@octocrawl/cli 0.3.0 → 0.3.1

package/dist/cli.js

@@ -385,6 +385,13 @@ function withEnvironmentProxy(policy, env) {
   const egressProxy = environmentProxy(env);
   return egressProxy === null ? policy : { ...policy, egressProxy };
 }
+function egressProxies(raw) {
+  const servers = (raw ?? "").split(/[\s,]+/).filter((entry3) => entry3 !== "").map((entry3, i) => proxyServer(`W2L_EGRESS_PROXIES entry ${i + 1}`, entry3));
+  return servers.filter((server, i) => servers.findIndex((other) => other.endpoint === server.endpoint) === i);
+}
+function withPoolProxy(policy, server) {
+  return { ...policy, origin: "operator", egressProxy: { source: "pool", https: server, http: server, noProxy: policy.egressProxy?.noProxy ?? [] } };
+}
 function proxyFor(url, policy) {
   const proxy = policy.origin === "operator" ? policy.egressProxy ?? null : null;
   if (proxy === null)
@@ -451,7 +458,7 @@ function proxyServer(name, raw) {
     throw new ProxyConfigError(`${name} is not a valid proxy URL.`);
   }
   if (url.protocol !== "http:" && url.protocol !== "https:") {
-    throw new ProxyConfigError(`${name} names a ${url.protocol.slice(0, -1)} proxy; W2L supports http:// and https:// proxies.`);
+    throw new ProxyConfigError(`${name} names a ${url.protocol.slice(0, -1)} proxy; Octocrawl supports http:// and https:// proxies.`);
   }
   const endpoint = `${url.hostname}:${url.port || (url.protocol === "https:" ? "443" : "80")}`;
   return {
@@ -547,7 +554,11 @@ function isResearchUserAgent(userAgent) {
   return /\bw2l-research\b/.test(userAgent) || userAgent.startsWith(`${SEC_DECLARED_NAME} `);
 }
 function robotsAgent(userAgent) {
-  return userAgent.startsWith(`${SEC_DECLARED_NAME} `) ? `${userAgent} ${RESEARCH_PRODUCT_TOKEN}` : userAgent;
+  const declared3 = userAgent.startsWith(`${SEC_DECLARED_NAME} `) ? `${userAgent} ${RESEARCH_PRODUCT_TOKEN}` : userAgent;
+  return `${declared3} ${PRODUCT_ROBOTS_TOKEN}`;
+}
+function isOctocrawlRobotsGroup(matchedAgent) {
+  return matchedAgent === PRODUCT_ROBOTS_TOKEN || matchedAgent === RESEARCH_PRODUCT_TOKEN;
 }
 function operatorContact(env) {
   const contact = (env["W2L_CONTACT"] ?? "").trim();
@@ -639,7 +650,7 @@ function checkIdentityHonesty(identity, sent) {
   }
   return { honest: mismatches.length === 0, mismatches };
 }
-var RESEARCH_UA_COMMENT, RESEARCH_USER_AGENT, MAX_CONTACT_LENGTH, SEC_DECLARED_NAME, RESEARCH_PRODUCT_TOKEN, CHROME_MAJOR_FLOOR, BROWSER_FINGERPRINT, MOBILE_BROWSER_FINGERPRINT, PREVIEW_PRODUCT_TOKEN, MODE_IDENTITIES;
+var RESEARCH_UA_COMMENT, RESEARCH_USER_AGENT, MAX_CONTACT_LENGTH, SEC_DECLARED_NAME, RESEARCH_PRODUCT_TOKEN, PRODUCT_ROBOTS_TOKEN, CHROME_MAJOR_FLOOR, BROWSER_FINGERPRINT, MOBILE_BROWSER_FINGERPRINT, PREVIEW_PRODUCT_TOKEN, MODE_IDENTITIES;
 var init_compliance = __esm({
   "packages/contracts/dist/compliance.js"() {
     "use strict";
@@ -648,6 +659,7 @@ var init_compliance = __esm({
     MAX_CONTACT_LENGTH = 200;
     SEC_DECLARED_NAME = "W2L Research";
     RESEARCH_PRODUCT_TOKEN = "w2l-research";
+    PRODUCT_ROBOTS_TOKEN = "octocrawl";
     CHROME_MAJOR_FLOOR = 128;
     BROWSER_FINGERPRINT = {
       locale: "en-US",
@@ -1577,11 +1589,11 @@ function readSchema(value, at = "schema") {
         if (depth > 0)
           unsupported(where, key, "only the root may declare it");
       } else if (!SCHEMA_KEYS.has(key)) {
-        unsupported(where, key, "W2L extraction does not support it");
+        unsupported(where, key, "Octocrawl extraction does not support it");
       }
     }
     if (rec.$schema !== void 0 && (typeof rec.$schema !== "string" || !SCHEMA_DIALECTS.test(rec.$schema))) {
-      unsupported(where, "$schema", `W2L follows JSON Schema draft-07, 2019-09 and 2020-12, not ${JSON.stringify(rec.$schema)}`);
+      unsupported(where, "$schema", `Octocrawl follows JSON Schema draft-07, 2019-09 and 2020-12, not ${JSON.stringify(rec.$schema)}`);
     }
     if (rec.$id !== void 0 && typeof rec.$id !== "string")
       invalid(where, "$id must be a string");
@@ -1669,7 +1681,7 @@ function readSchema(value, at = "schema") {
       const union = branches;
       const nullable2 = union.length === 2 && union.some(isNullSchema);
       if (!nullable2 && !union.every(isPrimitiveSchema))
-        unsupported(where, key, "W2L maps a schema-or-null union or a union of primitive types, not a union of objects, arrays or references");
+        unsupported(where, key, "Octocrawl maps a schema-or-null union or a union of primitive types, not a union of objects, arrays or references");
       union.forEach((branch, index) => visit(branch, depth + 1, `${where}.${key}[${index}]`));
     }
   };
@@ -1699,7 +1711,7 @@ function readListFormat(rec, name) {
   };
   if (rec.itemSelector === void 0) {
     if (rec.fields !== void 0)
-      throw new RequestError(`${name}.fields needs an itemSelector: without one, W2L finds the list and its fields itself`);
+      throw new RequestError(`${name}.fields needs an itemSelector: without one, Octocrawl finds the list and its fields itself`);
     return { type: "list" };
   }
   const itemSelector = selectorOf2(rec.itemSelector, `${name}.itemSelector`);
@@ -1945,7 +1957,7 @@ function readSelectors(value, name) {
 }
 function headerRefusal(name) {
   if (name === "user-agent" || name.startsWith("sec-ch-") || name.startsWith("sec-fetch-"))
-    return `headers.${name} is refused: the User-Agent and client hints are W2L's declared identity`;
+    return `headers.${name} is refused: the User-Agent and client hints are Octocrawl's declared identity`;
   if (CREDENTIAL_HEADERS.has(name))
     return `headers.${name} is refused: credentials are not sent as headers; mode 'authed' carries your own session on the record`;
   if (TRANSPORT_HEADERS.has(name))
@@ -2011,7 +2023,7 @@ function readParsers(value) {
     const name = `parsers[${index}]`;
     const type = typeof entry3 === "string" ? entry3 : entry3 !== null && typeof entry3 === "object" && !Array.isArray(entry3) ? entry3.type : void 0;
     if (type === "image")
-      throw new RequestError(`${name} is refused: W2L reads no image as a document (no OCR)`, "unsupported_parameter", { parameters: [name] });
+      throw new RequestError(`${name} is refused: Octocrawl reads no image as a document (no OCR)`, "unsupported_parameter", { parameters: [name] });
     if (type !== "pdf")
       throw new RequestError(`${name} must be "pdf" or { type: "pdf", mode, maxPages, pages, pageMarkers }`);
     if (parsers.length > 0)
@@ -2023,7 +2035,7 @@ function readParsers(value) {
     const rec = entry3;
     rejectUnknownKeys(rec, PDF_PARSER_KEYS, name);
     if (rec.mode === "ocr")
-      throw new RequestError(`${name}.mode "ocr" is refused: W2L reads a PDF's text layer and runs no OCR`, "unsupported_parameter", { parameters: [`${name}.mode`] });
+      throw new RequestError(`${name}.mode "ocr" is refused: Octocrawl reads a PDF's text layer and runs no OCR`, "unsupported_parameter", { parameters: [`${name}.mode`] });
     if (rec.mode !== void 0 && rec.mode !== "fast" && rec.mode !== "auto")
       throw new RequestError(`${name}.mode must be "fast" or "auto"`);
     const maxPages = rec.maxPages;
@@ -2260,6 +2272,7 @@ function parseCrawlStartRequest(body) {
   const maxConcurrency = readConcurrency(rec.maxConcurrency);
   const idempotencyKey = readIdempotencyKey(rec.idempotencyKey);
   const webhook = readWebhook(rec.webhook);
+  const ignoreRobotsTxt = readBoolean(rec.ignoreRobotsTxt, "ignoreRobotsTxt");
   const req = {
     url: readUrl(rec.url),
     mode,
@@ -2276,6 +2289,7 @@ function parseCrawlStartRequest(body) {
     ...maxConcurrency === void 0 ? {} : { maxConcurrency },
     ...idempotencyKey === void 0 ? {} : { idempotencyKey },
     ...webhook === void 0 ? {} : { webhook },
+    ...ignoreRobotsTxt === void 0 ? {} : { ignoreRobotsTxt },
     ...page,
     ...readAttribution(rec)
   };
@@ -2313,6 +2327,7 @@ function parseMapRequest(body) {
   }
   const includePaths = readPathPatterns(rec.includePaths, "includePaths");
   const excludePaths = readPathPatterns(rec.excludePaths, "excludePaths");
+  const ignoreRobotsTxt = readBoolean(rec.ignoreRobotsTxt, "ignoreRobotsTxt");
   return {
     url: readUrl(rec.url),
     ...rec.mode === void 0 ? {} : { mode: rec.mode },
@@ -2323,6 +2338,7 @@ function parseMapRequest(body) {
     ...scope,
     ...includePaths === void 0 ? {} : { includePaths },
     ...excludePaths === void 0 ? {} : { excludePaths },
+    ...ignoreRobotsTxt === void 0 ? {} : { ignoreRobotsTxt },
     ...readAttribution(rec)
   };
 }
@@ -2488,23 +2504,23 @@ var init_api = __esm({
       }
     };
     REFUSAL_HINTS = {
-      stealth: "W2L does not offer a stealth mode or stealth proxies; a proxy or session you own (mode authed) is the supported route",
-      ignoreRobotsTxt: "robots.txt is always read; a robotsOverride with a recorded reason fetches one URL past its rule, on the record",
-      hostedSkipTlsVerification: "a hosted server verifies every certificate; run W2L locally to use skipTlsVerification, which is recorded in the trace and a tls_unverified warning",
-      useIndex: "W2L keeps no URL index: a map reads the sitemaps the site declares and its start page, on the record; crawl reads further pages",
+      stealth: "Octocrawl has no stealth option on a request: a provider's stealth or challenge solving runs only on a server started with an access grant that names it (--access-grant, ADR 0005); a proxy or session you own (mode authed) is the other route",
+      ignoreRobotsTxt: "robots.txt is always read and recorded; on a local server a URL a scrape or batch names is fetched whatever it says, and ignoreRobotsTxt on a crawl or map fetches the links it disallows, on the record",
+      hostedSkipTlsVerification: "a hosted server verifies every certificate; run Octocrawl locally to use skipTlsVerification, which is recorded in the trace and a tls_unverified warning",
+      useIndex: "Octocrawl keeps no URL index: a map reads the sitemaps the site declares and its start page, on the record; crawl reads further pages",
       actions: "actions run on scrape and batch, where each page named gets the same steps; a crawl or a map does not take them"
     };
     PAGE_KEYS = ["onlyMainContent", "waitFor", "timeout", "maxFileBytes", "includeTags", "excludeTags", "headers", "mobile", "skipTlsVerification", "fastMode", "blockAds", "removeBase64Images", "parsers", "maxAge", "minAge", "storeInCache", "lockdown"];
     ATTRIBUTION_KEYS = ["origin", "integration"];
     SCRAPE_KEYS = ["url", "mode", "allowlistedDomains", "formats", "includeLinks", "debug", "robotsOverride", "actions", "handoff", ...PAGE_KEYS, ...ATTRIBUTION_KEYS];
     CRAWL_SCOPE_KEYS = ["regexOnFullURL", "ignoreQueryParameters", "deduplicateSimilarURLs", "crawlEntireDomain", "allowSubdomains", "allowExternalLinks"];
-    CRAWL_KEYS = ["url", "mode", "maxPages", "maxDepth", "useCached", "allowlistedDomains", "formats", "includeLinks", "includePaths", "excludePaths", ...CRAWL_SCOPE_KEYS, "sitemap", "maxConcurrency", "idempotencyKey", "webhook", ...PAGE_KEYS, ...ATTRIBUTION_KEYS];
+    CRAWL_KEYS = ["url", "mode", "maxPages", "maxDepth", "useCached", "allowlistedDomains", "formats", "includeLinks", "includePaths", "excludePaths", ...CRAWL_SCOPE_KEYS, "sitemap", "maxConcurrency", "idempotencyKey", "webhook", "ignoreRobotsTxt", ...PAGE_KEYS, ...ATTRIBUTION_KEYS];
     BATCH_SCOPE_NOOP_KEYS = { allowExternalLinks: "allowExternalLinks", includeSubdomains: "allowSubdomains" };
     BATCH_KEYS = ["urls", "mode", "formats", "includeLinks", "robotsOverrides", "maxConcurrency", "ignoreInvalidURLs", "allowExternalLinks", "includeSubdomains", "idempotencyKey", "appendToId", "webhook", "actions", ...PAGE_KEYS, ...ATTRIBUTION_KEYS];
     BATCH_APPEND_KEYS = ["urls", "appendToId", "ignoreInvalidURLs", "allowExternalLinks", "includeSubdomains", "idempotencyKey", "robotsOverrides", ...ATTRIBUTION_KEYS];
     ROBOTS_OVERRIDE_KEYS = ["reason", "recordedBy"];
     MAP_SCOPE_KEYS = ["includeSubdomains", "ignoreQueryParameters", "regexOnFullURL", "crawlEntireDomain", "deduplicateSimilarURLs"];
-    MAP_KEYS = ["url", "mode", "limit", "timeout", "search", "sitemap", ...MAP_SCOPE_KEYS, "includePaths", "excludePaths", ...ATTRIBUTION_KEYS];
+    MAP_KEYS = ["url", "mode", "limit", "timeout", "search", "sitemap", ...MAP_SCOPE_KEYS, "includePaths", "excludePaths", "ignoreRobotsTxt", ...ATTRIBUTION_KEYS];
     WEBHOOK_KEYS = ["url", "headers", "metadata", "events", "secretEnv"];
     WEBHOOK_RESERVED_HEADERS = /* @__PURE__ */ new Set(["content-type", "content-length", "host", "connection", "transfer-encoding"]);
     WEBHOOK_SECRET_ENV = /^W2L_WEBHOOK_SECRET_[A-Z0-9_]+$/;
@@ -2585,7 +2601,7 @@ function parseFirecrawlScrapeRequest(body) {
 function parseFirecrawlCrawlRequest(body) {
   const rec = asRecord2(body);
   const problems = noProblems();
-  checkShimKeys(rec, "", ["url", ...SHIM_ATTRIBUTION, "limit", "maxDepth", "includePaths", "excludePaths", "ignoreSitemap", "sitemapOnly", "scrapeOptions", ...SHIM_CRAWL_SCOPE_OPTIONS, "allowBackwardLinks", "crawlEntireDomain", "idempotencyKey", "webhook"], problems);
+  checkShimKeys(rec, "", ["url", ...SHIM_ATTRIBUTION, "limit", "maxDepth", "includePaths", "excludePaths", "ignoreSitemap", "sitemapOnly", "scrapeOptions", ...SHIM_CRAWL_SCOPE_OPTIONS, "allowBackwardLinks", "crawlEntireDomain", "idempotencyKey", "webhook", "ignoreRobotsTxt"], problems);
   let pageOptions2 = { parsers: shimParsers(void 0, void 0, "scrapeOptions.") };
   if (rec.scrapeOptions !== void 0) {
     const options = rec.scrapeOptions;
@@ -2626,6 +2642,8 @@ function parseFirecrawlCrawlRequest(body) {
     native.crawlEntireDomain = rec.crawlEntireDomain;
   if (rec.idempotencyKey !== void 0)
     native.idempotencyKey = rec.idempotencyKey;
+  if (rec.ignoreRobotsTxt !== void 0)
+    native.ignoreRobotsTxt = rec.ignoreRobotsTxt;
   if (rec.webhook !== void 0)
     native.webhook = rec.webhook;
   const parsed = parseCrawlStartRequest(native);
@@ -3017,9 +3035,9 @@ var init_evidenceRecord = __esm({
     EVIDENCE_SCHEMA_VERSION = "w2l.evidence/1";
     keysOf = () => (keys) => keys;
     EVIDENCE_RECORD_KEYS = {
-      record: keysOf()(["schemaVersion", "requestedUrl", "finalUrl", "redirectChain", "fetchedAt", "httpStatus", "status", "reason", "lane", "robotsDecision", "rawSha256", "contentEncoding", "outputSha256", "extractor", "fieldEvidence", "artifacts", "proxy", "identity", "pageActions"]),
+      record: keysOf()(["schemaVersion", "requestedUrl", "finalUrl", "redirectChain", "fetchedAt", "httpStatus", "status", "reason", "lane", "robotsDecision", "rawSha256", "contentEncoding", "outputSha256", "extractor", "fieldEvidence", "artifacts", "proxy", "identity", "pageActions", "access"]),
       redirectChain: keysOf()(["urls", "complete"]),
-      robotsDecision: keysOf()(["decision", "robotsUrl", "robotsSha256", "unreachable", "crawlDelayMs", "userOverride"]),
+      robotsDecision: keysOf()(["decision", "robotsUrl", "robotsSha256", "unreachable", "crawlDelayMs", "userOverride", "overrideBasis"]),
       outputSha256: keysOf()(["markdown", "json"]),
       extractor: keysOf()(["name", "version", "commit"]),
       fieldEvidence: keysOf()(["source", "locator"]),
@@ -3027,7 +3045,8 @@ var init_evidenceRecord = __esm({
       identity: keysOf()(["userAgent", "mode", "contact", "device", "requestHeaders"]),
       pageActions: keysOf()(["steps", "scriptRan"]),
       pageActionStep: keysOf()(["type", "outcome"]),
-      requestHeader: keysOf()(["name", "valueSha256"])
+      requestHeader: keysOf()(["name", "valueSha256"]),
+      access: keysOf()(["route", "executor", "executorVersion", "profile", "externalCostUsd"])
     };
   }
 });
@@ -3243,7 +3262,7 @@ function evaluateRobots(robots, userAgent, path) {
     return { allowed: true, appliedRules: [], matchedAgent: null, crawlDelayMs: null };
   }
   const ua = userAgent.toLowerCase();
-  const matchedAgent = group.agents.find((a) => a !== "*" && ua.includes(a)) ?? group.agents.find((a) => a === "*") ?? null;
+  const matchedAgent = group.agents.filter((a) => a !== "*" && ua.includes(a)).sort((a, b) => b.length - a.length)[0] ?? group.agents.find((a) => a === "*") ?? null;
   const appliedRules = group.rules.filter((r) => globMatches(r.tokens, path)).sort((a, b) => b.patternLength === a.patternLength ? Number(b.allow) - Number(a.allow) : b.patternLength - a.patternLength);
   return {
     allowed: isAllowed(group.rules, path),
@@ -3660,6 +3679,14 @@ var init_resilient = __esm({
 });
 
 // packages/http-core/dist/gate.js
+function perimeterXChallenge(head, lower) {
+  if (!lower.includes("_pxappid") || !PX_CAPTCHA_SCRIPT.test(lower))
+    return null;
+  const signals = ["px_captcha_script", "px_app_id"];
+  if (PX_CAPTCHA_CONTAINER.test(head))
+    signals.push("px_captcha_container");
+  return signals;
+}
 function challengePlatformBeyondJsd(lower) {
   const marker = "/cdn-cgi/challenge-platform";
   for (let at = lower.indexOf(marker); at !== -1; at = lower.indexOf(marker, at + marker.length)) {
@@ -3692,6 +3719,9 @@ function classifyGate(res) {
   const lower = head.toLowerCase();
   const contentful = res.contentful === true;
   if (res.status === 429) {
+    const px2 = perimeterXChallenge(head, lower);
+    if (px2 !== null)
+      return { reason: "captcha", signals: [...px2, "status_429"] };
     return { reason: "rate_limit", signals: ["status_429"] };
   }
   if (res.status === 451) {
@@ -3718,6 +3748,12 @@ function classifyGate(res) {
   if (/<form\b[^>]*\bhidden\b/i.test(head) && /\bname\s*=\s*["']js_challenge["']/i.test(head) && /\bname\s*=\s*["']jsc_token["']/i.test(head)) {
     return { reason: "bot_detected_generic", signals: ["reddit_js_verification"] };
   }
+  if (/<title[^>]*>\s*reddit - prove your humanity\s*<\/title>/.test(lower) && lower.includes("google.com/recaptcha/api.js")) {
+    return { reason: "captcha", signals: ["reddit_captcha_title", "recaptcha_script"] };
+  }
+  const px = perimeterXChallenge(head, lower);
+  if (px !== null)
+    return { reason: "captcha", signals: px };
   if (contentful)
     return null;
   const captcha = matched(lower, CAPTCHA_MARKERS);
@@ -3792,7 +3828,7 @@ function nextLane(reason2, from) {
       return from === "browser_proxy" ? null : "browser_proxy";
   }
 }
-var HEAD_BYTES, VENDOR_HEADERS, CF_STRONG_MARKERS, CF_INTERSTITIAL_PAIR, CAPTCHA_MARKERS, LOGIN_INTENT_PHRASES, PASSWORD_INPUT, TITLE_OR_H1, BARE_LOGIN_HEADING, GEO_MARKERS, BOT_STRONG_MARKERS, BOT_WEAK_MARKERS, GATE_SHAPED_STATUS, CF_JSD_PATH;
+var HEAD_BYTES, VENDOR_HEADERS, CF_STRONG_MARKERS, CF_INTERSTITIAL_PAIR, CAPTCHA_MARKERS, LOGIN_INTENT_PHRASES, PASSWORD_INPUT, TITLE_OR_H1, BARE_LOGIN_HEADING, GEO_MARKERS, BOT_STRONG_MARKERS, BOT_WEAK_MARKERS, GATE_SHAPED_STATUS, CF_JSD_PATH, PX_CAPTCHA_SCRIPT, PX_CAPTCHA_CONTAINER;
 var init_gate = __esm({
   "packages/http-core/dist/gate.js"() {
     "use strict";
@@ -3826,7 +3862,9 @@ var init_gate = __esm({
       ["challenges.cloudflare.com/turnstile", "widget_turnstile_script"],
       ["funcaptcha", "widget_funcaptcha"],
       ["arkoselabs", "widget_arkose"],
-      ["data-sitekey", "widget_sitekey"]
+      ["data-sitekey", "widget_sitekey"],
+      // PerimeterX's press-and-hold prompt, as Walmart words it: the widget's own instruction.
+      ["activate and hold the button", "text_activate_and_hold"]
     ];
     LOGIN_INTENT_PHRASES = [
       "sign in to continue",
@@ -3860,6 +3898,7 @@ var init_gate = __esm({
       ["unusual traffic from your computer network", "text_unusual_traffic"],
       ["automated queries", "text_automated_queries"],
       ["are you a robot", "text_are_you_a_robot"],
+      ["robot or human?", "text_robot_or_human"],
       ["verify you are human", "text_verify_you_are_human"],
       ["verifying you are human", "text_verifying_you_are_human"],
       ["bot detected", "text_bot_detected"],
@@ -3878,6 +3917,8 @@ var init_gate = __esm({
     ];
     GATE_SHAPED_STATUS = [403, 429, 503];
     CF_JSD_PATH = "/cdn-cgi/challenge-platform/scripts/jsd/";
+    PX_CAPTCHA_SCRIPT = /\/captcha\/captcha\.js|captcha\.px-(?:cdn|cloud)\.net\/[^"'\s<>]*captcha\.js/;
+    PX_CAPTCHA_CONTAINER = /<[a-z][^>]*\sid\s*=\s*["']?px-captcha(?=["'\s>/])/i;
   }
 });
 
@@ -4149,18 +4190,47 @@ var init_access2 = __esm({
 });
 
 // packages/http-core/dist/vendor.js
+function evaluateAccessCapability(capability, granted = []) {
+  const forever = REFUSED_FOREVER.find((e) => e.capability === capability);
+  if (forever !== void 0) {
+    return { capability, decision: "refused", reason: `${capability} is never enabled (ADR 0005): ${forever.principle}` };
+  }
+  const deferred = DEFERRED.find((e) => e.capability === capability);
+  if (deferred !== void 0) {
+    return {
+      capability,
+      decision: "deferred",
+      source: deferred.source,
+      restartWhen: deferred.restartWhen,
+      reason: `${capability} is deferred (ADR 0005; ${deferred.source}, "${deferred.row}"); it restarts when: ${deferred.restartWhen}`
+    };
+  }
+  if (AUTHORIZABLE.some((e) => e.capability === capability)) {
+    return granted.includes(capability) ? { capability, decision: "granted" } : { capability, decision: "not_granted", reason: `${capability} is off unless a grant names it (ADR 0005)` };
+  }
+  return { capability, decision: "unknown", reason: `${capability} is not an access capability ADR 0005 names` };
+}
 function evaluateVendorPolicy(offers, policy = DEFAULT_VENDOR_POLICY) {
-  const authorized = new Set(policy.authorized ?? []);
+  const authorized = [...new Set(policy.authorized ?? [])];
+  const operational = OPERATIONAL_POLICY_KEYS;
+  const declined = authorized.filter((key) => !operational.includes(key)).map((key) => evaluateAccessCapability(key, authorized)).filter((v) => v.decision === "refused" || v.decision === "deferred" || v.decision === "unknown");
   const enabled = [];
+  const withheld = [];
   for (const offer of offers) {
-    if (REFUSED_CAPABILITIES.includes(offer.capability)) {
+    const access = VENDOR_CAPABILITY_ACCESS[offer.capability];
+    if (access !== void 0) {
+      if (evaluateAccessCapability(access, authorized).decision === "granted") {
+        enabled.push({ capability: offer.capability, enableKey: access, optOutRequired: offer.vendorDefaultOn });
+      } else {
+        withheld.push(offer.capability);
+      }
       continue;
     }
     if (offer.enableKey === null) {
       enabled.push({ capability: offer.capability, enableKey: null, optOutRequired: offer.vendorDefaultOn });
       continue;
     }
-    if (authorized.has(offer.enableKey)) {
+    if (authorized.includes(offer.enableKey)) {
       enabled.push({
         capability: offer.capability,
         enableKey: offer.enableKey,
@@ -4168,20 +4238,99 @@ function evaluateVendorPolicy(offers, policy = DEFAULT_VENDOR_POLICY) {
       });
     }
   }
-  const unauthorized = [...authorized].filter((key) => !offers.some((o) => o.enableKey === key));
-  return { enabled, unauthorized, refused: [...REFUSED_CAPABILITIES] };
+  const vendorKeys = /* @__PURE__ */ new Set([...operational, ...Object.values(VENDOR_CAPABILITY_ACCESS)]);
+  const offered = new Set(offers.flatMap((o) => [o.enableKey, VENDOR_CAPABILITY_ACCESS[o.capability]]));
+  const declinedKeys = new Set(declined.map((v) => v.capability));
+  const unauthorized = authorized.filter((key) => vendorKeys.has(key) && !declinedKeys.has(key) && !offered.has(key));
+  return { enabled, unauthorized, withheld, declined, refused: REFUSED_FOREVER.map((e) => e.capability) };
 }
-var REFUSED_CAPABILITIES, DEFAULT_VENDOR_POLICY;
+var REFUSED_FOREVER, DEFERRED, AUTHORIZABLE, VENDOR_CAPABILITY_ACCESS, DEFAULT_VENDOR_POLICY, OPERATIONAL_POLICY_KEYS, AUTHORIZABLE_POLICY_KEYS;
 var init_vendor = __esm({
   "packages/http-core/dist/vendor.js"() {
     "use strict";
-    REFUSED_CAPABILITIES = [
-      "fingerprint_spoofing",
-      "cdp_patching",
-      "captcha_solving",
-      "identity_rotation"
+    REFUSED_FOREVER = [
+      {
+        capability: "identity_rotation",
+        principle: "cycling identities to outlast a block, including answering a 429 with another IP and carrying on"
+      },
+      {
+        capability: "patch_user_chrome",
+        principle: "modifying, patching or injecting into the person's own Chrome"
+      },
+      {
+        capability: "in_session_route_switch",
+        principle: "switching executor or egress inside an established interactive session without saying so"
+      },
+      {
+        capability: "secrets_in_records",
+        principle: "writing proxy credentials, cookies, solver tokens or a cdpEndpoint into a record or a log"
+      }
+    ];
+    DEFERRED = [
+      {
+        capability: "own_browser_engine",
+        source: "ROADMAP.md:263",
+        row: "An own browser fork or engine, and broad custom-fingerprint research",
+        restartWhen: "A maintained project stops working for a class of tasks that PA's set shows matters"
+      },
+      {
+        capability: "own_fingerprint_patches",
+        source: "ROADMAP.md:263",
+        row: "An own browser fork or engine, and broad custom-fingerprint research",
+        restartWhen: "A maintained project stops working for a class of tasks that PA's set shows matters"
+      },
+      {
+        capability: "own_captcha_model",
+        source: "ROADMAP.md:264",
+        row: "An in-house CAPTCHA model",
+        restartWhen: "Only if solver cost or coverage blocks paying users"
+      },
+      {
+        capability: "own_residential_network",
+        source: "ROADMAP.md:265",
+        row: "An own residential IP network",
+        restartWhen: "Not restarted; PA uses providers"
+      },
+      {
+        capability: "camoufox",
+        source: "ROADMAP.md:266",
+        row: "A second stealth engine (Camoufox)",
+        restartWhen: "Patchright leaves a clear class of PA tasks unsolved"
+      },
+      {
+        capability: "hosted_browser_cluster",
+        source: "ROADMAP.md:267",
+        row: "A hosted browser cluster beyond Cloud Run's instance cap",
+        restartWhen: "PH's phase 2 shows browser-lane demand that the instance cap cannot serve, and a key holder will pay for it"
+      }
+    ];
+    AUTHORIZABLE = [
+      { capability: "compatible_transport", tier: "standard", thirdPartyCost: false },
+      { capability: "egress_sessions", tier: "standard", thirdPartyCost: false },
+      { capability: "enhanced_browser", tier: "enhanced", thirdPartyCost: false },
+      { capability: "vendor_remote_browser", tier: "enhanced", thirdPartyCost: true },
+      { capability: "vendor_unlock_html", tier: "enhanced", thirdPartyCost: true },
+      { capability: "vendor_captcha_solving", tier: "enhanced", thirdPartyCost: true },
+      { capability: "vendor_stealth", tier: "enhanced", thirdPartyCost: true },
+      { capability: "third_party_captcha_solver", tier: "enhanced", thirdPartyCost: true }
     ];
+    VENDOR_CAPABILITY_ACCESS = {
+      fingerprint_spoofing: "vendor_stealth",
+      cdp_patching: "vendor_stealth",
+      captcha_solving: "vendor_captcha_solving",
+      identity_rotation: "identity_rotation"
+    };
     DEFAULT_VENDOR_POLICY = { authorized: [] };
+    OPERATIONAL_POLICY_KEYS = [
+      "session_persistence",
+      "live_view_handoff",
+      "residential_proxy",
+      "retry_orchestration"
+    ];
+    AUTHORIZABLE_POLICY_KEYS = [
+      ...OPERATIONAL_POLICY_KEYS,
+      ...AUTHORIZABLE.map((e) => e.capability)
+    ];
   }
 });
 
@@ -4193,14 +4342,19 @@ function evaluateProviderGate(provider, robots, path, unreachable = null) {
     appliedRules: [],
     refusedCapabilities: []
   };
-  const refused = provider.capabilities.filter((c) => REFUSED_CAPABILITIES.includes(c));
-  if (refused.length > 0) {
+  const verdicts = provider.capabilities.flatMap((c) => {
+    const access = VENDOR_CAPABILITY_ACCESS[c];
+    return access === void 0 ? [] : [{ capability: c, verdict: evaluateAccessCapability(access, provider.grants ?? []) }];
+  });
+  const blocked = verdicts.filter((v) => v.verdict.decision !== "granted");
+  if (blocked.length > 0) {
+    const forever = blocked.some((v) => v.verdict.decision === "refused");
     return {
       ...base,
       allowed: false,
-      refusal: "refused_capability",
-      reason: `Provider ${provider.id} offers ${refused.join(", ")}. Routing to it would buy the stealth layer we declined to build \u2014 changing whose machine runs the browser does not change what the browser is doing.`,
-      refusedCapabilities: refused
+      refusal: forever ? "refused_capability" : "ungranted_capability",
+      reason: `Provider ${provider.id} offers ${blocked.map((v) => v.capability).join(", ")}: ` + blocked.map((v) => "reason" in v.verdict ? v.verdict.reason : v.capability).join("; ") + ". Changing whose machine runs the browser does not change what the browser is doing.",
+      refusedCapabilities: blocked.map((v) => v.capability)
     };
   }
   if (provider.declaredUserAgent === null) {
@@ -4253,8 +4407,124 @@ var init_provider = __esm({
     "use strict";
     init_robots();
     init_vendor();
+  }
+});
+
+// packages/http-core/dist/accessGrant.js
+function isRecord(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function usd(v) {
+  if (v === void 0 || v === null)
+    return null;
+  return typeof v === "number" && Number.isFinite(v) && v > 0 ? v : void 0;
+}
+function normalizeAccessGrant(input) {
+  if (!isRecord(input)) {
+    return { ok: false, problems: [{ field: "grant", kind: "invalid", reason: "a grant is a JSON object" }] };
+  }
+  const problems = [];
+  const tier = input.tier ?? "standard";
+  if (!ACCESS_TIERS.includes(tier)) {
+    problems.push({ field: "tier", kind: "invalid", reason: `tier is one of ${ACCESS_TIERS.join(", ")}` });
+  }
+  const names = input.capabilities ?? [];
+  const capabilities = [];
+  if (!Array.isArray(names) || names.some((n) => typeof n !== "string")) {
+    problems.push({ field: "capabilities", kind: "invalid", reason: "capabilities is a list of capability names" });
+  } else {
+    for (const name of new Set(names)) {
+      const field3 = `capabilities.${name}`;
+      const verdict = evaluateAccessCapability(name, [name]);
+      if (verdict.decision === "refused") {
+        problems.push({ field: field3, kind: "refused", reason: verdict.reason });
+      } else if (verdict.decision === "deferred") {
+        problems.push({ field: field3, kind: "deferred", reason: verdict.reason, source: verdict.source, restartWhen: verdict.restartWhen });
+      } else if (verdict.decision === "unknown") {
+        problems.push({ field: field3, kind: "unknown_capability", reason: verdict.reason });
+      } else {
+        const entry3 = AUTHORIZABLE.find((e) => e.capability === name);
+        if (entry3.tier === "enhanced" && tier !== "enhanced") {
+          problems.push({ field: field3, kind: "tier_too_low", reason: `${name} needs tier enhanced; ${String(tier)} adds no third-party cost and no enhanced browser` });
+        }
+        capabilities.push(entry3.capability);
+      }
+    }
+  }
+  const budgetIn = input.budget ?? {};
+  let perRequestUsd = null;
+  let perRunUsd = null;
+  if (!isRecord(budgetIn)) {
+    problems.push({ field: "budget", kind: "invalid", reason: "budget is an object with perRequestUsd and perRunUsd" });
+  } else {
+    const req = usd(budgetIn.perRequestUsd);
+    const run = usd(budgetIn.perRunUsd);
+    if (req === void 0)
+      problems.push({ field: "budget.perRequestUsd", kind: "invalid", reason: "a positive number of US dollars, or null" });
+    if (run === void 0)
+      problems.push({ field: "budget.perRunUsd", kind: "invalid", reason: "a positive number of US dollars, or null" });
+    perRequestUsd = req ?? null;
+    perRunUsd = run ?? null;
+  }
+  const costed = capabilities.filter((c) => AUTHORIZABLE.find((e) => e.capability === c).thirdPartyCost);
+  if (costed.length > 0 && perRunUsd === null && !problems.some((p) => p.field === "budget.perRunUsd")) {
+    problems.push({
+      field: "budget.perRunUsd",
+      kind: "budget_required",
+      reason: `${costed.join(", ")} can spend a third party's money; a grant naming them needs a positive perRunUsd`
+    });
+  }
+  const scopeIn = input.scope ?? {};
+  let hosts = null;
+  if (!isRecord(scopeIn) || scopeIn.hosts !== void 0 && scopeIn.hosts !== null && (!Array.isArray(scopeIn.hosts) || scopeIn.hosts.some((h) => typeof h !== "string" || h.length === 0))) {
+    problems.push({ field: "scope.hosts", kind: "invalid", reason: "scope.hosts is a list of host names, or null" });
+  } else if (Array.isArray(scopeIn.hosts)) {
+    hosts = scopeIn.hosts;
+  }
+  const att = input.attestation;
+  let attestation = null;
+  if (att !== void 0 && att !== null) {
+    if (!isRecord(att) || [att.principal, att.at, att.statement].some((v) => typeof v !== "string" || v.trim().length === 0)) {
+      problems.push({ field: "attestation", kind: "invalid", reason: "attestation needs principal, at and statement" });
+    } else {
+      attestation = { principal: att.principal, at: att.at, statement: att.statement };
+    }
+  }
+  const enhancedOnly = capabilities.filter((c) => AUTHORIZABLE.find((e) => e.capability === c).tier === "enhanced");
+  if (enhancedOnly.length > 0 && attestation === null && !problems.some((p) => p.field === "attestation")) {
+    problems.push({
+      field: "attestation",
+      kind: "attestation_required",
+      reason: `${enhancedOnly.join(", ")} needs an attestation: who accepted it, when, and the statement they accepted`
+    });
+  }
+  if (problems.length > 0)
+    return { ok: false, problems };
+  return { ok: true, grant: { tier, capabilities, budget: { perRequestUsd, perRunUsd }, scope: { hosts }, attestation } };
+}
+function accessGrantFromText(text2) {
+  let input;
+  try {
+    input = JSON.parse(text2);
+  } catch {
+    throw new Error("access grant: not valid JSON");
+  }
+  const result = normalizeAccessGrant(input);
+  if (!result.ok) {
+    throw new Error(`access grant refused (ADR 0005):
+${result.problems.map((p) => `  - ${p.field}: ${p.reason}`).join("\n")}`);
+  }
+  if (result.grant.scope.hosts !== null) {
+    throw new Error("access grant refused: scope.hosts is not enforced yet, so a grant that names hosts would reach every host; leave scope out");
+  }
+  return result.grant;
+}
+var ACCESS_TIERS;
+var init_accessGrant = __esm({
+  "packages/http-core/dist/accessGrant.js"() {
+    "use strict";
     init_vendor();
-    init_vendor();
+    ACCESS_TIERS = ["standard", "enhanced", "my_browser"];
   }
 });
 
@@ -4310,12 +4580,12 @@ var init_failureClass = __esm({
 // packages/http-core/dist/governance.js
 function hostMatchesAllowlist(host, entry3) {
   const h = host.toLowerCase();
-  const normalized = entry3.toLowerCase();
-  if (normalized.startsWith("*.")) {
-    const suffix = normalized.slice(1);
-    return h === normalized.slice(2) || h.endsWith(suffix);
+  const normalized2 = entry3.toLowerCase();
+  if (normalized2.startsWith("*.")) {
+    const suffix = normalized2.slice(1);
+    return h === normalized2.slice(2) || h.endsWith(suffix);
   }
-  return h === normalized;
+  return h === normalized2;
 }
 function evaluateGovernance(url, policy) {
   let host;
@@ -4343,7 +4613,8 @@ var init_governance = __esm({
   "packages/http-core/dist/governance.js"() {
     "use strict";
     MODE_CHANNELS = {
-      standard: ["http", "browser_local"],
+      // http_compat: the http lane over the browser-compatible transport (ADR 0005 compatible_transport); its identity is the standard one.
+      standard: ["http", "http_compat", "browser_local"],
       research: ["http", "browser_local", "provider"],
       authed: ["http", "browser_local", "provider", "authed_session", "handoff"]
     };
@@ -4416,6 +4687,10 @@ function serialize(input) {
     field(c, "robots.override");
     field(c, r.override.reason);
     nullableField(c, r.override.recordedBy ?? null);
+    if (r.override.basis !== void 0) {
+      field(c, "robots.override.basis");
+      field(c, r.override.basis);
+    }
   }
   const total = c.reduce((n, arr) => n + arr.length, 0);
   const out = new Uint8Array(total);
@@ -4621,6 +4896,7 @@ var init_dist2 = __esm({
     init_access2();
     init_provider();
     init_vendor();
+    init_accessGrant();
     init_failureClass();
     init_governance();
     init_compliance2();
@@ -7620,10 +7896,76 @@ function collectDeclaredProductFacts(doc) {
 function fillPriceFromText(facts, doc) {
   fillMissing(facts, factsFromText(doc));
 }
+function isLabelled(el, doc) {
+  if (el.previousElementSibling !== null && tagOf(el.previousElementSibling) === "label")
+    return true;
+  if (el.closest("label") !== null || (el.getAttribute("aria-label") ?? "").trim() !== "")
+    return true;
+  if (["radiogroup", "listbox"].includes((el.getAttribute("role") ?? "").toLowerCase()))
+    return true;
+  const id = el.getAttribute("id");
+  return id !== null && id !== "" && qsa(doc, "label[for]").some((label) => label.getAttribute("for") === id);
+}
+function isProductOption(el) {
+  const form = el.closest("form");
+  if (form !== null && CART_FORM.test(`${form.getAttribute("action") ?? ""} ${form.getAttribute("id") ?? ""} ${form.getAttribute("class") ?? ""}`))
+    return true;
+  return [el, el.parentElement, ...Array.from(el.children)].some((node) => node !== null && OPTION_NAME.test(`${node.getAttribute("name") ?? ""} ${node.getAttribute("id") ?? ""} ${node.getAttribute("class") ?? ""}`));
+}
+function markOptionGroups(doc, excluded = /* @__PURE__ */ new Set()) {
+  const marked = /* @__PURE__ */ new Map();
+  const outside = (el) => ![...excluded].some((ex) => ex.contains(el));
+  const place = (replaced, values) => {
+    const unique = [...new Set(values.map((v) => v.replace(/\s+/g, " ").trim()).filter((v) => v !== ""))];
+    if (unique.length < 2)
+      return;
+    const placeholder = doc.createElement("span");
+    replaced.parentNode?.insertBefore(placeholder, replaced);
+    marked.set(placeholder, unique.join(", "));
+  };
+  for (const select of qsa(doc, "select")) {
+    if (!outside(select) || !isLabelled(select, doc) || !isProductOption(select))
+      continue;
+    const choices = qsa(select, "option").filter((option) => option.getAttribute("value") !== "").map((option) => textOf(option).trim());
+    const counts = choices.every((choice, at) => /^\d+$/.test(choice) && Number(choice) === Number(choices[0]) + at) && [0, 1].includes(Number(choices[0]));
+    if (!counts)
+      place(select, choices);
+  }
+  for (const group of qsa(doc, "div,span,ul,fieldset,p")) {
+    const kids = Array.from(group.children);
+    if (kids.length < 2 || !kids.every((kid) => tagOf(kid) === "button" && (kid.getAttribute("type") ?? "").toLowerCase() !== "submit"))
+      continue;
+    if (!outside(group) || !isLabelled(group, doc) || !isProductOption(group))
+      continue;
+    place(kids[0], kids.map((kid) => textOf(kid)));
+  }
+  return marked;
+}
+function settleOptionGroups(marked, keep) {
+  for (const [placeholder, values] of marked) {
+    if (keep && placeholder.parentNode !== null) {
+      const text2 = placeholder.ownerDocument.createTextNode(` ${values} `);
+      optionValues.add(text2);
+      placeholder.parentNode.replaceChild(text2, placeholder);
+    } else
+      placeholder.parentNode?.removeChild(placeholder);
+  }
+}
 function isRootish(doc, el) {
   return el === null || el === doc.body || el === doc.documentElement;
 }
+function describes(block) {
+  const unlabelled = (node) => {
+    if (node.nodeType === 3)
+      return optionValues.has(node) ? "" : node.textContent ?? "";
+    if (node.nodeType !== 1 || tagOf(node) === "label" || tagOf(node) === "a")
+      return "";
+    return Array.from(node.childNodes).map(unlabelled).join("");
+  };
+  return /[\p{L}\p{N}]/u.test(unlabelled(block.el));
+}
 function selectProduct(doc, blocks) {
+  const described2 = blocks.filter(describes);
   const scope = microdataProductScope(doc);
   if (scope && !isRootish(doc, scope))
     return scope;
@@ -7633,11 +7975,10 @@ function selectProduct(doc, blocks) {
     const lca = commonAncestor(heading2, price);
     if (!isRootish(doc, lca)) {
       const region = lca;
-      const prose3 = blocks.filter((b) => region.contains(b.el));
-      if (prose3.length > 0)
+      if (described2.some((b) => region.contains(b.el)))
         return region;
       for (let wider = region.parentElement; !isRootish(doc, wider); wider = wider.parentElement) {
-        if (blocks.some((b) => wider.contains(b.el)))
+        if (described2.some((b) => wider.contains(b.el)))
           return wider;
       }
       return region;
@@ -7651,7 +7992,7 @@ function selectProduct(doc, blocks) {
   }
   return null;
 }
-var CURRENCY_SYMBOLS, CURRENCY_CODES, AMOUNT, PRICE_RE;
+var CURRENCY_SYMBOLS, CURRENCY_CODES, AMOUNT, PRICE_RE, CART_FORM, OPTION_NAME, optionValues;
 var init_product = __esm({
   "packages/extract-tf/dist/product.js"() {
     "use strict";
@@ -7660,6 +8001,9 @@ var init_product = __esm({
     CURRENCY_CODES = "(?:USD|EUR|GBP|JPY|CNY|RMB|AUD|CAD|CHF|HKD|SGD|INR|KRW|BRL|MXN|SEK|NOK|DKK|PLN|TRY|ZAR)";
     AMOUNT = "(?:(?<![\\d.,'\u2019])\\d{1,3}(?:[\\s'\u2019]\\d{3}){1,4}(?:[.,]\\d{1,3})?|\\d{1,12}(?:[.,]\\d{1,3}){0,4})";
     PRICE_RE = new RegExp(`(?:${CURRENCY_SYMBOLS}|${CURRENCY_CODES})\\s{0,3}${AMOUNT}|${AMOUNT}\\s{0,3}(?:${CURRENCY_SYMBOLS}|${CURRENCY_CODES})`, "u");
+    CART_FORM = /cart|basket|bag/i;
+    OPTION_NAME = /swatch|variant|variation|attribute/i;
+    optionValues = /* @__PURE__ */ new WeakSet();
   }
 });
 
@@ -7669,10 +8013,10 @@ function hasToken(attr2, tokens) {
   return tokens.some((t) => lower.split(/[\s_-]+/).includes(t));
 }
 function hasRecommendationToken(attr2) {
-  const normalized = attr2.toLowerCase().replace(/([a-z])([A-Z])/g, "$1-$2").split(/\s+/).filter((t) => t.length > 0);
+  const normalized2 = attr2.toLowerCase().replace(/([a-z])([A-Z])/g, "$1-$2").split(/\s+/).filter((t) => t.length > 0);
   const camelSplit = attr2.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
   const parts = camelSplit.split(/[\s_]+/).filter((t) => t.length > 0);
-  const all = /* @__PURE__ */ new Set([...normalized, ...parts]);
+  const all = /* @__PURE__ */ new Set([...normalized2, ...parts]);
   return RECOMMENDATION_TOKENS.some((t) => all.has(t));
 }
 function isRecommendationHeading(text2) {
@@ -7685,14 +8029,17 @@ function isProductGrid(el) {
   const kids = Array.from(el.children);
   if (kids.length < 3)
     return false;
+  const pricedByTag = /* @__PURE__ */ new Map();
   let priced = 0;
   for (const kid of kids) {
     if (qsa(kid, "a").length === 0)
       continue;
-    if (looksLikePrice(textOf(kid)))
-      priced++;
+    if (!looksLikePrice(textOf(kid)))
+      continue;
+    priced++;
+    pricedByTag.set(tagOf(kid), (pricedByTag.get(tagOf(kid)) ?? 0) + 1);
   }
-  return priced >= 3 && priced >= kids.length * 0.6;
+  return Math.max(0, ...pricedByTag.values()) >= 3 && priced >= kids.length * 0.6;
 }
 function recommendationRegion(heading2) {
   const rank = Number(/^h([1-6])$/.exec(tagOf(heading2))?.[1] ?? "6");
@@ -7706,6 +8053,8 @@ function recommendationRegion(heading2) {
   return region;
 }
 function pruneRecommendations(doc) {
+  const h1s = qsa(doc, "h1");
+  const holdsH1 = (el) => h1s.length === 1 && el.contains(h1s[0]);
   for (const heading2 of qsa(doc, "h1,h2,h3,h4,h5,h6")) {
     if (!heading2.isConnected)
       continue;
@@ -7718,14 +8067,14 @@ function pruneRecommendations(doc) {
   for (const el of containers.reverse()) {
     if (!el.isConnected)
       continue;
-    if (isProductGrid(el))
+    if (!holdsH1(el) && isProductGrid(el))
       detach(el);
   }
   for (const el of qsa(doc, "[id],[class]")) {
     if (!el.isConnected)
       continue;
     const attr2 = `${el.getAttribute("id") ?? ""} ${el.getAttribute("class") ?? ""}`;
-    if (hasRecommendationToken(attr2))
+    if (hasRecommendationToken(attr2) && !holdsH1(el))
       detach(el);
   }
 }
@@ -7969,18 +8318,93 @@ var init_prune = __esm({
 function collapsed(text2) {
   return text2.replace(/\s+/g, " ").trim();
 }
+function hydrationPassages(data, out) {
+  const stack = [data];
+  while (stack.length > 0 && out.length < HYDRATION_MAX_PASSAGES) {
+    const node = stack.pop();
+    if (typeof node === "string") {
+      const text2 = collapsed(node);
+      if (text2.length >= HYDRATION_TEXT_MIN_CHARS && (text2.match(/ /g) ?? []).length >= HYDRATION_TEXT_MIN_SPACES)
+        out.push(text2);
+    } else if (Array.isArray(node)) {
+      for (const item of node)
+        stack.push(item);
+    } else if (typeof node === "object" && node !== null) {
+      for (const value of Object.values(node))
+        stack.push(value);
+    }
+  }
+}
+function recordName(item) {
+  if (typeof item !== "object" || item === null || Array.isArray(item))
+    return null;
+  const record3 = item;
+  const name = typeof record3.name === "string" ? record3.name : typeof record3.title === "string" ? record3.title : null;
+  if (name === null)
+    return null;
+  const text2 = collapsed(name).toLowerCase();
+  return text2.length >= LIST_NAME_MIN_CHARS ? text2 : null;
+}
+function collectRecordLists(data, out) {
+  const stack = [data];
+  while (stack.length > 0 && out.length < LIST_MAX_LISTS) {
+    const node = stack.pop();
+    if (Array.isArray(node)) {
+      const names = /* @__PURE__ */ new Set();
+      for (const item of node) {
+        if (typeof item === "object" && item !== null)
+          stack.push(item);
+        const name = names.size < LIST_MAX_NAMES ? recordName(item) : null;
+        if (name !== null)
+          names.add(name);
+      }
+      if (names.size >= LIST_MIN_RECORDS)
+        out.push([...names]);
+    } else if (typeof node === "object" && node !== null) {
+      for (const value of Object.values(node))
+        if (typeof value === "object" && value !== null)
+          stack.push(value);
+    }
+  }
+}
+function hydrationShown(raw, doc) {
+  const passages = [];
+  for (const text2 of raw.hydrationJson) {
+    try {
+      hydrationPassages(JSON.parse(text2), passages);
+    } catch {
+    }
+  }
+  if (passages.length === 0 || doc.body === null)
+    return false;
+  const seen = collapsed(textOf(doc.body));
+  return passages.every((passage) => seen.includes(passage));
+}
+function recordLists(raw) {
+  const lists = [];
+  for (const text2 of raw.hydrationJson) {
+    try {
+      collectRecordLists(JSON.parse(text2), lists);
+    } catch {
+    }
+  }
+  return lists;
+}
 function rawSignals(doc) {
   const markers = /* @__PURE__ */ new Set();
   let scriptChars = 0;
   let hydration = false;
+  const hydrationJson = [];
   for (const script of qsa(doc, "script")) {
     const text2 = script.textContent ?? "";
     if (script.getAttribute("src") === null)
       scriptChars += text2.length;
     const type = (script.getAttribute("type") ?? "").toLowerCase();
-    if (script.id === "__NEXT_DATA__" || type === "application/json" && text2.length >= HYDRATION_MIN_CHARS)
+    if (script.id === "__NEXT_DATA__" || type === "application/json" && text2.length >= HYDRATION_MIN_CHARS) {
       hydration = true;
-    else if (text2.length >= 64 && HYDRATION_SCRIPT.test(text2))
+      if (text2.length <= HYDRATION_MAX_JSON_CHARS)
+        hydrationJson.push(text2);
+    } else if (text2.length >= 64 && HYDRATION_SCRIPT.test(text2))
       hydration = true;
   }
   if (hydration)
@@ -8005,7 +8429,7 @@ function rawSignals(doc) {
   }
   if (qsa(doc, '[aria-busy="true"]').length > 0)
     markers.add("aria_busy");
-  return { scriptChars, markers: Array.from(markers) };
+  return { scriptChars, markers: Array.from(markers), hydrationJson };
 }
 function countEmptyTables(doc) {
   let empty = 0;
@@ -8015,8 +8439,20 @@ function countEmptyTables(doc) {
   }
   return empty;
 }
-function detectRenderSignals(raw, cleaned) {
-  const textChars = cleaned.body ? collapsed(textOf(cleaned.body)).length : 0;
+function partialRecordList(lists, visible) {
+  let partial = null;
+  for (const names of lists) {
+    const shown = names.filter((name) => visible.includes(name)).length;
+    if (shown < LIST_MIN_SHOWN || shown * 2 > names.length)
+      continue;
+    if (partial === null || names.length - shown > partial.declared - partial.shown)
+      partial = { declared: names.length, shown };
+  }
+  return partial;
+}
+function detectRenderSignals(raw, cleaned, context = {}) {
+  const visible = cleaned.body ? collapsed(textOf(cleaned.body)) : "";
+  const textChars = visible.length;
   const emptyTables = countEmptyTables(cleaned);
   const markers = raw.markers;
   const has2 = (m) => markers.includes(m);
@@ -8025,26 +8461,30 @@ function detectRenderSignals(raw, cleaned) {
     reason2 = "empty_table_with_scripts";
   else if (has2("app_root_empty") && raw.scriptChars >= 500)
     reason2 = "empty_app_root";
-  else if (textChars < 300 && raw.scriptChars >= 2e3)
+  else if (textChars < 300 && raw.scriptChars >= 2e3 && context.contentShown !== true)
     reason2 = "script_shell";
   else if (has2("js_fallback_marker") && raw.scriptChars > textChars)
     reason2 = "js_fallback";
   else if (has2("noscript_notice") && raw.scriptChars > textChars && (textChars < NOTICE_MAX_TEXT || has2("hydration_state")))
     reason2 = "js_fallback";
-  else if (has2("hydration_state") && textChars < 1500 && raw.scriptChars > textChars * 2)
+  else if (has2("hydration_state") && textChars < 1500 && raw.scriptChars > textChars * 2 && !(context.productShown === true && context.hydrationShown === true))
     reason2 = "hydration_shell";
   else if (has2("aria_busy") && raw.scriptChars >= 1e3)
     reason2 = "aria_busy";
+  const listRecords = reason2 === null && context.listing === true && raw.hydrationJson.length > 0 ? partialRecordList(recordLists(raw), visible.toLowerCase()) : null;
+  if (listRecords !== null)
+    reason2 = "hydration_list_partial";
   return {
     textChars,
     scriptChars: raw.scriptChars,
     emptyTables,
     markers,
+    ...listRecords === null ? {} : { listRecords },
     clientRendered: reason2 !== null,
     reason: reason2
   };
 }
-var APP_ROOT_SELECTOR, JS_FALLBACK_CLASS, HYDRATION_SCRIPT, APP_ROOT_MAX_TEXT, HYDRATION_MIN_CHARS, NOTICE_MAX_TEXT;
+var APP_ROOT_SELECTOR, JS_FALLBACK_CLASS, HYDRATION_SCRIPT, APP_ROOT_MAX_TEXT, HYDRATION_MIN_CHARS, NOTICE_MAX_TEXT, HYDRATION_TEXT_MIN_CHARS, HYDRATION_TEXT_MIN_SPACES, HYDRATION_MAX_JSON_CHARS, HYDRATION_MAX_PASSAGES, LIST_MIN_RECORDS, LIST_NAME_MIN_CHARS, LIST_MIN_SHOWN, LIST_MAX_NAMES, LIST_MAX_LISTS;
 var init_render = __esm({
   "packages/extract-tf/dist/render.js"() {
     "use strict";
@@ -8055,6 +8495,15 @@ var init_render = __esm({
     APP_ROOT_MAX_TEXT = 200;
     HYDRATION_MIN_CHARS = 2e3;
     NOTICE_MAX_TEXT = 1500;
+    HYDRATION_TEXT_MIN_CHARS = 80;
+    HYDRATION_TEXT_MIN_SPACES = 8;
+    HYDRATION_MAX_JSON_CHARS = 5e6;
+    HYDRATION_MAX_PASSAGES = 200;
+    LIST_MIN_RECORDS = 10;
+    LIST_NAME_MIN_CHARS = 12;
+    LIST_MIN_SHOWN = 3;
+    LIST_MAX_NAMES = 500;
+    LIST_MAX_LISTS = 50;
   }
 });
 
@@ -8857,6 +9306,8 @@ var init_detectList = __esm({
 function hasVisibleBuyBox(doc) {
   const h1s = qsa(doc, "h1");
   const prices = visiblePrices(doc);
+  if (h1s.length === 0)
+    return hasBuyBoxUnderH2(doc, prices);
   if (h1s.length !== 1 || prices.length !== 1 || prices[0].closest("li") !== null)
     return false;
   let heading2 = null;
@@ -8868,6 +9319,35 @@ function hasVisibleBuyBox(doc) {
   }
   return heading2 === h1s[0];
 }
+function hasBuyBoxUnderH2(doc, prices) {
+  const h2s = qsa(doc, "h2");
+  if (h2s.length !== 1 || h2s[0].closest("a") !== null)
+    return false;
+  const all = qsa(doc, "*");
+  const priceSet = new Set(prices);
+  let price = null;
+  for (const el of all.slice(all.indexOf(h2s[0]) + 1)) {
+    if (/^h[1-6]$/.test(tagOf(el)))
+      return false;
+    if (priceSet.has(el)) {
+      price = el;
+      break;
+    }
+  }
+  if (price === null || price.closest("li") !== null)
+    return false;
+  const block = commonAncestor(h2s[0], price);
+  if (block === null || prices.some((other) => other !== price && block.contains(other)))
+    return false;
+  if (prices.length - 1 >= PRODUCT_CARDS)
+    return false;
+  for (let up = price.parentElement; up !== null && up !== doc.body; up = up.parentElement) {
+    const siblings = Array.from(up.parentElement?.children ?? []).filter((sibling) => sibling !== up && tagOf(sibling) === tagOf(up) && prices.some((p) => sibling.contains(p)));
+    if (siblings.length >= 2)
+      return false;
+  }
+  return true;
+}
 function countAll(doc) {
   const textLength = (el) => (el?.textContent ?? "").replace(/\s+/g, " ").trim().length;
   const textChars = textLength(doc.body);
@@ -8895,35 +9375,53 @@ function normalizeTypeName(raw) {
   const last = /[#/]([^#/]+)$/.exec(trimmed)?.[1] ?? /^([^:]+):(.+)$/.exec(trimmed)?.[2] ?? trimmed;
   return last.toLowerCase();
 }
-function collectJsonLdTypes(node, out) {
+function collectPageTypes(root, out) {
+  for (const node of Array.isArray(root) ? root : [root]) {
+    if (typeof node !== "object" || node === null)
+      continue;
+    const record3 = node;
+    const t = record3["@type"];
+    for (const type of typeof t === "string" ? [t] : Array.isArray(t) ? t : [])
+      if (typeof type === "string")
+        out.push(normalizeTypeName(type));
+    if (Array.isArray(record3["@graph"]))
+      collectPageTypes(record3["@graph"], out);
+  }
+}
+function collectJsonLdTypes(node, out, listed, inList = false) {
   if (Array.isArray(node)) {
     for (const item of node)
-      collectJsonLdTypes(item, out);
+      collectJsonLdTypes(item, out, listed, inList);
     return;
   }
   if (typeof node !== "object" || node === null)
     return;
   const t = node["@type"];
-  if (typeof t === "string") {
-    out.push(normalizeTypeName(t));
-  } else if (Array.isArray(t)) {
-    for (const item of t)
-      if (typeof item === "string")
-        out.push(normalizeTypeName(item));
+  const types = (typeof t === "string" ? [t] : Array.isArray(t) ? t.filter((item) => typeof item === "string") : []).map(normalizeTypeName);
+  for (const type of types) {
+    if (inList && type === "product")
+      listed.products++;
+    else
+      out.push(type);
   }
+  const list2 = inList || types.includes("itemlist");
   for (const value of Object.values(node)) {
     if (typeof value === "object" && value !== null)
-      collectJsonLdTypes(value, out);
+      collectJsonLdTypes(value, out, listed, list2);
   }
 }
 function collectPageSignals(doc) {
   const jsonLdTypes = [];
+  const listed = { products: 0 };
+  const pageTypes = [];
   for (const el of qsa(doc, 'script[type="application/ld+json"]')) {
     const text2 = (el.textContent ?? "").trim();
     if (text2.length === 0)
       continue;
     try {
-      collectJsonLdTypes(JSON.parse(text2), jsonLdTypes);
+      const parsed = JSON.parse(text2);
+      collectJsonLdTypes(parsed, jsonLdTypes, listed);
+      collectPageTypes(parsed, pageTypes);
     } catch {
     }
   }
@@ -8940,7 +9438,9 @@ function collectPageSignals(doc) {
     itempropTokens,
     itemTypeTokens,
     postArticles: qsa(doc, "article.post").length,
-    productCards: productCards(doc)
+    productCards: productCards(doc),
+    listedProducts: listed.products,
+    pageTypes
   };
 }
 function productCards(doc) {
@@ -8953,9 +9453,11 @@ function productCards(doc) {
   });
   if (outer.length < PRODUCT_CARDS)
     return false;
-  const classes = (el) => splitTokens(el.getAttribute("class") ?? "").sort().join(" ");
-  const shapes = new Set(outer.map((el) => `${tagOf(el)} ${classes(el)}`));
-  if (shapes.size !== 1 || classes(outer[0]) === "" || outer.some((el) => el.querySelector("h1") !== null))
+  const classes = (el) => splitTokens(el.getAttribute("class") ?? "");
+  const exact = new Set(outer.map((el) => `${tagOf(el)} ${classes(el).sort().join(" ")}`)).size === 1 && classes(outer[0]).length > 0;
+  const siblings = outer.every((el) => el.parentElement === outer[0].parentElement) && new Set(outer.map(tagOf)).size === 1;
+  const shared = classes(outer[0]).some((name) => outer.every((el) => classes(el).includes(name)));
+  if (!(exact || siblings && shared) || outer.some((el) => el.querySelector("h1") !== null))
     return false;
   for (const card of outer) {
     for (let up = card.parentElement; up !== null; up = up.parentElement) {
@@ -8968,7 +9470,7 @@ function productCards(doc) {
   if (all.some((el, at) => at < first2 && /^h[2-6]$/.test(tagOf(el)) && isRecommendationHeading(textOf(el))))
     return false;
   const h1s = qsa(doc, "h1");
-  return !(h1s.length === 1 && visiblePrices(doc).some((price) => !outer.some((card) => card.contains(price))));
+  return !(h1s.length === 1 && visiblePrices(doc).some((price) => price.closest("header, nav") === null && !outer.some((card) => card.contains(price))));
 }
 function hasToken2(values, needle) {
   return values.includes(needle);
@@ -8982,7 +9484,7 @@ function countTokens(values, needles) {
 }
 function hasProductSignals(s) {
   const strong = hasToken2(s.jsonLdTypes, "product") || hasToken2(s.itemTypeTokens, "product") || hasToken2(s.itempropTokens, "product") || hasToken2(s.itempropTokens, "offer");
-  if (strong)
+  if (strong || s.listedProducts > 0)
     return true;
   return countTokens(s.itempropTokens, PRICE_ITEMPROPS) >= 2;
 }
@@ -8999,8 +9501,100 @@ function hasForumSignals(s) {
     return true;
   return hasToken2(s.jsonLdTypes, "forum") || hasToken2(s.itemTypeTokens, "forum");
 }
-function routeByCounts(c, s) {
-  if (s.productCards && !c.buyBox && !hasToken2(s.jsonLdTypes, "product")) {
+function namedNotListing(el) {
+  const name = `${el.getAttribute("id") ?? ""} ${el.getAttribute("class") ?? ""}`.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
+  return name.split(/[\s_-]+/).some((part) => NOT_LISTING_NAMES.some((word) => part.startsWith(word)));
+}
+function leadsWithLink(card) {
+  let lead = 0;
+  const walk = (node) => {
+    for (const child of Array.from(node.childNodes)) {
+      if (child.nodeType === 3) {
+        lead += ((child.textContent ?? "").match(/[\p{L}\p{N}]/gu) ?? []).length;
+        if (lead > CARD_LEAD_CHARS)
+          return false;
+      } else if (child.nodeType === 1) {
+        const el = child;
+        const href = tagOf(el) === "a" ? (el.getAttribute("href") ?? "").trim() : "";
+        if (href !== "" && !href.startsWith("#"))
+          return true;
+        const found = walk(el);
+        if (found !== null)
+          return found;
+      }
+    }
+    return null;
+  };
+  return walk(card) === true;
+}
+function largestCardGroup(doc) {
+  let best = [];
+  const inNamed = /* @__PURE__ */ new Map();
+  const insideNamed = (el) => {
+    const unsettled = [];
+    let answer = false;
+    for (let up = el; up !== null; up = up.parentElement) {
+      const known = inNamed.get(up);
+      if (known !== void 0) {
+        answer = known;
+        break;
+      }
+      unsettled.push(up);
+    }
+    for (const up of unsettled.reverse()) {
+      answer ||= namedNotListing(up);
+      inNamed.set(up, answer);
+    }
+    return answer;
+  };
+  for (const el of qsa(doc, "*")) {
+    if (el.children.length < GRID_CARDS || insideNamed(el))
+      continue;
+    const templates = /* @__PURE__ */ new Map();
+    for (const kid of Array.from(el.children)) {
+      if (!CARD_TAGS.has(tagOf(kid)) || namedNotListing(kid) || !isCard(kid) || !leadsWithLink(kid))
+        continue;
+      const template = `${tagOf(kid)} ${kid.getAttribute("class") ?? ""}`;
+      const group = templates.get(template);
+      if (group === void 0)
+        templates.set(template, [kid]);
+      else
+        group.push(kid);
+    }
+    for (const group of templates.values())
+      if (group.length > best.length)
+        best = group;
+  }
+  return best;
+}
+function hasCardGrid(doc) {
+  const cards = largestCardGroup(doc);
+  if (cards.length < GRID_CARDS)
+    return false;
+  const collapsedLength = (el) => textOf(el).replace(/\s+/g, " ").trim().length;
+  const cardSet = new Set(cards);
+  const blocks = classifyBlocks(doc);
+  const blockSet = new Set(blocks.map((b) => b.el));
+  let outside = 0;
+  for (const block of blocks) {
+    let counted = true;
+    for (let up = block.el.parentElement; up !== null; up = up.parentElement) {
+      if (cardSet.has(up) || blockSet.has(up)) {
+        counted = false;
+        break;
+      }
+    }
+    if (counted && !cardSet.has(block.el) && !STRUCTURAL_BLOCKS.has(tagOf(block.el)))
+      outside += block.length;
+  }
+  const inside = cards.reduce((sum, card) => sum + collapsedLength(card), 0);
+  return inside >= outside * 2;
+}
+function routeByCounts(c, s, doc) {
+  let grid;
+  const cardGrid = () => grid ??= hasCardGrid(doc);
+  const listedOnly = s.listedProducts >= PRODUCT_CARDS && COLLECTION_PAGE_TYPES.some((type) => hasToken2(s.pageTypes, type)) && (s.productCards || !hasToken2(s.itemTypeTokens, "product"));
+  if ((s.productCards || listedOnly) && !c.buyBox && !hasToken2(s.jsonLdTypes, "product")) {
     return { type: "collection", strategy: "article" };
   }
   if (hasProductSignals(s)) {
@@ -9012,8 +9606,8 @@ function routeByCounts(c, s) {
   if (hasForumSignals(s))
     return { type: "forum", strategy: "article" };
   if (c.buyBox && !hasArticleSignals(s))
-    return { type: "product", strategy: "product" };
-  if (c.main >= 1 && c.p >= 3 && c.headings >= 2) {
+    return { type: "product", strategy: "product", buyBox: true };
+  if (c.main >= 1 && c.p >= 3 && c.headings >= 2 && !cardGrid()) {
     return { type: "article", strategy: "article" };
   }
   const textInTables = c.tableChars >= c.textChars * 0.5;
@@ -9035,13 +9629,15 @@ function routeByCounts(c, s) {
   if (c.textChars > 3e3 && c.headings >= 5 && c.a >= 20) {
     return { type: "collection", strategy: "article" };
   }
+  if (cardGrid())
+    return { type: "collection", strategy: "article" };
   return { type: "article", strategy: "article" };
 }
 function pageSignalsFor(doc) {
   return collectPageSignals(doc);
 }
 function routePage(doc, signals = collectPageSignals(doc)) {
-  return routeByCounts(countAll(doc), signals);
+  return routeByCounts(countAll(doc), signals, doc);
 }
 function selectList(doc) {
   let best = null;
@@ -9086,9 +9682,39 @@ function textOutsideLinks(node) {
   return text2;
 }
 function isCard(item) {
-  if (qsa(item, "a[href]").length === 0)
+  const links = qsa(item, "a[href]");
+  if (links.length === 0)
     return false;
-  return (textOutsideLinks(item).match(/[\p{L}\p{N}]/gu) ?? []).length >= 3;
+  if ((textOutsideLinks(item).match(/[\p{L}\p{N}]/gu) ?? []).length >= 3)
+    return true;
+  return links.some((link2) => qsa(link2, "h2,h3,h4,h5,h6").some((heading2) => /[\p{L}\p{N}]/u.test(textOf(heading2))));
+}
+function alikeCards(cards) {
+  const byTag = /* @__PURE__ */ new Map();
+  for (const card of cards) {
+    const group = byTag.get(tagOf(card));
+    if (group === void 0)
+      byTag.set(tagOf(card), [card]);
+    else
+      group.push(card);
+  }
+  let most = 0;
+  for (const group of byTag.values()) {
+    const classes = group.map((card) => new Set(splitTokens(card.getAttribute("class") ?? "")));
+    const classless = classes.every((set2) => set2.size === 0);
+    const shared = [...classes[0]].some((name) => classes.every((set2) => set2.has(name)));
+    if (classless || shared) {
+      most = Math.max(most, group.length);
+      continue;
+    }
+    const exact = /* @__PURE__ */ new Map();
+    for (const set2 of classes) {
+      const key = [...set2].sort().join(" ");
+      exact.set(key, (exact.get(key) ?? 0) + 1);
+    }
+    most = Math.max(most, ...exact.values());
+  }
+  return most;
 }
 function selectCardList(doc) {
   const h1s = qsa(doc, "h1");
@@ -9104,14 +9730,7 @@ function selectCardList(doc) {
       continue;
     if (el.closest("header") !== null)
       continue;
-    const templates = /* @__PURE__ */ new Map();
-    for (const kid of Array.from(el.children)) {
-      if (!isCard(kid))
-        continue;
-      const template = `${kid.tagName} ${kid.getAttribute("class") ?? ""}`;
-      templates.set(template, (templates.get(template) ?? 0) + 1);
-    }
-    const cards = Math.max(0, ...templates.values());
+    const cards = alikeCards(Array.from(el.children).filter(isCard));
     if (cards >= 3 && cards > bestCards) {
       bestCards = cards;
       best = el;
@@ -9235,10 +9854,11 @@ function elementCounts(doc) {
   }
   return counts;
 }
-var PRODUCT_CARDS, PRICE_ITEMPROPS, ARTICLE_TYPES, DETECTED_LIST_ITEMS, DETECTED_ITEM_CHARS;
+var PRODUCT_CARDS, PRICE_ITEMPROPS, ARTICLE_TYPES, GRID_CARDS, CARD_TAGS, CARD_LEAD_CHARS, STRUCTURAL_BLOCKS, NOT_LISTING_NAMES, COLLECTION_PAGE_TYPES, DETECTED_LIST_ITEMS, DETECTED_ITEM_CHARS;
 var init_route = __esm({
   "packages/extract-tf/dist/route.js"() {
     "use strict";
+    init_classify();
     init_detectList();
     init_dom();
     init_prune();
@@ -9247,6 +9867,12 @@ var init_route = __esm({
     PRODUCT_CARDS = 3;
     PRICE_ITEMPROPS = ["price", "offers", "sku", "gtin", "mpn", "brand"];
     ARTICLE_TYPES = ["article", "newsarticle", "blogposting", "report", "scholarlyarticle", "techarticle"];
+    GRID_CARDS = 4;
+    CARD_TAGS = /* @__PURE__ */ new Set(["li", "div", "article", "section"]);
+    CARD_LEAD_CHARS = 24;
+    STRUCTURAL_BLOCKS = /* @__PURE__ */ new Set(["li", "td", "th"]);
+    NOT_LISTING_NAMES = ["comment", "reply", "replies", "reference", "reflist", "cite", "citation", "footnote", "endnote"];
+    COLLECTION_PAGE_TYPES = ["collectionpage", "searchresultspage"];
     DETECTED_LIST_ITEMS = 3;
     DETECTED_ITEM_CHARS = 40;
   }
@@ -9322,9 +9948,9 @@ function deliveryLocation(doc) {
     const raw = text(doc, selector);
     if (raw === null || /^update\s+location$/i.test(raw))
       continue;
-    const normalized = clean(raw.replace(/^deliver(?:ing|y)?\s+to\s+/i, "").replace(/[–—-]?\s*update\s+location\s*$/i, "").replace(/\b(Singapore)\s*(\d{6})\b/i, "$1 $2"));
-    if (normalized !== null)
-      return { value: normalized, selector };
+    const normalized2 = clean(raw.replace(/^deliver(?:ing|y)?\s+to\s+/i, "").replace(/[–—-]?\s*update\s+location\s*$/i, "").replace(/\b(Singapore)\s*(\d{6})\b/i, "$1 $2"));
+    if (normalized2 !== null)
+      return { value: normalized2, selector };
   }
   return null;
 }
@@ -9392,8 +10018,8 @@ function verifyProductIdentity(doc, url, selectedVariants) {
   const requestedId = amazonAsin(url) ?? "";
   const witnesses = [];
   const asin = (value) => {
-    const normalized = clean(value)?.toUpperCase();
-    return normalized && /^[A-Z0-9]{10}$/.test(normalized) ? normalized : null;
+    const normalized2 = clean(value)?.toUpperCase();
+    return normalized2 && /^[A-Z0-9]{10}$/.test(normalized2) ? normalized2 : null;
   };
   const add = (value, path) => {
     const id = asin(value);
@@ -9645,8 +10271,8 @@ function clean2(value) {
   const next = (value ?? "").replace(/\s+/g, " ").trim();
   return next.length > 0 ? next : null;
 }
-function field2(raw, source, path, normalized = raw) {
-  return { raw, normalized, source, path, status: "confirmed" };
+function field2(raw, source, path, normalized2 = raw) {
+  return { raw, normalized: normalized2, source, path, status: "confirmed" };
 }
 function record2(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
@@ -10234,7 +10860,10 @@ function pickTitle(doc, main) {
   const docTitle = doc.querySelector("title");
   return docTitle ? textOf(docTitle).trim() : null;
 }
-function confidenceOf(blocksLen, main, totalBlocks, mainLength, pageType, favorPrecision, favorRecall, product) {
+function showsBuyBox(main, price) {
+  return main.querySelector("h1,h2") !== null && textOf(main).replace(/\s+/g, " ").includes(price.replace(/\s+/g, " ").trim());
+}
+function confidenceOf(blocksLen, main, totalBlocks, mainLength, pageType, productShown, favorPrecision, favorRecall, product) {
   let conf = totalBlocks > 0 ? blocksLen / totalBlocks : 0;
   if (main && ["ARTICLE", "MAIN"].includes(main.tagName))
     conf = Math.min(1, conf + 0.15);
@@ -10244,6 +10873,8 @@ function confidenceOf(blocksLen, main, totalBlocks, mainLength, pageType, favorP
     conf = Math.min(conf, 0.75);
   if (product !== null && main !== null && product.name !== null && product.price !== null && product.name.source !== "text" && product.price.source !== "text") {
     conf = Math.max(conf, 0.6);
+  } else if (productShown) {
+    conf = Math.max(conf, BUY_BOX_CONFIDENCE);
   }
   if (favorPrecision)
     conf = Math.min(conf, 0.85);
@@ -10251,7 +10882,16 @@ function confidenceOf(blocksLen, main, totalBlocks, mainLength, pageType, favorP
     conf = Math.max(conf, 0.3);
   return Math.round(conf * 100) / 100;
 }
-var DEFAULT_CLASSIFY, ExtractTf, extractTf;
+function showsDeclaredProduct(main, product) {
+  if (main === null || product === null || product.name === null || product.price === null)
+    return false;
+  if (product.name.source === "text" || product.price.source === "text")
+    return false;
+  const text2 = textOf(main).replace(/\s+/g, " ");
+  const price = product.price.value.replace(/[^\d.,]/g, "");
+  return text2.includes(product.name.value.replace(/\s+/g, " ").trim()) && price !== "" && text2.includes(price);
+}
+var DEFAULT_CLASSIFY, BUY_BOX_CONFIDENCE, DESCRIPTION_MIN_CHARS, ExtractTf, extractTf;
 var init_extract = __esm({
   "packages/extract-tf/dist/extract.js"() {
     "use strict";
@@ -10272,6 +10912,8 @@ var init_extract = __esm({
       minTextLength: 25,
       maxLinkDensity: 0.2
     };
+    BUY_BOX_CONFIDENCE = 0.45;
+    DESCRIPTION_MIN_CHARS = 150;
     ExtractTf = class {
       extract(html2, options = {}) {
         const { favorPrecision = false, favorRecall = false, pruneSelectors, includeSelectors, blockAds = true } = options;
@@ -10291,10 +10933,13 @@ var init_extract = __esm({
         const fetchPreloads = Array.from(doc.document.querySelectorAll("link[rel][as]")).filter((link2) => (link2.getAttribute("rel") ?? "").toLowerCase().split(/\s+/).includes("preload") && (link2.getAttribute("as") ?? "").trim().toLowerCase() === "fetch").length;
         const raw = rawSignals(doc.document);
         const excluded = namedBy(doc.document, pruneSelectors ?? []);
+        const optionGroups = markOptionGroups(doc.document, excluded);
         cleanTree(doc.document, excluded);
         pruneTree(doc.document, { blockAds });
         detachAll(excluded);
         const decision = amazonProduct ? { type: "product", strategy: "product" } : routePage(doc.document, signals);
+        settleOptionGroups(optionGroups, decision.type === "product");
+        const dataShown = decision.buyBox === true && raw.hydrationJson.length > 0 && hydrationShown(raw, doc.document);
         if (decision.type === "product")
           pruneRecommendations(doc.document);
         const classifyOptions = { ...DEFAULT_CLASSIFY, favorPrecision };
@@ -10354,6 +10999,7 @@ var init_extract = __esm({
         }
         const blocks = classifyBlocks(doc.document, classifyOptions);
         const mainLength = main ? textOf(main).length : 0;
+        const productShown = decision.buyBox === true && main !== null && product !== null && product.price !== null && showsBuyBox(main, product.price.value) && blocks.some((b) => main.contains(b.el) && !/^h[1-6]$/.test(b.el.tagName.toLowerCase()) && b.length >= DESCRIPTION_MIN_CHARS);
         const adapter = amazonProduct ? adapterFor(doc.document, options.url, product) : preliminaryAdapter;
         const selection = includeSelectors !== void 0 && includeSelectors.length > 0 ? selectionBody(html2, includeSelectors, pruneSelectors) : null;
         const selected = selection !== null && !selection.blank;
@@ -10362,7 +11008,7 @@ var init_extract = __esm({
           mainHtml: selection !== null ? selection.html : main ? outerHtml(main) : "",
           baseUrl,
           metadata,
-          confidence: selected ? 1 : confidenceOf(blocks.filter((b) => main?.contains(b.el)).length, main, blocks.length, mainLength, decision.type, favorPrecision, favorRecall, product),
+          confidence: selected ? 1 : confidenceOf(blocks.filter((b) => main?.contains(b.el)).length, main, blocks.length, mainLength, decision.type, productShown, favorPrecision, favorRecall, product),
           // Escalate only when a strategy produced nothing at all. Routing to a
           // non-article strategy is not by itself an escalation reason.
           escalate: main === null,
@@ -10375,7 +11021,12 @@ var init_extract = __esm({
           adapterValidation: amazonValidation ?? adapter.validation,
           emptyTableShells,
           fetchPreloads,
-          render: detectRenderSignals(raw, doc.document),
+          render: detectRenderSignals(raw, doc.document, {
+            productShown,
+            hydrationShown: dataShown,
+            contentShown: showsDeclaredProduct(main, product),
+            listing: decision.type === "listing" || decision.type === "collection"
+          }),
           labelledValues: main ? collectLabelledValues(main) : [],
           timings: { parseMs, extractMs: Math.max(0, performance.now() - extractionStart) }
         };
@@ -11627,11 +12278,25 @@ function errorCode3(error) {
   return null;
 }
 function robotsOverrideWarning(decision, override) {
-  const rules = decision.appliedRules.map((rule) => rule.pattern).join(", ");
+  const robotsUrl = decision.robotsUrl ?? "robots.txt";
+  const verdict = decision.unreachable === void 0 ? `${robotsUrl} disallows this URL (rule ${decision.appliedRules.map((rule) => rule.pattern).join(", ")})` : `${robotsUrl} could not be read (${decision.unreachable}), which counts as a complete disallow`;
   const who = override.recordedBy === void 0 ? "" : ` by ${override.recordedBy}`;
+  const why = override.basis === "user_named_url" ? "it was fetched because the request named it: robots.txt binds the links a crawl or map discovers, not the URLs a person names" : override.basis === "ignore_robots_txt" ? "it was fetched because the crawl or map was started with ignoreRobotsTxt" : `it was fetched under an override recorded${who}: ${override.reason}`;
+  return { code: "robots_overridden", message: `${verdict}; ${why}` };
+}
+function applicableOverride(override, decision) {
+  if (override?.basis !== void 0 && isOctocrawlRobotsGroup(decision.matchedUserAgentGroup))
+    return void 0;
+  return override;
+}
+function overriddenDetail(url, decision, override) {
   return {
-    code: "robots_overridden",
-    message: `${decision.robotsUrl ?? "robots.txt"} disallows this URL (rule ${rules}); it was fetched under an override recorded${who}: ${override.reason}`
+    url,
+    appliedRules: decision.appliedRules,
+    ...decision.unreachable === void 0 ? {} : { unreachable: decision.unreachable },
+    reason: override.reason,
+    ...override.recordedBy === void 0 ? {} : { recordedBy: override.recordedBy },
+    basis: override.basis ?? "robots_override"
   };
 }
 function robotsOverrideApplied(trace, warning) {
@@ -11809,11 +12474,13 @@ var init_robotsLookup = __esm({
           path = parsed.pathname + parsed.search;
         } catch {
         }
-        const match = evaluateRobots(cached.robots, robotsAgent(userAgent), path);
+        const agent = robotsAgent(userAgent);
+        const match = evaluateRobots(cached.robots, agent, path);
+        const own = matchRobotsGroup(cached.robots, agent)?.agents.find((token) => isOctocrawlRobotsGroup(token));
         return {
           robotsUrl: cached.robotsUrl,
           robotsSha256: cached.sha256,
-          matchedUserAgentGroup: match.matchedAgent,
+          matchedUserAgentGroup: own ?? match.matchedAgent,
           appliedRules: match.appliedRules.map((r) => ({ pattern: r.pattern, allow: r.allow })),
           decision: match.allowed ? "allowed" : "disallowed",
           skippedFetch: false,
@@ -11930,7 +12597,7 @@ var init_provider2 = __esm({
           { at: 0, lane: "provider", event: "provider_selected", detail: { provider: this.provider.id } }
         ];
         const preflight = evaluateProviderGate(this.provider, null, "/");
-        if (preflight.refusal === "refused_capability" || preflight.refusal === "undeclared_user_agent") {
+        if (preflight.refusal === "refused_capability" || preflight.refusal === "ungranted_capability" || preflight.refusal === "undeclared_user_agent") {
           return this.denied(url, start, trace, preflight, {
             robotsUrl: null,
             robotsSha256: null,
@@ -12404,14 +13071,14 @@ var init_provider2 = __esm({
 });
 
 // packages/cli/src/run.ts
-import { mkdir as mkdir9, readFile as readFile6, writeFile as writeFile8 } from "fs/promises";
+import { mkdir as mkdir9, readFile as readFile7, writeFile as writeFile9 } from "fs/promises";
 import { join as join12 } from "path";
 
 // packages/api/dist/app.js
 import { Hono } from "hono";
 import { streamSSE } from "hono/streaming";
 import { createNodeWebSocket } from "@hono/node-ws";
-import { createHash as createHash14 } from "crypto";
+import { createHash as createHash15 } from "crypto";
 
 // packages/runtime/dist/taskStore.js
 function assertId(label, value) {
@@ -13323,6 +13990,7 @@ var CrawlOrchestrator = class {
   frontierOptions;
   workerCount;
   signal;
+  scrapeErrorCostUsd;
   shutdownSignal;
   sitemapSource;
   onStep;
@@ -13335,6 +14003,7 @@ var CrawlOrchestrator = class {
     this.frontierOptions = options;
     this.workerCount = Math.max(1, options.workerCount ?? 4);
     this.signal = options.signal;
+    this.scrapeErrorCostUsd = options.scrapeErrorCostUsd === void 0 ? null : options.scrapeErrorCostUsd;
     this.shutdownSignal = options.shutdownSignal;
     this.sitemapSource = options.sitemapSource;
     this.onStep = options.onStep;
@@ -13552,7 +14221,7 @@ var CrawlOrchestrator = class {
               } catch (error) {
                 if (stopped())
                   throw error;
-                outcome = { result: scrapeErrorResult(item.url, error, Date.now() - scrapeStartedAt), links: [] };
+                outcome = { result: scrapeErrorResult(item.url, error, Date.now() - scrapeStartedAt, this.scrapeErrorCostUsd), links: [] };
               }
               result = outcome.result;
               links = outcome.links.length > 0 ? outcome.links : linksOf(outcome.result);
@@ -13954,7 +14623,7 @@ function newAttempt(id, taskId, startedAt, recoveredFromAttemptId = null) {
     recoveredFromAttemptId
   };
 }
-function scrapeErrorResult(url, error, wallMs) {
+function scrapeErrorResult(url, error, wallMs, externalCostUsd) {
   const name = error instanceof Error ? error.name : typeof error;
   const message2 = error instanceof Error ? error.message : String(error);
   return {
@@ -13971,7 +14640,7 @@ function scrapeErrorResult(url, error, wallMs) {
     truncatedAt: null,
     compliance: null,
     evidence: { finalUrl: url, httpStatus: null, redirectChain: [], contentType: null, rawBodySha256: null, artifacts: [] },
-    usage: { ...EMPTY_USAGE, wallMs, bytesWire: null },
+    usage: { ...EMPTY_USAGE, wallMs, bytesWire: null, externalCostUsd },
     trace: [{ at: wallMs, lane: "http", event: "scrape_error", detail: { name, error: message2.slice(0, 500) } }]
   };
 }
@@ -15657,9 +16326,40 @@ function toEvidenceRecord(result, request7, output, options = {}) {
       device: requested ? declaredDevice(result) : null,
       requestHeaders: requested ? sentCustomHeaders(result) : null
     },
-    pageActions: pageActions(result)
+    pageActions: pageActions(result),
+    access: evidenceAccess(result)
   };
 }
+function evidenceAccess(result) {
+  const event = (name) => result.trace.find((e) => e.event === name)?.detail;
+  const text2 = (value) => typeof value === "string" && value !== "" ? value : null;
+  const hit = event("cache_hit");
+  const stored = hit?.externalCostUsd;
+  const externalCostUsd = hit === void 0 ? result.usage.externalCostUsd ?? null : typeof stored === "number" ? stored : null;
+  const route = (r, executor, executorVersion = null, profile = null) => ({ route: r, executor, executorVersion, profile, externalCostUsd });
+  const laneRan = result.trace.some((e) => e.event === "identity_sent" || e.event === "identity_declared" || e.event === "provider_selected");
+  if (!laneRan)
+    return route(null, null);
+  switch (result.lane) {
+    case "http": {
+      const transport = event("transport");
+      return transport === void 0 ? route("http", "undici") : route("http_compat", text2(transport.library), text2(transport.version), text2(transport.profile));
+    }
+    case "browser_local":
+    case "browser_proxy": {
+      const engine = event("browser_engine");
+      if (event("session_attached") !== void 0)
+        return route("authed_browser", "playwright");
+      return engine !== void 0 && engine.engine === "patchright" ? route("enhanced_browser", "patchright", text2(engine.version)) : route("browser", "playwright");
+    }
+    case "browser_local_authed": {
+      const read2 = event("user_browser_read");
+      return read2 === void 0 ? route("authed_browser", "playwright") : route("user_browser", text2(read2.browser));
+    }
+    case "provider":
+      return route("vendor", text2(event("provider_selected")?.provider));
+  }
+}
 function pageActions(result) {
   if (result.actions === void 0)
     return null;
@@ -15704,11 +16404,13 @@ function robotsDecision(result) {
       robotsSha256: signed.robotsSha256,
       unreachable: signed.unreachable ?? null,
       crawlDelayMs: signed.crawlDelayMs ?? null,
-      // A recorded robots override set the disallow aside; the record carries it.
-      userOverride: signed.override !== void 0
+      // An override set the disallow aside; the record carries it and on whose word.
+      userOverride: signed.override !== void 0,
+      overrideBasis: signed.override === void 0 ? null : signed.override.basis ?? "robots_override"
     };
   }
   const detail = [...result.trace].reverse().find((event) => event.event === "robots_checked")?.detail;
+  const overridden = result.trace.find((event) => event.event === "robots_overridden");
   const decision = detail?.decision;
   if (decision !== "allowed" && decision !== "disallowed" && decision !== "no_robots")
     return null;
@@ -15721,10 +16423,14 @@ function robotsDecision(result) {
     robotsSha256: typeof detail?.robotsSha256 === "string" ? detail.robotsSha256 : null,
     unreachable: typeof detail?.unreachable === "string" ? detail.unreachable : null,
     crawlDelayMs: typeof detail?.crawlDelayMs === "number" ? detail.crawlDelayMs : null,
-    // The HTTP lane mints no record; its trace says when a recorded override set the disallow aside.
-    userOverride: result.trace.some((event) => event.event === "robots_overridden")
+    // The HTTP lane mints no record; its trace says when an override set the disallow aside, and on whose word.
+    userOverride: overridden !== void 0,
+    overrideBasis: overridden === void 0 ? null : overrideBasisOf(overridden.detail?.basis)
   };
 }
+function overrideBasisOf(value) {
+  return value === "user_named_url" || value === "ignore_robots_txt" ? value : "robots_override";
+}
 function identityEvent(trace) {
   const detail = trace.find((event) => event.event === "identity_sent")?.detail;
   if (detail === void 0)
@@ -15816,7 +16522,7 @@ function pageCacheKey(url, parts) {
   return requestFingerprint({ v: 1, url: href, ...parts });
 }
 function cacheHitResult(hit) {
-  const event = { at: 0, lane: hit.result.lane, event: "cache_hit", detail: { cachedAt: hit.fetchedAt, ageMs: hit.ageMs } };
+  const event = { at: 0, lane: hit.result.lane, event: "cache_hit", detail: { cachedAt: hit.fetchedAt, ageMs: hit.ageMs, externalCostUsd: hit.result.usage.externalCostUsd ?? null } };
   return { ...hit.result, trace: [...hit.result.trace, event] };
 }
 function cacheMissResult(url, bounds) {
@@ -15834,7 +16540,7 @@ function cacheMissResult(url, bounds) {
     truncatedAt: null,
     compliance: null,
     evidence: { finalUrl: url, httpStatus: null, redirectChain: [], contentType: null, rawBodySha256: null, artifacts: [] },
-    usage: { wallMs: 0, bytesWire: 0, bytesDecompressed: 0, requestCount: 0, attemptCount: 0, contentTokens: null, browserMs: 0, externalCostUsd: null },
+    usage: { wallMs: 0, bytesWire: 0, bytesDecompressed: 0, requestCount: 0, attemptCount: 0, contentTokens: null, browserMs: 0, externalCostUsd: 0 },
     trace: [{ at: 0, lane: "http", event: "cache_miss", detail: { lockdown: true, ...bounds } }]
   };
 }
@@ -15937,6 +16643,8 @@ ${title ?? ""}`.toLowerCase();
           const verdict = await this.sources.robotsVerdict(canonicalUrl, scope);
           if (typeof verdict === "string")
             return verdict;
+          if (verdict.octocrawl === true)
+            return "octocrawl";
           return verdict.unreachable === void 0 ? "disallowed" : { unreachable: verdict.unreachable };
         } catch (error) {
           if (cancelled())
@@ -16024,6 +16732,8 @@ ${title ?? ""}`.toLowerCase();
             seen.refused++;
         }
       };
+      const ignoreRobots = spec.ignoreRobotsTxt === true;
+      const linkVerdict = (verdict) => typeof verdict === "object" ? "unreachable" : verdict;
       const titleOf = (found) => found.via === "link" ? found.text : found.entry.title;
       const offer = async (result, found) => {
         if (!result.accepted) {
@@ -16084,7 +16794,11 @@ ${title ?? ""}`.toLowerCase();
           refused.robotsUnchecked++;
           return false;
         }
-        if (verdict === "disallowed" || typeof verdict === "object") {
+        if (verdict === "octocrawl") {
+          refuseRobots(canonicalUrl, "disallowed");
+          return false;
+        }
+        if ((verdict === "disallowed" || typeof verdict === "object") && !ignoreRobots) {
           refuseRobots(canonicalUrl, verdict);
           return false;
         }
@@ -16093,22 +16807,25 @@ ${title ?? ""}`.toLowerCase();
           limitReached = true;
           return true;
         }
-        add(canonicalUrl, found, verdict);
+        add(canonicalUrl, found, linkVerdict(verdict));
         return true;
       };
       let startPage = null;
       let clientRendered = false;
       if (sitemapMode !== "only") {
-        const startVerdict = await verdictFor(startCanonical);
+        const fullStartVerdict = await verdictFor(startCanonical);
+        const startVerdict = fullStartVerdict === "octocrawl" ? "disallowed" : fullStartVerdict;
+        const startRefused = fullStartVerdict === "octocrawl" || !ignoreRobots;
         const blank = { url: spec.url, finalUrl: null, httpStatus: null, lane: "http", rawBodySha256: null, linksFound: 0, title: null, description: null };
-        if (startVerdict === "disallowed" || typeof startVerdict === "object") {
+        if ((startVerdict === "disallowed" || typeof startVerdict === "object") && startRefused) {
           refuseRobots(startCanonical, startVerdict);
           startPage = typeof startVerdict === "object" ? { ...blank, status: "failed", failureReason: "policy_denied", robots: "unreachable", robotsUnreachable: startVerdict.unreachable } : { ...blank, status: "failed", failureReason: "policy_denied", robots: "disallowed" };
         } else if (startVerdict === "unchecked") {
           refused.robotsUnchecked++;
           startPage = { ...blank, status: "failed", failureReason: "timeout", robots: null };
         } else {
-          const startLink = { url: startCanonical, via: ["start"], robots: startVerdict };
+          const startLink = { url: startCanonical, via: ["start"], robots: linkVerdict(startVerdict) };
+          const startRobots = { robots: linkVerdict(startVerdict), ...typeof startVerdict === "object" ? { robotsUnreachable: startVerdict.unreachable } : {} };
           links.push(startLink);
           byKey.set(keyOf(startCanonical), startLink);
           const keepStartIfMatching = () => {
@@ -16125,7 +16842,7 @@ ${title ?? ""}`.toLowerCase();
             if (cancelled() || Date.now() < deadlineAt)
               throw error;
             timedOut = true;
-            startPage = { ...blank, status: "failed", failureReason: "timeout", robots: startVerdict };
+            startPage = { ...blank, status: "failed", failureReason: "timeout", ...startRobots };
             keepStartIfMatching();
           }
           if (read2 !== null) {
@@ -16139,7 +16856,7 @@ ${title ?? ""}`.toLowerCase();
               status: result.status,
               failureReason: result.failureReason,
               lane: "http",
-              robots: startVerdict,
+              ...startRobots,
               rawBodySha256: result.evidence.rawBodySha256,
               linksFound: read2.links.length,
               title: title ?? null,
@@ -16269,8 +16986,9 @@ function nonEmpty(value) {
 }
 
 // packages/api/dist/engine.js
-import { existsSync as existsSync3, mkdirSync as mkdirSync8, readdirSync, writeFileSync } from "fs";
-import { mkdir as mkdir8, readFile as readFile5, writeFile as writeFile7 } from "fs/promises";
+import { createHash as createHash13 } from "crypto";
+import { existsSync as existsSync3, mkdirSync as mkdirSync8, readdirSync, readFileSync as readFileSync3, rmSync, writeFileSync } from "fs";
+import { mkdir as mkdir8, readFile as readFile6, writeFile as writeFile8 } from "fs/promises";
 import { isIP as isIP4 } from "net";
 import { homedir as homedir2 } from "os";
 import { join as join10 } from "path";
@@ -16444,6 +17162,36 @@ ${prose2(5, 23)}
 <div class="g-recaptcha" data-sitekey="fixture"></div>`
   }))
 };
+var ROBOT_OR_HUMAN_FACT = "The exhibit opens with a quiz called Robot or human? that asks visitors to date each portrait.";
+var staticArticleRobotOrHuman = {
+  truth: {
+    id: "static-article-robot-or-human",
+    target: "/static/article-robot-or-human",
+    kind: "fixture",
+    category: "static",
+    mustContain: [ROBOT_OR_HUMAN_FACT, ARTICLE_FACT],
+    mustNotContain: B,
+    expectedLane: "http",
+    emptyIsLegit: false,
+    expectedMainTokens: { min: 260, max: 900 },
+    budget: budget(2e3),
+    expectedStatus: "success",
+    notes: `Ordinary article on a PerimeterX-protected site: the sensor sets window._pxAppId on every page (Walmart's home page did on 2026-10-05), and the prose says "Robot or human?". Neither is the challenge, so a contentful page must stay success.`
+  },
+  respond: () => html(htmlPage({
+    title: "Kiln temperatures and glaze vitrification",
+    headExtra: "<script>window._pxAppId='PXfixture1'</script>",
+    bodyHtml: `<article>
+<h1>Kiln temperatures and glaze vitrification</h1>
+<p>${ROBOT_OR_HUMAN_FACT}</p>
+<p>${ARTICLE_FACT}</p>
+${prose2(6, 11)}
+<h2>Estuary sediment</h2>
+<p>${ARTICLE_FACT_2}</p>
+${prose2(5, 23)}
+</article>`
+  }))
+};
 var CJK_FACT = "\u7A91\u6E29\u8FBE\u5230\u4E00\u5343\u4E8C\u767E\u56DB\u5341\u5EA6\u540E\u91C9\u9762\u5F00\u59CB\u73BB\u5316\u3002";
 var staticCjk = {
   truth: {
@@ -17363,6 +18111,71 @@ var blockLoginWallBenefits = {
 </body></html>`
   })
 };
+var blockPerimeterX = {
+  truth: {
+    id: "block-perimeterx",
+    target: "/block/perimeterx",
+    kind: "fixture",
+    category: "blocked",
+    mustContain: [],
+    mustNotContain: ["Robot or human?", "Activate and hold the button"],
+    expectedLane: "http",
+    emptyIsLegit: false,
+    expectedMainTokens: null,
+    budget: budget(500),
+    expectedStatus: "blocked",
+    expectedBlockReason: "captcha",
+    notes: "Shaped like the PerimeterX press-and-hold page Walmart served with HTTP 200 (after a 307 to /blocked) on 2026-10-05, which browser_local returned as success. The widget renders into #px-captcha from the captcha script the page loads, configured by window._pxAppId. captcha, not bot_detected_generic: the button needs a person to press and hold it, and the browser lane had already run the page's JS when it got this page."
+  },
+  respond: () => ({
+    status: 200,
+    headers: { "content-type": "text/html; charset=utf-8" },
+    body: `<!doctype html><html lang="en"><head><title>Robot or human?</title>
+<script>window._pxAppId = 'PXfixture1'; window._pxJsClientSrc = '/px/' + window._pxAppId + '/init.js'; window._pxFirstPartyEnabled = true;
+var captchajs = "/px/" + window._pxAppId + "/captcha/captcha.js?a=c&m=0&g=b"</script>
+</head><body><div id="sign-in-widget"><a class="header-logo" href="/" aria-label="Home Page"></a>
+<h1 class="heading">Robot or human?</h1>
+<div class="re-captcha"><p class="bot-message" id="message">Activate and hold the button to confirm that you\u2019re human. Thank You!</p>
+<div id="px-captcha" style="margin:16px"></div></div>
+<div class="lite-footer"><a href="/terms">Terms of Use</a> <a href="/privacy">Privacy Policy</a><p>\xA9 Fixture Stores, Inc.</p></div>
+</div><script id="blockScript"></script><script>document.getElementById('blockScript').src = captchajs</script></body></html>`
+  })
+};
+var blockPerimeterX429 = {
+  truth: {
+    id: "block-perimeterx-429",
+    target: "/block/perimeterx-429",
+    kind: "fixture",
+    category: "blocked",
+    mustContain: [],
+    mustNotContain: ["Press & Hold"],
+    expectedLane: "http",
+    emptyIsLegit: false,
+    expectedMainTokens: null,
+    budget: budget(500),
+    expectedStatus: "blocked",
+    expectedBlockReason: "captcha",
+    notes: "Shaped like the PerimeterX stock block template Wayfair (and its sibling stores) served with HTTP 429 and no Retry-After on 2026-10-05. The status says rate limit, the page is the press-and-hold challenge: captcha, because a person can get through it and slowing down does not."
+  },
+  respond: () => ({
+    status: 429,
+    headers: { "content-type": "text/html" },
+    body: `<!DOCTYPE html><html lang="en"><head><meta charset="utf-8">
+<meta name="description" content="px-captcha"><title>Access to this page has been denied</title></head>
+<body><script>
+window._pxVid = ''; window._pxUuid = '00000000-0000-4000-8000-000000000000'; window._pxAppId = 'PXfixture2';
+window._pxHostUrl = '/fixture2/xhr'; window._pxJsClientSrc = '/fixture2/init.js'; window._pxFirstPartyEnabled = true;
+var pxCaptchaSrc = '/fixture2/captcha/captcha.js?a=c&u=00000000-0000-4000-8000-000000000000&v=&m=0';
+var script = document.createElement('script'); script.src = pxCaptchaSrc; script.onerror = onScriptError; document.head.appendChild(script);
+function onScriptError() { script = document.createElement('script');
+  script.src = 'https://captcha.px-cloud.net/PXfixture2/captcha.js?a=c&u=00000000-0000-4000-8000-000000000000&v=&m=0';
+  document.head.appendChild(script); }
+window._pxOnError = function () { var div = document.createElement('div');
+  div.innerHTML = '<div>Before we continue...</div><div>Press & Hold to confirm you are a human (and not a bot).</div>';
+  document.body.appendChild(div); };
+</script></body></html>`
+  })
+};
 var SOFT404_TEXT = "We could not find that page";
 var soft404 = {
   truth: {
@@ -17784,6 +18597,7 @@ var homePage = {
 var FIXTURES = [
   staticArticle,
   staticArticleWithWidget,
+  staticArticleRobotOrHuman,
   staticCjk,
   staticTable,
   t_thead,
@@ -17821,6 +18635,8 @@ var FIXTURES = [
   blockRateLimit,
   blockLoginWall,
   blockLoginWallBenefits,
+  blockPerimeterX,
+  blockPerimeterX429,
   soft404,
   redirectToHome,
   redirectChain,
@@ -18021,6 +18837,264 @@ var EgressRoute = class {
   }
 };
 
+// packages/bench/dist/compatTransport.js
+init_dist();
+init_egress();
+var COMPAT_LIBRARY = { name: "impit", version: "0.14.5" };
+var COMPAT_PROFILES = {
+  chrome142: {
+    browser: "chrome142",
+    headers: [
+      ["sec-ch-ua", '"Chromium";v="142", "Google Chrome";v="142", "Not_A Brand";v="99"'],
+      ["sec-ch-ua-mobile", "?0"],
+      ["sec-ch-ua-platform", '"macOS"'],
+      ["upgrade-insecure-requests", "1"],
+      ["user-agent", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"],
+      ["accept", "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7"],
+      ["sec-fetch-site", "none"],
+      ["sec-fetch-mode", "navigate"],
+      ["sec-fetch-user", "?1"],
+      ["sec-fetch-dest", "document"],
+      ["accept-encoding", "gzip, deflate, br, zstd"],
+      ["accept-language", "en-US,en;q=0.9"],
+      ["priority", "u=0, i"]
+    ]
+  }
+};
+var DEFAULT_COMPAT_PROFILE = "chrome142";
+function compatIdentity(profile = DEFAULT_COMPAT_PROFILE) {
+  const sent = new Map(COMPAT_PROFILES[profile].headers);
+  return {
+    mode: "standard",
+    userAgent: sent.get("user-agent"),
+    clientHints: { "sec-ch-ua": sent.get("sec-ch-ua"), "sec-ch-ua-mobile": sent.get("sec-ch-ua-mobile"), "sec-ch-ua-platform": sent.get("sec-ch-ua-platform") },
+    respectsRobots: true,
+    lane: "browser_local",
+    device: "desktop"
+  };
+}
+function prepareCompatIdentity(profile = DEFAULT_COMPAT_PROFILE) {
+  const headers = Object.fromEntries(COMPAT_PROFILES[profile].headers.map(([name, value]) => [name, value]));
+  const sentHeaders = { headers: Object.entries(headers).map(([name, value]) => ({ name, value })).sort((a, b) => a.name.localeCompare(b.name)) };
+  return { mode: "standard", identity: compatIdentity(profile), headers, identityHeaders: headers, customHeaders: {}, sentHeaders };
+}
+var impit;
+function loadImpit() {
+  impit ??= import("impit").catch((error) => {
+    impit = void 0;
+    throw new Error(`the compatible transport needs impit ${COMPAT_LIBRARY.version}, which did not load on ${process.platform}-${process.arch}: ${error instanceof Error ? error.message : String(error)}`);
+  });
+  return impit;
+}
+var PROXY_VARIABLES = ["HTTP_PROXY", "HTTPS_PROXY", "ALL_PROXY", "NO_PROXY", "http_proxy", "https_proxy", "all_proxy", "no_proxy"];
+var NO_PROXY_ANY = "*,0.0.0.0/0,::/0";
+function withLaneProxyOnly(direct, build) {
+  const saved = PROXY_VARIABLES.map((name) => [name, process.env[name]]);
+  for (const name of PROXY_VARIABLES)
+    delete process.env[name];
+  if (direct) {
+    process.env.NO_PROXY = NO_PROXY_ANY;
+    process.env.no_proxy = NO_PROXY_ANY;
+  }
+  try {
+    return build();
+  } finally {
+    for (const [name, value] of saved) {
+      if (value === void 0)
+        delete process.env[name];
+      else
+        process.env[name] = value;
+    }
+  }
+}
+var COMPAT_REQUEST_CEILING_MS = 10 * 6e4;
+function impitTimeoutMs(deadlineAt, now = Date.now()) {
+  return deadlineAt === void 0 ? COMPAT_REQUEST_CEILING_MS : Math.max(1e3, deadlineAt - now + 1e3);
+}
+function decodingFault(message2) {
+  return /kind: Decode\b/.test(message2) && !/hyper::Error|h2::|IncompleteBody|TimedOut|ConnectionReset|ConnectionAborted|BrokenPipe/.test(message2);
+}
+var IMPIT_DECODES = /* @__PURE__ */ new Set(["gzip", "deflate", "br", "zstd"]);
+function normalized(error) {
+  const message2 = error instanceof Error ? error.message : String(error);
+  const name = error instanceof Error ? error.name : "";
+  const as = (n, code) => Object.assign(new Error(message2.split("\n")[0] ?? message2), { name: n, ...code === void 0 ? {} : { code }, cause: error });
+  if (name === "TimeoutError" || name === "AbortError")
+    return error instanceof Error ? error : as("TimeoutError");
+  if (/InvalidCertificate|certificate|handshake|tls|ssl/i.test(message2)) {
+    const code = /expired/i.test(message2) ? "CERT_HAS_EXPIRED" : /not yet valid/i.test(message2) ? "CERT_NOT_YET_VALID" : /NotValidForName|name mismatch|hostname/i.test(message2) ? "HOSTNAME_MISMATCH" : /not trusted|UnknownIssuer|self.signed/i.test(message2) ? "CERT_UNTRUSTED" : "ERR_SSL_COMPAT_TRANSPORT";
+    return as("CompatTlsError", code);
+  }
+  if (/dns error|failed to lookup|nodename nor servname|Name or service not known/i.test(message2))
+    return as("DnsLookupError");
+  return as("ConnectError");
+}
+var CompatTransport = class {
+  networkPolicy;
+  profile;
+  clients = /* @__PURE__ */ new Map();
+  constructor(networkPolicy, profile = DEFAULT_COMPAT_PROFILE) {
+    this.networkPolicy = networkPolicy;
+    this.profile = profile;
+  }
+  async clientFor(url, ignoreTlsErrors) {
+    const proxy = proxyFor(url, this.networkPolicy);
+    const auth = proxy?.username === void 0 ? "" : `${encodeURIComponent(proxy.username)}:${encodeURIComponent(proxy.password ?? "")}@`;
+    const proxyUrl = proxy === null ? void 0 : proxy.url.replace("://", `://${auth}`);
+    const key = `${proxyUrl ?? "direct"}|${ignoreTlsErrors}`;
+    let client = this.clients.get(key);
+    if (client === void 0) {
+      const { Impit } = await loadImpit();
+      client = this.clients.get(key) ?? withLaneProxyOnly(proxyUrl === void 0, () => new Impit({ browser: COMPAT_PROFILES[this.profile].browser, followRedirects: false, ...proxyUrl === void 0 ? {} : { proxyUrl }, ...ignoreTlsErrors ? { ignoreTlsErrors: true } : {} }));
+      this.clients.set(key, client);
+    }
+    return client;
+  }
+  async fetch(url, options) {
+    let response;
+    const client = await this.clientFor(url, options.ignoreTlsErrors === true);
+    const cookie = options.cookies === void 0 ? "" : await options.cookies.header(url);
+    const extraHeaders = { ...options.extraHeaders ?? {}, ...cookie === "" ? {} : { cookie } };
+    const controller2 = new AbortController();
+    const abort = () => controller2.abort(options.signal?.reason);
+    if (options.signal?.aborted === true)
+      abort();
+    else
+      options.signal?.addEventListener("abort", abort, { once: true });
+    let headersTimedOut = false;
+    const headersTimer = setTimeout(() => {
+      headersTimedOut = true;
+      controller2.abort();
+    }, options.headersTimeoutMs);
+    try {
+      response = await client.fetch(url, {
+        redirect: "manual",
+        timeout: impitTimeoutMs(options.deadlineAt),
+        signal: controller2.signal,
+        ...Object.keys(extraHeaders).length === 0 ? {} : { headers: extraHeaders }
+      });
+    } catch (error) {
+      options.signal?.removeEventListener("abort", abort);
+      if (headersTimedOut && options.signal?.aborted !== true)
+        throw Object.assign(new Error(`no response headers within ${options.headersTimeoutMs} ms`), { name: "HeadersTimeoutError", cause: error });
+      throw normalized(error);
+    } finally {
+      clearTimeout(headersTimer);
+    }
+    if (options.cookies !== void 0) {
+      const headers = response.headers;
+      await options.cookies.keep(url, headers.getSetCookie?.() ?? (headers.get("set-cookie") === null ? [] : [headers.get("set-cookie")]));
+    }
+    const coding = response.headers.get("content-encoding")?.trim() ?? null;
+    const bodiless = response.status < 200 || response.status === 204 || response.status === 304;
+    const decodedFrom = !bodiless && coding !== null && IMPIT_DECODES.has(coding) ? coding : null;
+    if (decodedFrom !== null)
+      options.onDecoded?.(decodedFrom);
+    const header = (name) => decodedFrom !== null && name.toLowerCase() === "content-encoding" ? null : response.headers.get(name);
+    let bytes;
+    const readBody = async () => {
+      const cap = options.capFor(response.headers.get("content-type"), decodedFrom);
+      const reader = response.body.getReader();
+      if (cap === null) {
+        await reader.cancel().catch(() => {
+        });
+        return new Uint8Array();
+      }
+      const declared3 = decodedFrom === null ? Number(response.headers.get("content-length") ?? NaN) : NaN;
+      if (Number.isSafeInteger(declared3) && declared3 > cap) {
+        await reader.cancel().catch(() => {
+        });
+        throw new BodyTooLargeError(cap, declared3);
+      }
+      const started = performance.now();
+      const chunks = [];
+      let total = 0;
+      try {
+        while (true) {
+          let timer;
+          const stalled = new Promise((_, reject) => {
+            timer = setTimeout(() => reject(Object.assign(new Error("body read timed out"), { name: "BodyTimeoutError" })), options.bodyTimeoutMs);
+          });
+          let step;
+          try {
+            step = await Promise.race([reader.read(), stalled]);
+          } finally {
+            clearTimeout(timer);
+          }
+          if (step.done)
+            break;
+          total += step.value.byteLength;
+          if (total > cap)
+            throw new BodyTooLargeError(cap);
+          chunks.push(step.value);
+        }
+      } catch (error) {
+        await reader.cancel().catch(() => {
+        });
+        if (error instanceof BodyTooLargeError || error instanceof Error && error.name === "BodyTimeoutError")
+          throw error;
+        if (error instanceof Error && error.name === "AbortError")
+          throw error;
+        const message2 = error instanceof Error ? error.message : String(error);
+        if (decodedFrom !== null && decodingFault(message2))
+          throw new ContentDecodingError(decodedFrom, decodedFrom, "impit_decode");
+        const timedOut = error instanceof Error && error.name === "TimeoutError" || /TimedOut/.test(message2);
+        throw Object.assign(new Error(message2.split("\n")[0] ?? message2), { name: timedOut ? "BodyTimeoutError" : "SocketError", cause: error });
+      }
+      options.onBodyRead?.(Math.max(0, performance.now() - started));
+      const out = new Uint8Array(total);
+      let offset = 0;
+      for (const chunk of chunks) {
+        out.set(chunk, offset);
+        offset += chunk.byteLength;
+      }
+      return out;
+    };
+    const bodyBytes = () => bytes ??= readBody().finally(() => options.signal?.removeEventListener("abort", abort));
+    const bodyText = async () => {
+      try {
+        return new TextDecoder().decode(await bodyBytes());
+      } catch (error) {
+        if (error instanceof ContentDecodingError)
+          return "";
+        throw error;
+      }
+    };
+    return { status: response.status, headers: { get: header }, bodyBytes, bodyText };
+  }
+};
+function compatHostsChoice(env, grant, hosted) {
+  const raw = (env.W2L_COMPAT_HOSTS ?? "").split(",").map((value) => value.trim().toLowerCase().replace(/\.$/, "")).filter(Boolean);
+  if (raw.length === 0)
+    return [];
+  const invalid = raw.filter((host) => {
+    try {
+      return new URL(`http://${host}/`).hostname !== host || host.includes("*");
+    } catch {
+      return true;
+    }
+  });
+  if (invalid.length > 0)
+    throw new Error(`W2L_COMPAT_HOSTS takes host names, such as example.com: not ${invalid.join(", ")}`);
+  if (hosted)
+    throw new Error("W2L_COMPAT_HOSTS is refused on a hosted server (ADR 0005: the compatible transport resolves host names outside the hosted address check)");
+  if (!(grant?.capabilities ?? []).includes("compatible_transport")) {
+    throw new Error("W2L_COMPAT_HOSTS needs an access grant that names compatible_transport (ADR 0005; --access-grant or W2L_ACCESS_GRANT)");
+  }
+  return [...new Set(raw)].sort();
+}
+function compatHostListed(hosts, url) {
+  if (hosts.length === 0)
+    return false;
+  let host;
+  try {
+    host = new URL(url).hostname.toLowerCase().replace(/\.$/, "");
+  } catch {
+    return false;
+  }
+  return hosts.some((listed) => host === listed || host.endsWith(`.${listed}`));
+}
+
 // packages/bench/dist/subjects/resilientHttp.js
 init_robotsLookup();
 
@@ -18292,6 +19366,7 @@ async function readFileResponse(response, bytes, context) {
 var ResilientHttpSubject = class {
   fileStore;
   previewProductToken;
+  compat;
   meta = {
     id: "resilient-http",
     displayName: "Resilient HTTP (redirect+retry \xD7 extract-tf)",
@@ -18319,12 +19394,16 @@ var ResilientHttpSubject = class {
    * `fileStore`: where files (PDF, CSV, ...) are saved as received; without one a file is read but not saved.
    * `previewProductToken`: the hosted public preview's standard User-Agent carries PREVIEW_PRODUCT_TOKEN (previewIdentity).
    * `robotsCache`: a robots.txt cache shared with the crawl's sitemap reader, so one robots.txt read serves both; without one the subject keeps its own.
+   * `compat`: the browser-compatible transport (compatTransport.ts) in place of undici, with its profile's identity; standard mode on a local server only.
    */
-  constructor(mode = "standard", networkPolicy, scheduler, localPreviewProxyUrl, localPreviewRobotsException = false, fileStore = null, previewProductToken = false, robotsCache) {
+  constructor(mode = "standard", networkPolicy, scheduler, localPreviewProxyUrl, localPreviewRobotsException = false, fileStore = null, previewProductToken = false, robotsCache, compat = null) {
     this.fileStore = fileStore;
     this.previewProductToken = previewProductToken;
+    this.compat = compat;
     this.networkPolicy = networkPolicy ?? defaultNetworkPolicy();
-    this.prepared = prepareHttpIdentity(mode, this.networkPolicy.contact ?? null, null, "desktop", void 0, previewProductToken);
+    if (compat !== null && (mode !== "standard" || previewProductToken || localPreviewProxyUrl !== void 0))
+      throw new Error(`the compatible transport sends its profile's standard identity: not for ${mode !== "standard" ? `mode ${mode}` : "the hosted preview"}`);
+    this.prepared = compat !== null ? prepareCompatIdentity(compat.profile) : prepareHttpIdentity(mode, this.networkPolicy.contact ?? null, null, "desktop", void 0, previewProductToken);
     if (localPreviewRobotsException && !localPreviewProxyUrl)
       throw new Error("Local platform exception requires a loopback proxy");
     this.localPreviewRobotsException = localPreviewRobotsException;
@@ -18336,27 +19415,50 @@ var ResilientHttpSubject = class {
     this.route = new EgressRoute(this.networkPolicy, this.egress, this.localPreviewProxy);
     this.robotsCache = robotsCache ?? new RobotsOriginCache(this.networkPolicy, (url) => this.dispatcherFor(url));
     const maxBodyBytes = this.networkPolicy.maxBodyBytes;
-    this.fetcherFor = (initialUrl, headers, validators, signal, onBodyRead, onRequestWait, onEnvProxy, maxFileBytes = fileByteCap(this.networkPolicy), wire, routes = null) => async (url, init) => {
+    this.fetcherFor = (initialUrl, headers, validators, signal, onBodyRead, onRequestWait, onEnvProxy, maxFileBytes = fileByteCap(this.networkPolicy), wire, routes = null, onResponseCoding, deadlineAt, cookies) => async (url, init) => {
       await this.scheduler.beforeRequest(new URL(url).origin, init.signal ?? signal, onRequestWait);
       const envProxy = this.envProxyFor(url);
       if (envProxy !== null)
         onEnvProxy?.(url, envProxy);
+      if (this.compat !== null) {
+        onResponseCoding?.(null);
+        return this.compat.fetch(url, {
+          ...cookies === void 0 ? {} : { cookies },
+          signal: init.signal ?? signal,
+          headersTimeoutMs: init.headersTimeoutMs,
+          bodyTimeoutMs: init.bodyTimeoutMs,
+          capFor: (contentType, decodedFrom) => {
+            const kind = classifyContentType(contentType);
+            return kind === "unsupported" ? null : kind === "page" ? decodedFrom === null ? maxBodyBytes : this.networkPolicy.maxDecompressedBytes : maxFileBytes;
+          },
+          extraHeaders: url === initialUrl ? validators.etag ? { "if-none-match": validators.etag } : validators.lastModified ? { "if-modified-since": validators.lastModified } : {} : {},
+          ignoreTlsErrors: routes !== null,
+          ...deadlineAt === void 0 ? {} : { deadlineAt },
+          onDecoded: (coding) => onResponseCoding?.(coding),
+          ...onBodyRead === void 0 ? {} : { onBodyRead }
+        });
+      }
       const customNames = wire === void 0 ? [] : Object.keys(wire.headers);
       const sameOrigin2 = new URL(url).origin === new URL(initialUrl).origin;
       if (wire !== void 0 && customNames.length > 0 && !sameOrigin2)
         wire.onWithheld(url, customNames);
+      const cookie = cookies === void 0 ? "" : await cookies.header(url);
       const response = await request5(url, {
         dispatcher: this.dispatcherFor(url, routes),
         method: "GET",
         headersTimeout: init.headersTimeoutMs,
         bodyTimeout: init.bodyTimeoutMs,
         // The identity after the custom headers, so it is never overridden. Validators are bound to one representation; never forward on redirects.
-        headers: { ...wire !== void 0 && sameOrigin2 ? wire.headers : {}, ...headers, ...url === initialUrl ? validators.etag ? { "if-none-match": validators.etag } : validators.lastModified ? { "if-modified-since": validators.lastModified } : {} : {} },
+        headers: { ...wire !== void 0 && sameOrigin2 ? wire.headers : {}, ...headers, ...url === initialUrl ? validators.etag ? { "if-none-match": validators.etag } : validators.lastModified ? { "if-modified-since": validators.lastModified } : {} : {}, ...cookie === "" ? {} : { cookie } },
         signal: init.signal ?? signal
       }).catch((error) => {
         throw proxyRefusal(error) ?? error;
       });
       const responseHeaders = response.headers;
+      if (cookies !== void 0) {
+        const setCookie = responseHeaders["set-cookie"];
+        await cookies.keep(url, typeof setCookie === "string" ? [setCookie] : setCookie ?? []);
+      }
       const header = (name) => {
         const v = responseHeaders[name.toLowerCase()];
         return typeof v === "string" ? v : Array.isArray(v) ? v[0] ?? null : null;
@@ -18396,6 +19498,13 @@ var ResilientHttpSubject = class {
    * request's custom headers (`headers`) before it.
    */
   preparedFor(url, options) {
+    if (this.compat !== null) {
+      if (options.mobile === true || Object.keys(options.headers ?? {}).length > 0)
+        throw new Error("the compatible transport sends its profile's headers alone: no custom headers, no mobile identity");
+      const prepared2 = prepareCompatIdentity(this.compat.profile);
+      prepared2.identity.respectsRobots = this.prepared.identity.respectsRobots;
+      return prepared2;
+    }
     const prepared = prepareHttpIdentity(this.prepared.mode, this.networkPolicy.contact ?? null, new URL(url).hostname, options.mobile === true ? "mobile" : "desktop", options.headers, this.previewProductToken);
     prepared.identity.respectsRobots = this.prepared.identity.respectsRobots;
     return prepared;
@@ -18408,10 +19517,11 @@ var ResilientHttpSubject = class {
   envProxyFor(url) {
     return this.route.viaOperatorProxy(url);
   }
-  async fetch(url, deadlineMs, signal, validators = {}, onRetryAfter, options = {}, onRobotsOverride) {
+  /** `cookieSession`: the task's cookies (ADR 0005 `egress_sessions`), sent and kept on every hop; absent, none are. */
+  async fetch(url, deadlineMs, signal, validators = {}, onRetryAfter, options = {}, onRobotsOverride, cookieSession) {
     if (this.localPreviewRobotsException && !isLocalPreviewProxyTarget(url))
       throw new Error("Local platform exception is limited to fixed platform hosts");
-    const scope = createExecutionScope({ signal, deadlineAt: deadlineMs, onRetryAfter });
+    const scope = createExecutionScope({ signal, deadlineAt: deadlineMs, onRetryAfter, ...cookieSession === void 0 ? {} : { cookieSession } });
     const start = Date.now();
     const monotonicStart = performance.now();
     const origin = new URL(url).origin;
@@ -18546,18 +19656,18 @@ var ResilientHttpSubject = class {
           event: "robots_disallowed",
           detail: { url, appliedRules: robotsDecision2.appliedRules, ...robotsDecision2.unreachable === void 0 ? {} : { unreachable: robotsDecision2.unreachable } }
         });
-        const override = options.robotsOverride;
+        const override = applicableOverride(options.robotsOverride, robotsDecision2);
         if (robotsDecision2.unreachable !== void 0 && cached?.error?.tls === true) {
           trace.push({ at: Date.now() - start, lane: "http", event: "request_failed", detail: { reason: "tls_error", url: robotsDecision2.robotsUrl, error: cached.error.name, ...cached.error.code === null ? {} : { code: cached.error.code } } });
           return timedDenied("tls_error");
         }
-        if (override === void 0 || robotsDecision2.unreachable !== void 0)
+        if (override === void 0)
           return timedDenied("policy_denied");
         trace.push({
           at: Date.now() - start,
           lane: "http",
           event: "robots_overridden",
-          detail: { url, appliedRules: robotsDecision2.appliedRules, reason: override.reason, ...override.recordedBy === void 0 ? {} : { recordedBy: override.recordedBy } }
+          detail: overriddenDetail(url, robotsDecision2, override)
         });
         overrideWarning = robotsOverrideWarning(robotsDecision2, override);
         onRobotsOverride?.(robotsOverrideApplied(trace, overrideWarning));
@@ -18568,8 +19678,12 @@ var ResilientHttpSubject = class {
     const host = new URL(url).origin;
     if (cooldownWaitMs > 0)
       trace.push({ at: Date.now() - start, lane: "http", event: "host_cooldown_wait", detail: { host, waitMs: cooldownWaitMs } });
+    if (this.compat !== null)
+      trace.push({ at: Date.now() - start, lane: "http", event: "transport", detail: { library: COMPAT_LIBRARY.name, version: COMPAT_LIBRARY.version, profile: this.compat.profile } });
     const transportStart = performance.now();
     const maxFileBytes = fileByteCap(this.networkPolicy, options.maxFileBytes);
+    const transportCoding = { decoded: null };
+    const cookies = execution.cookieSession === void 0 ? void 0 : new SessionCookies(execution.cookieSession);
     const out = await resilientFetch(url, this.fetcherFor(url, prepared.identityHeaders, validators, signal, (ms) => {
       bodyReadMs += ms;
     }, (intervalMs, cooldownMs) => {
@@ -18577,11 +19691,13 @@ var ResilientHttpSubject = class {
       cooldownWaitMs += cooldownMs;
       pacingWaitMs += intervalMs + cooldownMs;
     }, (target, proxy) => {
-      trace.push({ at: Date.now() - start, lane: "http", event: "egress_proxy", detail: { url: target, proxy, source: "environment" } });
+      trace.push({ at: Date.now() - start, lane: "http", event: "egress_proxy", detail: { url: target, proxy, source: this.networkPolicy.egressProxy?.source ?? "environment" } });
     }, maxFileBytes, {
       headers: prepared.customHeaders,
       onWithheld: (to, names) => trace.push({ at: Date.now() - start, lane: "http", event: "custom_headers_withheld", detail: { to, names: [...names] } })
-    }, relaxed), {
+    }, relaxed, (coding) => {
+      transportCoding.decoded = coding;
+    }, deadlineAt, cookies), {
       signal,
       deadlineAt,
       onRetryAfter: (target, retryAt2) => {
@@ -18604,6 +19720,8 @@ var ResilientHttpSubject = class {
       transportMs = Math.max(0, performance.now() - transportStart - pacingWaitMs);
       return null;
     });
+    if (cookies !== void 0)
+      trace.push({ at: Date.now() - start, lane: "http", event: "session_cookies", detail: cookies.detail() });
     if (out === null)
       return timedDenied("timeout", this.scheduler.retryAt(host));
     const fetchedAt = out.status === null ? null : (/* @__PURE__ */ new Date()).toISOString();
@@ -18643,7 +19761,10 @@ var ResilientHttpSubject = class {
         ...file2 === void 0 ? {} : { file: file2 }
       };
     };
-    const contentEncoding = out.kind === "ok" && classifyContentType(contentType) !== "unsupported" ? contentEncodingLabel(out.headers?.get("content-encoding")) : void 0;
+    const contentEncoding = out.kind === "ok" && classifyContentType(contentType) !== "unsupported" ? contentEncodingLabel(out.headers?.get("content-encoding") ?? transportCoding.decoded) : void 0;
+    const transportDecoded = transportCoding.decoded;
+    if (transportDecoded !== null && out.kind === "ok")
+      trace.push({ at: Date.now() - start, lane: "http", event: "transport_decoded", detail: { contentEncoding: transportDecoded, by: COMPAT_LIBRARY.name } });
     let wire;
     let bytes;
     let undecoded = false;
@@ -18691,7 +19812,7 @@ var ResilientHttpSubject = class {
     transportMs += Math.max(0, bodyReadMs - bodyReadBeforeFinal);
     const file = contentful ? detectFile(contentType, bytes, responseFileName(out.finalUrl, out.headers?.get("content-disposition") ?? null)) : null;
     const body = file === null ? new TextDecoder().decode(bytes) : "";
-    const rawBodySha256 = file === null && !undecoded ? sha256Utf8(body) : null;
+    const rawBodySha256 = file === null && !undecoded && out.status !== null ? sha256Utf8(body) : null;
     const rawArtifacts = rawBodySha256 === null ? [] : await captureRawHtml(body, rawBodySha256);
     const base = {
       requestedUrl: url,
@@ -18717,13 +19838,13 @@ var ResilientHttpSubject = class {
       },
       usage: {
         wallMs,
-        bytesWire: wire.byteLength,
+        bytesWire: transportDecoded === null ? wire.byteLength : null,
         bytesDecompressed: file === null ? Buffer.byteLength(body) : bytes.byteLength,
         requestCount: out.requestCount,
         attemptCount: out.attemptCount,
         contentTokens: null,
         browserMs: 0,
-        externalCostUsd: null
+        externalCostUsd: 0
       },
       trace
     };
@@ -18863,7 +19984,8 @@ var ResilientHttpSubject = class {
           markers: render.markers,
           emptyTables: render.emptyTables,
           textChars: render.textChars,
-          scriptChars: render.scriptChars
+          scriptChars: render.scriptChars,
+          ...render.listRecords === void 0 ? {} : { listRecords: render.listRecords }
         }
       });
       return [{
@@ -18991,7 +20113,7 @@ var ResilientHttpSubject = class {
         attemptCount: 0,
         contentTokens: null,
         browserMs: 0,
-        externalCostUsd: null
+        externalCostUsd: 0
       },
       trace
     };
@@ -19046,13 +20168,85 @@ function proxyRefusal(error) {
   refusal.name = "ProxyConnectError";
   return refusal;
 }
+var SessionCookies = class {
+  session;
+  requestsWithCookies = 0;
+  kept = 0;
+  constructor(session) {
+    this.session = session;
+  }
+  async header(url) {
+    const header = await this.session.cookieHeader(url);
+    if (header !== "")
+      this.requestsWithCookies++;
+    return header;
+  }
+  async keep(url, setCookies) {
+    if (setCookies.length > 0)
+      this.kept += await this.session.store(url, setCookies);
+  }
+  detail() {
+    return { session: this.session.id, requestsWithCookies: this.requestsWithCookies, kept: this.kept };
+  }
+};
 
 // packages/bench/dist/subjects/browserLocal.js
 init_dist();
 init_dist3();
 init_dist2();
-init_egress();
+import { chromium as chromium2 } from "playwright";
+
+// packages/bench/dist/subjects/browserEngine.js
 import { chromium } from "playwright";
+var PLAYWRIGHT_ENGINE = { name: "playwright", launch: (options) => chromium.launch(options) };
+function browserEngineChoice(env, grant, hosted) {
+  const raw = (env.W2L_BROWSER_ENGINE ?? "").trim().toLowerCase();
+  if (raw === "" || raw === "playwright")
+    return "playwright";
+  if (raw !== "patchright")
+    throw new Error(`W2L_BROWSER_ENGINE is playwright or patchright, not ${raw}`);
+  if (hosted)
+    throw new Error("W2L_BROWSER_ENGINE=patchright is refused on a hosted server (ADR 0005: the enhanced browser runs only in a local Octocrawl instance)");
+  if (!(grant?.capabilities ?? []).includes("enhanced_browser")) {
+    throw new Error("W2L_BROWSER_ENGINE=patchright needs an access grant that names enhanced_browser (ADR 0005; --access-grant or W2L_ACCESS_GRANT)");
+  }
+  return "patchright";
+}
+var PATCHRIGHT_MODULE = ["patch", "right"].join("");
+var PATCHRIGHT_INSTALL = "install it where Octocrawl runs: npm install octocrawl patchright (or, with npx, npx -p octocrawl -p patchright octocrawl ...), then npx patchright install chromium";
+async function loadPatchrightEngine() {
+  const { createRequire: createRequire2 } = await import("module");
+  const { join: join13 } = await import("path");
+  const { pathToFileURL: pathToFileURL3 } = await import("url");
+  let mod;
+  let from = import.meta.url;
+  try {
+    mod = await import(PATCHRIGHT_MODULE);
+  } catch {
+    try {
+      const resolved = createRequire2(join13(process.cwd(), "package.json")).resolve(PATCHRIGHT_MODULE);
+      mod = await import(pathToFileURL3(resolved).href);
+      from = pathToFileURL3(resolved).href;
+    } catch {
+      throw new Error(`W2L_BROWSER_ENGINE=patchright needs the optional patchright package; ${PATCHRIGHT_INSTALL}`);
+    }
+  }
+  const chromiumApi = mod.chromium ?? mod.default?.chromium;
+  if (chromiumApi === void 0)
+    throw new Error("the patchright package found has no chromium export");
+  let version = null;
+  try {
+    version = createRequire2(from)(`${PATCHRIGHT_MODULE}/package.json`).version ?? null;
+  } catch {
+  }
+  return { name: "patchright", version, launch: async (options) => await chromiumApi.launch(options) };
+}
+async function browserEngineFor(name) {
+  return name === "patchright" ? await loadPatchrightEngine() : PLAYWRIGHT_ENGINE;
+}
+
+// packages/bench/dist/subjects/browserLocal.js
+init_egress();
 init_robotsLookup();
 
 // packages/bench/dist/subjects/browserActions.js
@@ -19198,10 +20392,10 @@ async function runPageActions(actions, ctx) {
     const guard = async () => {
       const landed = await refusedDocument();
       if (landed !== null)
-        throw new StepFailure("navigation_refused", `the step led the page to ${landed.url}, which W2L does not fetch (${landed.reason}); it is not read`);
+        throw new StepFailure("navigation_refused", `the step led the page to ${landed.url}, which Octocrawl does not fetch (${landed.reason}); it is not read`);
       const refused = ctx.takeRefusedNavigation();
       if (refused !== null)
-        throw new StepFailure("navigation_refused", `the step led the page to ${refused.url}, which W2L does not fetch (${refused.reason}); the request was not sent`);
+        throw new StepFailure("navigation_refused", `the step led the page to ${refused.url}, which Octocrawl does not fetch (${refused.reason}); the request was not sent`);
     };
     try {
       const detail = await runStep(action, ctx, result, artifacts, index, guard);
@@ -19217,7 +20411,7 @@ async function runPageActions(actions, ctx) {
       if (failure2.code !== "navigation_refused") {
         const landed = await refusedDocument().catch(() => null);
         if (landed !== null)
-          failure2 = new StepFailure("navigation_refused", `the step led the page to ${landed.url}, which W2L does not fetch (${landed.reason}); it is not read`);
+          failure2 = new StepFailure("navigation_refused", `the step led the page to ${landed.url}, which Octocrawl does not fetch (${landed.reason}); it is not read`);
       }
       if (failure2.code === "navigation_refused")
         dropSince(result, artifacts, before);
@@ -19321,9 +20515,10 @@ async function runStep(action, ctx, result, artifacts, index, guard) {
     case "executeJavascript": {
       let value;
       try {
-        value = await bounded(ctx, page.evaluate(`(async () => {
+        const expression = `(async () => {
 ${action.script}
-})()`));
+})()`;
+        value = await bounded(ctx, ctx.evaluateScript === void 0 ? page.evaluate(expression) : ctx.evaluateScript(expression));
       } catch (error) {
         if (signal?.aborted || error instanceof StepFailure)
           throw error;
@@ -20144,6 +21339,9 @@ var PAGE_CLOSE_MS = 2e3;
 async function closePage(page, timeoutMs = PAGE_CLOSE_MS) {
   return closeWithin(page.close(), timeoutMs);
 }
+function contextCookie(c) {
+  return { name: c.name, value: c.value, domain: c.domain, path: c.path, expires: c.expires, httpOnly: c.httpOnly, secure: c.secure, sameSite: c.sameSite };
+}
 async function closeWithin(closing, timeoutMs) {
   const settled2 = closing.then(() => true, () => true);
   let timer;
@@ -20163,6 +21361,7 @@ var BrowserLocalSubject = class {
   fileStore;
   previewProductToken;
   adHosts;
+  browserEngine;
   meta = {
     id: "browser-local",
     displayName: "browser-local (playwright chromium \xD7 extract-tf)",
@@ -20201,7 +21400,9 @@ var BrowserLocalSubject = class {
   accessConfig;
   /** The operator's environment proxy for every context this subject opens (local mode). */
   envProxy;
-  constructor(mode = "standard", access, headed = false, networkPolicy, managedProfileDir = null, scheduler, publicPreferenceState = null, browserAllowedHosts, onRenderedHtml, fileStore = null, previewProductToken = false, adHosts = AD_HOSTS) {
+  /** The launched engine's package version, once known (Patchright only). */
+  engineVersion = null;
+  constructor(mode = "standard", access, headed = false, networkPolicy, managedProfileDir = null, scheduler, publicPreferenceState = null, browserAllowedHosts, onRenderedHtml, fileStore = null, previewProductToken = false, adHosts = AD_HOSTS, browserEngine = "playwright") {
     this.mode = mode;
     this.headed = headed;
     this.managedProfileDir = managedProfileDir;
@@ -20211,6 +21412,10 @@ var BrowserLocalSubject = class {
     this.fileStore = fileStore;
     this.previewProductToken = previewProductToken;
     this.adHosts = adHosts;
+    this.browserEngine = browserEngine;
+    if (browserEngine !== "playwright" && (access != null || managedProfileDir !== null)) {
+      throw new Error("the enhanced browser runs only in the public browser lane, never with a saved login or a managed profile");
+    }
     if (publicPreferenceState !== null && (mode !== "standard" || access != null || managedProfileDir !== null)) {
       throw new Error("anonymous public preference state is only available to the standard public browser");
     }
@@ -20239,8 +21444,9 @@ var BrowserLocalSubject = class {
   ledger() {
     return this.chain.toLedger();
   }
-  async fetch(url, deadlineMs, signal, onRetryAfter, options = {}, onRobotsOverride) {
-    const scope = createExecutionScope({ signal, deadlineAt: deadlineMs, onRetryAfter });
+  /** `cookieSession`: the task's cookies (ADR 0005 `egress_sessions`): the context starts with them and leaves its own there. */
+  async fetch(url, deadlineMs, signal, onRetryAfter, options = {}, onRobotsOverride, cookieSession) {
+    const scope = createExecutionScope({ signal, deadlineAt: deadlineMs, onRetryAfter, ...cookieSession === void 0 ? {} : { cookieSession } });
     const start = Date.now();
     const monotonicStart = performance.now();
     let queueMs = 0;
@@ -20326,11 +21532,14 @@ var BrowserLocalSubject = class {
     const routeMatch = "**/*";
     let actionsRoute = null;
     let popupCloser = null;
+    let taskCookies = null;
     try {
       throwIfExecutionStopped(execution);
       await raceWithSignal(assertSafeUrl(url, this.networkPolicy), signal);
       const managedContext = this.managedProfileDir === null ? null : await raceWithSignal(this.getManagedContext(execution), signal);
       const browser = managedContext?.browser() ?? await raceWithSignal(this.getBrowser(execution), signal);
+      if (this.browserEngine !== "playwright")
+        trace.push({ at: Date.now() - start, lane: "browser_local", event: "browser_engine", detail: { engine: this.browserEngine, version: this.engineVersion } });
       throwIfExecutionStopped(execution);
       const version = browser.version();
       const major = Number(version.split(".")[0] ?? CHROME_MAJOR_FLOOR);
@@ -20361,15 +21570,15 @@ var BrowserLocalSubject = class {
         }
       });
       const host = this.hostOf(url);
-      const override = options.robotsOverride;
-      const overridden = identity.respectsRobots && robotsDecision2.decision === "disallowed" && robotsDecision2.unreachable === void 0 && override !== void 0;
+      const override = applicableOverride(options.robotsOverride, robotsDecision2);
+      const overridden = identity.respectsRobots && robotsDecision2.decision === "disallowed" && override !== void 0 && !(robotsDecision2.unreachable !== void 0 && cachedRobots?.error?.tls === true);
       if (override !== void 0 && overridden) {
-        trace.push({ at: Date.now() - start, lane: "browser_local", event: "robots_disallowed", detail: { url, appliedRules: robotsDecision2.appliedRules } });
+        trace.push({ at: Date.now() - start, lane: "browser_local", event: "robots_disallowed", detail: { url, appliedRules: robotsDecision2.appliedRules, ...robotsDecision2.unreachable === void 0 ? {} : { unreachable: robotsDecision2.unreachable } } });
         trace.push({
           at: Date.now() - start,
           lane: "browser_local",
           event: "robots_overridden",
-          detail: { url, appliedRules: robotsDecision2.appliedRules, reason: override.reason, ...override.recordedBy === void 0 ? {} : { recordedBy: override.recordedBy } }
+          detail: overriddenDetail(url, robotsDecision2, override)
         });
         onRobotsOverride?.(robotsOverrideApplied(trace, robotsOverrideWarning(robotsDecision2, override)));
       }
@@ -20430,7 +21639,7 @@ var BrowserLocalSubject = class {
             attemptCount: 0,
             contentTokens: null,
             browserMs: 0,
-            externalCostUsd: null
+            externalCostUsd: 0
           },
           trace
         };
@@ -20549,6 +21758,13 @@ var BrowserLocalSubject = class {
           detail: { cookieCount: userCookies.length, ...storedOrigins === 0 ? {} : { localStorageOrigins: storedOrigins }, sessionSha256: this.access.sessionSha256 }
         });
       }
+      if (execution.cookieSession !== void 0 && this.accessConfig?.session === void 0 && context !== this.managedContext) {
+        const cookies = await raceWithSignal(execution.cookieSession.browserCookies(url), signal);
+        if (cookies.length > 0)
+          await context.addCookies(cookies.map((c) => ({ ...c, ...c.expires < 0 ? { expires: -1 } : {} })));
+        const startedWith = cookies.length === 0 ? [] : (await raceWithSignal(context.cookies(), signal)).map(contextCookie);
+        taskCookies = { session: execution.cookieSession, startedWith };
+      }
       throwIfExecutionStopped(execution);
       const pendingPage = context.newPage();
       void pendingPage.then((created) => {
@@ -20637,7 +21853,7 @@ var BrowserLocalSubject = class {
         trace.push({ at: Date.now() - start, lane: "browser_local", event: "navigate", detail: { url: navigationUrl, attempt: attemptCount, timeoutMs: navigationTimeoutMs } });
         const envProxy = proxyFor(navigationUrl, this.networkPolicy);
         if (envProxy !== null)
-          trace.push({ at: Date.now() - start, lane: "browser_local", event: "egress_proxy", detail: { url: navigationUrl, proxy: envProxy.endpoint, source: "environment" } });
+          trace.push({ at: Date.now() - start, lane: "browser_local", event: "egress_proxy", detail: { url: navigationUrl, proxy: envProxy.endpoint, source: this.networkPolicy.egressProxy?.source ?? "environment" } });
         try {
           documents.restart();
           response = await page.goto(navigationUrl, { waitUntil: "domcontentloaded", timeout: navigationTimeoutMs });
@@ -20768,8 +21984,11 @@ var BrowserLocalSubject = class {
           });
         };
         context.on("page", popupCloser);
+        const actionPage = page;
         ran.actions = await runPageActions(options.actions, {
           page,
+          // Patchright's evaluate takes (pageFunction, arg, options, isolatedContext) and defaults to an isolated world.
+          evaluateScript: this.browserEngine === "patchright" ? (expression) => actionPage.evaluate(expression, void 0, void 0, false) : (expression) => actionPage.evaluate(expression),
           execution,
           trace,
           at: () => Date.now() - start,
@@ -20823,7 +22042,7 @@ var BrowserLocalSubject = class {
         const late = refusedNavigations.shift();
         const last = options.actions.length - 1;
         if (late !== void 0 && ran.actions.result.failed === void 0) {
-          ran.actions.result.failed = { index: last, type: options.actions[last].type, code: "navigation_refused", message: `after the steps, the page tried to go to ${late.url}, which W2L does not fetch (${late.reason}); the page stayed where it was` };
+          ran.actions.result.failed = { index: last, type: options.actions[last].type, code: "navigation_refused", message: `after the steps, the page tried to go to ${late.url}, which Octocrawl does not fetch (${late.reason}); the page stayed where it was` };
           dropLastStep(ran.actions);
         }
         for (const loadedUrl of documents.loaded.slice(ran.actions.checkedDocuments)) {
@@ -20832,7 +22051,7 @@ var BrowserLocalSubject = class {
             continue;
           trace.push({ at: Date.now() - start, lane: "browser_local", event: "navigation_refused", detail: { url: loadedUrl, reason: landed } });
           if (ran.actions.result.failed === void 0) {
-            ran.actions.result.failed = { index: last, type: options.actions[last].type, code: "navigation_refused", message: `after the steps, the page loaded ${loadedUrl}, which W2L does not fetch (${landed}); it is not read` };
+            ran.actions.result.failed = { index: last, type: options.actions[last].type, code: "navigation_refused", message: `after the steps, the page loaded ${loadedUrl}, which Octocrawl does not fetch (${landed}); it is not read` };
             dropLastStep(ran.actions);
           }
           return this.notRead(url, start, trace, finalUrl);
@@ -20915,7 +22134,7 @@ var BrowserLocalSubject = class {
           navigationFollowupCount: variantFollowups,
           contentTokens: null,
           browserMs,
-          externalCostUsd: null,
+          externalCostUsd: 0,
           timings: { retryWaitMs, totalMs: wallMs }
         },
         trace
@@ -21087,7 +22306,7 @@ var BrowserLocalSubject = class {
           attemptCount: 1,
           contentTokens: null,
           browserMs: wallMs,
-          externalCostUsd: null
+          externalCostUsd: 0
         },
         trace
       };
@@ -21095,6 +22314,11 @@ var BrowserLocalSubject = class {
       signal?.removeEventListener("abort", onAbort);
       if (page !== void 0)
         await closePage(page);
+      if (taskCookies !== null && context !== void 0) {
+        const held = await Promise.race([context.cookies().catch(() => null), new Promise((done) => setTimeout(() => done(null), PAGE_CLOSE_MS))]);
+        const changes = held === null ? { kept: 0, removed: 0 } : await taskCookies.session.storeBrowserChanges(taskCookies.startedWith, held.map(contextCookie));
+        trace.push({ at: Date.now() - start, lane: "browser_local", event: "session_cookies", detail: { session: taskCookies.session.id, startedWith: taskCookies.startedWith.length, ...changes, read: held !== null } });
+      }
       await session?.detach().catch(() => {
       });
       if (context !== void 0 && requestRoute !== null)
@@ -21161,7 +22385,7 @@ var BrowserLocalSubject = class {
           ...this.networkPolicy.egressProxy ? { envProxy: proxyFor(finalUrl, this.networkPolicy)?.endpoint ?? null } : {}
         },
         // The file's bytes are counted; what crossed the wire (compressed) is not measured.
-        usage: { wallMs: at(), bytesWire: null, bytesDecompressed: 0, requestCount: attemptCount, attemptCount, contentTokens: null, browserMs: at(), externalCostUsd: null },
+        usage: { wallMs: at(), bytesWire: null, bytesDecompressed: 0, requestCount: attemptCount, attemptCount, contentTokens: null, browserMs: at(), externalCostUsd: 0 },
         trace
       };
     };
@@ -21248,7 +22472,7 @@ var BrowserLocalSubject = class {
         artifacts: [],
         ...this.networkPolicy.egressProxy ? { envProxy: proxyFor(finalUrl, this.networkPolicy)?.endpoint ?? null } : {}
       },
-      usage: { wallMs, bytesWire: null, bytesDecompressed: 0, requestCount: attemptCount, attemptCount, contentTokens: null, browserMs: wallMs, externalCostUsd: null },
+      usage: { wallMs, bytesWire: null, bytesDecompressed: 0, requestCount: attemptCount, attemptCount, contentTokens: null, browserMs: wallMs, externalCostUsd: 0 },
       trace
     };
   }
@@ -21284,7 +22508,7 @@ var BrowserLocalSubject = class {
       truncatedAt: null,
       compliance: null,
       evidence: { finalUrl, httpStatus: null, redirectChain: [], contentType: null, rawBodySha256: null, artifacts: [] },
-      usage: { wallMs: Date.now() - start, bytesWire: 0, bytesDecompressed: 0, requestCount: 1, attemptCount: 1, contentTokens: null, browserMs: Date.now() - start, externalCostUsd: null },
+      usage: { wallMs: Date.now() - start, bytesWire: 0, bytesDecompressed: 0, requestCount: 1, attemptCount: 1, contentTokens: null, browserMs: Date.now() - start, externalCostUsd: 0 },
       trace
     };
   }
@@ -21325,7 +22549,7 @@ var BrowserLocalSubject = class {
         attemptCount: 0,
         contentTokens: null,
         browserMs: wallMs,
-        externalCostUsd: null
+        externalCostUsd: 0
       },
       trace
     };
@@ -21351,7 +22575,10 @@ var BrowserLocalSubject = class {
         ];
         if (this.activeExecutions === 0)
           throw new DOMException("Browser startup abandoned", "AbortError");
-        return chromium.launch({ headless: !this.headed, timeout: 3e4, ...args.length === 0 ? chromiumProxyLaunchOptions(this.envProxy) : { args } });
+        const engine = await browserEngineFor(this.browserEngine);
+        if (engine.version !== void 0)
+          this.engineVersion = engine.version;
+        return engine.launch({ headless: !this.headed, timeout: 3e4, ...args.length === 0 ? chromiumProxyLaunchOptions(this.envProxy) : { args } });
       };
       const pending = launch().then(async (browser) => {
         if (this.activeExecutions === 0) {
@@ -21377,7 +22604,7 @@ var BrowserLocalSubject = class {
     if (this.managedContext !== null)
       return this.managedContext;
     if (this.managedContextPromise === null) {
-      const pending = chromium.launchPersistentContext(this.managedProfileDir, { headless: !this.headed, timeout: 3e4, ...chromiumProxyLaunchOptions(this.envProxy) }).then(async (context) => {
+      const pending = chromium2.launchPersistentContext(this.managedProfileDir, { headless: !this.headed, timeout: 3e4, ...chromiumProxyLaunchOptions(this.envProxy) }).then(async (context) => {
         if (this.activeExecutions === 0) {
           if (this.managedContextPromise === pending)
             this.managedContextPromise = null;
@@ -21491,6 +22718,7 @@ function freshEntry() {
     latencyTotalMs: 0,
     latencySamplesMs: [],
     costTotalUsd: 0,
+    costUnknownAttempts: 0,
     lastFailureClass: null
   };
 }
@@ -21504,7 +22732,10 @@ function applyOutcome(entry3, outcome) {
   if (entry3.latencySamplesMs.length > MAX_LATENCY_SAMPLES) {
     entry3.latencySamplesMs = entry3.latencySamplesMs.slice(-MAX_LATENCY_SAMPLES);
   }
-  entry3.costTotalUsd += outcome.costUsd;
+  if (outcome.costUsd === null)
+    entry3.costUnknownAttempts += 1;
+  else
+    entry3.costTotalUsd += outcome.costUsd;
   entry3.lastFailureClass = outcome.failureClass;
 }
 var MemoryRoutingHistory = class {
@@ -21532,7 +22763,8 @@ function rankVendors(domainHistory, vendorIds) {
         score: EXPLORE_BONUS,
         successRate: 0,
         medianLatencyMs: null,
-        totalCostUsd: 0
+        totalCostUsd: 0,
+        costUnknown: false
       });
       continue;
     }
@@ -21544,13 +22776,15 @@ function rankVendors(domainHistory, vendorIds) {
       mid = samples.length % 2 === 0 ? (samples[half - 1] + samples[half]) / 2 : samples[half];
     }
     const cost = entry3.costTotalUsd;
-    const score = successRate + 0.3 / (1 + mid / 1e3) + 0.1 / (1 + cost / 0.1);
+    const costUnknown = entry3.costUnknownAttempts > 0;
+    const score = successRate + 0.3 / (1 + mid / 1e3) + (costUnknown ? 0 : 0.1 / (1 + cost / 0.1));
     scores.push({
       vendorId: id,
       score,
       successRate,
       medianLatencyMs: mid,
-      totalCostUsd: cost
+      totalCostUsd: cost,
+      costUnknown
     });
   }
   return scores.sort((a, b) => b.score - a.score);
@@ -21661,6 +22895,10 @@ var FileSessionStore = class _FileSessionStore {
 };
 
 // packages/bench/dist/routing/ladder.js
+function attemptOf(channel, id, result, ordinal, startedAt) {
+  return { channel: id, result, ordinal, startedAt, endedAt: (/* @__PURE__ */ new Date()).toISOString(), ...channel.vendorId === void 0 ? {} : { vendorId: channel.vendorId } };
+}
+var HTTP_CHANNELS = /* @__PURE__ */ new Set(["http", "http_compat"]);
 function summarize(channelsTried, attempts) {
   const cost = {
     knownSubtotal: attempts.reduce((sum, item) => sum + (item.result.usage.externalCostUsd ?? 0), 0),
@@ -21716,7 +22954,7 @@ function withLowContentYield(result, channelsTried) {
     return result;
   if (result.warnings?.some((warning) => warning.code === "low_content_yield") === true)
     return result;
-  return { ...result, warnings: [...result.warnings ?? [], lowContentYieldWarning(result, channelsTried.some((channel) => channel !== "http"))] };
+  return { ...result, warnings: [...result.warnings ?? [], lowContentYieldWarning(result, channelsTried.some((channel) => !HTTP_CHANNELS.has(channel)))] };
 }
 function withRenderedLowYield(result) {
   if (!CONTENTFUL_STATUS.has(result.status) || result.warnings?.some((warning) => warning.code === "low_content_yield") === true)
@@ -21811,11 +23049,11 @@ var LadderRunner = class {
       execution.onRobotsOverride?.(applied);
     } };
     try {
-      return carryRobotsOverride(await this.runWithinBudget(url, session, rungs, options, progress), progress.robotsOverrides);
+      return withRunCost(carryRobotsOverride(await this.runWithinBudget(url, session, rungs, options, progress), progress.robotsOverrides));
     } catch (error) {
       if (!deadlineReached(scope))
         throw error;
-      return carryRobotsOverride(deadlineOutcome(url, progress, null), progress.robotsOverrides);
+      return withRunCost(carryRobotsOverride(deadlineOutcome(url, progress, null), progress.robotsOverrides));
     } finally {
       scope.dispose();
     }
@@ -21866,7 +23104,7 @@ var LadderRunner = class {
       return finish2(this.governanceRefusal(url, decision.reason ?? "governance refused this url"), false);
     }
     const permitted = new Set(decision.permittedChannels);
-    const local = this.channels.filter((c) => c.vendorId === void 0 && permitted.has(c.id));
+    const local = this.channels.filter((c) => c.vendorId === void 0 && permitted.has(c.id) && (c.serves?.(url, options) ?? true));
     const providers = this.channels.filter((c) => c.vendorId !== void 0 && permitted.has(c.id));
     let ordered = [...local, ...await raceWithSignal(this.orderProviders(url, providers), execution.signal)];
     const sessionFirst = effectiveSession !== null && effectiveSession.vendor === "browser_local_authed" && sessionCoversHost(effectiveSession.domain, safeHost(url)) ? ordered.find((c) => c.id === "authed_session") ?? null : null;
@@ -21911,8 +23149,9 @@ var LadderRunner = class {
         return finish2(identityBlock, false);
       }
       channelsTried.push(channel.id);
+      const startedAt2 = (/* @__PURE__ */ new Date()).toISOString();
       const result = await raceWithSignal(channel.fetch(url, effectiveSession, execution, options), execution.signal);
-      attempts.push({ channel: channel.id, result });
+      attempts.push(attemptOf(channel, channel.id, result, attempts.length + 1, startedAt2));
       if (result.usage.deadlineExceeded === true || result.failureReason === "timeout" && deadlineReached(execution)) {
         return deadlineOutcome(url, progress, result);
       }
@@ -21955,7 +23194,7 @@ var LadderRunner = class {
             detail: { domain: snapshot.domain, vendor: channel.vendorId }
           });
         }
-        const qualityEvent = channel.id === "http" ? qualityEscalationEvent(result) : null;
+        const qualityEvent = HTTP_CHANNELS.has(channel.id) ? qualityEscalationEvent(result) : null;
         const thinHttp = qualityEvent !== null;
         const emptyConfirmed = !thinHttp && worseThanBest && bestSize === 0;
         if (thinHttp || worseThanBest) {
@@ -22080,7 +23319,7 @@ var LadderRunner = class {
     const outcome = {
       contentful: CONTENTFUL_STATUS.has(result.status),
       wallMs: result.usage.wallMs,
-      costUsd: result.usage.externalCostUsd ?? 0,
+      costUsd: result.usage.externalCostUsd,
       failureClass: cls
     };
     await this.history?.record(safeHost(url), vendorId, outcome);
@@ -22148,8 +23387,9 @@ var LadderRunner = class {
         summary: summarize([...channelsTried, `${channel.id}(retry)`], attempts)
       };
     }
+    const retryStartedAt = (/* @__PURE__ */ new Date()).toISOString();
     const retry = await raceWithSignal(channel.fetch(url, snapshot, execution, options), execution.signal);
-    attempts.push({ channel: `${channel.id}(retry)`, result: retry });
+    attempts.push(attemptOf(channel, `${channel.id}(retry)`, retry, attempts.length + 1, retryStartedAt));
     ladderTrace.push({
       at: retry.usage.wallMs,
       event: "ladder_step",
@@ -22199,7 +23439,7 @@ var LadderRunner = class {
         attemptCount: 0,
         contentTokens: null,
         browserMs: 0,
-        externalCostUsd: null
+        externalCostUsd: 0
       },
       trace: [{ at: 0, lane: "http", event: "governance_refusal", detail: { reason: reason2 } }]
     };
@@ -22262,7 +23502,13 @@ function deadlineOutcome(url, progress, returned) {
     const event = { at, lane: base.lane, event: "deadline_exceeded", detail: evidence === null ? detail : { ...detail, evidence: evidence.channel } };
     result = { ...base, status: "failed", failureReason: "timeout", blockReason: null, budgetExceeded: null, markdown: evidence?.result.markdown ?? null, usage: { ...base.usage, contentTokens: null, deadlineExceeded: true }, trace: [...base.trace, event] };
   }
-  return { result, channelsTried, handoffRequested: false, ladderTrace, summary: { ...summarize(channelsTried, attempts), totalMs: at } };
+  const summary = summarize(channelsTried, attempts);
+  const providerUnmeasured = interrupted !== null && attempts.length < channelsTried.length && laneOf(interrupted) === "provider";
+  const costed = providerUnmeasured ? { ...summary, externalCostUsd: null, externalCost: { ...summary.externalCost, unknown: true } } : summary;
+  return { result, channelsTried, handoffRequested: false, ladderTrace, summary: { ...costed, totalMs: at } };
+}
+function withRunCost(run) {
+  return { ...run, result: { ...run.result, usage: { ...run.result.usage, externalCostUsd: run.summary.externalCostUsd } } };
 }
 function noMainContentEvidence(attempts) {
   for (let i = attempts.length - 1; i >= 0; i--) {
@@ -22288,7 +23534,8 @@ function deadlineFailure(url, lane, wallMs) {
     compliance: null,
     evidence: { finalUrl: url, httpStatus: null, redirectChain: [], contentType: null, rawBodySha256: null, artifacts: [] },
     // The interrupted rung's traffic was not measured; the ladder summary holds what was.
-    usage: { wallMs, bytesWire: null, bytesDecompressed: 0, requestCount: 0, attemptCount: 0, contentTokens: null, browserMs: 0, externalCostUsd: null },
+    // A vendor rung may have billed before the deadline; a local one calls no third party.
+    usage: { wallMs, bytesWire: null, bytesDecompressed: 0, requestCount: 0, attemptCount: 0, contentTokens: null, browserMs: 0, externalCostUsd: lane === "provider" ? null : 0 },
     trace: []
   };
 }
@@ -22335,7 +23582,7 @@ function identityRefusedResult(url, channel, event, issues) {
       attemptCount: 0,
       contentTokens: null,
       browserMs: 0,
-      externalCostUsd: null
+      externalCostUsd: 0
     },
     trace: [
       {
@@ -22401,6 +23648,10 @@ function sessionRejection(url, result) {
   return { ...result, status: "blocked", blockReason: "login_wall", failureReason: null };
 }
 
+// packages/bench/dist/ladderCli.js
+init_dist2();
+import { readFileSync } from "fs";
+
 // packages/bench/dist/fileStore.js
 import { randomUUID as randomUUID2 } from "crypto";
 import { mkdir as mkdir4, rename as rename3, rm, stat, writeFile as writeFile4 } from "fs/promises";
@@ -22441,9 +23692,9 @@ init_provider2();
 init_dist2();
 var playwrightConnector = async (wsUrl, deadlineMs, signal) => {
   throwIfExecutionStopped({ signal, deadlineAt: deadlineMs });
-  const { chromium: chromium3 } = await import("playwright");
+  const { chromium: chromium4 } = await import("playwright");
   const remaining = deadlineMs === void 0 ? 3e4 : Math.max(1, deadlineMs - Date.now());
-  const pending = chromium3.connectOverCDP(wsUrl, { timeout: remaining });
+  const pending = chromium4.connectOverCDP(wsUrl, { timeout: remaining });
   void pending.then((browser) => {
     if (signal?.aborted)
       void browser.close().catch(() => {
@@ -22734,7 +23985,7 @@ var CdpVendorTransport = class {
 };
 
 // packages/bench/dist/vendors/connect.js
-async function connectVendor(ops, connector = playwrightConnector, resume, deadlineMs, signal) {
+async function connectVendor(ops, connector = playwrightConnector, resume, deadlineMs, signal, grants = []) {
   const transport = new CdpVendorTransport(ops, connector);
   if (resume !== void 0 && resume !== null) {
     transport.useResumedSession(resume);
@@ -22747,6 +23998,7 @@ async function connectVendor(ops, connector = playwrightConnector, resume, deadl
     // here: the three-layer split means the vendor adapter declares what it
     // CAN do, policy decides what we WILL use, and this list is the result.
     capabilities: ops.decision.enabled.map((c) => c.capability),
+    grants,
     honoursCallerUserAgent: false
   };
   return { declaration, transport };
@@ -22760,20 +24012,22 @@ var BROWSERBASE_CAPABILITIES = [
   { capability: "retry_orchestration", vendorDefaultOn: false, enableKey: "retry_orchestration" },
   { capability: "session_persistence", vendorDefaultOn: false, enableKey: "session_persistence" },
   { capability: "live_view_handoff", vendorDefaultOn: true, enableKey: "live_view_handoff" },
-  { capability: "captcha_solving", vendorDefaultOn: true, enableKey: "captcha_solving" },
-  { capability: "fingerprint_spoofing", vendorDefaultOn: false, enableKey: "fingerprint_spoofing" }
+  { capability: "captcha_solving", vendorDefaultOn: true, enableKey: "vendor_captcha_solving" },
+  { capability: "fingerprint_spoofing", vendorDefaultOn: false, enableKey: "vendor_stealth" }
 ];
 function browserbaseSessionBody(decision, projectId, resume) {
   const persistEnabled = decision.enabled.some((c) => c.capability === "session_persistence");
+  const solveEnabled = decision.enabled.some((c) => c.capability === "captcha_solving");
+  const stealthEnabled = decision.enabled.some((c) => c.capability === "fingerprint_spoofing");
   return {
     ...projectId === void 0 ? {} : { projectId },
     browserSettings: {
-      // Policy-level structural refusal. Browserbase defaults both to true;
-      // leaving the default in place would be buying the refused capability
-      // by omission, so the wire always says false.
-      solveCaptchas: false,
-      // The vendor's stealth mode forges fingerprint signals. Same refusal.
-      advancedStealth: false,
+      // Browserbase defaults solveCaptchas to true, so the off state is an
+      // explicit false, never an omission.
+      solveCaptchas: solveEnabled,
+      // Without the grant the body keeps the opt-out it has always sent;
+      // with it, the current field (`verified` replaced `advancedStealth`).
+      ...stealthEnabled ? { verified: true } : { advancedStealth: false },
       ...persistEnabled && resume?.browserbaseContextId !== void 0 ? { context: { id: resume.browserbaseContextId, persist: true } } : {}
     }
   };
@@ -22876,23 +24130,25 @@ var STEEL_CAPABILITIES = [
   { capability: "retry_orchestration", vendorDefaultOn: false, enableKey: "retry_orchestration" },
   { capability: "session_persistence", vendorDefaultOn: false, enableKey: "session_persistence" },
   { capability: "live_view_handoff", vendorDefaultOn: true, enableKey: "live_view_handoff" },
-  { capability: "captcha_solving", vendorDefaultOn: false, enableKey: "captcha_solving" },
-  { capability: "fingerprint_spoofing", vendorDefaultOn: true, enableKey: "fingerprint_spoofing" }
+  { capability: "captcha_solving", vendorDefaultOn: false, enableKey: "vendor_captcha_solving" },
+  { capability: "fingerprint_spoofing", vendorDefaultOn: true, enableKey: "vendor_stealth" }
 ];
 function steelSessionBody(decision, resume) {
   const persistEnabled = decision.enabled.some((c) => c.capability === "session_persistence");
+  const solveEnabled = decision.enabled.some((c) => c.capability === "captcha_solving");
+  const stealthEnabled = decision.enabled.some((c) => c.capability === "fingerprint_spoofing");
   return {
     // Steel injects a synthetic fingerprint BY DEFAULT. skipFingerprintInjection
-    // is the opt-out; the policy layer's structural refusal of
-    // fingerprint_spoofing makes this unconditional, exactly as with
-    // Browserbase's solveCaptchas. A session body without it would be buying
-    // the refused capability by omission.
+    // is the opt-out, sent unless the grant names `vendor_stealth` (ADR 0005);
+    // a body without it would buy the capability by omission. Solving follows
+    // `vendor_captcha_solving`. humanizeInteractions stays off under any
+    // grant: ADR 0005 grants no behaviour simulation.
     stealthConfig: {
-      skipFingerprintInjection: true,
-      autoCaptchaSolving: false,
+      skipFingerprintInjection: !stealthEnabled,
+      autoCaptchaSolving: solveEnabled,
       humanizeInteractions: false
     },
-    solveCaptcha: false,
+    solveCaptcha: solveEnabled,
     // First use persists the profile so the create response's profileId can
     // be saved and resumed later; a later run passes the saved profileId.
     ...persistEnabled ? { persistProfile: true } : {},
@@ -22963,8 +24219,11 @@ function buildChannels(mode, opts = {}) {
   if (preview && mode !== "standard")
     throw new Error(`the preview product token is for standard mode, not ${mode}`);
   const http = new ResilientHttpSubject(mode, opts.networkPolicy, originScheduler, opts.localPreviewProxyUrl, opts.localPreviewRobotsException === true, fileStore, preview, opts.robotsCache);
-  const plainBrowser = new BrowserLocalSubject(mode, null, opts.headed === true, opts.networkPolicy, null, originScheduler, opts.publicPreferenceState ?? null, opts.browserAllowedHosts, opts.onRenderedHtml, fileStore, preview);
+  const plainBrowser = new BrowserLocalSubject(mode, null, opts.headed === true, opts.networkPolicy, null, originScheduler, opts.publicPreferenceState ?? null, opts.browserAllowedHosts, opts.onRenderedHtml, fileStore, preview, void 0, opts.browserEngine ?? "playwright");
   const declared3 = preview ? identityBundleFrom(previewIdentity(modeIdentity(mode))) : identityForRoute(mode);
+  if (opts.compatTransport === true && (preview || opts.localPreviewProxyUrl !== void 0))
+    throw new Error("the compatible transport is for a local server, not the hosted preview");
+  const compat = opts.compatTransport === true && mode === "standard" ? new ResilientHttpSubject(mode, opts.networkPolicy, originScheduler, void 0, false, fileStore, false, opts.robotsCache, new CompatTransport(opts.networkPolicy ?? defaultNetworkPolicy())) : null;
   const authedSubjects = /* @__PURE__ */ new Map();
   const authedSubjectFor = (session) => {
     const key = `${session.domain}\0${sessionFingerprint(session)}`;
@@ -22991,18 +24250,24 @@ function buildChannels(mode, opts = {}) {
     {
       id: "http",
       identity: declared3,
-      fetch: (url, _session, execution, options) => opts.localSubjects?.http !== void 0 ? opts.localSubjects.http.fetch(url, execution?.deadlineAt, execution?.signal, execution, options) : http.fetch(url, execution?.deadlineAt, execution?.signal, {}, execution?.onRetryAfter, options, execution?.onRobotsOverride),
+      fetch: (url, _session, execution, options) => opts.localSubjects?.http !== void 0 ? opts.localSubjects.http.fetch(url, execution?.deadlineAt, execution?.signal, execution, options) : http.fetch(url, execution?.deadlineAt, execution?.signal, {}, execution?.onRetryAfter, options, execution?.onRobotsOverride, execution?.cookieSession),
       close: async () => {
         await http.teardown();
         await opts.localSubjects?.http?.teardown?.();
       }
     },
+    ...compat === null ? [] : [{
+      id: "http_compat",
+      identity: identityBundleFrom(compatIdentity()),
+      fetch: (url, _session, execution, options) => compat.fetch(url, execution?.deadlineAt, execution?.signal, {}, execution?.onRetryAfter, options, execution?.onRobotsOverride, execution?.cookieSession),
+      close: () => compat.teardown()
+    }],
     {
       id: "browser_local",
       identity: declared3,
       waitsFor: true,
       // No session here, ever: the plain rung is the public browser.
-      fetch: (url, _session, execution, options) => opts.localSubjects?.browser_local !== void 0 ? opts.localSubjects.browser_local.fetch(url, execution?.deadlineAt, execution?.signal, execution, options) : plainBrowser.fetch(url, execution?.deadlineAt, execution?.signal, execution?.onRetryAfter, options, execution?.onRobotsOverride),
+      fetch: (url, _session, execution, options) => opts.localSubjects?.browser_local !== void 0 ? opts.localSubjects.browser_local.fetch(url, execution?.deadlineAt, execution?.signal, execution, options) : plainBrowser.fetch(url, execution?.deadlineAt, execution?.signal, execution?.onRetryAfter, options, execution?.onRobotsOverride, execution?.cookieSession),
       close: async () => {
         await plainBrowser.teardown();
         await opts.localSubjects?.browser_local?.teardown?.();
@@ -23056,7 +24321,7 @@ function buildChannels(mode, opts = {}) {
               attemptCount: 0,
               contentTokens: null,
               browserMs: 0,
-              externalCostUsd: null
+              externalCostUsd: 0
             },
             trace
           };
@@ -23072,6 +24337,8 @@ function buildChannels(mode, opts = {}) {
   }
   if (mode === "standard")
     return channels;
+  if (!(opts.vendorPolicy?.authorized ?? []).includes("vendor_remote_browser"))
+    return channels;
   const named = new Set((process.env.W2L_VENDORS ?? "").split(",").map((name) => name.trim().toLowerCase()).filter((name) => name !== ""));
   const bbKey = opts.keys?.browserbase ?? (named.has("browserbase") ? process.env.BROWSERBASE_API_KEY : void 0) ?? "";
   const steelKey = opts.keys?.steel ?? (named.has("steel") ? process.env.STEEL_API_KEY : void 0) ?? "";
@@ -23099,7 +24366,7 @@ function buildChannels(mode, opts = {}) {
         return connected;
       if (pending === null) {
         opts.onVendorConnect?.(vendorId);
-        pending = connectVendor(ops, opts.vendorConnector, pendingResume ?? null, execution?.deadlineAt, execution?.signal).then((c) => {
+        pending = connectVendor(ops, opts.vendorConnector, pendingResume ?? null, execution?.deadlineAt, execution?.signal, opts.vendorPolicy?.authorized ?? []).then((c) => {
           connected = c;
           return c;
         }).catch((error) => {
@@ -23148,7 +24415,7 @@ function buildChannels(mode, opts = {}) {
               attemptCount: 0,
               contentTokens: null,
               browserMs: 0,
-              externalCostUsd: null
+              externalCostUsd: 0
             },
             trace: [
               {
@@ -23250,7 +24517,7 @@ function pageFromUserBrowser(read2, prior, options) {
       attemptCount: 0,
       contentTokens: null,
       browserMs: wallMs,
-      externalCostUsd: null
+      externalCostUsd: 0
     },
     trace
   };
@@ -23535,6 +24802,10 @@ function validateCdpEndpoint(value) {
     throw new Error("invalid CDP discovery endpoint");
   return u.href;
 }
+function publicSession(session) {
+  const { profileDir: _dir, cdpEndpoint: _endpoint, ...publicFields } = session;
+  return publicFields;
+}
 
 // packages/bench/dist/recipeExecutor.js
 import { createHash as createHash10 } from "crypto";
@@ -23543,7 +24814,7 @@ import { createHash as createHash10 } from "crypto";
 import { createHash as createHash9 } from "crypto";
 import { mkdir as mkdir6, rmdir as rmdir2 } from "fs/promises";
 import { join as join8, resolve as resolve3 } from "path";
-import { chromium as chromium2 } from "playwright";
+import { chromium as chromium3 } from "playwright";
 init_egress();
 
 // packages/bench/dist/recipeExecutor.js
@@ -23566,7 +24837,7 @@ import { mkdir as mkdir7, writeFile as writeFile6 } from "fs/promises";
 init_dist();
 
 // packages/sdk/dist/version.js
-var SDK_VERSION = "0.3.0";
+var SDK_VERSION = "0.3.1";
 
 // packages/sdk/dist/watcher.js
 init_dist();
@@ -23575,9 +24846,170 @@ init_dist();
 var SDK_ORIGIN = `js-sdk@${SDK_VERSION}`;
 
 // packages/bench/dist/benchmarkGate.js
-import { existsSync as existsSync2, readFileSync } from "fs";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
 import { execFileSync } from "child_process";
 
+// packages/bench/dist/cookieSession.js
+import { randomUUID as randomUUID3 } from "crypto";
+import { readFile as readFile4, rename as rename5, rm as rm2, writeFile as writeFile7 } from "fs/promises";
+import { CookieJar } from "tough-cookie";
+var SAME_SITE = { strict: "Strict", lax: "Lax", none: "None" };
+var TaskCookieSession = class {
+  file;
+  sessionId = randomUUID3();
+  // Lenient about what a site sends: a cookie it would not keep is skipped, never an error.
+  jar = new CookieJar(void 0, { looseMode: true });
+  /** Done once the file, if any, has been read; every method waits for it. */
+  ready;
+  writing = Promise.resolve();
+  /** Set when the task ended: a page still finishing afterwards changes the session in memory alone. */
+  closed = false;
+  /** `file`: where the session lives between runs of its task; without one it lives in memory alone. */
+  constructor(file) {
+    this.file = file;
+    this.ready = file === void 0 ? Promise.resolve() : this.load(file);
+  }
+  /** An opaque id for the record, unrelated to any cookie value; a session read from its file keeps the id it had. */
+  get id() {
+    return this.sessionId;
+  }
+  /** Deletes a task's session file: the task has ended, and its cookies go with it. */
+  static async remove(file) {
+    await rm2(file, { force: true });
+  }
+  /**
+   * The task has ended: deletes the file after the writes already queued, and writes nothing again,
+   * so a page that finishes after the task (one a cancel or a deadline stopped waiting for) cannot put it back.
+   */
+  async close() {
+    this.closed = true;
+    const file = this.file;
+    if (file === void 0)
+      return;
+    this.writing = this.writing.then(() => rm2(file, { force: true })).catch(() => {
+    });
+    await this.writing;
+  }
+  async load(file) {
+    let text2;
+    try {
+      text2 = await readFile4(file, "utf8");
+    } catch {
+      return;
+    }
+    try {
+      const saved = JSON.parse(text2);
+      if (saved.version !== 1 || typeof saved.id !== "string" || saved.jar === void 0)
+        return;
+      this.jar = await CookieJar.deserialize({ ...saved.jar, looseMode: true });
+      this.sessionId = saved.id;
+    } catch {
+    }
+  }
+  /** Writes the session to its file after a change, one write at a time. */
+  persist() {
+    const file = this.file;
+    if (file === void 0)
+      return Promise.resolve();
+    this.writing = this.writing.then(async () => {
+      if (this.closed)
+        return;
+      const temporary = `${file}.${randomUUID3()}.tmp`;
+      try {
+        await writeFile7(temporary, JSON.stringify({ version: 1, id: this.sessionId, jar: await this.jar.serialize() }), { mode: 384 });
+        await rename5(temporary, file);
+      } catch {
+        await rm2(temporary, { force: true }).catch(() => {
+        });
+      }
+    }).catch(() => {
+    });
+    return this.writing;
+  }
+  async cookieHeader(url) {
+    await this.ready;
+    return this.jar.getCookieString(url).catch(() => "");
+  }
+  async store(url, setCookies) {
+    await this.ready;
+    let kept = 0;
+    for (const line of setCookies) {
+      const cookie = await this.jar.setCookie(line, url, { ignoreError: true }).catch(() => void 0);
+      if (cookie !== void 0 && cookie.TTL() > 0)
+        kept++;
+    }
+    if (setCookies.length > 0)
+      await this.persist();
+    return kept;
+  }
+  async browserCookies(url) {
+    await this.ready;
+    const cookies = await this.jar.getCookies(url).catch(() => []);
+    return cookies.map((cookie) => ({
+      name: cookie.key,
+      value: cookie.value,
+      // A host-only cookie names its host alone; a domain cookie, with the leading dot, its subdomains too.
+      domain: cookie.hostOnly === true ? cookie.domain ?? "" : `.${cookie.domain ?? ""}`,
+      path: cookie.path ?? "/",
+      expires: cookie.expires instanceof Date ? Math.floor(cookie.expires.getTime() / 1e3) : -1,
+      httpOnly: cookie.httpOnly,
+      secure: cookie.secure,
+      sameSite: SAME_SITE[(cookie.sameSite ?? "").toLowerCase()] ?? "Lax"
+    }));
+  }
+  async storeBrowserChanges(startedWith, held) {
+    const key = (c) => `${c.name}\0${c.domain}\0${c.path}`;
+    const before = new Map(startedWith.map((c) => [key(c), c]));
+    const after = new Map(held.map((c) => [key(c), c]));
+    await this.ready;
+    let kept = 0;
+    let removed = 0;
+    for (const c of held) {
+      const was = before.get(key(c));
+      if (was !== void 0 && was.value === c.value) {
+        if (was.expires === c.expires || await this.currentValue(c) !== was.value)
+          continue;
+      }
+      if (await this.setLine(c, false))
+        kept++;
+    }
+    for (const c of startedWith) {
+      if (after.has(key(c)))
+        continue;
+      if (await this.currentValue(c) !== c.value)
+        continue;
+      await this.setLine(c, true);
+      removed++;
+    }
+    if (kept + removed > 0)
+      await this.persist();
+    return { kept, removed };
+  }
+  /** The session's value now for the cookie with this name, domain and path; undefined when it holds none. */
+  async currentValue(c) {
+    const same = (now) => now.name === c.name && now.domain === c.domain && now.path === c.path;
+    return (await this.browserCookies(`${c.secure ? "https" : "http"}://${c.domain.replace(/^\./, "")}${c.path}`)).find(same)?.value;
+  }
+  /** The cookie as the site would have set it (or deleted it): a host-only one without Domain, which an IP address cannot take. */
+  async setLine(c, remove) {
+    const host = c.domain.replace(/^\./, "");
+    if (host === "")
+      return false;
+    const path = c.path === "" ? "/" : c.path;
+    const line = [
+      `${c.name}=${remove ? "" : c.value}`,
+      `Path=${path}`,
+      ...c.domain.startsWith(".") ? [`Domain=${host}`] : [],
+      ...remove ? ["Expires=Thu, 01 Jan 1970 00:00:00 GMT"] : c.expires > 0 ? [`Expires=${new Date(c.expires * 1e3).toUTCString()}`] : [],
+      ...c.httpOnly ? ["HttpOnly"] : [],
+      ...c.secure ? ["Secure"] : [],
+      `SameSite=${c.sameSite}`
+    ].join("; ");
+    const stored = await this.jar.setCookie(line, `${c.secure ? "https" : "http"}://${host}${path}`, { ignoreError: true }).catch(() => void 0);
+    return stored !== void 0 && stored.TTL() > 0;
+  }
+};
+
 // packages/bench/dist/scrapeAtom.js
 var LadderScrapeAtom = class {
   runner;
@@ -23611,6 +25043,7 @@ init_egress();
 init_robotsLookup();
 
 // packages/bench/dist/sitemapSource.js
+init_dist();
 init_dist2();
 import { createHash as createHash12 } from "crypto";
 import { gunzipSync } from "zlib";
@@ -23628,6 +25061,7 @@ var HttpSitemapSource = class {
   route;
   robots;
   ownRobots;
+  ignoreRobotsTxt;
   /** The Crawl-delay of each origin whose robots.txt a file of this source was judged by (the strictest one seen). */
   crawlDelays = /* @__PURE__ */ new Map();
   /** When this source's last request to each origin left (monotonic). */
@@ -23641,6 +25075,7 @@ var HttpSitemapSource = class {
     this.routes = new EgressRoutes(this.policy);
     this.route = new EgressRoute(this.policy, this.routes);
     this.ownRobots = options.robots === void 0;
+    this.ignoreRobotsTxt = options.ignoreRobotsTxt === true;
     this.robots = options.robots ?? new RobotsOriginCache(this.policy, (url) => this.route.dispatcherFor(url));
   }
   async load(request7, context = {}) {
@@ -23752,7 +25187,7 @@ var HttpSitemapSource = class {
         this.crawlDelays.set(origin, Math.max(this.crawlDelays.get(origin) ?? 0, decision.crawlDelayMs));
       }
       record3.robots = decision.decision === "allowed" ? "allowed" : decision.decision === "no_robots" ? "no_robots" : "disallowed";
-      if (decision.decision === "disallowed") {
+      if (decision.decision === "disallowed" && (!this.ignoreRobotsTxt || isOctocrawlRobotsGroup(decision.matchedUserAgentGroup))) {
         return { record: { ...record3, kind: "refused", error: decision.unreachable === void 0 ? null : `robots_unreachable_${decision.unreachable}` }, locs: null };
       }
       const response = await this.fetch(url, identity.headers, scope);
@@ -23907,6 +25342,95 @@ init_dist3();
 init_dist();
 init_dist2();
 
+// packages/api/dist/egressPool.js
+init_dist();
+import { connect as netConnect } from "net";
+import { connect as tlsConnect } from "tls";
+var EGRESS_COOLDOWN_MS = 10 * 6e4;
+var MAX_EGRESS_SWITCHES = 2;
+var EgressPool = class {
+  now;
+  egresses;
+  cooldownUntil = /* @__PURE__ */ new Map();
+  next = 0;
+  constructor(servers, policy, now = Date.now) {
+    this.now = now;
+    if (servers.length === 0)
+      throw new Error("an egress pool needs at least one proxy");
+    this.egresses = servers.map((server) => ({ id: server.endpoint, policy: withPoolProxy(policy, server), server }));
+  }
+  get size() {
+    return this.egresses.length;
+  }
+  /** The egress with this id, when it is in the pool. */
+  byId(id) {
+    return this.egresses.find((egress) => egress.id === id);
+  }
+  /** Whether this egress is cooling down after a failure. */
+  cooling(id) {
+    return (this.cooldownUntil.get(id) ?? 0) > this.now();
+  }
+  /**
+   * The next egress in turn that is not cooling down and is not `except`; when every other one is
+   * cooling, the one whose cooldown ends first, so a task always has an egress.
+   */
+  pick(except) {
+    const candidates2 = this.egresses.filter((egress) => egress.id !== except);
+    const pool = candidates2.length === 0 ? this.egresses : candidates2;
+    for (let i = 0; i < this.egresses.length; i++) {
+      const egress = this.egresses[(this.next + i) % this.egresses.length];
+      if (!pool.includes(egress) || this.cooling(egress.id))
+        continue;
+      this.next = (this.next + i + 1) % this.egresses.length;
+      return egress;
+    }
+    return [...pool].sort((a, b) => (this.cooldownUntil.get(a.id) ?? 0) - (this.cooldownUntil.get(b.id) ?? 0))[0];
+  }
+  /** The egress failed its probe: it cools down. */
+  fail(id) {
+    this.cooldownUntil.set(id, this.now() + EGRESS_COOLDOWN_MS);
+  }
+};
+function egressInDoubt(outcome) {
+  const results = [outcome.result, ...(outcome.audit?.summary.attempts ?? []).map((attempt) => attempt.result)];
+  return outcome.result.status === "failed" && results.every((result) => (result.evidence.httpStatus ?? null) === null);
+}
+async function probeEgress(server, timeoutMs = 5e3) {
+  const url = new URL(server.url);
+  const port = Number(url.port || (url.protocol === "https:" ? 443 : 80));
+  return new Promise((resolve4) => {
+    let settled2 = false;
+    let socket;
+    const done = (verdict) => {
+      if (settled2)
+        return;
+      settled2 = true;
+      clearTimeout(timer);
+      socket?.destroy();
+      resolve4(verdict);
+    };
+    const timer = setTimeout(() => done("unreachable"), timeoutMs);
+    const auth = server.username === void 0 ? "" : `Proxy-Authorization: Basic ${Buffer.from(`${server.username}:${server.password ?? ""}`).toString("base64")}\r
+`;
+    const onConnect = () => socket.write(`CONNECT octocrawl-egress-probe.invalid:443 HTTP/1.1\r
+Host: octocrawl-egress-probe.invalid:443\r
+${auth}\r
+`);
+    socket = url.protocol === "https:" ? tlsConnect({ host: url.hostname, port, servername: url.hostname }, onConnect) : netConnect({ host: url.hostname, port }, onConnect);
+    let head = "";
+    socket.on("data", (chunk) => {
+      head += chunk.toString("latin1");
+      const status = /^HTTP\/\d(?:\.\d)? (\d{3})/.exec(head);
+      if (status !== null)
+        done(status[1] === "407" ? "credentials_refused" : "works");
+      else if (head.length > 4096)
+        done("works");
+    });
+    socket.on("error", () => done("unreachable"));
+    socket.on("close", () => done(head === "" ? "unreachable" : "works"));
+  });
+}
+
 // packages/api/dist/hints.js
 init_dist();
 var FAST_MODE_DECLINED_HINT = "the http lane asked for the browser lane; fastMode declined it; retry without fastMode";
@@ -23945,13 +25469,13 @@ function egressHint(result, host) {
   if (denied2 === void 0)
     return null;
   const why = denied2.detail?.error ?? denied2.detail?.reason;
-  return `the egress policy refused ${host}${typeof why === "string" ? ` (${why})` : ""} and nothing was fetched; W2L reaches public addresses, and a local server the addresses its policy allowlists`;
+  return `the egress policy refused ${host}${typeof why === "string" ? ` (${why})` : ""} and nothing was fetched; Octocrawl reaches public addresses, and a local server the addresses its policy allowlists`;
 }
 function laneEscalatedHint(run, host) {
   const { result } = run;
-  if (result.status !== "success" && result.status !== "partial" || !BROWSER_LANES.has(result.lane) || !run.channelsTried.includes("http"))
+  if (result.status !== "success" && result.status !== "partial" || !BROWSER_LANES.has(result.lane) || !run.channelsTried.some((channel) => HTTP_CHANNELS.has(channel)))
     return null;
-  const http = run.summary?.attempts.find((attempt) => attempt.channel === "http")?.result;
+  const http = run.summary?.attempts.find((attempt) => HTTP_CHANNELS.has(attempt.channel))?.result;
   if (http === void 0)
     return null;
   const reason2 = http.status === "blocked" ? http.blockReason : http.status === "failed" && http.failureReason === "http_error" ? "http_error" : null;
@@ -23979,11 +25503,16 @@ function robotsHint(result, host) {
     return null;
   const detail = disallowed.detail ?? {};
   if (typeof detail.unreachable === "string") {
-    return `robots.txt of ${host} could not be read (${detail.unreachable}), which counts as a complete disallow; W2L asks for it again after five minutes, and a robotsOverride does not set that aside`;
+    return `robots.txt of ${host} could not be read (${detail.unreachable}), which counts as a complete disallow; Octocrawl asks for it again after five minutes. ${ROBOTS_ROUTE}`;
   }
   const rules = (Array.isArray(detail.appliedRules) ? detail.appliedRules : []).filter((rule) => rule !== null && typeof rule === "object" && typeof rule.pattern === "string").filter((rule) => rule.allow === false).map((rule) => rule.pattern);
-  return `robots.txt of ${host} disallows this URL for W2L's identity (rule ${rules.length === 0 ? "unknown" : rules.join(", ")}); a robotsOverride with a recorded reason fetches it on the record`;
+  const group = result.trace.find((event) => event.event === "robots_checked")?.detail?.matchedGroup;
+  if (typeof group === "string" && isOctocrawlRobotsGroup(group)) {
+    return `robots.txt of ${host} disallows this URL for Octocrawl by name (User-agent: ${group}; rule ${rules.length === 0 ? "unknown" : rules.join(", ")}): the site owner's opt-out, which a named URL and ignoreRobotsTxt do not set aside; only a robotsOverride with your recorded reason does, on a local server`;
+  }
+  return `robots.txt of ${host} disallows this URL for Octocrawl's identity (rule ${rules.length === 0 ? "unknown" : rules.join(", ")}). ${ROBOTS_ROUTE}`;
 }
+var ROBOTS_ROUTE = "A local Octocrawl server fetches a URL a scrape or batch names whatever robots.txt says, and a crawl or map started there with ignoreRobotsTxt fetches the links it disallows, each on the record; a hosted server obeys robots.txt for every URL";
 function agentHintsFor(req, run) {
   const { result } = run;
   const hints = [];
@@ -23998,16 +25527,16 @@ function agentHintsFor(req, run) {
   }
   if (result.status === "blocked" && result.blockReason === "login_wall") {
     const rejected = run.ladderTrace?.find((event) => event.event === "ladder_session_rejected");
-    hints.push(rejected === void 0 ? "the page asks for a login; W2L does not create accounts; use mode authed with your own session" : `${host} refused your saved login for ${String(rejected.detail?.domain ?? host)} (expired or signed out); sign in to it again in Chrome and run octocrawl login import ${String(rejected.detail?.domain ?? host)}`);
+    hints.push(rejected === void 0 ? "the page asks for a login; Octocrawl does not create accounts; use mode authed with your own session" : `${host} refused your saved login for ${String(rejected.detail?.domain ?? host)} (expired or signed out); sign in to it again in Chrome and run octocrawl login import ${String(rejected.detail?.domain ?? host)}`);
   }
   if (result.status === "blocked" && result.blockReason !== null && GATES.has(result.blockReason)) {
-    hints.push(`${host} gates automated access on the lanes tried (${run.channelsTried.join(", ")}); W2L does not solve challenges or change its identity; a proxy or session you own is the supported route, or, on your own machine, getting through the check yourself in your own Chrome: handoff: true on a scrape (octocrawl scrape --handoff), or a batch handoff (octocrawl batch --handoff, POST /v1/batches/:id/handoff)`);
+    hints.push(`${host} gates automated access on the lanes tried (${run.channelsTried.join(", ")}); Octocrawl does not solve challenges or change its identity unless this server's access grant names a provider that does (--access-grant, ADR 0005); a proxy or session you own is the supported route, or, on your own machine, getting through the check yourself in your own Chrome: handoff: true on a scrape (octocrawl scrape --handoff), or a batch handoff (octocrawl batch --handoff, POST /v1/batches/:id/handoff)`);
   }
   const escalated = laneEscalatedHint(run, host);
   if (escalated !== null)
     hints.push(escalated);
   if (result.status === "failed" && result.failureReason === "tls_error") {
-    hints.push(`the certificate of ${host} did not verify and W2L keeps verification on; a local server takes skipTlsVerification for one request, recorded in the trace and a tls_unverified warning, and a hosted server refuses it`);
+    hints.push(`the certificate of ${host} did not verify and Octocrawl keeps verification on; a local server takes skipTlsVerification for one request, recorded in the trace and a tls_unverified warning, and a hosted server refuses it`);
   }
   if (result.status === "failed" && result.failureReason === "timeout") {
     hints.push(`no lane answered within the request's deadline; raise timeout (up to ${DEFAULT_SCRAPE_TIMEOUT_MS} ms)`);
@@ -24024,7 +25553,7 @@ function agentHintsFor(req, run) {
     hints.push(`the content was cut at character ${result.truncatedAt ?? "unknown"}; ask for rawHtml or a narrower includeTags`);
   }
   const fastModeDeclined = req.fastMode === true && result.lane === "http" && httpLaneAskedForBrowser(result);
-  const browserTried = run.channelsTried.some((channel) => channel !== "http");
+  const browserTried = run.channelsTried.some((channel) => !HTTP_CHANNELS.has(channel));
   if (!fastModeDeclined && result.warnings?.some((warning) => warning.code === "client_rendered_suspected")) {
     hints.push(`the page fills its data with JavaScript; the browser lane ${browserTried ? "was tried" : "was not tried"}`);
   }
@@ -24037,9 +25566,9 @@ function agentHintsFor(req, run) {
   const shellHinted = result.warnings?.some((warning) => warning.code === "client_rendered_suspected" || warning.code === "low_content_yield") === true;
   if (result.status === "failed" && result.failureReason === "empty_unverified" && !shellHinted && !fastModeDeclined) {
     if (result.file?.kind === "pdf")
-      hints.push("the PDF has no text layer, and W2L runs no OCR");
+      hints.push("the PDF has no text layer, and Octocrawl runs no OCR");
     else if (result.file === void 0)
-      hints.push("W2L found no main content on the page; onlyMainContent: false returns the whole page's Markdown as content, and includeTags names the elements to read instead");
+      hints.push("Octocrawl found no main content on the page; onlyMainContent: false returns the whole page's Markdown as content, and includeTags names the elements to read instead");
   }
   if (result.status === "failed" && result.failureReason === "http_error") {
     const status = result.evidence.httpStatus;
@@ -24069,7 +25598,7 @@ init_dist3();
 init_dist2();
 
 // packages/api/dist/chromeLogin.js
-import { readFile as readFile4 } from "fs/promises";
+import { readFile as readFile5 } from "fs/promises";
 import { homedir, userInfo } from "os";
 import { join as join9 } from "path";
 init_dist2();
@@ -24087,7 +25616,7 @@ function chromeUserDataDir(platform = process.platform, env = process.env, home
 async function chromeEndpoint(userDataDir) {
   let text2;
   try {
-    text2 = await readFile4(join9(userDataDir, "DevToolsActivePort"), "utf8");
+    text2 = await readFile5(join9(userDataDir, "DevToolsActivePort"), "utf8");
   } catch {
     throw new ChromeLoginError(`Chrome is not accepting a connection (no DevToolsActivePort in ${userDataDir}): ${ENABLE_HINT}`);
   }
@@ -24398,7 +25927,7 @@ async function readPage(connection, browser, url, options) {
   const host = new URL(url).hostname;
   const started = Date.now();
   let sawGate = null;
-  const gone = (error) => error instanceof ChromeLoginError && !/navigated or closed/i.test(error.message) && /Session with given id not found|No session with given id|No target with given id|closed the connection|Target closed|target not found|did not answer Target\.getTargetInfo/i.test(error.message) ? new HandoffNotThrough(`the tab for ${url} was closed, or Chrome quit, before W2L read it`, sawGate) : null;
+  const gone = (error) => error instanceof ChromeLoginError && !/navigated or closed/i.test(error.message) && /Session with given id not found|No session with given id|No target with given id|closed the connection|Target closed|target not found|did not answer Target\.getTargetInfo/i.test(error.message) ? new HandoffNotThrough(`the tab for ${url} was closed, or Chrome quit, before Octocrawl read it`, sawGate) : null;
   const ended = (error) => gone(error) ?? (error instanceof ChromeLoginError ? new HandoffNotThrough(`${url} was not read: ${error.message}`, sawGate) : error);
   let targetId;
   try {
@@ -24454,7 +25983,7 @@ async function readPage(connection, browser, url, options) {
     while (Date.now() - started < waitMs) {
       await new Promise((resolve4) => setTimeout(resolve4, pollMs));
       if (options.signal?.aborted === true)
-        throw new HandoffNotThrough(`the handoff of ${url} was cancelled before W2L read it`, sawGate);
+        throw new HandoffNotThrough(`the handoff of ${url} was cancelled before Octocrawl read it`, sawGate);
       if (navigation !== null && gone(navigation) !== null)
         throw gone(navigation);
       let state;
@@ -24542,7 +26071,7 @@ async function readPage(connection, browser, url, options) {
         browser
       };
     }
-    const where = last === null ? "it never loaded" : !sameSite(last.state.href, host) ? `it was on ${safeHost2(last.state.href)}, not ${host}` : stillGated(last, options) !== null ? `it still showed a check (${stillGated(last, options).reason}: ${stillGated(last, options).signals.join(", ")})` : clear >= CLEAR_READS && heard.act === null ? "the page showed no check, and you did not click on it to have it read (W2L reads a page in your Chrome only once you act in its tab; a site you are signed into is read with your login through octocrawl login import and mode authed)" : "it was not yet the page: still loading, at a sign-in step, or not answering 2xx";
+    const where = last === null ? "it never loaded" : !sameSite(last.state.href, host) ? `it was on ${safeHost2(last.state.href)}, not ${host}` : stillGated(last, options) !== null ? `it still showed a check (${stillGated(last, options).reason}: ${stillGated(last, options).signals.join(", ")})` : clear >= CLEAR_READS && heard.act === null ? "the page showed no check, and you did not click on it to have it read (Octocrawl reads a page in your Chrome only once you act in its tab; a site you are signed into is read with your login through octocrawl login import and mode authed)" : "it was not yet the page: still loading, at a sign-in step, or not answering 2xx";
     throw new HandoffNotThrough(`${url} was not through within ${Math.round(waitMs / 1e3)} s: ${where}`, sawGate);
   } catch (error) {
     throw ended(error);
@@ -25673,7 +27202,7 @@ async function extractStructured(result, format, execution = {}, modelConfig = s
     return { status: "incomplete", data, schemaSha256, evidence, issues, modelUsage: null };
   }
   if (modelConfig === null) {
-    issues.push({ code: "model_unavailable", message: "model fallback requested but W2L extraction model is not configured" }, ...missingIssues);
+    issues.push({ code: "model_unavailable", message: "model fallback requested but Octocrawl extraction model is not configured" }, ...missingIssues);
     return { status: "incomplete", data, schemaSha256, evidence, issues, modelUsage: null };
   }
   const errors = deterministicValid ? [] : validate.errors ?? [];
@@ -25943,6 +27472,9 @@ function compactScrapeResponse(next, req, formats = requestedFormats(req, next),
 var LoginsUnavailableError = class extends Error {
   name = "LoginsUnavailableError";
 };
+var SessionsUnavailableError = class extends Error {
+  name = "SessionsUnavailableError";
+};
 var HandoffUnavailableError = class extends Error {
   name = "HandoffUnavailableError";
 };
@@ -25960,7 +27492,45 @@ var NO_SITEMAP = {
   close: async () => {
   }
 };
+var EGRESS_FILE = "egress.json";
+var COOKIE_SESSION_NAME = /^cookie-session(?:\.[0-9a-f]+)?\.json(?:\..+\.tmp)?$/;
+function cookieSessionFileFor(taskDir, route) {
+  return join10(taskDir, `cookie-session.${createHash13("sha256").update(route).digest("hex").slice(0, 16)}.json`);
+}
+function removeCookieSessions(taskDir, keep) {
+  let names;
+  try {
+    names = readdirSync(taskDir);
+  } catch {
+    return;
+  }
+  for (const name of names)
+    if (COOKIE_SESSION_NAME.test(name) && join10(taskDir, name) !== keep)
+      rmSync(join10(taskDir, name), { force: true });
+}
+function bindTaskEgress(pool, file) {
+  let saved;
+  try {
+    const parsed = JSON.parse(readFileSync3(file, "utf8")).egress;
+    if (typeof parsed === "string")
+      saved = parsed;
+  } catch {
+  }
+  const kept = saved === void 0 ? void 0 : pool.byId(saved);
+  if (kept !== void 0 && !pool.cooling(kept.id))
+    return kept;
+  const egress = pool.pick(saved);
+  writeTaskEgress(file, egress.id);
+  return egress;
+}
+function writeTaskEgress(file, id) {
+  writeFileSync(file, `${JSON.stringify({ egress: id })}
+`, { mode: 384 });
+}
 var DEFAULT_WORKER_COUNT = 4;
+function fetchedPastRobots(result) {
+  return result.compliance?.robots.override !== void 0 || result.trace.some((event) => event.event === "robots_overridden");
+}
 function createApiEngine(options = {}) {
   const taskRoot = options.taskRoot ?? ".w2l/api";
   prepareTaskRoot(taskRoot);
@@ -25969,6 +27539,10 @@ function createApiEngine(options = {}) {
   const shutdownController = new AbortController();
   const monitorControllers = /* @__PURE__ */ new Map();
   const sessionBroker = new SessionBroker(new FileSessionBrokerStore(join10(taskRoot, "b3-sessions.json")));
+  const managedSessionsServed = () => {
+    if (options.hosted === true)
+      throw new SessionsUnavailableError("this server keeps no managed sessions: run Octocrawl on your own machine (octocrawl serve) for them");
+  };
   const userChrome = options.hosted === true ? null : options.userChrome ?? null;
   const handoffs = /* @__PURE__ */ new Set();
   const handoffClosing = new AbortController();
@@ -25976,6 +27550,29 @@ function createApiEngine(options = {}) {
   const savedLogins = options.hosted === true || (options.sessionsFile ?? null) === null ? null : readOnlySessions(new FileSessionStore(options.sessionsFile));
   const sessionsFor = (mode) => mode === "authed" ? savedLogins : null;
   const headed = options.headed === true;
+  const accessGrant = options.accessGrant ?? null;
+  const compatHosts = options.compatHosts ?? [];
+  const egressSessions = (accessGrant?.capabilities ?? []).includes("egress_sessions");
+  const egressProxyList = options.egressProxies ?? [];
+  if (egressProxyList.length > 0 && options.hosted === true)
+    throw new Error("egress proxies are refused on a hosted engine (ADR 0005)");
+  if (egressProxyList.length > 0 && !egressSessions)
+    throw new Error("egress proxies need an access grant that names egress_sessions (ADR 0005)");
+  if (compatHosts.length > 0 && options.hosted === true)
+    throw new Error("the compatible transport is refused on a hosted engine (ADR 0005)");
+  if (compatHosts.length > 0 && !(accessGrant?.capabilities ?? []).includes("compatible_transport"))
+    throw new Error("the compatible transport needs an access grant that names compatible_transport (ADR 0005)");
+  const compatOptionsRefusal = (page) => {
+    const wire = [...page.headers !== void 0 && Object.keys(page.headers).length > 0 ? ["headers"] : [], ...page.mobile === true ? ["mobile"] : []];
+    return wire.length === 0 ? null : wire.join(", ");
+  };
+  const compatTakes = (url, page) => compatHostListed(compatHosts, url) && compatOptionsRefusal(page) === null;
+  const grantedBudget = (budget2) => {
+    const cap = accessGrant?.budget.perRunUsd ?? null;
+    if (cap === null)
+      return budget2;
+    return { ...budget2, maxCostUsd: budget2.maxCostUsd === null ? cap : Math.min(budget2.maxCostUsd, cap) };
+  };
   const basePolicy = options.networkPolicy ?? localNetworkPolicy();
   const networkPolicy = {
     ...basePolicy,
@@ -25984,9 +27581,10 @@ function createApiEngine(options = {}) {
     // The operator's file cap: the policy's own, else W2L_MAX_FILE_BYTES, else the default.
     maxFileBytes: basePolicy.maxFileBytes ?? maxFileBytesFromEnv(process.env)
   };
+  const egressPool = egressProxyList.length === 0 ? null : new EgressPool(egressProxyList, networkPolicy);
   const fileStore = new FileStore(join10(taskRoot, "files"));
   const pageCache = PageCache.open(taskRoot);
-  const cachePlanFor = (url, mode, page, formats, channels, robotsOverride) => {
+  const cachePlanFor = (url, mode, page, formats, channels, robotsOverride, robotsSetAside2) => {
     if (mode === "authed")
       return null;
     if (page.actions !== void 0)
@@ -25999,14 +27597,15 @@ function createApiEngine(options = {}) {
     const { timeout: _timeout, ...shape } = fetchOptions(page, formats);
     const rungs = channels.map((channel) => channel.vendorId === void 0 ? channel.id : `${channel.id}(${channel.vendorId})`);
     const build = { extractor: EXTRACTOR_VERSION, pdf: PDF_TEXT_VERSION, file: FILE_TEXT_VERSION, commit: sourceCommitFromEnv() };
-    const key = pageCacheKey(url, { mode, fetch: shape, rungs, fastMode: page.fastMode === true, robotsOverride: robotsOverride ?? null, build });
-    return { key, bounds: lookup3 ? { minAgeMs: page.minAge ?? 0, maxAgeMs: page.maxAge ?? null } : null, lockdown: page.lockdown === true, store };
+    const access = accessGrant === null ? void 0 : { tier: accessGrant.tier, capabilities: [...accessGrant.capabilities].sort() };
+    const key = pageCacheKey(url, { mode, fetch: shape, rungs, fastMode: page.fastMode === true, robotsOverride: robotsOverride ?? null, build, ...access === void 0 ? {} : { access } });
+    return { key, bounds: lookup3 ? { minAgeMs: page.minAge ?? 0, maxAgeMs: page.maxAge ?? null } : null, lockdown: page.lockdown === true, store, robotsSetAside: robotsSetAside2 };
   };
   const consultCache = (plan, url, policy) => {
     if (plan === null || plan.bounds === null || !evaluateGovernance(url, policy).allowed)
       return { kind: "fetch", missed: false };
     const hit = pageCache.lookup(plan.key, plan.bounds);
-    if (hit !== null)
+    if (hit !== null && (plan.robotsSetAside || !fetchedPastRobots(hit.result)))
       return { kind: "hit", result: cacheHitResult(hit) };
     if (plan.lockdown)
       return { kind: "lockdown_miss", result: cacheMissResult(url, plan.bounds) };
@@ -26040,7 +27639,7 @@ function createApiEngine(options = {}) {
         }
         if (refusal.kind === "syntax")
           throw new RequestError(`${name} entry is not a valid CSS selector: ${selector}`);
-        throw new RequestError(`${name} entry uses ${refusal.reason}, which W2L does not match: ${selector} (supported: ${SUPPORTED_SELECTORS})`, "unsupported_parameter", { parameters: [`${name}[${index}]`] });
+        throw new RequestError(`${name} entry uses ${refusal.reason}, which Octocrawl does not match: ${selector} (supported: ${SUPPORTED_SELECTORS})`, "unsupported_parameter", { parameters: [`${name}[${index}]`] });
       }
       if (parts > MAX_SELECTOR_PARTS) {
         throw new RequestError(`${name} must hold at most ${MAX_SELECTOR_PARTS} selector parts in all, and holds ${parts} (a tag name, *, a class, an id, an attribute test and a pseudo-class each count as one)`);
@@ -26061,7 +27660,7 @@ function createApiEngine(options = {}) {
       }
       if (refusal.kind === "syntax")
         throw new RequestError(`attributes selectors[${index}].selector is not a valid CSS selector: ${selector}`);
-      throw new RequestError(`attributes selectors[${index}].selector uses ${refusal.reason}, which W2L does not match: ${selector} (supported: ${SUPPORTED_SELECTORS})`, "unsupported_parameter", { parameters: [`formats[${at}].selectors[${index}]`] });
+      throw new RequestError(`attributes selectors[${index}].selector uses ${refusal.reason}, which Octocrawl does not match: ${selector} (supported: ${SUPPORTED_SELECTORS})`, "unsupported_parameter", { parameters: [`formats[${at}].selectors[${index}]`] });
     }
     if (parts > MAX_SELECTOR_PARTS) {
       throw new RequestError(`attributes selectors must hold at most ${MAX_SELECTOR_PARTS} selector parts in all, and hold ${parts} (a tag name, *, a class, an id, an attribute test and a pseudo-class each count as one)`);
@@ -26082,22 +27681,25 @@ function createApiEngine(options = {}) {
       }
       if (refusal.kind === "syntax")
         throw new RequestError(`list ${path} is not a valid CSS selector: ${selector}`);
-      throw new RequestError(`list ${path} uses ${refusal.reason}, which W2L does not match: ${selector} (supported: ${SUPPORTED_SELECTORS})`, "unsupported_parameter", { parameters: [`formats[${at}].${path}`] });
+      throw new RequestError(`list ${path} uses ${refusal.reason}, which Octocrawl does not match: ${selector} (supported: ${SUPPORTED_SELECTORS})`, "unsupported_parameter", { parameters: [`formats[${at}].${path}`] });
     }
     if (parts > MAX_SELECTOR_PARTS)
       throw new RequestError(`list selectors must hold at most ${MAX_SELECTOR_PARTS} selector parts in all, and hold ${parts}`);
   };
+  const hosted = options.hosted === true;
+  const robotsSetAside = !hosted && options.allowRobotsOverride !== false;
   const checkRobotsOverride = (parameter, value) => {
-    if (options.allowRobotsOverride === false && value !== void 0) {
-      throw new RequestError(`unsupported parameter: ${parameter} (this server takes no robots override; a recorded override is for a local W2L server)`, "unsupported_parameter", { parameters: [parameter] });
+    if (!robotsSetAside && value !== void 0 && value !== false) {
+      throw new RequestError(`unsupported parameter: ${parameter} (this server obeys robots.txt for every URL; setting it aside is for a local Octocrawl server)`, "unsupported_parameter", { parameters: [parameter] });
     }
   };
-  const hosted = options.hosted === true;
+  const namedUrlOverride = robotsSetAside ? { reason: "the request named this URL", basis: "user_named_url" } : void 0;
+  const ignoreRobotsOverride = (ignore) => ignore === true && robotsSetAside ? { reason: "the crawl or map was started with ignoreRobotsTxt", basis: "ignore_robots_txt" } : void 0;
   const checkHostedOptions = (req) => {
     if (hosted && req.skipTlsVerification === true)
       throw new RequestError("skipTlsVerification is not available in hosted mode", "invalid_request", void 0, [REFUSAL_HINTS.hostedSkipTlsVerification]);
     if (hosted && req.actions !== void 0)
-      throw new RequestError("actions are not available in hosted mode: run W2L locally to use them");
+      throw new RequestError("actions are not available in hosted mode: run Octocrawl locally to use them");
   };
   const jobEvents = new JobEventHub();
   const jobWebhooks = new JobWebhooks(deliveryStore, { hosted, allowHttpLoopback: options.webhookPolicy?.allowHttpLoopback ?? !hosted });
@@ -26112,7 +27714,7 @@ function createApiEngine(options = {}) {
       throw error;
     });
     await scrapesDirReady;
-    await writeFile7(join10(scrapesDir, `${record3.scrapeId}.json`), JSON.stringify(record3, null, 2));
+    await writeFile8(join10(scrapesDir, `${record3.scrapeId}.json`), JSON.stringify(record3, null, 2));
   };
   const mapsDir = join10(taskRoot, "maps");
   let mapsDirReady = null;
@@ -26122,7 +27724,7 @@ function createApiEngine(options = {}) {
       throw error;
     });
     await mapsDirReady;
-    await writeFile7(join10(mapsDir, `${record3.response.id}.json`), JSON.stringify(record3));
+    await writeFile8(join10(mapsDir, `${record3.response.id}.json`), JSON.stringify(record3));
   };
   const mapMaxLimit = options.mapMaxLimit ?? (hosted ? HOSTED_MAP_MAX_LIMIT : MAX_MAP_LIMIT);
   const mapMaxTimeoutMs = options.mapMaxTimeoutMs ?? (hosted ? HOSTED_MAP_MAX_TIMEOUT_MS : MAX_MAP_TIMEOUT_MS);
@@ -26131,12 +27733,13 @@ function createApiEngine(options = {}) {
   const defaultMaxPages = options.defaultMaxPages ?? null;
   const workerCount = Math.max(1, options.workerCount ?? DEFAULT_WORKER_COUNT);
   const robotsCaches = /* @__PURE__ */ new Map();
-  const robotsCacheFor = (mode) => {
-    const existing = robotsCaches.get(mode);
+  const robotsCacheFor = (mode, egress) => {
+    const key = egress === void 0 ? mode : `${mode}|${egress.id}`;
+    const existing = robotsCaches.get(key);
     if (existing !== void 0)
       return existing;
-    const cache = new RobotsOriginCache(networkPolicy);
-    robotsCaches.set(mode, cache);
+    const cache = new RobotsOriginCache(egress?.policy ?? networkPolicy);
+    robotsCaches.set(key, cache);
     return cache;
   };
   const inflight = /* @__PURE__ */ new Map();
@@ -26161,24 +27764,27 @@ function createApiEngine(options = {}) {
   const activeScrapes = /* @__PURE__ */ new Set();
   const crawlControllers = /* @__PURE__ */ new Map();
   const runningCrawls = /* @__PURE__ */ new Map();
-  const createChannels = options.channelsFor ?? ((mode) => {
-    const channels = buildChannels(mode, { headed, networkPolicy, originScheduler, publicPreferenceState: options.publicPreferenceState, browserAllowedHosts: options.browserAllowedHosts, fileStore, robotsCache: robotsCacheFor(mode) });
-    return options.httpOnly ? channels.filter((channel) => channel.id === "http") : channels;
+  const createChannels = options.channelsFor ?? ((mode, egress) => {
+    const channels = buildChannels(mode, { headed, networkPolicy: egress?.policy ?? networkPolicy, originScheduler, publicPreferenceState: options.publicPreferenceState, browserAllowedHosts: options.browserAllowedHosts, fileStore, robotsCache: robotsCacheFor(mode, egress), vendorPolicy: { authorized: accessGrant?.capabilities ?? [] }, browserEngine: options.browserEngine ?? "playwright", compatTransport: compatHosts.length > 0 });
+    return options.httpOnly ? channels.filter((channel) => HTTP_CHANNELS.has(channel.id)) : channels;
   });
   const channelsByMode = /* @__PURE__ */ new Map();
   const historiesByMode = /* @__PURE__ */ new Map();
-  const channelsFor = (mode) => {
-    const existing = channelsByMode.get(mode);
+  const channelsFor = (mode, egress) => {
+    const key = egress === void 0 ? mode : `${mode}|${egress.id}`;
+    const existing = channelsByMode.get(key);
     if (existing !== void 0)
       return existing;
-    const channels = createChannels(mode);
-    channelsByMode.set(mode, channels);
+    const channels = createChannels(mode, egress);
+    channelsByMode.set(key, channels);
     return channels;
   };
-  const channelsForUrl = (mode, url, page = {}, formats = []) => {
-    const channels = channelsFor(mode);
+  const channelsForUrl = (mode, url, page = {}, formats = [], oneUrl = true, compat = true, egress) => {
+    const channels = channelsFor(mode, egress);
     const policy = options.channelPolicy?.(url) ?? "ladder";
-    let selected = policy === "ladder" ? channels : channels.filter((channel) => channel.id === (policy === "http_only" ? "http" : "browser_local"));
+    let selected = policy === "ladder" ? channels : channels.filter((channel) => policy === "http_only" ? HTTP_CHANNELS.has(channel.id) : channel.id === "browser_local");
+    if (!compat || oneUrl && !compatHostListed(compatHosts, url))
+      selected = selected.filter((channel) => channel.id !== "http_compat");
     if (selected.length === 0)
       throw new RequestError(`capture channel unavailable for ${policy}`);
     const filtered = [];
@@ -26208,10 +27814,10 @@ function createApiEngine(options = {}) {
     if (page.fastMode === true) {
       if (policy === "browser_only")
         throw new RequestError("fastMode is not available for this URL: it is served by the browser lane only");
-      const kept = selected.filter((channel) => channel.id === "http");
+      const kept = selected.filter((channel) => HTTP_CHANNELS.has(channel.id));
       if (kept.length === 0)
         throw new RequestError("fastMode is not available for this URL: no http rung is configured for it");
-      const dropped = selected.filter((channel) => channel.id !== "http").map(name);
+      const dropped = selected.filter((channel) => !HTTP_CHANNELS.has(channel.id)).map(name);
       if (dropped.length > 0)
         filtered.push({ reason: "fastMode", dropped });
       selected = kept;
@@ -26223,6 +27829,19 @@ function createApiEngine(options = {}) {
         filtered.push({ reason: wire.join(", "), dropped });
       selected = selected.filter((channel) => channel.vendorId === void 0);
     }
+    if (selected.some((channel) => channel.id === "http_compat")) {
+      const refusal = compatOptionsRefusal(page);
+      if (refusal !== null) {
+        filtered.push({ reason: refusal, dropped: ["http_compat"] });
+        selected = selected.filter((channel) => channel.id !== "http_compat");
+      } else if (oneUrl && selected.some((channel) => channel.id === "http")) {
+        filtered.push({ reason: "compatible_transport", dropped: ["http"] });
+        selected = selected.filter((channel) => channel.id !== "http");
+      }
+    }
+    if (selected.some((channel) => channel.id === "http_compat") && selected.some((channel) => channel.id === "http")) {
+      selected = selected.map((channel) => channel.id === "http" ? { ...channel, serves: (target, fetch2) => !compatTakes(target, fetch2) } : channel.id === "http_compat" ? { ...channel, serves: (target, fetch2) => compatTakes(target, fetch2) } : channel);
+    }
     return { channels: selected, filtered };
   };
   const historyFor = (mode) => {
@@ -26369,7 +27988,7 @@ function createApiEngine(options = {}) {
       const read2 = await chrome.read(url, { ...waitMs === void 0 ? {} : { waitMs }, ...hooks.onWaiting === void 0 ? {} : { onWaiting: hooks.onWaiting }, ...hooks.onConfirm === void 0 ? {} : { onConfirm: hooks.onConfirm }, ...hooks.onHidden === void 0 ? {} : { onHidden: hooks.onHidden }, signal, ...judged });
       const result = pageFromUserBrowser(read2, prior, fetchOpts);
       if (!CONTENTFUL_STATUS.has(result.status))
-        return { reason: `the page W2L read in Chrome was ${result.status} (${result.blockReason ?? result.failureReason ?? "no reason"}), not the page` };
+        return { reason: `the page Octocrawl read in Chrome was ${result.status} (${result.blockReason ?? result.failureReason ?? "no reason"}), not the page` };
       return { result };
     } catch (error) {
       if (!(error instanceof HandoffNotThrough))
@@ -26381,14 +28000,14 @@ function createApiEngine(options = {}) {
     if (req.handoff === void 0)
       return;
     if (userChrome === null)
-      throw new RequestError("handoff: this server does not hand pages to a person; run W2L on your own machine (octocrawl serve, the local MCP host, or the octocrawl CLI)", "unsupported_parameter", { parameters: ["handoff"] });
+      throw new RequestError("handoff: this server does not hand pages to a person; run Octocrawl on your own machine (octocrawl serve, the local MCP host, or the octocrawl CLI)", "unsupported_parameter", { parameters: ["handoff"] });
     const unread = unreadByPerson(fetchOptions(req, req.formats));
     if (unread !== null)
       throw new RequestError(`handoff: the request asks for ${unread}, which a page read in your own Chrome cannot give`, "unsupported_parameter", { parameters: ["handoff"] });
   }
   async function handOffScrape(req, prior, context, hooks) {
     if (handoffClosing.signal.aborted)
-      return { reason: "W2L is shutting down" };
+      return { reason: "Octocrawl is shutting down" };
     const signal = AbortSignal.any([...context.signal === void 0 ? [] : [context.signal], ...hooks.signal === void 0 ? [] : [hooks.signal], shutdownController.signal, handoffClosing.signal]);
     let chrome;
     try {
@@ -26406,17 +28025,17 @@ function createApiEngine(options = {}) {
     if (userChrome === null || !handoffResult(result) || unreadByPerson(fetchOptions(req, req.formats)) !== null)
       return result;
     const blockReason = result.blockReason;
-    const stopped = `${result.requestedUrl} stopped at a ${blockReason.replace(/_/g, " ")} W2L does not pass`;
-    const rationale = tried ? `${stopped}, and handed to you in your own Chrome it was not read there (the handoff_not_through warning says why): send the request again with handoff to try once more, with a longer handoff.waitMs if you needed more time` : `${stopped}: send the request again with handoff: true (octocrawl scrape --handoff) to get through it yourself in your own Chrome, and W2L reads the page there`;
+    const stopped = `${result.requestedUrl} stopped at a ${blockReason.replace(/_/g, " ")} Octocrawl does not pass`;
+    const rationale = tried ? `${stopped}, and handed to you in your own Chrome it was not read there (the handoff_not_through warning says why): send the request again with handoff to try once more, with a longer handoff.waitMs if you needed more time` : `${stopped}: send the request again with handoff: true (octocrawl scrape --handoff) to get through it yourself in your own Chrome, and Octocrawl reads the page there`;
     return { ...result, handoff: { reason: HANDOFF_REASONS[blockReason], liveViewUrl: null, rationale } };
   }
   async function handOff2(taskId, req, hooks) {
     if (!UUID.test(taskId))
       return null;
     if (userChrome === null)
-      throw new HandoffUnavailableError("this server does not hand pages to a person: run W2L on your own machine (octocrawl serve, the local MCP host, or the octocrawl CLI) to open them in your Chrome");
+      throw new HandoffUnavailableError("this server does not hand pages to a person: run Octocrawl on your own machine (octocrawl serve, the local MCP host, or the octocrawl CLI) to open them in your Chrome");
     if (handoffClosing.signal.aborted)
-      throw new HandoffUnavailableError("W2L is shutting down");
+      throw new HandoffUnavailableError("Octocrawl is shutting down");
     if (!existsSync3(join10(taskRoot, taskId, "checkpoint.sqlite")))
       return null;
     const store = SqliteTaskStore.open(join10(taskRoot, taskId));
@@ -26469,7 +28088,7 @@ function createApiEngine(options = {}) {
                   ...json2 === void 0 ? {} : { json: json2 }
                 };
                 if (shutdownController.signal.aborted || handoffClosing.signal.aborted) {
-                  items.push({ id: step.id, url: step.url, through: false, status: step.status, reason: "W2L shut down before the page was stored" });
+                  items.push({ id: step.id, url: step.url, through: false, status: step.status, reason: "Octocrawl shut down before the page was stored" });
                   continue;
                 }
                 const { audit: _stoppedAudit, ...kept } = step;
@@ -26504,23 +28123,55 @@ function createApiEngine(options = {}) {
     const mode = defaultApiMode(task.mode);
     const stored = task.batch ?? task.crawl;
     const selection = stored === void 0 || !hosted ? stored : { ...stored, skipTlsVerification: false };
-    const rungs = channelsForUrl(mode, task.seedUrl, selection ?? {}, selection?.formats ?? []);
-    const runner = new LadderRunner(rungs.channels, { mode, ...req.policyAllowlist.length ? { allowlistedDomains: req.policyAllowlist } : {} }, historyFor(mode), null, task.batch === void 0 ? null : sessionsFor(mode), { channelsFiltered: rungs.filtered });
-    const robotsOverrideFor = options.allowRobotsOverride === false || task.batch?.robotsOverrides === void 0 ? null : robotsOverrideLookup(task.batch.robotsOverrides);
-    const ladder = new LadderScrapeAtom(runner, robotsOverrideFor === null ? fetchOptions(selection, selection?.formats) : (url) => {
+    const egressFile = join10(task.taskDir, EGRESS_FILE);
+    const firstEgress = egressPool === null || mode === "authed" ? void 0 : bindTaskEgress(egressPool, egressFile);
+    let switches = 0;
+    const lanes = [];
+    const routeOf = (egress) => {
+      const env = networkPolicy.egressProxy ?? null;
+      return egress !== void 0 ? `pool:${egress.id}` : env === null ? "direct" : `env:${(env.https ?? env.http)?.endpoint ?? ""}`;
+    };
+    const endCookieSession = async (ended) => {
+      if (!ended)
+        return;
+      await Promise.all(lanes.map((lane) => lane.cookieSession?.close()));
+      removeCookieSessions(task.taskDir);
+      rmSync(egressFile, { force: true });
+    };
+    const runnerFor = (lane) => new LadderRunner(lane.channels, { mode, ...req.policyAllowlist.length ? { allowlistedDomains: req.policyAllowlist } : {} }, historyFor(mode), null, task.batch === void 0 ? null : sessionsFor(mode), { channelsFiltered: lane.filtered });
+    const recordedOverrideFor = !robotsSetAside || task.batch?.robotsOverrides === void 0 ? null : robotsOverrideLookup(task.batch.robotsOverrides);
+    const namedOverride = task.batch === void 0 ? ignoreRobotsOverride(task.crawl?.ignoreRobotsTxt) : namedUrlOverride;
+    const robotsOverrideFor = recordedOverrideFor === null && namedOverride === void 0 ? null : (url) => recordedOverrideFor?.(url) ?? namedOverride;
+    const ladderFor = (lane) => new LadderScrapeAtom(runnerFor(lane), robotsOverrideFor === null ? fetchOptions(selection, selection?.formats) : (url) => {
       const robotsOverride = robotsOverrideFor(url);
       return { ...fetchOptions(selection, selection?.formats), ...robotsOverride === void 0 ? {} : { robotsOverride } };
     });
-    const atom = selection === void 0 ? ladder : {
+    const laneFor = (egress) => {
+      const rungs = channelsForUrl(mode, task.seedUrl, selection ?? {}, selection?.formats ?? [], false, true, egress);
+      const sessionFile = cookieSessionFileFor(task.taskDir, routeOf(egress));
+      return { egress, rungs, ladder: ladderFor(rungs), cookieSession: egressSessions && mode !== "authed" ? new TaskCookieSession(sessionFile) : void 0 };
+    };
+    removeCookieSessions(task.taskDir, cookieSessionFileFor(task.taskDir, routeOf(firstEgress)));
+    let current = laneFor(firstEgress);
+    lanes.push(current);
+    const closeLadders = async () => {
+      await Promise.all(lanes.map((lane) => lane.ladder.close()));
+    };
+    const pageAtom = selection === void 0 ? { scrape: (url, context) => {
+      const lane = current;
+      return lane.ladder.scrape(url, lane.cookieSession === void 0 ? context : { ...context, cookieSession: lane.cookieSession });
+    }, close: closeLadders } : {
       async scrape(url, context) {
-        const page = createExecutionScope({ ...context, deadlineAt: Math.min(context?.deadlineAt ?? Infinity, Date.now() + (selection.timeout ?? DEFAULT_SCRAPE_TIMEOUT_MS)) });
+        const lane = current;
+        const page = createExecutionScope({ ...context, deadlineAt: Math.min(context?.deadlineAt ?? Infinity, Date.now() + (selection.timeout ?? DEFAULT_SCRAPE_TIMEOUT_MS)), ...lane.cookieSession === void 0 ? {} : { cookieSession: lane.cookieSession } });
         const formats = selection.formats ?? ["markdown"];
         const wants = (name) => hasFormat(formats, name);
         const custom = customJsonFormat(formats);
-        const plan = cachePlanFor(url, mode, selection, selection.formats, rungs.channels, robotsOverrideFor?.(url));
+        const cachePlan = cachePlanFor(url, mode, selection, selection.formats, lane.rungs.channels, recordedOverrideFor?.(url), robotsOverrideFor?.(url) !== void 0);
+        const plan = lane.cookieSession === void 0 || cachePlan?.lockdown === true ? cachePlan : null;
         const answer = consultCache(plan, url, { mode, ...req.policyAllowlist.length ? { allowlistedDomains: req.policyAllowlist } : {} });
         const { outcome, json: json2 } = await (async () => {
-          const outcome2 = answer.kind === "fetch" ? await ladder.scrape(url, page).then((fetched) => ({ ...fetched, result: afterFetch(plan, answer, fetched.result) })) : { result: answer.result, links: answer.result.links ?? [], cached: answer.kind === "hit" };
+          const outcome2 = answer.kind === "fetch" ? await lane.ladder.scrape(url, page).then((fetched) => ({ ...fetched, result: afterFetch(plan, answer, fetched.result) })) : { result: answer.result, links: answer.result.links ?? [], cached: answer.kind === "hit" };
           const json3 = wants("json") ? await extractStructured(extractionInput(outcome2.result), custom, page, structuredModelConfigFromEnv()) : void 0;
           return { outcome: outcome2, json: json3 };
         })().finally(() => page.dispose());
@@ -26542,11 +28193,45 @@ function createApiEngine(options = {}) {
           ...json2 === void 0 ? {} : { json: json2 }
         } };
       },
-      close: () => ladder.close()
+      close: closeLadders
+    };
+    const atom = egressPool === null || firstEgress === void 0 ? pageAtom : {
+      async scrape(url, context) {
+        let used = current;
+        let outcome = await pageAtom.scrape(url, context);
+        const events = [];
+        while (egressInDoubt(outcome)) {
+          let reason2;
+          if (current === used) {
+            if (switches >= MAX_EGRESS_SWITCHES)
+              break;
+            const verdict = await probeEgress(used.egress.server);
+            if (verdict === "works")
+              break;
+            reason2 = verdict;
+            if (current === used) {
+              egressPool.fail(used.egress.id);
+              switches++;
+              const next = egressPool.pick(used.egress.id);
+              writeTaskEgress(egressFile, next.id);
+              current = laneFor(next);
+              lanes.push(current);
+              await used.cookieSession?.close();
+            }
+          } else {
+            reason2 = "moved_with_task";
+          }
+          events.push({ at: 0, lane: outcome.result.lane, event: "egress_switched", detail: { from: used.egress.id, to: current.egress.id, reason: reason2, switches } });
+          used = current;
+          outcome = await pageAtom.scrape(url, context);
+        }
+        return events.length === 0 ? outcome : { ...outcome, result: { ...outcome.result, trace: [...outcome.result.trace, ...events] } };
+      },
+      close: () => pageAtom.close()
     };
     const controller2 = new AbortController();
     crawlControllers.set(task.id, controller2);
-    const sitemapSource = req.sitemap === "skip" ? void 0 : new HttpSitemapSource({ mode, device: selection?.mobile === true ? "mobile" : "desktop", networkPolicy, scheduler: originScheduler, robots: robotsCacheFor(mode) });
+    const sitemapSource = req.sitemap === "skip" ? void 0 : new HttpSitemapSource({ mode, device: selection?.mobile === true ? "mobile" : "desktop", networkPolicy: firstEgress?.policy ?? networkPolicy, scheduler: originScheduler, robots: robotsCacheFor(mode, firstEgress), ignoreRobotsTxt: ignoreRobotsOverride(task.crawl?.ignoreRobotsTxt) !== void 0 });
     const webhook = webhookOf(task);
     const kind = jobKindOf(task);
     const onStep = async (step) => {
@@ -26563,6 +28248,8 @@ function createApiEngine(options = {}) {
     const orchestrator = new CrawlOrchestrator({
       store,
       atom,
+      // A page whose scrape threw called a provider only if this mode has one: otherwise its third-party cost is a known 0.
+      scrapeErrorCostUsd: channelsFor(mode).some((channel) => channel.vendorId !== void 0) ? null : 0,
       workerCount,
       perHostConcurrency: Math.min(4, networkPolicy.perHostConcurrency),
       perHostMinDelayMs: networkPolicy.perHostMinDelayMs,
@@ -26585,7 +28272,7 @@ function createApiEngine(options = {}) {
         ...task.batch ? { seedUrls: task.batch.urls } : {},
         taskDir: task.taskDir,
         mode,
-        budget: task.budget,
+        budget: grantedBudget(task.budget),
         maxDepth: req.maxDepth,
         allowlistedDomains: req.allowlistedDomains,
         resumeFrom: req.resume ? task.id : null,
@@ -26605,6 +28292,8 @@ function createApiEngine(options = {}) {
       }
       await finishJob(task, store);
       inflight.delete(task.id);
+      const after = await store.getTask(task.id);
+      await endCookieSession(after !== null && isTerminalStatus(after.status));
       await store.close();
     }).catch(async (error) => {
       inflight.delete(task.id);
@@ -26612,6 +28301,7 @@ function createApiEngine(options = {}) {
       runningCrawls.delete(task.id);
       await markCrawlFailed(store, task.id);
       await finishJob(task, store, error instanceof Error ? error.message : String(error));
+      await endCookieSession(true);
       await store.close();
     });
     runningCrawls.set(task.id, orchestrator);
@@ -26631,6 +28321,10 @@ function createApiEngine(options = {}) {
       } else {
         if (task !== null && webhookOf(task) !== void 0 && isTerminalStatus(task.status))
           await reconcileFinished(task, store);
+        if (task !== null && isTerminalStatus(task.status)) {
+          removeCookieSessions(taskDir);
+          rmSync(join10(taskDir, EGRESS_FILE), { force: true });
+        }
         void store.close();
       }
     }).catch(() => {
@@ -26651,26 +28345,29 @@ function createApiEngine(options = {}) {
     const deadlineAt = req.timeout === void 0 ? context.deadlineAt ?? Date.now() + DEFAULT_SCRAPE_TIMEOUT_MS : Math.min(context.deadlineAt ?? Infinity, Date.now() + req.timeout);
     const scope = createExecutionScope({ ...context, signal: context.signal ? AbortSignal.any([context.signal, shutdownController.signal]) : shutdownController.signal, deadlineAt });
     const mode = defaultApiMode(req.mode);
-    const rungs = channelsForUrl(mode, req.url, req, req.formats ?? []);
+    const rungs = channelsForUrl(mode, req.url, req, req.formats ?? [], true, true, mode === "authed" ? void 0 : egressPool?.pick());
     const policy = {
       mode,
       ...req.allowlistedDomains !== void 0 && req.allowlistedDomains.length > 0 ? { allowlistedDomains: req.allowlistedDomains } : {}
     };
     const runner = new LadderRunner(rungs.channels, policy, historyFor(mode), null, sessionsFor(mode), { channelsFiltered: rungs.filtered });
-    const plan = record3 ? cachePlanFor(req.url, mode, req, req.formats, rungs.channels, req.robotsOverride) : null;
+    const robotsOverride = req.robotsOverride ?? (record3 ? namedUrlOverride : void 0);
+    const plan = record3 ? cachePlanFor(req.url, mode, req, req.formats, rungs.channels, req.robotsOverride, robotsOverride !== void 0) : null;
     const operation = (async () => {
       const answer = consultCache(plan, req.url, policy);
-      const run = answer.kind === "fetch" ? await runner.run(req.url, void 0, scope, { ...fetchOptions(req, req.formats), ...req.robotsOverride === void 0 ? {} : { robotsOverride: req.robotsOverride } }).then((fetched) => ({ ...fetched, result: afterFetch(plan, answer, fetched.result) })) : { result: answer.result, ...untriedAudit(Math.round(performance.now() - overallStart)) };
+      const run = answer.kind === "fetch" ? await runner.run(req.url, void 0, scope, { ...fetchOptions(req, req.formats), ...robotsOverride === void 0 ? {} : { robotsOverride } }).then((fetched) => ({ ...fetched, result: afterFetch(plan, answer, fetched.result) })) : { result: answer.result, ...untriedAudit(Math.round(performance.now() - overallStart)) };
       const handed = req.handoff !== void 0 && answer.kind === "fetch" && handoffResult(run.result) ? await handOffScrape(req, run.result, context, hooks) : null;
       const read2 = handed !== null && "result" in handed ? handed.result : null;
       const result = handed === null ? withHandoffHint(run.result, req) : "reason" in handed ? withHandoffHint({ ...run.result, warnings: [...run.result.warnings ?? [], { code: "handoff_not_through", message: `Handed to you in your Chrome, the page was not read: ${handed.reason}.` }] }, req, true) : answer.kind === "fetch" && answer.missed && plan?.bounds != null ? withCacheMiss(handed.result, plan.bounds) : handed.result;
       const agentHints = read2 !== null ? agentHintsFor(req, { channelsTried: [result.lane], result }) : agentHintsFor(req, { ...run, result });
+      const summary = read2 === null ? run.summary : { ...run.summary, ...summarize(run.channelsTried, [...run.summary.attempts, { channel: read2.lane, result: read2, ordinal: run.summary.attempts.length + 1 }]) };
       const full = {
         ...result,
+        // The answer's third-party spend is the whole call's: a page read in the person's Chrome after a provider tried it still cost what the provider charged.
+        usage: { ...result.usage, externalCostUsd: summary.externalCostUsd },
         channelsTried: run.channelsTried,
         ladderTrace: run.ladderTrace,
-        // The call's totals count the read in the person's Chrome as one more attempt, after the stopped run's.
-        summary: read2 === null ? run.summary : { ...run.summary, ...summarize(run.channelsTried, [...run.summary.attempts, { channel: read2.lane, result: read2 }]) },
+        summary,
         ...agentHints.length === 0 ? {} : { agentHints }
       };
       const shapeScope = handed !== null && "result" in handed ? createExecutionScope({ signal: AbortSignal.any([...context.signal === void 0 ? [] : [context.signal], shutdownController.signal]) }) : scope;
@@ -26700,6 +28397,8 @@ function createApiEngine(options = {}) {
     }
   }
   async function runMap(req, context) {
+    checkRobotsOverride("ignoreRobotsTxt", req.ignoreRobotsTxt);
+    const robotsOverride = ignoreRobotsOverride(req.ignoreRobotsTxt);
     if (req.limit !== void 0 && req.limit > mapMaxLimit)
       throw new RequestError(`limit must be at most ${mapMaxLimit} on this server`);
     if (req.timeout !== void 0 && req.timeout > mapMaxTimeoutMs)
@@ -26708,20 +28407,21 @@ function createApiEngine(options = {}) {
     if (readsPage && options.channelPolicy?.(req.url) === "browser_only")
       throw new RequestError("map is not available for this URL: this server reads it with the browser lane only");
     const mode = req.mode ?? "standard";
-    const rungs = readsPage ? channelsForUrl(mode, req.url, { fastMode: true }, ["rawHtml"]) : null;
+    const egress = egressPool?.pick();
+    const rungs = readsPage ? channelsForUrl(mode, req.url, { fastMode: true }, ["rawHtml"], true, false, egress) : null;
     const requestedAt = (/* @__PURE__ */ new Date()).toISOString();
     const id = crypto.randomUUID();
     const signal = context.signal ? AbortSignal.any([context.signal, shutdownController.signal]) : shutdownController.signal;
     const userAgentFor = (url) => prepareHttpIdentity(mode, networkPolicy.contact ?? null, new URL(url).hostname).identity.userAgent;
-    const robots = robotsCacheFor(mode);
+    const robots = robotsCacheFor(mode, egress);
     const lookups = /* @__PURE__ */ new Map();
     const runner = rungs === null ? null : new LadderRunner(rungs.channels, { mode }, historyFor(mode), null, null, { channelsFiltered: rungs.filtered });
-    const sitemap = req.sitemap === "skip" ? null : new HttpSitemapSource({ mode, networkPolicy, scheduler: originScheduler, robots });
+    const sitemap = req.sitemap === "skip" ? null : new HttpSitemapSource({ mode, networkPolicy: egress?.policy ?? networkPolicy, scheduler: originScheduler, robots, ignoreRobotsTxt: robotsOverride !== void 0 });
     const sources = {
       async readStartPage(url, scope) {
         if (runner === null)
           throw new Error("a sitemap-only map reads no page");
-        const run = await runner.run(url, void 0, scope, fetchOptions(void 0, ["rawHtml"]));
+        const run = await runner.run(url, void 0, scope, { ...fetchOptions(void 0, ["rawHtml"]), ...robotsOverride === void 0 ? {} : { robotsOverride } });
         const result = run.result;
         const links = typeof result.rawHtml === "string" ? collectLinkDetails(result.rawHtml, result.evidence.finalUrl || url) : [];
         const clientRendered = result.warnings?.some((warning) => warning.code === "client_rendered_suspected") === true || httpLaneAskedForBrowser(result);
@@ -26739,7 +28439,7 @@ function createApiEngine(options = {}) {
           lookups.set(origin, lookup3);
         }
         const decision = robots.decision(await lookup3, url, userAgent);
-        return decision.decision === "disallowed" ? { disallowed: true, ...decision.unreachable === void 0 ? {} : { unreachable: decision.unreachable } } : decision.decision;
+        return decision.decision === "disallowed" ? { disallowed: true, ...decision.unreachable === void 0 ? {} : { unreachable: decision.unreachable }, ...isOctocrawlRobotsGroup(decision.matchedUserAgentGroup) ? { octocrawl: true } : {} } : decision.decision;
       },
       identity: { mode, userAgent: userAgentFor(req.url) }
     };
@@ -26758,7 +28458,8 @@ function createApiEngine(options = {}) {
           excludePaths: req.excludePaths,
           regexOnFullURL: req.regexOnFullURL,
           crawlEntireDomain: req.crawlEntireDomain,
-          deduplicateSimilarURLs: req.deduplicateSimilarURLs
+          deduplicateSimilarURLs: req.deduplicateSimilarURLs,
+          ignoreRobotsTxt: robotsOverride !== void 0
         }, { signal });
         const agentHints = mapAgentHints(run, mapMaxTimeoutMs);
         const { elapsedMs, ...rest } = run;
@@ -26788,7 +28489,7 @@ function createApiEngine(options = {}) {
       if (!UUID.test(id))
         return null;
       try {
-        return JSON.parse(await readFile5(join10(mapsDir, `${id}.json`), "utf8"));
+        return JSON.parse(await readFile6(join10(mapsDir, `${id}.json`), "utf8"));
       } catch (error) {
         if (error.code === "ENOENT")
           return null;
@@ -26799,7 +28500,7 @@ function createApiEngine(options = {}) {
       if (!UUID.test(scrapeId))
         return null;
       try {
-        return JSON.parse(await readFile5(join10(scrapesDir, `${scrapeId}.json`), "utf8"));
+        return JSON.parse(await readFile6(join10(scrapesDir, `${scrapeId}.json`), "utf8"));
       } catch (error) {
         if (error.code === "ENOENT")
           return null;
@@ -26807,6 +28508,7 @@ function createApiEngine(options = {}) {
       }
     },
     async startCrawl(req) {
+      checkRobotsOverride("ignoreRobotsTxt", req.ignoreRobotsTxt);
       checkFileCap(req);
       checkSelectors(req);
       checkAttributeSelectors(req.formats);
@@ -26840,7 +28542,7 @@ function createApiEngine(options = {}) {
           budget: {
             maxPages: req.maxPages ?? defaultMaxPages,
             maxWallMs: null,
-            maxCostUsd: null,
+            maxCostUsd: accessGrant?.budget.perRunUsd ?? null,
             maxTokens: null
           },
           crawl: {
@@ -26859,6 +28561,7 @@ function createApiEngine(options = {}) {
             allowExternalLinks: req.allowExternalLinks === true,
             sitemap: req.sitemap ?? "include",
             maxConcurrency: req.maxConcurrency ?? null,
+            ...req.ignoreRobotsTxt === true ? { ignoreRobotsTxt: true } : {},
             ...pageOptions(req),
             // The destination is registered first (`job:<taskId>`); the task stores everything but the header values.
             ...webhookConfig === void 0 ? {} : { webhook: jobWebhooks.register(taskId, webhookConfig, req.webhookPayloadFormat) }
@@ -26939,7 +28642,7 @@ function createApiEngine(options = {}) {
           taskDir,
           mode: defaultApiMode(req.mode),
           status: "pending",
-          budget: { maxPages: null, maxWallMs: options.batchMaxWallMs ?? null, maxCostUsd: null, maxTokens: null },
+          budget: { maxPages: null, maxWallMs: options.batchMaxWallMs ?? null, maxCostUsd: accessGrant?.budget.perRunUsd ?? null, maxTokens: null },
           batch,
           ...attributionOf(req),
           createdAt: now,
@@ -27078,8 +28781,11 @@ function createApiEngine(options = {}) {
           if (latest?.status === "running")
             await store.putAttempt({ ...latest, status: "cancelled", endedAt: now });
           crawlControllers.get(taskId)?.abort();
-          if (!inflight.has(taskId))
+          if (!inflight.has(taskId)) {
             await finishJob(task, store);
+            removeCookieSessions(join10(taskRoot, taskId));
+            rmSync(join10(taskRoot, taskId, EGRESS_FILE), { force: true });
+          }
         }
       } finally {
         await store.close();
@@ -27117,7 +28823,7 @@ function createApiEngine(options = {}) {
     },
     async importLogin(req) {
       if (options.hosted === true || (options.sessionsFile ?? null) === null || userChrome === null)
-        throw new LoginsUnavailableError("this server does not save logins: run W2L on your own machine (octocrawl serve, the local MCP host, or octocrawl login import)");
+        throw new LoginsUnavailableError("this server does not save logins: run Octocrawl on your own machine (octocrawl serve, the local MCP host, or octocrawl login import)");
       try {
         loginDomain(req.site);
       } catch (error) {
@@ -27242,25 +28948,32 @@ function createApiEngine(options = {}) {
     },
     retryDelivery: (id) => deliveryStore.replayDeadLetter(id),
     async createManagedSession(input) {
+      managedSessionsServed();
       const profileDir = join10(taskRoot, "profiles", crypto.randomUUID());
-      return sessionBroker.createManagedSession({ ...input, profileDir });
+      return publicSession(await sessionBroker.createManagedSession({ ...input, profileDir }));
     },
     async authorizeManagedSession(sessionRef, accountRef) {
-      return sessionBroker.markAuthorized(sessionRef, accountRef);
+      managedSessionsServed();
+      return publicSession(await sessionBroker.markAuthorized(sessionRef, accountRef));
     },
     async revokeManagedSession(sessionRef) {
+      managedSessionsServed();
       await sessionBroker.revoke(sessionRef);
     },
     async getManagedSession(sessionRef) {
-      return sessionBroker.getSession(sessionRef);
+      managedSessionsServed();
+      return publicSession(await sessionBroker.getSession(sessionRef));
     },
     async renewManagedSession(sessionRef, expiresAt) {
-      return sessionBroker.renewExpired(sessionRef, expiresAt);
+      managedSessionsServed();
+      return publicSession(await sessionBroker.renewExpired(sessionRef, expiresAt));
     },
     async requestManagedHandoff(sessionRef, reason2, expiresAt) {
-      return sessionBroker.requestHandoff(sessionRef, reason2, expiresAt);
+      managedSessionsServed();
+      return publicSession(await sessionBroker.requestHandoff(sessionRef, reason2, expiresAt));
     },
     async captureManagedSession(input) {
+      managedSessionsServed();
       const access = await sessionBroker.grant({ ...input, origin: input.url });
       if (access.kind !== "granted")
         return access;
@@ -27399,7 +29112,7 @@ function withoutFetchUsage(response) {
     ...timings.modelMs === void 0 ? {} : { modelMs: timings.modelMs },
     ...timings.totalMs === void 0 ? {} : { totalMs: timings.totalMs }
   };
-  return { ...response, usage: { ...usage2, bytesWire: 0, bytesDecompressed: 0, requestCount: 0, attemptCount: 0, browserMs: 0, externalCostUsd: null, ...own === void 0 ? {} : { timings: own } } };
+  return { ...response, usage: { ...usage2, bytesWire: 0, bytesDecompressed: 0, requestCount: 0, attemptCount: 0, browserMs: 0, externalCostUsd: 0, ...own === void 0 ? {} : { timings: own } } };
 }
 var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function prepareTaskRoot(taskRoot) {
@@ -27466,7 +29179,7 @@ async function appendedWithoutStep(taskId, store) {
   return await store.countCompletedSteps(taskId) < batch.urls.length ? { ...task, batch } : null;
 }
 function activeCrawlOptions(task) {
-  const { formats, includeLinks, includePaths, excludePaths, maxDepth, allowlistedDomains, useCached, regexOnFullURL, ignoreQueryParameters, deduplicateSimilarURLs, crawlEntireDomain, allowSubdomains, allowExternalLinks, sitemap, maxConcurrency, webhook: _webhook, ...page } = task.crawl ?? {};
+  const { formats, includeLinks, includePaths, excludePaths, maxDepth, allowlistedDomains, useCached, regexOnFullURL, ignoreQueryParameters, deduplicateSimilarURLs, crawlEntireDomain, allowSubdomains, allowExternalLinks, sitemap, maxConcurrency, ignoreRobotsTxt, webhook: _webhook, ...page } = task.crawl ?? {};
   return {
     maxPages: task.budget.maxPages,
     maxDepth: maxDepth ?? null,
@@ -27482,6 +29195,7 @@ function activeCrawlOptions(task) {
     allowExternalLinks: allowExternalLinks ?? false,
     regexOnFullURL: regexOnFullURL ?? false,
     maxConcurrency: maxConcurrency ?? null,
+    ignoreRobotsTxt: ignoreRobotsTxt === true,
     scrapeOptions: { formats: formats ?? ["markdown"], includeLinks: includeLinks === true, ...page }
   };
 }
@@ -27530,7 +29244,7 @@ function handoffRequestOf(step) {
   return {
     reason: HANDOFF_REASONS[blockReason],
     liveViewUrl: null,
-    rationale: `${step.url} stopped at a ${blockReason.replace(/_/g, " ")} W2L does not pass: POST /v1/batches/${step.taskId}/handoff (MCP hand_off_batch, or octocrawl batch --handoff) opens it in your own Chrome, where you get through it, and W2L reads the page there`
+    rationale: `${step.url} stopped at a ${blockReason.replace(/_/g, " ")} Octocrawl does not pass: POST /v1/batches/${step.taskId}/handoff (MCP hand_off_batch, or octocrawl batch --handoff) opens it in your own Chrome, where you get through it, and Octocrawl reads the page there`
   };
 }
 async function stepsOf(store, taskId, kind) {
@@ -27663,7 +29377,7 @@ function readOnlySessions(store) {
 }
 
 // packages/api/dist/auth.js
-import { createHash as createHash13, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { createHash as createHash14, timingSafeEqual as timingSafeEqual2 } from "crypto";
 function bearerTokenMatcher(tokens) {
   const accepted = tokens.map(digest);
   return (presented) => {
@@ -27675,7 +29389,7 @@ function bearerTokenMatcher(tokens) {
   };
 }
 function digest(token) {
-  return createHash13("sha256").update(token, "utf8").digest();
+  return createHash14("sha256").update(token, "utf8").digest();
 }
 
 // packages/api/dist/jobStream.js
@@ -27910,7 +29624,7 @@ function createApp(engine, options = {}) {
     app.use("*", async (c, next) => {
       if (c.req.method !== "POST" || !RATE_LIMITED_POSTS.has(c.req.path))
         return next();
-      const key = tokens.length === 0 ? "local" : createHash14("sha256").update(presentedToken(c), "utf8").digest("hex");
+      const key = tokens.length === 0 ? "local" : createHash15("sha256").update(presentedToken(c), "utf8").digest("hex");
       const retryAfterSeconds = limiter.retryAfterSeconds(key);
       if (retryAfterSeconds === null)
         return next();
@@ -28237,7 +29951,13 @@ function createApp(engine, options = {}) {
     const body = await c.req.json();
     if (typeof body.workspaceId !== "string" || typeof body.accountRef !== "string" || typeof body.originScope !== "string")
       return fail(c, "invalid_request", "workspaceId, accountRef, and originScope are required");
-    return c.json(await engine.createManagedSession({ workspaceId: body.workspaceId, accountRef: body.accountRef, originScope: body.originScope, expiresAt: typeof body.expiresAt === "string" ? body.expiresAt : null }), 201);
+    try {
+      return c.json(await engine.createManagedSession({ workspaceId: body.workspaceId, accountRef: body.accountRef, originScope: body.originScope, expiresAt: typeof body.expiresAt === "string" ? body.expiresAt : null }), 201);
+    } catch (error) {
+      if (error instanceof SessionsUnavailableError)
+        return fail(c, "conflict", error.message);
+      throw error;
+    }
   });
   app.post("/v1/sessions/:id/authorize", async (c) => {
     const body = await c.req.json();
@@ -28260,8 +29980,8 @@ function createApp(engine, options = {}) {
   app.get("/v1/sessions/:id", async (c) => {
     try {
       return c.json(await engine.getManagedSession(c.req.param("id")), 200);
-    } catch {
-      return fail(c, "not_found", "session not found");
+    } catch (error) {
+      return error instanceof SessionsUnavailableError ? fail(c, "conflict", error.message) : fail(c, "not_found", "session not found");
     }
   });
   app.post("/v1/sessions/:id/renew", async (c) => {
@@ -28286,7 +30006,13 @@ function createApp(engine, options = {}) {
     const body = await c.req.json();
     if (typeof body.workspaceId !== "string" || typeof body.accountRef !== "string" || typeof body.url !== "string")
       return fail(c, "invalid_request", "workspaceId, accountRef, and url are required");
-    return c.json(await engine.captureManagedSession({ sessionRef: c.req.param("id"), workspaceId: body.workspaceId, accountRef: body.accountRef, url: body.url }), 200);
+    try {
+      return c.json(await engine.captureManagedSession({ sessionRef: c.req.param("id"), workspaceId: body.workspaceId, accountRef: body.accountRef, url: body.url }), 200);
+    } catch (error) {
+      if (error instanceof SessionsUnavailableError)
+        return fail(c, "conflict", error.message);
+      throw error;
+    }
   });
   app.post("/fc/v1/scrape", async (c) => {
     const req = parseFirecrawlScrapeRequest(await c.req.json());
@@ -28342,8 +30068,40 @@ function createApp(engine, options = {}) {
 }
 
 // packages/api/dist/listen.js
+init_dist2();
+import { readFileSync as readFileSync4 } from "fs";
 init_dist();
 var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "::1", "[::1]"]);
+function readEgressProxies(env, grant, hosted) {
+  const proxies = egressProxies(env.W2L_EGRESS_PROXIES);
+  if (proxies.length === 0)
+    return [];
+  if (hosted)
+    throw new Error("W2L_EGRESS_PROXIES is refused on a hosted server (ADR 0005: a hosted server connects direct, to addresses it checked)");
+  if (!(grant?.capabilities ?? []).includes("egress_sessions"))
+    throw new Error("W2L_EGRESS_PROXIES needs an access grant that names egress_sessions (ADR 0005; --access-grant or W2L_ACCESS_GRANT)");
+  return proxies;
+}
+function readAccessGrant(argv, env, hosted) {
+  const source = (readFlag(argv, "--access-grant") ?? env["W2L_ACCESS_GRANT"] ?? "").trim();
+  if (source === "")
+    return null;
+  let text2;
+  try {
+    text2 = source.startsWith("{") ? source : readFileSync4(source, "utf8");
+  } catch (error) {
+    throw new Error(`access grant: cannot read ${source}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  const grant = accessGrantFromText(text2);
+  if (hosted && grant.tier === "my_browser") {
+    throw new Error("access grant refused: tier my_browser reads the person's own Chrome, which a hosted server does not have");
+  }
+  return grant;
+}
+function accessGrantNotice(grant) {
+  const usd2 = (value) => value === null ? "none" : `${value} USD`;
+  return `access grant (ADR 0005): tier ${grant.tier}; ${grant.capabilities.length === 0 ? "no capabilities" : grant.capabilities.join(", ")}; run budget ${usd2(grant.budget.perRunUsd)}; per-request budget ${usd2(grant.budget.perRequestUsd)} (not enforced yet)${grant.attestation === null ? "" : `; accepted by ${grant.attestation.principal}`}`;
+}
 function jobStreamsEnabled(env) {
   return (env["W2L_JOB_STREAMS"] ?? "").trim().toLowerCase() !== "off";
 }
@@ -28354,6 +30112,13 @@ function parseListen(argv, env = process.env) {
   const tokens = readTokens(argv, env);
   const rateLimit = parseRateLimit(argv, env);
   const workerCount = parseWorkerCount(env);
+  const accessGrant = readAccessGrant(argv, env, hosted);
+  const browserEngine = browserEngineChoice(env, accessGrant, hosted);
+  const engineNotice = browserEngine === "playwright" ? [] : [`browser engine: ${browserEngine} on the public browser rung (ADR 0005 enhanced_browser); saved logins and managed sessions keep stock Playwright`];
+  const compatHosts = compatHostsChoice(env, accessGrant, hosted);
+  const egressList = readEgressProxies(env, accessGrant, hosted);
+  const egressNotice = egressList.length === 0 ? [] : [`egress proxies (ADR 0005 egress_sessions): ${egressList.map((proxy) => proxy.endpoint).join(", ")}; a batch or crawl keeps one for its run and moves on only when the proxy itself fails its probe (at most 2 times), never after a block, a challenge, a 429 or a site's reset; a scrape takes the next healthy one`];
+  const compatNotice = compatHosts.length === 0 ? [] : [`compatible transport (ADR 0005 compatible_transport): ${COMPAT_LIBRARY.name} ${COMPAT_LIBRARY.version}, profile ${DEFAULT_COMPAT_PROFILE}, in place of the http rung for standard-mode pages on ${compatHosts.join(", ")} and their subdomains; a request with custom headers or mobile keeps the http rung`];
   if (hosted) {
     if (tokens.length === 0) {
       throw new Error("hosted mode requires --token, W2L_API_TOKEN or W2L_API_TOKENS");
@@ -28370,10 +30135,14 @@ function parseListen(argv, env = process.env) {
       mapMaxLimit: HOSTED_MAP_MAX_LIMIT,
       mapMaxTimeoutMs: HOSTED_MAP_MAX_TIMEOUT_MS,
       allowRobotsOverride: false,
-      notices: [hostedProxyNotice(env), ...jobStreamsEnabled(env) ? [] : [JOB_STREAMS_OFF_NOTICE]].filter((notice) => notice !== null),
+      notices: [hostedProxyNotice(env), ...jobStreamsEnabled(env) ? [] : [JOB_STREAMS_OFF_NOTICE], ...accessGrant === null ? [] : [accessGrantNotice(accessGrant)]].filter((notice) => notice !== null),
       ...rateLimit === void 0 ? {} : { rateLimit },
       delivery: deliveryConfig("hosted", env),
-      jobStreams: jobStreamsEnabled(env)
+      jobStreams: jobStreamsEnabled(env),
+      accessGrant,
+      browserEngine,
+      compatHosts,
+      egressProxies: egressList
     };
   }
   const networkPolicy = withOperatorContact(withEnvironmentProxy(tunedPolicy(localNetworkPolicy(), env), env), env);
@@ -28392,10 +30161,14 @@ function parseListen(argv, env = process.env) {
     mapMaxLimit: MAX_MAP_LIMIT,
     mapMaxTimeoutMs: MAX_MAP_TIMEOUT_MS,
     allowRobotsOverride: true,
-    notices: [...networkPolicy.egressProxy ? [describeEgressProxy(networkPolicy.egressProxy)] : [], ...jobStreamsEnabled(env) ? [] : [JOB_STREAMS_OFF_NOTICE]],
+    notices: [...networkPolicy.egressProxy ? [describeEgressProxy(networkPolicy.egressProxy)] : [], ...jobStreamsEnabled(env) ? [] : [JOB_STREAMS_OFF_NOTICE], ...accessGrant === null ? [] : [accessGrantNotice(accessGrant)], ...engineNotice, ...compatNotice, ...egressNotice],
     ...rateLimit === void 0 ? {} : { rateLimit },
     delivery: deliveryConfig("local", env),
-    jobStreams: jobStreamsEnabled(env)
+    jobStreams: jobStreamsEnabled(env),
+    accessGrant,
+    browserEngine,
+    compatHosts,
+    egressProxies: egressList
   };
 }
 function deliveryConfig(mode, env = process.env) {
@@ -28480,12 +30253,18 @@ function readFlag(argv, name) {
 
 // packages/api/dist/cli.js
 import { serve } from "@hono/node-server";
-import { readFileSync as readFileSync2 } from "fs";
+import { readFileSync as readFileSync5 } from "fs";
 import { join as join11 } from "path";
 import { pathToFileURL as pathToFileURL2 } from "url";
 async function runApiServer(argv, env = process.env, options = {}) {
   const log = options.log ?? ((line) => console.log(line));
   const listen = parseListen([...argv], env);
+  if (listen.browserEngine === "patchright") {
+    const engine2 = await loadPatchrightEngine();
+    log(`w2l-api: patchright ${engine2.version ?? "(version unknown)"} loaded`);
+  }
+  if (listen.compatHosts.length > 0)
+    await loadImpit();
   const taskRoot = env.W2L_TASK_ROOT ?? ".w2l/api";
   const servesLogins = listen.mode === "local" && isLoopbackAuthority(listen.host.includes(":") && !listen.host.startsWith("[") ? `[${listen.host}]` : listen.host, false);
   if (listen.mode === "local" && !servesLogins)
@@ -28502,7 +30281,11 @@ async function runApiServer(argv, env = process.env, options = {}) {
     // A page a check stopped is handed to the person in their own Chrome by a server that answers them alone.
     userChrome: servesLogins ? {} : null,
     webhookPolicy: { allowHttpLoopback: listen.delivery.allowHttpLoopback },
-    workerCount: listen.workerCount
+    workerCount: listen.workerCount,
+    accessGrant: listen.accessGrant,
+    browserEngine: listen.browserEngine,
+    compatHosts: listen.compatHosts,
+    egressProxies: listen.egressProxies
   });
   const app = createApp(engine, { loopbackOnly: servesLogins, tokens: listen.tokens, exposeInternalErrors: listen.mode === "local", jobStreams: listen.jobStreams, ...listen.rateLimit === void 0 ? {} : { rateLimit: listen.rateLimit } });
   const deliveryStore = DeliveryStore.open(join11(taskRoot, "section-b-control.sqlite"));
@@ -28510,7 +30293,7 @@ async function runApiServer(argv, env = process.env, options = {}) {
     networkPolicy: listen.delivery.networkPolicy,
     allowHttpLoopback: listen.delivery.allowHttpLoopback,
     ...listen.delivery.proxyUrl === void 0 ? {} : { proxyUrl: listen.delivery.proxyUrl },
-    ...listen.delivery.caFile === void 0 ? {} : { ca: readFileSync2(listen.delivery.caFile) }
+    ...listen.delivery.caFile === void 0 ? {} : { ca: readFileSync5(listen.delivery.caFile) }
   });
   const workerController = new AbortController();
   const workerLoop = worker.run(workerController.signal).catch((error) => {
@@ -28588,6 +30371,7 @@ var KINDS = {
   allowExternalLinks: "boolean",
   includeSubdomains: "boolean",
   handoff: "boolean",
+  ignoreRobotsTxt: "boolean",
   waitFor: "int",
   timeout: "int",
   maxFileBytes: "int",
@@ -28772,8 +30556,8 @@ function usage(command) {
   }
   const synopsis = {
     crawl: "usage: octocrawl crawl <url> [options] [--out <dir>] | octocrawl crawl --resume <taskId>",
-    scrape: "usage: octocrawl scrape <url> [options] [--markdown] [--out <dir>] [--handoff]\n\n--handoff: a page a captcha, a challenge or a login wall stops opens in a new tab of your own Chrome\n(remote debugging on at chrome://inspect/#remote-debugging; click Allow); get through it there and click on the page,\nand W2L answers with it. W2L passes no check itself.",
-    batch: "usage: octocrawl batch <url>... [--urls-file <file>] [options] [--out <dir>] [--handoff]\n\n--handoff: when the batch ends, each page a captcha, a challenge or a login wall stopped opens in a new tab\nof your own Chrome (remote debugging on at chrome://inspect/#remote-debugging; click Allow once); get through\nit there and W2L reads the page. W2L passes no check itself.",
+    scrape: "usage: octocrawl scrape <url> [options] [--markdown] [--out <dir>] [--handoff]\n\n--handoff: a page a captcha, a challenge or a login wall stops opens in a new tab of your own Chrome\n(remote debugging on at chrome://inspect/#remote-debugging; click Allow); get through it there and click on the page,\nand Octocrawl answers with it. Octocrawl passes no check itself.",
+    batch: "usage: octocrawl batch <url>... [--urls-file <file>] [options] [--out <dir>] [--handoff]\n\n--handoff: when the batch ends, each page a captcha, a challenge or a login wall stopped opens in a new tab\nof your own Chrome (remote debugging on at chrome://inspect/#remote-debugging; click Allow once); get through\nit there and Octocrawl reads the page. Octocrawl passes no check itself.",
     map: "usage: octocrawl map <url> [options]"
   };
   const lines = optionKeys(command).map((key) => {
@@ -28805,7 +30589,7 @@ var LOGIN_USAGE = [
   "`octocrawl scrape <url> --mode authed` (and the API and MCP in mode authed) read the page signed in as you.",
   "First open chrome://inspect/#remote-debugging in Chrome 144 or later and turn on",
   '"Allow remote debugging for this browser instance"; Chrome then asks "Allow remote debugging?": click Allow.',
-  "W2L connects once, reads that site's cookies and the localStorage of its tabs you have open",
+  "Octocrawl connects once, reads that site's cookies and the localStorage of its tabs you have open",
   "(a site that keeps its login there needs a tab of it open), disconnects, and loads nothing in your tabs.",
   "Logins are kept in W2L_SESSIONS_FILE, else ~/.w2l/sessions.json (readable by you alone)."
 ].join("\n");
@@ -28890,7 +30674,7 @@ ${LOGIN_USAGE}`);
 }
 
 // packages/cli/src/run.ts
-var CLI_VERSION = "0.3.0";
+var CLI_VERSION = "0.3.1";
 async function runCli(argv, io) {
   const [name, ...rest] = argv;
   if (name === void 0 || name === "--help" || name === "help") {
@@ -28918,7 +30702,14 @@ ${usage(null)}`);
     }
     if (command === "batch" && line.cli.urlsFile !== void 0) line.urls.push(...await urlsFrom(line.cli.urlsFile));
     const taskRoot = line.cli.taskRoot ?? io.env.W2L_TASK_ROOT ?? ".w2l/cli";
-    const listen = parseListen([], { ...io.env, W2L_API_HOST: "127.0.0.1" });
+    let listen;
+    try {
+      listen = parseListen([], { ...io.env, W2L_API_HOST: "127.0.0.1" });
+      if (listen.browserEngine === "patchright") await loadPatchrightEngine();
+      if (listen.compatHosts.length > 0) await loadImpit();
+    } catch (error) {
+      throw new UsageError(error instanceof Error ? error.message : String(error));
+    }
     for (const notice of listen.notices) io.stderr(`octocrawl: ${notice}`);
     const engine = createApiEngine({
       taskRoot,
@@ -28929,7 +30720,11 @@ ${usage(null)}`);
       userChrome: {},
       webhookPolicy: { allowHttpLoopback: listen.delivery.allowHttpLoopback },
       workerCount: listen.workerCount,
-      resumeOnStart: false
+      resumeOnStart: false,
+      accessGrant: listen.accessGrant,
+      browserEngine: listen.browserEngine,
+      compatHosts: listen.compatHosts,
+      egressProxies: listen.egressProxies
     });
     try {
       return await runCommand(engine, command, line.urls, line.body, line.cli, io);
@@ -29025,8 +30820,8 @@ async function finish(engine, kind, taskId, cli, io) {
 function handoffPrompts(command, io) {
   return {
     onWaiting: (url, check) => io.stderr(`octocrawl ${command}: ${url} shows a ${check.replace(/_/g, " ")}: get through it in the Chrome tab that opened (click Allow if Chrome asks)`),
-    onConfirm: (url) => io.stderr(`octocrawl ${command}: ${url} shows no check in your Chrome: click on the page if it is the one to read (W2L reads it only once you act in its tab)`),
-    onHidden: (url) => io.stderr(`octocrawl ${command}: the Chrome tab W2L opened for ${url} is not in front: switch to it (clicks in another tab or window are not seen)`),
+    onConfirm: (url) => io.stderr(`octocrawl ${command}: ${url} shows no check in your Chrome: click on the page if it is the one to read (Octocrawl reads it only once you act in its tab)`),
+    onHidden: (url) => io.stderr(`octocrawl ${command}: the Chrome tab Octocrawl opened for ${url} is not in front: switch to it (clicks in another tab or window are not seen)`),
     ...io.signal === void 0 ? {} : { signal: io.signal }
   };
 }
@@ -29056,8 +30851,8 @@ async function settled(engine, kind, taskId, signal) {
 }
 async function writeOut(dir, pages, report, io) {
   await mkdir9(dir, { recursive: true });
-  await writeFile8(join12(dir, "results.jsonl"), pages.map((page) => JSON.stringify(page)).join("\n") + (pages.length > 0 ? "\n" : ""));
-  if (report !== null) await writeFile8(join12(dir, "report.json"), JSON.stringify(report, null, 2));
+  await writeFile9(join12(dir, "results.jsonl"), pages.map((page) => JSON.stringify(page)).join("\n") + (pages.length > 0 ? "\n" : ""));
+  if (report !== null) await writeFile9(join12(dir, "report.json"), JSON.stringify(report, null, 2));
   let markdowns = 0;
   let tables = 0;
   const rows = [EVIDENCE_COLUMNS.join(",")];
@@ -29065,17 +30860,17 @@ async function writeOut(dir, pages, report, io) {
     const stem = `${String(n + 1).padStart(4, "0")}-${slug(page.url ?? page.requestedUrl ?? "")}`;
     const markdownFile = typeof page.markdown === "string" ? `${stem}.md` : null;
     if (markdownFile !== null) {
-      await writeFile8(join12(dir, markdownFile), page.markdown);
+      await writeFile9(join12(dir, markdownFile), page.markdown);
       markdowns++;
     }
     rows.push(evidenceRow(page, markdownFile).map(csvField).join(","));
     for (const table of page.tables ?? []) {
       if (table.omitted !== void 0) continue;
-      await writeFile8(join12(dir, `${stem}.table-${table.tableIndex}.csv`), table.csv);
+      await writeFile9(join12(dir, `${stem}.table-${table.tableIndex}.csv`), table.csv);
       tables++;
     }
   }
-  await writeFile8(join12(dir, "results.csv"), rows.map((row) => `${row}\r
+  await writeFile9(join12(dir, "results.csv"), rows.map((row) => `${row}\r
 `).join(""));
   io.stderr(`octocrawl: wrote ${pages.length} results (results.jsonl, results.csv), ${markdowns} Markdown files and ${tables} CSV tables to ${dir}`);
 }
@@ -29132,11 +30927,11 @@ function slug(url) {
   return text2.replace(/[^A-Za-z0-9.-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 80) || "page";
 }
 async function urlsFrom(file) {
-  return (await readFile6(file, "utf8")).split(/\r?\n/).map((line) => line.replace(/#.*/, "").trim()).filter((line) => line !== "");
+  return (await readFile7(file, "utf8")).split(/\r?\n/).map((line) => line.replace(/#.*/, "").trim()).filter((line) => line !== "");
 }
 async function serve2(argv, io) {
   if (argv.includes("--help")) {
-    io.stdout("usage: octocrawl serve [--port <n>] [--host <addr>] [--hosted --token <t>] [--rate-limit-per-minute <n>] [--task-root <dir>]\nRuns the local API (as w2l-api does) on --task-root, else W2L_TASK_ROOT, else .w2l/api, until SIGINT.");
+    io.stdout("usage: octocrawl serve [--port <n>] [--host <addr>] [--hosted --token <t>] [--rate-limit-per-minute <n>] [--task-root <dir>] [--access-grant <file>]\nRuns the local API (as w2l-api does) on --task-root, else W2L_TASK_ROOT, else .w2l/api, until SIGINT. --access-grant (or W2L_ACCESS_GRANT) names what enhanced access may do (ADR 0005).");
     return 0;
   }
   const rest = [...argv];