hebits-client 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Asaf (lacherogwu)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,246 @@
+# hebits-client
+
+A TypeScript client for [Hebits](https://hebits.net)'s JSON API — a private, invite-only
+Gazelle-based BitTorrent tracker. It wraps `ajax.php`, the browse/search endpoint, account
+stats, the daily download counter, and `.torrent` downloads, and validates every response
+with [zod](https://zod.dev) so a change on the tracker's side surfaces as a typed error
+instead of silent `undefined`.
+
+## Before you start: you need a session cookie, not a password
+
+Hebits has no API key and no username/password login you can automate: the login form is
+behind a captcha. The only way to get a valid session is to log in with a real browser and
+copy the session cookie out of it (DevTools → Application/Storage → Cookies, or your
+browser's cookie export). Pass that cookie string to the client:
+
+```ts
+new Hebits({ cookie: 'session=abcdef...' });
+```
+
+The cookie eventually expires or gets invalidated server-side. When that happens, every
+call throws `LoginExpiredError` — see [Errors](#errors) below. There is no way to refresh
+it from inside this package; you have to log in again in a browser and supply a new one.
+
+## Install
+
+```sh
+npm install hebits-client
+```
+
+Requires Node.js 22+. The package ships as ESM only (no CommonJS build) with bundled
+TypeScript types.
+
+## Quick example
+
+```ts
+import { Hebits, LoginExpiredError, NotATorrentError } from 'hebits-client';
+
+const hebits = new Hebits({ cookie: process.env.HEBITS_COOKIE! });
+
+const account = await hebits.stats();
+console.log(`${account.userClass}, ratio ${account.ratio}`);
+
+const results = await hebits.browse({ imdb: 'tt0944947', season: 3, freeleechOnly: true });
+for (const torrent of results) {
+  console.log(torrent.name, torrent.size, torrent.seeders, torrent.downloadFactor);
+}
+
+try {
+  const bytes = await hebits.downloadTorrent(results[0]!.id);
+  // write `bytes` (a Uint8Array) to a .torrent file, or hand it to your client
+} catch (e) {
+  if (e instanceof NotATorrentError) {
+    // Hebits served an HTML refusal page instead of a torrent file
+  }
+  if (e instanceof LoginExpiredError) {
+    // the cookie is dead — go get a new one from the browser
+  }
+  throw e;
+}
+```
+
+## API
+
+### `new Hebits(options)`
+
+| option        | type                                  | default                    |
+| ------------- | ------------------------------------- | --------------------------- |
+| `cookie`      | `string`                               | required                    |
+| `baseUrl`     | `string`                               | `https://hebits.net`        |
+| `userAgent`   | `string`                               | `hebits-client/<version>`   |
+| `rateLimit`   | `{ limit: number; interval: number }`  | `{ limit: 1, interval: 2000 }` |
+| `cacheTtlMs`  | `number`                               | `600000` (10 minutes); `0` disables |
+| `cacheMaxEntries` | `number`                           | `200` — an LRU cap on how many distinct query keys the response cache holds at once |
+| `retry`       | `number`                               | `2`                          |
+| `timeoutMs`   | `number`                               | `30000`                     |
+
+`userAgent` exists for the rare case you need a different string; the default is honest on
+purpose (see [Rate limiting and identification](#rate-limiting-and-identification)), and
+you shouldn't change it to make requests look like they came from a browser.
+
+### `hebits.stats(): Promise<AccountStats>`
+
+Calls `ajax.php?action=index`. Returns:
+
+```ts
+interface AccountStats {
+  userId: number;
+  uploaded: number;
+  downloaded: number;
+  ratio: number;
+  requiredRatio: number;
+  userClass: string;
+}
+```
+
+### `hebits.dailyDownloads(userId?: number): Promise<{ used: number; limit: number }>`
+
+Reads the per-day download counter off the user's profile page (`user.php?id=N`). If you
+don't pass a `userId`, it resolves one for you by calling `stats()` first, so the common
+case is just `await hebits.dailyDownloads()`. This call always bypasses the response
+cache — a stale counter could let you exceed the tracker's daily allowance.
+
+### `hebits.checkLogin(): Promise<void>`
+
+Fetches the front page and checks for a logout link. Resolves silently if the cookie is
+still valid; throws `LoginExpiredError` if not. Useful as a cheap health check before a
+batch of other calls. This call always bypasses the response cache, so it never reports a
+dead cookie as valid just because a cached page is still within its TTL.
+
+### `hebits.browse(options?: BrowseOptions): Promise<HebitsTorrent[]>`
+
+Calls `ajax.php?action=browse` and flattens the tracker's group/torrent nesting into a
+single array of `HebitsTorrent` (see below) — one entry per torrent, not per release
+group.
+
+```ts
+interface BrowseOptions {
+  query?: string;          // free-text search; an IMDb id works here too — ignored if `imdb` is also set
+  imdb?: string;            // convenience: sets `query` to this IMDb id; takes precedence, silently discarding `query`
+  season?: number;          // appended to the query — Gazelle has no season parameter
+  freeleechOnly?: boolean;
+  categories?: number[];    // 1 Movies, 2 TV, 8 Movie packs — see the tracker's own category list
+  orderBy?: 'time' | 'size' | 'seeders' | 'snatches';
+  orderWay?: 'asc' | 'desc';
+  limit?: number;           // caps the flattened array; the API itself pages at 50 groups
+}
+```
+
+### `hebits.search(options: BrowseOptions): Promise<HebitsTorrent[]>`
+
+Same endpoint as `browse`, kept as a separate method because call sites read better as
+"search" when there's a concrete query. Unlike `browse`, `options` is required here.
+
+### `hebits.downloadTorrent(id: number): Promise<Uint8Array>`
+
+Downloads the `.torrent` file for a torrent id. Hebits serves an HTML page instead of a
+torrent file when it refuses a download (e.g. insufficient ratio, wrong class); this
+method checks the first byte for bencode's leading `d` and throws `NotATorrentError` with
+a snippet of the refusal page if the check fails, rather than handing you an HTML blob
+that looks like a file.
+
+## The `HebitsTorrent` shape
+
+Every torrent `browse`/`search` returns has this shape — the group it belongs to (film or
+show) is folded into each torrent, so you never deal with the tracker's nested
+group/torrent structure directly:
+
+```ts
+interface HebitsTorrent {
+  id: number;
+  groupId: number;
+  name: string;
+  groupName: string;
+  categoryId: number;
+  imdb?: string;
+  cover?: string;
+  tags: string[];
+  size: number;
+  fileCount: number;
+  seeders: number;
+  leechers: number;
+  snatches: number;
+  uploadedAt: Date;           // corrected to real UTC — see note below
+  resolution?: string;
+  codec?: string;
+  audio?: string;
+  container?: string;
+  downloadFactor: number;     // 1 = full cost, 0.5 = half, 0.25 = quarter, 0 = free/neutral
+  uploadFactor: number;       // 1 = normal, 2 / 3 = upload bonus, 0 = neutral
+  canUseToken: boolean;
+  hasSnatched: boolean;
+}
+```
+
+`uploadedAt` is computed from the tracker's unzoned local timestamp, corrected for
+Israel's actual DST offset on that date (not a fixed offset), so filtering on "uploaded in
+the last N hours" is correct year-round — including right around the DST transitions
+themselves, which need a two-pass offset resolution to get right. Two specific wall-clock
+windows per year are genuinely unrecoverable from an unzoned string alone (the tracker
+doesn't say which side of the transition it means): the hour that doesn't exist during
+spring-forward resolves forward past the gap, and the hour that occurs twice during
+fall-back resolves to the later occurrence, so a torrent uploaded in the first occurrence
+of that hour can read up to an hour newer than it really is. Both cases are documented in
+`parseHebitsTime`'s source comment.
+
+`downloadFactor` and `uploadFactor` collapse the tracker's seven separate freeleech/upload
+boolean flags into two numbers: freeleech beats half- and quarter-leech, and a
+neutral-leech flag overrides everything else to `0`/`0`.
+
+## Responses are validated, not trusted
+
+> Responses are validated with zod at the boundary. If Hebits changes its API, you get a
+> clear `ApiError` naming the field rather than `undefined` propagating into your own
+> logic.
+
+## Errors
+
+All errors extend `HebitsError` (itself an `Error`), so you can catch that base class or
+branch on the specific subclass:
+
+| class                | when it fires |
+| --------------------- | ------------- |
+| `LoginExpiredError`   | The response is a redirect to `login.php`, or a login form was served with a 200 — either way, the cookie is dead. This applies uniformly to every call this client makes, including `downloadTorrent`: a dead cookie on the download endpoint raises this too, not a generic error. Never retried automatically: retrying a dead cookie just hammers the tracker for no gain. |
+| `RateLimitedError`    | The tracker answered with HTTP 429 — on any endpoint, including downloads. |
+| `ApiError`            | Any other non-success HTTP status, a non-JSON body where JSON was expected, or a JSON body that fails the zod schema (the tracker's API shape changed). The message names the offending field(s). |
+| `NotATorrentError`    | `downloadTorrent` got a body that isn't bencode and isn't a login page either — Hebits served some other HTML refusal instead (e.g. insufficient ratio, wrong class). |
+
+## Rate limiting and identification
+
+This client is deliberately slow and honest, not fast and stealthy:
+
+- **One request in flight at a time**, throttled to roughly **one request every two
+  seconds** by default (`rateLimit: { limit: 1, interval: 2000 }`). Nothing this package
+  does is latency-sensitive. This is a single shared throttle across every call this
+  client makes — `browse`/`stats`/etc. AND `downloadTorrent` AND each retry attempt of
+  any of them — so browsing and downloading interleaving, or a burst of retried 5xxs,
+  never doubles the real request rate.
+- **Responses are cached for 10 minutes** by default (`cacheTtlMs`), capped at 200
+  distinct query keys by default (`cacheMaxEntries`, an LRU bound), so repeating the same
+  `browse`/`stats`/etc. call within that window returns the cached body instead of hitting
+  the tracker again. `checkLogin` and `dailyDownloads` always bypass this cache, since a
+  stale answer from either is actively wrong to act on.
+- **Concurrent identical requests are collapsed into one.** If two calls for the exact
+  same path and parameters overlap in flight, the second one just awaits the first's
+  in-flight promise instead of firing its own request.
+- **Requests identify themselves honestly.** The default User-Agent is
+  `hebits-client/<version>` — this client does not pretend to be a browser. A tracker
+  operator should be able to see a scripted client for what it is and rate-limit it
+  fairly, rather than have it blend into ordinary browser traffic.
+
+If your integration needs results faster than this, that's a sign to raise it with the
+tracker rather than to turn the throttle up.
+
+## What this package deliberately does not do
+
+- It never spends freeleech tokens on your behalf — nothing in this client calls a
+  token-spending action; that decision stays with you.
+- It never decides what's worth downloading — `browse`/`search` hand you data, you choose
+  what to call `downloadTorrent` with.
+- It does not store your cookie anywhere. It's held in memory for the lifetime of the
+  `Hebits` instance and sent as a request header; persisting it (env var, secrets
+  manager, wherever) is your responsibility.
+
+## License
+
+MIT

package/dist/index.d.ts

@@ -0,0 +1,113 @@
+/** One torrent, with its group's context folded in. This is the package's central type
+ *  and the only shape consumers see. */
+interface HebitsTorrent {
+    id: number;
+    groupId: number;
+    name: string;
+    groupName: string;
+    categoryId: number;
+    imdb?: string;
+    cover?: string;
+    tags: string[];
+    size: number;
+    fileCount: number;
+    seeders: number;
+    leechers: number;
+    snatches: number;
+    uploadedAt: Date;
+    resolution?: string;
+    codec?: string;
+    audio?: string;
+    container?: string;
+    downloadFactor: number;
+    uploadFactor: number;
+    canUseToken: boolean;
+    hasSnatched: boolean;
+}
+
+interface TransportOptions {
+    cookie: string;
+    baseUrl?: string;
+    userAgent?: string;
+    /** Default 1 request per 2s. Nothing here is latency-sensitive. */
+    rateLimit?: {
+        limit: number;
+        interval: number;
+    };
+    /** Default 10 minutes. Set 0 to disable. */
+    cacheTtlMs?: number;
+    /** Caps how many distinct query keys the response cache holds at once — a modest LRU
+     *  bound, so a long-lived process issuing many distinct queries (e.g. one IMDb id per
+     *  browse call) doesn't grow the cache without limit. Default 200. */
+    cacheMaxEntries?: number;
+    retry?: number;
+    timeoutMs?: number;
+}
+
+interface AccountStats {
+    userId: number;
+    uploaded: number;
+    downloaded: number;
+    ratio: number;
+    requiredRatio: number;
+    userClass: string;
+}
+interface BrowseOptions {
+    /** Free-text search. An IMDb id works here — it is what Jackett sends too. Ignored if
+     *  `imdb` is also set — see `imdb` below. */
+    query?: string;
+    /** Convenience: sets `query` to this IMDb id. Takes precedence over `query`: passing
+     *  both silently discards `query`. */
+    imdb?: string;
+    /** Appended to the query; Gazelle has no season parameter. */
+    season?: number;
+    freeleechOnly?: boolean;
+    /** 1 Movies, 2 TV, 8 Movie packs — see the tracker's category list. */
+    categories?: number[];
+    orderBy?: 'time' | 'size' | 'seeders' | 'snatches';
+    orderWay?: 'asc' | 'desc';
+    /** Cap applied after flattening. The API itself pages at 50 groups. */
+    limit?: number;
+}
+type HebitsOptions = TransportOptions;
+declare class Hebits {
+    #private;
+    constructor(options: HebitsOptions);
+    stats(): Promise<AccountStats>;
+    /** The endpoint is user.php?id=N, so an id is needed. Resolves one via stats() when
+     *  not supplied, so the common call takes no arguments. */
+    dailyDownloads(userId?: number): Promise<{
+        used: number;
+        limit: number;
+    }>;
+    checkLogin(): Promise<void>;
+    browse(options?: BrowseOptions): Promise<HebitsTorrent[]>;
+    /** The same endpoint as browse; separate because the call sites read differently. */
+    search(options: BrowseOptions): Promise<HebitsTorrent[]>;
+    /** Hebits serves an HTML page when it refuses a download, so validate before returning. */
+    downloadTorrent(id: number): Promise<Uint8Array>;
+}
+
+/** Base for everything this package throws. Consumers branch on the subclass. */
+declare class HebitsError extends Error {
+    constructor(message: string, options?: {
+        cause?: unknown;
+    });
+}
+/** The cookie is dead or was redirected to the login page. NEVER retried: retrying a
+ *  dead cookie just hammers the tracker. The operator must paste a fresh one. */
+declare class LoginExpiredError extends HebitsError {
+}
+/** The tracker asked us to slow down. */
+declare class RateLimitedError extends HebitsError {
+}
+/** The API answered, but not in a shape we accept: a non-success status, or a response
+ *  that failed schema validation. A schema failure here means the tracker changed. */
+declare class ApiError extends HebitsError {
+}
+/** A .torrent download returned something that is not bencode — Hebits serves an HTML
+ *  page when it refuses a download. */
+declare class NotATorrentError extends HebitsError {
+}
+
+export { type AccountStats, ApiError, type BrowseOptions, Hebits, HebitsError, type HebitsOptions, type HebitsTorrent, LoginExpiredError, NotATorrentError, RateLimitedError };

package/dist/index.js

@@ -0,0 +1,375 @@
+// src/errors.ts
+var HebitsError = class extends Error {
+  constructor(message, options) {
+    super(message, options);
+    this.name = new.target.name;
+  }
+};
+var LoginExpiredError = class extends HebitsError {
+};
+var RateLimitedError = class extends HebitsError {
+};
+var ApiError = class extends HebitsError {
+};
+var NotATorrentError = class extends HebitsError {
+};
+
+// src/normalise.ts
+function imdbFromCatalogue(url) {
+  return url?.match(/\b(tt\d+)\b/)?.[1];
+}
+function zoneOffsetMs(at, timeZone) {
+  const fmt = new Intl.DateTimeFormat("en-US", {
+    timeZone,
+    hour12: false,
+    year: "numeric",
+    month: "2-digit",
+    day: "2-digit",
+    hour: "2-digit",
+    minute: "2-digit",
+    second: "2-digit"
+  });
+  const p = Object.fromEntries(fmt.formatToParts(at).map((x) => [x.type, x.value]));
+  const asUtc = Date.UTC(
+    Number(p["year"]),
+    Number(p["month"]) - 1,
+    Number(p["day"]),
+    Number(p["hour"]) % 24,
+    Number(p["minute"]),
+    Number(p["second"])
+  );
+  return asUtc - at.getTime();
+}
+function parseHebitsTime(s) {
+  const naive = Date.parse(`${s.replace(" ", "T")}Z`);
+  if (Number.isNaN(naive)) throw new ApiError(`unparseable timestamp from Hebits: ${JSON.stringify(s)}`);
+  const o1 = zoneOffsetMs(new Date(naive), "Asia/Jerusalem");
+  const o2 = zoneOffsetMs(new Date(naive - o1), "Asia/Jerusalem");
+  return new Date(naive - o2);
+}
+function factorsFor(f) {
+  let downloadFactor = 1;
+  if (f.isHalfFreeleech) downloadFactor = 0.5;
+  if (f.isQuarterLeech) downloadFactor = 0.25;
+  if (f.isFreeleech || f.isPersonalFreeleech) downloadFactor = 0;
+  let uploadFactor = 1;
+  if (f.isUploadX2) uploadFactor = 2;
+  if (f.isUploadX3) uploadFactor = 3;
+  if (f.isNeutralLeech) return { downloadFactor: 0, uploadFactor: 0 };
+  return { downloadFactor, uploadFactor };
+}
+function flattenGroups(groups) {
+  const out = [];
+  for (const g of groups) {
+    const imdb = imdbFromCatalogue(g.catalogue);
+    for (const t of g.torrents) {
+      out.push({
+        id: t.torrentId,
+        groupId: g.groupId,
+        name: t.release ?? g.groupName,
+        groupName: g.groupName,
+        categoryId: g.categoryID,
+        imdb,
+        cover: g.cover,
+        tags: g.tags ?? [],
+        size: t.size,
+        fileCount: t.fileCount,
+        seeders: t.seeders,
+        leechers: t.leechers,
+        snatches: t.snatches,
+        uploadedAt: parseHebitsTime(t.time),
+        resolution: t.resolution,
+        codec: t.codec,
+        audio: t.audio,
+        container: t.container,
+        ...factorsFor(t),
+        canUseToken: t.canUseToken,
+        hasSnatched: t.hasSnatched
+      });
+    }
+  }
+  return out;
+}
+
+// src/schemas.ts
+import { z } from "zod";
+var rawTorrentSchema = z.object({
+  torrentId: z.number(),
+  release: z.string().optional(),
+  container: z.string().optional(),
+  codec: z.string().optional(),
+  resolution: z.string().optional(),
+  audio: z.string().optional(),
+  subbing: z.string().optional(),
+  language: z.string().nullable().optional(),
+  fileCount: z.number(),
+  time: z.string(),
+  size: z.number(),
+  snatches: z.number(),
+  seeders: z.number(),
+  leechers: z.number(),
+  isFreeleech: z.boolean(),
+  isHalfFreeleech: z.boolean(),
+  isQuarterLeech: z.boolean(),
+  isNeutralLeech: z.boolean(),
+  isPersonalFreeleech: z.boolean(),
+  isUploadX2: z.boolean(),
+  isUploadX3: z.boolean(),
+  canUseToken: z.boolean(),
+  hasSnatched: z.boolean()
+});
+var rawGroupSchema = z.object({
+  groupId: z.number(),
+  groupName: z.string(),
+  groupNameAlt: z.string().optional(),
+  categoryID: z.number(),
+  categoryName: z.string().optional(),
+  cover: z.string().optional(),
+  tags: z.array(z.string()).optional(),
+  catalogue: z.string().optional(),
+  groupYear: z.number().optional(),
+  torrents: z.array(rawTorrentSchema)
+});
+var browseResponseSchema = z.object({
+  status: z.literal("success"),
+  response: z.object({ results: z.array(rawGroupSchema) })
+});
+var rawUserStatsSchema = z.object({
+  uploaded: z.number(),
+  downloaded: z.number(),
+  ratio: z.number(),
+  requiredratio: z.number(),
+  class: z.string()
+});
+var indexResponseSchema = z.object({
+  status: z.literal("success"),
+  response: z.object({
+    id: z.number(),
+    username: z.string().optional(),
+    userstats: rawUserStatsSchema
+  })
+});
+function parseOrThrow(schema, data, endpoint) {
+  const result = schema.safeParse(data);
+  if (result.success) return result.data;
+  const where = result.error.issues.slice(0, 5).map((i) => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ");
+  throw new ApiError(`${endpoint} response did not match the expected shape \u2014 ${where}`);
+}
+
+// src/scrape.ts
+function parseDailyDownloads(html) {
+  const text = html.replace(/<[^>]+>/g, " ");
+  const m = text.match(/הורדות יומיות:\s*(\d+)\s*\/\s*(\d+)/);
+  if (!m) return null;
+  return { used: Number(m[1]), limit: Number(m[2]) };
+}
+function isLoggedIn(html) {
+  return /logout\.php\?auth=/.test(html);
+}
+
+// src/transport.ts
+import ky, { HTTPError } from "ky";
+import pThrottle from "p-throttle";
+var VERSION = "0.1.0";
+var LOGIN_MARKERS = [/id=["']loginform["']/i, /action=["']login\.php/i];
+var RETRYABLE_STATUS = /* @__PURE__ */ new Set([408, 500, 502, 503, 504]);
+var SNIFF_BYTES = 4096;
+function assertNotLoginPage(url, body) {
+  const path = (() => {
+    try {
+      return new URL(url).pathname;
+    } catch {
+      return url;
+    }
+  })();
+  if (path.endsWith("login.php") || LOGIN_MARKERS.some((re) => re.test(body))) {
+    throw new LoginExpiredError("Hebits returned the login page \u2014 the cookie has expired");
+  }
+}
+function sniff(body) {
+  return typeof body === "string" ? body : new TextDecoder().decode(body.slice(0, SNIFF_BYTES));
+}
+function createTransport(opts) {
+  const {
+    cookie,
+    baseUrl = "https://hebits.net",
+    userAgent = `hebits-client/${VERSION}`,
+    rateLimit = { limit: 1, interval: 2e3 },
+    cacheTtlMs = 10 * 60 * 1e3,
+    cacheMaxEntries = 200,
+    retry = 2,
+    timeoutMs = 3e4
+  } = opts;
+  const client = ky.create({
+    baseUrl,
+    timeout: timeoutMs,
+    redirect: "manual",
+    // ky's own retry is disabled: we retry ourselves, one attempt at a time through the
+    // throttle below, so a retry burst is still spaced like any other request. Retrying
+    // inside a single throttle slot (ky's default) would let a 5xx burst fire several
+    // requests back to back.
+    retry: 0,
+    headers: { cookie, "user-agent": userAgent }
+  });
+  const throttledAttempt = pThrottle(rateLimit)(
+    async (path, sp, responseType) => {
+      const res = await client.get(path, sp ? { searchParams: sp } : void 0);
+      const body = responseType === "text" ? await res.text() : new Uint8Array(await res.arrayBuffer());
+      return { res, body };
+    }
+  );
+  async function request(path, sp, responseType, retriesLeft = retry) {
+    try {
+      const { res, body } = await throttledAttempt(path, sp, responseType);
+      assertNotLoginPage(res.url, sniff(body));
+      return body;
+    } catch (e) {
+      if (e instanceof HTTPError) {
+        const { status, headers } = e.response;
+        if (status === 429) throw new RateLimitedError("Hebits asked us to slow down", { cause: e });
+        if (status >= 300 && status < 400 && /login\.php/.test(headers.get("location") ?? "")) {
+          throw new LoginExpiredError("Hebits redirected to login \u2014 the cookie has expired", { cause: e });
+        }
+        if (RETRYABLE_STATUS.has(status) && retriesLeft > 0) {
+          return request(path, sp, responseType, retriesLeft - 1);
+        }
+        throw new ApiError(`Hebits returned HTTP ${status} for ${path}`, { cause: e });
+      }
+      throw e;
+    }
+  }
+  const cache = /* @__PURE__ */ new Map();
+  const pending = /* @__PURE__ */ new Map();
+  function pruneCache() {
+    if (cacheTtlMs > 0) {
+      const now = Date.now();
+      for (const [k, v] of cache) {
+        if (now - v.at >= cacheTtlMs) cache.delete(k);
+      }
+    }
+    while (cache.size > cacheMaxEntries) {
+      const oldest = cache.keys().next().value;
+      if (oldest === void 0) break;
+      cache.delete(oldest);
+    }
+  }
+  function cacheGet(key) {
+    const hit = cache.get(key);
+    if (!hit || Date.now() - hit.at >= cacheTtlMs) return void 0;
+    cache.delete(key);
+    cache.set(key, hit);
+    return hit.body;
+  }
+  function cacheSet(key, body) {
+    cache.delete(key);
+    cache.set(key, { at: Date.now(), body });
+    pruneCache();
+  }
+  async function fetchBody(path, sp, opts2) {
+    const key = `${path}?${new URLSearchParams(Object.entries(sp ?? {}).map(([k, v]) => [k, String(v)])).toString()}`;
+    if (cacheTtlMs > 0 && !opts2?.bypassCache) {
+      const hit = cacheGet(key);
+      if (hit !== void 0) return hit;
+    }
+    const inFlight = pending.get(key);
+    if (inFlight) return inFlight;
+    const run = request(path, sp, "text").then(
+      (body) => {
+        if (cacheTtlMs > 0) cacheSet(key, body);
+        pending.delete(key);
+        return body;
+      },
+      (err) => {
+        pending.delete(key);
+        throw err;
+      }
+    );
+    pending.set(key, run);
+    return run;
+  }
+  return {
+    async json(path, sp, opts2) {
+      const body = await fetchBody(path, sp, opts2);
+      try {
+        return JSON.parse(body);
+      } catch (e) {
+        throw new ApiError(`${path} did not return JSON`, { cause: e });
+      }
+    },
+    text: (path, sp, opts2) => fetchBody(path, sp, opts2),
+    async bytes(path, sp) {
+      return request(path, sp, "bytes");
+    }
+  };
+}
+
+// src/client.ts
+var Hebits = class {
+  #transport;
+  #userId;
+  constructor(options) {
+    this.#transport = createTransport(options);
+  }
+  async stats() {
+    const raw = await this.#transport.json("ajax.php", { action: "index" });
+    const { response } = parseOrThrow(indexResponseSchema, raw, "ajax.php?action=index");
+    this.#userId = response.id;
+    const u = response.userstats;
+    return {
+      userId: response.id,
+      uploaded: u.uploaded,
+      downloaded: u.downloaded,
+      ratio: u.ratio,
+      requiredRatio: u.requiredratio,
+      userClass: u.class
+    };
+  }
+  /** The endpoint is user.php?id=N, so an id is needed. Resolves one via stats() when
+   *  not supplied, so the common call takes no arguments. */
+  async dailyDownloads(userId) {
+    const id = userId ?? this.#userId ?? (await this.stats()).userId;
+    const html = await this.#transport.text("user.php", { id }, { bypassCache: true });
+    const parsed = parseDailyDownloads(html);
+    if (!parsed) throw new ApiError("could not find the daily download counter on the profile page");
+    return parsed;
+  }
+  async checkLogin() {
+    const html = await this.#transport.text("", void 0, { bypassCache: true });
+    if (!isLoggedIn(html)) throw new LoginExpiredError("no logout link on the front page \u2014 the cookie has expired");
+  }
+  async browse(options = {}) {
+    const sp = { action: "browse", group_results: 0 };
+    const terms = [options.imdb ?? options.query, options.season ? `S${String(options.season).padStart(2, "0")}` : void 0].filter(Boolean).join(" ");
+    if (terms) sp["searchstr"] = terms;
+    if (options.freeleechOnly) sp["freetorrent"] = 1;
+    if (options.orderBy) sp["order_by"] = options.orderBy;
+    if (options.orderWay) sp["order_way"] = options.orderWay;
+    for (const c of options.categories ?? []) sp[`filter_cat[${c}]`] = 1;
+    const raw = await this.#transport.json("ajax.php", sp);
+    const parsed = parseOrThrow(browseResponseSchema, raw, "ajax.php?action=browse");
+    const flat = flattenGroups(parsed.response.results);
+    return options.limit === void 0 ? flat : flat.slice(0, options.limit);
+  }
+  /** The same endpoint as browse; separate because the call sites read differently. */
+  search(options) {
+    return this.browse(options);
+  }
+  /** Hebits serves an HTML page when it refuses a download, so validate before returning. */
+  async downloadTorrent(id) {
+    const bytes = await this.#transport.bytes("torrents.php", { action: "download", id });
+    if (bytes[0] !== 100) {
+      const head = new TextDecoder().decode(bytes.slice(0, 200)).replace(/\s+/g, " ");
+      throw new NotATorrentError(`Hebits refused the download for torrent ${id}: ${head}`);
+    }
+    return bytes;
+  }
+};
+export {
+  ApiError,
+  Hebits,
+  HebitsError,
+  LoginExpiredError,
+  NotATorrentError,
+  RateLimitedError
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/errors.ts","../src/normalise.ts","../src/schemas.ts","../src/scrape.ts","../src/transport.ts","../src/client.ts"],"sourcesContent":["/** Base for everything this package throws. Consumers branch on the subclass. */\nexport class HebitsError extends Error {\n  constructor(message: string, options?: { cause?: unknown }) {\n    super(message, options);\n    this.name = new.target.name;\n  }\n}\n\n/** The cookie is dead or was redirected to the login page. NEVER retried: retrying a\n *  dead cookie just hammers the tracker. The operator must paste a fresh one. */\nexport class LoginExpiredError extends HebitsError {}\n\n/** The tracker asked us to slow down. */\nexport class RateLimitedError extends HebitsError {}\n\n/** The API answered, but not in a shape we accept: a non-success status, or a response\n *  that failed schema validation. A schema failure here means the tracker changed. */\nexport class ApiError extends HebitsError {}\n\n/** A .torrent download returned something that is not bencode — Hebits serves an HTML\n *  page when it refuses a download. */\nexport class NotATorrentError extends HebitsError {}\n","import { ApiError } from './errors.js';\nimport type { RawGroup, RawTorrent } from './schemas.js';\n\n/** One torrent, with its group's context folded in. This is the package's central type\n *  and the only shape consumers see. */\nexport interface HebitsTorrent {\n  id: number;\n  groupId: number;\n  name: string;\n  groupName: string;\n  categoryId: number;\n  imdb?: string;\n  cover?: string;\n  tags: string[];\n  size: number;\n  fileCount: number;\n  seeders: number;\n  leechers: number;\n  snatches: number;\n  uploadedAt: Date;\n  resolution?: string;\n  codec?: string;\n  audio?: string;\n  container?: string;\n  downloadFactor: number;\n  uploadFactor: number;\n  canUseToken: boolean;\n  hasSnatched: boolean;\n}\n\nexport function imdbFromCatalogue(url: string | undefined): string | undefined {\n  return url?.match(/\\b(tt\\d+)\\b/)?.[1];\n}\n\n/** The API returns an unzoned local timestamp. Israel observes DST, so a fixed +02:00\n *  offset is wrong for half the year — Jackett hardcodes it and is an hour out each\n *  summer.\n *\n *  Resolve the real offset with Intl.formatToParts. Do NOT use the\n *  `new Date(d.toLocaleString('en-US', {timeZone}))` trick: it is correct only when the\n *  host machine runs in UTC, because the re-parse interprets the formatted string in the\n *  MACHINE's zone. Measured: on a host in Asia/Jerusalem it is 2h out in winter and 3h\n *  out in summer; in America/New_York, 5h out. That would silently corrupt any caller\n *  filtering on \"uploaded in the last N hours\". */\nfunction zoneOffsetMs(at: Date, timeZone: string): number {\n  const fmt = new Intl.DateTimeFormat('en-US', {\n    timeZone, hour12: false,\n    year: 'numeric', month: '2-digit', day: '2-digit',\n    hour: '2-digit', minute: '2-digit', second: '2-digit',\n  });\n  const p = Object.fromEntries(fmt.formatToParts(at).map((x) => [x.type, x.value])) as Record<string, string>;\n  const asUtc = Date.UTC(\n    Number(p['year']), Number(p['month']) - 1, Number(p['day']),\n    Number(p['hour']) % 24, Number(p['minute']), Number(p['second']),\n  );\n  return asUtc - at.getTime();\n}\n\n/** Two-pass offset resolution. A single sample at the naive-as-UTC instant is wrong near\n *  a DST transition, because the offset it reads is the one in force AT THAT INSTANT,\n *  not the one in force at the wall-clock time the string actually names. Sampling a\n *  second time at `naive - o1` — i.e. at our first guess of the real UTC instant —\n *  converges on the right offset on both sides of a transition.\n *\n *  Two wall-clock windows are genuinely unrecoverable from an unzoned string alone, and\n *  two-pass resolves them the same way every other DST-aware parser does rather than\n *  producing garbage:\n *   - Spring forward (e.g. 03-27 02:00-02:59 in 2026): these wall times never occur.\n *     Two-pass maps them forward into 03:xx IDT — the \"compatible\" disambiguation\n *     `Temporal` also uses.\n *   - Fall back (e.g. 10-25 01:00-01:59 in 2026): these wall times occur twice. Two-pass\n *     resolves to the LATER (IST) reading, so a torrent uploaded in the first occurrence\n *     of that hour can read up to an hour newer than it really is. Not recoverable — the\n *     information needed to pick the earlier one is not in the data. */\nexport function parseHebitsTime(s: string): Date {\n  const naive = Date.parse(`${s.replace(' ', 'T')}Z`);\n  if (Number.isNaN(naive)) throw new ApiError(`unparseable timestamp from Hebits: ${JSON.stringify(s)}`);\n  const o1 = zoneOffsetMs(new Date(naive), 'Asia/Jerusalem');\n  const o2 = zoneOffsetMs(new Date(naive - o1), 'Asia/Jerusalem');\n  return new Date(naive - o2);\n}\n\ntype Flags = Pick<\n  RawTorrent,\n  'isFreeleech' | 'isHalfFreeleech' | 'isQuarterLeech' | 'isNeutralLeech'\n  | 'isPersonalFreeleech' | 'isUploadX2' | 'isUploadX3'\n>;\n\n/** Collapse the tracker's seven boolean flags into the two numbers consumers reason\n *  about, so nobody has to remember that isQuarterLeech means 0.25.\n *\n *  Ordering is deliberate: freeleech beats half- and quarter-leech, and between those\n *  two, the cheaper one wins over a torrent somehow flagged both (quarter overrides\n *  half). Neutral overrides everything else — it means neither side counts, regardless\n *  of what else is set. */\nexport function factorsFor(f: Flags): { downloadFactor: number; uploadFactor: number } {\n  let downloadFactor = 1;\n  if (f.isHalfFreeleech) downloadFactor = 0.5;\n  if (f.isQuarterLeech) downloadFactor = 0.25;\n  if (f.isFreeleech || f.isPersonalFreeleech) downloadFactor = 0;\n\n  let uploadFactor = 1;\n  if (f.isUploadX2) uploadFactor = 2;\n  if (f.isUploadX3) uploadFactor = 3;\n\n  if (f.isNeutralLeech) return { downloadFactor: 0, uploadFactor: 0 };\n  return { downloadFactor, uploadFactor };\n}\n\nexport function flattenGroups(groups: RawGroup[]): HebitsTorrent[] {\n  const out: HebitsTorrent[] = [];\n  for (const g of groups) {\n    const imdb = imdbFromCatalogue(g.catalogue);\n    for (const t of g.torrents) {\n      out.push({\n        id: t.torrentId,\n        groupId: g.groupId,\n        name: t.release ?? g.groupName,\n        groupName: g.groupName,\n        categoryId: g.categoryID,\n        imdb,\n        cover: g.cover,\n        tags: g.tags ?? [],\n        size: t.size,\n        fileCount: t.fileCount,\n        seeders: t.seeders,\n        leechers: t.leechers,\n        snatches: t.snatches,\n        uploadedAt: parseHebitsTime(t.time),\n        resolution: t.resolution,\n        codec: t.codec,\n        audio: t.audio,\n        container: t.container,\n        ...factorsFor(t),\n        canUseToken: t.canUseToken,\n        hasSnatched: t.hasSnatched,\n      });\n    }\n  }\n  return out;\n}\n","import { z } from 'zod';\nimport { ApiError } from './errors.js';\n\n/** A single torrent inside a group. Field types confirmed against the live API on\n *  2026-09-18: the is* flags really are booleans, and `time` really is an unzoned string.\n *  `language` is confirmed against the fixtures to come back as JSON `null` (not omitted)\n *  on almost every torrent, so it is nullable as well as optional. */\nexport const rawTorrentSchema = z.object({\n  torrentId: z.number(),\n  release: z.string().optional(),\n  container: z.string().optional(),\n  codec: z.string().optional(),\n  resolution: z.string().optional(),\n  audio: z.string().optional(),\n  subbing: z.string().optional(),\n  language: z.string().nullable().optional(),\n  fileCount: z.number(),\n  time: z.string(),\n  size: z.number(),\n  snatches: z.number(),\n  seeders: z.number(),\n  leechers: z.number(),\n  isFreeleech: z.boolean(),\n  isHalfFreeleech: z.boolean(),\n  isQuarterLeech: z.boolean(),\n  isNeutralLeech: z.boolean(),\n  isPersonalFreeleech: z.boolean(),\n  isUploadX2: z.boolean(),\n  isUploadX3: z.boolean(),\n  canUseToken: z.boolean(),\n  hasSnatched: z.boolean(),\n});\n\n/** A release group: one film or show, holding several encodes. */\nexport const rawGroupSchema = z.object({\n  groupId: z.number(),\n  groupName: z.string(),\n  groupNameAlt: z.string().optional(),\n  categoryID: z.number(),\n  categoryName: z.string().optional(),\n  cover: z.string().optional(),\n  tags: z.array(z.string()).optional(),\n  catalogue: z.string().optional(),\n  groupYear: z.number().optional(),\n  torrents: z.array(rawTorrentSchema),\n});\n\nexport const browseResponseSchema = z.object({\n  status: z.literal('success'),\n  response: z.object({ results: z.array(rawGroupSchema) }),\n});\n\nexport const rawUserStatsSchema = z.object({\n  uploaded: z.number(),\n  downloaded: z.number(),\n  ratio: z.number(),\n  requiredratio: z.number(),\n  class: z.string(),\n});\n\nexport const indexResponseSchema = z.object({\n  status: z.literal('success'),\n  response: z.object({\n    id: z.number(),\n    username: z.string().optional(),\n    userstats: rawUserStatsSchema,\n  }),\n});\n\nexport type RawTorrent = z.infer<typeof rawTorrentSchema>;\nexport type RawGroup = z.infer<typeof rawGroupSchema>;\nexport type RawUserStats = z.infer<typeof rawUserStatsSchema>;\n\n/** Parse, or throw an ApiError that names the endpoint and the offending fields.\n *  A failure here means the tracker changed its API — that is the signal this package\n *  exists to give, in place of the community maintenance Jackett used to provide. */\nexport function parseOrThrow<T extends z.ZodTypeAny>(schema: T, data: unknown, endpoint: string): z.infer<T> {\n  const result = schema.safeParse(data);\n  if (result.success) return result.data;\n  const where = result.error.issues\n    .slice(0, 5)\n    .map((i) => `${i.path.join('.') || '(root)'}: ${i.message}`)\n    .join('; ');\n  throw new ApiError(`${endpoint} response did not match the expected shape — ${where}`);\n}\n","/** The profile page carries the daily download allowance as a Hebrew line:\n *  \"הורדות יומיות: 3 / 10\". Strip tags first so markup between the numbers cannot\n *  break the match. Returns null rather than guessing — a wrong limit here would let\n *  a caller spend downloads it does not have. */\nexport function parseDailyDownloads(html: string): { used: number; limit: number } | null {\n  const text = html.replace(/<[^>]+>/g, ' ');\n  const m = text.match(/הורדות יומיות:\\s*(\\d+)\\s*\\/\\s*(\\d+)/);\n  if (!m) return null;\n  return { used: Number(m[1]), limit: Number(m[2]) };\n}\n\n/** A logged-in page carries a logout link with an auth token. This is the same test\n *  Jackett's own indexer definition uses. */\nexport function isLoggedIn(html: string): boolean {\n  return /logout\\.php\\?auth=/.test(html);\n}\n","import ky, { HTTPError, type KyInstance } from 'ky';\nimport pThrottle from 'p-throttle';\nimport { ApiError, LoginExpiredError, RateLimitedError } from './errors.js';\n\nexport interface TransportOptions {\n  cookie: string;\n  baseUrl?: string;\n  userAgent?: string;\n  /** Default 1 request per 2s. Nothing here is latency-sensitive. */\n  rateLimit?: { limit: number; interval: number };\n  /** Default 10 minutes. Set 0 to disable. */\n  cacheTtlMs?: number;\n  /** Caps how many distinct query keys the response cache holds at once — a modest LRU\n   *  bound, so a long-lived process issuing many distinct queries (e.g. one IMDb id per\n   *  browse call) doesn't grow the cache without limit. Default 200. */\n  cacheMaxEntries?: number;\n  retry?: number;\n  timeoutMs?: number;\n}\n\nexport interface RequestOptions {\n  /** Skip the response cache for this call — read through to the tracker and still\n   *  write the fresh result back to the cache for everyone else. For calls where a\n   *  stale answer is actively wrong to act on (a login check, a daily quota count),\n   *  not just inconvenient. */\n  bypassCache?: boolean;\n}\n\nexport interface Transport {\n  json(path: string, searchParams?: Record<string, string | number>, opts?: RequestOptions): Promise<unknown>;\n  text(path: string, searchParams?: Record<string, string | number>, opts?: RequestOptions): Promise<string>;\n  bytes(path: string, searchParams?: Record<string, string | number>): Promise<Uint8Array>;\n}\n\n// Duplicates the version in package.json. Reading package.json from source would need an\n// import attribute and complicate the bundle for a string used in one header — accepted wart.\nconst VERSION = '0.1.0';\nconst LOGIN_MARKERS = [/id=[\"']loginform[\"']/i, /action=[\"']login\\.php/i];\nconst RETRYABLE_STATUS = new Set([408, 500, 502, 503, 504]);\n// How much of a byte body to decode when sniffing for a login page. Login pages are\n// small; a .torrent's bencode never starts with anything that decodes into this text.\nconst SNIFF_BYTES = 4096;\n\n/** A redirect to login, or a login form served with 200, both mean the cookie is dead.\n *  Matches the response URL's PATH only, not the full URL — a search for the literal\n *  string \"login.php\" (`browse({ query: 'login.php' })`) must not trip this. */\nfunction assertNotLoginPage(url: string, body: string): void {\n  const path = (() => {\n    try {\n      return new URL(url).pathname;\n    } catch {\n      return url;\n    }\n  })();\n  if (path.endsWith('login.php') || LOGIN_MARKERS.some((re) => re.test(body))) {\n    throw new LoginExpiredError('Hebits returned the login page — the cookie has expired');\n  }\n}\n\n/** Decode enough of a byte body to run the same login-page check text responses get.\n *  A .torrent file never decodes into anything matching LOGIN_MARKERS. */\nfunction sniff(body: string | Uint8Array): string {\n  return typeof body === 'string' ? body : new TextDecoder().decode(body.slice(0, SNIFF_BYTES));\n}\n\nexport function createTransport(opts: TransportOptions): Transport {\n  const {\n    cookie,\n    baseUrl = 'https://hebits.net',\n    userAgent = `hebits-client/${VERSION}`,\n    rateLimit = { limit: 1, interval: 2000 },\n    cacheTtlMs = 10 * 60 * 1000,\n    cacheMaxEntries = 200,\n    retry = 2,\n    timeoutMs = 30_000,\n  } = opts;\n\n  const client: KyInstance = ky.create({\n    baseUrl,\n    timeout: timeoutMs,\n    redirect: 'manual',\n    // ky's own retry is disabled: we retry ourselves, one attempt at a time through the\n    // throttle below, so a retry burst is still spaced like any other request. Retrying\n    // inside a single throttle slot (ky's default) would let a 5xx burst fire several\n    // requests back to back.\n    retry: 0,\n    headers: { cookie, 'user-agent': userAgent },\n  });\n\n  // ONE throttle for every request this transport makes — text, JSON, bytes, and each\n  // retry attempt of any of them. Two separate throttles (one per response type) would\n  // let browsing and downloading interleave at double the configured rate.\n  const throttledAttempt = pThrottle(rateLimit)(\n    async (path: string, sp: Record<string, string | number> | undefined, responseType: 'text' | 'bytes') => {\n      const res = await client.get(path, sp ? { searchParams: sp } : undefined);\n      const body = responseType === 'text' ? await res.text() : new Uint8Array(await res.arrayBuffer());\n      return { res, body };\n    },\n  );\n\n  async function request(\n    path: string,\n    sp: Record<string, string | number> | undefined,\n    responseType: 'text',\n    retriesLeft?: number,\n  ): Promise<string>;\n  async function request(\n    path: string,\n    sp: Record<string, string | number> | undefined,\n    responseType: 'bytes',\n    retriesLeft?: number,\n  ): Promise<Uint8Array>;\n  async function request(\n    path: string,\n    sp: Record<string, string | number> | undefined,\n    responseType: 'text' | 'bytes',\n    retriesLeft: number = retry,\n  ): Promise<string | Uint8Array> {\n    try {\n      const { res, body } = await throttledAttempt(path, sp, responseType);\n      assertNotLoginPage(res.url, sniff(body));\n      return body;\n    } catch (e) {\n      if (e instanceof HTTPError) {\n        const { status, headers } = e.response;\n        if (status === 429) throw new RateLimitedError('Hebits asked us to slow down', { cause: e });\n        if (status >= 300 && status < 400 && /login\\.php/.test(headers.get('location') ?? '')) {\n          throw new LoginExpiredError('Hebits redirected to login — the cookie has expired', { cause: e });\n        }\n        if (RETRYABLE_STATUS.has(status) && retriesLeft > 0) {\n          return request(path, sp, responseType as 'text', retriesLeft - 1);\n        }\n        throw new ApiError(`Hebits returned HTTP ${status} for ${path}`, { cause: e });\n      }\n      throw e;\n    }\n  }\n\n  // key -> settled value with its expiry, and key -> in-flight promise. `cache` is a\n  // Map, so iteration order is insertion order; entries are deleted-and-reinserted on\n  // every touch (read or write) so the first key is always the least recently used one.\n  const cache = new Map<string, { at: number; body: string }>();\n  const pending = new Map<string, Promise<string>>();\n\n  function pruneCache(): void {\n    if (cacheTtlMs > 0) {\n      const now = Date.now();\n      for (const [k, v] of cache) {\n        if (now - v.at >= cacheTtlMs) cache.delete(k);\n      }\n    }\n    while (cache.size > cacheMaxEntries) {\n      const oldest = cache.keys().next().value;\n      if (oldest === undefined) break;\n      cache.delete(oldest);\n    }\n  }\n\n  function cacheGet(key: string): string | undefined {\n    const hit = cache.get(key);\n    if (!hit || Date.now() - hit.at >= cacheTtlMs) return undefined;\n    cache.delete(key);\n    cache.set(key, hit); // bump recency\n    return hit.body;\n  }\n\n  function cacheSet(key: string, body: string): void {\n    cache.delete(key);\n    cache.set(key, { at: Date.now(), body });\n    pruneCache();\n  }\n\n  async function fetchBody(\n    path: string,\n    sp: Record<string, string | number> | undefined,\n    opts?: RequestOptions,\n  ): Promise<string> {\n    const key = `${path}?${new URLSearchParams(Object.entries(sp ?? {}).map(([k, v]) => [k, String(v)])).toString()}`;\n    if (cacheTtlMs > 0 && !opts?.bypassCache) {\n      const hit = cacheGet(key);\n      if (hit !== undefined) return hit;\n    }\n    const inFlight = pending.get(key);\n    if (inFlight) return inFlight;\n\n    // Attach the settle handler in the same statement that creates the promise, so the\n    // stored promise always has a handler and a rejection is never unobserved.\n    const run = request(path, sp, 'text').then(\n      (body) => {\n        if (cacheTtlMs > 0) cacheSet(key, body);\n        pending.delete(key);\n        return body;\n      },\n      (err) => {\n        pending.delete(key); // never cache a failure\n        throw err;\n      },\n    );\n    pending.set(key, run);\n    return run;\n  }\n\n  return {\n    async json(path, sp, opts) {\n      const body = await fetchBody(path, sp, opts);\n      try {\n        return JSON.parse(body);\n      } catch (e) {\n        throw new ApiError(`${path} did not return JSON`, { cause: e });\n      }\n    },\n    text: (path, sp, opts) => fetchBody(path, sp, opts),\n    async bytes(path, sp) {\n      // Binary bodies skip the text CACHE — .torrent files are large and fetched once\n      // each — but go through the same throttle, retry and error mapping (including the\n      // login-page check) as everything else. A download is a tracker request like any\n      // other, and letting it bypass rate limiting or error handling would defeat the\n      // point of having them at all.\n      return request(path, sp, 'bytes');\n    },\n  };\n}\n","import { ApiError, LoginExpiredError, NotATorrentError } from './errors.js';\nimport { flattenGroups, type HebitsTorrent } from './normalise.js';\nimport { browseResponseSchema, indexResponseSchema, parseOrThrow } from './schemas.js';\nimport { isLoggedIn, parseDailyDownloads } from './scrape.js';\nimport { createTransport, type Transport, type TransportOptions } from './transport.js';\n\nexport interface AccountStats {\n  userId: number;\n  uploaded: number;\n  downloaded: number;\n  ratio: number;\n  requiredRatio: number;\n  userClass: string;\n}\n\nexport interface BrowseOptions {\n  /** Free-text search. An IMDb id works here — it is what Jackett sends too. Ignored if\n   *  `imdb` is also set — see `imdb` below. */\n  query?: string;\n  /** Convenience: sets `query` to this IMDb id. Takes precedence over `query`: passing\n   *  both silently discards `query`. */\n  imdb?: string;\n  /** Appended to the query; Gazelle has no season parameter. */\n  season?: number;\n  freeleechOnly?: boolean;\n  /** 1 Movies, 2 TV, 8 Movie packs — see the tracker's category list. */\n  categories?: number[];\n  orderBy?: 'time' | 'size' | 'seeders' | 'snatches';\n  orderWay?: 'asc' | 'desc';\n  /** Cap applied after flattening. The API itself pages at 50 groups. */\n  limit?: number;\n}\n\nexport type HebitsOptions = TransportOptions;\n\nexport class Hebits {\n  readonly #transport: Transport;\n  #userId: number | undefined;\n\n  constructor(options: HebitsOptions) {\n    this.#transport = createTransport(options);\n  }\n\n  async stats(): Promise<AccountStats> {\n    const raw = await this.#transport.json('ajax.php', { action: 'index' });\n    const { response } = parseOrThrow(indexResponseSchema, raw, 'ajax.php?action=index');\n    this.#userId = response.id;\n    const u = response.userstats;\n    return {\n      userId: response.id,\n      uploaded: u.uploaded,\n      downloaded: u.downloaded,\n      ratio: u.ratio,\n      requiredRatio: u.requiredratio,\n      userClass: u.class,\n    };\n  }\n\n  /** The endpoint is user.php?id=N, so an id is needed. Resolves one via stats() when\n   *  not supplied, so the common call takes no arguments. */\n  async dailyDownloads(userId?: number): Promise<{ used: number; limit: number }> {\n    const id = userId ?? this.#userId ?? (await this.stats()).userId;\n    // Freshness-critical: a stale count could let a caller exceed the tracker's daily\n    // download allowance, so this always reads through to the tracker.\n    const html = await this.#transport.text('user.php', { id }, { bypassCache: true });\n    const parsed = parseDailyDownloads(html);\n    if (!parsed) throw new ApiError('could not find the daily download counter on the profile page');\n    return parsed;\n  }\n\n  async checkLogin(): Promise<void> {\n    // Freshness-critical: a cached page could report a dead cookie as valid for up to\n    // `cacheTtlMs`, defeating the point of a health check.\n    const html = await this.#transport.text('', undefined, { bypassCache: true });\n    if (!isLoggedIn(html)) throw new LoginExpiredError('no logout link on the front page — the cookie has expired');\n  }\n\n  async browse(options: BrowseOptions = {}): Promise<HebitsTorrent[]> {\n    const sp: Record<string, string | number> = { action: 'browse', group_results: 0 };\n    const terms = [options.imdb ?? options.query, options.season ? `S${String(options.season).padStart(2, '0')}` : undefined]\n      .filter(Boolean)\n      .join(' ');\n    if (terms) sp['searchstr'] = terms;\n    if (options.freeleechOnly) sp['freetorrent'] = 1;\n    if (options.orderBy) sp['order_by'] = options.orderBy;\n    if (options.orderWay) sp['order_way'] = options.orderWay;\n    for (const c of options.categories ?? []) sp[`filter_cat[${c}]`] = 1;\n\n    const raw = await this.#transport.json('ajax.php', sp);\n    const parsed = parseOrThrow(browseResponseSchema, raw, 'ajax.php?action=browse');\n    const flat = flattenGroups(parsed.response.results);\n    return options.limit === undefined ? flat : flat.slice(0, options.limit);\n  }\n\n  /** The same endpoint as browse; separate because the call sites read differently. */\n  search(options: BrowseOptions): Promise<HebitsTorrent[]> {\n    return this.browse(options);\n  }\n\n  /** Hebits serves an HTML page when it refuses a download, so validate before returning. */\n  async downloadTorrent(id: number): Promise<Uint8Array> {\n    const bytes = await this.#transport.bytes('torrents.php', { action: 'download', id });\n    if (bytes[0] !== 0x64 /* 'd' */) {\n      const head = new TextDecoder().decode(bytes.slice(0, 200)).replace(/\\s+/g, ' ');\n      throw new NotATorrentError(`Hebits refused the download for torrent ${id}: ${head}`);\n    }\n    return bytes;\n  }\n}\n"],"mappings":";AACO,IAAM,cAAN,cAA0B,MAAM;AAAA,EACrC,YAAY,SAAiB,SAA+B;AAC1D,UAAM,SAAS,OAAO;AACtB,SAAK,OAAO,WAAW;AAAA,EACzB;AACF;AAIO,IAAM,oBAAN,cAAgC,YAAY;AAAC;AAG7C,IAAM,mBAAN,cAA+B,YAAY;AAAC;AAI5C,IAAM,WAAN,cAAuB,YAAY;AAAC;AAIpC,IAAM,mBAAN,cAA+B,YAAY;AAAC;;;ACS5C,SAAS,kBAAkB,KAA6C;AAC7E,SAAO,KAAK,MAAM,aAAa,IAAI,CAAC;AACtC;AAYA,SAAS,aAAa,IAAU,UAA0B;AACxD,QAAM,MAAM,IAAI,KAAK,eAAe,SAAS;AAAA,IAC3C;AAAA,IAAU,QAAQ;AAAA,IAClB,MAAM;AAAA,IAAW,OAAO;AAAA,IAAW,KAAK;AAAA,IACxC,MAAM;AAAA,IAAW,QAAQ;AAAA,IAAW,QAAQ;AAAA,EAC9C,CAAC;AACD,QAAM,IAAI,OAAO,YAAY,IAAI,cAAc,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAChF,QAAM,QAAQ,KAAK;AAAA,IACjB,OAAO,EAAE,MAAM,CAAC;AAAA,IAAG,OAAO,EAAE,OAAO,CAAC,IAAI;AAAA,IAAG,OAAO,EAAE,KAAK,CAAC;AAAA,IAC1D,OAAO,EAAE,MAAM,CAAC,IAAI;AAAA,IAAI,OAAO,EAAE,QAAQ,CAAC;AAAA,IAAG,OAAO,EAAE,QAAQ,CAAC;AAAA,EACjE;AACA,SAAO,QAAQ,GAAG,QAAQ;AAC5B;AAkBO,SAAS,gBAAgB,GAAiB;AAC/C,QAAM,QAAQ,KAAK,MAAM,GAAG,EAAE,QAAQ,KAAK,GAAG,CAAC,GAAG;AAClD,MAAI,OAAO,MAAM,KAAK,EAAG,OAAM,IAAI,SAAS,sCAAsC,KAAK,UAAU,CAAC,CAAC,EAAE;AACrG,QAAM,KAAK,aAAa,IAAI,KAAK,KAAK,GAAG,gBAAgB;AACzD,QAAM,KAAK,aAAa,IAAI,KAAK,QAAQ,EAAE,GAAG,gBAAgB;AAC9D,SAAO,IAAI,KAAK,QAAQ,EAAE;AAC5B;AAeO,SAAS,WAAW,GAA4D;AACrF,MAAI,iBAAiB;AACrB,MAAI,EAAE,gBAAiB,kBAAiB;AACxC,MAAI,EAAE,eAAgB,kBAAiB;AACvC,MAAI,EAAE,eAAe,EAAE,oBAAqB,kBAAiB;AAE7D,MAAI,eAAe;AACnB,MAAI,EAAE,WAAY,gBAAe;AACjC,MAAI,EAAE,WAAY,gBAAe;AAEjC,MAAI,EAAE,eAAgB,QAAO,EAAE,gBAAgB,GAAG,cAAc,EAAE;AAClE,SAAO,EAAE,gBAAgB,aAAa;AACxC;AAEO,SAAS,cAAc,QAAqC;AACjE,QAAM,MAAuB,CAAC;AAC9B,aAAW,KAAK,QAAQ;AACtB,UAAM,OAAO,kBAAkB,EAAE,SAAS;AAC1C,eAAW,KAAK,EAAE,UAAU;AAC1B,UAAI,KAAK;AAAA,QACP,IAAI,EAAE;AAAA,QACN,SAAS,EAAE;AAAA,QACX,MAAM,EAAE,WAAW,EAAE;AAAA,QACrB,WAAW,EAAE;AAAA,QACb,YAAY,EAAE;AAAA,QACd;AAAA,QACA,OAAO,EAAE;AAAA,QACT,MAAM,EAAE,QAAQ,CAAC;AAAA,QACjB,MAAM,EAAE;AAAA,QACR,WAAW,EAAE;AAAA,QACb,SAAS,EAAE;AAAA,QACX,UAAU,EAAE;AAAA,QACZ,UAAU,EAAE;AAAA,QACZ,YAAY,gBAAgB,EAAE,IAAI;AAAA,QAClC,YAAY,EAAE;AAAA,QACd,OAAO,EAAE;AAAA,QACT,OAAO,EAAE;AAAA,QACT,WAAW,EAAE;AAAA,QACb,GAAG,WAAW,CAAC;AAAA,QACf,aAAa,EAAE;AAAA,QACf,aAAa,EAAE;AAAA,MACjB,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AACT;;;AC5IA,SAAS,SAAS;AAOX,IAAM,mBAAmB,EAAE,OAAO;AAAA,EACvC,WAAW,EAAE,OAAO;AAAA,EACpB,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACzC,WAAW,EAAE,OAAO;AAAA,EACpB,MAAM,EAAE,OAAO;AAAA,EACf,MAAM,EAAE,OAAO;AAAA,EACf,UAAU,EAAE,OAAO;AAAA,EACnB,SAAS,EAAE,OAAO;AAAA,EAClB,UAAU,EAAE,OAAO;AAAA,EACnB,aAAa,EAAE,QAAQ;AAAA,EACvB,iBAAiB,EAAE,QAAQ;AAAA,EAC3B,gBAAgB,EAAE,QAAQ;AAAA,EAC1B,gBAAgB,EAAE,QAAQ;AAAA,EAC1B,qBAAqB,EAAE,QAAQ;AAAA,EAC/B,YAAY,EAAE,QAAQ;AAAA,EACtB,YAAY,EAAE,QAAQ;AAAA,EACtB,aAAa,EAAE,QAAQ;AAAA,EACvB,aAAa,EAAE,QAAQ;AACzB,CAAC;AAGM,IAAM,iBAAiB,EAAE,OAAO;AAAA,EACrC,SAAS,EAAE,OAAO;AAAA,EAClB,WAAW,EAAE,OAAO;AAAA,EACpB,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,YAAY,EAAE,OAAO;AAAA,EACrB,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACnC,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,UAAU,EAAE,MAAM,gBAAgB;AACpC,CAAC;AAEM,IAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,QAAQ,EAAE,QAAQ,SAAS;AAAA,EAC3B,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,EAAE,CAAC;AACzD,CAAC;AAEM,IAAM,qBAAqB,EAAE,OAAO;AAAA,EACzC,UAAU,EAAE,OAAO;AAAA,EACnB,YAAY,EAAE,OAAO;AAAA,EACrB,OAAO,EAAE,OAAO;AAAA,EAChB,eAAe,EAAE,OAAO;AAAA,EACxB,OAAO,EAAE,OAAO;AAClB,CAAC;AAEM,IAAM,sBAAsB,EAAE,OAAO;AAAA,EAC1C,QAAQ,EAAE,QAAQ,SAAS;AAAA,EAC3B,UAAU,EAAE,OAAO;AAAA,IACjB,IAAI,EAAE,OAAO;AAAA,IACb,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,IAC9B,WAAW;AAAA,EACb,CAAC;AACH,CAAC;AASM,SAAS,aAAqC,QAAW,MAAe,UAA8B;AAC3G,QAAM,SAAS,OAAO,UAAU,IAAI;AACpC,MAAI,OAAO,QAAS,QAAO,OAAO;AAClC,QAAM,QAAQ,OAAO,MAAM,OACxB,MAAM,GAAG,CAAC,EACV,IAAI,CAAC,MAAM,GAAG,EAAE,KAAK,KAAK,GAAG,KAAK,QAAQ,KAAK,EAAE,OAAO,EAAE,EAC1D,KAAK,IAAI;AACZ,QAAM,IAAI,SAAS,GAAG,QAAQ,qDAAgD,KAAK,EAAE;AACvF;;;AChFO,SAAS,oBAAoB,MAAsD;AACxF,QAAM,OAAO,KAAK,QAAQ,YAAY,GAAG;AACzC,QAAM,IAAI,KAAK,MAAM,qCAAqC;AAC1D,MAAI,CAAC,EAAG,QAAO;AACf,SAAO,EAAE,MAAM,OAAO,EAAE,CAAC,CAAC,GAAG,OAAO,OAAO,EAAE,CAAC,CAAC,EAAE;AACnD;AAIO,SAAS,WAAW,MAAuB;AAChD,SAAO,qBAAqB,KAAK,IAAI;AACvC;;;ACfA,OAAO,MAAM,iBAAkC;AAC/C,OAAO,eAAe;AAmCtB,IAAM,UAAU;AAChB,IAAM,gBAAgB,CAAC,yBAAyB,wBAAwB;AACxE,IAAM,mBAAmB,oBAAI,IAAI,CAAC,KAAK,KAAK,KAAK,KAAK,GAAG,CAAC;AAG1D,IAAM,cAAc;AAKpB,SAAS,mBAAmB,KAAa,MAAoB;AAC3D,QAAM,QAAQ,MAAM;AAClB,QAAI;AACF,aAAO,IAAI,IAAI,GAAG,EAAE;AAAA,IACtB,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF,GAAG;AACH,MAAI,KAAK,SAAS,WAAW,KAAK,cAAc,KAAK,CAAC,OAAO,GAAG,KAAK,IAAI,CAAC,GAAG;AAC3E,UAAM,IAAI,kBAAkB,8DAAyD;AAAA,EACvF;AACF;AAIA,SAAS,MAAM,MAAmC;AAChD,SAAO,OAAO,SAAS,WAAW,OAAO,IAAI,YAAY,EAAE,OAAO,KAAK,MAAM,GAAG,WAAW,CAAC;AAC9F;AAEO,SAAS,gBAAgB,MAAmC;AACjE,QAAM;AAAA,IACJ;AAAA,IACA,UAAU;AAAA,IACV,YAAY,iBAAiB,OAAO;AAAA,IACpC,YAAY,EAAE,OAAO,GAAG,UAAU,IAAK;AAAA,IACvC,aAAa,KAAK,KAAK;AAAA,IACvB,kBAAkB;AAAA,IAClB,QAAQ;AAAA,IACR,YAAY;AAAA,EACd,IAAI;AAEJ,QAAM,SAAqB,GAAG,OAAO;AAAA,IACnC;AAAA,IACA,SAAS;AAAA,IACT,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA,IAKV,OAAO;AAAA,IACP,SAAS,EAAE,QAAQ,cAAc,UAAU;AAAA,EAC7C,CAAC;AAKD,QAAM,mBAAmB,UAAU,SAAS;AAAA,IAC1C,OAAO,MAAc,IAAiD,iBAAmC;AACvG,YAAM,MAAM,MAAM,OAAO,IAAI,MAAM,KAAK,EAAE,cAAc,GAAG,IAAI,MAAS;AACxE,YAAM,OAAO,iBAAiB,SAAS,MAAM,IAAI,KAAK,IAAI,IAAI,WAAW,MAAM,IAAI,YAAY,CAAC;AAChG,aAAO,EAAE,KAAK,KAAK;AAAA,IACrB;AAAA,EACF;AAcA,iBAAe,QACb,MACA,IACA,cACA,cAAsB,OACQ;AAC9B,QAAI;AACF,YAAM,EAAE,KAAK,KAAK,IAAI,MAAM,iBAAiB,MAAM,IAAI,YAAY;AACnE,yBAAmB,IAAI,KAAK,MAAM,IAAI,CAAC;AACvC,aAAO;AAAA,IACT,SAAS,GAAG;AACV,UAAI,aAAa,WAAW;AAC1B,cAAM,EAAE,QAAQ,QAAQ,IAAI,EAAE;AAC9B,YAAI,WAAW,IAAK,OAAM,IAAI,iBAAiB,gCAAgC,EAAE,OAAO,EAAE,CAAC;AAC3F,YAAI,UAAU,OAAO,SAAS,OAAO,aAAa,KAAK,QAAQ,IAAI,UAAU,KAAK,EAAE,GAAG;AACrF,gBAAM,IAAI,kBAAkB,4DAAuD,EAAE,OAAO,EAAE,CAAC;AAAA,QACjG;AACA,YAAI,iBAAiB,IAAI,MAAM,KAAK,cAAc,GAAG;AACnD,iBAAO,QAAQ,MAAM,IAAI,cAAwB,cAAc,CAAC;AAAA,QAClE;AACA,cAAM,IAAI,SAAS,wBAAwB,MAAM,QAAQ,IAAI,IAAI,EAAE,OAAO,EAAE,CAAC;AAAA,MAC/E;AACA,YAAM;AAAA,IACR;AAAA,EACF;AAKA,QAAM,QAAQ,oBAAI,IAA0C;AAC5D,QAAM,UAAU,oBAAI,IAA6B;AAEjD,WAAS,aAAmB;AAC1B,QAAI,aAAa,GAAG;AAClB,YAAM,MAAM,KAAK,IAAI;AACrB,iBAAW,CAAC,GAAG,CAAC,KAAK,OAAO;AAC1B,YAAI,MAAM,EAAE,MAAM,WAAY,OAAM,OAAO,CAAC;AAAA,MAC9C;AAAA,IACF;AACA,WAAO,MAAM,OAAO,iBAAiB;AACnC,YAAM,SAAS,MAAM,KAAK,EAAE,KAAK,EAAE;AACnC,UAAI,WAAW,OAAW;AAC1B,YAAM,OAAO,MAAM;AAAA,IACrB;AAAA,EACF;AAEA,WAAS,SAAS,KAAiC;AACjD,UAAM,MAAM,MAAM,IAAI,GAAG;AACzB,QAAI,CAAC,OAAO,KAAK,IAAI,IAAI,IAAI,MAAM,WAAY,QAAO;AACtD,UAAM,OAAO,GAAG;AAChB,UAAM,IAAI,KAAK,GAAG;AAClB,WAAO,IAAI;AAAA,EACb;AAEA,WAAS,SAAS,KAAa,MAAoB;AACjD,UAAM,OAAO,GAAG;AAChB,UAAM,IAAI,KAAK,EAAE,IAAI,KAAK,IAAI,GAAG,KAAK,CAAC;AACvC,eAAW;AAAA,EACb;AAEA,iBAAe,UACb,MACA,IACAA,OACiB;AACjB,UAAM,MAAM,GAAG,IAAI,IAAI,IAAI,gBAAgB,OAAO,QAAQ,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC;AAC/G,QAAI,aAAa,KAAK,CAACA,OAAM,aAAa;AACxC,YAAM,MAAM,SAAS,GAAG;AACxB,UAAI,QAAQ,OAAW,QAAO;AAAA,IAChC;AACA,UAAM,WAAW,QAAQ,IAAI,GAAG;AAChC,QAAI,SAAU,QAAO;AAIrB,UAAM,MAAM,QAAQ,MAAM,IAAI,MAAM,EAAE;AAAA,MACpC,CAAC,SAAS;AACR,YAAI,aAAa,EAAG,UAAS,KAAK,IAAI;AACtC,gBAAQ,OAAO,GAAG;AAClB,eAAO;AAAA,MACT;AAAA,MACA,CAAC,QAAQ;AACP,gBAAQ,OAAO,GAAG;AAClB,cAAM;AAAA,MACR;AAAA,IACF;AACA,YAAQ,IAAI,KAAK,GAAG;AACpB,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,MAAM,KAAK,MAAM,IAAIA,OAAM;AACzB,YAAM,OAAO,MAAM,UAAU,MAAM,IAAIA,KAAI;AAC3C,UAAI;AACF,eAAO,KAAK,MAAM,IAAI;AAAA,MACxB,SAAS,GAAG;AACV,cAAM,IAAI,SAAS,GAAG,IAAI,wBAAwB,EAAE,OAAO,EAAE,CAAC;AAAA,MAChE;AAAA,IACF;AAAA,IACA,MAAM,CAAC,MAAM,IAAIA,UAAS,UAAU,MAAM,IAAIA,KAAI;AAAA,IAClD,MAAM,MAAM,MAAM,IAAI;AAMpB,aAAO,QAAQ,MAAM,IAAI,OAAO;AAAA,IAClC;AAAA,EACF;AACF;;;AC1LO,IAAM,SAAN,MAAa;AAAA,EACT;AAAA,EACT;AAAA,EAEA,YAAY,SAAwB;AAClC,SAAK,aAAa,gBAAgB,OAAO;AAAA,EAC3C;AAAA,EAEA,MAAM,QAA+B;AACnC,UAAM,MAAM,MAAM,KAAK,WAAW,KAAK,YAAY,EAAE,QAAQ,QAAQ,CAAC;AACtE,UAAM,EAAE,SAAS,IAAI,aAAa,qBAAqB,KAAK,uBAAuB;AACnF,SAAK,UAAU,SAAS;AACxB,UAAM,IAAI,SAAS;AACnB,WAAO;AAAA,MACL,QAAQ,SAAS;AAAA,MACjB,UAAU,EAAE;AAAA,MACZ,YAAY,EAAE;AAAA,MACd,OAAO,EAAE;AAAA,MACT,eAAe,EAAE;AAAA,MACjB,WAAW,EAAE;AAAA,IACf;AAAA,EACF;AAAA;AAAA;AAAA,EAIA,MAAM,eAAe,QAA2D;AAC9E,UAAM,KAAK,UAAU,KAAK,YAAY,MAAM,KAAK,MAAM,GAAG;AAG1D,UAAM,OAAO,MAAM,KAAK,WAAW,KAAK,YAAY,EAAE,GAAG,GAAG,EAAE,aAAa,KAAK,CAAC;AACjF,UAAM,SAAS,oBAAoB,IAAI;AACvC,QAAI,CAAC,OAAQ,OAAM,IAAI,SAAS,+DAA+D;AAC/F,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,aAA4B;AAGhC,UAAM,OAAO,MAAM,KAAK,WAAW,KAAK,IAAI,QAAW,EAAE,aAAa,KAAK,CAAC;AAC5E,QAAI,CAAC,WAAW,IAAI,EAAG,OAAM,IAAI,kBAAkB,gEAA2D;AAAA,EAChH;AAAA,EAEA,MAAM,OAAO,UAAyB,CAAC,GAA6B;AAClE,UAAM,KAAsC,EAAE,QAAQ,UAAU,eAAe,EAAE;AACjF,UAAM,QAAQ,CAAC,QAAQ,QAAQ,QAAQ,OAAO,QAAQ,SAAS,IAAI,OAAO,QAAQ,MAAM,EAAE,SAAS,GAAG,GAAG,CAAC,KAAK,MAAS,EACrH,OAAO,OAAO,EACd,KAAK,GAAG;AACX,QAAI,MAAO,IAAG,WAAW,IAAI;AAC7B,QAAI,QAAQ,cAAe,IAAG,aAAa,IAAI;AAC/C,QAAI,QAAQ,QAAS,IAAG,UAAU,IAAI,QAAQ;AAC9C,QAAI,QAAQ,SAAU,IAAG,WAAW,IAAI,QAAQ;AAChD,eAAW,KAAK,QAAQ,cAAc,CAAC,EAAG,IAAG,cAAc,CAAC,GAAG,IAAI;AAEnE,UAAM,MAAM,MAAM,KAAK,WAAW,KAAK,YAAY,EAAE;AACrD,UAAM,SAAS,aAAa,sBAAsB,KAAK,wBAAwB;AAC/E,UAAM,OAAO,cAAc,OAAO,SAAS,OAAO;AAClD,WAAO,QAAQ,UAAU,SAAY,OAAO,KAAK,MAAM,GAAG,QAAQ,KAAK;AAAA,EACzE;AAAA;AAAA,EAGA,OAAO,SAAkD;AACvD,WAAO,KAAK,OAAO,OAAO;AAAA,EAC5B;AAAA;AAAA,EAGA,MAAM,gBAAgB,IAAiC;AACrD,UAAM,QAAQ,MAAM,KAAK,WAAW,MAAM,gBAAgB,EAAE,QAAQ,YAAY,GAAG,CAAC;AACpF,QAAI,MAAM,CAAC,MAAM,KAAgB;AAC/B,YAAM,OAAO,IAAI,YAAY,EAAE,OAAO,MAAM,MAAM,GAAG,GAAG,CAAC,EAAE,QAAQ,QAAQ,GAAG;AAC9E,YAAM,IAAI,iBAAiB,2CAA2C,EAAE,KAAK,IAAI,EAAE;AAAA,IACrF;AACA,WAAO;AAAA,EACT;AACF;","names":["opts"]}

package/package.json

@@ -0,0 +1,30 @@
+{
+  "name": "hebits-client",
+  "version": "0.1.0",
+  "description": "A client for the Hebits private tracker's JSON API.",
+  "license": "MIT",
+  "type": "module",
+  "repository": { "type": "git", "url": "git+https://github.com/lacherogwu/hebits-client.git" },
+  "keywords": ["hebits", "gazelle", "torrent", "tracker", "api-client"],
+  "author": "Asaf (lacherogwu)",
+  "exports": { ".": { "types": "./dist/index.d.ts", "default": "./dist/index.js" } },
+  "files": ["dist"],
+  "engines": { "node": ">=22" },
+  "scripts": {
+    "build": "tsup",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "prepublishOnly": "npm run typecheck && npm test && npm run build"
+  },
+  "dependencies": {
+    "ky": "^2.1.0",
+    "p-throttle": "^8.1.1",
+    "zod": "^4.6.5"
+  },
+  "devDependencies": {
+    "msw": "^2.15.0",
+    "tsup": "^8.5.1",
+    "typescript": "^5.9.3",
+    "vitest": "^5.0.1"
+  }
+}