Crawl Permission Gate

Most scrapers find out they have been banned, or sued, after the fact -- a 403, a Cloudflare challenge, a cease-and-desist. This gate moves that check to before the request goes out. It is a small TypeScript compiler and runtime gate that refuses to run a connector against a real host unless a versioned, human-reviewed policy record explicitly approves it, at grade A or B, with an active legal review and no kill switch engaged.

THE CORE TRICK is that the yes is unforgeable. A live admission can only come from a record loadPolicies() itself read off disk out of an approved/ directory -- not a record you construct in code, not a symlink pointing at an unreviewed file, not an object that merely has the right shape. The admission is branded in a module-private WeakSet, so nothing outside the package can mint a look-alike. Your own blocklist (host or host/path-prefix, normalised through the WHATWG URL parser to resist case, port, trailing-dot and percent-encoding bypasses) is layered underneath the approval check and applies even to an approved record's own allowed hosts -- a company's storefront can stay blocked while its developer API host stays usable.

WHAT SHIPS: the full gate (strict-mode ajv schema validation, directory and approval checks, blocklist matching, symlink-hardened file loading, fixture-mode sandboxing for testing against synthetic or loopback hosts), a validation CLI, and three generic template policy records that show the shape. You bring your own records for the sources you actually collect from.

VERIFIED: 85 tests, measured by running the suite.

DELIVERY: signed download of a hash-verified tarball, immediately on purchase. Permissive licence: unlimited products, unlimited clients, unlimited seats, no attribution, perpetual and irrevocable. One restriction, do not republish the source as source.