@bluefields/fetcher 0.2.0

package/dist/fetcher-patchright.js

@@ -0,0 +1,505 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+/**
+ * Patchright fetcher adapter (chunks 8 + Phase A real wiring).
+ *
+ * Patchright is a Chromium fork with CDP-leak patches that defeat many
+ * naive bot-detection signals (navigator.webdriver, console.debug
+ * fingerprinting, etc.). API is Playwright-compatible — drop-in.
+ *
+ * Production wiring is gated on IPROYAL_* env vars: when they're set,
+ * the factory (`tryCreatePatchrightAdapter`) returns a real adapter
+ * that launches Chromium with the IPRoyal residential proxy. Without
+ * them, callers fall back to the HTTP adapter (`fetcher-http.ts`).
+ *
+ * Per-fetch lifecycle: launch fresh browser → newContext → newPage →
+ * goto → wait → content + (optional) screenshot → close. One browser
+ * per fetch keeps fingerprint state isolated; pooling can ship later
+ * if launch overhead becomes load-bearing (~500ms per fetch today).
+ *
+ * Fingerprint rotation: v1 uses a small pool of (UA, viewport, locale,
+ * timezone) tuples picked randomly per fetch. Full diversity (Review #4)
+ * comes later — we just need basic variation to defeat per-tuple
+ * fingerprint blocklists.
+ *
+ * Egress IP: deferred. IPRoyal residential proxies rotate per-session;
+ * resolving the actual egress IP requires an extra eval to api.ipify.org
+ * which we don't want to pay on every fetch. Logged as a placeholder for
+ * now; revisit in M14-17 when attestation needs it (Review #3 manifest).
+ */
+import { createLayerLogger, envInt } from '@bluefields/primitives';
+import { BrowserPool } from './browser-pool.js';
+const log = createLayerLogger('fetcher');
+// Through a residential proxy a single page load can take 15-45s
+// (proxy hop + per-asset proxy auth + slow CDN paths). 30s was too
+// aggressive — bump to 60s.
+const DEFAULT_TIMEOUT_MS = envInt('BLUEFIELDS_BROWSER_TIMEOUT_MS', 60_000);
+const FETCHER_ID = 'patchright-v1';
+// ── Full-render settle tuning (see fullyRenderPage) ──────────────────────────
+// All bounds are belt-and-suspenders: the loop stops at the FIRST of (content
+// looks rendered), (DOM stopped growing), (max steps), or (deadline). Worst-case
+// added wall-clock ≈ networkidle cap + maxSteps*stepMs, always clamped to the
+// request's timeoutMs so full render can never hang past the caller's deadline.
+/** Best-effort `networkidle` wait cap (ms) — well under the default request timeout. */
+const FULL_RENDER_NETWORKIDLE_MS = 15_000;
+/** Pause after each scroll so lazy/XHR content can paint before we re-measure. */
+const FULL_RENDER_STEP_MS = 300;
+/** Hard cap on settle iterations — primary bound so a stubbed clock can't spin. */
+const FULL_RENDER_MAX_STEPS = 10;
+/** Once the page has at least this much visible text, treat it as rendered. */
+const FULL_RENDER_MIN_CHARS = 500;
+// Only the gateway is strictly required — IPROYAL_USERNAME/PASSWORD are
+// optional. If the proxy uses IP allowlist auth (Fly egress IP whitelisted
+// on IPRoyal), no credentials are needed. The Chromium ↔ HTTP-proxy auth
+// dance is broken anyway, so allowlist is the only path that works.
+export const PATCHRIGHT_REQUIRED_ENV = ['IPROYAL_GATEWAY'];
+const FINGERPRINT_POOL = [
+    {
+        userAgent: 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36',
+        viewport: { width: 1440, height: 900 },
+        locale: 'en-US',
+        timezoneId: 'America/New_York',
+    },
+    {
+        userAgent: 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36',
+        viewport: { width: 1920, height: 1080 },
+        locale: 'en-US',
+        timezoneId: 'America/Chicago',
+    },
+    {
+        userAgent: 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36',
+        viewport: { width: 1366, height: 768 },
+        locale: 'en-GB',
+        timezoneId: 'Europe/London',
+    },
+];
+function pickFingerprint(rand = Math.random) {
+    const idx = Math.floor(rand() * FINGERPRINT_POOL.length);
+    return FINGERPRINT_POOL[idx];
+}
+/**
+ * Resource types whose bytes we discard. Images/video/audio/fonts are the bulk
+ * of page weight and we only keep DOM text, so aborting them on the metered
+ * residential proxy is pure savings. We NEVER block document/script/xhr/fetch —
+ * the page wouldn't render. Stylesheets are usually safe to drop too (we read
+ * text, not layout); that one is gated behind BLOCK_STYLESHEET so it's a
+ * one-line flip if it ever regresses a JS-render stratum.
+ */
+const BLOCKED_RESOURCE_TYPES = new Set(['image', 'media', 'font']);
+/** Drop stylesheets too (default ON). Flip to `false` if it regresses rendering. */
+const BLOCK_STYLESHEET = true;
+/**
+ * Pure predicate: should the browser tier abort this request's download?
+ * Extracted so it's unit-tested without a live browser. The caller is
+ * responsible for skipping interception entirely when a screenshot is
+ * requested (a screenshot needs the full visual render).
+ */
+export function shouldBlockResource(resourceType, opts = {}) {
+    if (BLOCKED_RESOURCE_TYPES.has(resourceType))
+        return true;
+    if ((opts.blockStylesheet ?? BLOCK_STYLESHEET) && resourceType === 'stylesheet')
+        return true;
+    return false;
+}
+/**
+ * Returns the env-gated Patchright adapter when the required env vars
+ * are set; null otherwise. Callers (the factory in `index.ts`) fall
+ * back to the HTTP adapter when this returns null.
+ */
+export function tryCreatePatchrightAdapter(env = process.env) {
+    for (const key of PATCHRIGHT_REQUIRED_ENV) {
+        if (!env[key] || env[key]?.length === 0)
+            return null;
+    }
+    // Pass username/password ONLY if they're set. Production path uses
+    // IP allowlist auth (Fly egress IP whitelisted on IPRoyal) — no
+    // creds needed, no Chromium auth dance, no broken CONNECT tunnels.
+    // Local dev with personal IP whitelisted works the same way.
+    // If creds ARE set (legacy callers), pass them through — Patchright
+    // will try the CDP challenge handshake; works on most proxies, fails
+    // on IPRoyal residential.
+    const poolSize = parseIntEnv(env.PATCHRIGHT_POOL ?? '', 0);
+    return createPatchrightAdapter({
+        proxy: {
+            server: normalizeProxyServer(env.IPROYAL_GATEWAY ?? ''),
+            username: env.IPROYAL_USERNAME ?? '',
+            password: env.IPROYAL_PASSWORD ?? '',
+        },
+        ...(poolSize > 0 ? { pool: poolSize } : {}),
+    });
+}
+function parseIntEnv(raw, fallback) {
+    const n = Number.parseInt(raw, 10);
+    return Number.isFinite(n) && n > 0 ? n : fallback;
+}
+/**
+ * Normalize the proxy server URL — Playwright requires a protocol
+ * scheme (`http://host:port`), but IPRoyal's docs typically show the
+ * gateway as bare `host:port`. Prepend `http://` if missing so a
+ * naively-pasted value still works.
+ */
+function normalizeProxyServer(raw) {
+    const trimmed = raw.trim();
+    if (!trimmed)
+        return '';
+    if (/^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed))
+        return trimmed;
+    return `http://${trimmed}`;
+}
+/**
+ * Direct constructor — bypass the env gate. Useful in tests + when the
+ * caller has the proxy creds from somewhere other than env vars.
+ */
+export function createPatchrightAdapter(config) {
+    let cachedLauncher = config.chromiumImpl ?? null;
+    let pool = null;
+    let poolInitPromise = null;
+    const getLauncher = async () => {
+        if (cachedLauncher)
+            return cachedLauncher;
+        // Dynamic import so missing chromium binary / missing patchright
+        // package doesn't fail at module-load time.
+        const mod = (await import('patchright'));
+        cachedLauncher = mod.chromium;
+        return cachedLauncher;
+    };
+    const getPool = async () => {
+        if (!config.pool || config.pool <= 0)
+            return null;
+        if (pool)
+            return pool;
+        if (!poolInitPromise) {
+            poolInitPromise = (async () => {
+                const launcher = await getLauncher();
+                pool = new BrowserPool({ launcher, proxy: config.proxy, size: config.pool });
+                try {
+                    await pool.warm();
+                }
+                catch (err) {
+                    log.warn({ error: err instanceof Error ? err.message : String(err) }, 'browser-pool warm failed; falling back to per-fetch launch');
+                    pool = null;
+                }
+            })();
+        }
+        await poolInitPromise;
+        return pool;
+    };
+    return {
+        /**
+         * L4: eagerly build + warm the browser pool so the first customer fetch doesn't
+         * pay the ~0.5–1.5s cold Chromium launch. No-op when `config.pool` is unset/0
+         * (getPool returns null). Best-effort — getPool already swallows a warm failure
+         * and falls back to per-fetch launch.
+         */
+        async warmUp() {
+            await getPool();
+        },
+        async fetch(url, options = {}) {
+            const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+            const now = options.nowFn ?? (() => new Date());
+            const fingerprint = pickFingerprint(config.rand);
+            const userAgent = options.userAgent ?? config.defaultUserAgent ?? fingerprint.userAgent;
+            const startedAt = Date.now();
+            const fetchedAt = now();
+            const activePool = await getPool();
+            let slot = null;
+            let browser;
+            if (activePool) {
+                try {
+                    slot = await activePool.acquire();
+                    browser = slot.browser;
+                }
+                catch (err) {
+                    // Pool exhaustion / launch failure → fall back to per-fetch launch.
+                    log.warn({ error: err instanceof Error ? err.message : String(err) }, 'browser-pool acquire failed; per-fetch launch fallback');
+                    const launcher = await getLauncher();
+                    browser = await launcher.launch({
+                        proxy: config.proxy,
+                        headless: true,
+                        args: ['--no-sandbox', '--disable-dev-shm-usage', '--disable-gpu'],
+                        timeout: 20_000,
+                    });
+                }
+            }
+            else {
+                const launcher = await getLauncher();
+                browser = await launcher.launch({
+                    proxy: config.proxy,
+                    headless: true,
+                    args: ['--no-sandbox', '--disable-dev-shm-usage', '--disable-gpu'],
+                    timeout: 20_000,
+                });
+            }
+            let crashed = false;
+            let context = null;
+            // Abandonment hook: the escalating fetcher aborts this when it gives up on
+            // this tier's wall-clock budget. Closing the context makes any in-flight
+            // goto / full-render reject so the finally frees the browser — without it an
+            // abandoned browser fetch leaks headless Chromium (and the Node process).
+            const abortSignal = options.__abortSignal;
+            const onAbort = () => {
+                void context?.close?.().catch(() => undefined);
+            };
+            if (abortSignal) {
+                if (abortSignal.aborted)
+                    onAbort();
+                else
+                    abortSignal.addEventListener('abort', onAbort, { once: true });
+            }
+            try {
+                context = await browser.newContext({
+                    userAgent,
+                    viewport: fingerprint.viewport,
+                    locale: fingerprint.locale,
+                    timezoneId: fingerprint.timezoneId,
+                    ...(options.headers ? { extraHTTPHeaders: options.headers } : {}),
+                });
+                if (options.cookies && options.cookies.length > 0) {
+                    await context.addCookies(options.cookies);
+                }
+                const page = await context.newPage();
+                // Cut metered proxy egress: abort the image/media/font (+ stylesheet)
+                // downloads we never use — we only keep DOM text — and sum the bytes we
+                // DO transfer. Aborted requests never fire 'response', so the counter
+                // measures exactly what we kept. Skipped entirely when a screenshot is
+                // requested (it needs the full visual render). Both APIs are guarded
+                // because the narrow test mock omits them.
+                let bytesTransferred = 0;
+                if (typeof page.on === 'function') {
+                    page.on('response', (resp) => {
+                        const len = Number(resp.headers()['content-length'] ?? 0);
+                        if (Number.isFinite(len) && len > 0)
+                            bytesTransferred += len;
+                    });
+                }
+                if (!options.captureScreenshot && typeof page.route === 'function') {
+                    await page.route('**/*', async (route) => {
+                        try {
+                            if (shouldBlockResource(route.request().resourceType()))
+                                await route.abort();
+                            else
+                                await route.continue();
+                        }
+                        catch {
+                            // route already handled / page closed mid-flight — ignore.
+                        }
+                    });
+                }
+                // Default to 'domcontentloaded' — much faster than 'load'
+                // (no waiting for images/fonts/iframes) and almost always gives
+                // us the rendered HTML. Customers can override via waitFor.
+                const goStart = Date.now();
+                const response = await page.goto(url, {
+                    waitUntil: gotoWaitUntil(options.waitFor),
+                    timeout: timeoutMs,
+                });
+                log.info({ outcome: 'partial', url, goto_ms: Date.now() - goStart }, 'patchright goto finished');
+                if (options.waitFor?.type === 'selector') {
+                    await page.waitForSelector(options.waitFor.selector, {
+                        timeout: options.waitFor.timeoutMs ?? 5_000,
+                    });
+                }
+                else if (options.waitFor?.type === 'timeout') {
+                    await page.waitForTimeout(options.waitFor.ms);
+                }
+                else if (options.__fullRender) {
+                    // Escalation re-fetch of a JS shell with no customer waitFor: fully
+                    // render the SPA (best-effort networkidle + autoscroll + content
+                    // settle) so we read hydrated content instead of the same empty shell
+                    // tier-0 returned. Clamped to the request deadline — never hangs.
+                    await fullyRenderPage(page, { deadlineMs: startedAt + timeoutMs });
+                }
+                let actionResults;
+                if (options.actions && options.actions.length > 0) {
+                    actionResults = await runActions(page, options.actions);
+                }
+                const html = await page.content();
+                const screenshot = options.captureScreenshot
+                    ? await page.screenshot({ fullPage: true })
+                    : null;
+                const responseStatus = response?.status() ?? 0;
+                const responseHeaders = response?.headers() ?? {};
+                const finalUrl = page.url();
+                const fetchDurationMs = Math.max(1, Date.now() - startedAt);
+                log.info({
+                    outcome: 'ok',
+                    url,
+                    final_url: finalUrl,
+                    response_status: responseStatus,
+                    duration_ms: fetchDurationMs,
+                    screenshot: !!screenshot,
+                }, 'patchright fetch ok');
+                return {
+                    html,
+                    responseStatus,
+                    responseHeaders,
+                    fetchedAt,
+                    fetchDurationMs,
+                    fetcherId: FETCHER_ID,
+                    proxyEgressIp: '0.0.0.0',
+                    userAgent,
+                    rawHtmlSizeBytes: Buffer.byteLength(html, 'utf8'),
+                    bytesTransferred,
+                    screenshot,
+                    finalUrl,
+                    ...(actionResults ? { actionResults } : {}),
+                };
+            }
+            catch (err) {
+                crashed = true;
+                throw err;
+            }
+            finally {
+                if (abortSignal)
+                    abortSignal.removeEventListener('abort', onAbort);
+                // Close the per-fetch context (and its pages) FIRST. A pooled browser is
+                // released (kept warm), not closed, so without this it would accumulate
+                // one BrowserContext per fetch — a steady memory leak. Best-effort and
+                // harmless on the per-fetch-launch path where browser.close() also tears
+                // it down. Fetcher-layer cleanup only; no behavior change to the result.
+                if (context?.close) {
+                    await context.close().catch((err) => {
+                        log.warn({ error: err instanceof Error ? err.message : String(err) }, 'context.close() failed');
+                    });
+                }
+                if (slot && activePool) {
+                    if (crashed)
+                        activePool.dispose(slot);
+                    else
+                        activePool.release(slot);
+                }
+                else {
+                    await browser.close().catch((err) => {
+                        log.warn({ error: err instanceof Error ? err.message : String(err) }, 'browser.close() failed');
+                    });
+                }
+            }
+        },
+    };
+}
+/**
+ * Map the customer waitFor to the goto() `waitUntil`. Only `networkIdle` uses
+ * Playwright 'networkidle'; everything else — the default, plus the selector /
+ * timeout conditions (which wait AFTER navigation) — uses the fast
+ * 'domcontentloaded' (much quicker than 'load' and enough to read rendered HTML).
+ */
+function gotoWaitUntil(wait) {
+    return wait?.type === 'networkIdle' ? 'networkidle' : 'domcontentloaded';
+}
+/**
+ * Read visible-text length + scroll height in one page eval. Returns {0,0} on any
+ * failure (eval rejected, non-string result, unparseable) so callers never throw.
+ */
+async function readRenderMetric(page) {
+    try {
+        const raw = await page.evaluate('JSON.stringify({t:(document.body&&document.body.innerText||"").length,h:document.body?document.body.scrollHeight:0})');
+        if (typeof raw !== 'string')
+            return { textLen: 0, scrollHeight: 0 };
+        const parsed = JSON.parse(raw);
+        return { textLen: Number(parsed.t) || 0, scrollHeight: Number(parsed.h) || 0 };
+    }
+    catch {
+        return { textLen: 0, scrollHeight: 0 };
+    }
+}
+/**
+ * Fully render a JS app before its content is read: a best-effort `networkidle`
+ * wait, then a bounded autoscroll + content-settle loop. Used on escalation
+ * re-fetches of a SPA shell (no customer waitFor) so we capture hydrated content
+ * instead of the empty mount point tier-0 returned.
+ *
+ * Hard-bounded so it can never hang: the loop stops
+ * at the FIRST of — the page looks rendered (>= FULL_RENDER_MIN_CHARS visible text
+ * AND the DOM stopped growing), `maxSteps` reached, or the `deadlineMs` passed.
+ * Every page call is best-effort (errors swallowed): a flaky settle must never
+ * fail an otherwise-good fetch. Fetcher-layer only — it issues no new outbound
+ * request of ours; sub-resource loads happen inside the already-proxied browser,
+ * so the SSRF posture is unchanged.
+ */
+export async function fullyRenderPage(page, opts) {
+    const now = opts.nowMs ?? Date.now;
+    const maxSteps = opts.maxSteps ?? FULL_RENDER_MAX_STEPS;
+    const remaining = () => opts.deadlineMs - now();
+    // 1. Best-effort networkidle — the common "SPA finished its XHRs" signal.
+    //    Capped under the request timeout; a page that never goes idle (sockets,
+    //    polling) just times out here and we fall through to the scroll loop.
+    if (page.waitForLoadState && remaining() > 0) {
+        const timeout = Math.min(FULL_RENDER_NETWORKIDLE_MS, remaining());
+        await page.waitForLoadState('networkidle', { timeout }).catch(() => undefined);
+    }
+    // 2. Autoscroll + content settle. Scroll to the bottom to trigger lazy /
+    //    infinite content, pause to let it paint, then re-measure. Stop once the
+    //    page looks rendered AND the DOM has stopped growing (two equal heights).
+    let lastHeight = Number.NaN;
+    for (let step = 0; step < maxSteps && remaining() > 0; step++) {
+        await page
+            .evaluate('window.scrollTo(0, document.body ? document.body.scrollHeight : 0)')
+            .catch(() => undefined);
+        const pause = Math.min(FULL_RENDER_STEP_MS, Math.max(0, remaining()));
+        await page.waitForTimeout(pause).catch(() => undefined);
+        const metric = await readRenderMetric(page);
+        if (metric.textLen >= FULL_RENDER_MIN_CHARS && metric.scrollHeight === lastHeight)
+            break;
+        lastHeight = metric.scrollHeight;
+    }
+}
+/**
+ * Execute Phase F actions sequentially against an open page. Throws on
+ * the first failure with the action index included for easier debugging
+ * — the route surfaces this in the 502 response detail.
+ */
+export async function runActions(page, actions) {
+    const results = { screenshots: [], scrapes: [], javascriptReturns: [] };
+    for (let i = 0; i < actions.length; i++) {
+        const a = actions[i];
+        try {
+            if (a.type === 'wait') {
+                if (typeof a.milliseconds === 'number' && a.milliseconds > 0) {
+                    await page.waitForTimeout(a.milliseconds);
+                }
+                else if (a.selector) {
+                    await page.waitForSelector(a.selector, { timeout: a.timeoutMs ?? 5_000 });
+                }
+            }
+            else if (a.type === 'click') {
+                await page.click(a.selector, a.timeoutMs ? { timeout: a.timeoutMs } : undefined);
+            }
+            else if (a.type === 'write') {
+                if (a.selector) {
+                    await page.fill(a.selector, a.text);
+                }
+                else {
+                    await page.keyboard.type(a.text);
+                }
+            }
+            else if (a.type === 'press') {
+                await page.keyboard.press(a.key);
+            }
+            else if (a.type === 'scroll') {
+                const sign = a.direction === 'up' ? -1 : 1;
+                // String form so TS doesn't see `window` in server-side code.
+                const expr = typeof a.amount === 'number' && a.amount > 0
+                    ? `window.scrollBy(0, ${sign * a.amount})`
+                    : `window.scrollBy(0, ${sign} * window.innerHeight)`;
+                await page.evaluate(expr);
+            }
+            else if (a.type === 'screenshot') {
+                const shot = await page.screenshot({ fullPage: a.fullPage ?? true });
+                results.screenshots.push(Buffer.from(shot).toString('base64'));
+            }
+            else if (a.type === 'scrape') {
+                results.scrapes.push({ html: await page.content() });
+            }
+            else if (a.type === 'executeJavascript') {
+                // Runs in the fetched page's context (not our server). Result must
+                // be JSON-serializable; Playwright enforces this.
+                results.javascriptReturns.push({ value: await page.evaluate(a.script) });
+            }
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            throw new Error(`action[${i}] (${a.type}) failed: ${msg}`);
+        }
+    }
+    return results;
+}
+//# sourceMappingURL=fetcher-patchright.js.map

package/dist/fetcher-patchright.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetcher-patchright.js","sourceRoot":"","sources":["../src/fetcher-patchright.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAEnE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAahD,MAAM,GAAG,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;AAEzC,iEAAiE;AACjE,mEAAmE;AACnE,4BAA4B;AAC5B,MAAM,kBAAkB,GAAG,MAAM,CAAC,+BAA+B,EAAE,MAAM,CAAC,CAAC;AAC3E,MAAM,UAAU,GAAG,eAAe,CAAC;AAEnC,gFAAgF;AAChF,8EAA8E;AAC9E,iFAAiF;AACjF,8EAA8E;AAC9E,gFAAgF;AAChF,wFAAwF;AACxF,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAC1C,kFAAkF;AAClF,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,mFAAmF;AACnF,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACjC,+EAA+E;AAC/E,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAElC,wEAAwE;AACxE,2EAA2E;AAC3E,yEAAyE;AACzE,oEAAoE;AACpE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,iBAAiB,CAAU,CAAC;AAcpE,MAAM,gBAAgB,GAA+B;IACnD;QACE,SAAS,EACP,uHAAuH;QACzH,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE;QACtC,MAAM,EAAE,OAAO;QACf,UAAU,EAAE,kBAAkB;KAC/B;IACD;QACE,SAAS,EACP,iHAAiH;QACnH,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;QACvC,MAAM,EAAE,OAAO;QACf,UAAU,EAAE,iBAAiB;KAC9B;IACD;QACE,SAAS,EACP,uGAAuG;QACzG,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE;QACtC,MAAM,EAAE,OAAO;QACf,UAAU,EAAE,eAAe;KAC5B;CACF,CAAC;AAEF,SAAS,eAAe,CAAC,OAAqB,IAAI,CAAC,MAAM;IACvD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACzD,OAAO,gBAAgB,CAAC,GAAG,CAAE,CAAC;AAChC,CAAC;AAcD;;;;;;;GAOG;AACH,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AACxF,oFAAoF;AACpF,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAE9B;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,YAAoB,EACpB,OAAsC,EAAE;IAExC,IAAI,sBAAsB,CAAC,GAAG,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,IAAI,CAAC,IAAI,CAAC,eAAe,IAAI,gBAAgB,CAAC,IAAI,YAAY,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IAC7F,OAAO,KAAK,CAAC;AACf,CAAC;AAmHD;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAyB,OAAO,CAAC,GAAG;IAEpC,KAAK,MAAM,GAAG,IAAI,uBAAuB,EAAE,CAAC;QAC1C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;IACvD,CAAC;IACD,mEAAmE;IACnE,gEAAgE;IAChE,mEAAmE;IACnE,6DAA6D;IAC7D,oEAAoE;IACpE,qEAAqE;IACrE,0BAA0B;IAC1B,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3D,OAAO,uBAAuB,CAAC;QAC7B,KAAK,EAAE;YACL,MAAM,EAAE,oBAAoB,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC;YACvD,QAAQ,EAAE,GAAG,CAAC,gBAAgB,IAAI,EAAE;YACpC,QAAQ,EAAE,GAAG,CAAC,gBAAgB,IAAI,EAAE;SACrC;QACD,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5C,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,GAAW,EAAE,QAAgB;IAChD,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,GAAW;IACvC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAC7D,OAAO,UAAU,OAAO,EAAE,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAA+B;IACrE,IAAI,cAAc,GAA4B,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC;IAC1E,IAAI,IAAI,GAAuB,IAAI,CAAC;IACpC,IAAI,eAAe,GAAyB,IAAI,CAAC;IAEjD,MAAM,WAAW,GAAG,KAAK,IAA+B,EAAE;QACxD,IAAI,cAAc;YAAE,OAAO,cAAc,CAAC;QAC1C,iEAAiE;QACjE,4CAA4C;QAC5C,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,CAA8C,CAAC;QACtF,cAAc,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC9B,OAAO,cAAc,CAAC;IACxB,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,IAAiC,EAAE;QACtD,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAClD,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,eAAe,GAAG,CAAC,KAAK,IAAI,EAAE;gBAC5B,MAAM,QAAQ,GAAG,MAAM,WAAW,EAAE,CAAC;gBACrC,IAAI,GAAG,IAAI,WAAW,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC7E,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;gBACpB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,GAAG,CAAC,IAAI,CACN,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAC3D,4DAA4D,CAC7D,CAAC;oBACF,IAAI,GAAG,IAAI,CAAC;gBACd,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,CAAC;QACD,MAAM,eAAe,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,OAAO;QACL;;;;;WAKG;QACH,KAAK,CAAC,MAAM;YACV,MAAM,OAAO,EAAE,CAAC;QAClB,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,UAAwB,EAAE;YACzC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;YAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YAChD,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACjD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,gBAAgB,IAAI,WAAW,CAAC,SAAS,CAAC;YACxF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;YAExB,MAAM,UAAU,GAAG,MAAM,OAAO,EAAE,CAAC;YACnC,IAAI,IAAI,GAAuD,IAAI,CAAC;YACpE,IAAI,OAAwD,CAAC;YAC7D,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,CAAC;oBACH,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,CAAC;oBAClC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;gBACzB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,oEAAoE;oBACpE,GAAG,CAAC,IAAI,CACN,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAC3D,wDAAwD,CACzD,CAAC;oBACF,MAAM,QAAQ,GAAG,MAAM,WAAW,EAAE,CAAC;oBACrC,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;wBAC9B,KAAK,EAAE,MAAM,CAAC,KAAK;wBACnB,QAAQ,EAAE,IAAI;wBACd,IAAI,EAAE,CAAC,cAAc,EAAE,yBAAyB,EAAE,eAAe,CAAC;wBAClE,OAAO,EAAE,MAAM;qBAChB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,QAAQ,GAAG,MAAM,WAAW,EAAE,CAAC;gBACrC,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;oBAC9B,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,QAAQ,EAAE,IAAI;oBACd,IAAI,EAAE,CAAC,cAAc,EAAE,yBAAyB,EAAE,eAAe,CAAC;oBAClE,OAAO,EAAE,MAAM;iBAChB,CAAC,CAAC;YACL,CAAC;YAED,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,OAAO,GAAoC,IAAI,CAAC;YACpD,2EAA2E;YAC3E,yEAAyE;YACzE,6EAA6E;YAC7E,0EAA0E;YAC1E,MAAM,WAAW,GAAI,OAAgC,CAAC,aAAa,CAAC;YACpE,MAAM,OAAO,GAAG,GAAS,EAAE;gBACzB,KAAK,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACjD,CAAC,CAAC;YACF,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,WAAW,CAAC,OAAO;oBAAE,OAAO,EAAE,CAAC;;oBAC9B,WAAW,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACtE,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;oBACjC,SAAS;oBACT,QAAQ,EAAE,WAAW,CAAC,QAAQ;oBAC9B,MAAM,EAAE,WAAW,CAAC,MAAM;oBAC1B,UAAU,EAAE,WAAW,CAAC,UAAU;oBAClC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAClE,CAAC,CAAC;gBACH,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAClD,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBAC5C,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;gBAErC,sEAAsE;gBACtE,wEAAwE;gBACxE,sEAAsE;gBACtE,uEAAuE;gBACvE,qEAAqE;gBACrE,2CAA2C;gBAC3C,IAAI,gBAAgB,GAAG,CAAC,CAAC;gBACzB,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,UAAU,EAAE,CAAC;oBAClC,IAAI,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE;wBAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;wBAC1D,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;4BAAE,gBAAgB,IAAI,GAAG,CAAC;oBAC/D,CAAC,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;oBACnE,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;wBACvC,IAAI,CAAC;4BACH,IAAI,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,YAAY,EAAE,CAAC;gCAAE,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;;gCACxE,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC;wBAC9B,CAAC;wBAAC,MAAM,CAAC;4BACP,2DAA2D;wBAC7D,CAAC;oBACH,CAAC,CAAC,CAAC;gBACL,CAAC;gBAED,0DAA0D;gBAC1D,gEAAgE;gBAChE,4DAA4D;gBAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;oBACpC,SAAS,EAAE,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC;oBACzC,OAAO,EAAE,SAAS;iBACnB,CAAC,CAAC;gBACH,GAAG,CAAC,IAAI,CACN,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,EAC1D,0BAA0B,CAC3B,CAAC;gBAEF,IAAI,OAAO,CAAC,OAAO,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;oBACzC,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE;wBACnD,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK;qBAC5C,CAAC,CAAC;gBACL,CAAC;qBAAM,IAAI,OAAO,CAAC,OAAO,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;oBAC/C,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBAChD,CAAC;qBAAM,IAAK,OAAgC,CAAC,YAAY,EAAE,CAAC;oBAC1D,oEAAoE;oBACpE,iEAAiE;oBACjE,sEAAsE;oBACtE,kEAAkE;oBAClE,MAAM,eAAe,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,SAAS,GAAG,SAAS,EAAE,CAAC,CAAC;gBACrE,CAAC;gBAED,IAAI,aAAwC,CAAC;gBAC7C,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAClD,aAAa,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;gBAC1D,CAAC;gBAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;gBAClC,MAAM,UAAU,GAAG,OAAO,CAAC,iBAAiB;oBAC1C,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;oBAC3C,CAAC,CAAC,IAAI,CAAC;gBAET,MAAM,cAAc,GAAG,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;gBAC/C,MAAM,eAAe,GAAG,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAE5B,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC;gBAE5D,GAAG,CAAC,IAAI,CACN;oBACE,OAAO,EAAE,IAAI;oBACb,GAAG;oBACH,SAAS,EAAE,QAAQ;oBACnB,eAAe,EAAE,cAAc;oBAC/B,WAAW,EAAE,eAAe;oBAC5B,UAAU,EAAE,CAAC,CAAC,UAAU;iBACzB,EACD,qBAAqB,CACtB,CAAC;gBAEF,OAAO;oBACL,IAAI;oBACJ,cAAc;oBACd,eAAe;oBACf,SAAS;oBACT,eAAe;oBACf,SAAS,EAAE,UAAU;oBACrB,aAAa,EAAE,SAAS;oBACxB,SAAS;oBACT,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC;oBACjD,gBAAgB;oBAChB,UAAU;oBACV,QAAQ;oBACR,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC5C,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,GAAG,IAAI,CAAC;gBACf,MAAM,GAAG,CAAC;YACZ,CAAC;oBAAS,CAAC;gBACT,IAAI,WAAW;oBAAE,WAAW,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACnE,yEAAyE;gBACzE,wEAAwE;gBACxE,uEAAuE;gBACvE,yEAAyE;gBACzE,yEAAyE;gBACzE,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC;oBACnB,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;wBAClC,GAAG,CAAC,IAAI,CACN,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAC3D,wBAAwB,CACzB,CAAC;oBACJ,CAAC,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,IAAI,IAAI,UAAU,EAAE,CAAC;oBACvB,IAAI,OAAO;wBAAE,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;;wBACjC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBAChC,CAAC;qBAAM,CAAC;oBACN,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;wBAClC,GAAG,CAAC,IAAI,CACN,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAC3D,wBAAwB,CACzB,CAAC;oBACJ,CAAC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,IAAoB;IACzC,OAAO,IAAI,EAAE,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,kBAAkB,CAAC;AAC3E,CAAC;AAkBD;;;GAGG;AACH,KAAK,UAAU,gBAAgB,CAAC,IAAoB;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAC7B,sHAAsH,CACvH,CAAC;QACF,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;QACpE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA+B,CAAC;QAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IACzC,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAoB,EACpB,IAAuB;IAEvB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,qBAAqB,CAAC;IACxD,MAAM,SAAS,GAAG,GAAW,EAAE,CAAC,IAAI,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;IAExD,0EAA0E;IAC1E,6EAA6E;IAC7E,0EAA0E;IAC1E,IAAI,IAAI,CAAC,gBAAgB,IAAI,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,0BAA0B,EAAE,SAAS,EAAE,CAAC,CAAC;QAClE,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACjF,CAAC;IAED,yEAAyE;IACzE,6EAA6E;IAC7E,8EAA8E;IAC9E,IAAI,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC;IAC5B,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,QAAQ,IAAI,SAAS,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;QAC9D,MAAM,IAAI;aACP,QAAQ,CAAC,oEAAoE,CAAC;aAC9E,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QACtE,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAExD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,MAAM,CAAC,OAAO,IAAI,qBAAqB,IAAI,MAAM,CAAC,YAAY,KAAK,UAAU;YAAE,MAAM;QACzF,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC;IACnC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAoB,EACpB,OAAqB;IAErB,MAAM,OAAO,GAAkB,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,CAAC;IACvF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;QACtB,IAAI,CAAC;YACH,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACtB,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;oBAC7D,MAAM,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;gBAC5C,CAAC;qBAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;oBACtB,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,SAAS,IAAI,KAAK,EAAE,CAAC,CAAC;gBAC5E,CAAC;YACH,CAAC;iBAAM,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC9B,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACnF,CAAC;iBAAM,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC9B,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;oBACf,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;gBACtC,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACnC,CAAC;YACH,CAAC;iBAAM,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC9B,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACnC,CAAC;iBAAM,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC/B,MAAM,IAAI,GAAG,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC3C,8DAA8D;gBAC9D,MAAM,IAAI,GACR,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;oBAC1C,CAAC,CAAC,sBAAsB,IAAI,GAAG,CAAC,CAAC,MAAM,GAAG;oBAC1C,CAAC,CAAC,sBAAsB,IAAI,wBAAwB,CAAC;gBACzD,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;iBAAM,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACnC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC;gBACrE,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;YACjE,CAAC;iBAAM,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC/B,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACvD,CAAC;iBAAM,IAAI,CAAC,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;gBAC1C,mEAAmE;gBACnE,kDAAkD;gBAClD,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,aAAa,GAAG,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/fetcher-robots-gate.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Robots-gated fetcher — the central robots.txt choke point (see ROBOTS_POLICY.md).
+ *
+ * Wraps any FetcherAdapter so every route that fetches through it gets uniform
+ * robots handling (instead of the per-path drift the audit found). When
+ * robots-respect is enabled it:
+ *   - refuses URLs the target's robots.txt disallows for our product token →
+ *     throws `RobotsDisallowedError` (routes map it to 403 `robots_disallowed`);
+ *   - paces same-host requests by `max(Crawl-delay, politeness floor)`.
+ *
+ * Authorized opt-out: when the request carries the internal
+ * `__robotsBypassAuthorized` flag (resolved UPSTREAM at the API layer from the
+ * customer's `ignoreRobots` + `robotsAttestation` AND an account capability), the
+ * Disallow check is skipped and the bypass is logged for audit. The gate never
+ * decides authorization itself — that's an API/control concern (four-layer rule).
+ *
+ * Phase-in: respect is OFF by default; enable per-environment via
+ * `ROBOTS_RESPECT=1` or the explicit `respectRobots` option. When off, the gate
+ * is a transparent pass-through (zero behavior change). robots.txt evaluation is
+ * fail-open (a target's robots outage never blocks the fetch) — see
+ * `evaluateRobots`. robots.txt URLs are SSRF-validated inside `evaluateRobots`;
+ * this gate adds no new trust-boundary crossing.
+ */
+import { evaluateRobots } from '@bluefields/primitives';
+import type { FetcherAdapter } from './types.js';
+/** Audit record for an honored opt-out — the API layer adds customer/attestation context. */
+export interface RobotsBypassAudit {
+    url: string;
+    host: string;
+    /** Wall-clock ms (Date.now) when the bypass was honored. */
+    atMs: number;
+}
+export interface RobotsGateOptions {
+    /** The wrapped fetcher (e.g. the escalating adapter). */
+    inner: FetcherAdapter;
+    /**
+     * Master switch (phase-in). Default `env.ROBOTS_RESPECT === '1'` (OFF until an
+     * operator enables it). When false the gate is a pass-through.
+     */
+    respectRobots?: boolean;
+    /** Minimum same-host request spacing. Default `DEFAULT_POLITENESS_FLOOR_MS`. */
+    politenessFloorMs?: number;
+    /** Env used for the default `respectRobots` flag. Default `process.env`. */
+    env?: NodeJS.ProcessEnv;
+    /** Invoked when an authorized opt-out is honored (for the API-level audit log). */
+    onBypass?: (audit: RobotsBypassAudit) => void;
+    /** robots.txt fetch override (forwarded to `evaluateRobots`). */
+    robotsFetchImpl?: typeof fetch;
+    /** Override the robots evaluator. */
+    evaluate?: typeof evaluateRobots;
+    /** Clock for politeness pacing. Default `Date.now`. */
+    nowMsFn?: () => number;
+    /** Sleep for politeness pacing. Default real `setTimeout`. */
+    sleepFn?: (ms: number) => Promise<void>;
+}
+/**
+ * Build a robots-gated fetcher wrapping `opts.inner`. Drop-in `FetcherAdapter`,
+ * so adopting it is just wrapping the fetcher a route already constructs.
+ */
+export declare function createRobotsGatedFetcher(opts: RobotsGateOptions): FetcherAdapter;