scenri 0.9.1 → 0.9.3

package/dist/serve.js

@@ -1,6 +1,6 @@
 import { createUpdateChecker, classify, isReleaseTriplet, findNpm, stageVersion } from './chunk-FYQ5BAFA.js';
 import { shouldAdoptRunning, anotherScenriLines, portBusyLines } from './chunk-CMLJGPYC.js';
-import { SchemaTooNewError, createCore, BUDGET_EXHAUSTED, SpendCapError, budgetSize, EDIT_REFERENCE_ROLE_DIRECTIVE, REFERENCE_ROLE_DIRECTIVE, ratioLabel, searchTerms, termMatches, SCHEMA_VERSION, ASPECT_TOLERANCE } from './chunk-OJAG3FRX.js';
+import { SchemaTooNewError, createCore, BUDGET_EXHAUSTED, SpendCapError, budgetSize, EDIT_REFERENCE_ROLE_DIRECTIVE, REFERENCE_ROLE_DIRECTIVE, ratioLabel, searchTerms, termMatches, SCHEMA_VERSION, ASPECT_TOLERANCE } from './chunk-Y5L3KLX5.js';
 import { detectInstallKind } from './chunk-PAIAXRAC.js';
 export { detectInstallKind } from './chunk-PAIAXRAC.js';
 import { readMeta, repoSlug } from './chunk-Y3ZPBPLP.js';
@@ -12,7 +12,7 @@ import { homedir, networkInterfaces, tmpdir } from 'os';
 import { randomBytes, randomUUID, timingSafeEqual, createHash } from 'crypto';
 import { readFile, copyFile, stat, readdir, mkdtemp, rm, access, rename, unlink, writeFile } from 'fs/promises';
 import { spawn } from 'child_process';
-import sharp20 from 'sharp';
+import sharp21 from 'sharp';
 import Fastify from 'fastify';
 import fastifyStatic from '@fastify/static';
 import fastifyMultipart from '@fastify/multipart';
@@ -20,6 +20,8 @@ import JSZip from 'jszip';
 import { Ajv2020 } from 'ajv/dist/2020.js';
 import addFormats from 'ajv-formats';
 import * as cheerio from 'cheerio';
+import { lookup } from 'dns/promises';
+import { isIP } from 'net';
 import { parse } from 'node-html-parser';
 import pixelmatch from 'pixelmatch';
 import { PNG } from 'pngjs';
@@ -687,6 +689,108 @@ function resolveCodex(platform, spawnImpl, timeoutMs = WHERE_TIMEOUT_MS) {
   });
 }
 
+// ../engines/codex/src/childEnv.ts
+function buildChildEnv(parent, drop) {
+  if (drop.length === 0) return { ...parent };
+  const unwanted = new Set(drop.map((name) => name.toUpperCase()));
+  const child = {};
+  for (const [name, value] of Object.entries(parent)) {
+    if (unwanted.has(name.toUpperCase())) continue;
+    child[name] = value;
+  }
+  return child;
+}
+
+// ../engines/codex/src/classify.ts
+var CONFLICT_ENV_KEYS = ["CODEX_API_KEY", "CODEX_ACCESS_TOKEN", "OPENAI_API_KEY"];
+function presentConflictKeys(env, ignored = []) {
+  const dropped = new Set(ignored.map((n) => n.toUpperCase()));
+  const present = [];
+  for (const name of CONFLICT_ENV_KEYS) {
+    if (dropped.has(name)) continue;
+    const value = env[name];
+    if (typeof value === "string" && value.trim() !== "") present.push(name);
+  }
+  return present;
+}
+function listKeys(keys) {
+  if (keys.length === 0) return "";
+  if (keys.length === 1) return keys[0];
+  return `${keys.slice(0, -1).join(", ")} and ${keys[keys.length - 1]}`;
+}
+function conflictReason(keys) {
+  return `Codex is signed in, but ${listKeys(keys)} in this computer's environment is overriding that sign-in and OpenAI rejected it.`;
+}
+var NOT_FOUND = /failed to spawn codex|\bENOENT\b|command not found|is not recognized as an internal/i;
+var TOO_OLD = /requires a newer version of Codex|is too old/i;
+var USAGE_LIMIT = /usage limit/i;
+var SIGNED_OUT = /not logged in|login required|run .{0,3}codex login|no credentials found/i;
+var UNAUTHORIZED = /\b401\b|unauthorized/i;
+var BAD_KEY = /incorrect api key provided|invalid_api_key|invalid api key/i;
+var NETWORK = /ENOTFOUND|ECONNREFUSED|ECONNRESET|EAI_AGAIN|getaddrinfo|error sending request|dns error|tls handshake/i;
+var NO_OUTPUT = /produced no output for \d+s/i;
+var TIMED_OUT = /timed out after/i;
+var ALREADY_CONFLICT = /environment is overriding that sign-in/i;
+function classifyCodexFailure(input) {
+  const text = input.text ?? "";
+  const conflictKeys = presentConflictKeys(input.env, input.ignored);
+  const at = (code, reason) => ({ code, conflictKeys, reason });
+  if (ALREADY_CONFLICT.test(text)) return at("CODEX_AUTH_CONFLICT", conflictReason(conflictKeys));
+  if (NOT_FOUND.test(text)) return at("CODEX_NOT_FOUND", "Codex CLI is not installed on this computer.");
+  if (TOO_OLD.test(text)) return at("CODEX_VERSION_TOO_OLD", "Codex CLI on this computer is too old.");
+  if (USAGE_LIMIT.test(text)) return at("CODEX_USAGE_LIMIT", "Your Codex plan's usage limit is used up.");
+  if (SIGNED_OUT.test(text)) return at("CODEX_NOT_AUTHENTICATED", "Codex CLI is signed out on this computer.");
+  if (UNAUTHORIZED.test(text)) {
+    if (BAD_KEY.test(text) && conflictKeys.length > 0) return at("CODEX_AUTH_CONFLICT", conflictReason(conflictKeys));
+    return at("CODEX_401", "OpenAI did not accept the Codex sign-in on this computer.");
+  }
+  if (NETWORK.test(text)) return at("NETWORK_FAILURE", "Codex could not reach OpenAI.");
+  if (NO_OUTPUT.test(text)) return at("CODEX_NO_OUTPUT", "Codex never started answering.");
+  if (TIMED_OUT.test(text)) return at("CODEX_TIMEOUT", "Codex ran out of time.");
+  if (text.trim() !== "") return at("CODEX_EXECUTION_FAILED", "Codex stopped with an error.");
+  return at("UNKNOWN", "Codex stopped for a reason it did not give.");
+}
+
+// ../engines/codex/src/connect.ts
+var CONNECT_PROMPT = "Reply with the single word READY. Do not use any tools. Do not generate an image. Do not read or write any files.";
+var CONNECT_TIMEOUT_MS = 45e3;
+var CONNECT_TTL_MS = 10 * 6e4;
+function connectFingerprint(p) {
+  return [p.command, p.version ?? "unknown", [...p.present].sort().join("+"), [...p.ignored].sort().join("+")].join(
+    "|"
+  );
+}
+function outcomeFor(code) {
+  switch (code) {
+    case "CODEX_AUTH_CONFLICT":
+    case "CODEX_401":
+    case "CODEX_NOT_AUTHENTICATED":
+    case "CODEX_NOT_FOUND":
+    case "CODEX_VERSION_TOO_OLD":
+      return "refused";
+    default:
+      return "unproven";
+  }
+}
+function availabilityFrom(shallow, conn) {
+  if (!shallow.ok) return shallow;
+  if (!conn || conn.outcome !== "refused" || !conn.failure) return shallow;
+  const { code, reason } = conn.failure;
+  switch (code) {
+    case "CODEX_AUTH_CONFLICT":
+      return { ok: false, reason, code: "env-conflict" };
+    case "CODEX_401":
+    case "CODEX_NOT_AUTHENTICATED":
+      return { ok: false, reason, code: "not-authenticated" };
+    case "CODEX_VERSION_TOO_OLD":
+      return { ok: false, reason, code: "update-needed" };
+    case "CODEX_NOT_FOUND":
+      return { ok: false, reason, code: "not-installed" };
+    default:
+      return shallow;
+  }
+}
+
 // ../engines/codex/src/run.ts
 var NOT_INSTALLED_REASON = "Codex CLI is not installed on this computer";
 var NOT_AUTHENTICATED_REASON = "Codex CLI is installed but not signed in";
@@ -740,6 +844,11 @@ function codexFailureDetail(stderr, stdout) {
   const marked = body.startsWith("ERROR:") ? body : errorAt >= 0 ? body.slice(errorAt + 1) : "";
   return tailOf(marked) || tailOf(body) || tailOf(stdout.trim()) || tailOf(stderr.trim());
 }
+var MODEL_NEEDS_NEWER_CODEX = /The '([^']+)' model requires a newer version of Codex/;
+var BAD_KEY_401 = /incorrect api key provided|invalid_api_key|invalid api key/i;
+function tooOldForModel(version, model) {
+  return `Codex CLI ${version ?? "on this computer"} is too old for the model it is set to, ${model}.`;
+}
 function killTree(child, platform, spawnImpl) {
   if (platform === "win32" && child.pid) {
     try {
@@ -777,16 +886,23 @@ function createRunner(opts = {}) {
   const probeTtlMs = opts.probeTtlMs ?? PROBE_TTL_MS;
   const firstOutputMs = opts.firstOutputMs ?? FIRST_OUTPUT_TIMEOUT_MS;
   const platform = opts.platform ?? process.platform;
+  const connectTtlMs = opts.connectTtlMs ?? CONNECT_TTL_MS;
+  const connectTimeoutMs = opts.connectTimeoutMs ?? CONNECT_TIMEOUT_MS;
+  const parentEnv = opts.env ?? process.env;
+  const ignoreEnvKeys = opts.ignoreEnvKeys ?? (() => []);
   const killCodex = (child) => killTree(child, platform, spawnImpl);
   let resolved = null;
   async function resolution() {
     resolved ??= await resolveCodex(platform, spawnImpl);
     return resolved;
   }
+  let knownVersion = null;
+  let tooOldFor = null;
   const winArg = (a) => `"${a.replace(/[\r\n]+/g, " ").replace(/"/g, "'").replace(/%/g, " percent ")}"`;
   const spawnCodex = (exe, args, stdinOpen) => {
     const stdio = [stdinOpen ? "pipe" : "ignore", "pipe", "pipe"];
-    return exe.direct ? spawnImpl(exe.command, args, { stdio, ...platform !== "win32" ? { detached: true } : {} }) : spawnImpl([exe.command, ...args.map(winArg)].join(" "), [], { stdio, shell: true });
+    const env = buildChildEnv(parentEnv, ignoreEnvKeys());
+    return exe.direct ? spawnImpl(exe.command, args, { stdio, env, ...platform !== "win32" ? { detached: true } : {} }) : spawnImpl([exe.command, ...args.map(winArg)].join(" "), [], { stdio, env, shell: true });
   };
   async function run2(args, signal, io) {
     const exe = await resolution();
@@ -890,6 +1006,27 @@ function createRunner(opts = {}) {
           );
           return;
         }
+        const newer = MODEL_NEEDS_NEWER_CODEX.exec(stderr);
+        if (newer) {
+          const model = newer[1];
+          tooOldFor = { version: knownVersion, model };
+          invalidateProbe();
+          finish(
+            `exit-${code ?? "unknown"}`,
+            () => reject(new Error(`${tooOldForModel(knownVersion, model)} Update Codex CLI, then run this again.`))
+          );
+          return;
+        }
+        const conflicting = presentConflictKeys(parentEnv, ignoreEnvKeys());
+        if (conflicting.length > 0 && /\b401\b|unauthorized/i.test(stderr) && BAD_KEY_401.test(stderr)) {
+          noteConnection("refused", {
+            code: "CODEX_AUTH_CONFLICT",
+            conflictKeys: conflicting,
+            reason: conflictReason(conflicting)
+          });
+          finish(`exit-${code ?? "unknown"}`, () => reject(new Error(conflictReason(conflicting))));
+          return;
+        }
         const snippet2 = codexFailureDetail(stderr, stdout);
         finish(
           `exit-${code ?? "unknown"}`,
@@ -949,6 +1086,23 @@ function createRunner(opts = {}) {
     return avail;
   }
   let cached = null;
+  let connCache = null;
+  let connectInFlight = null;
+  function fingerprintFor(exe, version) {
+    const ignored = ignoreEnvKeys();
+    return connectFingerprint({
+      command: exe.command,
+      version,
+      present: presentConflictKeys(parentEnv, ignored),
+      ignored
+    });
+  }
+  function freshConnection(exe, version) {
+    if (!connCache || connectTtlMs <= 0) return null;
+    if (Date.now() - connCache.at >= connectTtlMs) return null;
+    if (connCache.fingerprint !== fingerprintFor(exe, version)) return null;
+    return connCache;
+  }
   async function probe() {
     if (process.env.SCENRI_NO_CODEX === "1") {
       return { ok: false, reason: NOT_INSTALLED_REASON, code: "not-installed" };
@@ -961,41 +1115,128 @@ function createRunner(opts = {}) {
     return value;
   }
   async function probeUncached() {
+    const { avail, exe, version } = await probeLadder();
+    return availabilityFrom(avail, freshConnection(exe, version));
+  }
+  async function probeLadder() {
     resolved = await resolveCodex(platform, spawnImpl);
     const exe = resolved;
     const ver = await probeSpawn(exe, ["--version"]);
     if (ver.outcome === "timeout") {
-      return verdict({ ok: false, reason: UNVERIFIED_REASON, code: "unverified" }, exe, null);
+      return {
+        avail: verdict({ ok: false, reason: UNVERIFIED_REASON, code: "unverified" }, exe, null),
+        exe,
+        version: null
+      };
     }
     if (ver.outcome !== "ok") {
-      return verdict({ ok: false, reason: NOT_INSTALLED_REASON, code: "not-installed" }, exe, null);
+      return {
+        avail: verdict({ ok: false, reason: NOT_INSTALLED_REASON, code: "not-installed" }, exe, null),
+        exe,
+        version: null
+      };
     }
     const version = parseCodexVersion(ver.stdout);
+    knownVersion = version;
     if (version && !versionAtLeast(version, MIN_CODEX_VERSION)) {
-      return verdict(
-        {
-          ok: false,
-          reason: `Codex CLI ${version} is too old. Scenri needs ${MIN_CODEX_VERSION} or newer.`,
-          code: "update-needed"
-        },
+      return {
+        avail: verdict(
+          {
+            ok: false,
+            reason: `Codex CLI ${version} is too old. Scenri needs ${MIN_CODEX_VERSION} or newer.`,
+            code: "update-needed"
+          },
+          exe,
+          version
+        ),
         exe,
         version
-      );
+      };
+    }
+    if (tooOldFor) {
+      if (version === tooOldFor.version) {
+        return {
+          avail: verdict(
+            { ok: false, reason: tooOldForModel(version, tooOldFor.model), code: "update-needed" },
+            exe,
+            version
+          ),
+          exe,
+          version
+        };
+      }
+      tooOldFor = null;
     }
     const login = await probeSpawn(exe, ["login", "status"]);
     if (login.outcome === "ok") {
-      return verdict({ ok: true }, exe, version);
+      return { avail: verdict({ ok: true }, exe, version), exe, version };
     }
     if (login.outcome === "nonzero") {
-      return verdict({ ok: false, reason: NOT_AUTHENTICATED_REASON, code: "not-authenticated" }, exe, version);
+      return {
+        avail: verdict({ ok: false, reason: NOT_AUTHENTICATED_REASON, code: "not-authenticated" }, exe, version),
+        exe,
+        version
+      };
+    }
+    return { avail: verdict({ ok: false, reason: UNVERIFIED_REASON, code: "unverified" }, exe, version), exe, version };
+  }
+  async function connect(o = {}) {
+    if (connectInFlight) return connectInFlight;
+    const pending = (async () => {
+      const { avail, exe, version } = await probeLadder();
+      const fingerprint = fingerprintFor(exe, version);
+      if (!o.force) {
+        const fresh = freshConnection(exe, version);
+        if (fresh) return fresh;
+      }
+      if (!avail.ok) {
+        return { outcome: "unproven", at: Date.now(), fingerprint };
+      }
+      let result;
+      try {
+        await withWorkDir(
+          (dir) => run2(execArgs(dir), void 0, {
+            stdin: CONNECT_PROMPT,
+            timeoutMs: connectTimeoutMs,
+            label: "connect"
+          })
+        );
+        result = { outcome: "proven", at: Date.now(), fingerprint };
+      } catch (err) {
+        const failure = classifyCodexFailure({
+          text: err instanceof Error ? err.message : String(err),
+          env: parentEnv,
+          ignored: ignoreEnvKeys()
+        });
+        result = { outcome: outcomeFor(failure.code), failure, at: Date.now(), fingerprint };
+      }
+      connCache = result;
+      cached = null;
+      return result;
+    })();
+    connectInFlight = pending;
+    try {
+      return await pending;
+    } finally {
+      connectInFlight = null;
     }
-    return verdict({ ok: false, reason: UNVERIFIED_REASON, code: "unverified" }, exe, version);
+  }
+  function noteConnection(outcome, failure) {
+    if (outcome === "unproven") return;
+    const exe = resolved;
+    if (!exe) return;
+    connCache = { outcome, failure, at: Date.now(), fingerprint: fingerprintFor(exe, knownVersion) };
+    cached = null;
   }
   function invalidateProbe() {
     cached = null;
     resolved = null;
   }
-  return { run: run2, withWorkDir, probe, invalidateProbe };
+  function invalidateConnection() {
+    connCache = null;
+    cached = null;
+  }
+  return { run: run2, withWorkDir, probe, invalidateProbe, connect, invalidateConnection, noteConnection };
 }
 var OUT_FILE = "analysis.json";
 function createCodexAnalyzer(opts = {}) {
@@ -1154,6 +1395,7 @@ function pick(v, allowed, max) {
 var INSTALL_COMMAND = "npm install -g @openai/codex";
 var INSTALL_DOCS_URL = "https://developers.openai.com/codex/cli";
 var INSTALL_COMMAND_SUDO = "sudo npm install -g @openai/codex";
+var INSTALL_COMMAND_WINDOWS = 'powershell -ExecutionPolicy ByPass -c "irm https://chatgpt.com/codex/install.ps1 | iex"';
 var DEFAULT_INSTALL_TIMEOUT_MS = 18e4;
 function stateFrom(avail) {
   if (avail.ok) return "ready";
@@ -1161,6 +1403,7 @@ function stateFrom(avail) {
     case "not-authenticated":
     case "update-needed":
     case "unverified":
+    case "env-conflict":
       return avail.code;
     default:
       return "not-installed";
@@ -1171,6 +1414,7 @@ function createCodexSetup(opts = {}) {
   const platform = opts.platform ?? process.platform;
   const runner = opts.runner ?? createRunner(opts);
   const installTimeoutMs = opts.installTimeoutMs ?? DEFAULT_INSTALL_TIMEOUT_MS;
+  const ignoreEnvKeys = opts.ignoreEnvKeys ?? (() => []);
   function run2(cmd, args, timeoutMs) {
     return new Promise((resolve) => {
       let settled = false;
@@ -1202,11 +1446,22 @@ function createCodexSetup(opts = {}) {
     });
   }
   return {
-    async status() {
+    async status(o = {}) {
       runner.invalidateProbe();
+      if (o.force) runner.invalidateConnection();
+      const conn = await runner.connect();
       const avail = await runner.probe();
+      const state = stateFrom(avail);
       const setupPlatform = platform === "win32" ? "windows" : platform === "darwin" ? "mac" : "linux";
-      return { state: stateFrom(avail), reason: avail.reason, platform: setupPlatform };
+      return {
+        state,
+        reason: avail.reason,
+        platform: setupPlatform,
+        conflictKeys: state === "env-conflict" ? conn.failure?.conflictKeys ?? [] : [],
+        ignoredKeys: [...ignoreEnvKeys()].filter(
+          (k) => CONFLICT_ENV_KEYS.includes(k)
+        )
+      };
     },
     async install() {
       const res = await run2("npm", ["install", "-g", "@openai/codex"], installTimeoutMs);
@@ -1223,6 +1478,14 @@ function createCodexSetup(opts = {}) {
         }
         return { ok: true };
       }
+      if (platform === "win32" && /EPERM|EACCES|EBUSY|permission denied|operation not permitted/i.test(res.stderr)) {
+        return {
+          ok: false,
+          fallbackCommand: INSTALL_COMMAND_WINDOWS,
+          docsUrl: INSTALL_DOCS_URL,
+          detail: "npm could not write its files. This is almost never about administrator rights: close Codex and any terminal window using it, then try again. If it keeps failing, the command below is OpenAI\u2019s own installer, which does not go through npm."
+        };
+      }
       if (platform !== "win32" && /EACCES|permission denied/i.test(res.stderr)) {
         return {
           ok: false,
@@ -1424,6 +1687,7 @@ function createCodexEngine(opts) {
                 fatal = err;
                 inner.abort();
                 runner.invalidateProbe();
+                noteFromError(err);
               }
             }
           }
@@ -1486,7 +1750,10 @@ function createCodexEngine(opts) {
         try {
           await runCodex(args, signal, { stdin: promptText, label: `edit refs=${editRefs.length}` });
         } catch (err) {
-          if (isFatalSetupError(err)) runner.invalidateProbe();
+          if (isFatalSetupError(err)) {
+            runner.invalidateProbe();
+            noteFromError(err);
+          }
           throw err;
         }
         const images = await collectImages(dir, before);
@@ -1495,10 +1762,17 @@ function createCodexEngine(opts) {
     }
   };
   function isFatalSetupError(err) {
-    return /failed to spawn|ENOENT|not logged in|login required|401|unauthorized/i.test(
+    return /failed to spawn|ENOENT|not logged in|login required|401|unauthorized|is too old|environment is overriding/i.test(
       String(err?.message ?? err)
     );
   }
+  function noteFromError(err) {
+    const failure = classifyCodexFailure({
+      text: String(err?.message ?? err),
+      env: process.env
+    });
+    runner.noteConnection(outcomeFor(failure.code), failure);
+  }
   function buildPrompt2(req, index, roles) {
     const variation = req.variations?.[index] ?? "";
     const roleDirective = REFERENCE_ROLE_DIRECTIVE;
@@ -1538,9 +1812,15 @@ function createCodexEngine(opts) {
 function keyGetter(core, settingKey, envVar) {
   return () => core.store.getSetting(settingKey) || process.env[envVar] || null;
 }
+var IGNORE_ENV_KEYS_SETTING = "codex.ignore_env_keys";
+function ignoreEnvKeysGetter(core) {
+  return () => (core.store.getSetting(IGNORE_ENV_KEYS_SETTING) ?? "").split(",").map((name) => name.trim().toUpperCase()).filter(
+    (name) => CONFLICT_ENV_KEYS.includes(name)
+  );
+}
 function createEngineRegistry(core, extra = []) {
   const saveImage = (buf) => core.images.save(buf);
-  const codexRunner = createRunner();
+  const codexRunner = createRunner({ ignoreEnvKeys: ignoreEnvKeysGetter(core) });
   const adapters = [
     createOpenRouterEngine({ getKey: keyGetter(core, "openrouter_api_key", "OPENROUTER_API_KEY"), saveImage }),
     createReplicateEngine({ getKey: keyGetter(core, "replicate_api_token", "REPLICATE_API_TOKEN"), saveImage }),
@@ -1599,7 +1879,7 @@ function createDemoEngine(saveImage, opts = {}) {
       <text x="24" y="${h - 48}" font-family="Helvetica, Arial" font-size="${Math.max(14, Math.round(w / 42))}" fill="#ffffff" opacity="0.92">${esc(label)}</text>
       <text x="24" y="${h - 22}" font-family="Helvetica, Arial" font-size="12" fill="#ffffff" opacity="0.6">Scenri demo engine</text>
     </svg>`;
-    return sharp20(Buffer.from(svg)).png().toBuffer();
+    return sharp21(Buffer.from(svg)).png().toBuffer();
   }
   return {
     capabilities() {
@@ -1790,7 +2070,7 @@ var resolvedRefs = /* @__PURE__ */ new Map();
 async function refHash(core, path) {
   const hit = resolvedRefs.get(path);
   if (hit && core.images.has(hit)) return hit;
-  const hash = core.images.save(await sharp20(readFileSync(path)).png().toBuffer());
+  const hash = core.images.save(await sharp21(readFileSync(path)).png().toBuffer());
   resolvedRefs.set(path, hash);
   return hash;
 }
@@ -1894,7 +2174,7 @@ var resolvedRefs2 = /* @__PURE__ */ new Map();
 async function refHash2(core, path) {
   const hit = resolvedRefs2.get(path);
   if (hit && core.images.has(hit)) return hit;
-  const hash = core.images.save(await sharp20(readFileSync(path)).png().toBuffer());
+  const hash = core.images.save(await sharp21(readFileSync(path)).png().toBuffer());
   resolvedRefs2.set(path, hash);
   return hash;
 }
@@ -2048,7 +2328,7 @@ function createThumbStore(core, opts = {}) {
   const pathFor = (key, w) => join(dir, `${key}-w${w}.webp`);
   const inflight = /* @__PURE__ */ new Map();
   const failed = /* @__PURE__ */ new Set();
-  const concurrency = Math.max(1, opts.concurrency ?? 2);
+  const concurrency = Math.max(1, opts.concurrency ?? 4);
   let active = 0;
   const waiting = [];
   const acquire = () => new Promise((resolve) => {
@@ -2067,7 +2347,7 @@ function createThumbStore(core, opts = {}) {
     const tmp = `${final}.${process.pid}.${Math.random().toString(36).slice(2, 8)}.tmp`;
     await acquire();
     try {
-      await sharp20(source).resize({ width: w, withoutEnlargement: true }).webp({ quality: QUALITY[w], effort: 4 }).toFile(tmp);
+      await sharp21(source).resize({ width: w, withoutEnlargement: true }).webp({ quality: QUALITY[w], effort: 4 }).toFile(tmp);
       await rename(tmp, final);
       return final;
     } catch {
@@ -2157,7 +2437,7 @@ var assetHash = (ref) => {
 };
 var LOGO_ROLES = ["primary", "mark", "wordmark", "monochrome", "alternate"];
 var LOGO_BACKGROUNDS = ["light", "dark", "any"];
-var toPng = (buf) => sharp20(buf).rotate().png().toBuffer();
+var toPng = (buf) => sharp21(buf).rotate().png().toBuffer();
 var COST_PROBE = {
   prompt: "",
   brand: { brand: {}, assetPaths: {} },
@@ -2170,11 +2450,11 @@ var MARK_MIN_EDGE = 1024;
 var MARK_TINY_EDGE = 256;
 var MARK_WARN_EDGE = 512;
 var toMarkPng = async (buf) => {
-  const out = await sharp20(buf, { density: 384 }).rotate().resize({ width: MARK_MAX_EDGE, height: MARK_MAX_EDGE, fit: "inside", withoutEnlargement: true }).png().toBuffer();
-  const meta = await sharp20(out).metadata();
+  const out = await sharp21(buf, { density: 384 }).rotate().resize({ width: MARK_MAX_EDGE, height: MARK_MAX_EDGE, fit: "inside", withoutEnlargement: true }).png().toBuffer();
+  const meta = await sharp21(out).metadata();
   const edge = Math.max(meta.width ?? 0, meta.height ?? 0);
   if (edge >= MARK_TINY_EDGE && edge < MARK_MIN_EDGE) {
-    return sharp20(out).resize({ width: MARK_MIN_EDGE, height: MARK_MIN_EDGE, fit: "inside", kernel: "lanczos3" }).png().toBuffer();
+    return sharp21(out).resize({ width: MARK_MIN_EDGE, height: MARK_MIN_EDGE, fit: "inside", kernel: "lanczos3" }).png().toBuffer();
   }
   return out;
 };
@@ -2185,9 +2465,9 @@ async function capReferenceEdge(core, path, maxEdge) {
   if (hit) return hit;
   let out = path;
   try {
-    const meta = await sharp20(path).metadata();
+    const meta = await sharp21(path).metadata();
     if ((meta.width ?? 0) > maxEdge || (meta.height ?? 0) > maxEdge) {
-      const buf = await sharp20(path).resize({ width: maxEdge, height: maxEdge, fit: "inside", withoutEnlargement: true }).png().toBuffer();
+      const buf = await sharp21(path).resize({ width: maxEdge, height: maxEdge, fit: "inside", withoutEnlargement: true }).png().toBuffer();
       out = core.images.pathFor(core.images.save(buf));
     }
   } catch {
@@ -3463,13 +3743,122 @@ function validateBrand(json) {
     errors: valid ? [] : (compiled.errors ?? []).map((e) => `${e.instancePath || "/"} ${e.message}`)
   };
 }
-var HEX_RE = /#[0-9a-fA-F]{6}\b/g;
-var FETCH_TIMEOUT_MS = 15e3;
+
+// ../brand-spec/src/colorParse.ts
+var CLAMP = (n) => Math.min(255, Math.max(0, Math.round(n)));
+var hex2 = (n) => CLAMP(n).toString(16).padStart(2, "0");
+var rgbHex = (r, g, b) => `#${hex2(r)}${hex2(g)}${hex2(b)}`;
+var MIN_ALPHA = 0.35;
+var NUM = String.raw`[-+]?[\d.]+%?`;
+var RGB_RE = new RegExp(String.raw`^rgba?\(\s*(${NUM})[\s,]+(${NUM})[\s,]+(${NUM})(?:[\s,/]+(${NUM}))?\s*\)$`, "i");
+var HSL_RE = new RegExp(
+  String.raw`^hsla?\(\s*(${NUM}|[-+]?[\d.]+deg)[\s,]+(${NUM})[\s,]+(${NUM})(?:[\s,/]+(${NUM}))?\s*\)$`,
+  "i"
+);
+var OKLCH_RE = new RegExp(
+  String.raw`^oklch\(\s*(${NUM})[\s,]+(${NUM})[\s,]+([-+]?[\d.]+)(?:deg)?(?:[\s,/]+(${NUM}))?\s*\)$`,
+  "i"
+);
+function scalar(token, full) {
+  const t = token.trim();
+  if (t.endsWith("%")) return Number.parseFloat(t) / 100 * full;
+  return Number.parseFloat(t);
+}
+function alphaOk(token) {
+  if (token == null) return true;
+  const a = token.trim().endsWith("%") ? Number.parseFloat(token) / 100 : Number.parseFloat(token);
+  return !Number.isNaN(a) && a >= MIN_ALPHA;
+}
+function toHex(value) {
+  const v = value.trim().toLowerCase();
+  const hex = /^#([0-9a-f]{3,8})$/.exec(v);
+  if (hex) {
+    const d = hex[1];
+    if (d.length === 3 || d.length === 4) {
+      if (d.length === 4 && !alphaOk(String(Number.parseInt(d[3] + d[3], 16) / 255))) return null;
+      return `#${d[0]}${d[0]}${d[1]}${d[1]}${d[2]}${d[2]}`;
+    }
+    if (d.length === 6) return `#${d}`;
+    if (d.length === 8) {
+      if (!alphaOk(String(Number.parseInt(d.slice(6, 8), 16) / 255))) return null;
+      return `#${d.slice(0, 6)}`;
+    }
+    return null;
+  }
+  const rgb = RGB_RE.exec(v);
+  if (rgb) {
+    if (!alphaOk(rgb[4])) return null;
+    return rgbHex(scalar(rgb[1], 255), scalar(rgb[2], 255), scalar(rgb[3], 255));
+  }
+  const hsl = HSL_RE.exec(v);
+  if (hsl) {
+    if (!alphaOk(hsl[4])) return null;
+    return hslHex(Number.parseFloat(hsl[1]), scalar(hsl[2], 1), scalar(hsl[3], 1));
+  }
+  const oklch = OKLCH_RE.exec(v);
+  if (oklch) {
+    if (!alphaOk(oklch[4])) return null;
+    return oklchHex(scalar(oklch[1], 1), Number.parseFloat(oklch[2]), Number.parseFloat(oklch[3]));
+  }
+  return null;
+}
+function hslHex(h, s, l) {
+  const c = (1 - Math.abs(2 * l - 1)) * s;
+  const hp = (h % 360 + 360) % 360 / 60;
+  const x = c * (1 - Math.abs(hp % 2 - 1));
+  const [r, g, b] = hp < 1 ? [c, x, 0] : hp < 2 ? [x, c, 0] : hp < 3 ? [0, c, x] : hp < 4 ? [0, x, c] : hp < 5 ? [x, 0, c] : [c, 0, x];
+  const m = l - c / 2;
+  return rgbHex((r + m) * 255, (g + m) * 255, (b + m) * 255);
+}
+function oklchHex(L, C, hDeg) {
+  const h = hDeg * Math.PI / 180;
+  const a = C * Math.cos(h);
+  const bb = C * Math.sin(h);
+  const l_ = L + 0.3963377774 * a + 0.2158037573 * bb;
+  const m_ = L - 0.1055613458 * a - 0.0638541728 * bb;
+  const s_ = L - 0.0894841775 * a - 1.291485548 * bb;
+  const l = l_ ** 3;
+  const m = m_ ** 3;
+  const s = s_ ** 3;
+  const lr = 4.0767416621 * l - 3.3077115913 * m + 0.2309699292 * s;
+  const lg = -1.2684380046 * l + 2.6097574011 * m - 0.3413193965 * s;
+  const lb = -0.0041960863 * l - 0.7034186147 * m + 1.707614701 * s;
+  const gamma = (u) => u <= 31308e-7 ? 12.92 * u : 1.055 * Math.abs(u) ** (1 / 2.4) - 0.055;
+  return rgbHex(gamma(lr) * 255, gamma(lg) * 255, gamma(lb) * 255);
+}
+var DECL_RE = /(--[\w-]+|[\w-]+)\s*:\s*([^;{}]*?(?:#[0-9a-fA-F]{3,8}|rgba?\([^)]*\)|hsla?\([^)]*\)|oklch\([^)]*\))[^;{}]*)/g;
+var TOKEN_RE = /#[0-9a-fA-F]{3,8}\b|rgba?\([^)]*\)|hsla?\([^)]*\)|oklch\([^)]*\)/g;
+function extractColors(css) {
+  const out = [];
+  const blocks = css.split("}");
+  for (const block of blocks) {
+    const brace = block.lastIndexOf("{");
+    const context = brace >= 0 ? block.slice(Math.max(0, brace - 200), brace) : "";
+    const body = brace >= 0 ? block.slice(brace + 1) : block;
+    DECL_RE.lastIndex = 0;
+    let decl = DECL_RE.exec(body);
+    while (decl !== null) {
+      const property = decl[1];
+      TOKEN_RE.lastIndex = 0;
+      let token = TOKEN_RE.exec(decl[2]);
+      while (token !== null) {
+        const hex = toHex(token[0]);
+        if (hex) out.push({ hex: hex.toLowerCase(), property, context });
+        token = TOKEN_RE.exec(decl[2]);
+      }
+      decl = DECL_RE.exec(body);
+    }
+  }
+  return out;
+}
+
+// ../brand-spec/src/colors.ts
 function hexToHsl(hex) {
-  const r = parseInt(hex.slice(1, 3), 16) / 255;
-  const g = parseInt(hex.slice(3, 5), 16) / 255;
-  const b = parseInt(hex.slice(5, 7), 16) / 255;
-  const max = Math.max(r, g, b), min = Math.min(r, g, b);
+  const r = Number.parseInt(hex.slice(1, 3), 16) / 255;
+  const g = Number.parseInt(hex.slice(3, 5), 16) / 255;
+  const b = Number.parseInt(hex.slice(5, 7), 16) / 255;
+  const max = Math.max(r, g, b);
+  const min = Math.min(r, g, b);
   const l = (max + min) / 2;
   if (max === min) return { h: 0, s: 0, l };
   const d = max - min;
@@ -3480,15 +3869,111 @@ function hexToHsl(hex) {
   else h = ((r - g) / d + 4) / 6;
   return { h: h * 360, s, l };
 }
-function pickPalette(colors) {
+var BRANDISH_VAR = /--(?:[\w-]*)(brand|primary|accent|secondary|theme|main)/i;
+var FRAMEWORK_VAR = /^--(tw-|[\w-]*-(?:50|\d{3})$)/i;
+var UTILITY_CLASS = /\.(bg|text|border|fill|stroke|ring|from|via|to|shadow|outline|divide|accent|caret|decoration|placeholder)-[a-z]+-\d{2,3}\b/i;
+var INTERACTIVE = /(btn|button|cta|primary|brand|badge|header|nav\b|link|hero)/i;
+function weightOf(hit) {
+  if (FRAMEWORK_VAR.test(hit.property) || UTILITY_CLASS.test(hit.context)) return 0;
+  if (hit.property.startsWith("--")) return BRANDISH_VAR.test(hit.property) ? 6 : 2;
+  if (INTERACTIVE.test(hit.context) || INTERACTIVE.test(hit.property)) return 3;
+  return 1;
+}
+function liveClassTokens($) {
+  const tokens = /* @__PURE__ */ new Set();
+  for (const sel of ["html", "body"]) {
+    for (const cls of ($(sel).first().attr("class") ?? "").split(/\s+/)) {
+      if (cls) tokens.add(cls.toLowerCase());
+    }
+  }
+  return [...tokens];
+}
+var familyOf = (cls) => cls.split("-")[0];
+function selectorIsLive(selector, live) {
+  const sel = selector.toLowerCase();
+  if (sel.includes(":root")) return true;
+  const families = new Set(live.map(familyOf));
+  return sel.split(",").some((branch) => {
+    const positive = branch.replace(/:not\([^)]*\)/g, "").match(/\.[a-z0-9_-]+/g);
+    if (!positive) return true;
+    const leading = positive[0].slice(1);
+    if (live.includes(leading)) return true;
+    return !families.has(familyOf(leading));
+  });
+}
+function roleOfProperty(property) {
+  if (!property.startsWith("--")) return null;
+  const name = property.slice(2).toLowerCase().replace(/^(brand|color|colour|theme|sc|c|ui)-/, "");
+  const base = /^(primary|secondary|accent|dark|light)(?:-(\d+|dark|light|hover|active|soft|muted|contrast|foreground|fg|bg))?$/.exec(
+    name
+  );
+  if (!base) return null;
+  return { role: base[1], variant: Boolean(base[2]) };
+}
+function declaredPalette(hits, live) {
+  const best = /* @__PURE__ */ new Map();
+  for (const hit of hits) {
+    const named = roleOfProperty(hit.property);
+    if (!named || FRAMEWORK_VAR.test(hit.property) || !selectorIsLive(hit.context, live)) continue;
+    const classes = hit.context.toLowerCase().match(/\.[a-z0-9_-]+/g) ?? [];
+    const onLiveRoot = classes.some((c) => live.includes(c.slice(1)));
+    const rank = (onLiveRoot ? 4 : classes.length > 0 ? 2 : 0) + (named.variant ? 0 : 1);
+    const seen = best.get(named.role);
+    if (seen && seen.rank > rank) continue;
+    best.set(named.role, { hex: hit.hex, rank });
+  }
+  return {
+    primary: best.get("primary")?.hex,
+    secondary: best.get("secondary")?.hex,
+    accent: best.get("accent")?.hex,
+    dark: best.get("dark")?.hex,
+    light: best.get("light")?.hex
+  };
+}
+function collectColors(sources, live = []) {
   const counts = /* @__PURE__ */ new Map();
-  for (const c of colors) counts.set(c.toLowerCase(), (counts.get(c.toLowerCase()) ?? 0) + 1);
-  const sorted = [...counts.entries()].sort((a, b) => b[1] - a[1]).map(([c]) => c);
+  for (const { css, weightScale = 1 } of sources) {
+    for (const hit of extractColors(css)) {
+      if (live.length > 0 && !selectorIsLive(hit.context, live)) continue;
+      const weight = weightOf(hit) * weightScale;
+      if (weight <= 0) continue;
+      counts.set(hit.hex, (counts.get(hit.hex) ?? 0) + weight);
+    }
+  }
+  return [...counts.entries()].map(([hex, weight]) => ({ hex, weight }));
+}
+function dedupeNearby(hits) {
+  const buckets = /* @__PURE__ */ new Map();
+  for (const hit of [...hits].sort((a, b) => b.weight - a.weight)) {
+    const { h, s, l } = hexToHsl(hit.hex);
+    const key = isNeutral(hit.hex) ? `grey:${Math.round(l * 8)}` : `${Math.round(h / 12)}:${Math.round(s * 8)}:${Math.round(l * 8)}`;
+    const seen = buckets.get(key);
+    if (seen) seen.weight += hit.weight;
+    else buckets.set(key, { ...hit });
+  }
+  return [...buckets.values()].sort((a, b) => b.weight - a.weight);
+}
+function dropSingletons(hits) {
+  if (hits.length < 12) return [...hits];
+  const kept = hits.filter((h) => h.weight > 1);
+  return kept.length > 0 ? kept : [...hits];
+}
+function chromaOf(hex) {
+  const r = Number.parseInt(hex.slice(1, 3), 16) / 255;
+  const g = Number.parseInt(hex.slice(3, 5), 16) / 255;
+  const b = Number.parseInt(hex.slice(5, 7), 16) / 255;
+  return Math.max(r, g, b) - Math.min(r, g, b);
+}
+function isNeutral(hex) {
+  const { l } = hexToHsl(hex);
+  return chromaOf(hex) < 0.1 || l < 0.06 || l > 0.96;
+}
+function pickPalette(hits) {
+  const sorted = [...hits].sort((a, b) => b.weight - a.weight).map((h) => h.hex);
   const saturated = [];
   const neutrals = [];
   for (const c of sorted) {
-    const { s, l } = hexToHsl(c);
-    if (s < 0.12 || l < 0.06 || l > 0.96) neutrals.push(c);
+    if (isNeutral(c)) neutrals.push(c);
     else saturated.push(c);
   }
   return {
@@ -3498,91 +3983,650 @@ function pickPalette(colors) {
     neutrals: neutrals.slice(0, 2)
   };
 }
-async function buildFromUrl(url, opts = {}) {
-  const fetchImpl = opts.fetchImpl ?? fetch;
-  const warnings = [];
-  const origin = new URL(url);
-  const controller = new AbortController();
-  const timeoutId = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
-  let res;
+function paletteFrom(sources, live = []) {
+  const hits = sources.flatMap((s) => extractColors(s.css));
+  const declared = declaredPalette(hits, live);
+  const counted = pickPalette(dropSingletons(dedupeNearby(collectColors(sources, live))));
+  const taken = /* @__PURE__ */ new Set();
+  const take = (hex) => {
+    if (!hex || taken.has(hex)) return void 0;
+    taken.add(hex);
+    return hex;
+  };
+  const primary = take(declared.primary) ?? take(counted.primary);
+  const secondary = take(declared.secondary) ?? take(counted.secondary);
+  const named = Boolean(declared.primary || declared.secondary);
+  const accent = (named ? [declared.accent, declared.dark, declared.light] : counted.accent).map(take).filter((h) => Boolean(h)).slice(0, 2);
+  const neutrals = counted.neutrals.filter((h) => !taken.has(h)).slice(0, 2);
+  return { primary, secondary, accent, neutrals };
+}
+
+// ../brand-spec/src/logoCandidates.ts
+var BASE = {
+  "json-ld": 170,
+  manifest: 85,
+  "apple-touch-icon": 80,
+  "header-img": 75,
+  "header-svg": 60,
+  "link-icon": 45,
+  "og-image": 10
+};
+var LOGOISH = /(^|[^a-z])(logo|wordmark|brandmark|lockup|masthead)([^a-z]|$)/i;
+var NOT_OURS = /(client|customer|partner|sponsor|press|award|integrat|collab|affiliat|featured-in|trusted-by|logos?-(wall|grid|cloud|strip)|testimonial|marquee|as-seen)/i;
+var SOCIAL = /(facebook|instagram|twitter|linkedin|youtube|tiktok|pinterest|threads|whatsapp|x-logo|social)/i;
+var FLAGGISH = /(\bflags?\b|locale|country|region|currency|\blang(uage)?\b)/i;
+var TRACKER = /(pixel|1x1|spacer|blank|beacon|analytics|doubleclick|facebook\.com\/tr)/i;
+var PHOTOISH = /(hero|banner|cover|photo|screenshot|slide|\bbg\b|background)/i;
+var DARKISH = /(dark|inverse|inverted|white|light-on)/i;
+var HEADER_SCOPE = 'header, nav, [role="banner"], .site-header, .navbar, .masthead, .topbar';
+var IMG_HORIZON = 40;
+function absolute(href, base) {
+  if (!href) return null;
+  const raw = href.trim();
+  if (raw === "") return null;
+  if (raw.startsWith("data:"))
+    return raw.length <= 262144 && /^data:image\/(svg\+xml|png|jpeg|webp)/i.test(raw) ? raw : null;
   try {
-    res = await fetchImpl(url, {
-      redirect: "follow",
-      headers: { "user-agent": "scenri/0.1 (+https://scenri.co)" },
-      signal: controller.signal
+    const u = new URL(raw, base);
+    return u.protocol === "http:" || u.protocol === "https:" ? u.toString() : null;
+  } catch {
+    return null;
+  }
+}
+function largestFromSrcset(srcset) {
+  const entries = srcset.split(",").map((part) => part.trim()).filter(Boolean).map((part) => {
+    const [url, descriptor = ""] = part.split(/\s+/);
+    const w = /^(\d+)w$/.exec(descriptor);
+    const x = /^([\d.]+)x$/.exec(descriptor);
+    return { url, rank: w ? Number(w[1]) : x ? Number(x[1]) * 1e3 : 1 };
+  });
+  if (entries.length === 0) return null;
+  return entries.sort((a, b) => b.rank - a.rank)[0].url;
+}
+function declaredEdgeOf(sizes, w, h) {
+  const fromSizes = sizes ? Math.max(...(sizes.match(/\d+/g) ?? ["0"]).map(Number)) : 0;
+  const fromAttrs = Math.max(Number(0) || 0, Number(0) || 0);
+  const edge = Math.max(fromSizes, fromAttrs);
+  return edge > 0 ? edge : null;
+}
+function layoutTerm(w, h, why) {
+  const width = Number(w ?? 0) || 0;
+  const height = Number(h ?? 0) || 0;
+  if (width > 0 && height > 0 && width <= 32 && height <= 32) {
+    why.push("icon-shaped");
+    return -20;
+  }
+  return 0;
+}
+function sizeTerm(edge, why) {
+  if (edge === null) return 0;
+  if (edge >= 512) {
+    why.push("large");
+    return 15;
+  }
+  if (edge >= 256) {
+    why.push("big enough");
+    return 8;
+  }
+  if (edge <= 64) {
+    why.push("favicon-sized");
+    return -25;
+  }
+  return 0;
+}
+function logoCandidates($, base, manifest) {
+  const out = [];
+  const host = base.hostname.replace(/^www\./, "").split(".")[0];
+  const push = (c) => {
+    if (c.score <= 0) return;
+    if (c.url && out.some((o) => o.url === c.url)) return;
+    out.push(c);
+  };
+  for (const node of $('script[type="application/ld+json"]').toArray()) {
+    for (const href of jsonLdLogos($(node).text())) {
+      const url = absolute(href, base);
+      if (url)
+        push({
+          url,
+          source: "json-ld",
+          score: BASE["json-ld"],
+          declaredEdge: null,
+          role: "primary",
+          why: ["declared as the organisation logo"]
+        });
+    }
+  }
+  for (const icon of manifest?.icons ?? []) {
+    const url = absolute(icon.src, base);
+    const edge = declaredEdgeOf(icon.sizes);
+    if (!url || (edge ?? 0) < 192) continue;
+    const why = ["from the web app manifest"];
+    push({
+      url,
+      source: "manifest",
+      score: BASE.manifest + sizeTerm(edge, why),
+      declaredEdge: edge,
+      role: "primary",
+      why
     });
-  } catch (err) {
-    if (err instanceof Error && err.name === "AbortError") {
-      throw new Error(`Timed out fetching ${url}`);
+  }
+  for (const el of $('link[rel="apple-touch-icon"], link[rel="apple-touch-icon-precomposed"]').toArray()) {
+    const url = absolute($(el).attr("href"), base);
+    const edge = declaredEdgeOf($(el).attr("sizes"));
+    const why = ["a touch icon"];
+    if (url)
+      push({
+        url,
+        source: "apple-touch-icon",
+        score: BASE["apple-touch-icon"] + sizeTerm(edge, why),
+        declaredEdge: edge,
+        role: "primary",
+        why
+      });
+  }
+  const imgs = $("img").toArray();
+  imgs.forEach((el, index) => {
+    const node = $(el);
+    const inHeader = node.closest(HEADER_SCOPE).length > 0;
+    if (!inHeader && index > IMG_HORIZON) return;
+    const src = node.attr("src") ?? node.attr("data-src") ?? node.attr("data-lazy-src") ?? largestFromSrcset(node.attr("srcset") ?? node.attr("data-srcset") ?? "") ?? void 0;
+    const url = absolute(src, base);
+    if (!url) return;
+    const text = [url, node.attr("alt") ?? "", node.attr("class") ?? "", node.attr("id") ?? ""].join(" ");
+    const ancestry = node.parents().slice(0, 6).map((_i, p) => `${$(p).attr("class") ?? ""} ${$(p).attr("id") ?? ""}`).get().join(" ");
+    const why = [];
+    let score = inHeader ? BASE["header-img"] : BASE["header-img"] - 20;
+    if (inHeader) why.push("in the header");
+    if (index <= 2) {
+      why.push("first image on the page");
+      score += 20;
+    } else if (index <= 6) {
+      score += 6;
+    }
+    score += layoutTerm(node.attr("width"), node.attr("height"), why);
+    score += semanticTerms(text, ancestry, host, why);
+    if (node.parent().children("img").length >= 3) {
+      why.push("one of a row of logos");
+      score -= 50;
+    }
+    push({
+      url,
+      source: "header-img",
+      score,
+      declaredEdge: null,
+      role: "primary",
+      ...DARKISH.test(text) ? { background: "dark" } : {},
+      why
+    });
+  });
+  for (const el of $(`${HEADER_SCOPE}`).find("svg").toArray().slice(0, 4)) {
+    const node = $(el);
+    const text = [node.attr("class") ?? "", node.attr("id") ?? "", node.attr("aria-label") ?? ""].join(" ");
+    const why = ["drawn in the header"];
+    const score = BASE["header-svg"] + semanticTerms(text, "", host, why);
+    const markup = $.html(el);
+    if (markup) push({ url: null, svg: markup, source: "header-svg", score, declaredEdge: null, role: "primary", why });
+  }
+  for (const el of $('link[rel~="icon"]').toArray()) {
+    const url = absolute($(el).attr("href"), base);
+    const edge = declaredEdgeOf($(el).attr("sizes"));
+    const why = ["the site icon"];
+    if (url)
+      push({
+        url,
+        source: "link-icon",
+        score: BASE["link-icon"] + sizeTerm(edge, why),
+        declaredEdge: edge,
+        role: "primary",
+        why
+      });
+  }
+  const og = absolute($('meta[property="og:image"]').attr("content"), base);
+  if (og)
+    push({
+      url: og,
+      source: "og-image",
+      score: BASE["og-image"],
+      declaredEdge: null,
+      role: "alternate",
+      why: ["the social share image"]
+    });
+  return out.sort((a, b) => b.score - a.score);
+}
+function pathOf(text) {
+  return text.replace(/https?:\/\/[^/\s]+/gi, "");
+}
+function semanticTerms(text, ancestry, host, why) {
+  let score = 0;
+  if (LOGOISH.test(text)) {
+    why.push("called a logo");
+    score += 40;
+  }
+  if (host.length >= 3 && pathOf(text).toLowerCase().includes(host.toLowerCase())) {
+    why.push("named after the site");
+    score += 6;
+  }
+  if (/\.svg(\?|$)/i.test(text)) score += 8;
+  if (/\.ico(\?|$)/i.test(text)) score -= 15;
+  if (/\.jpe?g(\?|$)/i.test(text)) score -= 10;
+  if (NOT_OURS.test(ancestry) || NOT_OURS.test(text)) {
+    why.push("inside a section of other companies");
+    score -= 40;
+  }
+  if (SOCIAL.test(text)) {
+    why.push("a social icon");
+    score -= 60;
+  }
+  if (FLAGGISH.test(text)) {
+    why.push("a flag or a region switcher");
+    score -= 60;
+  }
+  if (TRACKER.test(text)) {
+    why.push("a tracking pixel");
+    score -= 80;
+  }
+  if (PHOTOISH.test(text)) {
+    why.push("photography");
+    score -= 30;
+  }
+  if (DARKISH.test(text)) score -= 15;
+  return score;
+}
+function jsonLdLogos(text) {
+  let data;
+  try {
+    data = JSON.parse(text);
+  } catch {
+    return [];
+  }
+  const found = [];
+  const walk = (node, depth) => {
+    if (depth > 6 || node === null || typeof node !== "object") return;
+    if (Array.isArray(node)) {
+      for (const item of node) walk(item, depth + 1);
+      return;
     }
-    throw new Error(`Could not reach that site: ${url}`);
-  } finally {
-    clearTimeout(timeoutId);
+    const obj = node;
+    const logo = obj.logo;
+    if (typeof logo === "string") found.push(logo);
+    else if (logo && typeof logo === "object") {
+      const url = logo.url;
+      if (typeof url === "string") found.push(url);
+    }
+    for (const value of Object.values(obj)) walk(value, depth + 1);
+  };
+  walk(data, 0);
+  return found;
+}
+function svgAsMark(markup, longEdge = 1024) {
+  if (/<script|<foreignObject|(?:xlink:)?href\s*=\s*["']https?:/i.test(markup)) return null;
+  const viewBox = /viewBox\s*=\s*["']\s*[-\d.]+[\s,]+[-\d.]+[\s,]+([\d.]+)[\s,]+([\d.]+)\s*["']/i.exec(markup);
+  const width = /\bwidth\s*=\s*["']([\d.]+)/i.exec(markup);
+  const height = /\bheight\s*=\s*["']([\d.]+)/i.exec(markup);
+  const w = viewBox ? Number(viewBox[1]) : Number(width?.[1] ?? 0);
+  const h = viewBox ? Number(viewBox[2]) : Number(height?.[1] ?? 0);
+  if (!(w > 0 && h > 0)) return null;
+  const scale = longEdge / Math.max(w, h);
+  let out = markup.replace(/\s\bwidth\s*=\s*["'][^"']*["']/i, "").replace(/\s\bheight\s*=\s*["'][^"']*["']/i, "").replace(/<svg\b/i, `<svg width="${Math.round(w * scale)}" height="${Math.round(h * scale)}"`);
+  if (!/xmlns\s*=/.test(out)) out = out.replace(/<svg\b/i, '<svg xmlns="http://www.w3.org/2000/svg"');
+  return out;
+}
+
+// ../brand-spec/src/scrapeError.ts
+var ScrapeError = class extends Error {
+  constructor(code, message, statusCode = 502) {
+    super(message);
+    this.code = code;
+    this.statusCode = statusCode;
+  }
+  code;
+  statusCode;
+  name = "ScrapeError";
+};
+function urlRefusal(reason, message) {
+  return new ScrapeError(`url_${reason}`, message, 400);
+}
+
+// ../brand-spec/src/safeFetch.ts
+var DEFAULTS = {
+  budgetMs: 2e4,
+  requestMs: 8e3,
+  maxRedirects: 3,
+  maxHtmlBytes: 3e6,
+  maxCssBytes: 1e6,
+  maxAssetBytes: 5e6
+};
+function isPrivateAddress(ip) {
+  const kind = isIP(ip);
+  if (kind === 4) return isPrivateV4(ip);
+  if (kind === 6) return isPrivateV6(ip.toLowerCase());
+  return true;
+}
+function isPrivateV4(ip) {
+  const p = ip.split(".").map(Number);
+  if (p.length !== 4 || p.some((n) => !Number.isInteger(n) || n < 0 || n > 255)) return true;
+  const [a, b] = p;
+  if (a === 0 || a === 10 || a === 127) return true;
+  if (a === 100 && b >= 64 && b <= 127) return true;
+  if (a === 169 && b === 254) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 192 && b === 0) return true;
+  if (a === 192 && b === 88) return true;
+  if (a === 198 && (b === 18 || b === 19 || b === 51)) return true;
+  if (a === 203 && b === 0) return true;
+  if (a >= 224) return true;
+  return false;
+}
+function isPrivateV6(ip) {
+  const bare = ip.replace(/^\[|\]$/g, "");
+  if (bare === "::" || bare === "::1") return true;
+  const mapped = /^(?:::ffff:|64:ff9b::)(\d{1,3}(?:\.\d{1,3}){3})$/.exec(bare);
+  if (mapped) return isPrivateV4(mapped[1]);
+  const head = bare.split(":")[0];
+  if (/^f[cd]/.test(head)) return true;
+  if (/^fe[89ab]/.test(head)) return true;
+  if (/^ff/.test(head)) return true;
+  if (head === "2002") return true;
+  return false;
+}
+var PRIVATE_SUFFIX = /(^|\.)(local|internal|localhost|home\.arpa)$/i;
+function assertPublicHost(host, addresses, allow) {
+  if (allow) return;
+  const bare = host.replace(/^\[|\]$/g, "");
+  if (isIP(bare)) {
+    if (isPrivateAddress(bare)) throw blocked(host);
+    return;
+  }
+  if (!bare.includes(".") || PRIVATE_SUFFIX.test(bare)) throw blocked(host);
+  if (addresses.length === 0) throw new ScrapeError("unreachable", `Could not reach ${host}.`);
+  if (addresses.some((a) => isPrivateAddress(a))) throw blocked(host);
+}
+var blocked = (host) => new ScrapeError("blocked_host", `${host} points at this computer or a private network, not a public website.`, 400);
+var LIMIT = {
+  html: "maxHtmlBytes",
+  css: "maxCssBytes",
+  asset: "maxAssetBytes"
+};
+var TRUNCATES = { html: true, css: true, asset: false };
+function createGuardedFetch(opts = {}) {
+  const o = { ...DEFAULTS, ...opts };
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const resolve = opts.lookup ?? (async (host) => {
+    if (isIP(host.replace(/^\[|\]$/g, ""))) return [host.replace(/^\[|\]$/g, "")];
+    const all = await lookup(host, { all: true });
+    return all.map((a) => a.address);
+  });
+  const deadline = Date.now() + o.budgetMs;
+  const remaining = () => Math.max(0, deadline - Date.now());
+  async function once(url, as) {
+    let current = url;
+    let hops = 0;
+    let attempts = 0;
+    for (; ; ) {
+      const u = new URL(current);
+      if (u.protocol !== "http:" && u.protocol !== "https:")
+        throw new ScrapeError(
+          "url_scheme",
+          "Scenri reads web addresses only, the ones that start with http or https.",
+          400
+        );
+      let addresses = [];
+      if (!o.allowPrivateHosts) {
+        try {
+          addresses = await resolve(u.hostname);
+        } catch {
+          throw new ScrapeError("unreachable", `Could not reach ${u.hostname}.`);
+        }
+      }
+      assertPublicHost(u.hostname, addresses, Boolean(o.allowPrivateHosts));
+      const left = remaining();
+      if (left <= 0) throw new ScrapeError("timeout", "Reading that site took too long.");
+      const signal = AbortSignal.any([AbortSignal.timeout(Math.min(o.requestMs, left))]);
+      let res;
+      try {
+        res = await fetchImpl(current, {
+          redirect: "manual",
+          headers: { "user-agent": USER_AGENT, accept: ACCEPT[as] },
+          signal
+        });
+      } catch (err) {
+        if (err instanceof ScrapeError) throw err;
+        const aborted = err instanceof Error && (err.name === "AbortError" || err.name === "TimeoutError");
+        throw aborted ? new ScrapeError("timeout", `${u.hostname} took too long to answer.`) : new ScrapeError("unreachable", `Could not reach ${u.hostname}.`);
+      }
+      if (res.status >= 300 && res.status < 400) {
+        const location = res.headers.get("location");
+        await res.body?.cancel().catch(() => {
+        });
+        if (!location) throw new ScrapeError("http_status", `${u.hostname} answered ${res.status} with nowhere to go.`);
+        if (++hops > o.maxRedirects)
+          throw new ScrapeError(
+            "too_many_redirects",
+            `${new URL(url).hostname} kept redirecting, so nothing was read.`
+          );
+        current = new URL(location, current).toString();
+        continue;
+      }
+      if (!res.ok) {
+        if (RETRYABLE.has(res.status) && attempts < 1 && remaining() > 2e3) {
+          await res.body?.cancel().catch(() => {
+          });
+          await sleep3(700);
+          attempts++;
+          continue;
+        }
+        throw new ScrapeError("http_status", statusSentence(u.hostname, res.status));
+      }
+      const contentType = (res.headers.get("content-type") ?? "").toLowerCase();
+      const cap2 = o[LIMIT[as]];
+      const { bytes, truncated } = await readBounded(res, cap2, TRUNCATES[as]);
+      assertKind(as, contentType, bytes, u.hostname);
+      return {
+        finalUrl: res.url || current,
+        status: res.status,
+        contentType,
+        bytes,
+        text: as === "asset" ? "" : decode(bytes, contentType),
+        truncated
+      };
+    }
+  }
+  const guarded = ((url, as) => once(url, as));
+  guarded.remaining = remaining;
+  return guarded;
+}
+var USER_AGENT = "scenri/0.1 (+https://scenri.co)";
+var sleep3 = (ms) => new Promise((r) => setTimeout(r, ms));
+var RETRYABLE = /* @__PURE__ */ new Set([403, 408, 425, 429, 500, 502, 503, 504]);
+function statusSentence(host, status) {
+  if (status === 401 || status === 403)
+    return `${host} would not let Scenri read it. Some sites block anything that is not a person in a browser; you can still add the logo and colours by hand.`;
+  if (status === 404) return `There is no page at that address on ${host}.`;
+  if (status === 429) return `${host} asked Scenri to slow down. Try again in a minute.`;
+  if (status >= 500) return `${host} had trouble answering. Try again in a moment.`;
+  return `${host} answered ${status}, so there was nothing to read.`;
+}
+var ACCEPT = {
+  html: "text/html,application/xhtml+xml",
+  css: "text/css,*/*;q=0.1",
+  asset: "image/*"
+};
+async function readBounded(res, cap2, truncate) {
+  const declared = Number(res.headers.get("content-length") ?? "0");
+  if (!truncate && declared > cap2) {
+    await res.body?.cancel().catch(() => {
+    });
+    throw new ScrapeError("too_large", "That file is too large to read.");
+  }
+  const reader = res.body?.getReader();
+  if (!reader) return { bytes: Buffer.from(await res.arrayBuffer()), truncated: false };
+  const chunks = [];
+  let total = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    chunks.push(Buffer.from(value));
+    total += value.byteLength;
+    if (total >= cap2) {
+      await reader.cancel().catch(() => {
+      });
+      if (!truncate) throw new ScrapeError("too_large", "That file is too large to read.");
+      return { bytes: Buffer.concat(chunks).subarray(0, cap2), truncated: true };
+    }
+  }
+  return { bytes: Buffer.concat(chunks), truncated: false };
+}
+var IMAGE_MAGIC = [
+  ["png", (b) => b.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]))],
+  ["jpeg", (b) => b[0] === 255 && b[1] === 216],
+  ["gif", (b) => b.subarray(0, 3).toString("latin1") === "GIF"],
+  ["webp", (b) => b.subarray(0, 4).toString("latin1") === "RIFF" && b.subarray(8, 12).toString("latin1") === "WEBP"],
+  ["ico", (b) => b[0] === 0 && b[1] === 0 && (b[2] === 1 || b[2] === 2)],
+  ["svg", (b) => /<svg[\s>]/i.test(b.subarray(0, 1024).toString("utf8"))]
+];
+function assertKind(as, contentType, bytes, host) {
+  if (as === "html") {
+    const htmlish = /text\/html|application\/xhtml/.test(contentType);
+    const vague = contentType === "" || /^text\/plain|^application\/octet-stream/.test(contentType);
+    const looksLikeMarkup = vague && bytes.subarray(0, 512).toString("utf8").trimStart().startsWith("<");
+    if (!htmlish && !looksLikeMarkup)
+      throw new ScrapeError("not_a_page", `${host} answered with a file, not a web page.`);
+    return;
+  }
+  if (as === "asset") {
+    if (contentType.startsWith("image/")) return;
+    const vague = contentType === "" || /^application\/octet-stream/.test(contentType);
+    if (vague || IMAGE_MAGIC.some(([, test]) => test(bytes))) return;
+    throw new ScrapeError("not_a_page", "That logo was not an image.");
+  }
+}
+function decode(bytes, contentType) {
+  const declared = /charset=([\w-]+)/i.exec(contentType)?.[1];
+  const sniffed = declared ?? /charset=["']?([\w-]+)/i.exec(bytes.subarray(0, 1024).toString("latin1"))?.[1];
+  const label = (sniffed ?? "utf-8").toLowerCase();
+  if (label === "utf-8" || label === "utf8") return bytes.toString("utf8");
+  try {
+    return new TextDecoder(label, { fatal: false }).decode(bytes);
+  } catch {
+    return bytes.toString("utf8");
+  }
+}
+
+// ../brand-spec/src/siteUrl.ts
+var INVISIBLE = /[​-‍⁠­᠎‎‏‪-‮⁦-⁩]/g;
+var SPACES = /[\t\n\r\f\v   -   　]/g;
+var SCHEMED = /^[a-z][a-z0-9+.-]*:\/\//i;
+var OPAQUE = /^(javascript|data|mailto|tel|sms|file|about|blob|chrome|chrome-extension|view-source):/i;
+var HTTPISH = /^https?:\/\//i;
+var IP_LITERAL = /^(\d{1,3}(\.\d{1,3}){3}|\[[0-9a-f:]+\])$/i;
+var EXAMPLE = "acme.com";
+var MESSAGES = {
+  empty: `Paste a website address, like ${EXAMPLE}.`,
+  scheme: `Scenri reads web addresses only, the ones that start with http or https. Try ${EXAMPLE}.`,
+  space: "A web address cannot contain a space.",
+  host: `That does not look like a website address. Try ${EXAMPLE}.`,
+  unparseable: `That does not look like a website address. Try ${EXAMPLE}.`
+};
+var no = (reason, suggestion) => ({
+  ok: false,
+  reason,
+  message: suggestion && reason === "space" ? `${MESSAGES.space} Did you mean ${suggestion}?` : MESSAGES[reason],
+  ...suggestion ? { suggestion } : {}
+});
+function unwrap(value) {
+  const pairs = [
+    ["<", ">"],
+    ['"', '"'],
+    ["'", "'"]
+  ];
+  for (const [open, close] of pairs) {
+    if (value.length >= 2 && value.startsWith(open) && value.endsWith(close)) return value.slice(1, -1).trim();
+  }
+  return value;
+}
+function normalizeSiteUrl(input) {
+  const cleaned = unwrap(
+    String(input ?? "").replace(INVISIBLE, "").replace(SPACES, " ").trim()
+  );
+  if (cleaned === "") return no("empty");
+  const addedScheme = !SCHEMED.test(cleaned) && !OPAQUE.test(cleaned);
+  if (!addedScheme && !HTTPISH.test(cleaned)) return no("scheme");
+  const candidate = addedScheme ? `https://${cleaned}` : cleaned;
+  const authority = candidate.slice(candidate.indexOf("://") + 3).split(/[/?#]/)[0];
+  if (authority.includes(" ")) {
+    const squeezed = normalizeSiteUrl(cleaned.replace(/ /g, ""));
+    return no("space", squeezed.ok ? squeezed.url.replace(/^https?:\/\//, "").replace(/\/$/, "") : void 0);
+  }
+  let u;
+  try {
+    u = new URL(candidate);
+  } catch {
+    return no("unparseable");
   }
-  if (!res.ok) throw new Error(`Could not fetch ${url}: HTTP ${res.status}`);
-  const html = await res.text();
-  const $ = cheerio.load(html);
-  const name = $('meta[property="og:site_name"]').attr("content")?.trim() || $("title").first().text().trim().split(/\s+[|–—-]\s+/)[0] || origin.hostname.replace(/^www\./, "");
+  u.username = "";
+  u.password = "";
+  u.hash = "";
+  const host = u.hostname.replace(/\.$/, "");
+  u.hostname = host;
+  if (!host.includes(".") && !IP_LITERAL.test(host) && host !== "localhost") return no("host");
+  return { ok: true, url: u.toString(), host, addedScheme };
+}
+
+// ../brand-spec/src/buildFromUrl.ts
+var MAX_PORTRAIT_RATIO = 2.5;
+var CONFIDENT_SCORE = 80;
+var ICON_SOURCES = /* @__PURE__ */ new Set(["json-ld", "manifest", "apple-touch-icon", "link-icon"]);
+var LOGO_TRIES = 3;
+var MAX_SHEETS = 6;
+var SHEET_RANK = /(root|variables|tokens|colou?rs|palette|theme|main|app|style|tailwind|global|site|brand|base)/i;
+var SHEET_SKIP = /(font|icon|fontawesome|bootstrap-icons|swiper|slick|slider|lightbox|print)/i;
+async function buildFromUrl(url, opts = {}) {
+  const warnings = [];
+  const normalized = normalizeSiteUrl(url);
+  if (!normalized.ok) throw urlRefusal(normalized.reason, normalized.message);
+  const get = createGuardedFetch({
+    ...opts.guard,
+    ...opts.fetchImpl ? { fetchImpl: opts.fetchImpl, allowPrivateHosts: true } : {}
+  });
+  const page = await get(normalized.url, "html");
+  const origin = new URL(page.finalUrl);
+  const $ = cheerio.load(page.text);
+  const base = baseOf($, origin);
+  const named = pickName($, origin);
   const tagline = $('meta[name="description"]').attr("content")?.trim() || $('meta[property="og:description"]').attr("content")?.trim();
-  const colorSources = [];
-  const themeColor = $('meta[name="theme-color"]').attr("content");
-  if (themeColor && /^#[0-9a-fA-F]{6}$/.test(themeColor.trim())) {
-    for (let i = 0; i < 5; i++) colorSources.push(themeColor.trim());
-  }
-  const styleText = $("[style]").map((_, el) => $(el).attr("style")).get().join("\n") + "\n" + $("style").map((_, el) => $(el).text()).get().join("\n");
-  colorSources.push(...styleText.match(HEX_RE) ?? []);
-  const cssHref = $('link[rel="stylesheet"]').first().attr("href");
-  if (cssHref) {
+  const sources = [];
+  const themeColor = $('meta[name="theme-color"]').attr("content")?.trim();
+  const tileColor = $('meta[name="msapplication-TileColor"]').attr("content")?.trim();
+  for (const [value, scale] of [
+    [themeColor, 2],
+    [tileColor, 1]
+  ]) {
+    if (value) sources.push({ css: `:root{--brand-theme:${value}}`, weightScale: scale });
+  }
+  sources.push({ css: inlineCss($) });
+  for (const href of sheetHrefs($, base)) {
+    if (get.remaining() <= 0) break;
     try {
-      const cssUrl = new URL(cssHref, origin).toString();
-      const cssRes = await fetchImpl(cssUrl, { redirect: "follow" });
-      if (cssRes.ok) colorSources.push(...(await cssRes.text()).match(HEX_RE) ?? []);
+      const sheet = await get(href, "css");
+      sources.push({ css: sheet.text });
     } catch {
       warnings.push("Stylesheet fetch failed; palette from inline styles only.");
     }
   }
-  const palette = pickPalette(colorSources);
+  const palette = paletteFrom(sources, liveClassTokens($));
   if (!palette.primary) warnings.push("No confident palette found. Set colors manually.");
-  let logoRef;
-  let logoFromOg = false;
-  let logoTiny = false;
-  let iconHref = $('link[rel="apple-touch-icon"]').attr("href") || $('link[rel~="icon"]').attr("href");
-  if (!iconHref) {
-    iconHref = $('meta[property="og:image"]').attr("content");
-    logoFromOg = Boolean(iconHref);
-  }
-  if (iconHref && opts.saveAsset) {
-    try {
-      const iconRes = await fetchImpl(new URL(iconHref, origin).toString(), { redirect: "follow" });
-      if (iconRes.ok) {
-        const buf = Buffer.from(await iconRes.arrayBuffer());
-        if (buf.length > 0) {
-          logoRef = await opts.saveAsset(buf, "logo");
-          if (!logoFromOg && opts.probeLongEdge) {
-            const edge = await opts.probeLongEdge(buf).catch(() => null);
-            if (edge !== null && edge < 256) {
-              logoTiny = true;
-              warnings.push(
-                `The site icon is favicon-sized (${edge}px), so it was saved as an alternate mark, not the logo. Upload your real logo in Settings.`
-              );
-            }
-          }
-        }
-      }
-    } catch {
-      warnings.push("Logo download failed.");
-    }
-  }
-  if (!logoRef) warnings.push("No logo captured. Add one manually.");
-  else if (logoFromOg)
-    warnings.push(
-      "No site icon was found; the social share image was saved as an alternate mark. Check it before treating it as the logo."
-    );
+  const colorCount = [palette.primary, palette.secondary, ...palette.accent, ...palette.neutrals].filter(
+    Boolean
+  ).length;
+  const manifest = await readManifest($, base, get);
+  const candidates = logoCandidates($, base, manifest);
+  const picked = await downloadMark(candidates, get, opts, warnings);
   const brand = {
     specVersion: "0.1",
     meta: {
-      name,
-      slug: name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 48) || origin.hostname,
+      name: named.value,
+      slug: named.value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 48) || origin.hostname,
       ...tagline ? { tagline } : {},
       website: origin.origin,
       createdWith: opts.createdWith ?? "scenri",
@@ -3596,20 +4640,202 @@ async function buildFromUrl(url, opts = {}) {
         ...palette.neutrals.length ? { neutrals: palette.neutrals.map((hex) => ({ hex })) } : {}
       }
     } : {},
-    ...logoRef ? { logos: [{ role: logoFromOg || logoTiny ? "alternate" : "primary", file: logoRef }] } : {}
+    ...picked.ref ? {
+      logos: [
+        {
+          role: picked.role,
+          file: picked.ref,
+          ...picked.background ? { background: picked.background } : {}
+        }
+      ]
+    } : {}
+  };
+  return {
+    brand,
+    warnings,
+    report: {
+      url: page.finalUrl,
+      host: origin.hostname,
+      name: named,
+      tagline: tagline ?? null,
+      logo: {
+        status: picked.ref ? picked.role : "none",
+        source: picked.source,
+        ...picked.score != null ? { score: picked.score } : {},
+        ...picked.note ? { note: picked.note } : {}
+      },
+      colors: { count: colorCount }
+    }
   };
-  return { brand, warnings };
-}
-
-// ../brand-spec/src/mergeScrape.ts
-var str2 = (v) => typeof v === "string" ? v.trim() : "";
-var arr = (v) => Array.isArray(v) ? v : [];
-var hashOf = (ref) => {
-  const s = String(ref ?? "");
-  return s.startsWith("asset:") ? s.slice(6) : s;
-};
-function scrapedHexes(palette) {
-  return [palette?.primary, palette?.secondary, ...arr(palette?.accent), ...arr(palette?.neutrals)].filter((c) => typeof c?.hex === "string").map((c) => ({ hex: String(c.hex) }));
+}
+function baseOf($, origin) {
+  const declared = $("base[href]").attr("href");
+  if (!declared) return origin;
+  try {
+    return new URL(declared, origin);
+  } catch {
+    return origin;
+  }
+}
+function pickName($, origin) {
+  const ld = jsonLdName($);
+  if (ld) return { value: ld, source: "json-ld" };
+  const og = $('meta[property="og:site_name"]').attr("content")?.trim();
+  if (og) return { value: og, source: "og:site_name" };
+  const title = nameFromTitle($("title").first().text());
+  if (title) return { value: title, source: "title" };
+  return { value: origin.hostname.replace(/^www\./, ""), source: "hostname" };
+}
+function nameFromTitle(raw) {
+  const parts = raw.trim().split(/\s+[|\u00b7\u2022\u2013\u2014]\s+|\s+-\s+/).map((p) => p.trim()).filter(Boolean);
+  if (parts.length < 2) return parts[0] ?? "";
+  const first = parts[0];
+  const last = parts[parts.length - 1];
+  const words = (v) => v.split(/\s+/).length;
+  if (/^(home|homepage|index|welcome|start|main)$/i.test(first)) return last;
+  if (words(last) <= 4 && words(first) > words(last)) return last;
+  return first;
+}
+function jsonLdName($) {
+  for (const node of $('script[type="application/ld+json"]').toArray()) {
+    try {
+      const data = JSON.parse($(node).text());
+      const found = findOrgName(data, 0);
+      if (found) return found;
+    } catch {
+    }
+  }
+  return null;
+}
+function findOrgName(node, depth) {
+  if (depth > 6 || node === null || typeof node !== "object") return null;
+  if (Array.isArray(node)) {
+    for (const item of node) {
+      const found = findOrgName(item, depth + 1);
+      if (found) return found;
+    }
+    return null;
+  }
+  const obj = node;
+  const type = String(obj["@type"] ?? "");
+  if (/Organization|Corporation|LocalBusiness/i.test(type) && typeof obj.name === "string" && obj.name.trim())
+    return obj.name.trim();
+  for (const value of Object.values(obj)) {
+    const found = findOrgName(value, depth + 1);
+    if (found) return found;
+  }
+  return null;
+}
+function inlineCss($) {
+  const attrs = $("[style]").map((_, el) => `x{${$(el).attr("style")}}`).get().join("\n");
+  const blocks = $("style").map((_, el) => $(el).text()).get().join("\n");
+  return `${attrs}
+${blocks}`;
+}
+function sheetHrefs($, base) {
+  const hrefs = [];
+  for (const el of $('link[rel="stylesheet"]').toArray()) {
+    const href = $(el).attr("href");
+    if (!href || SHEET_SKIP.test(href)) continue;
+    try {
+      hrefs.push(new URL(href, base).toString());
+    } catch {
+    }
+  }
+  return hrefs.sort((a, b) => Number(SHEET_RANK.test(b)) - Number(SHEET_RANK.test(a))).slice(0, MAX_SHEETS);
+}
+async function readManifest($, base, get) {
+  const href = $('link[rel="manifest"]').attr("href");
+  if (!href || get.remaining() <= 0) return void 0;
+  try {
+    const res = await get(new URL(href, base).toString(), "css");
+    return JSON.parse(res.text);
+  } catch {
+    return void 0;
+  }
+}
+async function downloadMark(candidates, get, opts, warnings) {
+  if (!opts.saveAsset || candidates.length === 0) {
+    if (candidates.length === 0) warnings.push("No logo captured. Add one manually.");
+    return { role: "primary", source: null };
+  }
+  let fallback = null;
+  let tried = 0;
+  let failed = false;
+  for (const candidate of candidates) {
+    if (tried >= LOGO_TRIES || get.remaining() <= 0) break;
+    let buf = null;
+    if (candidate.svg) {
+      const sized = svgAsMark(candidate.svg);
+      if (!sized) continue;
+      buf = Buffer.from(sized, "utf8");
+    } else if (candidate.url?.startsWith("data:")) {
+      const comma = candidate.url.indexOf(",");
+      const body = candidate.url.slice(comma + 1);
+      buf = candidate.url.slice(0, comma).includes(";base64") ? Buffer.from(body, "base64") : Buffer.from(decodeURIComponent(body), "utf8");
+    } else if (candidate.url) {
+      tried++;
+      try {
+        buf = (await get(candidate.url, "asset")).bytes;
+      } catch {
+        failed = true;
+        continue;
+      }
+    }
+    if (!buf || buf.length === 0) continue;
+    let ref;
+    try {
+      ref = await opts.saveAsset(buf, "logo");
+    } catch {
+      failed = true;
+      continue;
+    }
+    const shape = opts.inspectMark ? await opts.inspectMark(buf).catch(() => null) : null;
+    if (shape?.blank) continue;
+    const edge = candidate.svg ? null : shape?.longEdge ?? null;
+    const tiny = edge !== null && edge < 256;
+    const tall = shape?.width != null && shape?.height != null && shape.width > 0 && shape.height / shape.width > MAX_PORTRAIT_RATIO;
+    const declaredIcon = ICON_SOURCES.has(candidate.source);
+    const unmeasured = !candidate.svg && shape === null;
+    const bigEnough = edge !== null ? declaredIcon && edge >= 512 : unmeasured;
+    const unsure = candidate.score < CONFIDENT_SCORE && !bigEnough;
+    const role = candidate.role === "alternate" || tiny || tall || unsure ? "alternate" : "primary";
+    const picked = {
+      ref,
+      role,
+      source: candidate.source,
+      score: candidate.score,
+      ...candidate.background ? { background: candidate.background } : {}
+    };
+    if (role === "primary") return picked;
+    if (tiny)
+      picked.note = `The site icon is favicon-sized (${edge}px), so it was saved as an alternate mark, not the logo. Upload your real logo in Settings.`;
+    else if (tall)
+      picked.note = "The only image we could find is much taller than it is wide, so it was saved as an alternate mark rather than the logo. Upload your real logo in Settings.";
+    else if (unsure)
+      picked.note = "We are not confident this is your logo, so it was saved as an alternate mark. Check it, or upload your real logo in Settings.";
+    else if (candidate.source === "og-image")
+      picked.note = "No site icon was found; the social share image was saved as an alternate mark. Check it before treating it as the logo.";
+    fallback ??= picked;
+  }
+  if (fallback) {
+    if (fallback.note) warnings.push(fallback.note);
+    return fallback;
+  }
+  if (failed) warnings.push("Logo download failed.");
+  warnings.push("No logo captured. Add one manually.");
+  return { role: "primary", source: null };
+}
+
+// ../brand-spec/src/mergeScrape.ts
+var str2 = (v) => typeof v === "string" ? v.trim() : "";
+var arr = (v) => Array.isArray(v) ? v : [];
+var hashOf = (ref) => {
+  const s = String(ref ?? "");
+  return s.startsWith("asset:") ? s.slice(6) : s;
+};
+function scrapedHexes(palette) {
+  return [palette?.primary, palette?.secondary, ...arr(palette?.accent), ...arr(palette?.neutrals)].filter((c) => typeof c?.hex === "string").map((c) => ({ hex: String(c.hex) }));
 }
 var hasPalette = (palette) => scrapedHexes(palette).length > 0;
 function mergeScrape(existing, scraped) {
@@ -3643,6 +4869,23 @@ function mergeScrape(existing, scraped) {
   }
   return { brand, suggestions: { palette: suggestions } };
 }
+async function inspectMark(buf, toPng2) {
+  const png = await toPng2(buf);
+  const meta = await sharp21(png).metadata();
+  let blank = false;
+  try {
+    const flat = await sharp21(png).flatten({ background: "#ffffff" }).toBuffer();
+    const stats = await sharp21(flat).stats();
+    blank = stats.channels.slice(0, 3).every((c) => c.min > 200);
+  } catch {
+  }
+  return {
+    longEdge: Math.max(meta.width ?? 0, meta.height ?? 0) || null,
+    width: meta.width ?? null,
+    height: meta.height ?? null,
+    blank
+  };
+}
 
 // ../catalog/src/url.ts
 function normalizeStoreUrl(input) {
@@ -3689,6 +4932,28 @@ function upgradeImageUrl(url) {
     return url;
   }
 }
+var LOCALE_SEGMENT = /^\/[a-z]{2}(?:-[A-Za-z]{2})?\//;
+function preferCanonicalLocale(urls) {
+  const canonical = /* @__PURE__ */ new Set();
+  for (const u of urls) {
+    try {
+      const parsed = new URL(u);
+      if (!LOCALE_SEGMENT.test(parsed.pathname)) canonical.add(`${parsed.origin}${parsed.pathname}`);
+    } catch {
+    }
+  }
+  if (!canonical.size) return urls;
+  return urls.filter((u) => {
+    try {
+      const parsed = new URL(u);
+      if (!LOCALE_SEGMENT.test(parsed.pathname)) return true;
+      const stripped = parsed.pathname.replace(LOCALE_SEGMENT, "/");
+      return !canonical.has(`${parsed.origin}${stripped}`);
+    } catch {
+      return true;
+    }
+  });
+}
 
 // ../catalog/src/normalize.ts
 function cleanText(s) {
@@ -3796,10 +5061,48 @@ function dedupeProducts(products) {
   }
   return [...byKey.values()];
 }
-
-// ../catalog/src/http/fetch.ts
-var USER_AGENT = "scenri-catalog/0.1 (+https://scenri.co)";
-function sleep3(ms) {
+var ALLOW_PRIVATE = process.env.SCENRI_SCRAPE_ALLOW_PRIVATE === "1";
+async function assertReachable(url, real) {
+  const u = new URL(url);
+  if (u.protocol !== "http:" && u.protocol !== "https:") {
+    throw new Error(`Scenri reads http and https addresses only, not ${u.protocol.replace(":", "")}`);
+  }
+  if (ALLOW_PRIVATE) return;
+  const host = u.hostname.replace(/^\[|\]$/g, "");
+  if (isIP(host)) {
+    assertPublicHost(u.hostname, [host], false);
+    return;
+  }
+  if (!real) return;
+  let addresses;
+  try {
+    addresses = (await lookup(host, { all: true })).map((a) => a.address);
+  } catch {
+    return;
+  }
+  assertPublicHost(u.hostname, addresses, false);
+}
+var USER_AGENT2 = "scenri-catalog/0.1 (+https://scenri.co)";
+async function readBounded2(res, maxBytes) {
+  if (!maxBytes || !res.body) return res.text();
+  const reader = res.body.getReader();
+  const decoder = new TextDecoder();
+  let out = "";
+  let seen = 0;
+  try {
+    while (seen < maxBytes) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      seen += value.byteLength;
+      out += decoder.decode(value, { stream: true });
+    }
+  } finally {
+    await reader.cancel().catch(() => {
+    });
+  }
+  return out + decoder.decode();
+}
+function sleep4(ms) {
   return new Promise((r) => setTimeout(r, ms));
 }
 async function httpGet(url, opts = {}) {
@@ -3813,17 +5116,34 @@ async function httpGet(url, opts = {}) {
     opts.signal?.addEventListener("abort", onAbort, { once: true });
     const timer = setTimeout(() => ctrl.abort(), timeoutMs);
     try {
-      const res = await fetchImpl(url, {
-        redirect: "follow",
-        signal: ctrl.signal,
-        headers: {
-          "user-agent": USER_AGENT,
-          accept: opts.accept ?? "application/json, text/html, application/xml, text/xml, */*;q=0.8",
-          ...opts.headers ?? {}
+      let current = url;
+      let res;
+      for (let hop = 0; ; hop++) {
+        await assertReachable(current, !opts.fetchImpl);
+        res = await fetchImpl(current, {
+          redirect: "manual",
+          signal: ctrl.signal,
+          headers: {
+            "user-agent": USER_AGENT2,
+            accept: opts.accept ?? "application/json, text/html, application/xml, text/xml, */*;q=0.8",
+            ...opts.headers ?? {}
+          }
+        });
+        if (res.status < 300 || res.status >= 400) break;
+        const location = res.headers.get("location");
+        await res.body?.cancel().catch(() => {
+        });
+        if (!location || hop >= 5) break;
+        current = new URL(location, current).toString();
+      }
+      if (res.url !== current) {
+        try {
+          Object.defineProperty(res, "url", { value: current, configurable: true });
+        } catch {
         }
-      });
+      }
       if ((res.status === 429 || res.status >= 500) && attempt < retries) {
-        await sleep3(400 * 2 ** attempt);
+        await sleep4(400 * 2 ** attempt);
         continue;
       }
       return res;
@@ -3831,7 +5151,7 @@ async function httpGet(url, opts = {}) {
       lastErr = err;
       if (opts.signal?.aborted) throw err;
       if (attempt < retries) {
-        await sleep3(400 * 2 ** attempt);
+        await sleep4(400 * 2 ** attempt);
         continue;
       }
       throw err;
@@ -3844,7 +5164,7 @@ async function httpGet(url, opts = {}) {
 }
 async function httpText(url, opts = {}) {
   const res = await httpGet(url, opts);
-  const text = await res.text();
+  const text = await readBounded2(res, opts.maxBytes);
   return { ok: res.ok, status: res.status, text, url: res.url || url };
 }
 async function httpJson(url, opts = {}) {
@@ -3874,6 +5194,273 @@ async function mapPool(items, concurrency, fn, signal) {
   await Promise.all(workers);
   return results;
 }
+function loadHtml(html) {
+  return parse(html);
+}
+function attr(el, name) {
+  return el?.getAttribute(name) ?? void 0;
+}
+function textOf(el) {
+  return (el?.text ?? "").replace(/\s+/g, " ").trim();
+}
+
+// ../catalog/src/adapters/productPage.ts
+function stableKey(url) {
+  return createHash("sha256").update(url).digest("hex").slice(0, 16);
+}
+var typesOf = (obj) => {
+  const t = obj["@type"];
+  const list2 = Array.isArray(t) ? t : t ? [t] : [];
+  return list2.map((x) => String(x).toLowerCase());
+};
+function walkJsonLd(node, groups, singles) {
+  if (!node) return;
+  if (Array.isArray(node)) {
+    for (const n of node) walkJsonLd(n, groups, singles);
+    return;
+  }
+  if (typeof node !== "object") return;
+  const obj = node;
+  const types = typesOf(obj);
+  if (types.includes("productgroup")) groups.push(obj);
+  else if (types.includes("product")) singles.push(obj);
+  if (obj["@graph"]) walkJsonLd(obj["@graph"], groups, singles);
+  for (const v of Object.values(obj)) {
+    if (v && typeof v === "object") walkJsonLd(v, groups, singles);
+  }
+}
+var asArray = (v) => Array.isArray(v) ? v : v == null ? [] : [v];
+function imagesOf(n, pageUrl) {
+  return [].concat(n.image ?? []).flat().map((img) => typeof img === "string" ? img : img?.url ?? img?.contentUrl).filter(Boolean).map((u, i) => ({ url: absolutize(pageUrl, String(u)), position: i, width: null, height: null, alt: null })).filter((img) => img.url);
+}
+var offerOf = (n) => Array.isArray(n?.offers) ? n.offers[0] : n?.offers;
+function variesBy(group) {
+  const named = asArray(group.variesBy).map((v) => String(v).split("/").pop() ?? "").filter(Boolean);
+  return named.length ? named : ["size", "color"];
+}
+function variantsOf(group, keys) {
+  return asArray(group.hasVariant).filter((v) => v && typeof v === "object").map((v, i) => {
+    const offer = offerOf(v);
+    const options = Object.fromEntries(
+      keys.map((k) => [k, v[k]]).filter(([, val]) => val != null && val !== "")
+    );
+    const base = String(v.sku || v.mpn || v.gtin || `${group.productGroupID ?? group.name ?? "group"}:${i}`);
+    const suffix = Object.values(options).join("/");
+    return {
+      externalKey: suffix ? `${base}:${suffix}` : base,
+      title: [v.name, ...Object.values(options)].filter(Boolean).join(" "),
+      sku: v.sku ? String(v.sku) : null,
+      price: offer?.price != null ? Number(offer.price) : null,
+      compareAtPrice: null,
+      currency: offer?.priceCurrency ?? null,
+      available: offer?.availability ? /instock/i.test(String(offer.availability)) : null,
+      options
+    };
+  });
+}
+function fromGroup(group, pageUrl) {
+  const keys = variesBy(group);
+  const variants = variantsOf(group, keys);
+  const url = absolutize(pageUrl, String(group.url ?? group["@id"] ?? pageUrl)) ?? pageUrl;
+  const images = imagesOf(group, pageUrl);
+  const fallback = images.length ? images : imagesOf(asArray(group.hasVariant)[0] ?? {}, pageUrl);
+  return normalizeProduct({
+    externalKey: String(group.productGroupID || group.sku || stableKey(url)),
+    title: String(group.name ?? "Product"),
+    descriptionHtml: group.description ? String(group.description) : null,
+    url,
+    vendor: group.brand?.name ?? (typeof group.brand === "string" ? group.brand : null),
+    productType: group.category ? String(group.category) : null,
+    category: group.category ? String(group.category) : null,
+    price: variants.find((v) => v.price != null)?.price ?? null,
+    compareAtPrice: null,
+    currency: variants.find((v) => v.currency)?.currency ?? null,
+    available: variants.some((v) => v.available) || null,
+    tags: [],
+    variants,
+    images: fallback,
+    raw: group
+  });
+}
+function fromSingle(n, pageUrl) {
+  const offers = offerOf(n);
+  const url = String(n.url ?? n["@id"] ?? pageUrl);
+  return normalizeProduct({
+    externalKey: String(n.sku || n.productID || n.mpn || stableKey(url)),
+    title: String(n.name ?? "Product"),
+    descriptionHtml: n.description ? String(n.description) : null,
+    url: absolutize(pageUrl, url) ?? pageUrl,
+    vendor: n.brand?.name ?? (typeof n.brand === "string" ? n.brand : null),
+    productType: n.category ? String(n.category) : null,
+    category: n.category ? String(n.category) : null,
+    price: offers?.price != null ? Number(offers.price) : null,
+    compareAtPrice: null,
+    currency: offers?.priceCurrency ?? null,
+    available: offers?.availability ? /instock/i.test(String(offers.availability)) : null,
+    tags: [],
+    variants: [],
+    images: imagesOf(n, pageUrl),
+    raw: n
+  });
+}
+function extractJsonLdProducts(html, pageUrl, doc) {
+  const root = doc ?? loadHtml(html);
+  const groups = [];
+  const singles = [];
+  for (const el of root.querySelectorAll('script[type="application/ld+json"]')) {
+    const raw = el.innerHTML;
+    if (!raw) continue;
+    try {
+      walkJsonLd(JSON.parse(raw), groups, singles);
+    } catch {
+    }
+  }
+  const claimed = /* @__PURE__ */ new Set();
+  for (const g of groups) for (const v of asArray(g.hasVariant)) if (v && typeof v === "object") claimed.add(v);
+  return [
+    ...groups.map((g) => fromGroup(g, pageUrl)),
+    ...singles.filter((n) => !claimed.has(n)).map((n) => fromSingle(n, pageUrl))
+  ];
+}
+var PRODUCT_MARKERS = [
+  'meta[property="og:type"][content="product"]',
+  'meta[property="product:price:amount"]',
+  'meta[property="og:price:amount"]',
+  '[itemtype*="schema.org/Product"]',
+  '[itemprop="price"]',
+  '[itemprop="offers"]',
+  'form[action*="/cart/add"]',
+  '[name="add"]'
+];
+var BUY_WORDS = /add to (cart|bag|basket)|buy now|add to my bag/i;
+var BUILD_ASSET = /\/_next\/static\/|\/static\/media\/|\/assets\/(icons|flags|ui)\//i;
+var NOT_A_PACKSHOT = /logo|icon|sprite|pixel|avatar|\bflags?\b|\/flags?\/|locale|country|currency|badge|payment|social/i;
+function looksLikeProduct(html, doc) {
+  const $ = doc ?? loadHtml(html);
+  for (const sel of PRODUCT_MARKERS) {
+    try {
+      if ($.querySelector(sel)) return true;
+    } catch {
+    }
+  }
+  for (const el of $.querySelectorAll('button, input[type="submit"], a')) {
+    const words = `${textOf(el)} ${attr(el, "value") ?? ""} ${attr(el, "aria-label") ?? ""}`;
+    if (BUY_WORDS.test(words)) return true;
+  }
+  return false;
+}
+function galleryImages($, pageUrl, cap2 = 12) {
+  const images = [];
+  const og = attr($.querySelector('meta[property="og:image"]'), "content");
+  if (og) {
+    const abs = absolutize(pageUrl, og);
+    if (abs) images.push({ url: abs, position: 0, width: null, height: null, alt: null });
+  }
+  for (const el of $.querySelectorAll("img[src]")) {
+    if (images.length >= cap2) break;
+    const src = attr(el, "src") || attr(el, "data-src");
+    const abs = src ? absolutize(pageUrl, src) : null;
+    if (!abs || NOT_A_PACKSHOT.test(abs) || BUILD_ASSET.test(abs)) continue;
+    if (images.some((x) => x.url === abs)) continue;
+    images.push({ url: abs, position: images.length, width: null, height: null, alt: attr(el, "alt") ?? null });
+  }
+  return images;
+}
+function parseProductHtml(html, pageUrl, doc) {
+  const $ = doc ?? loadHtml(html);
+  if (!looksLikeProduct(html, $)) return null;
+  const title = attr($.querySelector('meta[property="og:title"]'), "content") || textOf($.querySelector("h1")) || textOf($.querySelector("title"));
+  if (!title) return null;
+  const desc = attr($.querySelector('meta[property="og:description"]'), "content") || attr($.querySelector('meta[name="description"]'), "content") || null;
+  const images = galleryImages($, pageUrl);
+  const canonical = attr($.querySelector('link[rel="canonical"]'), "href");
+  const url = canonical ? absolutize(pageUrl, canonical) ?? pageUrl : pageUrl;
+  return normalizeProduct({
+    externalKey: stableKey(url),
+    title,
+    descriptionHtml: desc,
+    url,
+    images,
+    variants: [],
+    tags: [],
+    raw: { source: "html" }
+  });
+}
+function sellsSomething(p) {
+  const n = p.raw ?? {};
+  return Boolean(n.offers || n.sku || n.gtin || n.mpn || n.hasVariant || p.price != null);
+}
+function withGallery(product, doc, pageUrl) {
+  const have = new Set((product.images ?? []).map((i) => i.url));
+  const extra = galleryImages(doc, pageUrl).filter((i) => !have.has(i.url));
+  if (!extra.length) return product;
+  const images = [...product.images ?? []];
+  for (const img of extra) {
+    if (images.length >= 12) break;
+    images.push({ ...img, position: images.length });
+  }
+  return { ...product, images };
+}
+function productsFromPage(html, url) {
+  const doc = loadHtml(html);
+  const declared = looksLikeProduct(html, doc);
+  const fromLd = extractJsonLdProducts(html, url, doc);
+  const selling = declared ? fromLd : fromLd.filter(sellsSomething);
+  if (selling.length === 1) return [withGallery(selling[0], doc, url)];
+  if (selling.length) return selling;
+  if (!declared) return [];
+  const one = parseProductHtml(html, url, doc);
+  return one ? [one] : [];
+}
+var sleep5 = (ms) => new Promise((r) => setTimeout(r, ms));
+async function fetchProductPages(ctx, urls, opts = {}) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  let kept = 0;
+  const want = opts.want ?? Number.POSITIVE_INFINITY;
+  const ceiling = opts.maxPages ?? (Number.isFinite(want) ? want * 3 : urls.length);
+  const take = urls.slice(0, ceiling);
+  let bytes = 0;
+  await mapPool(
+    take,
+    opts.delayMs ? 1 : opts.concurrency ?? 5,
+    async (u) => {
+      if (kept >= want) return;
+      if (opts.deadline != null && Date.now() > opts.deadline) return;
+      if (opts.maxTotalBytes != null && bytes >= opts.maxTotalBytes) return;
+      try {
+        if (opts.delayMs) await sleep5(opts.delayMs);
+        const { ok, text, url } = await httpText(u, {
+          fetchImpl: ctx.fetchImpl,
+          signal: ctx.signal,
+          accept: "text/html",
+          maxBytes: opts.maxBytes
+        });
+        bytes += text.length;
+        if (opts.stats) {
+          opts.stats.pages += 1;
+          opts.stats.bytes = bytes;
+        }
+        if (!ok) {
+          if (opts.stats) opts.stats.refused = (opts.stats.refused ?? 0) + 1;
+          return;
+        }
+        for (const p of productsFromPage(text, url)) {
+          if (seen.has(p.externalKey)) continue;
+          seen.add(p.externalKey);
+          kept++;
+          if (opts.onEach) opts.onEach(p);
+          else out.push(p);
+        }
+        opts.onProduct?.(kept);
+      } catch {
+        if (opts.stats) opts.stats.refused = (opts.stats.refused ?? 0) + 1;
+      }
+    },
+    ctx.signal
+  );
+  return out;
+}
 
 // ../catalog/src/adapters/shopify.ts
 function mapShopifyProduct(base, p) {
@@ -3927,10 +5514,14 @@ function mapShopifyProduct(base, p) {
 async function fetchProductsJsonPage(ctx, page, limit = 250) {
   const origin = originOf(ctx.baseUrl);
   const url = `${origin}/products.json?limit=${limit}&page=${page}`;
-  const { ok, json } = await httpJson(url, { fetchImpl: ctx.fetchImpl, signal: ctx.signal });
-  if (!ok || !json?.products) return [];
-  return json.products;
+  const { ok, status, json } = await httpJson(url, {
+    fetchImpl: ctx.fetchImpl,
+    signal: ctx.signal
+  });
+  if (ok && json?.products) return { products: json.products, blocked: false };
+  return { products: [], blocked: status === 401 || status === 403 || status === 404 || status >= 500 };
 }
+var JSON_BLOCKED = "json-blocked";
 async function collectSitemapProductUrls(ctx) {
   const origin = originOf(ctx.baseUrl);
   const urls = /* @__PURE__ */ new Set();
@@ -3956,7 +5547,7 @@ async function collectSitemapProductUrls(ctx) {
       }
     }
   }
-  return [...urls];
+  return preferCanonicalLocale([...urls]);
 }
 var shopifyAdapter = {
   platform: "shopify",
@@ -3988,6 +5579,7 @@ var shopifyAdapter = {
   },
   async discover(ctx) {
     const warnings = [];
+    const hints = [];
     const keys = /* @__PURE__ */ new Set();
     const productUrls = /* @__PURE__ */ new Set();
     const origin = originOf(ctx.baseUrl);
@@ -3995,8 +5587,12 @@ var shopifyAdapter = {
     let emptyStreak = 0;
     while (emptyStreak < 1) {
       if (ctx.signal?.aborted) throw new Error("aborted");
-      const products = await fetchProductsJsonPage(ctx, page);
+      const { products, blocked: blocked2 } = await fetchProductsJsonPage(ctx, page);
       ctx.onProgress?.({ stage: "discovering", discovered: keys.size, message: `Shopify page ${page}` });
+      if (blocked2 && page === 1) {
+        hints.push(JSON_BLOCKED);
+        warnings.push("This store does not serve its product API, so the product pages were read instead");
+      }
       if (!products.length) {
         emptyStreak++;
         break;
@@ -4025,17 +5621,23 @@ var shopifyAdapter = {
       productKeys: [...keys],
       productUrls: [...productUrls],
       estimatedTotal: keys.size || productUrls.size || null,
-      warnings
+      // A store whose own product API answered but refused us leaves nothing
+      // to read but the pages themselves, one request each. That is what
+      // gymshark.com does, and it is the run worth batching.
+      byPage: hints.includes(JSON_BLOCKED),
+      warnings,
+      hints
     };
   },
   async fetchAll(ctx, discovered) {
     const origin = originOf(ctx.baseUrl);
     const out = [];
     const seen = /* @__PURE__ */ new Set();
+    const jsonBlocked = discovered.hints?.includes(JSON_BLOCKED) ?? false;
     let page = 1;
-    while (true) {
+    while (!jsonBlocked) {
       if (ctx.signal?.aborted) throw new Error("aborted");
-      const products = await fetchProductsJsonPage(ctx, page);
+      const { products } = await fetchProductsJsonPage(ctx, page);
       if (!products.length) break;
       for (const p of products) {
         const mapped = mapShopifyProduct(origin, p);
@@ -4052,48 +5654,56 @@ var shopifyAdapter = {
       page++;
       if (page > 1e4) break;
     }
-    const missingUrls = discovered.productUrls.filter((u) => {
-      const handle = /\/products\/([^/?#]+)/i.exec(u)?.[1];
-      return handle && !out.some((p) => p.handle === decodeURIComponent(handle));
+    const handleOf = (u) => {
+      const raw = /\/products\/([^/?#]+)/i.exec(u)?.[1];
+      return raw ? decodeURIComponent(raw) : null;
+    };
+    const stillMissing = () => discovered.productUrls.filter((u) => {
+      const handle = handleOf(u);
+      return handle && !out.some((p) => p.handle === handle);
     });
-    if (missingUrls.length) {
-      await mapPool(
-        missingUrls,
-        6,
-        async (u) => {
-          const handle = /\/products\/([^/?#]+)/i.exec(u)?.[1];
-          if (!handle) return;
-          const { ok, json } = await httpJson(`${origin}/products/${handle}.json`, {
-            fetchImpl: ctx.fetchImpl,
-            signal: ctx.signal
-          });
-          if (ok && json?.product) {
-            const mapped = mapShopifyProduct(origin, json.product);
-            if (!seen.has(mapped.externalKey)) {
-              seen.add(mapped.externalKey);
-              out.push(mapped);
-              ctx.onProgress?.({ stage: "fetching_products", fetched: out.length });
+    if (!jsonBlocked) {
+      const missingUrls = stillMissing();
+      if (missingUrls.length) {
+        await mapPool(
+          missingUrls,
+          6,
+          async (u) => {
+            const handle = handleOf(u);
+            if (!handle) return;
+            const { ok, json } = await httpJson(`${origin}/products/${handle}.json`, {
+              fetchImpl: ctx.fetchImpl,
+              signal: ctx.signal
+            });
+            if (ok && json?.product) {
+              const mapped = mapShopifyProduct(origin, json.product);
+              if (!seen.has(mapped.externalKey)) {
+                seen.add(mapped.externalKey);
+                out.push(mapped);
+                ctx.onProgress?.({ stage: "fetching_products", fetched: out.length });
+              }
             }
-          }
-        },
-        ctx.signal
-      );
+          },
+          ctx.signal
+        );
+      }
+    }
+    const unread = stillMissing();
+    if (unread.length) {
+      for (const p of await fetchProductPages(ctx, unread, {
+        concurrency: 4,
+        onProduct: (fetched) => ctx.onProgress?.({ stage: "fetching_products", fetched: out.length + fetched })
+      })) {
+        if (seen.has(p.externalKey)) continue;
+        seen.add(p.externalKey);
+        out.push(p);
+      }
     }
     return out;
   }
 };
-function loadHtml(html) {
-  return parse(html);
-}
-function attr(el, name) {
-  return el?.getAttribute(name) ?? void 0;
-}
-function textOf(el) {
-  return (el?.text ?? "").replace(/\s+/g, " ").trim();
-}
-function stableKey(url) {
-  return createHash("sha256").update(url).digest("hex").slice(0, 16);
-}
+
+// ../catalog/src/adapters/generic.ts
 async function extractSitemapUrls(ctx, filter = () => true) {
   const origin = originOf(ctx.baseUrl);
   const out = /* @__PURE__ */ new Set();
@@ -4125,89 +5735,7 @@ async function extractSitemapUrls(ctx, filter = () => true) {
     }
     if (seen.size > 200) break;
   }
-  return [...out];
-}
-function walkJsonLd(node, out) {
-  if (!node) return;
-  if (Array.isArray(node)) {
-    for (const n of node) walkJsonLd(n, out);
-    return;
-  }
-  if (typeof node !== "object") return;
-  const obj = node;
-  const type = obj["@type"];
-  const types = Array.isArray(type) ? type : type ? [type] : [];
-  if (types.some((t) => String(t).toLowerCase() === "product")) out.push(obj);
-  if (obj["@graph"]) walkJsonLd(obj["@graph"], out);
-  for (const v of Object.values(obj)) {
-    if (v && typeof v === "object") walkJsonLd(v, out);
-  }
-}
-function extractJsonLdProducts(html, pageUrl) {
-  const root = loadHtml(html);
-  const nodes = [];
-  for (const el of root.querySelectorAll('script[type="application/ld+json"]')) {
-    const raw = el.innerHTML;
-    if (!raw) continue;
-    try {
-      walkJsonLd(JSON.parse(raw), nodes);
-    } catch {
-    }
-  }
-  return nodes.map((n) => {
-    const offers = Array.isArray(n.offers) ? n.offers[0] : n.offers;
-    const images = [].concat(n.image ?? []).flat().map((img) => typeof img === "string" ? img : img?.url ?? img?.contentUrl).filter(Boolean).map((u, i) => ({ url: absolutize(pageUrl, String(u)), position: i, width: null, height: null, alt: null })).filter((img) => img.url);
-    const url = String(n.url ?? n["@id"] ?? pageUrl);
-    return normalizeProduct({
-      externalKey: String(n.sku || n.productID || n.mpn || stableKey(url)),
-      title: String(n.name ?? "Product"),
-      descriptionHtml: n.description ? String(n.description) : null,
-      url: absolutize(pageUrl, url) ?? pageUrl,
-      vendor: n.brand?.name ?? (typeof n.brand === "string" ? n.brand : null),
-      productType: n.category ? String(n.category) : null,
-      category: n.category ? String(n.category) : null,
-      price: offers?.price != null ? Number(offers.price) : null,
-      compareAtPrice: null,
-      currency: offers?.priceCurrency ?? null,
-      available: offers?.availability ? /instock/i.test(String(offers.availability)) : null,
-      tags: [],
-      variants: [],
-      images,
-      raw: n
-    });
-  });
-}
-function parseProductHtml(html, pageUrl) {
-  const $ = loadHtml(html);
-  const title = attr($.querySelector('meta[property="og:title"]'), "content") || textOf($.querySelector("h1")) || textOf($.querySelector("title"));
-  if (!title) return null;
-  const desc = attr($.querySelector('meta[property="og:description"]'), "content") || attr($.querySelector('meta[name="description"]'), "content") || null;
-  const images = [];
-  const og = attr($.querySelector('meta[property="og:image"]'), "content");
-  if (og) {
-    const abs = absolutize(pageUrl, og);
-    if (abs) images.push({ url: abs, position: 0, width: null, height: null, alt: null });
-  }
-  for (const el of $.querySelectorAll("img[src]")) {
-    if (images.length >= 12) break;
-    const src = attr(el, "src") || attr(el, "data-src");
-    const abs = src ? absolutize(pageUrl, src) : null;
-    if (!abs || /logo|icon|sprite|pixel|avatar/i.test(abs)) continue;
-    if (images.some((x) => x.url === abs)) continue;
-    images.push({ url: abs, position: images.length, width: null, height: null, alt: attr(el, "alt") ?? null });
-  }
-  const canonical = attr($.querySelector('link[rel="canonical"]'), "href");
-  const url = canonical ? absolutize(pageUrl, canonical) ?? pageUrl : pageUrl;
-  return normalizeProduct({
-    externalKey: stableKey(url),
-    title,
-    descriptionHtml: desc,
-    url,
-    images,
-    variants: [],
-    tags: [],
-    raw: { source: "html" }
-  });
+  return preferCanonicalLocale([...out]);
 }
 async function extractFeedUrls(ctx) {
   const origin = originOf(ctx.baseUrl);
@@ -4311,41 +5839,15 @@ var genericAdapter = {
       productKeys: [...productUrls].map(stableKey),
       productUrls: [...productUrls],
       estimatedTotal: productUrls.size || null,
+      // Nothing here but addresses: every product is its own page fetch.
+      byPage: true,
       warnings
     };
   },
   async fetchAll(ctx, discovered) {
-    const out = [];
-    const seen = /* @__PURE__ */ new Set();
-    await mapPool(
-      discovered.productUrls,
-      5,
-      async (u) => {
-        try {
-          const { ok, text, url } = await httpText(u, {
-            fetchImpl: ctx.fetchImpl,
-            signal: ctx.signal,
-            accept: "text/html"
-          });
-          if (!ok) return;
-          const fromLd = extractJsonLdProducts(text, url);
-          const list2 = fromLd.length ? fromLd : [parseProductHtml(text, url)].filter(Boolean);
-          for (const p of list2) {
-            if (seen.has(p.externalKey)) continue;
-            seen.add(p.externalKey);
-            out.push(p);
-          }
-          ctx.onProgress?.({
-            stage: "fetching_products",
-            fetched: out.length,
-            discovered: discovered.productUrls.length
-          });
-        } catch {
-        }
-      },
-      ctx.signal
-    );
-    return out;
+    return fetchProductPages(ctx, discovered.productUrls, {
+      onProduct: (fetched) => ctx.onProgress?.({ stage: "fetching_products", fetched, discovered: discovered.productUrls.length })
+    });
   }
 };
 
@@ -4453,6 +5955,9 @@ var woocommerceAdapter = {
       productKeys: [...keys],
       productUrls: [...productUrls],
       estimatedTotal: keys.size || productUrls.size || null,
+      // The WooCommerce store API answers in pages of a hundred, so the whole
+      // catalogue is a handful of requests and needs no batching of ours.
+      byPage: false,
       warnings
     };
   },
@@ -4484,30 +5989,13 @@ var woocommerceAdapter = {
     }
     if (apiWorked && out.length) return out;
     const urls = discovered.productUrls.length ? discovered.productUrls : [...new Set(discovered.productKeys)];
-    await mapPool(
-      urls,
-      5,
-      async (u) => {
-        try {
-          const {
-            ok,
-            text,
-            url: finalUrl
-          } = await httpText(u, { fetchImpl: ctx.fetchImpl, signal: ctx.signal, accept: "text/html" });
-          if (!ok) return;
-          const fromLd = extractJsonLdProducts(text, finalUrl);
-          const products = fromLd.length ? fromLd : [parseProductHtml(text, finalUrl)].filter(Boolean);
-          for (const p of products) {
-            if (seen.has(p.externalKey)) continue;
-            seen.add(p.externalKey);
-            out.push(p);
-          }
-          ctx.onProgress?.({ stage: "fetching_products", fetched: out.length });
-        } catch {
-        }
-      },
-      ctx.signal
-    );
+    for (const p of await fetchProductPages(ctx, urls, {
+      onProduct: (fetched) => ctx.onProgress?.({ stage: "fetching_products", fetched: out.length + fetched })
+    })) {
+      if (seen.has(p.externalKey)) continue;
+      seen.add(p.externalKey);
+      out.push(p);
+    }
     return out;
   }
 };
@@ -4572,45 +6060,19 @@ var webflowAdapter = {
     }
     ctx.onProgress?.({ stage: "discovering", discovered: productUrls.size });
     if (!productUrls.size) warnings.push("No Webflow product URLs discovered");
-    return {
-      productKeys: [...productUrls],
-      productUrls: [...productUrls],
-      estimatedTotal: productUrls.size || null,
-      warnings
-    };
-  },
-  async fetchAll(ctx, discovered) {
-    const out = [];
-    const seen = /* @__PURE__ */ new Set();
-    await mapPool(
-      discovered.productUrls,
-      5,
-      async (u) => {
-        try {
-          const { ok, text, url } = await httpText(u, {
-            fetchImpl: ctx.fetchImpl,
-            signal: ctx.signal,
-            accept: "text/html"
-          });
-          if (!ok) return;
-          const fromLd = extractJsonLdProducts(text, url);
-          const list2 = fromLd.length ? fromLd : [parseProductHtml(text, url)].filter(Boolean);
-          for (const p of list2) {
-            if (seen.has(p.externalKey)) continue;
-            seen.add(p.externalKey);
-            out.push(p);
-          }
-          ctx.onProgress?.({
-            stage: "fetching_products",
-            fetched: out.length,
-            discovered: discovered.productUrls.length
-          });
-        } catch {
-        }
-      },
-      ctx.signal
-    );
-    return out;
+    return {
+      productKeys: [...productUrls],
+      productUrls: [...productUrls],
+      estimatedTotal: productUrls.size || null,
+      // Webflow has no catalogue API to ask: every product is its own page.
+      byPage: true,
+      warnings
+    };
+  },
+  async fetchAll(ctx, discovered) {
+    return fetchProductPages(ctx, discovered.productUrls, {
+      onProduct: (fetched) => ctx.onProgress?.({ stage: "fetching_products", fetched, discovered: discovered.productUrls.length })
+    });
   }
 };
 
@@ -4652,7 +6114,7 @@ function baseProgress(platform = "unknown") {
     warnings: []
   };
 }
-async function runCatalogIngestion(opts) {
+async function discoverCatalog(opts) {
   const fetchImpl = opts.fetchImpl ?? fetch;
   const progress = baseProgress();
   const emit = (patch2) => {
@@ -4695,57 +6157,247 @@ async function runCatalogIngestion(opts) {
     warnings: [...progress.warnings, ...discovered.warnings],
     message: `Found ${discovered.estimatedTotal ?? discovered.productUrls.length} products`
   });
-  if (!(discovered.estimatedTotal ?? discovered.productUrls.length)) {
-    emit({
-      stage: "failed",
-      errors: [
-        ...progress.errors,
-        {
-          code: "empty_catalog",
-          message: detection.platform === "generic" ? "No public product catalog found. This store may be JavaScript-rendered or require authentication." : `No products discovered on this ${detection.platform} store.`
-        }
-      ]
-    });
-    return { baseUrl: detection.baseUrl, detection, products: [], progress };
+  const estimatedTotal = discovered.estimatedTotal ?? discovered.productUrls.length;
+  let empty = null;
+  if (!estimatedTotal) {
+    empty = {
+      code: "empty_catalog",
+      message: detection.platform === "generic" ? "No public product catalog found. This store may be JavaScript-rendered or require authentication." : `No products discovered on this ${detection.platform} store.`
+    };
+    emit({ stage: "failed", errors: [...progress.errors, empty] });
   }
-  emit({ stage: "fetching_products", message: "Fetching product details" });
-  let products = [];
+  return {
+    baseUrl: detection.baseUrl,
+    detection,
+    adapter,
+    ctx: { ...ctx, baseUrl: detection.baseUrl },
+    productUrls: discovered.productUrls,
+    productKeys: discovered.productKeys,
+    byPage: (discovered.byPage ?? false) && discovered.productUrls.length > 0,
+    estimatedTotal,
+    progress,
+    empty,
+    emit,
+    async fetchAll() {
+      emit({ stage: "fetching_products", message: "Fetching product details" });
+      try {
+        return dedupeProducts(await adapter.fetchAll({ ...ctx, baseUrl: detection.baseUrl }, discovered));
+      } catch (err) {
+        emit({
+          stage: "partial",
+          errors: [...progress.errors, { code: "fetch_failed", message: String(err?.message ?? err), retryable: true }]
+        });
+        return [];
+      }
+    }
+  };
+}
+
+// ../catalog/src/robots.ts
+var ALLOW_ALL = { rules: [], crawlDelayMs: 0 };
+function toRegExp(pattern) {
+  const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+  const anchored = escaped.endsWith("\\$") ? `${escaped.slice(0, -2)}$` : escaped;
+  return new RegExp(`^${anchored}`);
+}
+function parseRobots(text, agent = USER_AGENT2) {
+  const lines = text.split(/\r?\n/).map((l) => l.replace(/#.*$/, "").trim());
+  const groups = [];
+  let current = null;
+  let expectingAgents = false;
+  for (const line of lines) {
+    const at = line.indexOf(":");
+    if (at < 0) continue;
+    const field = line.slice(0, at).trim().toLowerCase();
+    const value = line.slice(at + 1).trim();
+    if (field === "user-agent") {
+      if (!current || !expectingAgents) {
+        current = { agents: [], rules: [], delay: 0 };
+        groups.push(current);
+        expectingAgents = true;
+      }
+      current.agents.push(value.toLowerCase());
+      continue;
+    }
+    if (!current) continue;
+    expectingAgents = false;
+    if (field === "disallow" && value) current.rules.push({ allow: false, pattern: value });
+    else if (field === "allow" && value) current.rules.push({ allow: true, pattern: value });
+    else if (field === "crawl-delay") {
+      const n = Number(value);
+      if (Number.isFinite(n) && n > 0) current.delay = n;
+    }
+  }
+  const token = agent.toLowerCase();
+  const mine = groups.filter((g) => g.agents.some((a) => a !== "*" && token.includes(a)));
+  const chosen = mine.length ? mine : groups.filter((g) => g.agents.includes("*"));
+  return {
+    rules: chosen.flatMap((g) => g.rules),
+    crawlDelayMs: Math.max(0, ...chosen.map((g) => g.delay)) * 1e3
+  };
+}
+function isAllowed(robots, url) {
+  let path;
   try {
-    products = await adapter.fetchAll({ ...ctx, baseUrl: detection.baseUrl }, discovered);
-  } catch (err) {
-    emit({
-      stage: "partial",
-      errors: [...progress.errors, { code: "fetch_failed", message: String(err?.message ?? err), retryable: true }]
-    });
+    const parsed = new URL(url);
+    path = `${parsed.pathname}${parsed.search}`;
+  } catch {
+    return true;
   }
-  products = dedupeProducts(products);
-  emit({
-    stage: products.length ? "fetching_products" : progress.stage,
-    fetched: products.length,
-    discovered: Math.max(progress.discovered, products.length),
-    message: `Fetched ${products.length} products`
-  });
-  if (!products.length) {
-    emit({
-      stage: "failed",
-      errors: [
-        ...progress.errors,
-        { code: "no_products_fetched", message: "Discovery found URLs but no product payloads could be parsed." }
-      ]
+  let best = null;
+  for (const rule of robots.rules) {
+    if (!toRegExp(rule.pattern).test(path)) continue;
+    const length = rule.pattern.replace(/[*$]/g, "").length;
+    if (!best || length > best.length || length === best.length && rule.allow) {
+      best = { allow: rule.allow, length };
+    }
+  }
+  return best ? best.allow : true;
+}
+async function fetchRobots(ctx) {
+  try {
+    const { ok, text } = await httpText(`${originOf(ctx.baseUrl)}/robots.txt`, {
+      fetchImpl: ctx.fetchImpl,
+      signal: ctx.signal,
+      retries: 0,
+      accept: "text/plain",
+      maxBytes: 512e3
     });
+    if (!ok || !text) return ALLOW_ALL;
+    return parseRobots(text);
+  } catch {
+    return ALLOW_ALL;
+  }
+}
+
+// ../catalog/src/candidates.ts
+var DEFAULT_SCAN_BUDGET = {
+  maxPreviewPages: 24,
+  maxBytesPerPage: 15e5,
+  maxTotalBytes: 4e7,
+  budgetMs: 25e3,
+  concurrency: 4,
+  /**
+   * Time the preview is owed even when discovery has already spent the lot.
+   *
+   * Discovery on a large store can run long, and when it overran the whole
+   * budget the preview read zero pages and the store was reported as one we
+   * could not open - from a site that was answering every request with a 200.
+   * Being slow to list a catalog is not the same as being shut.
+   */
+  previewFloorMs: 12e3
+};
+var COMMERCE_SIGNALS = /* @__PURE__ */ new Set([
+  "products.json",
+  "shopify-html",
+  "wc-store-api",
+  "woocommerce-html",
+  "webflow-commerce"
+]);
+function wwwVariant(baseUrl) {
+  try {
+    const url = new URL(baseUrl);
+    const labels = url.hostname.split(".");
+    if (labels.length !== 2 || /^\d+$/.test(labels[labels.length - 1])) return null;
+    url.hostname = `www.${url.hostname}`;
+    return url.origin;
+  } catch {
+    return null;
+  }
+}
+async function scanForCandidates(opts) {
+  const first = await scanOnce(opts, originOf(normalizeStoreUrl(opts.url)));
+  if (first.verdict === "found") return first;
+  const alternate = wwwVariant(first.baseUrl);
+  if (!alternate) return first;
+  const second = await scanOnce(opts, alternate);
+  return second.verdict === "found" ? second : first;
+}
+async function scanOnce(opts, baseUrl) {
+  const started = Date.now();
+  const budget = { ...DEFAULT_SCAN_BUDGET, ...opts.budget };
+  const deadline = started + budget.budgetMs;
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const ctx = {
+    fetchImpl,
+    baseUrl,
+    signal: opts.signal,
+    onProgress: opts.onProgress
+  };
+  const warnings = [];
+  const stats = { pages: 0, bytes: 0 };
+  const robots = await fetchRobots(ctx);
+  if (robots.crawlDelayMs) warnings.push("This site asks readers to go slowly, so the preview is smaller");
+  opts.onProgress?.({ stage: "discovering", message: "Looking for a shop" });
+  const detection = await detectPlatform(ctx);
+  const adapter = adapterFor(detection.platform);
+  let discovered;
+  try {
+    discovered = await adapter.discover(ctx);
+  } catch {
+    return done("blocked", [], [], 0, "none", [...warnings, "The product list could not be read"]);
+  }
+  warnings.push(...discovered.warnings);
+  const urls = discovered.productUrls.filter((u) => isAllowed(robots, u));
+  const refused = discovered.productUrls.length - urls.length;
+  if (refused > 0) warnings.push(`${refused} pages are disallowed by this site's robots.txt`);
+  const fromApi = detection.platform !== "generic" && !discovered.hints?.includes("json-blocked");
+  const countSource = urls.length === 0 ? "none" : fromApi ? "api" : "sitemap";
+  if (urls.length === 0) {
+    const commerce = detection.signals.some((sig) => COMMERCE_SIGNALS.has(sig));
+    return done(commerce ? "likely" : "none", [], [], 0, countSource, warnings);
+  }
+  opts.onProgress?.({ stage: "discovering", discovered: urls.length, message: "Reading a few products" });
+  const previewDeadline = Math.max(deadline, Date.now() + budget.previewFloorMs);
+  const read = dedupeProducts(
+    await fetchProductPages(ctx, urls, {
+      want: budget.maxPreviewPages,
+      stats,
+      concurrency: budget.concurrency,
+      maxBytes: budget.maxBytesPerPage,
+      maxTotalBytes: budget.maxTotalBytes,
+      delayMs: robots.crawlDelayMs,
+      deadline: previewDeadline,
+      onProduct: (fetched) => opts.onProgress?.({ stage: "fetching_products", fetched, discovered: urls.length })
+    })
+  );
+  const preview = read.slice(0, budget.maxPreviewPages);
+  const verdict = preview.length ? "found" : "blocked";
+  return done(verdict, preview, urls, urls.length, countSource, warnings);
+  function done(verdict2, candidates, candidateUrls, count, source, notes) {
+    return {
+      baseUrl,
+      platform: detection?.platform ?? "unknown",
+      signals: detection?.signals ?? [],
+      verdict: verdict2,
+      count,
+      countSource: source,
+      candidates,
+      candidateUrls,
+      truncated: count > candidates.length,
+      warnings: notes,
+      spent: { pages: stats.pages, bytes: stats.bytes, ms: Date.now() - started }
+    };
   }
-  return { baseUrl: detection.baseUrl, detection, products, progress };
 }
 
 // src/catalogImport.ts
 var running = /* @__PURE__ */ new Map();
 function cancelCatalogImport(jobId) {
-  const ctrl = running.get(jobId);
-  if (!ctrl) return false;
-  ctrl.abort();
+  const job = running.get(jobId);
+  if (!job) return false;
+  job.ctrl.abort();
   return true;
 }
-function startCatalogImport(deps, brandId, url) {
+async function settleCatalogImports(timeoutMs = 5e3) {
+  if (!running.size) return;
+  for (const { ctrl } of running.values()) ctrl.abort();
+  await Promise.race([
+    Promise.allSettled([...running.values()].map((j) => j.done)),
+    new Promise((r) => setTimeout(r, timeoutMs))
+  ]);
+}
+function startCatalogImport(deps, brandId, url, opts = {}) {
   const { core } = deps;
   if (!core.store.getBrand(brandId)) throw Object.assign(new Error("brand not found"), { statusCode: 404 });
   let normalized;
@@ -4756,57 +6408,185 @@ function startCatalogImport(deps, brandId, url) {
   }
   const job = core.catalog.createJob({ brandId, url: normalized });
   const ctrl = new AbortController();
-  running.set(job.id, ctrl);
-  void runJob(deps, job.id, brandId, normalized, ctrl.signal).finally(() => {
+  const done = runJob(deps, job.id, brandId, normalized, ctrl.signal, opts.only).finally(() => {
     running.delete(job.id);
   });
+  void done.catch(() => {
+  });
+  running.set(job.id, { ctrl, done });
   return { jobId: job.id };
 }
-async function runJob(deps, jobId, brandId, url, signal) {
+function progressWriter(patch2) {
+  let lastStage = "";
+  let lastMessage = null;
+  return (p) => {
+    const reported = p.stage === "queued" ? "discovering" : p.stage;
+    const stage = TERMINAL.has(reported) ? "fetching_products" : reported;
+    const message = p.message ?? null;
+    const notable = stage !== lastStage || message !== lastMessage || p.fetched % 10 === 0;
+    if (!notable) return;
+    lastStage = stage;
+    lastMessage = message;
+    patch2({
+      stage,
+      platform: p.platform,
+      discovered: p.discovered,
+      fetched: p.fetched,
+      warnings: p.warnings,
+      errors: p.errors,
+      message
+    });
+  };
+}
+async function runJob(deps, jobId, brandId, url, signal, only) {
   const { core, fetchImpl } = deps;
   const patch2 = (p) => core.catalog.updateJob(jobId, p);
   try {
-    patch2({ stage: "discovering", message: "Detecting store platform" });
-    const result = await runCatalogIngestion({
-      url,
-      fetchImpl,
-      signal,
-      onProgress: (p) => {
+    const tally = { fetched: 0, upserted: 0, imagesDone: 0, imagesTotal: 0, errors: [], seenKeys: [] };
+    const ctx = { fetchImpl: fetchImpl ?? fetch, baseUrl: url, signal };
+    let urls = [];
+    let bulk = null;
+    let baseUrl;
+    let platform;
+    let discovered;
+    let warnings = [];
+    const sweep = !only?.length;
+    if (only?.length) {
+      patch2({ stage: "fetching_products", message: `Importing ${only.length} products`, discovered: only.length });
+      const detection = await detectPlatform(ctx);
+      urls = only;
+      baseUrl = url;
+      platform = detection.platform;
+      discovered = only.length;
+    } else {
+      patch2({ stage: "discovering", message: "Detecting store platform" });
+      const found = await discoverCatalog({ url, fetchImpl, signal, onProgress: progressWriter(patch2) });
+      baseUrl = found.baseUrl;
+      platform = found.detection.platform;
+      discovered = found.estimatedTotal;
+      warnings = found.progress.warnings;
+      if (found.empty || !found.estimatedTotal) {
+        const source = core.catalog.upsertSource(brandId, found.baseUrl, platform);
+        patch2({ sourceId: source.id, platform });
         patch2({
-          stage: p.stage === "queued" ? "discovering" : p.stage,
-          platform: p.platform,
-          discovered: p.discovered,
-          fetched: p.fetched,
-          warnings: p.warnings,
-          errors: p.errors,
-          message: p.message ?? null
+          stage: "no_catalog",
+          errors: [],
+          warnings: found.progress.warnings,
+          message: "No shop found on this site",
+          finished: true
         });
+        core.catalog.setSourceStatus(source.id, "empty", true);
+        return;
       }
-    });
+      if (!found.byPage) {
+        const products = await found.fetchAll();
+        if (signal.aborted) {
+          patch2({ stage: "cancelled", errors: [], message: "Stopped before anything was saved", finished: true });
+          return;
+        }
+        if (!products.length) {
+          const source = core.catalog.upsertSource(brandId, baseUrl, platform);
+          patch2({ sourceId: source.id, platform });
+          patch2({
+            stage: "failed",
+            errors: found.progress.errors,
+            warnings: found.progress.warnings,
+            message: found.progress.errors[0]?.message ?? "No products imported",
+            finished: true
+          });
+          core.catalog.setSourceStatus(source.id, "failed", true);
+          return;
+        }
+        bulk = products;
+        discovered = found.progress.discovered;
+        warnings = found.progress.warnings;
+      }
+      if (!bulk) {
+        urls = found.productUrls;
+        patch2({ stage: "fetching_products", discovered, message: `Reading ${discovered.toLocaleString()} products` });
+      }
+    }
+    const run2 = beginWrite(deps, jobId, brandId, baseUrl, platform, tally, discovered);
+    const pictures = drainPictures(deps, jobId, brandId, tally, signal);
+    let pictureErrors;
+    const stats = { pages: 0, bytes: 0, refused: 0 };
+    try {
+      if (bulk) for (const p of bulk) run2.write(p);
+      else
+        await fetchProductPages(ctx, urls, {
+          concurrency: IMPORT_CONCURRENCY,
+          maxBytes: 15e5,
+          onEach: run2.write,
+          stats
+        });
+      if (!signal.aborted && tally.upserted) {
+        patch2({
+          stage: "processing_assets",
+          message: `Downloading ${tally.imagesTotal.toLocaleString()} pictures`,
+          upserted: tally.upserted,
+          fetched: tally.fetched
+        });
+      }
+    } finally {
+      pictures.stop();
+      pictureErrors = await pictures.done;
+    }
     if (signal.aborted) {
-      patch2({ stage: "failed", message: "Import cancelled", finished: true });
+      patch2({
+        stage: "cancelled",
+        errors: [],
+        message: tally.upserted ? `Stopped after saving ${tally.upserted.toLocaleString()} products` : "Stopped before anything was saved",
+        finished: true
+      });
+      core.catalog.setSourceStatus(run2.sourceId, "partial", true);
       return;
     }
-    const source = core.catalog.upsertSource(brandId, result.baseUrl, result.detection.platform);
-    patch2({ sourceId: source.id, platform: result.detection.platform });
-    core.catalog.setSourceStatus(source.id, "importing");
-    if (!result.products.length) {
-      const stage = result.progress.stage === "failed" ? "failed" : "failed";
+    if (!tally.upserted) {
+      const message = only?.length ? "None of the chosen products could be read" : `Found pages on this ${platform} store but could not read a product from any of them. The store may be blocking automated readers.`;
       patch2({
-        stage,
-        errors: result.progress.errors,
-        warnings: result.progress.warnings,
-        message: result.progress.errors[0]?.message ?? "No products imported",
+        stage: "failed",
+        message,
+        errors: [{ code: "no_products_fetched", message }],
         finished: true
       });
-      core.catalog.setSourceStatus(source.id, "failed", true);
+      core.catalog.setSourceStatus(run2.sourceId, "failed", true);
+      return;
+    }
+    run2.finish({
+      sweep,
+      warnings,
+      errors: pictureErrors,
+      refused: stats.refused,
+      // Every address was read. A bulk API hands the catalogue over whole, so
+      // there is nothing to cover.
+      covered: bulk ? true : stats.pages >= urls.length
+    });
+  } catch (err) {
+    if (signal.aborted) {
+      patch2({ stage: "cancelled", errors: [], message: "Stopped before anything was saved", finished: true });
       return;
     }
-    patch2({ stage: "fetching_products", fetched: result.products.length, message: "Saving products" });
-    let upserted = 0;
-    const seenKeys = [];
-    for (const p of result.products) {
-      if (signal.aborted) break;
+    patch2({
+      stage: "failed",
+      message: String(err?.message ?? err),
+      errors: [{ code: "import_failed", message: String(err?.message ?? err) }],
+      finished: true
+    });
+  }
+}
+var IMAGES_PER_PRODUCT = 3;
+var TERMINAL = /* @__PURE__ */ new Set(["completed", "partial", "no_catalog", "cancelled", "failed"]);
+var IMAGE_CONCURRENCY = 4;
+var sleep6 = (ms) => new Promise((r) => setTimeout(r, ms));
+function beginWrite(deps, jobId, brandId, baseUrl, platform, tally, discovered) {
+  const { core } = deps;
+  const patch2 = (p) => core.catalog.updateJob(jobId, p);
+  const source = core.catalog.upsertSource(brandId, baseUrl, platform);
+  patch2({ sourceId: source.id, platform });
+  core.catalog.setSourceStatus(source.id, "importing");
+  return {
+    sourceId: source.id,
+    write(p) {
       core.catalog.upsertProduct({
         sourceId: source.id,
         brandId,
@@ -4823,7 +6603,9 @@ async function runJob(deps, jobId, brandId, url, signal) {
         compareAtPrice: p.compareAtPrice,
         currency: p.currency,
         available: p.available,
-        raw: p.raw,
+        // `raw` is the whole crawled payload, 14.2 KB a product on gymshark
+        // and 32 MB across its catalog, written to sqlite and read by nothing.
+        raw: null,
         variants: p.variants,
         images: (p.images ?? []).map((img) => ({
           sourceUrl: img.url,
@@ -4832,93 +6614,111 @@ async function runJob(deps, jobId, brandId, url, signal) {
           height: img.height,
           alt: img.alt
         })),
-        collections: (p.collections ?? []).map((c) => ({
-          externalKey: c,
-          title: c
-        }))
+        collections: (p.collections ?? []).map((c) => ({ externalKey: c, title: c }))
+      });
+      tally.seenKeys.push(p.externalKey);
+      tally.upserted++;
+      tally.fetched++;
+      patch2({ upserted: tally.upserted, fetched: tally.fetched });
+    },
+    finish({
+      sweep,
+      warnings,
+      errors,
+      refused = 0,
+      covered = true
+    }) {
+      if (sweep) core.catalog.markMissingUnavailable(source.id, tally.seenKeys);
+      tally.errors = errors;
+      const partial = !covered || refused > 0;
+      const shut = refused > 0 && refused >= Math.max(20, tally.upserted * 0.25);
+      const message = shut ? `The store stopped answering after ${tally.upserted.toLocaleString()} of ${discovered.toLocaleString()} products. Try again later.` : partial ? `Imported ${tally.upserted.toLocaleString()} products with ${(errors.length + refused).toLocaleString()} issue${errors.length + refused === 1 ? "" : "s"}` : `Imported ${tally.upserted.toLocaleString()} products`;
+      patch2({
+        stage: partial ? "partial" : "completed",
+        upserted: tally.upserted,
+        fetched: tally.fetched,
+        imagesDone: tally.imagesDone,
+        imagesTotal: tally.imagesTotal,
+        errors: shut ? [...errors, { code: "store_refused", message: `${refused.toLocaleString()} pages were refused` }] : errors,
+        warnings,
+        message,
+        finished: true
       });
-      seenKeys.push(p.externalKey);
-      upserted++;
-      if (upserted % 10 === 0) patch2({ upserted, fetched: result.products.length });
+      core.catalog.setSourceStatus(source.id, partial ? "partial" : "ready", true);
     }
-    patch2({ upserted, fetched: result.products.length });
-    core.catalog.markMissingUnavailable(source.id, seenKeys);
-    const pending = core.catalog.listImagesNeedingAssets(brandId, 5e4);
-    patch2({
-      stage: "processing_assets",
-      imagesTotal: pending.length,
-      imagesDone: 0,
-      message: `Downloading ${pending.length} images`
-    });
-    const errors = [...core.catalog.getJob(jobId)?.errors ?? []];
-    let imagesDone = 0;
-    await mapPool(
-      pending,
-      6,
-      async (img) => {
-        if (signal.aborted) return;
-        try {
-          const res = await httpGet(img.sourceUrl, { fetchImpl, signal, timeoutMs: 4e4, retries: 2 });
-          if (!res.ok) {
-            errors.push({ code: "image_http", message: `HTTP ${res.status}`, url: img.sourceUrl });
-            return;
-          }
-          const buf = Buffer.from(await res.arrayBuffer());
-          if (!buf.length) {
-            errors.push({ code: "image_empty", message: "Empty image", url: img.sourceUrl });
-            return;
-          }
-          const png = await sharp20(buf).rotate().png().toBuffer();
-          const meta = await sharp20(png).metadata();
-          const hash = core.images.save(png);
-          core.catalog.setImageAsset(img.productId, img.sourceUrl, `asset:${hash}`, {
-            width: meta.width,
-            height: meta.height
-          });
-        } catch (err) {
+  };
+}
+var IMPORT_CONCURRENCY = 4;
+var PICTURE_ROUND = 60;
+function drainPictures(deps, jobId, brandId, tally, signal, imagesPerProduct = IMAGES_PER_PRODUCT) {
+  const { core, fetchImpl } = deps;
+  const patch2 = (p) => core.catalog.updateJob(jobId, p);
+  const errors = [...core.catalog.getJob(jobId)?.errors ?? []];
+  let stopped = false;
+  const done = (async () => {
+    while (!signal.aborted) {
+      const round = core.catalog.listImagesNeedingAssets(brandId, PICTURE_ROUND).filter((img) => img.position < imagesPerProduct);
+      if (!round.length) {
+        if (stopped) break;
+        await sleep6(150);
+        continue;
+      }
+      tally.imagesTotal += round.length;
+      await mapPool(
+        round,
+        IMAGE_CONCURRENCY,
+        async (img) => {
           if (signal.aborted) return;
-          errors.push({
-            code: "image_failed",
-            message: String(err?.message ?? err),
-            url: img.sourceUrl,
-            retryable: true
-          });
-        } finally {
-          imagesDone++;
-          if (imagesDone % 5 === 0 || imagesDone === pending.length) {
-            patch2({ imagesDone, imagesTotal: pending.length, errors });
+          try {
+            const res = await httpGet(img.sourceUrl, { fetchImpl, signal, timeoutMs: 4e4, retries: 2 });
+            if (!res.ok) {
+              errors.push({ code: "image_http", message: `HTTP ${res.status}`, url: img.sourceUrl });
+              return;
+            }
+            const buf = Buffer.from(await res.arrayBuffer());
+            if (!buf.length) {
+              errors.push({ code: "image_empty", message: "Empty image", url: img.sourceUrl });
+              return;
+            }
+            const probe = await sharp21(buf).metadata();
+            const turned = (probe.orientation ?? 1) > 1;
+            const keep = turned ? await sharp21(buf).rotate().toBuffer() : buf;
+            const meta = turned ? await sharp21(keep).metadata() : probe;
+            const hash = core.images.save(keep, meta.format ?? probe.format ?? "png");
+            core.catalog.setImageAsset(img.productId, img.sourceUrl, `asset:${hash}`, {
+              width: meta.width,
+              height: meta.height
+            });
+          } catch (err) {
+            if (signal.aborted) return;
+            errors.push({
+              code: "image_failed",
+              message: String(err?.message ?? err),
+              url: img.sourceUrl,
+              retryable: true
+            });
+          } finally {
+            tally.imagesDone++;
+            patch2({ imagesDone: tally.imagesDone, imagesTotal: tally.imagesTotal, errors });
           }
-        }
-      },
-      signal
-    );
-    if (signal.aborted) {
-      patch2({ stage: "failed", message: "Import cancelled", errors, finished: true });
-      core.catalog.setSourceStatus(source.id, "failed", true);
-      return;
+        },
+        signal
+      );
+      const stuck = core.catalog.listImagesNeedingAssets(brandId, PICTURE_ROUND).filter((img) => img.position < imagesPerProduct);
+      if (stuck.length && stuck[0]?.id === round[0]?.id) {
+        errors.push({ code: "images_stalled", message: "Some pictures could not be downloaded" });
+        break;
+      }
     }
-    const stillMissing = core.catalog.listImagesNeedingAssets(brandId, 1).length;
-    const productCount = result.products.length;
-    const partial = !!errors.length || stillMissing > 0 || result.progress.discovered > 0 && productCount < result.progress.discovered * 0.9;
-    patch2({
-      stage: partial ? "partial" : "completed",
-      upserted,
-      imagesDone,
-      imagesTotal: pending.length,
-      errors,
-      warnings: result.progress.warnings,
-      message: partial ? `Imported ${upserted} products with ${errors.length} issue${errors.length === 1 ? "" : "s"}` : `Imported ${upserted} products`,
-      finished: true
-    });
-    core.catalog.setSourceStatus(source.id, partial ? "partial" : "ready", true);
-  } catch (err) {
-    patch2({
-      stage: "failed",
-      message: String(err?.message ?? err),
-      errors: [{ code: "import_failed", message: String(err?.message ?? err) }],
-      finished: true
-    });
-  }
+    patch2({ imagesDone: tally.imagesDone, imagesTotal: tally.imagesTotal, errors });
+    return errors;
+  })();
+  return {
+    stop() {
+      stopped = true;
+    },
+    done
+  };
 }
 function resolveLibraryProduct(core, brandId, productId) {
   const brand = core.store.getBrand(brandId);
@@ -5346,7 +7146,7 @@ async function generateStudioSet(deps, job, who, sourcePaths, signal) {
   return { hashes: kept.map((f) => byAngle.get(f.angle)), angles: kept.map((f) => f.angle) };
 }
 async function edgeBarGeometry(buf) {
-  const { data, info } = await sharp20(buf).greyscale().raw().toBuffer({ resolveWithObject: true });
+  const { data, info } = await sharp21(buf).greyscale().raw().toBuffer({ resolveWithObject: true });
   const W = info.width;
   const H = info.height;
   const scan = (len, cross, at) => {
@@ -5400,7 +7200,7 @@ async function trimEdgeBars(core, hash) {
     const width = g.right - g.left + 1;
     const height = g.bottom - g.top + 1;
     if (width < g.W * 0.6 || height < g.H * 0.6) return hash;
-    const png = await sharp20(buf).extract({ left: g.left, top: g.top, width, height }).png().toBuffer();
+    const png = await sharp21(buf).extract({ left: g.left, top: g.top, width, height }).png().toBuffer();
     return core.images.save(png);
   } catch {
     return hash;
@@ -5471,7 +7271,7 @@ async function identityCrop(core, hash) {
   if (!out) return void 0;
   try {
     const height = Math.min(IDENTITY_TARGET_HEIGHT, Math.round(nativeHeight * IDENTITY_MAX_UPSCALE)) || IDENTITY_TARGET_HEIGHT;
-    const png = await sharp20(core.images.read(out)).resize({ height, fit: "inside", kernel: "lanczos3", withoutEnlargement: false }).png().toBuffer();
+    const png = await sharp21(core.images.read(out)).resize({ height, fit: "inside", kernel: "lanczos3", withoutEnlargement: false }).png().toBuffer();
     const scaled = core.images.save(png);
     identityCrops.set(hash, scaled);
     return scaled;
@@ -5500,12 +7300,12 @@ async function brandJsonWithIdentityCrops(core, json, characterIds) {
   return changed ? { ...json, characters } : json;
 }
 async function figureBox(buf) {
-  const meta = await sharp20(buf).metadata();
+  const meta = await sharp21(buf).metadata();
   const W = meta.width ?? 0;
   const H = meta.height ?? 0;
   if (!W || !H) return null;
   for (const threshold of FIGURE_TRIM_THRESHOLDS) {
-    const { info } = await sharp20(buf).trim({ threshold }).toBuffer({ resolveWithObject: true });
+    const { info } = await sharp21(buf).trim({ threshold }).toBuffer({ resolveWithObject: true });
     const left = Math.abs(info.trimOffsetLeft ?? 0);
     const top = Math.abs(info.trimOffsetTop ?? 0);
     const width = info.width ?? 0;
@@ -5538,13 +7338,13 @@ async function smartCover(core, hash, box) {
   if (!hash || !core.images.has(hash)) return void 0;
   try {
     const buf = core.images.read(hash);
-    const meta = await sharp20(buf).metadata();
+    const meta = await sharp21(buf).metadata();
     const w = meta.width ?? 0;
     const h = meta.height ?? 0;
     if (!w || !h) return void 0;
     const raw = box(w, h);
     const target = { width: Math.max(1, raw.width), height: Math.max(1, raw.height) };
-    const png = await sharp20(buf).resize(target.width, target.height, { fit: "cover", position: "attention" }).png().toBuffer();
+    const png = await sharp21(buf).resize(target.width, target.height, { fit: "cover", position: "attention" }).png().toBuffer();
     return core.images.save(png);
   } catch {
     return void 0;
@@ -5553,11 +7353,11 @@ async function smartCover(core, hash, box) {
 async function crop(core, hash, region, cap2) {
   if (!hash || !core.images.has(hash)) return void 0;
   try {
-    const meta = await sharp20(core.images.read(hash)).metadata();
+    const meta = await sharp21(core.images.read(hash)).metadata();
     const w = meta.width ?? 0;
     const h = meta.height ?? 0;
     if (!w || !h) return void 0;
-    let pipeline = sharp20(core.images.read(hash)).extract(region(w, h));
+    let pipeline = sharp21(core.images.read(hash)).extract(region(w, h));
     if (cap2) pipeline = pipeline.resize(cap2, cap2, { fit: "inside", withoutEnlargement: true });
     const png = await pipeline.png().toBuffer();
     return core.images.save(png);
@@ -5904,7 +7704,7 @@ var fromLab = (l, a, bb) => {
   return [clamp(R), clamp(G), clamp(B)];
 };
 var rawAt = async (png, edge) => {
-  let img = sharp20(png);
+  let img = sharp21(png);
   if (edge) img = img.resize(edge, edge, { fit: "fill" });
   const { data, info } = await img.removeAlpha().raw().toBuffer({ resolveWithObject: true });
   return { data, width: info.width, height: info.height };
@@ -5967,7 +7767,7 @@ async function gradeComposite(originalPng, modelInputPng, modelOutputPng) {
     if (residual > GRADE_GATE_MEAN_DELTA) return null;
     const full = await rawAt(originalPng);
     applyAffine(full, T);
-    const image = await sharp20(full.data, {
+    const image = await sharp21(full.data, {
       raw: { width: full.width, height: full.height, channels: 3 }
     }).png().toBuffer();
     return { image, residual };
@@ -6141,7 +7941,7 @@ function fitExpandToBudget(plan, source, pixelBudget) {
 }
 async function attentionCropOrigin(srcBuf, source, plan) {
   try {
-    const { info } = await sharp20(srcBuf).resize(plan.width, plan.height, { fit: "cover", position: "attention" }).toBuffer({ resolveWithObject: true });
+    const { info } = await sharp21(srcBuf).resize(plan.width, plan.height, { fit: "cover", position: "attention" }).toBuffer({ resolveWithObject: true });
     const attnLeft = typeof info.cropOffsetLeft === "number" ? Math.abs(info.cropOffsetLeft) : plan.left;
     const attnTop = typeof info.cropOffsetTop === "number" ? Math.abs(info.cropOffsetTop) : plan.top;
     const left = Math.round((attnLeft + plan.left) / 2);
@@ -6294,23 +8094,23 @@ function relax(grid, seam, fixedSweeps) {
 
 // src/expand.ts
 async function expandCanvas(source, plan) {
-  const bed = await sharp20(source).resize(plan.width, plan.height, { fit: "cover", position: "centre" }).blur(Math.max(8, Math.round(Math.max(plan.width, plan.height) / 40))).toBuffer();
-  return sharp20(bed).composite([{ input: source, left: plan.left, top: plan.top }]).png().toBuffer();
+  const bed = await sharp21(source).resize(plan.width, plan.height, { fit: "cover", position: "centre" }).blur(Math.max(8, Math.round(Math.max(plan.width, plan.height) / 40))).toBuffer();
+  return sharp21(bed).composite([{ input: source, left: plan.left, top: plan.top }]).png().toBuffer();
 }
 async function compositeExpand(engineImage, source, plan) {
-  const meta = await sharp20(engineImage).metadata();
+  const meta = await sharp21(engineImage).metadata();
   const want = plan.width / plan.height;
   const got = meta.width && meta.height ? meta.width / meta.height : 0;
   const sameOrientation = got > 0 && got >= 1 === want >= 1;
   const aligned = sameOrientation;
   const exact = meta.width === plan.width && meta.height === plan.height;
-  const surround = aligned ? exact ? engineImage : await sharp20(engineImage).resize(plan.width, plan.height, { fit: "cover", position: "centre" }).toBuffer() : await expandCanvasBedOnly(source, plan);
+  const surround = aligned ? exact ? engineImage : await sharp21(engineImage).resize(plan.width, plan.height, { fit: "cover", position: "centre" }).toBuffer() : await expandCanvasBedOnly(source, plan);
   const matched = aligned ? await matchMarginsToSeam(surround, source, plan) : surround;
-  const image = await sharp20(matched).composite([{ input: source, left: plan.left, top: plan.top }]).png().toBuffer();
+  const image = await sharp21(matched).composite([{ input: source, left: plan.left, top: plan.top }]).png().toBuffer();
   return { image, aligned };
 }
 async function matchMarginsToSeam(surround, source, plan) {
-  const src = await sharp20(source).metadata();
+  const src = await sharp21(source).metadata();
   if (!src.width || !src.height) return surround;
   const SW = src.width;
   const SH = src.height;
@@ -6357,8 +8157,8 @@ var MAX_CORRECTION = 60;
 async function reconcile(surround, source, side, axis) {
   const { margin } = side;
   if (margin.width < 1 || margin.height < 1) return surround;
-  const marginRaw = await sharp20(surround).extract(margin).removeAlpha().raw().toBuffer();
-  const edgeRaw = await sharp20(source).extract(side.srcEdge).removeAlpha().raw().toBuffer();
+  const marginRaw = await sharp21(surround).extract(margin).removeAlpha().raw().toBuffer();
+  const edgeRaw = await sharp21(source).extract(side.srcEdge).removeAlpha().raw().toBuffer();
   const W = margin.width;
   const H = margin.height;
   const along = axis === "width" ? H : W;
@@ -6412,11 +8212,11 @@ async function reconcile(surround, source, side, axis) {
       }
     }
   }
-  const patch2 = await sharp20(corrected, { raw: { width: W, height: H, channels: 3 } }).png().toBuffer();
-  return sharp20(surround).composite([{ input: patch2, left: margin.left, top: margin.top }]).toBuffer();
+  const patch2 = await sharp21(corrected, { raw: { width: W, height: H, channels: 3 } }).png().toBuffer();
+  return sharp21(surround).composite([{ input: patch2, left: margin.left, top: margin.top }]).toBuffer();
 }
 async function expandCanvasBedOnly(source, plan) {
-  return sharp20(source).resize(plan.width, plan.height, { fit: "cover", position: "centre" }).blur(Math.max(8, Math.round(Math.max(plan.width, plan.height) / 40))).toBuffer();
+  return sharp21(source).resize(plan.width, plan.height, { fit: "cover", position: "centre" }).blur(Math.max(8, Math.round(Math.max(plan.width, plan.height) / 40))).toBuffer();
 }
 function medianOf(rgb, channel, from, to) {
   const n = to - from;
@@ -6427,17 +8227,17 @@ function medianOf(rgb, channel, from, to) {
   return n % 2 ? values[(n - 1) / 2] : (values[n / 2 - 1] + values[n / 2]) / 2;
 }
 async function reframeExpand(engineImage, plan) {
-  const meta = await sharp20(engineImage).metadata();
+  const meta = await sharp21(engineImage).metadata();
   if (!(meta.width && meta.height)) return null;
   const want = plan.width / plan.height;
   const got = meta.width / meta.height;
   if (got >= 1 !== want >= 1) return null;
   if (meta.width === plan.width && meta.height === plan.height) return engineImage;
   const straight = Math.abs(got - want) / want <= 0.02;
-  return sharp20(engineImage).resize(plan.width, plan.height, { fit: straight ? "fill" : "cover", position: "centre" }).png().toBuffer();
+  return sharp21(engineImage).resize(plan.width, plan.height, { fit: straight ? "fill" : "cover", position: "centre" }).png().toBuffer();
 }
 async function seamScore(image, plan, source) {
-  const { data, info } = await sharp20(image).removeAlpha().greyscale().raw().toBuffer({ resolveWithObject: true });
+  const { data, info } = await sharp21(image).removeAlpha().greyscale().raw().toBuffer({ resolveWithObject: true });
   const W = info.width;
   const H = info.height;
   const horizontal = plan.axis === "width";
@@ -6470,7 +8270,7 @@ var SEAM_VISIBLE = 2.2;
 var OFFSET = 4;
 var RESIDUAL_VISIBLE = 15;
 async function seamResidual(image, plan, source) {
-  const { data, info } = await sharp20(image).removeAlpha().raw().toBuffer({ resolveWithObject: true });
+  const { data, info } = await sharp21(image).removeAlpha().raw().toBuffer({ resolveWithObject: true });
   const W = info.width;
   const H = info.height;
   const ch = info.channels;
@@ -6505,7 +8305,7 @@ var MAX_SHARE = 0.8;
 async function subjectFraction(src, source, axis) {
   try {
     const window = axis === "width" ? { width: Math.max(8, Math.round(source.width * 0.5)), height: source.height } : { width: source.width, height: Math.max(8, Math.round(source.height * 0.5)) };
-    const { info } = await sharp20(src).resize(window.width, window.height, { fit: "cover", position: "attention" }).toBuffer({ resolveWithObject: true });
+    const { info } = await sharp21(src).resize(window.width, window.height, { fit: "cover", position: "attention" }).toBuffer({ resolveWithObject: true });
     const offset = axis === "width" ? Math.abs(typeof info.cropOffsetLeft === "number" ? info.cropOffsetLeft : 0) : Math.abs(typeof info.cropOffsetTop === "number" ? info.cropOffsetTop : 0);
     const span = axis === "width" ? source.width : source.height;
     const extent = axis === "width" ? window.width : window.height;
@@ -6528,14 +8328,14 @@ function placeExpand(plan, source, fraction) {
 }
 var NEUTRAL = { r: 128, g: 128, b: 128 };
 async function conditioningCanvas(source, plan, fill = "edge") {
-  const meta = await sharp20(source).metadata();
+  const meta = await sharp21(source).metadata();
   const sw = meta.width ?? 0;
   const sh = meta.height ?? 0;
   if (!(sw > 0 && sh > 0)) throw new Error("conditioningCanvas: source has no dimensions");
   const layers = [];
   if (fill === "edge") layers.push(...await edgeMargins(source, plan, { width: sw, height: sh }));
   layers.push({ input: source, left: plan.left, top: plan.top });
-  const canvas = sharp20({
+  const canvas = sharp21({
     create: {
       width: plan.width,
       height: plan.height,
@@ -6547,7 +8347,7 @@ async function conditioningCanvas(source, plan, fill = "edge") {
 }
 async function edgeMargins(source, plan, size) {
   const out = [];
-  const strip = async (extract, width, height) => sharp20(source).extract(extract).resize(width, height, { fit: "fill" }).png().toBuffer();
+  const strip = async (extract, width, height) => sharp21(source).extract(extract).resize(width, height, { fit: "fill" }).png().toBuffer();
   if (plan.axis === "width") {
     const before = plan.left;
     const after = plan.width - plan.left - size.width;
@@ -6638,12 +8438,12 @@ async function resolveOutpaintRoute(all, shot) {
   return { engine: shot, method: "reframe", crossed: false };
 }
 async function driftDiff(a, b) {
-  const metaA = await sharp20(a).metadata();
-  const metaB = await sharp20(b).metadata();
+  const metaA = await sharp21(a).metadata();
+  const metaB = await sharp21(b).metadata();
   const width = Math.min(metaA.width ?? 1, metaB.width ?? 1, 1024);
   const height = Math.min(metaA.height ?? 1, metaB.height ?? 1, 1024);
   const [rawA, rawB] = await Promise.all(
-    [a, b].map((buf) => sharp20(buf).resize(width, height, { fit: "cover" }).ensureAlpha().raw().toBuffer())
+    [a, b].map((buf) => sharp21(buf).resize(width, height, { fit: "cover" }).ensureAlpha().raw().toBuffer())
   );
   const out = new PNG({ width, height });
   const changed = pixelmatch(rawA, rawB, out.data, width, height, { threshold: 0.1, diffColor: [255, 64, 64] });
@@ -6655,11 +8455,11 @@ async function driftDiff(a, b) {
   };
 }
 async function changeMask(a, b, cap2 = 1024) {
-  const metaA = await sharp20(a).metadata();
+  const metaA = await sharp21(a).metadata();
   const width = Math.min(metaA.width ?? 1, cap2);
   const height = Math.min(metaA.height ?? 1, cap2);
   const [rawA, rawB] = await Promise.all(
-    [a, b].map((buf) => sharp20(buf).resize(width, height, { fit: "fill" }).ensureAlpha().raw().toBuffer())
+    [a, b].map((buf) => sharp21(buf).resize(width, height, { fit: "fill" }).ensureAlpha().raw().toBuffer())
   );
   const out = new PNG({ width, height });
   pixelmatch(rawA, rawB, out.data, width, height, { threshold: 0.1, includeAA: true, diffMask: true });
@@ -6708,8 +8508,8 @@ function dilationFor(longEdge) {
 // src/localEdit.ts
 async function preserveOutsideChange(source, edited) {
   try {
-    const srcMeta = await sharp20(source).metadata();
-    const outMeta = await sharp20(edited).metadata();
+    const srcMeta = await sharp21(source).metadata();
+    const outMeta = await sharp21(edited).metadata();
     if (!srcMeta.width || !srcMeta.height || !outMeta.width || !outMeta.height)
       return { image: edited, outcome: "error", changed: 0 };
     const sameShape = Math.abs(outMeta.width / outMeta.height - srcMeta.width / srcMeta.height) / (srcMeta.width / srcMeta.height) <= 0.01;
@@ -6719,15 +8519,15 @@ async function preserveOutsideChange(source, edited) {
     if (outcome !== "composited") return { image: edited, outcome, changed: shape.changed };
     const r = dilationFor(Math.max(shape.width, shape.height));
     const rawShape = { raw: { width: shape.width, height: shape.height, channels: 1 } };
-    const spread = await sharp20(shape.mask, rawShape).blur(r).toColourspace("b-w").raw().toBuffer();
-    const dilated = await sharp20(spread, rawShape).threshold(8).toColourspace("b-w").raw().toBuffer();
-    const feathered = await sharp20(dilated, rawShape).blur(Math.max(2, r / 3)).toColourspace("b-w").raw().toBuffer();
-    const grown = await sharp20(feathered, rawShape).resize(srcMeta.width, srcMeta.height, { fit: "fill", kernel: "cubic" }).toColourspace("b-w").raw().toBuffer();
-    const editedRgb = await sharp20(edited).resize(srcMeta.width, srcMeta.height, { fit: "fill" }).removeAlpha().raw().toBuffer();
-    const masked = await sharp20(editedRgb, {
+    const spread = await sharp21(shape.mask, rawShape).blur(r).toColourspace("b-w").raw().toBuffer();
+    const dilated = await sharp21(spread, rawShape).threshold(8).toColourspace("b-w").raw().toBuffer();
+    const feathered = await sharp21(dilated, rawShape).blur(Math.max(2, r / 3)).toColourspace("b-w").raw().toBuffer();
+    const grown = await sharp21(feathered, rawShape).resize(srcMeta.width, srcMeta.height, { fit: "fill", kernel: "cubic" }).toColourspace("b-w").raw().toBuffer();
+    const editedRgb = await sharp21(edited).resize(srcMeta.width, srcMeta.height, { fit: "fill" }).removeAlpha().raw().toBuffer();
+    const masked = await sharp21(editedRgb, {
       raw: { width: srcMeta.width, height: srcMeta.height, channels: 3 }
     }).joinChannel(grown, { raw: { width: srcMeta.width, height: srcMeta.height, channels: 1 } }).png().toBuffer();
-    const image = await sharp20(source).removeAlpha().composite([{ input: masked }]).png().toBuffer();
+    const image = await sharp21(source).removeAlpha().composite([{ input: masked }]).png().toBuffer();
     return { image, outcome: "composited", changed: shape.changed };
   } catch {
     return { image: edited, outcome: "error", changed: 0 };
@@ -6765,7 +8565,7 @@ function registerLogoRoutes(app, deps) {
     const v = validateBrand(json);
     if (!v.valid) return reply.status(400).send({ error: "brand became invalid", details: v.errors });
     const row = core.store.updateBrand(brand.id, json);
-    const meta = await sharp20(core.images.read(part.hash)).metadata().catch(() => null);
+    const meta = await sharp21(core.images.read(part.hash)).metadata().catch(() => null);
     const logoEdge = meta ? Math.max(meta.width ?? 0, meta.height ?? 0) || null : null;
     return { ...row, logoHash: part.hash, logoEdge };
   });
@@ -6813,6 +8613,38 @@ function registerLogoRoutes(app, deps) {
     return core.store.updateBrand(brand.id, json);
   });
 }
+var scans = /* @__PURE__ */ new Map();
+var controllers = /* @__PURE__ */ new Map();
+var KEEP = 32;
+function remember(state) {
+  scans.set(state.id, state);
+  while (scans.size > KEEP) {
+    const oldest = scans.keys().next().value;
+    if (oldest === void 0) break;
+    scans.delete(oldest);
+    controllers.delete(oldest);
+  }
+}
+function getScan(scanId) {
+  return scans.get(scanId);
+}
+function startCatalogScan(deps, brandId, url) {
+  const { core, fetchImpl } = deps;
+  if (!core.store.getBrand(brandId)) throw Object.assign(new Error("brand not found"), { statusCode: 404 });
+  const id = randomUUID();
+  const ctrl = new AbortController();
+  const state = { id, brandId, url, status: "running", startedAt: Date.now() };
+  remember(state);
+  controllers.set(id, ctrl);
+  void scanForCandidates({ url, fetchImpl, signal: ctrl.signal }).then((result) => {
+    state.result = result;
+    state.status = "done";
+  }).catch((err) => {
+    state.status = "error";
+    state.error = err instanceof Error ? err.message : String(err);
+  }).finally(() => controllers.delete(id));
+  return { scanId: id };
+}
 
 // src/routes/catalogImport.ts
 function registerCatalogImportRoutes(app, deps) {
@@ -6820,23 +8652,104 @@ function registerCatalogImportRoutes(app, deps) {
   app.get("/api/brands/:id/products-library", async (req, reply) => {
     const brand = core.store.getBrand(req.params.id);
     if (!brand) return reply.status(404).send({ error: "brand not found" });
-    const products = core.catalog.listLibraryProducts(brand.id, brand.json);
+    const products = core.catalog.listLibraryIndex(brand.id, brand.json);
     const source = core.catalog.getSourceForBrand(brand.id);
     return { products, source };
   });
+  app.get("/api/brands/:id/products-library/:productId", async (req, reply) => {
+    const brand = core.store.getBrand(req.params.id);
+    if (!brand) return reply.status(404).send({ error: "brand not found" });
+    const product = core.catalog.libraryProduct(brand.id, brand.json, String(req.params.productId));
+    if (!product) return reply.status(404).send({ error: "product not found" });
+    return { product };
+  });
   app.get("/api/brands/:id/catalog/source", async (req, reply) => {
     const brand = core.store.getBrand(req.params.id);
     if (!brand) return reply.status(404).send({ error: "brand not found" });
     return { source: core.catalog.getSourceForBrand(brand.id) };
   });
+  app.post("/api/brands/:id/catalog/scan", async (req, reply) => {
+    const brandId = req.params.id;
+    const brand = core.store.getBrand(brandId);
+    if (!brand) return reply.status(404).send({ error: "brand not found" });
+    const url = String(req.body?.url ?? brand.json?.meta?.website ?? "");
+    if (!url.trim()) return reply.status(400).send({ error: "url required" });
+    try {
+      return startCatalogScan({ core, fetchImpl }, brandId, url);
+    } catch (err) {
+      return reply.status(err.statusCode ?? 500).send({ error: err.message ?? "scan failed" });
+    }
+  });
+  app.get("/api/brands/:id/catalog/scans/:scanId", async (req, reply) => {
+    const brandId = req.params.id;
+    const scan = getScan(req.params.scanId);
+    if (!scan || scan.brandId !== brandId) return reply.status(404).send({ error: "scan not found" });
+    return scan;
+  });
+  app.post("/api/brands/:id/catalog/details", async (req, reply) => {
+    const brand = core.store.getBrand(req.params.id);
+    if (!brand) return reply.status(404).send({ error: "brand not found" });
+    const asked = req.body?.urls;
+    if (!Array.isArray(asked) || asked.some((u) => typeof u !== "string")) {
+      return reply.status(400).send({ error: "urls must be a list of product addresses" });
+    }
+    const urls = asked.slice(0, 48);
+    if (!urls.length) return { products: [] };
+    const site = String(brand.json?.meta?.website ?? "");
+    let origin;
+    try {
+      origin = new URL(site.startsWith("http") ? site : `https://${site}`).origin;
+    } catch {
+      return reply.status(400).send({ error: "this brand has no website to read products from" });
+    }
+    const sameSite = urls.filter((u) => {
+      try {
+        return new URL(u).origin === origin;
+      } catch {
+        return false;
+      }
+    });
+    if (!sameSite.length) {
+      return reply.status(400).send({ error: "none of those products belong to this site" });
+    }
+    const products = await fetchProductPages({ fetchImpl: fetchImpl ?? fetch, baseUrl: origin }, sameSite, {
+      concurrency: 4,
+      maxBytes: 15e5
+    });
+    return { products };
+  });
   app.post("/api/brands/:id/catalog/import", async (req, reply) => {
     const brandId = req.params.id;
     const brand = core.store.getBrand(brandId);
     if (!brand) return reply.status(404).send({ error: "brand not found" });
     const url = String(req.body?.url ?? brand.json?.meta?.website ?? "");
     if (!url.trim()) return reply.status(400).send({ error: "url required" });
+    const asked = req.body?.urls;
+    let only;
+    if (asked != null) {
+      if (!Array.isArray(asked) || asked.some((u) => typeof u !== "string")) {
+        return reply.status(400).send({ error: "urls must be a list of product addresses" });
+      }
+      let origin;
+      try {
+        origin = new URL(url.startsWith("http") ? url : `https://${url}`).origin;
+      } catch {
+        return reply.status(400).send({ error: "url required" });
+      }
+      only = asked.filter((u) => {
+        try {
+          return new URL(u).origin === origin;
+        } catch {
+          return false;
+        }
+      });
+      if (!only.length) return reply.status(400).send({ error: "none of those products belong to this site" });
+      if (only.length > 2e3) {
+        return reply.status(400).send({ error: "That is nearly the whole catalogue. Import everything instead." });
+      }
+    }
     try {
-      return startCatalogImport({ core, fetchImpl }, brandId, url);
+      return startCatalogImport({ core, fetchImpl }, brandId, url, { only });
     } catch (err) {
       return reply.status(err.statusCode ?? 500).send({ error: err.message ?? "import failed" });
     }
@@ -6887,7 +8800,7 @@ async function vibrantColor(input) {
   let data;
   let channels;
   try {
-    const out = await sharp20(input).resize(48, 48, { fit: "inside" }).raw().toBuffer({ resolveWithObject: true });
+    const out = await sharp21(input).resize(48, 48, { fit: "inside" }).raw().toBuffer({ resolveWithObject: true });
     data = out.data;
     channels = out.info.channels;
   } catch {
@@ -6910,13 +8823,13 @@ async function vibrantColor(input) {
   const best = buckets.reduce((a, b) => b.score > a.score ? b : a, buckets[0]);
   if (best.score <= 0) {
     try {
-      const { dominant } = await sharp20(input).stats();
-      return toHex(dominant.r, dominant.g, dominant.b);
+      const { dominant } = await sharp21(input).stats();
+      return toHex2(dominant.r, dominant.g, dominant.b);
     } catch {
       return null;
     }
   }
-  return toHex(best.r / best.score, best.g / best.score, best.b / best.score);
+  return toHex2(best.r / best.score, best.g / best.score, best.b / best.score);
 }
 function rgbToHsl(r, g, b) {
   const rn = r / 255, gn = g / 255, bn = b / 255;
@@ -6931,7 +8844,7 @@ function rgbToHsl(r, g, b) {
   else h = ((rn - gn) / d + 4) * 60;
   return { h, s, l };
 }
-var toHex = (r, g, b) => "#" + [r, g, b].map(
+var toHex2 = (r, g, b) => "#" + [r, g, b].map(
   (v) => Math.max(0, Math.min(255, Math.round(v))).toString(16).padStart(2, "0")
 ).join("");
 
@@ -7454,7 +9367,7 @@ function registerProjectRoutes(app, deps) {
     const brand = core.store.getBrand(req.params.id);
     if (!brand) return reply.status(404).send({ error: "brand not found" });
     const limit = Math.min(Number(req.query.limit) || 60, 200);
-    return { nodes: core.store.recentActivity(brand.id, limit), jobs: core.catalog.listJobs(brand.id) };
+    return { nodes: core.store.recentActivity(brand.id, limit), jobs: core.catalog.listRecentJobs(brand.id) };
   });
   app.get("/api/brands/:id/workspace", async (req, reply) => {
     const brand = core.store.getBrand(req.params.id);
@@ -7563,7 +9476,10 @@ function registerProjectRoutes(app, deps) {
 function registerCodexSetupRoutes(app, deps) {
   const codexSetup = deps.codexSetup ?? createCodexSetup({ runner: deps.codexRunner });
   let codexSetupBusy = null;
-  app.get("/api/engines/codex/status", async () => codexSetup.status());
+  app.get("/api/engines/codex/status", async (req) => {
+    const force = req.query?.force === "1";
+    return codexSetup.status({ force });
+  });
   app.post("/api/engines/codex/install", async (_req, reply) => {
     if (codexSetupBusy) return reply.status(409).send({ error: `already running: ${codexSetupBusy}` });
     codexSetupBusy = "install";
@@ -7586,6 +9502,35 @@ function registerCodexSetupRoutes(app, deps) {
       codexSetupBusy = null;
     }
   });
+  app.post("/api/engines/codex/repair-env", async (req, reply) => {
+    const repair = deps.envRepair;
+    if (!repair) return reply.status(501).send({ error: "not available on this server" });
+    const asked = req.body?.keys;
+    if (!Array.isArray(asked) || asked.length === 0) return reply.status(400).send({ error: "keys required" });
+    const keys = asked.map((k) => String(k).trim().toUpperCase());
+    const unknown = keys.filter((k) => !CONFLICT_ENV_KEYS.includes(k));
+    if (unknown.length > 0) return reply.status(400).send({ error: `not a Codex credential: ${unknown.join(", ")}` });
+    if (codexSetupBusy) return reply.status(409).send({ error: `already running: ${codexSetupBusy}` });
+    codexSetupBusy = "repair";
+    try {
+      repair.set([.../* @__PURE__ */ new Set([...repair.get(), ...keys])]);
+      return { ok: true, ...await codexSetup.status({ force: true }) };
+    } finally {
+      codexSetupBusy = null;
+    }
+  });
+  app.post("/api/engines/codex/restore-env", async (_req, reply) => {
+    const repair = deps.envRepair;
+    if (!repair) return reply.status(501).send({ error: "not available on this server" });
+    if (codexSetupBusy) return reply.status(409).send({ error: `already running: ${codexSetupBusy}` });
+    codexSetupBusy = "repair";
+    try {
+      repair.set([]);
+      return { ok: true, ...await codexSetup.status({ force: true }) };
+    } finally {
+      codexSetupBusy = null;
+    }
+  });
 }
 var slug = (v, fallback) => {
   const s = String(v ?? "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40);
@@ -7766,8 +9711,8 @@ function registerImageRoutes(app, deps) {
     if (!part) return reply.status(400).send({ error: "multipart file field required" });
     const buf = await part.toBuffer();
     if (buf.length === 0) return reply.status(400).send({ error: "empty file" });
-    const fmt = (await sharp20(buf).metadata().catch(() => null))?.format;
-    const png = fmt === "svg" ? await toMarkPng(buf) : await sharp20(buf).rotate().png().toBuffer();
+    const fmt = (await sharp21(buf).metadata().catch(() => null))?.format;
+    const png = fmt === "svg" ? await toMarkPng(buf) : await sharp21(buf).rotate().png().toBuffer();
     return { hash: core.images.save(png) };
   });
   app.post("/api/diff", async (req, reply) => {
@@ -7789,6 +9734,39 @@ function registerImageRoutes(app, deps) {
 
 // src/release/notes.data.ts
 var RELEASES = [
+  {
+    version: "0.9.3",
+    date: "2026-09-14",
+    title: "Paste a website, get the brand and its products.",
+    sections: [
+      {
+        heading: "Brand",
+        body: "A website address is enough to start a brand. Scenri reads the logo, the wordmark and the palette a site actually declares, and says plainly what it found and what it could not."
+      },
+      {
+        heading: "Products",
+        body: "The same address brings in the store. Pick the products you want or take the whole catalogue, and watch them arrive: each one appears in your library as it lands, with its picture, newest first. A large store no longer runs out of memory partway through, and a shop that stops answering says so instead of looking empty."
+      },
+      {
+        heading: "Create",
+        body: "The insert menus reach everything. Typing $, @, / or # opens a shortlist that pages through the rest of that catalogue, with a count so nothing is quietly cut off, and the box stays where the caret is."
+      },
+      {
+        heading: "Fixes",
+        body: "A first run on Windows no longer stops at the desktop icon question, and never asks for an administrator it does not need. Codex reports itself ready only once a real run has authenticated."
+      }
+    ]
+  },
+  {
+    version: "0.9.2",
+    date: "2026-09-07",
+    sections: [
+      {
+        heading: "Fixes",
+        body: "If the Codex app has switched to a model your Codex CLI is too old for, a shot now stops with a plain sentence naming the version and the model, and the setup dialog opens on the update step rather than a green check. Update the CLI once and generation resumes."
+      }
+    ]
+  },
   {
     version: "0.9.1",
     date: "2026-09-07",
@@ -8749,15 +10727,15 @@ function registerDesktopRoutes(app, deps) {
         record: null
       };
     }
-    const { installDeps } = await import('./cli-FYWM4HBN.js');
-    const { desktopStatus } = await import('./install-4W6AARK6.js');
+    const { installDeps } = await import('./cli-SX46UQO6.js');
+    const { desktopStatus } = await import('./install-VXJPLYWM.js');
     return desktopStatus(installDeps(runtime.entry));
   });
   const install = deps.installImpl ?? (async () => {
     if (!runtime.entry) {
       return { ok: false, reason: "unsupported", message: "Desktop shortcuts are not available on this system yet." };
     }
-    const { addToDesktop } = await import('./cli-FYWM4HBN.js');
+    const { addToDesktop } = await import('./cli-SX46UQO6.js');
     return addToDesktop(runtime.entry);
   });
   app.get("/api/desktop", async () => {
@@ -8822,6 +10800,7 @@ function buildServer(opts) {
   registerAccessGuard(app, opts.access);
   const reserved = /* @__PURE__ */ new Map();
   const runningGenerations = /* @__PURE__ */ new Map();
+  core.catalog.reconcileInterruptedJobs();
   const thumbs = createThumbStore(core);
   const { scenes } = loadScenes(opts.templatesDir);
   const resolveScene = sceneResolver(scenes);
@@ -8831,8 +10810,11 @@ function buildServer(opts) {
     const e = err;
     const status = err instanceof SpendCapError ? 402 : e.statusCode ?? 500;
     const leaksPath = typeof e.code === "string" && /^(ENOENT|EACCES|EPERM|EISDIR|ENOTDIR)$/.test(e.code);
-    reply.status(status).send({ error: leaksPath ? "unexpected error" : e.message ?? "unexpected error" });
+    const rawRuntime = !e.statusCode && (err instanceof TypeError || err instanceof RangeError);
+    if (rawRuntime) console.error("unexpected error:", err);
+    reply.status(status).send({ error: leaksPath || rawRuntime ? "unexpected error" : e.message ?? "unexpected error" });
   });
+  const scrapeGuard = () => ({ allowPrivateHosts: process.env.SCENRI_SCRAPE_ALLOW_PRIVATE === "1" });
   app.get("/api/brands", async () => core.store.listBrands());
   app.post("/api/brands", async (req, reply) => {
     const json = req.body?.brand;
@@ -8841,10 +10823,12 @@ function buildServer(opts) {
     return core.store.createBrand(json);
   });
   app.post("/api/brands/from-url", async (req, reply) => {
-    const url = String(req.body?.url ?? "");
-    if (!/^https?:\/\//.test(url)) return reply.status(400).send({ error: "url must be http(s)" });
-    const { brand, warnings } = await buildFromUrl(url, {
+    const asked = normalizeSiteUrl(req.body?.url);
+    if (!asked.ok) return reply.status(400).send({ error: asked.message });
+    const url = asked.url;
+    const { brand, warnings, report } = await buildFromUrl(url, {
       fetchImpl: opts.fetchImpl,
+      guard: scrapeGuard(),
       // The store names every blob `<hash>.png` and /api/images/:hash always
       // serves image/png, so an un-normalized .ico or .svg here is a file lying
       // about its own format — broken in the marks grid, and mislabelled to any
@@ -8852,14 +10836,11 @@ function buildServer(opts) {
       saveAsset: async (buf) => `asset:${core.images.save(await toMarkPng(buf))}`,
       // Measured as stored (post-toMarkPng), so the scrape judges the same
       // pixels the compiler will one day attach.
-      probeLongEdge: async (buf) => {
-        const m = await sharp20(await toMarkPng(buf)).metadata();
-        return Math.max(m.width ?? 0, m.height ?? 0) || null;
-      },
+      inspectMark: (buf) => inspectMark(buf, toMarkPng),
       createdWith: `${meta.name}/${meta.version}`
     });
     const row = core.store.createBrand(brand);
-    return { ...row, warnings };
+    return { ...row, warnings, report };
   });
   app.put("/api/brands/:id", async (req, reply) => {
     const json = req.body?.brand;
@@ -8936,15 +10917,14 @@ function buildServer(opts) {
   app.post("/api/brands/:id/refresh-from-url", async (req, reply) => {
     const brand = core.store.getBrand(req.params.id);
     if (!brand) return reply.status(404).send({ error: "brand not found" });
-    const url = String(req.body?.url ?? brand.json?.meta?.website ?? "");
-    if (!/^https?:\/\//.test(url)) return reply.status(400).send({ error: "url must be http(s)" });
+    const asked = normalizeSiteUrl(req.body?.url ?? brand.json?.meta?.website);
+    if (!asked.ok) return reply.status(400).send({ error: asked.message });
+    const url = asked.url;
     const { brand: scraped, warnings } = await buildFromUrl(url, {
       fetchImpl: opts.fetchImpl,
+      guard: scrapeGuard(),
       saveAsset: async (buf) => `asset:${core.images.save(await toMarkPng(buf))}`,
-      probeLongEdge: async (buf) => {
-        const m = await sharp20(await toMarkPng(buf)).metadata();
-        return Math.max(m.width ?? 0, m.height ?? 0) || null;
-      },
+      inspectMark: (buf) => inspectMark(buf, toMarkPng),
       createdWith: `${meta.name}/${meta.version}`
     });
     const { brand: merged, suggestions } = mergeScrape(brand.json, scraped);
@@ -9252,7 +11232,14 @@ function buildServer(opts) {
     ],
     engineNames: () => engines.all().map((e) => ({ id: e.capabilities().id, name: e.capabilities().displayName }))
   });
-  registerCodexSetupRoutes(app, { codexSetup: opts.codexSetup, codexRunner: engines.codexRunner });
+  registerCodexSetupRoutes(app, {
+    codexSetup: opts.codexSetup,
+    codexRunner: engines.codexRunner,
+    envRepair: {
+      get: () => [...ignoreEnvKeysGetter(core)()],
+      set: (keys) => core.store.setSetting(IGNORE_ENV_KEYS_SETTING, keys.join(","))
+    }
+  });
   app.get("/api/engines", async () => {
     const list2 = [];
     for (const e of engines.all()) {
@@ -9315,11 +11302,11 @@ function buildServer(opts) {
     const out = [];
     for (const h of images) {
       const buf = core.images.read(h);
-      const meta2 = await sharp20(buf).metadata().catch(() => null);
+      const meta2 = await sharp21(buf).metadata().catch(() => null);
       if (!meta2?.width || !meta2.height) throw new Error("engine returned an undecodable image");
       const oriented = (meta2.orientation ?? 1) !== 1;
       out.push(
-        buf.subarray(0, 8).equals(PNG_SIG) && !oriented ? h : core.images.save(await sharp20(buf).rotate().png().toBuffer())
+        buf.subarray(0, 8).equals(PNG_SIG) && !oriented ? h : core.images.save(await sharp21(buf).rotate().png().toBuffer())
       );
     }
     return out;
@@ -9331,7 +11318,7 @@ function buildServer(opts) {
       const out = [];
       for (const h of images) {
         const buf = core.images.read(h);
-        const meta2 = await sharp20(buf).metadata();
+        const meta2 = await sharp21(buf).metadata();
         if (!meta2.width || !meta2.height) {
           out.push(h);
           continue;
@@ -9344,7 +11331,7 @@ function buildServer(opts) {
         }
         const w = got > target ? Math.round(meta2.height * target) : meta2.width;
         const hpx = got > target ? meta2.height : Math.round(meta2.width / target);
-        const cropped = await sharp20(buf).resize(w, hpx, { fit: "cover", position: "attention" }).png().toBuffer();
+        const cropped = await sharp21(buf).resize(w, hpx, { fit: "cover", position: "attention" }).png().toBuffer();
         app.log.info(
           { nodeId, got: `${meta2.width}x${meta2.height}`, want: `${w}x${hpx}` },
           "canvas: cropped a drifted frame to the asked ratio"
@@ -9363,7 +11350,7 @@ function buildServer(opts) {
   async function assertAspect(images, expect) {
     const want = expect.width / expect.height;
     for (const h of images) {
-      const meta2 = await sharp20(core.images.read(h)).metadata();
+      const meta2 = await sharp21(core.images.read(h)).metadata();
       if (!meta2.width || !meta2.height) continue;
       const got = meta2.width / meta2.height;
       if (Math.abs(got - want) / want > ASPECT_TOLERANCE)
@@ -9394,7 +11381,7 @@ function buildServer(opts) {
         if (post) own = await post(own);
         if (expect) await assertAspect(own, expect);
         try {
-          const meta2 = await sharp20(core.images.read(own[0])).metadata();
+          const meta2 = await sharp21(core.images.read(own[0])).metadata();
           const node = core.store.getNode(id);
           if (node && meta2.width && meta2.height) {
             const brief = node.brief ?? {};
@@ -9503,7 +11490,7 @@ function buildServer(opts) {
         crop: window
       });
       const work2 = async () => ({
-        images: [core.images.save(await sharp20(args.srcBuf).extract(window).png().toBuffer())],
+        images: [core.images.save(await sharp21(args.srcBuf).extract(window).png().toBuffer())],
         costUsd: 0
       });
       void runNode([node2.id], null, 0, work2, { width: plan2.width, height: plan2.height }).catch(
@@ -9528,7 +11515,7 @@ function buildServer(opts) {
       if (!srcHash || !core.images.has(String(srcHash)))
         return reply.status(400).send({ error: "edit needs a parent node with an image (sourceImage)" });
       const srcBuf = core.images.read(String(srcHash));
-      const srcMeta = await sharp20(srcBuf).metadata();
+      const srcMeta = await sharp21(srcBuf).metadata();
       if (!srcMeta.width || !srcMeta.height) return reply.status(400).send({ error: "source image unreadable" });
       return runCropNode({
         parentId: cropParentId,
@@ -9743,7 +11730,7 @@ function buildServer(opts) {
         );
       }
       const srcBuf = core.images.read(String(srcHash));
-      const srcMeta = await sharp20(srcBuf).metadata();
+      const srcMeta = await sharp21(srcBuf).metadata();
       if (srcMeta.width && srcMeta.height) expectShape = { width: srcMeta.width, height: srcMeta.height };
       const parentFormat = parent?.brief?.tokens?.find((t) => t?.t === "format");
       const parentNominal = parentFormat && Number(parentFormat.w) > 0 && Number(parentFormat.h) > 0 ? { width: Number(parentFormat.w), height: Number(parentFormat.h) } : null;
@@ -9777,7 +11764,7 @@ function buildServer(opts) {
         } else if (decision.op === "extend") {
           if (decision.assist) {
             expandAssist = { width: decision.assist.width, height: decision.assist.height };
-            workBuf = await sharp20(srcBuf).extract(decision.assist).png().toBuffer();
+            workBuf = await sharp21(srcBuf).extract(decision.assist).png().toBuffer();
             workSize = { width: decision.assist.width, height: decision.assist.height };
           }
           expandPlan = planExpand(workSize, targetRatio);
@@ -9798,7 +11785,7 @@ function buildServer(opts) {
         const fit = fitExpandToBudget(expandPlan, workSize, runEngine.capabilities().editPixelBudget);
         if (fit.scale < 1) {
           expandPlan = fit.plan;
-          workBuf = await sharp20(workBuf).resize(fit.source.width, fit.source.height, { fit: "fill", kernel: "lanczos3" }).png().toBuffer();
+          workBuf = await sharp21(workBuf).resize(fit.source.width, fit.source.height, { fit: "fill", kernel: "lanczos3" }).png().toBuffer();
           workSize = fit.source;
           extraWarnings.push(
             `${runEngine.capabilities().displayName} draws about ${((runEngine.capabilities().editPixelBudget ?? 0) / 1e6).toFixed(1)} megapixels, so this shape continues as a ${fit.plan.width}x${fit.plan.height} frame with the photograph riding inside it at ${fit.source.width}x${fit.source.height}. Nothing is upscaled; the stored size is the size the engine truly drew.`
@@ -9821,7 +11808,7 @@ function buildServer(opts) {
       if (editPixelBudget && stepped && (stepped.width !== srcMeta.width || stepped.height !== srcMeta.height)) {
         sentSize = stepped;
         budgetSourceHash = core.images.save(
-          await sharp20(srcBuf).resize(sentSize.width, sentSize.height, { fit: "fill", kernel: "lanczos3" }).png().toBuffer()
+          await sharp21(srcBuf).resize(sentSize.width, sentSize.height, { fit: "fill", kernel: "lanczos3" }).png().toBuffer()
         );
         if (!gradeOnlyAsk)
           extraWarnings.push(
@@ -9961,11 +11948,11 @@ function buildServer(opts) {
     const original = editedFrom ? core.images.read(editedFrom) : null;
     const localScope = kind === "edit" && !plan && editScope === "local" && original;
     const enforceEditCanvas = async (images) => {
-      const srcMeta = await sharp20(original).metadata();
+      const srcMeta = await sharp21(original).metadata();
       if (!srcMeta.width || !srcMeta.height) return images;
       const out = [];
       for (const h of images) {
-        const meta2 = await sharp20(core.images.read(h)).metadata();
+        const meta2 = await sharp21(core.images.read(h)).metadata();
         const got = { width: meta2.width ?? 0, height: meta2.height ?? 0 };
         const verdict = judgeEditSize({ width: srcMeta.width, height: srcMeta.height }, got, {
           pixelBudget: runEngine.capabilities().editPixelBudget
@@ -9995,7 +11982,7 @@ function buildServer(opts) {
           );
           out.push(
             core.images.save(
-              await sharp20(core.images.read(h)).resize(srcMeta.width, srcMeta.height, { fit: "fill" }).png().toBuffer()
+              await sharp21(core.images.read(h)).resize(srcMeta.width, srcMeta.height, { fit: "fill" }).png().toBuffer()
             )
           );
           try {
@@ -10017,7 +12004,7 @@ function buildServer(opts) {
       const out = [];
       for (const h of images) {
         const answer = core.images.read(h);
-        const got = await sharp20(answer).metadata();
+        const got = await sharp21(answer).metadata();
         if (got.width !== plan.width || got.height !== plan.height)
           app.log.info(
             { nodeId: node.id, got: `${got.width}x${got.height}`, want: `${plan.width}x${plan.height}` },
@@ -10178,6 +12165,7 @@ function buildServer(opts) {
       while (runningGenerations.size > 0 && Date.now() < deadline) {
         await new Promise((r) => setTimeout(r, 25));
       }
+      await settleCatalogImports();
       await thumbs.settle();
       await app.close();
       core.close();
@@ -10350,9 +12338,9 @@ async function run() {
     }
   }
   const ownEntry = fileURLToPath(import.meta.url);
-  const { addToDesktop, installDeps } = await import('./cli-FYWM4HBN.js');
-  const { refreshLauncher } = await import('./refresh-FKQABJOC.js');
-  const { askOnTerminal, offerDesktop, shouldOfferDesktop } = await import('./offer-IVTNHIDJ.js');
+  const { addToDesktop, installDeps } = await import('./cli-SX46UQO6.js');
+  const { refreshLauncher } = await import('./refresh-5HBDLLLB.js');
+  const { askOnTerminal, offerDesktop, shouldOfferDesktop } = await import('./offer-W6NJXMWT.js');
   const { launcherInstalled } = await import('./paths-6ZXRZUHY.js');
   const meta = readMeta();
   void refreshLauncher({ ...installDeps(ownEntry), ownEntry, installKind, pkg: meta.name }).then((r) => {
@@ -10374,7 +12362,7 @@ async function run() {
       add: () => addToDesktop(ownEntry),
       decline: () => core.store.setSetting("desktop.prompt", "declined"),
       say: (line) => console.log(line)
-    });
+    }).catch(() => console.log("  Could not ask about the desktop icon. Scenri is running anyway."));
     console.log("");
   }
 }
@@ -10384,8 +12372,8 @@ async function verify() {
     const db = new Database(":memory:");
     db.pragma("user_version");
     db.close();
-    const { default: sharp21 } = await import('sharp');
-    await sharp21({ create: { width: 1, height: 1, channels: 3, background: "#000" } }).png().toBuffer();
+    const { default: sharp22 } = await import('sharp');
+    await sharp22({ create: { width: 1, height: 1, channels: 3, background: "#000" } }).png().toBuffer();
     console.log(JSON.stringify({ ok: true, version: readMeta().version }));
   } catch (err) {
     console.log(JSON.stringify({ ok: false, error: String(err?.message ?? err) }));