this.patternAliases(id, elementOf(node.right, scope, null, id), scope)) { target.declare(pid.name, pinfo); this.countName(pid.name); }
+                    } else if (node.left.type === 'Identifier') this.bind(node.left.name, info, scope);
+                    break;
+                }
+                case 'CallExpression': case 'NewExpression': {
+                    const c = unchain(node.callee);
+                    this.calls.push({ node, scope });
+                    if (node.type === 'NewExpression') break;
+                    if (c.type === 'MemberExpression' && (EACH_METHODS.has(staticKey(c)) || staticKey(c) === 'reduce') && node.arguments[0] && FUNCTIONS.has(node.arguments[0].type)) {
+                        const list = this.exactList(c.object, scope, 0);
+                        if (list && list.length && list.length <= EXACT_VALUES && staticKey(c) !== 'reduce') this.paramStrings.set(node.arguments[0], list);
+                        else this.paramLists.set(node.arguments[0], { list: c.object, scope, index: staticKey(c) === 'reduce' ? 1 : 0 });
+                    }
+                    // p.then((value) => …): the value is the chain's, text from outside
+                    // when the chain fetched it. A chain is read once, from its base
+                    // up (its outermost link is visited first), so a chain of any
+                    // length costs its length; once text from outside flows in, every
+                    // later callback's parameter is that text (a callback that turns
+                    // it into something else is not read: the over-approximation refuses).
+                    if (c.type === 'MemberExpression' && ['then', 'catch', 'finally'].includes(staticKey(c)) && !this.thenRead.has(node)) {
+                        const links = [];
+                        let base = node;
+                        while (base && base.type === 'CallExpression') {
+                            const cc = unchain(base.callee);
+                            if (cc.type !== 'MemberExpression' || !['then', 'catch', 'finally'].includes(staticKey(cc))) break;
+                            links.push(base); base = unchain(cc.object);
+                        }
+                        let why = this.outside(base, scope);
+                        for (let i = links.length - 1; i >= 0; i--) {
+                            const link = links[i];
+                            this.thenRead.add(link);
+                            const arg = link.arguments.find((a) => FUNCTIONS.has(unchain(a)?.type) || unchain(a)?.type === 'Identifier');
+                            if (!arg) continue;
+                            if (why) this.handlers.push({ arg, scope, why });
+                            if (staticKey(unchain(link.callee)) !== 'then') continue;
+                            // The callback's first parameter is the chain's value so far: Promise.resolve(window).then((w) => w[k]) indexes the window.
+                            if (FUNCTIONS.has(unchain(arg).type) && unchain(link.callee).object) this.paramValues.set(unchain(arg), { node: unchain(link.callee).object, scope });
+                            const callback = this.callbackOf(arg, scope);
+                            why = why || (callback ? this.returnsOf(callback.node).map((r) => this.outside(r, this.scopes.get(callback.node) ?? scope)).find(Boolean) : null) || null;
+                        }
+                    }
+                    // addEventListener('message', handler), in every spelling: bare or on any target, the
+                    // handler inline or by name, the event's name written, spelled or not written (then it
+                    // may be 'message'): the handler's first parameter is another window's text.
+                    const listens = (c.type === 'MemberExpression' && staticKey(c) === 'addEventListener') || (c.type === 'Identifier' && this.globalName(c, scope) === 'addEventListener');
+                    if (listens && node.arguments[1]) {
+                        const names = node.arguments[0] ? this.exact(node.arguments[0], scope) : null;
+                        if (!names || names.some((e) => /^message(?:error)?$/i.test(e))) this.handlers.push({ arg: node.arguments[1], scope, why: 'a message from another window' });
+                    }
+                    // A write read back elsewhere: m.set(k, v), arr.push(v), el.setAttribute(name, v), storage.setItem(k, v), history.replaceState(state).
+                    if (c.type === 'MemberExpression' && ['set', 'push', 'unshift', 'add', 'setAttribute', 'setItem', 'replaceState', 'pushState'].includes(staticKey(c))) {
+                        const value = staticKey(c) === 'set' || staticKey(c) === 'setAttribute' || staticKey(c) === 'setItem' ? node.arguments[1] : node.arguments[0];
+                        if (value && this.writes.length < WRITES) this.writes.push({ node, value, scope, target: undefined });
+                    }
+                    break;
+                }
+                case 'ClassDeclaration': case 'ClassExpression':
+                    inner = new Scope(scope, false, false, this);
+                    this.scopes.set(node, inner);
+                    if (node.id) { inner.declare(node.id.name); if (node.type === 'ClassDeclaration') scope.declare(node.id.name); this.countName(node.id.name); }
+                    break;
+                case 'StaticBlock': inner = new Scope(scope, false, false, this); this.scopes.set(node, inner); break;
+                case 'BlockStatement': case 'ForStatement': case 'ForInStatement': case 'SwitchStatement':
+                    inner = new Scope(scope, false, scope.thisGlobal, this); this.scopes.set(node, inner);
+                    if (node.type === 'BlockStatement') this.hoist(node.body, inner);
+                    break;
+                case 'CatchClause':
+                    inner = new Scope(scope, false, scope.thisGlobal, this); this.scopes.set(node, inner);
+                    if (node.param) for (const id of patternNames(node.param)) { inner.declare(id.name); this.countName(id.name); }
+                    break;
+                case 'VariableDeclaration': case 'AssignmentExpression':
+                    // Recorded once the children are walked (the frame below the children pops after them).
+                    stack.push({ node, parent, scope, after: true });
+                    if (node.type === 'AssignmentExpression') {
+                        // x.onmessage = handler: the handler's first parameter is another window's text.
+                        if ((node.left.type === 'MemberExpression' && staticKey(node.left) === 'onmessage') || (node.left.type === 'Identifier' && node.left.name === 'onmessage')) this.handlers.push({ arg: node.right, scope, why: 'a message from another window' });
+                        // o.k = v, el.dataset.x = v, this.x = v: a write read back where the same thing is read.
+                        if (unchain(node.left).type === 'MemberExpression' && this.writes.length < WRITES) this.writes.push({ node, value: node.right, scope, target: undefined });
+                    }
+                    break;
+                case 'ImportDeclaration': {
+                    const from = node.source.value;
+                    this.imports.push(from);
+                    for (const s of node.specifiers) {
+                        if (s.type === 'ImportNamespaceSpecifier') root.declare(s.local.name, { alias: 'module', from });
+                        else root.declare(s.local.name, { alias: 'import', from, name: s.type === 'ImportDefaultSpecifier' ? 'default' : s.imported.type === 'Identifier' ? s.imported.name : String(s.imported.value) });
+                        this.countName(s.local.name);
+                    }
+                    break;
+                }
+                case 'ExportNamedDeclaration': {
+                    const d = node.declaration;
+                    if (d?.type === 'VariableDeclaration') for (const decl of d.declarations) for (const id of patternNames(decl.id)) this.exports.set(id.name, { local: id.name });
+                    else if (d?.id) this.exports.set(d.id.name, { local: d.id.name });
+                    for (const s of node.specifiers) {
+                        const exported = s.exported.type === 'Identifier' ? s.exported.name : String(s.exported.value);
+                        const local = s.local.type === 'Identifier' ? s.local.name : String(s.local.value);
+                        this.exports.set(exported, node.source ? { from: node.source.value, name: local } : { local });
+                    }
+                    break;
+                }
+                case 'ExportDefaultDeclaration': {
+                    const d = node.declaration;
+                    if (d.type === 'FunctionDeclaration' || d.type === 'ClassDeclaration') { if (d.id) this.exports.set('default', { local: d.id.name }); else { this.exports.set('default', { local: '*default*' }); if (d.type === 'FunctionDeclaration') root.declare('*default*', { alias: 'fn', node: d, scope: root }); } }
+                    else { this.exports.set('default', { local: '*default*' }); stack.push({ node, parent, scope, after: true }); }
+                    break;
+                }
+                case 'ExportAllDeclaration':
+                    if (node.exported) this.exports.set(node.exported.type === 'Identifier' ? node.exported.name : String(node.exported.value), { from: node.source.value, name: '*' });
+                    else this.stars.push(node.source.value);
+                    break;
+                default: break;
+            }
+            // Children in source order (the stack pops the last pushed first):
+            // a declaration's initialiser sees the names declared before it, so
+            // `const a = window; const b = a` makes b the window too.
+            const kids = [...children(node)];
+            for (let i = kids.length - 1; i >= 0; i--) {
+                const childContext = childCtx(node, kids[i][0], ctx);
+                stack.push({ node: kids[i][1], parent: node, grand: parent, scope: inner, ctx: childContext });
+            }
+        }
+        this.finishScopes();
+        this.pass1 = false;
+    }
+    // What a declaration or an assignment binds, read once its right side has
+    // been walked (so an assignment inside it is recorded first).
+    record(node, scope) {
+        this.begin();
+        if (node.type === 'VariableDeclaration') {
+            const target = node.kind === 'var' ? scope.fnScope() : scope;
+            for (const d of node.declarations) {
+                for (const [id, info] of this.patternAliases(d.id, d.init, scope)) { target.declare(id.name, info); this.countName(id.name); }
+            }
+            return;
+        }
+        if (node.type === 'ExportDefaultDeclaration') { this.root.declare('*default*', this.aliasInfo(node.declaration, scope)); return; }
+        const left = unchain(node.left);
+        if (left.type === 'Identifier') this.assigned(left, node.right, node.operator, scope);
+        // [a] = [window], ({ a } = { a: window }), ({ a = window } = {}): each name takes what the pattern reads for it.
+        else if ((left.type === 'ArrayPattern' || left.type === 'ObjectPattern') && node.operator === '=') {
+            for (const [id, info] of this.patternAliases(left, node.right, scope)) if (info.alias || info.hidden) this.bind(id.name, info, scope);
+        }
+        // window.w = navigator: the global `w`, assigned (its value read where it is written, bound at the root).
+        else if (left.type === 'MemberExpression' && GLOBAL_OBJECTS.has(this.globalName(left.object, scope))) {
+            const k = this.key(left, scope);
+            if (k != null && IDENTIFIER.test(k) && node.operator === '=') { const info = this.aliasInfo(node.right, scope); if (info.alias || info.hidden) this.bindGlobal(k, info); }
+        }
+        // o.__proto__ = window: o reads every global through its prototype chain; the name is the global object from here on.
+        else if (left.type === 'MemberExpression' && this.key(left, scope) === '__proto__' && node.operator === '=' && unchain(left.object).type === 'Identifier') {
+            const g = this.globalName(node.right, scope);
+            if (g != null && (GLOBAL_OBJECTS.has(g) || g === 'document')) this.bind(unchain(left.object).name, { alias: 'name', name: g === 'document' ? 'document' : 'window' }, scope, node.right);
+        }
+    }
+    // A property of the global object given a value: bound at the root, for
+    // this file and (through the pool) the others.
+    bindGlobal(name, info) {
+        const b = this.root.names.get(name);
+        if (!b) { this.root.declare(name, { ...info, global: true }); return; }
+        const was = { ...b };
+        this.bind(name, info, this.root);
+        if (!b.alias && was.alias) Object.assign(b, was);
+        b.global = true;
+    }
+    // After pass 1: the handlers' parameters are marked (a handler given by
+    // name has its scope only now), each function's call sites are gathered,
+    // and the functions called from where the analyser does not see (read as
+    // a value, exported, declared at a classic script's root, set on the
+    // global object) are marked escaped: their parameters stay unknown.
+    finishScopes() {
+        for (const h of this.handlers) {
+            // (Resolved now: a handler given by a name declared further down has its binding only at the end.)
+            const cb = h.fn ? { node: h.fn } : this.callbackOf(h.arg, h.scope);
+            if (!cb) continue;
+            const inner = this.scopes.get(cb.node);
+            const p = cb.node.params[0];
+            if (!inner || !p) continue;
+            for (const id of patternNames(p)) { const b = inner.names.get(id.name); if (b && !b.hidden) b.hidden = h.why; }
+        }
+        for (const { node, scope } of this.calls) {
+            const c = unchain(node.callee);
+            let fn = null;
+            if (FUNCTIONS.has(c.type)) fn = c;
+            else if (c.type === 'Identifier') { const b = scope.resolve(c.name); if (b?.alias === 'fn') fn = b.node; }
+            else if (c.type === 'SequenceExpression') { const last = unchain(c.expressions[c.expressions.length - 1]); if (FUNCTIONS.has(last.type)) fn = last; }
+            if (!fn) continue;
+            let s = this.sites.get(fn);
+            if (!s) this.sites.set(fn, (s = []));
+            if (s.length < EXACT_VALUES * 2) s.push({ args: node.arguments, scope }); else this.escaped.add(fn);
+        }
+        for (const r of this.refs) {
+            const b = r.scope.resolve(r.node.name);
+            if (b?.alias === 'value') { this.escapesMethod(r); continue; }
+            if (b?.alias !== 'fn') continue;
+            if (this.escapes(r)) this.escaped.add(b.node);
+        }
+        // The methods of an object handed to a function are called from where the analyser does not see.
+        for (const h of this.handed) for (const p of h.node.properties) { const v = p.type === 'Property' ? unchain(p.value) : null; if (v && FUNCTIONS.has(v.type)) this.escaped.add(v); }
+        // An exported function, a classic script's root function, one set on the global object: called from other
+        // files too. The scan gathers those calls across the bundle (bundle.mjs); a one-file analysis cannot.
+        for (const [, e] of this.exports) if (e.local != null) { const b = this.root.names.get(e.local); if (b?.alias === 'fn') this.open.add(b.node); }
+        for (const b of this.root.names.values()) if (b.alias === 'fn' && (this.mode === 'script' || b.global)) this.open.add(b.node);
+    }
+    // Does this reference to a name hand what it names on to code the analyser
+    // does not see? A call of it does not; a function set as a property of an
+    // object literal kept in a name (a module object, `window.X = { f }`) is
+    // called through that object, which the resolver follows; an export
+    // (`export { f }`) is reached by its importers, whose calls the scan
+    // gathers. Anything else (an argument, a value kept in a name, a default
+    // export) is a call site the analyser does not read.
+    escapes(r) {
+        const called = r.parent && (r.parent.type === 'CallExpression' || r.parent.type === 'NewExpression') && unchain(r.parent.callee) === r.node;
+        const stored = r.parent?.type === 'Property' && r.parent.value === r.node && r.grand?.type === 'ObjectExpression' && !this.handed.some((h) => h.node === r.grand);
+        const exported = r.parent?.type === 'ExportSpecifier';
+        return !called && !stored && !exported;
+    }
+    // A function of another file (an import, a member of a namespace, a global
+    // another script set) or a method of a written object, referenced here
+    // otherwise than as a callee — handed to forEach, a timer, a listener, kept
+    // in a name — is called from where the analyser does not see: escaped, in
+    // the file that wrote it, so its parameters stay unknown there. Run once
+    // the bundle is wired (bundle.mjs), before the call sites are gathered.
+    collectEscapes() {
+        for (const r of this.refs) {
+            const b = r.scope.resolve(r.node.name);
+            // (Only a name that reaches another file is followed: an import, a namespace, a global another script set.
+            // This file's own functions are marked by finishScopes, its written objects' methods by escapesMethod.)
+            if (b && b.alias !== 'import' && b.alias !== 'module' && b.alias !== 'name') continue;
+            if (!b && !this.globalsNamed(r.node.name, r.scope).length) continue;
+            if (b?.alias === 'name' && (GLOBAL_OBJECTS.has(b.name) || HOST_NAMES.has(b.name))) continue;
+            // The expression used: the name, or the member chain read off it (ns.f, API.show).
+            let used = r.node, parent = r.parent, grand = r.grand;
+            if (parent?.type === 'MemberExpression' && parent.object === r.node) {
+                used = parent; parent = grand; grand = null;
+                // (Only one member deep is known here: a longer chain's parent is not recorded, so it is read as handed on.)
+            }
+            if (!this.escapes({ node: used, parent, grand })) continue;
+            this.begin();
+            let leaves;
+            try { leaves = this.resolve(used, r.scope); } catch { continue; }
+            for (const l of leaves) {
+                if (!FUNCTIONS.has(l.node.type)) continue;
+                const owner = l.scope.analysis ?? this;
+                if (owner.scopes.has(l.node)) owner.escaped.add(l.node);
+            }
+        }
+        this.cache.clear();
+    }
+    // A method of a written object kept in a name (`const API = { show(h) { … } }`), read off it otherwise than
+    // as a callee (`setTimeout(API.show)`, `list.forEach(API.show)`): called from where the analyser does not see.
+    // By the syntax alone: the name's object literals, the property of that name, a function written there.
+    escapesMethod(r) {
+        const m = r.parent;
+        if (m?.type !== 'MemberExpression' || m.object !== r.node) return;
+        const k = this.key(m, r.scope);
+        if (k == null) return;
+        if (!this.escapes({ node: m, parent: r.grand, grand: null })) return;
+        const b = r.scope.resolve(r.node.name);
+        if (b?.alias !== 'value') return;
+        for (const v of b.nodes) {
+            const x = unchain(v.node);
+            if (x?.type !== 'ObjectExpression') continue;
+            for (const p of x.properties) {
+                if (p.type !== 'Property' || p.computed) continue;
+                const name = p.key.type === 'Identifier' ? p.key.name : String(p.key.value);
+                const fn = unchain(p.value);
+                if (name === k && fn && FUNCTIONS.has(fn.type)) this.escaped.add(fn);
+            }
+        }
+    }
+    collectWritten(text) {
+        if (this.writtenOverflow) return;
+        const { elements } = analyseHtml(text);
+        if (this.written.length + elements.length > ELEMENTS) { this.writtenOverflow = true; return; }
+        for (const e of elements) this.written.push({ ...e, written: true });
+    }
+    // Every call of this file whose callee the resolver reaches as a function
+    // (a method of a written object, an export, a function set on the global
+    // object by another file): a call site of that function, in whatever file
+    // it is, so its parameters are the arguments written there. Run once the
+    // bundle is wired (bundle.mjs), or on the file alone (judgeSource).
+    collectSites() {
+        if (this.sitesCollected) return;
+        this.sitesCollected = true;
+        // (The writes were indexed in pass 1, before every write was recorded: indexed again when next read.)
+        this.writesByKey = null; this.writesBySyntax = null;
+        // (Innermost first: a chain of calls is then read once, each link from the one below it already read.)
+        for (let i = this.calls.length - 1; i >= 0; i--) {
+            const { node, scope } = this.calls[i];
+            this.begin();
+            const c = unchain(node.callee);
+            if (c.type !== 'MemberExpression' && c.type !== 'Identifier') continue;
+            let leaves;
+            try { leaves = this.resolve(c, scope); } catch { continue; }
+            for (const l of leaves) {
+                if (!FUNCTIONS.has(l.node.type)) continue;
+                const owner = l.scope.analysis ?? this;
+                if (!owner.scopes.has(l.node)) continue;
+                let s = owner.sites.get(l.node);
+                if (!s) owner.sites.set(l.node, (s = []));
+                if (s.some((x) => x.args === node.arguments)) continue;
+                if (s.length < 128) s.push({ args: node.arguments, scope }); else owner.escaped.add(l.node);
+            }
+        }
+        this.cache.clear();
+    }
+    // Where a recorded write lands (target), read once and kept.
+    targetOf(w) {
+        if (w.target === undefined) {
+            const t = w.node.type === 'AssignmentExpression' ? this.target(w.node.left, w.scope) : this.target(w.node, w.scope);
+            w.target = t;
+            w.key = t ? t.key : null;
+        }
+        return w.target;
+    }
+
+    // A function declaration is hoisted: known to the whole block before the
+    // line it stands on (`const w = g(); … function g() { return this }`).
+    hoist(statements, scope) {
+        for (const s of statements) if (s.type === 'FunctionDeclaration' && s.id) scope.declare(s.id.name, { alias: 'fn', node: s });
+    }
+    // Is this function's this its object's? A class member, an object
+    // literal's property, a function assigned to a property (X.prototype.m =
+    // function, el.onload = function), one handed a receiver (.call, .apply,
+    // .bind), a getter or setter. Anything else may be called bare.
+    isMethod(fn, parent) {
+        if (!parent) return false;
+        switch (parent.type) {
+            case 'MethodDefinition': case 'PropertyDefinition': case 'Property': return parent.value === fn;
+            case 'AssignmentExpression': return parent.right === fn && unchain(parent.left).type === 'MemberExpression';
+            case 'MemberExpression': return parent.object === fn && ['call', 'apply', 'bind'].includes(staticKey(parent));
+            default: return false;
+        }
+    }
+    countName(name) {
+        this.names++;
+        if (name.length <= 2) this.short++;
+        if (HEX_NAME.test(name)) this.hexNames++;
+    }
+
+    // ---- pass 2: the rules ----------------------------------------------------
+
+    run(ast) {
+        const stack = [{ node: ast, parent: null, grand: null, key: null, ctx: 'expr', scope: this.scopes.get(ast) }];
+        while (stack.length) {
+            const frame = stack.pop();
+            const { node, ctx } = frame;
+            const inner = this.scopes.get(node) || frame.scope;
+            if (ctx === 'expr') this.check(frame);
+            else if (ctx === 'bind' && node.type !== 'Identifier') this.check(frame); // a default value or computed key inside a pattern
+            for (const [key, child] of children(node)) {
+                const childContext = childCtx(node, key, ctx);
+                if (childContext === 'skip') continue;
+                stack.push({ node: child, parent: node, grand: frame.parent, key, parentKey: frame.key, ctx: childContext, scope: inner });
+            }
+        }
+    }
+
+    check(frame) {
+        const { node, parent, key, scope } = frame;
+        this.begin();
+        switch (node.type) {
+            // A constant spelled across pieces is judged where it stands, as a
+            // literal is: 'java' + 'script:x', ['<img o', 'nerror=x>'].join(''),
+            // atob('PGltZy…') anywhere in the code, not only at a sink (a helper
+            // may hand it to one).
+            case 'BinaryExpression': if (node.operator === '+' && !(parent?.type === 'BinaryExpression' && parent.operator === '+')) this.constant(node, scope); return;
+            case 'Identifier': {
+                if (frame.ctx === 'bind') return;
+                // The target of a plain assignment is written, not read (`W = WebAssembly` binds W; the right side is the reference).
+                if (parent?.type === 'AssignmentExpression' && key === 'left' && parent.operator === '=') return;
+                // An unshadowed name is the global of that name; a name bound to
+                // a global (`const e = eval`, `let d; d = Date`) is judged as it.
+                const g = this.globalName(node, scope);
+                if (g != null) this.globalReference(g, frame);
+                return;
+            }
+            case 'MemberExpression': return this.member(frame);
+            case 'VariableDeclarator': if (node.id.type !== 'Identifier' && node.init) this.destructure(node.id, node.init, scope); return;
+            case 'CallExpression': { this.call(frame); const c = unchain(node.callee); if (this.isDecoder(node, scope) || (c.type === 'MemberExpression' && staticKey(c) === 'join')) this.constant(node, scope); return; }
+            case 'NewExpression': return this.construct(frame);
+            case 'WithStatement': return this.add('with', node, 'with (…)');
+            case 'ForInStatement': if (this.isGlobalObject(node.right, scope)) this.add('computed-global', node, 'for (… in the global object)'); return;
+            case 'SpreadElement': if (parent.type === 'ObjectExpression' && this.isGlobalObject(node.argument, scope)) this.add('computed-global', node, '{ ...the global object }'); return;
+            case 'ImportExpression': {
+                const s = literalString(node.source);
+                if (s == null) this.add('import-dynamic', node, 'import(…) of a computed address');
+                else if (SCHEME.test(s)) this.add('import-url', node, `import(${JSON.stringify(s.slice(0, 60))})`);
+                return;
+            }
+            case 'ImportDeclaration': case 'ExportAllDeclaration': case 'ExportNamedDeclaration': {
+                const s = node.source && literalString(node.source);
+                if (s != null && SCHEME.test(s)) this.add('import-url', node, `import from ${JSON.stringify(s.slice(0, 60))}`);
+                return;
+            }
+            case 'AssignmentExpression': {
+                const left = unchain(node.left);
+                if (left.type === 'ObjectPattern' || left.type === 'ArrayPattern') return this.destructure(left, node.right, scope);
+                if (left.type === 'MemberExpression') {
+                    const k = this.key(left, scope);
+                    const o = this.globalName(left.object, scope);
+                    // el.dataset.src is the data-src attribute, not the element's address.
+                    const inner = unchain(left.object);
+                    if (inner.type === 'MemberExpression' && this.key(inner, scope) === 'dataset') return;
+                    if (k === 'srcdoc') this.add('navigation', node, 'srcdoc =');
+                    // Any part of the address written is read back by the page: text decoded or fetched written there is refused as at a URL sink.
+                    if (o === 'location') { this.add('navigate', node, `location.${k ?? '[…]'} =`); this.urlSink(node, node.right, scope, `location.${k ?? '[…]'} =`); }
+                    // window.location = u and document.location = u move the page as location = u does.
+                    if (k === 'location' && (GLOBAL_OBJECTS.has(o) || o === 'document')) { this.add('navigate', node, `${o === 'document' ? 'document' : 'window'}.location =`); this.urlSink(node, node.right, scope, 'location ='); }
+                    if (k != null && MARKUP_PROPS.has(k)) this.markupSink(node, node.right, scope, `${k} ${node.operator}`);
+                    else if (k != null && URL_PROPS.has(k)) this.urlSink(node, node.right, scope, `${k} =`, left.object);
+                    else if (k === 'protocol') this.protocolSink(node, node.right, scope, 'protocol =');
+                    // o.__proto__ = window: o reads every global through its prototype chain, by whatever name.
+                    else if (k === '__proto__' && this.isGlobalObject(node.right, scope)) this.add('computed-global', node, '__proto__ = the global object: every global reached through the prototype chain');
+                } else if (left.type === 'Identifier' && this.globalName(left, scope) === 'location') { this.add('navigate', node, 'location ='); this.urlSink(node, node.right, scope, 'location ='); }
+                return;
+            }
+            case 'Literal': if (typeof node.value === 'string') this.text(node, node.value, node.raw); return;
+            // A template's markup is read whole, each expression standing in as a
+            // word: `<div class="${c}" onclick="…">` is one tag, not two halves.
+            case 'TemplateLiteral': if (node.expressions.length) { const values = this.exact(node, scope); if (values) for (const v of values) this.text(node, v, null); else for (const s of this.shapes(node, scope)) this.markup(node, s); } return;
+            case 'TemplateElement': this.text(node, node.value.cooked ?? node.value.raw, node.value.raw, parent.expressions.length === 0); return;
+            default: return;
+        }
+    }
+    constant(node, scope) {
+        if (literalString(node) != null) return;
+        const values = this.exact(node, scope);
+        if (!values) return;
+        for (const v of values) this.text(node, v, null);
+    }
+    // `a.protocol = 'javascript'`: a link whose address has a scheme that is
+    // not special (`x:evil()`) takes another such scheme from its protocol
+    // setter (the URL Standard's scheme state with a state override), and
+    // becomes javascript:evil(). The scheme is judged as what it spells; one
+    // not written down is refused.
+    protocolSink(node, value, scope, what) {
+        if (!value) return;
+        const hidden = this.hiddenSource(value, scope, { url: true });
+        if (hidden) return this.add('hidden-markup', node, `${what} ${hidden}`);
+        const values = this.exact(value, scope);
+        if (!values) return this.add('markup-source', node, `${what} a scheme not written down`);
+        for (const v of values) if (isJavascriptUrl(v.trim().replace(/:?$/, ':'))) this.add('inline-handler', node, `${what} '${v.slice(0, 12)}': the link becomes a javascript: URL`);
+    }
+    // Is this element one the code made as a media element (new Image(), new
+    // Audio(), createElement('img'))? Its src is a resource the browser
+    // fetches and never runs. An element found in the page is not known to be
+    // one: the code may have put another in its place.
+    isMedia(receiver, scope) {
+        if (!receiver) return false;
+        const leaves = this.resolve(receiver, scope);
+        if (this.unread(leaves, unchain(receiver)) || !leaves.length) return false;
+        return leaves.every((l) => {
+            const x = l.node;
+            if (x.type === 'NewExpression') { const g = this.globalName(x.callee, l.scope); return g === 'Image' || g === 'Audio'; }
+            if (x.type !== 'CallExpression') return false;
+            const c = unchain(x.callee);
+            if (c.type !== 'MemberExpression') return false;
+            const k = this.key(c, l.scope);
+            if (k !== 'createElement' && k !== 'createElementNS') return false;
+            const tags = this.exact(k === 'createElement' ? x.arguments[0] : x.arguments[1], l.scope);
+            return !!tags && tags.length > 0 && tags.every((t) => MEDIA_TAGS.has(t.toLowerCase().replace(/^[\w.-]+:/, '')));
+        });
+    }
+
+    // A value the page parses as markup (innerHTML, outerHTML,
+    // insertAdjacentHTML, setHTMLUnsafe, parseHTMLUnsafe,
+    // createContextualFragment, DOMParser.parseFromString, Reflect.set of
+    // innerHTML): read as its written pieces make it, a handler, a script or
+    // a javascript: URL spelled across pieces refused as one; a piece decoded
+    // or rearranged at run time refused as unread. A plain literal was walked
+    // already as a string.
+    markupSink(node, value, scope, what) {
+        if (!value) return;
+        const hidden = this.hiddenSource(value, scope);
+        if (hidden) this.add('hidden-markup', node, `${what} ${hidden}`);
+        if (literalString(value) != null) return;
+        const { texts, placed, unwritten } = this.alternatives(value, scope);
+        // Nothing of any alternative written down (not here, not in a written
+        // object or list, a function of the game's, another file, an attribute
+        // of the page): refused. An alternative written down is read as
+        // written; one not written beside it stands as a computed part, named
+        // for review (the stated limit a computed part in text position is).
+        if (!placed) { if (!hidden) this.add('markup-source', node, `${what} a value not written down`); }
+        else if (unwritten) this.add('markup-parts', node, `${what} a value one of whose alternatives is not written down`);
+        for (const s of texts) {
+            if (SCRIPT_TAG.test(s)) this.add('script-element', node, `a <script> spelled from pieces (${what})`);
+            this.markup(node, s, 'spelled from pieces');
+        }
+    }
+    // A value the page follows as a URL (href, src, location, open,
+    // setAttribute('href')): a javascript: URL or a data: document spelled
+    // across pieces is refused as one. The written start of each alternative
+    // fixes its scheme: a start that could still spell javascript: ('java' +
+    // x) or a data: document of a type not written is refused; one with
+    // nothing written at the start is a URL not written down, refused unless
+    // the element is a media element the code made (its src is a resource,
+    // never code); an alternative written beside one not written is named
+    // for review.
+    urlSink(node, value, scope, what, receiver = null) {
+        if (!value) return;
+        const hidden = this.hiddenSource(value, scope, { url: true });
+        if (hidden) this.add('hidden-markup', node, `${what} ${hidden}`);
+        if (literalString(value) != null) return;
+        const { texts, placed, unwritten } = this.alternatives(value, scope);
+        let heads = 0, headless = 0;
+        for (const s of texts) {
+            const plain = s.replace(MARKERS, '');
+            if (!s.includes(MARKER)) { if (isJavascriptUrl(plain)) this.add('inline-handler', node, `${what} a javascript: URL spelled from pieces`); this.dataUrl(node, plain, what); heads++; continue; }
+            const head = s.split(MARKER)[0].replace(/[\t\n\r]/g, '').replace(/^[\u0000- ]+/, '');
+            if (head === '') { headless++; continue; }
+            heads++;
+            if ('javascript:'.startsWith(head.toLowerCase())) this.add('inline-handler', node, `${what} a URL whose written start '${head.slice(0, 12)}' could spell javascript:`);
+            else if (/^data:/i.test(head)) {
+                const m = /^data:([^,;]*)([;,])/i.exec(head);
+                const mime = m ? m[1].trim().toLowerCase() : '';
+                if (!m || mime === '' || JS_MIME.test(mime) || PAGE_MIME.test(mime) || XML_MIME.test(mime) || !/^[\w.+-]+\/[\w.+-]+$/.test(mime)) this.add('data-url-code', node, `${what} a data: URL whose document is not written down`);
+            } else if (isJavascriptUrl(plain)) this.add('inline-handler', node, `${what} a javascript: URL spelled from pieces`);
+        }
+        if (receiver && this.isMedia(receiver, scope)) return;
+        if (!heads) { if (!hidden) this.add('markup-source', node, `${what} a URL not written down`); }
+        else if (headless || unwritten) this.add('markup-parts', node, `${what} a URL one of whose alternatives is not written down`);
+        void placed;
+    }
+
+    // A destructuring, judged as the members it reads: `const { eval: e } =
+    // window` reads window.eval and is refused as eval is; `{ constructor: F }
+    // = fn` reads fn.constructor; `{ ...rest } = window` and `{ [k]: v } =
+    // window` read the global object by names not written down. Patterns
+    // nest (`{ self: { eval: e } } = window`); the walk is a loop. An array
+    // pattern's initialiser elements are expressions pass 2 reads on its own.
+    destructure(pattern, init, scope) {
+        const stack = [[pattern, init]];
+        while (stack.length) {
+            const [p, from] = stack.pop();
+            if (!p || !from) continue;
+            switch (p.type) {
+                case 'AssignmentPattern': stack.push([p.left, from]); break;
+                case 'ObjectPattern': {
+                    const global = this.isGlobalObject(from, scope);
+                    for (const prop of p.properties) {
+                        if (prop.type === 'RestElement') { if (global) this.add('computed-global', prop, '{ …rest } = the global object'); continue; }
+                        const m = memberOf(from, prop);
+                        this.member({ node: m, parent: null, grand: null, key: null, scope });
+                        stack.push([prop.value, m]);
+                    }
+                    break;
+                }
+                case 'ArrayPattern': p.elements.forEach((e, i) => { const el = from.type === 'ArrayExpression' ? from.elements[i] : null; if (e && el && el.type !== 'SpreadElement') stack.push([e, el]); }); break;
+                default: break;
+            }
+        }
+    }
+
+    // A reference to a global by name: an unshadowed identifier, `window.name`,
+    // `Reflect.get(window, 'name')`. The position (parent, key) decides what is
+    // allowed of Function and of the global object itself.
+    globalReference(name, frame) {
+        const { node, parent, grand, key } = frame;
+        switch (name) {
+            case 'eval': return this.add('eval', node, 'eval');
+            case 'Function': {
+                // Function.prototype.call and friends are a reference to a method,
+                // not to the constructor; so are instanceof and typeof.
+                const prototypeMethod = parent?.type === 'MemberExpression' && key === 'object' && staticKey(parent) === 'prototype' && grand?.type === 'MemberExpression' && grand.object === parent && staticKey(grand) != null;
+                const compared = parent?.type === 'BinaryExpression' && ['instanceof', '===', '!==', '==', '!='].includes(parent.operator);
+                const typeOf = parent?.type === 'UnaryExpression' && parent.operator === 'typeof';
+                if (!prototypeMethod && !compared && !typeOf) this.add('function-constructor', node, 'Function');
+                return;
+            }
+            case 'Date': case 'Temporal': return this.add('clock', node, name);
+            case 'Intl': if (!(parent?.type === 'MemberExpression' && key === 'object')) this.add('locale', node, 'Intl'); return;
+            case 'localStorage': case 'sessionStorage': case 'indexedDB': case 'caches': return this.add('local-storage', node, name);
+            case 'XMLHttpRequest': case 'EventSource': return this.add('network', node, name);
+            case 'open': if (parent?.type === 'CallExpression' && key === 'callee') this.add('navigate', node, 'open(…)'); return;
+            // WebAssembly kept in a name, passed on or reached is a use (the
+            // scan refuses it outside a known library); a feature check is not.
+            case 'WebAssembly': {
+                const member = parent?.type === 'MemberExpression' && key === 'object';
+                const typeOf = parent?.type === 'UnaryExpression' && parent.operator === 'typeof';
+                const compared = parent?.type === 'BinaryExpression';
+                // A name the analyser follows (`const W = WebAssembly`, `w = WebAssembly`) is judged where it is used.
+                // (A pattern's members are judged by destructure(); parent null is such a member read.)
+                const aliased = parent == null || (parent.type === 'VariableDeclarator' && key === 'init') || (parent.type === 'AssignmentExpression' && key === 'right' && parent.operator === '=' && unchain(parent.left).type !== 'MemberExpression');
+                if (!member && !typeOf && !compared && !aliased) this.wasm.push({ line: (node.loc?.start.line ?? 1) + this.lineOffset, what: 'WebAssembly kept in a name or passed on' });
+                return;
+            }
+            default: {
+                const net = NETWORK_CLASSES.get(name);
+                if (net) return this.add(net, node, name);
+                if (FRAME_NAMES.has(name)) this.add('frame-reach', node, name);
+                return;
+            }
+        }
+    }
+
+    member(frame) {
+        const { node, parent, key, scope } = frame;
+        const o = this.globalName(node.object, scope);
+        const k = this.key(node, scope);
+        // A setter, getter or method reached through its property descriptor
+        // (Object.getOwnPropertyDescriptor(Element.prototype, 'innerHTML').set):
+        // called at once through .call/.apply/Reflect.apply it is judged as the
+        // property is (call()); kept, bound or passed on it is refused, and so
+        // is one of a name not written down.
+        if (k === 'set' || k === 'get' || k === 'value') {
+            const desc = this.descriptorOf(node.object, scope);
+            if (desc && desc.judged) {
+                const through = parent?.type === 'MemberExpression' && key === 'object' && ['call', 'apply'].includes(staticKey(parent));
+                const called = parent?.type === 'CallExpression' && key === 'callee';
+                const applied = parent?.type === 'CallExpression' && key === 'arguments' && unchain(parent.callee).type === 'MemberExpression' && staticKey(unchain(parent.callee)) === 'apply' && this.globalName(unchain(parent.callee).object, scope) === 'Reflect' && parent.arguments[0] === node;
+                if (!through && !called && !applied) this.add('method-reference', node, `.${k} of a property's descriptor${desc.name != null ? ` ('${desc.name}')` : ' (a name not written down)'} kept, bound or passed on`);
+                return;
+            }
+        }
+        if (o != null && (GLOBAL_OBJECTS.has(o) || o === 'document')) {
+            // `this[k] = v` in a function that is not a method (a constructor's
+            // `for (k in opts) this[k] = opts[k]`) writes a property; nothing
+            // runs from it. A read or a call of this[k] is the global object indexed.
+            const viaThis = unchain(node.object)?.type === 'ThisExpression';
+            const written = (parent?.type === 'AssignmentExpression' && key === 'left') || parent?.type === 'UpdateExpression' || (parent?.type === 'UnaryExpression' && parent.operator === 'delete');
+            if (k == null && viaThis && written) return;
+            if (k == null) return this.add('computed-global', node, viaThis ? 'this[…] where this may be the global object' : `${o === 'document' ? 'document' : 'the global object'}[…]`);
+            if (node.computed && escapedIdentifier(node.property)) this.add('hidden-name', node, `'${node.property.raw.slice(1, -1)}' spells ${k} in escapes`);
+            if (o === 'document') {
+                if (k === 'write' || k === 'writeln') this.add('document-write', node, `document.${k}`);
+                else if (k === 'cookie') this.add('local-storage', node, 'document.cookie');
+                else if (JUDGED_METHODS.has(k)) this.methodReference(frame, k);
+                return;
+            }
+            // window.name is the global `name`.
+            if (k === 'document') return;
+            this.globalReference(k, { node, parent, grand: frame.grand, key });
+            return;
+        }
+        switch (o) {
+            case 'navigator':
+                if (k == null) return this.hostComputed(frame, 'navigator');
+                if (k === 'serviceWorker') return this.add('service-worker', node, 'navigator.serviceWorker');
+                if (k === 'language' || k === 'languages') return this.add('locale', node, `navigator.${k}`);
+                if (k === 'webdriver') return this.add('fingerprint', node, 'navigator.webdriver (an automation check)');
+                if (FINGERPRINT_NAV.has(k)) return this.add('fingerprint', node, `navigator.${k}`);
+                if (k === 'sendBeacon') return this.add('network', node, 'navigator.sendBeacon');
+                if (k === 'storage') return this.add('local-storage', node, 'navigator.storage');
+                return;
+            case 'screen': if (k == null) return this.hostComputed(frame, 'screen'); if (FINGERPRINT_SCREEN.has(k)) this.add('fingerprint', node, `screen.${k}`); return;
+            case 'Intl': if (k == null) return this.hostComputed(frame, 'Intl'); return this.add(k === 'DateTimeFormat' ? 'timezone' : 'locale', node, `Intl.${k}`);
+            case 'location': if (k == null) return this.hostComputed(frame, 'location'); return;
+            case 'WebAssembly': {
+                // Any member of WebAssembly is a use but a feature check (typeof WebAssembly.instantiate, 'x' in WebAssembly, === undefined).
+                const typeOf = parent?.type === 'UnaryExpression' && parent.operator === 'typeof';
+                const compared = parent?.type === 'BinaryExpression';
+                if (!typeOf && !compared) this.wasm.push({ line: (node.loc?.start.line ?? 1) + this.lineOffset, what: `WebAssembly.${k ?? '[…]'}` });
+                return;
+            }
+            case 'Math': if (k === 'random') this.add('browser-rng', node, 'Math.random'); return;
+            case 'crypto': if (k == null) return this.hostComputed(frame, 'crypto'); if (k === 'getRandomValues' || k === 'randomUUID') this.add('browser-rng', node, `crypto.${k}`); return;
+            case 'performance': if (k == null) return this.hostComputed(frame, 'performance'); if (k === 'timeOrigin') this.add('clock', node, 'performance.timeOrigin'); return;
+            case 'URL': if (k === 'createObjectURL') this.add('blob-code', node, 'URL.createObjectURL'); return;
+            // The Navigation API moves the page as location does.
+            case 'navigation': if (k == null) return this.hostComputed(frame, 'navigation'); if (['navigate', 'reload', 'traverseTo', 'back', 'forward'].includes(k)) this.add('navigate', node, `navigation.${k}`); return;
+            // Reflect[k](window, name), Object[k](window): a method of Reflect or Object by a name not written
+            // down, handed the global object (or a host object): what it reads of it cannot be read; refused.
+            case 'Reflect': case 'Object': {
+                if (k != null) break;
+                const call = parent?.type === 'CallExpression' && key === 'callee' ? parent : null;
+                const hostArg = (a) => { const g = this.globalName(a, scope); return g != null && (GLOBAL_OBJECTS.has(g) || g === 'document' || ['navigator', 'location', 'screen', 'crypto', 'performance', 'navigation', 'Intl', 'WebAssembly'].includes(g)); };
+                if (!call) return this.add('method-reference', node, `${o}[…]: a method of ${o} by a name not written down, kept or passed on`);
+                if (call.arguments.some(hostArg)) return this.add('computed-global', node, `${o}[…](the global object, …): a method of ${o} by a name computed at run time`);
+                return;
+            }
+            default: break;
+        }
+        if (k === 'constructor') {
+            const compared = parent?.type === 'BinaryExpression' && ['instanceof', '===', '!==', '==', '!='].includes(parent.operator);
+            const property = parent?.type === 'MemberExpression' && key === 'object' ? staticKey(parent) : null;
+            const read = property != null && !CONSTRUCTOR_DENIED.has(property);
+            const bare = parent?.type === 'NewExpression' && key === 'callee' && parent.arguments.length === 0;
+            const typeOf = parent?.type === 'UnaryExpression' && parent.operator === 'typeof';
+            if (!compared && !read && !bare && !typeOf) this.add('function-constructor', node, '.constructor');
+            return;
+        }
+        if (k != null && TIMEZONE_METHODS.has(k) && parent?.type === 'CallExpression' && key === 'callee') return this.add('timezone', node, `.${k}()`);
+        // A method the rules judge by its arguments, read as a value: bound,
+        // kept in a name, passed on, or looked at (`if (el.setAttribute)`,
+        // which `typeof` says plainly). Called, directly or through .call/.apply,
+        // call() reads its arguments.
+        if (k != null && JUDGED_METHODS.has(k)) this.methodReference(frame, k);
+        if (k == null) {
+            // `let key = 'x'; key = 'constructor'; obj[key](…)`: one of the names
+            // the key is assigned is judged as the key would be.
+            if (this.keyNames(node, scope).includes('constructor')) this.add('function-constructor', node, '.constructor (one of the names the key is assigned)');
+            const hidden = this.hiddenName(node.property, scope);
+            if (hidden) this.add('hidden-name', node, hidden);
+        } else if (node.computed && escapedIdentifier(node.property)) this.add('hidden-name', node, `'${node.property.raw.slice(1, -1)}' spells ${k} in escapes`);
+    }
+
+    // A host object (navigator, location, screen, crypto, performance, Intl,
+    // the Navigation API) by a name computed at run time: what it reaches
+    // (serviceWorker, the address, the browser's identity, randomness, the
+    // time zone) cannot be read; refused, unless every name the key may be is
+    // written (a name assigned one literal after another), each then judged.
+    hostComputed(frame, o) {
+        const { node, scope } = frame;
+        const names = [...new Set([...this.keyNames(node, scope), ...(this.exact(node.property, scope) ?? [])])];
+        if (!names.length) return this.add('computed-global', node, `${o}[…]: a host object by a name computed at run time`);
+        for (const name of names) this.member({ ...frame, node: { ...node, computed: true, property: literalNode(name, node.property) } });
+    }
+    // The property a descriptor names, and its target: Object.getOwnPropertyDescriptor(T, 'name'),
+    // Reflect.getOwnPropertyDescriptor(T, 'name'), Object.getOwnPropertyDescriptors(T).name /
+    // ['name']. `judged` when the name is one the rules judge (a method, a markup or URL
+    // property, a sensitive token) or is not written down. null for anything else.
+    descriptorOf(n, scope) {
+        n = unchain(n);
+        if (!n) return null;
+        let target = null, nameArg = null, name = null;
+        if (n.type === 'CallExpression') {
+            const c = unchain(n.callee);
+            if (c.type !== 'MemberExpression') return null;
+            const o = this.globalName(c.object, scope), k = this.key(c, scope);
+            if (!((o === 'Object' || o === 'Reflect') && k === 'getOwnPropertyDescriptor')) return null;
+            target = n.arguments[0] ?? null; nameArg = n.arguments[1] ?? null;
+            const v = nameArg ? this.exact(nameArg, scope) : null;
+            name = v && v.length === 1 ? v[0] : null;
+            if (v && v.length > 1) name = null;
+        } else if (n.type === 'MemberExpression') {
+            const inner = unchain(n.object);
+            if (inner.type !== 'CallExpression') return null;
+            const c = unchain(inner.callee);
+            if (c.type !== 'MemberExpression' || this.globalName(c.object, scope) !== 'Object' || this.key(c, scope) !== 'getOwnPropertyDescriptors') return null;
+            target = inner.arguments[0] ?? null;
+            name = this.key(n, scope);
+        } else return null;
+        const judged = name == null || JUDGED_METHODS.has(name) || MARKUP_PROPS.has(name) || URL_PROPS.has(name) || SENSITIVE_TOKENS.has(name) || ['srcdoc', 'location', 'protocol', 'cookie', 'write', 'writeln', 'eval', 'Function'].includes(name);
+        return { target, name, judged };
+    }
+
+    methodReference(frame, k) {
+        const { node, parent, grand, key, parentKey } = frame;
+        const called = parent?.type === 'CallExpression' && key === 'callee';
+        const through = parent?.type === 'MemberExpression' && key === 'object' && ['call', 'apply'].includes(staticKey(parent));
+        const typeOf = parent?.type === 'UnaryExpression' && parent.operator === 'typeof';
+        // A feature check reads the method as a truth value, never as a function:
+        // `if (el.setAttribute)`, `document.createElementNS ? … : …`, `!el.setHTMLUnsafe`,
+        // and `a && b` standing in such a test.
+        const tested = (p, k) => (p && TESTED.has(p.type) && k === 'test') || (p?.type === 'UnaryExpression' && p.operator === '!');
+        const check = tested(parent, key) || (parent?.type === 'LogicalExpression' && tested(grand, parentKey));
+        if (!called && !through && !typeOf && !check) this.add('method-reference', node, `.${k} kept in a name, bound or passed on`);
+    }
+
+    // The method a call reaches and the arguments it gets, through the forms
+    // that hand a method on: `o.m.call(t, a, b)` and `o.m.apply(t, [a, b])` are
+    // `o.m(a, b)`; `Reflect.apply(o.m, t, [a, b])` too; and
+    // `Function.prototype.call.call(o.m, t, a)` is `o.m.call(t, a)`. An argument
+    // list not written down (`apply(t, args)`) is unknown: null, which the
+    // rules read as "not written down" and refuse.
+    resolveCall(node, scope) {
+        let callee = unchain(node.callee), args = node.arguments, receiver = null;
+        for (let i = 0; i < 8 && callee; i++) {
+            if (callee.type === 'MemberExpression') {
+                const m = staticKey(callee);
+                // Reflect.apply(f, t, [a, b]) is f(a, b) with this = t.
+                if (m === 'apply' && this.globalName(callee.object, scope) === 'Reflect') {
+                    const f = args && args[0] ? unchain(args[0]) : null;
+                    if (!f) return { callee: null, args: null, receiver };
+                    receiver = args[1] ?? receiver;
+                    callee = f; args = args.length < 3 ? [] : elementsOf(args[2]);
+                    continue;
+                }
+                if (m !== 'call' && m !== 'apply') break;
+                const inner = unchain(callee.object);
+                receiver = args && args[0] ? args[0] : receiver;
+                const shifted = args == null ? null : m === 'call' ? args.slice(1) : args.length < 2 ? [] : elementsOf(args[1]);
+                // Function.prototype.call.call(f, t, …): the method called is f, with .call's shifted arguments.
+                const proto = inner.type === 'MemberExpression' && ['call', 'apply'].includes(staticKey(inner)) && unchain(inner.object).type === 'MemberExpression' && staticKey(unchain(inner.object)) === 'prototype' && this.globalName(unchain(inner.object).object, scope) === 'Function';
+                if (proto) {
+                    const f = args && args[0] ? unchain(args[0]) : null;
+                    if (!f) return { callee: null, args: null, receiver };
+                    callee = { type: 'MemberExpression', object: f, property: { type: 'Identifier', name: staticKey(inner) }, computed: false, optional: false, loc: node.loc };
+                    args = shifted;
+                    continue;
+                }
+                callee = inner; args = shifted;
+                continue;
+            }
+            break;
+        }
+        return { callee, args, receiver };
+    }
+
+    call(frame) {
+        const { node, parent, key, scope } = frame;
+        const resolved = this.resolveCall(node, scope);
+        let callee = resolved.callee;
+        // (f.call(t, …) with f not written down: nothing to judge.)
+        if (!callee) return;
+        // The arguments as written, or none when the list is not written down
+        // (`apply(t, list)`): the rules that need one read it as missing.
+        const args = resolved.args ?? [];
+        const unknownArgs = resolved.args == null;
+        // A setter or a method reached through its property descriptor:
+        // desc.set.call(el, v) is el.<name> = v, desc.value.call(el, …) is
+        // el.<name>(…); a getter read is a read. A descriptor of a name not
+        // written down is refused (member() names it where it is read).
+        let viaDescriptor = false;
+        if (callee.type === 'MemberExpression' && ['set', 'value', 'get'].includes(staticKey(callee))) {
+            const desc = this.descriptorOf(callee.object, scope);
+            if (desc) {
+                const which = staticKey(callee);
+                if (desc.name == null) return this.add('method-reference', node, `.${which} of a property's descriptor by a name not written down, called`);
+                if (which === 'get') return;
+                // (desc.set.apply(el, list), desc.value.apply(el, list) with the list not written down: what the setter or method gets is not read.)
+                if (unknownArgs) return this.add('hidden-markup', node, `.${which} of '${desc.name}' through its descriptor, with arguments not written down`);
+                const target = resolved.receiver ?? desc.target ?? { type: 'Identifier', name: '*descriptor*', ...at(node) };
+                const property = { type: 'MemberExpression', object: target, property: { type: 'Identifier', name: desc.name, ...at(node) }, computed: false, optional: false, ...at(node) };
+                if (which === 'set') return this.check({ node: { type: 'AssignmentExpression', operator: '=', left: property, right: args[0] ?? literalNode(undefined, node), ...at(node) }, parent, key, grand: frame.grand, scope });
+                callee = property;
+                viaDescriptor = true;
+            }
+        }
+        // (function ({ eval: e }) { … })(window): the pattern reads the argument.
+        if (FUNCTIONS.has(callee.type)) callee.params.forEach((p, i) => { if (p.type !== 'Identifier' && args[i]) this.destructure(p, args[i], scope); });
+        let name = this.globalName(callee, scope);
+        // A judged method called bare (insertAdjacentHTML(…) with no receiver, as under a `with` or a
+        // page's own function of that name): judged as the method, whatever it is called on.
+        if (callee.type === 'Identifier' && name != null && JUDGED_METHODS.has(name)) { callee = { type: 'MemberExpression', object: { type: 'Identifier', name: '*bare*', ...at(callee) }, property: { type: 'Identifier', name, ...at(callee) }, computed: false, optional: false, ...at(callee) }; name = null; }
+        if (name === 'setTimeout' || name === 'setInterval') {
+            if (args[0] && this.isStringy(args[0], scope)) this.add('string-timer', node, `${name}(a string, …)`);
+            if (args[1]) {
+                const ms = this.fold(args[1], scope);
+                const simple = ['Literal', 'Identifier', 'MemberExpression', 'ChainExpression'].includes(args[1].type);
+                if (ms != null && ms > LIMITS.longTimerMs) this.add('timer', node, `${name} after ${Math.round(ms / 1000)} s`);
+                else if (ms == null && !simple) this.add('timer', node, `${name} with a computed delay`);
+            }
+            return;
+        }
+        if (name === 'fetch') {
+            const s = args[0] ? literalString(args[0]) : null;
+            if (s == null) this.add('network', node, 'fetch(a computed address)');
+            else if (s.startsWith('/api/')) this.add('own-server', node, `fetch(${JSON.stringify(s.slice(0, 40))})`);
+            return;
+        }
+        if (name === 'importScripts') {
+            if (unknownArgs) this.add('import-dynamic', node, 'importScripts(a list not written down)');
+            for (const a of args) { const s = literalString(a); if (s == null) this.add('import-dynamic', node, 'importScripts(a computed address)'); else if (SCHEME.test(s)) this.add('import-url', node, `importScripts(${JSON.stringify(s.slice(0, 60))})`); }
+            return;
+        }
+        if (name === 'open') { if (args[0]) this.urlSink(node, args[0], scope, 'open('); return; }
+        if (callee.type !== 'MemberExpression') return;
+        const o = this.globalName(callee.object, scope), k = this.key(callee, scope);
+        // document.write reached otherwise than as the member written (through its descriptor: member() never saw the node).
+        if (o === 'document' && (k === 'write' || k === 'writeln') && viaDescriptor) return this.add('document-write', node, `document.${k} through its descriptor`);
+        // Object.setPrototypeOf(o, window), Reflect.setPrototypeOf(o, window): o reads every global through its prototype chain from here on.
+        if ((o === 'Object' || o === 'Reflect') && k === 'setPrototypeOf' && args[1] && this.isGlobalObject(args[1], scope)) return this.add('computed-global', node, `${o}.setPrototypeOf(…, the global object): every global reached through the prototype chain`);
+        const read = this.reflectRead({ callee, arguments: args }, scope);
+        if (read) {
+            if (read.key == null) this.add('computed-global', node, `${o}.${k}(the global object, a computed name)`);
+            // Reflect.set(window, 'location', u) moves the page as window.location = u does.
+            else if (read.key === 'location' && k === 'set') { this.add('navigate', node, "Reflect.set(window, 'location')"); this.urlSink(node, args[2], scope, 'location ='); }
+            else if (read.key !== 'document') this.globalReference(read.key, { node, parent, grand: frame.grand, key });
+            return;
+        }
+        // Reflect.get(navigator, k): a host object by a name computed at run time is refused; by a written one, judged as the member.
+        if (o === 'Reflect' && (k === 'get' || k === 'has' || k === 'getOwnPropertyDescriptor') && args[0]) {
+            const host = this.globalName(args[0], scope);
+            if (host != null && ['navigator', 'location', 'screen', 'crypto', 'performance', 'navigation', 'Intl', 'WebAssembly'].includes(host)) {
+                const prop = args[1] ? this.exact(args[1], scope) : null;
+                if (!prop || !prop.length) return this.add('computed-global', node, `Reflect.${k}(${host}, a name computed at run time): a host object by a name computed at run time`);
+                for (const p of prop) this.member({ node: { type: 'MemberExpression', object: args[0], property: literalNode(p, node), computed: true, optional: false, ...at(node) }, parent: node, grand: parent, key: 'callee', scope });
+                return;
+            }
+        }
+        if (o === 'Reflect' && DESCRIPTOR_READERS.has(k) && args[1]) {
+            const hidden = this.hiddenName(args[1], scope);
+            if (hidden) this.add('hidden-name', node, `Reflect.${k}(…, ${hidden})`);
+            else if (literalString(args[1]) === 'constructor' && !(parent?.type === 'BinaryExpression')) this.add('function-constructor', node, `Reflect.${k}(…, 'constructor')`);
+            // Reflect.set(el, 'innerHTML', v) is el.innerHTML = v; Reflect.set(location, 'href', u) moves the page.
+            if (k === 'set') {
+                const prop = literalString(args[1]);
+                if (args[0] && this.globalName(args[0], scope) === 'location') { this.add('navigate', node, `Reflect.set(location, '${prop ?? '…'}')`); this.urlSink(node, args[2], scope, 'location ='); }
+                else if (prop != null && MARKUP_PROPS.has(prop)) this.markupSink(node, args[2], scope, `Reflect.set(…, '${prop}')`);
+                else if (prop != null && URL_PROPS.has(prop)) this.urlSink(node, args[2], scope, `Reflect.set(…, '${prop}')`, args[0]);
+                else if (prop === 'protocol') this.protocolSink(node, args[2], scope, "Reflect.set(…, 'protocol')");
+                else if (prop === 'srcdoc') this.add('navigation', node, "Reflect.set(…, 'srcdoc')");
+            }
+            if (k === 'getOwnPropertyDescriptor') this.descriptorTaken(frame, args, 'Reflect');
+            return;
+        }
+        if (o === 'Object' && (k === 'getOwnPropertyDescriptor' || k === 'defineProperty') && args[1]) {
+            const hidden = this.hiddenName(args[1], scope);
+            if (hidden) this.add('hidden-name', node, `Object.${k}(…, ${hidden})`);
+            else if (k === 'getOwnPropertyDescriptor' && literalString(args[1]) === 'constructor') this.add('function-constructor', node, "Object.getOwnPropertyDescriptor(…, 'constructor')");
+            if (k === 'getOwnPropertyDescriptor') this.descriptorTaken(frame, args, 'Object');
+            return;
+        }
+        // Object.getOwnPropertyDescriptors(o) of a game object, indexed by a name not written down: a descriptor of anything.
+        if (o === 'Object' && k === 'getOwnPropertyDescriptors' && args[0] && !this.isGlobalObject(args[0], scope) && parent?.type === 'MemberExpression' && key === 'object' && this.key(parent, scope) == null) { this.add('method-reference', node, 'Object.getOwnPropertyDescriptors(…)[a name not written down]'); return; }
+        if ((o === 'Object' && ENUMERATORS.has(k)) || (o === 'Reflect' && k === 'ownKeys')) {
+            if (args.some((a) => this.isGlobalObject(a, scope))) this.add('computed-global', node, `${o}.${k}(the global object)`);
+            return;
+        }
+        if (o === 'Object' && k === 'assign') {
+            if (args.slice(1).some((a) => this.isGlobalObject(a, scope))) this.add('computed-global', node, 'Object.assign(…, the global object)');
+            // Object.assign(location, { href: u }) moves the page; the href written there is read as location.href = u.
+            if (args[0] && this.globalName(args[0], scope) === 'location') {
+                this.add('navigate', node, 'Object.assign(location, …)');
+                for (const a of args.slice(1)) { const source = unchain(a); if (source?.type === 'ObjectExpression') for (const p of source.properties) { if (p.type === 'Property' && !p.computed && ['href', 'pathname', 'search', 'hash'].includes(p.key.name ?? p.key.value)) this.urlSink(node, p.value, scope, 'location.href ='); } else this.urlSink(node, a, scope, 'location ='); }
+            }
+            return;
+        }
+        if (o === 'navigation' && k === 'navigate') { this.urlSink(node, args[0], scope, 'navigation.navigate('); return; }
+        if (k === 'createElement' || k === 'createElementNS') {
+            // The tag as written or as its pieces spell it; a name not written
+            // down is named for review (a helper's `el(tag, …)` is the common
+            // case, and the browser's policy stands behind what it creates).
+            const tags = this.exact(k === 'createElement' ? args[0] : args[1], scope);
+            if (!tags) return this.add('element-name', node, `${k}(a computed name)`);
+            for (const tag of tags) {
+                const t = tag.toLowerCase().replace(/^[\w.-]+:/, '');
+                if (t === 'script') this.add('script-element', node, "createElement('script')");
+                else if (INPUT_TAGS.has(t)) this.add('input-element', node, `createElement('${t}')`);
+                else if (t === 'object' || t === 'embed') this.add('navigation', node, `createElement('${t}')`);
+            }
+            return;
+        }
+        // Markup the page parses: the second argument of insertAdjacentHTML, the first of the rest.
+        if (k === 'insertAdjacentHTML') {
+            if (unknownArgs) return this.add('hidden-markup', node, 'insertAdjacentHTML with arguments not written down');
+            return this.markupSink(node, args[1], scope, 'insertAdjacentHTML(…,');
+        }
+        if (k === 'setHTMLUnsafe' || k === 'parseHTMLUnsafe' || k === 'createContextualFragment' || k === 'parseFromString') {
+            if (unknownArgs) return this.add('hidden-markup', node, `${k} with arguments not written down`);
+            return this.markupSink(node, args[0], scope, `${k}(`);
+        }
+        if (k === 'setAttribute' || k === 'setAttributeNS' || k === 'toggleAttribute' || k === 'createAttribute' || k === 'createAttributeNS') {
+            // The attribute's name as written, or as its pieces make it
+            // (`'on' + 'click'`, atob(…), a const, each of a list a loop runs
+            // over, a reversed string): a handler is refused however it is
+            // spelled. A name built from a written prefix and something
+            // computed is read by the prefix: `'on' + type` is a handler,
+            // `'data-' + key` is not. A name the analyser cannot read is refused.
+            const ns = k === 'setAttributeNS' || k === 'createAttributeNS';
+            const nameArg = unknownArgs ? null : args[ns ? 1 : 0];
+            const valueArg = k === 'setAttribute' ? args[1] : k === 'setAttributeNS' ? args[2] : null;
+            if (!nameArg) return this.add('attribute-name', node, `${k}(a name not written down)`);
+            const names = this.exact(nameArg, scope);
+            if (names) {
+                for (const n of names) {
+                    const local = n.toLowerCase().replace(/^[\w.-]+:/, '');
+                    if (/^on/.test(local)) this.add('inline-handler', node, `${k}('${n.slice(0, 20)}', …)`);
+                    else if (local === 'srcdoc' || local === 'http-equiv') this.add('navigation', node, `${k}('${local}', …)`);
+                    else if (URL_ATTRIBUTES.has(local) && valueArg) this.urlSink(node, valueArg, scope, `${k}('${local}',`, resolved.receiver ?? callee.object);
+                }
+                return;
+            }
+            const spelled = this.spelled(nameArg, scope);
+            // A reversed or rearranged name reads as its pieces: judged backwards too.
+            const whole = spelled == null ? '' : spelled.replace(MARKERS, '').toLowerCase();
+            const reversed = [...whole].reverse().join('');
+            if (/^on/.test(whole) || /^on/.test(reversed)) return this.add('inline-handler', node, `${k}('${(spelled ?? '').replace(MARKERS, '…').slice(0, 20)}', …) spelled from pieces`);
+            const prefix = spelled == null || /\u0000/.test(spelled) || this.hiddenSource(nameArg, scope) ? '' : spelled.split(MARKER)[0].toLowerCase();
+            if (prefix === '') return this.add('attribute-name', node, `${k}(a name not written down)`);
+            const could = (attr) => attr.startsWith(prefix);
+            if (could('on')) return this.add('inline-handler', node, `${k}('${prefix}' + …, …): a name built from 'on'`);
+            if (could('srcdoc') || could('http-equiv')) return this.add('navigation', node, `${k}('${prefix}' + …, …): could be srcdoc or http-equiv`);
+            if ([...URL_ATTRIBUTES].some(could) && valueArg) this.urlSink(node, valueArg, scope, `${k}('${prefix}' + …,`, resolved.receiver ?? callee.object);
+            return;
+        }
+        if (o === 'location' && (k === 'assign' || k === 'replace' || k === 'reload')) { this.add('navigate', node, `location.${k}(…)`); if (k !== 'reload') this.urlSink(node, args[0], scope, `location.${k}(`); return; }
+        if (k === 'postMessage' && GLOBAL_OBJECTS.has(o)) return this.add('frame-reach', node, `${o}.postMessage`);
+    }
+    // A descriptor taken of a game object's property: read at once through
+    // .set/.get/.value and called, it is judged by call(); kept otherwise, a
+    // judged name (or one not written down) is a method kept in a name.
+    descriptorTaken(frame, args, via) {
+        const { node, parent, grand, key, scope } = frame;
+        if (!args[0] || this.isGlobalObject(args[0], scope)) return;
+        const desc = this.descriptorOf(node, scope);
+        if (!desc || !desc.judged) return;
+        const member = parent?.type === 'MemberExpression' && key === 'object' && ['set', 'get', 'value'].includes(staticKey(parent));
+        const called = member && grand && ((grand.type === 'MemberExpression' && ['call', 'apply'].includes(staticKey(grand))) || grand.type === 'CallExpression');
+        if (!called) this.add('method-reference', node, `${via}.getOwnPropertyDescriptor(…, ${desc.name != null ? `'${desc.name}'` : 'a name not written down'}) kept: its setter or method is called where the analyser does not read`);
+    }
+
+    construct(frame) {
+        const { node, scope } = frame;
+        const callee = unchain(node.callee);
+        const name = this.globalName(callee, scope);
+        const args = node.arguments;
+        switch (name) {
+            case 'Worker': case 'SharedWorker': {
+                const s = args[0] ? literalString(args[0]) : null;
+                if (s == null) this.add('blob-code', node, `new ${name}(a computed address)`);
+                else if (SCHEME.test(s)) this.add('blob-code', node, `new ${name}(${JSON.stringify(s.slice(0, 40))})`);
+                return;
+            }
+            case 'Blob': case 'File': {
+                // A Blob of JavaScript is a worker's code, one of HTML or XML (an
+                // SVG, an XHTML page) a document a frame may show: its parts, when
+                // written down, are read as that (a script parsed and walked,
+                // markup walked as the browser renders it); parts not written
+                // down are code or markup the analyser never read.
+                // The options are followed to where they are written (a literal, a name bound to one, Object.assign,
+                // a spread of written objects): every `type` they may hold is read; options not written down, or a
+                // type not written, may name a document or a script — refused, as a Response's init is.
+                const opts = args[name === 'File' ? 2 : 1];
+                if (!opts) return;
+                const types = this.blobTypes(opts, scope);
+                if (types === null) { this.add('blob-source', node, `new ${name}(…, options not written down)`); return; }
+                for (const type of types) this.typedText(node, elementsOf(args[0]), type, scope, `new ${name}(…, { type: ${type.trim().slice(0, 30)} })`);
+                return;
+            }
+            case 'Response': {
+                // A Response typed text/html or XML is a document too (a blob: URL
+                // of it framed): its body judged as a Blob's parts are; headers not
+                // written down may name any type, refused.
+                const init = args[1] ? unchain(args[1]) : null;
+                if (!init) return;
+                if (init.type !== 'ObjectExpression' || init.properties.some((p) => p.type !== 'Property' || p.computed)) return this.add('blob-source', node, 'new Response(…, init not written down)');
+                const headers = init.properties.find((p) => (p.key.name ?? p.key.value) === 'headers');
+                if (!headers) return;
+                const type = this.contentType(headers.value, scope);
+                if (type === undefined) return this.add('blob-source', node, 'new Response(…, { headers not written down })');
+                if (type == null) return;
+                const body = args[0] ? unchain(args[0]) : null;
+                if (body?.type === 'NewExpression') return; // a Blob or a FormData, judged where it is made
+                this.typedText(node, body ? [body] : [], type, scope, `new Response(…, { 'content-type': ${type.trim().slice(0, 30)} })`);
+                return;
+            }
+            case 'Proxy': if (args[0] && this.isGlobalObject(args[0], scope)) this.add('computed-global', node, 'new Proxy(the global object, …)'); return;
+            default: return;
+        }
+    }
+    // Every MIME type a Blob's or File's options may give (`type`), following
+    // the options to the objects written: [] when none is written there, null
+    // when the options, a property that may be `type`, or a type is not
+    // written down.
+    blobTypes(opts, scope) {
+        const leaves = this.resolve(opts, scope);
+        if (!leaves.length) return null;
+        const out = [];
+        for (const l of leaves) {
+            if (l.cut) return null;
+            const x = l.node;
+            // (undefined or null options give no type.)
+            if (x.type === 'Literal' && (x.value == null || x.value === undefined)) continue;
+            if (x.type === 'Identifier' && x.name === 'undefined') continue;
+            // (A written object, or Object.assign/freeze of ones, has its members read; anything else is not written down.)
+            const types = x.type === 'ObjectExpression' || x.type === 'CallExpression' ? this.membersOf(l, 'type', opts, scope, 0) : null;
+            if (types === null) return null;
+            for (const t of types) {
+                if (t.cut) return null;
+                const v = this.exactLeaf(t.node, t.scope, 0);
+                if (!v) return null;
+                out.push(...v);
+            }
+        }
+        return [...new Set(out)];
+    }
+    // The content-type a headers initialiser names: of an object literal
+    // (keys compared without case), `new Headers(…)` of one, a list of pairs.
+    // null when none; undefined when the headers are not written down.
+    contentType(headers, scope) {
+        const h = unchain(headers);
+        if (!h) return undefined;
+        if (h.type === 'NewExpression' && this.globalName(h.callee, scope) === 'Headers') return h.arguments[0] ? this.contentType(h.arguments[0], scope) : null;
+        if (h.type === 'ObjectExpression') {
+            if (h.properties.some((p) => p.type !== 'Property' || p.computed)) return undefined;
+            const p = h.properties.find((p) => String(p.key.name ?? p.key.value).toLowerCase() === 'content-type');
+            if (!p) return null;
+            const v = this.exact(p.value, scope);
+            return v && v.length === 1 ? v[0] : undefined;
+        }
+        if (h.type === 'ArrayExpression') {
+            for (const pair of h.elements) {
+                if (!pair || pair.type !== 'ArrayExpression' || pair.elements.length < 2) return undefined;
+                const k = this.exact(pair.elements[0], scope);
+                if (!k || k.length !== 1) return undefined;
+                if (k[0].toLowerCase() === 'content-type') { const v = this.exact(pair.elements[1], scope); return v && v.length === 1 ? v[0] : undefined; }
+            }
+            return null;
+        }
+        return undefined;
+    }
+    // Text typed as code or a document (a Blob's parts, a Response's body): a
+    // script is parsed and walked, a page or an XML document walked as the
+    // browser renders it; a part not written down is refused.
+    typedText(node, parts, type, scope, what) {
+        const js = JS_MIME.test(type), page = PAGE_MIME.test(type), xml = XML_MIME.test(type);
+        if (!js && !page && !xml) return;
+        if (js) this.add('blob-code', node, `${what}: javascript`);
+        const texts = parts && parts.map((p) => { const v = this.exact(p, scope); return v && v.length === 1 ? v[0] : null; });
+        if (!texts || texts.some((t) => t == null)) return this.add('blob-source', node, `${what} with parts not written down`);
+        const text = texts.join('');
+        if (js) {
+            const r = analyseSource(text, { mode: 'script', lineOffset: 0 });
+            for (const f of r.findings) this.add(f.rule, node, `${f.what} (in a blob's code)`);
+            for (const w of r.wasm) this.wasm.push({ line: (node.loc?.start.line ?? 1) + this.lineOffset, what: `${w.what} (in a blob's code)` });
+            if (r.minified) this.add('blob-source', node, 'a blob of minified code');
+        } else this.document(node, text, xml, what);
+    }
+
+    // Every string in the code: markup a game must not build, the report path,
+    // a javascript: URL, fields and credential words for review, escapes. A
+    // piece of a template with expressions is read for its words here and for
+    // its markup with the whole template (`whole` is false).
+    text(node, value, raw, whole = true) {
+        if (value.includes('/csp-report')) this.add('report-path', node, '"/csp-report"');
+        if (SCRIPT_TAG.test(value)) this.add('script-element', node, 'a <script> tag in text');
+        if (META_CSP.test(value)) this.add('meta-csp', node, 'a <meta http-equiv=Content-Security-Policy> in text');
+        if (NAVIGATION.test(value)) this.add('navigation', node, 'base, refresh, object/embed or srcdoc in text');
+        if (isJavascriptUrl(value)) this.add('inline-handler', node, 'a javascript: URL');
+        if (whole) { this.markup(node, value); this.dataUrl(node, value, 'a string'); }
+        const word = CREDENTIAL_WORDS.exec(value);
+        if (word) this.add('credential-words', node, JSON.stringify(word[0]));
+        if (typeof raw === 'string' && raw.includes('\\')) {
+            const escapes = raw.match(ESCAPE);
+            if (escapes && escapes.length >= 4 && escapes.every((e) => { const cp = parseInt(e.replace(/^\\[xu]\{?|\}$/g, ''), 16); return cp >= 0x20 && cp <= 0x7e; })) this.escapedStrings++;
+        }
+    }
+
+    // A string that holds a tag is markup the page will build (innerHTML,
+    // insertAdjacentHTML, outerHTML, createContextualFragment, setHTMLUnsafe):
+    // walked as a page is, so a handler attribute, a javascript: URL, a field
+    // or a data: script in it is seen, and a computed part where a tag or an
+    // attribute name goes is refused. The walk names the fields; the regex is
+    // for strings without a tag (`contenteditable` on its own).
+    markup(node, value, from = 'in text') {
+        if (MARKUP_IN_TEXT.test(value)) {
+            for (const f of analyseHtml(value).findings) this.add(f.rule, node, `${f.what} ${from}`);
+            return;
+        }
+        const input = INPUT_TAG.exec(value);
+        if (input && !(input[1]?.toLowerCase() === 'input' && PLAIN_INPUT_TYPES.test(input[2]))) this.add('input-element', node, input[1] ? `<${input[1].toLowerCase()}> ${from}` : `contenteditable ${from}`);
+    }
+
+    // A data: URL in a string: a script is code outside the bundle; a page or
+    // an SVG/XML document is read as the frame would render it (its handlers,
+    // scripts and inline code judged); one whose body cannot be decoded is
+    // refused unread. An image or a font is nothing.
+    dataUrl(node, value, what) {
+        const m = DATA_URL.exec(value);
+        if (!m) return;
+        const mime = m[1].trim().toLowerCase();
+        if (JS_MIME.test(mime)) return this.add('data-url-code', node, `${what}: a script in a data: URL`);
+        const page = PAGE_MIME.test(mime), xml = XML_MIME.test(mime);
+        if (!page && !xml) return;
+        // A page from a data: URL is a document that is not a file of the bundle (as a frame on one is); an SVG is art until it holds code.
+        if (page) this.add('data-url-code', node, `${what}: a page in a data: URL`);
+        let body;
+        if (/;\s*base64\s*(?:;|$)/i.test(m[2])) {
+            const b64 = m[3].replace(/\s+/g, '');
+            if (!/^[A-Za-z0-9+/_-]*={0,2}$/.test(b64) || b64.replace(/=+$/, '').length % 4 === 1) return this.add('data-url-code', node, `${what}: a data: document the analyser could not decode`);
+            body = Buffer.from(b64.replace(/-/g, '+').replace(/_/g, '/'), 'base64').toString('utf8');
+        } else {
+            try { body = decodeURIComponent(m[3]); } catch { return this.add('data-url-code', node, `${what}: a data: document the analyser could not decode`); }
+        }
+        this.document(node, body, xml, `${what}: a data: document`);
+    }
+
+    // A document a string holds (a data: URL's body, a Blob's parts): walked as
+    // a page or an XML document, its inline scripts parsed and walked.
+    document(node, text, xml, what) {
+        if (xml) { for (const f of analyseXml(text).findings) this.add(f.rule, node, `${f.what} (${what})`); return; }
+        const page = analyseHtml(text);
+        for (const f of page.findings) this.add(f.rule, node, `${f.what} (${what})`);
+        for (const script of page.scripts) {
+            const r = analyseSource(script.code, { mode: script.mode, lineOffset: 0 });
+            for (const f of r.findings) this.add(f.rule, node, `${f.what} (a script in ${what})`);
+            for (const w of r.wasm) this.wasm.push({ line: (node.loc?.start.line ?? 1) + this.lineOffset, what: `${w.what} (${what})` });
+            if (r.minified) this.add('blob-source', node, `minified code in ${what}`);
+        }
+    }
+}
+
+// ---- entry points -----------------------------------------------------------
+
+function parseScript(source, mode) {
+    const options = { ecmaVersion: 'latest', locations: true, allowHashBang: true };
+    const attempts = mode === 'module' ? ['module'] : mode === 'script' ? ['script'] : ['module', 'script'];
+    let error = null;
+    for (const sourceType of attempts) {
+        try { return { ast: parse(source, { ...options, sourceType }), mode: sourceType }; }
+        catch (e) { error = error || e; if (!(e instanceof SyntaxError)) throw e; }
+    }
+    return { error };
+}
+
+/**
+ * Analyse one script. `mode` is 'module', 'script', or 'auto' (a module first,
+ * a classic script when that fails: a .js file loaded by a plain <script> tag).
+ * `lineOffset` places an inline script's lines in its page.
+ *
+ * Returns { parsed, mode, findings: [{ level, rule, line, what }], names, short,
+ * minified, obfuscated, wasm: [{ line, what }], sourceMappingURL }.
+ */
+export function analyseSource(source, { mode = 'auto', lineOffset = 0 } = {}) {
+    const unit = prepareSource(source, { mode, lineOffset });
+    return judgeSource(unit);
+}
+
+/**
+ * The analysis in two steps, for the scan: every file of a bundle is parsed
+ * and its scopes built first (prepareSource), the files are then wired to one
+ * another (unit.analysis.modules, .pool, .pages: what another file exports,
+ * what a classic script sets on the global object, the elements of the pages
+ * a script runs in), and each is judged (judgeSource). A one-file analysis
+ * (analyseSource) knows nothing beyond its file.
+ */
+export function prepareSource(source, { mode = 'auto', lineOffset = 0 } = {}) {
+    const a = new Analysis(lineOffset);
+    const result = { parsed: false, mode: null, findings: a.findings, names: 0, short: 0, minified: false, wasm: a.wasm, sourceMappingURL: sourceMappingURL(source) };
+    const unit = { analysis: a, ast: null, result };
+    let parsed;
+    try { parsed = parseScript(source, mode); }
+    catch (e) {
+        // acorn recurses with the syntax: a file nested deeper than the stack is
+        // not one a browser's parser reads either, and is refused as such.
+        if (e instanceof RangeError) parsed = { error: Object.assign(new SyntaxError('nested too deep to parse'), { loc: { line: 1 } }) };
+        else throw e;
+    }
+    if (parsed.error) {
+        a.add('syntax', { loc: { start: { line: parsed.error.loc?.line ?? 1 } } }, parsed.error.message.replace(/\s*\(\d+:\d+\)$/, ''));
+        return unit;
+    }
+    result.parsed = true;
+    result.mode = parsed.mode;
+    a.mode = parsed.mode;
+    unit.ast = parsed.ast;
+    a.buildScopes(parsed.ast);
+    return unit;
+}
+export function judgeSource(unit) {
+    const { analysis: a, ast, result } = unit;
+    if (!ast) return result;
+    // (What pass 1 resolved it resolved before the bundle was wired, and before every name was bound: read again.)
+    a.cache.clear();
+    a.mentioned.clear(); a.globalNames.clear();
+    a.writesByKey = null; a.writesBySyntax = null;
+    a.collectSites();
+    a.run(ast);
+    result.names = a.names;
+    result.short = a.short;
+    result.minified = a.names >= LIMITS.minNames && a.short / a.names >= LIMITS.shortNameRatio;
+    if (a.hexNames >= LIMITS.hexNames) a.add('obfuscated', null, `${a.hexNames} names of the form _0x…`);
+    if (a.escapedStrings >= LIMITS.escapedStrings) a.add('obfuscated', null, `${a.escapedStrings} strings of plain text written in \\x or \\u escapes`);
+    return result;
+}
+
+/**
+ * The bundle path a module specifier or a script's src names, from the file
+ * that names it: relative to that file's folder, or from the bundle root
+ * when it starts with `/`. null for a URL, a bare specifier, a path out of
+ * the bundle (`/engine-sdk/sdk.js` is the platform's, not the bundle's).
+ */
+export function resolveSpecifier(from, specifier) {
+    if (typeof specifier !== 'string' || !specifier || /^[a-z][a-z0-9+.-]*:/i.test(specifier) || specifier.startsWith('//')) return null;
+    const clean = specifier.split(/[?#]/)[0];
+    if (!clean) return null;
+    const base = clean.startsWith('/') ? [] : from.split('/').slice(0, -1);
+    if (!clean.startsWith('/') && !clean.startsWith('./') && !clean.startsWith('../')) return null;
+    const out = [...base];
+    for (const part of clean.split('/')) {
+        if (part === '' || part === '.') continue;
+        if (part === '..') { if (!out.length) return null; out.pop(); continue; }
+        out.push(part);
+    }
+    return out.join('/');
+}
+
+/**
+ * The elements of a page (or of markup written as a string) a selector
+ * finds, by its last compound (the ancestors a complex selector asks for are
+ * not checked: more elements match, never fewer): a tag, #id, .class,
+ * [attr], [attr=value] and its ^= $= *= ~= |= forms, several of them, a
+ * list of selectors. A pseudo-class is skipped (more elements match). null
+ * when the selector cannot be read.
+ */
+export function matchSelector(elements, selector) {
+    const out = [];
+    for (const complex of selector.split(',')) {
+        const compounds = complex.trim().split(/\s*[>+~]\s*|\s+/).filter(Boolean);
+        if (!compounds.length) return null;
+        let compound = compounds[compounds.length - 1].replace(/::?[\w-]+(?:\([^()]*\))?/g, '');
+        const tests = [];
+        const tag = /^([a-zA-Z][\w-]*|\*)/.exec(compound);
+        if (tag) { compound = compound.slice(tag[0].length); if (tag[1] !== '*') tests.push((e) => e.tag === tag[1].toLowerCase()); }
+        const token = /^(?:#([\w-]+)|\.([\w-]+)|\[\s*([\w:-]+)\s*(?:([~|^$*]?=)\s*(?:"([^"]*)"|'([^']*)'|([^\]\s]+))\s*)?\s*[is]?\s*\])/;
+        while (compound.length) {
+            const m = token.exec(compound);
+            if (!m) return null;
+            compound = compound.slice(m[0].length);
+            if (m[1] != null) tests.push((e) => e.attrs.get('id') === m[1] || (e.written && (e.attrs.get('id') ?? '').includes(MARKER)));
+            else if (m[2] != null) tests.push((e) => (e.attrs.get('class') ?? '').split(/\s+/).includes(m[2]) || (e.written && (e.attrs.get('class') ?? '').includes(MARKER)));
+            else {
+                const attr = m[3].toLowerCase(), op = m[4], value = m[5] ?? m[6] ?? m[7];
+                tests.push((e) => {
+                    if (!e.attrs.has(attr)) return false;
+                    const v = e.attrs.get(attr);
+                    if (op == null) return true;
+                    if (e.written && v.includes(MARKER)) return true;
+                    switch (op) {
+                        case '=': return v === value;
+                        case '~=': return v.split(/\s+/).includes(value);
+                        case '|=': return v === value || v.startsWith(value + '-');
+                        case '^=': return value !== '' && v.startsWith(value);
+                        case '$=': return value !== '' && v.endsWith(value);
+                        case '*=': return value !== '' && v.includes(value);
+                        default: return false;
+                    }
+                });
+            }
+        }
+        if (!tests.length) return null;
+        for (const e of elements) if (tests.every((t) => t(e))) out.push(e);
+    }
+    return out;
+}
+
+// The //# sourceMappingURL=… comment, read from the tail of the file where
+// bundlers write it.
+function sourceMappingURL(source) {
+    const tail = source.slice(-4096);
+    const m = /\/\/[#@]\s*sourceMappingURL=(\S+)\s*$/m.exec(tail);
+    return m ? m[1] : null;
+}
+
+// ---- HTML ---------------------------------------------------------------------
+
+// The MIME types a browser runs a <script> as (WHATWG HTML, "JavaScript MIME
+// type essence match"), compared on the essence alone: `text/javascript;
+// charset=utf-8` and `text/livescript` run as surely as `text/javascript`.
+// No type, or `module`, is JavaScript too.
+const JS_MIME_ESSENCES = new Set(['application/ecmascript', 'application/javascript', 'application/x-ecmascript', 'application/x-javascript', 'text/ecmascript', 'text/javascript', 'text/javascript1.0', 'text/javascript1.1', 'text/javascript1.2', 'text/javascript1.3', 'text/javascript1.4', 'text/javascript1.5', 'text/jscript', 'text/livescript', 'text/x-ecmascript', 'text/x-javascript']);
+// What a <script type="…"> is: 'script', 'module', 'importmap', or null for
+// a data block the browser never runs (JSON, a shader, speculation rules).
+export function scriptKind(type) {
+    const t = type.trim().toLowerCase();
+    if (t === '') return 'script';
+    if (t === 'module') return 'module';
+    if (t === 'importmap') return 'importmap';
+    return JS_MIME_ESSENCES.has(t.split(';')[0].trim()) ? 'script' : null;
+}
+// Elements whose content HTML reads as text up to the closing tag. XML has
+// none: every element's content is markup (or a CDATA section).
+const RAW_TEXT = new Set(['script', 'style', 'textarea', 'title', 'xmp']);
+// One attribute at the position asked (sticky): a name, and a value in double
+// quotes, single quotes or bare. A quoted value holds any character but its
+// quote, `>` included; one never closed holds the rest of the file, as in the
+// browser, where the tag it is in is then dropped.
+const ATTRIBUTE = /([^\s"'<>\/=]+)(?:\s*=\s*(?:"([^"]*)(?:"|$)|'([^']*)(?:'|$)|([^\s>]+)))?/y;
+// A tag's name where a tag opens: letters, or a MARKER standing for a computed part.
+const TAG_NAME = /^<([a-zA-Z\uE000][\w:\-\uE000]*)/;
+const URL_ATTRIBUTES = new Set(['src', 'href', 'action', 'formaction', 'data', 'xlink:href', 'poster', 'ping']);
+const FRAME_TAGS = new Set(['iframe', 'frame', 'embed']);
+// SVG animation elements, which rewrite the attribute they name.
+const SMIL_TAGS = new Set(['animate', 'set', 'animatetransform', 'animatemotion', 'animatecolor']);
+
+// The character references an attribute value is read through, as the browser
+// reads them: numeric ones with or without the `;` (`&#106avascript:` is
+// javascript:), and the named ones that spell a URL's punctuation or the
+// whitespace the URL parser drops (`java&Tab;script:`, `javascript&colon;`).
+// No named reference spells an ASCII letter (`&fjlig;` spells "fj", which no
+// scheme holds), so this table reads every URL the full one would. A code
+// point outside Unicode, or a surrogate, is the replacement character.
+const NAMED_ENTITIES = new Map(Object.entries({ amp: '&', lt: '<', gt: '>', quot: '"', apos: "'", nbsp: '\u00a0', tab: '\t', newline: '\n', colon: ':', sol: '/', semi: ';', equals: '=', num: '#', lpar: '(', rpar: ')', excl: '!', quest: '?', period: '.', comma: ',', plus: '+', minus: '-', lowbar: '_', ast: '*', midast: '*', percnt: '%', commat: '@', dollar: '$', lsqb: '[', rsqb: ']', lbrack: '[', rbrack: ']', bsol: '\\', hat: '^', grave: '`', lcub: '{', rcub: '}', lbrace: '{', rbrace: '}', verbar: '|', vert: '|', verticalline: '|', fjlig: 'fj' }));
+const codePoint = (cp) => (cp > 0 && cp <= 0x10ffff && !(cp >= 0xd800 && cp <= 0xdfff) ? String.fromCodePoint(cp) : '�');
+const ENTITY = /&(?:#x([0-9a-f]+)|#(\d+)|([a-z]+));?/gi;
+// Every digit counts, as in the browser (and libxml2): `&#x000000006A;` is
+// U+006A, and a value past Unicode (parseInt/Number of a run of digits that
+// long is Infinity) is the replacement character.
+const decodeEntities = (s) => s.replace(ENTITY, (m, hex, dec, name) => {
+    if (hex) return codePoint(parseInt(hex, 16));
+    if (dec) return codePoint(Number(dec));
+    return NAMED_ENTITIES.get(name.toLowerCase()) ?? m;
+});
+
+/**
+ * Walk a page's tags once, in linear time, and return its scripts (each with
+ * its line and whether it is a module) and the markup findings: code in
+ * attributes, import maps, scripts and frames on data: URLs, fields, and a
+ * computed part (MARKER) where a tag or an attribute name goes, or as an
+ * unquoted value (markup-parts, for review: the walk cannot know what the
+ * part carries; a part inside a quoted value or in text is a stated limit). The scripts
+ * go to analyseSource; the markup rules a regex serves (CSP, base, refresh,
+ * object/embed, srcdoc, outside URLs) stay in scan.mjs.
+ *
+ * A tag is read whole, as the browser reads it: however long it runs on, and
+ * with `>` allowed inside a quoted value, so a handler after four kilobytes of
+ * padding, or after a value that holds a `>`, is seen. Every attribute written
+ * is judged (the browser keeps the first of a duplicated name; the walk keeps
+ * that one for its lookups and judges them all). Every step of the attribute
+ * walk consumes at least one character, so the time is the file's length; the
+ * attribute regex is anchored at its position and never searches ahead.
+ *
+ * `xml` reads the document as an XML parser does: an element's or an
+ * attribute's namespace prefix is not its name, so `<svg:script>` and
+ * `<h:script>` are scripts and `svg:onload` is judged as onload; no element's
+ * content is raw text.
+ */
+export function analyseHtml(html, { xml = false } = {}) {
+    const scripts = [];
+    const findings = [];
+    const elements = [];
+    let overflow = false;
+    const add = (rule, line, what) => findings.push({ level: RULES[rule].level, rule, line, what });
+    let line = 1, lineAt = 0;
+    const lineOf = (pos) => { for (; lineAt < pos; lineAt++) if (html.charCodeAt(lineAt) === 10) line++; return line; };
+    const localName = (name) => (xml ? name.replace(/^[\w.\-\uE000]+:/, '') : name);
+    let i = 0;
+    while (i < html.length) {
+        const lt = html.indexOf('<', i);
+        if (lt < 0) break;
+        if (html.startsWith('<!--', lt)) { const end = html.indexOf('-->', lt + 4); i = end < 0 ? html.length : end + 3; continue; }
+        const nameMatch = TAG_NAME.exec(html.slice(lt, lt + 64));
+        if (!nameMatch) { i = lt + 1; continue; }
+        const name = localName(nameMatch[1].toLowerCase());
+        const tagLine = lineOf(lt);
+        if (name.includes(MARKER)) add('markup-parts', tagLine, 'a tag named by a computed part');
+        const attrs = new Map();
+        const all = [];
+        let pos = lt + nameMatch[0].length, gt = -1;
+        while (pos < html.length) {
+            const ch = html.charCodeAt(pos);
+            if (ch === 0x3e) { gt = pos; break; } // >
+            if (ch === 0x20 || ch === 0x09 || ch === 0x0a || ch === 0x0c || ch === 0x0d || ch === 0x2f) { pos++; continue; } // space, tab, newline, form feed, return, /
+            ATTRIBUTE.lastIndex = pos;
+            const m = ATTRIBUTE.exec(html);
+            if (!m) { pos++; continue; } // a stray quote or =: the browser skips it too
+            const attr = m[1].toLowerCase();
+            const value = decodeEntities(m[2] ?? m[3] ?? m[4] ?? '');
+            // xlink:href is itself a name the rules know; any other prefix is dropped in XML.
+            const local = xml && attr !== 'xlink:href' ? attr.replace(/^[\w.\-\uE000]+:/, '') : attr;
+            // An unquoted value is one word: a computed part there that holds a space is attributes.
+            if (m[4] != null && m[4].includes(MARKER)) add('markup-parts', tagLine, `<${name} ${attr}=…> a computed part as an unquoted attribute value`);
+            all.push([local, value]);
+            if (!attrs.has(local)) attrs.set(local, value);
+            pos = ATTRIBUTE.lastIndex;
+        }
+        // A tag the file ends inside is dropped by the browser; its attributes
+        // were still read, since nothing after it runs anyway.
+        if (gt < 0) gt = html.length - 1;
+        // The element, for the code's lookups (getElementById, a selector) and the attributes it reads back.
+        if (elements.length < ELEMENTS) elements.push({ type: 'PageElement', tag: name, attrs, line: tagLine, written: false }); else overflow = true;
+        for (const [attr, value] of all) {
+            if (attr.includes(MARKER)) add('markup-parts', tagLine, `<${name} …> a computed part where an attribute name goes`);
+            else if (/^on/.test(attr)) add('inline-handler', tagLine, `<${name} ${attr}=…>`);
+            else if (URL_ATTRIBUTES.has(attr) && isJavascriptUrl(value)) add('inline-handler', tagLine, `<${name} ${attr}="javascript:…">`);
+            else if (attr === 'contenteditable') add('input-element', tagLine, `<${name} contenteditable>`);
+        }
+        // SMIL rewrites an attribute over time: <animate attributeName="href"
+        // values="javascript:…"> makes a link run code when clicked (Chromium
+        // does), <set attributeName="onclick"> aims at a handler. The target
+        // and every value it is given are judged as the attribute would be.
+        if (SMIL_TAGS.has(name)) {
+            const target = (attrs.get('attributename') ?? '').toLowerCase().replace(/^[\w.-]+:/, '');
+            if (/^on/.test(target)) add('inline-handler', tagLine, `<${name} attributeName="${target.slice(0, 20)}">: animates a handler attribute`);
+            else if (URL_ATTRIBUTES.has(target)) {
+                for (const k of ['to', 'from', 'by', 'values']) for (const v of (attrs.get(k) ?? '').split(';')) {
+                    if (isJavascriptUrl(v)) add('inline-handler', tagLine, `<${name} attributeName="${target}" ${k}="javascript:…">`);
+                    else if (/^\s*(?:data|blob):/i.test(v)) add('data-url-code', tagLine, `<${name} attributeName="${target}" ${k}="data:…">`);
+                }
+            }
+        }
+        if (INPUT_TAGS.has(name) && !(name === 'input' && /^(?:range|checkbox|radio|button|hidden|submit|reset|color|file|image)$/i.test(attrs.get('type') ?? ''))) add('input-element', tagLine, `<${name}${attrs.has('type') ? ' type=' + attrs.get('type') : ''}>`);
+        if ((name === 'script' || FRAME_TAGS.has(name)) && /^\s*(?:data|blob):/i.test(attrs.get('src') ?? '')) add('data-url-code', tagLine, `<${name} src="${attrs.get('src').slice(0, 30)}…">`);
+        if (name === 'object' && /^\s*(?:data|blob):/i.test(attrs.get('data') ?? '')) add('data-url-code', tagLine, '<object data="data:…">');
+        let next = gt + 1;
+        if (!xml && RAW_TEXT.has(name)) {
+            const close = html.slice(next).search(new RegExp(`</${name}\\b`, 'i'));
+            const end = close < 0 ? html.length : next + close;
+            const content = html.slice(next, end);
+            if (name === 'script') {
+                const kind = scriptKind(attrs.get('type') ?? '');
+                if (kind === 'importmap') add('import-map', tagLine, '<script type="importmap">');
+                else if (kind && content.trim()) scripts.push({ code: content, line: lineOf(next), mode: kind, src: attrs.get('src') ?? null });
+                // A data block (<script type="application/json">): text the code may read (its textContent) and put into the page as markup: judged as a data file is.
+                else if (!kind && content.trim()) for (const f of analyseData(content).findings) add(f.rule, lineOf(next), `${f.what.replace(/in a data file(?:'s (?:string|key))?/, `in a <script type="${(attrs.get('type') ?? '').slice(0, 30)}"> block`)}`);
+            } else if (content.trim()) {
+                // <xmp>, <textarea>, <title>, <style>: text the page shows as text, which the code may read back as markup; a tag, a handler or a javascript: URL in it is judged as in a data file (entities are read in textarea and title, as the browser reads them).
+                const text = name === 'textarea' || name === 'title' ? decodeEntities(content) : content;
+                for (const f of analyseData(text).findings) add(f.rule, lineOf(next), `${f.what.replace(/in a data file(?:'s (?:string|key))?/, `in <${name}> text`)}`);
+            }
+            next = end;
+        }
+        i = next;
+    }
+    return { scripts, findings, elements, overflow };
+}
+
+// ---- XML documents ------------------------------------------------------------
+
+// An internal DTD subset opens with `[` inside the DOCTYPE; a declaration of an
+// entity or an attribute default may also sit anywhere a hostile file puts it.
+const DOCTYPE_WITH_SUBSET = /<!DOCTYPE\s[^\[>]*\[/i;
+const DTD_DECLARATION = /<!(?:ENTITY|ATTLIST|ELEMENT|NOTATION)\b/i;
+
+/**
+ * Why an XML document is not read as the browser renders it: an internal DTD
+ * subset (`<!DOCTYPE svg [ … ]>`), whose `<!ENTITY>` declarations become
+ * markup where they are referenced and whose `<!ATTLIST … "default">`
+ * declarations add attributes — an `onload` among them — to every such
+ * element; a declaration of either kind wherever it stands; an
+ * `<?xml-stylesheet?>`, whose transform's output is the page the browser
+ * shows and is not this file. The analyser does not emulate any of it: the
+ * document is refused with the reason, and the studio exports plain SVG. An
+ * external DTD (`<!DOCTYPE svg PUBLIC "…" "…svg11.dtd">`) is not fetched by
+ * browsers (the XHTML DTDs they carry define no attribute default that runs)
+ * and is allowed. Returns [{ at, problem }].
+ */
+export function dtdProblems(xml) {
+    const out = [];
+    const subset = DOCTYPE_WITH_SUBSET.exec(xml);
+    if (subset) out.push({ at: subset.index, problem: 'an internal DTD subset (<!DOCTYPE … [ … ]>): its entities and attribute defaults become markup the analyser does not read' });
+    const decl = DTD_DECLARATION.exec(xml);
+    if (decl) out.push({ at: decl.index, problem: `a ${decl[0].slice(2).toUpperCase()} declaration: entities and attribute defaults become markup the analyser does not read` });
+    const stylesheet = xml.search(/<\?xml-stylesheet\b/i);
+    if (stylesheet >= 0) out.push({ at: stylesheet, problem: '<?xml-stylesheet?>: the browser renders the transform\'s output' });
+    return out;
+}
+
+/**
+ * An SVG, XML or XHTML document, read as the browser renders it when the
+ * page frames it: its tags walked with namespace prefixes dropped. Any script
+ * element is refused (svg-script: a game's scripts are .js files), as is a
+ * DTD subset, an entity or attribute-list declaration or an
+ * <?xml-stylesheet?> (xml-markup: markup the analyser would have to emulate
+ * the parser to read). Handlers, javascript: URLs and fields are the walk's
+ * findings.
+ */
+export function analyseXml(xml) {
+    const findings = [];
+    const lineAt = (at) => (at < 0 ? 1 : xml.slice(0, at).split('\n').length);
+    for (const { at, problem } of dtdProblems(xml)) findings.push({ level: RULES['xml-markup'].level, rule: 'xml-markup', line: lineAt(at), what: problem });
+    findings.push(...analyseHtml(xml, { xml: true }).findings);
+    const script = xml.search(SCRIPT_TAG);
+    if (script >= 0) findings.push({ level: RULES['svg-script'].level, rule: 'svg-script', line: lineAt(script), what: '<script> in an XML document' });
+    return { findings };
+}
+
+// ---- data files ---------------------------------------------------------------
+
+/**
+ * A text data file of the bundle (any file that is UTF-8 text and not code or
+ * markup: .json, .txt, .csv, .atlas, a shader, a template of any extension):
+ * what the game reads and puts into a page as markup comes from here when it
+ * is not written in the code, so its text is walked as markup is — a handler
+ * attribute, a <script>, a javascript: URL or a data: document in it is
+ * refused as it would be in a string of the code. A file that parses as JSON
+ * is read twice: as its raw text (the page may fetch it as text) and as every
+ * string it parses to (< is <), to the last one: the walk is linear in
+ * the file, which the file budget bounds. A byte-order mark is dropped first,
+ * as the browser's response.json() drops it. Returns { findings, parsed }:
+ * `parsed` says whether the text is JSON, so the caller refuses a .json that
+ * is not (the page would read it as JSON; the analyser could not).
+ */
+export function analyseData(text) {
+    const findings = [];
+    const seen = new Set();
+    const add = (rule, line, what) => { const id = `${rule}\0${line}\0${what}`; if (seen.has(id)) return; seen.add(id); findings.push({ level: RULES[rule].level, rule, line, what }); };
+    const judge = (value, line, where) => {
+        if (SCRIPT_TAG.test(value)) add('script-element', line, `a <script> tag ${where}`);
+        if (isJavascriptUrl(value)) add('inline-handler', line, `a javascript: URL ${where}`);
+        if (MARKUP_IN_TEXT.test(value)) for (const f of analyseHtml(value).findings) add(f.rule, line, `${f.what} ${where}`);
+        const m = DATA_URL.exec(value);
+        if (m && (JS_MIME.test(m[1]) || PAGE_MIME.test(m[1]) || XML_MIME.test(m[1]))) add('data-url-code', line, `a data: script or document ${where}`);
+    };
+    const src = text.charCodeAt(0) === 0xfeff ? text.slice(1) : text;
+    judge(src, 1, 'in a data file');
+    let parsed;
+    try { parsed = JSON.parse(src); } catch { return { findings, parsed: false }; }
+    const stack = [parsed];
+    // The walk is bounded: a file of more than DATA_VALUES values is not read
+    // to its end and is refused as such (data-file), never passed unread.
+    let steps = 0;
+    while (stack.length && steps++ < DATA_VALUES) {
+        const v = stack.pop();
+        if (typeof v === 'string') judge(v, 1, 'in a data file\'s string');
+        else if (Array.isArray(v)) for (const x of v) stack.push(x);
+        else if (v && typeof v === 'object') for (const k of Object.keys(v)) { judge(k, 1, 'in a data file\'s key'); stack.push(v[k]); }
+    }
+    if (stack.length) add('data-file', 1, `more than ${DATA_VALUES.toLocaleString('en')} values: not read to the end`);
+    return { findings, parsed: true, values: steps };
+}