lume-js 2.2.0 → 2.2.1

package/src/addons/hydrateState.js

@@ -2,8 +2,16 @@
  * Reads initial state from a `<script type="application/json">` element
  * embedded in the server-rendered HTML. Useful for SSR / hydration patterns.
  *
+ * @security Hydration trusts the DOM. An attacker who can inject HTML before
+ * the legitimate script (DOM clobbering) can control the parsed data. The
+ * element must be a real `<script type="application/json">` tag; non-script
+ * elements are rejected. Use the optional `validate` parameter to enforce a
+ * schema (e.g., whitelist allowed keys) before passing to `state()`.
+ *
  * @param {string} [selector='#__LUME_DATA__'] - CSS selector for the script element
- * @returns {object} Parsed JSON object, or empty object if not found / invalid
+ * @param {function} [validate] - Optional validator: (data) => boolean. If it
+ *   returns false, hydrateState returns {} instead of the parsed data.
+ * @returns {object} Parsed JSON object, or empty object if not found / invalid / rejected
  *
  * @example
  * ```html
@@ -16,15 +24,35 @@
  * import { state } from 'lume-js';
  * import { hydrateState } from 'lume-js/addons';
  *
- * const store = state(hydrateState());
+ * // With optional schema validation
+ * const data = hydrateState('#__LUME_DATA__', d =>
+ *   typeof d.title === 'string' && typeof d.count === 'number'
+ * );
+ * const store = state(data);
  * ```
  */
-export function hydrateState(selector = '#__LUME_DATA__') {
+export function hydrateState(selector = '#__LUME_DATA__', validate) {
   const el = typeof document !== 'undefined' ? document.querySelector(selector) : null;
   if (!el) return {};
+
+  // Reject non-script elements or scripts without the correct type.
+  // This mitigates DOM clobbering where an attacker injects a matching
+  // element with a different tag name (e.g., a div or a script with
+  // a different type that would still match querySelector by id).
+  if (el.tagName !== 'SCRIPT' || el.type !== 'application/json') {
+    return {};
+  }
+
+  let data;
   try {
-    return JSON.parse(el.textContent);
+    data = JSON.parse(el.textContent);
   } catch {
     return {};
   }
+
+  if (typeof validate === 'function' && !validate(data)) {
+    return {};
+  }
+
+  return data;
 }

package/src/addons/withPlugins.js

@@ -24,6 +24,10 @@
  *   onNotify(key, value)             — called before subscribers are notified
  *   onSubscribe(key)                 — called when $subscribe is invoked
  *
+ * @security Plugins run with full application privilege. A plugin can read
+ * all state, alter any write, or suppress mutations. Only pass trusted objects.
+ * Plugin objects are frozen after registration to prevent post-init mutation.
+ *
  * @param {object} store - A reactive proxy from state()
  * @param {Array<object>} plugins - Array of plugin objects
  * @returns {Proxy} A new proxy wrapping the store with plugin behavior
@@ -33,13 +37,15 @@ import { logError } from '../utils/log.js';
 export function withPlugins(store, plugins = []) {
   if (!plugins.length) return store;
 
-  // Call onInit hooks once at wrap time
+  // Call onInit hooks once at wrap time, then freeze each plugin to prevent
+  // post-registration mutation of its hooks (defense-in-depth).
   for (const p of plugins) {
     try {
       p.onInit?.();
     } catch (e) {
       logError(`[Lume.js] Plugin "${p.name}" error in onInit:`, e);
     }
+    Object.freeze(p);
   }
 
   // Track pending notifications for onNotify hooks.

package/src/core/bindDom.js

@@ -24,6 +24,11 @@
  * Usage:
  *   import { bindDom } from "lume-js";
  *   const cleanup = bindDom(document.body, store);
+ *
+ * @security `data-bind` attribute values are resolved once at bind time and
+ * trusted as state path expressions. If an attacker can inject `data-bind`
+ * attributes into the DOM, they can subscribe to any reachable reactive state.
+ * Ensure your HTML is trusted or sanitize it before calling bindDom().
  */
 
 import { logWarn } from '../utils/log.js';

package/src/core/state.js

@@ -22,7 +22,7 @@
  *   unsub(); // cleanup
  */
 
-import { logError } from '../utils/log.js';
+import { logError, logWarn } from '../utils/log.js';
 
 // Per-state batching – each state object maintains its own microtask flush.
 // This keeps effects simple and aligned with Lume's minimal philosophy.
@@ -55,6 +55,12 @@ const readers = new Set();
  *
  * Internal API — used by effect.js for auto-tracking. May be stabilized
  * for third-party addons in a future release.
+ *
+ * @security The observer sees reads from ALL state instances within the same
+ * module instance, including nested scopes. Only pass trusted observer functions.
+ * A future scoped variant (e.g., scopedReadObserver(store, fn)) may limit
+ * observation to a single state instance.
+ *
  * @param {function} onRead - Called on each property access inside fn
  * @param {function} fn - The function to run under observation
  */
@@ -191,6 +197,8 @@ export function state(obj) {
     };
   };
 
+  const BLOCKED_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+
   const proxy = new Proxy(obj, {
     get(target, key) {
       // Skip effect tracking for internal meta methods (e.g. $subscribe)
@@ -211,6 +219,11 @@ export function state(obj) {
     },
 
     set(target, key, value) {
+      if (typeof key === 'string' && BLOCKED_KEYS.has(key)) {
+        logWarn(`[Lume.js state] Blocked write to reserved key "${key}"`);
+        return true;
+      }
+
       const oldValue = target[key];
 
       // Skip update if value unchanged - Object.is() handles NaN and -0 correctly
@@ -256,12 +269,18 @@ export function state(obj) {
     };
   };
 
+  const MAX_SUBSCRIBERS = 1000;
+
   obj.$subscribe = (key, fn) => {
     if (typeof fn !== 'function') {
       throw new Error('Subscriber must be a function');
     }
 
     if (!listeners[key]) listeners[key] = [];
+    if (listeners[key].length >= MAX_SUBSCRIBERS) {
+      logWarn(`[Lume.js state] Subscriber limit (${MAX_SUBSCRIBERS}) reached for key "${key}". New subscriber ignored.`);
+      return () => {};
+    }
     listeners[key].push(fn);
 
     // Call immediately with current value (NOT batched)

package/src/handlers/stringAttr.js

@@ -5,12 +5,24 @@
  * @param {string} name - HTML attribute name (e.g., 'href', 'src', 'title')
  * @returns {{ attr: string, apply: function }}
  */
+
+const DANGEROUS_SCHEME = /^(javascript|vbscript|data\s*:\s*text\/html)/i;
+const URI_ATTRS = new Set(['href', 'src', 'action', 'srcset', 'poster', 'formaction']);
+
 export function stringAttr(name) {
   return {
     attr: `data-${name}`,
     apply(el, val) {
-      if (val == null) el.removeAttribute(name);
-      else el.setAttribute(name, String(val));
+      if (val == null) {
+        el.removeAttribute(name);
+        return;
+      }
+      const strVal = String(val);
+      if (URI_ATTRS.has(name) && DANGEROUS_SCHEME.test(strVal)) {
+        el.removeAttribute(name);
+        return;
+      }
+      el.setAttribute(name, strVal);
     }
   };
 }

package/dist/shared-Dcokqj5a.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"shared-Dcokqj5a.mjs","sources":["../src/utils/log.js","../src/core/state.js","../src/core/effect.js"],"sourcesContent":["/**\n * Environment-safe logging utilities for constrained runtimes\n * (e.g. service workers, embedded engines, SSR environments).\n *\n * All core and addon files should import these instead of\n * calling console.* directly to avoid ReferenceError when\n * console is not defined.\n */\n\nexport function logWarn(msg, ...rest) {\n  if (typeof console !== 'undefined' && typeof console.warn === 'function') {\n    console.warn(msg, ...rest);\n  }\n}\n\nexport function logError(msg, ...rest) {\n  if (typeof console !== 'undefined' && typeof console.error === 'function') {\n    console.error(msg, ...rest);\n  }\n}\n","/**\n * Lume-JS Reactive State Core\n *\n * Provides minimal reactive state with standard JavaScript.\n * Features automatic microtask batching for performance.\n * Read tracking is opt-in via withReadObserver — state.js has zero permanent\n * dependency on effect.js or any other module.\n *\n * Features:\n * - Lightweight and Go-style\n * - Explicit nested states\n * - $subscribe for listening to key changes\n * - Cleanup with unsubscribe\n * - Per-state microtask batching for writes\n * - Scope-based read tracking via withReadObserver (multi-observer safe)\n *\n * Usage:\n *   import { state } from \"lume-js\";\n *\n *   const store = state({ count: 0 });\n *   const unsub = store.$subscribe(\"count\", val => console.log(val));\n *   unsub(); // cleanup\n */\n\nimport { logError } from '../utils/log.js';\n\n// Per-state batching – each state object maintains its own microtask flush.\n// This keeps effects simple and aligned with Lume's minimal philosophy.\n\n/**\n * Creates a reactive state object.\n *\n * @param {Object} obj - Initial state object (must be plain object)\n * @returns {Proxy} Reactive proxy with $subscribe method\n *\n * @example\n * const store = state({ count: 0 });\n */\n\n// Active read observers — only populated during withReadObserver scopes.\n// This keeps state.js pure: tracking only happens when someone explicitly\n// asks to observe reads within a synchronous function call.\n//\n// Note: This Set is module-level, so all reactive state instances and effects\n// within the SAME module instance share it. This is standard behavior for\n// auto-tracking reactive libraries (Vue, MobX, Solid, etc.). Multiple copies\n// of the lume-js module (e.g. from different bundled chunks) each get their\n// own independent Set via ES module / CommonJS isolation.\nconst readers = new Set();\n\n/**\n * Run a function with a read observer active.\n * The observer receives (proxy, key, registerEffect) for every property read.\n * Multiple observers can be active simultaneously (nested effects, devtools, etc.)\n *\n * Internal API — used by effect.js for auto-tracking. May be stabilized\n * for third-party addons in a future release.\n * @param {function} onRead - Called on each property access inside fn\n * @param {function} fn - The function to run under observation\n */\nexport function withReadObserver(onRead, fn) {\n  readers.add(onRead);\n  try {\n    return fn();\n  } finally {\n    readers.delete(onRead);\n  }\n}\n\nexport function state(obj) {\n  // Validate input\n  if (!obj || typeof obj !== 'object' || Array.isArray(obj)) {\n    throw new Error('state() requires a plain object');\n  }\n  if (Object.isFrozen(obj) || Object.isSealed(obj)) {\n    throw new Error('state() requires a mutable plain object');\n  }\n\n  // Object.create(null) - no prototype chain lookups\n  const listeners = Object.create(null);\n  const pendingNotifications = new Map(); // Per-state pending changes\n  const pendingEffects = new Set(); // Dedupe effects per state\n  const beforeFlushHooks = [];\n  let flushScheduled = false;\n\n  /**\n   * Schedule a single microtask flush for this state object.\n   *\n   * Flush order per state:\n   * 1) Notify subscribers for changed keys (key → subscribers)\n   * 2) Run each queued effect exactly once (Set-based dedupe)\n   * 3) Repeat up to 100 iterations to handle cascading updates,\n   *    then log an error to prevent infinite loops.\n   *\n   * Notes:\n   * - Batching is per state; effects that depend on multiple states\n   *   may run once per state that changed (by design).\n   */\n  function scheduleFlush() {\n    if (flushScheduled) return;\n\n    flushScheduled = true;\n    // eslint-disable-next-line sonarjs/cognitive-complexity -- single-pass flush loop: hooks → subscribers → effects → cycle detection; must stay atomic\n    queueMicrotask(() => {\n      let iterations = 0;\n      const MAX_ITERATIONS = 100;\n\n      try {\n        while ((pendingNotifications.size > 0 || pendingEffects.size > 0) && iterations < MAX_ITERATIONS) {\n          iterations++;\n\n          // Run registered before-flush hooks (e.g. plugin onNotify)\n          for (let i = 0; i < beforeFlushHooks.length; i++) {\n            try {\n              beforeFlushHooks[i]();\n            } catch (err) {\n              logError('[Lume.js state] Error in beforeFlush hook:', err);\n            }\n          }\n\n          // Notify all subscribers of changed keys\n          for (const [key, value] of pendingNotifications) {\n            if (listeners[key]) {\n              const subs = listeners[key];\n              let i = 0;\n              while (i < subs.length) {\n                const fn = subs[i];\n                try {\n                  fn(value);\n                } catch (err) {\n                  logError(`[Lume.js state] Error notifying subscriber for key \"${String(key)}\":`, err);\n                }\n                // Only advance if fn wasn't removed (something shifted into its place)\n                if (subs[i] === fn) i++;\n              }\n            }\n          }\n\n          pendingNotifications.clear();\n\n          // Run each effect exactly once (Set deduplicates)\n          const effects = new Array(pendingEffects.size);\n          let idx = 0;\n          for (const effect of pendingEffects) {\n            effects[idx++] = effect;\n          }\n          pendingEffects.clear();\n          for (let i = 0; i < effects.length; i++) {\n            try {\n              effects[i]();\n            } catch (err) {\n              logError('[Lume.js state] Error in effect:', err);\n            }\n          }\n        }\n      } finally {\n        flushScheduled = false;\n      }\n\n      if (iterations >= MAX_ITERATIONS) {\n        logError(\n          '[Lume.js state] Maximum flush iterations reached (100). ' +\n          'This usually indicates an infinite loop caused by an effect or computed mutating state it depends on.'\n        );\n      }\n    });\n  }\n\n  // Brand symbol for type-level reactive identification\n  const REACTIVE_BRAND = Symbol('lume.reactive');\n  obj[REACTIVE_BRAND] = true;\n\n  // Defined once per state instance — not per property read — to avoid per-read closure allocation.\n  const registerEffect = (key, executeFn) => {\n    if (!listeners[key]) listeners[key] = [];\n\n    const callback = () => {\n      pendingEffects.add(executeFn);\n    };\n\n    listeners[key].push(callback);\n\n    return () => {\n      if (listeners[key]) {\n        const idx = listeners[key].indexOf(callback);\n        if (idx !== -1) {\n          listeners[key].splice(idx, 1);\n          if (listeners[key].length === 0) delete listeners[key];\n        }\n      }\n    };\n  };\n\n  const proxy = new Proxy(obj, {\n    get(target, key) {\n      // Skip effect tracking for internal meta methods (e.g. $subscribe)\n      if (typeof key === 'string' && key.startsWith('$')) {\n        return target[key];\n      }\n\n      const value = target[key];\n\n      // Notify active read observers (effects, devtools, etc.)\n      if (readers.size > 0) {\n        for (const reader of readers) {\n          reader(proxy, key, registerEffect);\n        }\n      }\n\n      return value;\n    },\n\n    set(target, key, value) {\n      const oldValue = target[key];\n\n      // Skip update if value unchanged - Object.is() handles NaN and -0 correctly\n      if (Object.is(oldValue, value)) return true;\n\n      target[key] = value;\n\n      // Batch notifications at the state level (per-state, not global)\n      pendingNotifications.set(key, value);\n      scheduleFlush();\n\n      return true;\n    }\n  });\n\n  /**\n   * Subscribe to changes for a specific key.\n   * Calls the callback immediately with the current value.\n   * Returns an unsubscribe function for cleanup.\n   *\n   * @param {string} key - Property key to watch\n   * @param {function} fn - Callback function\n   * @returns {function} Unsubscribe function\n   */\n  // Set on obj (not proxy) to avoid triggering the set trap.\n  // The get trap already returns target[key] directly for $-prefixed keys.\n  /**\n   * Register a callback to run before each flush.\n   * Returns an unsubscribe function.\n   */\n  obj.$beforeFlush = (fn) => {\n    if (typeof fn !== 'function') {\n      throw new Error('$beforeFlush requires a function');\n    }\n    if (beforeFlushHooks.indexOf(fn) === -1) {\n      beforeFlushHooks.push(fn);\n    }\n    return () => {\n      const idx = beforeFlushHooks.indexOf(fn);\n      if (idx !== -1) {\n        beforeFlushHooks.splice(idx, 1);\n      }\n    };\n  };\n\n  obj.$subscribe = (key, fn) => {\n    if (typeof fn !== 'function') {\n      throw new Error('Subscriber must be a function');\n    }\n\n    if (!listeners[key]) listeners[key] = [];\n    listeners[key].push(fn);\n\n    // Call immediately with current value (NOT batched)\n    fn(proxy[key]);\n\n    // Return unsubscribe function\n    return () => {\n      if (listeners[key]) {\n        const idx = listeners[key].indexOf(fn);\n        if (idx !== -1) {\n          listeners[key].splice(idx, 1);\n          if (listeners[key].length === 0) delete listeners[key];\n        }\n      }\n    };\n  };\n\n  return proxy;\n}\n","import { withReadObserver } from './state.js';\nimport { logError } from '../utils/log.js';\n\n/**\n * Lume-JS Effect\n *\n * Reactive effects with two modes:\n * 1. Auto-tracking (default): Tracks dependencies automatically via withReadObserver\n * 2. Explicit deps: You specify exactly what triggers re-runs\n *\n * Auto-tracking uses scope-based read observation — state.js has zero permanent\n * dependency on this module. Read tracking is only active during the synchronous\n * execution of an effect's body.\n *\n * Usage:\n *   import { effect } from \"lume-js\";\n *\n *   // Auto-tracking mode (existing behavior)\n *   effect(() => {\n *     console.log('Count is:', store.count);\n *     // Automatically re-runs when store.count changes\n *   });\n *\n *   // Explicit deps mode (new - no magic)\n *   effect(() => {\n *     console.log('Count is:', store.count);\n *   }, [[store, 'count']]);  // Only re-runs when store.count changes\n *\n * Features:\n * - Automatic dependency collection via withReadObserver scope (default)\n * - Explicit dependencies for side-effects\n * - Returns cleanup function\n * - Compatible with per-state batching\n */\n\n// Module-scoped effect context (prevents third-party spoofing via globalThis)\nlet currentEffect = null;\n\n// withReadObserver is used below to scope read tracking to synchronous effect execution.\n\n/**\n * Creates an effect that runs reactively\n *\n * @param {function} fn - Function to run reactively\n * @param {Array<[object, string]>} [deps] - Optional explicit dependencies as [store, key] tuples\n * @returns {function} Cleanup function to stop the effect\n *\n * @example\n * // Auto-tracking (default)\n * const store = state({ count: 0 });\n * effect(() => {\n *   document.title = `Count: ${store.count}`;\n * });\n * \n * @example\n * // Explicit deps (no magic)\n * effect(() => {\n *   analytics.log(store.count);  // Won't track store.count automatically\n * }, [[store, 'count']]);        // Explicit: only re-run on store.count\n */\n// eslint-disable-next-line sonarjs/cognitive-complexity -- handles both auto-tracking and explicit-deps modes with cleanup; splitting would require exporting internal state\nexport function effect(fn, deps) {\n  if (typeof fn !== 'function') {\n    throw new Error('effect() requires a function');\n  }\n\n  const cleanups = [];\n  let isRunning = false;\n\n  /**\n   * Execute the effect function\n   */\n  const execute = () => {\n    /* v8 ignore next -- re-entry guard: unreachable because $subscribe fires via microtask after isRunning resets in finally */\n    if (isRunning) return;\n    isRunning = true;\n\n    try {\n      fn();\n    } catch (error) {\n      logError('[Lume.js effect] Error in effect:', error);\n      throw error;\n    } finally {\n      isRunning = false;\n    }\n  };\n\n  // EXPLICIT DEPS MODE: deps array provided\n  if (Array.isArray(deps)) {\n    // Subscribe to each [store, key1, key2, ...] tuple explicitly\n    for (const dep of deps) {\n      if (Array.isArray(dep) && dep.length >= 2) {\n        const [store, ...keys] = dep;\n        if (store && typeof store.$subscribe === 'function') {\n          // Subscribe to each key in this tuple\n          for (const key of keys) {\n            // $subscribe calls immediately, then on changes\n            // We want: call execute immediately once, then on changes\n            let isFirst = true;\n            const unsub = store.$subscribe(key, () => {\n              if (isFirst) {\n                isFirst = false;\n                return; // Skip first call, we'll run execute() below\n              }\n              execute();\n            });\n            cleanups.push(unsub);\n          }\n        }\n      }\n    }\n    // Run immediately\n    execute();\n  }\n  // AUTO-TRACKING MODE: no deps (existing behavior)\n  else {\n    const executeWithTracking = () => {\n      /* v8 ignore next -- defensive guard: synchronous re-entry is unreachable through the public API */\n      if (isRunning) return;\n\n      // Save previous subscriptions instead of cleaning immediately.\n      // If fn() doesn't read any state (early return / error), we restore\n      // them so the effect stays reactive.\n      const oldCleanups = cleanups.splice(0);\n\n      // Create effect context for tracking\n      const myContext = {\n        fn,\n        cleanups,\n        execute: executeWithTracking,\n        tracking: {}\n      };\n\n      // Set as current effect (for state.js to detect)\n      // Save previous context to support nested effects/computed\n      const previousEffect = currentEffect;\n      currentEffect = myContext;\n      isRunning = true;\n\n      try {\n        const onRead = (proxy, key, registerEffect) => {\n          // Only the currently active effect (not a nested one) creates subscriptions\n          if (currentEffect !== myContext) return;\n          if (myContext.tracking[key]) return;\n          myContext.tracking[key] = true;\n          myContext.cleanups.push(registerEffect(key, myContext.execute));\n        };\n        withReadObserver(onRead, fn);\n      } catch (error) {\n        // On error, restore old subscriptions so the effect stays reactive\n        cleanups.length = 0;\n        cleanups.push(...oldCleanups);\n        logError('[Lume.js effect] Error in effect:', error);\n        throw error;\n      } finally {\n        // Restore previous context (not undefined) to support nesting\n        currentEffect = previousEffect;\n        isRunning = false;\n      }\n\n      // If fn() created new subscriptions, clean old ones.\n      // If it didn't (e.g., early return), keep old subscriptions intact.\n      if (cleanups.length > 0) {\n        for (const cleanup of oldCleanups) cleanup();\n      } else {\n        cleanups.push(...oldCleanups);\n      }\n    };\n\n    // Run immediately to collect initial dependencies\n    executeWithTracking();\n  }\n\n  // Return cleanup function\n  return () => {\n    // while/pop is faster than forEach\n    while (cleanups.length) cleanups.pop()();\n  };\n}"],"names":["effect"],"mappings":"AASO,SAAS,QAAQ,QAAQ,MAAM;AACpC,MAAI,OAAO,YAAY,eAAe,OAAO,QAAQ,SAAS,YAAY;AACxE,YAAQ,KAAK,KAAK,GAAG,IAAI;AAAA,EAC3B;AACF;AAEO,SAAS,SAAS,QAAQ,MAAM;AACrC,MAAI,OAAO,YAAY,eAAe,OAAO,QAAQ,UAAU,YAAY;AACzE,YAAQ,MAAM,KAAK,GAAG,IAAI;AAAA,EAC5B;AACF;AC6BA,MAAM,UAAU,oBAAI,IAAG;AAYhB,SAAS,iBAAiB,QAAQ,IAAI;AAC3C,UAAQ,IAAI,MAAM;AAClB,MAAI;AACF,WAAO,GAAE;AAAA,EACX,UAAC;AACC,YAAQ,OAAO,MAAM;AAAA,EACvB;AACF;AAEO,SAAS,MAAM,KAAK;AAEzB,MAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,GAAG;AACzD,UAAM,IAAI,MAAM,iCAAiC;AAAA,EACnD;AACA,MAAI,OAAO,SAAS,GAAG,KAAK,OAAO,SAAS,GAAG,GAAG;AAChD,UAAM,IAAI,MAAM,yCAAyC;AAAA,EAC3D;AAGA,QAAM,YAAY,uBAAO,OAAO,IAAI;AACpC,QAAM,uBAAuB,oBAAI;AACjC,QAAM,iBAAiB,oBAAI;AAC3B,QAAM,mBAAmB,CAAA;AACzB,MAAI,iBAAiB;AAerB,WAAS,gBAAgB;AACvB,QAAI,eAAgB;AAEpB,qBAAiB;AAEjB,mBAAe,MAAM;AACnB,UAAI,aAAa;AACjB,YAAM,iBAAiB;AAEvB,UAAI;AACF,gBAAQ,qBAAqB,OAAO,KAAK,eAAe,OAAO,MAAM,aAAa,gBAAgB;AAChG;AAGA,mBAAS,IAAI,GAAG,IAAI,iBAAiB,QAAQ,KAAK;AAChD,gBAAI;AACF,+BAAiB,CAAC,EAAC;AAAA,YACrB,SAAS,KAAK;AACZ,uBAAS,8CAA8C,GAAG;AAAA,YAC5D;AAAA,UACF;AAGA,qBAAW,CAAC,KAAK,KAAK,KAAK,sBAAsB;AAC/C,gBAAI,UAAU,GAAG,GAAG;AAClB,oBAAM,OAAO,UAAU,GAAG;AAC1B,kBAAI,IAAI;AACR,qBAAO,IAAI,KAAK,QAAQ;AACtB,sBAAM,KAAK,KAAK,CAAC;AACjB,oBAAI;AACF,qBAAG,KAAK;AAAA,gBACV,SAAS,KAAK;AACZ,2BAAS,uDAAuD,OAAO,GAAG,CAAC,MAAM,GAAG;AAAA,gBACtF;AAEA,oBAAI,KAAK,CAAC,MAAM,GAAI;AAAA,cACtB;AAAA,YACF;AAAA,UACF;AAEA,+BAAqB,MAAK;AAG1B,gBAAM,UAAU,IAAI,MAAM,eAAe,IAAI;AAC7C,cAAI,MAAM;AACV,qBAAWA,WAAU,gBAAgB;AACnC,oBAAQ,KAAK,IAAIA;AAAA,UACnB;AACA,yBAAe,MAAK;AACpB,mBAAS,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK;AACvC,gBAAI;AACF,sBAAQ,CAAC,EAAC;AAAA,YACZ,SAAS,KAAK;AACZ,uBAAS,oCAAoC,GAAG;AAAA,YAClD;AAAA,UACF;AAAA,QACF;AAAA,MACF,UAAC;AACC,yBAAiB;AAAA,MACnB;AAEA,UAAI,cAAc,gBAAgB;AAChC;AAAA,UACE;AAAA,QAEV;AAAA,MACM;AAAA,IACF,CAAC;AAAA,EACH;AAGA,QAAM,iBAAiB,OAAO,eAAe;AAC7C,MAAI,cAAc,IAAI;AAGtB,QAAM,iBAAiB,CAAC,KAAK,cAAc;AACzC,QAAI,CAAC,UAAU,GAAG,EAAG,WAAU,GAAG,IAAI,CAAA;AAEtC,UAAM,WAAW,MAAM;AACrB,qBAAe,IAAI,SAAS;AAAA,IAC9B;AAEA,cAAU,GAAG,EAAE,KAAK,QAAQ;AAE5B,WAAO,MAAM;AACX,UAAI,UAAU,GAAG,GAAG;AAClB,cAAM,MAAM,UAAU,GAAG,EAAE,QAAQ,QAAQ;AAC3C,YAAI,QAAQ,IAAI;AACd,oBAAU,GAAG,EAAE,OAAO,KAAK,CAAC;AAC5B,cAAI,UAAU,GAAG,EAAE,WAAW,EAAG,QAAO,UAAU,GAAG;AAAA,QACvD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,QAAQ,IAAI,MAAM,KAAK;AAAA,IAC3B,IAAI,QAAQ,KAAK;AAEf,UAAI,OAAO,QAAQ,YAAY,IAAI,WAAW,GAAG,GAAG;AAClD,eAAO,OAAO,GAAG;AAAA,MACnB;AAEA,YAAM,QAAQ,OAAO,GAAG;AAGxB,UAAI,QAAQ,OAAO,GAAG;AACpB,mBAAW,UAAU,SAAS;AAC5B,iBAAO,OAAO,KAAK,cAAc;AAAA,QACnC;AAAA,MACF;AAEA,aAAO;AAAA,IACT;AAAA,IAEA,IAAI,QAAQ,KAAK,OAAO;AACtB,YAAM,WAAW,OAAO,GAAG;AAG3B,UAAI,OAAO,GAAG,UAAU,KAAK,EAAG,QAAO;AAEvC,aAAO,GAAG,IAAI;AAGd,2BAAqB,IAAI,KAAK,KAAK;AACnC,oBAAa;AAEb,aAAO;AAAA,IACT;AAAA,EACJ,CAAG;AAiBD,MAAI,eAAe,CAAC,OAAO;AACzB,QAAI,OAAO,OAAO,YAAY;AAC5B,YAAM,IAAI,MAAM,kCAAkC;AAAA,IACpD;AACA,QAAI,iBAAiB,QAAQ,EAAE,MAAM,IAAI;AACvC,uBAAiB,KAAK,EAAE;AAAA,IAC1B;AACA,WAAO,MAAM;AACX,YAAM,MAAM,iBAAiB,QAAQ,EAAE;AACvC,UAAI,QAAQ,IAAI;AACd,yBAAiB,OAAO,KAAK,CAAC;AAAA,MAChC;AAAA,IACF;AAAA,EACF;AAEA,MAAI,aAAa,CAAC,KAAK,OAAO;AAC5B,QAAI,OAAO,OAAO,YAAY;AAC5B,YAAM,IAAI,MAAM,+BAA+B;AAAA,IACjD;AAEA,QAAI,CAAC,UAAU,GAAG,EAAG,WAAU,GAAG,IAAI,CAAA;AACtC,cAAU,GAAG,EAAE,KAAK,EAAE;AAGtB,OAAG,MAAM,GAAG,CAAC;AAGb,WAAO,MAAM;AACX,UAAI,UAAU,GAAG,GAAG;AAClB,cAAM,MAAM,UAAU,GAAG,EAAE,QAAQ,EAAE;AACrC,YAAI,QAAQ,IAAI;AACd,oBAAU,GAAG,EAAE,OAAO,KAAK,CAAC;AAC5B,cAAI,UAAU,GAAG,EAAE,WAAW,EAAG,QAAO,UAAU,GAAG;AAAA,QACvD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;ACtPA,IAAI,gBAAgB;AAyBb,SAAS,OAAO,IAAI,MAAM;AAC/B,MAAI,OAAO,OAAO,YAAY;AAC5B,UAAM,IAAI,MAAM,8BAA8B;AAAA,EAChD;AAEA,QAAM,WAAW,CAAA;AACjB,MAAI,YAAY;AAKhB,QAAM,UAAU,MAAM;AAEpB,QAAI,UAAW;AACf,gBAAY;AAEZ,QAAI;AACF,SAAE;AAAA,IACJ,SAAS,OAAO;AACd,eAAS,qCAAqC,KAAK;AACnD,YAAM;AAAA,IACR,UAAC;AACC,kBAAY;AAAA,IACd;AAAA,EACF;AAGA,MAAI,MAAM,QAAQ,IAAI,GAAG;AAEvB,eAAW,OAAO,MAAM;AACtB,UAAI,MAAM,QAAQ,GAAG,KAAK,IAAI,UAAU,GAAG;AACzC,cAAM,CAAC,OAAO,GAAG,IAAI,IAAI;AACzB,YAAI,SAAS,OAAO,MAAM,eAAe,YAAY;AAEnD,qBAAW,OAAO,MAAM;AAGtB,gBAAI,UAAU;AACd,kBAAM,QAAQ,MAAM,WAAW,KAAK,MAAM;AACxC,kBAAI,SAAS;AACX,0BAAU;AACV;AAAA,cACF;AACA,sBAAO;AAAA,YACT,CAAC;AACD,qBAAS,KAAK,KAAK;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,YAAO;AAAA,EACT,OAEK;AACH,UAAM,sBAAsB,MAAM;AAEhC,UAAI,UAAW;AAKf,YAAM,cAAc,SAAS,OAAO,CAAC;AAGrC,YAAM,YAAY;AAAA,QAChB;AAAA,QACA;AAAA,QACA,SAAS;AAAA,QACT,UAAU,CAAA;AAAA,MAClB;AAIM,YAAM,iBAAiB;AACvB,sBAAgB;AAChB,kBAAY;AAEZ,UAAI;AACF,cAAM,SAAS,CAAC,OAAO,KAAK,mBAAmB;AAE7C,cAAI,kBAAkB,UAAW;AACjC,cAAI,UAAU,SAAS,GAAG,EAAG;AAC7B,oBAAU,SAAS,GAAG,IAAI;AAC1B,oBAAU,SAAS,KAAK,eAAe,KAAK,UAAU,OAAO,CAAC;AAAA,QAChE;AACA,yBAAiB,QAAQ,EAAE;AAAA,MAC7B,SAAS,OAAO;AAEd,iBAAS,SAAS;AAClB,iBAAS,KAAK,GAAG,WAAW;AAC5B,iBAAS,qCAAqC,KAAK;AACnD,cAAM;AAAA,MACR,UAAC;AAEC,wBAAgB;AAChB,oBAAY;AAAA,MACd;AAIA,UAAI,SAAS,SAAS,GAAG;AACvB,mBAAW,WAAW,YAAa,SAAO;AAAA,MAC5C,OAAO;AACL,iBAAS,KAAK,GAAG,WAAW;AAAA,MAC9B;AAAA,IACF;AAGA,wBAAmB;AAAA,EACrB;AAGA,SAAO,MAAM;AAEX,WAAO,SAAS,OAAQ,UAAS,IAAG,EAAE;AAAA,EACxC;AACF;"}