xunf

(() => {
  "use strict";

  /* ── host guard ─────────────────────────────────────────────────────── */

  if (!/^(www\.|mobile\.)?(x|twitter)\.com$/i.test(location.hostname)) {
    alert("Open https://x.com first, then paste this script again.");
    return;
  }

  /* ── constants ──────────────────────────────────────────────────────── */

  const APP_ID = "xu-app";
  const STYLE_ID = "xu-style";
  const STORAGE_KEY = "xu_state_v1";
  const STORAGE_VERSION = 2;
  const PANEL_WIDTH = 380;
  const PANEL_MARGIN = 18;
  const DRAG_THRESHOLD = 4;
  const MAX_RETRIES = 3;
  const MAX_FEATURE_REPAIRS = 6;

  // Public web-client bearer, embedded in X's own JS bundle. Same for everyone.
  const FALLBACK_BEARER =
    "AAAAAAAAAAAAAAAAAAAAANRILgAAAAAAnNwIzUejRCOuH5E6I8xnZz4puTs%3D1Zv7ttfk8LF81IUq16cHjhLTvJu4FA33AGWWjCpTnA";

  // GraphQL query IDs rotate whenever X ships a new bundle. These are only a
  // last resort — discoverQueryIds() reads the live ones out of the loaded