@koda-sl/baker-cli 0.387.0 → 0.389.0-dev.8065ad8f0

package/dist/chunk-DX4GIDO7.js

@@ -0,0 +1,296 @@
+import {
+  DIRECT_ROUTE,
+  captureProxyCredentials,
+  childEnvWith,
+  plannedRoutes,
+  shouldEscalate
+} from "./chunk-O6QKCJE4.js";
+
+// src/lib/vimeoCookie.ts
+import { writeFile } from "fs/promises";
+import path from "path";
+var COOKIE_NAME = "vimeo";
+async function writeVimeoCookieFile(cookie, workDir) {
+  const value = cookie?.trim();
+  if (!value) return void 0;
+  const expires = Math.floor(Date.now() / 1e3) + 365 * 24 * 60 * 60;
+  const jar = [
+    "# Netscape HTTP Cookie File",
+    [".vimeo.com", "TRUE", "/", "TRUE", String(expires), COOKIE_NAME, value].join("	"),
+    ""
+  ].join("\n");
+  const filePath = path.join(workDir, "vimeo-cookies.txt");
+  await writeFile(filePath, jar, { mode: 384 });
+  return filePath;
+}
+var VIMEO_AUTH_SIGNATURES = ["oauth token", "only works when logged-in", "unable to fetch new oauth tokens"];
+function isVimeoAuthFailure(detail) {
+  const haystack = detail.toLowerCase();
+  if (!haystack.includes("[vimeo]")) return false;
+  return VIMEO_AUTH_SIGNATURES.some((signature) => haystack.includes(signature));
+}
+
+// src/lib/ytDlpSignal.ts
+var HTTP_ERROR = /HTTP Error (\d{3})/i;
+var CHALLENGE_PHRASES = [
+  "sign in to confirm you're not a bot",
+  "sign in to confirm you\u2019re not a bot",
+  "confirm you are not a bot",
+  "unusual traffic",
+  "captcha"
+];
+var NOT_A_BLOCK_PHRASES = ["private video", "video unavailable", "members-only", "this video is available to"];
+var PROXY_TUNNEL_FAILURE = /tunnel connection failed: 407|proxy authentication required|http error 407/i;
+function ytDlpBlockSignal(stderr) {
+  const text = stderr.toLowerCase();
+  if (PROXY_TUNNEL_FAILURE.test(stderr)) return { status: 407 };
+  if (NOT_A_BLOCK_PHRASES.some((phrase) => text.includes(phrase))) return {};
+  const status = HTTP_ERROR.exec(stderr);
+  if (status) return { status: Number(status[1]) };
+  if (CHALLENGE_PHRASES.some((phrase) => text.includes(phrase))) return { challenge: true };
+  return {};
+}
+
+// src/lib/ytDlp.ts
+import { spawn } from "child_process";
+import { readdir, readFile } from "fs/promises";
+import path2 from "path";
+
+// src/lib/ytDlpFormat.ts
+function videoFormatArgs(maxResolution) {
+  const sort = maxResolution ? ["-S", `res:${maxResolution}`] : [];
+  return ["--format", "bv*+ba/b", ...sort, "--merge-output-format", "mp4"];
+}
+
+// src/lib/ytDlpPlayerClient.ts
+var YOUTUBE_FALLBACK_CLIENT_ARGS = ["--extractor-args", "youtube:player_client=android"];
+var MEDIA_FETCH_REFUSED = "unable to download video data";
+var YOUTUBE_HOSTS = ["youtube.com", "youtu.be"];
+function isYouTube(url) {
+  let host;
+  try {
+    host = new URL(url).hostname.toLowerCase();
+  } catch {
+    return false;
+  }
+  return YOUTUBE_HOSTS.some((known) => host === known || host.endsWith(`.${known}`));
+}
+function needsPlayerClientRetry(url, stderr) {
+  return isYouTube(url) && stderr.toLowerCase().includes(MEDIA_FETCH_REFUSED);
+}
+
+// src/lib/ytDlp.ts
+var YT_DLP_BIN = "yt-dlp";
+var YT_DLP_TIMEOUT_MS = 10 * 60 * 1e3;
+var YT_DLP_PROBE_TIMEOUT_MS = 60 * 1e3;
+var TRUST_SYSTEM_CERTS = ["--compat-options", "no-certifi"];
+var YtDlpError = class extends Error {
+  constructor(message, stderrTail) {
+    super(message);
+    this.stderrTail = stderrTail;
+    this.name = "YtDlpError";
+  }
+};
+function tail(text, maxLines) {
+  return text.split("\n").slice(-maxLines).join("\n");
+}
+async function runYtDlp(args) {
+  const outTemplate = path2.join(args.workDir, "out.%(ext)s");
+  const infoPath = path2.join(args.workDir, "out.info.json");
+  const argv = [
+    args.url,
+    "--no-playlist",
+    "--no-progress",
+    "--no-warnings",
+    "--quiet",
+    "--write-info-json",
+    ...TRUST_SYSTEM_CERTS,
+    "-o",
+    outTemplate
+  ];
+  if (args.audioOnly) {
+    argv.push("-x", "--audio-format", "m4a");
+  } else {
+    argv.push(...videoFormatArgs(args.maxHeight));
+  }
+  const cookieFile = await writeVimeoCookieFile(args.vimeoCookie, args.workDir);
+  if (cookieFile) argv.push("--cookies", cookieFile);
+  args.onLog?.(`yt-dlp: downloading ${args.audioOnly ? "audio" : "video"}`);
+  const timeoutMs = args.timeoutMs ?? YT_DLP_TIMEOUT_MS;
+  const { code, stderr, tier, reducedQuality } = await downloadWithClientFallback({
+    url: args.url,
+    argv,
+    onLog: args.onLog,
+    ladder: (attemptArgv) => runViaLadder({ url: args.url, argv: attemptArgv, timeoutMs, onLog: args.onLog, country: args.country }),
+    repeat: (attemptArgv, route) => spawnAndWait(YT_DLP_BIN, attemptArgv, timeoutMs, { extraEnv: proxyEnvFor(route) })
+  });
+  if (code !== 0) {
+    throw new YtDlpError(`yt-dlp exited ${code}`, tail(stderr, 40));
+  }
+  const files = await readdir(args.workDir);
+  const wanted = args.audioOnly ? ".m4a" : ".mp4";
+  const downloaded = files.find((f) => f.startsWith("out.") && f.endsWith(wanted));
+  if (!downloaded) {
+    throw new YtDlpError(`yt-dlp finished but produced no ${wanted} file (saw: ${files.join(", ")})`, "");
+  }
+  let info = {};
+  try {
+    info = JSON.parse(await readFile(infoPath, "utf-8"));
+  } catch {
+  }
+  return { filePath: path2.join(args.workDir, downloaded), info, tier, reducedQuality };
+}
+async function probeYtDlp(args) {
+  const argv = [
+    args.url,
+    "--no-playlist",
+    "--no-warnings",
+    "--dump-single-json",
+    "--skip-download",
+    // Without this the probe fails wherever the *download* would fail, which
+    // defeats the point of probing: yt-dlp still runs format selection for
+    // `--dump-single-json`, so a binary too old to read a site's format list
+    // exits "Requested format is not available" and we learn nothing — measured
+    // against a stale build, which returned full metadata the moment this flag
+    // was added. Duration and id come from the page, not from a format.
+    "--ignore-no-formats-error",
+    ...TRUST_SYSTEM_CERTS
+  ];
+  if (args.cookieDir) {
+    const cookieFile = await writeVimeoCookieFile(args.vimeoCookie, args.cookieDir);
+    if (cookieFile) argv.push("--cookies", cookieFile);
+  }
+  let stdout = "";
+  const { code, stderr, tier } = await walkYtDlpLadder({
+    url: args.url,
+    credentials: captureProxyCredentials(),
+    attempt: async (route) => {
+      const result = await spawnAndWait(YT_DLP_BIN, argv, args.timeoutMs ?? YT_DLP_PROBE_TIMEOUT_MS, {
+        extraEnv: proxyEnvFor(route),
+        captureStdout: true
+      });
+      stdout = result.stdout ?? "";
+      return result;
+    },
+    onLog: args.onLog,
+    country: args.country
+  });
+  if (code !== 0) {
+    throw new YtDlpError(`yt-dlp exited ${code}`, tail(stderr, 40));
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(stdout);
+  } catch {
+    throw new YtDlpError("yt-dlp returned metadata that could not be read", tail(stdout, 5));
+  }
+  if (parsed === null || typeof parsed !== "object") {
+    throw new YtDlpError("yt-dlp returned no metadata for that link", tail(stderr, 40));
+  }
+  return { info: parsed, tier };
+}
+function isAudioOnly(info) {
+  return info.vcodec === "none";
+}
+function durationSeconds(info) {
+  const raw = info.duration;
+  return typeof raw === "number" && Number.isFinite(raw) && raw > 0 ? raw : void 0;
+}
+function canonicalUrl(info) {
+  const raw = info.webpage_url;
+  return typeof raw === "string" && raw.length > 0 ? raw : void 0;
+}
+async function walkYtDlpLadder(args) {
+  const routes = plannedRoutes(args.url, args.credentials, args.country ? { country: args.country } : void 0);
+  let last = { code: -1, stderr: "", tier: "direct", route: DIRECT_ROUTE };
+  for (const route of routes) {
+    const tier = route.kind === "proxy" ? route.tier : "direct";
+    if (route.kind === "proxy") args.onLog?.(`yt-dlp: retrying via ${tier}`);
+    last = { ...await args.attempt(route), tier, route };
+    if (last.code === 0) return last;
+    if (!shouldEscalate(ytDlpBlockSignal(last.stderr))) return last;
+  }
+  return last;
+}
+async function downloadWithClientFallback(args) {
+  const first = await args.ladder(args.argv);
+  if (first.code === 0 || !needsPlayerClientRetry(args.url, first.stderr)) {
+    return { ...first, reducedQuality: false };
+  }
+  args.onLog?.("yt-dlp: retrying with the fallback player client");
+  const again = await args.repeat([...args.argv, ...YOUTUBE_FALLBACK_CLIENT_ARGS], first.route);
+  return { ...again, tier: first.tier, route: first.route, reducedQuality: again.code === 0 };
+}
+function runViaLadder(args) {
+  return walkYtDlpLadder({
+    url: args.url,
+    credentials: captureProxyCredentials(),
+    attempt: (route) => spawnAndWait(YT_DLP_BIN, args.argv, args.timeoutMs, { extraEnv: proxyEnvFor(route) }),
+    onLog: args.onLog,
+    country: args.country
+  });
+}
+function proxyEnvFor(route) {
+  if (route.kind !== "proxy") return void 0;
+  const uri = new URL(route.server);
+  uri.username = encodeURIComponent(route.username);
+  uri.password = encodeURIComponent(route.password);
+  return {
+    HTTP_PROXY: uri.toString(),
+    HTTPS_PROXY: uri.toString(),
+    http_proxy: uri.toString(),
+    https_proxy: uri.toString()
+  };
+}
+function spawnAndWait(bin, argv, timeoutMs, options = {}) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(bin, argv, {
+      stdio: ["ignore", "pipe", "pipe"],
+      // `childEnvWith` because `spawn`'s `env` REPLACES the environment rather
+      // than extending it — passing only the additions would strip PATH.
+      ...options.extraEnv ? { env: childEnvWith(options.extraEnv) } : {}
+    });
+    const stderrChunks = [];
+    const stdoutChunks = [];
+    let stderrLen = 0;
+    const MAX_STDERR = 256 * 1024;
+    child.stdout.on("data", (chunk) => {
+      if (options.captureStdout) stdoutChunks.push(chunk);
+    });
+    child.stderr.on("data", (chunk) => {
+      if (stderrLen < MAX_STDERR) {
+        stderrChunks.push(chunk);
+        stderrLen += chunk.length;
+      }
+    });
+    const timer = setTimeout(() => {
+      child.kill("SIGKILL");
+      reject(new Error(`${bin} timed out after ${timeoutMs}ms`));
+    }, timeoutMs);
+    child.on("error", (err) => {
+      clearTimeout(timer);
+      reject(new Error(`failed to spawn "${bin}" \u2014 ${err.message}`));
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      resolve({
+        code: code ?? -1,
+        stderr: Buffer.concat(stderrChunks).toString("utf-8"),
+        ...options.captureStdout ? { stdout: Buffer.concat(stdoutChunks).toString("utf-8") } : {}
+      });
+    });
+  });
+}
+
+export {
+  isVimeoAuthFailure,
+  ytDlpBlockSignal,
+  YT_DLP_BIN,
+  YtDlpError,
+  runYtDlp,
+  probeYtDlp,
+  isAudioOnly,
+  durationSeconds,
+  canonicalUrl
+};
+//# sourceMappingURL=chunk-DX4GIDO7.js.map

package/dist/chunk-DX4GIDO7.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/lib/vimeoCookie.ts","../src/lib/ytDlpSignal.ts","../src/lib/ytDlp.ts","../src/lib/ytDlpFormat.ts","../src/lib/ytDlpPlayerClient.ts"],"sourcesContent":["import { writeFile } from \"node:fs/promises\";\nimport path from \"node:path\";\n\n/**\n * Vimeo's session cookie, as a file yt-dlp can read.\n *\n * Vimeo is the only platform with no anonymous route left: every yt-dlp client\n * either cannot mint a token any more or refuses without a login, and the\n * failure is identical through direct, datacenter and residential exits, so it\n * is neither our IP nor our TLS fingerprint. A logged-in cookie is the whole\n * fix — measured, `vimeo` alone is sufficient and `vuid`/`auth_xsrft` without it\n * are worthless.\n *\n * The cookie arrives as a value, never as a path: the backend owns the secret\n * and the sandbox owns its filesystem, so nothing outside writes into the\n * Runtime. `--cookies <path>` then puts only the path in argv, keeping the\n * credential out of `ps` — the same rule that governs proxy passwords.\n */\n\n/** The single cookie yt-dlp's `_is_logged_in` actually checks. */\nconst COOKIE_NAME = \"vimeo\";\n\n/**\n * Write the cookie jar, returning its path — or undefined when unconfigured.\n *\n * Undefined rather than an empty file, because an empty jar is not the same as\n * no jar: yt-dlp would read it, find no session, and fail with the anonymous\n * error while looking as though credentials had been supplied.\n */\nexport async function writeVimeoCookieFile(cookie: string | undefined, workDir: string): Promise<string | undefined> {\n  const value = cookie?.trim();\n  if (!value) return undefined;\n\n  // A year out. The jar's own expiry is a formality — Vimeo expires the session\n  // server-side on its own schedule, and `isVimeoAuthFailure` is what notices.\n  const expires = Math.floor(Date.now() / 1000) + 365 * 24 * 60 * 60;\n  const jar = [\n    \"# Netscape HTTP Cookie File\",\n    [\".vimeo.com\", \"TRUE\", \"/\", \"TRUE\", String(expires), COOKIE_NAME, value].join(\"\\t\"),\n    \"\",\n  ].join(\"\\n\");\n\n  const filePath = path.join(workDir, \"vimeo-cookies.txt\");\n  // 0o600 at creation, not chmod-after: the sandbox runs the agent's own shell,\n  // and a world-readable window between write and chmod is a window.\n  await writeFile(filePath, jar, { mode: 0o600 });\n  return filePath;\n}\n\n/**\n * Whether a Vimeo failure is about authentication rather than the video.\n *\n * Every one of these phrasings means the same thing to whoever pasted the link —\n * Vimeo would not talk to us — but Vimeo's own wording (\"Failed to fetch macos\n * OAuth token\") names an internal detail that sends the reader nowhere. The\n * distinction earns its place because this credential *expires*: without it, the\n * day the cookie lapses looks like a brand-new mystery instead of a five-minute\n * re-export.\n *\n * Scoped to `[vimeo]` so another platform's 401 cannot inherit advice about a\n * cookie that has nothing to do with it.\n */\nconst VIMEO_AUTH_SIGNATURES = [\"oauth token\", \"only works when logged-in\", \"unable to fetch new oauth tokens\"] as const;\n\nexport function isVimeoAuthFailure(detail: string): boolean {\n  const haystack = detail.toLowerCase();\n  if (!haystack.includes(\"[vimeo]\")) return false;\n  return VIMEO_AUTH_SIGNATURES.some((signature) => haystack.includes(signature));\n}\n","import type { BlockSignal } from \"@baker/proxy\";\n\n/**\n * yt-dlp's stderr, read as the same signal every other surface produces.\n *\n * Deliberately only extraction — `shouldEscalate` still makes the decision, so\n * yt-dlp cannot drift into its own private idea of what a block is. The two\n * halves have to stay separate: a downloader that decided for itself would be\n * the one surface where a 404 could cost money.\n *\n * The parsing exists because yt-dlp gives us prose and an exit code, not a\n * response. There is no status line to read, so the status has to be recovered\n * from the sentence it was printed into.\n */\n\n/** `HTTP Error 403: Forbidden`, in any of the shapes yt-dlp writes it. */\nconst HTTP_ERROR = /HTTP Error (\\d{3})/i;\n\n/**\n * Refusals that arrive as prose with no status at all.\n *\n * YouTube's bot check is the one that matters: it is the single most common\n * reason a datacenter IP fails a download that a residential one completes, and\n * it looks like an ordinary successful page to everything except a human\n * reading the text.\n */\nconst CHALLENGE_PHRASES = [\n  \"sign in to confirm you're not a bot\",\n  \"sign in to confirm you’re not a bot\",\n  \"confirm you are not a bot\",\n  \"unusual traffic\",\n  \"captcha\",\n];\n\n/**\n * Prose that must never escalate, checked *before* the phrases above.\n *\n * \"Private video. Sign in if you've been granted access\" contains a sign-in\n * demand and is not a block — no exit IP on earth opens it, and treating it as\n * one would spend the expensive rung on every private link an agent is handed.\n */\nconst NOT_A_BLOCK_PHRASES = [\"private video\", \"video unavailable\", \"members-only\", \"this video is available to\"];\n\n/**\n * Our own proxy refusing us, which yt-dlp writes without an `HTTP Error` prefix.\n *\n * Checked before everything else. A 407 cannot come from an origin server, so\n * recovering it is what lets `isProxyFailure` separate \"the platform's egress\n * credentials are wrong\" from \"this site blocked us\" — opposite remediations,\n * and the first is otherwise invisible: a rotated password reads downstream as\n * every site having simultaneously started refusing us.\n */\nconst PROXY_TUNNEL_FAILURE = /tunnel connection failed: 407|proxy authentication required|http error 407/i;\n\nexport function ytDlpBlockSignal(stderr: string): BlockSignal {\n  const text = stderr.toLowerCase();\n\n  if (PROXY_TUNNEL_FAILURE.test(stderr)) return { status: 407 };\n\n  if (NOT_A_BLOCK_PHRASES.some((phrase) => text.includes(phrase))) return {};\n\n  // First, not last. yt-dlp prints a line per retry, so the final line is\n  // usually \"giving up after 3 retries\" — the verdict that started the sequence\n  // is the one that says why.\n  const status = HTTP_ERROR.exec(stderr);\n  if (status) return { status: Number(status[1]) };\n\n  if (CHALLENGE_PHRASES.some((phrase) => text.includes(phrase))) return { challenge: true };\n  return {};\n}\n","import { spawn } from \"node:child_process\";\nimport { readdir, readFile } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport type { ProxyCredentials, ProxyRoute, ProxyTier } from \"@baker/proxy\";\nimport { DIRECT_ROUTE, plannedRoutes, shouldEscalate } from \"@baker/proxy\";\nimport { captureProxyCredentials, childEnvWith } from \"../env.ts\";\nimport { writeVimeoCookieFile } from \"./vimeoCookie.ts\";\nimport { videoFormatArgs } from \"./ytDlpFormat.ts\";\nimport { needsPlayerClientRetry, YOUTUBE_FALLBACK_CLIENT_ARGS } from \"./ytDlpPlayerClient.ts\";\nimport { ytDlpBlockSignal } from \"./ytDlpSignal.ts\";\n\n/**\n * yt-dlp, run through the egress ladder, shared by the canvas `ingest` node and\n * `baker videos ingest`.\n *\n * Both download the same kinds of URL from the same sandbox and must agree about\n * what \"blocked\" means and how a credential is written down — and the second of\n * those is a decision that silently means two different passwords if it is made\n * twice (see `proxyEnvFor`). One copy is the point.\n *\n * Callers own how a failure is reported: the node wraps `YtDlpError` in a\n * `NodeExecutionError`, the command turns it into a `{ ok: false }` envelope.\n */\n\nexport const YT_DLP_BIN = \"yt-dlp\";\nexport const YT_DLP_TIMEOUT_MS = 10 * 60 * 1000;\n/** A probe fetches no media, so it gets a much shorter leash than a download. */\nexport const YT_DLP_PROBE_TIMEOUT_MS = 60 * 1000;\n\nexport type YtDlpInfo = Record<string, unknown>;\n\n/**\n * Verify TLS against the system bundle, never certifi's.\n *\n * The Runtime reads HTTPS through the credential broker, and the broker's CA is\n * installed in the system bundle (`SSL_CERT_FILE`) and nowhere else. yt-dlp is\n * installed with certifi and, left alone, verifies against certifi's own copy —\n * so once the broker shipped, every direct download in a Runtime failed with\n * `CERTIFICATE_VERIFY_FAILED` while `curl` to the same host answered. The agent\n * that hit it on our own CDN worked around it by pointing a committed canvas at\n * its gitignored local cache, which broke the next Session's publish. The\n * impersonating (curl_cffi) path reads `CURL_CA_BUNDLE`, which the broker also\n * sets, so it needs nothing here.\n */\nconst TRUST_SYSTEM_CERTS = [\"--compat-options\", \"no-certifi\"] as const;\n\nexport class YtDlpError extends Error {\n  constructor(\n    message: string,\n    readonly stderrTail: string,\n  ) {\n    super(message);\n    this.name = \"YtDlpError\";\n  }\n}\n\nexport function tail(text: string, maxLines: number): string {\n  return text.split(\"\\n\").slice(-maxLines).join(\"\\n\");\n}\n\n/**\n * Download `url` into `workDir`, climbing to a paid exit only if the host\n * refused the cheaper one. Returns the media file and yt-dlp's info.json\n * (best-effort — yt-dlp omits it for some direct file URLs).\n *\n * By default the best the site will release: `bv*+ba/b`. There used to be an\n * optional height cap here, on the reasoning that a 4K master is bytes we\n * re-encode anyway — but both callers now want the master, because capping\n * discards source pixels before the systems that make renditions from them ever\n * see them, and that loss is permanent while the saving is one download.\n * The one exception is opt-in: a bulk import may pass `maxHeight`.\n */\nexport async function runYtDlp(args: {\n  url: string;\n  audioOnly: boolean;\n  workDir: string;\n  timeoutMs?: number;\n  onLog?: (message: string) => void;\n  country?: string;\n  /** Vimeo session cookie value; written to a jar in `workDir` when present. */\n  vimeoCookie?: string;\n  /** Opt-in resolution cap (shorter side) for bulk imports — see `videoFormatArgs`. */\n  maxHeight?: number;\n}): Promise<{ filePath: string; info: YtDlpInfo; tier: EgressTier; reducedQuality: boolean }> {\n  const outTemplate = path.join(args.workDir, \"out.%(ext)s\");\n  const infoPath = path.join(args.workDir, \"out.info.json\");\n\n  const argv: string[] = [\n    args.url,\n    \"--no-playlist\",\n    \"--no-progress\",\n    \"--no-warnings\",\n    \"--quiet\",\n    \"--write-info-json\",\n    ...TRUST_SYSTEM_CERTS,\n    \"-o\",\n    outTemplate,\n  ];\n\n  if (args.audioOnly) {\n    argv.push(\"-x\", \"--audio-format\", \"m4a\");\n  } else {\n    argv.push(...videoFormatArgs(args.maxHeight));\n  }\n\n  const cookieFile = await writeVimeoCookieFile(args.vimeoCookie, args.workDir);\n  if (cookieFile) argv.push(\"--cookies\", cookieFile);\n\n  args.onLog?.(`yt-dlp: downloading ${args.audioOnly ? \"audio\" : \"video\"}`);\n  const timeoutMs = args.timeoutMs ?? YT_DLP_TIMEOUT_MS;\n  const { code, stderr, tier, reducedQuality } = await downloadWithClientFallback({\n    url: args.url,\n    argv,\n    onLog: args.onLog,\n    ladder: (attemptArgv) =>\n      runViaLadder({ url: args.url, argv: attemptArgv, timeoutMs, onLog: args.onLog, country: args.country }),\n    repeat: (attemptArgv, route) => spawnAndWait(YT_DLP_BIN, attemptArgv, timeoutMs, { extraEnv: proxyEnvFor(route) }),\n  });\n\n  if (code !== 0) {\n    throw new YtDlpError(`yt-dlp exited ${code}`, tail(stderr, 40));\n  }\n\n  const files = await readdir(args.workDir);\n  const wanted = args.audioOnly ? \".m4a\" : \".mp4\";\n  const downloaded = files.find((f) => f.startsWith(\"out.\") && f.endsWith(wanted));\n  if (!downloaded) {\n    throw new YtDlpError(`yt-dlp finished but produced no ${wanted} file (saw: ${files.join(\", \")})`, \"\");\n  }\n\n  let info: YtDlpInfo = {};\n  try {\n    info = JSON.parse(await readFile(infoPath, \"utf-8\")) as YtDlpInfo;\n  } catch {\n    // info.json is best-effort — yt-dlp sometimes omits it for direct file URLs.\n  }\n\n  return { filePath: path.join(args.workDir, downloaded), info, tier, reducedQuality };\n}\n\n/**\n * Read a URL's metadata without fetching any media.\n *\n * Worth its own round trip because it settles the one thing that has to be known\n * before the expensive part starts: how long the video is. Measured, a ten-hour\n * link is now refused in ~3s, where the byte ceiling it replaced could only\n * refuse it after the download it was meant to avoid. It also carries the\n * provider id, which used to be readable only from the download's own info.json.\n *\n * Climbs the same egress ladder as the download, so a host that answers only a\n * paid exit is probed through one too.\n */\nexport async function probeYtDlp(args: {\n  url: string;\n  timeoutMs?: number;\n  onLog?: (message: string) => void;\n  country?: string;\n  /** Vimeo session cookie value. `cookieDir` must be set for it to be used. */\n  vimeoCookie?: string;\n  cookieDir?: string;\n}): Promise<{ info: YtDlpInfo; tier: EgressTier }> {\n  const argv = [\n    args.url,\n    \"--no-playlist\",\n    \"--no-warnings\",\n    \"--dump-single-json\",\n    \"--skip-download\",\n    // Without this the probe fails wherever the *download* would fail, which\n    // defeats the point of probing: yt-dlp still runs format selection for\n    // `--dump-single-json`, so a binary too old to read a site's format list\n    // exits \"Requested format is not available\" and we learn nothing — measured\n    // against a stale build, which returned full metadata the moment this flag\n    // was added. Duration and id come from the page, not from a format.\n    \"--ignore-no-formats-error\",\n    ...TRUST_SYSTEM_CERTS,\n  ];\n\n  // The probe needs the same credential as the download: Vimeo refuses metadata\n  // to an anonymous caller too, so probing without it fails before the duration\n  // gate ever runs.\n  if (args.cookieDir) {\n    const cookieFile = await writeVimeoCookieFile(args.vimeoCookie, args.cookieDir);\n    if (cookieFile) argv.push(\"--cookies\", cookieFile);\n  }\n\n  let stdout = \"\";\n  const { code, stderr, tier } = await walkYtDlpLadder({\n    url: args.url,\n    credentials: captureProxyCredentials(),\n    attempt: async (route) => {\n      const result = await spawnAndWait(YT_DLP_BIN, argv, args.timeoutMs ?? YT_DLP_PROBE_TIMEOUT_MS, {\n        extraEnv: proxyEnvFor(route),\n        captureStdout: true,\n      });\n      stdout = result.stdout ?? \"\";\n      return result;\n    },\n    onLog: args.onLog,\n    country: args.country,\n  });\n\n  if (code !== 0) {\n    throw new YtDlpError(`yt-dlp exited ${code}`, tail(stderr, 40));\n  }\n\n  // Parsed, not trusted: yt-dlp prints a bare `null` for a page it recognised\n  // but could not extract, and on at least one site it pairs that with a\n  // non-zero exit — so the exit code alone is not enough to promise an object.\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(stdout);\n  } catch {\n    throw new YtDlpError(\"yt-dlp returned metadata that could not be read\", tail(stdout, 5));\n  }\n  if (parsed === null || typeof parsed !== \"object\") {\n    throw new YtDlpError(\"yt-dlp returned no metadata for that link\", tail(stderr, 40));\n  }\n  return { info: parsed as YtDlpInfo, tier };\n}\n\n/**\n * True only when the source explicitly says it carries no video.\n *\n * `vcodec: \"none\"` is the assertion; a *missing* vcodec is not, and that\n * distinction is the whole function. Measured: SoundCloud reports `\"none\"`,\n * while Streamable reports `null` and is perfectly good video. The obvious\n * version of this check — \"no format has a video codec\" — matches both and\n * would refuse Streamable, which ingests fine today.\n *\n * Caught at probe time because the alternative is what it replaces: the\n * download succeeds, produces an `.m4a`, and the caller fails looking for an\n * `.mp4` — surfaced as \"yt-dlp finished but produced no .mp4 file\", which names\n * an internal expectation rather than the fact that someone linked to audio.\n */\nexport function isAudioOnly(info: YtDlpInfo): boolean {\n  return info.vcodec === \"none\";\n}\n\n/** The probed duration in seconds, when the site reported one that can be read. */\nexport function durationSeconds(info: YtDlpInfo): number | undefined {\n  const raw = info.duration;\n  return typeof raw === \"number\" && Number.isFinite(raw) && raw > 0 ? raw : undefined;\n}\n\n/**\n * The canonical page URL for what was probed, when the extractor resolved one.\n *\n * Worth preferring over the URL a person pasted, because yt-dlp has already done\n * the normalising: measured, it turns `youtu.be/<id>?si=…&t=42`,\n * `/shorts/<id>` and `m.youtube.com/watch?v=<id>&feature=share` all into the one\n * `www.youtube.com/watch?v=<id>`. Storing the raw paste instead files the same\n * video under a different `externalUrl` depending on where the link was copied\n * from, which is exactly the provenance question this field exists to answer.\n */\nexport function canonicalUrl(info: YtDlpInfo): string | undefined {\n  const raw = info.webpage_url;\n  return typeof raw === \"string\" && raw.length > 0 ? raw : undefined;\n}\n\n/**\n * Walk the ladder: direct first, then each configured tier, stopping the moment\n * the failure is one a different exit IP cannot fix.\n *\n * The escalation decision is `shouldEscalate`'s, not ours — the same closed\n * allow-list every other egress surface uses. A downloader that decided for\n * itself would be the one surface where a 404 could cost money.\n */\nexport type EgressTier = \"direct\" | ProxyTier;\n\n/**\n * Which rung produced this result — so a paid exit is never spent invisibly.\n *\n * The `route` is here, and not just the tier's name, because one caller needs to\n * *repeat* the rung rather than merely report it: the player-client fallback\n * re-runs on whichever exit already got far enough to be refused at the media\n * stage. A name cannot be handed back to `proxyEnvFor`; the route can.\n */\nexport type LadderResult = SpawnResult & { tier: EgressTier; route: ProxyRoute };\n\nexport async function walkYtDlpLadder(args: {\n  url: string;\n  credentials: ProxyCredentials;\n  attempt: (route: ProxyRoute) => Promise<SpawnResult>;\n  onLog?: (message: string) => void;\n  /**\n   * ISO-3166 alpha-2 exit country for the paid rungs. Omit for \"wherever\".\n   *\n   * Not inferred and never automatic: a country is only right when someone\n   * knows *which* one opens the video, and guessing would multiply the cost of\n   * every failure by the length of the guess list. `@baker/proxy` owns the\n   * per-product syntax — datacenter and residential spell geo differently and\n   * each rejects the other's token.\n   */\n  country?: string;\n}): Promise<LadderResult> {\n  const routes = plannedRoutes(args.url, args.credentials, args.country ? { country: args.country } : undefined);\n  let last: LadderResult = { code: -1, stderr: \"\", tier: \"direct\", route: DIRECT_ROUTE };\n\n  for (const route of routes) {\n    const tier: EgressTier = route.kind === \"proxy\" ? route.tier : \"direct\";\n    if (route.kind === \"proxy\") args.onLog?.(`yt-dlp: retrying via ${tier}`);\n    last = { ...(await args.attempt(route)), tier, route };\n    if (last.code === 0) return last;\n    if (!shouldEscalate(ytDlpBlockSignal(last.stderr))) return last;\n  }\n  return last;\n}\n\n/**\n * The download, plus the one retry that changes the player instead of the exit.\n *\n * Split out from `runYtDlp` with its two runners injected because the decision\n * this makes is the expensive one to get wrong and the hardest to observe: it\n * spends egress. A test can drive both branches here; it cannot drive them\n * through a function that spawns a binary.\n *\n * **The retry repeats one rung and opens no new one.** It re-runs on\n * `first.route` — whichever exit already got far enough to be refused at the\n * media stage — rather than walking the ladder again. Walking it again was the\n * first version of this and it was wrong in exactly the way this whole change\n * exists to stop: the trigger is a 403, `shouldEscalate` treats a 403 as\n * escalatable, so a fallback client that was also refused would climb through\n * datacenter and residential a second time, paying twice more for a verdict\n * that has already been shown not to depend on the address. Re-using the rung\n * is also what makes the retry correct when the *only* rung that reached the\n * media stage was a paid one — a direct-only retry would land back on the bot\n * wall that made us leave direct in the first place.\n */\nexport async function downloadWithClientFallback(args: {\n  url: string;\n  argv: readonly string[];\n  ladder: (argv: readonly string[]) => Promise<LadderResult>;\n  repeat: (argv: readonly string[], route: ProxyRoute) => Promise<SpawnResult>;\n  onLog?: (message: string) => void;\n}): Promise<LadderResult & { reducedQuality: boolean }> {\n  const first = await args.ladder(args.argv);\n  if (first.code === 0 || !needsPlayerClientRetry(args.url, first.stderr)) {\n    return { ...first, reducedQuality: false };\n  }\n\n  args.onLog?.(\"yt-dlp: retrying with the fallback player client\");\n  const again = await args.repeat([...args.argv, ...YOUTUBE_FALLBACK_CLIENT_ARGS], first.route);\n\n  // `tier` and `route` stay the first attempt's: the retry deliberately did not\n  // move, so reporting a different rung would misstate what was spent.\n  return { ...again, tier: first.tier, route: first.route, reducedQuality: again.code === 0 };\n}\n\nfunction runViaLadder(args: {\n  url: string;\n  argv: readonly string[];\n  timeoutMs: number;\n  onLog?: (message: string) => void;\n  country?: string;\n}): Promise<LadderResult> {\n  return walkYtDlpLadder({\n    url: args.url,\n    credentials: captureProxyCredentials(),\n    attempt: (route) => spawnAndWait(YT_DLP_BIN, args.argv, args.timeoutMs, { extraEnv: proxyEnvFor(route) }),\n    onLog: args.onLog,\n    country: args.country,\n  });\n}\n\n/**\n * A route as the environment a child process reads it from.\n *\n * Env, never `--proxy`: the flag would put the password in `argv`, readable by\n * any `ps` sharing the sandbox and printed by yt-dlp into the very stderr this\n * module reads back and attaches to an error. Both spellings, because \"which\n * case does this tool read\" is not worth being wrong about once — and `NO_PROXY`\n * is deliberately unset, since `plannedRoutes` has already refused to build a\n * proxy route for a private address.\n *\n * The percent-encoding is correct here and is deliberately **not** the same\n * decision as `browserProxyUrl` in `@baker/proxy`. Measured against both readers\n * with a proxy that logs what it receives: given `ab%3Dcd`, yt-dlp (Python)\n * authenticates as `ab=cd` — it decodes — while Chromium authenticates as the\n * literal `ab%3Dcd`. The same URL means two different passwords depending on who\n * reads it, so each side is written for its own reader. Do not harmonise them.\n */\nexport function proxyEnvFor(route: ProxyRoute): Record<string, string> | undefined {\n  if (route.kind !== \"proxy\") return undefined;\n  const uri = new URL(route.server);\n  uri.username = encodeURIComponent(route.username);\n  uri.password = encodeURIComponent(route.password);\n  return {\n    HTTP_PROXY: uri.toString(),\n    HTTPS_PROXY: uri.toString(),\n    http_proxy: uri.toString(),\n    https_proxy: uri.toString(),\n  };\n}\n\nexport type SpawnResult = { code: number; stderr: string; stdout?: string };\n\n/**\n * Spawn helper local to yt-dlp: the engine's `cli-runner` rejects URL arguments\n * by policy, which is directly at odds with yt-dlp's job.\n *\n * stdout is discarded unless asked for, because on a download it is the media\n * progress firehose; the probe is the one caller that actually wants it.\n */\nexport function spawnAndWait(\n  bin: string,\n  argv: readonly string[],\n  timeoutMs: number,\n  options: { extraEnv?: Record<string, string>; captureStdout?: boolean } = {},\n): Promise<SpawnResult> {\n  return new Promise((resolve, reject) => {\n    const child = spawn(bin, argv, {\n      stdio: [\"ignore\", \"pipe\", \"pipe\"],\n      // `childEnvWith` because `spawn`'s `env` REPLACES the environment rather\n      // than extending it — passing only the additions would strip PATH.\n      ...(options.extraEnv ? { env: childEnvWith(options.extraEnv) } : {}),\n    });\n    const stderrChunks: Buffer[] = [];\n    const stdoutChunks: Buffer[] = [];\n    let stderrLen = 0;\n    const MAX_STDERR = 256 * 1024;\n\n    child.stdout.on(\"data\", (chunk: Buffer) => {\n      if (options.captureStdout) stdoutChunks.push(chunk);\n    });\n    child.stderr.on(\"data\", (chunk: Buffer) => {\n      if (stderrLen < MAX_STDERR) {\n        stderrChunks.push(chunk);\n        stderrLen += chunk.length;\n      }\n    });\n\n    const timer = setTimeout(() => {\n      child.kill(\"SIGKILL\");\n      reject(new Error(`${bin} timed out after ${timeoutMs}ms`));\n    }, timeoutMs);\n\n    child.on(\"error\", (err) => {\n      clearTimeout(timer);\n      reject(new Error(`failed to spawn \"${bin}\" — ${err.message}`));\n    });\n\n    child.on(\"close\", (code) => {\n      clearTimeout(timer);\n      resolve({\n        code: code ?? -1,\n        stderr: Buffer.concat(stderrChunks).toString(\"utf-8\"),\n        ...(options.captureStdout ? { stdout: Buffer.concat(stdoutChunks).toString(\"utf-8\") } : {}),\n      });\n    });\n  });\n}\n","/**\n * Which video yt-dlp keeps. By default the best the site releases — see\n * `runYtDlp` for why the master matters. A caller importing in bulk may cap\n * the resolution instead: a whole channel of 4K masters is five times the bytes\n * of 1080p, and those bytes are what overruns a download's time budget.\n *\n * The cap is on the shorter side (yt-dlp's `res` sort field), not the height: a\n * vertical Short's 1080p is 1080×1920, and a height cap would keep its 608×1080\n * rendition instead. A sort rather than a filter, so when nothing fits the cap\n * the closest there is still beats no video.\n */\nexport function videoFormatArgs(maxResolution?: number): string[] {\n  const sort = maxResolution ? [\"-S\", `res:${maxResolution}`] : [];\n  return [\"--format\", \"bv*+ba/b\", ...sort, \"--merge-output-format\", \"mp4\"];\n}\n","/**\n * The second thing to try when YouTube hands us a video and then refuses it.\n *\n * Distinct from the egress ladder, and the distinction is the whole point. The\n * ladder answers \"would a different IP help\"; this answers \"would a different\n * *client* help\" — and measured inside a Runtime, the second question is the one\n * that was failing. yt-dlp's default client selection lands on `android_vr`,\n * whose media URLs YouTube now signs and then rejects, so extraction succeeds,\n * a format is chosen, and the byte fetch comes back\n * `unable to download video data: HTTP Error 403: Forbidden`. That failure is\n * identical from every exit: direct, datacenter and residential all produced it,\n * so climbing the ladder spent both paid rungs to reproduce it.\n *\n * The `android` client resolves a progressive format whose URL is honoured from\n * the same address — verified on two unrelated videos from the Runtime's own IP\n * after the default clients had 403'd. It is a *fallback*, not the default: it\n * currently offers only 360p, so it is worth reaching for once the good formats\n * have already been refused and worth nothing before that.\n */\n\n/** yt-dlp's argv for the fallback client. Appended, never substituted. */\nexport const YOUTUBE_FALLBACK_CLIENT_ARGS = [\"--extractor-args\", \"youtube:player_client=android\"] as const;\n\n/**\n * The refusal that happens *after* a format was chosen.\n *\n * Deliberately this exact phrase rather than a bare 403: a 403 raised while\n * fetching the page is a block on us, which the egress ladder already owns and\n * can actually fix. This one is raised on the media URL yt-dlp was just given,\n * which no exit IP changes.\n */\nconst MEDIA_FETCH_REFUSED = \"unable to download video data\";\n\nconst YOUTUBE_HOSTS = [\"youtube.com\", \"youtu.be\"];\n\nfunction isYouTube(url: string): boolean {\n  let host: string;\n  try {\n    host = new URL(url).hostname.toLowerCase();\n  } catch {\n    return false;\n  }\n  return YOUTUBE_HOSTS.some((known) => host === known || host.endsWith(`.${known}`));\n}\n\n/** True when re-running with the fallback client is worth one more attempt. */\nexport function needsPlayerClientRetry(url: string, stderr: string): boolean {\n  return isYouTube(url) && stderr.toLowerCase().includes(MEDIA_FETCH_REFUSED);\n}\n"],"mappings":";;;;;;;;;AAAA,SAAS,iBAAiB;AAC1B,OAAO,UAAU;AAmBjB,IAAM,cAAc;AASpB,eAAsB,qBAAqB,QAA4B,SAA8C;AACnH,QAAM,QAAQ,QAAQ,KAAK;AAC3B,MAAI,CAAC,MAAO,QAAO;AAInB,QAAM,UAAU,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI,MAAM,KAAK,KAAK;AAChE,QAAM,MAAM;AAAA,IACV;AAAA,IACA,CAAC,cAAc,QAAQ,KAAK,QAAQ,OAAO,OAAO,GAAG,aAAa,KAAK,EAAE,KAAK,GAAI;AAAA,IAClF;AAAA,EACF,EAAE,KAAK,IAAI;AAEX,QAAM,WAAW,KAAK,KAAK,SAAS,mBAAmB;AAGvD,QAAM,UAAU,UAAU,KAAK,EAAE,MAAM,IAAM,CAAC;AAC9C,SAAO;AACT;AAeA,IAAM,wBAAwB,CAAC,eAAe,6BAA6B,kCAAkC;AAEtG,SAAS,mBAAmB,QAAyB;AAC1D,QAAM,WAAW,OAAO,YAAY;AACpC,MAAI,CAAC,SAAS,SAAS,SAAS,EAAG,QAAO;AAC1C,SAAO,sBAAsB,KAAK,CAAC,cAAc,SAAS,SAAS,SAAS,CAAC;AAC/E;;;ACpDA,IAAM,aAAa;AAUnB,IAAM,oBAAoB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AASA,IAAM,sBAAsB,CAAC,iBAAiB,qBAAqB,gBAAgB,4BAA4B;AAW/G,IAAM,uBAAuB;AAEtB,SAAS,iBAAiB,QAA6B;AAC5D,QAAM,OAAO,OAAO,YAAY;AAEhC,MAAI,qBAAqB,KAAK,MAAM,EAAG,QAAO,EAAE,QAAQ,IAAI;AAE5D,MAAI,oBAAoB,KAAK,CAAC,WAAW,KAAK,SAAS,MAAM,CAAC,EAAG,QAAO,CAAC;AAKzE,QAAM,SAAS,WAAW,KAAK,MAAM;AACrC,MAAI,OAAQ,QAAO,EAAE,QAAQ,OAAO,OAAO,CAAC,CAAC,EAAE;AAE/C,MAAI,kBAAkB,KAAK,CAAC,WAAW,KAAK,SAAS,MAAM,CAAC,EAAG,QAAO,EAAE,WAAW,KAAK;AACxF,SAAO,CAAC;AACV;;;ACrEA,SAAS,aAAa;AACtB,SAAS,SAAS,gBAAgB;AAClC,OAAOA,WAAU;;;ACSV,SAAS,gBAAgB,eAAkC;AAChE,QAAM,OAAO,gBAAgB,CAAC,MAAM,OAAO,aAAa,EAAE,IAAI,CAAC;AAC/D,SAAO,CAAC,YAAY,YAAY,GAAG,MAAM,yBAAyB,KAAK;AACzE;;;ACOO,IAAM,+BAA+B,CAAC,oBAAoB,+BAA+B;AAUhG,IAAM,sBAAsB;AAE5B,IAAM,gBAAgB,CAAC,eAAe,UAAU;AAEhD,SAAS,UAAU,KAAsB;AACvC,MAAI;AACJ,MAAI;AACF,WAAO,IAAI,IAAI,GAAG,EAAE,SAAS,YAAY;AAAA,EAC3C,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO,cAAc,KAAK,CAAC,UAAU,SAAS,SAAS,KAAK,SAAS,IAAI,KAAK,EAAE,CAAC;AACnF;AAGO,SAAS,uBAAuB,KAAa,QAAyB;AAC3E,SAAO,UAAU,GAAG,KAAK,OAAO,YAAY,EAAE,SAAS,mBAAmB;AAC5E;;;AFxBO,IAAM,aAAa;AACnB,IAAM,oBAAoB,KAAK,KAAK;AAEpC,IAAM,0BAA0B,KAAK;AAiB5C,IAAM,qBAAqB,CAAC,oBAAoB,YAAY;AAErD,IAAM,aAAN,cAAyB,MAAM;AAAA,EACpC,YACE,SACS,YACT;AACA,UAAM,OAAO;AAFJ;AAGT,SAAK,OAAO;AAAA,EACd;AACF;AAEO,SAAS,KAAK,MAAc,UAA0B;AAC3D,SAAO,KAAK,MAAM,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,IAAI;AACpD;AAcA,eAAsB,SAAS,MAW+D;AAC5F,QAAM,cAAcC,MAAK,KAAK,KAAK,SAAS,aAAa;AACzD,QAAM,WAAWA,MAAK,KAAK,KAAK,SAAS,eAAe;AAExD,QAAM,OAAiB;AAAA,IACrB,KAAK;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,IACH;AAAA,IACA;AAAA,EACF;AAEA,MAAI,KAAK,WAAW;AAClB,SAAK,KAAK,MAAM,kBAAkB,KAAK;AAAA,EACzC,OAAO;AACL,SAAK,KAAK,GAAG,gBAAgB,KAAK,SAAS,CAAC;AAAA,EAC9C;AAEA,QAAM,aAAa,MAAM,qBAAqB,KAAK,aAAa,KAAK,OAAO;AAC5E,MAAI,WAAY,MAAK,KAAK,aAAa,UAAU;AAEjD,OAAK,QAAQ,uBAAuB,KAAK,YAAY,UAAU,OAAO,EAAE;AACxE,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,EAAE,MAAM,QAAQ,MAAM,eAAe,IAAI,MAAM,2BAA2B;AAAA,IAC9E,KAAK,KAAK;AAAA,IACV;AAAA,IACA,OAAO,KAAK;AAAA,IACZ,QAAQ,CAAC,gBACP,aAAa,EAAE,KAAK,KAAK,KAAK,MAAM,aAAa,WAAW,OAAO,KAAK,OAAO,SAAS,KAAK,QAAQ,CAAC;AAAA,IACxG,QAAQ,CAAC,aAAa,UAAU,aAAa,YAAY,aAAa,WAAW,EAAE,UAAU,YAAY,KAAK,EAAE,CAAC;AAAA,EACnH,CAAC;AAED,MAAI,SAAS,GAAG;AACd,UAAM,IAAI,WAAW,iBAAiB,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;AAAA,EAChE;AAEA,QAAM,QAAQ,MAAM,QAAQ,KAAK,OAAO;AACxC,QAAM,SAAS,KAAK,YAAY,SAAS;AACzC,QAAM,aAAa,MAAM,KAAK,CAAC,MAAM,EAAE,WAAW,MAAM,KAAK,EAAE,SAAS,MAAM,CAAC;AAC/E,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,WAAW,mCAAmC,MAAM,eAAe,MAAM,KAAK,IAAI,CAAC,KAAK,EAAE;AAAA,EACtG;AAEA,MAAI,OAAkB,CAAC;AACvB,MAAI;AACF,WAAO,KAAK,MAAM,MAAM,SAAS,UAAU,OAAO,CAAC;AAAA,EACrD,QAAQ;AAAA,EAER;AAEA,SAAO,EAAE,UAAUA,MAAK,KAAK,KAAK,SAAS,UAAU,GAAG,MAAM,MAAM,eAAe;AACrF;AAcA,eAAsB,WAAW,MAQkB;AACjD,QAAM,OAAO;AAAA,IACX,KAAK;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA;AAAA,IACA,GAAG;AAAA,EACL;AAKA,MAAI,KAAK,WAAW;AAClB,UAAM,aAAa,MAAM,qBAAqB,KAAK,aAAa,KAAK,SAAS;AAC9E,QAAI,WAAY,MAAK,KAAK,aAAa,UAAU;AAAA,EACnD;AAEA,MAAI,SAAS;AACb,QAAM,EAAE,MAAM,QAAQ,KAAK,IAAI,MAAM,gBAAgB;AAAA,IACnD,KAAK,KAAK;AAAA,IACV,aAAa,wBAAwB;AAAA,IACrC,SAAS,OAAO,UAAU;AACxB,YAAM,SAAS,MAAM,aAAa,YAAY,MAAM,KAAK,aAAa,yBAAyB;AAAA,QAC7F,UAAU,YAAY,KAAK;AAAA,QAC3B,eAAe;AAAA,MACjB,CAAC;AACD,eAAS,OAAO,UAAU;AAC1B,aAAO;AAAA,IACT;AAAA,IACA,OAAO,KAAK;AAAA,IACZ,SAAS,KAAK;AAAA,EAChB,CAAC;AAED,MAAI,SAAS,GAAG;AACd,UAAM,IAAI,WAAW,iBAAiB,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;AAAA,EAChE;AAKA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,MAAM;AAAA,EAC5B,QAAQ;AACN,UAAM,IAAI,WAAW,mDAAmD,KAAK,QAAQ,CAAC,CAAC;AAAA,EACzF;AACA,MAAI,WAAW,QAAQ,OAAO,WAAW,UAAU;AACjD,UAAM,IAAI,WAAW,6CAA6C,KAAK,QAAQ,EAAE,CAAC;AAAA,EACpF;AACA,SAAO,EAAE,MAAM,QAAqB,KAAK;AAC3C;AAgBO,SAAS,YAAY,MAA0B;AACpD,SAAO,KAAK,WAAW;AACzB;AAGO,SAAS,gBAAgB,MAAqC;AACnE,QAAM,MAAM,KAAK;AACjB,SAAO,OAAO,QAAQ,YAAY,OAAO,SAAS,GAAG,KAAK,MAAM,IAAI,MAAM;AAC5E;AAYO,SAAS,aAAa,MAAqC;AAChE,QAAM,MAAM,KAAK;AACjB,SAAO,OAAO,QAAQ,YAAY,IAAI,SAAS,IAAI,MAAM;AAC3D;AAsBA,eAAsB,gBAAgB,MAeZ;AACxB,QAAM,SAAS,cAAc,KAAK,KAAK,KAAK,aAAa,KAAK,UAAU,EAAE,SAAS,KAAK,QAAQ,IAAI,MAAS;AAC7G,MAAI,OAAqB,EAAE,MAAM,IAAI,QAAQ,IAAI,MAAM,UAAU,OAAO,aAAa;AAErF,aAAW,SAAS,QAAQ;AAC1B,UAAM,OAAmB,MAAM,SAAS,UAAU,MAAM,OAAO;AAC/D,QAAI,MAAM,SAAS,QAAS,MAAK,QAAQ,wBAAwB,IAAI,EAAE;AACvE,WAAO,EAAE,GAAI,MAAM,KAAK,QAAQ,KAAK,GAAI,MAAM,MAAM;AACrD,QAAI,KAAK,SAAS,EAAG,QAAO;AAC5B,QAAI,CAAC,eAAe,iBAAiB,KAAK,MAAM,CAAC,EAAG,QAAO;AAAA,EAC7D;AACA,SAAO;AACT;AAsBA,eAAsB,2BAA2B,MAMO;AACtD,QAAM,QAAQ,MAAM,KAAK,OAAO,KAAK,IAAI;AACzC,MAAI,MAAM,SAAS,KAAK,CAAC,uBAAuB,KAAK,KAAK,MAAM,MAAM,GAAG;AACvE,WAAO,EAAE,GAAG,OAAO,gBAAgB,MAAM;AAAA,EAC3C;AAEA,OAAK,QAAQ,kDAAkD;AAC/D,QAAM,QAAQ,MAAM,KAAK,OAAO,CAAC,GAAG,KAAK,MAAM,GAAG,4BAA4B,GAAG,MAAM,KAAK;AAI5F,SAAO,EAAE,GAAG,OAAO,MAAM,MAAM,MAAM,OAAO,MAAM,OAAO,gBAAgB,MAAM,SAAS,EAAE;AAC5F;AAEA,SAAS,aAAa,MAMI;AACxB,SAAO,gBAAgB;AAAA,IACrB,KAAK,KAAK;AAAA,IACV,aAAa,wBAAwB;AAAA,IACrC,SAAS,CAAC,UAAU,aAAa,YAAY,KAAK,MAAM,KAAK,WAAW,EAAE,UAAU,YAAY,KAAK,EAAE,CAAC;AAAA,IACxG,OAAO,KAAK;AAAA,IACZ,SAAS,KAAK;AAAA,EAChB,CAAC;AACH;AAmBO,SAAS,YAAY,OAAuD;AACjF,MAAI,MAAM,SAAS,QAAS,QAAO;AACnC,QAAM,MAAM,IAAI,IAAI,MAAM,MAAM;AAChC,MAAI,WAAW,mBAAmB,MAAM,QAAQ;AAChD,MAAI,WAAW,mBAAmB,MAAM,QAAQ;AAChD,SAAO;AAAA,IACL,YAAY,IAAI,SAAS;AAAA,IACzB,aAAa,IAAI,SAAS;AAAA,IAC1B,YAAY,IAAI,SAAS;AAAA,IACzB,aAAa,IAAI,SAAS;AAAA,EAC5B;AACF;AAWO,SAAS,aACd,KACA,MACA,WACA,UAA0E,CAAC,GACrD;AACtB,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAM,QAAQ,MAAM,KAAK,MAAM;AAAA,MAC7B,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA;AAAA;AAAA,MAGhC,GAAI,QAAQ,WAAW,EAAE,KAAK,aAAa,QAAQ,QAAQ,EAAE,IAAI,CAAC;AAAA,IACpE,CAAC;AACD,UAAM,eAAyB,CAAC;AAChC,UAAM,eAAyB,CAAC;AAChC,QAAI,YAAY;AAChB,UAAM,aAAa,MAAM;AAEzB,UAAM,OAAO,GAAG,QAAQ,CAAC,UAAkB;AACzC,UAAI,QAAQ,cAAe,cAAa,KAAK,KAAK;AAAA,IACpD,CAAC;AACD,UAAM,OAAO,GAAG,QAAQ,CAAC,UAAkB;AACzC,UAAI,YAAY,YAAY;AAC1B,qBAAa,KAAK,KAAK;AACvB,qBAAa,MAAM;AAAA,MACrB;AAAA,IACF,CAAC;AAED,UAAM,QAAQ,WAAW,MAAM;AAC7B,YAAM,KAAK,SAAS;AACpB,aAAO,IAAI,MAAM,GAAG,GAAG,oBAAoB,SAAS,IAAI,CAAC;AAAA,IAC3D,GAAG,SAAS;AAEZ,UAAM,GAAG,SAAS,CAAC,QAAQ;AACzB,mBAAa,KAAK;AAClB,aAAO,IAAI,MAAM,oBAAoB,GAAG,YAAO,IAAI,OAAO,EAAE,CAAC;AAAA,IAC/D,CAAC;AAED,UAAM,GAAG,SAAS,CAAC,SAAS;AAC1B,mBAAa,KAAK;AAClB,cAAQ;AAAA,QACN,MAAM,QAAQ;AAAA,QACd,QAAQ,OAAO,OAAO,YAAY,EAAE,SAAS,OAAO;AAAA,QACpD,GAAI,QAAQ,gBAAgB,EAAE,QAAQ,OAAO,OAAO,YAAY,EAAE,SAAS,OAAO,EAAE,IAAI,CAAC;AAAA,MAC3F,CAAC;AAAA,IACH,CAAC;AAAA,EACH,CAAC;AACH;","names":["path","path"]}

package/dist/chunk-EDLZGTGN.js

@@ -0,0 +1,216 @@
+// ../api/src/identity/digest.ts
+var SHA256_HEX = /^[0-9a-fA-F]{64}$/;
+function isSha256Hex(value) {
+  return SHA256_HEX.test(value);
+}
+
+// ../api/src/identity/email.ts
+function normalizeEmailV1(raw) {
+  const trimmed = raw.trim().toLowerCase();
+  return trimmed === "" ? null : trimmed;
+}
+var EMAIL = /^[^\s@]+@[^\s@.]+(?:\.[^\s@.]+)+$/;
+function normalizeEmailV2(raw) {
+  const trimmed = raw.trim().toLowerCase();
+  return EMAIL.test(trimmed) ? trimmed : null;
+}
+
+// ../api/src/identity/phone.ts
+function normalizePhoneV1(raw) {
+  const digits = raw.trim().toLowerCase().replace(/[^0-9]/g, "");
+  return digits === "" ? null : `+${digits}`;
+}
+var PHONE_PUNCTUATION = /[\s()./-]/g;
+var E164 = /^\+[1-9]\d{7,14}$/;
+function normalizePhoneV2(raw) {
+  const compact = raw.replace(PHONE_PUNCTUATION, "");
+  const e164 = compact.startsWith("00") ? `+${compact.slice(2)}` : compact;
+  return E164.test(e164) ? e164 : null;
+}
+
+// ../api/src/identity/index.ts
+function normalizeIdentity(raw, version) {
+  const value = raw.kind === "email" ? version === 1 ? normalizeEmailV1(raw.value) : normalizeEmailV2(raw.value) : version === 1 ? normalizePhoneV1(raw.value) : normalizePhoneV2(raw.value);
+  return value === null ? null : { kind: raw.kind, value, normalizationVersion: version };
+}
+
+// ../api/src/event-ingest/matching.ts
+var MATCH_FIELDS = [
+  "first_name",
+  "last_name",
+  "date_of_birth",
+  "gender",
+  "city",
+  "region",
+  "postal_code",
+  "country"
+];
+var MATCH_COOKIES = ["fbp", "fbc"];
+function tightened(value) {
+  const stripped = value.toLowerCase().replace(/[^\p{L}\p{N}]/gu, "");
+  return stripped === "" ? null : stripped;
+}
+function loosened(value) {
+  const collapsed = value.trim().toLowerCase().replace(/\s+/g, " ");
+  return collapsed === "" ? null : collapsed;
+}
+function birthDate(value) {
+  const digits = value.replace(/\D/g, "");
+  if (!/^\d{8}$/.test(digits)) return null;
+  const month = Number(digits.slice(4, 6));
+  const day = Number(digits.slice(6, 8));
+  if (month < 1 || month > 12 || day < 1 || day > 31) return null;
+  return digits;
+}
+function genderLetter(value) {
+  const first = value.trim().toLowerCase().charAt(0);
+  return first === "f" || first === "m" ? first : null;
+}
+function countryCode(value) {
+  const code = value.trim().toLowerCase();
+  return /^[a-z]{2}$/.test(code) ? code : null;
+}
+var MATCH_SPECS = {
+  first_name: { keep: "hashed", normalize: tightened, meta: "fn", google: "hashed_first_name" },
+  last_name: { keep: "hashed", normalize: tightened, meta: "ln", google: "hashed_last_name" },
+  // Meta only. Google's enhanced conversions have no date of birth, so there is
+  // no destination wanting it in the clear and every reason not to keep one.
+  date_of_birth: { keep: "hashed", normalize: birthDate, meta: "db", google: null },
+  gender: { keep: "plain", normalize: genderLetter, meta: "ge", google: null },
+  city: { keep: "plain", normalize: loosened, meta: "ct", google: "city" },
+  region: { keep: "plain", normalize: loosened, meta: "st", google: "state" },
+  postal_code: { keep: "plain", normalize: loosened, meta: "zp", google: "postal_code" },
+  country: { keep: "plain", normalize: countryCode, meta: "country", google: "country_code" }
+};
+var MATCH_FIELD_FORWARDING = [
+  { field: "email", meta: "em", google: "hashed_email", hashed: true },
+  { field: "phone", meta: "ph", google: "hashed_phone_number", hashed: true },
+  // Kept in the clear — see `resolveOwnId`. The digest is still computed and
+  // still stored beside it, so a Meta forward has one; what changed is that the
+  // sender's own key is now readable, which is the entire reason they sent it.
+  { field: "external_id", meta: "external_id", google: null, hashed: false },
+  ...MATCH_FIELDS.map((field) => ({
+    field,
+    meta: MATCH_SPECS[field].meta,
+    google: MATCH_SPECS[field].google,
+    hashed: MATCH_SPECS[field].keep === "hashed"
+  })),
+  { field: "fbp", meta: "fbp", google: null, hashed: false },
+  { field: "fbc", meta: "fbc", google: null, hashed: false }
+];
+
+// ../api/src/event-ingest/vocabulary.ts
+var INGEST_CLICK_ID_PARAMS = [
+  "gclid",
+  "wbraid",
+  "gbraid",
+  "dclid",
+  "fbclid",
+  "ttclid",
+  "twclid",
+  "li_fat_id",
+  "msclkid",
+  "rdt_cid",
+  "epik",
+  "sccid",
+  "oppref"
+];
+
+// ../api/src/event-sources/fields.ts
+var MATCH_LABELS = {
+  first_name: "First name",
+  last_name: "Last name",
+  date_of_birth: "Date of birth",
+  gender: "Gender",
+  city: "City",
+  region: "Region",
+  postal_code: "Postcode",
+  country: "Country"
+};
+var CLICK_LABELS = {
+  gclid: "Google click id",
+  wbraid: "Google click id (iOS, web to app)",
+  gbraid: "Google click id (iOS, app)",
+  dclid: "Google click id (Display & Video)",
+  fbclid: "Meta click id",
+  ttclid: "TikTok click id",
+  twclid: "X click id",
+  li_fat_id: "LinkedIn click id",
+  msclkid: "Microsoft click id",
+  rdt_cid: "Reddit click id",
+  epik: "Pinterest click id",
+  sccid: "Snapchat click id",
+  oppref: "ChatGPT Ads click id"
+};
+var SOURCE_FIELDS = [
+  { field: "event_name", label: "What happened", group: "event" },
+  { field: "event_time", label: "When it happened", group: "event" },
+  { field: "event_id", label: "Its id", group: "event" },
+  { field: "email", label: "Email", group: "person" },
+  { field: "phone", label: "Phone", group: "person" },
+  { field: "external_id", label: "Your own id for the person", group: "person" },
+  ...MATCH_FIELDS.map((field) => ({ field, label: MATCH_LABELS[field], group: "person" })),
+  { field: "value", label: "Amount", group: "money" },
+  { field: "currency", label: "Currency", group: "money" },
+  ...INGEST_CLICK_ID_PARAMS.map((field) => ({ field, label: CLICK_LABELS[field], group: "click" }))
+];
+var SOURCE_FIELD_NAMES = SOURCE_FIELDS.map((spec) => spec.field);
+var FIELD_SET = new Set(SOURCE_FIELD_NAMES);
+function isSourceField(value) {
+  return FIELD_SET.has(value);
+}
+var PROPERTY_ROW_PREFIX = "properties.";
+var PROPERTY_KEY_MAX = 64;
+var PROPERTY_KEY = /^[A-Za-z0-9_][A-Za-z0-9_.-]*$/;
+var RESERVED_PROPERTY_KEYS = ["baker_source", "hubspot_property", "hubspot_value"];
+function isPropertyRow(row) {
+  return row.startsWith(PROPERTY_ROW_PREFIX);
+}
+function propertyKeyOf(row) {
+  return isPropertyRow(row) ? row.slice(PROPERTY_ROW_PREFIX.length) : null;
+}
+function propertyKeyProblem(key) {
+  const trimmed = key.trim();
+  if (trimmed === "") return "A property needs a name.";
+  if (trimmed.length > PROPERTY_KEY_MAX) return `A property name is at most ${PROPERTY_KEY_MAX} characters.`;
+  if (!PROPERTY_KEY.test(trimmed)) {
+    return `"${trimmed}" is not a property name: letters, digits, underscore, dash and dot only, starting with a letter or digit.`;
+  }
+  if (RESERVED_PROPERTY_KEYS.includes(trimmed)) return `"${trimmed}" is written by Baker itself; pick another name.`;
+  return null;
+}
+function mappingRowProblem(row) {
+  if (isSourceField(row)) return null;
+  const key = propertyKeyOf(row);
+  if (key === null) {
+    return `"${row}" is not a field an event can carry. A field is one of ${SOURCE_FIELD_NAMES.join(", ")}; an extra property is spelled properties.<name>.`;
+  }
+  return propertyKeyProblem(key);
+}
+
+// ../api/src/event-sources/template.ts
+var MENTION = /\{\{\s*([^{}]+?)\s*\}\}/g;
+function mentionOf(path) {
+  return `{{${path}}}`;
+}
+function templateMentions(template) {
+  const seen = [];
+  for (const match of template.matchAll(MENTION)) {
+    const path = (match[1] ?? "").trim();
+    if (path !== "" && !seen.includes(path)) seen.push(path);
+  }
+  return seen;
+}
+
+export {
+  isSha256Hex,
+  normalizeIdentity,
+  MATCH_COOKIES,
+  MATCH_FIELD_FORWARDING,
+  INGEST_CLICK_ID_PARAMS,
+  SOURCE_FIELD_NAMES,
+  mappingRowProblem,
+  mentionOf,
+  templateMentions
+};
+//# sourceMappingURL=chunk-EDLZGTGN.js.map