devstack 0.1.0

package/vendor/skills/skills/cloudflare/references/bot-management/gotchas.md

@@ -0,0 +1,116 @@
+# Bot Management Gotchas
+
+## Common Errors
+
+### "Bot Score = 0"
+
+**Cause:** Bot Management didn't run (internal Cloudflare request, Worker routing to zone (Orange-to-Orange), or request handled before BM (Redirect Rules, etc.))  
+**Solution:** Check request flow and ensure Bot Management runs in request lifecycle
+
+### "JavaScript Detections Not Working"
+
+**Cause:** `js_detection.passed` always false or undefined due to: CSP headers don't allow `/cdn-cgi/challenge-platform/`, using on first page visit (needs HTML page first), ad blockers or disabled JS, JSD not enabled in dashboard, or using Block action (must use Managed Challenge)  
+**Solution:** Add CSP header `Content-Security-Policy: script-src 'self' /cdn-cgi/challenge-platform/;` and ensure JSD is enabled with Managed Challenge action
+
+### "False Positives (Legitimate Users Blocked)"
+
+**Cause:** Bot detection incorrectly flagging legitimate users  
+**Solution:** Check Bot Analytics for affected IPs/paths, identify detection source (ML, Heuristics, etc.), create exception rule like `(cf.bot_management.score lt 30 and http.request.uri.path eq "/problematic-path")` with Action: Skip (Bot Management), or allowlist by IP/ASN/country
+
+### "False Negatives (Bots Not Caught)"
+
+**Cause:** Bots bypassing detection  
+**Solution:** Lower score threshold (30 → 50), enable JavaScript Detections, add JA3/JA4 fingerprinting rules, or use rate limiting as fallback
+
+### "Verified Bot Blocked"
+
+**Cause:** Search engine bot blocked by WAF Managed Rules (not just Bot Management)  
+**Solution:** Create WAF exception for specific rule ID and verify bot via reverse DNS
+
+### "Yandex Bot Blocked During IP Update"
+
+**Cause:** Yandex updates bot IPs; new IPs unrecognized for 48h during propagation  
+**Solution:**
+
+1. Check Security Events for specific WAF rule ID blocking Yandex
+2. Create WAF exception:
+   ```txt
+   (http.user_agent contains "YandexBot" and ip.src in {<yandex-ip-range>})
+   Action: Skip (WAF Managed Ruleset)
+   ```
+3. Monitor Bot Analytics for 48h
+4. Remove exception after propagation completes
+
+Issue resolves automatically after 48h. Contact Cloudflare Support if persists.
+
+### "JA3/JA4 Missing"
+
+**Cause:** Non-HTTPS traffic, Worker routing traffic, Orange-to-Orange traffic via Worker, or Bot Management skipped  
+**Solution:** JA3/JA4 only available for HTTPS/TLS traffic; check request routing
+
+**JA3/JA4 Not User-Unique:** Same browser/library version = same fingerprint
+
+- Don't use for user identification
+- Use for client profiling only
+- Fingerprints change with browser updates
+
+## Bot Verification Methods
+
+Cloudflare verifies bots via:
+
+1. **Reverse DNS (IP validation):** Traditional method—bot IP resolves to expected domain
+2. **Web Bot Auth:** Modern cryptographic verification—faster propagation
+
+When `verifiedBot=true`, bot passed at least one method.
+
+**Inactive verified bots:** IPs removed after 24h of no traffic.
+
+## Detection Engine Behavior
+
+| Engine                | Score      | Timing         | Plan       | Notes                           |
+| --------------------- | ---------- | -------------- | ---------- | ------------------------------- |
+| Heuristics            | Always 1   | Immediate      | All        | Known fingerprints—overrides ML |
+| ML                    | 1-99       | Immediate      | All        | Majority of detections          |
+| Anomaly Detection     | Influences | After baseline | Enterprise | Optional, baseline analysis     |
+| JavaScript Detections | Pass/fail  | After JS       | Pro+       | Headless browser detection      |
+| Cloudflare Service    | N/A        | N/A            | Enterprise | Zero Trust internal source      |
+
+**Priority:** Heuristics > ML—if heuristic matches, score=1 regardless of ML.
+
+## Limits
+
+| Limit                         | Value                                     | Notes                                       |
+| ----------------------------- | ----------------------------------------- | ------------------------------------------- |
+| Bot Score = 0                 | Means not computed                        | Not score = 100                             |
+| First request JSD data        | May not be available                      | JSD data appears on subsequent requests     |
+| Score accuracy                | Not 100% guaranteed                       | False positives/negatives possible          |
+| JSD on first HTML page visit  | Not supported                             | Requires subsequent page load               |
+| JSD requirements              | JavaScript-enabled browser                | Won't work with JS disabled or ad blockers  |
+| JSD ETag stripping            | Strips ETags from HTML responses          | May affect caching behavior                 |
+| JSD CSP compatibility         | Requires specific CSP                     | Not compatible with some CSP configurations |
+| JSD meta CSP tags             | Not supported                             | Must use HTTP headers                       |
+| JSD WebSocket support         | Not supported                             | WebSocket endpoints won't work with JSD     |
+| JSD mobile app support        | Native apps won't pass                    | Only works in browsers                      |
+| JA3/JA4 traffic type          | HTTPS/TLS only                            | Not available for non-HTTPS traffic         |
+| JA3/JA4 Worker routing        | Missing for Worker-routed traffic         | Check request routing                       |
+| JA3/JA4 uniqueness            | Not unique per user                       | Shared by clients with same browser/library |
+| JA3/JA4 stability             | Can change with updates                   | Browser/library updates affect fingerprints |
+| WAF custom rules (Free)       | 5                                         | Varies by plan                              |
+| WAF custom rules (Pro)        | 20                                        | Varies by plan                              |
+| WAF custom rules (Business)   | 100                                       | Varies by plan                              |
+| WAF custom rules (Enterprise) | 1,000+                                    | Varies by plan                              |
+| Workers CPU time              | Varies by plan                            | Applies to bot logic                        |
+| Bot Analytics sampling        | 1-10% adaptive                            | High-volume zones sampled more aggressively |
+| Bot Analytics history         | 30 days max                               | Historical data retention limit             |
+| CSP requirements for JSD      | Must allow `/cdn-cgi/challenge-platform/` | Required for JSD to function                |
+
+### Plan Restrictions
+
+| Feature                   | Free    | Pro/Business | Enterprise |
+| ------------------------- | ------- | ------------ | ---------- |
+| Granular scores (1-99)    | No      | No           | Yes        |
+| JA3/JA4                   | No      | No           | Yes        |
+| Anomaly Detection         | No      | No           | Yes        |
+| Corporate Proxy detection | No      | No           | Yes        |
+| Verified bot categories   | Limited | Limited      | Full       |
+| Custom WAF rules          | 5       | 20/100       | 1,000+     |

package/vendor/skills/skills/cloudflare/references/bot-management/patterns.md

@@ -0,0 +1,181 @@
+# Bot Management Patterns
+
+## E-commerce Protection
+
+```txt
+# High security for checkout
+(cf.bot_management.score lt 50 and http.request.uri.path in {"/checkout" "/cart/add"} and not cf.bot_management.verified_bot and not cf.bot_management.corporate_proxy)
+Action: Managed Challenge
+```
+
+## API Protection
+
+```txt
+# Protect API with JS detection + score
+(http.request.uri.path matches "^/api/" and (cf.bot_management.score lt 30 or not cf.bot_management.js_detection.passed) and not cf.bot_management.verified_bot)
+Action: Block
+```
+
+## SEO-Friendly Bot Handling
+
+```txt
+# Allow search engine crawlers
+(cf.bot_management.score lt 30 and not cf.verified_bot_category in {"Search Engine Crawler"})
+Action: Managed Challenge
+```
+
+## Block AI Scrapers
+
+```txt
+# Block training crawlers only (allow AI assistants/search)
+(cf.verified_bot_category eq "AI Crawler")
+Action: Block
+
+# Block all AI-related bots (training + assistants + search)
+(cf.verified_bot_category in {"AI Crawler" "AI Assistant" "AI Search"})
+Action: Block
+
+# Allow AI Search, block AI Crawler and AI Assistant
+(cf.verified_bot_category in {"AI Crawler" "AI Assistant"})
+Action: Block
+
+# Or use dashboard: Security > Settings > Bot Management > Block AI Bots
+```
+
+## Rate Limiting by Bot Score
+
+```txt
+# Stricter limits for suspicious traffic
+(cf.bot_management.score lt 50)
+Rate: 10 requests per 10 seconds
+
+(cf.bot_management.score ge 50)
+Rate: 100 requests per 10 seconds
+```
+
+## Mobile App Allowlisting
+
+```txt
+# Identify mobile app by JA3/JA4
+(cf.bot_management.ja4 in {"fingerprint1" "fingerprint2"})
+Action: Skip (all remaining rules)
+```
+
+## Datacenter Detection
+
+```typescript
+import type { IncomingRequestCfProperties } from "@cloudflare/workers-types";
+
+// Low score + not corporate proxy = likely datacenter bot
+export default {
+  async fetch(request: Request): Promise<Response> {
+    const cf = request.cf as IncomingRequestCfProperties | undefined;
+    const botMgmt = cf?.botManagement;
+
+    if (botMgmt?.score && botMgmt.score < 30 && !botMgmt.corporateProxy && !botMgmt.verifiedBot) {
+      return new Response("Datacenter traffic blocked", { status: 403 });
+    }
+
+    return fetch(request);
+  },
+};
+```
+
+## Conditional Delay (Tarpit)
+
+```typescript
+import type { IncomingRequestCfProperties } from "@cloudflare/workers-types";
+
+// Add delay proportional to bot suspicion
+export default {
+  async fetch(request: Request): Promise<Response> {
+    const cf = request.cf as IncomingRequestCfProperties | undefined;
+    const botMgmt = cf?.botManagement;
+
+    if (botMgmt?.score && botMgmt.score < 50 && !botMgmt.verifiedBot) {
+      // Delay: 0-2 seconds for scores 50-0
+      const delayMs = Math.max(0, (50 - botMgmt.score) * 40);
+      await new Promise(r => setTimeout(r, delayMs));
+    }
+
+    return fetch(request);
+  },
+};
+```
+
+## Layered Defense
+
+```txt
+1. Bot Management (score-based)
+2. JavaScript Detections (for JS-capable clients)
+3. Rate Limiting (fallback protection)
+4. WAF Managed Rules (OWASP, etc.)
+```
+
+## Progressive Enhancement
+
+```txt
+Public content: High threshold (score < 10)
+Authenticated: Medium threshold (score < 30)
+Sensitive: Low threshold (score < 50) + JSD
+```
+
+## Zero Trust for Bots
+
+```txt
+1. Default deny (all scores < 30)
+2. Allowlist verified bots
+3. Allowlist mobile apps (JA3/JA4)
+4. Allowlist corporate proxies
+5. Allowlist static resources
+```
+
+## Workers: Score + JS Detection
+
+```typescript
+import type { IncomingRequestCfProperties } from "@cloudflare/workers-types";
+
+export default {
+  async fetch(request: Request): Promise<Response> {
+    const cf = request.cf as IncomingRequestCfProperties | undefined;
+    const botMgmt = cf?.botManagement;
+    const url = new URL(request.url);
+
+    if (botMgmt?.staticResource) return fetch(request); // Skip static
+
+    // API endpoints: require JS detection + good score
+    if (url.pathname.startsWith("/api/")) {
+      const jsDetectionPassed = botMgmt?.jsDetection?.passed ?? false;
+      const score = botMgmt?.score ?? 100;
+
+      if (!jsDetectionPassed || score < 30) {
+        return new Response("Unauthorized", { status: 401 });
+      }
+    }
+
+    return fetch(request);
+  },
+};
+```
+
+## Rate Limiting by JWT Claim + Bot Score
+
+```txt
+# Enterprise: Combine bot score with JWT validation
+Rate limiting > Custom rules
+- Field: lookup_json_string(http.request.jwt.claims["{config_id}"][0], "sub")
+- Matches: user ID claim
+- Additional condition: cf.bot_management.score lt 50
+```
+
+## WAF Integration Points
+
+- **WAF Custom Rules**: Primary enforcement mechanism
+- **Rate Limiting Rules**: Bot score as dimension, stricter limits for low scores
+- **Transform Rules**: Pass score to origin via custom header
+- **Workers**: Programmatic bot logic, custom scoring algorithms
+- **Page Rules / Configuration Rules**: Zone-level overrides, path-specific settings
+
+## See Also
+
+- [gotchas.md](./gotchas.md) - Common errors, false positives/negatives, limitations

package/vendor/skills/skills/cloudflare/references/browser-rendering/README.md

@@ -0,0 +1,84 @@
+# Cloudflare Browser Rendering Skill Reference
+
+**Description**: Expert knowledge for Cloudflare Browser Rendering - control headless Chrome on Cloudflare's global network for browser automation, screenshots, PDFs, web scraping, testing, and content generation.
+
+**When to use**: Any task involving Cloudflare Browser Rendering including: taking screenshots, generating PDFs, web scraping, browser automation, testing web applications, extracting structured data, capturing page metrics, or automating browser interactions.
+
+## Decision Tree
+
+### REST API vs Workers Bindings
+
+**Use REST API when:**
+
+- One-off, stateless tasks (screenshot, PDF, content fetch)
+- No Workers infrastructure yet
+- Simple integrations from external services
+- Need quick prototyping without deployment
+
+**Use Workers Bindings when:**
+
+- Complex browser automation workflows
+- Need session reuse for performance
+- Multiple page interactions per request
+- Custom scripting and logic required
+- Building production applications
+
+### Puppeteer vs Playwright
+
+| Feature        | Puppeteer                    | Playwright                |
+| -------------- | ---------------------------- | ------------------------- |
+| API Style      | Chrome DevTools Protocol     | High-level abstractions   |
+| Selectors      | CSS, XPath                   | CSS, text, role, test-id  |
+| Best for       | Advanced control, CDP access | Quick automation, testing |
+| Learning curve | Steeper                      | Gentler                   |
+
+**Use Puppeteer:** Need CDP protocol access, Chrome-specific features, migration from existing Puppeteer code
+**Use Playwright:** Modern selector APIs, cross-browser patterns, faster development
+
+## Tier Limits Summary
+
+| Limit               | Free Tier  | Paid Tier   |
+| ------------------- | ---------- | ----------- |
+| Daily browser time  | 10 minutes | Unlimited\* |
+| Concurrent sessions | 3          | 30          |
+| Requests per minute | 6          | 180         |
+
+\*Subject to fair-use policy. See [gotchas.md](gotchas.md) for details.
+
+## Reading Order
+
+**New to Browser Rendering:**
+
+1. [configuration.md](configuration.md) - Setup and deployment
+2. [patterns.md](patterns.md) - Common use cases with examples
+3. [api.md](api.md) - API reference
+4. [gotchas.md](gotchas.md) - Avoid common pitfalls
+
+**Specific task:**
+
+- **Setup/deployment** → [configuration.md](configuration.md)
+- **API reference/endpoints** → [api.md](api.md)
+- **Example code/patterns** → [patterns.md](patterns.md)
+- **Debugging/troubleshooting** → [gotchas.md](gotchas.md)
+
+**REST API users:**
+
+- Start with [api.md](api.md) REST API section
+- Check [gotchas.md](gotchas.md) for rate limits
+
+**Workers users:**
+
+- Start with [configuration.md](configuration.md)
+- Review [patterns.md](patterns.md) for session management
+- Reference [api.md](api.md) for Workers Bindings
+
+## In This Reference
+
+- **[configuration.md](configuration.md)** - Setup, deployment, wrangler config, compatibility
+- **[api.md](api.md)** - REST API endpoints + Workers Bindings (Puppeteer/Playwright)
+- **[patterns.md](patterns.md)** - Common patterns, use cases, real examples
+- **[gotchas.md](gotchas.md)** - Troubleshooting, best practices, tier limits, common errors
+
+## See Also
+
+- [Cloudflare Docs](https://developers.cloudflare.com/browser-rendering/)

package/vendor/skills/skills/cloudflare/references/browser-rendering/api.md

@@ -0,0 +1,108 @@
+# Browser Rendering API
+
+## REST API
+
+**Base:** `https://api.cloudflare.com/client/v4/accounts/{accountId}/browser-rendering`  
+**Auth:** `Authorization: Bearer <token>` (Browser Rendering - Edit permission)
+
+### Endpoints
+
+| Endpoint      | Description              | Key Options                                 |
+| ------------- | ------------------------ | ------------------------------------------- |
+| `/content`    | Get rendered HTML        | `url`, `waitUntil`                          |
+| `/screenshot` | Capture image            | `screenshotOptions: {type, fullPage, clip}` |
+| `/pdf`        | Generate PDF             | `pdfOptions: {format, landscape, margin}`   |
+| `/snapshot`   | HTML + inlined resources | `url`                                       |
+| `/scrape`     | Extract by selectors     | `selectors: ["h1", ".price"]`               |
+| `/json`       | AI-structured extraction | `schema: {name: "string", price: "number"}` |
+| `/links`      | Get all links            | `url`                                       |
+| `/markdown`   | Convert to markdown      | `url`                                       |
+
+```bash
+curl -X POST '.../browser-rendering/screenshot' \
+  -H "Authorization: Bearer $TOKEN" \
+  -d '{"url":"https://example.com","screenshotOptions":{"fullPage":true}}'
+```
+
+## Workers Binding
+
+```jsonc
+// wrangler.jsonc
+{ "browser": { "binding": "MYBROWSER" } }
+```
+
+## Puppeteer
+
+```typescript
+import puppeteer from "@cloudflare/puppeteer";
+
+const browser = await puppeteer.launch(env.MYBROWSER, { keep_alive: 600000 });
+const page = await browser.newPage();
+await page.goto("https://example.com", { waitUntil: "networkidle0" });
+
+// Content
+const html = await page.content();
+const title = await page.title();
+
+// Screenshot/PDF
+await page.screenshot({ fullPage: true, type: "png" });
+await page.pdf({ format: "A4", printBackground: true });
+
+// Interaction
+await page.click("#button");
+await page.type("#input", "text");
+await page.evaluate(() => document.querySelector("h1")?.textContent);
+
+// Session management
+const sessions = await puppeteer.sessions(env.MYBROWSER);
+const limits = await puppeteer.limits(env.MYBROWSER);
+
+await browser.close();
+```
+
+## Playwright
+
+```typescript
+import { launch, connect } from "@cloudflare/playwright";
+
+const browser = await launch(env.MYBROWSER, { keep_alive: 600000 });
+const page = await browser.newPage();
+
+await page.goto("https://example.com", { waitUntil: "networkidle" });
+
+// Modern selectors
+await page.locator(".button").click();
+await page.getByText("Submit").click();
+await page.getByTestId("search").fill("query");
+
+// Context for isolation
+const context = await browser.newContext({
+  viewport: { width: 1920, height: 1080 },
+  userAgent: "custom",
+});
+
+await browser.close();
+```
+
+## Session Management
+
+```typescript
+// List sessions
+await puppeteer.sessions(env.MYBROWSER);
+
+// Connect to existing
+await puppeteer.connect(env.MYBROWSER, sessionId);
+
+// Check limits
+await puppeteer.limits(env.MYBROWSER);
+// { remaining: ms, total: ms, concurrent: n }
+```
+
+## Key Options
+
+| Option            | Values                                                     |
+| ----------------- | ---------------------------------------------------------- |
+| `waitUntil`       | `load`, `domcontentloaded`, `networkidle0`, `networkidle2` |
+| `keep_alive`      | Max 600000ms (10 min)                                      |
+| `screenshot.type` | `png`, `jpeg`                                              |
+| `pdf.format`      | `A4`, `Letter`, `Legal`                                    |

package/vendor/skills/skills/cloudflare/references/browser-rendering/configuration.md

@@ -0,0 +1,78 @@
+# Configuration & Setup
+
+## Installation
+
+```bash
+npm install @cloudflare/puppeteer  # or @cloudflare/playwright
+```
+
+**Use Cloudflare packages** - standard `puppeteer`/`playwright` won't work in Workers.
+
+## wrangler.json
+
+```json
+{
+  "name": "browser-worker",
+  "main": "src/index.ts",
+  "compatibility_date": "2025-01-01",
+  "compatibility_flags": ["nodejs_compat"],
+  "browser": {
+    "binding": "MYBROWSER"
+  }
+}
+```
+
+**Required:** `nodejs_compat` flag and `browser.binding`.
+
+## TypeScript
+
+```typescript
+interface Env {
+  MYBROWSER: Fetcher;
+}
+
+export default {
+  async fetch(request: Request, env: Env): Promise<Response> {
+    // ...
+  },
+} satisfies ExportedHandler<Env>;
+```
+
+## Development
+
+```bash
+wrangler dev --remote  # --remote required for browser binding
+```
+
+**Local mode does NOT support Browser Rendering** - must use `--remote`.
+
+## REST API
+
+No wrangler config needed. Get API token with "Browser Rendering - Edit" permission.
+
+```bash
+curl -X POST \
+  'https://api.cloudflare.com/client/v4/accounts/{accountId}/browser-rendering/screenshot' \
+  -H 'Authorization: Bearer TOKEN' \
+  -d '{"url": "https://example.com"}' --output screenshot.png
+```
+
+## Requirements
+
+| Requirement           | Value                             |
+| --------------------- | --------------------------------- |
+| Node.js compatibility | `nodejs_compat` flag              |
+| Compatibility date    | 2023-03-01+                       |
+| Module format         | ES modules only                   |
+| Browser               | Chromium 119+ (no Firefox/Safari) |
+
+**Not supported:** WebGL, WebRTC, extensions, `file://` protocol, Service Worker syntax.
+
+## Troubleshooting
+
+| Error                             | Solution                            |
+| --------------------------------- | ----------------------------------- |
+| `MYBROWSER is undefined`          | Use `wrangler dev --remote`         |
+| `nodejs_compat not enabled`       | Add to `compatibility_flags`        |
+| `Module not found`                | `npm install @cloudflare/puppeteer` |
+| `Browser Rendering not available` | Enable in dashboard                 |

package/vendor/skills/skills/cloudflare/references/browser-rendering/gotchas.md

@@ -0,0 +1,91 @@
+# Browser Rendering Gotchas
+
+## Tier Limits
+
+| Limit               | Free       | Paid        |
+| ------------------- | ---------- | ----------- |
+| Daily browser time  | 10 min     | Unlimited\* |
+| Concurrent sessions | 3          | 30          |
+| Requests/minute     | 6          | 180         |
+| Session keep-alive  | 10 min max | 10 min max  |
+
+\*Subject to fair-use policy.
+
+**Check quota:**
+
+```typescript
+const limits = await puppeteer.limits(env.MYBROWSER);
+// { remaining: 540000, total: 600000, concurrent: 2 }
+```
+
+## Always Close Browsers
+
+```typescript
+const browser = await puppeteer.launch(env.MYBROWSER);
+try {
+  const page = await browser.newPage();
+  await page.goto("https://example.com");
+  return new Response(await page.content());
+} finally {
+  await browser.close(); // ALWAYS in finally
+}
+```
+
+**Workers vs REST:** REST auto-closes after timeout. Workers must call `close()` or session stays open until `keep_alive` expires.
+
+## Optimize Concurrency
+
+```typescript
+// ❌ 3 sessions (hits free tier limit)
+const browser1 = await puppeteer.launch(env.MYBROWSER);
+const browser2 = await puppeteer.launch(env.MYBROWSER);
+
+// ✅ 1 session, multiple pages
+const browser = await puppeteer.launch(env.MYBROWSER);
+const page1 = await browser.newPage();
+const page2 = await browser.newPage();
+```
+
+## Common Errors
+
+| Error                         | Cause                                   | Fix                                           |
+| ----------------------------- | --------------------------------------- | --------------------------------------------- |
+| Session limit exceeded        | Too many concurrent                     | Close unused browsers, use pages not browsers |
+| Page navigation timeout       | Slow page or `networkidle` on busy page | Increase timeout, use `waitUntil: "load"`     |
+| Session not found             | Expired session                         | Catch error, launch new session               |
+| Evaluation failed             | DOM element missing                     | Use `?.` optional chaining                    |
+| Protocol error: Target closed | Page closed during operation            | Await all ops before closing                  |
+
+## page.evaluate() Gotchas
+
+```typescript
+// ❌ Outer scope not available
+const selector = "h1";
+await page.evaluate(() => document.querySelector(selector));
+
+// ✅ Pass as argument
+await page.evaluate(sel => document.querySelector(sel)?.textContent, selector);
+```
+
+## Performance
+
+**waitUntil options (fastest to slowest):**
+
+1. `domcontentloaded` - DOM ready
+2. `load` - load event (default)
+3. `networkidle0` - no network for 500ms
+
+**Block unnecessary resources:**
+
+```typescript
+await page.setRequestInterception(true);
+page.on("request", req => {
+  if (["image", "stylesheet", "font"].includes(req.resourceType())) {
+    req.abort();
+  } else {
+    req.continue();
+  }
+});
+```
+
+**Session reuse:** Cold start ~1-2s, warm connect ~100-200ms. Store sessionId in KV for reuse.