agent-bober 0.17.1 → 0.19.0

package/dist/seo/sources/citation-verifier.d.ts

@@ -0,0 +1,95 @@
+/**
+ * DamcrawlerCitationVerifier — verifies each already-cited URL is live and
+ * carries the target brand, via a gated damcrawler scrape (in-house-ai-
+ * visibility, Sprint 4;
+ * arch-20260717-in-house-oss-ai-visibility-architecture.md:163-174,253,283).
+ *
+ * Mirrors `DamcrawlerSerpProvider`'s guard-first/lazy-load/never-throw shape
+ * (`./damcrawler-serp-provider.ts:69-106`) with two differences: the network
+ * call is a per-URL `scrape()` (not `search()`), and there is a THIRD guard
+ * — `assertSafeUrl` per url, AFTER `load()`, BEFORE any damcrawler network
+ * call — mirroring `DamcrawlerCrawlEngine`'s SSRF guard (F2,
+ * `./damcrawler-crawl-engine.ts:156,191-192,227`). This class only fetches
+ * URLs a `MentionCitationExtractor` already surfaced as candidates — it does
+ * NOT scrape answer-engine UIs (that is `ScrapeArmEngineProvider`, Sprint
+ * 10, a nonGoal here).
+ *
+ * `verify()` is fail-closed on every axis (sc-4-2): axis off, damcrawler
+ * absent, a per-url SSRF rejection, or a scrape error/`.error` result all
+ * degrade that url to `{ live: false, brandOnPage: false }` — this class
+ * NEVER fabricates a live citation and NEVER throws to its caller. It
+ * returns exactly one `VerifiedCitation` per input url, in input order.
+ *
+ * damcrawler's `ScrapeResult` (confirmed against
+ * `/Users/bober4ik/damcrawler/src/commands/scrape.ts:99-125`) exposes NO
+ * numeric HTTP status field — the batch-mode `error?` string is the only
+ * failure signal, so `live` here means "scrape succeeded without an
+ * `.error`", not literally "returned HTTP 200".
+ *
+ * Per ADR-11, the scraped `title`/`markdown` are attacker-controlled
+ * free-text and are sanitized HERE, at the network->in-process boundary,
+ * via `ContentSanitizer(dam.sanitize)` — mirrors every other damcrawler
+ * adapter (`damcrawler-crawl-engine.ts`, `damcrawler-serp-provider.ts`).
+ * `brandOnPage` is computed over the SANITIZED body only.
+ */
+import type { SeoEgressGuard } from "../egress.js";
+/** One verified (or fail-closed-unverified) citation URL. */
+export type VerifiedCitation = {
+    url: string;
+    live: boolean;
+    brandOnPage: boolean;
+};
+export interface CitationVerifier {
+    verify(target: string, urls: string[]): Promise<VerifiedCitation[]>;
+}
+/**
+ * NARROW local view of the ONLY damcrawler surface this verifier calls —
+ * confirmed against the real damcrawler source (sprint briefing §1):
+ *   - `scrape(urls, options)` — `damcrawler/src/commands/scrape.ts:99-125`;
+ *     batch-mode result rows carry `{url, title, markdown, error?}`; there is
+ *     NO numeric HTTP status field, `error?` is the only failure signal.
+ *   - `sanitize(raw, options?)` — the ONLY damcrawler sanitize export that
+ *     yields `hadThreats` (`damcrawler/src/lib/sanitize.ts:68-79,89`);
+ *     `sanitizeWithReport` returns a bare `string` and must NOT be used
+ *     here (mirrors every other damcrawler adapter in this directory).
+ *   - `assertSafeUrl(urlString)` — damcrawler's own SSRF guard
+ *     (`damcrawler/src/index.ts:259`), called per url AFTER `load()`,
+ *     BEFORE any damcrawler network call (F2, mirrors
+ *     `damcrawler-crawl-engine.ts:156,191-192,227`).
+ * Defined locally (not imported from the real dep) so tests never need the
+ * real `damcrawler` package installed.
+ */
+interface DamcrawlerVerifyModule {
+    scrape(urls: string[], options: {
+        formats?: string[];
+    }): Promise<Array<{
+        url: string;
+        title: string;
+        markdown: string;
+        error?: string;
+    }>>;
+    sanitize(raw: string, options?: {
+        sourceUrl?: string;
+    }): {
+        content: string;
+        hadThreats: boolean;
+    };
+    assertSafeUrl(urlString: string): Promise<void>;
+}
+/** Loader seam — the default performs the lazy dynamic import; tests inject a FAKE module (or `undefined` to simulate the dep being absent). */
+export type DamcrawlerVerifyLoader = () => Promise<DamcrawlerVerifyModule | undefined>;
+/**
+ * `CitationVerifier` backed by damcrawler. Guard-first, lazy-load, per-url
+ * SSRF-guarded, sanitize-at-boundary, never-throw; returns exactly one
+ * `VerifiedCitation` per input url, in order.
+ */
+export declare class DamcrawlerCitationVerifier implements CitationVerifier {
+    private readonly egress;
+    private readonly load;
+    constructor(egress: SeoEgressGuard, load?: DamcrawlerVerifyLoader);
+    verify(target: string, urls: string[]): Promise<VerifiedCitation[]>;
+    /** Verifies a single url: SSRF guard, then scrape+sanitize+brand-match. Never throws — fail-closed on any error. */
+    private verifyOne;
+}
+export {};
+//# sourceMappingURL=citation-verifier.d.ts.map

package/dist/seo/sources/citation-verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"citation-verifier.d.ts","sourceRoot":"","sources":["../../../src/seo/sources/citation-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAGnD,6DAA6D;AAC7D,MAAM,MAAM,gBAAgB,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,CAAC;AAEpF,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;CACrE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,UAAU,sBAAsB;IAC9B,MAAM,CACJ,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAC9B,OAAO,CAAC,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IACpF,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,OAAO,CAAA;KAAE,CAAC;IAClG,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAED,gJAAgJ;AAChJ,MAAM,MAAM,sBAAsB,GAAG,MAAM,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CAAC;AAyDvF;;;;GAIG;AACH,qBAAa,0BAA2B,YAAW,gBAAgB;IAE/D,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBADJ,MAAM,EAAE,cAAc,EACtB,IAAI,GAAE,sBAAsC;IAGzD,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAoBzE,oHAAoH;YACtG,SAAS;CA6BxB"}

package/dist/seo/sources/citation-verifier.js

@@ -0,0 +1,106 @@
+import { ContentSanitizer } from "../content-sanitizer.js";
+const defaultLoader = async () => {
+    // Indirection through a variable: under `moduleResolution: NodeNext` a
+    // LITERAL `import("damcrawler")` is statically resolved by tsc and fails
+    // with TS2307 when the dep is absent. Routing the specifier through a
+    // `string` variable makes tsc treat the result as `any`, so `tsc --noEmit`
+    // stays clean whether or not damcrawler is installed (mirrors
+    // `damcrawler-crawl-engine.ts:111-120`, `damcrawler-serp-provider.ts:54-63`).
+    const mod = "damcrawler";
+    return (await import(mod).catch(() => undefined));
+};
+// ── Host/brand matching — mirrors mention-citation-extractor.ts:55-95 ────
+// No shared URL/host util exists in `src` (that file's docstring, :16-18);
+// these tiny helpers are duplicated deliberately rather than reaching across
+// module boundaries for a private implementation detail.
+/** `try { new URL(candidate).hostname } catch { "" }` — URL parsing must never throw here. Accepts a full URL or a bare domain. */
+function safeHost(raw) {
+    if (typeof raw !== "string" || raw.trim().length === 0)
+        return "";
+    const hasScheme = /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//.test(raw);
+    const candidate = hasScheme ? raw : `https://${raw}`;
+    try {
+        return new URL(candidate).hostname.toLowerCase();
+    }
+    catch {
+        return "";
+    }
+}
+/** Strips a leading `www.` label. */
+function stripWww(host) {
+    return host.startsWith("www.") ? host.slice(4) : host;
+}
+/** Bare, `www.`-stripped host for `raw` — `""` when `raw` is empty/malformed. */
+function bareHost(raw) {
+    return stripWww(safeHost(raw));
+}
+/** The host's first label — the brand token (e.g. `"target"` from `"target.example"`). */
+function brandToken(host) {
+    const [first] = host.split(".");
+    return first ?? "";
+}
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/** Case-insensitive, word-boundary substring test (avoids `"ace"` matching inside `"space"`). */
+function containsWordBoundary(haystack, needle) {
+    if (!needle)
+        return false;
+    const pattern = new RegExp(`\\b${escapeRegExp(needle)}\\b`, "i");
+    return pattern.test(haystack);
+}
+/**
+ * `CitationVerifier` backed by damcrawler. Guard-first, lazy-load, per-url
+ * SSRF-guarded, sanitize-at-boundary, never-throw; returns exactly one
+ * `VerifiedCitation` per input url, in order.
+ */
+export class DamcrawlerCitationVerifier {
+    egress;
+    load;
+    constructor(egress, load = defaultLoader) {
+        this.egress = egress;
+        this.load = load;
+    }
+    async verify(target, urls) {
+        const unverified = () => urls.map((url) => ({ url, live: false, brandOnPage: false }));
+        // -- STATEMENT 1: egress gate — FIRST, before any import (sc-4-2) --
+        try {
+            this.egress.assertAllowed("site-crawl");
+        }
+        catch {
+            return unverified();
+        }
+        const dam = await this.load();
+        if (!dam)
+            return unverified(); // damcrawler-not-installed (optional peer dep)
+        const brand = brandToken(bareHost(target));
+        const sanitizer = new ContentSanitizer(dam.sanitize); // ADR-11: sanitize at the network->in-process boundary
+        const results = await Promise.all(urls.map((url) => this.verifyOne(dam, sanitizer, brand, url)));
+        return results;
+    }
+    /** Verifies a single url: SSRF guard, then scrape+sanitize+brand-match. Never throws — fail-closed on any error. */
+    async verifyOne(dam, sanitizer, brand, url) {
+        try {
+            await dam.assertSafeUrl(url); // F2-style guard, AFTER load(), BEFORE any damcrawler network call
+        }
+        catch {
+            return { url, live: false, brandOnPage: false };
+        }
+        try {
+            const [result] = await dam.scrape([url], { formats: ["markdown"] });
+            // Missing result row or a batch-mode `.error` — damcrawler's ScrapeResult
+            // has no numeric HTTP status; `error?` is the only failure signal.
+            if (!result || result.error) {
+                return { url, live: false, brandOnPage: false };
+            }
+            const title = sanitizer.clean(result.title, url).content;
+            const body = sanitizer.clean(result.markdown, url).content;
+            const brandOnPage = containsWordBoundary(body, brand) || containsWordBoundary(title, brand);
+            return { url, live: true, brandOnPage };
+        }
+        catch {
+            return { url, live: false, brandOnPage: false }; // scrape threw — fail-closed
+        }
+    }
+}
+//# sourceMappingURL=citation-verifier.js.map

package/dist/seo/sources/citation-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"citation-verifier.js","sourceRoot":"","sources":["../../../src/seo/sources/citation-verifier.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAsC3D,MAAM,aAAa,GAA2B,KAAK,IAAI,EAAE;IACvD,uEAAuE;IACvE,yEAAyE;IACzE,sEAAsE;IACtE,2EAA2E;IAC3E,8DAA8D;IAC9D,8EAA8E;IAC9E,MAAM,GAAG,GAAG,YAAY,CAAC;IACzB,OAAO,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAuC,CAAC;AAC1F,CAAC,CAAC;AAEF,4EAA4E;AAC5E,2EAA2E;AAC3E,6EAA6E;AAC7E,yDAAyD;AAEzD,mIAAmI;AACnI,SAAS,QAAQ,CAAC,GAAW;IAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClE,MAAM,SAAS,GAAG,+BAA+B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,EAAE,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,qCAAqC;AACrC,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC;AAED,iFAAiF;AACjF,SAAS,QAAQ,CAAC,GAAW;IAC3B,OAAO,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,0FAA0F;AAC1F,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,KAAK,IAAI,EAAE,CAAC;AACrB,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED,iGAAiG;AACjG,SAAS,oBAAoB,CAAC,QAAgB,EAAE,MAAc;IAC5D,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,MAAM,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACjE,OAAO,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,0BAA0B;IAElB;IACA;IAFnB,YACmB,MAAsB,EACtB,OAA+B,aAAa;QAD5C,WAAM,GAAN,MAAM,CAAgB;QACtB,SAAI,GAAJ,IAAI,CAAwC;IAC5D,CAAC;IAEJ,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,IAAc;QACzC,MAAM,UAAU,GAAG,GAAuB,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QAE3G,qEAAqE;QACrE,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,UAAU,EAAE,CAAC;QACtB,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,GAAG;YAAE,OAAO,UAAU,EAAE,CAAC,CAAC,+CAA+C;QAE9E,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,uDAAuD;QAE7G,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QACjG,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,oHAAoH;IAC5G,KAAK,CAAC,SAAS,CACrB,GAA2B,EAC3B,SAA2B,EAC3B,KAAa,EACb,GAAW;QAEX,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,mEAAmE;QACnG,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;QAClD,CAAC;QAED,IAAI,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACpE,0EAA0E;YAC1E,mEAAmE;YACnE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBAC5B,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;YAClD,CAAC;YAED,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC;YACzD,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC;YAC3D,MAAM,WAAW,GAAG,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAE5F,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,6BAA6B;QAChF,CAAC;IACH,CAAC;CACF"}

package/dist/seo/sources/crawl-source.d.ts

@@ -0,0 +1,62 @@
+/**
+ * CrawlSource — the `url-inspection` + `link-graph` `SeoDataSource` adapter
+ * over `CrawlEngine` (spec-20260717-seo-improver-builder, Sprint 7; ADR-6,
+ * ADR-8).
+ *
+ * Wraps the Sprint-6 `DamcrawlerCrawlEngine` (which self-guards the
+ * `site-crawl` egress axis, the optional-dependency load, the F2
+ * engine-boundary SSRF check, and F1 title/url/body sanitization). This
+ * adapter adds two things on top:
+ *
+ *   1. The GSC url-inspection LEDGER GATE (ADR-6): every crawl call books
+ *      against the SAME `governor.admit({ source:"gsc",
+ *      capability:"url-inspection", estRows:pageBudget })` ceiling the
+ *      live GSC adapter uses (2,000 queries/day/property) — crawling is
+ *      free (`estCostUsd:0`, ADR-9) but is NOT free of the daily-quantity
+ *      ceiling, so a crawl that would exceed it abstains instead of
+ *      over-crawling (sc-7-2). `admit()` gates BEFORE the engine is ever
+ *      called; `record()` runs ONLY after the engine returns `data`.
+ *   2. DEFENSE-IN-DEPTH row sanitization (sc-7-3): this adapter holds its
+ *      OWN `ContentSanitizer` and cleans every free-text field it emits
+ *      (url-inspection `url`; link-graph `fromUrl`/`toUrl`/`anchor`) even
+ *      though the engine already sanitizes what it controls — an injected
+ *      test double standing in for a future/alternate `CrawlEngine`
+ *      implementation might not.
+ *
+ * Serves ONLY `url-inspection` and `link-graph` (sc-7-1); every other
+ * capability is `{ kind: "disabled" }` unconditionally. Precedence between
+ * this source and `GscAdapter` for `url-inspection` (when both `site-crawl`
+ * and `search-console` are on) is the router's job (ADR-8, Sprint 9,
+ * nonGoal here) — this class is not wired into `selectSource` this sprint.
+ */
+import type { SeoQuotaGovernor } from "../quota-governor.js";
+import type { CrawlEngine } from "../crawl-engine.js";
+import type { ContentSanitizer } from "../content-sanitizer.js";
+import type { SeoDataSource, SeoCapability, SearchAnalyticsQuery, SearchAnalyticsRow, UrlInspectionQuery, UrlInspectionRow, SerpQuery, SerpRow, KeywordQuery, KeywordRow, BacklinkQuery, BacklinkRow, AiVisibilityQuery, AiVisibilityRow, LinkGraphQuery, LinkGraphRow } from "../data-source.js";
+import type { DataOutcome } from "../types.js";
+export declare class CrawlSource implements SeoDataSource {
+    private readonly governor;
+    private readonly engine;
+    private readonly sanitizer;
+    constructor(governor: SeoQuotaGovernor, engine: CrawlEngine, sanitizer: ContentSanitizer);
+    capabilities(): SeoCapability[];
+    /**
+     * URL indexability via `CrawlEngine.urlVisibility` (damcrawler
+     * `probeVisibility`). Ledger-gated (sc-7-2), then defense-in-depth
+     * sanitized (sc-7-3) before it reaches the caller/analyzer.
+     */
+    urlInspection(q: UrlInspectionQuery): Promise<DataOutcome<UrlInspectionRow[]>>;
+    /**
+     * Internal link graph via `CrawlEngine.linkGraph`. Ledger-gated against
+     * the SAME url-inspection ceiling (ADR-6 — the crawl consumes the same
+     * ledger counter regardless of which capability it serves), then
+     * defense-in-depth sanitized.
+     */
+    linkGraph(q: LinkGraphQuery): Promise<DataOutcome<LinkGraphRow[]>>;
+    searchAnalytics(_q: SearchAnalyticsQuery): Promise<DataOutcome<SearchAnalyticsRow[]>>;
+    serp(_q: SerpQuery): Promise<DataOutcome<SerpRow[]>>;
+    keywords(_q: KeywordQuery): Promise<DataOutcome<KeywordRow[]>>;
+    backlinks(_q: BacklinkQuery): Promise<DataOutcome<BacklinkRow[]>>;
+    aiVisibility(_q: AiVisibilityQuery): Promise<DataOutcome<AiVisibilityRow[]>>;
+}
+//# sourceMappingURL=crawl-source.d.ts.map

package/dist/seo/sources/crawl-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crawl-source.d.ts","sourceRoot":"","sources":["../../../src/seo/sources/crawl-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAgB,MAAM,sBAAsB,CAAC;AAC3E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EACV,aAAa,EACb,aAAa,EACb,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,SAAS,EACT,OAAO,EACP,YAAY,EACZ,UAAU,EACV,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,YAAY,EACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,qBAAa,WAAY,YAAW,aAAa;IAE7C,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAFT,QAAQ,EAAE,gBAAgB,EAC1B,MAAM,EAAE,WAAW,EACnB,SAAS,EAAE,gBAAgB;IAG9C,YAAY,IAAI,aAAa,EAAE;IAI/B;;;;OAIG;IACG,aAAa,CAAC,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAuBpF;;;;;OAKG;IACG,SAAS,CAAC,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC,CAAC;IA2BlE,eAAe,CAAC,EAAE,EAAE,oBAAoB,GAAG,OAAO,CAAC,WAAW,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAIrF,IAAI,CAAC,EAAE,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IAIpD,QAAQ,CAAC,EAAE,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC,CAAC;IAI9D,SAAS,CAAC,EAAE,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC;IAIjE,YAAY,CAAC,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,eAAe,EAAE,CAAC,CAAC;CAGnF"}

package/dist/seo/sources/crawl-source.js

@@ -0,0 +1,87 @@
+export class CrawlSource {
+    governor;
+    engine;
+    sanitizer;
+    constructor(governor, engine, sanitizer) {
+        this.governor = governor;
+        this.engine = engine;
+        this.sanitizer = sanitizer;
+    }
+    capabilities() {
+        return ["url-inspection", "link-graph"];
+    }
+    /**
+     * URL indexability via `CrawlEngine.urlVisibility` (damcrawler
+     * `probeVisibility`). Ledger-gated (sc-7-2), then defense-in-depth
+     * sanitized (sc-7-3) before it reaches the caller/analyzer.
+     */
+    async urlInspection(q) {
+        const pageBudget = 1; // one probe per inspection URL
+        const req = {
+            source: "gsc",
+            capability: "url-inspection",
+            scope: { siteUrl: q.siteUrl },
+            estRows: pageBudget,
+            estCostUsd: 0, // crawling is free (ADR-9) — only the daily-quantity ceiling applies
+        };
+        const decision = this.governor.admit(req);
+        if (!decision.admit)
+            return { kind: "abstain", reason: decision.reason }; // over-budget => abstain, NO engine call
+        const out = await this.engine.urlVisibility(q);
+        if (out.kind !== "data")
+            return out; // propagate the engine's own abstain/disabled unchanged
+        const rows = out.rows.map((r) => ({
+            ...r,
+            url: this.sanitizer.clean(r.url, r.url).content,
+        }));
+        await this.governor.record(req, 0); // ONLY after a successful engine call
+        return { kind: "data", rows, provenance: out.provenance };
+    }
+    /**
+     * Internal link graph via `CrawlEngine.linkGraph`. Ledger-gated against
+     * the SAME url-inspection ceiling (ADR-6 — the crawl consumes the same
+     * ledger counter regardless of which capability it serves), then
+     * defense-in-depth sanitized.
+     */
+    async linkGraph(q) {
+        const pageBudget = q.limit ?? 1;
+        const req = {
+            source: "gsc",
+            capability: "url-inspection",
+            scope: {},
+            estRows: pageBudget,
+            estCostUsd: 0,
+        };
+        const decision = this.governor.admit(req);
+        if (!decision.admit)
+            return { kind: "abstain", reason: decision.reason };
+        const out = await this.engine.linkGraph(q);
+        if (out.kind !== "data")
+            return out;
+        const rows = out.rows.map((r) => ({
+            fromUrl: this.sanitizer.clean(r.fromUrl, r.fromUrl).content,
+            toUrl: this.sanitizer.clean(r.toUrl, r.fromUrl).content,
+            anchor: r.anchor === undefined ? undefined : this.sanitizer.clean(r.anchor, r.fromUrl).content,
+            internal: r.internal,
+        }));
+        await this.governor.record(req, 0);
+        return { kind: "data", rows, provenance: out.provenance };
+    }
+    // -- Every other capability is unserved by CrawlSource (sc-7-1) ---------
+    async searchAnalytics(_q) {
+        return { kind: "disabled" };
+    }
+    async serp(_q) {
+        return { kind: "disabled" };
+    }
+    async keywords(_q) {
+        return { kind: "disabled" };
+    }
+    async backlinks(_q) {
+        return { kind: "disabled" };
+    }
+    async aiVisibility(_q) {
+        return { kind: "disabled" };
+    }
+}
+//# sourceMappingURL=crawl-source.js.map

package/dist/seo/sources/crawl-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crawl-source.js","sourceRoot":"","sources":["../../../src/seo/sources/crawl-source.ts"],"names":[],"mappings":"AAsDA,MAAM,OAAO,WAAW;IAEH;IACA;IACA;IAHnB,YACmB,QAA0B,EAC1B,MAAmB,EACnB,SAA2B;QAF3B,aAAQ,GAAR,QAAQ,CAAkB;QAC1B,WAAM,GAAN,MAAM,CAAa;QACnB,cAAS,GAAT,SAAS,CAAkB;IAC3C,CAAC;IAEJ,YAAY;QACV,OAAO,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;IAC1C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CAAC,CAAqB;QACvC,MAAM,UAAU,GAAG,CAAC,CAAC,CAAC,+BAA+B;QACrD,MAAM,GAAG,GAAiB;YACxB,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,gBAAgB;YAC5B,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;YAC7B,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,CAAC,EAAE,qEAAqE;SACrF,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ,CAAC,KAAK;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,yCAAyC;QAEnH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QAC/C,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,GAAG,CAAC,CAAC,wDAAwD;QAE7F,MAAM,IAAI,GAAuB,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpD,GAAG,CAAC;YACJ,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO;SAChD,CAAC,CAAC,CAAC;QACJ,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,sCAAsC;QAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;IAC5D,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CAAC,CAAiB;QAC/B,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAChC,MAAM,GAAG,GAAiB;YACxB,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,gBAAgB;YAC5B,KAAK,EAAE,EAAE;YACT,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,CAAC;SACd,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ,CAAC,KAAK;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QAEzE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,GAAG,CAAC;QAEpC,MAAM,IAAI,GAAmB,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAChD,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO;YAC3D,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO;YACvD,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO;YAC9F,QAAQ,EAAE,CAAC,CAAC,QAAQ;SACrB,CAAC,CAAC,CAAC;QACJ,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;IAC5D,CAAC;IAED,0EAA0E;IAE1E,KAAK,CAAC,eAAe,CAAC,EAAwB;QAC5C,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAa;QACtB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,EAAgB;QAC7B,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,EAAiB;QAC/B,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,EAAqB;QACtC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC9B,CAAC;CACF"}

package/dist/seo/sources/damcrawler-crawl-engine.d.ts

@@ -0,0 +1,151 @@
+/**
+ * DamcrawlerCrawlEngine — the `CrawlEngine` implementation backed by the
+ * optional `damcrawler` peer dependency (spec-20260717-seo-improver-builder,
+ * Sprint 6 + Sprint 7; ADR-6, ADR-9, ADR-11).
+ *
+ * Mirrors `AiVisibilityAdapter`'s guard-first/never-throw/injected-port
+ * shape (`./ai-visibility-adapter.ts:106-143`) with two differences: the
+ * injected seam is a damcrawler MODULE LOADER (not an `HttpClient`/vendor
+ * provider), and there is no quota governor — local crawling has no USD
+ * cost (ADR-9 Options table; do not book anything here). `CrawlSource`
+ * (Sprint 7) books the GSC url-inspection ledger counter, not this class.
+ *
+ * ADR-9's decision is that `damcrawler` (+ its `playwright` peer) stay
+ * OPTIONAL/PEER dependencies, loaded ONLY via a lazy `import()` behind the
+ * `site-crawl` egress axis:
+ *   1. `this.egress.assertAllowed("site-crawl")` — the FIRST statement of
+ *      EVERY method, before any import runs. Throws when the axis is off;
+ *      caught immediately and converted to `abstain` WITHOUT ever loading
+ *      damcrawler — this is what keeps the offline/all-axes-off path
+ *      byte-identical (damcrawler/playwright are never required there).
+ *   2. `this.load()` — the injected `DamcrawlerLoader`. The default
+ *      implementation performs the actual dynamic `import()`; when the
+ *      real dependency is not installed the import rejects and resolves to
+ *      `undefined`, which this class maps to
+ *      `{ kind: "abstain", reason: "damcrawler-not-installed" }`.
+ *   3. An engine-boundary SSRF guard (`dam.assertSafeUrl`, Sprint 7 F2) on
+ *      every caller-supplied URL — AFTER `load()`, BEFORE any damcrawler
+ *      network call. A rejection (`SsrfError` or anything else) degrades
+ *      to `{ kind: "abstain", reason: "ssrf-blocked" }` — protection no
+ *      longer relies solely on the optional dep's own internal guard.
+ *   4. Any OTHER error thrown by the loaded module (a `BrowserError` when
+ *      Chromium is absent, a `TimeoutError`, a `CrawlError`, or anything
+ *      else) degrades to `{ kind: "abstain", reason: "source-error" }` —
+ *      this class NEVER throws to its caller.
+ *
+ * Crawled page free-text (body, title, URL) is attacker-controlled. Per
+ * ADR-11 it is sanitized HERE, at the network->in-process boundary, via
+ * `ContentSanitizer` wrapping the already-loaded module's `sanitize` export
+ * — BEFORE any row reaches `SeoAnalyzer`'s prompt-serialization. Sprint 7
+ * (F1) widens this from body-only to EVERY free-text field on
+ * `CrawlPageRow` (`title`, `url`, `content`) — `CrawlPageRow`'s docstring
+ * asserts the row is fully sanitized, and `SeoAnalyzer` serializes the
+ * whole row verbatim.
+ *
+ * `linkGraph()` (Sprint 7) resolves the markdown-vs-HTML gap left by
+ * Sprint 6: `crawl()` yields page bodies as Markdown with no link data, so
+ * this method uses damcrawler's `scrape(urls, { formats: ["links"] })`
+ * instead, which internally fetches HTML and extracts real
+ * `LinkGraphRow` edges.
+ *
+ * Sprint 9 fix (F1 REOPENED — iteration 2): `linkGraph()`'s `fromUrl`/
+ * `toUrl`/`anchor` and `urlVisibility()`'s `url` are EQUALLY
+ * attacker-controlled free-text (the anchor text and link targets on a
+ * crawled page are written by whoever controls that page) and are now
+ * sanitized HERE too, via the SAME `ContentSanitizer(dam.sanitize)` pattern
+ * `crawl()` already uses — every engine method sanitizes at the
+ * network->in-process boundary before its rows can reach `SeoAnalyzer`'s
+ * `JSON.stringify` prompt serialization. `CrawlSource`'s own sanitizer
+ * (sc-7-3) remains a genuine defense-in-depth SECOND layer now that this
+ * layer is real, not the sole layer standing between an attacker-controlled
+ * anchor and the LLM prompt.
+ */
+import type { SeoEgressGuard } from "../egress.js";
+import type { DataOutcome } from "../types.js";
+import type { UrlInspectionQuery, UrlInspectionRow, LinkGraphQuery, LinkGraphRow, CrawlPageRow } from "../data-source.js";
+import type { CrawlEngine, CrawlQuery } from "../crawl-engine.js";
+/**
+ * NARROW local view of the ONLY damcrawler surface this engine calls —
+ * confirmed against the real damcrawler source (sprint briefing §2):
+ *   - `crawl(startUrl, options)` — `options` is a REQUIRED parameter
+ *     (`damcrawler/src/commands/crawl.ts:158`); page body is `.markdown`,
+ *     NOT `.content` (`crawl.ts:90-96`).
+ *   - `probeVisibility(url, rootUrl, opts?)` (`damcrawler/src/lib/visibility-probe.ts:66`).
+ *   - `sanitize(raw, options?)` — the ONLY damcrawler sanitize export that
+ *     yields `hadThreats` (`damcrawler/src/lib/sanitize.ts:68-79,89`);
+ *     `sanitizeWithReport` returns a bare `string` and must NOT be used
+ *     here (briefing §0/§9.1).
+ *   - `assertSafeUrl(urlString)` (Sprint 7, F2) — damcrawler's own SSRF
+ *     guard, exported `damcrawler/src/index.ts:259`; short-circuits WITHOUT
+ *     a DNS lookup for a literal private/link-local IP or a non-http(s)
+ *     scheme (`ssrf.ts:79-81,94-99`).
+ *   - `scrape(urls, options)` (Sprint 7, linkGraph) — internally fetches
+ *     HTML and runs `extractLinks` over it, returning `ScrapeResult.links`
+ *     (`damcrawler/src/commands/scrape.ts:36-37,112,366-373`).
+ */
+export interface DamcrawlerModule {
+    crawl(startUrl: string, options: {
+        limit?: number;
+        maxDepth?: number;
+    }): Promise<{
+        startUrl: string;
+        pages: Array<{
+            url: string;
+            title: string;
+            depth: number;
+            markdown: string;
+        }>;
+        stats: {
+            pages: number;
+            errors: number;
+        };
+    }>;
+    probeVisibility(url: string, rootUrl: string): Promise<"visible" | "hidden">;
+    sanitize(raw: string, options?: {
+        sourceUrl?: string;
+    }): {
+        content: string;
+        hadThreats: boolean;
+    };
+    /** SSRF guard (F2) — throws (typically a named `SsrfError`) for a disallowed URL, resolves void otherwise. */
+    assertSafeUrl(urlString: string): Promise<void>;
+    /** Link extraction (linkGraph) — `formats: ["links"]` yields `page.links` per fetched URL. */
+    scrape(urls: string[], options: {
+        formats?: string[];
+        limit?: number;
+    }): Promise<Array<{
+        url: string;
+        title: string;
+        links?: Array<{
+            url: string;
+            text: string;
+            rel?: string;
+        }>;
+        error?: string;
+    }>>;
+}
+/** Loader seam — the default performs the lazy dynamic import; tests inject a FAKE module (or `undefined` to simulate the dep being absent). */
+export type DamcrawlerLoader = () => Promise<DamcrawlerModule | undefined>;
+/**
+ * `CrawlEngine` backed by damcrawler. Serves `crawl`/`urlVisibility`/
+ * `linkGraph` fully; every method is guard-first, lazy-load, SSRF-guarded,
+ * and never-throw.
+ */
+export declare class DamcrawlerCrawlEngine implements CrawlEngine {
+    private readonly egress;
+    private readonly load;
+    private readonly now;
+    constructor(egress: SeoEgressGuard, load?: DamcrawlerLoader, now?: () => string);
+    /** Site crawl -> sanitized `CrawlPageRow[]`. Guard, load, SSRF-guard, crawl+sanitize, degrade — never throws. */
+    crawl(q: CrawlQuery): Promise<DataOutcome<CrawlPageRow[]>>;
+    /** URL indexability probe -> single-row `UrlInspectionRow[]`. Guard, load, SSRF-guard, probe, degrade — never throws. */
+    urlVisibility(q: UrlInspectionQuery): Promise<DataOutcome<UrlInspectionRow[]>>;
+    /**
+     * Internal link graph -> flat `LinkGraphRow[]` edges (ADR-6). Guard,
+     * load, SSRF-guard, scrape+extract, degrade — never throws. Uses
+     * `scrape(formats:["links"])` rather than `crawl()`, which yields
+     * Markdown with no link data (see class docstring).
+     */
+    linkGraph(q: LinkGraphQuery): Promise<DataOutcome<LinkGraphRow[]>>;
+}
+//# sourceMappingURL=damcrawler-crawl-engine.d.ts.map

package/dist/seo/sources/damcrawler-crawl-engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"damcrawler-crawl-engine.d.ts","sourceRoot":"","sources":["../../../src/seo/sources/damcrawler-crawl-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC1H,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGlE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CACH,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7C,OAAO,CAAC;QACT,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,KAAK,CAAC;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC9E,KAAK,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC;KAC1C,CAAC,CAAC;IACH,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,QAAQ,CAAC,CAAC;IAC7E,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,OAAO,CAAA;KAAE,CAAC;IAClG,8GAA8G;IAC9G,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,8FAA8F;IAC9F,MAAM,CACJ,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9C,OAAO,CAAC,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,KAAK,CAAC;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,GAAG,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;CAC/H;AAED,gJAAgJ;AAChJ,MAAM,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAC;AAsB3E;;;;GAIG;AACH,qBAAa,qBAAsB,YAAW,WAAW;IAErD,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAErB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAHH,MAAM,EAAE,cAAc,EACtB,IAAI,GAAE,gBAAgC,EAEtC,GAAG,GAAE,MAAM,MAAuC;IAGrE,iHAAiH;IAC3G,KAAK,CAAC,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC,CAAC;IAiChE,yHAAyH;IACnH,aAAa,CAAC,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC,CAAC;IA+BpF;;;;;OAKG;IACG,SAAS,CAAC,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC,CAAC;CA0CzE"}