dexterm-cli 0.0.0-stage → 0.1.1

package/dist/packages/data/src/larp/evidence.js

@@ -0,0 +1,288 @@
+// LARP detector — mechanical evidence signals (task-1315). Pure + deterministic
+// given fetched bytes; no network except through an injected fetcher. These are
+// SIGNALS, never verdicts: the analyst weighs them. HTML is parsed with regex
+// only (zero-dep, and we never execute it) because the page is untrusted data.
+import { classifyLink, parseHttpUrl } from "./links.js";
+const DRAINER_SIGNATURES = [
+    [/setApprovalForAll/i, 'setApprovalForAll (ERC-721/1155 approval drainer)'],
+    [/permit2|permit\(/i, 'permit/permit2 signature grab'],
+    [/eth_sendTransaction|window\.ethereum/i, 'EVM wallet calls on a Solana token (chain mismatch)'],
+    [/eval\s*\(\s*atob\s*\(/i, 'eval(atob( obfuscated script'],
+    [/Function\s*\(\s*atob/i, 'Function(atob( obfuscated script'],
+    [/drainer|seaport\.js|inferno|monkey-drainer|pink-drainer/i, 'known drainer-kit string'],
+    [/signAllTransactions[\s\S]{0,400}(SystemProgram\.transfer|createTransferInstruction)/i, 'sign-all then transfer-all pattern'],
+];
+const BUILDER_SIGNATURES = [
+    [/\.carrd\.co|data-carrd|cardScript/i, 'carrd'],
+    [/static\.wixstatic\.com|X-Wix-|wix\.com/i, 'wix'],
+    [/squarespace\.com|static1\.squarespace/i, 'squarespace'],
+    [/framerusercontent\.com|framer\.com|data-framer/i, 'framer'],
+    [/assets\.website-files\.com|webflow\.(io|com)|data-wf-/i, 'webflow'],
+    [/cdn\.durable\.co|durable\.co/i, 'durable'],
+    [/\.github\.io|github-pages/i, 'github-pages'],
+    [/vercel\.app|_next\/static/i, 'vercel/next'],
+    [/netlify\.app|netlify/i, 'netlify'],
+    [/dorik|data-dorik/i, 'dorik'],
+];
+const DEFAULT_PAGE_SIGNATURES = [
+    [/there isn.?t a github pages site here|404\.html/i, 'github-pages 404'],
+    [/the deployment could not be found|deployment_not_found|welcome to vercel/i, 'vercel default/missing'],
+    [/this (domain|site) is (for sale|parked)|buy this domain|parkingcrew|sedoparking|godaddy\.com\/domainfind/i, 'parked domain'],
+    [/future home of something|default web page|it works!|apache2 (ubuntu|debian) default/i, 'web-server default page'],
+    [/site not found|no such app|there's nothing here/i, 'host placeholder (missing app)'],
+    [/this site can.?t be reached|dns_probe_finished/i, 'unreachable'],
+    [/^\s*(coming soon|under construction)\s*$/i, 'coming-soon stub'],
+];
+function firstMatch(html, table) {
+    for (const [re, name] of table)
+        if (re.test(html))
+            return name;
+    return null;
+}
+function allMatches(html, table) {
+    const out = [];
+    for (const [re, name] of table)
+        if (re.test(html))
+            out.push(name);
+    return out;
+}
+function tag(html, re) {
+    const m = re.exec(html);
+    return m ? m[1].replace(/\s+/g, ' ').trim() : null;
+}
+/** Strip tags/scripts/styles to a rough visible-text approximation. */
+function visibleText(html) {
+    return html
+        .replace(/<script[\s\S]*?<\/script>/gi, ' ')
+        .replace(/<style[\s\S]*?<\/style>/gi, ' ')
+        .replace(/<!--[\s\S]*?-->/g, ' ')
+        .replace(/<[^>]+>/g, ' ')
+        .replace(/&[a-z#0-9]+;/gi, ' ')
+        .replace(/\s+/g, ' ')
+        .trim();
+}
+/** Every absolute http(s) href/src on the page. */
+export function extractUrls(html, baseUrl) {
+    const out = new Set();
+    const re = /(?:href|src)\s*=\s*["']([^"']+)["']/gi;
+    let m;
+    while ((m = re.exec(html)) !== null) {
+        const raw = m[1];
+        let abs;
+        try {
+            abs = new URL(raw, baseUrl ?? undefined).toString();
+        }
+        catch {
+            abs = null;
+        }
+        const p = abs ? parseHttpUrl(abs) : null;
+        if (p)
+            out.add(p.toString());
+    }
+    return [...out];
+}
+function hostOf(url) {
+    const u = parseHttpUrl(url);
+    return u ? u.hostname.toLowerCase().replace(/^www\./, '') : null;
+}
+/**
+ * Compute mechanical signals from a fetched page. `symbol`/`name` enable the "does the site even
+ * mention this token" check. Returns a `fetched:false` bundle (with the block reason) when the
+ * fetch failed, so the analyst can report it as a missing-data fact rather than guess.
+ */
+export function pageSignals(res, opts = {}) {
+    const base = {
+        fetched: res.ok, status: res.status, finalUrl: res.ok ? res.finalUrl : null, blocked: res.blocked,
+        title: null, description: null, generator: null, siteBuilder: null, defaultPage: null,
+        textLength: 0, linkCount: 0, externalHosts: [], hasApp: false, hasDocs: false, hasWhitepaper: false,
+        hasGithub: false, walletConnect: false, drainerFlags: [], scriptHosts: [], mentionsSymbol: null, mentionsName: null, excerpt: '',
+        links: [], teamClaim: false, stockTextSignals: [],
+    };
+    if (!res.ok || !res.body)
+        return base;
+    const html = res.body;
+    const finalHost = hostOf(res.finalUrl);
+    const title = tag(html, /<title[^>]*>([\s\S]*?)<\/title>/i);
+    const description = tag(html, /<meta[^>]+name=["']description["'][^>]*content=["']([^"']*)["']/i)
+        ?? tag(html, /<meta[^>]+property=["']og:description["'][^>]*content=["']([^"']*)["']/i);
+    const generator = tag(html, /<meta[^>]+name=["']generator["'][^>]*content=["']([^"']*)["']/i);
+    const text = visibleText(html);
+    const urls = extractUrls(html, res.finalUrl);
+    const externalHosts = [...new Set(urls.map(hostOf).filter((h) => !!h && h !== finalHost))];
+    const scriptRe = /<script[^>]+src\s*=\s*["']([^"']+)["']/gi;
+    const scriptHosts = new Set();
+    let sm;
+    while ((sm = scriptRe.exec(html)) !== null) {
+        const h = hostOf(sm[1].startsWith('http') ? sm[1] : new URL(sm[1], res.finalUrl ?? 'https://x/').toString());
+        if (h && h !== finalHost)
+            scriptHosts.add(h);
+    }
+    const kinds = new Set(urls.map((u) => { const p = parseHttpUrl(u); return p ? classifyLink(p) : 'other'; }));
+    const lowerHtml = html.toLowerCase();
+    const hasApp = /\b(launch app|open app|dapp|\/app\b|app\.|demo|try (it|now)|get started)\b/i.test(text) || /href=["'][^"']*\/(app|dapp|demo)\b/i.test(html);
+    const sym = (opts.symbol ?? '').replace(/^\$/, '').toLowerCase();
+    const name = (opts.name ?? '').toLowerCase();
+    const lowerText = text.toLowerCase();
+    return {
+        ...base,
+        title: title ? title.slice(0, 160) : null,
+        description: description ? description.slice(0, 300) : null,
+        generator: generator ? generator.slice(0, 80) : null,
+        siteBuilder: firstMatch(html, BUILDER_SIGNATURES) ?? (generator ? generator.split(/[\s(]/)[0].toLowerCase() : null),
+        defaultPage: firstMatch(text, DEFAULT_PAGE_SIGNATURES) ?? (text.length < 40 ? 'near-empty page' : null),
+        textLength: text.length,
+        linkCount: urls.length,
+        externalHosts: externalHosts.slice(0, 30),
+        hasApp,
+        hasDocs: kinds.has('docs') || /\bdocs?\b|documentation|whitepaper|litepaper/i.test(text),
+        hasWhitepaper: /whitepaper|litepaper/i.test(lowerHtml),
+        hasGithub: kinds.has('github'),
+        walletConnect: /connect\s*wallet|walletconnect|@solana\/wallet-adapter|window\.solana|phantom|solflare/i.test(html),
+        drainerFlags: allMatches(html, DRAINER_SIGNATURES),
+        scriptHosts: [...scriptHosts].slice(0, 20),
+        mentionsSymbol: sym ? lowerText.includes(sym) : null,
+        mentionsName: name ? lowerText.includes(name) : null,
+        excerpt: text.slice(0, 1200),
+        links: urls.slice(0, 24).map((url) => ({ url, kind: classifyLink(new URL(url)) })),
+        teamClaim: /\b(our team|founder|co-founder|meet the team)\b/i.test(text),
+        stockTextSignals: allMatches(text, [[/lorem ipsum/i, 'lorem ipsum placeholder'], [/your (company|brand|business) (name|here)/i, 'template placeholder'], [/insert (text|copy|title) here/i, 'unfilled template']]),
+    };
+}
+/** Exact advertised domain, stripping only www. Without a PSL, never attribute
+ * a public suffix's registration (co.uk) to a project (docs.coin.co.uk).
+ * RDAP may refuse a subdomain; that is missing data, not an invented age. */
+export function registrableDomain(url) {
+    const u = parseHttpUrl(url);
+    if (!u)
+        return null;
+    const host = u.hostname.toLowerCase().replace(/^www\./, '');
+    if (/^\d/.test(host) || host.includes(':'))
+        return null; // IP literal
+    const parts = host.split('.');
+    if (parts.length < 2)
+        return null;
+    return host;
+}
+/** Domain registration age + registrar via RDAP (rdap.org bootstrap). Keyless. */
+export async function domainAgeViaRdap(url, fetchText, now = () => Date.now()) {
+    const domain = registrableDomain(url);
+    const base = { domain: domain ?? '', registeredAt: null, ageDays: null, registrar: null, privacy: null, source: 'rdap', error: null };
+    if (!domain)
+        return { ...base, error: 'no registrable domain' };
+    let r;
+    try {
+        r = await fetchText(`https://rdap.org/domain/${encodeURIComponent(domain)}`);
+    }
+    catch (e) {
+        return { ...base, error: `rdap fetch failed: ${e.message}` };
+    }
+    if (!r.ok)
+        return { ...base, error: `rdap status ${r.status}` };
+    let data;
+    try {
+        data = JSON.parse(r.body);
+    }
+    catch {
+        return { ...base, error: 'rdap: invalid json' };
+    }
+    const events = data.events ?? [];
+    const reg = events.find((e) => e.eventAction === 'registration')?.eventDate ?? null;
+    const entities = data.entities ?? [];
+    const registrar = entities.find((e) => e.roles?.includes('registrar'))?.vcardArray ? vcardName(entities.find((e) => e.roles?.includes('registrar')).vcardArray) : null;
+    const registrant = entities.find((e) => e.roles?.includes('registrant'));
+    const privacy = registrant ? /redact|privacy|protect|withheld|gdpr/i.test(JSON.stringify(registrant)) : null;
+    const ageDays = reg ? Math.max(0, Math.round((now() - Date.parse(reg)) / 86_400_000)) : null;
+    return { domain, registeredAt: reg, ageDays: Number.isFinite(ageDays) ? ageDays : null, registrar, privacy, source: 'rdap', error: null };
+}
+function vcardName(vcardArray) {
+    // vCard jCard: ["vcard", [ ["fn", {}, "text", "Name"], ... ]]
+    try {
+        const entries = vcardArray[1];
+        const fn = entries.find((e) => e[0] === 'fn');
+        return fn ? String(fn[3]).slice(0, 80) : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Parse github.com/<owner>/<repo> from a URL. */
+export function parseGithubRepo(url) {
+    const u = parseHttpUrl(url);
+    if (!u || u.hostname.toLowerCase().replace(/^www\./, '') !== 'github.com')
+        return null;
+    const parts = u.pathname.split('/').filter(Boolean);
+    if (parts.length < 2)
+        return null;
+    const owner = parts[0];
+    const repo = parts[1].replace(/\.git$/, '');
+    if (/^(orgs|sponsors|features|about|topics|collections|marketplace)$/i.test(owner))
+        return null;
+    return { owner, repo };
+}
+/** Repo creation/last-push/stars via the keyless GitHub REST API (60 req/hr unauth). */
+export async function githubRepoActivity(url, fetchText, now = () => Date.now()) {
+    const r = parseGithubRepo(url);
+    if (!r)
+        return null;
+    const base = { owner: r.owner, repo: r.repo, createdAt: null, pushedAt: null, daysSincePush: null, stars: null, openIssues: null, archived: null, fork: null, description: null, error: null };
+    let res;
+    try {
+        res = await fetchText(`https://api.github.com/repos/${encodeURIComponent(r.owner)}/${encodeURIComponent(r.repo)}`);
+    }
+    catch (e) {
+        return { ...base, error: `github fetch failed: ${e.message}` };
+    }
+    if (!res.ok)
+        return { ...base, error: res.status === 404 ? 'repo not found' : `github status ${res.status}` };
+    let d;
+    try {
+        d = JSON.parse(res.body);
+    }
+    catch {
+        return { ...base, error: 'github: invalid json' };
+    }
+    const pushedAt = typeof d.pushed_at === 'string' ? d.pushed_at : null;
+    const daysSincePush = pushedAt ? Math.max(0, Math.round((now() - Date.parse(pushedAt)) / 86_400_000)) : null;
+    const commits = [];
+    let historyError = null;
+    try {
+        const history = await fetchText(`https://api.github.com/repos/${encodeURIComponent(r.owner)}/${encodeURIComponent(r.repo)}/commits?per_page=5`);
+        const parsed = history.ok ? JSON.parse(history.body) : null;
+        if (!Array.isArray(parsed))
+            historyError = `commit history unavailable (${history.status})`;
+        else
+            for (const item of parsed.slice(0, 5)) {
+                if (typeof item?.sha === 'string' && /^[a-f0-9]{40}$/.test(item.sha))
+                    commits.push({ sha: item.sha, date: typeof item.commit?.committer?.date === 'string' ? item.commit.committer.date : null });
+            }
+    }
+    catch {
+        historyError = 'commit history unavailable';
+    }
+    return {
+        owner: r.owner, repo: r.repo,
+        createdAt: typeof d.created_at === 'string' ? d.created_at : null,
+        pushedAt, daysSincePush,
+        stars: typeof d.stargazers_count === 'number' ? d.stargazers_count : null,
+        openIssues: typeof d.open_issues_count === 'number' ? d.open_issues_count : null,
+        archived: typeof d.archived === 'boolean' ? d.archived : null,
+        fork: typeof d.fork === 'boolean' ? d.fork : null,
+        description: typeof d.description === 'string' ? d.description.slice(0, 200) : null,
+        commits, historyError,
+        error: null,
+    };
+}
+/** Reachability of a small set of advertised links (broken-link signal). Caller caps the list. */
+export async function probeLinks(urls, fetchProbe, max = 8) {
+    const out = [];
+    for (const url of urls.slice(0, max)) {
+        try {
+            const r = await fetchProbe(url);
+            out.push({ url, ok: r.ok, status: r.status, blocked: r.blocked });
+        }
+        catch (e) {
+            out.push({ url, ok: false, status: 0, blocked: e.message });
+        }
+    }
+    return out;
+}

package/dist/packages/data/src/larp/links.js

@@ -0,0 +1,137 @@
+// LARP detector — link extraction (task-1315). Pure, offline, deterministic.
+// Collects every website/social link a coin advertises from the three keyless
+// sources we already read — DexScreener token `info` (websites[] + socials[]),
+// Jupiter token metadata (website/twitter/telegram) and the pump.fun metadata
+// URI JSON — then classifies and de-duplicates them. No network here: callers
+// pass already-fetched raw shapes. Only http/https links survive; mailto:,
+// javascript:, data: and relative links are dropped.
+const MAX_LINKS = 24;
+/** Parse to a URL only if it is a syntactically valid absolute http(s) link. */
+export function parseHttpUrl(raw) {
+    if (typeof raw !== 'string')
+        return null;
+    const s = raw.trim();
+    if (!s || s.length > 2048)
+        return null;
+    let u;
+    try {
+        u = new URL(s);
+    }
+    catch {
+        return null;
+    }
+    if (u.protocol !== 'http:' && u.protocol !== 'https:')
+        return null;
+    if (u.username || u.password)
+        return null;
+    if (!u.hostname)
+        return null;
+    return u;
+}
+/** Lower-cased host with any leading `www.` removed. */
+function bareHost(u) {
+    return u.hostname.toLowerCase().replace(/^www\./, '');
+}
+/** Classify a link by host (and path for docs). Host is the source of truth, not any label. */
+export function classifyLink(u) {
+    const host = bareHost(u);
+    const path = u.pathname.toLowerCase();
+    if (host === 'twitter.com' || host === 'x.com' || host === 'fxtwitter.com' || host === 'nitter.net' || host === 't.co')
+        return 'x';
+    if (host === 't.me' || host === 'telegram.me' || host === 'telegram.dog')
+        return 'telegram';
+    if (host === 'discord.gg' || host === 'discord.com' || host === 'discordapp.com')
+        return 'discord';
+    if (host === 'github.com' || host === 'raw.githubusercontent.com')
+        return 'github';
+    if (host === 'medium.com' || host.endsWith('.medium.com'))
+        return 'medium';
+    if (host === 'youtube.com' || host === 'youtu.be' || host.endsWith('.youtube.com'))
+        return 'youtube';
+    if (host === 'reddit.com' || host.endsWith('.reddit.com'))
+        return 'reddit';
+    if (host === 'instagram.com' || host.endsWith('.instagram.com'))
+        return 'instagram';
+    if (host === 'tiktok.com' || host.endsWith('.tiktok.com'))
+        return 'tiktok';
+    if (host === 'facebook.com' || host === 'fb.com' || host.endsWith('.facebook.com'))
+        return 'facebook';
+    if (host === 'linktr.ee' || host === 'linktree.com')
+        return 'linktree';
+    if (host.endsWith('.gitbook.io') || host === 'gitbook.io' || host.startsWith('docs.') || path.startsWith('/docs') || path.startsWith('/whitepaper'))
+        return 'docs';
+    return 'website';
+}
+/** A short, injection-inert label for the link list (host; DexScreener website labels when sane). */
+function labelFor(u, rawLabel, kind) {
+    const host = bareHost(u);
+    if (kind === 'website' && rawLabel) {
+        const clean = rawLabel.replace(/[\u0000-\u001F\u007F]/g, '').replace(/\s+/g, ' ').trim().slice(0, 24);
+        if (clean)
+            return clean;
+    }
+    return host;
+}
+/** Map a DexScreener social `type` to our kind when the host is ambiguous (host still wins). */
+function socialTypeKind(type) {
+    switch ((type ?? '').toLowerCase()) {
+        case 'twitter':
+        case 'x': return 'x';
+        case 'telegram': return 'telegram';
+        case 'discord': return 'discord';
+        case 'github': return 'github';
+        case 'medium': return 'medium';
+        case 'youtube': return 'youtube';
+        case 'reddit': return 'reddit';
+        case 'instagram': return 'instagram';
+        case 'tiktok': return 'tiktok';
+        case 'facebook': return 'facebook';
+        default: return null;
+    }
+}
+/** De-dup key: scheme-insensitive host + path (ignores trailing slash and query). */
+function dedupKey(u) {
+    return `${bareHost(u)}${u.pathname.replace(/\/+$/, '')}`.toLowerCase();
+}
+/**
+ * Extract and classify every advertised link for a token. Source order sets priority for the
+ * primary website/x/telegram picks and for de-duplication (the first occurrence wins its label).
+ */
+export function extractLinks(src) {
+    const out = [];
+    const seen = new Set();
+    const add = (raw, source, typeHint, rawLabel) => {
+        if (out.length >= MAX_LINKS)
+            return;
+        const u = parseHttpUrl(raw);
+        if (!u)
+            return;
+        const key = dedupKey(u);
+        if (seen.has(key))
+            return;
+        seen.add(key);
+        // Host classification wins; the DexScreener `type` only disambiguates a generic host.
+        let kind = classifyLink(u);
+        if (kind === 'website') {
+            const hinted = socialTypeKind(typeHint);
+            if (hinted)
+                kind = hinted;
+        }
+        out.push({ kind, url: u.toString(), label: labelFor(u, rawLabel, kind), source });
+    };
+    // 1) DexScreener info: explicit websites[] then socials[].
+    for (const w of src.dexscreener?.info?.websites ?? [])
+        add(w?.url, 'dexscreener', undefined, w?.label);
+    for (const s of src.dexscreener?.info?.socials ?? [])
+        add(s?.url, 'dexscreener', s?.type, s?.label);
+    // 2) Jupiter flat fields.
+    add(src.jupiter?.website, 'jupiter');
+    add(src.jupiter?.twitter, 'jupiter', 'twitter');
+    add(src.jupiter?.telegram, 'jupiter', 'telegram');
+    // 3) pump.fun metadata URI JSON.
+    add(src.pumpfun?.website, 'pumpfun');
+    add(src.pumpfun?.twitter ?? src.pumpfun?.x, 'pumpfun', 'twitter');
+    add(src.pumpfun?.telegram, 'pumpfun', 'telegram');
+    const first = (k) => out.find((l) => l.kind === k)?.url ?? null;
+    return { website: first('website'), x: first('x'), telegram: first('telegram'), all: out };
+}

package/dist/packages/data/src/larp/robots.js

@@ -0,0 +1,90 @@
+// Conservative robots policy for analyst page reads, never a bypass for blocked pages.
+import { safeFetch, SsrfError } from "./safe-fetch.js";
+// Iterative wildcard matching avoids regex backtracking on attacker-owned robots.
+function pathMatches(pattern, target) {
+    const unreserved = (s) => s.replace(/%([a-f0-9]{2})/gi, (m, hex) => {
+        const ch = String.fromCharCode(parseInt(hex, 16));
+        return /[a-z0-9._~-]/i.test(ch) ? ch : m.toUpperCase();
+    });
+    pattern = unreserved(pattern);
+    target = unreserved(target);
+    const exact = pattern.endsWith('$');
+    const p = (exact ? pattern.slice(0, -1) : pattern + '*');
+    let i = 0, j = 0, star = -1, retry = 0;
+    while (j < target.length) {
+        if (p[i] === '*') {
+            star = i++;
+            retry = j;
+        }
+        else if (p[i] === target[j]) {
+            i++;
+            j++;
+        }
+        else if (star >= 0) {
+            i = star + 1;
+            j = ++retry;
+        }
+        else
+            return false;
+    }
+    while (p[i] === '*')
+        i++;
+    return i === p.length;
+}
+/** RFC-style product groups and longest-path allow/disallow matching. */
+export function robotsAllows(text, url) {
+    const groups = [];
+    let group = { agents: [], rules: [] };
+    for (const line of text.split(/\r?\n/)) {
+        const m = /^\s*([\w-]+)\s*:\s*(.*?)\s*$/.exec(line.split('#')[0]);
+        if (!m)
+            continue;
+        const key = m[1].toLowerCase(), value = m[2];
+        if (key === 'user-agent') {
+            if (group.rules.length) {
+                groups.push(group);
+                group = { agents: [], rules: [] };
+            }
+            group.agents.push(value.toLowerCase());
+        }
+        else if (group.agents.length && (key === 'allow' || key === 'disallow') && value) {
+            group.rules.push({ allow: key === 'allow', path: value });
+        }
+    }
+    groups.push(group);
+    const specific = groups.filter((g) => g.agents.includes('dexterm'));
+    const selected = specific.length ? specific : groups.filter((g) => g.agents.includes('*'));
+    let best = -1, allowed = true;
+    for (const rule of selected.flatMap((g) => g.rules)) {
+        if (pathMatches(rule.path, url.pathname + url.search)) {
+            const length = rule.path.replaceAll('*', '').length;
+            if (length > best || (length === best && rule.allow)) {
+                best = length;
+                allowed = rule.allow;
+            }
+        }
+    }
+    return allowed;
+}
+export async function fetchPage(url, options = {}) {
+    // Per-operation cache only: no persistent untrusted state, and every origin
+    // reached by a redirect gets its own robots check through the SSRF transport.
+    const robots = new Map();
+    return safeFetch(url, { ...options, beforeRequest: async (target) => {
+            let result = robots.get(target.origin);
+            if (!result) {
+                result = await safeFetch(new URL('/robots.txt', target).href, { ...options, beforeRequest: undefined, maxBytes: 64 * 1024, timeoutMs: 3000 });
+                robots.set(target.origin, result);
+            }
+            if ([404, 410].includes(result.status) && !result.blocked)
+                return;
+            if (!result.ok || result.blocked || result.truncated)
+                throw new SsrfError('robots unavailable; page not fetched');
+            // A long requested crawl delay cannot fit this interactive tool's budget.
+            // Decline the page rather than quietly violate it (even for another group).
+            if ([...result.body.matchAll(/^\s*crawl-delay\s*:\s*([\d.]+)/gim)].some((m) => Number(m[1]) > 1))
+                throw new SsrfError('robots crawl-delay exceeds interactive budget; page not fetched');
+            if (!robotsAllows(result.body, target))
+                throw new SsrfError('robots disallow; page not fetched');
+        } });
+}