@crawlbrulee/sdk 0.13.1 → 0.14.0

package/README.md

@@ -109,12 +109,16 @@ const page = await crawlbrulee.scrape({
     screenshot: {
       type: 'full_page',
       device_mode: 'desktop',
-      cleanup: { ads_and_popups: true },
     },
   },
+  // Shapes markdown, cleaned_html, links, images AND the screenshot.
+  // Never touches raw_html — that is always the page before any removal.
+  cleanup: {
+    ads_and_popups: true,
+    exclude_selectors: ['nav', 'footer'],
+  },
   require_js: true,
   proxy: 'advanced',
-  exclude_selectors: ['nav', 'footer'],
   cache: { max_age: 3600 },
   location: { country: 'US' },
 })
@@ -218,9 +222,47 @@ console.log(result.links.length, 'urls on page 1 of', result.response_meta.pagin
 console.log(result.response_meta.usage.credits, 'credits charged') // usage accounting, alongside pagination + truncation
 ```
 
+- **`max_urls`** defaults to `5_000` and maxes out at `100_000`. discovery _stops_ at this number, so a smaller value
+  is a cheaper and faster crawl, not just a shorter answer.
+- **`limit`** (urls per page) defaults to `5_000` and maxes out at `10_000`.
+- the sdk sends only the fields you pass — omit `max_urls` or `limit` and the server applies its own default.
+
 `result.response_meta` carries `usage` (`credits` / billed `engine` / resolved `proxy`) alongside the map-specific `pagination`
-and `truncation` blocks. map operations do not produce screenshot slices. see the [map endpoint](https://crawlbrulee.com/docs/map) for discovery rules and pagination
-semantics.
+and `truncation` blocks. map operations do not produce screenshot slices.
+
+#### did the map miss pages?
+
+a map that stopped at your own `max_urls` comes back with exactly `max_urls` links and `response_capped: false` — the
+signal that more exists is `discovery_cap_reason`, not the capped flags:
+
+```ts
+const { truncation } = result.response_meta
+
+if (truncation.discovery_capped) {
+  // the site has more pages than this map lists
+  console.log('stopped by:', truncation.discovery_cap_reason) // 'max_urls' | 'time' | 'file_budget' | 'depth' | 'file_size'
+  console.log(truncation.sitemaps_skipped, 'sitemap files skipped or partly read')
+}
+
+if (truncation.discovery_cap_reason === 'max_urls') {
+  // the only reason you can fix from the request — ask again with a higher max_urls
+}
+```
+
+every other reason (`time`, `file_budget`, `depth`, `file_size`) means the site itself is big, slow or deeply nested;
+re-asking with a higher `max_urls` will not return more.
+
+#### url shape and ordering
+
+returned urls are normalised the same way `/scrape` normalises the `url` it returns: the host is kept as the site
+publishes it (a `www.` host stays `www.`), the query string is sorted with known tracking parameters stripped, and a
+trailing slash is dropped.
+
+ordering is stable — link type first, then home-page links before sitemap-only links, then shallower paths before
+deeper ones, then alphabetical. where a url came from drives that ordering server-side and is deliberately not returned,
+so a link item is always just `{ url }`.
+
+see the [map endpoint](https://crawlbrulee.com/docs/map) for discovery rules and pagination semantics.
 
 ### account
 
@@ -337,16 +379,19 @@ always verify the signature **before** parsing or trusting the body. the `X-Cwbl
 every failure raised by the sdk extends [`CrawlbruleeError`](src/errors.ts). typed subclasses are exported for the most actionable
 cases:
 
-| class                     | when it's raised                                                                                     |
-| ------------------------- | ---------------------------------------------------------------------------------------------------- |
-| `AuthenticationError`     | 401 / 403 responses (missing, invalid, or unauthorized api key).                                     |
-| `RateLimitError`          | 429 responses. exposes `retryAfterMs` and `limitedBy` when the server provided them.                 |
-| `UsageAllocationError`    | the org's plan limit was hit. exposes `reason` (`credit_limit`, `concurrency_limit`, …) and `usage`. |
-| `ValidationError`         | 4xx caused by a bad request (`invalid_url`, `url_too_long`, `blocked_url`, …).                       |
-| `NotFoundError`           | 404 responses (e.g. unknown async `jobId`).                                                          |
-| `ServiceUnavailableError` | 503 responses (`service_unavailable`). the api is temporarily unavailable — transient, retry it.     |
-| `TransportError`          | network failures, aborts, non-json responses, request body read failures.                            |
-| `CrawlbruleeError`        | base class — used for any other api error. always has `status`, `errorName`, `message`.              |
+| class                     | when it's raised                                                                                           |
+| ------------------------- | ---------------------------------------------------------------------------------------------------------- |
+| `AuthenticationError`     | 401 / 403 responses (missing, invalid, or unauthorized api key).                                           |
+| `AntibotBlockedError`     | 403 `antibot_blocked` — the target site's bot protection blocked us. not a key problem.                    |
+| `TooManyRedirectsError`   | 422 `too_many_redirects` — the target site redirected in a loop. not a bad request; retrying rarely helps. |
+| `PageTooLargeError`       | 422 `page_too_large` — the page's html was too large to process. terminal; do not retry it.                |
+| `RateLimitError`          | 429 responses. exposes `retryAfterMs` and `limitedBy` when the server provided them.                       |
+| `UsageAllocationError`    | the org's plan limit was hit. exposes `reason` (`credit_limit`, `concurrency_limit`, …) and `usage`.       |
+| `ValidationError`         | 4xx caused by a bad request (`invalid_url`, `url_too_long`, `blocked_url`, …).                             |
+| `NotFoundError`           | 404 responses (e.g. unknown async `jobId`).                                                                |
+| `ServiceUnavailableError` | 503 responses (`service_unavailable`). the api is temporarily unavailable — transient, retry it.           |
+| `TransportError`          | network failures, aborts, non-json responses, request body read failures.                                  |
+| `CrawlbruleeError`        | base class — used for any other api error. always has `status`, `errorName`, `message`.                    |
 
 ```ts
 import { Crawlbrulee, RateLimitError, UsageAllocationError } from '@crawlbrulee/sdk'
@@ -371,6 +416,19 @@ backoff, and a 429 carries a `retryAfterMs` hint when the server sent one. a 503
 request for a moment; it says nothing about your credentials, so it is **not** a reason to rotate your api key. a key
 that is genuinely missing, invalid, or expired comes back as a 401 and raises `AuthenticationError` instead.
 
+**not every 403 is a key problem.** a 403 carrying `antibot_blocked` means the _target site_ blocked the request, not
+that your key was rejected — it raises `AntibotBlockedError`. retrying the same request rarely helps; use a higher
+proxy tier (`proxy: 'advanced'`) or skip the site. both `/scrape` and `/map` can return it. only a 403 with an
+unrecognized name still falls back to `AuthenticationError`.
+
+**a 422 `too_many_redirects` is the target's doing too.** the site redirected the request in a loop, or through more
+hops than the api follows — it raises `TooManyRedirectsError`, not `ValidationError`, because nothing about your
+request was wrong. retrying rarely helps. both `/scrape` and `/map` can return it.
+
+**a 422 `page_too_large` means the page, not the request.** the page's html was too large to process, so it raises
+`PageTooLargeError`, not `ValidationError`. it is terminal: the same url will fail the same way, so do not retry it —
+scrape a smaller page instead. `/scrape` returns it; `/map` does not.
+
 for exhaustive branching, switch on `err.errorName` — the literal-typed union is exported as `ApiErrorName`. the
 `isCrawlbruleeError(err)` type guard narrows an `unknown` to the base error. the api docs carry the canonical
 [error reference](https://crawlbrulee.com/docs/errors) — every `errorName`, what causes it, and how to recover.

package/dist/index.cjs

@@ -12,7 +12,7 @@ const DEFAULT_REQUEST_TIMEOUT_MS = 0;
 /** Environment variable read by `Crawlbrulee.fromEnv()` to source the API key. */
 const ENV_API_KEY = "CRAWLBRULEE_API_KEY";
 /** Identifies the SDK in the `User-Agent` header. Kept in one place for easy bumping. */
-const USER_AGENT = "@crawlbrulee/sdk/0.13.1 (node)";
+const USER_AGENT = "@crawlbrulee/sdk/0.14.0 (node)";
 
 //#endregion
 //#region src/errors.ts
@@ -51,7 +51,14 @@ var CrawlbruleeError = class extends Error {
 		this.response = options.response;
 	}
 };
-/** Raised for 401 / 403 responses (missing, invalid, or unauthorized API key). */
+/**
+* Raised when the API rejects your credentials — a missing, invalid, or
+* unauthorized API key (`invalid_credentials`, `access_denied`).
+*
+* Not every 403 is a key problem: a 403 carrying `antibot_blocked` is the
+* *target site* blocking us and raises {@link AntibotBlockedError} instead.
+* Only an unrecognized 403 name falls back to this class.
+*/
 var AuthenticationError = class extends CrawlbruleeError {
 	constructor(message, options) {
 		super(message, options);
@@ -59,6 +66,43 @@ var AuthenticationError = class extends CrawlbruleeError {
 	}
 };
 /**
+* Raised when the target site's anti-bot protection blocked the request
+* (HTTP 403, `antibot_blocked`). Not an API-key problem — retrying the same
+* tier rarely helps; try a higher proxy tier or skip the site.
+*/
+var AntibotBlockedError = class extends CrawlbruleeError {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "AntibotBlockedError";
+	}
+};
+/**
+* Raised when the target site redirected the request in a loop, or through
+* more hops than the API follows (HTTP 422, `too_many_redirects`). Like
+* {@link AntibotBlockedError} this is the target's doing — not a key problem
+* and not a bad request — so it is neither an `AuthenticationError` nor a
+* `ValidationError`. Retrying rarely helps. Returned by both `scrape` and `map`.
+*/
+var TooManyRedirectsError = class extends CrawlbruleeError {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "TooManyRedirectsError";
+	}
+};
+/**
+* Raised when the page's HTML was too large to process (HTTP 422,
+* `page_too_large`). Like {@link TooManyRedirectsError} this is about the page,
+* not your request — so it is neither an `AuthenticationError` nor a
+* `ValidationError`. It is terminal: the same URL fails the same way, so do not
+* retry it. Returned by `scrape`.
+*/
+var PageTooLargeError = class extends CrawlbruleeError {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "PageTooLargeError";
+	}
+};
+/**
 * Raised for HTTP 429 responses. When the server included a `retry_after_ms`
 * hint in `details` it is surfaced directly on the instance.
 *
@@ -189,6 +233,21 @@ function createApiError(body, status) {
 				response
 			});
 		}
+		case "antibot_blocked": return new AntibotBlockedError(message, {
+			status,
+			errorName: name,
+			response
+		});
+		case "too_many_redirects": return new TooManyRedirectsError(message, {
+			status,
+			errorName: name,
+			response
+		});
+		case "page_too_large": return new PageTooLargeError(message, {
+			status,
+			errorName: name,
+			response
+		});
 		case "invalid_credentials":
 		case "access_denied": return new AuthenticationError(message, {
 			status,
@@ -873,6 +932,7 @@ function getSubtle() {
 }
 
 //#endregion
+exports.AntibotBlockedError = AntibotBlockedError;
 exports.AuthenticationError = AuthenticationError;
 exports.Crawlbrulee = Crawlbrulee;
 exports.CrawlbruleeError = CrawlbruleeError;
@@ -881,8 +941,10 @@ exports.DEFAULT_REQUEST_TIMEOUT_MS = DEFAULT_REQUEST_TIMEOUT_MS;
 exports.DEFAULT_WEBHOOK_TOLERANCE_SECONDS = DEFAULT_WEBHOOK_TOLERANCE_SECONDS;
 exports.ENV_API_KEY = ENV_API_KEY;
 exports.NotFoundError = NotFoundError;
+exports.PageTooLargeError = PageTooLargeError;
 exports.RateLimitError = RateLimitError;
 exports.ServiceUnavailableError = ServiceUnavailableError;
+exports.TooManyRedirectsError = TooManyRedirectsError;
 exports.TransportError = TransportError;
 exports.UsageAllocationError = UsageAllocationError;
 exports.ValidationError = ValidationError;

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","names":[],"sources":["../src/config.ts","../src/errors.ts","../src/instrumentation.ts","../src/http.ts","../src/client.ts","../src/webhooks.ts"],"sourcesContent":["/**\n * Production base URL of the crawlbrulee API. Used by default when the caller\n * doesn't pass a `baseUrl` to {@link Crawlbrulee}. Local development and\n * staging callers point at their own host via that option.\n */\nexport const DEFAULT_BASE_URL = 'https://api.crawlbrulee.com'\n\n/** Default request timeout when the caller doesn't specify one (0 disables the timeout). */\nexport const DEFAULT_REQUEST_TIMEOUT_MS = 0\n\n/** Environment variable read by `Crawlbrulee.fromEnv()` to source the API key. */\nexport const ENV_API_KEY = 'CRAWLBRULEE_API_KEY'\n\n/** Identifies the SDK in the `User-Agent` header. Kept in one place for easy bumping. */\nexport const USER_AGENT = '@crawlbrulee/sdk/0.13.1 (node)'\n","import type {\n  ApiErrorDetails,\n  ApiErrorName,\n  ApiErrorResponse,\n  RateLimitErrorDetails,\n  UsageAllocationErrorDetails,\n} from './types/common.js'\n\n/**\n * Base error class for every failure raised by the SDK.\n *\n * Two kinds of failures end up here:\n *\n * 1. **API errors** — the server returned a non-2xx response with a well-formed\n *    JSON body. In that case `status`, `errorName` and (sometimes) `details`\n *    are populated.\n * 2. **Transport errors** — the request never produced a structured response\n *    (network failure, abort, timeout, non-JSON body, etc.). In that case\n *    `status` may be `0` and `errorName` is one of the synthetic transport\n *    names (`request_timeout`, `client_closed_request`) or `null`.\n *\n * Typed subclasses are exported for the most common cases. To branch on more\n * specific server-side errors, switch on `err.errorName` or use the\n * {@link isCrawlbruleeError} helper.\n */\nexport class CrawlbruleeError extends Error {\n  /** HTTP status code; `0` for transport-level failures with no response. */\n  readonly status: number\n  /** The `name` field from the API error body, or `null` for transport errors. */\n  readonly errorName: ApiErrorName | null\n  /** Structured detail block from the API error body, if any. */\n  readonly details?: ApiErrorDetails\n  /** The original parsed error body, when one was received. */\n  readonly response?: ApiErrorResponse\n\n  constructor(\n    message: string,\n    options: {\n      status: number\n      errorName: ApiErrorName | null\n      details?: ApiErrorDetails\n      response?: ApiErrorResponse\n      cause?: unknown\n    }\n  ) {\n    super(message, options.cause !== undefined ? { cause: options.cause } : undefined)\n    this.name = 'CrawlbruleeError'\n    this.status = options.status\n    this.errorName = options.errorName\n    this.details = options.details\n    this.response = options.response\n  }\n}\n\n/** Raised for 401 / 403 responses (missing, invalid, or unauthorized API key). */\nexport class AuthenticationError extends CrawlbruleeError {\n  constructor(\n    message: string,\n    options: { status: number; errorName: ApiErrorName; response?: ApiErrorResponse }\n  ) {\n    super(message, options)\n    this.name = 'AuthenticationError'\n  }\n}\n\n/**\n * Raised for HTTP 429 responses. When the server included a `retry_after_ms`\n * hint in `details` it is surfaced directly on the instance.\n *\n * `errorName` is always the literal `'too_many_requests'` — the SDK normalizes\n * this even when the server returns a 429 with a different `name` field\n * (e.g. a CDN coalescing upstream rate limiting). The original body is still\n * available on `response`.\n */\nexport class RateLimitError extends CrawlbruleeError {\n  override readonly errorName: 'too_many_requests'\n  /** Suggested delay (ms) before retrying, when the server provided one. */\n  readonly retryAfterMs?: number\n  /** Which rate limit was tripped (e.g. `org`, `ip`), when provided. */\n  readonly limitedBy?: string\n\n  constructor(\n    message: string,\n    options: {\n      status: number\n      details?: RateLimitErrorDetails\n      response?: ApiErrorResponse\n    }\n  ) {\n    super(message, { ...options, errorName: 'too_many_requests', details: options.details })\n    this.name = 'RateLimitError'\n    this.errorName = 'too_many_requests'\n    this.retryAfterMs = options.details?.retry_after_ms\n    this.limitedBy = options.details?.limited_by\n  }\n}\n\n/**\n * Raised when the API rejects a request because the org's plan limits would\n * be exceeded (credit limit, concurrency cap, overage hard cap, etc.).\n *\n * `errorName` is always the literal `'usage_allocation_error'`.\n */\nexport class UsageAllocationError extends CrawlbruleeError {\n  override readonly errorName: 'usage_allocation_error'\n  /** Specific reason the allocation was denied. */\n  readonly reason: UsageAllocationErrorDetails['reason']\n  /** Current usage / limit snapshot at the time of the rejection. */\n  readonly usage?: UsageAllocationErrorDetails['details']\n\n  constructor(\n    message: string,\n    options: {\n      status: number\n      details: UsageAllocationErrorDetails\n      response?: ApiErrorResponse\n    }\n  ) {\n    super(message, { ...options, errorName: 'usage_allocation_error' })\n    this.name = 'UsageAllocationError'\n    this.errorName = 'usage_allocation_error'\n    this.reason = options.details.reason\n    this.usage = options.details.details\n  }\n}\n\n/** Raised for 4xx responses caused by an invalid request shape or arguments. */\nexport class ValidationError extends CrawlbruleeError {\n  constructor(\n    message: string,\n    options: { status: number; errorName: ApiErrorName; response?: ApiErrorResponse }\n  ) {\n    super(message, options)\n    this.name = 'ValidationError'\n  }\n}\n\n/** Raised for 404 responses (e.g. unknown async job ID). */\nexport class NotFoundError extends CrawlbruleeError {\n  constructor(\n    message: string,\n    options: { status: number; errorName: ApiErrorName; response?: ApiErrorResponse }\n  ) {\n    super(message, options)\n    this.name = 'NotFoundError'\n  }\n}\n\n/**\n * Raised for 503 responses — the API could not serve the request right now\n * (a transient infrastructure failure, not a problem with your request).\n *\n * This is **retryable**: back off and try again. In particular it is not an\n * authentication failure, so it is never a reason to rotate your API key —\n * a genuinely bad or expired key still comes back as a 401\n * (`invalid_credentials`) and raises {@link AuthenticationError}.\n */\nexport class ServiceUnavailableError extends CrawlbruleeError {\n  constructor(\n    message: string,\n    options: { status: number; errorName: ApiErrorName; response?: ApiErrorResponse }\n  ) {\n    super(message, options)\n    this.name = 'ServiceUnavailableError'\n  }\n}\n\n/**\n * Raised when a request cannot be sent or no structured response is parsed.\n *\n * The `errorName` discriminates the cause:\n * - `'request_timeout'` — the per-request timeout fired.\n * - `'client_closed_request'` — the caller's `AbortSignal` fired.\n * - `null` — generic transport failure (network error, non-JSON body, etc.).\n */\nexport class TransportError extends CrawlbruleeError {\n  constructor(\n    message: string,\n    options: {\n      status?: number\n      errorName?: 'request_timeout' | 'client_closed_request' | null\n      cause?: unknown\n    } = {}\n  ) {\n    super(message, {\n      status: options.status ?? 0,\n      errorName: options.errorName ?? null,\n      cause: options.cause,\n    })\n    this.name = 'TransportError'\n  }\n}\n\n/** Narrow `unknown` to the SDK's base error type. */\nexport function isCrawlbruleeError(err: unknown): err is CrawlbruleeError {\n  return err instanceof CrawlbruleeError\n}\n\n/**\n * Map an API error body + HTTP status to the most specific error class.\n *\n * Dispatch is **name-first**: the body's `name` field is the most reliable\n * signal of what went wrong. Status code is used only as a fallback when the\n * name is unrecognized (e.g. a CDN-synthesized error). This avoids\n * miscategorizing things like a 403 with `name: 'not_found'` as an auth error.\n *\n * Internal — used by the HTTP layer.\n */\nexport function createApiError(body: ApiErrorResponse, status: number): CrawlbruleeError {\n  const { name, message, details } = body\n  const response = body\n\n  switch (name) {\n    case 'too_many_requests':\n      return new RateLimitError(message, {\n        status,\n        details: details?.error_name === 'too_many_requests' ? details : undefined,\n        response,\n      })\n\n    case 'usage_allocation_error': {\n      // Without a structured details block we still want a typed error — fall\n      // back to a synthetic `internal_error` reason so callers can branch.\n      const usageDetails: UsageAllocationErrorDetails =\n        details?.error_name === 'usage_allocation_error'\n          ? details\n          : { error_name: 'usage_allocation_error', reason: 'internal_error' }\n      return new UsageAllocationError(message, { status, details: usageDetails, response })\n    }\n\n    case 'invalid_credentials':\n    case 'access_denied':\n      return new AuthenticationError(message, { status, errorName: name, response })\n\n    case 'not_found':\n      return new NotFoundError(message, { status, errorName: name, response })\n\n    case 'service_unavailable':\n      return new ServiceUnavailableError(message, { status, errorName: name, response })\n\n    case 'validation_error':\n    case 'invalid_url':\n    case 'url_too_long':\n    case 'unsupported_url_schema':\n    case 'url_credentials_not_supported':\n    case 'blocked_url':\n    case 'unsupported_content':\n    case 'unsupported_screenshot_output':\n      return new ValidationError(message, { status, errorName: name, response })\n  }\n\n  // Name was not specific enough — fall back to status-based heuristics, but\n  // never override what the name said. A 429 with an unrecognized name still\n  // promotes to RateLimitError (the class invariant normalizes errorName).\n  if (status === 429) {\n    return new RateLimitError(message, { status, response })\n  }\n  if (status === 401 || status === 403) {\n    return new AuthenticationError(message, { status, errorName: name, response })\n  }\n  if (status === 404) {\n    return new NotFoundError(message, { status, errorName: name, response })\n  }\n  if (status === 503) {\n    return new ServiceUnavailableError(message, { status, errorName: name, response })\n  }\n\n  return new CrawlbruleeError(message, { status, errorName: name, details, response })\n}\n","import { DEFAULT_BASE_URL } from './config.js'\nimport { CrawlbruleeError } from './errors.js'\n\n/** Function shape compatible with the global `fetch`. */\nexport type FetchLike = typeof fetch\n\n/**\n * Centralized factory for the low-level dependencies the SDK injects into its\n * HTTP layer. Production code resolves these to the runtime's global `fetch`\n * and the burned-in production base URL; tests stub this module to swap in\n * mocks and alternate hosts.\n *\n * This is internal — it is not exported from the package's public entry. Tests\n * import it from `src/instrumentation.js` directly and use `vi.spyOn` to\n * substitute behavior.\n */\nexport const CwblInstrumentation = {\n  /**\n   * Resolve the `fetch` implementation the SDK should use. Throws a\n   * {@link CrawlbruleeError} if the runtime does not expose a global `fetch`.\n   */\n  getFetch(): FetchLike {\n    const g = globalThis as { fetch?: FetchLike }\n    if (typeof g.fetch !== 'function') {\n      throw new CrawlbruleeError(\n        'No global fetch is available in this runtime. crawlbrulee requires Node.js 22+, Bun, Deno, or a modern browser/edge runtime.',\n        { status: 0, errorName: null }\n      )\n    }\n    return g.fetch.bind(globalThis)\n  },\n\n  /**\n   * Resolve the base URL the SDK should target. Returns the production host by\n   * default; tests stub this to point at a mock origin.\n   */\n  getBaseUrl(): string {\n    return DEFAULT_BASE_URL\n  },\n}\n","import { DEFAULT_REQUEST_TIMEOUT_MS, USER_AGENT } from './config.js'\nimport { TransportError, createApiError, type CrawlbruleeError } from './errors.js'\nimport { CwblInstrumentation, type FetchLike } from './instrumentation.js'\nimport type { ApiErrorResponse } from './types/common.js'\n\n/** HTTP methods used by the SDK. */\nexport type HttpMethod = 'GET' | 'POST'\n\n/** Options the SDK accepts at construction time for the HTTP layer. */\nexport interface HttpClientOptions {\n  /** API key sent as `Authorization: Bearer <key>`. */\n  apiKey: string\n  /**\n   * Override the base URL. Trailing slashes are stripped. Falls back to\n   * {@link CwblInstrumentation.getBaseUrl} (which resolves to the production\n   * host) when unset.\n   */\n  baseUrl?: string\n  /**\n   * Per-request timeout in milliseconds. Pass `0` (or omit) to disable the\n   * timeout entirely.\n   */\n  timeoutMs?: number\n}\n\n/** Per-call overrides accepted on every resource method. */\nexport interface RequestOptions {\n  /** Abort the request when this signal fires. Composable with the timeout. */\n  signal?: AbortSignal\n  /**\n   * Override the constructor-level `timeoutMs` for this call. Pass `0` to\n   * disable the timeout for this call.\n   */\n  timeoutMs?: number\n}\n\ninterface SendArgs extends RequestOptions {\n  method: HttpMethod\n  path: string\n  body?: unknown\n}\n\ninterface ComposedSignal {\n  signal: AbortSignal | undefined\n  /** Returns `true` if the abort was triggered by the per-request timeout. */\n  timedOut: () => boolean\n  /** Releases the timer and any listeners attached to the caller's signal. */\n  cleanup: () => void\n}\n\n/**\n * Minimal `fetch`-based HTTP layer used by {@link Crawlbrulee}. Handles:\n *\n * - URL composition (joining `baseUrl` and path safely).\n * - JSON serialization and parsing.\n * - The `Authorization: Bearer …` header.\n * - Composing the caller's `AbortSignal` with an internal timeout signal. The\n *   timeout covers the WHOLE request, including the response body read — not\n *   just the time-to-headers.\n * - Mapping non-2xx responses to typed `CrawlbruleeError` subclasses via\n *   {@link createApiError}.\n *\n * The base URL and `fetch` implementation are sourced from\n * {@link CwblInstrumentation} at construction time so tests can stub the\n * module.\n */\nexport class HttpClient {\n  readonly baseUrl: string\n  private readonly apiKey: string\n  private readonly fetch: FetchLike\n  private readonly timeoutMs: number\n\n  constructor(options: HttpClientOptions) {\n    this.baseUrl = stripTrailingSlash(options.baseUrl ?? CwblInstrumentation.getBaseUrl())\n    this.apiKey = options.apiKey\n    this.fetch = CwblInstrumentation.getFetch()\n    this.timeoutMs = options.timeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS\n  }\n\n  /** Send a `GET` request and parse the response as `T`. */\n  get<T>(path: string, options?: RequestOptions): Promise<T> {\n    return this.send<T>({ method: 'GET', path, ...options })\n  }\n\n  /** Send a `POST` request with a JSON body and parse the response as `T`. */\n  post<T>(path: string, body: unknown, options?: RequestOptions): Promise<T> {\n    return this.send<T>({ method: 'POST', path, body, ...options })\n  }\n\n  private async send<T>(args: SendArgs): Promise<T> {\n    const url = this.buildUrl(args.path)\n    const headers = this.buildHeaders(args)\n    const body = args.body === undefined ? undefined : JSON.stringify(args.body)\n    const composed = this.composeSignal(args.signal, args.timeoutMs)\n\n    try {\n      let res: Response\n      try {\n        res = await this.fetch(url, {\n          method: args.method,\n          headers,\n          body,\n          signal: composed.signal,\n        })\n      } catch (cause: unknown) {\n        throw abortOrNetworkError(cause, composed.timedOut(), args.timeoutMs ?? this.timeoutMs)\n      }\n\n      let text: string\n      try {\n        text = await res.text()\n      } catch (cause: unknown) {\n        if (isAbortError(cause)) {\n          throw abortOrNetworkError(cause, composed.timedOut(), args.timeoutMs ?? this.timeoutMs)\n        }\n        throw new TransportError(`Failed to read response body (status ${res.status}).`, {\n          status: res.status,\n          cause,\n        })\n      }\n\n      const parsed = parseJsonOrThrow(text, res.status)\n      if (!res.ok) throw toApiError(parsed, res.status, text)\n      return parsed as T\n    } finally {\n      composed.cleanup()\n    }\n  }\n\n  private buildUrl(path: string): string {\n    if (!path.startsWith('/')) {\n      throw new TypeError(`crawlbrulee SDK: path must start with '/' (received '${path}')`)\n    }\n    return `${this.baseUrl}${path}`\n  }\n\n  private buildHeaders(args: SendArgs): Record<string, string> {\n    const headers: Record<string, string> = {\n      accept: 'application/json',\n      'user-agent': USER_AGENT,\n      authorization: `Bearer ${this.apiKey}`,\n    }\n    if (args.body !== undefined) headers['content-type'] = 'application/json'\n    return headers\n  }\n\n  /**\n   * Build a single `AbortSignal` that fires when either the caller-supplied\n   * signal aborts OR the per-request timeout elapses. The returned `cleanup`\n   * callback MUST be invoked on every exit path so we don't leak timers or\n   * dead listeners on long-lived caller signals.\n   */\n  private composeSignal(\n    callerSignal: AbortSignal | undefined,\n    overrideTimeoutMs: number | undefined\n  ): ComposedSignal {\n    const timeoutMs = overrideTimeoutMs ?? this.timeoutMs\n    const hasTimeout = Number.isFinite(timeoutMs) && timeoutMs > 0\n\n    if (!hasTimeout && !callerSignal) {\n      return { signal: undefined, timedOut: () => false, cleanup: () => {} }\n    }\n\n    if (!hasTimeout) {\n      return { signal: callerSignal, timedOut: () => false, cleanup: () => {} }\n    }\n\n    const controller = new AbortController()\n    let didTimeout = false\n    const timer = setTimeout(() => {\n      didTimeout = true\n      controller.abort(new Error('request_timeout'))\n    }, timeoutMs)\n\n    let onCallerAbort: (() => void) | undefined\n    if (callerSignal) {\n      if (callerSignal.aborted) {\n        clearTimeout(timer)\n        controller.abort(callerSignal.reason)\n      } else {\n        onCallerAbort = () => {\n          clearTimeout(timer)\n          controller.abort(callerSignal.reason)\n        }\n        callerSignal.addEventListener('abort', onCallerAbort, { once: true })\n      }\n    }\n\n    const cleanup = () => {\n      clearTimeout(timer)\n      if (onCallerAbort && callerSignal) {\n        callerSignal.removeEventListener('abort', onCallerAbort)\n      }\n    }\n\n    return { signal: controller.signal, timedOut: () => didTimeout, cleanup }\n  }\n}\n\nfunction stripTrailingSlash(url: string): string {\n  return url.replace(/\\/+$/, '')\n}\n\nfunction isAbortError(err: unknown): boolean {\n  return err instanceof Error && err.name === 'AbortError'\n}\n\nfunction abortOrNetworkError(cause: unknown, timedOut: boolean, timeoutMs: number): TransportError {\n  if (isAbortError(cause)) {\n    if (timedOut) {\n      return new TransportError(`Request timed out after ${timeoutMs}ms.`, {\n        errorName: 'request_timeout',\n        cause,\n      })\n    }\n    return new TransportError('Request aborted by caller.', {\n      errorName: 'client_closed_request',\n      cause,\n    })\n  }\n  return new TransportError(formatNetworkErrorMessage(cause), { cause })\n}\n\nfunction formatNetworkErrorMessage(cause: unknown): string {\n  if (cause instanceof Error) {\n    return `Network error: ${cause.message}`\n  }\n  return 'Network error: unknown failure while sending the request.'\n}\n\nfunction parseJsonOrThrow(text: string, status: number): unknown {\n  if (text === '') return {}\n  try {\n    return JSON.parse(text)\n  } catch (cause: unknown) {\n    const preview = text.length > 200 ? `${text.slice(0, 200)}…` : text\n    throw new TransportError(`Unexpected non-JSON response (status ${status}): ${preview}`, {\n      status,\n      cause,\n    })\n  }\n}\n\nfunction toApiError(parsed: unknown, status: number, rawText: string): CrawlbruleeError {\n  if (isApiErrorResponse(parsed)) {\n    return createApiError(parsed, status)\n  }\n  const preview = rawText.length > 200 ? `${rawText.slice(0, 200)}…` : rawText\n  return new TransportError(`HTTP ${status}: ${preview || '(empty body)'}`, { status })\n}\n\nfunction isApiErrorResponse(value: unknown): value is ApiErrorResponse {\n  if (value === null || typeof value !== 'object') return false\n  const v = value as Record<string, unknown>\n  return typeof v.name === 'string' && typeof v.message === 'string'\n}\n","import { ENV_API_KEY } from './config.js'\nimport { CrawlbruleeError } from './errors.js'\nimport { HttpClient, type RequestOptions } from './http.js'\nimport type {\n  AsyncJobStatusResponse,\n  AsyncScrapeRequest,\n  AsyncScrapeResponse,\n  MapRequest,\n  MapResponse,\n  ScrapeCompleteWebhook,\n  ScrapeRequest,\n  ScrapeResponse,\n  UsageResponse,\n  WhoamiResponse,\n} from './types/index.js'\n\n/** Options accepted by the {@link Crawlbrulee} constructor. */\nexport interface CrawlbruleeOptions {\n  /**\n   * API key sent as `Authorization: Bearer <key>`. Required — to read from the\n   * environment instead, use {@link Crawlbrulee.fromEnv}. Leading and trailing\n   * whitespace is stripped; an empty / whitespace-only value is rejected.\n   */\n  apiKey: string\n  /**\n   * Override the base URL the SDK targets. Defaults to the production host\n   * ({@link DEFAULT_BASE_URL}). Intended for local development and staging\n   * (e.g. `https://api.<staging-domain>`) — production callers should\n   * leave it unset. Trailing slashes are stripped.\n   */\n  baseUrl?: string\n  /**\n   * Per-request timeout in milliseconds. Defaults to `0` (no timeout). Set to a\n   * positive number to abort slow requests; a per-call `timeoutMs` override\n   * takes precedence. The timeout covers the WHOLE request, including the\n   * response body read.\n   */\n  timeoutMs?: number\n}\n\n/**\n * Options accepted by {@link Crawlbrulee.waitForScrape}.\n *\n * Note: `timeoutMs` here is the OVERALL wait budget across all polls — not the\n * per-HTTP-request timeout. The per-poll HTTP timeout is whatever the client\n * was constructed with; if you want to bound each individual poll, construct\n * the client with `timeoutMs` set.\n */\nexport interface WaitForScrapeOptions extends Omit<RequestOptions, 'timeoutMs'> {\n  /** Time between status polls in milliseconds. Default `2000`. */\n  intervalMs?: number\n  /**\n   * Maximum total time to wait before giving up, in milliseconds. Default\n   * `300_000` (5 minutes). Pass `0` to wait indefinitely.\n   */\n  timeoutMs?: number\n}\n\n/**\n * Official client for the crawlbrulee API.\n *\n * @example\n * ```ts\n * import { Crawlbrulee } from '@crawlbrulee/sdk'\n *\n * const crawlbrulee = new Crawlbrulee({ apiKey: 'cwbl_…' })\n * // or read CRAWLBRULEE_API_KEY from the environment:\n * const crawlbrulee = Crawlbrulee.fromEnv()\n *\n * const page = await crawlbrulee.scrape({\n *   url: 'https://example.com',\n *   extract: { markdown: true, links: true },\n * })\n * console.log(page.markdown)\n * ```\n */\nexport class Crawlbrulee {\n  /** Resolved base URL — trailing slash already stripped. */\n  readonly baseUrl: string\n  /** Underlying HTTP layer. Exposed for advanced use cases (custom endpoints). */\n  readonly http: HttpClient\n\n  constructor(options: CrawlbruleeOptions) {\n    const apiKey = options.apiKey?.trim()\n    if (!apiKey) {\n      throw new CrawlbruleeError(\n        `Missing API key. Pass { apiKey } to Crawlbrulee or call Crawlbrulee.fromEnv() to read ${ENV_API_KEY}.`,\n        { status: 0, errorName: null }\n      )\n    }\n    this.http = new HttpClient({ apiKey, baseUrl: options.baseUrl, timeoutMs: options.timeoutMs })\n    this.baseUrl = this.http.baseUrl\n  }\n\n  /**\n   * Build a {@link Crawlbrulee} reading the API key from\n   * `process.env.CRAWLBRULEE_API_KEY`. Throws if the variable is unset, empty,\n   * or whitespace.\n   *\n   * Any other constructor option can be passed via `overrides`.\n   *\n   * @example\n   * ```ts\n   * const crawlbrulee = Crawlbrulee.fromEnv()\n   * const crawlbrulee = Crawlbrulee.fromEnv({ timeoutMs: 30_000 })\n   * ```\n   */\n  static fromEnv(overrides: Omit<CrawlbruleeOptions, 'apiKey'> = {}): Crawlbrulee {\n    const apiKey = readEnv(ENV_API_KEY)\n    if (!apiKey) {\n      throw new CrawlbruleeError(\n        `${ENV_API_KEY} is not set. Export it in your shell, or pass apiKey to new Crawlbrulee({ apiKey }).`,\n        { status: 0, errorName: null }\n      )\n    }\n    return new Crawlbrulee({ ...overrides, apiKey })\n  }\n\n  // ------------------------------------------------------------------\n  // Scraping\n  // ------------------------------------------------------------------\n\n  /**\n   * Scrape a URL synchronously and return the extracted content.\n   *\n   * The request blocks until the scrape is finished. For long-running jobs\n   * (heavy JS rendering, screenshots of long pages) prefer\n   * {@link Crawlbrulee.scrapeAsync} so the connection isn't held open.\n   *\n   * @param request — body for `POST /api/scrape`.\n   * @param options — per-call timeout and abort signal.\n   */\n  scrape(request: ScrapeRequest, options?: RequestOptions): Promise<ScrapeResponse> {\n    return this.http.post<ScrapeResponse>('/api/scrape', request, options)\n  }\n\n  /**\n   * Submit an asynchronous scrape job and return its `job_id`. Poll the job\n   * with {@link Crawlbrulee.getScrapeStatus} or wait for completion with\n   * {@link Crawlbrulee.waitForScrape}.\n   *\n   * Pass an optional `webhook` to have the API deliver a signed\n   * `scrape.complete` `POST` to your endpoint when the job finishes (see\n   * {@link AsyncScrapeWebhook}). This field is async-only.\n   */\n  scrapeAsync(request: AsyncScrapeRequest, options?: RequestOptions): Promise<AsyncScrapeResponse> {\n    return this.http.post<AsyncScrapeResponse>('/api/scrape/async', request, options)\n  }\n\n  /** Look up the current status of an async scrape job. */\n  getScrapeStatus(jobId: string, options?: RequestOptions): Promise<AsyncJobStatusResponse> {\n    assertNonEmptyJobId(jobId)\n    return this.http.get<AsyncJobStatusResponse>(\n      `/api/scrape/status/${encodeURIComponent(jobId)}`,\n      options\n    )\n  }\n\n  /**\n   * Fetch the result of a completed async scrape job. Throws if the job is\n   * still pending/running — call {@link Crawlbrulee.getScrapeStatus}\n   * first, or use {@link Crawlbrulee.waitForScrape} to poll-then-fetch.\n   */\n  getScrapeResult(jobId: string, options?: RequestOptions): Promise<ScrapeResponse> {\n    assertNonEmptyJobId(jobId)\n    return this.http.get<ScrapeResponse>(`/api/scrape/result/${encodeURIComponent(jobId)}`, options)\n  }\n\n  /**\n   * Fetch the scrape result referenced by a `scrape.complete` webhook body.\n   *\n   * Always verify the webhook signature with `verifyWebhookSignature` before\n   * acting on it; this method trusts the parsed body it is handed.\n   *\n   * Behavior by `data.status`:\n   * - `success` — delegates to {@link Crawlbrulee.getScrapeResult} for the\n   *   webhook's `job_id` and returns the parsed result.\n   * - `failed` — throws a {@link CrawlbruleeError} carrying `data.error`\n   *   (`errorName: 'job_failed'`); there is no result to fetch.\n   * - `cancelled` — throws a {@link CrawlbruleeError}\n   *   (`errorName: 'client_closed_request'`).\n   *\n   * A non-`scrape.complete` envelope throws a {@link CrawlbruleeError}\n   * defensively. Any HTTP error from the underlying fetch propagates as the\n   * usual typed `CrawlbruleeError` subclass.\n   */\n  async fetchScrapeResultFromWebhook(\n    webhook: ScrapeCompleteWebhook,\n    options?: RequestOptions\n  ): Promise<ScrapeResponse> {\n    if (webhook?.event !== 'scrape.complete') {\n      throw new CrawlbruleeError(\n        `Expected a 'scrape.complete' webhook but received '${String(webhook?.event)}'.`,\n        { status: 0, errorName: 'validation_error' }\n      )\n    }\n\n    const { job_id: jobId, status, error } = webhook.data\n\n    switch (status) {\n      case 'success':\n        return this.getScrapeResult(jobId, options)\n\n      case 'failed':\n        throw new CrawlbruleeError(error ?? `Async scrape job ${jobId} failed.`, {\n          status: 0,\n          errorName: 'job_failed',\n        })\n\n      case 'cancelled':\n        throw new CrawlbruleeError(`Async scrape job ${jobId} was cancelled.`, {\n          status: 0,\n          errorName: 'client_closed_request',\n        })\n\n      default:\n        throw new CrawlbruleeError(\n          `Async scrape webhook for job ${jobId} carried an unexpected status '${String(status)}'.`,\n          { status: 0, errorName: 'validation_error' }\n        )\n    }\n  }\n\n  /**\n   * Poll an async scrape job until it reaches a terminal state, then return\n   * the scrape result.\n   *\n   * Throws a {@link CrawlbruleeError} when:\n   * - the job ends in `failed` (`errorName: 'job_failed'`),\n   * - the server reports an unexpected status (`errorName: 'job_failed'`),\n   * - the overall wait exceeds `timeoutMs` (`errorName: 'request_timeout'`),\n   * - the caller's `signal` aborts (`errorName: 'client_closed_request'`).\n   */\n  async waitForScrape(jobId: string, options: WaitForScrapeOptions = {}): Promise<ScrapeResponse> {\n    assertNonEmptyJobId(jobId)\n    const intervalMs = options.intervalMs ?? 2000\n    const timeoutMs = options.timeoutMs ?? 300_000\n    const deadline = timeoutMs > 0 ? Date.now() + timeoutMs : Number.POSITIVE_INFINITY\n\n    while (true) {\n      throwIfAborted(options.signal)\n      if (Date.now() >= deadline) {\n        throw new CrawlbruleeError(\n          `Timed out after ${timeoutMs}ms waiting for async scrape job ${jobId}.`,\n          { status: 0, errorName: 'request_timeout' }\n        )\n      }\n\n      const status = await this.getScrapeStatus(jobId, { signal: options.signal })\n\n      switch (status.status) {\n        case 'done':\n          return this.getScrapeResult(jobId, { signal: options.signal })\n\n        case 'failed':\n          throw new CrawlbruleeError(status.error ?? `Async scrape job ${jobId} failed.`, {\n            status: 0,\n            errorName: 'job_failed',\n          })\n\n        case 'pending':\n        case 'running':\n          break\n\n        default:\n          throw new CrawlbruleeError(\n            `Async scrape job ${jobId} returned unexpected status '${String(status.status)}'.`,\n            { status: 0, errorName: 'job_failed' }\n          )\n      }\n\n      await sleep(intervalMs, options.signal)\n    }\n  }\n\n  // ------------------------------------------------------------------\n  // Mapping\n  // ------------------------------------------------------------------\n\n  /**\n   * Build (or return a cached) site link-map for a domain. Combines sitemap\n   * discovery with the freshest cached homepage scrape when available.\n   */\n  map(request: MapRequest, options?: RequestOptions): Promise<MapResponse> {\n    return this.http.post<MapResponse>('/api/map', request, options)\n  }\n\n  // ------------------------------------------------------------------\n  // Account\n  // ------------------------------------------------------------------\n\n  /**\n   * Return the current billing-cycle usage: total/used/available credits,\n   * used quota percentage, max concurrency, and when the cycle resets.\n   */\n  usage(options?: RequestOptions): Promise<UsageResponse> {\n    return this.http.get<UsageResponse>('/api/usage', options)\n  }\n\n  /**\n   * Return the organization name and identifying details of the API token\n   * used to authenticate this request. Useful for confirming which key is in\n   * use before performing destructive operations.\n   */\n  whoami(options?: RequestOptions): Promise<WhoamiResponse> {\n    return this.http.get<WhoamiResponse>('/api/whoami', options)\n  }\n}\n\n/**\n * Defensive read of `process.env[name]`. Guards both the absence of `process`\n * (browser / edge runtimes) and Deno's permission throw on env access without\n * `--allow-env`.\n */\nfunction readEnv(name: string): string | undefined {\n  try {\n    if (typeof process === 'undefined' || !process.env) return undefined\n    const v = process.env[name]\n    return typeof v === 'string' && v.trim().length > 0 ? v.trim() : undefined\n  } catch {\n    return undefined\n  }\n}\n\nfunction assertNonEmptyJobId(jobId: string): void {\n  if (typeof jobId !== 'string' || jobId.trim().length === 0) {\n    throw new CrawlbruleeError('jobId must be a non-empty string.', {\n      status: 0,\n      errorName: null,\n    })\n  }\n}\n\nfunction throwIfAborted(signal: AbortSignal | undefined): void {\n  if (signal?.aborted) {\n    throw new CrawlbruleeError('Request aborted by caller.', {\n      status: 0,\n      errorName: 'client_closed_request',\n      cause: signal.reason,\n    })\n  }\n}\n\nfunction sleep(ms: number, signal: AbortSignal | undefined): Promise<void> {\n  return new Promise((resolve, reject) => {\n    const onAbort = () => {\n      clearTimeout(timer)\n      reject(\n        new CrawlbruleeError('Request aborted by caller.', {\n          status: 0,\n          errorName: 'client_closed_request',\n          cause: signal?.reason,\n        })\n      )\n    }\n    const timer = setTimeout(() => {\n      signal?.removeEventListener('abort', onAbort)\n      resolve()\n    }, ms)\n    if (signal) {\n      if (signal.aborted) {\n        clearTimeout(timer)\n        onAbort()\n        return\n      }\n      signal.addEventListener('abort', onAbort, { once: true })\n    }\n  })\n}\n","/**\n * Verification for async scrape completion webhooks.\n *\n * {@link verifyWebhookSignature} validates the signature crawlbrulee attaches to\n * every webhook delivery. It is a standalone, network-free helper built on Web\n * Crypto (`globalThis.crypto.subtle`) so it runs unchanged on Node.js 22+,\n * browsers, Bun, Deno, and edge runtimes — it never touches `node:crypto`.\n */\n\n/** HTTP header carrying the primary webhook signature (always present). */\nexport const WEBHOOK_SIGNATURE_HEADER = 'X-Cwbl-Signature'\n\n/**\n * HTTP header carrying a signature produced with the previous signing secret.\n * Present only during a signing-secret rotation grace window.\n */\nexport const WEBHOOK_SIGNATURE_ROTATED_HEADER = 'X-Cwbl-Signature-Rotated'\n\n/** HTTP header carrying the unique event id, useful for delivery de-duplication. */\nexport const WEBHOOK_EVENT_ID_HEADER = 'X-Cwbl-Event-Id'\n\n/** Default replay-protection window (seconds) applied to the signed timestamp. */\nexport const DEFAULT_WEBHOOK_TOLERANCE_SECONDS = 300\n\n/** Which signature header satisfied verification. */\nexport type WebhookSignatureSource = 'primary' | 'rotated'\n\n/**\n * Why a webhook signature failed to verify.\n *\n * - `missing_signature` — neither the primary nor the rotated header was present.\n * - `malformed_signature` — a header was present but not in the expected\n *   `t=<unix_seconds>,v1=<64_hex>` format.\n * - `timestamp_out_of_tolerance` — the signed timestamp drifted further from now\n *   than `toleranceSeconds` allows (replay protection).\n * - `signature_mismatch` — a well-formed, in-tolerance signature did not match\n *   the one computed from the payload and secret.\n */\nexport type WebhookVerificationFailureReason =\n  | 'missing_signature'\n  | 'malformed_signature'\n  | 'timestamp_out_of_tolerance'\n  | 'signature_mismatch'\n\n/** Result of {@link verifyWebhookSignature}. Verification failure is returned, not thrown. */\nexport type WebhookVerificationResult =\n  | { verified: true; signedWith: WebhookSignatureSource }\n  | { verified: false; reason: WebhookVerificationFailureReason }\n\n/** Options for {@link verifyWebhookSignature}. */\nexport interface VerifyWebhookSignatureOptions {\n  /**\n   * The raw request body, exactly as received. Pass the bytes/string the server\n   * signed — do NOT re-serialize parsed JSON, or the signature will not match.\n   */\n  payload: string | Uint8Array\n  /**\n   * The request headers. Accepts a fetch `Headers` instance or a plain object\n   * (Express/Node give lowercased keys, values possibly arrays). Lookup is\n   * case-insensitive.\n   */\n  headers: Headers | Record<string, string | string[] | undefined>\n  /** The current signing secret (`whsec_…`). */\n  secret: string\n  /**\n   * Replay-protection window in seconds. Defaults to\n   * {@link DEFAULT_WEBHOOK_TOLERANCE_SECONDS} (300). Pass `0` (or any falsy\n   * value) to disable the timestamp check entirely.\n   */\n  toleranceSeconds?: number\n}\n\nconst SIGNATURE_FORMAT = /^t=(\\d+),v1=([0-9a-f]{64})$/\n\ninterface ParsedSignature {\n  timestamp: number\n  signature: string\n}\n\n/**\n * Verify a crawlbrulee webhook signature against the primary and rotated\n * headers.\n *\n * The signing scheme matches the backend:\n * - the signed payload is `` `${t}.${rawBody}` `` where `t` is the unix-seconds\n *   integer from the header and `rawBody` is the raw request body,\n * - the signature is `HMAC-SHA256(secret, signedPayload)` as lowercase hex,\n * - the header value is `t=<unix_seconds>,v1=<64_hex>`.\n *\n * The supplied `secret` is tried against the primary header first, then the\n * rotated header (which the API emits during a signing-secret rotation grace\n * window). Whichever matches wins, and the result reports which header it was.\n *\n * This NEVER throws on a verification failure — failures are normal control\n * flow and are returned as `{ verified: false, reason }`.\n *\n * @example\n * ```ts\n * const result = await verifyWebhookSignature({\n *   payload: rawBody,\n *   headers: req.headers,\n *   secret: process.env.CRAWLBRULEE_WEBHOOK_SECRET!,\n * })\n * if (!result.verified) return res.status(400).end()\n * ```\n */\nexport async function verifyWebhookSignature(\n  options: VerifyWebhookSignatureOptions\n): Promise<WebhookVerificationResult> {\n  const { payload, headers, secret } = options\n  const toleranceSeconds = options.toleranceSeconds ?? DEFAULT_WEBHOOK_TOLERANCE_SECONDS\n\n  const primaryHeader = getHeader(headers, WEBHOOK_SIGNATURE_HEADER)\n  const rotatedHeader = getHeader(headers, WEBHOOK_SIGNATURE_ROTATED_HEADER)\n\n  if (primaryHeader === undefined && rotatedHeader === undefined) {\n    return { verified: false, reason: 'missing_signature' }\n  }\n\n  const nowSeconds = Math.floor(Date.now() / 1000)\n  const body = toBytes(payload)\n  const key = await importHmacKey(secret)\n\n  // Track the \"best\" failure reason so the result is informative: a real\n  // mismatch should win over a malformed sibling header. Order from least to\n  // most specific.\n  let failure: WebhookVerificationFailureReason = 'malformed_signature'\n\n  for (const source of ['primary', 'rotated'] as const) {\n    const raw = source === 'primary' ? primaryHeader : rotatedHeader\n    if (raw === undefined) continue\n\n    const parsed = parseSignatureHeader(raw)\n    if (!parsed) {\n      // A malformed header can't verify; keep looking at the other one.\n      continue\n    }\n\n    if (toleranceSeconds && Math.abs(nowSeconds - parsed.timestamp) > toleranceSeconds) {\n      failure = mostSpecificFailure(failure, 'timestamp_out_of_tolerance')\n      continue\n    }\n\n    const expected = await computeSignatureHex(key, parsed.timestamp, body)\n    if (constantTimeEqualHex(expected, parsed.signature)) {\n      return { verified: true, signedWith: source }\n    }\n\n    failure = mostSpecificFailure(failure, 'signature_mismatch')\n  }\n\n  return { verified: false, reason: failure }\n}\n\n/**\n * Rank verification failures so the returned reason reflects the most\n * actionable problem encountered across the two headers.\n */\nfunction mostSpecificFailure(\n  current: WebhookVerificationFailureReason,\n  candidate: WebhookVerificationFailureReason\n): WebhookVerificationFailureReason {\n  const rank: Record<WebhookVerificationFailureReason, number> = {\n    missing_signature: 0,\n    malformed_signature: 1,\n    timestamp_out_of_tolerance: 2,\n    signature_mismatch: 3,\n  }\n  return rank[candidate] > rank[current] ? candidate : current\n}\n\n/** Case-insensitive header lookup over `Headers` or a plain object. */\nfunction getHeader(\n  headers: Headers | Record<string, string | string[] | undefined>,\n  name: string\n): string | undefined {\n  if (typeof Headers !== 'undefined' && headers instanceof Headers) {\n    return headers.get(name) ?? undefined\n  }\n  const target = name.toLowerCase()\n  for (const key of Object.keys(headers)) {\n    if (key.toLowerCase() !== target) continue\n    const value = (headers as Record<string, string | string[] | undefined>)[key]\n    if (Array.isArray(value)) return value[0]\n    return value ?? undefined\n  }\n  return undefined\n}\n\nfunction parseSignatureHeader(value: string): ParsedSignature | null {\n  const match = SIGNATURE_FORMAT.exec(value.trim())\n  if (!match) return null\n  const timestamp = Number(match[1])\n  if (!Number.isSafeInteger(timestamp)) return null\n  return { timestamp, signature: match[2]! }\n}\n\nfunction toBytes(payload: string | Uint8Array): Uint8Array {\n  return typeof payload === 'string' ? new TextEncoder().encode(payload) : payload\n}\n\n/**\n * Web Crypto types, derived from the runtime global so we don't have to pull in\n * the DOM `lib` (the SDK compiles against `lib: ES2022` + `@types/node`).\n */\ntype SubtleCryptoLike = typeof globalThis.crypto.subtle\ntype CryptoKeyLike = Awaited<ReturnType<SubtleCryptoLike['importKey']>>\n\nfunction importHmacKey(secret: string): Promise<CryptoKeyLike> {\n  return getSubtle().importKey(\n    'raw',\n    new TextEncoder().encode(secret),\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['sign']\n  )\n}\n\nasync function computeSignatureHex(\n  key: CryptoKeyLike,\n  timestamp: number,\n  body: Uint8Array\n): Promise<string> {\n  const prefix = new TextEncoder().encode(`${timestamp}.`)\n  const message = new Uint8Array(prefix.length + body.length)\n  message.set(prefix, 0)\n  message.set(body, prefix.length)\n  const digest = await getSubtle().sign('HMAC', key, message)\n  return toHex(new Uint8Array(digest))\n}\n\nfunction toHex(bytes: Uint8Array): string {\n  let hex = ''\n  for (const byte of bytes) {\n    hex += byte.toString(16).padStart(2, '0')\n  }\n  return hex\n}\n\n/**\n * Length-checked, constant-time comparison of two lowercase hex strings. Folds\n * every byte into an accumulator with XOR — never early-returns on the first\n * mismatch — so timing does not leak how much of the signature matched.\n */\nfunction constantTimeEqualHex(a: string, b: string): boolean {\n  if (a.length !== b.length) return false\n  let diff = 0\n  for (let i = 0; i < a.length; i++) {\n    diff |= a.charCodeAt(i) ^ b.charCodeAt(i)\n  }\n  return diff === 0\n}\n\nfunction getSubtle(): SubtleCryptoLike {\n  const subtle = globalThis.crypto?.subtle\n  if (!subtle) {\n    throw new Error(\n      'Web Crypto (globalThis.crypto.subtle) is not available in this runtime. crawlbrulee webhook verification requires Node.js 22+, Bun, Deno, or a modern browser/edge runtime.'\n    )\n  }\n  return subtle\n}\n"],"mappings":";;;;;;;;AAKA,MAAa,mBAAmB;;AAGhC,MAAa,6BAA6B;;AAG1C,MAAa,cAAc;;AAG3B,MAAa,aAAa;;;;;;;;;;;;;;;;;;;;;ACW1B,IAAa,mBAAb,cAAsC,MAAM;;CAE1C,AAAS;;CAET,AAAS;;CAET,AAAS;;CAET,AAAS;CAET,YACE,SACA,SAOA;EACA,MAAM,SAAS,QAAQ,UAAU,SAAY,EAAE,OAAO,QAAQ,MAAM,IAAI,MAAS;EACjF,KAAK,OAAO;EACZ,KAAK,SAAS,QAAQ;EACtB,KAAK,YAAY,QAAQ;EACzB,KAAK,UAAU,QAAQ;EACvB,KAAK,WAAW,QAAQ;CAC1B;AACF;;AAGA,IAAa,sBAAb,cAAyC,iBAAiB;CACxD,YACE,SACA,SACA;EACA,MAAM,SAAS,OAAO;EACtB,KAAK,OAAO;CACd;AACF;;;;;;;;;;AAWA,IAAa,iBAAb,cAAoC,iBAAiB;CACnD,AAAkB;;CAElB,AAAS;;CAET,AAAS;CAET,YACE,SACA,SAKA;EACA,MAAM,SAAS;GAAE,GAAG;GAAS,WAAW;GAAqB,SAAS,QAAQ;EAAQ,CAAC;EACvF,KAAK,OAAO;EACZ,KAAK,YAAY;EACjB,KAAK,eAAe,QAAQ,SAAS;EACrC,KAAK,YAAY,QAAQ,SAAS;CACpC;AACF;;;;;;;AAQA,IAAa,uBAAb,cAA0C,iBAAiB;CACzD,AAAkB;;CAElB,AAAS;;CAET,AAAS;CAET,YACE,SACA,SAKA;EACA,MAAM,SAAS;GAAE,GAAG;GAAS,WAAW;EAAyB,CAAC;EAClE,KAAK,OAAO;EACZ,KAAK,YAAY;EACjB,KAAK,SAAS,QAAQ,QAAQ;EAC9B,KAAK,QAAQ,QAAQ,QAAQ;CAC/B;AACF;;AAGA,IAAa,kBAAb,cAAqC,iBAAiB;CACpD,YACE,SACA,SACA;EACA,MAAM,SAAS,OAAO;EACtB,KAAK,OAAO;CACd;AACF;;AAGA,IAAa,gBAAb,cAAmC,iBAAiB;CAClD,YACE,SACA,SACA;EACA,MAAM,SAAS,OAAO;EACtB,KAAK,OAAO;CACd;AACF;;;;;;;;;;AAWA,IAAa,0BAAb,cAA6C,iBAAiB;CAC5D,YACE,SACA,SACA;EACA,MAAM,SAAS,OAAO;EACtB,KAAK,OAAO;CACd;AACF;;;;;;;;;AAUA,IAAa,iBAAb,cAAoC,iBAAiB;CACnD,YACE,SACA,UAII,CAAC,GACL;EACA,MAAM,SAAS;GACb,QAAQ,QAAQ,UAAU;GAC1B,WAAW,QAAQ,aAAa;GAChC,OAAO,QAAQ;EACjB,CAAC;EACD,KAAK,OAAO;CACd;AACF;;AAGA,SAAgB,mBAAmB,KAAuC;CACxE,OAAO,eAAe;AACxB;;;;;;;;;;;AAYA,SAAgB,eAAe,MAAwB,QAAkC;CACvF,MAAM,EAAE,MAAM,SAAS,YAAY;CACnC,MAAM,WAAW;CAEjB,QAAQ,MAAR;EACE,KAAK,qBACH,OAAO,IAAI,eAAe,SAAS;GACjC;GACA,SAAS,SAAS,eAAe,sBAAsB,UAAU;GACjE;EACF,CAAC;EAEH,KAAK,0BAA0B;GAG7B,MAAM,eACJ,SAAS,eAAe,2BACpB,UACA;IAAE,YAAY;IAA0B,QAAQ;GAAiB;GACvE,OAAO,IAAI,qBAAqB,SAAS;IAAE;IAAQ,SAAS;IAAc;GAAS,CAAC;EACtF;EAEA,KAAK;EACL,KAAK,iBACH,OAAO,IAAI,oBAAoB,SAAS;GAAE;GAAQ,WAAW;GAAM;EAAS,CAAC;EAE/E,KAAK,aACH,OAAO,IAAI,cAAc,SAAS;GAAE;GAAQ,WAAW;GAAM;EAAS,CAAC;EAEzE,KAAK,uBACH,OAAO,IAAI,wBAAwB,SAAS;GAAE;GAAQ,WAAW;GAAM;EAAS,CAAC;EAEnF,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK,iCACH,OAAO,IAAI,gBAAgB,SAAS;GAAE;GAAQ,WAAW;GAAM;EAAS,CAAC;CAC7E;CAKA,IAAI,WAAW,KACb,OAAO,IAAI,eAAe,SAAS;EAAE;EAAQ;CAAS,CAAC;CAEzD,IAAI,WAAW,OAAO,WAAW,KAC/B,OAAO,IAAI,oBAAoB,SAAS;EAAE;EAAQ,WAAW;EAAM;CAAS,CAAC;CAE/E,IAAI,WAAW,KACb,OAAO,IAAI,cAAc,SAAS;EAAE;EAAQ,WAAW;EAAM;CAAS,CAAC;CAEzE,IAAI,WAAW,KACb,OAAO,IAAI,wBAAwB,SAAS;EAAE;EAAQ,WAAW;EAAM;CAAS,CAAC;CAGnF,OAAO,IAAI,iBAAiB,SAAS;EAAE;EAAQ,WAAW;EAAM;EAAS;CAAS,CAAC;AACrF;;;;;;;;;;;;;;AC5PA,MAAa,sBAAsB;;;;;CAKjC,WAAsB;EACpB,MAAM,IAAI;EACV,IAAI,OAAO,EAAE,UAAU,YACrB,MAAM,IAAI,iBACR,gIACA;GAAE,QAAQ;GAAG,WAAW;EAAK,CAC/B;EAEF,OAAO,EAAE,MAAM,KAAK,UAAU;CAChC;;;;;CAMA,aAAqB;EACnB,OAAO;CACT;AACF;;;;;;;;;;;;;;;;;;;;AC2BA,IAAa,aAAb,MAAwB;CACtB,AAAS;CACT,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAEjB,YAAY,SAA4B;EACtC,KAAK,UAAU,mBAAmB,QAAQ,WAAW,oBAAoB,WAAW,CAAC;EACrF,KAAK,SAAS,QAAQ;EACtB,KAAK,QAAQ,oBAAoB,SAAS;EAC1C,KAAK,YAAY,QAAQ;CAC3B;;CAGA,IAAO,MAAc,SAAsC;EACzD,OAAO,KAAK,KAAQ;GAAE,QAAQ;GAAO;GAAM,GAAG;EAAQ,CAAC;CACzD;;CAGA,KAAQ,MAAc,MAAe,SAAsC;EACzE,OAAO,KAAK,KAAQ;GAAE,QAAQ;GAAQ;GAAM;GAAM,GAAG;EAAQ,CAAC;CAChE;CAEA,MAAc,KAAQ,MAA4B;EAChD,MAAM,MAAM,KAAK,SAAS,KAAK,IAAI;EACnC,MAAM,UAAU,KAAK,aAAa,IAAI;EACtC,MAAM,OAAO,KAAK,SAAS,SAAY,SAAY,KAAK,UAAU,KAAK,IAAI;EAC3E,MAAM,WAAW,KAAK,cAAc,KAAK,QAAQ,KAAK,SAAS;EAE/D,IAAI;GACF,IAAI;GACJ,IAAI;IACF,MAAM,MAAM,KAAK,MAAM,KAAK;KAC1B,QAAQ,KAAK;KACb;KACA;KACA,QAAQ,SAAS;IACnB,CAAC;GACH,SAAS,OAAgB;IACvB,MAAM,oBAAoB,OAAO,SAAS,SAAS,GAAG,KAAK,aAAa,KAAK,SAAS;GACxF;GAEA,IAAI;GACJ,IAAI;IACF,OAAO,MAAM,IAAI,KAAK;GACxB,SAAS,OAAgB;IACvB,IAAI,aAAa,KAAK,GACpB,MAAM,oBAAoB,OAAO,SAAS,SAAS,GAAG,KAAK,aAAa,KAAK,SAAS;IAExF,MAAM,IAAI,eAAe,wCAAwC,IAAI,OAAO,KAAK;KAC/E,QAAQ,IAAI;KACZ;IACF,CAAC;GACH;GAEA,MAAM,SAAS,iBAAiB,MAAM,IAAI,MAAM;GAChD,IAAI,CAAC,IAAI,IAAI,MAAM,WAAW,QAAQ,IAAI,QAAQ,IAAI;GACtD,OAAO;EACT,UAAU;GACR,SAAS,QAAQ;EACnB;CACF;CAEA,AAAQ,SAAS,MAAsB;EACrC,IAAI,CAAC,KAAK,WAAW,GAAG,GACtB,MAAM,IAAI,UAAU,wDAAwD,KAAK,GAAG;EAEtF,OAAO,GAAG,KAAK,UAAU;CAC3B;CAEA,AAAQ,aAAa,MAAwC;EAC3D,MAAM,UAAkC;GACtC,QAAQ;GACR,cAAc;GACd,eAAe,UAAU,KAAK;EAChC;EACA,IAAI,KAAK,SAAS,QAAW,QAAQ,kBAAkB;EACvD,OAAO;CACT;;;;;;;CAQA,AAAQ,cACN,cACA,mBACgB;EAChB,MAAM,YAAY,qBAAqB,KAAK;EAC5C,MAAM,aAAa,OAAO,SAAS,SAAS,KAAK,YAAY;EAE7D,IAAI,CAAC,cAAc,CAAC,cAClB,OAAO;GAAE,QAAQ;GAAW,gBAAgB;GAAO,eAAe,CAAC;EAAE;EAGvE,IAAI,CAAC,YACH,OAAO;GAAE,QAAQ;GAAc,gBAAgB;GAAO,eAAe,CAAC;EAAE;EAG1E,MAAM,aAAa,IAAI,gBAAgB;EACvC,IAAI,aAAa;EACjB,MAAM,QAAQ,iBAAiB;GAC7B,aAAa;GACb,WAAW,sBAAM,IAAI,MAAM,iBAAiB,CAAC;EAC/C,GAAG,SAAS;EAEZ,IAAI;EACJ,IAAI,cACF,IAAI,aAAa,SAAS;GACxB,aAAa,KAAK;GAClB,WAAW,MAAM,aAAa,MAAM;EACtC,OAAO;GACL,sBAAsB;IACpB,aAAa,KAAK;IAClB,WAAW,MAAM,aAAa,MAAM;GACtC;GACA,aAAa,iBAAiB,SAAS,eAAe,EAAE,MAAM,KAAK,CAAC;EACtE;EAGF,MAAM,gBAAgB;GACpB,aAAa,KAAK;GAClB,IAAI,iBAAiB,cACnB,aAAa,oBAAoB,SAAS,aAAa;EAE3D;EAEA,OAAO;GAAE,QAAQ,WAAW;GAAQ,gBAAgB;GAAY;EAAQ;CAC1E;AACF;AAEA,SAAS,mBAAmB,KAAqB;CAC/C,OAAO,IAAI,QAAQ,QAAQ,EAAE;AAC/B;AAEA,SAAS,aAAa,KAAuB;CAC3C,OAAO,eAAe,SAAS,IAAI,SAAS;AAC9C;AAEA,SAAS,oBAAoB,OAAgB,UAAmB,WAAmC;CACjG,IAAI,aAAa,KAAK,GAAG;EACvB,IAAI,UACF,OAAO,IAAI,eAAe,2BAA2B,UAAU,MAAM;GACnE,WAAW;GACX;EACF,CAAC;EAEH,OAAO,IAAI,eAAe,8BAA8B;GACtD,WAAW;GACX;EACF,CAAC;CACH;CACA,OAAO,IAAI,eAAe,0BAA0B,KAAK,GAAG,EAAE,MAAM,CAAC;AACvE;AAEA,SAAS,0BAA0B,OAAwB;CACzD,IAAI,iBAAiB,OACnB,OAAO,kBAAkB,MAAM;CAEjC,OAAO;AACT;AAEA,SAAS,iBAAiB,MAAc,QAAyB;CAC/D,IAAI,SAAS,IAAI,OAAO,CAAC;CACzB,IAAI;EACF,OAAO,KAAK,MAAM,IAAI;CACxB,SAAS,OAAgB;EAEvB,MAAM,IAAI,eAAe,wCAAwC,OAAO,KADxD,KAAK,SAAS,MAAM,GAAG,KAAK,MAAM,GAAG,GAAG,EAAE,KAAK,QACyB;GACtF;GACA;EACF,CAAC;CACH;AACF;AAEA,SAAS,WAAW,QAAiB,QAAgB,SAAmC;CACtF,IAAI,mBAAmB,MAAM,GAC3B,OAAO,eAAe,QAAQ,MAAM;CAGtC,OAAO,IAAI,eAAe,QAAQ,OAAO,KADzB,QAAQ,SAAS,MAAM,GAAG,QAAQ,MAAM,GAAG,GAAG,EAAE,KAAK,YACb,kBAAkB,EAAE,OAAO,CAAC;AACtF;AAEA,SAAS,mBAAmB,OAA2C;CACrE,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU,OAAO;CACxD,MAAM,IAAI;CACV,OAAO,OAAO,EAAE,SAAS,YAAY,OAAO,EAAE,YAAY;AAC5D;;;;;;;;;;;;;;;;;;;;;;ACnLA,IAAa,cAAb,MAAa,YAAY;;CAEvB,AAAS;;CAET,AAAS;CAET,YAAY,SAA6B;EACvC,MAAM,SAAS,QAAQ,QAAQ,KAAK;EACpC,IAAI,CAAC,QACH,MAAM,IAAI,iBACR,yFAAyF,YAAY,IACrG;GAAE,QAAQ;GAAG,WAAW;EAAK,CAC/B;EAEF,KAAK,OAAO,IAAI,WAAW;GAAE;GAAQ,SAAS,QAAQ;GAAS,WAAW,QAAQ;EAAU,CAAC;EAC7F,KAAK,UAAU,KAAK,KAAK;CAC3B;;;;;;;;;;;;;;CAeA,OAAO,QAAQ,YAAgD,CAAC,GAAgB;EAC9E,MAAM,SAAS,QAAQ,WAAW;EAClC,IAAI,CAAC,QACH,MAAM,IAAI,iBACR,GAAG,YAAY,uFACf;GAAE,QAAQ;GAAG,WAAW;EAAK,CAC/B;EAEF,OAAO,IAAI,YAAY;GAAE,GAAG;GAAW;EAAO,CAAC;CACjD;;;;;;;;;;;CAgBA,OAAO,SAAwB,SAAmD;EAChF,OAAO,KAAK,KAAK,KAAqB,eAAe,SAAS,OAAO;CACvE;;;;;;;;;;CAWA,YAAY,SAA6B,SAAwD;EAC/F,OAAO,KAAK,KAAK,KAA0B,qBAAqB,SAAS,OAAO;CAClF;;CAGA,gBAAgB,OAAe,SAA2D;EACxF,oBAAoB,KAAK;EACzB,OAAO,KAAK,KAAK,IACf,sBAAsB,mBAAmB,KAAK,KAC9C,OACF;CACF;;;;;;CAOA,gBAAgB,OAAe,SAAmD;EAChF,oBAAoB,KAAK;EACzB,OAAO,KAAK,KAAK,IAAoB,sBAAsB,mBAAmB,KAAK,KAAK,OAAO;CACjG;;;;;;;;;;;;;;;;;;;CAoBA,MAAM,6BACJ,SACA,SACyB;EACzB,IAAI,SAAS,UAAU,mBACrB,MAAM,IAAI,iBACR,sDAAsD,OAAO,SAAS,KAAK,EAAE,KAC7E;GAAE,QAAQ;GAAG,WAAW;EAAmB,CAC7C;EAGF,MAAM,EAAE,QAAQ,OAAO,QAAQ,UAAU,QAAQ;EAEjD,QAAQ,QAAR;GACE,KAAK,WACH,OAAO,KAAK,gBAAgB,OAAO,OAAO;GAE5C,KAAK,UACH,MAAM,IAAI,iBAAiB,SAAS,oBAAoB,MAAM,WAAW;IACvE,QAAQ;IACR,WAAW;GACb,CAAC;GAEH,KAAK,aACH,MAAM,IAAI,iBAAiB,oBAAoB,MAAM,kBAAkB;IACrE,QAAQ;IACR,WAAW;GACb,CAAC;GAEH,SACE,MAAM,IAAI,iBACR,gCAAgC,MAAM,iCAAiC,OAAO,MAAM,EAAE,KACtF;IAAE,QAAQ;IAAG,WAAW;GAAmB,CAC7C;EACJ;CACF;;;;;;;;;;;CAYA,MAAM,cAAc,OAAe,UAAgC,CAAC,GAA4B;EAC9F,oBAAoB,KAAK;EACzB,MAAM,aAAa,QAAQ,cAAc;EACzC,MAAM,YAAY,QAAQ,aAAa;EACvC,MAAM,WAAW,YAAY,IAAI,KAAK,IAAI,IAAI,YAAY,OAAO;EAEjE,OAAO,MAAM;GACX,eAAe,QAAQ,MAAM;GAC7B,IAAI,KAAK,IAAI,KAAK,UAChB,MAAM,IAAI,iBACR,mBAAmB,UAAU,kCAAkC,MAAM,IACrE;IAAE,QAAQ;IAAG,WAAW;GAAkB,CAC5C;GAGF,MAAM,SAAS,MAAM,KAAK,gBAAgB,OAAO,EAAE,QAAQ,QAAQ,OAAO,CAAC;GAE3E,QAAQ,OAAO,QAAf;IACE,KAAK,QACH,OAAO,KAAK,gBAAgB,OAAO,EAAE,QAAQ,QAAQ,OAAO,CAAC;IAE/D,KAAK,UACH,MAAM,IAAI,iBAAiB,OAAO,SAAS,oBAAoB,MAAM,WAAW;KAC9E,QAAQ;KACR,WAAW;IACb,CAAC;IAEH,KAAK;IACL,KAAK,WACH;IAEF,SACE,MAAM,IAAI,iBACR,oBAAoB,MAAM,+BAA+B,OAAO,OAAO,MAAM,EAAE,KAC/E;KAAE,QAAQ;KAAG,WAAW;IAAa,CACvC;GACJ;GAEA,MAAM,MAAM,YAAY,QAAQ,MAAM;EACxC;CACF;;;;;CAUA,IAAI,SAAqB,SAAgD;EACvE,OAAO,KAAK,KAAK,KAAkB,YAAY,SAAS,OAAO;CACjE;;;;;CAUA,MAAM,SAAkD;EACtD,OAAO,KAAK,KAAK,IAAmB,cAAc,OAAO;CAC3D;;;;;;CAOA,OAAO,SAAmD;EACxD,OAAO,KAAK,KAAK,IAAoB,eAAe,OAAO;CAC7D;AACF;;;;;;AAOA,SAAS,QAAQ,MAAkC;CACjD,IAAI;EACF,IAAI,OAAO,YAAY,eAAe,CAAC,QAAQ,KAAK,OAAO;EAC3D,MAAM,IAAI,QAAQ,IAAI;EACtB,OAAO,OAAO,MAAM,YAAY,EAAE,KAAK,CAAC,CAAC,SAAS,IAAI,EAAE,KAAK,IAAI;CACnE,QAAQ;EACN;CACF;AACF;AAEA,SAAS,oBAAoB,OAAqB;CAChD,IAAI,OAAO,UAAU,YAAY,MAAM,KAAK,CAAC,CAAC,WAAW,GACvD,MAAM,IAAI,iBAAiB,qCAAqC;EAC9D,QAAQ;EACR,WAAW;CACb,CAAC;AAEL;AAEA,SAAS,eAAe,QAAuC;CAC7D,IAAI,QAAQ,SACV,MAAM,IAAI,iBAAiB,8BAA8B;EACvD,QAAQ;EACR,WAAW;EACX,OAAO,OAAO;CAChB,CAAC;AAEL;AAEA,SAAS,MAAM,IAAY,QAAgD;CACzE,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,MAAM,gBAAgB;GACpB,aAAa,KAAK;GAClB,OACE,IAAI,iBAAiB,8BAA8B;IACjD,QAAQ;IACR,WAAW;IACX,OAAO,QAAQ;GACjB,CAAC,CACH;EACF;EACA,MAAM,QAAQ,iBAAiB;GAC7B,QAAQ,oBAAoB,SAAS,OAAO;GAC5C,QAAQ;EACV,GAAG,EAAE;EACL,IAAI,QAAQ;GACV,IAAI,OAAO,SAAS;IAClB,aAAa,KAAK;IAClB,QAAQ;IACR;GACF;GACA,OAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;EAC1D;CACF,CAAC;AACH;;;;;;;;;;;;;ACtWA,MAAa,2BAA2B;;;;;AAMxC,MAAa,mCAAmC;;AAGhD,MAAa,0BAA0B;;AAGvC,MAAa,oCAAoC;AAkDjD,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCzB,eAAsB,uBACpB,SACoC;CACpC,MAAM,EAAE,SAAS,SAAS,WAAW;CACrC,MAAM,mBAAmB,QAAQ;CAEjC,MAAM,gBAAgB,UAAU,SAAS,wBAAwB;CACjE,MAAM,gBAAgB,UAAU,SAAS,gCAAgC;CAEzE,IAAI,kBAAkB,UAAa,kBAAkB,QACnD,OAAO;EAAE,UAAU;EAAO,QAAQ;CAAoB;CAGxD,MAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;CAC/C,MAAM,OAAO,QAAQ,OAAO;CAC5B,MAAM,MAAM,MAAM,cAAc,MAAM;CAKtC,IAAI,UAA4C;CAEhD,KAAK,MAAM,UAAU,CAAC,WAAW,SAAS,GAAY;EACpD,MAAM,MAAM,WAAW,YAAY,gBAAgB;EACnD,IAAI,QAAQ,QAAW;EAEvB,MAAM,SAAS,qBAAqB,GAAG;EACvC,IAAI,CAAC,QAEH;EAGF,IAAI,oBAAoB,KAAK,IAAI,aAAa,OAAO,SAAS,IAAI,kBAAkB;GAClF,UAAU,oBAAoB,SAAS,4BAA4B;GACnE;EACF;EAGA,IAAI,qBAAqB,MADF,oBAAoB,KAAK,OAAO,WAAW,IAAI,GACnC,OAAO,SAAS,GACjD,OAAO;GAAE,UAAU;GAAM,YAAY;EAAO;EAG9C,UAAU,oBAAoB,SAAS,oBAAoB;CAC7D;CAEA,OAAO;EAAE,UAAU;EAAO,QAAQ;CAAQ;AAC5C;;;;;AAMA,SAAS,oBACP,SACA,WACkC;CAClC,MAAM,OAAyD;EAC7D,mBAAmB;EACnB,qBAAqB;EACrB,4BAA4B;EAC5B,oBAAoB;CACtB;CACA,OAAO,KAAK,aAAa,KAAK,WAAW,YAAY;AACvD;;AAGA,SAAS,UACP,SACA,MACoB;CACpB,IAAI,OAAO,YAAY,eAAe,mBAAmB,SACvD,OAAO,QAAQ,IAAI,IAAI,KAAK;CAE9B,MAAM,SAAS,KAAK,YAAY;CAChC,KAAK,MAAM,OAAO,OAAO,KAAK,OAAO,GAAG;EACtC,IAAI,IAAI,YAAY,MAAM,QAAQ;EAClC,MAAM,QAAS,QAA0D;EACzE,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM;EACvC,OAAO,SAAS;CAClB;AAEF;AAEA,SAAS,qBAAqB,OAAuC;CACnE,MAAM,QAAQ,iBAAiB,KAAK,MAAM,KAAK,CAAC;CAChD,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,YAAY,OAAO,MAAM,EAAE;CACjC,IAAI,CAAC,OAAO,cAAc,SAAS,GAAG,OAAO;CAC7C,OAAO;EAAE;EAAW,WAAW,MAAM;CAAI;AAC3C;AAEA,SAAS,QAAQ,SAA0C;CACzD,OAAO,OAAO,YAAY,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,OAAO,IAAI;AAC3E;AASA,SAAS,cAAc,QAAwC;CAC7D,OAAO,UAAU,CAAC,CAAC,UACjB,OACA,IAAI,YAAY,CAAC,CAAC,OAAO,MAAM,GAC/B;EAAE,MAAM;EAAQ,MAAM;CAAU,GAChC,OACA,CAAC,MAAM,CACT;AACF;AAEA,eAAe,oBACb,KACA,WACA,MACiB;CACjB,MAAM,SAAS,IAAI,YAAY,CAAC,CAAC,OAAO,GAAG,UAAU,EAAE;CACvD,MAAM,UAAU,IAAI,WAAW,OAAO,SAAS,KAAK,MAAM;CAC1D,QAAQ,IAAI,QAAQ,CAAC;CACrB,QAAQ,IAAI,MAAM,OAAO,MAAM;CAC/B,MAAM,SAAS,MAAM,UAAU,CAAC,CAAC,KAAK,QAAQ,KAAK,OAAO;CAC1D,OAAO,MAAM,IAAI,WAAW,MAAM,CAAC;AACrC;AAEA,SAAS,MAAM,OAA2B;CACxC,IAAI,MAAM;CACV,KAAK,MAAM,QAAQ,OACjB,OAAO,KAAK,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG;CAE1C,OAAO;AACT;;;;;;AAOA,SAAS,qBAAqB,GAAW,GAAoB;CAC3D,IAAI,EAAE,WAAW,EAAE,QAAQ,OAAO;CAClC,IAAI,OAAO;CACX,KAAK,IAAI,IAAI,GAAG,IAAI,EAAE,QAAQ,KAC5B,QAAQ,EAAE,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC;CAE1C,OAAO,SAAS;AAClB;AAEA,SAAS,YAA8B;CACrC,MAAM,SAAS,WAAW,QAAQ;CAClC,IAAI,CAAC,QACH,MAAM,IAAI,MACR,6KACF;CAEF,OAAO;AACT"}
+{"version":3,"file":"index.cjs","names":[],"sources":["../src/config.ts","../src/errors.ts","../src/instrumentation.ts","../src/http.ts","../src/client.ts","../src/webhooks.ts"],"sourcesContent":["/**\n * Production base URL of the crawlbrulee API. Used by default when the caller\n * doesn't pass a `baseUrl` to {@link Crawlbrulee}. Local development and\n * staging callers point at their own host via that option.\n */\nexport const DEFAULT_BASE_URL = 'https://api.crawlbrulee.com'\n\n/** Default request timeout when the caller doesn't specify one (0 disables the timeout). */\nexport const DEFAULT_REQUEST_TIMEOUT_MS = 0\n\n/** Environment variable read by `Crawlbrulee.fromEnv()` to source the API key. */\nexport const ENV_API_KEY = 'CRAWLBRULEE_API_KEY'\n\n/** Identifies the SDK in the `User-Agent` header. Kept in one place for easy bumping. */\nexport const USER_AGENT = '@crawlbrulee/sdk/0.14.0 (node)'\n","import type {\n  ApiErrorDetails,\n  ApiErrorName,\n  ApiErrorResponse,\n  RateLimitErrorDetails,\n  UsageAllocationErrorDetails,\n} from './types/common.js'\n\n/**\n * Base error class for every failure raised by the SDK.\n *\n * Two kinds of failures end up here:\n *\n * 1. **API errors** — the server returned a non-2xx response with a well-formed\n *    JSON body. In that case `status`, `errorName` and (sometimes) `details`\n *    are populated.\n * 2. **Transport errors** — the request never produced a structured response\n *    (network failure, abort, timeout, non-JSON body, etc.). In that case\n *    `status` may be `0` and `errorName` is one of the synthetic transport\n *    names (`request_timeout`, `client_closed_request`) or `null`.\n *\n * Typed subclasses are exported for the most common cases. To branch on more\n * specific server-side errors, switch on `err.errorName` or use the\n * {@link isCrawlbruleeError} helper.\n */\nexport class CrawlbruleeError extends Error {\n  /** HTTP status code; `0` for transport-level failures with no response. */\n  readonly status: number\n  /** The `name` field from the API error body, or `null` for transport errors. */\n  readonly errorName: ApiErrorName | null\n  /** Structured detail block from the API error body, if any. */\n  readonly details?: ApiErrorDetails\n  /** The original parsed error body, when one was received. */\n  readonly response?: ApiErrorResponse\n\n  constructor(\n    message: string,\n    options: {\n      status: number\n      errorName: ApiErrorName | null\n      details?: ApiErrorDetails\n      response?: ApiErrorResponse\n      cause?: unknown\n    }\n  ) {\n    super(message, options.cause !== undefined ? { cause: options.cause } : undefined)\n    this.name = 'CrawlbruleeError'\n    this.status = options.status\n    this.errorName = options.errorName\n    this.details = options.details\n    this.response = options.response\n  }\n}\n\n/**\n * Raised when the API rejects your credentials — a missing, invalid, or\n * unauthorized API key (`invalid_credentials`, `access_denied`).\n *\n * Not every 403 is a key problem: a 403 carrying `antibot_blocked` is the\n * *target site* blocking us and raises {@link AntibotBlockedError} instead.\n * Only an unrecognized 403 name falls back to this class.\n */\nexport class AuthenticationError extends CrawlbruleeError {\n  constructor(\n    message: string,\n    options: { status: number; errorName: ApiErrorName; response?: ApiErrorResponse }\n  ) {\n    super(message, options)\n    this.name = 'AuthenticationError'\n  }\n}\n\n/**\n * Raised when the target site's anti-bot protection blocked the request\n * (HTTP 403, `antibot_blocked`). Not an API-key problem — retrying the same\n * tier rarely helps; try a higher proxy tier or skip the site.\n */\nexport class AntibotBlockedError extends CrawlbruleeError {\n  constructor(\n    message: string,\n    options: { status: number; errorName: ApiErrorName; response?: ApiErrorResponse }\n  ) {\n    super(message, options)\n    this.name = 'AntibotBlockedError'\n  }\n}\n\n/**\n * Raised when the target site redirected the request in a loop, or through\n * more hops than the API follows (HTTP 422, `too_many_redirects`). Like\n * {@link AntibotBlockedError} this is the target's doing — not a key problem\n * and not a bad request — so it is neither an `AuthenticationError` nor a\n * `ValidationError`. Retrying rarely helps. Returned by both `scrape` and `map`.\n */\nexport class TooManyRedirectsError extends CrawlbruleeError {\n  constructor(\n    message: string,\n    options: { status: number; errorName: ApiErrorName; response?: ApiErrorResponse }\n  ) {\n    super(message, options)\n    this.name = 'TooManyRedirectsError'\n  }\n}\n\n/**\n * Raised when the page's HTML was too large to process (HTTP 422,\n * `page_too_large`). Like {@link TooManyRedirectsError} this is about the page,\n * not your request — so it is neither an `AuthenticationError` nor a\n * `ValidationError`. It is terminal: the same URL fails the same way, so do not\n * retry it. Returned by `scrape`.\n */\nexport class PageTooLargeError extends CrawlbruleeError {\n  constructor(\n    message: string,\n    options: { status: number; errorName: ApiErrorName; response?: ApiErrorResponse }\n  ) {\n    super(message, options)\n    this.name = 'PageTooLargeError'\n  }\n}\n\n/**\n * Raised for HTTP 429 responses. When the server included a `retry_after_ms`\n * hint in `details` it is surfaced directly on the instance.\n *\n * `errorName` is always the literal `'too_many_requests'` — the SDK normalizes\n * this even when the server returns a 429 with a different `name` field\n * (e.g. a CDN coalescing upstream rate limiting). The original body is still\n * available on `response`.\n */\nexport class RateLimitError extends CrawlbruleeError {\n  override readonly errorName: 'too_many_requests'\n  /** Suggested delay (ms) before retrying, when the server provided one. */\n  readonly retryAfterMs?: number\n  /** Which rate limit was tripped (e.g. `org`, `ip`), when provided. */\n  readonly limitedBy?: string\n\n  constructor(\n    message: string,\n    options: {\n      status: number\n      details?: RateLimitErrorDetails\n      response?: ApiErrorResponse\n    }\n  ) {\n    super(message, { ...options, errorName: 'too_many_requests', details: options.details })\n    this.name = 'RateLimitError'\n    this.errorName = 'too_many_requests'\n    this.retryAfterMs = options.details?.retry_after_ms\n    this.limitedBy = options.details?.limited_by\n  }\n}\n\n/**\n * Raised when the API rejects a request because the org's plan limits would\n * be exceeded (credit limit, concurrency cap, overage hard cap, etc.).\n *\n * `errorName` is always the literal `'usage_allocation_error'`.\n */\nexport class UsageAllocationError extends CrawlbruleeError {\n  override readonly errorName: 'usage_allocation_error'\n  /** Specific reason the allocation was denied. */\n  readonly reason: UsageAllocationErrorDetails['reason']\n  /** Current usage / limit snapshot at the time of the rejection. */\n  readonly usage?: UsageAllocationErrorDetails['details']\n\n  constructor(\n    message: string,\n    options: {\n      status: number\n      details: UsageAllocationErrorDetails\n      response?: ApiErrorResponse\n    }\n  ) {\n    super(message, { ...options, errorName: 'usage_allocation_error' })\n    this.name = 'UsageAllocationError'\n    this.errorName = 'usage_allocation_error'\n    this.reason = options.details.reason\n    this.usage = options.details.details\n  }\n}\n\n/** Raised for 4xx responses caused by an invalid request shape or arguments. */\nexport class ValidationError extends CrawlbruleeError {\n  constructor(\n    message: string,\n    options: { status: number; errorName: ApiErrorName; response?: ApiErrorResponse }\n  ) {\n    super(message, options)\n    this.name = 'ValidationError'\n  }\n}\n\n/** Raised for 404 responses (e.g. unknown async job ID). */\nexport class NotFoundError extends CrawlbruleeError {\n  constructor(\n    message: string,\n    options: { status: number; errorName: ApiErrorName; response?: ApiErrorResponse }\n  ) {\n    super(message, options)\n    this.name = 'NotFoundError'\n  }\n}\n\n/**\n * Raised for 503 responses — the API could not serve the request right now\n * (a transient infrastructure failure, not a problem with your request).\n *\n * This is **retryable**: back off and try again. In particular it is not an\n * authentication failure, so it is never a reason to rotate your API key —\n * a genuinely bad or expired key still comes back as a 401\n * (`invalid_credentials`) and raises {@link AuthenticationError}.\n */\nexport class ServiceUnavailableError extends CrawlbruleeError {\n  constructor(\n    message: string,\n    options: { status: number; errorName: ApiErrorName; response?: ApiErrorResponse }\n  ) {\n    super(message, options)\n    this.name = 'ServiceUnavailableError'\n  }\n}\n\n/**\n * Raised when a request cannot be sent or no structured response is parsed.\n *\n * The `errorName` discriminates the cause:\n * - `'request_timeout'` — the per-request timeout fired.\n * - `'client_closed_request'` — the caller's `AbortSignal` fired.\n * - `null` — generic transport failure (network error, non-JSON body, etc.).\n */\nexport class TransportError extends CrawlbruleeError {\n  constructor(\n    message: string,\n    options: {\n      status?: number\n      errorName?: 'request_timeout' | 'client_closed_request' | null\n      cause?: unknown\n    } = {}\n  ) {\n    super(message, {\n      status: options.status ?? 0,\n      errorName: options.errorName ?? null,\n      cause: options.cause,\n    })\n    this.name = 'TransportError'\n  }\n}\n\n/** Narrow `unknown` to the SDK's base error type. */\nexport function isCrawlbruleeError(err: unknown): err is CrawlbruleeError {\n  return err instanceof CrawlbruleeError\n}\n\n/**\n * Map an API error body + HTTP status to the most specific error class.\n *\n * Dispatch is **name-first**: the body's `name` field is the most reliable\n * signal of what went wrong. Status code is used only as a fallback when the\n * name is unrecognized (e.g. a CDN-synthesized error). This avoids\n * miscategorizing things like a 403 with `name: 'not_found'` as an auth error.\n *\n * Internal — used by the HTTP layer.\n */\nexport function createApiError(body: ApiErrorResponse, status: number): CrawlbruleeError {\n  const { name, message, details } = body\n  const response = body\n\n  switch (name) {\n    case 'too_many_requests':\n      return new RateLimitError(message, {\n        status,\n        details: details?.error_name === 'too_many_requests' ? details : undefined,\n        response,\n      })\n\n    case 'usage_allocation_error': {\n      // Without a structured details block we still want a typed error — fall\n      // back to a synthetic `internal_error` reason so callers can branch.\n      const usageDetails: UsageAllocationErrorDetails =\n        details?.error_name === 'usage_allocation_error'\n          ? details\n          : { error_name: 'usage_allocation_error', reason: 'internal_error' }\n      return new UsageAllocationError(message, { status, details: usageDetails, response })\n    }\n\n    case 'antibot_blocked':\n      return new AntibotBlockedError(message, { status, errorName: name, response })\n\n    case 'too_many_redirects':\n      return new TooManyRedirectsError(message, { status, errorName: name, response })\n\n    case 'page_too_large':\n      return new PageTooLargeError(message, { status, errorName: name, response })\n\n    case 'invalid_credentials':\n    case 'access_denied':\n      return new AuthenticationError(message, { status, errorName: name, response })\n\n    case 'not_found':\n      return new NotFoundError(message, { status, errorName: name, response })\n\n    case 'service_unavailable':\n      return new ServiceUnavailableError(message, { status, errorName: name, response })\n\n    case 'validation_error':\n    case 'invalid_url':\n    case 'url_too_long':\n    case 'unsupported_url_schema':\n    case 'url_credentials_not_supported':\n    case 'blocked_url':\n    case 'unsupported_content':\n    case 'unsupported_screenshot_output':\n      return new ValidationError(message, { status, errorName: name, response })\n  }\n\n  // Name was not specific enough — fall back to status-based heuristics, but\n  // never override what the name said. A 429 with an unrecognized name still\n  // promotes to RateLimitError (the class invariant normalizes errorName).\n  if (status === 429) {\n    return new RateLimitError(message, { status, response })\n  }\n  if (status === 401 || status === 403) {\n    return new AuthenticationError(message, { status, errorName: name, response })\n  }\n  if (status === 404) {\n    return new NotFoundError(message, { status, errorName: name, response })\n  }\n  if (status === 503) {\n    return new ServiceUnavailableError(message, { status, errorName: name, response })\n  }\n\n  return new CrawlbruleeError(message, { status, errorName: name, details, response })\n}\n","import { DEFAULT_BASE_URL } from './config.js'\nimport { CrawlbruleeError } from './errors.js'\n\n/** Function shape compatible with the global `fetch`. */\nexport type FetchLike = typeof fetch\n\n/**\n * Centralized factory for the low-level dependencies the SDK injects into its\n * HTTP layer. Production code resolves these to the runtime's global `fetch`\n * and the burned-in production base URL; tests stub this module to swap in\n * mocks and alternate hosts.\n *\n * This is internal — it is not exported from the package's public entry. Tests\n * import it from `src/instrumentation.js` directly and use `vi.spyOn` to\n * substitute behavior.\n */\nexport const CwblInstrumentation = {\n  /**\n   * Resolve the `fetch` implementation the SDK should use. Throws a\n   * {@link CrawlbruleeError} if the runtime does not expose a global `fetch`.\n   */\n  getFetch(): FetchLike {\n    const g = globalThis as { fetch?: FetchLike }\n    if (typeof g.fetch !== 'function') {\n      throw new CrawlbruleeError(\n        'No global fetch is available in this runtime. crawlbrulee requires Node.js 22+, Bun, Deno, or a modern browser/edge runtime.',\n        { status: 0, errorName: null }\n      )\n    }\n    return g.fetch.bind(globalThis)\n  },\n\n  /**\n   * Resolve the base URL the SDK should target. Returns the production host by\n   * default; tests stub this to point at a mock origin.\n   */\n  getBaseUrl(): string {\n    return DEFAULT_BASE_URL\n  },\n}\n","import { DEFAULT_REQUEST_TIMEOUT_MS, USER_AGENT } from './config.js'\nimport { TransportError, createApiError, type CrawlbruleeError } from './errors.js'\nimport { CwblInstrumentation, type FetchLike } from './instrumentation.js'\nimport type { ApiErrorResponse } from './types/common.js'\n\n/** HTTP methods used by the SDK. */\nexport type HttpMethod = 'GET' | 'POST'\n\n/** Options the SDK accepts at construction time for the HTTP layer. */\nexport interface HttpClientOptions {\n  /** API key sent as `Authorization: Bearer <key>`. */\n  apiKey: string\n  /**\n   * Override the base URL. Trailing slashes are stripped. Falls back to\n   * {@link CwblInstrumentation.getBaseUrl} (which resolves to the production\n   * host) when unset.\n   */\n  baseUrl?: string\n  /**\n   * Per-request timeout in milliseconds. Pass `0` (or omit) to disable the\n   * timeout entirely.\n   */\n  timeoutMs?: number\n}\n\n/** Per-call overrides accepted on every resource method. */\nexport interface RequestOptions {\n  /** Abort the request when this signal fires. Composable with the timeout. */\n  signal?: AbortSignal\n  /**\n   * Override the constructor-level `timeoutMs` for this call. Pass `0` to\n   * disable the timeout for this call.\n   */\n  timeoutMs?: number\n}\n\ninterface SendArgs extends RequestOptions {\n  method: HttpMethod\n  path: string\n  body?: unknown\n}\n\ninterface ComposedSignal {\n  signal: AbortSignal | undefined\n  /** Returns `true` if the abort was triggered by the per-request timeout. */\n  timedOut: () => boolean\n  /** Releases the timer and any listeners attached to the caller's signal. */\n  cleanup: () => void\n}\n\n/**\n * Minimal `fetch`-based HTTP layer used by {@link Crawlbrulee}. Handles:\n *\n * - URL composition (joining `baseUrl` and path safely).\n * - JSON serialization and parsing.\n * - The `Authorization: Bearer …` header.\n * - Composing the caller's `AbortSignal` with an internal timeout signal. The\n *   timeout covers the WHOLE request, including the response body read — not\n *   just the time-to-headers.\n * - Mapping non-2xx responses to typed `CrawlbruleeError` subclasses via\n *   {@link createApiError}.\n *\n * The base URL and `fetch` implementation are sourced from\n * {@link CwblInstrumentation} at construction time so tests can stub the\n * module.\n */\nexport class HttpClient {\n  readonly baseUrl: string\n  private readonly apiKey: string\n  private readonly fetch: FetchLike\n  private readonly timeoutMs: number\n\n  constructor(options: HttpClientOptions) {\n    this.baseUrl = stripTrailingSlash(options.baseUrl ?? CwblInstrumentation.getBaseUrl())\n    this.apiKey = options.apiKey\n    this.fetch = CwblInstrumentation.getFetch()\n    this.timeoutMs = options.timeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS\n  }\n\n  /** Send a `GET` request and parse the response as `T`. */\n  get<T>(path: string, options?: RequestOptions): Promise<T> {\n    return this.send<T>({ method: 'GET', path, ...options })\n  }\n\n  /** Send a `POST` request with a JSON body and parse the response as `T`. */\n  post<T>(path: string, body: unknown, options?: RequestOptions): Promise<T> {\n    return this.send<T>({ method: 'POST', path, body, ...options })\n  }\n\n  private async send<T>(args: SendArgs): Promise<T> {\n    const url = this.buildUrl(args.path)\n    const headers = this.buildHeaders(args)\n    const body = args.body === undefined ? undefined : JSON.stringify(args.body)\n    const composed = this.composeSignal(args.signal, args.timeoutMs)\n\n    try {\n      let res: Response\n      try {\n        res = await this.fetch(url, {\n          method: args.method,\n          headers,\n          body,\n          signal: composed.signal,\n        })\n      } catch (cause: unknown) {\n        throw abortOrNetworkError(cause, composed.timedOut(), args.timeoutMs ?? this.timeoutMs)\n      }\n\n      let text: string\n      try {\n        text = await res.text()\n      } catch (cause: unknown) {\n        if (isAbortError(cause)) {\n          throw abortOrNetworkError(cause, composed.timedOut(), args.timeoutMs ?? this.timeoutMs)\n        }\n        throw new TransportError(`Failed to read response body (status ${res.status}).`, {\n          status: res.status,\n          cause,\n        })\n      }\n\n      const parsed = parseJsonOrThrow(text, res.status)\n      if (!res.ok) throw toApiError(parsed, res.status, text)\n      return parsed as T\n    } finally {\n      composed.cleanup()\n    }\n  }\n\n  private buildUrl(path: string): string {\n    if (!path.startsWith('/')) {\n      throw new TypeError(`crawlbrulee SDK: path must start with '/' (received '${path}')`)\n    }\n    return `${this.baseUrl}${path}`\n  }\n\n  private buildHeaders(args: SendArgs): Record<string, string> {\n    const headers: Record<string, string> = {\n      accept: 'application/json',\n      'user-agent': USER_AGENT,\n      authorization: `Bearer ${this.apiKey}`,\n    }\n    if (args.body !== undefined) headers['content-type'] = 'application/json'\n    return headers\n  }\n\n  /**\n   * Build a single `AbortSignal` that fires when either the caller-supplied\n   * signal aborts OR the per-request timeout elapses. The returned `cleanup`\n   * callback MUST be invoked on every exit path so we don't leak timers or\n   * dead listeners on long-lived caller signals.\n   */\n  private composeSignal(\n    callerSignal: AbortSignal | undefined,\n    overrideTimeoutMs: number | undefined\n  ): ComposedSignal {\n    const timeoutMs = overrideTimeoutMs ?? this.timeoutMs\n    const hasTimeout = Number.isFinite(timeoutMs) && timeoutMs > 0\n\n    if (!hasTimeout && !callerSignal) {\n      return { signal: undefined, timedOut: () => false, cleanup: () => {} }\n    }\n\n    if (!hasTimeout) {\n      return { signal: callerSignal, timedOut: () => false, cleanup: () => {} }\n    }\n\n    const controller = new AbortController()\n    let didTimeout = false\n    const timer = setTimeout(() => {\n      didTimeout = true\n      controller.abort(new Error('request_timeout'))\n    }, timeoutMs)\n\n    let onCallerAbort: (() => void) | undefined\n    if (callerSignal) {\n      if (callerSignal.aborted) {\n        clearTimeout(timer)\n        controller.abort(callerSignal.reason)\n      } else {\n        onCallerAbort = () => {\n          clearTimeout(timer)\n          controller.abort(callerSignal.reason)\n        }\n        callerSignal.addEventListener('abort', onCallerAbort, { once: true })\n      }\n    }\n\n    const cleanup = () => {\n      clearTimeout(timer)\n      if (onCallerAbort && callerSignal) {\n        callerSignal.removeEventListener('abort', onCallerAbort)\n      }\n    }\n\n    return { signal: controller.signal, timedOut: () => didTimeout, cleanup }\n  }\n}\n\nfunction stripTrailingSlash(url: string): string {\n  return url.replace(/\\/+$/, '')\n}\n\nfunction isAbortError(err: unknown): boolean {\n  return err instanceof Error && err.name === 'AbortError'\n}\n\nfunction abortOrNetworkError(cause: unknown, timedOut: boolean, timeoutMs: number): TransportError {\n  if (isAbortError(cause)) {\n    if (timedOut) {\n      return new TransportError(`Request timed out after ${timeoutMs}ms.`, {\n        errorName: 'request_timeout',\n        cause,\n      })\n    }\n    return new TransportError('Request aborted by caller.', {\n      errorName: 'client_closed_request',\n      cause,\n    })\n  }\n  return new TransportError(formatNetworkErrorMessage(cause), { cause })\n}\n\nfunction formatNetworkErrorMessage(cause: unknown): string {\n  if (cause instanceof Error) {\n    return `Network error: ${cause.message}`\n  }\n  return 'Network error: unknown failure while sending the request.'\n}\n\nfunction parseJsonOrThrow(text: string, status: number): unknown {\n  if (text === '') return {}\n  try {\n    return JSON.parse(text)\n  } catch (cause: unknown) {\n    const preview = text.length > 200 ? `${text.slice(0, 200)}…` : text\n    throw new TransportError(`Unexpected non-JSON response (status ${status}): ${preview}`, {\n      status,\n      cause,\n    })\n  }\n}\n\nfunction toApiError(parsed: unknown, status: number, rawText: string): CrawlbruleeError {\n  if (isApiErrorResponse(parsed)) {\n    return createApiError(parsed, status)\n  }\n  const preview = rawText.length > 200 ? `${rawText.slice(0, 200)}…` : rawText\n  return new TransportError(`HTTP ${status}: ${preview || '(empty body)'}`, { status })\n}\n\nfunction isApiErrorResponse(value: unknown): value is ApiErrorResponse {\n  if (value === null || typeof value !== 'object') return false\n  const v = value as Record<string, unknown>\n  return typeof v.name === 'string' && typeof v.message === 'string'\n}\n","import { ENV_API_KEY } from './config.js'\nimport { CrawlbruleeError } from './errors.js'\nimport { HttpClient, type RequestOptions } from './http.js'\nimport type {\n  AsyncJobStatusResponse,\n  AsyncScrapeRequest,\n  AsyncScrapeResponse,\n  MapRequest,\n  MapResponse,\n  ScrapeCompleteWebhook,\n  ScrapeRequest,\n  ScrapeResponse,\n  UsageResponse,\n  WhoamiResponse,\n} from './types/index.js'\n\n/** Options accepted by the {@link Crawlbrulee} constructor. */\nexport interface CrawlbruleeOptions {\n  /**\n   * API key sent as `Authorization: Bearer <key>`. Required — to read from the\n   * environment instead, use {@link Crawlbrulee.fromEnv}. Leading and trailing\n   * whitespace is stripped; an empty / whitespace-only value is rejected.\n   */\n  apiKey: string\n  /**\n   * Override the base URL the SDK targets. Defaults to the production host\n   * ({@link DEFAULT_BASE_URL}). Intended for local development and staging\n   * (e.g. `https://api.<staging-domain>`) — production callers should\n   * leave it unset. Trailing slashes are stripped.\n   */\n  baseUrl?: string\n  /**\n   * Per-request timeout in milliseconds. Defaults to `0` (no timeout). Set to a\n   * positive number to abort slow requests; a per-call `timeoutMs` override\n   * takes precedence. The timeout covers the WHOLE request, including the\n   * response body read.\n   */\n  timeoutMs?: number\n}\n\n/**\n * Options accepted by {@link Crawlbrulee.waitForScrape}.\n *\n * Note: `timeoutMs` here is the OVERALL wait budget across all polls — not the\n * per-HTTP-request timeout. The per-poll HTTP timeout is whatever the client\n * was constructed with; if you want to bound each individual poll, construct\n * the client with `timeoutMs` set.\n */\nexport interface WaitForScrapeOptions extends Omit<RequestOptions, 'timeoutMs'> {\n  /** Time between status polls in milliseconds. Default `2000`. */\n  intervalMs?: number\n  /**\n   * Maximum total time to wait before giving up, in milliseconds. Default\n   * `300_000` (5 minutes). Pass `0` to wait indefinitely.\n   */\n  timeoutMs?: number\n}\n\n/**\n * Official client for the crawlbrulee API.\n *\n * @example\n * ```ts\n * import { Crawlbrulee } from '@crawlbrulee/sdk'\n *\n * const crawlbrulee = new Crawlbrulee({ apiKey: 'cwbl_…' })\n * // or read CRAWLBRULEE_API_KEY from the environment:\n * const crawlbrulee = Crawlbrulee.fromEnv()\n *\n * const page = await crawlbrulee.scrape({\n *   url: 'https://example.com',\n *   extract: { markdown: true, links: true },\n * })\n * console.log(page.markdown)\n * ```\n */\nexport class Crawlbrulee {\n  /** Resolved base URL — trailing slash already stripped. */\n  readonly baseUrl: string\n  /** Underlying HTTP layer. Exposed for advanced use cases (custom endpoints). */\n  readonly http: HttpClient\n\n  constructor(options: CrawlbruleeOptions) {\n    const apiKey = options.apiKey?.trim()\n    if (!apiKey) {\n      throw new CrawlbruleeError(\n        `Missing API key. Pass { apiKey } to Crawlbrulee or call Crawlbrulee.fromEnv() to read ${ENV_API_KEY}.`,\n        { status: 0, errorName: null }\n      )\n    }\n    this.http = new HttpClient({ apiKey, baseUrl: options.baseUrl, timeoutMs: options.timeoutMs })\n    this.baseUrl = this.http.baseUrl\n  }\n\n  /**\n   * Build a {@link Crawlbrulee} reading the API key from\n   * `process.env.CRAWLBRULEE_API_KEY`. Throws if the variable is unset, empty,\n   * or whitespace.\n   *\n   * Any other constructor option can be passed via `overrides`.\n   *\n   * @example\n   * ```ts\n   * const crawlbrulee = Crawlbrulee.fromEnv()\n   * const crawlbrulee = Crawlbrulee.fromEnv({ timeoutMs: 30_000 })\n   * ```\n   */\n  static fromEnv(overrides: Omit<CrawlbruleeOptions, 'apiKey'> = {}): Crawlbrulee {\n    const apiKey = readEnv(ENV_API_KEY)\n    if (!apiKey) {\n      throw new CrawlbruleeError(\n        `${ENV_API_KEY} is not set. Export it in your shell, or pass apiKey to new Crawlbrulee({ apiKey }).`,\n        { status: 0, errorName: null }\n      )\n    }\n    return new Crawlbrulee({ ...overrides, apiKey })\n  }\n\n  // ------------------------------------------------------------------\n  // Scraping\n  // ------------------------------------------------------------------\n\n  /**\n   * Scrape a URL synchronously and return the extracted content.\n   *\n   * The request blocks until the scrape is finished. For long-running jobs\n   * (heavy JS rendering, screenshots of long pages) prefer\n   * {@link Crawlbrulee.scrapeAsync} so the connection isn't held open.\n   *\n   * @param request — body for `POST /api/scrape`.\n   * @param options — per-call timeout and abort signal.\n   */\n  scrape(request: ScrapeRequest, options?: RequestOptions): Promise<ScrapeResponse> {\n    return this.http.post<ScrapeResponse>('/api/scrape', request, options)\n  }\n\n  /**\n   * Submit an asynchronous scrape job and return its `job_id`. Poll the job\n   * with {@link Crawlbrulee.getScrapeStatus} or wait for completion with\n   * {@link Crawlbrulee.waitForScrape}.\n   *\n   * Pass an optional `webhook` to have the API deliver a signed\n   * `scrape.complete` `POST` to your endpoint when the job finishes (see\n   * {@link AsyncScrapeWebhook}). This field is async-only.\n   */\n  scrapeAsync(request: AsyncScrapeRequest, options?: RequestOptions): Promise<AsyncScrapeResponse> {\n    return this.http.post<AsyncScrapeResponse>('/api/scrape/async', request, options)\n  }\n\n  /** Look up the current status of an async scrape job. */\n  getScrapeStatus(jobId: string, options?: RequestOptions): Promise<AsyncJobStatusResponse> {\n    assertNonEmptyJobId(jobId)\n    return this.http.get<AsyncJobStatusResponse>(\n      `/api/scrape/status/${encodeURIComponent(jobId)}`,\n      options\n    )\n  }\n\n  /**\n   * Fetch the result of a completed async scrape job. Throws if the job is\n   * still pending/running — call {@link Crawlbrulee.getScrapeStatus}\n   * first, or use {@link Crawlbrulee.waitForScrape} to poll-then-fetch.\n   */\n  getScrapeResult(jobId: string, options?: RequestOptions): Promise<ScrapeResponse> {\n    assertNonEmptyJobId(jobId)\n    return this.http.get<ScrapeResponse>(`/api/scrape/result/${encodeURIComponent(jobId)}`, options)\n  }\n\n  /**\n   * Fetch the scrape result referenced by a `scrape.complete` webhook body.\n   *\n   * Always verify the webhook signature with `verifyWebhookSignature` before\n   * acting on it; this method trusts the parsed body it is handed.\n   *\n   * Behavior by `data.status`:\n   * - `success` — delegates to {@link Crawlbrulee.getScrapeResult} for the\n   *   webhook's `job_id` and returns the parsed result.\n   * - `failed` — throws a {@link CrawlbruleeError} carrying `data.error`\n   *   (`errorName: 'job_failed'`); there is no result to fetch.\n   * - `cancelled` — throws a {@link CrawlbruleeError}\n   *   (`errorName: 'client_closed_request'`).\n   *\n   * A non-`scrape.complete` envelope throws a {@link CrawlbruleeError}\n   * defensively. Any HTTP error from the underlying fetch propagates as the\n   * usual typed `CrawlbruleeError` subclass.\n   */\n  async fetchScrapeResultFromWebhook(\n    webhook: ScrapeCompleteWebhook,\n    options?: RequestOptions\n  ): Promise<ScrapeResponse> {\n    if (webhook?.event !== 'scrape.complete') {\n      throw new CrawlbruleeError(\n        `Expected a 'scrape.complete' webhook but received '${String(webhook?.event)}'.`,\n        { status: 0, errorName: 'validation_error' }\n      )\n    }\n\n    const { job_id: jobId, status, error } = webhook.data\n\n    switch (status) {\n      case 'success':\n        return this.getScrapeResult(jobId, options)\n\n      case 'failed':\n        throw new CrawlbruleeError(error ?? `Async scrape job ${jobId} failed.`, {\n          status: 0,\n          errorName: 'job_failed',\n        })\n\n      case 'cancelled':\n        throw new CrawlbruleeError(`Async scrape job ${jobId} was cancelled.`, {\n          status: 0,\n          errorName: 'client_closed_request',\n        })\n\n      default:\n        throw new CrawlbruleeError(\n          `Async scrape webhook for job ${jobId} carried an unexpected status '${String(status)}'.`,\n          { status: 0, errorName: 'validation_error' }\n        )\n    }\n  }\n\n  /**\n   * Poll an async scrape job until it reaches a terminal state, then return\n   * the scrape result.\n   *\n   * Throws a {@link CrawlbruleeError} when:\n   * - the job ends in `failed` (`errorName: 'job_failed'`),\n   * - the server reports an unexpected status (`errorName: 'job_failed'`),\n   * - the overall wait exceeds `timeoutMs` (`errorName: 'request_timeout'`),\n   * - the caller's `signal` aborts (`errorName: 'client_closed_request'`).\n   */\n  async waitForScrape(jobId: string, options: WaitForScrapeOptions = {}): Promise<ScrapeResponse> {\n    assertNonEmptyJobId(jobId)\n    const intervalMs = options.intervalMs ?? 2000\n    const timeoutMs = options.timeoutMs ?? 300_000\n    const deadline = timeoutMs > 0 ? Date.now() + timeoutMs : Number.POSITIVE_INFINITY\n\n    while (true) {\n      throwIfAborted(options.signal)\n      if (Date.now() >= deadline) {\n        throw new CrawlbruleeError(\n          `Timed out after ${timeoutMs}ms waiting for async scrape job ${jobId}.`,\n          { status: 0, errorName: 'request_timeout' }\n        )\n      }\n\n      const status = await this.getScrapeStatus(jobId, { signal: options.signal })\n\n      switch (status.status) {\n        case 'done':\n          return this.getScrapeResult(jobId, { signal: options.signal })\n\n        case 'failed':\n          throw new CrawlbruleeError(status.error ?? `Async scrape job ${jobId} failed.`, {\n            status: 0,\n            errorName: 'job_failed',\n          })\n\n        case 'pending':\n        case 'running':\n          break\n\n        default:\n          throw new CrawlbruleeError(\n            `Async scrape job ${jobId} returned unexpected status '${String(status.status)}'.`,\n            { status: 0, errorName: 'job_failed' }\n          )\n      }\n\n      await sleep(intervalMs, options.signal)\n    }\n  }\n\n  // ------------------------------------------------------------------\n  // Mapping\n  // ------------------------------------------------------------------\n\n  /**\n   * Build (or return a cached) site link-map for a domain. Combines sitemap\n   * discovery with the freshest cached homepage scrape when available.\n   */\n  map(request: MapRequest, options?: RequestOptions): Promise<MapResponse> {\n    return this.http.post<MapResponse>('/api/map', request, options)\n  }\n\n  // ------------------------------------------------------------------\n  // Account\n  // ------------------------------------------------------------------\n\n  /**\n   * Return the current billing-cycle usage: total/used/available credits,\n   * used quota percentage, max concurrency, and when the cycle resets.\n   */\n  usage(options?: RequestOptions): Promise<UsageResponse> {\n    return this.http.get<UsageResponse>('/api/usage', options)\n  }\n\n  /**\n   * Return the organization name and identifying details of the API token\n   * used to authenticate this request. Useful for confirming which key is in\n   * use before performing destructive operations.\n   */\n  whoami(options?: RequestOptions): Promise<WhoamiResponse> {\n    return this.http.get<WhoamiResponse>('/api/whoami', options)\n  }\n}\n\n/**\n * Defensive read of `process.env[name]`. Guards both the absence of `process`\n * (browser / edge runtimes) and Deno's permission throw on env access without\n * `--allow-env`.\n */\nfunction readEnv(name: string): string | undefined {\n  try {\n    if (typeof process === 'undefined' || !process.env) return undefined\n    const v = process.env[name]\n    return typeof v === 'string' && v.trim().length > 0 ? v.trim() : undefined\n  } catch {\n    return undefined\n  }\n}\n\nfunction assertNonEmptyJobId(jobId: string): void {\n  if (typeof jobId !== 'string' || jobId.trim().length === 0) {\n    throw new CrawlbruleeError('jobId must be a non-empty string.', {\n      status: 0,\n      errorName: null,\n    })\n  }\n}\n\nfunction throwIfAborted(signal: AbortSignal | undefined): void {\n  if (signal?.aborted) {\n    throw new CrawlbruleeError('Request aborted by caller.', {\n      status: 0,\n      errorName: 'client_closed_request',\n      cause: signal.reason,\n    })\n  }\n}\n\nfunction sleep(ms: number, signal: AbortSignal | undefined): Promise<void> {\n  return new Promise((resolve, reject) => {\n    const onAbort = () => {\n      clearTimeout(timer)\n      reject(\n        new CrawlbruleeError('Request aborted by caller.', {\n          status: 0,\n          errorName: 'client_closed_request',\n          cause: signal?.reason,\n        })\n      )\n    }\n    const timer = setTimeout(() => {\n      signal?.removeEventListener('abort', onAbort)\n      resolve()\n    }, ms)\n    if (signal) {\n      if (signal.aborted) {\n        clearTimeout(timer)\n        onAbort()\n        return\n      }\n      signal.addEventListener('abort', onAbort, { once: true })\n    }\n  })\n}\n","/**\n * Verification for async scrape completion webhooks.\n *\n * {@link verifyWebhookSignature} validates the signature crawlbrulee attaches to\n * every webhook delivery. It is a standalone, network-free helper built on Web\n * Crypto (`globalThis.crypto.subtle`) so it runs unchanged on Node.js 22+,\n * browsers, Bun, Deno, and edge runtimes — it never touches `node:crypto`.\n */\n\n/** HTTP header carrying the primary webhook signature (always present). */\nexport const WEBHOOK_SIGNATURE_HEADER = 'X-Cwbl-Signature'\n\n/**\n * HTTP header carrying a signature produced with the previous signing secret.\n * Present only during a signing-secret rotation grace window.\n */\nexport const WEBHOOK_SIGNATURE_ROTATED_HEADER = 'X-Cwbl-Signature-Rotated'\n\n/** HTTP header carrying the unique event id, useful for delivery de-duplication. */\nexport const WEBHOOK_EVENT_ID_HEADER = 'X-Cwbl-Event-Id'\n\n/** Default replay-protection window (seconds) applied to the signed timestamp. */\nexport const DEFAULT_WEBHOOK_TOLERANCE_SECONDS = 300\n\n/** Which signature header satisfied verification. */\nexport type WebhookSignatureSource = 'primary' | 'rotated'\n\n/**\n * Why a webhook signature failed to verify.\n *\n * - `missing_signature` — neither the primary nor the rotated header was present.\n * - `malformed_signature` — a header was present but not in the expected\n *   `t=<unix_seconds>,v1=<64_hex>` format.\n * - `timestamp_out_of_tolerance` — the signed timestamp drifted further from now\n *   than `toleranceSeconds` allows (replay protection).\n * - `signature_mismatch` — a well-formed, in-tolerance signature did not match\n *   the one computed from the payload and secret.\n */\nexport type WebhookVerificationFailureReason =\n  | 'missing_signature'\n  | 'malformed_signature'\n  | 'timestamp_out_of_tolerance'\n  | 'signature_mismatch'\n\n/** Result of {@link verifyWebhookSignature}. Verification failure is returned, not thrown. */\nexport type WebhookVerificationResult =\n  | { verified: true; signedWith: WebhookSignatureSource }\n  | { verified: false; reason: WebhookVerificationFailureReason }\n\n/** Options for {@link verifyWebhookSignature}. */\nexport interface VerifyWebhookSignatureOptions {\n  /**\n   * The raw request body, exactly as received. Pass the bytes/string the server\n   * signed — do NOT re-serialize parsed JSON, or the signature will not match.\n   */\n  payload: string | Uint8Array\n  /**\n   * The request headers. Accepts a fetch `Headers` instance or a plain object\n   * (Express/Node give lowercased keys, values possibly arrays). Lookup is\n   * case-insensitive.\n   */\n  headers: Headers | Record<string, string | string[] | undefined>\n  /** The current signing secret (`whsec_…`). */\n  secret: string\n  /**\n   * Replay-protection window in seconds. Defaults to\n   * {@link DEFAULT_WEBHOOK_TOLERANCE_SECONDS} (300). Pass `0` (or any falsy\n   * value) to disable the timestamp check entirely.\n   */\n  toleranceSeconds?: number\n}\n\nconst SIGNATURE_FORMAT = /^t=(\\d+),v1=([0-9a-f]{64})$/\n\ninterface ParsedSignature {\n  timestamp: number\n  signature: string\n}\n\n/**\n * Verify a crawlbrulee webhook signature against the primary and rotated\n * headers.\n *\n * The signing scheme matches the backend:\n * - the signed payload is `` `${t}.${rawBody}` `` where `t` is the unix-seconds\n *   integer from the header and `rawBody` is the raw request body,\n * - the signature is `HMAC-SHA256(secret, signedPayload)` as lowercase hex,\n * - the header value is `t=<unix_seconds>,v1=<64_hex>`.\n *\n * The supplied `secret` is tried against the primary header first, then the\n * rotated header (which the API emits during a signing-secret rotation grace\n * window). Whichever matches wins, and the result reports which header it was.\n *\n * This NEVER throws on a verification failure — failures are normal control\n * flow and are returned as `{ verified: false, reason }`.\n *\n * @example\n * ```ts\n * const result = await verifyWebhookSignature({\n *   payload: rawBody,\n *   headers: req.headers,\n *   secret: process.env.CRAWLBRULEE_WEBHOOK_SECRET!,\n * })\n * if (!result.verified) return res.status(400).end()\n * ```\n */\nexport async function verifyWebhookSignature(\n  options: VerifyWebhookSignatureOptions\n): Promise<WebhookVerificationResult> {\n  const { payload, headers, secret } = options\n  const toleranceSeconds = options.toleranceSeconds ?? DEFAULT_WEBHOOK_TOLERANCE_SECONDS\n\n  const primaryHeader = getHeader(headers, WEBHOOK_SIGNATURE_HEADER)\n  const rotatedHeader = getHeader(headers, WEBHOOK_SIGNATURE_ROTATED_HEADER)\n\n  if (primaryHeader === undefined && rotatedHeader === undefined) {\n    return { verified: false, reason: 'missing_signature' }\n  }\n\n  const nowSeconds = Math.floor(Date.now() / 1000)\n  const body = toBytes(payload)\n  const key = await importHmacKey(secret)\n\n  // Track the \"best\" failure reason so the result is informative: a real\n  // mismatch should win over a malformed sibling header. Order from least to\n  // most specific.\n  let failure: WebhookVerificationFailureReason = 'malformed_signature'\n\n  for (const source of ['primary', 'rotated'] as const) {\n    const raw = source === 'primary' ? primaryHeader : rotatedHeader\n    if (raw === undefined) continue\n\n    const parsed = parseSignatureHeader(raw)\n    if (!parsed) {\n      // A malformed header can't verify; keep looking at the other one.\n      continue\n    }\n\n    if (toleranceSeconds && Math.abs(nowSeconds - parsed.timestamp) > toleranceSeconds) {\n      failure = mostSpecificFailure(failure, 'timestamp_out_of_tolerance')\n      continue\n    }\n\n    const expected = await computeSignatureHex(key, parsed.timestamp, body)\n    if (constantTimeEqualHex(expected, parsed.signature)) {\n      return { verified: true, signedWith: source }\n    }\n\n    failure = mostSpecificFailure(failure, 'signature_mismatch')\n  }\n\n  return { verified: false, reason: failure }\n}\n\n/**\n * Rank verification failures so the returned reason reflects the most\n * actionable problem encountered across the two headers.\n */\nfunction mostSpecificFailure(\n  current: WebhookVerificationFailureReason,\n  candidate: WebhookVerificationFailureReason\n): WebhookVerificationFailureReason {\n  const rank: Record<WebhookVerificationFailureReason, number> = {\n    missing_signature: 0,\n    malformed_signature: 1,\n    timestamp_out_of_tolerance: 2,\n    signature_mismatch: 3,\n  }\n  return rank[candidate] > rank[current] ? candidate : current\n}\n\n/** Case-insensitive header lookup over `Headers` or a plain object. */\nfunction getHeader(\n  headers: Headers | Record<string, string | string[] | undefined>,\n  name: string\n): string | undefined {\n  if (typeof Headers !== 'undefined' && headers instanceof Headers) {\n    return headers.get(name) ?? undefined\n  }\n  const target = name.toLowerCase()\n  for (const key of Object.keys(headers)) {\n    if (key.toLowerCase() !== target) continue\n    const value = (headers as Record<string, string | string[] | undefined>)[key]\n    if (Array.isArray(value)) return value[0]\n    return value ?? undefined\n  }\n  return undefined\n}\n\nfunction parseSignatureHeader(value: string): ParsedSignature | null {\n  const match = SIGNATURE_FORMAT.exec(value.trim())\n  if (!match) return null\n  const timestamp = Number(match[1])\n  if (!Number.isSafeInteger(timestamp)) return null\n  return { timestamp, signature: match[2]! }\n}\n\nfunction toBytes(payload: string | Uint8Array): Uint8Array {\n  return typeof payload === 'string' ? new TextEncoder().encode(payload) : payload\n}\n\n/**\n * Web Crypto types, derived from the runtime global so we don't have to pull in\n * the DOM `lib` (the SDK compiles against `lib: ES2022` + `@types/node`).\n */\ntype SubtleCryptoLike = typeof globalThis.crypto.subtle\ntype CryptoKeyLike = Awaited<ReturnType<SubtleCryptoLike['importKey']>>\n\nfunction importHmacKey(secret: string): Promise<CryptoKeyLike> {\n  return getSubtle().importKey(\n    'raw',\n    new TextEncoder().encode(secret),\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['sign']\n  )\n}\n\nasync function computeSignatureHex(\n  key: CryptoKeyLike,\n  timestamp: number,\n  body: Uint8Array\n): Promise<string> {\n  const prefix = new TextEncoder().encode(`${timestamp}.`)\n  const message = new Uint8Array(prefix.length + body.length)\n  message.set(prefix, 0)\n  message.set(body, prefix.length)\n  const digest = await getSubtle().sign('HMAC', key, message)\n  return toHex(new Uint8Array(digest))\n}\n\nfunction toHex(bytes: Uint8Array): string {\n  let hex = ''\n  for (const byte of bytes) {\n    hex += byte.toString(16).padStart(2, '0')\n  }\n  return hex\n}\n\n/**\n * Length-checked, constant-time comparison of two lowercase hex strings. Folds\n * every byte into an accumulator with XOR — never early-returns on the first\n * mismatch — so timing does not leak how much of the signature matched.\n */\nfunction constantTimeEqualHex(a: string, b: string): boolean {\n  if (a.length !== b.length) return false\n  let diff = 0\n  for (let i = 0; i < a.length; i++) {\n    diff |= a.charCodeAt(i) ^ b.charCodeAt(i)\n  }\n  return diff === 0\n}\n\nfunction getSubtle(): SubtleCryptoLike {\n  const subtle = globalThis.crypto?.subtle\n  if (!subtle) {\n    throw new Error(\n      'Web Crypto (globalThis.crypto.subtle) is not available in this runtime. crawlbrulee webhook verification requires Node.js 22+, Bun, Deno, or a modern browser/edge runtime.'\n    )\n  }\n  return subtle\n}\n"],"mappings":";;;;;;;;AAKA,MAAa,mBAAmB;;AAGhC,MAAa,6BAA6B;;AAG1C,MAAa,cAAc;;AAG3B,MAAa,aAAa;;;;;;;;;;;;;;;;;;;;;ACW1B,IAAa,mBAAb,cAAsC,MAAM;;CAE1C,AAAS;;CAET,AAAS;;CAET,AAAS;;CAET,AAAS;CAET,YACE,SACA,SAOA;EACA,MAAM,SAAS,QAAQ,UAAU,SAAY,EAAE,OAAO,QAAQ,MAAM,IAAI,MAAS;EACjF,KAAK,OAAO;EACZ,KAAK,SAAS,QAAQ;EACtB,KAAK,YAAY,QAAQ;EACzB,KAAK,UAAU,QAAQ;EACvB,KAAK,WAAW,QAAQ;CAC1B;AACF;;;;;;;;;AAUA,IAAa,sBAAb,cAAyC,iBAAiB;CACxD,YACE,SACA,SACA;EACA,MAAM,SAAS,OAAO;EACtB,KAAK,OAAO;CACd;AACF;;;;;;AAOA,IAAa,sBAAb,cAAyC,iBAAiB;CACxD,YACE,SACA,SACA;EACA,MAAM,SAAS,OAAO;EACtB,KAAK,OAAO;CACd;AACF;;;;;;;;AASA,IAAa,wBAAb,cAA2C,iBAAiB;CAC1D,YACE,SACA,SACA;EACA,MAAM,SAAS,OAAO;EACtB,KAAK,OAAO;CACd;AACF;;;;;;;;AASA,IAAa,oBAAb,cAAuC,iBAAiB;CACtD,YACE,SACA,SACA;EACA,MAAM,SAAS,OAAO;EACtB,KAAK,OAAO;CACd;AACF;;;;;;;;;;AAWA,IAAa,iBAAb,cAAoC,iBAAiB;CACnD,AAAkB;;CAElB,AAAS;;CAET,AAAS;CAET,YACE,SACA,SAKA;EACA,MAAM,SAAS;GAAE,GAAG;GAAS,WAAW;GAAqB,SAAS,QAAQ;EAAQ,CAAC;EACvF,KAAK,OAAO;EACZ,KAAK,YAAY;EACjB,KAAK,eAAe,QAAQ,SAAS;EACrC,KAAK,YAAY,QAAQ,SAAS;CACpC;AACF;;;;;;;AAQA,IAAa,uBAAb,cAA0C,iBAAiB;CACzD,AAAkB;;CAElB,AAAS;;CAET,AAAS;CAET,YACE,SACA,SAKA;EACA,MAAM,SAAS;GAAE,GAAG;GAAS,WAAW;EAAyB,CAAC;EAClE,KAAK,OAAO;EACZ,KAAK,YAAY;EACjB,KAAK,SAAS,QAAQ,QAAQ;EAC9B,KAAK,QAAQ,QAAQ,QAAQ;CAC/B;AACF;;AAGA,IAAa,kBAAb,cAAqC,iBAAiB;CACpD,YACE,SACA,SACA;EACA,MAAM,SAAS,OAAO;EACtB,KAAK,OAAO;CACd;AACF;;AAGA,IAAa,gBAAb,cAAmC,iBAAiB;CAClD,YACE,SACA,SACA;EACA,MAAM,SAAS,OAAO;EACtB,KAAK,OAAO;CACd;AACF;;;;;;;;;;AAWA,IAAa,0BAAb,cAA6C,iBAAiB;CAC5D,YACE,SACA,SACA;EACA,MAAM,SAAS,OAAO;EACtB,KAAK,OAAO;CACd;AACF;;;;;;;;;AAUA,IAAa,iBAAb,cAAoC,iBAAiB;CACnD,YACE,SACA,UAII,CAAC,GACL;EACA,MAAM,SAAS;GACb,QAAQ,QAAQ,UAAU;GAC1B,WAAW,QAAQ,aAAa;GAChC,OAAO,QAAQ;EACjB,CAAC;EACD,KAAK,OAAO;CACd;AACF;;AAGA,SAAgB,mBAAmB,KAAuC;CACxE,OAAO,eAAe;AACxB;;;;;;;;;;;AAYA,SAAgB,eAAe,MAAwB,QAAkC;CACvF,MAAM,EAAE,MAAM,SAAS,YAAY;CACnC,MAAM,WAAW;CAEjB,QAAQ,MAAR;EACE,KAAK,qBACH,OAAO,IAAI,eAAe,SAAS;GACjC;GACA,SAAS,SAAS,eAAe,sBAAsB,UAAU;GACjE;EACF,CAAC;EAEH,KAAK,0BAA0B;GAG7B,MAAM,eACJ,SAAS,eAAe,2BACpB,UACA;IAAE,YAAY;IAA0B,QAAQ;GAAiB;GACvE,OAAO,IAAI,qBAAqB,SAAS;IAAE;IAAQ,SAAS;IAAc;GAAS,CAAC;EACtF;EAEA,KAAK,mBACH,OAAO,IAAI,oBAAoB,SAAS;GAAE;GAAQ,WAAW;GAAM;EAAS,CAAC;EAE/E,KAAK,sBACH,OAAO,IAAI,sBAAsB,SAAS;GAAE;GAAQ,WAAW;GAAM;EAAS,CAAC;EAEjF,KAAK,kBACH,OAAO,IAAI,kBAAkB,SAAS;GAAE;GAAQ,WAAW;GAAM;EAAS,CAAC;EAE7E,KAAK;EACL,KAAK,iBACH,OAAO,IAAI,oBAAoB,SAAS;GAAE;GAAQ,WAAW;GAAM;EAAS,CAAC;EAE/E,KAAK,aACH,OAAO,IAAI,cAAc,SAAS;GAAE;GAAQ,WAAW;GAAM;EAAS,CAAC;EAEzE,KAAK,uBACH,OAAO,IAAI,wBAAwB,SAAS;GAAE;GAAQ,WAAW;GAAM;EAAS,CAAC;EAEnF,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK,iCACH,OAAO,IAAI,gBAAgB,SAAS;GAAE;GAAQ,WAAW;GAAM;EAAS,CAAC;CAC7E;CAKA,IAAI,WAAW,KACb,OAAO,IAAI,eAAe,SAAS;EAAE;EAAQ;CAAS,CAAC;CAEzD,IAAI,WAAW,OAAO,WAAW,KAC/B,OAAO,IAAI,oBAAoB,SAAS;EAAE;EAAQ,WAAW;EAAM;CAAS,CAAC;CAE/E,IAAI,WAAW,KACb,OAAO,IAAI,cAAc,SAAS;EAAE;EAAQ,WAAW;EAAM;CAAS,CAAC;CAEzE,IAAI,WAAW,KACb,OAAO,IAAI,wBAAwB,SAAS;EAAE;EAAQ,WAAW;EAAM;CAAS,CAAC;CAGnF,OAAO,IAAI,iBAAiB,SAAS;EAAE;EAAQ,WAAW;EAAM;EAAS;CAAS,CAAC;AACrF;;;;;;;;;;;;;;AC7TA,MAAa,sBAAsB;;;;;CAKjC,WAAsB;EACpB,MAAM,IAAI;EACV,IAAI,OAAO,EAAE,UAAU,YACrB,MAAM,IAAI,iBACR,gIACA;GAAE,QAAQ;GAAG,WAAW;EAAK,CAC/B;EAEF,OAAO,EAAE,MAAM,KAAK,UAAU;CAChC;;;;;CAMA,aAAqB;EACnB,OAAO;CACT;AACF;;;;;;;;;;;;;;;;;;;;AC2BA,IAAa,aAAb,MAAwB;CACtB,AAAS;CACT,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAEjB,YAAY,SAA4B;EACtC,KAAK,UAAU,mBAAmB,QAAQ,WAAW,oBAAoB,WAAW,CAAC;EACrF,KAAK,SAAS,QAAQ;EACtB,KAAK,QAAQ,oBAAoB,SAAS;EAC1C,KAAK,YAAY,QAAQ;CAC3B;;CAGA,IAAO,MAAc,SAAsC;EACzD,OAAO,KAAK,KAAQ;GAAE,QAAQ;GAAO;GAAM,GAAG;EAAQ,CAAC;CACzD;;CAGA,KAAQ,MAAc,MAAe,SAAsC;EACzE,OAAO,KAAK,KAAQ;GAAE,QAAQ;GAAQ;GAAM;GAAM,GAAG;EAAQ,CAAC;CAChE;CAEA,MAAc,KAAQ,MAA4B;EAChD,MAAM,MAAM,KAAK,SAAS,KAAK,IAAI;EACnC,MAAM,UAAU,KAAK,aAAa,IAAI;EACtC,MAAM,OAAO,KAAK,SAAS,SAAY,SAAY,KAAK,UAAU,KAAK,IAAI;EAC3E,MAAM,WAAW,KAAK,cAAc,KAAK,QAAQ,KAAK,SAAS;EAE/D,IAAI;GACF,IAAI;GACJ,IAAI;IACF,MAAM,MAAM,KAAK,MAAM,KAAK;KAC1B,QAAQ,KAAK;KACb;KACA;KACA,QAAQ,SAAS;IACnB,CAAC;GACH,SAAS,OAAgB;IACvB,MAAM,oBAAoB,OAAO,SAAS,SAAS,GAAG,KAAK,aAAa,KAAK,SAAS;GACxF;GAEA,IAAI;GACJ,IAAI;IACF,OAAO,MAAM,IAAI,KAAK;GACxB,SAAS,OAAgB;IACvB,IAAI,aAAa,KAAK,GACpB,MAAM,oBAAoB,OAAO,SAAS,SAAS,GAAG,KAAK,aAAa,KAAK,SAAS;IAExF,MAAM,IAAI,eAAe,wCAAwC,IAAI,OAAO,KAAK;KAC/E,QAAQ,IAAI;KACZ;IACF,CAAC;GACH;GAEA,MAAM,SAAS,iBAAiB,MAAM,IAAI,MAAM;GAChD,IAAI,CAAC,IAAI,IAAI,MAAM,WAAW,QAAQ,IAAI,QAAQ,IAAI;GACtD,OAAO;EACT,UAAU;GACR,SAAS,QAAQ;EACnB;CACF;CAEA,AAAQ,SAAS,MAAsB;EACrC,IAAI,CAAC,KAAK,WAAW,GAAG,GACtB,MAAM,IAAI,UAAU,wDAAwD,KAAK,GAAG;EAEtF,OAAO,GAAG,KAAK,UAAU;CAC3B;CAEA,AAAQ,aAAa,MAAwC;EAC3D,MAAM,UAAkC;GACtC,QAAQ;GACR,cAAc;GACd,eAAe,UAAU,KAAK;EAChC;EACA,IAAI,KAAK,SAAS,QAAW,QAAQ,kBAAkB;EACvD,OAAO;CACT;;;;;;;CAQA,AAAQ,cACN,cACA,mBACgB;EAChB,MAAM,YAAY,qBAAqB,KAAK;EAC5C,MAAM,aAAa,OAAO,SAAS,SAAS,KAAK,YAAY;EAE7D,IAAI,CAAC,cAAc,CAAC,cAClB,OAAO;GAAE,QAAQ;GAAW,gBAAgB;GAAO,eAAe,CAAC;EAAE;EAGvE,IAAI,CAAC,YACH,OAAO;GAAE,QAAQ;GAAc,gBAAgB;GAAO,eAAe,CAAC;EAAE;EAG1E,MAAM,aAAa,IAAI,gBAAgB;EACvC,IAAI,aAAa;EACjB,MAAM,QAAQ,iBAAiB;GAC7B,aAAa;GACb,WAAW,sBAAM,IAAI,MAAM,iBAAiB,CAAC;EAC/C,GAAG,SAAS;EAEZ,IAAI;EACJ,IAAI,cACF,IAAI,aAAa,SAAS;GACxB,aAAa,KAAK;GAClB,WAAW,MAAM,aAAa,MAAM;EACtC,OAAO;GACL,sBAAsB;IACpB,aAAa,KAAK;IAClB,WAAW,MAAM,aAAa,MAAM;GACtC;GACA,aAAa,iBAAiB,SAAS,eAAe,EAAE,MAAM,KAAK,CAAC;EACtE;EAGF,MAAM,gBAAgB;GACpB,aAAa,KAAK;GAClB,IAAI,iBAAiB,cACnB,aAAa,oBAAoB,SAAS,aAAa;EAE3D;EAEA,OAAO;GAAE,QAAQ,WAAW;GAAQ,gBAAgB;GAAY;EAAQ;CAC1E;AACF;AAEA,SAAS,mBAAmB,KAAqB;CAC/C,OAAO,IAAI,QAAQ,QAAQ,EAAE;AAC/B;AAEA,SAAS,aAAa,KAAuB;CAC3C,OAAO,eAAe,SAAS,IAAI,SAAS;AAC9C;AAEA,SAAS,oBAAoB,OAAgB,UAAmB,WAAmC;CACjG,IAAI,aAAa,KAAK,GAAG;EACvB,IAAI,UACF,OAAO,IAAI,eAAe,2BAA2B,UAAU,MAAM;GACnE,WAAW;GACX;EACF,CAAC;EAEH,OAAO,IAAI,eAAe,8BAA8B;GACtD,WAAW;GACX;EACF,CAAC;CACH;CACA,OAAO,IAAI,eAAe,0BAA0B,KAAK,GAAG,EAAE,MAAM,CAAC;AACvE;AAEA,SAAS,0BAA0B,OAAwB;CACzD,IAAI,iBAAiB,OACnB,OAAO,kBAAkB,MAAM;CAEjC,OAAO;AACT;AAEA,SAAS,iBAAiB,MAAc,QAAyB;CAC/D,IAAI,SAAS,IAAI,OAAO,CAAC;CACzB,IAAI;EACF,OAAO,KAAK,MAAM,IAAI;CACxB,SAAS,OAAgB;EAEvB,MAAM,IAAI,eAAe,wCAAwC,OAAO,KADxD,KAAK,SAAS,MAAM,GAAG,KAAK,MAAM,GAAG,GAAG,EAAE,KAAK,QACyB;GACtF;GACA;EACF,CAAC;CACH;AACF;AAEA,SAAS,WAAW,QAAiB,QAAgB,SAAmC;CACtF,IAAI,mBAAmB,MAAM,GAC3B,OAAO,eAAe,QAAQ,MAAM;CAGtC,OAAO,IAAI,eAAe,QAAQ,OAAO,KADzB,QAAQ,SAAS,MAAM,GAAG,QAAQ,MAAM,GAAG,GAAG,EAAE,KAAK,YACb,kBAAkB,EAAE,OAAO,CAAC;AACtF;AAEA,SAAS,mBAAmB,OAA2C;CACrE,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU,OAAO;CACxD,MAAM,IAAI;CACV,OAAO,OAAO,EAAE,SAAS,YAAY,OAAO,EAAE,YAAY;AAC5D;;;;;;;;;;;;;;;;;;;;;;ACnLA,IAAa,cAAb,MAAa,YAAY;;CAEvB,AAAS;;CAET,AAAS;CAET,YAAY,SAA6B;EACvC,MAAM,SAAS,QAAQ,QAAQ,KAAK;EACpC,IAAI,CAAC,QACH,MAAM,IAAI,iBACR,yFAAyF,YAAY,IACrG;GAAE,QAAQ;GAAG,WAAW;EAAK,CAC/B;EAEF,KAAK,OAAO,IAAI,WAAW;GAAE;GAAQ,SAAS,QAAQ;GAAS,WAAW,QAAQ;EAAU,CAAC;EAC7F,KAAK,UAAU,KAAK,KAAK;CAC3B;;;;;;;;;;;;;;CAeA,OAAO,QAAQ,YAAgD,CAAC,GAAgB;EAC9E,MAAM,SAAS,QAAQ,WAAW;EAClC,IAAI,CAAC,QACH,MAAM,IAAI,iBACR,GAAG,YAAY,uFACf;GAAE,QAAQ;GAAG,WAAW;EAAK,CAC/B;EAEF,OAAO,IAAI,YAAY;GAAE,GAAG;GAAW;EAAO,CAAC;CACjD;;;;;;;;;;;CAgBA,OAAO,SAAwB,SAAmD;EAChF,OAAO,KAAK,KAAK,KAAqB,eAAe,SAAS,OAAO;CACvE;;;;;;;;;;CAWA,YAAY,SAA6B,SAAwD;EAC/F,OAAO,KAAK,KAAK,KAA0B,qBAAqB,SAAS,OAAO;CAClF;;CAGA,gBAAgB,OAAe,SAA2D;EACxF,oBAAoB,KAAK;EACzB,OAAO,KAAK,KAAK,IACf,sBAAsB,mBAAmB,KAAK,KAC9C,OACF;CACF;;;;;;CAOA,gBAAgB,OAAe,SAAmD;EAChF,oBAAoB,KAAK;EACzB,OAAO,KAAK,KAAK,IAAoB,sBAAsB,mBAAmB,KAAK,KAAK,OAAO;CACjG;;;;;;;;;;;;;;;;;;;CAoBA,MAAM,6BACJ,SACA,SACyB;EACzB,IAAI,SAAS,UAAU,mBACrB,MAAM,IAAI,iBACR,sDAAsD,OAAO,SAAS,KAAK,EAAE,KAC7E;GAAE,QAAQ;GAAG,WAAW;EAAmB,CAC7C;EAGF,MAAM,EAAE,QAAQ,OAAO,QAAQ,UAAU,QAAQ;EAEjD,QAAQ,QAAR;GACE,KAAK,WACH,OAAO,KAAK,gBAAgB,OAAO,OAAO;GAE5C,KAAK,UACH,MAAM,IAAI,iBAAiB,SAAS,oBAAoB,MAAM,WAAW;IACvE,QAAQ;IACR,WAAW;GACb,CAAC;GAEH,KAAK,aACH,MAAM,IAAI,iBAAiB,oBAAoB,MAAM,kBAAkB;IACrE,QAAQ;IACR,WAAW;GACb,CAAC;GAEH,SACE,MAAM,IAAI,iBACR,gCAAgC,MAAM,iCAAiC,OAAO,MAAM,EAAE,KACtF;IAAE,QAAQ;IAAG,WAAW;GAAmB,CAC7C;EACJ;CACF;;;;;;;;;;;CAYA,MAAM,cAAc,OAAe,UAAgC,CAAC,GAA4B;EAC9F,oBAAoB,KAAK;EACzB,MAAM,aAAa,QAAQ,cAAc;EACzC,MAAM,YAAY,QAAQ,aAAa;EACvC,MAAM,WAAW,YAAY,IAAI,KAAK,IAAI,IAAI,YAAY,OAAO;EAEjE,OAAO,MAAM;GACX,eAAe,QAAQ,MAAM;GAC7B,IAAI,KAAK,IAAI,KAAK,UAChB,MAAM,IAAI,iBACR,mBAAmB,UAAU,kCAAkC,MAAM,IACrE;IAAE,QAAQ;IAAG,WAAW;GAAkB,CAC5C;GAGF,MAAM,SAAS,MAAM,KAAK,gBAAgB,OAAO,EAAE,QAAQ,QAAQ,OAAO,CAAC;GAE3E,QAAQ,OAAO,QAAf;IACE,KAAK,QACH,OAAO,KAAK,gBAAgB,OAAO,EAAE,QAAQ,QAAQ,OAAO,CAAC;IAE/D,KAAK,UACH,MAAM,IAAI,iBAAiB,OAAO,SAAS,oBAAoB,MAAM,WAAW;KAC9E,QAAQ;KACR,WAAW;IACb,CAAC;IAEH,KAAK;IACL,KAAK,WACH;IAEF,SACE,MAAM,IAAI,iBACR,oBAAoB,MAAM,+BAA+B,OAAO,OAAO,MAAM,EAAE,KAC/E;KAAE,QAAQ;KAAG,WAAW;IAAa,CACvC;GACJ;GAEA,MAAM,MAAM,YAAY,QAAQ,MAAM;EACxC;CACF;;;;;CAUA,IAAI,SAAqB,SAAgD;EACvE,OAAO,KAAK,KAAK,KAAkB,YAAY,SAAS,OAAO;CACjE;;;;;CAUA,MAAM,SAAkD;EACtD,OAAO,KAAK,KAAK,IAAmB,cAAc,OAAO;CAC3D;;;;;;CAOA,OAAO,SAAmD;EACxD,OAAO,KAAK,KAAK,IAAoB,eAAe,OAAO;CAC7D;AACF;;;;;;AAOA,SAAS,QAAQ,MAAkC;CACjD,IAAI;EACF,IAAI,OAAO,YAAY,eAAe,CAAC,QAAQ,KAAK,OAAO;EAC3D,MAAM,IAAI,QAAQ,IAAI;EACtB,OAAO,OAAO,MAAM,YAAY,EAAE,KAAK,CAAC,CAAC,SAAS,IAAI,EAAE,KAAK,IAAI;CACnE,QAAQ;EACN;CACF;AACF;AAEA,SAAS,oBAAoB,OAAqB;CAChD,IAAI,OAAO,UAAU,YAAY,MAAM,KAAK,CAAC,CAAC,WAAW,GACvD,MAAM,IAAI,iBAAiB,qCAAqC;EAC9D,QAAQ;EACR,WAAW;CACb,CAAC;AAEL;AAEA,SAAS,eAAe,QAAuC;CAC7D,IAAI,QAAQ,SACV,MAAM,IAAI,iBAAiB,8BAA8B;EACvD,QAAQ;EACR,WAAW;EACX,OAAO,OAAO;CAChB,CAAC;AAEL;AAEA,SAAS,MAAM,IAAY,QAAgD;CACzE,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,MAAM,gBAAgB;GACpB,aAAa,KAAK;GAClB,OACE,IAAI,iBAAiB,8BAA8B;IACjD,QAAQ;IACR,WAAW;IACX,OAAO,QAAQ;GACjB,CAAC,CACH;EACF;EACA,MAAM,QAAQ,iBAAiB;GAC7B,QAAQ,oBAAoB,SAAS,OAAO;GAC5C,QAAQ;EACV,GAAG,EAAE;EACL,IAAI,QAAQ;GACV,IAAI,OAAO,SAAS;IAClB,aAAa,KAAK;IAClB,QAAQ;IACR;GACF;GACA,OAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;EAC1D;CACF,CAAC;AACH;;;;;;;;;;;;;ACtWA,MAAa,2BAA2B;;;;;AAMxC,MAAa,mCAAmC;;AAGhD,MAAa,0BAA0B;;AAGvC,MAAa,oCAAoC;AAkDjD,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCzB,eAAsB,uBACpB,SACoC;CACpC,MAAM,EAAE,SAAS,SAAS,WAAW;CACrC,MAAM,mBAAmB,QAAQ;CAEjC,MAAM,gBAAgB,UAAU,SAAS,wBAAwB;CACjE,MAAM,gBAAgB,UAAU,SAAS,gCAAgC;CAEzE,IAAI,kBAAkB,UAAa,kBAAkB,QACnD,OAAO;EAAE,UAAU;EAAO,QAAQ;CAAoB;CAGxD,MAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;CAC/C,MAAM,OAAO,QAAQ,OAAO;CAC5B,MAAM,MAAM,MAAM,cAAc,MAAM;CAKtC,IAAI,UAA4C;CAEhD,KAAK,MAAM,UAAU,CAAC,WAAW,SAAS,GAAY;EACpD,MAAM,MAAM,WAAW,YAAY,gBAAgB;EACnD,IAAI,QAAQ,QAAW;EAEvB,MAAM,SAAS,qBAAqB,GAAG;EACvC,IAAI,CAAC,QAEH;EAGF,IAAI,oBAAoB,KAAK,IAAI,aAAa,OAAO,SAAS,IAAI,kBAAkB;GAClF,UAAU,oBAAoB,SAAS,4BAA4B;GACnE;EACF;EAGA,IAAI,qBAAqB,MADF,oBAAoB,KAAK,OAAO,WAAW,IAAI,GACnC,OAAO,SAAS,GACjD,OAAO;GAAE,UAAU;GAAM,YAAY;EAAO;EAG9C,UAAU,oBAAoB,SAAS,oBAAoB;CAC7D;CAEA,OAAO;EAAE,UAAU;EAAO,QAAQ;CAAQ;AAC5C;;;;;AAMA,SAAS,oBACP,SACA,WACkC;CAClC,MAAM,OAAyD;EAC7D,mBAAmB;EACnB,qBAAqB;EACrB,4BAA4B;EAC5B,oBAAoB;CACtB;CACA,OAAO,KAAK,aAAa,KAAK,WAAW,YAAY;AACvD;;AAGA,SAAS,UACP,SACA,MACoB;CACpB,IAAI,OAAO,YAAY,eAAe,mBAAmB,SACvD,OAAO,QAAQ,IAAI,IAAI,KAAK;CAE9B,MAAM,SAAS,KAAK,YAAY;CAChC,KAAK,MAAM,OAAO,OAAO,KAAK,OAAO,GAAG;EACtC,IAAI,IAAI,YAAY,MAAM,QAAQ;EAClC,MAAM,QAAS,QAA0D;EACzE,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM;EACvC,OAAO,SAAS;CAClB;AAEF;AAEA,SAAS,qBAAqB,OAAuC;CACnE,MAAM,QAAQ,iBAAiB,KAAK,MAAM,KAAK,CAAC;CAChD,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,YAAY,OAAO,MAAM,EAAE;CACjC,IAAI,CAAC,OAAO,cAAc,SAAS,GAAG,OAAO;CAC7C,OAAO;EAAE;EAAW,WAAW,MAAM;CAAI;AAC3C;AAEA,SAAS,QAAQ,SAA0C;CACzD,OAAO,OAAO,YAAY,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,OAAO,IAAI;AAC3E;AASA,SAAS,cAAc,QAAwC;CAC7D,OAAO,UAAU,CAAC,CAAC,UACjB,OACA,IAAI,YAAY,CAAC,CAAC,OAAO,MAAM,GAC/B;EAAE,MAAM;EAAQ,MAAM;CAAU,GAChC,OACA,CAAC,MAAM,CACT;AACF;AAEA,eAAe,oBACb,KACA,WACA,MACiB;CACjB,MAAM,SAAS,IAAI,YAAY,CAAC,CAAC,OAAO,GAAG,UAAU,EAAE;CACvD,MAAM,UAAU,IAAI,WAAW,OAAO,SAAS,KAAK,MAAM;CAC1D,QAAQ,IAAI,QAAQ,CAAC;CACrB,QAAQ,IAAI,MAAM,OAAO,MAAM;CAC/B,MAAM,SAAS,MAAM,UAAU,CAAC,CAAC,KAAK,QAAQ,KAAK,OAAO;CAC1D,OAAO,MAAM,IAAI,WAAW,MAAM,CAAC;AACrC;AAEA,SAAS,MAAM,OAA2B;CACxC,IAAI,MAAM;CACV,KAAK,MAAM,QAAQ,OACjB,OAAO,KAAK,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG;CAE1C,OAAO;AACT;;;;;;AAOA,SAAS,qBAAqB,GAAW,GAAoB;CAC3D,IAAI,EAAE,WAAW,EAAE,QAAQ,OAAO;CAClC,IAAI,OAAO;CACX,KAAK,IAAI,IAAI,GAAG,IAAI,EAAE,QAAQ,KAC5B,QAAQ,EAAE,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC;CAE1C,OAAO,SAAS;AAClB;AAEA,SAAS,YAA8B;CACrC,MAAM,SAAS,WAAW,QAAQ;CAClC,IAAI,CAAC,QACH,MAAM,IAAI,MACR,6KACF;CAEF,OAAO;AACT"}