@detiq/crawler 0.1.3

package/src/phash.ts

@@ -0,0 +1,151 @@
+import sharp from 'sharp';
+import type { OverlayOptions } from 'sharp';
+
+/**
+ * Composites neutral grey (128,128,128) over each ignoredRegion (fractional
+ * 0-1 coordinates) so masked content — timestamps, live counters, ads —
+ * contributes nothing to any downstream pixel comparison. Shared by every
+ * comparison path (whole-image hash, per-cell grid hash, AI vision) so a
+ * region masked once is actually ignored everywhere, not just in the
+ * cheapest check.
+ */
+export async function applyMask(
+  imagePath: string,
+  ignoredRegions: Array<{ x: number; y: number; width: number; height: number }>,
+): Promise<Buffer> {
+  const meta = await sharp(imagePath).metadata();
+  const W = meta.width ?? 1200;
+  const H = meta.height ?? 800;
+
+  const overlays: OverlayOptions[] = await Promise.all(
+    ignoredRegions.map(async (r) => {
+      const rW = Math.max(1, Math.round(r.width * W));
+      const rH = Math.max(1, Math.round(r.height * H));
+      const buf = await sharp({
+        create: { width: rW, height: rH, channels: 3, background: { r: 128, g: 128, b: 128 } },
+      }).png().toBuffer();
+      return { input: buf, top: Math.round(r.y * H), left: Math.round(r.x * W) } as OverlayOptions;
+    }),
+  );
+
+  return sharp(imagePath).composite(overlays).png().toBuffer();
+}
+
+/**
+ * Compute an 8x8 average hash (aHash) of an image file, with optional mask overlays.
+ * ignoredRegions are fractional (0-1 range), converted to pixels here.
+ * Masked regions are filled with neutral grey (128,128,128) before hashing.
+ */
+async function hashWithMasks(
+  imagePath: string,
+  ignoredRegions: Array<{ x: number; y: number; width: number; height: number }> = [],
+): Promise<bigint> {
+  const pipeline = ignoredRegions.length > 0
+    ? sharp(await applyMask(imagePath, ignoredRegions))
+    : sharp(imagePath);
+
+  const buf = await pipeline.resize(8, 8, { fit: 'fill' }).greyscale().raw().toBuffer();
+  const pixels = Array.from(buf);
+  const mean = pixels.reduce((s, p) => s + p, 0) / pixels.length;
+  return pixels.reduce((h, p, i) => (p >= mean ? h | (1n << BigInt(63 - i)) : h), 0n);
+}
+
+function hammingDistance(a: bigint, b: bigint): number {
+  let xor = a ^ b;
+  let count = 0;
+  while (xor !== 0n) { count += Number(xor & 1n); xor >>= 1n; }
+  return count;
+}
+
+export async function screenshotDiffPercent(
+  pathA: string,
+  pathB: string,
+  ignoredRegions: Array<{ x: number; y: number; width: number; height: number }> = [],
+): Promise<{ pHashDistance: number; changeLevel: 'IDENTICAL' | 'MINOR' | 'MODERATE' | 'SIGNIFICANT' }> {
+  const [hashA, hashB] = await Promise.all([
+    hashWithMasks(pathA, ignoredRegions),
+    hashWithMasks(pathB, ignoredRegions),
+  ]);
+  let xor = hashA ^ hashB;
+  let dist = 0;
+  while (xor !== 0n) { dist += Number(xor & 1n); xor >>= 1n; }
+  const pct = parseFloat(((dist / 64) * 100).toFixed(1));
+  const changeLevel = pct === 0 ? 'IDENTICAL' : pct < 10 ? 'MINOR' : pct < 30 ? 'MODERATE' : 'SIGNIFICANT';
+  return { pHashDistance: pct, changeLevel };
+}
+
+/**
+ * Grid-based layout analysis: divides screenshots into a 3×3 grid and computes
+ * pHash per cell. Returns which regions changed and where, for the VisualDiff.changes field.
+ * Uses sharp's `extract` to crop each cell before hashing.
+ */
+export async function gridLayoutDiff(
+  pathA: string,
+  pathB: string,
+  ignoredRegions: Array<{ x: number; y: number; width: number; height: number }> = [],
+): Promise<Array<{ location: string; severity: string; description: string }>> {
+  const GRID_LABELS = [
+    'top-left',    'top-center',    'top-right',
+    'mid-left',    'mid-center',    'mid-right',
+    'bottom-left', 'bottom-center', 'bottom-right',
+  ];
+
+  try {
+    // Mask before cropping into cells — a masked region (e.g. a timestamp)
+    // then contributes nothing to any cell's hash, instead of only being
+    // ignored by the separate whole-image hash in screenshotDiffPercent().
+    const [sourceA, sourceB] = ignoredRegions.length > 0
+      ? await Promise.all([applyMask(pathA, ignoredRegions), applyMask(pathB, ignoredRegions)])
+      : [pathA, pathB];
+
+    const [metaA, metaB] = await Promise.all([
+      sharp(sourceA).metadata(),
+      sharp(sourceB).metadata(),
+    ]);
+    const W = Math.min(metaA.width ?? 1200, metaB.width ?? 1200);
+    const H = Math.min(metaA.height ?? 800, metaB.height ?? 800);
+    const cW = Math.floor(W / 3);
+    const cH = Math.floor(H / 3);
+
+    const changes: Array<{ location: string; severity: string; description: string }> = [];
+
+    for (let row = 0; row < 3; row++) {
+      for (let col = 0; col < 3; col++) {
+        const region = { left: col * cW, top: row * cH, width: cW, height: cH };
+        const label = GRID_LABELS[row * 3 + col];
+
+        const [hashA, hashB] = await Promise.all([
+          sharp(sourceA).extract(region).resize(8, 8, { fit: 'fill' }).greyscale().raw().toBuffer()
+            .then((buf) => {
+              const pixels = Array.from(buf);
+              const mean = pixels.reduce((s, p) => s + p, 0) / pixels.length;
+              return pixels.reduce((h, p, i) => p >= mean ? h | (1n << BigInt(63 - i)) : h, 0n);
+            }),
+          sharp(sourceB).extract(region).resize(8, 8, { fit: 'fill' }).greyscale().raw().toBuffer()
+            .then((buf) => {
+              const pixels = Array.from(buf);
+              const mean = pixels.reduce((s, p) => s + p, 0) / pixels.length;
+              return pixels.reduce((h, p, i) => p >= mean ? h | (1n << BigInt(63 - i)) : h, 0n);
+            }),
+        ]);
+
+        let xor = hashA ^ hashB;
+        let dist = 0;
+        while (xor !== 0n) { dist += Number(xor & 1n); xor >>= 1n; }
+        const pct = (dist / 64) * 100;
+
+        if (pct >= 5) {
+          const severity = pct >= 20 ? 'HIGH' : pct >= 10 ? 'MEDIUM' : 'LOW';
+          changes.push({
+            location: label,
+            severity,
+            description: `${Math.round(pct)}% visual change in ${label.replace('-', ' ')} region`,
+          });
+        }
+      }
+    }
+    return changes;
+  } catch {
+    return [];
+  }
+}

package/src/pii-scrubber.ts

@@ -0,0 +1,99 @@
+/**
+ * PII scrubber — detects and redacts Personally Identifiable Information
+ * from crawled markdown, HTML, and extracted text before storage.
+ *
+ * GDPR Article 4(1): "any information relating to an identified or identifiable natural person"
+ */
+
+export interface PiiMatch {
+  type: 'email' | 'phone' | 'ssn' | 'credit-card' | 'ip-address' | 'passport' | 'iban' | 'dob';
+  value: string;
+  start: number;
+  end: number;
+}
+
+export interface ScrubResult {
+  text: string;
+  matches: PiiMatch[];
+  scrubbed: boolean;
+}
+
+// Patterns — ordered from most-specific to least-specific
+const PATTERNS: Array<{ type: PiiMatch['type']; re: RegExp }> = [
+  // Email — RFC 5321 simplified
+  { type: 'email', re: /\b[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}\b/g },
+  // US SSN — 9 digits with dashes or spaces
+  { type: 'ssn', re: /\b(?!000|666|9\d\d)\d{3}[-\s](?!00)\d{2}[-\s](?!0000)\d{4}\b/g },
+  // Credit card — Visa/MC/Amex/Discover with optional spaces/dashes
+  { type: 'credit-card', re: /\b(?:4\d{3}|5[1-5]\d{2}|3[47]\d{2}|6(?:011|5\d{2}))[-\s]?\d{4}[-\s]?\d{4}[-\s]?\d{3,4}\b/g },
+  // IBAN — international bank account (15-34 chars)
+  { type: 'iban', re: /\b[A-Z]{2}\d{2}[A-Z0-9]{1,30}\b/g },
+  // Phone — international or US formats
+  { type: 'phone', re: /(?:\+?1[-.\s]?)?\(?\d{3}\)?[-.\s]\d{3}[-.\s]\d{4}\b|\+\d{1,3}[-.\s]\d{2,4}[-.\s]\d{3,4}[-.\s]\d{3,4}/g },
+  // Date of birth — common formats
+  { type: 'dob', re: /\b(?:0?[1-9]|1[0-2])\/(?:0?[1-9]|[12]\d|3[01])\/(?:19|20)\d{2}\b/g },
+  // IPv4 private/internal addresses — only flag private-looking ones in content
+  { type: 'ip-address', re: /\b(?:192\.168\.\d{1,3}\.\d{1,3}|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(?:1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3})\b/g },
+];
+
+const REDACT_MAP: Record<PiiMatch['type'], string> = {
+  email: '[EMAIL]',
+  phone: '[PHONE]',
+  ssn: '[SSN]',
+  'credit-card': '[CARD]',
+  'ip-address': '[IP]',
+  passport: '[PASSPORT]',
+  iban: '[IBAN]',
+  dob: '[DOB]',
+};
+
+export function detectPii(text: string): PiiMatch[] {
+  const matches: PiiMatch[] = [];
+  const seen = new Set<string>();
+
+  for (const { type, re } of PATTERNS) {
+    const r = new RegExp(re.source, re.flags.includes('g') ? re.flags : re.flags + 'g');
+    let m: RegExpExecArray | null;
+    while ((m = r.exec(text)) !== null) {
+      const key = `${type}:${m.index}`;
+      if (!seen.has(key)) {
+        seen.add(key);
+        matches.push({ type, value: m[0], start: m.index, end: m.index + m[0].length });
+      }
+    }
+  }
+
+  return matches.sort((a, b) => a.start - b.start);
+}
+
+export function scrubPii(text: string): ScrubResult {
+  const matches = detectPii(text);
+  if (matches.length === 0) return { text, matches: [], scrubbed: false };
+
+  // Replace from end to start so indices stay valid
+  let scrubbed = text;
+  for (let i = matches.length - 1; i >= 0; i--) {
+    const { type, start, end } = matches[i];
+    scrubbed = scrubbed.slice(0, start) + REDACT_MAP[type] + scrubbed.slice(end);
+  }
+
+  return { text: scrubbed, matches, scrubbed: true };
+}
+
+export function hasPii(text: string): boolean {
+  for (const { re } of PATTERNS) {
+    const r = new RegExp(re.source, re.flags);
+    if (r.test(text)) return true;
+  }
+  return false;
+}
+
+export function scrubObject<T extends Record<string, unknown>>(obj: T, fields: (keyof T)[]): T {
+  const result = { ...obj };
+  for (const field of fields) {
+    if (typeof result[field] === 'string') {
+      (result as any)[field] = scrubPii(result[field] as string).text;
+    }
+  }
+  return result;
+}

package/src/playwright-recorder.ts

@@ -0,0 +1,170 @@
+/**
+ * Playwright test recorder — generate Playwright test code from crawl data.
+ *
+ * Given a list of crawled screens, generates a minimal Playwright test file that:
+ * 1. Navigates to each screen URL
+ * 2. Verifies the page title
+ * 3. Checks key elements visible on the page
+ * 4. Verifies no console errors (optional)
+ *
+ * This is a "smoke test" generator — not a full interaction recorder.
+ * Output: valid TypeScript Playwright test file ready to run with npx playwright test.
+ */
+
+export interface RecorderScreen {
+  id: string;
+  name: string;
+  url: string;
+  title?: string;
+  heading?: string;
+  markdownWordCount?: number;
+  smartLocator?: {
+    tag: string;          // e.g. 'button', 'a', 'input'
+    text?: string;        // visible text content
+    role?: string;        // ARIA role
+    placeholder?: string; // for inputs
+    nearText?: string;    // nearby label text
+  };
+}
+
+export interface RecorderOpts {
+  baseUrl?: string;
+  includeConsoleCheck?: boolean;
+  testTimeout?: number; // ms, default 30000
+  projectName?: string;
+  useSmartLocators?: boolean; // default true
+}
+
+function buildSmartLocatorHelper(): string {
+  return `
+// smartLocator — falls back to similarity search when primary selector fails.
+// Generated by ZeTa Crawler. Do not edit manually.
+async function smartLocator(page: any, primary: string, ref: { tag?: string; text?: string; role?: string; placeholder?: string }) {
+  try {
+    const el = page.locator(primary);
+    if (await el.count() > 0) return el;
+  } catch { /* fall through */ }
+  // Fallback: find by ARIA role + text
+  if (ref.role && ref.text) {
+    const byRole = page.getByRole(ref.role as any, { name: ref.text, exact: false });
+    if (await byRole.count() > 0) return byRole;
+  }
+  // Fallback: find by text content
+  if (ref.text) {
+    const byText = page.getByText(ref.text, { exact: false });
+    if (await byText.count() > 0) return byText;
+  }
+  // Fallback: find by placeholder
+  if (ref.placeholder) {
+    const byPlaceholder = page.getByPlaceholder(ref.placeholder, { exact: false });
+    if (await byPlaceholder.count() > 0) return byPlaceholder;
+  }
+  // Last resort: return the primary (will fail with original error)
+  return page.locator(primary);
+}`.trim();
+}
+
+function sanitizeTestName(name: string): string {
+  return name.replace(/[^a-zA-Z0-9 _-]/g, '').trim().slice(0, 80) || 'Screen';
+}
+
+function escapeString(s: string): string {
+  return s.replace(/\\/g, '\\\\').replace(/'/g, "\\'").replace(/`/g, '\\`');
+}
+
+export function generatePlaywrightTest(screens: RecorderScreen[], opts: RecorderOpts = {}): string {
+  const {
+    includeConsoleCheck = false,
+    testTimeout = 30_000,
+    projectName = 'ZeTa Crawl',
+    useSmartLocators = true,
+  } = opts;
+
+  const needsSmartLocator = useSmartLocators && screens.some(s => s.smartLocator != null);
+
+  const lines: string[] = [
+    `// Generated by ZeTa Crawler — ${new Date().toISOString()}`,
+    `// Project: ${escapeString(projectName)}`,
+    `// Screens: ${screens.length}`,
+    `// Run: npx playwright test`,
+    '',
+    "import { test, expect } from '@playwright/test';",
+    '',
+  ];
+
+  if (needsSmartLocator) {
+    lines.push(buildSmartLocatorHelper(), '');
+  }
+
+  lines.push(`test.setTimeout(${testTimeout});`, '');
+
+  if (includeConsoleCheck) {
+    lines.push(
+      `test.beforeEach(async ({ page }) => {`,
+      `  const errors: string[] = [];`,
+      `  page.on('console', msg => { if (msg.type() === 'error') errors.push(msg.text()); });`,
+      `  page.on('pageerror', err => errors.push(err.message));`,
+      `  (page as any).__consoleErrors = errors;`,
+      `});`,
+      '',
+    );
+  }
+
+  for (const screen of screens) {
+    const testName = sanitizeTestName(screen.name);
+    lines.push(
+      `test('${escapeString(testName)}', async ({ page }) => {`,
+      `  await page.goto('${escapeString(screen.url)}');`,
+      `  await expect(page).toHaveURL(/${escapeString(screen.url.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'))}/);`,
+    );
+
+    if (screen.title) {
+      lines.push(`  await expect(page).toHaveTitle(/${escapeString(screen.title.slice(0, 40).replace(/[.*+?^${}()|[\]\\]/g, '\\$&'))}/i);`);
+    }
+
+    if (screen.heading) {
+      const h = escapeString(screen.heading.slice(0, 60));
+      if (needsSmartLocator && screen.smartLocator) {
+        const tag = escapeString(screen.smartLocator.tag);
+        const text = escapeString(screen.smartLocator.text ?? '');
+        lines.push(
+          `  const headingEl = await smartLocator(page, 'h1, h2, h3', { tag: '${tag}', text: '${text}' });`,
+          `  await expect(headingEl.first()).toContainText('${h}', { ignoreCase: true });`,
+        );
+      } else {
+        lines.push(`  await expect(page.locator('h1, h2, h3').first()).toContainText('${h}', { ignoreCase: true });`);
+      }
+    }
+
+    if (includeConsoleCheck) {
+      lines.push(`  expect((page as any).__consoleErrors ?? []).toHaveLength(0);`);
+    }
+
+    lines.push(`});`, '');
+  }
+
+  return lines.join('\n');
+}
+
+export function generatePlaywrightConfig(opts: { baseUrl?: string; reportDir?: string } = {}): string {
+  const { baseUrl = 'http://localhost:3000', reportDir = 'playwright-report' } = opts;
+  return `// playwright.config.ts — generated by ZeTa Crawler
+import { defineConfig } from '@playwright/test';
+
+export default defineConfig({
+  testDir: './tests',
+  reporter: [['html', { outputFolder: '${reportDir}' }]],
+  use: {
+    baseURL: '${baseUrl}',
+    headless: true,
+    screenshot: 'only-on-failure',
+    video: 'retain-on-failure',
+  },
+  projects: [
+    { name: 'chromium', use: { browserName: 'chromium' } },
+    { name: 'firefox', use: { browserName: 'firefox' } },
+    { name: 'webkit', use: { browserName: 'webkit' } },
+  ],
+});
+`;
+}

package/src/policies/crawl-safety.ts

@@ -0,0 +1,46 @@
+import type { DomainProfile } from '../profiles/domain-profile.js';
+
+export interface CrawlSafetyDecision {
+  allowed: boolean;
+  reason?: string;
+  severity: 'info' | 'warn' | 'block';
+}
+
+const DESTRUCTIVE_ACTION = /\b(delete|remove|destroy|deactivate|disable|cancel|refund|void|transfer|withdraw|pay now|place order|submit order|confirm payment|send money|publish|approve|reject|bulk update|drop)\b/i;
+const SECRET_LIKE = /\b(api[_ -]?key|secret|token|password|authorization|cookie|set-cookie)\b/i;
+
+export function assessActionSafety(label: string, profile: DomainProfile): CrawlSafetyDecision {
+  const riskyByProfile = profile.riskyActions.some((risk) => label.toLowerCase().includes(risk.toLowerCase()));
+  if (DESTRUCTIVE_ACTION.test(label) || riskyByProfile) {
+    return {
+      allowed: false,
+      severity: 'block',
+      reason: `Blocked risky action "${label}" for ${profile.industry} profile.`,
+    };
+  }
+  return { allowed: true, severity: 'info' };
+}
+
+export function redactSensitiveValue(value: string): string {
+  let redacted = value
+    .replace(/[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/gi, '[email]')
+    .replace(/\b(?:\+?\d[\d -]{8,}\d)\b/g, '[phone-or-id]')
+    .replace(/\b(?:\d[ -]*?){13,19}\b/g, '[card-like-number]')
+    .replace(/\b[A-Za-z0-9_-]{24,}\b/g, '[token-like-value]');
+  if (SECRET_LIKE.test(redacted)) redacted = redacted.replace(/:\s*[^,\s}]+/g, ': [redacted]');
+  return redacted;
+}
+
+export function redactJson(value: unknown): unknown {
+  if (typeof value === 'string') return redactSensitiveValue(value);
+  if (Array.isArray(value)) return value.map(redactJson);
+  if (value && typeof value === 'object') {
+    const out: Record<string, unknown> = {};
+    for (const [key, item] of Object.entries(value)) {
+      if (SECRET_LIKE.test(key)) out[key] = '[redacted]';
+      else out[key] = redactJson(item);
+    }
+    return out;
+  }
+  return value;
+}

package/src/profiles/domain-profile.ts

@@ -0,0 +1,167 @@
+export type Industry =
+  | 'ecommerce'
+  | 'banking'
+  | 'fintech'
+  | 'healthcare'
+  | 'pharma'
+  | 'agriculture'
+  | 'legacy-enterprise'
+  | 'saas'
+  | 'unknown';
+
+export interface DomainProfile {
+  industry: Industry;
+  confidence: number;
+  importantScreenPatterns: string[];
+  workflowGoals: string[];
+  piiRules: string[];
+  riskyActions: string[];
+  safeProbeRules: string[];
+  requiredArtifacts: string[];
+  evidence: string[];
+}
+
+const COMMON_REQUIRED_ARTIFACTS = [
+  'screenshot',
+  'dom',
+  'markdown',
+  'accessibility',
+  'network',
+  'performance',
+];
+
+const PROFILES: Record<Industry, Omit<DomainProfile, 'confidence' | 'evidence'>> = {
+  ecommerce: {
+    industry: 'ecommerce',
+    importantScreenPatterns: ['catalog', 'product', 'search', 'filter', 'cart', 'checkout', 'payment', 'order', 'returns'],
+    workflowGoals: ['discover product catalogue', 'map cart and checkout', 'capture order confirmation and failure states', 'map search/filter/sort'],
+    piiRules: ['mask email', 'mask phone', 'mask address', 'mask card-like numbers'],
+    riskyActions: ['place order', 'submit payment', 'save card', 'apply real coupon'],
+    safeProbeRules: ['do not click final payment/order buttons', 'use invalid test card data only', 'stop before irreversible purchase'],
+    requiredArtifacts: COMMON_REQUIRED_ARTIFACTS,
+  },
+  banking: {
+    industry: 'banking',
+    importantScreenPatterns: ['login', 'mfa', 'dashboard', 'accounts', 'transactions', 'transfer', 'beneficiary', 'statement', 'dispute'],
+    workflowGoals: ['map account overview', 'map transactions and statements', 'map transfer setup without submitting', 'map MFA/session timeout states'],
+    piiRules: ['mask account numbers', 'mask balances', 'mask names', 'mask addresses', 'mask tax identifiers'],
+    riskyActions: ['transfer money', 'add beneficiary', 'submit dispute', 'download sensitive statement'],
+    safeProbeRules: ['read-only by default', 'never submit transfer confirmation', 'never alter beneficiary data'],
+    requiredArtifacts: COMMON_REQUIRED_ARTIFACTS,
+  },
+  fintech: {
+    industry: 'fintech',
+    importantScreenPatterns: ['kyc', 'wallet', 'transactions', 'cards', 'payments', 'payouts', 'risk', 'compliance', 'disputes'],
+    workflowGoals: ['map KYC onboarding', 'map wallet/payment states', 'map failed payment and dispute flows', 'capture compliance screens'],
+    piiRules: ['mask card numbers', 'mask bank accounts', 'mask identity documents', 'mask balances'],
+    riskyActions: ['send payment', 'withdraw funds', 'change card status', 'submit KYC with real data'],
+    safeProbeRules: ['sandbox data only', 'stop before money movement', 'never upload real identity documents'],
+    requiredArtifacts: COMMON_REQUIRED_ARTIFACTS,
+  },
+  healthcare: {
+    industry: 'healthcare',
+    importantScreenPatterns: ['patient', 'appointment', 'claims', 'provider', 'prescription', 'records', 'lab', 'consent'],
+    workflowGoals: ['map patient lookup safely', 'map appointment booking before final submit', 'map claims and prescription screens', 'capture consent and records UX'],
+    piiRules: ['mask PHI', 'mask patient names', 'mask MRN', 'mask DOB', 'mask diagnosis', 'mask prescriptions'],
+    riskyActions: ['schedule real appointment', 'submit claim', 'change medication', 'message provider with PHI'],
+    safeProbeRules: ['use synthetic patients only', 'do not submit clinical changes', 'avoid external notifications'],
+    requiredArtifacts: COMMON_REQUIRED_ARTIFACTS,
+  },
+  pharma: {
+    industry: 'pharma',
+    importantScreenPatterns: ['product', 'dosage', 'safety', 'batch', 'adverse-event', 'regulatory', 'trial', 'label'],
+    workflowGoals: ['map product and safety content', 'map adverse event intake before submit', 'capture regulatory and batch workflows'],
+    piiRules: ['mask patient reports', 'mask reporter contact', 'mask trial participant identifiers'],
+    riskyActions: ['submit adverse event', 'change safety record', 'publish regulatory content'],
+    safeProbeRules: ['stop before regulatory or safety submission', 'use synthetic reports only'],
+    requiredArtifacts: COMMON_REQUIRED_ARTIFACTS,
+  },
+  agriculture: {
+    industry: 'agriculture',
+    importantScreenPatterns: ['crop', 'field', 'weather', 'inventory', 'marketplace', 'logistics', 'sensor', 'subsidy'],
+    workflowGoals: ['map crop and field planning', 'map inventory/marketplace flows', 'capture logistics and sensor dashboards'],
+    piiRules: ['mask farmer identity', 'mask location precision', 'mask subsidy identifiers'],
+    riskyActions: ['place market order', 'submit subsidy application', 'change sensor/device control'],
+    safeProbeRules: ['avoid irreversible orders', 'avoid device actuation', 'use test farm data'],
+    requiredArtifacts: COMMON_REQUIRED_ARTIFACTS,
+  },
+  'legacy-enterprise': {
+    industry: 'legacy-enterprise',
+    importantScreenPatterns: ['frameset', 'iframe', 'popup', 'table', 'search', 'admin', 'report', 'export'],
+    workflowGoals: ['map menu trees', 'capture iframe and popup states', 'map table filters and reports', 'detect session timeout'],
+    piiRules: ['mask table cells that look like PII', 'mask exported identifiers'],
+    riskyActions: ['bulk update', 'delete record', 'export production data', 'submit admin change'],
+    safeProbeRules: ['read-only table probing', 'never click delete/bulk actions', 'capture popups without committing'],
+    requiredArtifacts: COMMON_REQUIRED_ARTIFACTS,
+  },
+  saas: {
+    industry: 'saas',
+    importantScreenPatterns: ['dashboard', 'settings', 'users', 'billing', 'integrations', 'reports', 'admin', 'workspace'],
+    workflowGoals: ['map workspace navigation', 'map settings and integrations', 'map role/user management without changing state', 'capture dashboards and reports'],
+    piiRules: ['mask emails', 'mask tokens', 'mask API keys', 'mask billing data'],
+    riskyActions: ['delete workspace', 'invite real user', 'rotate key', 'change billing plan'],
+    safeProbeRules: ['never submit destructive settings', 'redact secrets immediately', 'use sandbox users'],
+    requiredArtifacts: COMMON_REQUIRED_ARTIFACTS,
+  },
+  unknown: {
+    industry: 'unknown',
+    importantScreenPatterns: ['login', 'dashboard', 'settings', 'search', 'detail', 'report', 'form'],
+    workflowGoals: ['map top-level navigation', 'capture forms and validation states', 'discover hidden menus', 'classify domain after first pages'],
+    piiRules: ['mask emails', 'mask phone numbers', 'mask long identifiers', 'mask card-like numbers'],
+    riskyActions: ['delete', 'submit payment', 'transfer', 'publish', 'send notification'],
+    safeProbeRules: ['read-only by default', 'stop before irreversible actions', 'use synthetic data only'],
+    requiredArtifacts: COMMON_REQUIRED_ARTIFACTS,
+  },
+};
+
+const INDUSTRY_HINTS: Array<{ industry: Industry; terms: RegExp[] }> = [
+  { industry: 'ecommerce', terms: [/cart/i, /checkout/i, /product/i, /catalog/i, /sku/i, /wishlist/i, /order/i] },
+  { industry: 'banking', terms: [/account/i, /statement/i, /beneficiar/i, /transfer/i, /iban/i, /routing/i, /balance/i] },
+  { industry: 'fintech', terms: [/wallet/i, /kyc/i, /payout/i, /card/i, /payment/i, /risk/i, /dispute/i] },
+  { industry: 'healthcare', terms: [/patient/i, /provider/i, /appointment/i, /claim/i, /prescription/i, /medical/i, /lab result/i] },
+  { industry: 'pharma', terms: [/pharma/i, /dosage/i, /adverse/i, /batch/i, /regulatory/i, /clinical trial/i, /label/i] },
+  { industry: 'agriculture', terms: [/crop/i, /field/i, /farm/i, /harvest/i, /sensor/i, /weather/i, /subsidy/i] },
+  { industry: 'legacy-enterprise', terms: [/frameset/i, /iframe/i, /popup/i, /legacy/i, /report export/i, /mainframe/i] },
+  { industry: 'saas', terms: [/workspace/i, /tenant/i, /integration/i, /billing/i, /api key/i, /admin/i, /dashboard/i] },
+];
+
+export function classifyDomainProfile(input: {
+  appUrl: string;
+  projectName?: string | null;
+  appType?: string | null;
+  seedText?: string;
+}): DomainProfile {
+  const haystack = [input.appUrl, input.projectName ?? '', input.appType ?? '', input.seedText ?? ''].join(' ');
+  const scores = new Map<Industry, { score: number; evidence: string[] }>();
+  for (const { industry, terms } of INDUSTRY_HINTS) {
+    for (const term of terms) {
+      if (term.test(haystack)) {
+        const prev = scores.get(industry) ?? { score: 0, evidence: [] };
+        prev.score += 1;
+        prev.evidence.push(term.source);
+        scores.set(industry, prev);
+      }
+    }
+  }
+  let selected: Industry = 'unknown';
+  let best = 0;
+  let evidence: string[] = [];
+  for (const [industry, result] of scores) {
+    if (result.score > best) {
+      selected = industry;
+      best = result.score;
+      evidence = result.evidence;
+    }
+  }
+  const base = PROFILES[selected];
+  return {
+    ...base,
+    confidence: best === 0 ? 0.25 : Math.min(0.95, 0.35 + best * 0.15),
+    evidence,
+  };
+}
+
+export function getProfile(industry: Industry): DomainProfile {
+  const base = PROFILES[industry] ?? PROFILES.unknown;
+  return { ...base, confidence: 1, evidence: ['explicit'] };
+}