@profullstack/x402-gateway 0.6.0 → 0.8.0

package/README.md

@@ -89,7 +89,11 @@ export const GET = robotsRoute(gateway, { disallow: ['/login', '/api/'] });
 | `header` | `x-crawl-pass` | where the pass goes; `Authorization: Bearer` works too |
 | `path` | `/crawl` | the sales page |
 | `openPaths` | `[]` | extra paths a refused crawler may read (`robots.txt`, the sales page, `security.txt` and `.well-known/` always are) |
-| `isPaidAgent` | training list | `(userAgent) => boolean` |
+| `isPaidAgent` | training + scraper + headless lists | `(userAgent) => boolean` |
+| `scrapers` | `SCRAPER_AGENTS` | SEO resellers (AhrefsBot, SemrushBot, MJ12bot, DataForSeoBot, ...): charged and refused in robots.txt |
+| `headless` | `HEADLESS_AGENTS` | headless browsers that name themselves (Lightpanda, HeadlessChrome, PhantomJS): charged |
+| `chargeStaleBrowsers` | `true` | charge a desktop Chrome/Edge/Firefox string about two years behind its auto-updates. Scraper rotation pools copy old strings; people's browsers update themselves. Phones, Firefox ESRs and the last version an old OS can run are never judged |
+| `welcome` | `WELCOME_CRAWLERS` | Googlebot, bingbot and Applebot read unmetered when their address is in the operator's published range. A copied string from anywhere else is metered like everyone; `false` turns this off |
 | `training`, `retrieval` | the lists in `./agents` | |
 | `secret` | the CoinPay key | pass signing secret |
 | `page` | built in | `(ctx) => html` |
@@ -99,9 +103,19 @@ export const GET = robotsRoute(gateway, { disallow: ['/login', '/api/'] });
 | `denyCidrs` | `[]` | IPv4 ranges answered with a tiny `403` before anything else. For a VPS fleet that spoofs a browser: hosting ranges serve no readers. |
 | `chargeSpoofedBrowsers` | `false` | charge a request that claims `Chrome/…` but sends no `Sec-Fetch-Mode`. Every Chromium since 76, headless included, sends it on every request and no script or extension can remove it, so its absence means an HTTP client with a copied string. Firefox and Safari are not judged. |
 | `exempt` | | `(request) => boolean`, never charged: e.g. a request carrying your signed-in cookie |
+| `powerKeys` | Profullstack's | Power Keys honoured as a pass, kid to public key. `false` switches it off. See below. |
+| `revokedKeys` | | Power Key subjects no longer honoured |
 
 Without `coinpay.apiKey` and `payTo` the gateway still answers training crawlers with 402 and the page says payments are off. Nothing is sold, but nothing is given away either.
 
+## One key for every site
+
+A day pass opens one site for a day. A [Power Key](https://profullstack.com/shop) is bought once and opens every Profullstack property for good: no crawler paywall, no allowance, no per-site pass. It is an Ed25519-signed token from [`@profullstack/keys`](https://www.npmjs.com/package/@profullstack/keys), and the gateway verifies it offline with the public key that package ships, so a site honours it with no configuration and no call to anyone.
+
+A client sends it as `Authorization: Bearer pfs_...`, in `x-power-key`, or as `x-api-key`. `passFrom` reads it and `verifyPass` verifies it, so a throttle built on the gateway skips it the same way it skips a day pass. The 402 body carries `powerKey: { shop, header }` and the sales page says where to buy one.
+
+Running the gateway somewhere that is not a Profullstack property? Pass `powerKeys: false`, or your own `{ kid: publicKey }` map to sell keys of your own with `mintKey` from the same package.
+
 ## A free allowance that sells instead of refusing
 
 Named crawlers are one problem. The other is an ordinary client hammering the

package/index.d.ts

@@ -34,6 +34,8 @@ export interface PageContext {
   training: string[];
   retrieval: string[];
   contact: string;
+  /** Where a Power Key is bought and the header it goes in, or null when they are switched off. */
+  powerKey?: { shop: string; header: string } | null;
 }
 
 export interface GatewayOptions {
@@ -66,6 +68,14 @@ export interface GatewayOptions {
   denyCidrs?: string[];
   /** Charge a request that claims "Chrome/…" but lacks the Sec-Fetch-Mode header every Chromium sends. Default false. */
   chargeSpoofedBrowsers?: boolean;
+  /** Charge a desktop browser string ~2 years behind its auto-updates (a scraper rotation pool). Default true. */
+  chargeStaleBrowsers?: boolean;
+  /** SEO resellers: charged, and refused in robots.txt. Default SCRAPER_AGENTS. */
+  scrapers?: string[];
+  /** Headless browsers that name themselves: charged. Default HEADLESS_AGENTS. */
+  headless?: string[];
+  /** Search crawlers never metered when their address matches their name. Default WELCOME_CRAWLERS; false disables. */
+  welcome?: WelcomeCrawler[] | false;
   /** Requests never charged, e.g. ones carrying a signed-in cookie. */
   exempt?: (request: Request) => boolean;
   /** Pass signing secret. Defaults to the CoinPay key. */
@@ -82,6 +92,15 @@ export interface GatewayOptions {
   freeQuota?: number | FreeQuotaOptions;
   /** What a pass unlocks, listed on the sales page and in the 402 body. */
   benefits?: string[];
+  /**
+   * Power Keys honoured as a pass: kid -> base64url Ed25519 public key, as
+   * @profullstack/keys ships them. Defaults to Profullstack's keys, so a key
+   * bought at profullstack.com/shop opens this site with no configuration.
+   * `false` switches it off.
+   */
+  powerKeys?: Record<string, string> | false;
+  /** Power Key subjects no longer honoured (refunded, leaked). */
+  revokedKeys?: Iterable<string>;
   fetch?: typeof fetch;
 }
 
@@ -176,10 +195,14 @@ export interface Gateway {
   };
   robotsTxt: (extra?: RobotsOptions) => string;
   page: () => string;
-  /** The pass this request presents, from the gateway's header or a bearer token. */
+  /** The pass this request presents: a day pass from the gateway's header or a bearer token, or a Power Key. */
   passFrom: (request: Request) => string | null;
-  /** Whether that token is a live pass this gateway minted. */
+  /** Whether that token opens the site: a live day pass this gateway minted, or a valid, unrevoked Power Key. */
   verifyPass: (token: string | null) => Promise<boolean>;
+  /** Whether the gateway's own rules charge this request (lists, spoofed or stale browser). */
+  isPaid: (request: Request) => boolean;
+  /** Whether this is a welcome search crawler whose address matches its name. */
+  isWelcome: (request: Request) => boolean;
   /** The x402 offer this gateway would make, without answering a request. */
   offer: (days?: number) => Offer;
   /** The full 402 body around that offer: the offer plus the pass terms. */
@@ -190,6 +213,13 @@ export function createGateway(options: GatewayOptions): Gateway;
 export function wantsHtml(accept?: string | null): boolean;
 
 export const TRAINING_AGENTS: string[];
+export const SCRAPER_AGENTS: string[];
+export const HEADLESS_AGENTS: string[];
+export interface WelcomeCrawler {
+  token: string;
+  cidrs: string[];
+}
+export const WELCOME_CRAWLERS: WelcomeCrawler[];
 export const RETRIEVAL_AGENTS: string[];
 export function isTrainingAgent(userAgent?: string | null, agents?: string[]): boolean;
 
@@ -202,6 +232,9 @@ export function compileCidrs(list?: string[]): Cidr[];
 export function inCidrs(ip: string, compiled: Cidr[]): boolean;
 export function clientIp(request: Request): string;
 export function isSpoofedBrowser(request: Request): boolean;
+export function isStaleBrowser(userAgent: string, now?: number, maxMajorsBehind?: number): boolean;
+export function currentMajor(browser: 'chrome' | 'firefox', now?: number): number;
+export function welcomeCrawler(request: Request, list: WelcomeCrawler[] | null | undefined): string | null;
 export function renderPage(ctx: PageContext): string;
 
 export function mintPass(args: { secret: string; ref: string | null; expiresAt: number; now?: number }): Promise<{ token: string; expiresAt: number; ref: string | null }>;

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "@profullstack/x402-gateway",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "type": "module",
-  "description": "Sell crawl access to AI training crawlers by the day over x402, settled by CoinPay. One middleware: 402 with an offer, a sales page with CLI instructions, signed passes, and a robots.txt that keeps search crawlers welcome.",
+  "description": "Sell crawl access to AI training crawlers by the day over x402, settled by CoinPay. One middleware: 402 with an offer, a sales page with CLI instructions, signed passes, Profullstack Power Keys honoured as a pass, and a robots.txt that keeps search crawlers welcome.",
   "keywords": [
     "x402",
+    "power-key",
     "402",
     "payment-required",
     "crawler",
@@ -69,5 +70,8 @@
   "sideEffects": false,
   "scripts": {
     "test": "node --test"
+  },
+  "dependencies": {
+    "@profullstack/keys": "^0.1.0"
   }
 }

package/src/agents.js

@@ -24,8 +24,35 @@ export const TRAINING_AGENTS = [
   'FacebookBot',
   'Bytespider',
   'Applebot-Extended',
+  // Amazon documents Amazonbot's crawl as one that "may be used to train
+  // Amazon AI models", and it sends no reader back from any of it.
+  'Amazonbot',
 ];
 
+/**
+ * Crawlers that resell what they read and send nobody back: SEO backlink and
+ * keyword databases. They do obey robots.txt, so they are refused there as well
+ * as charged, which is the cheapest outcome of all: they stop asking.
+ */
+export const SCRAPER_AGENTS = [
+  'AhrefsBot',
+  'SemrushBot',
+  'MJ12bot',
+  'DataForSeoBot',
+  'DotBot',
+  'BLEXBot',
+  'serpstatbot',
+  'Barkrowler',
+];
+
+/**
+ * Headless browsers that say so. Nobody reads a page through one of these; a
+ * scrape does, and it runs the page's scripts while it is at it. Lightpanda was
+ * 151k requests from 63k addresses on one site in a day (2026-10-19). They do
+ * not read robots.txt, so they are charged, never named there.
+ */
+export const HEADLESS_AGENTS = ['Lightpanda', 'HeadlessChrome', 'PhantomJS'];
+
 /**
  * Retrieval crawlers, named in robots.txt so their operators can see they are
  * welcome. Google-Extended is Google's training token but Google documents it
@@ -57,3 +84,23 @@ export function isTrainingAgent(userAgent = '', agents = TRAINING_AGENTS) {
   if (!ua) return false;
   return lower(agents).some((t) => ua.includes(t));
 }
+
+/**
+ * Search crawlers that are welcome everywhere, with the address ranges their
+ * operators publish. A user agent alone is not enough to spare a caller from
+ * the free allowance -- "Googlebot" is the first string a scraper copies -- so
+ * a crawler is only spared when its address agrees with its name.
+ *
+ * Ranges are the stable blocks of each operator's published list
+ * (developers.google.com/static/search/apis/ipranges/googlebot.json,
+ * bing.com/toolbox/bingbot.json, Apple's 17.0.0.0/8); a crawl from outside them
+ * is simply metered like everyone else, which fails safe.
+ */
+export const WELCOME_CRAWLERS = [
+  { token: 'Googlebot', cidrs: ['66.249.64.0/19', '192.178.4.0/22', '34.100.182.96/28'] },
+  {
+    token: 'bingbot',
+    cidrs: ['40.77.167.0/24', '157.55.39.0/24', '207.46.13.0/24', '52.167.144.0/24', '40.77.188.0/22', '20.15.133.160/27'],
+  },
+  { token: 'Applebot', cidrs: ['17.0.0.0/8'] },
+];

package/src/edge.js

@@ -111,3 +111,97 @@ export function isSpoofedBrowser(request) {
   if (DECLARES_ITSELF.test(ua)) return false;
   return !request.headers.has('sec-fetch-mode');
 }
+
+/* ---------------------------------------------------------- stale strings -- */
+
+/*
+ * Where each browser's version stood on a known day, and how fast it moves:
+ * both ship a major every four weeks. Computing "current" from the date keeps
+ * the check from going stale itself, which a hard-coded number would within a
+ * year.
+ */
+const DAY = 86_400_000;
+const CADENCE = 28 * DAY;
+const CHROME_ANCHOR = { major: 120, at: Date.UTC(2023, 11, 5) };
+const FIREFOX_ANCHOR = { major: 121, at: Date.UTC(2023, 11, 19) };
+
+/** The major a browser that auto-updates would be on at `now`. */
+export function currentMajor(browser, now = Date.now()) {
+  const a = browser === 'firefox' ? FIREFOX_ANCHOR : CHROME_ANCHOR;
+  return a.major + Math.max(0, Math.floor((now - a.at) / CADENCE));
+}
+
+/*
+ * The last version an old operating system can run, and Firefox's extended
+ * support releases. A person stuck on one of these is still a person, so these
+ * are never called stale, however old.
+ */
+const TERMINAL_CHROME = [
+  { major: 109, os: /Windows NT 6\./ }, // Windows 7, 8, 8.1
+  { major: 116, os: /Macintosh/ }, // macOS 10.13, 10.14
+  { major: 128, os: /Macintosh/ }, // macOS 10.15
+  { major: 138, os: /Macintosh/ }, // macOS 11
+];
+const FIREFOX_ESR = [115, 128, 140, 153];
+
+/**
+ * A desktop browser string far older than anything that auto-updates.
+ *
+ * Chrome, Edge and Firefox update themselves every four weeks, so a desktop
+ * "Chrome/120" two years after Chrome 120 shipped is a string copied into a
+ * scraper's rotation pool, not a browser. That is exactly what the swarms do:
+ * on 2026-10-19 one pool of ten strings (Chrome 118-120, Edge 119-120, Firefox
+ * 120-121) walked watchnews.now and r4ck.dev from thousands of residential
+ * addresses, running the page scripts as it went.
+ *
+ * Only desktop strings are judged. Phones and embedded webviews legitimately
+ * sit years behind, and a declared crawler is judged by the lists instead.
+ *
+ * @param {string} ua
+ * @param {number} [now]
+ * @param {number} [maxMajorsBehind=24]  about 22 months of releases
+ */
+export function isStaleBrowser(ua, now = Date.now(), maxMajorsBehind = 24) {
+  const s = String(ua ?? '');
+  if (!/Windows NT|Macintosh|X11; (?:Linux|Ubuntu|Fedora)/.test(s)) return false;
+  if (/Mobile|Android|iPhone|iPad|CrOS/.test(s)) return false;
+  if (DECLARES_ITSELF.test(s)) return false;
+
+  const ff = /\bFirefox\/(\d+)/.exec(s);
+  if (ff) {
+    const major = Number(ff[1]);
+    if (FIREFOX_ESR.includes(major)) return false;
+    return major < currentMajor('firefox', now) - maxMajorsBehind;
+  }
+  const chrome = /\bChrome\/(\d+)/.exec(s);
+  if (chrome) {
+    const major = Number(chrome[1]);
+    if (TERMINAL_CHROME.some((t) => t.major === major && t.os.test(s))) return false;
+    return major < currentMajor('chrome', now) - maxMajorsBehind;
+  }
+  return false;
+}
+
+/* -------------------------------------------------------- welcome crawlers -- */
+
+const COMPILED = new WeakMap();
+
+/**
+ * The welcome crawler a request is, judged by name AND address, or null.
+ *
+ * @param {Request} request
+ * @param {{token: string, cidrs: string[]}[]} list  e.g. WELCOME_CRAWLERS
+ */
+export function welcomeCrawler(request, list) {
+  if (!list?.length) return null;
+  const ua = (request.headers.get('user-agent') ?? '').toLowerCase();
+  if (!ua) return null;
+  const ip = clientIp(request);
+  for (const c of list) {
+    if (!ua.includes(c.token.toLowerCase())) continue;
+    let compiled = COMPILED.get(c);
+    if (!compiled) COMPILED.set(c, (compiled = compileCidrs(c.cidrs)));
+    if (inCidrs(ip, compiled)) return c.token;
+  }
+  return null;
+}

package/src/index.js

@@ -1,5 +1,6 @@
-import { isTrainingAgent, RETRIEVAL_AGENTS, TRAINING_AGENTS } from './agents.js';
-import { clientIp, compileCidrs, inCidrs, isSpoofedBrowser } from './edge.js';
+import { HEADER as POWER_KEY_HEADER, isPowerKey, keyFrom, PROFULLSTACK_KEYS, SHOP_URL, verifyKey } from '@profullstack/keys';
+import { HEADLESS_AGENTS, isTrainingAgent, RETRIEVAL_AGENTS, SCRAPER_AGENTS, TRAINING_AGENTS, WELCOME_CRAWLERS } from './agents.js';
+import { clientIp, compileCidrs, inCidrs, isSpoofedBrowser, isStaleBrowser, welcomeCrawler } from './edge.js';
 import { memoryQuotaStore, meters, normaliseQuota, quotaHeaders, spend } from './quota.js';
 import { renderPage } from './page.js';
 import { mintPass, readPass } from './pass.js';
@@ -15,13 +16,14 @@ import {
   verifyAndSettle,
 } from './x402.js';
 
-export { isTrainingAgent, RETRIEVAL_AGENTS, TRAINING_AGENTS } from './agents.js';
-export { clientIp, compileCidrs, inCidrs, isSpoofedBrowser, parseCidr } from './edge.js';
+export { HEADLESS_AGENTS, isTrainingAgent, RETRIEVAL_AGENTS, SCRAPER_AGENTS, TRAINING_AGENTS, WELCOME_CRAWLERS } from './agents.js';
+export { clientIp, compileCidrs, currentMajor, inCidrs, isSpoofedBrowser, isStaleBrowser, parseCidr, welcomeCrawler } from './edge.js';
 export { renderPage } from './page.js';
 export { mintPass, readPass } from './pass.js';
 export { robotsTxt } from './robots.js';
 export { buildOffer, decodePayment, expectedFor, METHODS, verifyAndSettle } from './x402.js';
 export { memoryQuotaStore, normaliseQuota, quotaHeaders, spend } from './quota.js';
+export { isPowerKey, keyFrom, PROFULLSTACK_KEYS, verifyKey } from '@profullstack/keys';
 
 /**
  * A gateway that sells crawl access to training crawlers, by the day, over x402.
@@ -54,8 +56,14 @@ export { memoryQuotaStore, normaliseQuota, quotaHeaders, spend } from './quota.j
  * @param {(ua: string) => boolean} [options.isPaidAgent]
  * @param {string[]} [options.denyCidrs]           IPv4 ranges answered 403 before anything else, e.g. a VPS fleet's provider
  * @param {boolean} [options.chargeSpoofedBrowsers=false]  charge a "Chrome/…" request that lacks the Sec-Fetch-Mode header every Chromium sends
+ * @param {boolean} [options.chargeStaleBrowsers=true]  charge a desktop browser string two years behind its auto-updates (a rotation pool)
+ * @param {string[]} [options.scrapers]            SEO resellers charged and refused in robots.txt; default SCRAPER_AGENTS
+ * @param {string[]} [options.headless]            headless browsers charged; default HEADLESS_AGENTS
+ * @param {{token: string, cidrs: string[]}[]|false} [options.welcome]  search crawlers never metered when name and address agree; default WELCOME_CRAWLERS
  * @param {(request: Request) => boolean} [options.exempt]  requests never charged, e.g. ones carrying a signed-in cookie
  * @param {string} [options.secret]                pass signing secret; defaults to the CoinPay key
+ * @param {Record<string,string>|false} [options.powerKeys]  kid -> public key of the Power Keys honoured as a pass; defaults to Profullstack's, `false` switches it off
+ * @param {Iterable<string>} [options.revokedKeys]  Power Key subjects no longer honoured
  * @param {(ctx: object) => string} [options.page] custom sales page renderer
  * @param {string} [options.contact]               mailto: or URL for bulk deals
  * @param {(sale: object) => void|Promise<void>} [options.onSale]   accounting hook; awaited before the receipt goes out, and its errors are swallowed
@@ -109,6 +117,13 @@ export function createGateway(options = {}) {
       buy: days > 1 ? `${buyUrl}?days=${days}` : buyUrl,
       buyDays: `${buyUrl}?days=<n>`,
     },
+    /*
+     * The other way in. A Power Key from the shop opens this site and every
+     * other Profullstack property for good, so the 402 says so: a client that
+     * has one but sent it in the wrong place, or that would rather buy once
+     * than pay by the day, learns here where and how.
+     */
+    ...(o.powerKeys ? { powerKey: { shop: SHOP_URL, header: POWER_KEY_HEADER, bearer: true } } : {}),
     ...extra,
   });
 
@@ -152,14 +167,35 @@ export function createGateway(options = {}) {
     training: o.training,
     retrieval: o.retrieval,
     contact: o.contact,
+    powerKey: o.powerKeys ? { shop: SHOP_URL, header: POWER_KEY_HEADER } : null,
   });
 
-  /** The pass a request presents, from the named header or a bearer token. */
+  /**
+   * The pass a request presents: a day pass from the named header or a bearer
+   * token, or a Power Key wherever @profullstack/keys reads one.
+   */
   const passFrom = (request) => {
     const direct = request.headers.get(o.header);
     if (direct) return direct.trim();
     const m = /^Bearer\s+(cp_[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)$/i.exec(request.headers.get('authorization') ?? '');
-    return m ? m[1] : null;
+    if (m) return m[1];
+    return o.powerKeys ? keyFrom(request) : null;
+  };
+
+  /**
+   * Whether a token opens the site: a live day pass this gateway minted, or a
+   * Power Key signed by a key in `powerKeys` and not revoked. A Power Key is
+   * bought once at the shop and honoured everywhere, which is the point of it:
+   * the site never asks anyone whether it is good, it checks the signature.
+   */
+  const honours = async (token) => {
+    if (!token) return false;
+    if (isPowerKey(token)) {
+      if (!o.powerKeys) return false;
+      const result = await verifyKey(token, { publicKeys: o.powerKeys, revoked: o.revokedKeys });
+      return result.ok;
+    }
+    return Boolean(await readPass(token, { secret }));
   };
 
   /**
@@ -342,15 +378,24 @@ export function createGateway(options = {}) {
      * were the only reason to refuse and is not now that a quota exists.
      */
     const token = passFrom(request);
-    const paid = Boolean(token && (await readPass(token, { secret })));
-    if (paid) return null;
+    if (await honours(token)) return null;
 
+    const ua = request.headers.get('user-agent') ?? '';
     const pays =
-      o.isPaidAgent(request.headers.get('user-agent') ?? '') ||
-      (o.chargeSpoofedBrowsers && isSpoofedBrowser(request));
+      o.isPaidAgent(ua) ||
+      (o.chargeSpoofedBrowsers && isSpoofedBrowser(request)) ||
+      (o.chargeStaleBrowsers && isStaleBrowser(ua));
     if (pays && !isOpen(path)) return sell(request);
     if (isOpen(path)) return null;
 
+    /*
+     * A search crawler that is who it says it is reads free and unmetered.
+     * Googlebot walking a large site from a handful of addresses outruns any
+     * per-address allowance, and answering it 402 is how a site leaves the
+     * index. Name and address must agree, so copying the string buys nothing.
+     */
+    if (welcomeCrawler(request, o.welcome)) return null;
+
     /*
      * Everyone else gets the free allowance. Running out is answered with a
      * price rather than a 429: the caller has just shown it wants more than
@@ -387,7 +432,22 @@ export function createGateway(options = {}) {
      * paying crawlers twice.
      */
     passFrom,
-    verifyPass: async (token) => Boolean(token && (await readPass(token, { secret }))),
+    verifyPass: honours,
+    /**
+     * Whether a request is a charged crawler by this gateway's rules (the
+     * lists, a spoofed or a stale browser string), and whether it is a welcome
+     * search crawler whose address matches its name. Exposed so a throttle
+     * that meters every route charges and spares exactly the same callers.
+     */
+    isPaid: (request) => {
+      const ua = request.headers.get('user-agent') ?? '';
+      return (
+        o.isPaidAgent(ua) ||
+        (o.chargeSpoofedBrowsers && isSpoofedBrowser(request)) ||
+        (o.chargeStaleBrowsers && isStaleBrowser(ua))
+      );
+    },
+    isWelcome: (request) => Boolean(welcomeCrawler(request, o.welcome)),
     /**
      * The x402 offer this gateway would make, and the full receipt body around
      * it, without answering a request.
@@ -404,7 +464,13 @@ export function createGateway(options = {}) {
     receipt,
     /** robots.txt with this gateway's lists and sales path. */
     robotsTxt: (extra = {}) =>
-      robotsTxt({ siteUrl: o.siteUrl, path: o.path, training: o.training, retrieval: o.retrieval, ...extra }),
+      robotsTxt({
+        siteUrl: o.siteUrl,
+        path: o.path,
+        training: [...o.training, ...o.scrapers],
+        retrieval: o.retrieval,
+        ...extra,
+      }),
     /** The sales page as HTML, for a site that mounts it on a route of its own. */
     page: () => o.page(pageCtx()),
   };
@@ -453,6 +519,9 @@ function normalise(options) {
   const siteUrl = String(options.siteUrl ?? '').replace(/\/+$/, '');
   if (!siteUrl) throw new Error('createGateway needs siteUrl');
   const training = options.training ?? TRAINING_AGENTS;
+  const scrapers = options.scrapers ?? SCRAPER_AGENTS;
+  const headless = options.headless ?? HEADLESS_AGENTS;
+  const paid = [...training, ...scrapers, ...headless];
   return {
     siteUrl,
     siteName: options.siteName || new URL(siteUrl).hostname,
@@ -470,16 +539,22 @@ function normalise(options) {
     openPaths: options.openPaths ?? [],
     denyCidrs: options.denyCidrs ?? [],
     chargeSpoofedBrowsers: Boolean(options.chargeSpoofedBrowsers),
+    chargeStaleBrowsers: options.chargeStaleBrowsers !== false,
     exempt: options.exempt ?? null,
     training,
+    scrapers,
+    headless,
+    welcome: options.welcome === false ? null : (options.welcome ?? WELCOME_CRAWLERS),
     retrieval: options.retrieval ?? RETRIEVAL_AGENTS,
-    isPaidAgent: options.isPaidAgent ?? ((ua) => isTrainingAgent(ua, training)),
+    isPaidAgent: options.isPaidAgent ?? ((ua) => isTrainingAgent(ua, paid)),
     secret: options.secret ?? '',
     page: options.page ?? renderPage,
     contact: options.contact ?? '',
     onSale: options.onSale ?? null,
     freeQuota: normaliseQuota(options.freeQuota),
     benefits: Array.isArray(options.benefits) ? options.benefits : null,
+    powerKeys: options.powerKeys === false ? null : (options.powerKeys ?? PROFULLSTACK_KEYS),
+    revokedKeys: options.revokedKeys ?? null,
     fetch: options.fetch ?? globalThis.fetch,
   };
 }

package/src/page.js

@@ -60,6 +60,7 @@ export function renderPage(ctx) {
     maxDays = 30,
     quota = null,
     benefits = null,
+    powerKey = null,
   } = ctx;
 
   /*
@@ -95,6 +96,10 @@ export function renderPage(ctx) {
     benefits && benefits.length
       ? `<h2>What a pass gets you</h2>\n<ul>\n${benefits.map((b) => `  <li>${esc(b)}</li>`).join('\n')}\n</ul>`
       : '';
+  const powerKeyNote = powerKey
+    ? `<h2>Or buy one key for every Profullstack site</h2>
+<p>A <a href="${esc(powerKey.shop)}">Power Key</a> is bought once and opens this site and every other Profullstack property, with no day passes and no limits. Send it as <code>Authorization: Bearer pfs_...</code> or in <code>${esc(powerKey.header)}</code> and this page never answers 402 again.</p>`
+    : '';
   const window =
     minutes === 1440
       ? 'one day'
@@ -134,6 +139,7 @@ ${
 }
 
 ${unlocks}
+${powerKeyNote}
 ${arithmetic}
 
 <h2>How it works</h2>