@humain/terminal 0.0.4-beta.1 → 0.0.5

package/dist/humain/web-access/vendor/brightdata.js.map

@@ -1 +1 @@
-{"version":3,"file":"brightdata.js","sourceRoot":"","sources":["../../../../src/humain/web-access/vendor/brightdata.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAClG,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEpD,MAAM,kBAAkB,GAAG,oCAAoC,CAAC;AAChE,MAAM,WAAW,GAAG,sBAAsB,EAAE,CAAC;AAC7C,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC,gFAAgF;AAChF,gFAAgF;AAChF,iFAAiF;AACjF,+EAA+E;AAC/E,gFAAgF;AAChF,+DAA+D;AAC/D,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAExC,iFAAiF;AACjF,+EAA+E;AAC/E,2BAA2B;AAC3B,MAAM,WAAW,GAA2B;IAC3C,GAAG,EAAE,OAAO;IACZ,IAAI,EAAE,OAAO;IACb,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,OAAO;CACb,CAAC;AAwBF,IAAI,YAAY,GAA2B,IAAI,CAAC;AAEhD,mFAAmF;AACnF,oFAAkF;AAClF,kFAAgF;AAChF,4CAA4C;AAC5C,mFAAmF;AACnF,oFAAoF;AACpF,sFAAsF;AACtF,gFAAgF;AAChF,mDAAmD;AACnD,EAAE;AACF,8EAA8E;AAC9E,oFAAoF;AACpF,gFAAgF;AAChF,oFAAoF;AACpF,SAAS,iBAAiB,CAAC,GAAY,EAAU;IAChD,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC1F,OAAO,QAAQ,CAAC,CAAC,CAAC,mBAAmB,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC;AAAA,CACtE;AAED,SAAS,UAAU,GAAoB;IACtC,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IACtC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC9B,YAAY,GAAG,EAAE,CAAC;QAClB,OAAO,YAAY,CAAC;IACrB,CAAC;IAED,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC/C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,mBAAmB,WAAW,KAAK,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,qBAAqB,WAAW,0BAA0B,CAAC,CAAC;IAC7E,CAAC;IACD,YAAY,GAAG,MAAyB,CAAC;IACzC,OAAO,YAAY,CAAC;AAAA,CACpB;AAED,KAAK,UAAU,SAAS,CAAC,MAAoB,EAA0B;IACtE,OAAO,iBAAiB,CAAC;QACxB,QAAQ,EAAE,aAAa;QACvB,eAAe,EAAE,UAAU,EAAE,CAAC,gBAAgB;QAC9C,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAChD,MAAM;KACN,CAAC,CAAC;AAAA,CACH;AAED,KAAK,UAAU,aAAa,CAAC,MAAoB,EAAmB;IACnE,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACd,0CAA0C;YAC1C,eAAe,WAAW,4CAA4C;YACtE,oDAAoD;YACpD,sDAAsD,CACtD,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAAA,CACd;AAED,iFAAiF;AACjF,iFAAiF;AACjF,yDAAyD;AACzD,EAAE;AACF,mEAAmE;AACnE,kFAAkF;AAClF,+EAA6E;AAC7E,mFAAmF;AACnF,8EAA8E;AAC9E,4EAA4E;AAC5E,sEAAsE;AACtE,6DAA6D;AAC7D,SAAS,aAAa,CAAC,KAAc,EAAiB;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAAA,CACnD;AAOD,kFAAkF;AAClF,8EAA8E;AAC9E,sEAAsE;AACtE,SAAS,eAAe,GAAuB;IAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IACjD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QACnD,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAC/D,CAAC;IACD,MAAM,UAAU,GAAG,UAAU,EAAE,CAAC,kBAAkB,CAAC;IACnD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;QACzD,OAAO,EAAE,GAAG,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,yBAAyB,WAAW,EAAE,EAAE,CAAC;IAClF,CAAC;IACD,OAAO,IAAI,CAAC;AAAA,CACZ;AAED,SAAS,WAAW,GAAkB;IACrC,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;IAClC,OAAO,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAAA,CACnD;AAED,kFAAkF;AAClF,mFAAmF;AACnF,6EAA2E;AAC3E,+EAA+E;AAC/E,uDAAuD;AACvD,SAAS,eAAe,GAAW;IAClC,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACd,qCAAqC,OAAO,CAAC,KAAK,uDAAuD;YACzG,SAAS,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO;YAC9C,6IAA6I;YAC7I,yDAAyD,CACzD,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CACd,wDAAwD;QACxD,eAAe,WAAW,oDAAoD;QAC9E,sDAAsD;QACtD,0HAA0H;QAC1H,+CAA+C,CAC/C,CAAC;AAAA,CACF;AAED,SAAS,cAAc,CAAC,KAAyB,EAAU;IAC1D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACnE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAAA,CACpD;AAED,SAAS,eAAe,CAAC,KAAa,EAAiB;IACtD,IAAI,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACvC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACzD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC;QACpF,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACR,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,CAAC;IACD,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACxC,OAAO,mCAAmC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAAA,CACtE;AAOD,SAAS,iBAAiB,CAAC,YAAkC,EAAiB;IAC7E,MAAM,OAAO,GAAkB,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC5D,IAAI,CAAC,YAAY,EAAE,MAAM;QAAE,OAAO,OAAO,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QAC9E,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,OAAO,CAAC;AAAA,CACf;AAED,kFAAkF;AAClF,+EAA+E;AAC/E,gFAAgF;AAChF,4EAA0E;AAC1E,SAAS,gBAAgB,CAAC,KAAa,EAAE,OAAsB,EAAU;IACxE,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC;IACtB,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,QAAQ,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1C,CAAC;SAAM,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAAA,CACvB;AAED,SAAS,YAAY,CAAC,WAAmB,EAAE,UAAkB,EAAE,aAA6C,EAAU;IACrH,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;IACvD,8EAA8E;IAC9E,0EAA0E;IAC1E,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,IAAI,GAAG;QAAE,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAChC,4EAA4E;IAC5E,+EAA+E;IAC/E,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC5B,OAAO,iCAAiC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AAAA,CAC5D;AAED,SAAS,aAAa,CAAC,QAAgB,EAAE,MAAc,EAAW;IACjE,OAAO,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;AAAA,CAC9D;AAED,4EAA4E;AAC5E,iFAAiF;AACjF,iEAAiE;AACjE,SAAS,mBAAmB,CAAC,GAAW,EAAE,OAAsB,EAAW;IAC1E,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACJ,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACpF,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AAAA,CACzE;AAED,SAAS,aAAa,CAAC,MAAoB,EAAe;IACzD,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACvD,OAAO,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AAAA,CAC7D;AAED,SAAS,YAAY,CAAC,GAAY,EAAU;IAC3C,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAAA,CACxD;AAED,+EAA6E;AAC7E,mFAAiF;AACjF,iFAAiF;AACjF,mFAAmF;AACnF,iFAAiF;AACjF,iFAAiF;AACjF,8EAA8E;AAC9E,gFAAgF;AAChF,sEAAsE;AACtE,MAAM,qBAAqB,GAAG,gDAAgD,CAAC;AAE/E,sEAAsE;AACtE,kFAAkF;AAClF,2EAA2E;AAC3E,iFAAiF;AACjF,mFAAmF;AACnF,mFAAmF;AACnF,0EAA0E;AAC1E,mFAAmF;AACnF,sFAAoF;AACpF,qFAAqF;AACrF,qFAAqF;AACrF,EAAE;AACF,mFAAmF;AACnF,+EAA+E;AAC/E,gFAAgF;AAChF,MAAM,oBAAoB,GAAG,sCAAsC,CAAC;AAEpE,kFAAkF;AAClF,qFAAqF;AACrF,EAAE;AACF,yFAAyF;AACzF,yFAAyF;AACzF,yFAAyF;AACzF,yFAAyF;AACzF,yFAAyF;AACzF,4FAA0F;AAC1F,2FAAyF;AACzF,6FAAyF;AACzF,6FAAyF;AACzF,EAAE;AACF,oFAAoF;AACpF,6EAA6E;AAC7E,kEAAkE;AAClE,gFAAgF;AAChF,sFAAsF;AACtF,8EAA8E;AAC9E,sFAAsF;AACtF,sFAAsF;AACtF,uFAAuF;AACvF,mFAAiF;AACjF,+CAA+C;AAE/C,2EAA2E;AAC3E,qFAAqF;AACrF,wFAAsF;AACtF,kEAAkE;AAClE,sFAAsF;AACtF,uFAAuF;AACvF,8DAA8D;AAC9D,EAAE;AACF,qFAAqF;AACrF,0FAAwF;AACxF,kFAAkF;AAClF,iDAAiD;AACjD,SAAS,aAAa,CAAC,IAAY,EAAE,KAAK,GAAG,GAAG,EAAU;IACzD,OAAO,IAAI;SACT,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE;SACN,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;SACf,OAAO,CAAC,qBAAqB,EAAE,aAAa,CAAC;SAC7C,OAAO,CAAC,oBAAoB,EAAE,4BAA4B,CAAC,CAAC;AAAA,CAC9D;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,OAAe,EAAS;IAC9D,OAAO,IAAI,KAAK,CAAC,sDAAsD,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;AAAA,CAC3F;AAED,2EAAyE;AACzE,iFAA+E;AAC/E,iEAAiE;AACjE,EAAE;AACF,uFAAuF;AACvF,qFAAqF;AACrF,gEAAgE;AAChE,SAAS,aAAa,CAAC,QAAiC,EAAE,MAAqB,EAAiB;IAC/F,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;SACnE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/E,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;SAC9E,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE;QAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAChF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;aAC5E,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,aAAa,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;AAAA,CACtE;AAED,iFAA6E;AAC7E,6EAA6E;AAC7E,4EAA4E;AAC5E,iFAAiF;AACjF,4EAA4E;AAC5E,kFAAkF;AAClF,iFAAiF;AACjF,kFAAkF;AAClF,6BAA6B;AAC7B,SAAS,iBAAiB,CAAC,KAAc,EAAE,IAAY,EAAE,MAAqB,EAA0B;IACvG,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjE,MAAM,eAAe,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,QAAQ,GAAG,KAAgC,CAAC;IAClD,MAAM,aAAa,GAAG,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACtD,IAAI,aAAa,EAAE,CAAC;QACnB,MAAM,eAAe,CAAC,IAAI,EAAE,oDAAoD,aAAa,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACjE,MAAM,eAAe,CACpB,IAAI,EACJ,iGAAiG;YACjG,qGAAqG,CACrG,CAAC;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,MAAM,eAAe,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;IAC5F,MAAM,OAAO,GAA8B,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QACzD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjE,MAAM,eAAe,CAAC,IAAI,EAAE,oBAAoB,KAAK,UAAU,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,CACnB;AAED,SAAS,UAAU,CAClB,OAA8C,EAC9C,UAAkB,EAClB,OAAsB,EACM;IAC5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IACvC,MAAM,MAAM,GAA8B,EAAE,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,IAAI,CAAC,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC;YAAE,SAAS;QACzD,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,KAAK,IAAI,UAAU,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE;YAC7C,GAAG;YACH,OAAO,EAAE,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;SACjG,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,IAAI,UAAU;YAAE,MAAM;IACxC,CAAC;IACD,OAAO,MAAM,CAAC;AAAA,CACd;AAED,0EAA0E;AAC1E,iFAA+E;AAC/E,SAAS,WAAW,CAAC,OAAkC,EAAU;IAChE,OAAO,OAAO;SACZ,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO;QAC9B,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,aAAa,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,GAAG,GAAG;QAC9D,CAAC,CAAC,WAAW,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,GAAG,GAAG,CAAC;SAC5C,IAAI,CAAC,MAAM,CAAC,CAAC;AAAA,CACf;AAED,8EAA8E;AAC9E,kFAAkF;AAClF,0EAA0E;AAC1E,iFAAiF;AACjF,gFAAgF;AAChF,8CAA8C;AAC9C,EAAE;AACF,6EAA6E;AAC7E,iFAA+E;AAC/E,mFAAmF;AACnF,+EAA6E;AAC7E,gFAAgF;AAChF,+EAA+E;AAC/E,MAAM,UAAU,qBAAqB,GAAY;IAChD,IAAI,CAAC;QACJ,IAAI,WAAW,EAAE,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACzC,OAAO,mBAAmB,CAAC;YAC1B,QAAQ,EAAE,aAAa;YACvB,eAAe,EAAE,UAAU,EAAE,CAAC,gBAAgB;YAC9C,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;SAChD,CAAC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AAAA,CACD;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAAa,EAAE,OAAO,GAA4B,EAAE,EAA2B;IACzH,2EAA2E;IAC3E,oDAAoD;IACpD,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,WAAW,GAAG,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,IAAI,GAA4B;QACrC,GAAG,EAAE,YAAY,CAAC,WAAW,EAAE,UAAU,EAAE,OAAO,CAAC,aAAa,CAAC;QACjE,IAAI;QACJ,2EAA2E;QAC3E,wEAAsE;QACtE,8EAA4E;QAC5E,MAAM,EAAE,KAAK;QACb,WAAW,EAAE,cAAc;KAC3B,CAAC;IAEF,MAAM,UAAU,GAAG,eAAe,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IACjF,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,KAAK,CAAC,kBAAkB,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACR,eAAe,EAAE,UAAU,MAAM,EAAE;gBACnC,cAAc,EAAE,kBAAkB;aAClC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC;SACrC,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,eAAe,GAAG,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1D,IAAI,eAAe,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,eAAe,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;;YAC3F,eAAe,CAAC,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;QAC3D,IAAI,eAAe,KAAK,OAAO;YAAE,MAAM,GAAG,CAAC;QAC3C,MAAM,aAAa,GAAG,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACjD,IAAI,GAAG,YAAY,KAAK;YAAE,aAAa,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QACxD,MAAM,aAAa,CAAC;IACrB,CAAC;IAED,+EAA+E;IAC/E,+EAA+E;IAC/E,gCAAgC;IAChC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,eAAe,CAAC,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,aAAa,CAAC,gBAAgB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,CAAC,MAAM,aAAa,IAAI,KAAK,SAAS,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED,8EAA8E;IAC9E,2EAA2E;IAC3E,4EAA4E;IAC5E,uEAAuE;IACvE,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;QACjB,eAAe,CAAC,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,oDAAoD,IAAI,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACJ,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,eAAe,CAAC,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzD,8EAA8E;QAC9E,iFAAiF;QACjF,iFAA+E;QAC/E,iFAAiF;QACjF,kFAAkF;QAClF,mFAAmF;QACnF,kFAAkF;QAClF,mFAAmF;QACnF,mCAAmC;QACnC,MAAM,IAAI,GAAG,aAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,kDAAkD,IAAI,KAAK,IAAI,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,IAAI,IAA4B,CAAC;IACjC,IAAI,CAAC;QACJ,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,eAAe,CAAC,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzD,MAAM,GAAG,CAAC;IACX,CAAC;IAED,eAAe,CAAC,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IAC9D,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;AAAA,CACjD","sourcesContent":["import { existsSync, readFileSync } from \"node:fs\";\nimport { activityMonitor } from \"./activity.ts\";\nimport type { SearchOptions, SearchResponse } from \"./perplexity.ts\";\nimport { hasCredentialSource, redactCredential, resolveCredential } from \"./credential-source.ts\";\nimport { getWebSearchConfigPath } from \"./utils.ts\";\n\nconst BRIGHTDATA_API_URL = \"https://api.brightdata.com/request\";\nconst CONFIG_PATH = getWebSearchConfigPath();\nconst SEARCH_TIMEOUT_MS = 60_000;\n\n// Bright Data proxies a real Google SERP through a provisioned \"zone\" and bills\n// per successful request against it. A SERP zone (Bright Data zone type `serp`)\n// and a Web Unlocker zone (type `unblocker`) are separate products with separate\n// prices, so the zone used for search is its own required setting and is never\n// guessed: the wrong zone is either an opaque 400 or a charge against the wrong\n// line of the invoice. Pricing: https://brightdata.com/pricing\nconst ZONE_PATTERN = /^[A-Za-z0-9_-]+$/;\n\n// Google's own time filter, passed straight through in the proxied URL. Unlike a\n// query-text hint this is an engine-side filter, so results outside the window\n// are not returned at all.\nconst RECENCY_TBS: Record<string, string> = {\n\tday: \"qdr:d\",\n\tweek: \"qdr:w\",\n\tmonth: \"qdr:m\",\n\tyear: \"qdr:y\",\n};\n\ninterface WebSearchConfig {\n\tbrightdataApiKey?: unknown;\n\tbrightdataSerpZone?: unknown;\n}\n\ninterface BrightDataOrganicResult {\n\tlink?: unknown;\n\ttitle?: unknown;\n\tdescription?: unknown;\n}\n\ninterface BrightDataSerpResponse {\n\torganic?: BrightDataOrganicResult[];\n}\n\ninterface BrightDataSearchOptions extends SearchOptions {\n\t// Accepted for parity with the other providers and deliberately ignored: a\n\t// SERP zone returns ranked links, never page bodies, so there is nothing to\n\t// return inline and `inlineContent` is never set.\n\tincludeContent?: boolean;\n}\n\nlet cachedConfig: WebSearchConfig | null = null;\n\n// `web-search.json` is a credential store: its own text is the secret. V8 quotes a\n// window of the source it choked on back inside the `JSON.parse` message — with a\n// short file, the whole file — so `{\"brightdataApiKey\": bd-real-token}` (quotes\n// forgotten around a pasted token) produces\n// `Unexpected token 'b', \"{\"brightdataApiKey\": bd-real-token}\" is not valid JSON`.\n// There is no credential to redact against at this point, because the credential is\n// what the file was being read for, so the parser's text is dropped entirely and only\n// its position is kept. That position is also the only part that cannot carry a\n// status-shaped phrase into `providerErrorStatus`.\n//\n// This is a deliberate divergence from `serpdive.ts:59-62`, `brave.ts:33-36`,\n// `anysearch.ts:48-51` and `firecrawl.ts:50-53`, which all quote the parser message\n// verbatim. They have the same leak; fixing it for every provider is a separate\n// change, and this module is not going to copy the bug forward to justify symmetry.\nfunction configParseDetail(err: unknown): string {\n\tconst position = errorMessage(err).match(/at position \\d+(?: \\(line \\d+ column \\d+\\))?/i);\n\treturn position ? `not valid JSON, ${position[0]}` : \"not valid JSON\";\n}\n\nfunction loadConfig(): WebSearchConfig {\n\tif (cachedConfig) return cachedConfig;\n\tif (!existsSync(CONFIG_PATH)) {\n\t\tcachedConfig = {};\n\t\treturn cachedConfig;\n\t}\n\n\tconst raw = readFileSync(CONFIG_PATH, \"utf-8\");\n\tlet parsed: unknown;\n\ttry {\n\t\tparsed = JSON.parse(raw);\n\t} catch (err) {\n\t\tthrow new Error(`Failed to parse ${CONFIG_PATH}: ${configParseDetail(err)}`);\n\t}\n\tif (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n\t\tthrow new Error(`Invalid config in ${CONFIG_PATH}: expected a JSON object`);\n\t}\n\tcachedConfig = parsed as WebSearchConfig;\n\treturn cachedConfig;\n}\n\nasync function getApiKey(signal?: AbortSignal): Promise<string | null> {\n\treturn resolveCredential({\n\t\tprovider: \"Bright Data\",\n\t\tconfiguredValue: loadConfig().brightdataApiKey,\n\t\tenvironmentValue: process.env.BRIGHTDATA_API_KEY,\n\t\tsignal,\n\t});\n}\n\nasync function requireApiKey(signal?: AbortSignal): Promise<string> {\n\tconst apiKey = await getApiKey(signal);\n\tif (!apiKey) {\n\t\tthrow new Error(\n\t\t\t\"Bright Data API key not found. Either:\\n\" +\n\t\t\t`  1. Create ${CONFIG_PATH} with { \"brightdataApiKey\": \"your-key\" }\\n` +\n\t\t\t\"  2. Set BRIGHTDATA_API_KEY environment variable\\n\" +\n\t\t\t\"Get a key at https://brightdata.com/cp/setting/users\",\n\t\t);\n\t}\n\treturn apiKey;\n}\n\n// A zone name is an account-scoped identifier, not a URL. Validating the charset\n// here keeps a stray value out of the request body, where Bright Data reports it\n// as a generic 400 that reads like a credential problem.\n//\n// Total by construction: an invalid zone is `null`, never a throw.\n// `isBrightDataAvailable()` reads this, and availability is evaluated outside its\n// callers' error handling — `gemini-search.ts` checks it before entering the\n// per-provider try/catch, and `index.ts` awaits `getProviderAvailability()` on the\n// `web_search` path with nothing around it. A throw here would therefore take\n// `web_search` down for Brave and OpenAI too, over one mistyped Bright Data\n// setting. The loud, actionable error belongs on the request path, in\n// `requireSerpZone()`, where only this provider is affected.\nfunction normalizeZone(value: unknown): string | null {\n\tif (typeof value !== \"string\") return null;\n\tconst trimmed = value.trim();\n\tif (!trimmed) return null;\n\treturn ZONE_PATTERN.test(trimmed) ? trimmed : null;\n}\n\ninterface ZoneSetting {\n\traw: string;\n\tlabel: string;\n}\n\n// Resolved by presence, not by validity: a `BRIGHTDATA_SERP_ZONE` that is set but\n// malformed must not silently hand the request to the config file's zone. The\n// setting the user actually filled in is the setting the error names.\nfunction serpZoneSetting(): ZoneSetting | null {\n\tconst fromEnv = process.env.BRIGHTDATA_SERP_ZONE;\n\tif (typeof fromEnv === \"string\" && fromEnv.trim()) {\n\t\treturn { raw: fromEnv.trim(), label: \"BRIGHTDATA_SERP_ZONE\" };\n\t}\n\tconst configured = loadConfig().brightdataSerpZone;\n\tif (typeof configured === \"string\" && configured.trim()) {\n\t\treturn { raw: configured.trim(), label: `brightdataSerpZone in ${CONFIG_PATH}` };\n\t}\n\treturn null;\n}\n\nfunction getSerpZone(): string | null {\n\tconst setting = serpZoneSetting();\n\treturn setting ? normalizeZone(setting.raw) : null;\n}\n\n// There is no safe default, and in particular no fallback to a Web Unlocker zone:\n// `serp` and `unblocker` are different Bright Data zone types, priced differently,\n// and an Unlocker zone does not return SERP JSON — substituting one buys a\n// confusing paid failure instead of a search. A missing or malformed SERP zone\n// fails loudly here, before anything billable happens.\nfunction requireSerpZone(): string {\n\tconst setting = serpZoneSetting();\n\tconst zone = setting ? normalizeZone(setting.raw) : null;\n\tif (zone) return zone;\n\tif (setting) {\n\t\tthrow new Error(\n\t\t\t`Bright Data SERP zone is invalid: ${setting.label} must be a zone name of letters, digits, \"-\", or \"_\" ` +\n\t\t\t`(got \"${untrustedText(setting.raw, 60)}\").\\n` +\n\t\t\t\"The zone must be of Bright Data type `serp`; a Web Unlocker zone (type `unblocker`) is a different product and does not return SERP JSON.\\n\" +\n\t\t\t\"Create or rename one at https://brightdata.com/cp/zones\",\n\t\t);\n\t}\n\tthrow new Error(\n\t\t\"Bright Data SERP zone is invalid or missing. Either:\\n\" +\n\t\t`  1. Create ${CONFIG_PATH} with { \"brightdataSerpZone\": \"your_serp_zone\" }\\n` +\n\t\t\"  2. Set BRIGHTDATA_SERP_ZONE environment variable\\n\" +\n\t\t\"The zone must be of Bright Data type `serp`; a Web Unlocker zone is a different product and does not return SERP JSON.\\n\" +\n\t\t\"Create one at https://brightdata.com/cp/zones\",\n\t);\n}\n\nfunction normalizeCount(value: number | undefined): number {\n\tif (typeof value !== \"number\" || !Number.isFinite(value)) return 5;\n\treturn Math.max(1, Math.min(Math.floor(value), 20));\n}\n\nfunction normalizeDomain(value: string): string | null {\n\tlet input = value.trim().toLowerCase();\n\tif (!input) return null;\n\tif (input.startsWith(\"-\")) input = input.slice(1).trim();\n\tif (!input) return null;\n\ttry {\n\t\tconst parsed = input.includes(\"://\") ? new URL(input) : new URL(`https://${input}`);\n\t\tinput = parsed.hostname;\n\t} catch {\n\t\tinput = input.split(\"/\")[0]?.split(\":\")[0] ?? \"\";\n\t}\n\tinput = input.replace(/^\\.+|\\.+$/g, \"\");\n\treturn /^[a-z0-9][a-z0-9.-]*\\.[a-z]{2,}$/i.test(input) ? input : null;\n}\n\ninterface DomainFilters {\n\tinclude: string[];\n\texclude: string[];\n}\n\nfunction parseDomainFilter(domainFilter: string[] | undefined): DomainFilters {\n\tconst filters: DomainFilters = { include: [], exclude: [] };\n\tif (!domainFilter?.length) return filters;\n\tfor (const raw of domainFilter) {\n\t\tconst domain = normalizeDomain(raw);\n\t\tif (!domain) continue;\n\t\tconst target = raw.trim().startsWith(\"-\") ? filters.exclude : filters.include;\n\t\tif (!target.includes(domain)) target.push(domain);\n\t}\n\treturn filters;\n}\n\n// Bright Data has no domain parameter, but the engine behind it is Google, so the\n// filter is expressed the way Google expresses it: as `site:` operators inside\n// the query. That asks the engine for the right pages instead of discarding the\n// wrong ones locally — the difference SERPdive documents as a limitation.\nfunction buildSearchQuery(query: string, filters: DomainFilters): string {\n\tconst parts = [query];\n\tif (filters.include.length === 1) {\n\t\tparts.push(`site:${filters.include[0]}`);\n\t} else if (filters.include.length > 1) {\n\t\tparts.push(filters.include.map((domain) => `site:${domain}`).join(\" OR \"));\n\t}\n\tfor (const domain of filters.exclude) {\n\t\tparts.push(`-site:${domain}`);\n\t}\n\treturn parts.join(\" \");\n}\n\nfunction buildSerpUrl(searchQuery: string, numResults: number, recencyFilter: SearchOptions[\"recencyFilter\"]): string {\n\tconst params = new URLSearchParams({ q: searchQuery });\n\t// One SERP request is billed once whatever `num` says, so asking for a little\n\t// headroom is free and leaves something to keep after local re-filtering.\n\tparams.set(\"num\", String(Math.min(numResults + 5, 20)));\n\tconst tbs = recencyFilter ? RECENCY_TBS[recencyFilter] : undefined;\n\tif (tbs) params.set(\"tbs\", tbs);\n\t// `brd_json=1` is what makes Bright Data return the SERP as JSON instead of\n\t// Google's HTML. Without it `data_format: \"parsed_light\"` has nothing to read.\n\tparams.set(\"brd_json\", \"1\");\n\treturn `https://www.google.com/search?${params.toString()}`;\n}\n\nfunction domainMatches(hostname: string, domain: string): boolean {\n\treturn hostname === domain || hostname.endsWith(`.${domain}`);\n}\n\n// `site:` narrows the SERP but does not guarantee it: Google still mixes in\n// related hosts, and an OR group is honoured loosely. The same filter is applied\n// again here so the contract holds on what is actually returned.\nfunction passesDomainFilters(url: string, filters: DomainFilters): boolean {\n\tif (filters.include.length === 0 && filters.exclude.length === 0) return true;\n\tlet hostname: string;\n\ttry {\n\t\thostname = new URL(url).hostname.toLowerCase();\n\t} catch {\n\t\treturn false;\n\t}\n\tif (filters.exclude.some((domain) => domainMatches(hostname, domain))) return false;\n\tif (filters.include.length === 0) return true;\n\treturn filters.include.some((domain) => domainMatches(hostname, domain));\n}\n\nfunction requestSignal(signal?: AbortSignal): AbortSignal {\n\tconst timeout = AbortSignal.timeout(SEARCH_TIMEOUT_MS);\n\treturn signal ? AbortSignal.any([signal, timeout]) : timeout;\n}\n\nfunction errorMessage(err: unknown): string {\n\treturn err instanceof Error ? err.message : String(err);\n}\n\n// Text that did not originate here — a proxied response body, a `JSON.parse`\n// message quoting that body, a config value — is quoted into Error messages, and\n// `gemini-search.ts` classifies routing failures by reading a status back out of\n// the message text (`providerErrorStatus`, /\\b(?:error|status|http)\\s+(\\d{3})\\b/).\n// A proxied Google interstitial that merely mentions \"Error 503\" would otherwise\n// be read as *our* status and retried as a transient failure, when what actually\n// happened is that a 200 was billed and is unusable. Status-shaped phrases in\n// quoted text are rewritten to `upstream <code>`: the number is still reported,\n// but only this module's own wording can name the status we received.\nconst STATUS_SHAPED_PATTERN = /\\b(?:error|status|http)[\\s:=-]{1,4}(\\d{3})\\b/gi;\n\n// `providerErrorStatus` is not the only thing that reads our message.\n// `classifyProviderError` also matches bare keyword phrases, and its branch order\n// decides which ones can reach us: `searchRouting.fallbackOn` accepts only\n// `transient`, `quota` and `network`, and of those three only the `quota` branch\n// (/rate limit|quota|too many requests/) runs BEFORE the `invalid-response` branch\n// that this module's own wording always triggers. So a billed 200 whose body reads\n// \"You have exceeded your rate limit\" would classify as `quota`, and with\n// `fallbackOn: [\"quota\"]` the user is charged, silently served the next provider's\n// answer, and shown no diagnostic — the failure mode this module exists to prevent.\n// `transient` and `network` sit after `invalid-response` and are unreachable for the\n// same reason; the test suite pins that ordering assumption rather than trusting it.\n//\n// The phrase is replaced rather than removed: the reader still learns the upstream\n// page mentioned a rate limit, but no substring of the replacement matches any\n// classifier branch (\"rate-limit\" is hyphenated, so /rate limit/ cannot match).\nconst QUOTA_SHAPED_PATTERN = /rate limit|quota|too many requests/gi;\n\n// The complete inventory of places foreign text is quoted into a message or a log\n// line, and what each one is required to apply. Adding a fifth means adding it here:\n//\n// | site                                            | redactCredential | untrustedText |\n// | ----------------------------------------------- | ---------------- | ------------- |\n// | non-2xx response body                           | yes              | yes (300)     |\n// | invalid-JSON raw body                           | yes              | yes (300)     |\n// | Bright Data's own 200 error envelope            | yes              | yes (200)     |\n// | transport/abort error from `fetch`               | yes              | n/a — see (a) |\n// | rejected zone value                             | n/a — see (b)    | yes (60)      |\n// | `JSON.parse` message on a response body         | n/a — see (c)    | n/a — see (c) |\n// | `JSON.parse` failure on `web-search.json`       | n/a — see (c)    | n/a — see (c) |\n//\n// (a) That message is generated locally by undici or by `AbortSignal`, never by the\n//     proxied page, and the abort branch below matches on it; collapsing and\n//     truncating it would buy nothing and could break that match.\n// (b) The zone is resolved *before* the credential on purpose, so that a config\n//     mistake never spawns a `!command` resolver. There is therefore no key to redact\n//     against yet, and the value being echoed is the user's own zone setting.\n// (c) Neither parser message is quoted at all, so neither needs a filter or a cap. V8\n//     embeds a *prefix* of the offending input in its message, and `redactCredential`\n//     substitutes whole values, so a prefix cannot be redacted out of it. Dropping the\n//     message removes the leak by construction — see `configParseDetail` and the\n//     `JSON.parse` catch on the response path.\n\n// Truncation happens BEFORE the rewrite, and the order is the whole point.\n// `STATUS_SHAPED_PATTERN` requires `(\\d{3})\\b`, so `error 5031` is deliberately left\n// alone — it is not a status. Sanitising first and slicing second let the cut land on\n// the 4th digit and hand back a freshly forged `error 503`, which\n// `gemini-search.ts`'s `providerErrorStatus` then reads as *our* status: a billed 200\n// classified `transient` and silently re-run on the next provider. Slicing first means\n// the rewrite always sees the exact text that will be quoted.\n//\n// The rewrite runs last and is therefore allowed to push the result a few characters\n// past `limit` (\"error 503\" → \"upstream 503\"). `limit` bounds how much upstream text is\n// quoted, not the final string length; a second `slice()` after the rewrite would\n// re-open exactly the hole this ordering closes.\nfunction untrustedText(text: string, limit = 300): string {\n\treturn text\n\t\t.replace(/\\s+/g, \" \")\n\t\t.trim()\n\t\t.slice(0, limit)\n\t\t.replace(STATUS_SHAPED_PATTERN, \"upstream $1\")\n\t\t.replace(QUOTA_SHAPED_PATTERN, \"upstream rate-limit notice\");\n}\n\nfunction invalidResponse(zone: string, message: string): Error {\n\treturn new Error(`Bright Data API returned invalid response for zone ${zone}: ${message}`);\n}\n\n// Bright Data reports some failures inside a normal HTTP 200 body — e.g.\n// `{\"error\":\"zone not found\",\"code\":\"zone_missing\"}` — because `format: \"raw\"`\n// means the HTTP layer describes the proxy hop, not the outcome.\n//\n// The envelope is upstream text, so it gets the same two-step treatment as every other\n// quoted body: `redactCredential` first (an upstream \"token <yours> is not valid for\n// this zone\" must not reprint the token), then `untrustedText`.\nfunction envelopeError(envelope: Record<string, unknown>, apiKey: string | null): string | null {\n\tconst parts: string[] = [];\n\tconst { error, errors } = envelope;\n\tif (typeof error === \"string\" && error.trim()) parts.push(error.trim());\n\telse if (error && typeof error === \"object\") parts.push(JSON.stringify(error));\n\tif (Array.isArray(errors) && errors.length > 0) parts.push(JSON.stringify(errors));\n\telse if (typeof errors === \"string\" && errors.trim()) parts.push(errors.trim());\n\tif (parts.length === 0) return null;\n\tfor (const key of [\"code\", \"error_code\"]) {\n\t\tconst code = envelope[key];\n\t\tif (typeof code === \"string\" && code.trim()) parts.push(`${key} ${code.trim()}`);\n\t\telse if (typeof code === \"number\") parts.push(`${key} ${code}`);\n\t}\n\treturn untrustedText(redactCredential(parts.join(\", \"), apiKey), 200);\n}\n\n// The envelope is validated strictly — every branch below throws — because a\n// shape this provider cannot read means the request was billed for something\n// unusable, and returning `{ answer: \"\", results: [] }` would report a paid\n// failure as \"the web had no answer\". That includes the two shapes that are JSON\n// but not a SERP: Bright Data's own error envelope, and an envelope with no\n// `organic` array at all. anysearch.ts rejects the equivalent shape the same way.\n// Individual organic entries are the one deliberate exception: a real SERP mixes\n// in entries with no link, and one of those must not throw away a page of results\n// that was already paid for.\nfunction parseSerpResponse(value: unknown, zone: string, apiKey: string | null): BrightDataSerpResponse {\n\tif (!value || typeof value !== \"object\" || Array.isArray(value)) {\n\t\tthrow invalidResponse(zone, \"expected an object envelope\");\n\t}\n\tconst envelope = value as Record<string, unknown>;\n\tconst upstreamError = envelopeError(envelope, apiKey);\n\tif (upstreamError) {\n\t\tthrow invalidResponse(zone, `Bright Data reported an error instead of a SERP: ${upstreamError}`);\n\t}\n\tif (envelope.organic === undefined || envelope.organic === null) {\n\t\tthrow invalidResponse(\n\t\t\tzone,\n\t\t\t\"expected an organic array and the envelope carried none. A `serp` zone queried with brd_json=1 \" +\n\t\t\t\"returns { organic: [...] }; a zone of type `unblocker`, or a missing brd_json=1, is the usual cause\",\n\t\t);\n\t}\n\tif (!Array.isArray(envelope.organic)) throw invalidResponse(zone, \"expected organic array\");\n\tconst organic: BrightDataOrganicResult[] = [];\n\tfor (const [index, entry] of envelope.organic.entries()) {\n\t\tif (!entry || typeof entry !== \"object\" || Array.isArray(entry)) {\n\t\t\tthrow invalidResponse(zone, `expected organic[${index}] object`);\n\t\t}\n\t\torganic.push(entry as BrightDataOrganicResult);\n\t}\n\treturn { organic };\n}\n\nfunction mapResults(\n\torganic: BrightDataOrganicResult[] | undefined,\n\tnumResults: number,\n\tfilters: DomainFilters,\n): SearchResponse[\"results\"] {\n\tif (!Array.isArray(organic)) return [];\n\tconst mapped: SearchResponse[\"results\"] = [];\n\tfor (const item of organic) {\n\t\tconst url = typeof item.link === \"string\" ? item.link.trim() : \"\";\n\t\tif (!url || !passesDomainFilters(url, filters)) continue;\n\t\tconst title = typeof item.title === \"string\" ? item.title.trim() : \"\";\n\t\tmapped.push({\n\t\t\ttitle: title || `Source ${mapped.length + 1}`,\n\t\t\turl,\n\t\t\tsnippet: typeof item.description === \"string\" ? item.description.replace(/\\s+/g, \" \").trim() : \"\",\n\t\t});\n\t\tif (mapped.length >= numResults) break;\n\t}\n\treturn mapped;\n}\n\n// A SERP zone returns ranked links, never a synthesized answer, so one is\n// assembled from the sources — the same shape brave.ts and searxng.ts produce.\nfunction buildAnswer(results: SearchResponse[\"results\"]): string {\n\treturn results\n\t\t.map((result) => result.snippet\n\t\t\t? `${result.snippet}\\nSource: ${result.title} (${result.url})`\n\t\t\t: `Source: ${result.title} (${result.url})`)\n\t\t.join(\"\\n\\n\");\n}\n\n// Both halves are required: a token with no zone cannot make a request, and a\n// zone with no token cannot either. Availability therefore checks the config this\n// surface actually needs rather than merely a key, the way firecrawl.ts's\n// `isFirecrawlAvailable()` checks its required base URL. Reporting \"unavailable\"\n// for a half-finished setup keeps the incomplete case out of provider selection\n// instead of turning it into a failed search.\n//\n// It is also a pure predicate that cannot throw. Callers evaluate it outside\n// their error handling — `gemini-search.ts` before the per-provider try/catch,\n// `index.ts` in the uncaught `getProviderAvailability()` await on the `web_search`\n// path — so any throw from a malformed Bright Data setting or an unparseable\n// config file would break search for every other provider too. Misconfiguration\n// makes this provider unavailable here; the request path reports it in detail.\nexport function isBrightDataAvailable(): boolean {\n\ttry {\n\t\tif (getSerpZone() === null) return false;\n\t\treturn hasCredentialSource({\n\t\t\tprovider: \"Bright Data\",\n\t\t\tconfiguredValue: loadConfig().brightdataApiKey,\n\t\t\tenvironmentValue: process.env.BRIGHTDATA_API_KEY,\n\t\t});\n\t} catch {\n\t\treturn false;\n\t}\n}\n\nexport async function searchWithBrightData(query: string, options: BrightDataSearchOptions = {}): Promise<SearchResponse> {\n\t// Zone before key: a config mistake must not spawn a `!command` credential\n\t// resolver, and must not reach a billable endpoint.\n\tconst zone = requireSerpZone();\n\tconst apiKey = await requireApiKey(options.signal);\n\tconst numResults = normalizeCount(options.numResults);\n\tconst filters = parseDomainFilter(options.domainFilter);\n\tconst searchQuery = buildSearchQuery(query, filters);\n\tconst body: Record<string, unknown> = {\n\t\turl: buildSerpUrl(searchQuery, numResults, options.recencyFilter),\n\t\tzone,\n\t\t// `format: \"raw\"` returns the proxied body verbatim; `data_format` selects\n\t\t// Bright Data's own parsing of it. `parsed_light` is the SERP shape —\n\t\t// { organic: [{ link, title, description }] } — and carries no page bodies.\n\t\tformat: \"raw\",\n\t\tdata_format: \"parsed_light\",\n\t};\n\n\tconst activityId = activityMonitor.logStart({ type: \"api\", query: searchQuery });\n\tlet response: Response;\n\ttry {\n\t\tresponse = await fetch(BRIGHTDATA_API_URL, {\n\t\t\tmethod: \"POST\",\n\t\t\theaders: {\n\t\t\t\t\"Authorization\": `Bearer ${apiKey}`,\n\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t},\n\t\t\tbody: JSON.stringify(body),\n\t\t\tsignal: requestSignal(options.signal),\n\t\t});\n\t} catch (err) {\n\t\tconst message = errorMessage(err);\n\t\tconst redactedMessage = redactCredential(message, apiKey);\n\t\tif (redactedMessage.toLowerCase().includes(\"abort\")) activityMonitor.logComplete(activityId, 0);\n\t\telse activityMonitor.logError(activityId, redactedMessage);\n\t\tif (redactedMessage === message) throw err;\n\t\tconst redactedError = new Error(redactedMessage);\n\t\tif (err instanceof Error) redactedError.name = err.name;\n\t\tthrow redactedError;\n\t}\n\n\t// Every thrown message names the zone the request was billed against: with two\n\t// Bright Data zone types in play, \"which zone did I pay on\" is the first thing\n\t// a paid failure has to answer.\n\tif (!response.ok) {\n\t\tactivityMonitor.logComplete(activityId, response.status);\n\t\tconst errorText = untrustedText(redactCredential(await response.text(), apiKey));\n\t\tthrow new Error(`Bright Data API error ${response.status} for zone ${zone}: ${errorText}`);\n\t}\n\n\t// The body is read as text before parsing on purpose. `format: \"raw\"` means a\n\t// 200 can still carry an upstream interstitial instead of SERP JSON, and a\n\t// bare parser error (\"Unexpected token <\") hides a request that was billed.\n\t// Quoting the body is the only way the user learns what they paid for.\n\tconst raw = await response.text();\n\tif (!raw.trim()) {\n\t\tactivityMonitor.logComplete(activityId, response.status);\n\t\tthrow new Error(`Bright Data API returned empty response for zone ${zone}`);\n\t}\n\n\tlet rawData: unknown;\n\ttry {\n\t\trawData = JSON.parse(raw);\n\t} catch (err) {\n\t\tactivityMonitor.logComplete(activityId, response.status);\n\t\t// The parser's own message is deliberately NOT quoted here. V8 embeds a short\n\t\t// window of the offending input in it (`Unexpected token 'x', \"xxxxxxxx-x\"...`),\n\t\t// and that window is a *prefix* of the body — so when the body starts with the\n\t\t// credential, `redactCredential` cannot match it: it replaces the whole key, and\n\t\t// a 10-character prefix is not the whole key. Redacting the detail half therefore\n\t\t// still printed 10 cleartext characters of the token. The detail also adds nothing\n\t\t// this message does not already carry: the wording names the failure and the body\n\t\t// below shows what arrived, filtered. Dropping it removes the leak by construction\n\t\t// rather than by pattern-matching.\n\t\tconst body = untrustedText(redactCredential(raw, apiKey));\n\t\tthrow new Error(`Bright Data API returned invalid JSON for zone ${zone}: ${body}`);\n\t}\n\n\tlet data: BrightDataSerpResponse;\n\ttry {\n\t\tdata = parseSerpResponse(rawData, zone, apiKey);\n\t} catch (err) {\n\t\tactivityMonitor.logComplete(activityId, response.status);\n\t\tthrow err;\n\t}\n\n\tactivityMonitor.logComplete(activityId, response.status);\n\tconst results = mapResults(data.organic, numResults, filters);\n\treturn { answer: buildAnswer(results), results };\n}\n"]}
+{"version":3,"file":"brightdata.js","sourceRoot":"","sources":["../../../../src/humain/web-access/vendor/brightdata.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAClG,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEpD,MAAM,kBAAkB,GAAG,oCAAoC,CAAC;AAChE,MAAM,WAAW,GAAG,sBAAsB,EAAE,CAAC;AAC7C,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC,gFAAgF;AAChF,gFAAgF;AAChF,iFAAiF;AACjF,+EAA+E;AAC/E,gFAAgF;AAChF,+DAA+D;AAC/D,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAExC,iFAAiF;AACjF,+EAA+E;AAC/E,2BAA2B;AAC3B,MAAM,WAAW,GAA2B;IAC3C,GAAG,EAAE,OAAO;IACZ,IAAI,EAAE,OAAO;IACb,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,OAAO;CACb,CAAC;AAwBF,IAAI,YAAY,GAA2B,IAAI,CAAC;AAEhD,mFAAmF;AACnF,kFAAkF;AAClF,gFAAgF;AAChF,4CAA4C;AAC5C,mFAAmF;AACnF,oFAAoF;AACpF,sFAAsF;AACtF,gFAAgF;AAChF,mDAAmD;AACnD,EAAE;AACF,8EAA8E;AAC9E,oFAAoF;AACpF,gFAAgF;AAChF,oFAAoF;AACpF,SAAS,iBAAiB,CAAC,GAAY;IACtC,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC1F,OAAO,QAAQ,CAAC,CAAC,CAAC,mBAAmB,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC;AACvE,CAAC;AAED,SAAS,UAAU;IAClB,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IACtC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC9B,YAAY,GAAG,EAAE,CAAC;QAClB,OAAO,YAAY,CAAC;IACrB,CAAC;IAED,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC/C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,mBAAmB,WAAW,KAAK,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,qBAAqB,WAAW,0BAA0B,CAAC,CAAC;IAC7E,CAAC;IACD,YAAY,GAAG,MAAyB,CAAC;IACzC,OAAO,YAAY,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,MAAoB;IAC5C,OAAO,iBAAiB,CAAC;QACxB,QAAQ,EAAE,aAAa;QACvB,eAAe,EAAE,UAAU,EAAE,CAAC,gBAAgB;QAC9C,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAChD,MAAM;KACN,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,MAAoB;IAChD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACd,0CAA0C;YAC1C,eAAe,WAAW,4CAA4C;YACtE,oDAAoD;YACpD,sDAAsD,CACtD,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,iFAAiF;AACjF,iFAAiF;AACjF,yDAAyD;AACzD,EAAE;AACF,mEAAmE;AACnE,kFAAkF;AAClF,6EAA6E;AAC7E,mFAAmF;AACnF,8EAA8E;AAC9E,4EAA4E;AAC5E,sEAAsE;AACtE,6DAA6D;AAC7D,SAAS,aAAa,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AACpD,CAAC;AAOD,kFAAkF;AAClF,8EAA8E;AAC9E,sEAAsE;AACtE,SAAS,eAAe;IACvB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IACjD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QACnD,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAC/D,CAAC;IACD,MAAM,UAAU,GAAG,UAAU,EAAE,CAAC,kBAAkB,CAAC;IACnD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;QACzD,OAAO,EAAE,GAAG,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,yBAAyB,WAAW,EAAE,EAAE,CAAC;IAClF,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,WAAW;IACnB,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;IAClC,OAAO,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACpD,CAAC;AAED,kFAAkF;AAClF,mFAAmF;AACnF,2EAA2E;AAC3E,+EAA+E;AAC/E,uDAAuD;AACvD,SAAS,eAAe;IACvB,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACd,qCAAqC,OAAO,CAAC,KAAK,uDAAuD;YACzG,SAAS,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO;YAC9C,6IAA6I;YAC7I,yDAAyD,CACzD,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CACd,wDAAwD;QACxD,eAAe,WAAW,oDAAoD;QAC9E,sDAAsD;QACtD,0HAA0H;QAC1H,+CAA+C,CAC/C,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAyB;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACnE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACrC,IAAI,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACvC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACzD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC;QACpF,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACR,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,CAAC;IACD,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACxC,OAAO,mCAAmC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACvE,CAAC;AAOD,SAAS,iBAAiB,CAAC,YAAkC;IAC5D,MAAM,OAAO,GAAkB,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC5D,IAAI,CAAC,YAAY,EAAE,MAAM;QAAE,OAAO,OAAO,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QAC9E,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,kFAAkF;AAClF,+EAA+E;AAC/E,gFAAgF;AAChF,0EAA0E;AAC1E,SAAS,gBAAgB,CAAC,KAAa,EAAE,OAAsB;IAC9D,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC;IACtB,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,QAAQ,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1C,CAAC;SAAM,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,YAAY,CAAC,WAAmB,EAAE,UAAkB,EAAE,aAA6C;IAC3G,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;IACvD,8EAA8E;IAC9E,0EAA0E;IAC1E,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,IAAI,GAAG;QAAE,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAChC,4EAA4E;IAC5E,+EAA+E;IAC/E,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC5B,OAAO,iCAAiC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC7D,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB,EAAE,MAAc;IACtD,OAAO,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,4EAA4E;AAC5E,iFAAiF;AACjF,iEAAiE;AACjE,SAAS,mBAAmB,CAAC,GAAW,EAAE,OAAsB;IAC/D,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACJ,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACpF,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,aAAa,CAAC,MAAoB;IAC1C,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACvD,OAAO,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AAC9D,CAAC;AAED,SAAS,YAAY,CAAC,GAAY;IACjC,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACzD,CAAC;AAED,6EAA6E;AAC7E,iFAAiF;AACjF,iFAAiF;AACjF,mFAAmF;AACnF,iFAAiF;AACjF,iFAAiF;AACjF,8EAA8E;AAC9E,gFAAgF;AAChF,sEAAsE;AACtE,MAAM,qBAAqB,GAAG,gDAAgD,CAAC;AAE/E,sEAAsE;AACtE,kFAAkF;AAClF,2EAA2E;AAC3E,iFAAiF;AACjF,mFAAmF;AACnF,mFAAmF;AACnF,0EAA0E;AAC1E,mFAAmF;AACnF,oFAAoF;AACpF,qFAAqF;AACrF,qFAAqF;AACrF,EAAE;AACF,mFAAmF;AACnF,+EAA+E;AAC/E,gFAAgF;AAChF,MAAM,oBAAoB,GAAG,sCAAsC,CAAC;AAEpE,kFAAkF;AAClF,qFAAqF;AACrF,EAAE;AACF,yFAAyF;AACzF,yFAAyF;AACzF,yFAAyF;AACzF,yFAAyF;AACzF,yFAAyF;AACzF,0FAA0F;AAC1F,yFAAyF;AACzF,yFAAyF;AACzF,yFAAyF;AACzF,EAAE;AACF,oFAAoF;AACpF,6EAA6E;AAC7E,kEAAkE;AAClE,gFAAgF;AAChF,sFAAsF;AACtF,8EAA8E;AAC9E,sFAAsF;AACtF,sFAAsF;AACtF,uFAAuF;AACvF,iFAAiF;AACjF,+CAA+C;AAE/C,2EAA2E;AAC3E,qFAAqF;AACrF,sFAAsF;AACtF,kEAAkE;AAClE,sFAAsF;AACtF,uFAAuF;AACvF,8DAA8D;AAC9D,EAAE;AACF,qFAAqF;AACrF,wFAAwF;AACxF,kFAAkF;AAClF,iDAAiD;AACjD,SAAS,aAAa,CAAC,IAAY,EAAE,KAAK,GAAG,GAAG;IAC/C,OAAO,IAAI;SACT,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE;SACN,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;SACf,OAAO,CAAC,qBAAqB,EAAE,aAAa,CAAC;SAC7C,OAAO,CAAC,oBAAoB,EAAE,4BAA4B,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,OAAe;IACrD,OAAO,IAAI,KAAK,CAAC,sDAAsD,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;AAC5F,CAAC;AAED,yEAAyE;AACzE,+EAA+E;AAC/E,iEAAiE;AACjE,EAAE;AACF,uFAAuF;AACvF,qFAAqF;AACrF,gEAAgE;AAChE,SAAS,aAAa,CAAC,QAAiC,EAAE,MAAqB;IAC9E,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;SACnE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/E,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;SAC9E,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE;QAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAChF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;aAC5E,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,aAAa,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;AACvE,CAAC;AAED,6EAA6E;AAC7E,6EAA6E;AAC7E,4EAA4E;AAC5E,iFAAiF;AACjF,4EAA4E;AAC5E,kFAAkF;AAClF,iFAAiF;AACjF,kFAAkF;AAClF,6BAA6B;AAC7B,SAAS,iBAAiB,CAAC,KAAc,EAAE,IAAY,EAAE,MAAqB;IAC7E,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjE,MAAM,eAAe,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,QAAQ,GAAG,KAAgC,CAAC;IAClD,MAAM,aAAa,GAAG,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACtD,IAAI,aAAa,EAAE,CAAC;QACnB,MAAM,eAAe,CAAC,IAAI,EAAE,oDAAoD,aAAa,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACjE,MAAM,eAAe,CACpB,IAAI,EACJ,iGAAiG;YACjG,qGAAqG,CACrG,CAAC;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,MAAM,eAAe,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;IAC5F,MAAM,OAAO,GAA8B,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QACzD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjE,MAAM,eAAe,CAAC,IAAI,EAAE,oBAAoB,KAAK,UAAU,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAC;AACpB,CAAC;AAED,SAAS,UAAU,CAClB,OAA8C,EAC9C,UAAkB,EAClB,OAAsB;IAEtB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IACvC,MAAM,MAAM,GAA8B,EAAE,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,IAAI,CAAC,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC;YAAE,SAAS;QACzD,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,KAAK,IAAI,UAAU,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE;YAC7C,GAAG;YACH,OAAO,EAAE,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;SACjG,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,IAAI,UAAU;YAAE,MAAM;IACxC,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,0EAA0E;AAC1E,+EAA+E;AAC/E,SAAS,WAAW,CAAC,OAAkC;IACtD,OAAO,OAAO;SACZ,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO;QAC9B,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,aAAa,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,GAAG,GAAG;QAC9D,CAAC,CAAC,WAAW,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,GAAG,GAAG,CAAC;SAC5C,IAAI,CAAC,MAAM,CAAC,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,kFAAkF;AAClF,0EAA0E;AAC1E,iFAAiF;AACjF,gFAAgF;AAChF,8CAA8C;AAC9C,EAAE;AACF,6EAA6E;AAC7E,+EAA+E;AAC/E,mFAAmF;AACnF,6EAA6E;AAC7E,gFAAgF;AAChF,+EAA+E;AAC/E,MAAM,UAAU,qBAAqB;IACpC,IAAI,CAAC;QACJ,IAAI,WAAW,EAAE,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACzC,OAAO,mBAAmB,CAAC;YAC1B,QAAQ,EAAE,aAAa;YACvB,eAAe,EAAE,UAAU,EAAE,CAAC,gBAAgB;YAC9C,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;SAChD,CAAC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAAa,EAAE,OAAO,GAA4B,EAAE;IAC9F,2EAA2E;IAC3E,oDAAoD;IACpD,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,WAAW,GAAG,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,IAAI,GAA4B;QACrC,GAAG,EAAE,YAAY,CAAC,WAAW,EAAE,UAAU,EAAE,OAAO,CAAC,aAAa,CAAC;QACjE,IAAI;QACJ,2EAA2E;QAC3E,sEAAsE;QACtE,4EAA4E;QAC5E,MAAM,EAAE,KAAK;QACb,WAAW,EAAE,cAAc;KAC3B,CAAC;IAEF,MAAM,UAAU,GAAG,eAAe,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IACjF,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,KAAK,CAAC,kBAAkB,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACR,eAAe,EAAE,UAAU,MAAM,EAAE;gBACnC,cAAc,EAAE,kBAAkB;aAClC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC;SACrC,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,eAAe,GAAG,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1D,IAAI,eAAe,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,eAAe,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;;YAC3F,eAAe,CAAC,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;QAC3D,IAAI,eAAe,KAAK,OAAO;YAAE,MAAM,GAAG,CAAC;QAC3C,MAAM,aAAa,GAAG,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACjD,IAAI,GAAG,YAAY,KAAK;YAAE,aAAa,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QACxD,MAAM,aAAa,CAAC;IACrB,CAAC;IAED,+EAA+E;IAC/E,+EAA+E;IAC/E,gCAAgC;IAChC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,eAAe,CAAC,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,aAAa,CAAC,gBAAgB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,CAAC,MAAM,aAAa,IAAI,KAAK,SAAS,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED,8EAA8E;IAC9E,2EAA2E;IAC3E,4EAA4E;IAC5E,uEAAuE;IACvE,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;QACjB,eAAe,CAAC,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,oDAAoD,IAAI,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACJ,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,eAAe,CAAC,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzD,8EAA8E;QAC9E,iFAAiF;QACjF,+EAA+E;QAC/E,iFAAiF;QACjF,kFAAkF;QAClF,mFAAmF;QACnF,kFAAkF;QAClF,mFAAmF;QACnF,mCAAmC;QACnC,MAAM,IAAI,GAAG,aAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,kDAAkD,IAAI,KAAK,IAAI,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,IAAI,IAA4B,CAAC;IACjC,IAAI,CAAC;QACJ,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,eAAe,CAAC,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzD,MAAM,GAAG,CAAC;IACX,CAAC;IAED,eAAe,CAAC,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IAC9D,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;AAClD,CAAC","sourcesContent":["import { existsSync, readFileSync } from \"node:fs\";\nimport { activityMonitor } from \"./activity.ts\";\nimport type { SearchOptions, SearchResponse } from \"./perplexity.ts\";\nimport { hasCredentialSource, redactCredential, resolveCredential } from \"./credential-source.ts\";\nimport { getWebSearchConfigPath } from \"./utils.ts\";\n\nconst BRIGHTDATA_API_URL = \"https://api.brightdata.com/request\";\nconst CONFIG_PATH = getWebSearchConfigPath();\nconst SEARCH_TIMEOUT_MS = 60_000;\n\n// Bright Data proxies a real Google SERP through a provisioned \"zone\" and bills\n// per successful request against it. A SERP zone (Bright Data zone type `serp`)\n// and a Web Unlocker zone (type `unblocker`) are separate products with separate\n// prices, so the zone used for search is its own required setting and is never\n// guessed: the wrong zone is either an opaque 400 or a charge against the wrong\n// line of the invoice. Pricing: https://brightdata.com/pricing\nconst ZONE_PATTERN = /^[A-Za-z0-9_-]+$/;\n\n// Google's own time filter, passed straight through in the proxied URL. Unlike a\n// query-text hint this is an engine-side filter, so results outside the window\n// are not returned at all.\nconst RECENCY_TBS: Record<string, string> = {\n\tday: \"qdr:d\",\n\tweek: \"qdr:w\",\n\tmonth: \"qdr:m\",\n\tyear: \"qdr:y\",\n};\n\ninterface WebSearchConfig {\n\tbrightdataApiKey?: unknown;\n\tbrightdataSerpZone?: unknown;\n}\n\ninterface BrightDataOrganicResult {\n\tlink?: unknown;\n\ttitle?: unknown;\n\tdescription?: unknown;\n}\n\ninterface BrightDataSerpResponse {\n\torganic?: BrightDataOrganicResult[];\n}\n\ninterface BrightDataSearchOptions extends SearchOptions {\n\t// Accepted for parity with the other providers and deliberately ignored: a\n\t// SERP zone returns ranked links, never page bodies, so there is nothing to\n\t// return inline and `inlineContent` is never set.\n\tincludeContent?: boolean;\n}\n\nlet cachedConfig: WebSearchConfig | null = null;\n\n// `web-search.json` is a credential store: its own text is the secret. V8 quotes a\n// window of the source it choked on back inside the `JSON.parse` message — with a\n// short file, the whole file — so `{\"brightdataApiKey\": bd-real-token}` (quotes\n// forgotten around a pasted token) produces\n// `Unexpected token 'b', \"{\"brightdataApiKey\": bd-real-token}\" is not valid JSON`.\n// There is no credential to redact against at this point, because the credential is\n// what the file was being read for, so the parser's text is dropped entirely and only\n// its position is kept. That position is also the only part that cannot carry a\n// status-shaped phrase into `providerErrorStatus`.\n//\n// This is a deliberate divergence from `serpdive.ts:59-62`, `brave.ts:33-36`,\n// `anysearch.ts:48-51` and `firecrawl.ts:50-53`, which all quote the parser message\n// verbatim. They have the same leak; fixing it for every provider is a separate\n// change, and this module is not going to copy the bug forward to justify symmetry.\nfunction configParseDetail(err: unknown): string {\n\tconst position = errorMessage(err).match(/at position \\d+(?: \\(line \\d+ column \\d+\\))?/i);\n\treturn position ? `not valid JSON, ${position[0]}` : \"not valid JSON\";\n}\n\nfunction loadConfig(): WebSearchConfig {\n\tif (cachedConfig) return cachedConfig;\n\tif (!existsSync(CONFIG_PATH)) {\n\t\tcachedConfig = {};\n\t\treturn cachedConfig;\n\t}\n\n\tconst raw = readFileSync(CONFIG_PATH, \"utf-8\");\n\tlet parsed: unknown;\n\ttry {\n\t\tparsed = JSON.parse(raw);\n\t} catch (err) {\n\t\tthrow new Error(`Failed to parse ${CONFIG_PATH}: ${configParseDetail(err)}`);\n\t}\n\tif (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n\t\tthrow new Error(`Invalid config in ${CONFIG_PATH}: expected a JSON object`);\n\t}\n\tcachedConfig = parsed as WebSearchConfig;\n\treturn cachedConfig;\n}\n\nasync function getApiKey(signal?: AbortSignal): Promise<string | null> {\n\treturn resolveCredential({\n\t\tprovider: \"Bright Data\",\n\t\tconfiguredValue: loadConfig().brightdataApiKey,\n\t\tenvironmentValue: process.env.BRIGHTDATA_API_KEY,\n\t\tsignal,\n\t});\n}\n\nasync function requireApiKey(signal?: AbortSignal): Promise<string> {\n\tconst apiKey = await getApiKey(signal);\n\tif (!apiKey) {\n\t\tthrow new Error(\n\t\t\t\"Bright Data API key not found. Either:\\n\" +\n\t\t\t`  1. Create ${CONFIG_PATH} with { \"brightdataApiKey\": \"your-key\" }\\n` +\n\t\t\t\"  2. Set BRIGHTDATA_API_KEY environment variable\\n\" +\n\t\t\t\"Get a key at https://brightdata.com/cp/setting/users\",\n\t\t);\n\t}\n\treturn apiKey;\n}\n\n// A zone name is an account-scoped identifier, not a URL. Validating the charset\n// here keeps a stray value out of the request body, where Bright Data reports it\n// as a generic 400 that reads like a credential problem.\n//\n// Total by construction: an invalid zone is `null`, never a throw.\n// `isBrightDataAvailable()` reads this, and availability is evaluated outside its\n// callers' error handling — `gemini-search.ts` checks it before entering the\n// per-provider try/catch, and `index.ts` awaits `getProviderAvailability()` on the\n// `web_search` path with nothing around it. A throw here would therefore take\n// `web_search` down for Brave and OpenAI too, over one mistyped Bright Data\n// setting. The loud, actionable error belongs on the request path, in\n// `requireSerpZone()`, where only this provider is affected.\nfunction normalizeZone(value: unknown): string | null {\n\tif (typeof value !== \"string\") return null;\n\tconst trimmed = value.trim();\n\tif (!trimmed) return null;\n\treturn ZONE_PATTERN.test(trimmed) ? trimmed : null;\n}\n\ninterface ZoneSetting {\n\traw: string;\n\tlabel: string;\n}\n\n// Resolved by presence, not by validity: a `BRIGHTDATA_SERP_ZONE` that is set but\n// malformed must not silently hand the request to the config file's zone. The\n// setting the user actually filled in is the setting the error names.\nfunction serpZoneSetting(): ZoneSetting | null {\n\tconst fromEnv = process.env.BRIGHTDATA_SERP_ZONE;\n\tif (typeof fromEnv === \"string\" && fromEnv.trim()) {\n\t\treturn { raw: fromEnv.trim(), label: \"BRIGHTDATA_SERP_ZONE\" };\n\t}\n\tconst configured = loadConfig().brightdataSerpZone;\n\tif (typeof configured === \"string\" && configured.trim()) {\n\t\treturn { raw: configured.trim(), label: `brightdataSerpZone in ${CONFIG_PATH}` };\n\t}\n\treturn null;\n}\n\nfunction getSerpZone(): string | null {\n\tconst setting = serpZoneSetting();\n\treturn setting ? normalizeZone(setting.raw) : null;\n}\n\n// There is no safe default, and in particular no fallback to a Web Unlocker zone:\n// `serp` and `unblocker` are different Bright Data zone types, priced differently,\n// and an Unlocker zone does not return SERP JSON — substituting one buys a\n// confusing paid failure instead of a search. A missing or malformed SERP zone\n// fails loudly here, before anything billable happens.\nfunction requireSerpZone(): string {\n\tconst setting = serpZoneSetting();\n\tconst zone = setting ? normalizeZone(setting.raw) : null;\n\tif (zone) return zone;\n\tif (setting) {\n\t\tthrow new Error(\n\t\t\t`Bright Data SERP zone is invalid: ${setting.label} must be a zone name of letters, digits, \"-\", or \"_\" ` +\n\t\t\t`(got \"${untrustedText(setting.raw, 60)}\").\\n` +\n\t\t\t\"The zone must be of Bright Data type `serp`; a Web Unlocker zone (type `unblocker`) is a different product and does not return SERP JSON.\\n\" +\n\t\t\t\"Create or rename one at https://brightdata.com/cp/zones\",\n\t\t);\n\t}\n\tthrow new Error(\n\t\t\"Bright Data SERP zone is invalid or missing. Either:\\n\" +\n\t\t`  1. Create ${CONFIG_PATH} with { \"brightdataSerpZone\": \"your_serp_zone\" }\\n` +\n\t\t\"  2. Set BRIGHTDATA_SERP_ZONE environment variable\\n\" +\n\t\t\"The zone must be of Bright Data type `serp`; a Web Unlocker zone is a different product and does not return SERP JSON.\\n\" +\n\t\t\"Create one at https://brightdata.com/cp/zones\",\n\t);\n}\n\nfunction normalizeCount(value: number | undefined): number {\n\tif (typeof value !== \"number\" || !Number.isFinite(value)) return 5;\n\treturn Math.max(1, Math.min(Math.floor(value), 20));\n}\n\nfunction normalizeDomain(value: string): string | null {\n\tlet input = value.trim().toLowerCase();\n\tif (!input) return null;\n\tif (input.startsWith(\"-\")) input = input.slice(1).trim();\n\tif (!input) return null;\n\ttry {\n\t\tconst parsed = input.includes(\"://\") ? new URL(input) : new URL(`https://${input}`);\n\t\tinput = parsed.hostname;\n\t} catch {\n\t\tinput = input.split(\"/\")[0]?.split(\":\")[0] ?? \"\";\n\t}\n\tinput = input.replace(/^\\.+|\\.+$/g, \"\");\n\treturn /^[a-z0-9][a-z0-9.-]*\\.[a-z]{2,}$/i.test(input) ? input : null;\n}\n\ninterface DomainFilters {\n\tinclude: string[];\n\texclude: string[];\n}\n\nfunction parseDomainFilter(domainFilter: string[] | undefined): DomainFilters {\n\tconst filters: DomainFilters = { include: [], exclude: [] };\n\tif (!domainFilter?.length) return filters;\n\tfor (const raw of domainFilter) {\n\t\tconst domain = normalizeDomain(raw);\n\t\tif (!domain) continue;\n\t\tconst target = raw.trim().startsWith(\"-\") ? filters.exclude : filters.include;\n\t\tif (!target.includes(domain)) target.push(domain);\n\t}\n\treturn filters;\n}\n\n// Bright Data has no domain parameter, but the engine behind it is Google, so the\n// filter is expressed the way Google expresses it: as `site:` operators inside\n// the query. That asks the engine for the right pages instead of discarding the\n// wrong ones locally — the difference SERPdive documents as a limitation.\nfunction buildSearchQuery(query: string, filters: DomainFilters): string {\n\tconst parts = [query];\n\tif (filters.include.length === 1) {\n\t\tparts.push(`site:${filters.include[0]}`);\n\t} else if (filters.include.length > 1) {\n\t\tparts.push(filters.include.map((domain) => `site:${domain}`).join(\" OR \"));\n\t}\n\tfor (const domain of filters.exclude) {\n\t\tparts.push(`-site:${domain}`);\n\t}\n\treturn parts.join(\" \");\n}\n\nfunction buildSerpUrl(searchQuery: string, numResults: number, recencyFilter: SearchOptions[\"recencyFilter\"]): string {\n\tconst params = new URLSearchParams({ q: searchQuery });\n\t// One SERP request is billed once whatever `num` says, so asking for a little\n\t// headroom is free and leaves something to keep after local re-filtering.\n\tparams.set(\"num\", String(Math.min(numResults + 5, 20)));\n\tconst tbs = recencyFilter ? RECENCY_TBS[recencyFilter] : undefined;\n\tif (tbs) params.set(\"tbs\", tbs);\n\t// `brd_json=1` is what makes Bright Data return the SERP as JSON instead of\n\t// Google's HTML. Without it `data_format: \"parsed_light\"` has nothing to read.\n\tparams.set(\"brd_json\", \"1\");\n\treturn `https://www.google.com/search?${params.toString()}`;\n}\n\nfunction domainMatches(hostname: string, domain: string): boolean {\n\treturn hostname === domain || hostname.endsWith(`.${domain}`);\n}\n\n// `site:` narrows the SERP but does not guarantee it: Google still mixes in\n// related hosts, and an OR group is honoured loosely. The same filter is applied\n// again here so the contract holds on what is actually returned.\nfunction passesDomainFilters(url: string, filters: DomainFilters): boolean {\n\tif (filters.include.length === 0 && filters.exclude.length === 0) return true;\n\tlet hostname: string;\n\ttry {\n\t\thostname = new URL(url).hostname.toLowerCase();\n\t} catch {\n\t\treturn false;\n\t}\n\tif (filters.exclude.some((domain) => domainMatches(hostname, domain))) return false;\n\tif (filters.include.length === 0) return true;\n\treturn filters.include.some((domain) => domainMatches(hostname, domain));\n}\n\nfunction requestSignal(signal?: AbortSignal): AbortSignal {\n\tconst timeout = AbortSignal.timeout(SEARCH_TIMEOUT_MS);\n\treturn signal ? AbortSignal.any([signal, timeout]) : timeout;\n}\n\nfunction errorMessage(err: unknown): string {\n\treturn err instanceof Error ? err.message : String(err);\n}\n\n// Text that did not originate here — a proxied response body, a `JSON.parse`\n// message quoting that body, a config value — is quoted into Error messages, and\n// `gemini-search.ts` classifies routing failures by reading a status back out of\n// the message text (`providerErrorStatus`, /\\b(?:error|status|http)\\s+(\\d{3})\\b/).\n// A proxied Google interstitial that merely mentions \"Error 503\" would otherwise\n// be read as *our* status and retried as a transient failure, when what actually\n// happened is that a 200 was billed and is unusable. Status-shaped phrases in\n// quoted text are rewritten to `upstream <code>`: the number is still reported,\n// but only this module's own wording can name the status we received.\nconst STATUS_SHAPED_PATTERN = /\\b(?:error|status|http)[\\s:=-]{1,4}(\\d{3})\\b/gi;\n\n// `providerErrorStatus` is not the only thing that reads our message.\n// `classifyProviderError` also matches bare keyword phrases, and its branch order\n// decides which ones can reach us: `searchRouting.fallbackOn` accepts only\n// `transient`, `quota` and `network`, and of those three only the `quota` branch\n// (/rate limit|quota|too many requests/) runs BEFORE the `invalid-response` branch\n// that this module's own wording always triggers. So a billed 200 whose body reads\n// \"You have exceeded your rate limit\" would classify as `quota`, and with\n// `fallbackOn: [\"quota\"]` the user is charged, silently served the next provider's\n// answer, and shown no diagnostic — the failure mode this module exists to prevent.\n// `transient` and `network` sit after `invalid-response` and are unreachable for the\n// same reason; the test suite pins that ordering assumption rather than trusting it.\n//\n// The phrase is replaced rather than removed: the reader still learns the upstream\n// page mentioned a rate limit, but no substring of the replacement matches any\n// classifier branch (\"rate-limit\" is hyphenated, so /rate limit/ cannot match).\nconst QUOTA_SHAPED_PATTERN = /rate limit|quota|too many requests/gi;\n\n// The complete inventory of places foreign text is quoted into a message or a log\n// line, and what each one is required to apply. Adding a fifth means adding it here:\n//\n// | site                                            | redactCredential | untrustedText |\n// | ----------------------------------------------- | ---------------- | ------------- |\n// | non-2xx response body                           | yes              | yes (300)     |\n// | invalid-JSON raw body                           | yes              | yes (300)     |\n// | Bright Data's own 200 error envelope            | yes              | yes (200)     |\n// | transport/abort error from `fetch`               | yes              | n/a — see (a) |\n// | rejected zone value                             | n/a — see (b)    | yes (60)      |\n// | `JSON.parse` message on a response body         | n/a — see (c)    | n/a — see (c) |\n// | `JSON.parse` failure on `web-search.json`       | n/a — see (c)    | n/a — see (c) |\n//\n// (a) That message is generated locally by undici or by `AbortSignal`, never by the\n//     proxied page, and the abort branch below matches on it; collapsing and\n//     truncating it would buy nothing and could break that match.\n// (b) The zone is resolved *before* the credential on purpose, so that a config\n//     mistake never spawns a `!command` resolver. There is therefore no key to redact\n//     against yet, and the value being echoed is the user's own zone setting.\n// (c) Neither parser message is quoted at all, so neither needs a filter or a cap. V8\n//     embeds a *prefix* of the offending input in its message, and `redactCredential`\n//     substitutes whole values, so a prefix cannot be redacted out of it. Dropping the\n//     message removes the leak by construction — see `configParseDetail` and the\n//     `JSON.parse` catch on the response path.\n\n// Truncation happens BEFORE the rewrite, and the order is the whole point.\n// `STATUS_SHAPED_PATTERN` requires `(\\d{3})\\b`, so `error 5031` is deliberately left\n// alone — it is not a status. Sanitising first and slicing second let the cut land on\n// the 4th digit and hand back a freshly forged `error 503`, which\n// `gemini-search.ts`'s `providerErrorStatus` then reads as *our* status: a billed 200\n// classified `transient` and silently re-run on the next provider. Slicing first means\n// the rewrite always sees the exact text that will be quoted.\n//\n// The rewrite runs last and is therefore allowed to push the result a few characters\n// past `limit` (\"error 503\" → \"upstream 503\"). `limit` bounds how much upstream text is\n// quoted, not the final string length; a second `slice()` after the rewrite would\n// re-open exactly the hole this ordering closes.\nfunction untrustedText(text: string, limit = 300): string {\n\treturn text\n\t\t.replace(/\\s+/g, \" \")\n\t\t.trim()\n\t\t.slice(0, limit)\n\t\t.replace(STATUS_SHAPED_PATTERN, \"upstream $1\")\n\t\t.replace(QUOTA_SHAPED_PATTERN, \"upstream rate-limit notice\");\n}\n\nfunction invalidResponse(zone: string, message: string): Error {\n\treturn new Error(`Bright Data API returned invalid response for zone ${zone}: ${message}`);\n}\n\n// Bright Data reports some failures inside a normal HTTP 200 body — e.g.\n// `{\"error\":\"zone not found\",\"code\":\"zone_missing\"}` — because `format: \"raw\"`\n// means the HTTP layer describes the proxy hop, not the outcome.\n//\n// The envelope is upstream text, so it gets the same two-step treatment as every other\n// quoted body: `redactCredential` first (an upstream \"token <yours> is not valid for\n// this zone\" must not reprint the token), then `untrustedText`.\nfunction envelopeError(envelope: Record<string, unknown>, apiKey: string | null): string | null {\n\tconst parts: string[] = [];\n\tconst { error, errors } = envelope;\n\tif (typeof error === \"string\" && error.trim()) parts.push(error.trim());\n\telse if (error && typeof error === \"object\") parts.push(JSON.stringify(error));\n\tif (Array.isArray(errors) && errors.length > 0) parts.push(JSON.stringify(errors));\n\telse if (typeof errors === \"string\" && errors.trim()) parts.push(errors.trim());\n\tif (parts.length === 0) return null;\n\tfor (const key of [\"code\", \"error_code\"]) {\n\t\tconst code = envelope[key];\n\t\tif (typeof code === \"string\" && code.trim()) parts.push(`${key} ${code.trim()}`);\n\t\telse if (typeof code === \"number\") parts.push(`${key} ${code}`);\n\t}\n\treturn untrustedText(redactCredential(parts.join(\", \"), apiKey), 200);\n}\n\n// The envelope is validated strictly — every branch below throws — because a\n// shape this provider cannot read means the request was billed for something\n// unusable, and returning `{ answer: \"\", results: [] }` would report a paid\n// failure as \"the web had no answer\". That includes the two shapes that are JSON\n// but not a SERP: Bright Data's own error envelope, and an envelope with no\n// `organic` array at all. anysearch.ts rejects the equivalent shape the same way.\n// Individual organic entries are the one deliberate exception: a real SERP mixes\n// in entries with no link, and one of those must not throw away a page of results\n// that was already paid for.\nfunction parseSerpResponse(value: unknown, zone: string, apiKey: string | null): BrightDataSerpResponse {\n\tif (!value || typeof value !== \"object\" || Array.isArray(value)) {\n\t\tthrow invalidResponse(zone, \"expected an object envelope\");\n\t}\n\tconst envelope = value as Record<string, unknown>;\n\tconst upstreamError = envelopeError(envelope, apiKey);\n\tif (upstreamError) {\n\t\tthrow invalidResponse(zone, `Bright Data reported an error instead of a SERP: ${upstreamError}`);\n\t}\n\tif (envelope.organic === undefined || envelope.organic === null) {\n\t\tthrow invalidResponse(\n\t\t\tzone,\n\t\t\t\"expected an organic array and the envelope carried none. A `serp` zone queried with brd_json=1 \" +\n\t\t\t\"returns { organic: [...] }; a zone of type `unblocker`, or a missing brd_json=1, is the usual cause\",\n\t\t);\n\t}\n\tif (!Array.isArray(envelope.organic)) throw invalidResponse(zone, \"expected organic array\");\n\tconst organic: BrightDataOrganicResult[] = [];\n\tfor (const [index, entry] of envelope.organic.entries()) {\n\t\tif (!entry || typeof entry !== \"object\" || Array.isArray(entry)) {\n\t\t\tthrow invalidResponse(zone, `expected organic[${index}] object`);\n\t\t}\n\t\torganic.push(entry as BrightDataOrganicResult);\n\t}\n\treturn { organic };\n}\n\nfunction mapResults(\n\torganic: BrightDataOrganicResult[] | undefined,\n\tnumResults: number,\n\tfilters: DomainFilters,\n): SearchResponse[\"results\"] {\n\tif (!Array.isArray(organic)) return [];\n\tconst mapped: SearchResponse[\"results\"] = [];\n\tfor (const item of organic) {\n\t\tconst url = typeof item.link === \"string\" ? item.link.trim() : \"\";\n\t\tif (!url || !passesDomainFilters(url, filters)) continue;\n\t\tconst title = typeof item.title === \"string\" ? item.title.trim() : \"\";\n\t\tmapped.push({\n\t\t\ttitle: title || `Source ${mapped.length + 1}`,\n\t\t\turl,\n\t\t\tsnippet: typeof item.description === \"string\" ? item.description.replace(/\\s+/g, \" \").trim() : \"\",\n\t\t});\n\t\tif (mapped.length >= numResults) break;\n\t}\n\treturn mapped;\n}\n\n// A SERP zone returns ranked links, never a synthesized answer, so one is\n// assembled from the sources — the same shape brave.ts and searxng.ts produce.\nfunction buildAnswer(results: SearchResponse[\"results\"]): string {\n\treturn results\n\t\t.map((result) => result.snippet\n\t\t\t? `${result.snippet}\\nSource: ${result.title} (${result.url})`\n\t\t\t: `Source: ${result.title} (${result.url})`)\n\t\t.join(\"\\n\\n\");\n}\n\n// Both halves are required: a token with no zone cannot make a request, and a\n// zone with no token cannot either. Availability therefore checks the config this\n// surface actually needs rather than merely a key, the way firecrawl.ts's\n// `isFirecrawlAvailable()` checks its required base URL. Reporting \"unavailable\"\n// for a half-finished setup keeps the incomplete case out of provider selection\n// instead of turning it into a failed search.\n//\n// It is also a pure predicate that cannot throw. Callers evaluate it outside\n// their error handling — `gemini-search.ts` before the per-provider try/catch,\n// `index.ts` in the uncaught `getProviderAvailability()` await on the `web_search`\n// path — so any throw from a malformed Bright Data setting or an unparseable\n// config file would break search for every other provider too. Misconfiguration\n// makes this provider unavailable here; the request path reports it in detail.\nexport function isBrightDataAvailable(): boolean {\n\ttry {\n\t\tif (getSerpZone() === null) return false;\n\t\treturn hasCredentialSource({\n\t\t\tprovider: \"Bright Data\",\n\t\t\tconfiguredValue: loadConfig().brightdataApiKey,\n\t\t\tenvironmentValue: process.env.BRIGHTDATA_API_KEY,\n\t\t});\n\t} catch {\n\t\treturn false;\n\t}\n}\n\nexport async function searchWithBrightData(query: string, options: BrightDataSearchOptions = {}): Promise<SearchResponse> {\n\t// Zone before key: a config mistake must not spawn a `!command` credential\n\t// resolver, and must not reach a billable endpoint.\n\tconst zone = requireSerpZone();\n\tconst apiKey = await requireApiKey(options.signal);\n\tconst numResults = normalizeCount(options.numResults);\n\tconst filters = parseDomainFilter(options.domainFilter);\n\tconst searchQuery = buildSearchQuery(query, filters);\n\tconst body: Record<string, unknown> = {\n\t\turl: buildSerpUrl(searchQuery, numResults, options.recencyFilter),\n\t\tzone,\n\t\t// `format: \"raw\"` returns the proxied body verbatim; `data_format` selects\n\t\t// Bright Data's own parsing of it. `parsed_light` is the SERP shape —\n\t\t// { organic: [{ link, title, description }] } — and carries no page bodies.\n\t\tformat: \"raw\",\n\t\tdata_format: \"parsed_light\",\n\t};\n\n\tconst activityId = activityMonitor.logStart({ type: \"api\", query: searchQuery });\n\tlet response: Response;\n\ttry {\n\t\tresponse = await fetch(BRIGHTDATA_API_URL, {\n\t\t\tmethod: \"POST\",\n\t\t\theaders: {\n\t\t\t\t\"Authorization\": `Bearer ${apiKey}`,\n\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t},\n\t\t\tbody: JSON.stringify(body),\n\t\t\tsignal: requestSignal(options.signal),\n\t\t});\n\t} catch (err) {\n\t\tconst message = errorMessage(err);\n\t\tconst redactedMessage = redactCredential(message, apiKey);\n\t\tif (redactedMessage.toLowerCase().includes(\"abort\")) activityMonitor.logComplete(activityId, 0);\n\t\telse activityMonitor.logError(activityId, redactedMessage);\n\t\tif (redactedMessage === message) throw err;\n\t\tconst redactedError = new Error(redactedMessage);\n\t\tif (err instanceof Error) redactedError.name = err.name;\n\t\tthrow redactedError;\n\t}\n\n\t// Every thrown message names the zone the request was billed against: with two\n\t// Bright Data zone types in play, \"which zone did I pay on\" is the first thing\n\t// a paid failure has to answer.\n\tif (!response.ok) {\n\t\tactivityMonitor.logComplete(activityId, response.status);\n\t\tconst errorText = untrustedText(redactCredential(await response.text(), apiKey));\n\t\tthrow new Error(`Bright Data API error ${response.status} for zone ${zone}: ${errorText}`);\n\t}\n\n\t// The body is read as text before parsing on purpose. `format: \"raw\"` means a\n\t// 200 can still carry an upstream interstitial instead of SERP JSON, and a\n\t// bare parser error (\"Unexpected token <\") hides a request that was billed.\n\t// Quoting the body is the only way the user learns what they paid for.\n\tconst raw = await response.text();\n\tif (!raw.trim()) {\n\t\tactivityMonitor.logComplete(activityId, response.status);\n\t\tthrow new Error(`Bright Data API returned empty response for zone ${zone}`);\n\t}\n\n\tlet rawData: unknown;\n\ttry {\n\t\trawData = JSON.parse(raw);\n\t} catch (err) {\n\t\tactivityMonitor.logComplete(activityId, response.status);\n\t\t// The parser's own message is deliberately NOT quoted here. V8 embeds a short\n\t\t// window of the offending input in it (`Unexpected token 'x', \"xxxxxxxx-x\"...`),\n\t\t// and that window is a *prefix* of the body — so when the body starts with the\n\t\t// credential, `redactCredential` cannot match it: it replaces the whole key, and\n\t\t// a 10-character prefix is not the whole key. Redacting the detail half therefore\n\t\t// still printed 10 cleartext characters of the token. The detail also adds nothing\n\t\t// this message does not already carry: the wording names the failure and the body\n\t\t// below shows what arrived, filtered. Dropping it removes the leak by construction\n\t\t// rather than by pattern-matching.\n\t\tconst body = untrustedText(redactCredential(raw, apiKey));\n\t\tthrow new Error(`Bright Data API returned invalid JSON for zone ${zone}: ${body}`);\n\t}\n\n\tlet data: BrightDataSerpResponse;\n\ttry {\n\t\tdata = parseSerpResponse(rawData, zone, apiKey);\n\t} catch (err) {\n\t\tactivityMonitor.logComplete(activityId, response.status);\n\t\tthrow err;\n\t}\n\n\tactivityMonitor.logComplete(activityId, response.status);\n\tconst results = mapResults(data.organic, numResults, filters);\n\treturn { answer: buildAnswer(results), results };\n}\n"]}

package/dist/humain/web-access/vendor/chrome-cookies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"chrome-cookies.d.ts","sourceRoot":"","sources":["../../../../src/humain/web-access/vendor/chrome-cookies.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAgD/C,wBAAgB,6BAA6B,IAAI,MAAM,GAAG,IAAI,CAE7D;AAED,wBAAgB,8BAA8B,IAAI,MAAM,GAAG,IAAI,CAE9D;AAED,wBAAsB,gBAAgB,CACrC,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GACxD,OAAO,CAAC;IAAE,OAAO,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,IAAI,CAAC,CAQ5D;AAED,wBAAsB,yBAAyB,CAC9C,OAAO,EAAE;IAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,GAAG,CAAA;CAAE,GAClJ,OAAO,CAAC;IAAE,OAAO,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAiInF","sourcesContent":["import { execFile } from \"node:child_process\";\nimport { pbkdf2Sync, createDecipheriv } from \"node:crypto\";\nimport { copyFileSync, existsSync, mkdtempSync, readdirSync, realpathSync, rmSync } from \"node:fs\";\nimport { tmpdir, homedir } from \"node:os\";\nimport { isAbsolute, join, sep } from \"node:path\";\nimport { isBrowserCookieAccessAllowed } from \"./gemini-web-config.ts\";\n\nexport type CookieMap = Record<string, string>;\n\ninterface BrowserConfig {\n\tname: string;\n\tbaseDir: string;\n\tkeychainService?: string;\n\tkeychainAccount?: string;\n\tsecretToolApp?: string;\n}\n\ntype SqliteRow = Record<string, unknown>;\ntype SqliteFailure = \"unavailable\" | \"query\";\n\ninterface BrowserCookieEntry {\n\tname: string;\n\tvalue: string;\n\tpath: string;\n}\n\nconst GOOGLE_ORIGINS = [\n\t\"https://gemini.google.com\",\n\t\"https://accounts.google.com\",\n\t\"https://www.google.com\",\n];\n\nconst ALL_COOKIE_NAMES = new Set([\n\t\"__Secure-1PSID\", \"__Secure-1PSIDTS\", \"__Secure-1PSIDCC\", \"__Secure-1PAPISID\", \"NID\", \"AEC\", \"SOCS\",\n\t\"__Secure-BUCKET\", \"__Secure-ENID\", \"SID\", \"HSID\", \"SSID\", \"APISID\", \"SAPISID\", \"__Secure-3PSID\",\n\t\"__Secure-3PSIDTS\", \"__Secure-3PAPISID\", \"SIDCC\",\n]);\n\nconst MACOS_BROWSER_CONFIGS: BrowserConfig[] = [\n\t{ name: \"Helium\", baseDir: \"Library/Application Support/net.imput.helium\", keychainService: \"Helium Storage Key\", keychainAccount: \"Helium\" },\n\t{ name: \"Chrome\", baseDir: \"Library/Application Support/Google/Chrome\", keychainService: \"Chrome Safe Storage\", keychainAccount: \"Chrome\" },\n\t{ name: \"Brave\", baseDir: \"Library/Application Support/BraveSoftware/Brave-Browser\", keychainService: \"Brave Safe Storage\", keychainAccount: \"Brave\" },\n\t{ name: \"Arc\", baseDir: \"Library/Application Support/Arc/User Data\", keychainService: \"Arc Safe Storage\", keychainAccount: \"Arc\" },\n];\n\nconst LINUX_BROWSER_CONFIGS: BrowserConfig[] = [\n\t{ name: \"Chromium\", baseDir: \".config/chromium\", secretToolApp: \"chromium\" },\n\t{ name: \"Chrome\", baseDir: \".config/google-chrome\", secretToolApp: \"chrome\" },\n];\n\nconst browserPasswordCache = new Map<string, Promise<string | null>>();\nlet lastCookieDiagnostic: string | null = null;\nlet sqliteModule: typeof import(\"node:sqlite\") | null = null;\nlet sqliteImportAttempted = false;\n\nexport function getLastGoogleCookieDiagnostic(): string | null {\n\treturn lastCookieDiagnostic;\n}\n\nexport function getLastBrowserCookieDiagnostic(): string | null {\n\treturn lastCookieDiagnostic;\n}\n\nexport async function getGoogleCookies(\n\toptions?: { profile?: string; requiredCookies?: string[] },\n): Promise<{ cookies: CookieMap; warnings: string[] } | null> {\n\treturn getBrowserCookiesForHosts({\n\t\thosts: GOOGLE_ORIGINS.map((origin) => new URL(origin).hostname),\n\t\tprofile: options?.profile,\n\t\trequiredCookies: options?.requiredCookies,\n\t\tcookieNames: ALL_COOKIE_NAMES,\n\t\trequiredLabel: \"Gemini\",\n\t});\n}\n\nexport async function getBrowserCookiesForHosts(\n\toptions: { hosts: string[]; profile?: string; requiredCookies?: string[]; cookieNames?: Iterable<string>; requiredLabel?: string; requestUrl?: URL },\n): Promise<{ cookies: CookieMap; warnings: string[]; cookieHeader?: string } | null> {\n\tlastCookieDiagnostic = null;\n\tif (!isBrowserCookieAccessAllowed()) {\n\t\tlastCookieDiagnostic = \"Browser cookie access is disabled; enable allowBrowserCookies to use browser cookies.\";\n\t\treturn null;\n\t}\n\n\tconst currentPlatform = process.platform;\n\tconst configs = currentPlatform === \"darwin\" ? MACOS_BROWSER_CONFIGS : currentPlatform === \"linux\" ? LINUX_BROWSER_CONFIGS : [];\n\tif (configs.length === 0) {\n\t\tlastCookieDiagnostic = \"Chromium cookie extraction is unsupported on this platform.\";\n\t\treturn null;\n\t}\n\n\tconst warningSet = new Set<string>();\n\tconst rawProfile = typeof options.profile === \"string\" ? options.profile.trim() : \"\";\n\tconst requestedProfile = normalizeProfileName(options.profile);\n\tif (rawProfile && !requestedProfile) {\n\t\tlastCookieDiagnostic = \"Configured Chromium profile must be a profile directory name, not a path.\";\n\t\treturn null;\n\t}\n\tconst requiredCookies = normalizeCookieNames(options.requiredCookies);\n\tconst cookieNames = normalizeCookieNames(options.cookieNames ? [...options.cookieNames] : undefined);\n\tconst hosts = normalizeHosts(options.hosts);\n\tif (hosts.length === 0) {\n\t\tlastCookieDiagnostic = \"No valid cookie hosts were requested.\";\n\t\treturn null;\n\t}\n\tconst home = homedir();\n\tlet sawCookieDatabase = false;\n\tlet sawRequiredCookies = false;\n\tlet sawAnyHostCookie = false;\n\tlet sawBackendFailure: SqliteFailure | undefined;\n\tlet sawUnsafeProfilePath = false;\n\n\tfor (const config of configs) {\n\t\tconst profiles = requestedProfile ? [requestedProfile] : listBrowserProfiles(home, config);\n\t\tfor (const profile of profiles) {\n\t\t\tconst profilePath = resolveProfilePath(home, config, profile);\n\t\t\tif (profilePath === \"outside-root\") {\n\t\t\t\tsawUnsafeProfilePath = true;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (!profilePath) continue;\n\t\t\tconst cookiesPath = join(profilePath, \"Cookies\");\n\t\t\tsawCookieDatabase = true;\n\n\t\t\tconst tempDir = mkdtempSync(join(tmpdir(), \"pi-chrome-cookies-\"));\n\t\t\ttry {\n\t\t\t\tconst tempDb = join(tempDir, \"Cookies\");\n\t\t\t\tcopyFileSync(cookiesPath, tempDb);\n\t\t\t\tcopySidecar(cookiesPath, tempDb, \"-wal\");\n\t\t\t\tcopySidecar(cookiesPath, tempDb, \"-shm\");\n\n\t\t\t\tif (requiredCookies?.length) {\n\t\t\t\t\tconst preflight = await hasCookieNames(tempDb, hosts, requiredCookies);\n\t\t\t\t\tif (preflight.failure) sawBackendFailure = preflight.failure;\n\t\t\t\t\tif (!preflight.present) continue;\n\t\t\t\t\tsawRequiredCookies = true;\n\t\t\t\t}\n\n\t\t\t\tconst password = await readBrowserPassword(config, currentPlatform);\n\t\t\t\tif (!password) {\n\t\t\t\t\twarningSet.add(`Could not read ${config.name} cookie encryption password`);\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\n\t\t\t\tconst key = pbkdf2Sync(password, \"saltysalt\", currentPlatform === \"darwin\" ? 1003 : 1, 16, \"sha1\");\n\t\t\t\tconst metaVersion = await readMetaVersion(tempDb);\n\t\t\t\tif (metaVersion.failure) sawBackendFailure = metaVersion.failure;\n\t\t\t\tif (metaVersion.value === null) continue;\n\t\t\t\tconst rowsResult = await queryCookieRows(tempDb, hosts, cookieNames ?? null, Boolean(options.requestUrl));\n\t\t\t\tif (rowsResult.status === \"failure\") {\n\t\t\t\t\tsawBackendFailure = rowsResult.failure;\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\n\t\t\t\tconst entries: BrowserCookieEntry[] = [];\n\t\t\t\tconst cookies: CookieMap = {};\n\t\t\t\tfor (const row of rowsResult.rows) {\n\t\t\t\t\tconst name = typeof row.name === \"string\" ? row.name : \"\";\n\t\t\t\t\tif (!name) continue;\n\t\t\t\t\tlet value = typeof row.value === \"string\" && row.value.length > 0 ? row.value : null;\n\t\t\t\t\tif (!value && typeof row.encrypted_value_hex === \"string\" && /^[0-9a-f]*$/i.test(row.encrypted_value_hex)) {\n\t\t\t\t\t\tvalue = decryptCookieValue(Buffer.from(row.encrypted_value_hex, \"hex\"), key, metaVersion.value >= 24);\n\t\t\t\t\t}\n\t\t\t\t\tif (!value) continue;\n\t\t\t\t\tconst path = typeof row.path === \"string\" && row.path.startsWith(\"/\") ? row.path : \"/\";\n\t\t\t\t\tif (options.requestUrl && !pathMatches(options.requestUrl.pathname || \"/\", path)) continue;\n\t\t\t\t\tentries.push({ name, value, path });\n\t\t\t\t\tif (!cookies[name]) cookies[name] = value;\n\t\t\t\t}\n\n\t\t\t\tif (entries.length > 0) sawAnyHostCookie = true;\n\t\t\t\tif (requiredCookies?.length && !requiredCookies.every((name) => Boolean(cookies[name]))) continue;\n\t\t\t\tif (entries.length === 0) continue;\n\t\t\t\treturn {\n\t\t\t\t\tcookies,\n\t\t\t\t\twarnings: [...warningSet],\n\t\t\t\t\t...(options.requestUrl ? { cookieHeader: buildCookieHeader(entries) } : {}),\n\t\t\t\t};\n\t\t\t} finally {\n\t\t\t\trmSync(tempDir, { recursive: true, force: true });\n\t\t\t}\n\t\t}\n\t}\n\n\tif (sawBackendFailure === \"unavailable\") {\n\t\tlastCookieDiagnostic = \"SQLite backend unavailable: install sqlite3 or use a runtime with SQLite support.\";\n\t} else if (sawBackendFailure === \"query\") {\n\t\tlastCookieDiagnostic = \"SQLite query failed while reading the copied Chromium cookie database.\";\n\t} else if (sawUnsafeProfilePath) {\n\t\tlastCookieDiagnostic = \"Configured Chromium profile must resolve inside the browser profile root.\";\n\t} else if (!sawCookieDatabase) {\n\t\tlastCookieDiagnostic = requestedProfile\n\t\t\t? `Chromium profile '${requestedProfile}' does not contain a cookie database.`\n\t\t\t: \"No detected Chromium profile contains a cookie database.\";\n\t} else if (requiredCookies?.length && !sawRequiredCookies) {\n\t\tlastCookieDiagnostic = `No detected Chromium profile contains the required ${options.requiredLabel ?? \"browser\"} cookies.`;\n\t} else if (!sawAnyHostCookie) {\n\t\tlastCookieDiagnostic = options.requestUrl\n\t\t\t? \"No detected Chromium profile contains cookies for the requested URL.\"\n\t\t\t: \"No detected Chromium profile contains cookies for the requested host.\";\n\t} else if (warningSet.size > 0) {\n\t\tlastCookieDiagnostic = [...warningSet][0];\n\t} else {\n\t\tlastCookieDiagnostic = \"Required Gemini cookies were not available or could not be decrypted.\";\n\t}\n\treturn null;\n}\n\nfunction normalizeProfileName(value: string | undefined): string | undefined {\n\tif (typeof value !== \"string\") return undefined;\n\tconst normalized = value.trim();\n\tif (!normalized) return undefined;\n\tif (isAbsolute(normalized) || normalized === \".\" || normalized === \"..\" || normalized.includes(\"/\") || normalized.includes(\"\\\\\")) {\n\t\treturn undefined;\n\t}\n\treturn normalized;\n}\n\nfunction resolveProfilePath(home: string, config: BrowserConfig, profile: string): string | \"outside-root\" | null {\n\tconst basePath = join(home, config.baseDir);\n\tconst profilePath = join(basePath, profile);\n\tconst cookiesPath = join(profilePath, \"Cookies\");\n\tif (!existsSync(cookiesPath)) return null;\n\ttry {\n\t\tconst baseRealPath = realpathSync(basePath);\n\t\tconst profileRealPath = realpathSync(profilePath);\n\t\tif (profileRealPath !== baseRealPath && !profileRealPath.startsWith(`${baseRealPath}${sep}`)) return \"outside-root\";\n\t\treturn profileRealPath;\n\t} catch {\n\t\treturn null;\n\t}\n}\n\nfunction normalizeCookieNames(names: string[] | undefined): string[] | undefined {\n\tif (!names?.length) return undefined;\n\tconst normalized = names.filter((name): name is string => typeof name === \"string\").map((name) => name.trim()).filter(Boolean);\n\treturn normalized.length > 0 ? [...new Set(normalized)] : undefined;\n}\n\nfunction normalizeHosts(hosts: string[]): string[] {\n\treturn [...new Set(hosts.map(host => host.trim().toLowerCase().replace(/^\\[|\\]$/g, \"\").replace(/\\.$/, \"\")).filter(Boolean))];\n}\n\nfunction listBrowserProfiles(home: string, config: BrowserConfig): string[] {\n\tconst basePath = join(home, config.baseDir);\n\tif (!existsSync(basePath)) return [\"Default\"];\n\tconst profiles = new Set<string>();\n\ttry {\n\t\tfor (const entry of readdirSync(basePath, { withFileTypes: true })) {\n\t\t\tif (entry.isDirectory() && existsSync(join(basePath, entry.name, \"Cookies\"))) profiles.add(entry.name);\n\t\t}\n\t} catch {\n\t}\n\tif (profiles.size === 0) return [\"Default\"];\n\treturn [...profiles].sort(compareProfileNames);\n}\n\nfunction compareProfileNames(a: string, b: string): number {\n\tconst key = (name: string): [number, number] => {\n\t\tif (name === \"Default\") return [0, 0];\n\t\tconst profile = /^Profile\\s+(\\d+)$/i.exec(name);\n\t\tif (profile) return [1, Number(profile[1])];\n\t\tconst person = /^Person\\s+(\\d+)$/i.exec(name);\n\t\tif (person) return [2, Number(person[1])];\n\t\treturn [3, Number.MAX_SAFE_INTEGER];\n\t};\n\tconst [ap, ai] = key(a);\n\tconst [bp, bi] = key(b);\n\treturn ap - bp || ai - bi || a.localeCompare(b, undefined, { sensitivity: \"base\", numeric: true });\n}\n\nfunction decryptCookieValue(encrypted: Uint8Array, key: Buffer, stripHash: boolean): string | null {\n\tconst buf = Buffer.from(encrypted);\n\tif (buf.length < 3 || !/^v\\d\\d$/.test(buf.subarray(0, 3).toString(\"utf8\"))) return null;\n\tconst ciphertext = buf.subarray(3);\n\tif (!ciphertext.length) return \"\";\n\ttry {\n\t\tconst decipher = createDecipheriv(\"aes-128-cbc\", key, Buffer.alloc(16, 0x20));\n\t\tdecipher.setAutoPadding(false);\n\t\tconst unpadded = removePkcs7Padding(Buffer.concat([decipher.update(ciphertext), decipher.final()]));\n\t\tconst bytes = stripHash && unpadded.length >= 32 ? unpadded.subarray(32) : unpadded;\n\t\tconst decoded = new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes);\n\t\tlet i = 0;\n\t\twhile (i < decoded.length && decoded.charCodeAt(i) < 0x20) i++;\n\t\treturn decoded.slice(i);\n\t} catch {\n\t\treturn null;\n\t}\n}\n\nfunction removePkcs7Padding(buf: Buffer): Buffer {\n\tif (!buf.length) return buf;\n\tconst padding = buf[buf.length - 1];\n\treturn !padding || padding > 16 ? buf : buf.subarray(0, buf.length - padding);\n}\n\nfunction readBrowserPassword(config: BrowserConfig, currentPlatform: typeof process.platform): Promise<string | null> {\n\tconst cacheKey = `${currentPlatform}:${config.name}`;\n\tconst cached = browserPasswordCache.get(cacheKey);\n\tif (cached) return cached;\n\tconst passwordResult = currentPlatform === \"darwin\"\n\t\t? config.keychainAccount && config.keychainService\n\t\t\t? readKeychainPassword(config.keychainAccount, config.keychainService).then(password => ({ password, cacheable: Boolean(password) }))\n\t\t\t: Promise.resolve({ password: null, cacheable: false })\n\t\t: currentPlatform === \"linux\"\n\t\t\t? readLinuxPassword(config.secretToolApp)\n\t\t\t: Promise.resolve({ password: null, cacheable: false });\n\tconst passwordPromise = passwordResult.then(({ password, cacheable }) => {\n\t\tif (!cacheable) browserPasswordCache.delete(cacheKey);\n\t\treturn password;\n\t}, (error) => {\n\t\tbrowserPasswordCache.delete(cacheKey);\n\t\tthrow error;\n\t});\n\tbrowserPasswordCache.set(cacheKey, passwordPromise);\n\treturn passwordPromise;\n}\n\nfunction readKeychainPassword(account: string, service: string): Promise<string | null> {\n\treturn new Promise((resolve) => {\n\t\texecFile(\"security\", [\"find-generic-password\", \"-w\", \"-a\", account, \"-s\", service], { timeout: 5000 }, (err, stdout) => {\n\t\t\tif (err) { resolve(null); return; }\n\t\t\tresolve(stdout.trim() || null);\n\t\t});\n\t});\n}\n\nfunction readLinuxPassword(secretToolApp: string | undefined): Promise<{ password: string; cacheable: boolean }> {\n\tif (!secretToolApp) return Promise.resolve({ password: \"peanuts\", cacheable: true });\n\treturn new Promise((resolve) => {\n\t\texecFile(\"secret-tool\", [\"lookup\", \"application\", secretToolApp], { timeout: 5000 }, (err, stdout) => {\n\t\t\tif (err) { resolve({ password: \"peanuts\", cacheable: false }); return; }\n\t\t\tconst password = stdout.trim();\n\t\t\tresolve(password ? { password, cacheable: true } : { password: \"peanuts\", cacheable: false });\n\t\t});\n\t});\n}\n\nasync function importSqlite(): Promise<typeof import(\"node:sqlite\") | null> {\n\tif (process.env.PI_WEB_ACCESS_DISABLE_NODE_SQLITE === \"1\") return null;\n\tif (sqliteImportAttempted) return sqliteModule;\n\tsqliteImportAttempted = true;\n\tconst orig = process.emitWarning.bind(process);\n\tprocess.emitWarning = ((warning: string | Error, ...args: unknown[]) => {\n\t\tconst msg = typeof warning === \"string\" ? warning : warning?.message ?? \"\";\n\t\tif (msg.includes(\"SQLite is an experimental feature\")) return;\n\t\treturn (orig as Function)(warning, ...args);\n\t}) as typeof process.emitWarning;\n\ttry {\n\t\tsqliteModule = await import(\"node:sqlite\");\n\t} catch {\n\t\tsqliteModule = null;\n\t} finally {\n\t\tprocess.emitWarning = orig;\n\t}\n\treturn sqliteModule;\n}\n\ntype QueryResult =\n\t| { status: \"success\"; rows: SqliteRow[] }\n\t| { status: \"failure\"; failure: SqliteFailure };\n\nasync function runSqliteQuery(dbPath: string, sql: string): Promise<QueryResult> {\n\tconst sqlite = await importSqlite();\n\tlet queryFailed = false;\n\tif (sqlite) {\n\t\ttry {\n\t\t\tconst db = new sqlite.DatabaseSync(dbPath, { readOnly: true });\n\t\t\ttry {\n\t\t\t\treturn { status: \"success\", rows: db.prepare(sql).all() as SqliteRow[] };\n\t\t\t} finally {\n\t\t\t\tdb.close();\n\t\t\t}\n\t\t} catch {\n\t\t\tqueryFailed = true;\n\t\t}\n\t}\n\n\tconst cli = await runSqliteCli(dbPath, sql);\n\tif (cli.status === \"success\") return cli;\n\tif (cli.failure === \"query\") queryFailed = true;\n\tconst python = await runPythonSqlite(dbPath, sql);\n\tif (python.status === \"success\") return python;\n\tif (python.failure === \"query\") queryFailed = true;\n\treturn { status: \"failure\", failure: queryFailed ? \"query\" : \"unavailable\" };\n}\n\nfunction runSqliteCli(dbPath: string, sql: string): Promise<QueryResult> {\n\treturn new Promise((resolve) => {\n\t\texecFile(\"sqlite3\", [\"-readonly\", \"-json\", dbPath, sql], { timeout: 5000, maxBuffer: 1024 * 1024 }, (err, stdout) => {\n\t\t\tif (err) { resolve({ status: \"failure\", failure: err.code === \"ENOENT\" ? \"unavailable\" : \"query\" }); return; }\n\t\t\ttry {\n\t\t\t\tconst parsed = JSON.parse(stdout || \"[]\");\n\t\t\t\tresolve(Array.isArray(parsed) ? { status: \"success\", rows: parsed as SqliteRow[] } : { status: \"failure\", failure: \"query\" });\n\t\t\t} catch {\n\t\t\t\tresolve({ status: \"failure\", failure: \"query\" });\n\t\t\t}\n\t\t});\n\t});\n}\n\nfunction runPythonSqlite(dbPath: string, sql: string): Promise<QueryResult> {\n\tconst script = \"import json,sqlite3,sys\\ntry:\\n c=sqlite3.connect('file:'+sys.argv[1]+'?mode=ro',uri=True)\\n c.row_factory=sqlite3.Row\\n print(json.dumps([dict(r) for r in c.execute(sys.argv[2]).fetchall()]))\\nexcept Exception:\\n sys.exit(1)\";\n\treturn new Promise((resolve) => {\n\t\texecFile(\"python3\", [\"-c\", script, dbPath, sql], { timeout: 5000, maxBuffer: 1024 * 1024 }, (err, stdout) => {\n\t\t\tif (err) { resolve({ status: \"failure\", failure: err.code === \"ENOENT\" ? \"unavailable\" : \"query\" }); return; }\n\t\t\ttry {\n\t\t\t\tconst parsed = JSON.parse(stdout || \"[]\");\n\t\t\t\tresolve(Array.isArray(parsed) ? { status: \"success\", rows: parsed as SqliteRow[] } : { status: \"failure\", failure: \"query\" });\n\t\t\t} catch {\n\t\t\t\tresolve({ status: \"failure\", failure: \"query\" });\n\t\t\t}\n\t\t});\n\t});\n}\n\nasync function readMetaVersion(dbPath: string): Promise<{ value: number | null; failure?: SqliteFailure }> {\n\tconst result = await runSqliteQuery(dbPath, \"SELECT value FROM meta WHERE key = 'version'\");\n\tif (result.status === \"failure\") {\n\t\treturn result.failure === \"unavailable\"\n\t\t\t? { value: null, failure: result.failure }\n\t\t\t: { value: 0 };\n\t}\n\tconst value = result.rows[0]?.value;\n\tif (typeof value === \"number\") return { value: Math.floor(value) };\n\tif (typeof value === \"string\") return { value: parseInt(value, 10) || 0 };\n\treturn { value: 0 };\n}\n\nasync function hasCookieNames(dbPath: string, hosts: string[], names: string[]): Promise<{ present: boolean; failure?: SqliteFailure }> {\n\tconst result = await runSqliteQuery(dbPath, `SELECT DISTINCT name FROM cookies WHERE ${buildCookieWhere(hosts, names)}`);\n\tif (result.status === \"failure\") return { present: false, failure: result.failure };\n\tconst present = new Set(result.rows.map((row) => typeof row.name === \"string\" ? row.name : \"\"));\n\treturn { present: names.every((name) => present.has(name)) };\n}\n\nasync function queryCookieRows(dbPath: string, hosts: string[], names: Iterable<string> | null, filterExpired: boolean): Promise<QueryResult> {\n\tconst columns = await readCookieColumns(dbPath);\n\tif (columns.status === \"failure\") return columns;\n\tconst pathExpr = columns.columns.has(\"path\") ? \"path\" : \"'/' AS path\";\n\tconst expiresExpr = columns.columns.has(\"expires_utc\") ? \"expires_utc\" : \"0 AS expires_utc\";\n\tconst expiryFilter = filterExpired && columns.columns.has(\"expires_utc\") ? ` AND (expires_utc = 0 OR expires_utc > ${chromeExpiryNowMicros()})` : \"\";\n\tconst partitionFilter = filterExpired ? unpartitionedCookieFilter(columns.columns) : \"\";\n\treturn runSqliteQuery(dbPath, `SELECT name, value, host_key, ${pathExpr}, ${expiresExpr}, hex(encrypted_value) AS encrypted_value_hex FROM cookies WHERE ${buildCookieWhere(hosts, names ?? undefined)}${expiryFilter}${partitionFilter} ORDER BY length(path) DESC, expires_utc ASC`);\n}\n\nasync function readCookieColumns(dbPath: string): Promise<{ status: \"success\"; columns: Set<string> } | { status: \"failure\"; failure: SqliteFailure }> {\n\tconst result = await runSqliteQuery(dbPath, \"PRAGMA table_info(cookies)\");\n\tif (result.status === \"failure\") return result;\n\treturn { status: \"success\", columns: new Set(result.rows.map(row => typeof row.name === \"string\" ? row.name : \"\")) };\n}\n\nfunction chromeExpiryNowMicros(): number {\n\treturn (Date.now() + 11644473600000) * 1000;\n}\n\nfunction unpartitionedCookieFilter(columns: Set<string>): string {\n\tconst clauses: string[] = [];\n\tif (columns.has(\"top_frame_site_key\")) clauses.push(\"(top_frame_site_key IS NULL OR top_frame_site_key = '')\");\n\tif (columns.has(\"partition_key\")) clauses.push(\"(partition_key IS NULL OR partition_key = '')\");\n\tif (columns.has(\"is_partitioned\")) clauses.push(\"(is_partitioned IS NULL OR is_partitioned = 0)\");\n\treturn clauses.length > 0 ? ` AND ${clauses.join(\" AND \")}` : \"\";\n}\n\nfunction buildCookieHeader(entries: BrowserCookieEntry[]): string {\n\treturn entries\n\t\t.sort((a, b) => b.path.length - a.path.length)\n\t\t.map(({ name, value }) => `${name}=${value}`)\n\t\t.join(\"; \");\n}\n\nfunction pathMatches(requestPath: string, cookiePath: string): boolean {\n\tif (requestPath === cookiePath) return true;\n\tif (!requestPath.startsWith(cookiePath)) return false;\n\tif (cookiePath.endsWith(\"/\")) return true;\n\treturn requestPath[cookiePath.length] === \"/\";\n}\n\nfunction buildCookieWhere(hosts: string[], cookieNames?: Iterable<string>): string {\n\tconst hostClauses: string[] = [];\n\tfor (const host of hosts) {\n\t\tconst escapedHost = escapeSqlString(host);\n\t\thostClauses.push(`host_key = '${escapedHost}'`);\n\t\tfor (const candidate of domainCookieHosts(host)) {\n\t\t\thostClauses.push(`host_key = '.${escapeSqlString(candidate)}'`);\n\t\t}\n\t}\n\tlet where = `(${[...new Set(hostClauses)].join(\" OR \")})`;\n\tconst names = cookieNames ? [...cookieNames].filter(Boolean) : [];\n\tif (names.length) where += ` AND name IN (${names.map((name) => `'${escapeSqlString(name)}'`).join(\", \")})`;\n\treturn where;\n}\n\nfunction escapeSqlString(value: string): string {\n\treturn value.replaceAll(\"'\", \"''\");\n}\n\nfunction domainCookieHosts(host: string): string[] {\n\tconst parts = host.split(\".\").filter(Boolean);\n\tif (parts.length <= 1) return [];\n\tconst candidates = new Set<string>();\n\tfor (let i = 0; i <= parts.length - 2; i++) candidates.add(parts.slice(i).join(\".\"));\n\treturn [...candidates];\n}\n\nfunction copySidecar(srcDb: string, targetDb: string, suffix: string): void {\n\tconst sidecar = `${srcDb}${suffix}`;\n\tif (!existsSync(sidecar)) return;\n\ttry {\n\t\tcopyFileSync(sidecar, `${targetDb}${suffix}`);\n\t} catch {\n\t}\n}\n"]}
+{"version":3,"file":"chrome-cookies.d.ts","sourceRoot":"","sources":["../../../../src/humain/web-access/vendor/chrome-cookies.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAsD/C,wBAAgB,6BAA6B,IAAI,MAAM,GAAG,IAAI,CAE7D;AAED,wBAAgB,8BAA8B,IAAI,MAAM,GAAG,IAAI,CAE9D;AAED,wBAAsB,gBAAgB,CACrC,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GACxD,OAAO,CAAC;IAAE,OAAO,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,IAAI,CAAC,CAQ5D;AAED,wBAAsB,yBAAyB,CAC9C,OAAO,EAAE;IAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,GAAG,CAAA;CAAE,GAClJ,OAAO,CAAC;IAAE,OAAO,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CA2InF"}

package/dist/humain/web-access/vendor/chrome-cookies.js

@@ -1,6 +1,6 @@
 import { execFile } from "node:child_process";
 import { pbkdf2Sync, createDecipheriv } from "node:crypto";
-import { copyFileSync, existsSync, mkdtempSync, readdirSync, realpathSync, rmSync } from "node:fs";
+import { copyFileSync, existsSync, mkdtempSync, readdirSync, readFileSync, realpathSync, rmSync } from "node:fs";
 import { tmpdir, homedir } from "node:os";
 import { isAbsolute, join, sep } from "node:path";
 import { isBrowserCookieAccessAllowed } from "./gemini-web-config.js";
@@ -24,6 +24,10 @@ const LINUX_BROWSER_CONFIGS = [
     { name: "Chromium", baseDir: ".config/chromium", secretToolApp: "chromium" },
     { name: "Chrome", baseDir: ".config/google-chrome", secretToolApp: "chrome" },
 ];
+const WINDOWS_BROWSER_CONFIGS = [
+    { name: "Chrome", baseDir: "Google/Chrome/User Data", usesLocalAppData: true },
+    { name: "Edge", baseDir: "Microsoft/Edge/User Data", usesLocalAppData: true },
+];
 const browserPasswordCache = new Map();
 let lastCookieDiagnostic = null;
 let sqliteModule = null;
@@ -50,7 +54,7 @@ export async function getBrowserCookiesForHosts(options) {
         return null;
     }
     const currentPlatform = process.platform;
-    const configs = currentPlatform === "darwin" ? MACOS_BROWSER_CONFIGS : currentPlatform === "linux" ? LINUX_BROWSER_CONFIGS : [];
+    const configs = currentPlatform === "darwin" ? MACOS_BROWSER_CONFIGS : currentPlatform === "linux" ? LINUX_BROWSER_CONFIGS : currentPlatform === "win32" ? WINDOWS_BROWSER_CONFIGS : [];
     if (configs.length === 0) {
         lastCookieDiagnostic = "Chromium cookie extraction is unsupported on this platform.";
         return null;
@@ -69,12 +73,13 @@ export async function getBrowserCookiesForHosts(options) {
         lastCookieDiagnostic = "No valid cookie hosts were requested.";
         return null;
     }
-    const home = homedir();
+    const home = currentPlatform === "win32" ? process.env.USERPROFILE || homedir() : homedir();
     let sawCookieDatabase = false;
     let sawRequiredCookies = false;
     let sawAnyHostCookie = false;
     let sawBackendFailure;
     let sawUnsafeProfilePath = false;
+    let sawWindowsAppBoundCookie = false;
     for (const config of configs) {
         const profiles = requestedProfile ? [requestedProfile] : listBrowserProfiles(home, config);
         for (const profile of profiles) {
@@ -85,7 +90,9 @@ export async function getBrowserCookiesForHosts(options) {
             }
             if (!profilePath)
                 continue;
-            const cookiesPath = join(profilePath, "Cookies");
+            const cookiesPath = cookieDatabasePath(profilePath, config);
+            if (!cookiesPath)
+                continue;
             sawCookieDatabase = true;
             const tempDir = mkdtempSync(join(tmpdir(), "pi-chrome-cookies-"));
             try {
@@ -101,12 +108,15 @@ export async function getBrowserCookiesForHosts(options) {
                         continue;
                     sawRequiredCookies = true;
                 }
-                const password = await readBrowserPassword(config, currentPlatform);
-                if (!password) {
-                    warningSet.add(`Could not read ${config.name} cookie encryption password`);
+                const key = currentPlatform === "win32"
+                    ? await readWindowsEncryptionKey(config, home)
+                    : await readBrowserPassword(config, currentPlatform).then((password) => password ? pbkdf2Sync(password, "saltysalt", currentPlatform === "darwin" ? 1003 : 1, 16, "sha1") : null);
+                if (!key) {
+                    warningSet.add(currentPlatform === "win32"
+                        ? `Could not read ${config.name} Windows cookie encryption key`
+                        : `Could not read ${config.name} cookie encryption password`);
                     continue;
                 }
-                const key = pbkdf2Sync(password, "saltysalt", currentPlatform === "darwin" ? 1003 : 1, 16, "sha1");
                 const metaVersion = await readMetaVersion(tempDb);
                 if (metaVersion.failure)
                     sawBackendFailure = metaVersion.failure;
@@ -125,7 +135,12 @@ export async function getBrowserCookiesForHosts(options) {
                         continue;
                     let value = typeof row.value === "string" && row.value.length > 0 ? row.value : null;
                     if (!value && typeof row.encrypted_value_hex === "string" && /^[0-9a-f]*$/i.test(row.encrypted_value_hex)) {
-                        value = decryptCookieValue(Buffer.from(row.encrypted_value_hex, "hex"), key, metaVersion.value >= 24);
+                        const encrypted = Buffer.from(row.encrypted_value_hex, "hex");
+                        if (currentPlatform === "win32" && encrypted.subarray(0, 3).toString("utf8") === "v20")
+                            sawWindowsAppBoundCookie = true;
+                        value = currentPlatform === "win32"
+                            ? decryptWindowsCookieValue(encrypted, key, metaVersion.value >= 24)
+                            : decryptCookieValue(encrypted, key, metaVersion.value >= 24);
                     }
                     if (!value)
                         continue;
@@ -170,6 +185,9 @@ export async function getBrowserCookiesForHosts(options) {
     else if (requiredCookies?.length && !sawRequiredCookies) {
         lastCookieDiagnostic = `No detected Chromium profile contains the required ${options.requiredLabel ?? "browser"} cookies.`;
     }
+    else if (sawWindowsAppBoundCookie) {
+        lastCookieDiagnostic = "Windows Chromium v20 app-bound cookies are not supported.";
+    }
     else if (!sawAnyHostCookie) {
         lastCookieDiagnostic = options.requestUrl
             ? "No detected Chromium profile contains cookies for the requested URL."
@@ -195,10 +213,9 @@ function normalizeProfileName(value) {
     return normalized;
 }
 function resolveProfilePath(home, config, profile) {
-    const basePath = join(home, config.baseDir);
+    const basePath = browserBasePath(home, config);
     const profilePath = join(basePath, profile);
-    const cookiesPath = join(profilePath, "Cookies");
-    if (!existsSync(cookiesPath))
+    if (!cookieDatabasePath(profilePath, config))
         return null;
     try {
         const baseRealPath = realpathSync(basePath);
@@ -211,6 +228,18 @@ function resolveProfilePath(home, config, profile) {
         return null;
     }
 }
+function cookieDatabasePath(profilePath, config) {
+    const networkCookies = join(profilePath, "Network", "Cookies");
+    if (config.usesLocalAppData && existsSync(networkCookies))
+        return networkCookies;
+    const legacyCookies = join(profilePath, "Cookies");
+    return existsSync(legacyCookies) ? legacyCookies : null;
+}
+function browserBasePath(home, config) {
+    return config.usesLocalAppData
+        ? join(process.env.LOCALAPPDATA || join(home, "AppData", "Local"), config.baseDir)
+        : join(home, config.baseDir);
+}
 function normalizeCookieNames(names) {
     if (!names?.length)
         return undefined;
@@ -221,13 +250,13 @@ function normalizeHosts(hosts) {
     return [...new Set(hosts.map(host => host.trim().toLowerCase().replace(/^\[|\]$/g, "").replace(/\.$/, "")).filter(Boolean))];
 }
 function listBrowserProfiles(home, config) {
-    const basePath = join(home, config.baseDir);
+    const basePath = browserBasePath(home, config);
     if (!existsSync(basePath))
         return ["Default"];
     const profiles = new Set();
     try {
         for (const entry of readdirSync(basePath, { withFileTypes: true })) {
-            if (entry.isDirectory() && existsSync(join(basePath, entry.name, "Cookies")))
+            if (entry.isDirectory() && cookieDatabasePath(join(basePath, entry.name), config))
                 profiles.add(entry.name);
         }
     }
@@ -275,6 +304,22 @@ function decryptCookieValue(encrypted, key, stripHash) {
         return null;
     }
 }
+function decryptWindowsCookieValue(encrypted, key, stripHash) {
+    const buf = Buffer.from(encrypted);
+    if (buf.subarray(0, 3).toString("utf8") !== "v10" || buf.length < 3 + 12 + 16)
+        return null;
+    try {
+        const nonce = buf.subarray(3, 15);
+        const ciphertext = buf.subarray(15, -16);
+        const decipher = createDecipheriv("aes-256-gcm", key, nonce);
+        decipher.setAuthTag(buf.subarray(-16));
+        const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+        return new TextDecoder("utf-8", { fatal: true }).decode(stripHash && plaintext.length >= 32 ? plaintext.subarray(32) : plaintext);
+    }
+    catch {
+        return null;
+    }
+}
 function removePkcs7Padding(buf) {
     if (!buf.length)
         return buf;
@@ -304,6 +349,40 @@ function readBrowserPassword(config, currentPlatform) {
     browserPasswordCache.set(cacheKey, passwordPromise);
     return passwordPromise;
 }
+async function readWindowsEncryptionKey(config, home) {
+    try {
+        const localState = JSON.parse(readFileSync(join(browserBasePath(home, config), "Local State"), "utf8"));
+        const encodedKey = localState.os_crypt?.encrypted_key;
+        if (typeof encodedKey !== "string")
+            return null;
+        const protectedKey = Buffer.from(encodedKey, "base64");
+        if (protectedKey.subarray(0, 5).toString("utf8") !== "DPAPI")
+            return null;
+        const decrypted = await unprotectWindowsData(protectedKey.subarray(5));
+        return decrypted?.length === 32 ? decrypted : null;
+    }
+    catch {
+        return null;
+    }
+}
+function unprotectWindowsData(protectedData) {
+    return new Promise((resolve) => {
+        const script = "Add-Type -AssemblyName System.Security;$data=[Convert]::FromBase64String($env:PIWA_PROTECTED);$clear=[System.Security.Cryptography.ProtectedData]::Unprotect($data,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Write([Convert]::ToBase64String($clear))";
+        const encoded = Buffer.from(script, "utf16le").toString("base64");
+        execFile("powershell.exe", ["-NoProfile", "-NonInteractive", "-EncodedCommand", encoded], { timeout: 5000, maxBuffer: 1024 * 1024, env: { ...process.env, PIWA_PROTECTED: protectedData.toString("base64") } }, (err, stdout) => {
+            if (err) {
+                resolve(null);
+                return;
+            }
+            try {
+                resolve(Buffer.from(stdout.trim(), "base64"));
+            }
+            catch {
+                resolve(null);
+            }
+        });
+    });
+}
 function readKeychainPassword(account, service) {
     return new Promise((resolve) => {
         execFile("security", ["find-generic-password", "-w", "-a", account, "-s", service], { timeout: 5000 }, (err, stdout) => {
@@ -443,10 +522,10 @@ async function queryCookieRows(dbPath, hosts, names, filterExpired) {
     if (columns.status === "failure")
         return columns;
     const pathExpr = columns.columns.has("path") ? "path" : "'/' AS path";
-    const expiresExpr = columns.columns.has("expires_utc") ? "expires_utc" : "0 AS expires_utc";
-    const expiryFilter = filterExpired && columns.columns.has("expires_utc") ? ` AND (expires_utc = 0 OR expires_utc > ${chromeExpiryNowMicros()})` : "";
+    const expiresExpr = columns.columns.has("expires_utc") ? chromeExpiryMillisExpr() : "0";
+    const expiryFilter = filterExpired && columns.columns.has("expires_utc") ? ` AND (${expiresExpr} = 0 OR ${expiresExpr} > ${chromeExpiryNowMillis()})` : "";
     const partitionFilter = filterExpired ? unpartitionedCookieFilter(columns.columns) : "";
-    return runSqliteQuery(dbPath, `SELECT name, value, host_key, ${pathExpr}, ${expiresExpr}, hex(encrypted_value) AS encrypted_value_hex FROM cookies WHERE ${buildCookieWhere(hosts, names ?? undefined)}${expiryFilter}${partitionFilter} ORDER BY length(path) DESC, expires_utc ASC`);
+    return runSqliteQuery(dbPath, `SELECT name, value, host_key, ${pathExpr}, ${expiresExpr} AS expires_utc, hex(encrypted_value) AS encrypted_value_hex FROM cookies WHERE ${buildCookieWhere(hosts, names ?? undefined)}${expiryFilter}${partitionFilter} ORDER BY length(path) DESC, ${expiresExpr} ASC`);
 }
 async function readCookieColumns(dbPath) {
     const result = await runSqliteQuery(dbPath, "PRAGMA table_info(cookies)");
@@ -454,8 +533,11 @@ async function readCookieColumns(dbPath) {
         return result;
     return { status: "success", columns: new Set(result.rows.map(row => typeof row.name === "string" ? row.name : "")) };
 }
-function chromeExpiryNowMicros() {
-    return (Date.now() + 11644473600000) * 1000;
+function chromeExpiryMillisExpr() {
+    return "CASE WHEN expires_utc = 0 THEN 0 ELSE CAST(expires_utc / 1000 AS INTEGER) + CASE WHEN expires_utc % 1000 = 0 THEN 0 ELSE 1 END END";
+}
+function chromeExpiryNowMillis() {
+    return Date.now() + 11644473600000;
 }
 function unpartitionedCookieFilter(columns) {
     const clauses = [];