tenderkit 0.1.0__py3-none-any.whl

tenderkit/platforms/public_documents.py

@@ -0,0 +1,206 @@
+"""Public attachments on e-ProPublico, LogIntrade and eB2B."""
+import hashlib
+import json
+import ntpath
+from pathlib import Path
+import re
+import tempfile
+from urllib.parse import unquote, urljoin, urlsplit
+
+from tenderkit.limits import MAX_BYTES, MAX_LISTED
+from tenderkit.model import DocumentRef, PlatformLink
+from tenderkit.platforms.backends import FetchError
+from tenderkit.platforms.base import extension
+from tenderkit.platforms.html import Tree
+from tenderkit.platforms.session import eb2b_file_redirect, tenant_url
+
+UUID = r'[a-fA-F0-9]{8}(?:-[a-fA-F0-9]{4}){3}-[a-fA-F0-9]{12}'
+INTEGER_ID = r'[1-9][0-9]*'
+
+
+class PublicDocuments:
+    def __init__(self, session):
+        self.session = session
+
+    def matches(self, url):
+        return tenant_url(url, self.domain)
+
+    def procedure(self, notice):
+        url = notice.platform_url or ''
+        if not self.matches(url):
+            return None
+        match = self.procedure_path.fullmatch(unquote(urlsplit(url).path).rstrip('/'))
+        if match is None:
+            raise FetchError('NO_REFERENCE')
+        return PlatformLink(self.name, urljoin(url, match[0]), match[1])
+
+    def _base(self, link):
+        if link.platform != self.name or not self.matches(link.url):
+            raise FetchError('UNSAFE_URL')
+        return 'https://' + urlsplit(link.url).hostname
+
+    def _reference(self, page, href, name, **kwargs):
+        url = urljoin(page, href)
+        parts = urlsplit(url)
+        match = self.file_path.fullmatch(unquote(parts.path))
+        if (not self.matches(url) or parts.hostname != urlsplit(page).hostname
+                or parts.query or parts.fragment or not match):
+            raise FetchError('UNSAFE_URL')
+        if not name:
+            raise FetchError('DOWNLOAD_REJECTED')
+        return DocumentRef(name=name, url=url, key=match[1], **kwargs)
+
+    def download(self, ref, to):
+        self_ref = self._reference(ref.url, ref.url, ref.name)
+        if self_ref.key != ref.key:
+            raise FetchError('UNSAFE_URL')
+        response = self.session.get(ref.url, stream=True, timeout=60,
+                                    headers={'Accept': 'application/octet-stream, */*'})
+        size = 0
+        digest = hashlib.sha256()
+        temporary = None
+        try:
+            if response.status_code >= 400:
+                raise FetchError(f'HTTP_{response.status_code}')
+            if response.url and response.url != ref.url and not eb2b_file_redirect(ref.url, response.url):
+                raise FetchError('UNSAFE_URL')
+            media = response.headers.get('Content-Type', '').split(';')[0].strip().lower()
+            if media in ('text/html', 'application/json'):
+                raise FetchError('DOWNLOAD_REJECTED')
+            with tempfile.NamedTemporaryFile(dir=to, suffix='.tmp', delete=False) as stream:
+                temporary = Path(stream.name)
+                for block in response.iter_content(1 << 16):
+                    if not size and block.removeprefix(b'\xef\xbb\xbf').lstrip().lower().startswith(
+                            (b'<!doctype html', b'<html', b'<head', b'<body')):
+                        raise FetchError('DOWNLOAD_REJECTED')
+                    size += len(block)
+                    if size > MAX_BYTES:
+                        raise FetchError('TOO_LARGE')
+                    digest.update(block)
+                    stream.write(block)
+            if not size:
+                raise FetchError('DOWNLOAD_REJECTED')
+            suffix = extension(dict(url='', name=ref.name, ext=ref.ext))
+            target = Path(to) / f'{digest.hexdigest()}.{suffix}'
+            temporary.replace(target)
+            return target
+        finally:
+            response.close()
+            if temporary is not None:
+                temporary.unlink(missing_ok=True)
+
+
+class EProPublico(PublicDocuments):
+    name = 'e-ProPublico'
+    domain = 'e-propublico.pl'
+    procedure_path = re.compile(fr'/Ogloszenia/Details/({UUID})', re.I)
+    file_path = re.compile(fr'/Dokumenty/Download/({UUID})', re.I)
+
+    def documents(self, link):
+        base = self._base(link)
+        match = self.procedure_path.fullmatch(unquote(urlsplit(link.url).path))
+        if not match or match[1] != link.key:
+            raise FetchError('NO_REFERENCE')
+        response = self.session.get(base + '/Ogloszenia/DokumentyZamowienia',
+                                    params={'przetargId': link.key}, timeout=30,
+                                    headers={'Accept': 'text/html'})
+        root = Tree(response.text).root
+        if not root.find('h5', attr='class', value='section-header'):
+            raise FetchError('NOT_FOUND')
+        result = []
+        for row in root.find_all('tr'):
+            anchor = row.find('a', attr='href', value=lambda href: '/dokumenty/download/' in href.lower())
+            if anchor:
+                cells = row.find_all('td', direct=True)
+                result.append(self._reference(base, anchor.attrs['href'], anchor.text(' '),
+                    ext=cells[2].text() if len(cells) > 2 else None,
+                    published=cells[4].text() if len(cells) > 4 else None))
+        return result
+
+
+class LogIntrade(PublicDocuments):
+    name = 'LogIntrade'
+    domain = 'logintrade.net'
+    procedure_path = re.compile(fr'/zapytania_email,({INTEGER_ID}),[a-zA-Z0-9_-]+\.html')
+    file_path = re.compile(r'/DocumentService,getAttachmentUnlogged,([a-zA-Z0-9_+=/-]+)\.html')
+
+    def documents(self, link):
+        self._base(link)
+        match = self.procedure_path.fullmatch(unquote(urlsplit(link.url).path))
+        if not match or match[1] != link.key:
+            raise FetchError('NO_REFERENCE')
+        root = Tree(self.session.get(link.url, timeout=30, headers={'Accept': 'text/html'}).text).root
+        attachments = root.find(attr='class', value='attachments')
+        if attachments is None:
+            raise FetchError('NOT_FOUND')
+        result = []
+        for row in attachments.find_all(attr='class', value='attachment'):
+            anchor = row.find('a', attr='href', value=lambda href: 'getAttachmentUnlogged' in href)
+            name = row.find(attr='class', value='attachment-name')
+            published = row.find(attr='class', value='attachment-date')
+            if anchor and name:
+                result.append(self._reference(link.url, anchor.attrs['href'], name.text(' '),
+                                              published=published.text() if published else None))
+        return result
+
+
+class Eb2b(PublicDocuments):
+    name = 'eB2B'
+    domain = 'eb2b.com.pl'
+    procedure_path = re.compile(fr'/(?:open-preview-auction|preview-auction|auction)\.html/({INTEGER_ID})(?:/[^/]+)?')
+    file_path = re.compile(fr'/auction/auction/download-attachment/id/({INTEGER_ID})')
+
+    def _data(self, base, route, params):
+        payload = self.session.get(base + '/auction/auction/' + route, params=params, timeout=30).json()
+        if not isinstance(payload, dict) or payload.get('success') is not True:
+            raise FetchError('NOT_FOUND')
+        rows = payload.get('data')
+        if not isinstance(rows, list) or any(not isinstance(row, dict) for row in rows):
+            raise FetchError('NOT_FOUND')
+        return rows
+
+    def procedure(self, notice):
+        url = notice.platform_url or ''
+        if not self.matches(url):
+            return None
+        match = self.procedure_path.fullmatch(urlsplit(url).path.rstrip('/'))
+        if match:
+            return PlatformLink(self.name, url.split('?', 1)[0].split('#', 1)[0].rstrip('/'), match[1])
+        if not notice.reference:
+            raise FetchError('NO_REFERENCE')
+        base = 'https://' + urlsplit(url).hostname
+        query = json.dumps([dict(property='auction_number', value=notice.reference)])
+        rows = self._data(base, 'list', dict(filter=query, page=1, start=0, limit=25))
+        matched = [str(row.get('id')) for row in rows if row.get('auction_number') == notice.reference]
+        if len(rows) >= 25 or len(matched) != 1 or not re.fullmatch(INTEGER_ID, matched[0]):
+            raise FetchError('NOT_FOUND')
+        key = matched[0]
+        return PlatformLink(self.name, f'{base}/open-preview-auction.html/{key}', key)
+
+    def documents(self, link):
+        base = self._base(link)
+        match = self.procedure_path.fullmatch(urlsplit(link.url).path)
+        if not match or match[1] != link.key:
+            raise FetchError('NO_REFERENCE')
+        result, seen = [], set()
+        limit = 100
+        for offset in range(0, MAX_LISTED + 1, limit):
+            rows = self._data(base, 'list-attachment', dict(id=link.key, leave_date='', deleted=0,
+                              bidder=0, page=offset // limit + 1, start=offset, limit=limit))
+            if len(rows) > limit:
+                raise FetchError('TOO_MANY_DOCUMENTS')
+            for row in rows:
+                key = str(row.get('id'))
+                if not re.fullmatch(INTEGER_ID, key) or key in seen:
+                    raise FetchError('DOWNLOAD_REJECTED')
+                seen.add(key)
+                if len(seen) > MAX_LISTED:
+                    raise FetchError('TOO_MANY_DOCUMENTS')
+                if (row.get('is_public') is True and row.get('is_active') is True
+                        and row.get('is_current') is True and row.get('contractor_id') is None):
+                    result.append(self._reference(base, f'/auction/auction/download-attachment/id/{key}',
+                                  ntpath.basename(row.get('name') or ''), ext=row.get('extension'),
+                                  published=row.get('publication_date'), origin=row.get('type_name')))
+            if len(rows) < limit:
+                return result
+        raise FetchError('TOO_MANY_DOCUMENTS')

tenderkit/platforms/pz_html.py

@@ -0,0 +1,127 @@
+"""platformazakupowa.pl public HTML: attachments, messages and offer folders."""
+import re
+from urllib.parse import urljoin
+
+from tenderkit.platforms.html import Tree
+
+BASE_URL = 'https://platformazakupowa.pl'
+RATE_LIMIT_MARKER = 'Wykryto nietypowy ruch'
+PROCEEDING_STATUSES = ('active', 'ended', 'canceled', 'closed')
+
+
+def resolve_transaction_url(org_slug, reference_number, session):
+    for status in PROCEEDING_STATUSES:
+        response = session.get(f'{BASE_URL}/pn/{org_slug}/proceedings/ajax',
+            params=dict(status=status, page=1, query=reference_number, **{'sort-field': 'endsAt', 'sort-type': 'DESC'}), timeout=30)
+        response.raise_for_status()
+        auctions = response.json().get('auctions') or []
+        if len(auctions) == 1:
+            return f"{BASE_URL}/transakcja/{auctions[0]['id']}"
+        if len(auctions) > 1:
+            raise LookupError('Ambiguous procedure reference')
+    raise LookupError('Procedure not found')
+
+
+def parse_attachments(html):
+    table = Tree(html).root.find('table', attr='class', value='all-attachments-table')
+    if table is None:
+        return []
+    body = table.find('tbody') or table
+    documents = []
+    for row in body.find_all('tr'):
+        cells = row.find_all('td')
+        link = row.find('a', attr='class', value='proceeding-file-download')
+        if len(cells) < 6 or link is None or not link.attrs.get('href'):
+            continue
+        documents.append(dict(name=cells[0].text(), extension=cells[1].text(), sizeKb=cells[2].text(),
+            publishedDate=cells[3].text(' '), source=cells[4].text(), downloadUrl=urljoin(BASE_URL, link.attrs['href'])))
+    return documents
+
+
+def parse_offers(html):
+    root = Tree(html).root
+    offers = []
+    for head in root.find_all(attr='id', value=lambda v: v.startswith('offer-attachment-accordion-heading-')):
+        offer_id = head.attrs['id'].rsplit('-', 1)[-1]
+        text = re.sub(r'\s+', ' ', head.text(' '))
+        name = re.search(r'Nazwa firmy:\s*(.*?)\s*NIP:', text)
+        submitted = re.search(r'Data z[łl]o[żz]enia oferty:\s*([\d-]+ [\d:]+)', text)
+        body = root.find(attr='id', value='offer-attachment-accordion-collapse-' + offer_id)
+        files = []
+        for row in body.find_all('tr') if body else []:
+            link = row.find('a', attr='href', value=lambda v: 'get_new' in v)
+            cells = row.find_all('td')
+            if link is not None and cells:
+                files.append(dict(name=cells[0].text(), sizeKb=cells[2].text() if len(cells)>2 else None,
+                                  downloadUrl=urljoin(BASE_URL, link.attrs['href'])))
+        offers.append(dict(id=offer_id, name=(name[1].strip(' -') or None) if name else None,
+                           submitted=submitted[1] if submitted else None, files=files))
+    return offers
+
+
+def parse_messages(html):
+    table = Tree(html).root.find(attr='id', value='comments_info')
+    messages = {}
+    for row in table.find_all('tr') if table else []:
+        cells = row.find_all('td', direct=True)
+        stamp = re.search(r'(\d{4}-\d{2}-\d{2})\s+(\d{2}:\d{2}:\d{2})', cells[0].text(' ')) if cells else None
+        if stamp and len(cells) >= 3:
+            messages[f'{stamp[1]} {stamp[2]}'] = re.sub(r'\s+', ' ', cells[2].text(' ')).strip()[:500]
+    return messages
+
+OPENING = re.compile(r'zestawienie\s+(z[łl]o[żz]onych\s+|otwartych\s+)?ofert|z\s+otwarcia\s+ofert|protok[oó][łl]\s+z\s+otwarcia|informacja\s+z\s+otwarcia|informacja\s+o\s+z[łl]o[żz]onych\s+ofert|art\.?\s*222\s*(ust\.?\s*)?5|art\.?\s*222_5', re.I)
+
+RESULT = re.compile(r'wyb[oó]r|wybor|wynik|uniewa[żz]ni|rozstrzygni|najkorzystniejsz', re.I)
+
+NEEDED = re.compile(r'otwarci|zestawieni', re.I)
+
+CHECK = re.compile(r'formularz|cenow|ofert|kwot|zestawien|wykonawc|cen[ay]\b', re.I)
+
+OFFER_FILE = re.compile(r'\.(zip|7z|rar|pdf|xlsx?|docx?|ods|odt)$', re.I)
+
+NOT_OFFER = re.compile(r'swz|specyfikacj|ogłosz|ogloszen|wyjaśni|wyjasni|pytan|odpowied|modyfikac|zmian|umow|kwot|unieważn|protok', re.I)
+
+ATTACHED = 'Publiczna Sesja Otwarcia Ofert - Oferta z załącznika '
+
+ARCHIVE = re.compile(r'\.(zip|7z|rar)$', re.I)
+
+def is_opening(name, text=None):
+    return not ARCHIVE.search(name) and bool(OPENING.search(name if text is None else text))
+
+def attached_offers(documents):
+    """Mark attachments that are offers when the offers section has no files: published at or after the first
+    opening summary, not a letter, notice or SWZ. Each becomes an anonymous offer, identified later by its amounts."""
+    if any(d.get('offerId') for d in documents):
+        return
+    opened = min((d['publishedDate'] or '' for d in documents if d['folder'] == 'Informacja z otwarcia ofert'), default=None)
+    if not opened:
+        return
+    for i, d in enumerate(documents, 1):
+        if (d['folder'] is None and (d['publishedDate'] or '') >= opened and OFFER_FILE.search(d['name'])
+                and not NOT_OFFER.search(d['name']) and not RESULT.search(d['name']) and not RESULT.search(d.get('message') or '')):
+            d['folder'] = ATTACHED + str(i)
+            d['attachedOffer'] = True
+
+def documents_from_page(html):
+    """Every public document of a transaction page, classified as in the manifest: the attachments table (the opening
+    summary gets the folder 'Informacja z otwarcia ofert'), the files of each offer ('Publiczna Sesja Otwarcia Ofert -
+    <firma>'; the platform hides the name of most) and, when the offers section has no files, the attachments published
+    with the opening summary. Also used by the download queue (tools/fetch_worker.py)."""
+    documents = [dict(name=a['name'] if a['name'].lower().endswith('.'+a['extension'].lower()) else f"{a['name']}.{a['extension']}",
+                      folder='Informacja z otwarcia ofert' if is_opening(a['name']) else None,
+                      publishedDate=a['publishedDate'], sizeText=a['sizeKb']+' KB', downloadUrl=a['downloadUrl'], kind=a['source'])
+                 for a in parse_attachments(html)]
+    # An attachment shares its publication time with the message it came with.
+    messages = parse_messages(html)
+    for d in documents:
+        message = messages.get(re.sub(r'\s+', ' ', d['publishedDate'] or '').strip())
+        if message:
+            d['message'] = message
+            if d['folder'] is None and is_opening(d['name'], message) and not RESULT.search(message):
+                d['folder'] = 'Informacja z otwarcia ofert'
+    for offer in parse_offers(html):
+        folder = f"Publiczna Sesja Otwarcia Ofert - {offer['name'] or 'Oferta '+offer['id']}"
+        documents += [dict(name=f['name'], folder=folder, publishedDate=offer['submitted'], sizeText=f"{f['sizeKb']} KB",
+                           downloadUrl=f['downloadUrl'], offerId=offer['id'], hiddenName=offer['name'] is None) for f in offer['files']]
+    attached_offers(documents)
+    return documents

tenderkit/platforms/session.py

@@ -0,0 +1,114 @@
+"""Cookie-preserving, paced public platform HTTP; redirects stay on platform hosts."""
+from http.cookiejar import CookieJar
+import time
+import re
+from urllib.parse import urlsplit, parse_qs
+from urllib.request import build_opener, HTTPCookieProcessor, HTTPRedirectHandler
+
+from tenderkit.http import Session
+from tenderkit.platforms.backends import FetchError
+
+BK_HOST = 'bazakonkurencyjnosci.funduszeeuropejskie.gov.pl'
+DOMAINS = ('platformazakupowa.pl', 'ezamawiajacy.pl', 'ezamowienia.gov.pl')
+DOCUMENT_DOMAINS = ('e-propublico.pl', 'logintrade.net', 'eb2b.com.pl')
+
+
+def tenant_url(url, domain):
+    try:
+        parts = urlsplit(url)
+        host = parts.hostname or ''
+        return (parts.scheme == 'https' and parts.username is None and parts.port in (None, 443)
+                and (host == domain or host.endswith('.' + domain)))
+    except ValueError:
+        return False
+
+
+def eb2b_file_redirect(source, target):
+    if not tenant_url(source, 'eb2b.com.pl') or not tenant_url(target, 's3.eu-central-1.amazonaws.com'):
+        return False
+    original, destination = urlsplit(source), urlsplit(target)
+    return (re.fullmatch(r'/auction/auction/download-attachment/id/[1-9][0-9]*', original.path) is not None
+            and destination.hostname == 'eb2b-platforma.s3.eu-central-1.amazonaws.com'
+            and bool(parse_qs(destination.query).get('X-Amz-Signature')))
+
+
+def bk_platform_url(url):
+    try:
+        parts = urlsplit(url)
+        return (parts.scheme == 'https' and parts.hostname == BK_HOST
+                and parts.username is None and parts.port in (None, 443))
+    except ValueError:
+        return False
+
+
+def native_platform_url(url):
+    try:
+        parts = urlsplit(url)
+        return (parts.scheme == 'https' and parts.hostname == 'ezamowienia.gov.pl'
+                and parts.username is None and parts.port in (None, 443))
+    except ValueError:
+        return False
+
+
+def public_platform_url(url):
+    if bk_platform_url(url):
+        return True
+    if any(tenant_url(url, domain) for domain in DOCUMENT_DOMAINS):
+        return True
+    try:
+        parts = urlsplit(url)
+        host = (parts.hostname or '').lower()
+        return (parts.scheme in ('http', 'https') and not parts.username and not parts.password
+                and parts.port in (None, 80, 443)
+                and any(host == domain or host.endswith('.' + domain) for domain in DOMAINS))
+    except ValueError:
+        return False
+
+
+class PlatformRedirect(HTTPRedirectHandler):
+    def redirect_request(self, request, response, code, message, headers, newurl):
+        source = request.full_url
+        if eb2b_file_redirect(source, newurl):
+            return super().redirect_request(request, response, code, message, headers, newurl)
+        if urlsplit(source).hostname == 'eb2b-platforma.s3.eu-central-1.amazonaws.com':
+            raise FetchError('UNSAFE_URL')
+        for domain in DOCUMENT_DOMAINS:
+            if tenant_url(source, domain) and (not tenant_url(newurl, domain)
+                    or urlsplit(source).hostname != urlsplit(newurl).hostname):
+                raise FetchError('UNSAFE_URL')
+        if bk_platform_url(request.full_url) and not bk_platform_url(newurl):
+            raise FetchError('UNSAFE_URL')
+        if urlsplit(request.full_url).hostname == 'ezamowienia.gov.pl' and not native_platform_url(newurl):
+            raise FetchError('UNSAFE_URL')
+        if not public_platform_url(newurl):
+            target = urlsplit(newurl)
+            query = parse_qs(target.query)
+            callback = query.get('redirect_uri', [''])[0]
+            anonymous_probe = (
+                request.get_method() == 'GET' and urlsplit(request.full_url).hostname in ('platformazakupowa.pl', 'www.platformazakupowa.pl')
+                and target.scheme == 'https' and target.hostname == 'accounts.opennexus.com'
+                and not target.username and target.port in (None, 443)
+                and target.path == '/sso/v1/oauth/authorize' and query.get('prompt') == ['none']
+                and public_platform_url(callback) and urlsplit(callback).hostname in ('platformazakupowa.pl', 'www.platformazakupowa.pl'))
+            if not anonymous_probe:
+                raise FetchError('UNSAFE_URL')
+        return super().redirect_request(request, response, code, message, headers, newurl)
+
+
+class PlatformSession(Session):
+    def __init__(self, delay=2.1, sleep=time.sleep):
+        super().__init__(build_opener(HTTPCookieProcessor(CookieJar()), PlatformRedirect()))
+        self.delay, self.sleep = delay, sleep
+
+    def request(self, method, url, **kwargs):
+        if not public_platform_url(url):
+            raise FetchError('UNSAFE_URL')
+        self.sleep(self.delay)
+        response = super().request(method, url, **kwargs)
+        if response.url and not (public_platform_url(response.url) or eb2b_file_redirect(url, response.url)):
+            response.close()
+            raise FetchError('LOGIN_REQUIRED')
+        if response.status_code >= 400:
+            response.close()
+            raise FetchError(f'HTTP_{response.status_code}')
+        return response

tenderkit/profile.py

@@ -0,0 +1,216 @@
+"""An industry profile: which notices a project wants, as a TOML file (tomllib, standard library).
+
+    name = "leki"
+    cpv = ["336*"]                         # a code, or a prefix ending in *
+    exclude_cpv = ["33696*", "336316*"]    # codes that never count, even inside cpv
+    keywords_any = ["lek", "farmaceut"]    # empty: no keyword condition
+    exclude_keywords = ["weterynar"]
+
+Keywords match from the start of a word in the title, description or lot titles. Use *term* for a substring.
+Matching is case- and diacritics-insensitive. Profile.matches applies the filters the source cannot handle.
+"""
+from dataclasses import dataclass
+from datetime import datetime
+from decimal import Decimal, InvalidOperation
+from functools import lru_cache
+from zoneinfo import ZoneInfo
+from pathlib import Path
+import re
+import tomllib
+import unicodedata
+
+from tenderkit.interfaces import SourceQuery
+from tenderkit.model import Notice
+
+_CPV = re.compile(r'^\d{1,8}\*?$')
+
+
+@dataclass(frozen=True)
+class ValueRange:
+    min: Decimal | None = None
+    max: Decimal | None = None
+    currency: str = 'PLN'
+
+    def __post_init__(self):
+        for name in ('min', 'max'):
+            value = getattr(self, name)
+            if value is not None:
+                try:
+                    value = Decimal(str(value))
+                except InvalidOperation as exc:
+                    raise ValueError('Invalid value bound') from exc
+                if not value.is_finite() or value < 0:
+                    raise ValueError('Value bounds must be finite and nonnegative')
+                object.__setattr__(self, name, value)
+        if self.min is not None and self.max is not None and self.min > self.max:
+            raise ValueError('Value min exceeds max')
+        if not re.fullmatch(r'[A-Z]{3}', self.currency):
+            raise ValueError('Currency must be a three-letter code')
+
+
+@dataclass(frozen=True)
+class DeadlineRange:
+    min: int = 0
+    max: int = 120
+
+    def __post_init__(self):
+        if type(self.min) is not int or type(self.max) is not int or not 0 <= self.min <= self.max <= 3650:
+            raise ValueError('Invalid deadline_days bounds')
+
+
+def fold(text):
+    """Lower case without diacritics ('Leków' -> 'lekow'), the form keywords are matched in."""
+    text = unicodedata.normalize('NFKD', (text or '').replace('ł', 'l').replace('Ł', 'L'))
+    return ''.join(c for c in text if not unicodedata.combining(c)).casefold()
+
+
+@lru_cache(maxsize=1024)
+def _keyword_pattern(keyword):
+    term = fold(keyword.strip())
+    substring = len(term) > 2 and term.startswith('*') and term.endswith('*')
+    if substring:
+        term = term[1:-1]
+    phrase = r'\s+'.join(re.escape(word) for word in term.split())
+    return re.compile(('' if substring else r'(?<!\w)') + phrase) if phrase else re.compile(r'(?!)')
+
+
+def _keyword_fields(notice):
+    yield 'title', None, notice.title
+    for paragraph in (notice.description or '').split('\n\n'):
+        yield 'description', None, paragraph
+    for lot in notice.lots:
+        if lot.title:
+            yield 'lot_title', lot.number, lot.title
+    for title in notice.lot_titles:
+        yield 'lot_title', None, title
+
+
+@dataclass(frozen=True)
+class Profile:
+    name: str
+    cpv: tuple[str, ...] = ()
+    exclude_cpv: tuple[str, ...] = ()
+    keywords_any: tuple[str, ...] = ()
+    exclude_keywords: tuple[str, ...] = ()
+    notice_types: tuple[str, ...] = ()
+    value: ValueRange | None = None
+    regions: tuple[str, ...] = ()
+    deadline_days: DeadlineRange | None = None
+    exclude_buyers: tuple[str, ...] = ()
+    documents: tuple[str, ...] = ()
+
+    def __post_init__(self):
+        if not isinstance(self.name, str) or not self.name.strip():
+            raise ValueError('Profile name must be nonempty')
+        for name in ('cpv', 'exclude_cpv', 'keywords_any', 'exclude_keywords', 'notice_types', 'regions', 'exclude_buyers', 'documents'):
+            values = getattr(self, name)
+            if (not isinstance(values, (list, tuple)) or len(values) > 64
+                    or any(not isinstance(v, str) or not v.strip() or len(v) > 200 for v in values)):
+                raise ValueError(f'{name} must be an array of nonempty strings')
+            object.__setattr__(self, name, tuple(values))
+        bad = [c for c in self.cpv + self.exclude_cpv if not _CPV.match(c)]
+        if bad:
+            raise ValueError(f'profile {self.name}: CPV must be digits, optionally ending in *: {bad}')
+        if self.value is not None and not isinstance(self.value, ValueRange):
+            raise ValueError('value must be a ValueRange')
+        if self.deadline_days is not None and not isinstance(self.deadline_days, DeadlineRange):
+            raise ValueError('deadline_days must be a DeadlineRange')
+        if any(not re.fullmatch(r'\d{2}', r) for r in self.regions):
+            raise ValueError('regions must contain two-digit TERYT voivodeship codes')
+
+    def cpv_prefixes(self):
+        """'336*' -> '336'; a full code stays as it is."""
+        return tuple(c.rstrip('*') for c in self.cpv)
+
+    def source_query(self):
+        return SourceQuery(cpv_prefixes=self.cpv_prefixes(), notice_types=self.notice_types)
+
+    @staticmethod
+    def _cpv_hit(code, patterns):
+        return any(code.startswith(p[:-1]) if p.endswith('*') else code == p for p in patterns)
+
+    def matches_cpv(self, codes):
+        """Whether one of the notice's codes (main or lot) is wanted: inside cpv (or cpv is empty) and not in exclude_cpv.
+        A notice whose every code is excluded does not match; one with medicines beside reagents still does."""
+        codes = [str(code) for code in codes]
+        if self.exclude_cpv:
+            kept = [code for code in codes if not self._cpv_hit(code, self.exclude_cpv)]
+            if codes and not kept:
+                return False
+            codes = kept
+        return not self.cpv or any(self._cpv_hit(code, self.cpv) for code in codes)
+
+    def matches_text(self, text):
+        return self._matches_keywords((text,))
+
+    def _matches_keywords(self, texts):
+        if not (self.keywords_any or self.exclude_keywords):
+            return True
+        folded = tuple(fold(text) for text in texts if text)
+        if any(_keyword_pattern(term).search(text) for term in self.exclude_keywords for text in folded):
+            return False
+        return not self.keywords_any or any(
+            _keyword_pattern(term).search(text) for term in self.keywords_any for text in folded)
+
+    def keyword_matches(self, notice):
+        """Return the configured inclusion terms that matched and their source fields."""
+        if not self.keywords_any:
+            return []
+        fields = [(field, lot, fold(text)) for field, lot, text in _keyword_fields(notice) if text]
+        hits = dict.fromkeys(
+            (term, field, lot)
+            for term in self.keywords_any for field, lot, text in fields
+            if _keyword_pattern(term).search(text)
+        )
+        return [dict(keyword=term, field=field, lot=lot) if lot is not None else dict(keyword=term, field=field)
+                for term, field, lot in hits]
+
+    def matches(self, notice: Notice, *, today=None):
+        if not self.matches_cpv(notice.cpv):
+            return False
+        if self.notice_types and notice.notice_type not in self.notice_types:
+            return False
+        if self.regions and notice.buyer_region not in self.regions:
+            return False
+        if any(fold(b) in fold(notice.buyer_name) or b == notice.buyer_id for b in self.exclude_buyers):
+            return False
+        if self.value:
+            if notice.value is None or notice.currency != self.value.currency:
+                return False
+            if self.value.min is not None and notice.value < self.value.min:
+                return False
+            if self.value.max is not None and notice.value > self.value.max:
+                return False
+        if self.deadline_days:
+            if notice.deadline is None:
+                return False
+            deadline = notice.deadline.astimezone(ZoneInfo('Europe/Warsaw')) if notice.deadline.tzinfo else notice.deadline
+            days = (deadline.date() - (today or datetime.now(ZoneInfo('Europe/Warsaw')).date())).days
+            if not self.deadline_days.min <= days <= self.deadline_days.max:
+                return False
+        return self._matches_keywords(text for _, _, text in _keyword_fields(notice))
+
+
+def load_profile(path):
+    source = path if hasattr(path, 'read_text') else Path(path)     # a path or an importlib.resources file
+    data = tomllib.loads(source.read_text(encoding='utf-8'))
+    return profile_from_dict(data, origin=str(path))
+
+
+def profile_from_dict(data, *, origin='profile'):
+    unknown = set(data) - set(Profile.__dataclass_fields__)
+    if unknown:
+        raise ValueError(f'{origin}: unknown profile keys {sorted(unknown)}')
+    data = dict(data)
+    for key, cls in (('value', ValueRange), ('deadline_days', DeadlineRange)):
+        if key in data and data[key] is not None:
+            if not isinstance(data[key], dict):
+                raise ValueError(f'{key} must be a table')
+            try:
+                data[key] = cls(**data[key])
+            except TypeError as exc:
+                raise ValueError(f'Invalid {key} fields') from exc
+    try:
+        return Profile(**data)
+    except TypeError as exc:
+        raise ValueError('Invalid profile fields') from exc