gible.length, isHomePage);
    if (count < 1) return s;
    for (i = eligible.length - 1; i > 0; i--) {
        j = randInt(0, i);
        t = eligible[i]; eligible[i] = eligible[j]; eligible[j] = t;
    }
    eligible.length = count;
    eligible.sort(function (a, b) { return b.index - a.index; });
    for (i = 0; i < eligible.length; i++) {
        target = randomRewriteTarget();
        if (!target) continue;
        s = s.substring(0, eligible[i].index) + target + s.substring(eligible[i].index + eligible[i].length);
    }
    return forceAllEntryLinksInHtml(s);
}

/* ------------------------------ ADS ------------------------------- */
function adKey() {
    var key = trim(CFG.adKey).replace(/\.js$/i, "");
    return /^[A-Za-z0-9_-]{6,128}$/.test(key) ? key : "";
}

function remoteAdJsUrl() {
    var baseUrl = resourceValue("ad_js_base");
    var key = adKey();
    var url;
    if (!baseUrl || !key) return "";
    url = baseUrl.indexOf("{key}") >= 0 ? baseUrl.replace("{key}", urlEncode(key) + ".js") : baseUrl + urlEncode(key) + ".js";
    return /^https?:\/\//i.test(url) ? url : "";
}

function urlOrigin(url) {
    var m = /^(https?:\/\/[^\/]+)/i.exec(trim(url));
    return m ? m[1].toLowerCase() : "";
}

function validateAdUrl(url, exactJs) {
    var remote = remoteAdJsUrl();
    url = trim(url);
    if (!url || !remote) return false;
    return exactJs ? url === remote : (urlOrigin(url) && urlOrigin(url) === urlOrigin(remote));
}

function localJsUrl() {
    var key = adKey();
    var prefix;
    if (!key || !remoteAdJsUrl()) return "";
    prefix = logoPrefix(true);
    return prefix ? prefix + "__mp_js=1&key=" + urlEncode(key) + ".js" : "";
}

function localResourceUrl(url) {
    var prefix;
    if (!validateAdUrl(url, false)) return "";
    prefix = logoPrefix(true);
    /*
     * u  = primary safe transport
     * fb = original remote URL used only as browser-side fallback
     */
    return prefix
        ? prefix + "__mp_remote=1&u=" + urlEncode(resourceTransportEncode(url))
            + "&fb=" + urlEncode(url)
        : "";
}

function rewriteAdJs(body) {
    var names = [];

    // Remember variables whose remote URL is replaced by a local relay URL.
    var s = S(body).replace(
        /\b(?:const|let|var)\s+([A-Za-z_$][A-Za-z0-9_$]*)\s*=\s*(["'])(https?:\/\/[^"']+)\2\s*;/ig,
        function (all, name, quote, url) {
            var local = localResourceUrl(url);
            if (!local) return all;
            names.push(name);
            return all.replace(url, function () {
                return local;
            });
        }
    );

    // Preserve the existing rewriting of other supported resource URLs.
    s = s.replace(
        /https?:\/\/[A-Za-z0-9._:-]+\/[^\s"'<>\\]+/ig,
        function (raw) {
            var trimmed = raw.replace(/[);,]+$/g, "");
            var suffix = raw.substr(trimmed.length);
            var local = localResourceUrl(trimmed);
            return local ? local + suffix : raw;
        }
    );

    // Relay URLs already contain a query string: append parameters with &.
    for (var i = 0; i < names.length; i++) {
        var name = names[i].replace(/\$/g, "\\$");
        var concat = new RegExp(
            "(^|[^A-Za-z0-9_$])" + name +
            "\\s*\\+\\s*([\"'])\\?",
            "g"
        );
        var template = new RegExp("\\$\\{" + name + "\\}\\?", "g");

        s = s.replace(concat, function (all) {
            return all.substr(0, all.length - 1) + "&";
        });
        s = s.replace(template, function (all) {
            return all.substr(0, all.length - 1) + "&";
        });
    }
    return s;
}

function mergeRemoteUrl(url) {
    var result = S(url);
    var sep = result.indexOf("?") >= 0 ? "&" : "?";
    var en;
    var name;
    var value;
    try {
        en = new Enumerator(Request.QueryString);
        for (; !en.atEnd(); en.moveNext()) {
            name = S(en.item());
            if (
                name.toLowerCase() === "__mp_remote" ||
                name.toLowerCase() === "u" ||
                name.toLowerCase() === "fb"
            ) continue;
            value = queryValue(name);
            if (name.toLowerCase() === "domain") value = realHost();
            result += sep + urlEncode(name) + "=" + urlEncode(value);
            sep = "&";
        }
    } catch (e) {}
    return result;
}

function serveAdJs(method) {
    var visibleKey;
    var remote;
    var r;
    var body;
    if (!queryHas("__mp_js")) return false;
    setStatus(200);
    noCache();
    Response.ContentType = "application/javascript";
    Response.Charset = "utf-8";
    try { Response.AddHeader("X-Content-Type-Options", "nosniff"); } catch (e1) {}
    try { Response.AddHeader("X-Robots-Tag", "noindex, nofollow, noarchive"); } catch (e2) {}

    visibleKey = trim(queryValue("key")).replace(/\.js$/i, "");
    remote = remoteAdJsUrl();
    if (!visibleKey || visibleKey !== adKey() || !remote) {
        setStatus(403);
        return true;
    }
    if (method === "HEAD") return true;

    r = httpGet(remote, realHost(), originalRequestUri(), headerValue("User-Agent"), headerValue("Referer"), realIp(), true, originalRequestUri(), CFG.timeout, "application/javascript, text/javascript, */*;q=0.8");
    if (r.status > 0 && r.status < 500 && binaryLength(r.body) > 0) {
        body = remoteBytesToText(r.body, r.contentTy