jourilo 0.1.0 → 1.0.1

package/plugin/dist/jourilo.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// Jourilo 0.1.0 - generated by scripts/build.mjs. Do not edit; edit src/ instead.
+// Jourilo 1.0.1 - generated by scripts/build.mjs. Do not edit; edit src/ instead.
 import { createRequire as __jouriloCreateRequire } from 'node:module';
 const require = __jouriloCreateRequire(import.meta.url);
 var __create = Object.create;
@@ -82,16 +82,26 @@ var init_errors = __esm({
 // src/core/fs-safety.ts
 import { chmodSync, existsSync, mkdirSync, realpathSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 function resolveInside(root, child) {
   if (child.includes("\0")) throw new JouriloError("UNSAFE_PATH", "Path contains a NUL byte.");
-  const base2 = existsSync(root) ? realpathSync(root) : resolve(root);
-  const target = resolve(base2, child);
-  const real = existsSync(target) ? realpathSync(target) : target;
+  const base2 = realpathDeep(resolve(root));
+  const real = realpathDeep(resolve(base2, child));
   const rel = relative(base2, real);
   if (rel === "" || !rel.startsWith(`..${sep}`) && rel !== ".." && !isAbsolute(rel)) return real;
   throw new JouriloError("UNSAFE_PATH", `Path escapes ${root}: ${child}`);
 }
+function realpathDeep(path2) {
+  let existing = path2;
+  const rest = [];
+  while (!existsSync(existing)) {
+    const parent = dirname(existing);
+    if (parent === existing) return path2;
+    rest.unshift(basename(existing));
+    existing = parent;
+  }
+  return join(realpathSync(existing), ...rest);
+}
 function writeFileSafe(path2, data, opts = {}) {
   mkdirSync(dirname(path2), { recursive: true });
   writeFileSync(path2, data, opts.private ? { mode: 384 } : void 0);
@@ -129,7 +139,7 @@ __export(workspace_exports, {
   Workspace: () => Workspace
 });
 import { existsSync as existsSync2, mkdirSync as mkdirSync2, readdirSync, readFileSync, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname2, join, resolve as resolve2 } from "node:path";
+import { dirname as dirname2, join as join2, resolve as resolve2 } from "node:path";
 var Workspace;
 var init_workspace = __esm({
   "src/core/workspace.ts"() {
@@ -143,11 +153,11 @@ var init_workspace = __esm({
         this.root = resolve2(root ?? process.env.JOURILO_WORKSPACE ?? ".jourilo");
       }
       get runsDir() {
-        return join(this.root, "runs");
+        return join2(this.root, "runs");
       }
       ensure() {
         mkdirSync2(this.runsDir, { recursive: true });
-        const ignore = join(this.root, ".gitignore");
+        const ignore = join2(this.root, ".gitignore");
         if (!existsSync2(ignore)) writeFileSync2(ignore, "*\n");
       }
       runDir(id) {
@@ -156,12 +166,12 @@ var init_workspace = __esm({
       createRunDir(id) {
         this.ensure();
         const dir = this.runDir(id);
-        mkdirSync2(join(dir, "screenshots"), { recursive: true });
+        mkdirSync2(join2(dir, "screenshots"), { recursive: true });
         return dir;
       }
       saveRun(run) {
         const dir = this.createRunDir(run.id);
-        const file = join(dir, "run.json");
+        const file = join2(dir, "run.json");
         writeFileSync2(file, `${JSON.stringify(run, null, 2)}
 `);
         return file;
@@ -170,7 +180,7 @@ var init_workspace = __esm({
         if (!existsSync2(this.runsDir)) return [];
         const out = [];
         for (const id of readdirSync(this.runsDir).sort()) {
-          const file = join(this.runsDir, id, "run.json");
+          const file = join2(this.runsDir, id, "run.json");
           if (!existsSync2(file)) continue;
           try {
             const run = JSON.parse(readFileSync(file, "utf8"));
@@ -196,13 +206,13 @@ var init_workspace = __esm({
           const runs2 = this.listRuns();
           const pick = runs2[runs2.length - (ref === "latest" ? 1 : 2)];
           if (!pick) throw new JouriloError("NOT_FOUND", `No ${ref} run in ${this.runsDir}.`);
-          file = join(this.runsDir, pick.id, "run.json");
+          file = join2(this.runsDir, pick.id, "run.json");
         } else if (ref.endsWith(".json") && existsSync2(ref)) {
           file = resolve2(ref);
-        } else if (existsSync2(join(ref, "run.json"))) {
+        } else if (existsSync2(join2(ref, "run.json"))) {
           file = resolve2(ref, "run.json");
         } else {
-          file = join(this.runDir(ref), "run.json");
+          file = join2(this.runDir(ref), "run.json");
         }
         if (!existsSync2(file)) throw new JouriloError("NOT_FOUND", `Run not found: ${ref}`);
         const run = JSON.parse(readFileSync(file, "utf8"));
@@ -38811,7 +38821,7 @@ var require_axe = __commonJS({
 init_errors();
 
 // src/core/version.ts
-var VERSION = true ? "0.1.0" : "0.0.0-dev";
+var VERSION = true ? "1.0.1" : "0.0.0-dev";
 
 // src/cli/framework.ts
 init_errors();
@@ -38884,7 +38894,7 @@ import { fileURLToPath } from "node:url";
 
 // src/agents/adapters.ts
 import { homedir as homedir2 } from "node:os";
-import { join as join2 } from "node:path";
+import { join as join3 } from "node:path";
 var MARK_START = "<!-- jourilo:start -->";
 var MARK_END = "<!-- jourilo:end -->";
 function instructions(cmd) {
@@ -38922,7 +38932,7 @@ var ADAPTERS = [
     id: "claude-skill",
     name: "Claude Code personal skill (adds a bare /jourilo command)",
     scope: "user",
-    path: () => join2(homedir2(), ".claude", "skills", "jourilo", "SKILL.md"),
+    path: () => join3(homedir2(), ".claude", "skills", "jourilo", "SKILL.md"),
     render: (cmd) => `---
 name: jourilo
 description: Jourilo product experience & conversion engineering \u2014 audit UX, accessibility, performance and conversion in a real browser, run user journeys, fix root causes and verify. Use for /jourilo.
@@ -38942,14 +38952,14 @@ ${instructions(cmd)}`
     name: "OpenAI Codex / AGENTS.md-compatible agents",
     scope: "project",
     section: true,
-    path: (root) => join2(root, "AGENTS.md"),
+    path: (root) => join3(root, "AGENTS.md"),
     render: (cmd) => instructions(cmd)
   },
   {
     id: "cursor",
     name: "Cursor project rule",
     scope: "project",
-    path: (root) => join2(root, ".cursor", "rules", "jourilo.mdc"),
+    path: (root) => join3(root, ".cursor", "rules", "jourilo.mdc"),
     render: (cmd) => `---
 description: Jourilo product experience & conversion engineering (UX, accessibility, journeys, verified fixes)
 alwaysApply: false
@@ -39028,7 +39038,7 @@ import { resolve as resolve5 } from "node:path";
 // src/browser/capture.ts
 var import_axe_core = __toESM(require_axe(), 1);
 init_fs_safety();
-import { join as join3 } from "node:path";
+import { join as join5 } from "node:path";
 
 // src/core/hash.ts
 import { createHash, randomBytes } from "node:crypto";
@@ -39506,6 +39516,246 @@ function excerpt(input, max = 240) {
   return clean.length > max ? `${clean.slice(0, max - 1)}\u2026` : clean;
 }
 
+// src/journeys/safety.ts
+var DESTRUCTIVE = lexicon("destructive");
+var FINANCIAL = lexicon("financial");
+function signalWords(raw) {
+  return raw.replace(new RegExp("([\\p{Ll}\\p{N}])(\\p{Lu})", "gu"), "$1 $2").replace(/[^\p{L}\p{N}]+/gu, " ").trim().toLowerCase();
+}
+var DESTRUCTIVE_WORDS = new RegExp(
+  `(?<![\\p{L}\\p{N}])(${[
+    "delete",
+    "destroy",
+    "remove",
+    "erase",
+    "purge",
+    "wipe",
+    "trash",
+    "cancel",
+    "unsubscribe",
+    "deactivate",
+    "terminate",
+    "revoke",
+    "close account",
+    "sil",
+    "silme",
+    "kaldir",
+    "kald\u0131r",
+    "iptal",
+    "loeschen",
+    "l\xF6schen",
+    "entfernen",
+    "kuendigen",
+    "k\xFCndigen",
+    "eliminar",
+    "borrar",
+    "cancelar",
+    "dar de baja",
+    "supprimer",
+    "effacer",
+    "resilier",
+    "r\xE9silier",
+    "annuler",
+    "desabonner",
+    "d\xE9sabonner"
+  ].join("|")})(?![\\p{L}\\p{N}])`,
+  "iu"
+);
+var FINANCIAL_WORDS = new RegExp(
+  `(?<![\\p{L}\\p{N}])(${[
+    "pay",
+    "payment",
+    "payments",
+    "checkout",
+    "purchase",
+    "charge",
+    "charges",
+    "order",
+    "orders",
+    "billing",
+    "subscription",
+    "transfer",
+    "withdraw",
+    "withdrawal",
+    "donate",
+    "payout",
+    "odeme",
+    "\xF6deme",
+    "satin al",
+    "sat\u0131n al",
+    "siparis",
+    "sipari\u015F",
+    "zahlung",
+    "bezahlen",
+    "kaufen",
+    "bestellung",
+    "pago",
+    "pagar",
+    "comprar",
+    "pedido",
+    "paiement",
+    "payer",
+    "acheter",
+    "commande"
+  ].join("|")})(?![\\p{L}\\p{N}])`,
+  "iu"
+);
+var DIALOG_WORDS = /^(cancel|cancelar|annuler|iptal)$/i;
+function classifyAction(name, signals = "", targets = "") {
+  const attrWords = signalWords(signals).split(" ").filter((w) => !DIALOG_WORDS.test(w)).join(" ");
+  const urlWords = signalWords(targets);
+  if (DESTRUCTIVE.test(name) || attrWords && DESTRUCTIVE_WORDS.test(attrWords) || urlWords && DESTRUCTIVE_WORDS.test(urlWords))
+    return "destructive";
+  if (FINANCIAL.test(name)) return "financial";
+  return null;
+}
+function checkAction(ctx, policy) {
+  const safeHost = policy.hostClass === "local";
+  const label = ctx.name || signalWords(`${ctx.signals ?? ""} ${ctx.targets ?? ""}`).slice(0, 60) || "this control";
+  const risky = classifyAction(ctx.name, ctx.signals, ctx.targets) ?? (ctx.paymentForm ? "financial" : null);
+  if (risky) {
+    if (!safeHost)
+      return {
+        allowed: false,
+        reason: `"${label}" looks ${risky === "financial" ? "like a payment/purchase" : "irreversible"}; Jourilo never performs it on a non-local host.`
+      };
+    if (!policy.allowDestructive)
+      return {
+        allowed: false,
+        reason: `"${label}" looks ${risky === "financial" ? "like a payment/purchase" : "irreversible"}; rerun with --allow-destructive on a local/test environment with sandbox data to include it.`
+      };
+  }
+  if (ctx.submitsForm && !safeHost && !policy.allowSubmit) {
+    return {
+      allowed: false,
+      reason: "Submitting a form on a non-local host is blocked; use --allow-submit only on an environment you are authorized to test, with test accounts."
+    };
+  }
+  return { allowed: true };
+}
+var SAFE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
+function isGraphqlRead(body) {
+  if (!body) return false;
+  try {
+    const q = JSON.parse(body).query;
+    return typeof q === "string" && /^\s*(query\b|\{)/.test(q) && !/\bmutation\b/.test(q);
+  } catch {
+    return false;
+  }
+}
+function checkRequest(r, policy) {
+  let u;
+  try {
+    u = new URL(r.url);
+  } catch {
+    return { allowed: true };
+  }
+  if (u.protocol !== "http:" && u.protocol !== "https:") return { allowed: true };
+  const method = r.method.toUpperCase();
+  const firstParty = u.origin === policy.origin;
+  const safeHost = policy.hostClass === "local";
+  if (r.isNavigation && r.mainFrame && !firstParty && !(policy.allowOrigins ?? []).includes(u.origin))
+    return {
+      allowed: false,
+      kind: "off-origin",
+      reason: `Navigation to ${u.origin} leaves the target origin ${policy.origin}; Jourilo does not act on other sites (allow it with --allow-origin ${u.origin}).`
+    };
+  const words = signalWords(`${u.pathname} ${u.search}`);
+  const mutating = !SAFE_METHODS.has(method);
+  const risky = method === "DELETE" || r.isNavigation && !mutating && DESTRUCTIVE_WORDS.test(words) ? "destructive" : mutating && DESTRUCTIVE_WORDS.test(words) ? "destructive" : mutating && FINANCIAL_WORDS.test(words) ? "financial" : null;
+  const what = `${method} ${u.pathname}`;
+  if (risky && (policy.mode === "read-only" || !safeHost || !policy.allowDestructive))
+    return {
+      allowed: false,
+      kind: risky,
+      reason: `${what} looks ${risky === "financial" ? "like a payment/purchase" : "irreversible"}; ${policy.mode === "read-only" ? "audits never send it" : safeHost ? "rerun with --allow-destructive on a local/test environment with sandbox data to include it" : "Jourilo never sends it to a non-local host"}.`
+    };
+  if (!mutating || isGraphqlRead(r.body)) return { allowed: true };
+  if (policy.mode === "read-only")
+    return {
+      allowed: false,
+      kind: "submit",
+      reason: `${what} would send data; audits only observe (form probes simulate the submission instead).`
+    };
+  if (!safeHost && !policy.allowSubmit && (firstParty || r.isNavigation))
+    return {
+      allowed: false,
+      kind: "submit",
+      reason: `${what} sends data to a non-local host; use --allow-submit only on an environment you are authorized to test, with test accounts.`
+    };
+  return { allowed: true };
+}
+function testData(runId, vars = {}) {
+  const tag = runId.replace(/[^a-z0-9]/gi, "").slice(-10).toLowerCase();
+  const base2 = {
+    email: `jourilo+${tag}@example.test`,
+    password: `Jr-${tag}-Q7!x`,
+    name: "Jordan Test",
+    firstName: "Jordan",
+    lastName: "Test",
+    phone: "+1 555 0100",
+    company: "Example Test Co",
+    search: "test",
+    zip: "10001",
+    // Published test card from Stripe's docs; only useful in a provider's test mode.
+    testCard: "4242 4242 4242 4242"
+  };
+  return { ...base2, ...vars };
+}
+function interpolate(value, data) {
+  return value.replace(/\{\{\s*([A-Za-z][\w]*)\s*\}\}/g, (m, k) => data[k] ?? m);
+}
+function isSecretValue(raw) {
+  return /\{\{\s*(password|testCard|secret|token)\s*\}\}/i.test(raw);
+}
+
+// src/journeys/request-guard.ts
+async function installRequestGuard(target, policy) {
+  const blocked = [];
+  const urls = /* @__PURE__ */ new Set();
+  const handler = async (route) => {
+    const req = route.request();
+    let mainFrame = req.isNavigationRequest();
+    try {
+      const frame = req.frame();
+      mainFrame = frame.parentFrame() === null;
+    } catch {
+    }
+    const verdict = checkRequest(
+      {
+        url: req.url(),
+        method: req.method(),
+        isNavigation: req.isNavigationRequest(),
+        mainFrame,
+        body: req.postData()
+      },
+      policy
+    );
+    if (!verdict.allowed) {
+      if (blocked.length < 200)
+        blocked.push({
+          url: redactUrl(req.url()),
+          method: req.method(),
+          reason: verdict.reason,
+          kind: verdict.kind ?? "submit",
+          navigation: req.isNavigationRequest(),
+          at: Date.now()
+        });
+      urls.add(req.url());
+      await route.abort("blockedbyclient").catch(() => void 0);
+      return;
+    }
+    await route.fallback().catch(() => void 0);
+  };
+  await target.route("**/*", handler);
+  return {
+    blocked,
+    isBlocked: (u) => urls.has(u) || urls.has(u.split("#")[0]),
+    since: (t) => blocked.filter((b) => b.at >= t),
+    detach: () => target.unroute("**/*", handler).catch(() => void 0)
+  };
+}
+
 // raw:src/browser/inpage/probe.js
 var probe_default = `// Runs inside the audited page. Plain JavaScript (no imports, no bundler helpers) evaluated as
 // \`(probe)(options)\`. It only reads the DOM; it never changes the page.
@@ -40192,6 +40442,28 @@ var ESCAPE_TRAP = `(sels) => {
   next.focus();
   return true;
 }`;
+var TRAP_ADVICE = `(selectors) => {
+  const text = document.body.innerText || '';
+  const m = text.match(/(press|use|hit)\\s+(ctrl|control|alt|option|shift|cmd|command|esc|escape|f\\d+)[^.\\n]{0,24}?\\s+to\\s+(exit|leave|escape|close|quit|move on|continue)[^.\\n]{0,40}/i);
+  if (m) return m[0].trim();
+  for (const s of selectors) {
+    const el = document.querySelector(s);
+    const name = el ? (el.getAttribute('aria-label') || el.textContent || '').trim() : '';
+    if (/\\b(how to|help|exit|leave|skip out)\\b/i.test(name)) return name.slice(0, 80);
+  }
+  return null;
+}`;
+async function shotAround(page, r) {
+  const pad = 24;
+  const clip = {
+    x: Math.max(0, r.x - pad),
+    y: Math.max(0, r.y - pad),
+    width: r.width + pad * 2,
+    height: r.height + pad * 2
+  };
+  if (r.width < 1 || r.height < 1 || clip.width * clip.height > 640 * 480) return null;
+  return page.screenshot({ clip, fullPage: true, animations: "disabled", caret: "hide", type: "png" }).catch(() => null);
+}
 async function keyboardWalk(page, maxTabs = 60) {
   const focusableCount = await page.evaluate(COUNT_FOCUSABLE);
   const stops = [];
@@ -40202,6 +40474,7 @@ async function keyboardWalk(page, maxTabs = 60) {
   );
   let prevHandle = null;
   let prevFocused = null;
+  let prevShot = null;
   const limit = Math.min(maxTabs, focusableCount + 12);
   const sequence = [];
   const newStop = (d) => ({
@@ -40236,6 +40509,9 @@ async function keyboardWalk(page, maxTabs = 60) {
   for (let i = 0; i < limit; i++) {
     await page.keyboard.press(tabKey);
     walk2.pressed++;
+    await page.evaluate(
+      "new Promise((r) => requestAnimationFrame(() => requestAnimationFrame(() => setTimeout(r, 20))))"
+    ).catch(() => void 0);
     const handle = await page.evaluateHandle("document.activeElement");
     const data = await handle.evaluate(inPage(FOCUS_INFO));
     const prevSelector = sequence[sequence.length - 1];
@@ -40248,12 +40524,24 @@ async function keyboardWalk(page, maxTabs = 60) {
         walk2.trap = { selectors: [data.selector] };
       }
     }
+    const isNewStop = !!data && !noMove && !stops.some((s) => s.selector === data.selector);
+    const curFocused = isNewStop ? await handle.evaluate(inPage(FOCUS_STYLES)).catch(() => null) : null;
+    const curShot = isNewStop ? await shotAround(page, data.rect) : null;
     if (prevHandle && prevFocused && stops.length) {
       const unfocused = await prevHandle.evaluate(inPage(FOCUS_STYLES)).catch(() => null);
       const last = stops[stops.length - 1];
       if (unfocused) {
         last.indicatorChanges = prevFocused.filter((s, k) => s !== unfocused[k]);
         last.indicatorChecked = true;
+        if (!last.indicatorChanges.length && prevShot) {
+          await handle.evaluate(inPage("(el) => el.blur && el.blur()")).catch(() => void 0);
+          const neutral = await shotAround(page, last.rect);
+          await handle.evaluate(inPage("(el) => el.focus && el.focus()")).catch(() => void 0);
+          if (neutral && !neutral.equals(prevShot))
+            last.indicatorChanges = [
+              "the area around the element changes on focus (indicator drawn by another element)"
+            ];
+        }
         if (process.env.JOURILO_DEBUG?.includes("keyboard"))
           process.stderr.write(
             `[keyboard]   ${last.selector} changes=${JSON.stringify(last.indicatorChanges)}
@@ -40266,6 +40554,7 @@ async function keyboardWalk(page, maxTabs = 60) {
       break;
     }
     prevFocused = null;
+    prevShot = null;
     if (!data) {
       if (stops.length) walk2.completedCycle = true;
       break;
@@ -40286,7 +40575,8 @@ async function keyboardWalk(page, maxTabs = 60) {
       for (const s of tail) counts.set(s, (counts.get(s) ?? 0) + 1);
       const distinct = new Set([...counts].filter(([, n]) => n >= 2).map(([s]) => s));
       const cycling = distinct.size > 0 && tail.slice(-4).every((s) => distinct.has(s));
-      if (cycling && distinct.size <= 3 && focusableCount > distinct.size + 2 && !data.inModal) {
+      const unreached = focusableCount - new Set(sequence).size;
+      if (cycling && distinct.size <= 3 && unreached > 0 && !data.inModal) {
         walk2.trap = { selectors: [...distinct] };
         if (!escaped && await page.evaluate(`(${ESCAPE_TRAP})(${JSON.stringify([...distinct])})`).catch(() => false)) {
           escaped = true;
@@ -40306,12 +40596,653 @@ async function keyboardWalk(page, maxTabs = 60) {
       prevHandle = null;
       continue;
     }
-    prevFocused = await handle.evaluate(inPage(FOCUS_STYLES)).catch(() => null);
+    prevFocused = curFocused;
+    prevShot = curShot;
     prevHandle = handle;
     stops.push(newStop(data));
   }
+  if (walk2.trap) {
+    const advice = await page.evaluate(`(${TRAP_ADVICE})(${JSON.stringify(walk2.trap.selectors)})`).catch(() => null);
+    if (advice) {
+      walk2.trap.advice = advice;
+      const key = adviceKey(advice);
+      if (key) {
+        const trapped = walk2.trap.selectors;
+        await page.locator(trapped[0]).first().focus({ timeout: 2e3 }).catch(() => void 0);
+        await page.keyboard.press(key).catch(() => void 0);
+        await page.evaluate("new Promise((r) => requestAnimationFrame(() => setTimeout(r, 30)))").catch(() => void 0);
+        const out = await page.evaluate(
+          `((sel) => { const a = document.activeElement; return !!a && a !== document.body && !sel.some((s) => a.matches(s)); })(${JSON.stringify(trapped)})`
+        ).catch(() => false);
+        walk2.trap.adviceWorks = out;
+      }
+    }
+  }
   return walk2;
 }
+function adviceKey(advice) {
+  const m = advice.match(/\b(?:press|use|hit)\s+([a-z0-9]+(?:\s*[+-]\s*[a-z0-9]+)*)/i);
+  if (!m) return null;
+  const NAMES = {
+    ctrl: "Control",
+    control: "Control",
+    alt: "Alt",
+    option: "Alt",
+    shift: "Shift",
+    cmd: "Meta",
+    command: "Meta",
+    esc: "Escape",
+    escape: "Escape",
+    tab: "Tab",
+    enter: "Enter"
+  };
+  const parts = m[1].split(/\s*[+-]\s*/).map(
+    (k) => NAMES[k.toLowerCase()] ?? (/^f\d{1,2}$/i.test(k) ? k.toUpperCase() : k.length === 1 ? k.toUpperCase() : null)
+  );
+  if (parts.some((p) => !p) || !parts.some((p) => p !== "Shift" && !/^(Control|Alt|Meta)$/.test(p) || parts.length === 1))
+    return null;
+  return parts.join("+");
+}
+
+// src/core/net-guard.ts
+import { lookup as dnsLookup } from "node:dns";
+import http from "node:http";
+import https from "node:https";
+import net, { isIP as isIP2 } from "node:net";
+
+// src/core/url-safety.ts
+init_errors();
+import { lookup } from "node:dns/promises";
+import { isIP } from "node:net";
+var LOCAL_SUFFIXES = [".localhost", ".test"];
+function isLocalHostname(host) {
+  const h = host.replace(/^\[|\]$/g, "").toLowerCase();
+  return h === "localhost" || h === "::1" || /^127\.\d+\.\d+\.\d+$/.test(h) || h === "0.0.0.0" || LOCAL_SUFFIXES.some((s) => h.endsWith(s));
+}
+var METADATA_V4 = /* @__PURE__ */ new Set(["169.254.169.254", "169.254.170.2", "169.254.169.123", "100.100.100.200"]);
+function classifyV4(v) {
+  const [a, b, c, d] = v.split(".").map(Number);
+  if (METADATA_V4.has(`${a}.${b}.${c}.${d}`)) return "metadata";
+  if (a === 0) return b === 0 && c === 0 && d === 0 ? "loopback" : "reserved";
+  if (a === 127) return "loopback";
+  if (a === 10 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168) return "private";
+  if (a === 100 && b >= 64 && b <= 127) return "private";
+  if (a === 169 && b === 254) return "link-local";
+  if (a === 192 && b === 0 && (c === 0 || c === 2)) return "reserved";
+  if (a === 192 && b === 88 && c === 99) return "reserved";
+  if (a === 198 && (b === 18 || b === 19)) return "reserved";
+  if (a === 198 && b === 51 && c === 100) return "reserved";
+  if (a === 203 && b === 0 && c === 113) return "reserved";
+  if (a >= 224) return "reserved";
+  return "public";
+}
+function v6Groups(v) {
+  let s = v.split("%")[0];
+  const tail = s.match(/(\d+\.\d+\.\d+\.\d+)$/);
+  if (tail) {
+    const p = tail[1].split(".").map(Number);
+    s = `${s.slice(0, -tail[1].length)}${(p[0] << 8 | p[1]).toString(16)}:${(p[2] << 8 | p[3]).toString(16)}`;
+  }
+  const halves = s.split("::");
+  if (halves.length > 2) return null;
+  const parse2 = (h) => h ? h.split(":").map((g) => Number.parseInt(g, 16)) : [];
+  const head = parse2(halves[0]);
+  const rest = halves.length === 2 ? parse2(halves[1]) : [];
+  const fill = 8 - head.length - rest.length;
+  if (fill < 0 || halves.length === 1 && fill !== 0) return null;
+  const groups = [...head, ...Array(fill).fill(0), ...rest];
+  return groups.every((g) => Number.isInteger(g) && g >= 0 && g <= 65535) ? groups : null;
+}
+var v4From = (hi, lo) => `${hi >> 8}.${hi & 255}.${lo >> 8}.${lo & 255}`;
+function classifyV6(v) {
+  const g = v6Groups(v);
+  if (!g) return "reserved";
+  const [g0, g1, g2, g3, g4, g5, g6, g7] = g;
+  const zeroTo = (n) => g.slice(0, n).every((x) => x === 0);
+  if (zeroTo(8)) return "loopback";
+  if (zeroTo(7) && g7 === 1) return "loopback";
+  if (zeroTo(5) && g5 === 65535) return classifyV4(v4From(g6, g7));
+  if (zeroTo(6)) return classifyV4(v4From(g6, g7));
+  if (g0 === 100 && g1 === 65435 && g2 === 0 && g3 === 0 && g4 === 0 && g5 === 0)
+    return classifyV4(v4From(g6, g7));
+  if (g0 === 100 && g1 === 65435 && g2 === 1) return "private";
+  if (g0 === 8194) return classifyV4(v4From(g1, g2));
+  if (g0 === 8193 && g1 === 0) return "reserved";
+  if (g0 === 8193 && g1 === 3512) return "reserved";
+  if (g0 === 256 && g1 === 0 && g2 === 0 && g3 === 0) return "reserved";
+  if (g0 === 64768 && g1 === 3778 && g2 + g3 + g4 + g5 + g6 === 0 && g7 === 596) return "metadata";
+  if ((g0 & 65024) === 64512) return "private";
+  if ((g0 & 65472) === 65152) return "link-local";
+  if ((g0 & 65472) === 65216) return "private";
+  if ((g0 & 65280) === 65280) return "reserved";
+  return "public";
+}
+function classifyIp(ip) {
+  const v = ip.replace(/^\[|\]$/g, "").toLowerCase();
+  const family = isIP(v.split("%")[0]);
+  if (family === 4) return classifyV4(v);
+  if (family === 6) return classifyV6(v);
+  return "reserved";
+}
+function addressVerdict(ip, policy) {
+  const cls = classifyIp(ip);
+  switch (cls) {
+    case "public":
+      return { ok: true };
+    case "metadata":
+      return {
+        ok: false,
+        reason: `${ip} is a cloud instance-metadata endpoint; Jourilo never connects to it.`
+      };
+    case "reserved":
+      return { ok: false, reason: `${ip} is a reserved or special-purpose address.` };
+    case "loopback":
+      return policy.target === "local" || policy.allowPrivate ? { ok: true } : { ok: false, reason: `${ip} is this machine (loopback); a public target may not reach it.` };
+    default:
+      return policy.allowPrivate ? { ok: true } : {
+        ok: false,
+        reason: `${ip} is a ${cls} network address; pass --allow-private if you are authorized.`
+      };
+  }
+}
+function parseTargetUrl(raw) {
+  let url;
+  try {
+    url = new URL(/^[a-z][a-z0-9+.-]*:\/\//i.test(raw) ? raw : `https://${raw}`);
+  } catch {
+    throw new JouriloError("INVALID_INPUT", `Not a valid URL: ${raw}`);
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new JouriloError("UNSAFE_URL", `Only http and https URLs are supported (got ${url.protocol}).`);
+  }
+  url.hash = "";
+  return url;
+}
+var systemResolver = (host) => lookup(host, { all: true, verbatim: true });
+var PRIVATE_HINT = "Pass --allow-private if you are authorized to test this host.";
+async function checkTarget(url, opts = {}) {
+  const host = url.hostname.replace(/^\[|\]$/g, "");
+  const literal = isIP(host) !== 0;
+  if (literal) {
+    const cls = classifyIp(host);
+    if (cls === "metadata" || cls === "reserved" && host !== "0.0.0.0")
+      throw new JouriloError("UNSAFE_URL", `${host} is a ${cls} address; Jourilo does not audit it.`);
+    if (cls === "loopback") return "local";
+    if (cls === "public") return "public";
+    if (!opts.allowPrivate)
+      throw new JouriloError("UNSAFE_URL", `${host} is a private network address.`, PRIVATE_HINT);
+    return "private";
+  }
+  if (isLocalHostname(host)) return "local";
+  if (opts.resolveDns === false) return "public";
+  let addrs;
+  try {
+    addrs = await (opts.resolver ?? systemResolver)(host);
+  } catch {
+    return "public";
+  }
+  const classes = addrs.map((a) => ({ address: a.address, cls: classifyIp(a.address) }));
+  const forbidden = classes.find((c) => c.cls === "metadata" || c.cls === "reserved");
+  if (forbidden)
+    throw new JouriloError(
+      "UNSAFE_URL",
+      `${host} resolves to ${forbidden.address}, a ${forbidden.cls} address; Jourilo does not audit it.`
+    );
+  const nonPublic = classes.filter((c) => c.cls !== "public");
+  if (!nonPublic.length) return "public";
+  if (!opts.allowPrivate) {
+    const mixed = nonPublic.length < classes.length;
+    throw new JouriloError(
+      "UNSAFE_URL",
+      mixed ? `${host} resolves to both public and private addresses (${nonPublic.map((c) => c.address).join(", ")}); this is refused because the browser could connect to either (DNS rebinding).` : `${host} resolves to a private network address (${nonPublic[0].address}).`,
+      PRIVATE_HINT
+    );
+  }
+  return "private";
+}
+function isCrawlable(candidate, origin) {
+  let u;
+  try {
+    u = new URL(candidate);
+  } catch {
+    return false;
+  }
+  if (u.origin !== origin) return false;
+  if (/\/(log-?out|sign-?out|logoff|delete|destroy|remove|unsubscribe|cancel)(\/|$|\?)/i.test(u.pathname))
+    return false;
+  if (/\.(pdf|zip|gz|dmg|exe|msi|png|jpe?g|gif|webp|svg|mp4|mp3|woff2?|ttf|ico|xml|json|txt|csv)$/i.test(
+    u.pathname
+  ))
+    return false;
+  return true;
+}
+function normalizeForCrawl(raw) {
+  const u = new URL(raw);
+  u.hash = "";
+  for (const k of [...u.searchParams.keys()])
+    if (/^utm_|^(fbclid|gclid|ref)$/i.test(k)) u.searchParams.delete(k);
+  if (u.pathname !== "/" && u.pathname.endsWith("/")) u.pathname = u.pathname.replace(/\/+$/, "");
+  return u.toString();
+}
+
+// src/core/net-guard.ts
+var GuardBlockedError = class extends Error {
+  code = "EJOURILOBLOCKED";
+};
+var systemResolve = (host) => new Promise(
+  (resolve10, reject) => dnsLookup(host, { all: true, verbatim: true }, (err, addrs) => err ? reject(err) : resolve10(addrs))
+);
+async function resolveAllowed(host, port, policy, deps = {}) {
+  const h = host.replace(/^\[|\]$/g, "");
+  const verdict = deps.verdict ?? ((ip) => addressVerdict(ip, policy));
+  let addrs;
+  if (isIP2(h)) addrs = [{ address: h, family: isIP2(h) }];
+  else {
+    try {
+      addrs = await (deps.resolve ?? systemResolve)(h);
+    } catch (err) {
+      throw Object.assign(new Error(`DNS lookup failed for ${h}`), { cause: err });
+    }
+  }
+  let reason = "";
+  for (const a of addrs) {
+    const v = verdict(a.address, port);
+    if (v.ok) return { address: a.address, family: a.family };
+    reason ||= v.reason;
+  }
+  return { blocked: reason || `${h} did not resolve to an allowed address.` };
+}
+function guardedLookup(policy, port, deps = {}) {
+  return (hostname, options, callback) => {
+    const wantAll = typeof options === "object" && options?.all === true;
+    resolveAllowed(hostname, port, policy, deps).then(
+      (r) => {
+        if ("blocked" in r) return callback(new GuardBlockedError(r.blocked), wantAll ? [] : "", 0);
+        if (wantAll) return callback(null, [{ address: r.address, family: r.family }]);
+        callback(null, r.address, r.family);
+      },
+      (err) => callback(err, wantAll ? [] : "", 0)
+    );
+  };
+}
+function splitHostPort(authority, defaultPort) {
+  const m = authority.match(/^(\[[^\]]+\]|[^:]+)(?::(\d+))?$/);
+  if (!m) return null;
+  const port = m[2] ? Number(m[2]) : defaultPort;
+  if (!Number.isInteger(port) || port < 1 || port > 65535) return null;
+  return { host: m[1].replace(/^\[|\]$/g, ""), port };
+}
+var HOP_BY_HOP = /* @__PURE__ */ new Set([
+  "proxy-connection",
+  "proxy-authorization",
+  "proxy-authenticate",
+  "connection",
+  "keep-alive",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade"
+]);
+function isLoopbackName(host) {
+  const h = host.replace(/^\[|\]$/g, "").toLowerCase();
+  return h === "localhost" || h.endsWith(".localhost") || isIP2(h) !== 0 && classifyIp(h) === "loopback";
+}
+function loopbackRedirectVerdict(location, from, policy) {
+  let to;
+  try {
+    to = new URL(location, from);
+  } catch {
+    return null;
+  }
+  if (!isLoopbackName(to.hostname)) return null;
+  if (policy.target === "local" || policy.allowPrivate) return null;
+  return `redirect from ${from.host} to ${to.host} (this machine) refused.`;
+}
+function redirectEscape(url, redirectedFrom, policy) {
+  if (!redirectedFrom) return null;
+  try {
+    return loopbackRedirectVerdict(url, new URL(redirectedFrom), policy);
+  } catch {
+    return null;
+  }
+}
+async function startNetGuard(policy, deps = {}) {
+  const blocked = [];
+  const seen = /* @__PURE__ */ new Set();
+  const record = (host, port2, reason) => {
+    const key = `${host}:${port2}`;
+    if (seen.has(key) || blocked.length >= 200) return;
+    seen.add(key);
+    blocked.push({ host, port: port2, reason });
+  };
+  const sockets = /* @__PURE__ */ new Set();
+  const track = (s) => {
+    sockets.add(s);
+    s.on("close", () => sockets.delete(s));
+    return s;
+  };
+  const connectUpstream = (host, port2, onReady, onFail) => {
+    resolveAllowed(host, port2, policy, deps).then(
+      (r) => {
+        if ("blocked" in r) {
+          record(host, port2, r.blocked);
+          return onFail(403, r.blocked);
+        }
+        const upstream = track(net.connect({ host: r.address, port: port2 }));
+        upstream.once("connect", () => onReady(upstream));
+        upstream.once("error", (err) => onFail(502, err.message));
+      },
+      (err) => onFail(502, err.message)
+    );
+  };
+  const pipeBoth = (client, upstream, head) => {
+    if (head.length) upstream.write(head);
+    upstream.pipe(client);
+    client.pipe(upstream);
+    upstream.on("error", () => client.destroy());
+    client.on("error", () => upstream.destroy());
+    client.on("close", () => upstream.destroy());
+    upstream.on("close", () => client.destroy());
+  };
+  const server = http.createServer((req, res) => {
+    let target;
+    try {
+      target = new URL(req.url ?? "");
+      if (target.protocol !== "http:") throw new Error("not http");
+    } catch {
+      res.writeHead(400).end("Jourilo network guard: absolute http:// URL expected.");
+      return;
+    }
+    const host = target.hostname.replace(/^\[|\]$/g, "");
+    const port2 = Number(target.port || 80);
+    const headers = {};
+    for (const [k, v] of Object.entries(req.headers))
+      if (v !== void 0 && !HOP_BY_HOP.has(k.toLowerCase())) headers[k] = v;
+    const fail = (status, reason) => {
+      if (res.headersSent) return void res.destroy();
+      res.writeHead(status, { "content-type": "text/plain" }).end(status === 403 ? `Blocked by Jourilo network guard: ${reason}` : "Bad gateway");
+    };
+    resolveAllowed(host, port2, policy, deps).then(
+      (r) => {
+        if ("blocked" in r) {
+          record(host, port2, r.blocked);
+          req.resume();
+          return fail(403, r.blocked);
+        }
+        const upstream = http.request({
+          host: r.address,
+          port: port2,
+          method: req.method,
+          path: `${target.pathname}${target.search}`,
+          headers,
+          setHost: false
+        });
+        upstream.on("response", (up) => {
+          const loc = (up.statusCode ?? 0) >= 300 && (up.statusCode ?? 0) < 400 ? up.headers.location : void 0;
+          const refused = loc ? loopbackRedirectVerdict(loc, target, policy) : null;
+          if (refused) {
+            up.resume();
+            record(host, port2, refused);
+            return fail(403, refused);
+          }
+          const out = {};
+          for (const [k, v] of Object.entries(up.headers))
+            if (v !== void 0 && !HOP_BY_HOP.has(k.toLowerCase())) out[k] = v;
+          res.writeHead(up.statusCode ?? 502, up.statusMessage, out);
+          up.pipe(res);
+        });
+        upstream.on("error", (err) => fail(502, err.message));
+        req.pipe(upstream);
+      },
+      (err) => fail(502, err.message)
+    );
+  });
+  server.on("connect", (req, client, head) => {
+    track(client);
+    client.on("error", () => void 0);
+    const hp = splitHostPort(req.url ?? "", 443);
+    if (!hp) {
+      client.end("HTTP/1.1 400 Bad Request\r\n\r\n");
+      return;
+    }
+    connectUpstream(
+      hp.host,
+      hp.port,
+      (upstream) => {
+        client.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+        pipeBoth(client, upstream, head);
+      },
+      (status, reason) => client.end(
+        `HTTP/1.1 ${status} ${status === 403 ? "Forbidden" : "Bad Gateway"}\r
+content-type: text/plain\r
+\r
+${status === 403 ? `Blocked by Jourilo network guard: ${reason}` : ""}`
+      )
+    );
+  });
+  server.on("upgrade", (req, client, head) => {
+    track(client);
+    client.on("error", () => void 0);
+    let target;
+    try {
+      target = new URL(req.url ?? "");
+    } catch {
+      client.end("HTTP/1.1 400 Bad Request\r\n\r\n");
+      return;
+    }
+    connectUpstream(
+      target.hostname,
+      Number(target.port || 80),
+      (upstream) => {
+        const lines = [`${req.method} ${target.pathname}${target.search} HTTP/1.1`];
+        for (let i = 0; i < req.rawHeaders.length; i += 2) {
+          const k = req.rawHeaders[i];
+          if (/^proxy-/i.test(k)) continue;
+          lines.push(`${k}: ${req.rawHeaders[i + 1]}`);
+        }
+        upstream.write(`${lines.join("\r\n")}\r
+\r
+`);
+        pipeBoth(client, upstream, head);
+      },
+      (status) => client.end(`HTTP/1.1 ${status} ${status === 403 ? "Forbidden" : "Bad Gateway"}\r
+\r
+`)
+    );
+  });
+  server.on("connection", (s) => track(s));
+  server.on("clientError", (_err, socket) => socket.destroy());
+  await new Promise((resolve10, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => resolve10());
+  });
+  const { port } = server.address();
+  return {
+    url: `http://127.0.0.1:${port}`,
+    policy,
+    blocked,
+    close: () => new Promise((resolve10) => {
+      for (const s of sockets) s.destroy();
+      server.close(() => resolve10());
+    })
+  };
+}
+async function guardedFetchText(url, policy, opts) {
+  const origin = new URL(url).origin;
+  let current = new URL(url);
+  for (let hop = 0; hop < 6; hop++) {
+    if (current.origin !== origin) return null;
+    const port = Number(current.port || (current.protocol === "https:" ? 443 : 80));
+    const pre = await resolveAllowed(current.hostname, port, policy, opts.deps).catch(() => null);
+    if (!pre || "blocked" in pre) return null;
+    const res = await new Promise((resolve10) => {
+      const mod = current.protocol === "https:" ? https : http;
+      const req = mod.get(
+        current,
+        {
+          headers: { "user-agent": opts.userAgent, accept: "text/plain, application/xml, text/xml, */*" },
+          lookup: guardedLookup(policy, port, opts.deps),
+          timeout: opts.timeoutMs,
+          agent: false
+        },
+        (r) => {
+          const status = r.statusCode ?? 0;
+          if (status >= 300 && status < 400 && r.headers.location) {
+            r.resume();
+            return resolve10({ status, location: r.headers.location });
+          }
+          if (status < 200 || status >= 300) {
+            r.resume();
+            return resolve10({ status });
+          }
+          const max = opts.maxBytes ?? 2e6;
+          let size = 0;
+          const chunks = [];
+          r.on("data", (c) => {
+            size += c.length;
+            if (size <= max) chunks.push(c);
+            else r.destroy();
+          });
+          const done = () => resolve10({ status, body: Buffer.concat(chunks).toString("utf8") });
+          r.on("end", done);
+          r.on("close", done);
+          r.on("error", () => resolve10(null));
+        }
+      );
+      req.on("timeout", () => req.destroy());
+      req.on("error", () => resolve10(null));
+    });
+    if (!res) return null;
+    if (res.location) {
+      try {
+        current = new URL(res.location, current);
+      } catch {
+        return null;
+      }
+      continue;
+    }
+    return res.body ?? null;
+  }
+  return null;
+}
+
+// src/browser/runtime.ts
+init_errors();
+import { spawnSync } from "node:child_process";
+import { createRequire } from "node:module";
+import { dirname as dirname4, join as join4 } from "node:path";
+var cached;
+async function loadPlaywright() {
+  if (cached) return cached;
+  try {
+    cached = await import("playwright-core");
+    return cached;
+  } catch {
+    throw new JouriloError(
+      "BROWSER_UNAVAILABLE",
+      "playwright-core is not installed.",
+      "Run `npm install` in the Jourilo directory (or `npx jourilo setup`)."
+    );
+  }
+}
+async function launchBrowser(name = "chromium", headed = false, guard) {
+  const pw = await loadPlaywright();
+  const type = name === "firefox" ? pw.firefox : name === "webkit" ? pw.webkit : pw.chromium;
+  const opts = { headless: !headed };
+  if (name === "chrome" || name === "msedge") opts.channel = name;
+  if (guard) {
+    if (name === "firefox") {
+      opts.proxy = { server: guard.url };
+      opts.firefoxUserPrefs = {
+        "network.proxy.allow_hijacking_localhost": true,
+        "network.proxy.no_proxies_on": "",
+        "media.peerconnection.enabled": false,
+        "network.dns.disablePrefetch": true
+      };
+    } else if (name === "webkit") {
+      opts.proxy = { server: guard.url };
+    } else {
+      opts.proxy = { server: guard.url, bypass: "<-loopback>" };
+      opts.args = [
+        "--force-webrtc-ip-handling-policy=disable_non_proxied_udp",
+        "--webrtc-ip-handling-policy=disable_non_proxied_udp",
+        "--disable-quic"
+      ];
+    }
+  }
+  try {
+    return await type.launch(opts);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (/Executable doesn't exist|browserType\.launch: .*not found|install/i.test(msg)) {
+      throw new JouriloError(
+        "BROWSER_UNAVAILABLE",
+        `The ${name} browser is not installed for Playwright.`,
+        name === "chrome" || name === "msedge" ? `Install ${name === "chrome" ? "Google Chrome" : "Microsoft Edge"}, or use --browser chromium.` : `Run \`jourilo setup --browser ${name}\` (downloads the browser build Playwright needs), or use --browser chrome to drive an installed Google Chrome.`
+      );
+    }
+    throw new JouriloError("BROWSER_UNAVAILABLE", `Could not launch ${name}: ${msg.split("\n")[0]}`);
+  }
+}
+function installBrowser(name) {
+  const require2 = createRequire(import.meta.url);
+  let cli;
+  try {
+    cli = join4(dirname4(require2.resolve("playwright-core/package.json")), "cli.js");
+  } catch {
+    throw new JouriloError(
+      "BROWSER_UNAVAILABLE",
+      "playwright-core is not installed; cannot install browsers."
+    );
+  }
+  const res = spawnSync(process.execPath, [cli, "install", name], { encoding: "utf8" });
+  return { ok: res.status === 0, output: `${res.stdout ?? ""}${res.stderr ?? ""}`.trim() };
+}
+
+// src/browser/session.ts
+var sessions = /* @__PURE__ */ new WeakMap();
+async function openGuardedBrowser(name, headed, policy) {
+  const guard = await startNetGuard(policy);
+  let browser;
+  try {
+    browser = await launchBrowser(name, headed, guard);
+  } catch (err) {
+    await guard.close();
+    throw err;
+  }
+  const escaped = [];
+  sessions.set(browser, { policy, escaped });
+  return {
+    browser,
+    guard,
+    report: () => ({ blocked: [...guard.blocked], escaped: [...escaped] }),
+    close: async () => {
+      await browser.close().catch(() => void 0);
+      await guard.close();
+    }
+  };
+}
+function watchContext(browser, ctx) {
+  const s = sessions.get(browser);
+  if (!s) return;
+  ctx.on("request", (req) => {
+    const from = req.redirectedFrom()?.url() ?? null;
+    const reason = redirectEscape(req.url(), from, s.policy);
+    if (reason && s.escaped.length < 50) s.escaped.push({ url: redactUrl(req.url()), reason });
+  });
+}
+function networkLimitations(r) {
+  const out = [];
+  if (r.blocked.length)
+    out.push(
+      `The network guard refused ${r.blocked.length} connection(s) to non-public addresses (${r.blocked.slice(0, 3).map((b) => `${b.host}:${b.port}`).join(", ")}${r.blocked.length > 3 ? ", \u2026" : ""}); content that depends on them was not loaded.`
+    );
+  if (r.escaped.length)
+    out.push(
+      `SECURITY: ${r.escaped.length} redirect(s) from the target reached this machine outside the network guard (${r.escaped[0].url}). This browser follows HTTPS redirects to loopback addresses directly; use Chromium or Firefox for untrusted sites.`
+    );
+  return out;
+}
 
 // src/browser/vitals.ts
 var VITALS_INIT_SCRIPT = `(() => {
@@ -40409,6 +41340,11 @@ function toMetrics(v, spread, runs2 = 1) {
     }
     const rounded = unit === "score" ? Math.round(value * 1e3) / 1e3 : Math.round(value);
     const m = { name, value: rounded, unit, source: "lab" };
+    if (runs2 > 1 && range) {
+      const r2 = (x) => unit === "score" ? Math.round(x * 1e3) / 1e3 : Math.round(x);
+      m.runs = runs2;
+      m.range = [r2(range[0]), r2(range[1])];
+    }
     const r = rate(name, rounded);
     if (r) m.rating = r;
     if (note) m.note = note;
@@ -40428,56 +41364,6 @@ function toMetrics(v, spread, runs2 = 1) {
   return out;
 }
 
-// src/journeys/safety.ts
-var DESTRUCTIVE = lexicon("destructive");
-var FINANCIAL = lexicon("financial");
-function checkAction(ctx, policy) {
-  const safeHost = policy.hostClass === "local";
-  const risky = DESTRUCTIVE.test(ctx.name) ? "destructive" : FINANCIAL.test(ctx.name) || ctx.paymentForm ? "financial" : null;
-  if (risky) {
-    if (!safeHost)
-      return {
-        allowed: false,
-        reason: `"${ctx.name}" looks ${risky === "financial" ? "like a payment/purchase" : "irreversible"}; Jourilo never performs it on a non-local host.`
-      };
-    if (!policy.allowDestructive)
-      return {
-        allowed: false,
-        reason: `"${ctx.name}" looks ${risky === "financial" ? "like a payment/purchase" : "irreversible"}; rerun with --allow-destructive on a local/test environment with sandbox data to include it.`
-      };
-  }
-  if (ctx.submitsForm && !safeHost && !policy.allowSubmit) {
-    return {
-      allowed: false,
-      reason: "Submitting a form on a non-local host is blocked; use --allow-submit only on an environment you are authorized to test, with test accounts."
-    };
-  }
-  return { allowed: true };
-}
-function testData(runId, vars = {}) {
-  const tag = runId.replace(/[^a-z0-9]/gi, "").slice(-10).toLowerCase();
-  const base2 = {
-    email: `jourilo+${tag}@example.test`,
-    password: `Jr-${tag}-Q7!x`,
-    name: "Jordan Test",
-    firstName: "Jordan",
-    lastName: "Test",
-    phone: "+1 555 0100",
-    company: "Example Test Co",
-    search: "test",
-    zip: "10001",
-    // Published test card from Stripe's docs; only useful in a provider's test mode.
-    testCard: "4242 4242 4242 4242"
-  };
-  return { ...base2, ...vars };
-}
-function interpolate(value, data) {
-  return value.replace(/\{\{\s*([A-Za-z][\w]*)\s*\}\}/g, (m, k) => data[k] ?? m);
-}
-function isSecretValue(raw) {
-  return /\{\{\s*(password|testCard|secret|token)\s*\}\}/i.test(raw);
-}
-
 // src/browser/widgets.ts
 var AVOID = /(?<![\p{L}])(add to (cart|basket|bag)|sepete ekle|in den warenkorb|añadir al carrito|ajouter au panier|like|beğen|follow|takip et|vote|oy ver|log ?out|sign ?out|çıkış yap|abmelden|cerrar sesión|déconnexion)(?![\p{L}])/iu;
 var TRIGGERS = `(() => {
@@ -40494,6 +41380,16 @@ var TRIGGERS = `(() => {
   };
   return Array.from(document.querySelectorAll('[aria-haspopup]:not([aria-haspopup="false"]), [aria-expanded], [aria-controls], a[href="#"], a[href^="#"]:not([href="#main"]):not([href^="#content"]), a[href^="javascript:"]'))
     .filter((e) => e.getClientRects().length > 0 && getComputedStyle(e).visibility !== 'hidden' && !e.disabled && /^(BUTTON|A|SUMMARY)$|^button$/i.test(e.tagName === 'DIV' || e.tagName === 'SPAN' ? (e.getAttribute('role') || '') : e.tagName))
+    // A link to a section that is already on screen is in-page navigation (skip links, table of contents), not a
+    // popup trigger; following it only scrolls.
+    .filter((e) => {
+      const href = e.tagName === 'A' ? e.getAttribute('href') || '' : '';
+      if (!/^#./.test(href) || e.hasAttribute('aria-haspopup') || e.hasAttribute('aria-expanded') || e.hasAttribute('aria-controls')) return true;
+      let id = href.slice(1);
+      try { id = decodeURIComponent(id); } catch {}
+      const target = document.getElementById(id) || document.getElementsByName(id)[0];
+      return !(target && target.getClientRects().length > 0 && getComputedStyle(target).visibility !== 'hidden');
+    })
     .slice(0, 8)
     .map((e) => {
       const r = e.getBoundingClientRect();
@@ -40515,11 +41411,17 @@ var SNAPSHOT_LAYERS = `(() => {
     return (cs.position === 'fixed' || cs.position === 'absolute') && e.getClientRects().length > 0 && cs.visibility !== 'hidden' && big(e);
   });
   // Signatures, not node identity: frameworks that re-render replace nodes without anything new appearing.
-  const sig = (e) => { const r = e.getBoundingClientRect(); return e.tagName + '.' + String(e.className) + '|' + Math.round(r.left) + ',' + Math.round(r.top) + ',' + Math.round(r.width) + ',' + Math.round(r.height); };
+  // Page coordinates for absolutely positioned layers, so scrolling does not make an existing layer look new.
+  const sig = (e) => { const r = e.getBoundingClientRect(); const fixed = getComputedStyle(e).position === 'fixed'; return e.tagName + '.' + String(e.className) + '|' + Math.round(r.left + (fixed ? 0 : scrollX)) + ',' + Math.round(r.top + (fixed ? 0 : scrollY)) + ',' + Math.round(r.width) + ',' + Math.round(r.height); };
   window.__jouriloLayers = new Set(layers.map(sig));
 })()`;
-var STATE = `(controls) => {
-  const visible = (e) => !!e && e.getClientRects().length > 0 && getComputedStyle(e).visibility !== 'hidden';
+var STATE = `(controls, mode) => {
+  const visible = (e) => !!e && e.isConnected && e.getClientRects().length > 0 && getComputedStyle(e).visibility !== 'hidden';
+  if (mode === 'same') {
+    const d = window.__jouriloDialog;
+    const ae = document.activeElement;
+    return { dialogOpen: visible(d) && (d.tagName !== 'DIALOG' || d.open), unlabelled: false, focusInDialog: !!d && !!ae && d.contains(ae), focusables: 0, controlledVisible: null, activeSelector: ae && ae !== document.body ? (ae.id ? '#' + ae.id : ae.tagName.toLowerCase()) : null };
+  }
   const dialogs = Array.from(document.querySelectorAll('[role="dialog"], [role="alertdialog"], dialog[open], [aria-modal="true"]')).filter(visible);
   let d = dialogs[dialogs.length - 1] || null;
   let unlabelled = false;
@@ -40528,12 +41430,14 @@ var STATE = `(controls) => {
     const fresh = Array.from(document.querySelectorAll('body *')).filter((e) => {
       const cs = getComputedStyle(e);
       const r = e.getBoundingClientRect();
-      const sig = e.tagName + '.' + String(e.className) + '|' + Math.round(r.left) + ',' + Math.round(r.top) + ',' + Math.round(r.width) + ',' + Math.round(r.height);
+      const fixed = cs.position === 'fixed';
+      const sig = e.tagName + '.' + String(e.className) + '|' + Math.round(r.left + (fixed ? 0 : scrollX)) + ',' + Math.round(r.top + (fixed ? 0 : scrollY)) + ',' + Math.round(r.width) + ',' + Math.round(r.height);
       return (cs.position === 'fixed' || cs.position === 'absolute') && visible(e) && big(e) && !window.__jouriloLayers.has(sig);
     });
     const outer = fresh.filter((e) => !fresh.some((o) => o !== e && o.contains(e)));
     if (outer.length) { d = outer[outer.length - 1]; unlabelled = true; }
   }
+  window.__jouriloDialog = d;
   const ae = document.activeElement;
   const controlled = controls ? controls.split(/\\s+/).map((id) => document.getElementById(id)).filter(Boolean) : [];
   const focusables = d ? Array.from(d.querySelectorAll('a[href], button, input:not([type="hidden"]), select, textarea, [tabindex]:not([tabindex="-1"])')).filter(visible).length : 0;
@@ -40546,10 +41450,89 @@ var STATE = `(controls) => {
     activeSelector: ae && ae !== document.body ? (ae.id ? '#' + ae.id : ae.tagName.toLowerCase()) : null,
   };
 }`;
+var COMPOSITES = `(() => {
+  const ITEM = { tablist: 'tab', radiogroup: 'radio', listbox: 'option', menubar: 'menuitem, [role="menuitemcheckbox"], [role="menuitemradio"]', tree: 'treeitem' };
+  const visible = (e) => e.getClientRects().length > 0 && getComputedStyle(e).visibility !== 'hidden';
+  const tabbable = (e) => e.tabIndex >= 0 && !e.disabled && e.getAttribute('aria-disabled') !== 'true' && visible(e);
+  const out = [];
+  for (const [role, item] of Object.entries(ITEM)) {
+    for (const c of document.querySelectorAll('[role="' + role + '"]')) {
+      if (!visible(c) || out.length >= 6) continue;
+      const items = Array.from(c.querySelectorAll(item.split(',').map((s) => s.trim().startsWith('[') ? s : '[role="' + s.trim() + '"]').join(','))).filter(visible);
+      if (items.length < 2) continue;
+      const stops = items.filter(tabbable);
+      const containerStop = tabbable(c) && c.hasAttribute('aria-activedescendant');
+      if (stops.length > 1 || (!stops.length && !containerStop)) continue;
+      const id = 'jourilo-composite-' + out.length;
+      c.setAttribute('data-jourilo-composite', id);
+      if (stops[0]) stops[0].setAttribute('data-jourilo-composite-stop', id);
+      const r = c.getBoundingClientRect();
+      const orientation = c.getAttribute('aria-orientation') || (role === 'listbox' || role === 'tree' ? 'vertical' : 'horizontal');
+      out.push({ id, role, orientation, items: items.length, name: (c.getAttribute('aria-label') || items.map((i) => i.innerText.trim()).filter(Boolean).slice(0, 3).join(' / ')).replace(/\\s+/g, ' ').slice(0, 80), rect: { x: Math.round(r.left + scrollX), y: Math.round(r.top + scrollY), width: Math.round(r.width), height: Math.round(r.height) } });
+    }
+  }
+  return out;
+})()`;
+var COMPOSITE_STATE = `(id) => {
+  const c = document.querySelector('[data-jourilo-composite="' + id + '"]');
+  if (!c) return null;
+  const ae = document.activeElement;
+  const marks = Array.from(c.querySelectorAll('[aria-selected], [aria-checked]')).map((e) => (e.getAttribute('aria-selected') || '') + (e.getAttribute('aria-checked') || '')).join('');
+  return { focusIn: !!ae && c.contains(ae), active: ae ? (ae.id || ae.textContent || '').trim().slice(0, 40) + '#' + Array.from(c.querySelectorAll('*')).indexOf(ae) : '', descendant: c.getAttribute('aria-activedescendant') || '', marks };
+}`;
+async function checkComposites(page, out) {
+  const found = await page.evaluate(COMPOSITES).catch(() => []);
+  for (const c of found) {
+    const stop = page.locator(`[data-jourilo-composite-stop="${c.id}"]`);
+    const target = await stop.count() ? stop.first() : page.locator(`[data-jourilo-composite="${c.id}"]`);
+    const read3 = () => page.evaluate(`(${COMPOSITE_STATE})(${JSON.stringify(c.id)})`);
+    try {
+      await target.focus({ timeout: 2e3 });
+    } catch {
+      continue;
+    }
+    const before = await read3();
+    if (!before?.focusIn) continue;
+    out.composites++;
+    const keys = c.orientation === "vertical" ? ["ArrowDown", "ArrowRight"] : ["ArrowRight", "ArrowDown"];
+    let moved = false;
+    for (const key of keys) {
+      await page.keyboard.press(key);
+      await page.waitForTimeout(120);
+      const after = await read3();
+      if (after && (after.active !== before.active || after.descendant !== before.descendant || after.marks !== before.marks)) {
+        moved = true;
+        break;
+      }
+    }
+    if (!moved)
+      out.issues.push({
+        kind: "composite-unreachable",
+        trigger: `[role="${c.role}"]`,
+        name: c.name || c.role,
+        rect: c.rect,
+        detail: `Only one of the ${c.items} items of this ${c.role} is in the Tab order, and the arrow keys do not move to the others, so ${c.items - 1} item(s) cannot be reached with a keyboard.`,
+        steps: [
+          `Press Tab until the ${c.role} "${c.name || c.role}" has focus.`,
+          `Press ${keys.join(" and ")}: focus and selection stay where they are.`
+        ]
+      });
+  }
+  await page.evaluate(
+    `document.querySelectorAll('[data-jourilo-composite],[data-jourilo-composite-stop]').forEach((e) => { e.removeAttribute('data-jourilo-composite'); e.removeAttribute('data-jourilo-composite-stop'); })`
+  ).catch(() => void 0);
+}
 async function checkWidgets(page) {
   const triggers = await page.evaluate(TRIGGERS);
-  const out = { triggers: triggers.length, dialogs: 0, disclosures: 0, issues: [] };
-  const state = (controls) => page.evaluate(`(${STATE})(${JSON.stringify(controls)})`);
+  const out = {
+    triggers: triggers.length,
+    dialogs: 0,
+    disclosures: 0,
+    composites: 0,
+    issues: []
+  };
+  await checkComposites(page, out);
+  const state = (controls, mode = "open") => page.evaluate(`(${STATE})(${JSON.stringify(controls)}, ${JSON.stringify(mode)})`);
   for (const t of triggers) {
     if (DESTRUCTIVE.test(t.name) || FINANCIAL.test(t.name) || AVOID.test(t.name)) continue;
     const loc = page.locator(t.selector).first();
@@ -40580,7 +41563,7 @@ async function checkWidgets(page) {
         );
       } else {
         for (let k = 0; k <= after.focusables; k++) await page.keyboard.press("Tab");
-        const tabbed = await state(t.controls);
+        const tabbed = await state(t.controls, "same");
         if (tabbed.dialogOpen && !tabbed.focusInDialog)
           issue(
             "dialog-focus-escapes",
@@ -40589,7 +41572,7 @@ async function checkWidgets(page) {
       }
       await page.keyboard.press("Escape");
       await page.waitForTimeout(300);
-      const closed = await state(t.controls);
+      const closed = await state(t.controls, "same");
       if (closed.dialogOpen) {
         issue("dialog-escape", "Pressing Escape did not close the dialog.");
         await page.reload({ waitUntil: "load" }).catch(() => void 0);
@@ -40645,6 +41628,7 @@ async function newContext(browser, vp, opts) {
     serviceWorkers: "block",
     ...opts.storageState ? { storageState: opts.storageState } : {}
   });
+  watchContext(browser, ctx);
   await ctx.addInitScript({ content: NAME_SHIM });
   await ctx.addInitScript({ content: VITALS_INIT_SCRIPT });
   return ctx;
@@ -40652,6 +41636,7 @@ async function newContext(browser, vp, opts) {
 function observe(page, origin) {
   const consoleEntries = [];
   const network = [];
+  let ignored = () => false;
   page.on("console", (msg) => {
     const t = msg.type();
     if (t !== "error" && t !== "warning") return;
@@ -40674,6 +41659,7 @@ function observe(page, origin) {
     }
   };
   page.on("requestfailed", (req) => {
+    if (ignored(req.url())) return;
     const failure = req.failure()?.errorText ?? "failed";
     if (/ERR_ABORTED|NS_BINDING_ABORTED|cancelled/i.test(failure)) return;
     if (network.length >= 100) return;
@@ -40695,7 +41681,13 @@ function observe(page, origin) {
       firstParty: firstParty(res.url())
     });
   });
-  return { console: consoleEntries, network };
+  return {
+    console: consoleEntries,
+    network,
+    ignore: (fn) => {
+      ignored = fn;
+    }
+  };
 }
 async function settle(page, timeoutMs) {
   await page.waitForLoadState("networkidle", { timeout: Math.min(timeoutMs, 5e3) }).catch(() => void 0);
@@ -40832,12 +41824,12 @@ async function capturePage(ctx, url, vp, opts) {
     if (opts.screenshots !== false) {
       const base2 = `${slug(new URL(url).pathname.replace(/^\/$/, "home"), 40)}-${shortHash(url).slice(0, 6)}-${vp.name}`;
       const mask = [...DEFAULT_MASK, ...opts.mask ?? []].map((s) => page.locator(s));
-      const full = join3("screenshots", `${base2}.jpg`);
-      const fold = join3("screenshots", `${base2}-fold.jpg`);
+      const full = join5("screenshots", `${base2}.jpg`);
+      const fold = join5("screenshots", `${base2}-fold.jpg`);
       try {
         const height = Math.min(obs.probe?.scroll.height ?? vp.height, 12e3);
         await page.screenshot({
-          path: join3(opts.runDir, full),
+          path: join5(opts.runDir, full),
           type: "jpeg",
           quality: 80,
           fullPage: true,
@@ -40849,7 +41841,7 @@ async function capturePage(ctx, url, vp, opts) {
         });
         obs.screenshot = toPosix(full);
         await page.screenshot({
-          path: join3(opts.runDir, fold),
+          path: join5(opts.runDir, fold),
           type: "jpeg",
           quality: 80,
           animations: "disabled",
@@ -40863,6 +41855,15 @@ async function capturePage(ctx, url, vp, opts) {
       }
     }
     if (opts.keyboard !== false) {
+      const guard = await installRequestGuard(page, {
+        origin,
+        hostClass: "public",
+        allowSubmit: false,
+        allowDestructive: false,
+        mode: "read-only"
+      });
+      live.ignore(guard.isBlocked);
+      obs.blockedActions = guard.blocked;
       obs.keyboard = await keyboardWalk(page).catch((e) => {
         obs.errors.push(`keyboard: ${e.message.split("\n")[0]}`);
         return null;
@@ -40933,59 +41934,6 @@ function sanitizeInventory(inv) {
   }
 }
 
-// src/browser/runtime.ts
-init_errors();
-import { spawnSync } from "node:child_process";
-import { createRequire } from "node:module";
-import { dirname as dirname4, join as join4 } from "node:path";
-var cached;
-async function loadPlaywright() {
-  if (cached) return cached;
-  try {
-    cached = await import("playwright-core");
-    return cached;
-  } catch {
-    throw new JouriloError(
-      "BROWSER_UNAVAILABLE",
-      "playwright-core is not installed.",
-      "Run `npm install` in the Jourilo directory (or `npx jourilo setup`)."
-    );
-  }
-}
-async function launchBrowser(name = "chromium", headed = false) {
-  const pw = await loadPlaywright();
-  const type = name === "firefox" ? pw.firefox : name === "webkit" ? pw.webkit : pw.chromium;
-  const opts = { headless: !headed };
-  if (name === "chrome" || name === "msedge") opts.channel = name;
-  try {
-    return await type.launch(opts);
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    if (/Executable doesn't exist|browserType\.launch: .*not found|install/i.test(msg)) {
-      throw new JouriloError(
-        "BROWSER_UNAVAILABLE",
-        `The ${name} browser is not installed for Playwright.`,
-        name === "chrome" || name === "msedge" ? `Install ${name === "chrome" ? "Google Chrome" : "Microsoft Edge"}, or use --browser chromium.` : `Run \`jourilo setup --browser ${name}\` (downloads the browser build Playwright needs), or use --browser chrome to drive an installed Google Chrome.`
-      );
-    }
-    throw new JouriloError("BROWSER_UNAVAILABLE", `Could not launch ${name}: ${msg.split("\n")[0]}`);
-  }
-}
-function installBrowser(name) {
-  const require2 = createRequire(import.meta.url);
-  let cli;
-  try {
-    cli = join4(dirname4(require2.resolve("playwright-core/package.json")), "cli.js");
-  } catch {
-    throw new JouriloError(
-      "BROWSER_UNAVAILABLE",
-      "playwright-core is not installed; cannot install browsers."
-    );
-  }
-  const res = spawnSync(process.execPath, [cli, "install", name], { encoding: "utf8" });
-  return { ok: res.status === 0, output: `${res.stdout ?? ""}${res.stderr ?? ""}`.trim() };
-}
-
 // src/audit/finding.ts
 function pathOf(url) {
   try {
@@ -41179,6 +42127,16 @@ function nielsen(n) {
     url: "https://www.nngroup.com/articles/ten-usability-heuristics/"
   };
 }
+var MANUAL_REVIEW = [
+  "1.1.1 Non-text content: is each text alternative accurate and useful (presence is checked, meaning is not)?",
+  "1.2.x Time-based media: are captions, audio description and transcripts correct and complete?",
+  "1.3.2 Meaningful sequence and 1.3.3 Sensory characteristics: does the reading order make sense; do instructions rely only on shape, position or colour?",
+  "1.4.1 Use of colour and 1.4.11 Non-text contrast (where not measured): is colour the only cue anywhere?",
+  "2.4.4 / 2.4.6 Link purpose, headings and labels: are they descriptive in context?",
+  "2.5.7 Dragging movements: does every drag have a single-pointer alternative?",
+  "3.1.2 Language of parts, 3.2.6 Consistent help, 3.3.7 Redundant entry, 3.3.8 Accessible authentication (beyond paste blocking).",
+  "4.1.3 Status messages and the overall experience with a screen reader and with voice control."
+];
 
 // src/conversion/rules.ts
 var VAGUE = lexicon("vagueCta", { exact: true });
@@ -41399,97 +42357,6 @@ function formFriction(obs, form) {
 init_errors();
 init_types();
 
-// src/core/url-safety.ts
-init_errors();
-import { lookup } from "node:dns/promises";
-import { isIP } from "node:net";
-var LOCAL_SUFFIXES = [".localhost", ".test"];
-function isLocalHostname(host) {
-  const h = host.replace(/^\[|\]$/g, "").toLowerCase();
-  return h === "localhost" || h === "::1" || /^127\.\d+\.\d+\.\d+$/.test(h) || h === "0.0.0.0" || LOCAL_SUFFIXES.some((s) => h.endsWith(s));
-}
-function isPrivateIp(ip) {
-  const v = ip.replace(/^\[|\]$/g, "").toLowerCase();
-  if (isIP(v) === 4) {
-    const [a, b] = v.split(".").map(Number);
-    return a === 10 || a === 127 || a === 0 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 100 && b >= 64 && b <= 127;
-  }
-  if (isIP(v) === 6) {
-    if (v === "::1" || v === "::") return true;
-    if (v.startsWith("fc") || v.startsWith("fd") || v.startsWith("fe80")) return true;
-    const mapped = v.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/);
-    return mapped ? isPrivateIp(mapped[1]) : false;
-  }
-  return false;
-}
-function parseTargetUrl(raw) {
-  let url;
-  try {
-    url = new URL(/^[a-z][a-z0-9+.-]*:\/\//i.test(raw) ? raw : `https://${raw}`);
-  } catch {
-    throw new JouriloError("INVALID_INPUT", `Not a valid URL: ${raw}`);
-  }
-  if (url.protocol !== "http:" && url.protocol !== "https:") {
-    throw new JouriloError("UNSAFE_URL", `Only http and https URLs are supported (got ${url.protocol}).`);
-  }
-  url.hash = "";
-  return url;
-}
-async function checkTarget(url, opts = {}) {
-  const host = url.hostname;
-  if (isLocalHostname(host)) return "local";
-  if (isPrivateIp(host)) {
-    if (!opts.allowPrivate) {
-      throw new JouriloError(
-        "UNSAFE_URL",
-        `${host} is a private network address.`,
-        "Pass --allow-private if you are authorized to test this host."
-      );
-    }
-    return "private";
-  }
-  if (opts.resolveDns !== false && isIP(host) === 0) {
-    try {
-      const addrs = await lookup(host, { all: true });
-      if (addrs.length && addrs.every((a) => isPrivateIp(a.address)) && !opts.allowPrivate) {
-        throw new JouriloError(
-          "UNSAFE_URL",
-          `${host} resolves to a private network address.`,
-          "Pass --allow-private if you are authorized to test this host."
-        );
-      }
-      if (addrs.some((a) => isPrivateIp(a.address))) return "private";
-    } catch (err) {
-      if (err instanceof JouriloError) throw err;
-    }
-  }
-  return "public";
-}
-function isCrawlable(candidate, origin) {
-  let u;
-  try {
-    u = new URL(candidate);
-  } catch {
-    return false;
-  }
-  if (u.origin !== origin) return false;
-  if (/\/(log-?out|sign-?out|logoff|delete|destroy|remove|unsubscribe|cancel)(\/|$|\?)/i.test(u.pathname))
-    return false;
-  if (/\.(pdf|zip|gz|dmg|exe|msi|png|jpe?g|gif|webp|svg|mp4|mp3|woff2?|ttf|ico|xml|json|txt|csv)$/i.test(
-    u.pathname
-  ))
-    return false;
-  return true;
-}
-function normalizeForCrawl(raw) {
-  const u = new URL(raw);
-  u.hash = "";
-  for (const k of [...u.searchParams.keys()])
-    if (/^utm_|^(fbclid|gclid|ref)$/i.test(k)) u.searchParams.delete(k);
-  if (u.pathname !== "/" && u.pathname.endsWith("/")) u.pathname = u.pathname.replace(/\/+$/, "");
-  return u.toString();
-}
-
 // src/discovery/robots.ts
 function parseRobots(text, agent2 = "jourilo") {
   const groups = [];
@@ -41569,49 +42436,50 @@ function rankUrl(url, depth) {
   for (const [re, w] of IMPORTANT) if (re.test(path2)) score += w;
   return score;
 }
-async function fetchText(url, timeoutMs) {
-  try {
-    const res = await fetch(url, {
-      signal: AbortSignal.timeout(timeoutMs),
-      redirect: "follow",
-      headers: { "user-agent": `${USER_AGENT_TOKEN} (+https://github.com/cihantopac/jourilo)` }
-    });
-    if (!res.ok) return null;
-    if (new URL(res.url).origin !== new URL(url).origin) return null;
-    const text = await res.text();
-    return text.slice(0, 2e6);
-  } catch {
-    return null;
-  }
+async function fetchText(url, timeoutMs, policy) {
+  return guardedFetchText(url, policy, {
+    timeoutMs,
+    userAgent: `${USER_AGENT_TOKEN} (+https://github.com/cihantopac/jourilo)`
+  }).catch(() => null);
 }
-async function loadRobots(origin, timeoutMs = 8e3) {
-  const text = await fetchText(`${origin}/robots.txt`, timeoutMs);
+async function loadRobots(origin, policy, timeoutMs = 8e3) {
+  const text = await fetchText(`${origin}/robots.txt`, timeoutMs, policy);
   return text === null ? null : parseRobots(text, USER_AGENT_TOKEN);
 }
-async function sitemapUrls(origin, robots, timeoutMs) {
-  const candidates = [...robots?.sitemaps ?? [], `${origin}/sitemap.xml`];
-  const urls = [];
-  for (const sm of candidates.slice(0, 3)) {
-    let smUrl;
+async function sitemapUrls(origin, robots, timeoutMs, policy) {
+  const local = policy.target === "local";
+  const rebase = (raw) => {
     try {
-      smUrl = new URL(sm);
+      const u = new URL(raw, origin);
+      if (u.origin === origin) return u.toString();
+      return local ? new URL(`${u.pathname}${u.search}`, origin).toString() : null;
     } catch {
-      continue;
+      return null;
     }
-    if (smUrl.origin !== origin) continue;
-    const xml = await fetchText(smUrl.toString(), timeoutMs);
+  };
+  const candidates = [...robots?.sitemaps ?? [], `${origin}/sitemap.xml`];
+  const urls = [];
+  let rebasedFrom = null;
+  for (const sm of candidates.slice(0, 3)) {
+    const smUrl = rebase(sm);
+    if (!smUrl) continue;
+    const xml = await fetchText(smUrl, timeoutMs, policy);
     if (!xml) continue;
     for (const m of xml.matchAll(/<loc>\s*([^<\s]+)\s*<\/loc>/g)) {
-      urls.push(m[1].replace(/&amp;/g, "&"));
+      const loc = m[1].replace(/&amp;/g, "&");
+      const mapped = rebase(loc);
+      if (!mapped) continue;
+      if (mapped !== loc) rebasedFrom ??= new URL(loc).origin;
+      urls.push(mapped);
       if (urls.length >= 500) break;
     }
     if (urls.length) break;
   }
-  return urls;
+  return { urls, rebasedFrom };
 }
 async function crawl(ctx, start, opts) {
   const origin = new URL(start).origin;
-  const robots = opts.respectRobots ? await loadRobots(origin) : null;
+  const robots = opts.respectRobots ? await loadRobots(origin, opts.policy) : null;
   const skipped = [];
   const seen = /* @__PURE__ */ new Map();
   const queue = [];
@@ -41634,8 +42502,8 @@ async function crawl(ctx, start, opts) {
   };
   push(start, 0);
   for (const extra of opts.include ?? []) push(new URL(extra, start).toString(), 0);
-  const fromSitemap = await sitemapUrls(origin, robots, opts.timeoutMs);
-  for (const u of fromSitemap) push(u, 1);
+  const fromSitemap = await sitemapUrls(origin, robots, opts.timeoutMs, opts.policy);
+  for (const u of fromSitemap.urls) push(u, 1);
   const visited = /* @__PURE__ */ new Set();
   const page = await ctx.newPage();
   try {
@@ -41676,13 +42544,19 @@ async function crawl(ctx, start, opts) {
     if (picked.length >= opts.maxPages) break;
     if (!picked.includes(p)) picked.push(p);
   }
-  return { pages: picked, skipped, robots, sitemapUrls: fromSitemap.length };
+  return {
+    pages: picked,
+    skipped,
+    robots,
+    sitemapUrls: fromSitemap.urls.length,
+    sitemapRebasedFrom: fromSitemap.rebasedFrom
+  };
 }
 
 // src/integrations/context.ts
 init_fs_safety();
 import { existsSync as existsSync4, readdirSync as readdirSync2, readFileSync as readFileSync3, statSync } from "node:fs";
-import { join as join5, relative as relative2 } from "node:path";
+import { join as join6, relative as relative2 } from "node:path";
 var CONTEXT_SCHEMA = "jourilo.context/v1";
 function readJson(file) {
   try {
@@ -41716,11 +42590,11 @@ function flattenTokens(tokens) {
 }
 function readMarkilo(root, brandSlug) {
   for (const dir of ["branding", "brand"]) {
-    const manifestFile = join5(root, dir, "markilo.json");
+    const manifestFile = join6(root, dir, "markilo.json");
     const manifest = readJson(manifestFile);
     if (!manifest?.brands?.length) continue;
     const brand = manifest.brands.find((b) => b.slug === brandSlug) ?? manifest.brands.find((b) => b.role === "master") ?? manifest.brands[0];
-    const tokensFile = join5(root, dir, "brands", brand.slug, "exports", "tokens", "tokens.json");
+    const tokensFile = join6(root, dir, "brands", brand.slug, "exports", "tokens", "tokens.json");
     if (!existsSync4(tokensFile)) continue;
     const { colors, fonts } = flattenTokens(readJson(tokensFile));
     return {
@@ -41735,13 +42609,13 @@ function readMarkilo(root, brandSlug) {
   return null;
 }
 function readSearvex(root) {
-  const runs2 = join5(root, ".searvex", "runs");
+  const runs2 = join6(root, ".searvex", "runs");
   if (!existsSync4(runs2)) return null;
-  const dirs = readdirSync2(runs2).filter((d) => existsSync4(join5(runs2, d, "report.json"))).sort(
-    (a, b) => statSync(join5(runs2, b, "report.json")).mtimeMs - statSync(join5(runs2, a, "report.json")).mtimeMs
+  const dirs = readdirSync2(runs2).filter((d) => existsSync4(join6(runs2, d, "report.json"))).sort(
+    (a, b) => statSync(join6(runs2, b, "report.json")).mtimeMs - statSync(join6(runs2, a, "report.json")).mtimeMs
   );
   if (!dirs.length) return null;
-  const file = join5(runs2, dirs[0], "report.json");
+  const file = join6(runs2, dirs[0], "report.json");
   const report2 = readJson(file);
   if (!report2?.findings) return null;
   return {
@@ -41757,7 +42631,7 @@ function readSearvex(root) {
   };
 }
 function readExplicit(root) {
-  const file = join5(root, "jourilo.context.json");
+  const file = join6(root, "jourilo.context.json");
   const data = readJson(file);
   if (!data) return null;
   if (data.schema !== CONTEXT_SCHEMA)
@@ -41946,6 +42820,12 @@ var AFTER = `([sel, beforeText]) => {
 }`;
 async function probeFormValidation(ctx, url, form, vp, policy, runDir) {
   const page = await ctx.newPage();
+  const guard = await installRequestGuard(page, {
+    ...policy,
+    allowDestructive: false,
+    origin: new URL(url).origin,
+    mode: policy.allowSubmit ? "journey" : "read-only"
+  });
   const base2 = {
     url: redactUrl(url),
     form: form.selector,
@@ -41978,10 +42858,12 @@ async function probeFormValidation(ctx, url, form, vp, policy, runDir) {
     );
     const startUrl = page.url();
     const submit = page.locator(form.selector).locator('button[type="submit"], button:not([type]), input[type="submit"]').first();
+    const submittedAt = Date.now();
     if (await submit.count()) await submit.click({ timeout: 1e4 });
     else await page.locator(form.selector).locator("input").first().press("Enter");
     await page.waitForLoadState("networkidle", { timeout: 3e3 }).catch(() => void 0);
     await page.waitForTimeout(600);
+    const intercepted = guard.since(submittedAt);
     const shotFile = toPosix(`screenshots/form-${shortHash(url, form.selector).slice(0, 8)}-${vp.name}.jpg`);
     await page.screenshot({
       path: `${runDir}/${shotFile}`,
@@ -42000,6 +42882,16 @@ async function probeFormValidation(ctx, url, form, vp, policy, runDir) {
     const evidence = [
       { type: "screenshot", file: shotFile, note: "After submitting the empty form" }
     ];
+    if (after && !after.errorish.length && !after.ariaInvalid && intercepted.length) {
+      return {
+        result: {
+          ...base2,
+          outcome: "simulated",
+          detail: `No client-side validation; the empty submission (${intercepted[0].method} ${intercepted[0].url}) was intercepted, so server-side feedback was not tested.`
+        },
+        findings
+      };
+    }
     if (!after || !after.errorish.length && !after.ariaInvalid) {
       const accepted = navigated && after !== null;
       findings.push(
@@ -42093,6 +42985,7 @@ async function probeFormValidation(ctx, url, form, vp, policy, runDir) {
   } catch (err) {
     return { result: { ...base2, outcome: "error", detail: excerpt(err.message, 200) }, findings };
   } finally {
+    await guard.detach();
     await page.close().catch(() => void 0);
   }
 }
@@ -42304,18 +43197,20 @@ function keyboardFindings(obs) {
     );
   }
   if (kb.trap) {
+    const advised = !!kb.trap.advice && kb.trap.adviceWorks !== false;
+    const broken = !!kb.trap.advice && kb.trap.adviceWorks === false;
     out.push(
       makeFinding({
         ruleId: "jourilo/keyboard-trap",
-        title: "Keyboard focus is trapped",
+        title: advised ? "Keyboard focus is held; the page explains a way out" : "Keyboard focus is trapped",
         category: "accessibility",
-        kind: "defect",
-        severity: "critical",
+        kind: advised ? "needs-review" : "defect",
+        severity: advised ? "moderate" : "critical",
         confidence: "medium",
         provenance: "observed",
         url: obs.url,
         viewport: vp,
-        description: `Pressing Tab cycled between ${kb.trap.selectors.length} element(s) outside any modal dialog while the page has ${kb.focusableCount} focusable elements.`,
+        description: `Pressing Tab cycled between ${kb.trap.selectors.length} element(s) outside any modal dialog while the page has ${kb.focusableCount} focusable elements.${advised ? ` The page explains how to leave ("${kb.trap.advice}")${kb.trap.adviceWorks ? ", and that key let focus out" : ""}; check that the instruction is announced before focus is held.` : ""}${broken ? ` The page says "${kb.trap.advice}", but pressing it did not let focus out.` : ""}`,
         impact: "Keyboard users cannot reach the rest of the page and may have to reload it.",
         recommendation: 'Remove custom keydown handlers that intercept Tab outside dialogs; if this is a dialog, mark it aria-modal="true" and provide Escape to close.',
         standards: [wcag("2.1.2")],
@@ -42510,6 +43405,22 @@ var WIDGET_RULES = {
       }
     ]
   },
+  "composite-unreachable": {
+    ruleId: "jourilo/composite-keyboard",
+    title: "Items of a tab list, radio group, list box or menu bar cannot be reached with the keyboard",
+    severity: "serious",
+    impact: "Keyboard and screen-reader users can reach only the current item; the other tabs, options or choices are out of reach.",
+    recommendation: "Implement the arrow-key pattern for this widget (move focus or aria-activedescendant to the next item with the arrow keys), or put every item in the Tab order.",
+    standards: [
+      wcag("2.1.1"),
+      {
+        standard: "WAI-ARIA APG",
+        id: "keyboard-interface",
+        title: "Developing a Keyboard Interface",
+        url: "https://www.w3.org/WAI/ARIA/apg/practices/keyboard-interface/"
+      }
+    ]
+  },
   "dialog-escape": {
     ruleId: "jourilo/dialog-escape",
     title: "Escape does not close the dialog",
@@ -42600,8 +43511,7 @@ function widgetFindings(obs) {
       occurrences: issues.length,
       reproduction: [
         `Open ${obs.url} at the ${obs.viewport.name} viewport.`,
-        `Focus "${issues[0].name}" with Tab and press Enter.`,
-        issues[0].detail
+        ...issues[0].steps ?? [`Focus "${issues[0].name}" with Tab and press Enter.`, issues[0].detail]
       ]
     });
   });
@@ -43029,9 +43939,13 @@ async function runAudit(ws, opts) {
   const runDir = ws.createRunDir(id);
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   const limitations = [];
-  let browser;
+  let session;
   try {
-    browser = await launchBrowser(opts.browser, opts.headed);
+    session = await openGuardedBrowser(opts.browser, opts.headed, {
+      target: hostClass,
+      allowPrivate: opts.allowPrivate
+    });
+    const browser = session.browser;
     const browserVersion = browser.version();
     let urls;
     if (opts.urls?.length) {
@@ -43056,6 +43970,7 @@ async function runAudit(ws, opts) {
         maxDepth: opts.maxDepth,
         respectRobots: opts.respectRobots,
         timeoutMs: opts.timeoutMs,
+        policy: session.guard.policy,
         ...opts.include ? { include: opts.include } : {}
       });
       await ctx.close();
@@ -43063,6 +43978,10 @@ async function runAudit(ws, opts) {
       const robotsSkips = found.skipped.filter((s) => s.reason === "robots.txt").length;
       if (robotsSkips)
         limitations.push(`${robotsSkips} URL(s) were skipped because robots.txt disallows them.`);
+      if (found.sitemapRebasedFrom)
+        limitations.push(
+          `The sitemap lists ${found.sitemapRebasedFrom} URLs; their paths were audited on the local server instead.`
+        );
       if (!found.robots && opts.respectRobots && hostClass === "public")
         limitations.push("No robots.txt was found; crawling stayed on the target origin.");
       if (!urls.length) urls = [{ url: target.toString() }];
@@ -43095,6 +44014,16 @@ async function runAudit(ws, opts) {
         await ctx.close().catch(() => void 0);
       }
     }
+    if (hostClass === "local" && !opts.urls?.length) {
+      const startPath = target.pathname;
+      const missing = observations.filter((o) => o.status === 404 && new URL(o.url).pathname === startPath);
+      if (missing.length && observations.some((o) => (o.status ?? 200) < 400)) {
+        for (const m of missing) observations.splice(observations.indexOf(m), 1);
+        limitations.push(
+          `${startPath} returned 404 on this local server (no start page in the build); it was not audited. The other pages were found through the sitemap and links.`
+        );
+      }
+    }
     const runs2 = Math.max(1, Math.min(9, Math.round(opts.runs ?? 1)));
     if (runs2 > 1) {
       for (const obs of observations) {
@@ -43117,6 +44046,7 @@ async function runAudit(ws, opts) {
       }
     }
     const formFindings = [];
+    const simulated = [];
     const formsAllowed = hostClass === "local" || opts.allowSubmit === true;
     if (opts.forms !== false && !opts.inventoryOnly && formsAllowed) {
       const vp = opts.viewports.find((v) => !v.hasTouch) ?? opts.viewports[0];
@@ -43142,11 +44072,16 @@ async function runAudit(ws, opts) {
             formFindings.push(...r.findings);
             if (r.result.outcome === "blocked")
               limitations.push(`Form ${form.selector} on ${o.url} was not submitted: ${r.result.detail}`);
+            if (r.result.outcome === "simulated") simulated.push(`${form.selector} on ${o.url}`);
           }
         }
       } finally {
         await ctx.close().catch(() => void 0);
       }
+      if (simulated.length)
+        limitations.push(
+          `Form validation was simulated: empty submissions were intercepted before reaching the server, so nothing was written. ${simulated.length} form(s) rely on the server for validation feedback (${simulated.slice(0, 3).join("; ")}${simulated.length > 3 ? "; \u2026" : ""}); that feedback was not tested. Rerun with --allow-submit on a disposable environment to test it.`
+        );
     } else if (opts.forms !== false && observations.some((o) => o.probe?.inventory.forms.length)) {
       limitations.push(
         "Form validation was not tested: submitting forms on a public host requires --allow-submit (authorized test environments only)."
@@ -43188,6 +44123,13 @@ async function runAudit(ws, opts) {
         "Throttling simulated a mid-range mobile network and 4\xD7 CPU slowdown (Chromium only)."
       );
     else limitations.push("Measured without network/CPU throttling: real mobile devices are usually slower.");
+    const network = session.report();
+    limitations.push(...networkLimitations(network));
+    const stopped = observations.flatMap((o) => o.blockedActions ?? []);
+    if (stopped.length)
+      limitations.push(
+        `While keys were pressed and widgets operated, ${stopped.length} request(s) that would have changed data or left the site were stopped (e.g. ${stopped[0].method} ${stopped[0].url}); audits only observe.`
+      );
     const pages = observations.map((o) => ({
       url: o.url,
       finalUrl: o.finalUrl,
@@ -43228,12 +44170,13 @@ async function runAudit(ws, opts) {
       findings,
       summary: summarize(findings, pages.length, 0),
       limitations: [...new Set(limitations)],
-      ...opts.context && (opts.context.brand || opts.context.search) ? { context: opts.context } : {}
+      ...opts.context && (opts.context.brand || opts.context.search) ? { context: opts.context } : {},
+      ...network.blocked.length || network.escaped.length ? { network } : {}
     };
     ws.saveRun(run);
     return { run, runDir, observations };
   } finally {
-    await browser?.close().catch(() => void 0);
+    await session?.close();
   }
 }
 function summarize(findings, pages, journeys2) {
@@ -43323,7 +44266,7 @@ init_errors();
 init_fs_safety();
 import { existsSync as existsSync5, readdirSync as readdirSync3, readFileSync as readFileSync4, statSync as statSync2 } from "node:fs";
 import { createServer } from "node:http";
-import { extname, join as join6, resolve as resolve4 } from "node:path";
+import { extname, join as join7, resolve as resolve4 } from "node:path";
 var TYPES = {
   ".html": "text/html; charset=utf-8",
   ".css": "text/css; charset=utf-8",
@@ -43356,24 +44299,34 @@ function stablePort(root) {
 async function serveStatic(root, port = 0, opts = {}) {
   if (!existsSync5(root) || !statSync2(root).isDirectory())
     throw new JouriloError("NOT_FOUND", `Not a directory: ${root}`);
-  const cfgFile = join6(root, "jourilo-fixture.json");
+  const cfgFile = join7(root, "jourilo-fixture.json");
   const cfg = existsSync5(cfgFile) ? JSON.parse(readFileSync4(cfgFile, "utf8")) : {};
   const spa = opts.spa ?? cfg.spa ?? looksLikeSpa(root);
   const server = createServer((req, res) => {
     const url = new URL(req.url ?? "/", "http://localhost");
-    let pathname2 = decodeURIComponent(url.pathname);
+    let pathname2;
+    try {
+      pathname2 = decodeURIComponent(url.pathname);
+    } catch {
+      res.writeHead(400).end("Bad request");
+      return;
+    }
+    if (pathname2.split("/").some((seg) => seg.startsWith(".") && seg !== ".well-known")) {
+      res.writeHead(404, { "content-type": "text/plain" }).end("Not found");
+      return;
+    }
     const delay = cfg.delays?.[pathname2] ?? 0;
     const send = () => {
       try {
         let file = resolveInside(root, `.${pathname2}`);
-        if (existsSync5(file) && statSync2(file).isDirectory()) file = join6(file, "index.html");
+        if (existsSync5(file) && statSync2(file).isDirectory()) file = join7(file, "index.html");
         if (!existsSync5(file) && !extname(pathname2)) {
           const html = resolveInside(root, `.${pathname2}.html`);
           if (existsSync5(html)) file = html;
         }
-        if (!existsSync5(file) && spa && !extname(pathname2)) file = join6(root, "index.html");
+        if (!existsSync5(file) && spa && !extname(pathname2)) file = join7(root, "index.html");
         if (!existsSync5(file)) {
-          const notFound = join6(root, "404.html");
+          const notFound = join7(root, "404.html");
           res.writeHead(404, { "content-type": TYPES[".html"] });
           res.end(existsSync5(notFound) ? readFileSync4(notFound) : "Not found");
           return;
@@ -43419,7 +44372,7 @@ async function serveStatic(root, port = 0, opts = {}) {
 // src/repair/locate.ts
 init_fs_safety();
 import { readdirSync as readdirSync4, readFileSync as readFileSync5, statSync as statSync3 } from "node:fs";
-import { extname as extname2, join as join7, relative as relative3 } from "node:path";
+import { extname as extname2, join as join8, relative as relative3 } from "node:path";
 var SOURCE_EXT = /* @__PURE__ */ new Set([
   ".html",
   ".htm",
@@ -43478,7 +44431,7 @@ function indexRepository(root, maxFiles = 6e3) {
     for (const name of entries) {
       if (out.length >= maxFiles) return;
       if (name.startsWith(".") && name !== ".vitepress") continue;
-      const full = join7(dir, name);
+      const full = join8(dir, name);
       let st;
       try {
         st = statSync3(full);
@@ -43761,7 +44714,26 @@ function locateFindings(run, repoRoot) {
 
 // src/report/index.ts
 import { writeFileSync as writeFileSync4 } from "node:fs";
-import { join as join8 } from "node:path";
+import { join as join9 } from "node:path";
+
+// src/report/brand.ts
+var WORDMARK_VIEWBOX = "-18 -74 320 107";
+var WORDMARK_PATHS = [
+  "m-15.5-64.4 3.2-3.2h55.5v2.6l-8 2.65L35.3-2C35.3 18 25 30.5 10 30.5c-6.5 0-12-3-15-9.5l-6.5-8L-5 5l6.5 8-3 3.7c2 4.8 6 7.8 11.5 7.8 9 0 14.3-6.5 14.3-18.5v-65.5q-.7-1.3-2.8-1.7h-33.8Z",
+  "M70.15-3.85q3.65 0 6.4-1.75t4.3-5.45 1.55-9.6q0-6.5-1.5-10.87-1.5-4.38-4.25-6.6-2.75-2.23-6.7-2.23-3.6 0-6.35 1.73-2.75 1.72-4.3 5.44-1.55 3.73-1.55 9.63 0 6.4 1.48 10.8 1.47 4.4 4.27 6.65t6.65 2.25M69.8 1.1q-6.85 0-11.97-2.87-5.13-2.88-7.93-8-2.8-5.13-2.8-11.88 0-6.95 2.98-12.3 2.97-5.35 8.2-8.37 5.22-3.03 12.07-3.03 6.9 0 11.98 2.88 5.07 2.87 7.9 7.97 2.82 5.1 2.82 11.9 0 6.95-2.97 12.3-2.98 5.35-8.2 8.38Q76.65 1.1 69.8 1.1",
+  "M115.1-14.95q0 2.8.8 4.45t2.73 2.4q1.92.75 5.22.75 3.1 0 6.1-1.05 2.1-.75 3.5-1.8v-28.25l-6.65-3.05v-2.55l17.2-.9-.65 6.3V-8.3q.5.45 1.3 1t1.78 1.05q.97.5 1.95.9.97.4 1.82.6v1.8L136.2.9h-1.35l-1.1-7.45q-1.55 1.5-2.9 2.6Q128.45-2 126.4-.9T122.3.65t-4.45.45q-6.45 0-9.52-3.88-3.08-3.87-3.08-11.57v-23.9l-7.2-3.2v-2.6L115.7-45l-.6 6.25Z",
+  "m186-44 6.5 8-6.5 8-6.5-8q-3.5.6-7.5 2v29.1l7.75 2.5V0h-24.9v-2.4l7.3-2.4v-29.25q-.7-.75-1.77-1.42-1.08-.68-2.48-1.38t-3.15-1.4v-1.65l14.65-5.45h1.4l1 8.15Q178-43.5 186-44",
+  "m207.8-72.4 6.5 7.5-6.5 7.5-6.5-7.5Zm5.85 27.05-.45 9.45v31.1l7.3 2.4V0h-24.45v-2.4l7.25-2.4v-29.95q-.55-.65-1.75-1.43-1.2-.77-2.67-1.54-1.48-.78-2.98-1.33V-41l16.05-4.35Z",
+  "m241.2-4.8 7.3 2.4V0h-24.45v-2.4l7.25-2.4v-55.5q-.7-.8-1.85-1.6t-2.75-1.65-3.55-1.65v-1.9l17.25-4.5h1.5l-.7 9.25Z",
+  "M277-3.85q3.65 0 6.4-1.75t4.3-5.45 1.55-9.6q0-6.5-1.5-10.87-1.5-4.38-4.25-6.6-2.75-2.23-6.7-2.23-3.6 0-6.35 1.73-2.75 1.72-4.3 5.44-1.55 3.73-1.55 9.63 0 6.4 1.48 10.8 1.47 4.4 4.27 6.65T277-3.85m-.35 4.95q-6.85 0-11.97-2.87-5.13-2.88-7.93-8-2.8-5.13-2.8-11.88 0-6.95 2.98-12.3 2.97-5.35 8.2-8.37 5.22-3.03 12.07-3.03 6.9 0 11.98 2.88 5.07 2.87 7.9 7.97 2.82 5.1 2.82 11.9 0 6.95-2.97 12.3-2.98 5.35-8.2 8.38-5.23 3.02-12.08 3.02"
+];
+var SYMBOL_PATH = "m150 122 42-42h670v70q-75 10-120 50v400c0 220-130 345-310 345-90 0-150-30-175-75l-85-100 85-100 85 100-18 21c23 39 58 61 113 61 115 0 175-82 175-252V205q-12-35-52-41H192Z";
+function wordmarkSvg(height) {
+  return `<svg xmlns="http://www.w3.org/2000/svg" viewBox="${WORDMARK_VIEWBOX}" height="${height}" role="img" aria-label="Jourilo" fill="currentColor">${WORDMARK_PATHS.map((d) => `<path d="${d}"/>`).join("")}</svg>`;
+}
+var FAVICON_URL = `data:image/svg+xml,${encodeURIComponent(
+  `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1024 1024"><style>path{fill:#1c1a17}@media (prefers-color-scheme:dark){path{fill:#f4efe4}}</style><path d="${SYMBOL_PATH}"/></svg>`
+)}`;
 
 // src/report/html.ts
 function esc(s) {
@@ -43881,7 +44853,9 @@ function journeysHtml(journeys2) {
   if (!journeys2.length)
     return '<p class="muted">No journeys were run. Use <code>jourilo journeys suggest</code> and <code>jourilo journeys run</code>.</p>';
   return journeys2.map(
-    (j) => `<section class="journey ${j.status}"><h3>${esc(j.name)} <span class="pill st-${j.status}">${j.status}</span> <span class="muted">${esc(j.viewport)} \xB7 ${(j.durationMs / 1e3).toFixed(1)} s</span></h3>
+    (j) => `<section class="journey ${j.status}"><h3>${esc(j.name)} <span class="pill st-${j.status}">${j.status}</span>${j.stability ? ` <span class="pill ${j.stability === "flaky" ? "st-failed" : "st-passed"}">${j.stability}</span>` : ""} <span class="muted">${esc(j.viewport)} \xB7 ${(j.durationMs / 1e3).toFixed(1)} s</span></h3>
+${j.attempts ? `<p class="muted">${j.attempts.length} attempts: ${j.attempts.map((a) => esc(a.status)).join(", ")}${j.stability === "flaky" ? " \u2014 the steps below are from a failing attempt." : ""}</p>` : ""}
+${j.blockedRequests?.length ? `<details><summary>${j.blockedRequests.length} request(s) stopped by the safety policy</summary><ul>${j.blockedRequests.map((b) => `<li><code>${esc(b.method)} ${esc(b.url)}</code> \u2014 ${esc(b.reason)}</li>`).join("")}</ul></details>` : ""}
 <ol class="steps">${j.steps.map(
       (s) => `<li class="${s.status}"><div>${esc(s.description)} <span class="pill st-${s.status}">${s.status}</span> <span class="muted">${s.durationMs} ms</span>${s.error ? `<pre>${esc(s.error)}</pre>` : ""}</div>${s.screenshot ? `<a href="${safeHref(s.screenshot)}" target="_blank" rel="noopener"><img class="stepshot" loading="lazy" alt="" src="${safeHref(s.screenshot)}"></a>` : ""}</li>`
     ).join("")}</ol>
@@ -43889,11 +44863,18 @@ function journeysHtml(journeys2) {
 ${j.trace ? `<p>Trace: <code>${esc(j.trace)}</code> (open with <code>npx playwright show-trace</code>)</p>` : ""}</section>`
   ).join("");
 }
+function networkHtml(run) {
+  const n = run.network;
+  if (!n || !n.blocked.length && !n.escaped.length) return "";
+  return `<h2>Network safety</h2>
+${n.escaped.length ? `<p class="poor"><strong>Security event:</strong> ${n.escaped.length} redirect(s) reached this machine outside the network guard. Rerun untrusted sites in Chromium or Firefox.</p><ul>${n.escaped.map((e) => `<li><code>${esc(e.url)}</code> \u2014 ${esc(e.reason)}</li>`).join("")}</ul>` : ""}
+${n.blocked.length ? `<p class="muted">Connections the page tried to open and the guard refused (content depending on them did not load):</p><table><thead><tr><th>Host</th><th>Port</th><th>Reason</th></tr></thead><tbody>${n.blocked.map((b) => `<tr><td><code>${esc(b.host)}</code></td><td>${b.port}</td><td>${esc(b.reason)}</td></tr>`).join("")}</tbody></table>` : ""}`;
+}
 function compareHtml(cmp) {
   const row = (label, n, cls) => `<div class="card ${cls}"><div class="num">${n}</div><div>${label}</div></div>`;
   return `<div class="cards">${row("Fixed", cmp.fixed.length, "good")}${row("New", cmp.introduced.length, "poor")}${row("Still present", cmp.persisting.length, "")}${row("Changed severity", cmp.changed.length, "")}</div>
 <p class="muted">Baseline run <code>${esc(cmp.base.id)}</code> (${esc(cmp.base.startedAt)}) vs <code>${esc(cmp.head.id)}</code> (${esc(cmp.head.startedAt)}).</p>
-${cmp.metrics.length ? `<table><thead><tr><th>Page</th><th>Viewport</th><th>Metric</th><th>Before</th><th>After</th><th>\u0394</th></tr></thead><tbody>${cmp.metrics.map((m) => `<tr><td>${esc(pathname(m.url))}</td><td>${esc(m.viewport)}</td><td>${esc(m.name)}</td><td>${m.before}</td><td>${m.after}</td><td class="${m.delta < 0 ? "good" : m.delta > 0 ? "poor" : ""}">${m.delta > 0 ? "+" : ""}${m.delta}</td></tr>`).join("")}</tbody></table><p class="muted">Lab deltas from single visits can be noise; repeat runs before drawing conclusions.</p>` : ""}`;
+${cmp.metrics.length ? `<table><thead><tr><th>Page</th><th>Viewport</th><th>Metric</th><th>Before</th><th>After</th><th>\u0394</th><th>Verdict</th></tr></thead><tbody>${cmp.metrics.map((m) => `<tr><td>${esc(pathname(m.url))}</td><td>${esc(m.viewport)}</td><td>${esc(m.name)}</td><td>${m.before}</td><td>${m.after}</td><td class="${m.verdict === "improved" ? "good" : m.verdict === "regressed" ? "poor" : ""}">${m.delta > 0 ? "+" : ""}${m.delta}</td><td>${esc(m.verdict)}</td></tr>`).join("")}</tbody></table><p class="muted">Lab metrics. "Improved"/"regressed" need repeated visits whose ranges do not overlap (<code>--runs 5</code>); "unconfirmed" is a large change seen in single visits; "noise" is within measurement variation.</p>` : ""}`;
 }
 function contextHtml(run) {
   const c = run.context;
@@ -43983,9 +44964,10 @@ function renderHtml(run, cmp, history = []) {
 <html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
 <meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src 'self' data:; style-src 'unsafe-inline'; script-src 'unsafe-inline'">
 <title>Jourilo report \xB7 ${esc(run.target)}</title>
+<link rel="icon" href="${FAVICON_URL}">
 <style>${CSS2}</style></head>
 <body>
-<header class="top"><div class="brand">Jourilo <span class="muted">Experience Observatory</span></div>
+<header class="top"><div class="brand">${wordmarkSvg(34)}<span class="muted">Experience Observatory</span></div>
 <div class="meta"><b>${esc(run.target)}</b><br><span class="muted">${esc(run.mode)} mode \xB7 ${esc(new Date(run.startedAt).toUTCString())} \xB7 ${esc(run.browser.name)} ${esc(run.browser.version)} \xB7 ${run.viewports.map((v) => `${esc(v.name)} ${v.width}\xD7${v.height}`).join(", ")} \xB7 Jourilo ${esc(run.tool.version)}</span></div></header>
 <nav class="tabs" role="tablist">
 <button role="tab" aria-selected="true" data-tab="overview">Overview</button>
@@ -44006,6 +44988,8 @@ ${roadmapHtml(findings)}
 ${historyHtml(run, history)}
 ${contextHtml(run)}
 <h2>Limitations of this run</h2><ul class="limits">${run.limitations.map((l) => `<li>${esc(l)}</li>`).join("")}</ul>
+${networkHtml(run)}
+<h2>Still needs a person</h2><p class="muted">Automated checks cannot judge these WCAG 2.2 criteria; no run, including this one, shows conformance.</p><ul class="limits">${MANUAL_REVIEW.map((m) => `<li>${esc(m)}</li>`).join("")}</ul>
 </section>
 <section id="findings" class="panel" hidden>
 <div class="filters">
@@ -44026,12 +45010,12 @@ ${cmp ? `<section id="compare" class="panel" hidden>${compareHtml(cmp)}</section
 </body></html>`;
 }
 var CSS2 = `
-:root{--bg:#f7f7f8;--fg:#18181b;--muted:#6b6b76;--card:#fff;--line:#e4e4e7;--accent:#4338ca;--crit:#b91c1c;--ser:#c2410c;--mod:#a16207;--min:#4b5563;--good:#15803d;--poor:#b91c1c;--ni:#a16207}
-@media (prefers-color-scheme:dark){:root{--bg:#0f0f12;--fg:#ececf1;--muted:#a1a1aa;--card:#18181d;--line:#2e2e35;--accent:#a5b4fc;--crit:#f87171;--ser:#fb923c;--mod:#facc15;--min:#cbd5e1;--good:#4ade80;--poor:#f87171;--ni:#facc15}}
+:root{--bg:#f4efe4;--fg:#1c1a17;--muted:#65635f;--card:#fffdf8;--line:#e2d9c7;--accent:#875802;--crit:#b91c1c;--ser:#c2410c;--mod:#955d05;--min:#4b5563;--good:#14713a;--poor:#b91c1c;--ni:#955d05}
+@media (prefers-color-scheme:dark){:root{--bg:#100d08;--fg:#f4efe4;--muted:#b9b7b4;--card:#1c1a17;--line:#393835;--accent:#d9af79;--crit:#f87171;--ser:#fb923c;--mod:#facc15;--min:#cbd5e1;--good:#4ade80;--poor:#f87171;--ni:#facc15}}
 *{box-sizing:border-box}body{margin:0;background:var(--bg);color:var(--fg);font:15px/1.5 system-ui,-apple-system,Segoe UI,sans-serif}
 a{color:var(--accent)}code,pre{font:12.5px/1.4 ui-monospace,SFMono-Regular,Menlo,monospace}pre{white-space:pre-wrap;word-break:break-word;background:var(--bg);border:1px solid var(--line);padding:6px 8px;border-radius:6px;margin:4px 0}
 .top{display:flex;gap:24px;align-items:center;justify-content:space-between;flex-wrap:wrap;padding:16px 24px;border-bottom:1px solid var(--line);background:var(--card)}
-.brand{font-weight:700;font-size:18px}.muted{color:var(--muted)}.meta{text-align:right;font-size:13px;overflow-wrap:anywhere}
+.brand{display:flex;align-items:center;gap:20px;font-size:15px}.brand svg{display:block;flex:none}.muted{color:var(--muted)}.meta{text-align:right;font-size:13px;overflow-wrap:anywhere}
 .tabs{display:flex;gap:4px;padding:0 24px;background:var(--card);border-bottom:1px solid var(--line);overflow-x:auto}
 .tabs button{font:inherit;background:none;border:0;border-bottom:3px solid transparent;padding:12px 12px;color:var(--muted);cursor:pointer;white-space:nowrap}
 .tabs button[aria-selected=true]{color:var(--fg);border-color:var(--accent);font-weight:600}.tabs button:focus-visible{outline:2px solid var(--accent)}
@@ -44111,6 +45095,18 @@ function renderMarkdown(run, cmp, limit = 25) {
       lines.push(`- \u{1F195} ${f.severity}: ${md(f.title)} \u2014 \`${path(f.url)}\``);
     for (const f of cmp.fixed.slice(0, 10)) lines.push(`- \u2705 fixed: ${md(f.title)} \u2014 \`${path(f.url)}\``);
     lines.push("");
+    if (cmp.metrics.length) {
+      lines.push(
+        "| Page | Viewport | Metric | Before | After | Verdict |",
+        "| ---- | -------- | ------ | ------ | ----- | ------- |",
+        ...cmp.metrics.map(
+          (m) => `| \`${path(m.url)}\` | ${m.viewport} | ${m.name} | ${m.before} | ${m.after} | ${m.verdict} |`
+        ),
+        "",
+        "Lab metrics. Improved/regressed requires repeated visits whose ranges do not overlap (`--runs 5`).",
+        ""
+      );
+    }
   }
   const sorted = [...run.findings].sort(
     (a, b) => severityRank(a.severity) - severityRank(b.severity) || b.occurrences - a.occurrences
@@ -44151,6 +45147,22 @@ function renderMarkdown(run, cmp, limit = 25) {
     lines.push("");
   }
   lines.push("## Limitations", "", ...run.limitations.map((l) => `- ${md(l)}`), "");
+  if (run.network?.blocked.length || run.network?.escaped.length)
+    lines.push(
+      "## Network safety",
+      "",
+      ...run.network.escaped.map((e) => `- \u26A0\uFE0F security event: \`${md(e.url)}\` \u2014 ${md(e.reason)}`) ?? [],
+      ...run.network.blocked.map((b) => `- refused \`${md(b.host)}:${b.port}\` \u2014 ${md(b.reason)}`),
+      ""
+    );
+  lines.push(
+    "## Still needs a person",
+    "",
+    "Automated checks cannot judge these WCAG 2.2 criteria; no run shows conformance.",
+    "",
+    ...MANUAL_REVIEW.map((m) => `- ${md(m)}`),
+    ""
+  );
   return lines.join("\n");
 }
 function renderSarif(run) {
@@ -44203,13 +45215,13 @@ function renderSarif(run) {
 
 // src/report/index.ts
 function writeReports(dir, run, cmp, opts = {}) {
-  const html = join8(dir, "report.html");
-  const markdown = join8(dir, "report.md");
+  const html = join9(dir, "report.html");
+  const markdown = join9(dir, "report.md");
   writeFileSync4(html, renderHtml(run, cmp, opts.history));
   writeFileSync4(markdown, renderMarkdown(run, cmp));
   const out = { html, markdown };
   if (opts.sarif) {
-    out.sarif = join8(dir, "report.sarif");
+    out.sarif = join9(dir, "report.sarif");
     writeFileSync4(out.sarif, `${JSON.stringify(renderSarif(run), null, 2)}
 `);
   }
@@ -44367,8 +45379,11 @@ var audit = {
   --brand SLUG         Markilo brand to check design consistency against (default: master brand)
   --ignore-robots      Ignore robots.txt (only for sites you own or are authorized to test)
   --allow-private      Allow private-network hosts (10.x, 192.168.x, ...)
-  --no-forms           Do not submit forms (by default, forms on local hosts are submitted empty to test validation)
-  --allow-submit       Allow submitting forms on non-local hosts (authorized test environments only)
+  --no-forms           Skip the form validation probe
+                       (by default, on local hosts, an empty submission is simulated: nothing that sends data
+                       leaves the browser, so no database is written; server-side feedback is reported as untested)
+  --allow-submit       Really send empty submissions to test server-side validation, on local or other hosts
+                       (disposable/test environments you are authorized to use only; never to delete/payment URLs)
   --sarif              Also write report.sarif for code scanning
   --fail-on SEVERITY   Exit 1 if a defect at or above this severity exists (CI gate)`,
   run: (ctx) => auditCommand(ctx, audit.usage)
@@ -44390,11 +45405,11 @@ var conversion = {
 
 // src/cli/commands/bench.ts
 import { existsSync as existsSync7, readdirSync as readdirSync5, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "node:fs";
-import { join as join9, resolve as resolve6 } from "node:path";
+import { join as join10, resolve as resolve6 } from "node:path";
 init_errors();
-var matches = (f, e) => f.ruleId === e.rule && pathOf(f.url).split("?")[0].replace(/\/$/, "") === e.path.replace(/\/$/, "") && (!e.viewport || (f.viewport ?? "").split(", ").includes(e.viewport));
+var matches = (f, e) => f.ruleId === e.rule && (!e.kind || f.kind === e.kind) && pathOf(f.url).split("?")[0].replace(/\/$/, "") === e.path.replace(/\/$/, "") && (!e.viewport || (f.viewport ?? "").split(", ").includes(e.viewport));
 async function benchFixture(dir, wsRoot) {
-  const expected = JSON.parse(readFileSync6(join9(dir, "expected.json"), "utf8"));
+  const expected = JSON.parse(readFileSync6(join10(dir, "expected.json"), "utf8"));
   const server = await serveStatic(dir);
   const t0 = Date.now();
   try {
@@ -44409,6 +45424,7 @@ async function benchFixture(dir, wsRoot) {
       headed: false,
       respectRobots: true,
       allowPrivate: false,
+      allowSubmit: expected.audit?.allowSubmit === true,
       keyboard: true,
       throttle: false,
       timeoutMs: 3e4,
@@ -44464,12 +45480,12 @@ var bench = {
     const root = resolve6(ctx.positionals[0] ?? "fixtures/sites");
     if (!existsSync7(root)) throw new JouriloError("NOT_FOUND", `No fixtures at ${root}`);
     const only = str(ctx, "only");
-    const dirs = readdirSync5(root).filter((d) => existsSync7(join9(root, d, "expected.json"))).filter((d) => !only || d === only);
+    const dirs = readdirSync5(root).filter((d) => existsSync7(join10(root, d, "expected.json"))).filter((d) => !only || d === only);
     if (!dirs.length) throw new JouriloError("NOT_FOUND", `No fixtures with expected.json in ${root}`);
     const results = [];
     for (const d of dirs) {
       ctx.log(`bench: ${d}`);
-      results.push(await benchFixture(join9(root, d), join9(ctx.ws.root, "bench")));
+      results.push(await benchFixture(join10(root, d), join10(ctx.ws.root, "bench")));
     }
     const found = results.reduce((a, r) => a + r.found, 0);
     const expected = results.reduce((a, r) => a + r.expected, 0);
@@ -44519,13 +45535,230 @@ var bench = {
 };
 
 // src/cli/commands/discover.ts
-import { existsSync as existsSync9, statSync as statSync6, writeFileSync as writeFileSync6 } from "node:fs";
-import { join as join11, resolve as resolve7 } from "node:path";
+import { existsSync as existsSync10, statSync as statSync7, writeFileSync as writeFileSync6 } from "node:fs";
+import { join as join13, resolve as resolve7 } from "node:path";
 
 // src/discovery/repo.ts
 init_fs_safety();
+import { existsSync as existsSync9, readdirSync as readdirSync7, readFileSync as readFileSync8, statSync as statSync6 } from "node:fs";
+import { basename as basename3, dirname as dirname6, join as join12, relative as relative5 } from "node:path";
+
+// src/discovery/laravel.ts
+init_fs_safety();
 import { existsSync as existsSync8, readdirSync as readdirSync6, readFileSync as readFileSync7, statSync as statSync5 } from "node:fs";
-import { basename, dirname as dirname5, join as join10, relative as relative4 } from "node:path";
+import { basename as basename2, dirname as dirname5, join as join11, relative as relative4 } from "node:path";
+function read(file) {
+  try {
+    return statSync5(file).size > 4e5 ? "" : readFileSync7(file, "utf8");
+  } catch {
+    return "";
+  }
+}
+function stripComments(php) {
+  return php.replace(/\/\*[\s\S]*?\*\//g, (m) => m.replace(/[^\n]/g, " ")).replace(/(^|[^:'"\\])\/\/[^\n]*/g, (m, p) => p + " ".repeat(m.length - p.length));
+}
+function argValue(arg) {
+  const lit = arg.match(/^\s*(['"])(.*?)\1\s*$/);
+  if (lit) return lit[2];
+  const ternary = arg.match(/\?\s*(['"])(.*?)\1\s*:\s*(['"])(.*?)\3/);
+  if (ternary) return ternary[2] || ternary[4] || "";
+  return null;
+}
+function joinPath(prefix, path2) {
+  const p = `/${[prefix, path2].map((s) => s.replace(/^\/+|\/+$/g, "")).filter(Boolean).join("/")}`;
+  return p.replace(/\{(\w+)\??\}/g, ":$1");
+}
+var AUTH_MW = /^(auth(:[\w,]+)?|verified|password\.confirm|can:.+|[\w.]*\.auth|[\w.]*\bauthenticated)$/;
+function middlewares(chain) {
+  const out = [];
+  for (const m of chain.matchAll(/middleware\(\s*(\[[^\]]*\]|['"][^'"]+['"])/g))
+    for (const s of m[1].matchAll(/['"]([^'"]+)['"]/g)) out.push(s[1]);
+  return out;
+}
+function entryFiles(appRoot) {
+  const out = /* @__PURE__ */ new Set();
+  const add = (rel) => {
+    const abs = join11(appRoot, rel);
+    if (existsSync8(abs)) out.add(toPosix(relative4(appRoot, abs)));
+  };
+  add("routes/web.php");
+  for (const f of ["bootstrap/app.php", "app/Providers/RouteServiceProvider.php"]) {
+    const t = read(join11(appRoot, f));
+    for (const m of t.matchAll(/web\s*:\s*__DIR__\s*\.\s*['"]([^'"]+)['"]/g)) add(join11(dirname5(f), m[1]));
+    for (const m of t.matchAll(/base_path\(\s*['"](routes\/[^'"]+\.php)['"]\s*\)/g))
+      if (!/routes\/(api|console|channels)\.php$/.test(m[1])) add(m[1]);
+  }
+  return [...out];
+}
+function scanFile(appRoot, rel, inherited, routes, seen) {
+  if (seen.has(rel)) return;
+  seen.add(rel);
+  const text = stripComments(read(join11(appRoot, rel)));
+  if (!text) return;
+  const stack = [{ prefix: inherited.prefix, auth: inherited.auth, depth: -1 }];
+  let depth = 0;
+  let stmtStart = 0;
+  let pendingGroup = null;
+  const top = () => stack[stack.length - 1];
+  for (let i = 0; i < text.length; i++) {
+    const ch = text[i];
+    if (ch === "'" || ch === '"') {
+      const q = ch;
+      for (i++; i < text.length && text[i] !== q; i++) if (text[i] === "\\") i++;
+      continue;
+    }
+    if (ch === "{") {
+      depth++;
+      if (pendingGroup) {
+        stack.push({ ...pendingGroup, depth });
+        pendingGroup = null;
+      }
+      stmtStart = i + 1;
+      continue;
+    }
+    if (ch === "}") {
+      if (top().depth === depth && stack.length > 1) stack.pop();
+      depth--;
+      stmtStart = i + 1;
+      continue;
+    }
+    if (ch === ";") {
+      const stmt = text.slice(stmtStart, i);
+      stmtStart = i + 1;
+      handleStatement(stmt);
+      continue;
+    }
+    if (text.startsWith("group(", i) && /->|::/.test(text.slice(Math.max(0, i - 2), i))) {
+      const chain = text.slice(stmtStart, i);
+      const rest = text.slice(i, i + 200);
+      const included = rest.match(
+        /^group\(\s*(?:__DIR__\s*\.\s*['"]([^'"]+)['"]|base_path\(\s*['"]([^'"]+)['"]\s*\))/
+      );
+      const g = groupOf(chain);
+      if (included) {
+        const target = included[1] ? join11(dirname5(rel), included[1]) : included[2];
+        scanFile(appRoot, toPosix(target), g, routes, seen);
+      } else if (/^group\(\s*(?:static\s+)?function/.test(rest)) pendingGroup = g;
+    }
+  }
+  function groupOf(chain) {
+    const pre = chain.match(/prefix\(([^)]*\)?)\)/);
+    const value = pre ? argValue(pre[1]) : null;
+    const auth = middlewares(chain).filter((m) => AUTH_MW.test(m));
+    return {
+      prefix: joinPath(top().prefix, value ?? "").replace(/^\/$/, ""),
+      auth: [...top().auth, ...auth]
+    };
+  }
+  function handleStatement(stmt) {
+    const req = stmt.match(/^\s*(?:require|include)(?:_once)?\s*\(?\s*__DIR__\s*\.\s*['"]([^'"]+\.php)['"]/);
+    if (req) {
+      scanFile(appRoot, toPosix(join11(dirname5(rel), req[1])), top(), routes, seen);
+      return;
+    }
+    const m = stmt.match(
+      /\b(?:Route|Volt)::(get|view|any|match|livewire|inertia|redirect|permanentRedirect|route)\(\s*(?:\[[^\]]*\]\s*,\s*)?(['"])([^'"]*)\2/
+    );
+    if (!m) return;
+    const verb = m[1];
+    if (verb === "match" && !/['"]get['"]/i.test(stmt)) return;
+    const via = verb === "livewire" ? "Livewire" : verb === "route" && /Volt::/.test(stmt) ? "Volt" : verb === "inertia" ? "Inertia" : verb === "redirect" || verb === "permanentRedirect" ? "redirect" : "Laravel";
+    if (via === "redirect") return;
+    const path2 = joinPath(top().prefix, m[3]);
+    const own = middlewares(stmt).filter((x) => AUTH_MW.test(x));
+    routes.push({ path: path2, file: rel, via, dynamic: /[:{]/.test(path2), auth: [...top().auth, ...own] });
+  }
+}
+function kebab(name) {
+  return name.replace(/([a-z0-9])([A-Z])/g, "$1-$2").replace(/([A-Z])([A-Z][a-z])/g, "$1-$2").toLowerCase();
+}
+function plural(word) {
+  if (/(s|x|z|ch|sh)$/.test(word)) return `${word}es`;
+  if (/[^aeiou]y$/.test(word)) return `${word.slice(0, -1)}ies`;
+  return `${word}s`;
+}
+function phpFiles(dir, depth) {
+  if (!existsSync8(dir)) return [];
+  const out = [];
+  for (const e of readdirSync6(dir, { withFileTypes: true })) {
+    const full = join11(dir, e.name);
+    if (e.isDirectory() && depth > 1) out.push(...phpFiles(full, depth - 1));
+    else if (e.isFile() && e.name.endsWith(".php")) out.push(full);
+  }
+  return out.sort();
+}
+function filamentPanels(appRoot, routes) {
+  const dir = join11(appRoot, "app/Providers/Filament");
+  const files = existsSync8(dir) ? readdirSync6(dir).filter((f) => f.endsWith("PanelProvider.php")) : [];
+  const panels = [];
+  for (const f of files) {
+    const rel = `app/Providers/Filament/${f}`;
+    const t = stripComments(read(join11(appRoot, rel)));
+    const id = t.match(/->id\(\s*['"]([^'"]+)['"]/)?.[1] ?? kebab(f.replace(/PanelProvider\.php$/, ""));
+    const pathArg = t.match(/->path\(([^)]*\)?)\)/)?.[1];
+    const path2 = joinPath("", (pathArg !== void 0 ? argValue(pathArg) : null) ?? id);
+    const login = /->login\(/.test(t);
+    panels.push({ id, path: path2, login, file: rel });
+    const auth = ["filament"];
+    routes.push({ path: path2, file: rel, via: "Filament", dynamic: false, auth });
+    if (login)
+      routes.push({ path: joinPath(path2, "login"), file: rel, via: "Filament", dynamic: false, auth: [] });
+    for (const [sub, isResource] of [
+      ["app/Filament/Resources", true],
+      ["app/Filament/Pages", false]
+    ]) {
+      for (const file of phpFiles(join11(appRoot, sub), 2)) {
+        const name = basename2(file, ".php");
+        if (isResource ? !name.endsWith("Resource") : name === "Dashboard") continue;
+        const relFile = toPosix(join11(sub, relative4(join11(appRoot, sub), file)));
+        if (!isResource && /\/(Concerns|Widgets)\//.test(relFile)) continue;
+        const own = read(file).match(/static\s+(?:\?string\s+)?\$slug\s*=\s*['"]([^'"]+)['"]/)?.[1];
+        const slug2 = own ?? (isResource ? plural(kebab(name.replace(/Resource$/, ""))) : kebab(name));
+        routes.push({ path: joinPath(path2, slug2), file: relFile, via: "Filament", dynamic: false, auth });
+      }
+    }
+  }
+  return panels;
+}
+function topLevelKeys(php, name) {
+  const start = php.search(new RegExp(`['"]${name}['"]\\s*=>\\s*\\[`));
+  if (start < 0) return [];
+  const open = php.indexOf("[", start);
+  const keys = [];
+  let depth = 0;
+  for (let i = open; i < php.length; i++) {
+    const ch = php[i];
+    if (ch === "'" || ch === '"') {
+      let j = i + 1;
+      while (j < php.length && php[j] !== ch) j += php[j] === "\\" ? 2 : 1;
+      if (depth === 1 && /^\s*=>/.test(php.slice(j + 1, j + 8))) keys.push(php.slice(i + 1, j));
+      i = j;
+      continue;
+    }
+    if (ch === "[") depth++;
+    else if (ch === "]" && --depth === 0) break;
+  }
+  return keys;
+}
+function laravelProfile(appRoot) {
+  const routes = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const f of entryFiles(appRoot)) scanFile(appRoot, f, { prefix: "", auth: [] }, routes, seen);
+  const routesDir = join11(appRoot, "routes");
+  if (existsSync8(routesDir)) {
+    for (const f of readdirSync6(routesDir))
+      if (f.endsWith(".php") && !/^(api|console|channels)\.php$/.test(f))
+        scanFile(appRoot, `routes/${f}`, { prefix: "", auth: [] }, routes, seen);
+  }
+  const panels = filamentPanels(appRoot, routes);
+  const authConfig = stripComments(read(join11(appRoot, "config/auth.php")));
+  const guards = topLevelKeys(authConfig, "guards");
+  const unique = /* @__PURE__ */ new Map();
+  for (const r of routes) if (!unique.has(r.path)) unique.set(r.path, r);
+  return { routes: [...unique.values()], guards, panels };
+}
+
+// src/discovery/repo.ts
 var SKIP = /* @__PURE__ */ new Set([
   "node_modules",
   ".git",
@@ -44550,21 +45783,21 @@ function walk(root, max = 2e4) {
     if (out.length >= max || depth > 14) return;
     let entries;
     try {
-      entries = readdirSync6(dir);
+      entries = readdirSync7(dir);
     } catch {
       return;
     }
     for (const n of entries) {
       if (SKIP.has(n) || n.startsWith(".") && n !== ".github") continue;
-      const full = join10(dir, n);
+      const full = join12(dir, n);
       let st;
       try {
-        st = statSync5(full);
+        st = statSync6(full);
       } catch {
         continue;
       }
       if (st.isDirectory()) rec(full, depth + 1);
-      else out.push(toPosix(relative4(root, full)));
+      else out.push(toPosix(relative5(root, full)));
     }
   };
   rec(root, 0);
@@ -44572,16 +45805,16 @@ function walk(root, max = 2e4) {
 }
 function readJson2(file) {
   try {
-    return JSON.parse(readFileSync7(file, "utf8"));
+    return JSON.parse(readFileSync8(file, "utf8"));
   } catch {
     return null;
   }
 }
-function read(file, max = 4e5) {
+function read2(file, max = 4e5) {
   try {
-    const st = statSync5(file);
+    const st = statSync6(file);
     if (st.size > max) return "";
-    return readFileSync7(file, "utf8");
+    return readFileSync8(file, "utf8");
   } catch {
     return "";
   }
@@ -44689,7 +45922,7 @@ function fileRoutes(appRoot, files, frameworks) {
     [
       "Next.js",
       /^(?:src\/)?pages\/(.+)\.(tsx|jsx|ts|js|mdx|md)$/,
-      (m) => /^_(app|document|error)/.test(basename(m[1])) ? null : { segs: m[1].split("/"), kind: m[1].startsWith("api/") ? "api" : "page" }
+      (m) => /^_(app|document|error)/.test(basename3(m[1])) ? null : { segs: m[1].split("/"), kind: m[1].startsWith("api/") ? "api" : "page" }
     ],
     ["Nuxt", /^(?:app\/)?pages\/(.+)\.vue$/, (m) => ({ segs: m[1].split("/"), kind: "page" })],
     [
@@ -44737,7 +45970,6 @@ function fileRoutes(appRoot, files, frameworks) {
   const codeRoute = [
     [/\.(t|j)sx?$/, /<Route\s[^>]*path=["'`]([^"'`]+)["'`]/g, "React Router"],
     [/\.(t|j)sx?$|\.vue$/, /\bpath:\s*["'`](\/[^"'`]*)["'`]/g, "Router config"],
-    [/routes\/web\.php$/, /Route::(?:get|view|match|any)\(\s*['"]([^'"]+)['"]/g, "Laravel"],
     [
       /\.dart$/,
       /GoRoute\(\s*(?:name:\s*['"][^'"]*['"]\s*,\s*)?path:\s*['"]([^'"]+)['"]/g,
@@ -44748,7 +45980,7 @@ function fileRoutes(appRoot, files, frameworks) {
   for (const f of files) {
     for (const [fileRe, re, label] of codeRoute) {
       if (!fileRe.test(f)) continue;
-      const text = read(join10(appRoot, f));
+      const text = read2(join12(appRoot, f));
       if (!text) continue;
       for (const m of text.matchAll(re)) {
         const raw = m[1].trim();
@@ -44759,6 +45991,9 @@ function fileRoutes(appRoot, files, frameworks) {
       }
     }
   }
+  if (has("Laravel"))
+    for (const r of laravelProfile(appRoot).routes)
+      add(r.path, r.file, "page", r.via === "Laravel" ? "Laravel" : `Laravel (${r.via})`, r.dynamic);
   return routes.sort((a, b) => a.path.localeCompare(b.path));
 }
 function devCommand(appRoot, pkg, frameworks, rel) {
@@ -44780,7 +46015,7 @@ function devCommand(appRoot, pkg, frameworks, rel) {
   };
   const def = frameworks.map((f) => defaults[f]).find(Boolean) ?? null;
   if (script) {
-    const lock = existsSync8(join10(appRoot, "pnpm-lock.yaml")) ? "pnpm" : existsSync8(join10(appRoot, "yarn.lock")) ? "yarn" : existsSync8(join10(appRoot, "bun.lockb")) || existsSync8(join10(appRoot, "bun.lock")) ? "bun" : "npm";
+    const lock = existsSync9(join12(appRoot, "pnpm-lock.yaml")) ? "pnpm" : existsSync9(join12(appRoot, "yarn.lock")) ? "yarn" : existsSync9(join12(appRoot, "bun.lockb")) || existsSync9(join12(appRoot, "bun.lock")) ? "bun" : "npm";
     return {
       command: lock,
       args: ["run", script],
@@ -44788,9 +46023,9 @@ function devCommand(appRoot, pkg, frameworks, rel) {
       source: `${rel || "."}/package.json`
     };
   }
-  if (existsSync8(join10(appRoot, "artisan")))
+  if (existsSync9(join12(appRoot, "artisan")))
     return { command: "php", args: ["artisan", "serve"], port: 8e3, source: `${rel || "."}/artisan` };
-  if (existsSync8(join10(appRoot, "pubspec.yaml")) && existsSync8(join10(appRoot, "web")))
+  if (existsSync9(join12(appRoot, "pubspec.yaml")) && existsSync9(join12(appRoot, "web")))
     return {
       command: "flutter",
       args: ["run", "-d", "web-server", "--web-port", "8080"],
@@ -44800,9 +46035,9 @@ function devCommand(appRoot, pkg, frameworks, rel) {
   return null;
 }
 function profileApp(repoRoot, appRoot, files) {
-  const rel = toPosix(relative4(repoRoot, appRoot));
-  const pkgFile = join10(appRoot, "package.json");
-  const pkg = existsSync8(pkgFile) ? readJson2(pkgFile) : null;
+  const rel = toPosix(relative5(repoRoot, appRoot));
+  const pkgFile = join12(appRoot, "package.json");
+  const pkg = existsSync9(pkgFile) ? readJson2(pkgFile) : null;
   const deps = {
     ...pkg?.dependencies ?? {},
     ...pkg?.devDependencies ?? {}
@@ -44813,14 +46048,14 @@ function profileApp(repoRoot, appRoot, files) {
       if (s.group === "framework" && s.dep.test(d) && !frameworks.some((f) => f.value === s.label))
         frameworks.push(fact(s.label, `${rel || "."}/package.json`));
   }
-  const composer = existsSync8(join10(appRoot, "composer.json")) ? readJson2(join10(appRoot, "composer.json")) : null;
+  const composer = existsSync9(join12(appRoot, "composer.json")) ? readJson2(join12(appRoot, "composer.json")) : null;
   if (composer && JSON.stringify(composer.require ?? {}).includes("laravel/framework"))
     frameworks.push(fact("Laravel", `${rel || "."}/composer.json`));
-  const pubspec = read(join10(appRoot, "pubspec.yaml"));
+  const pubspec = read2(join12(appRoot, "pubspec.yaml"));
   if (/\bflutter:\s*\n\s+sdk:\s*flutter/.test(pubspec))
     frameworks.push(
       fact(
-        existsSync8(join10(appRoot, "web")) ? "Flutter (web enabled)" : "Flutter",
+        existsSync9(join12(appRoot, "web")) ? "Flutter (web enabled)" : "Flutter",
         `${rel || "."}/pubspec.yaml`
       )
     );
@@ -44836,48 +46071,49 @@ function profileApp(repoRoot, appRoot, files) {
   );
   return {
     root: rel || ".",
-    name: pkg?.name ?? basename(appRoot),
+    name: pkg?.name ?? basename3(appRoot),
     frameworks,
     routes,
     devCommand: devCommand(appRoot, pkg, names, rel),
     components: {
       count: componentFiles.length,
-      dirs: [...new Set(componentFiles.map((f) => dirname5(f)))].slice(0, 12)
+      dirs: [...new Set(componentFiles.map((f) => dirname6(f)))].slice(0, 12)
     }
   };
 }
 function discoverRepository(root) {
   const files = walk(root);
   const gaps = [];
-  const rootPkg = existsSync8(join10(root, "package.json")) ? readJson2(join10(root, "package.json")) : null;
+  const rootPkg = existsSync9(join12(root, "package.json")) ? readJson2(join12(root, "package.json")) : null;
   let monorepo = null;
   const appRoots = [];
   const ws = rootPkg?.workspaces;
   const wsGlobs = Array.isArray(ws) ? ws : Array.isArray(ws?.packages) ? ws.packages : [];
-  const pnpm = read(join10(root, "pnpm-workspace.yaml"));
+  const pnpm = read2(join12(root, "pnpm-workspace.yaml"));
   for (const m of pnpm.matchAll(/^\s*-\s*['"]?([^'"\n]+)['"]?\s*$/gm)) wsGlobs.push(m[1]);
   if (wsGlobs.length)
     monorepo = fact(
       `workspaces: ${wsGlobs.join(", ")}`,
-      existsSync8(join10(root, "pnpm-workspace.yaml")) ? "pnpm-workspace.yaml" : "package.json"
+      existsSync9(join12(root, "pnpm-workspace.yaml")) ? "pnpm-workspace.yaml" : "package.json"
     );
   for (const g of wsGlobs) {
     const base2 = g.replace(/\/\*\*?$/, "");
     if (g.endsWith("*")) {
-      const dir = join10(root, base2);
-      if (!existsSync8(dir)) continue;
-      for (const n of readdirSync6(dir))
-        if (existsSync8(join10(dir, n, "package.json"))) appRoots.push(join10(dir, n));
-    } else if (existsSync8(join10(root, base2, "package.json"))) appRoots.push(join10(root, base2));
+      const dir = join12(root, base2);
+      if (!existsSync9(dir)) continue;
+      for (const n of readdirSync7(dir))
+        if (existsSync9(join12(dir, n, "package.json"))) appRoots.push(join12(dir, n));
+    } else if (existsSync9(join12(root, base2, "package.json"))) appRoots.push(join12(root, base2));
   }
   const apps = (appRoots.length ? appRoots : [root]).map((r) => profileApp(root, r, files)).filter(
     (a, _, all) => all.length === 1 || a.routes.length > 0 || a.frameworks.some((f) => !["React", "Vue", "Svelte", "Vite"].includes(f.value))
   );
   if (!apps.length) apps.push(profileApp(root, root, files));
+  const laravelRoles = [];
   const allPkgs = files.filter((f) => f.endsWith("package.json")).slice(0, 60);
   const signals = /* @__PURE__ */ new Map();
   for (const p of allPkgs) {
-    const j = readJson2(join10(root, p));
+    const j = readJson2(join12(root, p));
     const deps = Object.keys({
       ...j?.dependencies ?? {},
       ...j?.devDependencies ?? {}
@@ -44890,11 +46126,31 @@ function discoverRepository(root) {
         signals.set(s.group, list2);
       }
   }
-  const composer = existsSync8(join10(root, "composer.json")) ? JSON.stringify(readJson2(join10(root, "composer.json"))?.require ?? {}) : "";
+  const composer = existsSync9(join12(root, "composer.json")) ? JSON.stringify(readJson2(join12(root, "composer.json"))?.require ?? {}) : "";
   if (/laravel\/(breeze|fortify|jetstream|sanctum)/.test(composer))
     (signals.get("auth") ?? signals.set("auth", []).get("auth")).push(
       fact(composer.match(/laravel\/(breeze|fortify|jetstream|sanctum)/)[0], "composer.json")
     );
+  for (const app of apps.filter((a) => a.frameworks.some((f) => f.value === "Laravel"))) {
+    const lp = laravelProfile(join12(root, app.root));
+    const at = (f) => app.root === "." ? f : `${app.root}/${f}`;
+    const authList = signals.get("auth") ?? signals.set("auth", []).get("auth");
+    if (lp.guards.length)
+      authList.push(fact(`Laravel guards: ${lp.guards.join(", ")}`, at("config/auth.php")));
+    for (const p of lp.panels.filter((x) => x.login))
+      authList.push(fact(`Filament panel "${p.id}" with login at ${p.path}/login`, at(p.file)));
+    const protectedRoutes = lp.routes.filter((r) => r.auth.length && r.via !== "Filament");
+    if (protectedRoutes.length)
+      authList.push(
+        fact(
+          `${protectedRoutes.length} route(s) behind ${[...new Set(protectedRoutes.flatMap((r) => r.auth))].join(", ")}`,
+          at(protectedRoutes[0].file)
+        )
+      );
+    for (const g of lp.guards.filter((x) => !["web", "api", "sanctum"].includes(x)))
+      laravelRoles.push(fact(g, at("config/auth.php")));
+    for (const p of lp.panels) laravelRoles.push(fact(`${p.id} panel user`, at(p.file)));
+  }
   if (/laravel\/cashier/.test(composer))
     (signals.get("payments") ?? signals.set("payments", []).get("payments")).push(
       fact("laravel/cashier", "composer.json")
@@ -44904,9 +46160,9 @@ function discoverRepository(root) {
   let cssVariables = 0;
   for (const f of files) {
     if (/(^|\/)(tokens?|design-tokens|theme)\.(json|ts|js|css)$/i.test(f) || /\.tokens\.json$/.test(f))
-      tokens.push(fact(basename(f), f));
+      tokens.push(fact(basename3(f), f));
     if (/\.(css|scss)$/.test(f)) {
-      const t = read(join10(root, f), 3e5);
+      const t = read2(join12(root, f), 3e5);
       cssVariables += (t.match(/--[a-z0-9-]+\s*:/gi) ?? []).length;
       for (const m of t.matchAll(/font-family\s*:\s*["']?([A-Za-z][\w -]+?)["']?\s*[,;]/g)) {
         const name = m[1].trim();
@@ -44915,7 +46171,7 @@ function discoverRepository(root) {
       }
     }
     if (/\.(tsx|jsx|ts|js)$/.test(f) && /layout|_app|_document/.test(f)) {
-      const t = read(join10(root, f));
+      const t = read2(join12(root, f));
       for (const m of t.matchAll(/import\s*\{\s*([A-Z][\w,\s]+)\}\s*from\s*['"]next\/font\/google['"]/g))
         for (const n of m[1].split(",").map((s) => s.trim()).filter(Boolean))
           if (!fonts.some((x) => x.value === n)) fonts.push(fact(n.replace(/_/g, " "), f));
@@ -44939,8 +46195,9 @@ function discoverRepository(root) {
       fact("signed-in user", allRoutes.find((r) => r.role === "dashboard" || r.role === "settings").file)
     );
   roles.unshift(fact("visitor", "public routes"));
+  for (const r of laravelRoles) if (!roles.some((x) => x.value === r.value)) roles.push(r);
   for (const f of files.filter((x) => /\.(ts|tsx|js|php|dart|rb|py)$/.test(x)).slice(0, 3e3)) {
-    const t = read(join10(root, f), 12e4);
+    const t = read2(join12(root, f), 12e4);
     for (const m of t.matchAll(
       /\brole\s*(?:===?|==|:)\s*['"](owner|admin|editor|viewer|member|manager|customer|seller|vendor|teacher|student)['"]/gi
     )) {
@@ -44953,11 +46210,12 @@ function discoverRepository(root) {
   const cj = (name, rs, why) => {
     if (rs.length) candidateJourneys.push({ name, routes: [...new Set(rs)].slice(0, 6), why });
   };
-  cj(
-    "Sign up and reach the product",
-    [...byRole("signup"), ...byRole("dashboard")],
-    "signup and dashboard routes exist"
-  );
+  if (byRole("signup").length)
+    cj(
+      "Sign up and reach the product",
+      [...byRole("signup"), ...byRole("dashboard")],
+      byRole("dashboard").length ? "signup and dashboard routes exist" : "signup route exists"
+    );
   cj("Sign in", byRole("login"), "login route exists");
   cj("Recover access", byRole("recovery"), "password recovery route exists");
   cj(
@@ -44972,7 +46230,7 @@ function discoverRepository(root) {
   let readmeSummary = null;
   const readmeFile = files.find((f) => /^readme\.md$/i.test(f));
   if (readmeFile) {
-    const para = read(join10(root, readmeFile)).split(/\n\s*\n/).map((p) => p.replace(/<[^>]+>|!\[[^\]]*\]\([^)]*\)|\[!\[[^\]]*\]\([^)]*\)\]\([^)]*\)/g, "").trim()).find((p) => p.length > 60 && !p.startsWith("#") && !p.startsWith("```") && !p.startsWith("|"));
+    const para = read2(join12(root, readmeFile)).split(/\n\s*\n/).map((p) => p.replace(/<[^>]+>|!\[[^\]]*\]\([^)]*\)|\[!\[[^\]]*\]\([^)]*\)\]\([^)]*\)/g, "").trim()).find((p) => p.length > 60 && !p.startsWith("#") && !p.startsWith("```") && !p.startsWith("|"));
     if (para) readmeSummary = fact(para.replace(/\s+/g, " ").slice(0, 400), readmeFile);
   }
   const description = typeof rootPkg?.description === "string" ? fact(rootPkg.description, "package.json") : null;
@@ -44996,7 +46254,7 @@ function discoverRepository(root) {
     schemaVersion: 1,
     kind: "repository",
     root,
-    name: rootPkg?.name ?? basename(root),
+    name: rootPkg?.name ?? basename3(root),
     description,
     readmeSummary,
     monorepo,
@@ -45169,9 +46427,9 @@ var discover = {
   async run(ctx) {
     const target = requirePositional(ctx, 0, "path|url", discover.usage);
     ctx.ws.ensure();
-    if (!target.includes("://") && existsSync9(target) && statSync6(target).isDirectory()) {
+    if (!target.includes("://") && existsSync10(target) && statSync7(target).isDirectory()) {
       const profile2 = discoverRepository(resolve7(target));
-      const file2 = join11(ctx.ws.root, "product.json");
+      const file2 = join13(ctx.ws.root, "product.json");
       writeFileSync6(file2, `${JSON.stringify(profile2, null, 2)}
 `);
       return { data: { file: file2, profile: profile2 }, text: `${repoText(profile2)}
@@ -45196,7 +46454,7 @@ var discover = {
       onProgress: ctx.log
     });
     const profile = buildSiteProfile(run, observations);
-    const file = join11(ctx.ws.root, "site.json");
+    const file = join13(ctx.ws.root, "site.json");
     writeFileSync6(file, `${JSON.stringify(profile, null, 2)}
 `);
     return { data: { file, profile }, text: `${siteText(profile)}
@@ -45207,8 +46465,8 @@ var discover = {
 
 // src/cli/commands/experiment.ts
 init_errors();
-import { existsSync as existsSync10, mkdirSync as mkdirSync4, readFileSync as readFileSync8, writeFileSync as writeFileSync7 } from "node:fs";
-import { join as join12 } from "node:path";
+import { existsSync as existsSync11, mkdirSync as mkdirSync4, readFileSync as readFileSync9, writeFileSync as writeFileSync7 } from "node:fs";
+import { join as join14 } from "node:path";
 
 // src/experiment/stats.ts
 function normCdf(z) {
@@ -45630,19 +46888,19 @@ Jourilo never invents traffic, conversions or effects: every number comes from y
       if (!f) throw new JouriloError("NOT_FOUND", `Finding ${fp} is not in run ${run.id}.`);
       if (f.kind !== "hypothesis")
         ctx.log(`Note: ${f.ruleId} is a ${f.kind}; defects should usually be fixed, not A/B tested.`);
-      const productFile = join12(ctx.ws.root, "product.json");
-      const product = existsSync10(productFile) ? JSON.parse(readFileSync8(productFile, "utf8")) : null;
+      const productFile = join14(ctx.ws.root, "product.json");
+      const product = existsSync11(productFile) ? JSON.parse(readFileSync9(productFile, "utf8")) : null;
       const plan = planExperiment(run.id, f, {
         ...numOpt(ctx, "baseline") !== void 0 ? { baseline: numOpt(ctx, "baseline") } : {},
         ...numOpt(ctx, "mde") !== void 0 ? { mde: numOpt(ctx, "mde") } : {},
         ...numOpt(ctx, "daily-traffic") !== void 0 ? { dailyTraffic: numOpt(ctx, "daily-traffic") } : {},
         product
       });
-      const outDir = join12(ctx.ws.root, "experiments");
+      const outDir = join14(ctx.ws.root, "experiments");
       mkdirSync4(outDir, { recursive: true });
-      const md2 = join12(outDir, `${plan.id}.md`);
+      const md2 = join14(outDir, `${plan.id}.md`);
       writeFileSync7(md2, planMarkdown(plan));
-      writeFileSync7(join12(outDir, `${plan.id}.json`), `${JSON.stringify(plan, null, 2)}
+      writeFileSync7(join14(outDir, `${plan.id}.json`), `${JSON.stringify(plan, null, 2)}
 `);
       return { data: { plan, file: md2 }, text: `${planMarkdown(plan)}
 Saved: ${md2}` };
@@ -45665,8 +46923,8 @@ Saved: ${md2}` };
 };
 
 // src/cli/commands/finding.ts
-import { existsSync as existsSync11 } from "node:fs";
-import { join as join13 } from "node:path";
+import { existsSync as existsSync12 } from "node:fs";
+import { join as join15 } from "node:path";
 init_errors();
 init_fs_safety();
 var CATEGORIES = [
@@ -45724,7 +46982,7 @@ var finding = {
         "At least one --evidence file from the run (e.g. screenshots/home-\u2026-desktop.jpg) is required: judgments must point at what they judge."
       );
     for (const e of evidenceFiles)
-      if (!existsSync11(resolveInside(dir, e)))
+      if (!existsSync12(resolveInside(dir, e)))
         throw new JouriloError("NOT_FOUND", `Evidence ${e} is not in run ${run.id}.`);
     const url = str(ctx, "url") ?? run.pages[0]?.url ?? run.target;
     const f = makeFinding({
@@ -45761,20 +47019,20 @@ var finding = {
     writeReports(dir, run, void 0, { history: ctx.ws.listRuns() });
     return {
       data: f,
-      text: `Added ${f.provenance} finding ${f.fingerprint} to run ${run.id} (${join13(dir, "report.html")}).`
+      text: `Added ${f.provenance} finding ${f.fingerprint} to run ${run.id} (${join15(dir, "report.html")}).`
     };
   }
 };
 
 // src/cli/commands/journeys.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync5, readdirSync as readdirSync7, readFileSync as readFileSync9, writeFileSync as writeFileSync8 } from "node:fs";
-import { basename as basename2, join as join15, resolve as resolve8 } from "node:path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync7, readdirSync as readdirSync10, readFileSync as readFileSync12, writeFileSync as writeFileSync9 } from "node:fs";
+import { basename as basename5, join as join19, resolve as resolve8 } from "node:path";
 init_errors();
 init_fs_safety();
 init_types();
 
 // src/journeys/runner.ts
-import { join as join14 } from "node:path";
+import { join as join16 } from "node:path";
 init_fs_safety();
 
 // src/journeys/schema.ts
@@ -45887,15 +47145,61 @@ function locatorFor(page, t) {
   return page.locator(t.css);
 }
 var ELEMENT_FACTS = `(el) => {
-  const form = el.form || el.closest('form');
-  const tag = el.tagName;
-  const type = (el.getAttribute('type') || '').toLowerCase();
+  if (!el || el === document.body || el === document.documentElement) return null;
+  const act = el.closest('a[href],button,input,select,textarea,summary,[role=button],[role=link],[role=menuitem],[role=tab],[role=option],[role=checkbox],[role=switch]') || el;
+  const form = act.form || act.closest('form');
+  const tag = act.tagName;
+  const type = (act.getAttribute('type') || '').toLowerCase();
+  const role = (act.getAttribute('role') || '').toLowerCase();
   const submits = !!form && ((tag === 'BUTTON' && (type === '' || type === 'submit')) || (tag === 'INPUT' && (type === 'submit' || type === 'image')));
-  const inField = !!form && (tag === 'INPUT' || tag === 'SELECT');
-  const payment = !!form && !!form.querySelector('input[autocomplete^="cc-"], input[name*="card" i], input[name*="cvc" i], input[name*="cvv" i]');
-  const name = (el.getAttribute('aria-label') || el.innerText || el.value || el.getAttribute('title') || '').replace(/\\s+/g, ' ').trim().slice(0, 120);
-  return { submits, inField, payment, name };
+  const inField = !!form && ((tag === 'INPUT' && !['button','submit','reset','checkbox','radio','image','file','range','color'].includes(type)) || tag === 'SELECT');
+  const textarea = tag === 'TEXTAREA' || act.isContentEditable;
+  const buttonLike = tag === 'BUTTON' || tag === 'SUMMARY' || (tag === 'INPUT' && ['button','submit','reset','image'].includes(type)) || ['button','menuitem','tab','option','switch','checkbox'].includes(role);
+  const linkLike = (tag === 'A' && act.hasAttribute('href')) || role === 'link';
+  const payment = !!form && !!form.querySelector('input[autocomplete^="cc-"], input[name*="card" i], input[name*="cvc" i], input[name*="cvv" i], input[data-stripe], iframe[src*="stripe"], iframe[name*="card" i], iframe[title*="card" i]');
+  const byIds = (attr) => (act.getAttribute(attr) || '').split(/\\s+/).map((id) => id && document.getElementById(id)).filter(Boolean).map((n) => n.innerText || n.textContent || '').join(' ');
+  const inner = Array.from(act.querySelectorAll('img[alt], [aria-label], svg title')).map((n) => n.getAttribute('alt') || n.getAttribute('aria-label') || n.textContent || '').join(' ');
+  const name = (act.getAttribute('aria-label') || byIds('aria-labelledby') || act.innerText || act.value || act.getAttribute('title') || act.getAttribute('alt') || inner || '').replace(/\\s+/g, ' ').trim().slice(0, 120);
+  const attrs = [];
+  for (const n of [act, ...Array.from(act.querySelectorAll('*')).slice(0, 20)])
+    for (const a of Array.from(n.attributes))
+      if (/^(id|class|name|title|data-[\\w-]+)$/.test(a.name) || ((a.name === 'href' || a.name === 'xlink:href') && n.tagName.toLowerCase() === 'use'))
+        attrs.push(a.value);
+  const targets = [];
+  if (linkLike && act.getAttribute('href')) targets.push(act.href || act.getAttribute('href'));
+  if (act.getAttribute('formaction')) targets.push(act.formAction || act.getAttribute('formaction'));
+  if (form && (submits || inField)) targets.push(form.getAttribute('action') || '');
+  return { submits, inField, textarea, buttonLike, linkLike, payment, name, signals: attrs.join(' ').slice(0, 1500), targets: targets.join(' ') };
 }`;
+function keyEffect(key, f) {
+  if (!f) return "none";
+  const k = key.split("+").pop();
+  const mods = key.includes("+");
+  const enter = k === "Enter" || k === "NumpadEnter";
+  const space = k === " " || k === "Space";
+  if (enter) {
+    if (f.textarea) return mods ? "submit" : "none";
+    if (f.inField) return "submit";
+    if (f.buttonLike || f.linkLike) return f.submits ? "submit" : "activate";
+    return "activate";
+  }
+  if (space && f.buttonLike) return f.submits ? "submit" : "activate";
+  return "none";
+}
+function verdictFor(f, effect, action, policy) {
+  const submitsForm = effect === "submit" || f.submits;
+  return checkAction(
+    {
+      action,
+      name: f.name,
+      signals: f.signals,
+      targets: f.targets,
+      submitsForm,
+      paymentForm: f.payment && submitsForm
+    },
+    policy
+  );
+}
 var facts = (src) => new Function(`return (${src})(arguments[0])`);
 function matchesUrl(actual, expected) {
   if (expected.startsWith("re:")) {
@@ -45925,34 +47229,31 @@ async function act(page, step, opts) {
   switch (step.action) {
     case "goto": {
       const url = new URL(value(step.url), opts.base);
-      if (url.origin !== opts.base.origin)
-        throw new Error(`goto ${url.origin} leaves the target origin ${opts.base.origin}`);
+      if (url.origin !== opts.base.origin && !(opts.allowOrigins ?? []).includes(url.origin))
+        throw new Blocked(`goto ${url.origin} leaves the target origin ${opts.base.origin}`);
       await page.goto(url.toString(), { waitUntil: "load", timeout: t * 3 });
       await page.waitForLoadState("networkidle", { timeout: 3e3 }).catch(() => void 0);
       return;
     }
     case "click":
     case "press": {
-      const loc = step.action === "click" ? locatorFor(page, step.target).first() : step.target ? locatorFor(page, step.target).first() : null;
+      const loc = step.target ? locatorFor(page, step.target).first() : null;
+      let handle = null;
       if (loc) {
         await loc.waitFor({ state: "visible", timeout: t });
-        const f = await loc.evaluate(facts(ELEMENT_FACTS));
-        const submitsForm = step.action === "click" ? f.submits : step.key === "Enter" && f.inField;
-        const verdict = checkAction(
-          {
-            action: step.action,
-            name: step.action === "click" ? f.name : "",
-            submitsForm,
-            paymentForm: f.payment && submitsForm
-          },
-          opts.policy
-        );
+        handle = await loc.elementHandle({ timeout: t });
+      } else {
+        handle = (await page.evaluateHandle("document.activeElement")).asElement();
+      }
+      const f = handle ? await handle.evaluate(facts(ELEMENT_FACTS)) : null;
+      const effect = step.action === "click" ? f?.submits ? "submit" : "activate" : keyEffect(step.key, f);
+      if (f && effect !== "none") {
+        const verdict = verdictFor(f, effect, step.action, opts.policy);
         if (!verdict.allowed) throw new Blocked(verdict.reason);
-        if (step.action === "click") await loc.click({ timeout: t });
-        else await loc.press(step.key, { timeout: t });
-      } else if (step.action === "press") {
-        await page.keyboard.press(step.key);
       }
+      if (step.action === "click") await handle.click({ timeout: t });
+      else if (loc && handle) await handle.press(step.key, { timeout: t });
+      else await page.keyboard.press(step.key);
       await page.waitForLoadState("networkidle", { timeout: 3e3 }).catch(() => void 0);
       return;
     }
@@ -46004,10 +47305,17 @@ async function runJourney(browser, spec, opts) {
     runDir: opts.runDir,
     ...opts.storageState ? { storageState: opts.storageState } : {}
   });
-  const tracePath = opts.trace ? join14("traces", `${spec.id}-${vp.name}.zip`) : void 0;
+  const tracePath = opts.trace ? join16("traces", `${spec.id}-${vp.name}.zip`) : void 0;
   if (tracePath) await ctx.tracing.start({ screenshots: true, snapshots: true, title: spec.name });
+  const guard = await installRequestGuard(ctx, {
+    ...opts.policy,
+    origin: opts.base.origin,
+    ...opts.allowOrigins ? { allowOrigins: opts.allowOrigins } : {},
+    mode: "journey"
+  });
   const page = await ctx.newPage();
   const live = observe(page, opts.base.origin);
+  live.ignore(guard.isBlocked);
   const steps = [];
   const findings = [];
   const t0 = Date.now();
@@ -46015,10 +47323,10 @@ async function runJourney(browser, spec, opts) {
   const startUrl = new URL(interpolate(spec.start, opts.data), opts.base);
   const allSteps = [{ action: "goto", url: startUrl.toString() }, ...spec.steps];
   const shot = async (i) => {
-    const file = join14("screenshots", `journey-${spec.id}-${vp.name}-${String(i).padStart(2, "0")}.jpg`);
+    const file = join16("screenshots", `journey-${spec.id}-${vp.name}-${String(i).padStart(2, "0")}.jpg`);
     try {
       await page.screenshot({
-        path: join14(opts.runDir, file),
+        path: join16(opts.runDir, file),
         type: "jpeg",
         quality: 70,
         animations: "disabled",
@@ -46057,6 +47365,14 @@ async function runJourney(browser, spec, opts) {
         res.status = err instanceof Blocked ? "blocked" : "failed";
         res.error = excerpt(err.message.split("\n")[0], 300);
       }
+      const stopped = guard.since(s0).filter((b) => b.navigation || b.kind !== "submit");
+      if (stopped.length && res.status !== "blocked") {
+        res.status = "blocked";
+        res.error = excerpt(
+          `${stopped[0].reason}${stopped.length > 1 ? ` (+${stopped.length - 1} more)` : ""}`,
+          300
+        );
+      }
       res.durationMs = Date.now() - s0;
       res.url = redactUrl(page.url());
       const s = await shot(i);
@@ -46115,7 +47431,7 @@ async function runJourney(browser, spec, opts) {
     const vitals = await page.evaluate(READ_VITALS_SCRIPT).catch(() => null);
     const durationMs = Date.now() - t0;
     if (tracePath) {
-      await ctx.tracing.stop({ path: join14(opts.runDir, tracePath) });
+      await ctx.tracing.stop({ path: join16(opts.runDir, tracePath) });
     }
     if (opts.saveAuth && status === "passed") {
       writeFileSafe(opts.saveAuth, JSON.stringify(await ctx.storageState(), null, 2), { private: true });
@@ -46128,8 +47444,10 @@ async function runJourney(browser, spec, opts) {
       steps,
       successCriteria: criteria,
       durationMs,
-      ...tracePath ? { trace: toPosix(tracePath) } : {}
+      ...tracePath ? { trace: toPosix(tracePath) } : {},
+      ...guard.blocked.length ? { blockedRequests: guard.blocked.map(({ method, url: url2, reason }) => ({ method, url: url2, reason })) } : {}
     };
+    const blockedNote = guard.blocked.length ? ` The safety policy stopped ${guard.blocked.length} request(s) during this journey (e.g. ${guard.blocked[0].method} ${guard.blocked[0].url}), which may be why.` : "";
     const reproduction = steps.filter((s) => s.status !== "skipped").map((s) => s.description);
     const failedStep = steps.find((s) => s.status === "failed");
     const blockedStep = steps.find((s) => s.status === "blocked");
@@ -46149,7 +47467,9 @@ async function runJourney(browser, spec, opts) {
           provenance: "observed",
           url,
           viewport: vp.name,
-          description: failedStep ? `Step ${failedStep.index + 1} (${failedStep.description}) failed: ${failedStep.error}` : `All steps ran, but ${unmet.length} success criterion/criteria were not met: ${unmet.map((c) => `${c.description}${c.detail ? ` (${c.detail})` : ""}`).join("; ")}.`,
+          description: `${failedStep ? `Step ${failedStep.index + 1} (${failedStep.description}) failed: ${failedStep.error}` : `All steps ran, but ${unmet.length} success criterion/criteria were not met: ${unmet.map((c) => `${c.description}${c.detail ? ` (${c.detail})` : ""}`).join("; ")}.`}${blockedNote}`,
+          // A goal missed because Jourilo itself stopped a request is not evidence that the site is broken.
+          ...blockedNote ? { confidence: "low" } : {},
           impact: spec.goal ? `People trying to ${spec.goal} cannot complete it.` : "People cannot complete this task.",
           recommendation: spec.source === "suggested" ? "Check whether the journey definition matches the intended flow (it was generated); if it does, fix the step that failed." : "Fix the step that failed, then rerun the journey.",
           standards: [nielsen(9)],
@@ -46402,33 +47722,382 @@ function suggestJourneys(run) {
   return out;
 }
 
+// src/repair/git.ts
+init_errors();
+init_fs_safety();
+import { spawnSync as spawnSync2 } from "node:child_process";
+import { existsSync as existsSync14, mkdirSync as mkdirSync6, readdirSync as readdirSync9, readFileSync as readFileSync11, writeFileSync as writeFileSync8 } from "node:fs";
+import { dirname as dirname8, join as join18 } from "node:path";
+
+// src/repair/transaction.ts
+init_errors();
+init_fs_safety();
+import { createHash as createHash2, randomBytes as randomBytes2 } from "node:crypto";
+import {
+  closeSync,
+  existsSync as existsSync13,
+  fsyncSync,
+  lstatSync,
+  mkdirSync as mkdirSync5,
+  openSync,
+  readdirSync as readdirSync8,
+  readFileSync as readFileSync10,
+  renameSync,
+  rmSync,
+  statSync as statSync8,
+  unlinkSync,
+  writeSync
+} from "node:fs";
+import { basename as basename4, dirname as dirname7, join as join17 } from "node:path";
+var sha256 = (b) => createHash2("sha256").update(b).digest("hex");
+var recordsDir = (wsRoot) => join17(wsRoot, "checkpoints");
+var txDir = (wsRoot, id) => join17(recordsDir(wsRoot), id);
+function atomicWrite(path2, data, mode) {
+  mkdirSync5(dirname7(path2), { recursive: true });
+  const tmp = join17(dirname7(path2), `.${basename4(path2)}.jourilo-${randomBytes2(4).toString("hex")}.tmp`);
+  const fd = openSync(tmp, "wx", mode ?? 420);
+  try {
+    let off = 0;
+    while (off < data.length) off += writeSync(fd, data, off, data.length - off);
+    fsyncSync(fd);
+  } finally {
+    closeSync(fd);
+  }
+  for (let attempt = 0; ; attempt++) {
+    try {
+      renameSync(tmp, path2);
+      return;
+    } catch (err) {
+      if (attempt >= 5 || !["EPERM", "EBUSY", "EACCES"].includes(err.code ?? "")) {
+        rmSync(tmp, { force: true });
+        throw err;
+      }
+      const until = Date.now() + 50 * (attempt + 1);
+      while (Date.now() < until) ;
+    }
+  }
+}
+function saveRecord(wsRoot, tx) {
+  mkdirSync5(recordsDir(wsRoot), { recursive: true });
+  atomicWrite(join17(recordsDir(wsRoot), `${tx.id}.json`), Buffer.from(`${JSON.stringify(tx, null, 2)}
+`));
+}
+function writablePath(root, file) {
+  const abs = resolveInside(root, file);
+  const lexical = join17(root, file);
+  if (existsSync13(lexical) && lstatSync(lexical).isSymbolicLink())
+    throw new JouriloError(
+      "UNSAFE_PATH",
+      `${file} is a symbolic link; Jourilo does not write through links. Make this change by hand.`
+    );
+  return abs;
+}
+function readOrNull(path2) {
+  return existsSync13(path2) ? readFileSync10(path2) : null;
+}
+function applyTransaction(root, wsRoot, edits, opts = {}) {
+  const pending = activeTransactions(wsRoot).filter((t) => t.state === "pending");
+  if (pending.length)
+    throw new JouriloError(
+      "INVALID_INPUT",
+      `An earlier change (${pending[0].id}) was interrupted before it finished.`,
+      `Run \`jourilo rollback ${pending[0].id} --yes\` to restore those files first.`
+    );
+  const names = edits.map((e) => e.file);
+  const dup = names.find((n, i) => names.indexOf(n) !== i);
+  if (dup) throw new JouriloError("INTERNAL", `${dup} appears twice in one change; combine its edits first.`);
+  const prepared = edits.map((e) => {
+    const abs = writablePath(root, e.file);
+    const current = readOrNull(abs);
+    const same = e.before === null ? current === null : current?.equals(e.before);
+    if (!same)
+      throw new JouriloError(
+        "INVALID_INPUT",
+        `${e.file} changed after the fix was planned; nothing was written.`,
+        "Run the command again so the plan is computed from the current file."
+      );
+    return { ...e, abs, mode: current ? statSync8(abs).mode & 511 : null };
+  });
+  const tx = {
+    kind: "fix-transaction",
+    id: newRunId(),
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    root,
+    note: opts.note ?? "",
+    ...opts.undoes ? { undoes: opts.undoes } : {},
+    state: "pending",
+    files: prepared.map((p) => ({
+      file: p.file,
+      beforeSha: p.before ? sha256(p.before) : null,
+      afterSha: p.after ? sha256(p.after) : null,
+      mode: p.mode,
+      state: "pending"
+    }))
+  };
+  for (const p of prepared)
+    if (p.before) atomicWrite(resolveInside(join17(txDir(wsRoot, tx.id), "before"), p.file), p.before);
+  saveRecord(wsRoot, tx);
+  try {
+    prepared.forEach((p, i) => {
+      opts.beforeWrite?.(p.file, i);
+      if (p.after) atomicWrite(p.abs, p.after, p.mode);
+      else if (existsSync13(p.abs)) unlinkSync(p.abs);
+      tx.files[i].state = "written";
+      saveRecord(wsRoot, tx);
+    });
+  } catch (err) {
+    const undo = rollbackTransaction(wsRoot, tx, { force: false });
+    tx.state = "failed";
+    saveRecord(wsRoot, tx);
+    const msg = err instanceof Error ? err.message : String(err);
+    throw new JouriloError(
+      "INTERNAL",
+      `Writing the changes failed (${msg}); ${undo.restored.length} file(s) already written were restored.${undo.conflicts.length ? ` Not restored: ${undo.conflicts.map((c) => c.file).join(", ")}.` : ""}`
+    );
+  }
+  tx.state = "applied";
+  saveRecord(wsRoot, tx);
+  return tx;
+}
+function rollbackTransaction(wsRoot, tx, opts = {}) {
+  const result = { restored: [], alreadyRestored: [], conflicts: [] };
+  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  for (const f of tx.files) {
+    if (opts.files?.length && !opts.files.includes(f.file)) continue;
+    if (f.state === "restored") {
+      result.alreadyRestored.push(f.file);
+      continue;
+    }
+    const abs = writablePath(tx.root, f.file);
+    const current = readOrNull(abs);
+    const currentSha = current ? sha256(current) : null;
+    if (currentSha === f.beforeSha) {
+      f.state = "restored";
+      delete f.conflict;
+      result.alreadyRestored.push(f.file);
+      continue;
+    }
+    if (currentSha !== f.afterSha) {
+      const reason = current === null ? "deleted after the change was applied" : "modified after the change was applied (not by Jourilo)";
+      if (!opts.force) {
+        f.state = "conflict";
+        f.conflict = reason;
+        result.conflicts.push({ file: f.file, reason });
+        continue;
+      }
+      let savedCopy;
+      if (current) {
+        savedCopy = resolveInside(join17(txDir(wsRoot, tx.id), "conflicts", stamp), f.file);
+        atomicWrite(savedCopy, current);
+      }
+      result.conflicts.push({ file: f.file, reason, ...savedCopy ? { savedCopy } : {} });
+    }
+    if (f.beforeSha === null) {
+      if (existsSync13(abs)) unlinkSync(abs);
+    } else {
+      const backup = resolveInside(join17(txDir(wsRoot, tx.id), "before"), f.file);
+      if (!existsSync13(backup)) {
+        f.state = "conflict";
+        f.conflict = "backup missing";
+        result.conflicts.push({ file: f.file, reason: "backup missing; cannot restore" });
+        continue;
+      }
+      const bytes = readFileSync10(backup);
+      if (sha256(bytes) !== f.beforeSha) {
+        result.conflicts.push({ file: f.file, reason: "backup does not match its recorded hash" });
+        continue;
+      }
+      atomicWrite(abs, bytes, f.mode);
+    }
+    f.state = "restored";
+    delete f.conflict;
+    result.restored.push(f.file);
+  }
+  const allBack = tx.files.every((f) => f.state === "restored");
+  if (tx.state !== "pending" || allBack) tx.state = allBack ? "rolled-back" : "partially-rolled-back";
+  saveRecord(wsRoot, tx);
+  return result;
+}
+function isTransaction(x) {
+  return !!x && typeof x === "object" && x.kind === "fix-transaction";
+}
+function activeTransactions(wsRoot) {
+  const dir = recordsDir(wsRoot);
+  if (!existsSync13(dir)) return [];
+  const out = [];
+  for (const f of readdirSync8(dir).filter((n) => n.endsWith(".json")).sort()) {
+    try {
+      const rec = JSON.parse(readFileSync10(join17(dir, f), "utf8"));
+      if (isTransaction(rec) && ["pending", "applied", "partially-rolled-back"].includes(rec.state))
+        out.push(rec);
+    } catch {
+    }
+  }
+  return out;
+}
+function previewRollback(tx) {
+  return tx.files.map((f) => {
+    if (f.state === "restored") return { file: f.file, action: "unchanged" };
+    const abs = writablePath(tx.root, f.file);
+    const current = readOrNull(abs);
+    const sha = current ? sha256(current) : null;
+    if (sha === f.beforeSha) return { file: f.file, action: "unchanged" };
+    if (sha === f.afterSha) return { file: f.file, action: "restore" };
+    return {
+      file: f.file,
+      action: "conflict",
+      reason: current === null ? "deleted after the change" : "modified after the change"
+    };
+  });
+}
+
+// src/repair/git.ts
+function git(cwd, args) {
+  const r = spawnSync2("git", args, { cwd, encoding: "utf8", maxBuffer: 64 * 1024 * 1024 });
+  return { ok: r.status === 0, out: (r.stdout ?? "").trim(), err: (r.stderr ?? "").trim() };
+}
+function isGitRepo(root) {
+  return git(root, ["rev-parse", "--is-inside-work-tree"]).out === "true";
+}
+function untrackedFiles(root) {
+  return git(root, ["ls-files", "--others", "--exclude-standard"]).out.split("\n").filter(Boolean);
+}
+function createCheckpoint(root, wsRoot, note = "") {
+  if (!isGitRepo(root))
+    throw new JouriloError(
+      "INVALID_INPUT",
+      `${root} is not a git repository; checkpoints need git.`,
+      "Run `git init` and commit, or keep your own backup before applying fixes."
+    );
+  const head = git(root, ["rev-parse", "HEAD"]);
+  if (!head.ok)
+    throw new JouriloError(
+      "INVALID_INPUT",
+      "The repository has no commits yet; commit once before using checkpoints."
+    );
+  const stash = git(root, ["stash", "create", `jourilo checkpoint ${note}`.trim()]);
+  const cp = {
+    id: newRunId(),
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    head: head.out,
+    snapshot: stash.out || head.out,
+    untracked: untrackedFiles(root),
+    note
+  };
+  git(root, ["update-ref", `refs/jourilo/checkpoints/${cp.id}`, cp.snapshot]);
+  const dir = join18(wsRoot, "checkpoints");
+  mkdirSync6(dir, { recursive: true });
+  writeFileSync8(join18(dir, `${cp.id}.json`), `${JSON.stringify(cp, null, 2)}
+`);
+  return cp;
+}
+function loadCheckpoint(wsRoot, id) {
+  const dir = join18(wsRoot, "checkpoints");
+  const read3 = (name) => JSON.parse(readFileSync11(join18(dir, `${name}.json`), "utf8"));
+  let pick = id;
+  if (id === "latest") {
+    const names = existsSync14(dir) ? readdirSync9(dir).filter((f) => f.endsWith(".json")).map((f) => f.replace(/\.json$/, "")).sort().reverse() : [];
+    pick = names.find((n) => {
+      try {
+        const rec = read3(n);
+        if (!isTransaction(rec)) return !rec.rolledBack;
+        return !rec.undoes && ["applied", "pending", "partially-rolled-back"].includes(rec.state);
+      } catch {
+        return false;
+      }
+    });
+  }
+  if (!pick || !/^[\w-]+$/.test(pick) || !existsSync14(join18(dir, `${pick}.json`)))
+    throw new JouriloError("NOT_FOUND", `Checkpoint not found: ${id}`);
+  return read3(pick);
+}
+function diffSince(root, cp) {
+  const stat = git(root, ["diff", "--stat", cp.snapshot]).out;
+  const patch = git(root, ["diff", cp.snapshot]).out;
+  const newFiles = untrackedFiles(root).filter((f) => !cp.untracked.includes(f));
+  return { stat, patch, newFiles };
+}
+function backupDir(wsRoot, cp) {
+  return join18(wsRoot, "checkpoints", cp.id);
+}
+function blob(root, rev, file) {
+  const r = spawnSync2("git", ["cat-file", "blob", `${rev}:${file}`], {
+    cwd: root,
+    maxBuffer: 64 * 1024 * 1024
+  });
+  return r.status === 0 ? r.stdout : null;
+}
+function rollbackCheckpoint(root, cp, wsRoot, opts = {}) {
+  const changed = git(root, ["diff", "--name-only", "--no-renames", cp.snapshot]).out.split("\n").filter(Boolean).filter((f) => !opts.files?.length || opts.files.includes(f));
+  const edits = [];
+  const notRestorable = [];
+  for (const f of changed) {
+    const target = resolveInside(root, f);
+    const current = existsSync14(target) ? readFileSync11(target) : null;
+    const saved = resolveInside(backupDir(wsRoot, cp), f);
+    let wanted = existsSync14(saved) ? readFileSync11(saved) : null;
+    if (!wanted) {
+      const content = blob(root, cp.snapshot, f);
+      if (!content) {
+        notRestorable.push(f);
+        continue;
+      }
+      wanted = current?.includes("\r\n") && !content.includes("\r\n") ? Buffer.from(content.toString("utf8").replace(/\n/g, "\r\n"), "utf8") : content;
+    }
+    if (current?.equals(wanted)) continue;
+    edits.push({ file: f, before: current, after: wanted });
+  }
+  const transaction = edits.length ? applyTransaction(root, wsRoot, edits, { note: `rollback to checkpoint ${cp.id}`, undoes: cp.id }) : null;
+  return {
+    transaction,
+    restored: edits.map((e) => e.file),
+    // Files that did not exist at checkpoint time are listed, never deleted.
+    leftUntracked: [
+      ...notRestorable,
+      ...untrackedFiles(root).filter((f) => !cp.untracked.includes(f) && !notRestorable.includes(f))
+    ]
+  };
+}
+function markRolledBack(wsRoot, cp, transactionId) {
+  const file = join18(wsRoot, "checkpoints", `${cp.id}.json`);
+  writeFileSync8(file, `${JSON.stringify({ ...cp, rolledBack: transactionId }, null, 2)}
+`);
+}
+function wouldBeCommitted(file) {
+  let dir = dirname8(file);
+  while (!existsSync14(dir) && dirname8(dir) !== dir) dir = dirname8(dir);
+  if (!isGitRepo(dir)) return false;
+  const r = spawnSync2("git", ["check-ignore", "-q", "--no-index", file], { cwd: dir });
+  return r.status === 1;
+}
+
 // src/cli/commands/journeys.ts
 function journeysDir(ws) {
-  return join15(ws.root, "journeys");
+  return join19(ws.root, "journeys");
 }
 function loadJourneys(ws, refs) {
   const dir = journeysDir(ws);
   const files = [];
   if (!refs.length) {
-    if (!existsSync12(dir)) return [];
+    if (!existsSync15(dir)) return [];
     files.push(
-      ...readdirSync7(dir).filter((f) => f.endsWith(".json")).sort().map((f) => join15(dir, f))
+      ...readdirSync10(dir).filter((f) => f.endsWith(".json")).sort().map((f) => join19(dir, f))
     );
   } else {
     for (const r of refs) {
-      if (r.endsWith(".json") && existsSync12(r)) files.push(resolve8(r));
-      else if (existsSync12(join15(dir, `${r}.json`))) files.push(join15(dir, `${r}.json`));
+      if (r.endsWith(".json") && existsSync15(r)) files.push(resolve8(r));
+      else if (existsSync15(join19(dir, `${r}.json`))) files.push(join19(dir, `${r}.json`));
       else throw new JouriloError("NOT_FOUND", `Journey not found: ${r} (looked in ${dir})`);
     }
   }
   return files.map((f) => {
     let raw;
     try {
-      raw = JSON.parse(readFileSync9(f, "utf8"));
+      raw = JSON.parse(readFileSync12(f, "utf8"));
     } catch (err) {
-      throw new JouriloError("INVALID_INPUT", `${basename2(f)} is not valid JSON: ${err.message}`);
+      throw new JouriloError("INVALID_INPUT", `${basename5(f)} is not valid JSON: ${err.message}`);
     }
-    return validateJourney(raw, basename2(f));
+    return validateJourney(raw, basename5(f));
   });
 }
 function parseVars(ctx) {
@@ -46448,7 +48117,7 @@ async function suggest(ctx) {
   if (!target || ctx.ws.listRuns().some((r) => r.id === target) || target === "latest") {
     run = ctx.ws.loadRun(target ?? "latest").run;
   } else {
-    const isDir = existsSync12(target) && !target.includes("://");
+    const isDir = existsSync15(target) && !target.includes("://");
     const server = isDir ? await serveStatic(resolve8(target)) : void 0;
     try {
       ctx.log("Discovering pages to derive journeys (no audit rules applied) \u2026");
@@ -46475,16 +48144,16 @@ async function suggest(ctx) {
   }
   const specs = suggestJourneys(run);
   const dir = journeysDir(ctx.ws);
-  mkdirSync5(dir, { recursive: true });
+  mkdirSync7(dir, { recursive: true });
   const written = [];
   const kept = [];
   for (const s of specs) {
-    const file = join15(dir, `${s.id}.json`);
-    if (existsSync12(file) && !flag(ctx, "force")) {
+    const file = join19(dir, `${s.id}.json`);
+    if (existsSync15(file) && !flag(ctx, "force")) {
       kept.push(s.id);
       continue;
     }
-    writeFileSync8(file, `${JSON.stringify(s, null, 2)}
+    writeFileSync9(file, `${JSON.stringify(s, null, 2)}
 `);
     written.push(file);
   }
@@ -46500,6 +48169,42 @@ async function suggest(ctx) {
     ].filter(Boolean).join("\n")
   };
 }
+function summarizeAttempts(spec, attempts) {
+  if (attempts.length === 1) return attempts[0];
+  const passed = attempts.filter((a) => a.result.status === "passed").length;
+  const rep = attempts.find((a) => a.result.status !== "passed") ?? attempts[0];
+  const result = {
+    ...rep.result,
+    attempts: attempts.map((a) => ({ status: a.result.status, durationMs: a.result.durationMs })),
+    stability: passed === 0 || passed === attempts.length ? "stable" : "flaky"
+  };
+  if (result.stability === "stable") return { result, findings: rep.findings };
+  const findings = [
+    ...rep.findings.map((f) => ({ ...f, confidence: "low" })),
+    makeFinding({
+      ruleId: "journey/flaky",
+      key: spec.id,
+      journey: spec.id,
+      title: `Journey "${spec.name}" passed ${passed} of ${attempts.length} times`,
+      category: "reliability",
+      kind: "needs-review",
+      severity: "moderate",
+      confidence: "high",
+      provenance: "observed",
+      url: rep.result.steps.at(-1)?.url || spec.start,
+      viewport: rep.result.viewport,
+      description: `The same steps gave different outcomes across ${attempts.length} runs (${attempts.map((a) => a.result.status).join(", ")}). Either the product behaves inconsistently (race conditions, timing, data dependence) or the journey depends on timing; the failing run's evidence is attached to the journey.`,
+      impact: "Intermittent failures reach real users and make before/after comparisons unreliable.",
+      recommendation: "Compare the failing attempt with a passing one: look for requests that finish in a different order, elements that render late, or data created by an earlier run. Fix the product if it is a race; otherwise make the journey wait for the right state.",
+      standards: [],
+      evidence: [{ type: "step", snippet: rep.result.steps.find((s) => s.status !== "passed")?.error ?? "" }],
+      reproduction: [
+        `Run the journey ${attempts.length} times: jourilo journeys run ${spec.id} --repeat ${attempts.length}`
+      ]
+    })
+  ];
+  return { result, findings };
+}
 async function runCmd(ctx) {
   const baseArg = str(ctx, "base");
   if (!baseArg)
@@ -46511,7 +48216,7 @@ async function runCmd(ctx) {
       "No journeys to run.",
       "Create some with `jourilo journeys suggest <url>`."
     );
-  const isDir = existsSync12(baseArg) && !baseArg.includes("://");
+  const isDir = existsSync15(baseArg) && !baseArg.includes("://");
   const server = isDir ? await serveStatic(resolve8(baseArg)) : void 0;
   try {
     const base2 = parseTargetUrl(server?.url ?? baseArg);
@@ -46519,7 +48224,12 @@ async function runCmd(ctx) {
     const id = newRunId();
     const runDir = ctx.ws.createRunDir(id);
     const browserName = str(ctx, "browser") ?? "chromium";
-    const browser = await launchBrowser(browserName, flag(ctx, "headed"));
+    const session = await openGuardedBrowser(browserName, flag(ctx, "headed"), {
+      target: hostClass,
+      allowPrivate: flag(ctx, "allow-private")
+    });
+    const browser = session.browser;
+    const browserVersion = browser.version();
     const startedAt = (/* @__PURE__ */ new Date()).toISOString();
     const journeys2 = [];
     let findings = [];
@@ -46534,16 +48244,29 @@ async function runCmd(ctx) {
       limitations.push(
         "--allow-destructive is ignored on non-local hosts: irreversible and payment actions were blocked."
       );
+    const allowOrigins = list(ctx, "allow-origin").map((o) => {
+      const u = parseTargetUrl(o);
+      return u.origin;
+    });
+    const repeat = Math.max(1, Math.min(10, num(ctx, "repeat", 1)));
     const saveAuthArg = str(ctx, "save-auth");
+    if (saveAuthArg && repeat > 1)
+      throw new JouriloError("USAGE", "--save-auth cannot be combined with --repeat.");
     if (saveAuthArg && specs.length !== 1)
       throw new JouriloError("USAGE", "--save-auth needs exactly one journey (the sign-in journey).");
     const saveAuth = saveAuthArg ? resolve8(saveAuthArg) : void 0;
-    if (saveAuth)
+    if (saveAuth) {
       limitations.push(
         `Signed-in state saved to ${displayPath(saveAuth)} (owner-only permissions). Treat it like a password; it is a test-account session.`
       );
+      if (wouldBeCommitted(saveAuth)) {
+        const warning = `WARNING: ${displayPath(saveAuth)} is inside a git repository and not ignored, so it could be committed with its session cookies. Add it to .gitignore or save it under .jourilo/.`;
+        limitations.push(warning);
+        ctx.log(warning);
+      }
+    }
     if (flag(ctx, "trace")) {
-      mkdirSync5(join15(runDir, "traces"), { recursive: true });
+      mkdirSync7(join19(runDir, "traces"), { recursive: true });
       limitations.push(
         "Playwright traces contain DOM snapshots and typed values: keep them private (they are excluded from git)."
       );
@@ -46553,27 +48276,38 @@ async function runCmd(ctx) {
       for (const spec of specs) {
         for (const vp of viewports) {
           ctx.log(`journey ${spec.id}${vp ? ` (${vp})` : ""}`);
-          const { result, findings: jf } = await runJourney(browser, spec, {
-            base: base2,
-            runDir,
-            hostClass,
-            policy,
-            data,
-            trace: flag(ctx, "trace"),
-            stepTimeoutMs: num(ctx, "timeout", 10) * 1e3,
-            ...vp ? { viewportOverride: vp } : {},
-            ...str(ctx, "auth") ? { storageState: str(ctx, "auth") } : {},
-            ...saveAuth ? { saveAuth } : {},
-            log: ctx.log
-          });
-          ctx.log(`  \u2192 ${result.status} (${(result.durationMs / 1e3).toFixed(1)} s)`);
+          const attempts = [];
+          for (let k = 0; k < repeat; k++) {
+            const r = await runJourney(browser, spec, {
+              base: base2,
+              runDir,
+              hostClass,
+              policy,
+              data: repeat > 1 ? testData(`${id}${k}`, parseVars(ctx)) : data,
+              trace: flag(ctx, "trace") && k === 0,
+              stepTimeoutMs: num(ctx, "timeout", 10) * 1e3,
+              ...vp ? { viewportOverride: vp } : {},
+              ...str(ctx, "auth") ? { storageState: str(ctx, "auth") } : {},
+              ...saveAuth ? { saveAuth } : {},
+              ...allowOrigins.length ? { allowOrigins } : {},
+              log: k === 0 ? ctx.log : void 0
+            });
+            if (repeat > 1) ctx.log(`  attempt ${k + 1}/${repeat}: ${r.result.status}`);
+            attempts.push(r);
+          }
+          const { result, findings: jf } = summarizeAttempts(spec, attempts);
+          ctx.log(
+            `  \u2192 ${result.status}${result.stability ? ` (${result.stability})` : ""} (${(result.durationMs / 1e3).toFixed(1)} s)`
+          );
           journeys2.push(result);
           findings.push(...jf);
         }
       }
     } finally {
-      await browser.close().catch(() => void 0);
+      await session.close();
     }
+    const network = session.report();
+    limitations.push(...networkLimitations(network));
     findings = mergeFindings(findings);
     const run = {
       schemaVersion: RUN_SCHEMA_VERSION,
@@ -46583,7 +48317,7 @@ async function runCmd(ctx) {
       target: server ? `${displayPath(resolve8(baseArg))} (served at ${server.url})` : base2.toString(),
       startedAt,
       finishedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      browser: { name: browserName, version: "" },
+      browser: { name: browserName, version: browserVersion },
       viewports: parseViewports([...new Set(journeys2.map((j) => j.viewport))].join(",") || "desktop"),
       settings: {
         journeys: specs.map((s) => s.id),
@@ -46598,7 +48332,8 @@ async function runCmd(ctx) {
       limitations: [
         ...limitations,
         "Journeys prove that a scripted path works (or not) in one browser; they do not measure how real people choose paths."
-      ]
+      ],
+      ...network.blocked.length || network.escaped.length ? { network } : {}
     };
     const repo = str(ctx, "repo") ?? (isDir ? resolve8(baseArg) : void 0);
     if (repo) locateFindings(run, repo);
@@ -46634,6 +48369,7 @@ var journeys = {
     "allow-submit": { type: "boolean" },
     "allow-destructive": { type: "boolean" },
     "allow-private": { type: "boolean" },
+    "allow-origin": { type: "string", multiple: true },
     "fail-on-failure": { type: "boolean" },
     browser: { type: "string" },
     headed: { type: "boolean" },
@@ -46642,7 +48378,8 @@ var journeys = {
     timeout: { type: "string" },
     pages: { type: "string" },
     force: { type: "boolean" },
-    "save-auth": { type: "string" }
+    "save-auth": { type: "string" },
+    repeat: { type: "string" }
   },
   details: `Subcommands:
   suggest [url|dir|run]  Derive journeys from a site (or an existing run) into .jourilo/journeys/*.json
@@ -46655,13 +48392,18 @@ Run options:
   --var key=value        Test data for {{key}} placeholders (also JOURILO_VAR_KEY env vars)
   --allow-submit         Allow form submission on non-local hosts (authorized test environments only)
   --allow-destructive    Allow irreversible/payment actions \u2014 local hosts with sandbox data only
+  --allow-origin ORIGIN  Let the page navigate to another origin you are authorized to test (e.g. a test IdP)
   --trace                Record a Playwright trace per journey (contains typed values; keep private)
   --auth FILE            Playwright storage state for signed-in journeys
   --save-auth FILE       After a passing sign-in journey (exactly one), save its session for --auth (test accounts only)
+  --repeat N             Run each journey N times (max 10); mixed outcomes are reported as flaky
   --fail-on-failure      Exit 1 when a journey fails
 
 Safety: payment, purchase, delete and cancel actions are never performed on non-local hosts; form submission
-on non-local hosts needs --allow-submit. Blocked steps are reported, not skipped silently.`,
+on non-local hosts needs --allow-submit. The policy is checked twice: on the element about to be clicked or
+pressed (its name, link target, form action and identifiers \u2014 icon-only buttons included), and on every request
+the page then sends (form posts, DELETE, requests to delete/cancel/payment endpoints, navigation to other
+origins). Blocked steps are reported, not skipped silently.`,
   async run(ctx) {
     const sub = ctx.positionals[0] ?? "list";
     if (sub === "suggest") return suggest(ctx);
@@ -46679,8 +48421,8 @@ ${specs.map((s) => `  ${s.id.padEnd(32)} ${s.steps.length} steps, ${s.success.le
 };
 
 // src/cli/commands/optimize.ts
-import { existsSync as existsSync15, mkdirSync as mkdirSync7, writeFileSync as writeFileSync10 } from "node:fs";
-import { join as join17, resolve as resolve9 } from "node:path";
+import { existsSync as existsSync17, mkdirSync as mkdirSync8, writeFileSync as writeFileSync10 } from "node:fs";
+import { join as join20, resolve as resolve9 } from "node:path";
 init_errors();
 init_fs_safety();
 
@@ -46751,17 +48493,17 @@ function unifiedDiff(file, before, after, context = 3) {
 }
 
 // src/repair/fixes.ts
-import { existsSync as existsSync13, readFileSync as readFileSync10 } from "node:fs";
+import { existsSync as existsSync16, readFileSync as readFileSync13 } from "node:fs";
 import { extname as extname3 } from "node:path";
 init_fs_safety();
 function base(f, title, explanation, expectedEffect) {
   return { fingerprint: f.fingerprint, ruleId: f.ruleId, title, explanation, expectedEffect };
 }
 var isJsx = (file) => /\.(jsx|tsx)$/.test(file);
-var htmlLang = (f, _root, read2) => {
+var htmlLang = (f, _root, read3) => {
   const src = f.sources?.find((s) => s.reason.includes("<html>"));
   if (!src) return null;
-  const text = read2(src.file);
+  const text = read3(src.file);
   if (!text) return null;
   const path2 = (() => {
     try {
@@ -46787,10 +48529,10 @@ var htmlLang = (f, _root, read2) => {
     ]
   };
 };
-var viewportMeta = (f, _root, read2) => {
+var viewportMeta = (f, _root, read3) => {
   const src = f.sources?.find((s) => /\.html?$/.test(s.file) && s.reason.includes("viewport"));
   if (!src) return null;
-  const text = read2(src.file);
+  const text = read3(src.file);
   if (!text || /name=["']viewport["']/i.test(text)) return null;
   const anchor = /<meta\s+charset=[^>]*>/i.test(text) ? /(<meta\s+charset=[^>]*>)(\r?\n?)(\s*)/i : /(<head\b[^>]*>)(\r?\n?)(\s*)/i;
   const after = text.replace(
@@ -46812,7 +48554,7 @@ ${indent}`
     ]
   };
 };
-var autocomplete = (f, root, read2) => {
+var autocomplete = (f, root, read3) => {
   const edits = /* @__PURE__ */ new Map();
   const tokens = [];
   for (const e of f.evidence) {
@@ -46824,7 +48566,7 @@ var autocomplete = (f, root, read2) => {
     const token = suggestAutocomplete(type, name, label === "\u2205" ? null : label, purpose);
     if (token.startsWith("on (")) continue;
     for (const s of f.sources ?? []) {
-      const cur = edits.get(s.file)?.after ?? read2(s.file);
+      const cur = edits.get(s.file)?.after ?? read3(s.file);
       if (!cur) continue;
       const attr = isJsx(s.file) ? "autoComplete" : "autocomplete";
       const re = new RegExp(
@@ -46832,7 +48574,7 @@ var autocomplete = (f, root, read2) => {
       );
       const next = cur.replace(re, `$1 ${attr}="${token}"$2`);
       if (next !== cur) {
-        edits.set(s.file, { before: edits.get(s.file)?.before ?? read2(s.file), after: next });
+        edits.set(s.file, { before: edits.get(s.file)?.before ?? read3(s.file), after: next });
         tokens.push(`${name} \u2192 ${token}`);
         break;
       }
@@ -46853,10 +48595,10 @@ var autocomplete = (f, root, read2) => {
     ]
   };
 };
-var focusVisible = (f, _root, read2) => {
+var focusVisible = (f, _root, read3) => {
   const src = f.sources?.find((s) => /\.(css|scss|less)$/.test(s.file) && s.reason.includes("focus outline"));
   if (!src) return null;
-  const text = read2(src.file);
+  const text = read3(src.file);
   if (!text) return null;
   const lines = text.split("\n");
   let start = src.line - 1;
@@ -46886,10 +48628,10 @@ ${sels.join(",\n")} {
     ]
   };
 };
-var pasteAllowed = (f, _root, read2) => {
+var pasteAllowed = (f, _root, read3) => {
   const src = f.sources?.find((s) => s.reason.includes("paste"));
   if (!src) return null;
-  const text = read2(src.file);
+  const text = read3(src.file);
   if (!text) return null;
   const after = text.replace(/(<input\b[^>]*?)\s+on[pP]aste=(?:"[^"]*"|'[^']*'|\{[^}]*\})([^>]*>)/g, "$1$2");
   if (after === text) return null;
@@ -46907,7 +48649,7 @@ var pasteAllowed = (f, _root, read2) => {
   };
 };
 var escRe = (x) => x.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-var imageDimensions = (f, _root, read2) => {
+var imageDimensions = (f, _root, read3) => {
   const edits = /* @__PURE__ */ new Map();
   const done = [];
   const notes = [];
@@ -46917,7 +48659,7 @@ var imageDimensions = (f, _root, read2) => {
     const h = Number(e.data?.naturalHeight);
     if (!src || !(w > 0 && h > 0)) continue;
     for (const s of f.sources ?? []) {
-      const cur = edits.get(s.file)?.after ?? read2(s.file);
+      const cur = edits.get(s.file)?.after ?? read3(s.file);
       if (!cur) continue;
       const re = new RegExp(
         `<img\\b(?=[^>]*\\bsrc=["'{]?["']?${escRe(src)}["'])(?![^>]*\\bwidth=)(?![^>]*\\bheight=)[^>]*?(\\s*/?>)`
@@ -46935,7 +48677,7 @@ var imageDimensions = (f, _root, read2) => {
       }
       tag = tag.replace(/(\s*\/?>)$/, ` width="${w}" height="${h}"$1`);
       edits.set(s.file, {
-        before: edits.get(s.file)?.before ?? read2(s.file),
+        before: edits.get(s.file)?.before ?? read3(s.file),
         after: cur.replace(m[0], tag)
       });
       done.push(`${src} \u2192 ${w}\xD7${h}`);
@@ -46957,14 +48699,14 @@ var imageDimensions = (f, _root, read2) => {
     ]
   };
 };
-var placeholderLabel = (f, _root, read2) => {
+var placeholderLabel = (f, _root, read3) => {
   const edits = /* @__PURE__ */ new Map();
   const done = [];
   for (const e of f.evidence) {
     const name = e.snippet?.match(/name=(\S+)/)?.[1];
     if (!name || name === "\u2205") continue;
     for (const s of f.sources ?? []) {
-      const cur = edits.get(s.file)?.after ?? read2(s.file);
+      const cur = edits.get(s.file)?.after ?? read3(s.file);
       if (!cur) continue;
       const jsx = isJsx(s.file);
       const re = new RegExp(`<(input|textarea|select)\\b(?=[^>]*\\bname=["']${escRe(name)}["'])[^>]*>`);
@@ -46982,7 +48724,7 @@ var placeholderLabel = (f, _root, read2) => {
       }
       const label = `<label ${jsx ? "htmlFor" : "for"}="${id}">${placeholder}</label> `;
       edits.set(s.file, {
-        before: edits.get(s.file)?.before ?? read2(s.file),
+        before: edits.get(s.file)?.before ?? read3(s.file),
         after: cur.replace(tag, `${label}${newTag}`)
       });
       done.push(`${name} \u2192 "${placeholder}"`);
@@ -47012,15 +48754,28 @@ var FIXERS = {
   "jourilo/unsized-images": imageDimensions,
   "jourilo/placeholder-label": placeholderLabel
 };
+function utf8OrNull(buf) {
+  const text = buf.toString("utf8");
+  return Buffer.from(text, "utf8").equals(buf) ? text : null;
+}
+function composeEdits(plans) {
+  const byFile = /* @__PURE__ */ new Map();
+  for (const p of plans)
+    for (const e of p.edits) {
+      const prev = byFile.get(e.file);
+      byFile.set(e.file, { file: e.file, before: prev?.before ?? e.before, after: e.after });
+    }
+  return [...byFile.values()];
+}
 function planFixes(findings, root) {
   const cache = /* @__PURE__ */ new Map();
-  const read2 = (file) => {
+  const read3 = (file) => {
     if (!cache.has(file)) {
       try {
         const abs = resolveInside(root, file);
         cache.set(
           file,
-          existsSync13(abs) && [
+          existsSync16(abs) && [
             ".html",
             ".htm",
             ".css",
@@ -47034,7 +48789,7 @@ function planFixes(findings, root) {
             ".svelte",
             ".astro",
             ".php"
-          ].includes(extname3(abs).toLowerCase()) ? readFileSync10(abs, "utf8") : null
+          ].includes(extname3(abs).toLowerCase()) ? utf8OrNull(readFileSync13(abs)) : null
         );
       } catch {
         cache.set(file, null);
@@ -47047,10 +48802,10 @@ function planFixes(findings, root) {
   for (const f of findings) {
     const fixer = FIXERS[f.ruleId];
     if (!fixer || !f.sources?.length) continue;
-    const plan = fixer(f, root, (file) => touched.get(file) ?? read2(file));
+    const plan = fixer(f, root, (file) => touched.get(file) ?? read3(file));
     if (!plan) continue;
     for (const e of plan.edits) {
-      e.before = touched.get(e.file) ?? read2(e.file) ?? e.before;
+      e.before = touched.get(e.file) ?? read3(e.file) ?? e.before;
       touched.set(e.file, e.after);
     }
     if (plans.some(
@@ -47062,119 +48817,21 @@ function planFixes(findings, root) {
   return plans;
 }
 
-// src/repair/git.ts
-init_errors();
-init_fs_safety();
-import { spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync14, mkdirSync as mkdirSync6, readdirSync as readdirSync8, readFileSync as readFileSync11, writeFileSync as writeFileSync9 } from "node:fs";
-import { dirname as dirname6, join as join16 } from "node:path";
-function git(cwd, args) {
-  const r = spawnSync2("git", args, { cwd, encoding: "utf8", maxBuffer: 64 * 1024 * 1024 });
-  return { ok: r.status === 0, out: (r.stdout ?? "").trim(), err: (r.stderr ?? "").trim() };
-}
-function isGitRepo(root) {
-  return git(root, ["rev-parse", "--is-inside-work-tree"]).out === "true";
-}
-function untrackedFiles(root) {
-  return git(root, ["ls-files", "--others", "--exclude-standard"]).out.split("\n").filter(Boolean);
-}
-function createCheckpoint(root, wsRoot, note = "") {
-  if (!isGitRepo(root))
-    throw new JouriloError(
-      "INVALID_INPUT",
-      `${root} is not a git repository; checkpoints need git.`,
-      "Run `git init` and commit, or keep your own backup before applying fixes."
-    );
-  const head = git(root, ["rev-parse", "HEAD"]);
-  if (!head.ok)
-    throw new JouriloError(
-      "INVALID_INPUT",
-      "The repository has no commits yet; commit once before using checkpoints."
-    );
-  const stash = git(root, ["stash", "create", `jourilo checkpoint ${note}`.trim()]);
-  const cp = {
-    id: newRunId(),
-    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-    head: head.out,
-    snapshot: stash.out || head.out,
-    untracked: untrackedFiles(root),
-    note
-  };
-  git(root, ["update-ref", `refs/jourilo/checkpoints/${cp.id}`, cp.snapshot]);
-  const dir = join16(wsRoot, "checkpoints");
-  mkdirSync6(dir, { recursive: true });
-  writeFileSync9(join16(dir, `${cp.id}.json`), `${JSON.stringify(cp, null, 2)}
-`);
-  return cp;
-}
-function loadCheckpoint(wsRoot, id) {
-  const dir = join16(wsRoot, "checkpoints");
-  const pick = id === "latest" ? existsSync14(dir) ? readdirSync8(dir).filter((f) => f.endsWith(".json")).sort().pop()?.replace(/\.json$/, "") : void 0 : id;
-  if (!pick || !/^[\w-]+$/.test(pick) || !existsSync14(join16(dir, `${pick}.json`)))
-    throw new JouriloError("NOT_FOUND", `Checkpoint not found: ${id}`);
-  return JSON.parse(readFileSync11(join16(dir, `${pick}.json`), "utf8"));
-}
-function diffSince(root, cp) {
-  const stat = git(root, ["diff", "--stat", cp.snapshot]).out;
-  const patch = git(root, ["diff", cp.snapshot]).out;
-  const newFiles = untrackedFiles(root).filter((f) => !cp.untracked.includes(f));
-  return { stat, patch, newFiles };
-}
-function backupDir(wsRoot, cp) {
-  return join16(wsRoot, "checkpoints", cp.id);
-}
-function backupFiles(root, wsRoot, cp, files) {
-  for (const f of files) {
-    const src = resolveInside(root, f);
-    if (!existsSync14(src)) continue;
-    const dest = resolveInside(backupDir(wsRoot, cp), f);
-    mkdirSync6(dirname6(dest), { recursive: true });
-    writeFileSync9(dest, readFileSync11(src));
+// src/report/compare.ts
+var RESOLUTION = { LCP: 150, FCP: 150, TBT: 100, CLS: 0.02, Transfer: 0 };
+function metricVerdict(name, a, b) {
+  const delta = b.value - a.value;
+  if (name === "Transfer") {
+    if (Math.abs(delta) <= Math.max(2048, a.value * 0.02)) return "noise";
+    return delta < 0 ? "improved" : "regressed";
   }
-}
-function blob(root, rev, file) {
-  const r = spawnSync2("git", ["cat-file", "blob", `${rev}:${file}`], {
-    cwd: root,
-    maxBuffer: 64 * 1024 * 1024
-  });
-  return r.status === 0 ? r.stdout : null;
-}
-function rollback(root, cp, wsRoot) {
-  const changed = git(root, ["diff", "--name-only", cp.snapshot]).out.split("\n").filter(Boolean);
-  const restored = [];
-  const notRestorable = [];
-  for (const f of changed) {
-    const target = resolveInside(root, f);
-    const saved = wsRoot ? resolveInside(backupDir(wsRoot, cp), f) : null;
-    if (saved && existsSync14(saved)) {
-      writeFileSync9(target, readFileSync11(saved));
-      restored.push(f);
-      continue;
-    }
-    const content = blob(root, cp.snapshot, f);
-    if (!content) {
-      notRestorable.push(f);
-      continue;
-    }
-    let out = content;
-    const current = existsSync14(target) ? readFileSync11(target) : null;
-    if (current?.includes("\r\n") && !content.includes("\r\n"))
-      out = Buffer.from(content.toString("utf8").replace(/\n/g, "\r\n"), "utf8");
-    mkdirSync6(dirname6(target), { recursive: true });
-    writeFileSync9(target, out);
-    restored.push(f);
+  if (a.range && b.range) {
+    const overlap = a.range[0] <= b.range[1] && b.range[0] <= a.range[1];
+    if (overlap || Math.abs(delta) < (RESOLUTION[name] ?? 0) / 2) return "noise";
+    return delta < 0 ? "improved" : "regressed";
   }
-  return {
-    restored,
-    // Files that did not exist at checkpoint time are listed, never deleted.
-    leftUntracked: [
-      ...notRestorable,
-      ...untrackedFiles(root).filter((f) => !cp.untracked.includes(f) && !notRestorable.includes(f))
-    ]
-  };
+  return Math.abs(delta) < (RESOLUTION[name] ?? 0) ? "noise" : "unconfirmed";
 }
-
-// src/report/compare.ts
 function pathKey(u) {
   try {
     const x = new URL(u);
@@ -47200,7 +48857,15 @@ function compareRuns(base2, head) {
       const b = hp.metrics.find((m) => m.name === name);
       if (!a || !b) continue;
       const delta = Math.round((b.value - a.value) * 1e3) / 1e3;
-      metrics.push({ url: hp.url, viewport: hp.viewport, name, before: a.value, after: b.value, delta });
+      metrics.push({
+        url: hp.url,
+        viewport: hp.viewport,
+        name,
+        before: a.value,
+        after: b.value,
+        delta,
+        verdict: metricVerdict(name, a, b)
+      });
     }
   }
   const regressionFree = !introduced.some(
@@ -47212,7 +48877,7 @@ function compareRuns(base2, head) {
 // src/cli/commands/optimize.ts
 var optimize = {
   name: "optimize",
-  summary: "Plan (and with --apply, make) minimal source fixes for located findings; shows diffs, checkpoints first.",
+  summary: "Plan (and with --apply, make) minimal source fixes for located findings; shows diffs, writes one reversible change.",
   usage: "jourilo optimize [run=latest] --repo <path> [--rule id ...] [--apply]",
   options: {
     repo: { type: "string" },
@@ -47221,13 +48886,16 @@ var optimize = {
     apply: { type: "boolean" }
   },
   details: `Deterministic fixers (others are reported with source candidates for a person or agent to fix):
-  axe/html-has-lang, jourilo/missing-viewport-meta, jourilo/input-purpose, jourilo/focus-visible, jourilo/paste-blocked
-Without --apply nothing is written. With --apply, a git checkpoint is created first (jourilo rollback undoes it).
+  axe/html-has-lang, jourilo/missing-viewport-meta, jourilo/input-purpose, jourilo/focus-visible, jourilo/paste-blocked,
+  jourilo/unsized-images, jourilo/placeholder-label
+Without --apply nothing is written. With --apply, all files are written as one change: each file must be unchanged
+since the plan, writes are atomic, an interrupted apply is undone, and \`jourilo rollback <id>\` restores the files
+(git is not required).
 Afterwards run \`jourilo verify <run>\` to repeat the audit and compare.`,
   async run(ctx) {
     const { run, dir } = ctx.ws.loadRun(ctx.positionals[0] ?? "latest");
     const repo = resolve9(str(ctx, "repo") ?? run.settings.repo ?? ".");
-    if (!existsSync15(repo)) throw new JouriloError("NOT_FOUND", `Repository not found: ${repo}`);
+    if (!existsSync17(repo)) throw new JouriloError("NOT_FOUND", `Repository not found: ${repo}`);
     if (run.findings.every((f) => !f.sources)) locateFindings(run, repo);
     const rules = list(ctx, "rule");
     const only = list(ctx, "finding");
@@ -47254,23 +48922,29 @@ Afterwards run \`jourilo verify <run>\` to repeat the audit and compare.`,
       );
     let checkpoint2 = null;
     if (flag(ctx, "apply") && plans.length) {
-      const finalContent = /* @__PURE__ */ new Map();
-      for (const p of plans) for (const e of p.edits) finalContent.set(e.file, e.after);
-      if (isGitRepo(repo)) {
-        const cp = createCheckpoint(repo, ctx.ws.root, `before optimize of run ${run.id}`);
-        backupFiles(repo, ctx.ws.root, cp, [...finalContent.keys()]);
-        checkpoint2 = cp.id;
-      } else ctx.log("Warning: not a git repository, so no checkpoint/rollback is available.");
-      for (const [file, content] of finalContent) writeFileSync10(resolveInside(repo, file), content);
-      const outDir = join17(ctx.ws.root, "fixes");
-      mkdirSync7(outDir, { recursive: true });
+      const edits = composeEdits(plans);
+      const tx = applyTransaction(
+        repo,
+        ctx.ws.root,
+        edits.map((e) => ({
+          file: e.file,
+          before: Buffer.from(e.before, "utf8"),
+          after: Buffer.from(e.after, "utf8")
+        })),
+        {
+          note: `optimize run ${run.id}`
+        }
+      );
+      checkpoint2 = tx.id;
+      const outDir = join20(ctx.ws.root, "fixes");
+      mkdirSync8(outDir, { recursive: true });
       writeFileSync10(
-        join17(outDir, `${run.id}.json`),
+        join20(outDir, `${run.id}.json`),
         `${JSON.stringify({ run: run.id, checkpoint: checkpoint2, applied: plans.map((p) => ({ fingerprint: p.fingerprint, ruleId: p.ruleId, title: p.title, files: p.edits.map((e) => e.file) })) }, null, 2)}
 `
       );
       lines.push(
-        `Applied ${plans.length} fix(es) to ${finalContent.size} file(s).${checkpoint2 ? ` Checkpoint ${checkpoint2} (jourilo rollback ${checkpoint2}).` : ""}`,
+        `Applied ${plans.length} fix(es) to ${edits.length} file(s) as change ${checkpoint2} (undo: jourilo rollback ${checkpoint2} --yes).`,
         `Next: jourilo verify ${run.id}`
       );
     } else if (plans.length) {
@@ -47278,7 +48952,7 @@ Afterwards run \`jourilo verify <run>\` to repeat the audit and compare.`,
     }
     lines.push(
       "",
-      `${manual.length} other defect(s) need a person or agent; source candidates are in the report (${join17(dir, "report.html")}).`
+      `${manual.length} other defect(s) need a person or agent; source candidates are in the report (${join20(dir, "report.html")}).`
     );
     return {
       data: {
@@ -47299,6 +48973,21 @@ Afterwards run \`jourilo verify <run>\` to repeat the audit and compare.`,
     };
   }
 };
+function metricSummary(metrics) {
+  if (!metrics.length) return [];
+  const n = (v) => metrics.filter((m) => m.verdict === v);
+  const lines = [
+    `  lab metrics: ${n("improved").length} improved \xB7 ${n("regressed").length} regressed \xB7 ${n("noise").length} within noise \xB7 ${n("unconfirmed").length} unconfirmed`,
+    ...[...n("improved"), ...n("regressed")].map(
+      (m) => `    ${m.verdict === "improved" ? "\u2193" : "\u2191"} ${m.name} ${new URL(m.url).pathname} (${m.viewport}): ${m.before} \u2192 ${m.after}`
+    )
+  ];
+  if (n("unconfirmed").length)
+    lines.push(
+      "    Unconfirmed changes come from single visits; repeat with `jourilo audit \u2026 --runs 5` to confirm."
+    );
+  return lines;
+}
 var verify = {
   name: "verify",
   summary: "Repeat a run with the same scope (pages, viewports) after a change and compare: fixed, new, persisting, metric deltas.",
@@ -47316,7 +49005,7 @@ var verify = {
         "INVALID_INPUT",
         `Run ${base2.id} has no recorded scope (created by an older version or by journeys).`
       );
-    const servedDir = (str(ctx, "target") && existsSync15(str(ctx, "target")) ? resolve9(str(ctx, "target")) : void 0) ?? base2.settings.servedDir;
+    const servedDir = (str(ctx, "target") && existsSync17(str(ctx, "target")) ? resolve9(str(ctx, "target")) : void 0) ?? base2.settings.servedDir;
     const server = servedDir ? await serveStatic(servedDir) : void 0;
     try {
       const origin = server?.url ?? new URL(str(ctx, "target") ?? scope.urls[0]).origin;
@@ -47337,6 +49026,8 @@ var verify = {
         allowPrivate: base2.settings.hostClass === "private",
         keyboard: base2.settings.keyboard !== false,
         throttle: base2.settings.throttle === true,
+        // Same number of visits as the baseline, so medians are compared with medians.
+        runs: typeof base2.settings.runs === "number" ? base2.settings.runs : 1,
         timeoutMs: 3e4,
         mask: [],
         mode: base2.mode,
@@ -47372,6 +49063,7 @@ var verify = {
           `  fixed ${cmp.fixed.length} \xB7 new ${cmp.introduced.length} \xB7 still present ${cmp.persisting.length}`,
           ...cmp.fixed.map((f) => `  \u2713 fixed  ${f.title} (${new URL(f.url).pathname})`),
           ...cmp.introduced.map((f) => `  \u2717 new    ${f.severity} ${f.title} (${new URL(f.url).pathname})`),
+          ...metricSummary(cmp.metrics),
           cmp.regressionFree ? "  No new serious/critical defects." : "  \u26A0 Regression: new serious/critical defects.",
           `  Report: ${reports.html}`
         ].join("\n"),
@@ -47391,6 +49083,11 @@ var checkpoint = {
     const repo = resolve9(str(ctx, "repo") ?? ".");
     if (ctx.positionals[0] === "diff") {
       const cp2 = loadCheckpoint(ctx.ws.root, ctx.positionals[1] ?? "latest");
+      if (isTransaction(cp2))
+        return {
+          data: { transaction: cp2, files: previewRollback(cp2) },
+          text: previewRollback(cp2).map((f) => `${f.action.padEnd(9)} ${f.file}${f.reason ? ` (${f.reason})` : ""}`).join("\n")
+        };
       const d = diffSince(repo, cp2);
       return {
         data: { checkpoint: cp2, ...d },
@@ -47409,26 +49106,78 @@ ${d.patch}`
 };
 var rollbackCmd = {
   name: "rollback",
-  summary: "Restore tracked files to a checkpoint (requires --yes). Untracked files created since are listed, not deleted.",
-  usage: "jourilo rollback <checkpoint-id|latest> --yes [--repo .]",
-  options: { repo: { type: "string" }, yes: { type: "boolean" } },
+  summary: "Undo an applied fix (or restore a checkpoint) without overwriting later edits; requires --yes. The rollback can itself be undone.",
+  usage: "jourilo rollback <id|latest> --yes [--repo .] [--file path ...] [--force]",
+  options: {
+    repo: { type: "string" },
+    yes: { type: "boolean" },
+    file: { type: "string", multiple: true },
+    force: { type: "boolean" }
+  },
+  details: `For a change made by \`optimize --apply\` (or a previous rollback), a file is restored only while it still
+holds exactly what Jourilo wrote. A file edited afterwards is reported as a conflict and left alone; --force restores
+it anyway after saving the current bytes under .jourilo/checkpoints/<id>/conflicts/.
+For a checkpoint made with \`jourilo checkpoint\`, every tracked file changed since then is restored (everything you
+or an agent changed in the meantime); the current bytes are kept, and the printed id undoes the rollback.
+Untracked files created after a checkpoint are listed, never deleted.`,
   async run(ctx) {
+    const rec = loadCheckpoint(ctx.ws.root, ctx.positionals[0] ?? "latest");
+    const files = list(ctx, "file");
+    if (isTransaction(rec)) {
+      const preview = previewRollback(rec).filter((f) => !files.length || files.includes(f.file));
+      if (!flag(ctx, "yes"))
+        return {
+          data: { transaction: rec.id, preview },
+          text: [
+            `Change ${rec.id} (${rec.note || "no note"}), ${rec.state}:`,
+            ...preview.map((f) => `  ${f.action.padEnd(9)} ${f.file}${f.reason ? ` \u2014 ${f.reason}` : ""}`),
+            preview.some((f) => f.action === "conflict") ? "Conflicting files are left alone unless you add --force (their current bytes are saved first)." : "",
+            "Re-run with --yes to roll back."
+          ].filter(Boolean).join("\n")
+        };
+      const r2 = rollbackTransaction(ctx.ws.root, rec, {
+        force: flag(ctx, "force"),
+        ...files.length ? { files } : {}
+      });
+      const conflicted = r2.conflicts.filter((c) => !c.savedCopy && !flag(ctx, "force"));
+      return {
+        data: { transaction: rec.id, ...r2 },
+        text: [
+          `Restored ${r2.restored.length} file(s) from change ${rec.id}.`,
+          ...r2.alreadyRestored.map((f) => `  unchanged ${f} (already original)`),
+          ...r2.conflicts.map(
+            (c) => `  ${c.savedCopy ? "forced   " : "conflict "} ${c.file} \u2014 ${c.reason}${c.savedCopy ? ` (your version saved to ${displayPath(c.savedCopy)})` : ""}`
+          ),
+          conflicted.length ? "Conflicting files were not touched. Use --force to restore them anyway." : ""
+        ].filter(Boolean).join("\n"),
+        exitCode: conflicted.length ? 1 : 0
+      };
+    }
+    const cp = rec;
     const repo = resolve9(str(ctx, "repo") ?? ".");
-    const cp = loadCheckpoint(ctx.ws.root, ctx.positionals[0] ?? "latest");
     const d = diffSince(repo, cp);
     if (!flag(ctx, "yes"))
       return {
         data: { checkpoint: cp, wouldRestore: d.stat, newFiles: d.newFiles },
-        text: `Would restore:
+        text: `Would restore (every change since the checkpoint, including your own edits):
 ${d.stat || "(nothing)"}
-Re-run with --yes to roll back.`,
+The current versions are kept and the rollback can be undone. Re-run with --yes to roll back.`,
         exitCode: 0
       };
-    const r = rollback(repo, cp, ctx.ws.root);
+    const r = rollbackCheckpoint(repo, cp, ctx.ws.root, files.length ? { files } : {});
+    if (r.transaction && !files.length) markRolledBack(ctx.ws.root, cp, r.transaction.id);
     return {
-      data: r,
-      text: `Restored ${r.restored.length} file(s) to checkpoint ${cp.id}.${r.leftUntracked.length ? `
-Not removed (created after the checkpoint): ${r.leftUntracked.join(", ")}` : ""}`
+      data: {
+        checkpoint: cp.id,
+        transaction: r.transaction?.id ?? null,
+        restored: r.restored,
+        leftUntracked: r.leftUntracked
+      },
+      text: [
+        `Restored ${r.restored.length} file(s) to checkpoint ${cp.id}.`,
+        r.transaction ? `Undo this rollback with: jourilo rollback ${r.transaction.id} --yes` : "",
+        r.leftUntracked.length ? `Not removed (created after the checkpoint): ${r.leftUntracked.join(", ")}` : ""
+      ].filter(Boolean).join("\n")
     };
   }
 };
@@ -47675,7 +49424,18 @@ function usage() {
   lines.push("Global options: --json (machine-readable stdout), --workspace DIR (default .jourilo), --quiet");
   return lines.join("\n");
 }
+function nodeSupported(version) {
+  const [major = 0, minor = 0] = version.replace(/^v/, "").split(".").map(Number);
+  return major > 20 || major === 20 && minor >= 10;
+}
 async function main(argv) {
+  if (!nodeSupported(process.versions.node)) {
+    process.stderr.write(
+      `Jourilo needs Node.js 20.10 or newer (this is ${process.versions.node}). Install a current LTS from https://nodejs.org.
+`
+    );
+    return 2;
+  }
   const [name, ...rest] = argv;
   if (!name || name === "--help" || name === "-h" || name === "help") {
     process.stdout.write(`${usage()}
@@ -47736,7 +49496,8 @@ main(process.argv.slice(2)).then((code) => {
   process.exitCode = code;
 });
 export {
-  main
+  main,
+  nodeSupported
 };
 /*! Bundled license information: