playwright-archaeologist 0.1.1

package/dist/chunk-F5WCXM7I.js

@@ -0,0 +1,4469 @@
+import {
+  normalizeUrl,
+  shouldCrawl
+} from "./chunk-RWPEKZOW.js";
+
+// src/types/config.ts
+import { z } from "zod";
+var ViewportSchema = z.object({
+  width: z.number().int().min(320, "Viewport width must be >= 320").max(7680, "Viewport width must be <= 7680"),
+  height: z.number().int().min(240, "Viewport height must be >= 240").max(4320, "Viewport height must be <= 4320")
+});
+function parseViewport(input) {
+  const match = input.match(/^(\d+)x(\d+)$/);
+  if (!match) return null;
+  const width = parseInt(match[1], 10);
+  const height = parseInt(match[2], 10);
+  const result = ViewportSchema.safeParse({ width, height });
+  return result.success ? result.data : null;
+}
+var OutputFormatSchema = z.enum(["html", "json", "openapi", "both"]);
+function normalizeEntryUrl(raw) {
+  const warnings = [];
+  let url = raw.trim();
+  if (!/^https?:\/\//i.test(url)) {
+    if (/^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(url)) {
+      throw new Error(`Unsupported protocol in URL: ${url}. Only http and https are allowed.`);
+    }
+    url = `https://${url}`;
+    warnings.push(`No protocol specified. Using https://${raw.trim()}`);
+  }
+  try {
+    const parsed = new URL(url);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+      throw new Error(`Unsupported protocol "${parsed.protocol}". Only http: and https: are allowed.`);
+    }
+    if (!parsed.hostname || parsed.hostname.length === 0) {
+      throw new Error("URL has no hostname.");
+    }
+  } catch (err) {
+    if (err instanceof TypeError) {
+      throw new Error(`Invalid URL: ${url}`);
+    }
+    throw err;
+  }
+  return { url, warnings };
+}
+var CrawlConfigSchema = z.object({
+  // ---- Target ----
+  /** Entry URL to start crawling. Must be http or https. */
+  targetUrl: z.string().url("Target URL must be a valid URL"),
+  // ---- Discovery ----
+  /** Maximum crawl depth from the entry URL. 0 = entry URL only. */
+  depth: z.number().int().min(0, "Depth must be >= 0").max(100, "Depth is clamped to 100").default(5),
+  /** Maximum total pages to visit. */
+  maxPages: z.number().int().min(1, "Max pages must be >= 1").max(1e5, "Max pages is clamped to 100,000").default(1e3),
+  /** URL glob patterns to include. Only URLs matching at least one pattern are crawled. */
+  include: z.array(z.string()).default([]),
+  /** URL glob patterns to exclude. URLs matching any pattern are skipped. */
+  exclude: z.array(z.string()).default([]),
+  /** Whether to follow links to external origins. Default: false (same-origin only). */
+  followExternal: z.boolean().default(false),
+  /** Enable Tier 3 clicking: click non-link interactive elements to discover SPA states. */
+  deepClick: z.boolean().default(false),
+  /** Crawl cross-origin iframe content. Default: false (record URL only). */
+  includeIframes: z.boolean().default(false),
+  // ---- Performance ----
+  /** Number of parallel browser contexts. */
+  concurrency: z.number().int().min(1, "Concurrency must be >= 1").max(20, "Concurrency is clamped to 20").default(3),
+  /** Delay in milliseconds between page visits per context. */
+  delay: z.number().int().min(0, "Delay must be >= 0").max(6e4, "Delay must be <= 60000ms").default(0),
+  /** Per-page navigation timeout in milliseconds. */
+  timeout: z.number().int().min(1e3, "Timeout must be >= 1000ms").max(3e5, "Timeout must be <= 300000ms").default(3e4),
+  /** Global crawl timeout in seconds. 0 = no limit. */
+  maxTime: z.number().int().min(0, "Max time must be >= 0").max(86400, "Max time must be <= 86400s (24 hours)").default(3600),
+  // ---- Auth ----
+  /** Path to auth script (.ts or .js) exporting a default async function. */
+  authScript: z.string().optional(),
+  /** Path to cookies JSON file for session injection. */
+  cookiesFile: z.string().optional(),
+  /** Include cookies/auth headers in output (default: scrubbed). */
+  includeCookies: z.boolean().default(false),
+  // ---- Output ----
+  /** Output directory path. Created if it does not exist. Parent must exist. */
+  outputDir: z.string().default(".archaeologist"),
+  /** Output format(s). */
+  format: OutputFormatSchema.default("both"),
+  /** Skip screenshot capture entirely. */
+  noScreenshots: z.boolean().default(false),
+  /** Skip HAR recording entirely. */
+  noHar: z.boolean().default(false),
+  // ---- Display ----
+  /** Primary viewport dimensions. */
+  viewport: ViewportSchema.default({ width: 1280, height: 720 }),
+  /** Additional viewports for responsive screenshots (empty = primary only). */
+  additionalViewports: z.array(ViewportSchema).default([]),
+  // ---- Resume ----
+  /** Resume from last checkpoint in the output directory. */
+  resume: z.boolean().default(false),
+  /** Skip confirmation prompts (auth script execution, etc.). */
+  yes: z.boolean().default(false),
+  // ---- Security ----
+  /** Allow crawling private/internal IP ranges (SSRF protection bypass). */
+  allowPrivate: z.boolean().default(false),
+  // ---- Diff (for `pa diff` subcommand) ----
+  /** Pixel diff threshold (0-1 scale, lower = more sensitive). */
+  diffThreshold: z.number().min(0, "Diff threshold must be >= 0").max(1, "Diff threshold must be <= 1").default(0.1),
+  /** Maximum diff ratio (0-100%) before a screenshot is considered "changed". */
+  diffMaxRatio: z.number().min(0, "Diff max ratio must be >= 0").max(100, "Diff max ratio must be <= 100").default(0.5),
+  /** Fields to ignore during API diff (comma-separated or array). */
+  diffIgnoreFields: z.array(z.string()).default([
+    "timestamp",
+    "createdAt",
+    "updatedAt",
+    "date",
+    "requestId",
+    "traceId",
+    "correlationId",
+    "token",
+    "nonce",
+    "csrf",
+    "etag",
+    "lastModified"
+  ])
+});
+var DiffConfigSchema = z.object({
+  /** Path to the "old" .archaeologist bundle. */
+  oldBundle: z.string(),
+  /** Path to the "new" .archaeologist bundle. */
+  newBundle: z.string(),
+  /** Output directory for diff report and artifacts. */
+  outputDir: z.string().default(".archaeologist"),
+  /** Pixel diff threshold. */
+  diffThreshold: CrawlConfigSchema.shape.diffThreshold,
+  /** Maximum diff ratio. */
+  diffMaxRatio: CrawlConfigSchema.shape.diffMaxRatio,
+  /** Fields to ignore during API response diff. */
+  diffIgnoreFields: CrawlConfigSchema.shape.diffIgnoreFields,
+  /** Normalize dynamic values (UUIDs, timestamps, JWTs) before diffing. */
+  normalizeDynamicValues: z.boolean().default(false),
+  /** Show detailed value-level diffs (default: schema-level only). */
+  detailed: z.boolean().default(false),
+  /** Output formats for the diff report. */
+  outputFormats: z.object({
+    html: z.string().optional(),
+    json: z.string().optional(),
+    junit: z.string().optional(),
+    markdown: z.string().optional()
+  }).default({})
+});
+
+// src/types/errors.ts
+var ArchaeologistError = class extends Error {
+  /** Machine-readable error code for programmatic handling. */
+  code;
+  constructor(message, code, options) {
+    super(message, options);
+    this.name = "ArchaeologistError";
+    this.code = code;
+  }
+};
+var ConfigError = class extends ArchaeologistError {
+  /** The config field that failed validation (e.g. "depth", "viewport"). */
+  field;
+  /** The invalid value the user supplied. */
+  value;
+  constructor(field, message, value) {
+    super(message, "ERR_CONFIG");
+    this.name = "ConfigError";
+    this.field = field;
+    this.value = value;
+  }
+};
+var AuthError = class extends ArchaeologistError {
+  reason;
+  scriptPath;
+  constructor(reason, message, scriptPath, options) {
+    super(message, "ERR_AUTH", options);
+    this.name = "AuthError";
+    this.reason = reason;
+    this.scriptPath = scriptPath;
+  }
+};
+var CrawlError = class extends ArchaeologistError {
+  /** The URL being processed when the error occurred. */
+  url;
+  constructor(message, code, url, options) {
+    super(message, code, options);
+    this.name = "CrawlError";
+    this.url = url;
+  }
+};
+var NavigationError = class extends CrawlError {
+  status;
+  /** HTTP status code, if applicable (e.g. 404, 500). */
+  httpStatus;
+  constructor(url, status, message, httpStatus, options) {
+    super(message, "ERR_NAVIGATION", url, options);
+    this.name = "NavigationError";
+    this.status = status;
+    this.httpStatus = httpStatus;
+  }
+};
+var CollectorError = class extends CrawlError {
+  collector;
+  constructor(collector, url, message, options) {
+    super(message, "ERR_COLLECTOR", url, options);
+    this.name = "CollectorError";
+    this.collector = collector;
+  }
+};
+var DiffError = class extends ArchaeologistError {
+  reason;
+  constructor(reason, message, options) {
+    super(message, "ERR_DIFF", options);
+    this.name = "DiffError";
+    this.reason = reason;
+  }
+};
+var BundleError = class extends ArchaeologistError {
+  reason;
+  bundlePath;
+  constructor(reason, message, bundlePath, options) {
+    super(message, "ERR_BUNDLE", options);
+    this.name = "BundleError";
+    this.reason = reason;
+    this.bundlePath = bundlePath;
+  }
+};
+
+// src/utils/logger.ts
+var RESET = "\x1B[0m";
+var DIM = "\x1B[2m";
+var RED = "\x1B[31m";
+var YELLOW = "\x1B[33m";
+var GREEN = "\x1B[32m";
+var CYAN = "\x1B[36m";
+var BOLD = "\x1B[1m";
+var LEVEL_PRIORITY = {
+  debug: 0,
+  info: 1,
+  warn: 2,
+  error: 3
+};
+function timestamp() {
+  const now = /* @__PURE__ */ new Date();
+  const h = String(now.getHours()).padStart(2, "0");
+  const m = String(now.getMinutes()).padStart(2, "0");
+  const s = String(now.getSeconds()).padStart(2, "0");
+  const ms = String(now.getMilliseconds()).padStart(3, "0");
+  return `${h}:${m}:${s}.${ms}`;
+}
+var Logger = class {
+  level;
+  constructor(level = "info") {
+    this.level = level;
+  }
+  /** Update the minimum log level at runtime. */
+  setLevel(level) {
+    this.level = level;
+  }
+  /** Get the current minimum log level. */
+  getLevel() {
+    return this.level;
+  }
+  /** Check whether a given level would be emitted. */
+  isLevelEnabled(level) {
+    return LEVEL_PRIORITY[level] >= LEVEL_PRIORITY[this.level];
+  }
+  debug(message, ...args) {
+    if (!this.isLevelEnabled("debug")) return;
+    const ts = `${DIM}${timestamp()}${RESET}`;
+    const prefix = `${CYAN}DEBUG${RESET}`;
+    console.error(`${ts} ${prefix} ${message}`, ...args);
+  }
+  info(message, ...args) {
+    if (!this.isLevelEnabled("info")) return;
+    const ts = `${DIM}${timestamp()}${RESET}`;
+    const prefix = `${BOLD}INFO${RESET}`;
+    console.error(`${ts} ${prefix}  ${message}`, ...args);
+  }
+  warn(message, ...args) {
+    if (!this.isLevelEnabled("warn")) return;
+    const ts = `${DIM}${timestamp()}${RESET}`;
+    const prefix = `${YELLOW}WARN${RESET}`;
+    console.error(`${ts} ${prefix}  ${message}`, ...args);
+  }
+  error(message, ...args) {
+    if (!this.isLevelEnabled("error")) return;
+    const ts = `${DIM}${timestamp()}${RESET}`;
+    const prefix = `${RED}ERROR${RESET}`;
+    console.error(`${ts} ${prefix} ${message}`, ...args);
+  }
+  /** Success message — always shown at info level or below. */
+  success(message, ...args) {
+    if (!this.isLevelEnabled("info")) return;
+    const ts = `${DIM}${timestamp()}${RESET}`;
+    const prefix = `${GREEN}OK${RESET}`;
+    console.error(`${ts} ${prefix}    ${message}`, ...args);
+  }
+};
+var logger = new Logger("info");
+
+// src/crawl/frontier.ts
+var Frontier = class {
+  queue = [];
+  head = 0;
+  seen = /* @__PURE__ */ new Set();
+  maxDepth;
+  constructor(options = {}) {
+    this.maxDepth = options.maxDepth ?? Infinity;
+  }
+  /**
+   * Add a URL to the queue. Returns false if already seen or exceeds max depth.
+   */
+  enqueue(entry) {
+    if (entry.depth > this.maxDepth) {
+      return false;
+    }
+    const normalized = normalizeUrl(entry.url);
+    if (this.seen.has(normalized)) {
+      return false;
+    }
+    this.seen.add(normalized);
+    this.queue.push(entry);
+    return true;
+  }
+  /**
+   * Remove and return the next URL from the queue (FIFO).
+   * Returns undefined if queue is empty.
+   */
+  dequeue() {
+    if (this.head >= this.queue.length) {
+      return void 0;
+    }
+    const entry = this.queue[this.head++];
+    if (this.head > this.queue.length / 2) {
+      this.queue = this.queue.slice(this.head);
+      this.head = 0;
+    }
+    return entry;
+  }
+  /**
+   * Check if a URL has been seen (ever enqueued, whether still queued or already dequeued).
+   */
+  hasSeen(url) {
+    const normalized = normalizeUrl(url);
+    return this.seen.has(normalized);
+  }
+  /**
+   * Get the number of URLs remaining in the queue.
+   */
+  get size() {
+    return this.queue.length - this.head;
+  }
+  /**
+   * Get the total number of URLs seen (visited + queued).
+   */
+  get totalSeen() {
+    return this.seen.size;
+  }
+  /**
+   * Check if the queue is empty.
+   */
+  get isEmpty() {
+    return this.head >= this.queue.length;
+  }
+};
+
+// src/security/output-sanitizer.ts
+import { resolve, extname, isAbsolute, normalize } from "path";
+import { accessSync, constants } from "fs";
+import { platform } from "os";
+var WINDOWS_RESERVED = /* @__PURE__ */ new Set([
+  "CON",
+  "PRN",
+  "AUX",
+  "NUL",
+  "COM1",
+  "COM2",
+  "COM3",
+  "COM4",
+  "COM5",
+  "COM6",
+  "COM7",
+  "COM8",
+  "COM9",
+  "LPT1",
+  "LPT2",
+  "LPT3",
+  "LPT4",
+  "LPT5",
+  "LPT6",
+  "LPT7",
+  "LPT8",
+  "LPT9"
+]);
+function sanitizeFilename(input) {
+  if (!input) return "_unnamed";
+  let result = input;
+  try {
+    result = decodeURIComponent(result);
+  } catch {
+  }
+  result = result.replace(/\0/g, "");
+  result = result.replace(/\.\.\//g, "");
+  result = result.replace(/\.\.\\/g, "");
+  result = result.replace(/\.\./g, "");
+  result = result.replace(/[/\\:*?"<>|\x00-\x1F\x7F]/g, "_");
+  result = result.replace(/[^a-zA-Z0-9._-]/g, "_");
+  result = result.replace(/_{2,}/g, "_");
+  result = result.replace(/^[_]+/, "");
+  result = result.replace(/[_]+$/, "");
+  if (!result || result === "." || result === "..") {
+    return "_unnamed";
+  }
+  const ext = extname(result);
+  const nameWithoutExt = ext ? result.slice(0, -ext.length) : result;
+  if (WINDOWS_RESERVED.has(nameWithoutExt.toUpperCase())) {
+    result = `_${nameWithoutExt}${ext}`;
+  }
+  const MAX_LENGTH = 255;
+  if (result.length > MAX_LENGTH) {
+    const extension = extname(result);
+    if (extension && extension.length < 20) {
+      const maxBase = MAX_LENGTH - extension.length;
+      result = result.slice(0, maxBase) + extension;
+    } else {
+      result = result.slice(0, MAX_LENGTH);
+    }
+  }
+  return result;
+}
+function urlToFilename(url) {
+  let result;
+  try {
+    const parsed = new URL(url);
+    result = parsed.hostname + parsed.pathname;
+    if (parsed.search) {
+      result += parsed.search;
+    }
+  } catch {
+    result = url;
+  }
+  return sanitizeFilename(result);
+}
+
+// src/collectors/screenshot-capturer.ts
+import { createHash } from "crypto";
+import { mkdir, stat } from "fs/promises";
+import { join } from "path";
+var DEFAULT_VIEWPORT = { width: 1280, height: 720 };
+var MAX_SCROLL_INCREMENTS = 3;
+var SCROLL_SETTLE_MS = 200;
+async function captureScreenshots(page, baseUrl, outputDir, viewport) {
+  const effectiveViewport = viewport ?? DEFAULT_VIEWPORT;
+  const pageUrl = page.url();
+  const baseName = urlToFilename(pageUrl);
+  const fullPageFilename = `${baseName}_full.png`;
+  const viewportFilename = `${baseName}_viewport.png`;
+  const fullPagePath = join(outputDir, fullPageFilename);
+  const viewportPath = join(outputDir, viewportFilename);
+  try {
+    await mkdir(outputDir, { recursive: true });
+    await triggerLazyContent(page, effectiveViewport);
+    const modalDetected = await detectModals(page);
+    const fullPageBuffer = await page.screenshot({ fullPage: true, path: fullPagePath });
+    const viewportBuffer = await page.screenshot({ path: viewportPath });
+    const fullPageHash = computeSha256(fullPageBuffer);
+    const viewportHash = computeSha256(viewportBuffer);
+    const dimensions = extractPngDimensions(fullPageBuffer);
+    const fileSizeBytes = await getFileSize(fullPagePath, fullPageBuffer);
+    return {
+      pageUrl,
+      fullPagePath,
+      viewportPath,
+      viewport: effectiveViewport,
+      fullPageHash,
+      viewportHash,
+      dimensions,
+      fileSizeBytes,
+      modalDetected
+    };
+  } catch {
+    return {
+      pageUrl,
+      fullPagePath: "",
+      viewportPath: "",
+      viewport: effectiveViewport,
+      fullPageHash: "0".repeat(64),
+      viewportHash: "0".repeat(64),
+      dimensions: { width: 0, height: 0 },
+      fileSizeBytes: 0,
+      modalDetected: false
+    };
+  }
+}
+async function triggerLazyContent(page, viewport) {
+  const scrollHeight = await page.evaluate(() => document.documentElement.scrollHeight);
+  const viewportHeight = viewport.height;
+  const maxScrollDistance = viewportHeight * MAX_SCROLL_INCREMENTS;
+  const targetScroll = Math.min(scrollHeight, maxScrollDistance);
+  for (let scrolled = viewportHeight; scrolled <= targetScroll; scrolled += viewportHeight) {
+    await page.evaluate((y) => window.scrollTo(0, y), scrolled);
+    await page.evaluate(
+      (ms) => new Promise((resolve2) => setTimeout(resolve2, ms)),
+      SCROLL_SETTLE_MS
+    );
+  }
+  await page.evaluate(() => window.scrollTo(0, 0));
+}
+async function detectModals(page) {
+  const modalSelector = 'dialog[open], [role="dialog"], .modal.show, .modal.active';
+  const locator = page.locator(modalSelector);
+  try {
+    const count = await locator.count();
+    if (count === 0) return false;
+    for (let i = 0; i < count; i++) {
+      const isVisible = await locator.nth(i).isVisible();
+      if (isVisible) return true;
+    }
+    return false;
+  } catch {
+    return false;
+  }
+}
+function computeSha256(buffer) {
+  return createHash("sha256").update(buffer).digest("hex");
+}
+function extractPngDimensions(buffer) {
+  if (buffer.length < 24) {
+    return { width: 0, height: 0 };
+  }
+  const width = buffer.readUInt32BE(16);
+  const height = buffer.readUInt32BE(20);
+  return { width, height };
+}
+async function getFileSize(filePath, buffer) {
+  try {
+    const stats = await stat(filePath);
+    return stats.size;
+  } catch {
+    return buffer.length;
+  }
+}
+
+// src/collectors/form-prober.ts
+async function probeForms(page, pageUrl) {
+  const forms = [];
+  const formLocators = await page.locator("form").all();
+  for (const formLocator of formLocators) {
+    try {
+      const rawForm = await formLocator.evaluate(
+        (formEl, currentPageUrl) => {
+          const rawAction = formEl.getAttribute("action");
+          let action = "";
+          if (rawAction !== null && rawAction !== "") {
+            try {
+              action = new URL(rawAction, currentPageUrl).href;
+            } catch {
+              action = rawAction;
+            }
+          }
+          const method = (formEl.getAttribute("method") ?? "GET").toUpperCase();
+          const id = formEl.getAttribute("id");
+          const name = formEl.getAttribute("name");
+          const enctype = formEl.getAttribute("enctype");
+          const ariaLabel = formEl.getAttribute("aria-label");
+          const fieldEls = formEl.querySelectorAll("input, select, textarea");
+          const fields = [];
+          const processedRadioGroups = /* @__PURE__ */ new Set();
+          fieldEls.forEach((el) => {
+            const tagName = el.tagName.toLowerCase();
+            const fieldName = el.getAttribute("name") ?? "";
+            let fieldType;
+            if (tagName === "select") {
+              fieldType = "select";
+            } else if (tagName === "textarea") {
+              fieldType = "textarea";
+            } else {
+              fieldType = el.type ?? "text";
+            }
+            if ((fieldType === "radio" || fieldType === "checkbox") && fieldName) {
+              if (processedRadioGroups.has(fieldName)) return;
+              processedRadioGroups.add(fieldName);
+              const groupEls = formEl.querySelectorAll(
+                `input[name="${CSS.escape(fieldName)}"]`
+              );
+              const options2 = [];
+              groupEls.forEach((groupEl) => {
+                const inp = groupEl;
+                const groupLabel = deriveLabel(groupEl);
+                options2.push({
+                  value: inp.value ?? "",
+                  label: groupLabel ?? inp.value ?? "",
+                  selected: inp.checked
+                });
+              });
+              const firstEl = groupEls[0];
+              fields.push({
+                name: fieldName,
+                type: fieldType,
+                required: firstEl.required || firstEl.getAttribute("aria-required") === "true",
+                pattern: null,
+                placeholder: null,
+                label: deriveLabel(firstEl),
+                options: options2,
+                min: null,
+                max: null,
+                step: null,
+                maxLength: null,
+                multiple: false,
+                accept: null,
+                defaultValue: null,
+                isPassword: false
+              });
+              return;
+            }
+            if (fieldType === "radio" || fieldType === "checkbox") {
+              if (fieldName && processedRadioGroups.has(fieldName)) return;
+            }
+            const required = el.required || el.getAttribute("aria-required") === "true";
+            const pattern = el.getAttribute("pattern");
+            const placeholder = el.getAttribute("placeholder");
+            const label = deriveLabel(el);
+            let options = null;
+            if (tagName === "select") {
+              const selectEl = el;
+              options = [];
+              const optionEls = selectEl.querySelectorAll("option");
+              optionEls.forEach((opt) => {
+                options.push({
+                  value: opt.value,
+                  label: opt.textContent?.trim() ?? opt.value,
+                  selected: opt.selected
+                });
+              });
+            }
+            const min = el.getAttribute("min");
+            const max = el.getAttribute("max");
+            const step = el.getAttribute("step");
+            const maxLengthAttr = el.getAttribute("maxlength");
+            const maxLength = maxLengthAttr !== null ? parseInt(maxLengthAttr, 10) : null;
+            const multiple = el.multiple || el.multiple || false;
+            const accept = el.getAttribute("accept");
+            const isPassword = fieldType === "password";
+            let defaultValue = null;
+            if (tagName === "textarea") {
+              defaultValue = el.value || null;
+            } else if (tagName === "select") {
+              const selectedOpt = el.selectedOptions[0];
+              defaultValue = selectedOpt?.value ?? null;
+            } else {
+              defaultValue = el.value || null;
+            }
+            fields.push({
+              name: fieldName,
+              type: fieldType,
+              required,
+              pattern,
+              placeholder,
+              label,
+              options,
+              min,
+              max,
+              step,
+              maxLength: maxLength !== null && !isNaN(maxLength) ? maxLength : null,
+              multiple,
+              accept,
+              defaultValue,
+              isPassword
+            });
+          });
+          let submitButtonText = null;
+          const submitBtn = formEl.querySelector('button[type="submit"]') ?? formEl.querySelector('input[type="submit"]');
+          if (submitBtn) {
+            if (submitBtn.tagName.toLowerCase() === "input") {
+              submitButtonText = submitBtn.value || null;
+            } else {
+              submitButtonText = submitBtn.textContent?.trim() || null;
+            }
+          } else {
+            const firstButton = formEl.querySelector("button");
+            if (firstButton) {
+              submitButtonText = firstButton.textContent?.trim() || null;
+            }
+          }
+          return {
+            action,
+            method,
+            id,
+            name,
+            enctype,
+            ariaLabel,
+            fields,
+            submitButtonText
+          };
+          function deriveLabel(element) {
+            const ariaLbl = element.getAttribute("aria-label");
+            if (ariaLbl) return ariaLbl;
+            const labelledBy = element.getAttribute("aria-labelledby");
+            if (labelledBy) {
+              const labelEl = document.getElementById(labelledBy);
+              if (labelEl) {
+                const text = labelEl.textContent?.trim();
+                if (text) return text;
+              }
+            }
+            const elId = element.getAttribute("id");
+            if (elId) {
+              const labelEl = document.querySelector(
+                `label[for="${CSS.escape(elId)}"]`
+              );
+              if (labelEl) {
+                const text = labelEl.textContent?.trim();
+                if (text) return text;
+              }
+            }
+            const parentLabel = element.closest("label");
+            if (parentLabel) {
+              const text = parentLabel.textContent?.trim();
+              if (text) return text;
+            }
+            return null;
+          }
+        },
+        pageUrl
+      );
+      forms.push(convertRawFormToFormInfo(rawForm, false));
+    } catch {
+      continue;
+    }
+  }
+  try {
+    const implicitForms = await page.evaluate(
+      (currentPageUrl) => {
+        const allFields = document.querySelectorAll(
+          "input, select, textarea"
+        );
+        const orphanedFields = [];
+        allFields.forEach((field) => {
+          if (!field.closest("form")) {
+            const tagName = field.tagName.toLowerCase();
+            const type = field.type;
+            if (tagName === "input" && (type === "hidden" || type === "submit" || type === "button")) {
+              return;
+            }
+            orphanedFields.push(field);
+          }
+        });
+        if (orphanedFields.length === 0) return [];
+        const fields = orphanedFields.map((el) => {
+          const tagName = el.tagName.toLowerCase();
+          const fieldName = el.getAttribute("name") ?? "";
+          let fieldType;
+          if (tagName === "select") {
+            fieldType = "select";
+          } else if (tagName === "textarea") {
+            fieldType = "textarea";
+          } else {
+            fieldType = el.type ?? "text";
+          }
+          const required = el.required || el.getAttribute("aria-required") === "true";
+          let options = null;
+          if (tagName === "select") {
+            options = [];
+            const optionEls = el.querySelectorAll("option");
+            optionEls.forEach((opt) => {
+              options.push({
+                value: opt.value,
+                label: opt.textContent?.trim() ?? opt.value,
+                selected: opt.selected
+              });
+            });
+          }
+          const isPassword = fieldType === "password";
+          let defaultValue = null;
+          if (tagName === "textarea") {
+            defaultValue = el.value || null;
+          } else if (tagName === "select") {
+            const selectedOpt = el.selectedOptions[0];
+            defaultValue = selectedOpt?.value ?? null;
+          } else {
+            defaultValue = el.value || null;
+          }
+          let label = null;
+          const ariaLbl = el.getAttribute("aria-label");
+          if (ariaLbl) {
+            label = ariaLbl;
+          } else {
+            const elId = el.getAttribute("id");
+            if (elId) {
+              const labelEl = document.querySelector(
+                `label[for="${CSS.escape(elId)}"]`
+              );
+              if (labelEl) {
+                label = labelEl.textContent?.trim() ?? null;
+              }
+            }
+            if (!label) {
+              const parentLabel = el.closest("label");
+              if (parentLabel) {
+                label = parentLabel.textContent?.trim() ?? null;
+              }
+            }
+          }
+          return {
+            name: fieldName,
+            type: fieldType,
+            required,
+            pattern: el.getAttribute("pattern"),
+            placeholder: el.getAttribute("placeholder"),
+            label,
+            options,
+            min: el.getAttribute("min"),
+            max: el.getAttribute("max"),
+            step: el.getAttribute("step"),
+            maxLength: el.getAttribute("maxlength") ? parseInt(el.getAttribute("maxlength"), 10) : null,
+            multiple: el.multiple || false,
+            accept: el.getAttribute("accept"),
+            defaultValue,
+            isPassword
+          };
+        });
+        let submitButtonText = null;
+        const submitBtns = document.querySelectorAll(
+          'button[type="submit"], input[type="submit"]'
+        );
+        submitBtns.forEach((btn) => {
+          if (!btn.closest("form") && !submitButtonText) {
+            if (btn.tagName.toLowerCase() === "input") {
+              submitButtonText = btn.value || null;
+            } else {
+              submitButtonText = btn.textContent?.trim() || null;
+            }
+          }
+        });
+        return [
+          {
+            action: "",
+            method: "GET",
+            id: null,
+            name: null,
+            enctype: null,
+            ariaLabel: null,
+            fields,
+            submitButtonText
+          }
+        ];
+      },
+      pageUrl
+    );
+    for (const rawForm of implicitForms) {
+      forms.push(convertRawFormToFormInfo(rawForm, true));
+    }
+  } catch {
+  }
+  return {
+    pageUrl,
+    forms
+  };
+}
+function convertRawFormToFormInfo(raw, isImplicit) {
+  const fields = raw.fields.map((f) => {
+    const field = {
+      name: f.name,
+      type: f.type,
+      required: f.required
+    };
+    if (f.pattern != null) field.pattern = f.pattern;
+    if (f.placeholder != null) field.placeholder = f.placeholder;
+    if (f.label != null) field.label = f.label;
+    if (f.options != null) field.options = f.options;
+    if (f.min != null) field.min = f.min;
+    if (f.max != null) field.max = f.max;
+    if (f.step != null) field.step = f.step;
+    if (f.maxLength != null) field.maxLength = f.maxLength;
+    if (f.multiple) field.multiple = f.multiple;
+    if (f.accept != null) field.accept = f.accept;
+    if (f.isPassword && f.defaultValue != null) {
+      field.defaultValue = "[REDACTED]";
+    } else if (f.defaultValue != null) {
+      field.defaultValue = f.defaultValue;
+    }
+    return field;
+  });
+  const formInfo = {
+    action: raw.action,
+    method: raw.method,
+    isImplicit,
+    fields,
+    validationMessages: [],
+    wasHidden: false
+  };
+  if (raw.id != null) formInfo.id = raw.id;
+  if (raw.name != null) formInfo.name = raw.name;
+  if (raw.submitButtonText != null) formInfo.submitButtonText = raw.submitButtonText;
+  if (raw.enctype != null) formInfo.enctype = raw.enctype;
+  if (raw.ariaLabel != null) formInfo.ariaLabel = raw.ariaLabel;
+  return formInfo;
+}
+
+// src/security/credential-scrubber.ts
+var ALWAYS_SCRUB_HEADERS = /* @__PURE__ */ new Set([
+  "authorization",
+  "proxy-authorization",
+  "x-api-key",
+  "x-auth-token",
+  "x-session-id",
+  "x-csrf-token",
+  "x-xsrf-token"
+]);
+var COOKIE_HEADERS = /* @__PURE__ */ new Set([
+  "cookie",
+  "set-cookie"
+]);
+function scrubHeaders(headers, options) {
+  const result = {};
+  const includeCookies = options?.includeCookies ?? false;
+  for (const [key, value] of Object.entries(headers)) {
+    const lower = key.toLowerCase();
+    if (ALWAYS_SCRUB_HEADERS.has(lower)) {
+      result[key] = "[REDACTED]";
+      continue;
+    }
+    if (COOKIE_HEADERS.has(lower)) {
+      if (includeCookies) {
+        result[key] = value;
+      } else {
+        result[key] = "[REDACTED]";
+      }
+      continue;
+    }
+    result[key] = value;
+  }
+  return result;
+}
+
+// src/collectors/network-logger.ts
+var MAX_BODY_SIZE = 100 * 1024;
+var MAX_WS_MESSAGES_PER_DIRECTION = 5;
+var ANALYTICS_DOMAINS = [
+  "google-analytics.com",
+  "googletagmanager.com",
+  "analytics.google.com",
+  "segment.io",
+  "segment.com",
+  "cdn.segment.com",
+  "api.segment.io",
+  "mixpanel.com",
+  "hotjar.com",
+  "fullstory.com",
+  "heap.io",
+  "heapanalytics.com",
+  "amplitude.com",
+  "plausible.io",
+  "clarity.ms",
+  "newrelic.com",
+  "nr-data.net",
+  "sentry.io",
+  "datadog",
+  "pendo.io"
+];
+var STATIC_EXTENSIONS = /* @__PURE__ */ new Set([
+  ".css",
+  ".js",
+  ".png",
+  ".jpg",
+  ".jpeg",
+  ".gif",
+  ".svg",
+  ".woff",
+  ".woff2",
+  ".ttf",
+  ".eot",
+  ".otf",
+  ".ico",
+  ".webp",
+  ".avif",
+  ".mp4",
+  ".webm",
+  ".mp3",
+  ".ogg",
+  ".wav",
+  ".map"
+]);
+var STATIC_RESOURCE_TYPES = /* @__PURE__ */ new Set([
+  "stylesheet",
+  "image",
+  "font",
+  "media"
+]);
+function createNetworkLogger(page, pageUrl, options) {
+  const includeCookies = options?.includeCookies ?? false;
+  let counter = 0;
+  const requestIdMap = /* @__PURE__ */ new Map();
+  const requestTimings = /* @__PURE__ */ new Map();
+  const requests = [];
+  const responses = [];
+  const failedRequests = [];
+  const graphqlOperations = [];
+  const webSocketConnections = [];
+  let pageOrigin = "";
+  try {
+    pageOrigin = new URL(pageUrl).origin;
+  } catch {
+  }
+  function classifyRequest(url, resourceType, contentType) {
+    if (resourceType === "websocket") {
+      return "websocket";
+    }
+    try {
+      const hostname = new URL(url).hostname;
+      for (const domain of ANALYTICS_DOMAINS) {
+        if (hostname.includes(domain)) {
+          return "analytics";
+        }
+      }
+    } catch {
+    }
+    if (url.includes("/api/") || url.includes("/graphql") || contentType && contentType.includes("application/json")) {
+      return "api";
+    }
+    if (STATIC_RESOURCE_TYPES.has(resourceType)) {
+      return "static";
+    }
+    try {
+      const pathname = new URL(url).pathname;
+      const dotIndex = pathname.lastIndexOf(".");
+      if (dotIndex !== -1) {
+        const ext = pathname.slice(dotIndex).toLowerCase();
+        if (STATIC_EXTENSIONS.has(ext)) {
+          return "static";
+        }
+      }
+    } catch {
+    }
+    if (pageOrigin) {
+      try {
+        const requestOrigin = new URL(url).origin;
+        if (requestOrigin !== pageOrigin) {
+          return "third-party";
+        }
+      } catch {
+      }
+    }
+    return "other";
+  }
+  function mapInitiator(resourceType) {
+    switch (resourceType) {
+      case "document":
+        return "navigation";
+      case "script":
+      case "stylesheet":
+        return "script";
+      case "fetch":
+        return "fetch";
+      case "xhr":
+        return "xhr";
+      default:
+        return "other";
+    }
+  }
+  function tryDetectGraphQL(request, requestId, url, body) {
+    if (request.method() !== "POST") return;
+    if (!url.includes("graphql")) return;
+    if (!body) return;
+    try {
+      const parsed = JSON.parse(body);
+      const operationName = parsed.operationName ?? "unknown";
+      const query = parsed.query ?? "";
+      const variables = parsed.variables;
+      let operationType = "query";
+      const trimmedQuery = query.trimStart();
+      if (trimmedQuery.startsWith("mutation")) {
+        operationType = "mutation";
+      } else if (trimmedQuery.startsWith("subscription")) {
+        operationType = "subscription";
+      }
+      const op = {
+        pageUrl,
+        endpointUrl: url,
+        operationName,
+        operationType,
+        query
+      };
+      if (variables !== void 0 && variables !== null) {
+        op.variables = variables;
+      }
+      graphqlOperations.push(op);
+    } catch {
+    }
+  }
+  function onRequest(request) {
+    const id = `req_${counter++}`;
+    requestIdMap.set(request, id);
+    requestTimings.set(id, Date.now());
+    const url = request.url();
+    const resourceType = request.resourceType();
+    const method = request.method();
+    const rawHeaders = request.headers();
+    const postData = request.postData() ?? void 0;
+    const contentType = rawHeaders["content-type"] ?? void 0;
+    const classification = classifyRequest(url, resourceType, contentType);
+    const initiator = mapInitiator(resourceType);
+    const captured = {
+      requestId: id,
+      url,
+      method,
+      headers: scrubHeaders(rawHeaders, { includeCookies }),
+      resourceType,
+      classification,
+      initiator
+    };
+    if (postData !== void 0) {
+      captured.body = postData;
+    }
+    if (contentType !== void 0) {
+      captured.contentType = contentType;
+    }
+    requests.push(captured);
+    tryDetectGraphQL(request, id, url, postData);
+  }
+  async function onResponse(response) {
+    const request = response.request();
+    const id = requestIdMap.get(request);
+    if (!id) return;
+    const startTime = requestTimings.get(id) ?? Date.now();
+    const timing = Date.now() - startTime;
+    const rawHeaders = response.headers();
+    const statusCode = response.status();
+    const contentType = rawHeaders["content-type"] ?? void 0;
+    let body;
+    let bodySize = 0;
+    try {
+      const buffer = await response.body();
+      bodySize = buffer.length;
+      if (contentType && isTextContentType(contentType)) {
+        const text = buffer.toString("utf-8");
+        body = text.length > MAX_BODY_SIZE ? text.slice(0, MAX_BODY_SIZE) : text;
+      }
+    } catch {
+    }
+    const captured = {
+      requestId: id,
+      statusCode,
+      headers: scrubHeaders(rawHeaders, { includeCookies }),
+      bodySize,
+      timing
+    };
+    if (body !== void 0) {
+      captured.body = body;
+    }
+    if (contentType !== void 0) {
+      captured.contentType = contentType;
+    }
+    responses.push(captured);
+    if (body) {
+      const gqlOp = graphqlOperations.find((op) => {
+        const matchingReq = requests.find((r) => r.requestId === id);
+        return matchingReq && op.endpointUrl === matchingReq.url;
+      });
+      if (gqlOp && gqlOp.responseData === void 0) {
+        try {
+          gqlOp.responseData = JSON.parse(body);
+        } catch {
+        }
+      }
+    }
+  }
+  function onRequestFailed(request) {
+    const id = requestIdMap.get(request) ?? `req_${counter++}`;
+    const url = request.url();
+    const method = request.method();
+    const resourceType = request.resourceType();
+    const classification = classifyRequest(url, resourceType);
+    const failure = request.failure();
+    const errorText = failure?.errorText ?? "Unknown error";
+    failedRequests.push({
+      requestId: id,
+      url,
+      method,
+      errorText,
+      classification
+    });
+  }
+  function onWebSocket(ws) {
+    const wsUrl = ws.url();
+    let sentCount = 0;
+    let receivedCount = 0;
+    const connection = {
+      url: wsUrl,
+      pageUrl,
+      connected: true,
+      messageCount: 0,
+      sampleMessages: []
+    };
+    webSocketConnections.push(connection);
+    ws.on("framereceived", (data) => {
+      connection.messageCount++;
+      if (receivedCount < MAX_WS_MESSAGES_PER_DIRECTION) {
+        receivedCount++;
+        connection.sampleMessages.push({
+          direction: "received",
+          data: typeof data.payload === "string" ? data.payload : data.payload.toString("utf-8"),
+          timestamp: (/* @__PURE__ */ new Date()).toISOString()
+        });
+      }
+    });
+    ws.on("framesent", (data) => {
+      connection.messageCount++;
+      if (sentCount < MAX_WS_MESSAGES_PER_DIRECTION) {
+        sentCount++;
+        connection.sampleMessages.push({
+          direction: "sent",
+          data: typeof data.payload === "string" ? data.payload : data.payload.toString("utf-8"),
+          timestamp: (/* @__PURE__ */ new Date()).toISOString()
+        });
+      }
+    });
+    ws.on("close", () => {
+      connection.connected = false;
+    });
+  }
+  return {
+    start() {
+      page.on("request", onRequest);
+      page.on("response", onResponse);
+      page.on("requestfailed", onRequestFailed);
+      page.on("websocket", onWebSocket);
+    },
+    stop() {
+      page.off("request", onRequest);
+      page.off("response", onResponse);
+      page.off("requestfailed", onRequestFailed);
+      page.off("websocket", onWebSocket);
+      return {
+        pageUrl,
+        requests,
+        responses,
+        failedRequests,
+        graphqlOperations,
+        webSocketConnections,
+        cookieMutations: []
+      };
+    }
+  };
+}
+function isTextContentType(contentType) {
+  const lower = contentType.toLowerCase();
+  return lower.includes("text/") || lower.includes("application/json") || lower.includes("application/xml") || lower.includes("application/javascript") || lower.includes("application/xhtml") || lower.includes("application/graphql") || lower.includes("+json") || lower.includes("+xml");
+}
+
+// src/assembler/api-grouper.ts
+var UUID_WITH_DASHES = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var UUID_WITHOUT_DASHES = /^[0-9a-f]{32}$/i;
+function isNumericId(segment) {
+  return /^\d+$/.test(segment);
+}
+function isUuid(segment) {
+  return UUID_WITH_DASHES.test(segment) || UUID_WITHOUT_DASHES.test(segment);
+}
+function isSlug(segment) {
+  if (!segment || !segment.includes("-")) return false;
+  if (!/^[a-z0-9]+(-[a-z0-9]+)+$/.test(segment)) return false;
+  if (isUuid(segment)) return false;
+  return true;
+}
+function parameterizePath(path2) {
+  const pathOnly = path2.split("?")[0];
+  const segments = pathOnly.split("/");
+  const parameterized = segments.map((segment) => {
+    if (!segment) return segment;
+    if (isUuid(segment)) return ":id";
+    if (isNumericId(segment)) return ":id";
+    if (isSlug(segment)) return ":slug";
+    return segment;
+  });
+  return parameterized.join("/");
+}
+function extractParameterTypes(path2) {
+  const pathOnly = path2.split("?")[0];
+  const segments = pathOnly.split("/");
+  const result = {};
+  let idIndex = 0;
+  let slugIndex = 0;
+  for (const segment of segments) {
+    if (!segment) continue;
+    if (isUuid(segment)) {
+      result[`:id_${idIndex++}`] = "uuid";
+    } else if (isNumericId(segment)) {
+      result[`:id_${idIndex++}`] = "id";
+    } else if (isSlug(segment)) {
+      result[`:slug_${slugIndex++}`] = "slug";
+    }
+  }
+  return result;
+}
+function groupEndpoints(endpoints) {
+  if (endpoints.length === 0) return [];
+  const groupMap = /* @__PURE__ */ new Map();
+  for (const endpoint of endpoints) {
+    const pattern = parameterizePath(endpoint.url);
+    const key = `${endpoint.method} ${pattern}`;
+    const existing = groupMap.get(key);
+    if (existing) {
+      existing.examples.push(endpoint);
+    } else {
+      groupMap.set(key, {
+        pattern,
+        method: endpoint.method,
+        examples: [endpoint],
+        parameterTypes: extractParameterTypes(endpoint.url)
+      });
+    }
+  }
+  return Array.from(groupMap.values());
+}
+
+// src/assembler/flow-graph.ts
+var MAX_LABEL_LENGTH = 30;
+var DEFAULT_MAX_NODES = 50;
+function urlToLabel(url) {
+  let path2;
+  try {
+    const parsed = new URL(url);
+    path2 = parsed.pathname;
+  } catch {
+    path2 = url.split("?")[0];
+  }
+  if (path2 === "/" || path2 === "") {
+    return "/";
+  }
+  const stripped = path2.startsWith("/") ? path2.slice(1) : path2;
+  const parameterized = parameterizePath("/" + stripped).slice(1);
+  if (parameterized.length > MAX_LABEL_LENGTH) {
+    return parameterized.slice(0, MAX_LABEL_LENGTH - 3) + "...";
+  }
+  return parameterized;
+}
+function detectCycles(edges) {
+  if (edges.length === 0) return [];
+  const adjacency = /* @__PURE__ */ new Map();
+  const allNodes = /* @__PURE__ */ new Set();
+  for (const edge of edges) {
+    allNodes.add(edge.from);
+    allNodes.add(edge.to);
+    let neighbors = adjacency.get(edge.from);
+    if (!neighbors) {
+      neighbors = /* @__PURE__ */ new Set();
+      adjacency.set(edge.from, neighbors);
+    }
+    neighbors.add(edge.to);
+  }
+  const cycleNodeSet = /* @__PURE__ */ new Set();
+  const state = /* @__PURE__ */ new Map();
+  const pathStack = [];
+  function dfs(node) {
+    state.set(node, 1);
+    pathStack.push(node);
+    const neighbors = adjacency.get(node);
+    if (neighbors) {
+      for (const neighbor of neighbors) {
+        const neighborState = state.get(neighbor) ?? 0;
+        if (neighborState === 1) {
+          const cycleStartIndex = pathStack.indexOf(neighbor);
+          if (cycleStartIndex >= 0) {
+            for (let i = cycleStartIndex; i < pathStack.length; i++) {
+              cycleNodeSet.add(pathStack[i]);
+            }
+          }
+        } else if (neighborState === 0) {
+          dfs(neighbor);
+        }
+      }
+    }
+    pathStack.pop();
+    state.set(node, 2);
+  }
+  for (const node of allNodes) {
+    if ((state.get(node) ?? 0) === 0) {
+      dfs(node);
+    }
+  }
+  return Array.from(cycleNodeSet);
+}
+function clusterByPathPrefix(urls) {
+  const clusters = /* @__PURE__ */ new Map();
+  for (const url of urls) {
+    let path2;
+    try {
+      path2 = new URL(url).pathname;
+    } catch {
+      path2 = url.split("?")[0];
+    }
+    const segments = path2.split("/").filter(Boolean);
+    const prefix = segments.length > 0 ? segments[0] : "/";
+    let group = clusters.get(prefix);
+    if (!group) {
+      group = [];
+      clusters.set(prefix, group);
+    }
+    group.push(url);
+  }
+  return clusters;
+}
+function buildFlowGraph(edges, entryUrl) {
+  const edgeKeys = /* @__PURE__ */ new Set();
+  const dedupedEdges = [];
+  for (const edge of edges) {
+    const key = `${edge.from}\0${edge.to}\0${edge.trigger}`;
+    if (!edgeKeys.has(key)) {
+      edgeKeys.add(key);
+      dedupedEdges.push(edge);
+    }
+  }
+  const urlSet = /* @__PURE__ */ new Set();
+  urlSet.add(entryUrl);
+  for (const edge of dedupedEdges) {
+    urlSet.add(edge.from);
+    urlSet.add(edge.to);
+  }
+  const inDegree = /* @__PURE__ */ new Map();
+  const outDegree = /* @__PURE__ */ new Map();
+  for (const url of urlSet) {
+    inDegree.set(url, 0);
+    outDegree.set(url, 0);
+  }
+  for (const edge of dedupedEdges) {
+    inDegree.set(edge.to, (inDegree.get(edge.to) ?? 0) + 1);
+    outDegree.set(edge.from, (outDegree.get(edge.from) ?? 0) + 1);
+  }
+  const cycleNodes = detectCycles(dedupedEdges);
+  const hasCycles = cycleNodes.length > 0;
+  const allUrls = Array.from(urlSet);
+  const clusters = clusterByPathPrefix(allUrls);
+  const urlToCluster = /* @__PURE__ */ new Map();
+  for (const [prefix, urls] of clusters) {
+    for (const url of urls) {
+      urlToCluster.set(url, prefix);
+    }
+  }
+  const nodes = allUrls.map((url) => ({
+    url,
+    label: urlToLabel(url),
+    isEntry: url === entryUrl,
+    isExit: (outDegree.get(url) ?? 0) === 0,
+    inDegree: inDegree.get(url) ?? 0,
+    outDegree: outDegree.get(url) ?? 0,
+    cluster: urlToCluster.get(url)
+  }));
+  return {
+    nodes,
+    edges: dedupedEdges,
+    entryUrl,
+    hasCycles,
+    cycleNodes,
+    clusters
+  };
+}
+function sanitizeMermaidLabel(label) {
+  return label.replace(/"/g, "#quot;").replace(/\[/g, "#lsqb;").replace(/\]/g, "#rsqb;").replace(/\(/g, "#lpar;").replace(/\)/g, "#rpar;").replace(/\{/g, "#lcub;").replace(/\}/g, "#rcub;").replace(/</g, "#lt;").replace(/>/g, "#gt;");
+}
+function nodeId(url, index) {
+  return `N${index}`;
+}
+function edgeStyle(trigger) {
+  switch (trigger) {
+    case "link":
+    case "click":
+    case "form-submit":
+      return "-->";
+    case "redirect":
+    case "meta-refresh":
+    case "js-redirect":
+      return "-.->";
+    case "pushState":
+    case "replaceState":
+    case "navigation-api":
+      return "-.->";
+    default:
+      return "-->";
+  }
+}
+function generateMermaidDefinition(graph, options) {
+  const maxNodes = options?.maxNodes ?? DEFAULT_MAX_NODES;
+  if (graph.nodes.length === 0) {
+    return "flowchart LR\n";
+  }
+  const urlIndex = /* @__PURE__ */ new Map();
+  graph.nodes.forEach((node, i) => {
+    urlIndex.set(node.url, i);
+  });
+  const lines = ["flowchart LR"];
+  const useSubgraphs = graph.nodes.length > maxNodes;
+  if (useSubgraphs) {
+    const clusterNodes = /* @__PURE__ */ new Map();
+    for (const node of graph.nodes) {
+      const cluster = node.cluster ?? "/";
+      let group = clusterNodes.get(cluster);
+      if (!group) {
+        group = [];
+        clusterNodes.set(cluster, group);
+      }
+      group.push(node);
+    }
+    for (const [cluster, nodes] of clusterNodes) {
+      const sanitizedCluster = sanitizeMermaidLabel(cluster);
+      lines.push(`  subgraph ${sanitizedCluster}`);
+      for (const node of nodes) {
+        const id = nodeId(node.url, urlIndex.get(node.url));
+        const label = sanitizeMermaidLabel(node.label);
+        if (node.isEntry) {
+          lines.push(`    ${id}(["${label}"])`);
+        } else if (node.isExit) {
+          lines.push(`    ${id}[/"${label}"/]`);
+        } else {
+          lines.push(`    ${id}["${label}"]`);
+        }
+      }
+      lines.push("  end");
+    }
+  } else {
+    for (const node of graph.nodes) {
+      const id = nodeId(node.url, urlIndex.get(node.url));
+      const label = sanitizeMermaidLabel(node.label);
+      if (node.isEntry) {
+        lines.push(`  ${id}(["${label}"])`);
+      } else if (node.isExit) {
+        lines.push(`  ${id}[/"${label}"/]`);
+      } else {
+        lines.push(`  ${id}["${label}"]`);
+      }
+    }
+  }
+  for (const edge of graph.edges) {
+    const fromIdx = urlIndex.get(edge.from);
+    const toIdx = urlIndex.get(edge.to);
+    if (fromIdx === void 0 || toIdx === void 0) continue;
+    const fromId = nodeId(edge.from, fromIdx);
+    const toId = nodeId(edge.to, toIdx);
+    const style = edgeStyle(edge.trigger);
+    const triggerLabel = edge.triggerText ? ` |${sanitizeMermaidLabel(edge.triggerText)}|` : "";
+    lines.push(`  ${fromId} ${style}${triggerLabel} ${toId}`);
+  }
+  return lines.join("\n") + "\n";
+}
+
+// src/report/openapi-output.ts
+import { writeFile, mkdir as mkdir2 } from "fs/promises";
+import { dirname } from "path";
+var STATUS_DESCRIPTIONS = {
+  200: "Success",
+  201: "Created",
+  204: "No Content",
+  400: "Bad Request",
+  401: "Unauthorized",
+  403: "Forbidden",
+  404: "Not Found",
+  500: "Internal Server Error"
+};
+function inferSchema(value, depth = 0) {
+  if (value === null || value === void 0) {
+    return { type: "string", nullable: true };
+  }
+  if (Array.isArray(value)) {
+    if (value.length === 0 || depth >= 2) {
+      return { type: "array", items: {} };
+    }
+    return { type: "array", items: inferSchema(value[0], depth + 1) };
+  }
+  if (typeof value === "object") {
+    if (depth >= 2) {
+      return { type: "object" };
+    }
+    const properties = {};
+    for (const [key, val] of Object.entries(value)) {
+      properties[key] = inferSchema(val, depth + 1);
+    }
+    return { type: "object", properties };
+  }
+  if (typeof value === "number") {
+    return Number.isInteger(value) ? { type: "integer" } : { type: "number" };
+  }
+  if (typeof value === "boolean") {
+    return { type: "boolean" };
+  }
+  return { type: "string" };
+}
+function toOpenApiPath(pattern) {
+  return pattern.replace(/:([a-zA-Z_][a-zA-Z0-9_]*)/g, "{$1}");
+}
+function extractPathParams(pattern) {
+  const params = [];
+  const re = /:([a-zA-Z_][a-zA-Z0-9_]*)/g;
+  let match;
+  while ((match = re.exec(pattern)) !== null) {
+    params.push(match[1]);
+  }
+  return params;
+}
+function generateOperationId(method, pattern) {
+  const segments = pattern.split("/").filter(Boolean).map((seg) => {
+    if (seg.startsWith(":")) {
+      const paramName = seg.slice(1);
+      return "By" + paramName.charAt(0).toUpperCase() + paramName.slice(1);
+    }
+    return seg.charAt(0).toUpperCase() + seg.slice(1);
+  });
+  return method.toLowerCase() + segments.join("");
+}
+function extractTag(pattern) {
+  const segments = pattern.split("/").filter(Boolean);
+  const prefixes = /* @__PURE__ */ new Set(["api", "v1", "v2", "v3", "v4", "rest"]);
+  for (const seg of segments) {
+    if (seg.startsWith(":")) continue;
+    if (prefixes.has(seg.toLowerCase())) continue;
+    return seg;
+  }
+  return void 0;
+}
+var BODY_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH"]);
+function generateOpenApiSpec(endpoints, options) {
+  if (!options.title) {
+    throw new Error("OpenAPI title is required");
+  }
+  if (!options.targetUrl) {
+    throw new Error("OpenAPI targetUrl is required");
+  }
+  const info = {
+    title: options.title,
+    version: options.version ?? "1.0.0"
+  };
+  if (options.description) {
+    info.description = options.description;
+  }
+  const serverUrl = options.targetUrl.replace(/\/+$/, "");
+  const paths = {};
+  for (const endpoint of endpoints) {
+    const openApiPath = toOpenApiPath(endpoint.pattern);
+    const methodKey = endpoint.method.toLowerCase();
+    if (!paths[openApiPath]) {
+      paths[openApiPath] = {};
+    }
+    const operation = buildOperation(endpoint);
+    paths[openApiPath][methodKey] = operation;
+  }
+  return {
+    openapi: "3.0.3",
+    info,
+    servers: [{ url: serverUrl }],
+    paths
+  };
+}
+function buildOperation(endpoint) {
+  const operationId = generateOperationId(endpoint.method, endpoint.pattern);
+  const summary = `${endpoint.method} ${endpoint.pattern}`;
+  const operation = {
+    summary,
+    operationId,
+    responses: {}
+  };
+  const paramNames = extractPathParams(endpoint.pattern);
+  if (paramNames.length > 0) {
+    operation.parameters = paramNames.map((name) => ({
+      name,
+      in: "path",
+      required: true,
+      schema: { type: "string" }
+    }));
+  }
+  const tag = extractTag(endpoint.pattern);
+  if (tag) {
+    operation.tags = [tag];
+  }
+  if (BODY_METHODS.has(endpoint.method.toUpperCase()) && endpoint.exampleRequest.body) {
+    const contentType = endpoint.exampleRequest.contentType ?? "application/json";
+    let parsed;
+    try {
+      parsed = JSON.parse(endpoint.exampleRequest.body);
+    } catch {
+      parsed = endpoint.exampleRequest.body;
+    }
+    operation.requestBody = {
+      content: {
+        [contentType]: {
+          schema: inferSchema(parsed),
+          example: parsed
+        }
+      }
+    };
+  }
+  for (const statusCode of endpoint.observedStatusCodes) {
+    const description = STATUS_DESCRIPTIONS[statusCode] ?? "Response";
+    const responseEntry = {
+      description
+    };
+    if (statusCode === endpoint.exampleResponse.statusCode && endpoint.exampleResponse.body) {
+      const contentType = endpoint.exampleResponse.contentType ?? "application/json";
+      let parsed;
+      try {
+        parsed = JSON.parse(endpoint.exampleResponse.body);
+      } catch {
+        parsed = endpoint.exampleResponse.body;
+      }
+      responseEntry.content = {
+        [contentType]: {
+          schema: inferSchema(parsed),
+          example: parsed
+        }
+      };
+    }
+    operation.responses[String(statusCode)] = responseEntry;
+  }
+  if (endpoint.observedStatusCodes.length === 0) {
+    operation.responses["200"] = { description: "Success" };
+  }
+  return operation;
+}
+async function writeOpenApiSpec(spec, outputPath) {
+  if (!outputPath) {
+    throw new Error("Output path is required");
+  }
+  await mkdir2(dirname(outputPath), { recursive: true });
+  const json = JSON.stringify(spec, null, 2) + "\n";
+  await writeFile(outputPath, json, "utf-8");
+}
+
+// src/report/html/escape.ts
+function escapeHtml(input) {
+  const stripped = input.replace(/\0/g, "");
+  return stripped.replace(/[&<>"']/g, (char) => {
+    switch (char) {
+      case "&":
+        return "&amp;";
+      case "<":
+        return "&lt;";
+      case ">":
+        return "&gt;";
+      case '"':
+        return "&quot;";
+      case "'":
+        return "&#039;";
+      default:
+        return char;
+    }
+  });
+}
+function escapeAttribute(input) {
+  const htmlEscaped = escapeHtml(input);
+  return htmlEscaped.replace(/\//g, "&#x2F;").replace(/`/g, "&#96;");
+}
+function escapeJsonInHtml(jsonString) {
+  return jsonString.replace(/<\//g, "<\\/").replace(/<!--/g, "<\\!--");
+}
+
+// src/report/html/template.ts
+var CSP_META = `<meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'unsafe-inline'; script-src 'unsafe-inline'; img-src data: blob:;">`;
+function generateCss() {
+  return `
+    :root {
+      --bg: #ffffff;
+      --bg-surface: #f8f9fa;
+      --bg-surface-hover: #f0f1f3;
+      --bg-nav: #1a1a2e;
+      --text: #1a1a2e;
+      --text-muted: #6c757d;
+      --text-nav: #ffffff;
+      --border: #dee2e6;
+      --border-light: #e9ecef;
+      --accent: #4361ee;
+      --accent-hover: #3a56d4;
+      --status-2xx: #198754;
+      --status-3xx: #0d6efd;
+      --status-4xx: #e67700;
+      --status-5xx: #dc3545;
+      --method-get: #198754;
+      --method-post: #0d6efd;
+      --method-put: #e67700;
+      --method-delete: #dc3545;
+      --method-patch: #cc8800;
+      --badge-bg: #e9ecef;
+      --shadow: 0 1px 3px rgba(0,0,0,0.08);
+      --radius: 6px;
+    }
+
+    @media (prefers-color-scheme: dark) {
+      :root {
+        --bg: #0d1117;
+        --bg-surface: #161b22;
+        --bg-surface-hover: #1c2129;
+        --bg-nav: #010409;
+        --text: #e6edf3;
+        --text-muted: #8b949e;
+        --text-nav: #e6edf3;
+        --border: #30363d;
+        --border-light: #21262d;
+        --accent: #58a6ff;
+        --accent-hover: #79b8ff;
+        --status-2xx: #3fb950;
+        --status-3xx: #58a6ff;
+        --status-4xx: #d29922;
+        --status-5xx: #f85149;
+        --method-get: #3fb950;
+        --method-post: #58a6ff;
+        --method-put: #d29922;
+        --method-delete: #f85149;
+        --method-patch: #e3b341;
+        --badge-bg: #21262d;
+        --shadow: 0 1px 3px rgba(0,0,0,0.3);
+      }
+    }
+
+    * { box-sizing: border-box; margin: 0; padding: 0; }
+
+    body {
+      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, Cantarell, sans-serif;
+      line-height: 1.6;
+      color: var(--text);
+      background: var(--bg);
+    }
+
+    /* Navigation */
+    .nav {
+      position: sticky;
+      top: 0;
+      z-index: 100;
+      background: var(--bg-nav);
+      color: var(--text-nav);
+      display: flex;
+      align-items: center;
+      gap: 0.25rem;
+      padding: 0 1.5rem;
+      box-shadow: var(--shadow);
+      flex-wrap: wrap;
+    }
+    .nav-brand {
+      font-weight: 700;
+      font-size: 0.95rem;
+      padding: 0.75rem 0.5rem 0.75rem 0;
+      margin-right: 1rem;
+      white-space: nowrap;
+    }
+    .nav a {
+      color: var(--text-nav);
+      text-decoration: none;
+      padding: 0.75rem 0.75rem;
+      font-size: 0.875rem;
+      opacity: 0.8;
+      transition: opacity 0.15s;
+    }
+    .nav a:hover, .nav a:focus { opacity: 1; }
+
+    /* Main */
+    .container {
+      max-width: 1200px;
+      margin: 0 auto;
+      padding: 1.5rem;
+    }
+
+    /* Stats bar */
+    .stats {
+      display: grid;
+      grid-template-columns: repeat(auto-fit, minmax(160px, 1fr));
+      gap: 1rem;
+      margin-bottom: 2rem;
+    }
+    .stat-card {
+      background: var(--bg-surface);
+      border: 1px solid var(--border-light);
+      border-radius: var(--radius);
+      padding: 1rem 1.25rem;
+    }
+    .stat-label {
+      font-size: 0.75rem;
+      text-transform: uppercase;
+      letter-spacing: 0.05em;
+      color: var(--text-muted);
+      margin-bottom: 0.25rem;
+    }
+    .stat-value {
+      font-size: 1.5rem;
+      font-weight: 700;
+    }
+    .stat-value a {
+      color: var(--accent);
+      text-decoration: none;
+    }
+
+    /* Search */
+    .search-bar {
+      margin-bottom: 1.5rem;
+    }
+    .search-bar input {
+      width: 100%;
+      max-width: 400px;
+      padding: 0.5rem 0.75rem;
+      border: 1px solid var(--border);
+      border-radius: var(--radius);
+      font-size: 0.875rem;
+      background: var(--bg);
+      color: var(--text);
+    }
+    .search-bar input:focus {
+      outline: 2px solid var(--accent);
+      outline-offset: -1px;
+    }
+
+    /* Sections */
+    .section {
+      margin-bottom: 2.5rem;
+    }
+    .section-title {
+      font-size: 1.25rem;
+      font-weight: 700;
+      margin-bottom: 1rem;
+      padding-bottom: 0.5rem;
+      border-bottom: 2px solid var(--border-light);
+    }
+
+    /* Details / Summary */
+    details {
+      margin: 0.75rem 0;
+      border: 1px solid var(--border-light);
+      border-radius: var(--radius);
+      overflow: hidden;
+    }
+    summary {
+      cursor: pointer;
+      font-weight: 600;
+      padding: 0.75rem 1rem;
+      background: var(--bg-surface);
+      user-select: none;
+    }
+    summary:hover { background: var(--bg-surface-hover); }
+    details > :not(summary) { padding: 0 1rem; }
+    details[open] > :not(summary) { padding: 0.75rem 1rem; }
+
+    /* Tables */
+    table {
+      width: 100%;
+      border-collapse: collapse;
+      font-size: 0.875rem;
+    }
+    th, td {
+      padding: 0.625rem 0.75rem;
+      text-align: left;
+      border-bottom: 1px solid var(--border-light);
+    }
+    th {
+      background: var(--bg-surface);
+      font-weight: 600;
+      font-size: 0.8rem;
+      text-transform: uppercase;
+      letter-spacing: 0.03em;
+      color: var(--text-muted);
+      position: sticky;
+      top: 0;
+    }
+    tbody tr:hover { background: var(--bg-surface-hover); }
+    tr[data-searchable] { transition: none; }
+
+    /* Badges */
+    .badge {
+      display: inline-block;
+      padding: 0.15rem 0.5rem;
+      border-radius: 3px;
+      font-size: 0.75rem;
+      font-weight: 600;
+      font-family: 'SF Mono', SFMono-Regular, Consolas, 'Liberation Mono', Menlo, monospace;
+    }
+    .badge-get { background: var(--method-get); color: #fff; }
+    .badge-post { background: var(--method-post); color: #fff; }
+    .badge-put { background: var(--method-put); color: #fff; }
+    .badge-delete { background: var(--method-delete); color: #fff; }
+    .badge-patch { background: var(--method-patch); color: #fff; }
+    .badge-default { background: var(--badge-bg); color: var(--text); }
+    .badge-field {
+      background: var(--badge-bg);
+      color: var(--text);
+      margin: 0.1rem;
+    }
+    .badge-required {
+      background: var(--status-5xx);
+      color: #fff;
+    }
+
+    /* Status colors */
+    .status-2xx { color: var(--status-2xx); font-weight: 600; }
+    .status-3xx { color: var(--status-3xx); font-weight: 600; }
+    .status-4xx { color: var(--status-4xx); font-weight: 600; }
+    .status-5xx { color: var(--status-5xx); font-weight: 600; }
+
+    /* Sitemap tree */
+    .sitemap-tree { list-style: none; padding-left: 0; }
+    .sitemap-tree ul { list-style: none; padding-left: 1.25rem; }
+    .sitemap-tree li { padding: 0.2rem 0; }
+    .sitemap-tree .tree-label {
+      font-family: 'SF Mono', SFMono-Regular, Consolas, 'Liberation Mono', Menlo, monospace;
+      font-size: 0.85rem;
+    }
+    .sitemap-tree .tree-title {
+      color: var(--text-muted);
+      font-size: 0.8rem;
+      margin-left: 0.5rem;
+    }
+
+    /* Screenshots grid */
+    .screenshot-grid {
+      display: grid;
+      grid-template-columns: repeat(auto-fill, minmax(280px, 1fr));
+      gap: 1rem;
+    }
+    .screenshot-card {
+      border: 1px solid var(--border-light);
+      border-radius: var(--radius);
+      overflow: hidden;
+      cursor: pointer;
+      transition: box-shadow 0.15s;
+    }
+    .screenshot-card:hover {
+      box-shadow: 0 4px 12px rgba(0,0,0,0.12);
+    }
+    .screenshot-card img {
+      width: 100%;
+      height: auto;
+      display: block;
+      background: var(--bg-surface);
+    }
+    .screenshot-label {
+      padding: 0.5rem 0.75rem;
+      font-size: 0.8rem;
+      color: var(--text-muted);
+      background: var(--bg-surface);
+      overflow: hidden;
+      text-overflow: ellipsis;
+      white-space: nowrap;
+    }
+
+    /* Dialog lightbox */
+    dialog {
+      border: none;
+      border-radius: var(--radius);
+      padding: 0;
+      max-width: 90vw;
+      max-height: 90vh;
+      background: var(--bg);
+      box-shadow: 0 8px 30px rgba(0,0,0,0.3);
+    }
+    dialog::backdrop {
+      background: rgba(0,0,0,0.6);
+    }
+    .dialog-content {
+      display: flex;
+      flex-direction: column;
+      align-items: center;
+      padding: 1rem;
+    }
+    .dialog-content img {
+      max-width: 100%;
+      max-height: 80vh;
+    }
+    .dialog-actions {
+      display: flex;
+      gap: 0.75rem;
+      margin-top: 0.75rem;
+      align-items: center;
+    }
+    .dialog-actions a, .dialog-actions button {
+      font-size: 0.85rem;
+      padding: 0.4rem 0.8rem;
+      border-radius: var(--radius);
+      cursor: pointer;
+    }
+    .dialog-actions button {
+      border: 1px solid var(--border);
+      background: var(--bg-surface);
+      color: var(--text);
+    }
+    .dialog-actions a {
+      background: var(--accent);
+      color: #fff;
+      text-decoration: none;
+    }
+
+    /* Flow diagram */
+    .flow-svg-container { overflow-x: auto; }
+    .flow-svg-container svg { max-width: 100%; height: auto; }
+
+    /* Examples sub-rows */
+    .examples-list {
+      list-style: none;
+      padding: 0;
+      margin: 0;
+    }
+    .examples-list li {
+      padding: 0.2rem 0;
+      font-size: 0.8rem;
+      font-family: 'SF Mono', SFMono-Regular, Consolas, 'Liberation Mono', Menlo, monospace;
+    }
+
+    /* Responsive */
+    @media (max-width: 768px) {
+      .nav { padding: 0 0.75rem; }
+      .nav a { padding: 0.5rem 0.5rem; font-size: 0.8rem; }
+      .container { padding: 1rem; }
+      .stats { grid-template-columns: repeat(2, 1fr); }
+      .screenshot-grid { grid-template-columns: repeat(auto-fill, minmax(200px, 1fr)); }
+      th, td { padding: 0.4rem 0.5rem; font-size: 0.8rem; }
+    }
+
+    /* Print */
+    @media print {
+      .nav { display: none; }
+      .search-bar { display: none; }
+      body { background: #fff; color: #000; }
+      .container { max-width: none; padding: 0; }
+      details { border: none; }
+      details[open] > summary { background: none; border-bottom: 1px solid #ccc; }
+      details { break-inside: avoid; }
+      details > * { display: block !important; }
+      details:not([open]) > :not(summary) { display: block !important; }
+      .screenshot-card { break-inside: avoid; }
+      dialog { display: none; }
+      table { font-size: 0.75rem; }
+      th { background: #f0f0f0 !important; }
+    }
+  `;
+}
+function generateJs(hasScreenshots) {
+  return `
+    (function() {
+      // Search filter
+      var searchInput = document.getElementById('report-search');
+      if (searchInput) {
+        searchInput.addEventListener('input', function(e) {
+          var term = e.target.value.toLowerCase();
+          var rows = document.querySelectorAll('tr[data-searchable]');
+          for (var i = 0; i < rows.length; i++) {
+            var text = rows[i].textContent.toLowerCase();
+            rows[i].style.display = term && text.indexOf(term) === -1 ? 'none' : '';
+          }
+          var items = document.querySelectorAll('li[data-searchable]');
+          for (var j = 0; j < items.length; j++) {
+            var itemText = items[j].textContent.toLowerCase();
+            items[j].style.display = term && itemText.indexOf(term) === -1 ? 'none' : '';
+          }
+        });
+      }
+      ${hasScreenshots ? `
+      // Screenshot lightbox
+      var dialog = document.getElementById('screenshot-dialog');
+      var dialogImg = document.getElementById('dialog-img');
+      var dialogLink = document.getElementById('dialog-link');
+      var cards = document.querySelectorAll('.screenshot-card');
+      for (var k = 0; k < cards.length; k++) {
+        cards[k].addEventListener('click', function() {
+          var src = this.getAttribute('data-full');
+          var thumb = this.querySelector('img');
+          if (dialogImg && thumb) dialogImg.src = thumb.src;
+          if (dialogLink) dialogLink.href = src;
+          if (dialog && dialog.showModal) dialog.showModal();
+        });
+      }
+      var closeBtn = document.getElementById('dialog-close');
+      if (closeBtn && dialog) {
+        closeBtn.addEventListener('click', function() { dialog.close(); });
+      }
+      if (dialog) {
+        dialog.addEventListener('click', function(e) {
+          if (e.target === dialog) dialog.close();
+        });
+      }
+      ` : ""}
+    })();
+  `;
+}
+function statusClass(status) {
+  if (status >= 200 && status < 300) return "status-2xx";
+  if (status >= 300 && status < 400) return "status-3xx";
+  if (status >= 400 && status < 500) return "status-4xx";
+  if (status >= 500) return "status-5xx";
+  return "";
+}
+function methodBadgeClass(method) {
+  const m = method.toUpperCase();
+  switch (m) {
+    case "GET":
+      return "badge badge-get";
+    case "POST":
+      return "badge badge-post";
+    case "PUT":
+      return "badge badge-put";
+    case "DELETE":
+      return "badge badge-delete";
+    case "PATCH":
+      return "badge badge-patch";
+    default:
+      return "badge badge-default";
+  }
+}
+function formatDuration(seconds) {
+  if (seconds < 60) return `${seconds.toFixed(1)}s`;
+  const mins = Math.floor(seconds / 60);
+  const secs = seconds % 60;
+  return `${mins}m ${secs.toFixed(0)}s`;
+}
+function buildTree(pages) {
+  const root = { segment: "", children: /* @__PURE__ */ new Map() };
+  for (const page of pages) {
+    let path2;
+    try {
+      const u = new URL(page.url);
+      path2 = u.pathname;
+    } catch {
+      path2 = page.url;
+    }
+    const segments = path2.split("/").filter(Boolean);
+    let current = root;
+    for (const seg of segments) {
+      if (!current.children.has(seg)) {
+        current.children.set(seg, { segment: seg, children: /* @__PURE__ */ new Map() });
+      }
+      current = current.children.get(seg);
+    }
+    current.page = page;
+    if (segments.length === 0) {
+      root.page = page;
+    }
+  }
+  return root;
+}
+function renderTree(node, depth = 0) {
+  const lines = [];
+  if (node.page) {
+    const page = node.page;
+    const label = node.segment || "/";
+    const statusCls = statusClass(page.status);
+    const titlePart = page.title ? ` <span class="tree-title">${escapeHtml(page.title)}</span>` : "";
+    lines.push(
+      `<li data-searchable><span class="tree-label">${escapeHtml(label)}</span> <span class="${statusCls}">${page.status}</span>${titlePart}</li>`
+    );
+  } else if (depth > 0) {
+    lines.push(`<li><span class="tree-label">${escapeHtml(node.segment)}/</span></li>`);
+  }
+  const sortedChildren = [...node.children.entries()].sort((a, b) => a[0].localeCompare(b[0]));
+  if (sortedChildren.length > 0) {
+    lines.push("<ul>");
+    for (const [, child] of sortedChildren) {
+      lines.push(renderTree(child, depth + 1));
+    }
+    lines.push("</ul>");
+  }
+  return lines.join("\n");
+}
+function renderNavigation(input) {
+  const hasScreenshots = input.screenshots && input.screenshots.length > 0;
+  const hasFlow = !!input.flowDiagramSvg;
+  const pages = input.pages ?? input.sitemap ?? [];
+  const links = [];
+  if (pages.length > 0) links.push('<a href="#sitemap">Sitemap</a>');
+  if (input.forms.length > 0) links.push('<a href="#forms">Forms</a>');
+  if (input.apiEndpoints.length > 0) links.push('<a href="#api">API</a>');
+  if (hasScreenshots) links.push('<a href="#screenshots">Screenshots</a>');
+  if (hasFlow) links.push('<a href="#flow">Flow</a>');
+  return `<nav class="nav" role="navigation" aria-label="Report sections">
+    <span class="nav-brand">Archaeologist</span>
+    ${links.join("\n    ")}
+  </nav>`;
+}
+function renderStatsBar(input) {
+  return `<div class="stats">
+    <div class="stat-card">
+      <div class="stat-label">Target</div>
+      <div class="stat-value"><a href="${escapeAttribute(input.targetUrl)}">${escapeHtml(truncateUrl(input.targetUrl))}</a></div>
+    </div>
+    <div class="stat-card">
+      <div class="stat-label">Crawl Date</div>
+      <div class="stat-value">${escapeHtml(input.crawlDate)}</div>
+    </div>
+    <div class="stat-card">
+      <div class="stat-label">Duration</div>
+      <div class="stat-value">${escapeHtml(formatDuration(input.duration))}</div>
+    </div>
+    <div class="stat-card">
+      <div class="stat-label">Pages Visited</div>
+      <div class="stat-value">${input.pagesVisited}</div>
+    </div>
+    <div class="stat-card">
+      <div class="stat-label">Errors</div>
+      <div class="stat-value">${input.errors}</div>
+    </div>
+  </div>`;
+}
+function truncateUrl(url) {
+  if (url.length <= 40) return url;
+  try {
+    const u = new URL(url);
+    return u.hostname + (u.pathname.length > 1 ? u.pathname : "");
+  } catch {
+    return url;
+  }
+}
+function renderSitemapSection(pages) {
+  if (pages.length === 0) return "";
+  const tree = buildTree(pages);
+  const treeHtml = renderTree(tree);
+  return `<div class="section" id="sitemap">
+    <h2 class="section-title">Sitemap (${pages.length} pages)</h2>
+    <details open>
+      <summary>Page Tree</summary>
+      <ul class="sitemap-tree">
+        ${treeHtml}
+      </ul>
+    </details>
+  </div>`;
+}
+function renderFormsSection(forms) {
+  if (forms.length === 0) return "";
+  const rows = forms.map((form) => {
+    const fieldsHtml = form.fields.map((f) => {
+      const reqClass = f.required ? "badge badge-required" : "badge badge-field";
+      return `<span class="${reqClass}">${escapeHtml(f.name)}: ${escapeHtml(f.type)}</span>`;
+    }).join(" ");
+    return `<tr data-searchable>
+      <td>${escapeHtml(form.url)}</td>
+      <td>${escapeHtml(form.action)}</td>
+      <td><span class="${methodBadgeClass(form.method)}">${escapeHtml(form.method.toUpperCase())}</span></td>
+      <td>${fieldsHtml}</td>
+    </tr>`;
+  }).join("\n");
+  return `<div class="section" id="forms">
+    <h2 class="section-title">Forms (${forms.length})</h2>
+    <table>
+      <thead><tr><th>Page URL</th><th>Action</th><th>Method</th><th>Fields</th></tr></thead>
+      <tbody>${rows}</tbody>
+    </table>
+  </div>`;
+}
+function renderApiSection(endpoints) {
+  if (endpoints.length === 0) return "";
+  const rows = endpoints.map((ep) => {
+    const pattern = ep.pattern ?? ep.url ?? "";
+    const examplesHtml = ep.examples && ep.examples.length > 0 ? `<details><summary>${ep.examples.length} example(s)</summary><ul class="examples-list">${ep.examples.map(
+      (ex) => `<li>${escapeHtml(ex.url)} <span class="${statusClass(ex.status)}">${ex.status}</span></li>`
+    ).join("")}</ul></details>` : ep.status != null ? `<span class="${statusClass(ep.status)}">${ep.status}</span>` : "";
+    return `<tr data-searchable>
+      <td><span class="${methodBadgeClass(ep.method)}">${escapeHtml(ep.method.toUpperCase())}</span></td>
+      <td>${escapeHtml(pattern)}</td>
+      <td>${examplesHtml}</td>
+    </tr>`;
+  }).join("\n");
+  return `<div class="section" id="api">
+    <h2 class="section-title">API Endpoints (${endpoints.length})</h2>
+    <table>
+      <thead><tr><th>Method</th><th>Pattern</th><th>Details</th></tr></thead>
+      <tbody>${rows}</tbody>
+    </table>
+  </div>`;
+}
+function renderScreenshotsSection(screenshots) {
+  if (screenshots.length === 0) return "";
+  const cards = screenshots.map((ss) => {
+    let label;
+    try {
+      const u = new URL(ss.url);
+      label = u.pathname || "/";
+    } catch {
+      label = ss.url;
+    }
+    return `<div class="screenshot-card" data-full="${escapeAttribute(ss.fullPath)}" data-searchable>
+      <img src="data:image/jpeg;base64,${escapeAttribute(ss.thumbnailBase64)}" alt="Screenshot of ${escapeAttribute(label)}" loading="lazy">
+      <div class="screenshot-label">${escapeHtml(label)}</div>
+    </div>`;
+  }).join("\n");
+  return `<div class="section" id="screenshots">
+    <h2 class="section-title">Screenshots (${screenshots.length})</h2>
+    <div class="screenshot-grid">
+      ${cards}
+    </div>
+  </div>
+
+  <dialog id="screenshot-dialog">
+    <div class="dialog-content">
+      <img id="dialog-img" src="" alt="Full screenshot">
+      <div class="dialog-actions">
+        <a id="dialog-link" href="" target="_blank" rel="noopener">Open Full Image</a>
+        <button id="dialog-close" type="button">Close</button>
+      </div>
+    </div>
+  </dialog>`;
+}
+function renderFlowSection(svgContent) {
+  return `<div class="section" id="flow">
+    <h2 class="section-title">Flow Diagram</h2>
+    <details open>
+      <summary>Navigation Flow</summary>
+      <div class="flow-svg-container">
+        ${svgContent}
+      </div>
+    </details>
+  </div>`;
+}
+function generateReportHtml(input) {
+  const pages = input.pages ?? input.sitemap ?? [];
+  const screenshots = input.screenshots ?? [];
+  const hasScreenshots = screenshots.length > 0;
+  const hasFlow = !!input.flowDiagramSvg;
+  const reportTitle = input.title ? escapeHtml(input.title) : `Archaeologist Report: ${escapeHtml(input.targetUrl)}`;
+  const reportData = {
+    targetUrl: input.targetUrl,
+    crawlDate: input.crawlDate,
+    duration: input.duration,
+    pagesVisited: input.pagesVisited,
+    errors: input.errors,
+    pageCount: pages.length,
+    formCount: input.forms.length,
+    apiEndpointCount: input.apiEndpoints.length,
+    screenshotCount: screenshots.length
+  };
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  ${CSP_META}
+  <title>${reportTitle}</title>
+  <style>${generateCss()}</style>
+</head>
+<body>
+  ${renderNavigation(input)}
+
+  <div class="container">
+    <h1>${reportTitle}</h1>
+
+    ${renderStatsBar(input)}
+
+    <div class="search-bar">
+      <input type="text" id="report-search" placeholder="Filter pages, forms, endpoints..." aria-label="Search report">
+    </div>
+
+    ${renderSitemapSection(pages)}
+    ${renderFormsSection(input.forms)}
+    ${renderApiSection(input.apiEndpoints)}
+    ${hasScreenshots ? renderScreenshotsSection(screenshots) : ""}
+    ${hasFlow ? renderFlowSection(input.flowDiagramSvg) : ""}
+  </div>
+
+  <script type="application/json" id="report-data">${escapeJsonInHtml(JSON.stringify(reportData))}</script>
+  <script>${generateJs(hasScreenshots)}</script>
+</body>
+</html>`;
+}
+
+// src/crawl/orchestrator.ts
+import * as fs from "fs/promises";
+import * as path from "path";
+import { chromium } from "playwright";
+
+// src/security/network-guard.ts
+import { lookup } from "dns/promises";
+var METADATA_HOSTNAMES = /* @__PURE__ */ new Set([
+  "metadata.google.internal",
+  "169.254.169.254",
+  "kubernetes.default.svc"
+]);
+var ALLOWED_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:"]);
+function parseOctet(s) {
+  if (s === "") return NaN;
+  if (/^0x/i.test(s)) {
+    return parseInt(s, 16);
+  }
+  if (s.length > 1 && s.startsWith("0") && /^\d+$/.test(s)) {
+    return parseInt(s, 8);
+  }
+  const n = Number(s);
+  return Number.isInteger(n) ? n : NaN;
+}
+function parseIpv4ToNumber(ip) {
+  if (/^(0x[\da-fA-F]+|\d+)$/.test(ip)) {
+    const n = ip.startsWith("0x") || ip.startsWith("0X") ? parseInt(ip, 16) : Number(ip);
+    if (Number.isFinite(n) && n >= 0 && n <= 4294967295) {
+      return n;
+    }
+    return null;
+  }
+  const parts = ip.split(".");
+  if (parts.length !== 4) return null;
+  let result = 0;
+  for (let i = 0; i < 4; i++) {
+    const octet = parseOctet(parts[i]);
+    if (isNaN(octet) || octet < 0 || octet > 255) return null;
+    result = result << 8 | octet;
+  }
+  return result >>> 0;
+}
+function isPrivateIpv4Number(num) {
+  if (num >>> 24 === 0) return true;
+  if (num >>> 24 === 10) return true;
+  if (num >>> 24 === 127) return true;
+  if (num >>> 24 === 172) {
+    const second = num >>> 16 & 255;
+    if (second >= 16 && second <= 31) return true;
+  }
+  if (num >>> 16 === (192 << 8 | 168)) return true;
+  if (num >>> 16 === (169 << 8 | 254)) return true;
+  return false;
+}
+function isPrivateIp(ip) {
+  if (!ip || typeof ip !== "string") return false;
+  const trimmed = ip.trim();
+  if (trimmed.includes(":")) {
+    return isPrivateIpv6(trimmed);
+  }
+  const num = parseIpv4ToNumber(trimmed);
+  if (num === null) return false;
+  return isPrivateIpv4Number(num);
+}
+function isPrivateIpv6(ip) {
+  let cleaned = ip.replace(/%.*$/, "");
+  const v4MappedMatch = cleaned.match(
+    /^(?:::ffff:|0{1,4}:0{1,4}:0{1,4}:0{1,4}:0{1,4}:ffff:)(\d+\.\d+\.\d+\.\d+)$/i
+  );
+  if (v4MappedMatch) {
+    return isPrivateIp(v4MappedMatch[1]);
+  }
+  const expanded = expandIpv6(cleaned);
+  if (!expanded) return false;
+  if (expanded === "0000:0000:0000:0000:0000:0000:0000:0001") return true;
+  if (expanded === "0000:0000:0000:0000:0000:0000:0000:0000") return true;
+  const firstGroup = parseInt(expanded.substring(0, 4), 16);
+  if ((firstGroup & 65024) === 64512) return true;
+  if ((firstGroup & 65472) === 65152) return true;
+  return false;
+}
+function expandIpv6(ip) {
+  let addr = ip.replace(/^\[|\]$/g, "");
+  const lastColon = addr.lastIndexOf(":");
+  const possibleV4 = addr.substring(lastColon + 1);
+  if (possibleV4.includes(".")) {
+    const num = parseIpv4ToNumber(possibleV4);
+    if (num === null) return null;
+    const hi = num >>> 16 & 65535;
+    const lo = num & 65535;
+    addr = addr.substring(0, lastColon + 1) + hi.toString(16).padStart(4, "0") + ":" + lo.toString(16).padStart(4, "0");
+  }
+  const parts = addr.split("::");
+  if (parts.length > 2) return null;
+  if (parts.length === 2) {
+    const left = parts[0] ? parts[0].split(":") : [];
+    const right = parts[1] ? parts[1].split(":") : [];
+    const missing = 8 - left.length - right.length;
+    if (missing < 0) return null;
+    const mid = Array(missing).fill("0000");
+    const all = [...left, ...mid, ...right];
+    return all.map((g) => g.padStart(4, "0")).join(":");
+  }
+  const groups = addr.split(":");
+  if (groups.length !== 8) return null;
+  return groups.map((g) => g.padStart(4, "0")).join(":");
+}
+function isMetadataHostname(hostname) {
+  if (!hostname) return false;
+  const lower = hostname.toLowerCase().trim();
+  return METADATA_HOSTNAMES.has(lower);
+}
+function isAllowedProtocol(url) {
+  try {
+    const parsed = new URL(url);
+    return ALLOWED_PROTOCOLS.has(parsed.protocol);
+  } catch {
+    const lower = url.toLowerCase().trim();
+    if (lower.startsWith("http:") || lower.startsWith("https:")) return true;
+    return false;
+  }
+}
+function extractHostname(urlStr) {
+  try {
+    const parsed = new URL(urlStr);
+    return parsed.hostname;
+  } catch {
+    return "";
+  }
+}
+async function isBlockedUrl(url, options) {
+  const allowPrivate = options?.allowPrivate ?? false;
+  if (!isAllowedProtocol(url)) {
+    return { blocked: true, reason: "Blocked protocol \u2014 only http: and https: are allowed" };
+  }
+  let hostname;
+  try {
+    hostname = extractHostname(url);
+  } catch {
+    return { blocked: true, reason: "Failed to parse URL (fail-closed)" };
+  }
+  if (!hostname) {
+    return { blocked: true, reason: "Empty hostname (fail-closed)" };
+  }
+  let decodedHostname;
+  try {
+    decodedHostname = decodeURIComponent(hostname);
+  } catch {
+    return { blocked: true, reason: "Invalid hostname encoding (fail-closed)" };
+  }
+  if (isMetadataHostname(decodedHostname)) {
+    if (allowPrivate) return { blocked: false };
+    return { blocked: true, reason: "Blocked metadata hostname" };
+  }
+  const cleanedHost = decodedHostname.replace(/^\[|\]$/g, "");
+  if (isPrivateIp(cleanedHost)) {
+    if (allowPrivate) return { blocked: false };
+    return { blocked: true, reason: `Blocked private IP: ${cleanedHost}` };
+  }
+  const ipNum = parseIpv4ToNumber(cleanedHost);
+  if (ipNum !== null) {
+    if (isPrivateIpv4Number(ipNum)) {
+      if (allowPrivate) return { blocked: false };
+      return { blocked: true, reason: `Blocked private IP (encoded): ${cleanedHost}` };
+    }
+    return { blocked: false };
+  }
+  try {
+    const result = await lookup(decodedHostname, { all: true });
+    const addresses = Array.isArray(result) ? result : [result];
+    for (const entry of addresses) {
+      const addr = typeof entry === "string" ? entry : entry.address;
+      if (isPrivateIp(addr)) {
+        if (allowPrivate) return { blocked: false };
+        return { blocked: true, reason: `DNS resolved to private IP: ${addr}` };
+      }
+    }
+    return { blocked: false };
+  } catch {
+    return { blocked: true, reason: "DNS resolution failed (fail-closed)" };
+  }
+}
+
+// src/security/browser-hardening.ts
+var TOOL_VERSION = "0.1.0";
+var LAUNCH_OPTIONS = {
+  handleSIGINT: false,
+  handleSIGTERM: false,
+  handleSIGHUP: false,
+  args: [
+    "--disable-webrtc",
+    "--enforce-webrtc-ip-permission-check",
+    "--force-webrtc-ip-handling-policy=disable_non_proxied_udp"
+  ]
+};
+function getSecureContextOptions(opts) {
+  return {
+    bypassCSP: true,
+    acceptDownloads: false,
+    javaScriptEnabled: true,
+    ignoreHTTPSErrors: false,
+    serviceWorkers: "block",
+    permissions: [],
+    viewport: opts?.viewport ?? { width: 1280, height: 720 },
+    ...opts?.userAgent && { userAgent: opts.userAgent },
+    ...opts?.storageState && { storageState: opts.storageState },
+    ...opts?.recordHar && { recordHar: opts.recordHar }
+  };
+}
+function getSecureLaunchOptions() {
+  return { ...LAUNCH_OPTIONS };
+}
+
+// src/crawl/orchestrator.ts
+var INIT_SCRIPT = `
+(() => {
+  // DOM stability detection \u2014 sets window.__pa_isDomStable when no mutations
+  // have occurred for 500ms.
+  let _paStableTimer = null;
+  let _paIsStable = false;
+
+  window.__pa_isDomStable = () => _paIsStable;
+
+  const observer = new MutationObserver(() => {
+    _paIsStable = false;
+    if (_paStableTimer) clearTimeout(_paStableTimer);
+    _paStableTimer = setTimeout(() => { _paIsStable = true; }, 500);
+  });
+
+  // Start observing once the DOM is ready.
+  if (document.documentElement) {
+    observer.observe(document.documentElement, {
+      childList: true,
+      subtree: true,
+      attributes: true,
+    });
+  } else {
+    document.addEventListener('DOMContentLoaded', () => {
+      observer.observe(document.documentElement, {
+        childList: true,
+        subtree: true,
+        attributes: true,
+      });
+    });
+  }
+
+  // Mark stable initially after a short delay (for static pages).
+  _paStableTimer = setTimeout(() => { _paIsStable = true; }, 500);
+})();
+`;
+function sleep(ms) {
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
+}
+async function visitPage(page, entry, config) {
+  try {
+    const response = await page.goto(entry.url, {
+      waitUntil: "load",
+      timeout: config.timeout
+    });
+    if (!response) {
+      return { status: "no_response", url: entry.url, finalUrl: entry.url };
+    }
+    const finalUrl = response.url();
+    const httpStatus = response.status();
+    if (httpStatus >= 400) {
+      return {
+        status: "http_error",
+        url: entry.url,
+        finalUrl,
+        httpStatus,
+        response
+      };
+    }
+    await page.waitForFunction("window.__pa_isDomStable && window.__pa_isDomStable()", {
+      timeout: 5e3
+    }).catch(() => {
+      logger.debug(`DOM stability timeout on ${entry.url} \u2014 proceeding anyway`);
+    });
+    return {
+      status: "ok",
+      url: entry.url,
+      finalUrl,
+      httpStatus,
+      response
+    };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (message.includes("net::ERR_")) {
+      return {
+        status: "network_error",
+        url: entry.url,
+        finalUrl: entry.url,
+        error: message
+      };
+    }
+    if (message.includes("Timeout") || message.includes("timeout")) {
+      return {
+        status: "timeout",
+        url: entry.url,
+        finalUrl: entry.url,
+        error: message
+      };
+    }
+    return {
+      status: "network_error",
+      url: entry.url,
+      finalUrl: entry.url,
+      error: message
+    };
+  }
+}
+async function scanPage(page, targetUrl) {
+  try {
+    const mod = await import("./page-scanner-Q76HROEW.js");
+    if (typeof mod.scanPage === "function") {
+      return await mod.scanPage(page, targetUrl);
+    }
+  } catch {
+  }
+  return inlineScanPage(page);
+}
+async function inlineScanPage(page) {
+  const url = page.url();
+  const data = await page.evaluate(() => {
+    const title = document.title || "";
+    const anchors = Array.from(document.querySelectorAll("a[href]"));
+    const links = anchors.map((a) => {
+      const el = a;
+      const href = el.href;
+      if (!href || href.startsWith("javascript:") || href.startsWith("mailto:")) {
+        return null;
+      }
+      return {
+        href,
+        text: (el.textContent || "").trim().slice(0, 200),
+        isExternal: el.origin !== window.location.origin,
+        rel: el.rel || void 0
+      };
+    }).filter(Boolean);
+    const headings = Array.from(document.querySelectorAll("h1, h2, h3, h4, h5, h6")).map((h) => ({
+      level: parseInt(h.tagName[1], 10),
+      text: (h.textContent || "").trim().slice(0, 500)
+    }));
+    const metaTags = Array.from(document.querySelectorAll("meta[name], meta[property]")).map((m) => {
+      const el = m;
+      return {
+        name: el.name || void 0,
+        property: el.getAttribute("property") || void 0,
+        content: el.content || ""
+      };
+    });
+    const landmarkRoles = ["banner", "navigation", "main", "complementary", "contentinfo", "search", "form", "region"];
+    const landmarks = Array.from(document.querySelectorAll("[role]")).filter((el) => landmarkRoles.includes((el.getAttribute("role") || "").toLowerCase())).map((el) => ({
+      role: el.getAttribute("role"),
+      tagName: el.tagName.toLowerCase(),
+      label: el.getAttribute("aria-label") || void 0
+    }));
+    const textContent = (document.body?.innerText || "").slice(0, 1e4);
+    let hash = 0;
+    for (let i = 0; i < textContent.length; i++) {
+      const char = textContent.charCodeAt(i);
+      hash = (hash << 5) - hash + char | 0;
+    }
+    const contentHash = Math.abs(hash).toString(16).padStart(8, "0");
+    const perfEntry = performance.getEntriesByType("navigation")[0];
+    const timing = {
+      loadTime: perfEntry ? Math.round(perfEntry.loadEventEnd - perfEntry.startTime) : 0,
+      domContentLoaded: perfEntry ? Math.round(perfEntry.domContentLoadedEventEnd - perfEntry.startTime) : 0,
+      firstContentfulPaint: void 0
+    };
+    const fcp = performance.getEntriesByName("first-contentful-paint")[0];
+    if (fcp) {
+      timing.firstContentfulPaint = Math.round(fcp.startTime);
+    }
+    const hashRoutingDetected = window.location.hash.startsWith("#/") || window.location.hash.startsWith("#!/");
+    return {
+      title,
+      links,
+      headings,
+      metaTags,
+      landmarks,
+      contentHash,
+      timing,
+      hashRoutingDetected
+    };
+  });
+  return {
+    url,
+    statusCode: 200,
+    title: data.title,
+    metaTags: data.metaTags,
+    headings: data.headings,
+    landmarks: data.landmarks,
+    links: data.links,
+    interactiveElements: [],
+    timing: data.timing,
+    contentHash: data.contentHash,
+    hashRoutingDetected: data.hashRoutingDetected
+  };
+}
+function buildRouteTree(pages, targetUrl) {
+  const root = {
+    segment: "/",
+    url: targetUrl,
+    title: "",
+    statusCode: 0,
+    contentHash: "",
+    headings: [],
+    landmarks: [],
+    depth: 0,
+    children: [],
+    formCount: 0,
+    apiCallCount: 0,
+    hasScreenshot: false
+  };
+  for (const page of pages) {
+    if (page.url === targetUrl && page.pageScan) {
+      root.title = page.pageScan.title;
+      root.statusCode = page.pageScan.statusCode;
+      root.contentHash = page.pageScan.contentHash;
+      root.headings = page.pageScan.headings;
+      root.landmarks = page.pageScan.landmarks;
+      root.hasScreenshot = !!page.screenshot;
+      continue;
+    }
+    let segment;
+    try {
+      const parsed = new URL(page.url);
+      segment = parsed.pathname.split("/").filter(Boolean).pop() || parsed.pathname;
+    } catch {
+      segment = page.url;
+    }
+    const node = {
+      segment,
+      url: page.url,
+      title: page.pageScan?.title || "",
+      statusCode: page.pageScan?.statusCode || page.httpStatus || 0,
+      contentHash: page.pageScan?.contentHash || "",
+      headings: page.pageScan?.headings || [],
+      landmarks: page.pageScan?.landmarks || [],
+      depth: page.depth,
+      children: [],
+      formCount: 0,
+      apiCallCount: 0,
+      hasScreenshot: !!page.screenshot
+    };
+    root.children.push(node);
+  }
+  return root;
+}
+function pagesToRouteInfos(pages) {
+  return pages.filter((p) => p.status === "ok").map((p) => ({
+    url: p.url,
+    title: p.pageScan?.title || "",
+    statusCode: p.pageScan?.statusCode || p.httpStatus || 0,
+    contentHash: p.pageScan?.contentHash || "",
+    depth: p.depth,
+    formCount: 0,
+    apiCallCount: 0,
+    hasScreenshot: !!p.screenshot,
+    discoveryMethod: p.discoveryMethod
+  }));
+}
+function buildApiEndpointGroupsFromPages(pages) {
+  const groupMap = /* @__PURE__ */ new Map();
+  for (const page of pages) {
+    if (!page.networkLog) continue;
+    const log = page.networkLog;
+    for (const req of log.requests) {
+      if (req.classification !== "api") continue;
+      let urlPath;
+      try {
+        urlPath = new URL(req.url).pathname;
+      } catch {
+        urlPath = req.url;
+      }
+      const pattern = parameterizePath(urlPath);
+      const key = `${req.method} ${pattern}`;
+      let group = groupMap.get(key);
+      if (!group) {
+        group = {
+          pattern,
+          method: req.method,
+          urls: [],
+          callingPages: /* @__PURE__ */ new Set(),
+          statusCodes: /* @__PURE__ */ new Set(),
+          contentTypes: /* @__PURE__ */ new Set(),
+          isGraphQL: req.url.includes("graphql"),
+          graphqlOps: /* @__PURE__ */ new Set()
+        };
+        groupMap.set(key, group);
+      }
+      group.urls.push(req.url);
+      group.callingPages.add(page.url);
+      const resp = log.responses.find((r) => r.requestId === req.requestId);
+      if (resp) {
+        group.statusCodes.add(resp.statusCode);
+        if (resp.contentType) group.contentTypes.add(resp.contentType);
+      }
+      if (!group.firstRequest) {
+        group.firstRequest = {
+          url: req.url,
+          headers: req.headers,
+          body: req.body,
+          contentType: req.contentType
+        };
+      }
+      if (!group.firstResponse && resp) {
+        group.firstResponse = {
+          statusCode: resp.statusCode,
+          headers: resp.headers,
+          body: resp.body,
+          contentType: resp.contentType,
+          bodySize: resp.bodySize
+        };
+      }
+    }
+    for (const gqlOp of log.graphqlOperations) {
+      const key = `POST ${parameterizePath(new URL(gqlOp.endpointUrl).pathname)}`;
+      const group = groupMap.get(key);
+      if (group) {
+        group.isGraphQL = true;
+        group.graphqlOps.add(gqlOp.operationName);
+      }
+    }
+  }
+  const result = [];
+  for (const g of groupMap.values()) {
+    result.push({
+      pattern: g.pattern,
+      method: g.method,
+      classification: "api",
+      observedUrls: g.urls,
+      callCount: g.urls.length,
+      callingPages: Array.from(g.callingPages),
+      exampleRequest: g.firstRequest ?? {
+        url: g.urls[0] ?? "",
+        headers: {}
+      },
+      exampleResponse: g.firstResponse ?? {
+        statusCode: 0,
+        headers: {},
+        bodySize: 0
+      },
+      observedStatusCodes: Array.from(g.statusCodes),
+      observedContentTypes: Array.from(g.contentTypes),
+      isGraphQL: g.isGraphQL,
+      graphqlOperations: g.graphqlOps.size > 0 ? Array.from(g.graphqlOps) : void 0
+    });
+  }
+  return result;
+}
+function buildScreenshotManifest(pages, outputDir) {
+  return pages.filter((p) => p.screenshot && p.screenshot.fullPagePath).map((p) => {
+    const ss = p.screenshot;
+    const fullPageRel = path.relative(outputDir, ss.fullPagePath);
+    const viewportRel = path.relative(outputDir, ss.viewportPath);
+    return {
+      url: ss.pageUrl,
+      title: p.pageScan?.title || "",
+      fullPagePath: fullPageRel,
+      viewportPath: viewportRel,
+      viewport: ss.viewport,
+      dimensions: ss.dimensions,
+      fullPageHash: ss.fullPageHash,
+      thumbnailBase64: ""
+      // Thumbnail generation is a separate step (not in M1).
+    };
+  });
+}
+function buildAssembledArtifacts(crawlResult, pages) {
+  const routeTree = buildRouteTree(pages, crawlResult.config.targetUrl);
+  const routes = pagesToRouteInfos(pages);
+  const allForms = pages.filter((p) => p.formProbe).flatMap((p) => p.formProbe.forms);
+  const apiEndpoints = buildApiEndpointGroupsFromPages(pages);
+  const allGraphqlOps = pages.filter((p) => p.networkLog).flatMap((p) => p.networkLog.graphqlOperations);
+  const allWebSockets = pages.filter((p) => p.networkLog).flatMap((p) => p.networkLog.webSocketConnections);
+  const allEdges = pages.flatMap((p) => p.navigationEdges);
+  const flowGraph = allEdges.length > 0 ? buildFlowGraph(allEdges, crawlResult.config.targetUrl) : void 0;
+  const mermaidDef = flowGraph ? generateMermaidDefinition(flowGraph) : "";
+  const screenshots = buildScreenshotManifest(pages, crawlResult.config.targetUrl);
+  for (const node of [routeTree, ...routeTree.children]) {
+    const pageForNode = pages.find((p) => p.url === node.url);
+    if (pageForNode) {
+      node.formCount = pageForNode.formProbe?.forms.length ?? 0;
+      node.apiCallCount = pageForNode.networkLog?.requests.filter((r) => r.classification === "api").length ?? 0;
+      node.hasScreenshot = !!pageForNode.screenshot;
+    }
+  }
+  const enrichedRoutes = routes.map((r) => {
+    const pageForRoute = pages.find((p) => p.url === r.url);
+    return {
+      ...r,
+      formCount: pageForRoute?.formProbe?.forms.length ?? 0,
+      apiCallCount: pageForRoute?.networkLog?.requests.filter((req) => req.classification === "api").length ?? 0,
+      hasScreenshot: !!pageForRoute?.screenshot
+    };
+  });
+  return {
+    meta: {
+      toolVersion: TOOL_VERSION,
+      targetUrl: crawlResult.config.targetUrl,
+      crawlDate: crawlResult.startedAt,
+      duration: crawlResult.durationMs,
+      pagesVisited: pages.length,
+      pagesDiscovered: crawlResult.pages.length + crawlResult.unvisitedUrls.length,
+      formsFound: allForms.length,
+      apiEndpointsFound: apiEndpoints.length,
+      screenshotsTaken: screenshots.length,
+      errorCount: crawlResult.errors.length,
+      completionStatus: crawlResult.completionStatus,
+      viewport: crawlResult.config.viewport
+    },
+    routeTree,
+    routes: enrichedRoutes,
+    forms: allForms,
+    apiEndpoints,
+    graphqlOperations: allGraphqlOps,
+    webSocketConnections: allWebSockets,
+    flowGraph: flowGraph ? {
+      nodes: flowGraph.nodes.map((n) => ({
+        url: n.url,
+        title: pages.find((p) => p.url === n.url)?.pageScan?.title || "",
+        cluster: n.cluster ?? "/"
+      })),
+      edges: flowGraph.edges,
+      entryPoint: flowGraph.entryUrl,
+      deadEnds: flowGraph.nodes.filter((n) => n.isExit).map((n) => n.url),
+      cycles: flowGraph.cycleNodes.length > 0 ? [flowGraph.cycleNodes] : []
+    } : {
+      nodes: pages.filter((p) => p.status === "ok").map((p) => ({
+        url: p.url,
+        title: p.pageScan?.title || "",
+        cluster: "/"
+      })),
+      edges: [],
+      entryPoint: crawlResult.config.targetUrl,
+      deadEnds: [],
+      cycles: []
+    },
+    flowDiagrams: {
+      overview: { definition: mermaidDef },
+      sections: []
+    },
+    screenshots,
+    errors: crawlResult.errors
+  };
+}
+async function writeOutputFiles(outputDir, crawlResult, pages) {
+  const paths = {};
+  const sitemap = pages.filter((p) => p.status === "ok").map((p) => ({
+    url: p.url,
+    title: p.pageScan?.title || "",
+    depth: p.depth,
+    statusCode: p.httpStatus,
+    links: p.pageScan?.links.length ?? 0
+  }));
+  const sitemapPath = path.join(outputDir, "sitemap.json");
+  await fs.writeFile(sitemapPath, JSON.stringify(sitemap, null, 2), "utf-8");
+  paths.sitemapJson = sitemapPath;
+  const summary = {
+    targetUrl: crawlResult.config.targetUrl,
+    startedAt: crawlResult.startedAt,
+    finishedAt: crawlResult.finishedAt,
+    durationMs: crawlResult.durationMs,
+    pagesVisited: crawlResult.pages.length,
+    pagesDiscovered: crawlResult.pages.length + crawlResult.unvisitedUrls.length,
+    completionStatus: crawlResult.completionStatus,
+    errors: crawlResult.errors.length
+  };
+  const summaryPath = path.join(outputDir, "crawl-summary.json");
+  await fs.writeFile(summaryPath, JSON.stringify(summary, null, 2), "utf-8");
+  return paths;
+}
+async function ensureOutputDir(outputDir) {
+  await fs.mkdir(outputDir, { recursive: true });
+}
+async function checkBrowserInstallation() {
+  let browser;
+  try {
+    browser = await chromium.launch({ handleSIGINT: false, handleSIGTERM: false, handleSIGHUP: false });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    throw new Error(
+      `Chromium browser not found. Run \`pa install\` to install it.
+
+Details: ${message}`
+    );
+  } finally {
+    if (browser) {
+      await browser.close();
+    }
+  }
+}
+async function dig(config) {
+  const startedAt = /* @__PURE__ */ new Date();
+  const errors = [];
+  const pages = [];
+  let completionStatus = "complete";
+  let interrupted = false;
+  let browser;
+  let context;
+  const sigintHandler = () => {
+    logger.warn("SIGINT received \u2014 shutting down gracefully...");
+    interrupted = true;
+    completionStatus = "interrupted";
+  };
+  process.on("SIGINT", sigintHandler);
+  try {
+    logger.info(`Crawling ${config.targetUrl}...`);
+    logger.info(`  depth=${config.depth}, maxPages=${config.maxPages}, concurrency=${config.concurrency}`);
+    logger.info(`  viewport=${config.viewport.width}x${config.viewport.height}`);
+    logger.info(`  output=${config.outputDir}, format=${config.format}`);
+    await ensureOutputDir(config.outputDir);
+    await checkBrowserInstallation();
+    browser = await chromium.launch(getSecureLaunchOptions());
+    logger.debug("Browser launched");
+    const contextOptions = getSecureContextOptions({
+      viewport: config.viewport,
+      recordHar: config.noHar ? void 0 : {
+        path: path.join(config.outputDir, "crawl.har"),
+        content: "embed",
+        mode: "minimal"
+      }
+    });
+    context = await browser.newContext(contextOptions);
+    await context.addInitScript(INIT_SCRIPT);
+    const frontier = new Frontier({ maxDepth: config.depth });
+    logger.debug("Browser context created with secure defaults");
+    frontier.enqueue({ url: config.targetUrl, depth: 0 });
+    logger.debug(`Frontier initialized with entry URL: ${config.targetUrl}`);
+    let visitedCount = 0;
+    const crawlStartTime = Date.now();
+    while (!frontier.isEmpty && visitedCount < config.maxPages && !interrupted) {
+      if (config.maxTime > 0) {
+        const elapsed = (Date.now() - crawlStartTime) / 1e3;
+        if (elapsed >= config.maxTime) {
+          logger.warn(`Max crawl time reached (${config.maxTime}s) \u2014 stopping`);
+          completionStatus = "max_time_reached";
+          break;
+        }
+      }
+      const entry = frontier.dequeue();
+      if (!entry) break;
+      if (!config.allowPrivate) {
+        const blockResult = await isBlockedUrl(entry.url);
+        if (blockResult.blocked) {
+          logger.warn(`SSRF blocked: ${entry.url} \u2014 ${blockResult.reason}`);
+          errors.push({
+            timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+            url: entry.url,
+            code: "ERR_SECURITY_BLOCK",
+            message: blockResult.reason || "Blocked by SSRF protection",
+            securityReason: "private_ip"
+          });
+          continue;
+        }
+      }
+      const page = await context.newPage();
+      const pageStartTime = Date.now();
+      page.on("popup", async (popup) => {
+        try {
+          const popupUrl = popup.url();
+          if (popupUrl && popupUrl !== "about:blank") {
+            logger.debug(`Popup detected: ${popupUrl}`);
+            if (shouldCrawl(popupUrl, config.targetUrl, {
+              include: config.include,
+              exclude: config.exclude,
+              followExternal: config.followExternal
+            })) {
+              frontier.enqueue({ url: popupUrl, depth: entry.depth + 1 });
+            }
+          }
+          await popup.close();
+        } catch {
+        }
+      });
+      const jsErrors = [];
+      page.on("pageerror", (err) => {
+        jsErrors.push(err.message);
+        logger.debug(`JS error on ${entry.url}: ${err.message}`);
+      });
+      page.on("dialog", async (dialog) => {
+        logger.debug(`Dialog on ${entry.url}: ${dialog.type()} "${dialog.message()}"`);
+        await dialog.dismiss();
+      });
+      const networkLogger = createNetworkLogger(page, entry.url, {
+        includeCookies: config.includeCookies
+      });
+      networkLogger.start();
+      const visitResult = await visitPage(page, entry, config);
+      visitedCount++;
+      const pageVisitResult = {
+        url: entry.url,
+        finalUrl: visitResult.finalUrl,
+        status: visitResult.status,
+        httpStatus: visitResult.httpStatus,
+        depth: entry.depth,
+        referrer: entry.referrer,
+        discoveryMethod: entry.referrer ? "link" : "entry",
+        visitedAt: new Date(pageStartTime).toISOString(),
+        durationMs: 0,
+        collectorErrors: [],
+        navigationEdges: []
+      };
+      if (visitResult.status === "ok") {
+        try {
+          const scanResult = await scanPage(page, config.targetUrl);
+          pageVisitResult.pageScan = scanResult;
+          pageVisitResult.httpStatus = scanResult.statusCode;
+          for (const link of scanResult.links) {
+            if (shouldCrawl(link.href, config.targetUrl, {
+              include: config.include,
+              exclude: config.exclude,
+              followExternal: config.followExternal
+            })) {
+              const enqueued = frontier.enqueue({
+                url: link.href,
+                depth: entry.depth + 1,
+                referrer: entry.url
+              });
+              if (enqueued) {
+                pageVisitResult.navigationEdges.push({
+                  from: entry.url,
+                  to: link.href,
+                  trigger: "link",
+                  triggerText: link.text || void 0
+                });
+              }
+            }
+          }
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          logger.warn(`Scanner error on ${entry.url}: ${message}`);
+          pageVisitResult.collectorErrors.push({
+            collector: "page-scanner",
+            message
+          });
+        }
+        if (!config.noScreenshots) {
+          try {
+            const screenshotsDir = path.join(config.outputDir, "screenshots");
+            const ssResult = await captureScreenshots(page, config.targetUrl, screenshotsDir, config.viewport);
+            pageVisitResult.screenshot = ssResult;
+          } catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            logger.warn(`Screenshot error on ${entry.url}: ${message}`);
+            pageVisitResult.collectorErrors.push({ collector: "screenshot-capturer", message });
+          }
+        }
+        try {
+          const formResult = await probeForms(page, entry.url);
+          pageVisitResult.formProbe = formResult;
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          logger.warn(`Form probe error on ${entry.url}: ${message}`);
+          pageVisitResult.collectorErrors.push({ collector: "form-prober", message });
+        }
+      } else {
+        const errorMessage = visitResult.error || `Navigation failed: ${visitResult.status}`;
+        errors.push({
+          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+          url: entry.url,
+          code: "ERR_NAVIGATION",
+          message: errorMessage,
+          status: visitResult.status === "timeout" ? "timeout" : "network_error",
+          httpStatus: visitResult.httpStatus
+        });
+      }
+      try {
+        const networkResult = networkLogger.stop();
+        pageVisitResult.networkLog = networkResult;
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        logger.warn(`Network log error on ${entry.url}: ${message}`);
+        pageVisitResult.collectorErrors.push({ collector: "network-logger", message });
+      }
+      pageVisitResult.durationMs = Date.now() - pageStartTime;
+      pages.push(pageVisitResult);
+      try {
+        await page.close();
+      } catch {
+      }
+      if (config.delay > 0 && !interrupted) {
+        await sleep(config.delay);
+      }
+      const statusIcon = visitResult.status === "ok" ? "OK" : visitResult.status.toUpperCase();
+      logger.info(
+        `[${visitedCount}/${frontier.totalSeen}] ${statusIcon} ${entry.url}${entry.depth > 0 ? ` (depth ${entry.depth})` : ""}`
+      );
+      if (visitResult.status !== "ok" && visitResult.error) {
+        logger.warn(`  Error: ${visitResult.error}`);
+      }
+    }
+    if (!interrupted && completionStatus === "complete") {
+      if (visitedCount >= config.maxPages && !frontier.isEmpty) {
+        completionStatus = "max_pages_reached";
+      }
+    }
+    logger.debug("Closing browser context...");
+    if (context) {
+      await context.close().catch((err) => {
+        const message = err instanceof Error ? err.message : String(err);
+        logger.warn(`Context close error (HAR may not be written): ${message}`);
+      });
+    }
+    logger.debug("Closing browser...");
+    if (browser) {
+      await browser.close().catch((err) => {
+        const message = err instanceof Error ? err.message : String(err);
+        logger.warn(`Browser close error: ${message}`);
+      });
+    }
+    context = void 0;
+    browser = void 0;
+    const finishedAt = /* @__PURE__ */ new Date();
+    const durationMs = finishedAt.getTime() - startedAt.getTime();
+    const unvisitedUrls = [];
+    while (!frontier.isEmpty) {
+      const remaining = frontier.dequeue();
+      if (remaining) unvisitedUrls.push(remaining.url);
+    }
+    const crawlResult = {
+      config: {
+        targetUrl: config.targetUrl,
+        depth: config.depth,
+        maxPages: config.maxPages,
+        concurrency: config.concurrency,
+        viewport: config.viewport,
+        followExternal: config.followExternal,
+        deepClick: config.deepClick
+      },
+      startedAt: startedAt.toISOString(),
+      finishedAt: finishedAt.toISOString(),
+      durationMs,
+      pages,
+      unvisitedUrls,
+      errors,
+      completionStatus
+    };
+    let outputPaths = {};
+    try {
+      outputPaths = await writeOutputFiles(config.outputDir, crawlResult, pages);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      logger.error(`Failed to write output files: ${message}`);
+    }
+    const artifacts = buildAssembledArtifacts(crawlResult, pages);
+    try {
+      if (artifacts.forms.length > 0) {
+        await fs.writeFile(
+          path.join(config.outputDir, "forms.json"),
+          JSON.stringify(artifacts.forms, null, 2),
+          "utf-8"
+        );
+        logger.info(`  Forms: ${artifacts.forms.length} found`);
+      }
+      if (artifacts.apiEndpoints.length > 0) {
+        await fs.writeFile(
+          path.join(config.outputDir, "api-map.json"),
+          JSON.stringify(artifacts.apiEndpoints, null, 2),
+          "utf-8"
+        );
+        logger.info(`  API endpoints: ${artifacts.apiEndpoints.length} groups`);
+      }
+      const allEdges = pages.flatMap((p) => p.navigationEdges);
+      if (allEdges.length > 0) {
+        const flowGraph = buildFlowGraph(allEdges, config.targetUrl);
+        const mermaidDef = generateMermaidDefinition(flowGraph);
+        await fs.writeFile(
+          path.join(config.outputDir, "flow-graph.mmd"),
+          mermaidDef,
+          "utf-8"
+        );
+        logger.info(`  Flow graph: ${flowGraph.nodes.length} nodes, ${flowGraph.edges.length} edges`);
+      }
+      if (artifacts.apiEndpoints.length > 0) {
+        try {
+          const spec = generateOpenApiSpec(artifacts.apiEndpoints, {
+            title: `API - ${config.targetUrl}`,
+            targetUrl: config.targetUrl
+          });
+          await writeOpenApiSpec(spec, path.join(config.outputDir, "openapi.json"));
+          logger.info("  OpenAPI spec written");
+        } catch (err) {
+          logger.warn(`OpenAPI generation failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+      }
+      try {
+        const reportInput = {
+          targetUrl: config.targetUrl,
+          crawlDate: new Date(crawlStartTime).toISOString(),
+          duration: (Date.now() - crawlStartTime) / 1e3,
+          pagesVisited: visitedCount,
+          errors: errors.length,
+          pages: pages.filter((p) => p.status === "ok").map((p) => ({
+            url: p.url,
+            title: p.pageScan?.title || "",
+            status: p.httpStatus || 0,
+            depth: p.depth,
+            contentHash: p.pageScan?.contentHash
+          })),
+          forms: artifacts.forms.map((f) => ({
+            url: f.action || "",
+            action: f.action,
+            method: f.method,
+            fields: f.fields.map((field) => ({
+              name: field.name,
+              type: field.type,
+              required: field.required
+            }))
+          })),
+          apiEndpoints: artifacts.apiEndpoints.map((g) => ({
+            pattern: g.pattern,
+            method: g.method,
+            examples: g.observedUrls.slice(0, 5).map((url) => ({
+              url,
+              status: g.exampleResponse.statusCode
+            }))
+          })),
+          // Mermaid-to-SVG rendering is a later feature; omit flow diagram from HTML for now.
+          flowDiagramSvg: void 0
+        };
+        const html = generateReportHtml(reportInput);
+        await fs.writeFile(path.join(config.outputDir, "report.html"), html, "utf-8");
+        logger.success(`HTML report: ${path.join(config.outputDir, "report.html")}`);
+      } catch (err) {
+        logger.warn(`Report generation failed: ${err instanceof Error ? err.message : String(err)}`);
+      }
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      logger.warn(`Additional output generation error: ${message}`);
+    }
+    logger.success(
+      `Crawl complete: ${pages.length} pages visited, ${frontier.totalSeen} URLs discovered, ${errors.length} errors`
+    );
+    logger.info(`  Duration: ${(durationMs / 1e3).toFixed(1)}s`);
+    logger.info(`  Status: ${completionStatus}`);
+    logger.info(`  Output: ${config.outputDir}`);
+    return {
+      artifacts,
+      outputPaths: {
+        outputDir: config.outputDir,
+        sitemapJson: outputPaths.sitemapJson,
+        harFile: config.noHar ? void 0 : path.join(config.outputDir, "crawl.har")
+      },
+      errors,
+      completionStatus
+    };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    logger.error(`Fatal crawl error: ${message}`);
+    errors.push({
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      url: config.targetUrl,
+      code: "ERR_FATAL",
+      message
+    });
+    const finishedAt = /* @__PURE__ */ new Date();
+    const durationMs = finishedAt.getTime() - startedAt.getTime();
+    try {
+      await ensureOutputDir(config.outputDir);
+      await writeOutputFiles(
+        config.outputDir,
+        {
+          config: {
+            targetUrl: config.targetUrl,
+            depth: config.depth,
+            maxPages: config.maxPages,
+            concurrency: config.concurrency,
+            viewport: config.viewport,
+            followExternal: config.followExternal,
+            deepClick: config.deepClick
+          },
+          startedAt: startedAt.toISOString(),
+          finishedAt: finishedAt.toISOString(),
+          durationMs,
+          pages,
+          unvisitedUrls: [],
+          errors,
+          completionStatus: "error"
+        },
+        pages
+      );
+    } catch {
+    }
+    const artifacts = buildAssembledArtifacts(
+      {
+        config: {
+          targetUrl: config.targetUrl,
+          depth: config.depth,
+          maxPages: config.maxPages,
+          concurrency: config.concurrency,
+          viewport: config.viewport,
+          followExternal: config.followExternal,
+          deepClick: config.deepClick
+        },
+        startedAt: startedAt.toISOString(),
+        finishedAt: finishedAt.toISOString(),
+        durationMs,
+        pages,
+        unvisitedUrls: [],
+        errors,
+        completionStatus: "error"
+      },
+      pages
+    );
+    return {
+      artifacts,
+      outputPaths: { outputDir: config.outputDir },
+      errors,
+      completionStatus: "error"
+    };
+  } finally {
+    process.removeListener("SIGINT", sigintHandler);
+    if (context) {
+      await context.close().catch(() => {
+      });
+    }
+    if (browser) {
+      await browser.close().catch(() => {
+      });
+    }
+  }
+}
+
+// src/diff/diff-engine.ts
+import { readFile as readFile2 } from "fs/promises";
+import { join as join3 } from "path";
+async function loadJson(filePath) {
+  try {
+    const content = await readFile2(filePath, "utf-8");
+    return JSON.parse(content);
+  } catch {
+    return null;
+  }
+}
+async function loadManifest(bundleDir) {
+  const manifestPath = join3(bundleDir, "manifest.json");
+  const manifest = await loadJson(manifestPath);
+  if (!manifest) {
+    throw new DiffError(
+      "manifest_invalid",
+      `Could not load manifest.json from bundle: ${bundleDir}`
+    );
+  }
+  if (manifest.version !== 1) {
+    throw new DiffError(
+      "manifest_invalid",
+      `Unsupported manifest version ${manifest.version} in: ${bundleDir}`
+    );
+  }
+  return manifest;
+}
+function formKey(form) {
+  if (form.id) return `id:${form.id}`;
+  return `${form.action}:${form.method}`;
+}
+function apiKey(endpoint) {
+  return `${endpoint.method} ${endpoint.pattern}`;
+}
+function diffRoutes(oldRoutes, newRoutes) {
+  const oldByUrl = new Map(oldRoutes.map((r) => [r.url, r]));
+  const newByUrl = new Map(newRoutes.map((r) => [r.url, r]));
+  const added = [];
+  const removed = [];
+  const changed = [];
+  let unchangedCount = 0;
+  for (const [url, newRoute] of newByUrl) {
+    const oldRoute = oldByUrl.get(url);
+    if (!oldRoute) {
+      added.push(newRoute);
+      continue;
+    }
+    const changes = {};
+    let hasChanges = false;
+    if (oldRoute.title !== newRoute.title) {
+      changes.title = { old: oldRoute.title, new: newRoute.title };
+      hasChanges = true;
+    }
+    if (oldRoute.statusCode !== newRoute.statusCode) {
+      changes.statusCode = { old: oldRoute.statusCode, new: newRoute.statusCode };
+      hasChanges = true;
+    }
+    if (oldRoute.contentHash !== newRoute.contentHash) {
+      changes.contentHash = { old: oldRoute.contentHash, new: newRoute.contentHash };
+      hasChanges = true;
+    }
+    if (hasChanges) {
+      changed.push({ url, changes });
+    } else {
+      unchangedCount++;
+    }
+  }
+  for (const [url, oldRoute] of oldByUrl) {
+    if (!newByUrl.has(url)) {
+      removed.push(oldRoute);
+    }
+  }
+  return { added, removed, changed, unchangedCount };
+}
+function diffFields(oldFields, newFields) {
+  const oldByName = new Map(oldFields.map((f) => [f.name, f]));
+  const newByName = new Map(newFields.map((f) => [f.name, f]));
+  const fieldsAdded = [];
+  const fieldsRemoved = [];
+  const fieldsChanged = [];
+  for (const [name, newField] of newByName) {
+    const oldField = oldByName.get(name);
+    if (!oldField) {
+      fieldsAdded.push(newField);
+      continue;
+    }
+    const changes = {};
+    let hasChanges = false;
+    if (oldField.type !== newField.type) {
+      changes.type = { old: oldField.type, new: newField.type };
+      hasChanges = true;
+    }
+    if (oldField.required !== newField.required) {
+      changes.required = { old: oldField.required, new: newField.required };
+      hasChanges = true;
+    }
+    if (oldField.pattern !== newField.pattern) {
+      changes.validationPattern = {
+        old: oldField.pattern ?? "",
+        new: newField.pattern ?? ""
+      };
+      hasChanges = true;
+    }
+    if (oldField.placeholder !== newField.placeholder) {
+      changes.placeholder = {
+        old: oldField.placeholder ?? "",
+        new: newField.placeholder ?? ""
+      };
+      hasChanges = true;
+    }
+    if (oldField.options || newField.options) {
+      const oldValues = new Set((oldField.options ?? []).map((o) => o.value));
+      const newValues = new Set((newField.options ?? []).map((o) => o.value));
+      const optionsAdded = [...newValues].filter((v) => !oldValues.has(v));
+      const optionsRemoved = [...oldValues].filter((v) => !newValues.has(v));
+      if (optionsAdded.length > 0 || optionsRemoved.length > 0) {
+        changes.options = { added: optionsAdded, removed: optionsRemoved };
+        hasChanges = true;
+      }
+    }
+    if (hasChanges) {
+      fieldsChanged.push({ name, changes });
+    }
+  }
+  for (const [name, oldField] of oldByName) {
+    if (!newByName.has(name)) {
+      fieldsRemoved.push(oldField);
+    }
+  }
+  return { fieldsAdded, fieldsRemoved, fieldsChanged };
+}
+function diffForms(oldForms, newForms) {
+  const oldByKey = new Map(oldForms.map((f) => [formKey(f), f]));
+  const newByKey = new Map(newForms.map((f) => [formKey(f), f]));
+  const added = [];
+  const removed = [];
+  const changed = [];
+  let unchangedCount = 0;
+  for (const [key, newForm] of newByKey) {
+    const oldForm = oldByKey.get(key);
+    if (!oldForm) {
+      added.push(newForm);
+      continue;
+    }
+    const fieldDiff = diffFields(oldForm.fields, newForm.fields);
+    const changeEntry = {};
+    let hasChanges = false;
+    if (fieldDiff.fieldsAdded.length > 0) {
+      changeEntry.fieldsAdded = fieldDiff.fieldsAdded;
+      hasChanges = true;
+    }
+    if (fieldDiff.fieldsRemoved.length > 0) {
+      changeEntry.fieldsRemoved = fieldDiff.fieldsRemoved;
+      hasChanges = true;
+    }
+    if (fieldDiff.fieldsChanged.length > 0) {
+      changeEntry.fieldsChanged = fieldDiff.fieldsChanged;
+      hasChanges = true;
+    }
+    if (oldForm.action !== newForm.action) {
+      changeEntry.actionChanged = { old: oldForm.action, new: newForm.action };
+      hasChanges = true;
+    }
+    if (oldForm.method !== newForm.method) {
+      changeEntry.methodChanged = { old: oldForm.method, new: newForm.method };
+      hasChanges = true;
+    }
+    if (hasChanges) {
+      changed.push({
+        formId: key,
+        pageUrl: newForm.action,
+        // best available context
+        changes: changeEntry
+      });
+    } else {
+      unchangedCount++;
+    }
+  }
+  for (const [key, oldForm] of oldByKey) {
+    if (!newByKey.has(key)) {
+      removed.push(oldForm);
+    }
+  }
+  return { added, removed, changed, unchangedCount };
+}
+function diffApi(oldEndpoints, newEndpoints) {
+  const oldByKey = new Map(oldEndpoints.map((e) => [apiKey(e), e]));
+  const newByKey = new Map(newEndpoints.map((e) => [apiKey(e), e]));
+  const added = [];
+  const removed = [];
+  const changed = [];
+  let unchangedCount = 0;
+  for (const [key, newEp] of newByKey) {
+    const oldEp = oldByKey.get(key);
+    if (!oldEp) {
+      added.push(newEp);
+      continue;
+    }
+    const changes = {};
+    let hasChanges = false;
+    const oldStatuses = new Set(oldEp.observedStatusCodes);
+    const newStatuses = new Set(newEp.observedStatusCodes);
+    const statusCodesAdded = [...newStatuses].filter((s) => !oldStatuses.has(s));
+    const statusCodesRemoved = [...oldStatuses].filter((s) => !newStatuses.has(s));
+    if (statusCodesAdded.length > 0) {
+      changes.statusCodesAdded = statusCodesAdded;
+      hasChanges = true;
+    }
+    if (statusCodesRemoved.length > 0) {
+      changes.statusCodesRemoved = statusCodesRemoved;
+      hasChanges = true;
+    }
+    const oldContentTypes = oldEp.observedContentTypes;
+    const newContentTypes = newEp.observedContentTypes;
+    if (oldContentTypes.length > 0 && newContentTypes.length > 0 && oldContentTypes[0] !== newContentTypes[0]) {
+      changes.contentTypeChanged = {
+        old: oldContentTypes[0],
+        new: newContentTypes[0]
+      };
+      hasChanges = true;
+    }
+    const oldSize = oldEp.exampleResponse.bodySize;
+    const newSize = newEp.exampleResponse.bodySize;
+    if (oldSize > 0 && newSize > 0) {
+      const percentChange = Math.abs((newSize - oldSize) / oldSize * 100);
+      if (percentChange > 10) {
+        changes.bodySizeChange = {
+          old: oldSize,
+          new: newSize,
+          percentChange: Math.round(percentChange * 100) / 100
+        };
+        hasChanges = true;
+      }
+    }
+    if (hasChanges) {
+      changed.push({ endpointId: key, changes });
+    } else {
+      unchangedCount++;
+    }
+  }
+  for (const [key, oldEp] of oldByKey) {
+    if (!newByKey.has(key)) {
+      removed.push(oldEp);
+    }
+  }
+  return { added, removed, changed, unchangedCount };
+}
+function diffScreenshots(oldScreenshots, newScreenshots, oldDir, newDir) {
+  const oldByUrl = new Map(oldScreenshots.map((s) => [s.url, s]));
+  const newByUrl = new Map(newScreenshots.map((s) => [s.url, s]));
+  const added = [];
+  const removed = [];
+  const changed = [];
+  let unchangedCount = 0;
+  for (const [url, newSs] of newByUrl) {
+    const oldSs = oldByUrl.get(url);
+    if (!oldSs) {
+      added.push({ url, screenshotPath: join3(newDir, newSs.path) });
+      continue;
+    }
+    if (oldSs.sha256 !== newSs.sha256) {
+      changed.push({
+        url,
+        diffPercentage: 100,
+        diffPixelCount: 0,
+        // unknown without pixel analysis
+        totalPixels: 0,
+        // unknown without pixel analysis
+        diffImagePath: "",
+        // no diff image generated in hash-only mode
+        oldScreenshotPath: join3(oldDir, oldSs.path),
+        newScreenshotPath: join3(newDir, newSs.path)
+      });
+    } else {
+      unchangedCount++;
+    }
+  }
+  for (const [url] of oldByUrl) {
+    if (!newByUrl.has(url)) {
+      removed.push({ url });
+    }
+  }
+  return { added, removed, changed, unchangedCount };
+}
+async function loadScreenshotEntries(bundleDir, manifest) {
+  const screenshotManifest = await loadJson(join3(bundleDir, "data", "screenshot-manifest.json"));
+  if (screenshotManifest && Array.isArray(screenshotManifest)) {
+    return screenshotManifest.map((s) => ({
+      url: s.url,
+      sha256: s.fullPageHash,
+      path: s.fullPagePath
+    }));
+  }
+  return manifest.files.filter((f) => f.type === "screenshot").map((f) => ({
+    url: f.path,
+    // best available identifier
+    sha256: f.sha256,
+    path: f.path
+  }));
+}
+async function diffBundles(oldDir, newDir) {
+  const [oldManifest, newManifest] = await Promise.all([
+    loadManifest(oldDir),
+    loadManifest(newDir)
+  ]);
+  const [oldSitemap, newSitemap] = await Promise.all([
+    loadJson(join3(oldDir, "data", "sitemap.json")),
+    loadJson(join3(newDir, "data", "sitemap.json"))
+  ]);
+  const [oldForms, newForms] = await Promise.all([
+    loadJson(join3(oldDir, "data", "forms.json")),
+    loadJson(join3(newDir, "data", "forms.json"))
+  ]);
+  const [oldApiMap, newApiMap] = await Promise.all([
+    loadJson(join3(oldDir, "data", "api-map.json")),
+    loadJson(join3(newDir, "data", "api-map.json"))
+  ]);
+  const [oldScreenshotEntries, newScreenshotEntries] = await Promise.all([
+    loadScreenshotEntries(oldDir, oldManifest),
+    loadScreenshotEntries(newDir, newManifest)
+  ]);
+  const sitemap = diffRoutes(oldSitemap ?? [], newSitemap ?? []);
+  const forms = diffForms(oldForms ?? [], newForms ?? []);
+  const api = diffApi(oldApiMap ?? [], newApiMap ?? []);
+  const screenshots = diffScreenshots(
+    oldScreenshotEntries,
+    newScreenshotEntries,
+    oldDir,
+    newDir
+  );
+  const summary = {
+    routes: {
+      added: sitemap.added.length,
+      removed: sitemap.removed.length,
+      changed: sitemap.changed.length,
+      unchanged: sitemap.unchangedCount
+    },
+    forms: {
+      added: forms.added.length,
+      removed: forms.removed.length,
+      changed: forms.changed.length,
+      unchanged: forms.unchangedCount
+    },
+    api: {
+      added: api.added.length,
+      removed: api.removed.length,
+      changed: api.changed.length,
+      unchanged: api.unchangedCount
+    },
+    screenshots: {
+      added: screenshots.added.length,
+      removed: screenshots.removed.length,
+      changed: screenshots.changed.length,
+      unchanged: screenshots.unchangedCount
+    }
+  };
+  const hasChanges = summary.routes.added + summary.routes.removed + summary.routes.changed + summary.forms.added + summary.forms.removed + summary.forms.changed + summary.api.added + summary.api.removed + summary.api.changed + summary.screenshots.added + summary.screenshots.removed + summary.screenshots.changed > 0;
+  return {
+    meta: {
+      oldBundle: {
+        path: oldDir,
+        createdAt: oldManifest.createdAt,
+        targetUrl: oldManifest.config.targetUrl,
+        toolVersion: oldManifest.toolVersion
+      },
+      newBundle: {
+        path: newDir,
+        createdAt: newManifest.createdAt,
+        targetUrl: newManifest.config.targetUrl,
+        toolVersion: newManifest.toolVersion
+      },
+      comparedAt: (/* @__PURE__ */ new Date()).toISOString()
+    },
+    hasChanges,
+    sitemap,
+    forms,
+    api,
+    screenshots,
+    summary
+  };
+}
+
+// src/diff/diff-report.ts
+var CSP_META2 = `<meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'unsafe-inline'; script-src 'unsafe-inline'; img-src data: blob:;">`;
+var STYLES = `
+  * { margin: 0; padding: 0; box-sizing: border-box; }
+  body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; line-height: 1.6; color: #1a1a2e; background: #f8f9fa; padding: 2rem; max-width: 1200px; margin: 0 auto; }
+  h1 { font-size: 1.8rem; margin-bottom: 0.5rem; }
+  h2 { font-size: 1.4rem; margin: 2rem 0 1rem; border-bottom: 2px solid #e0e0e0; padding-bottom: 0.5rem; }
+  h3 { font-size: 1.1rem; margin: 1rem 0 0.5rem; }
+  .meta { color: #666; font-size: 0.9rem; margin-bottom: 2rem; }
+  .summary { display: grid; grid-template-columns: repeat(auto-fit, minmax(200px, 1fr)); gap: 1rem; margin-bottom: 2rem; }
+  .summary-card { background: #fff; border-radius: 8px; padding: 1rem; box-shadow: 0 1px 3px rgba(0,0,0,0.1); }
+  .summary-card h3 { margin: 0 0 0.5rem; font-size: 1rem; }
+  .summary-card .count { font-size: 2rem; font-weight: bold; }
+  .no-changes { background: #d4edda; color: #155724; padding: 1rem; border-radius: 8px; text-align: center; font-size: 1.2rem; }
+  .badge { display: inline-block; padding: 2px 8px; border-radius: 4px; font-size: 0.75rem; font-weight: 600; text-transform: uppercase; }
+  .badge-added { background: #d4edda; color: #155724; }
+  .badge-removed { background: #f8d7da; color: #721c24; }
+  .badge-changed { background: #fff3cd; color: #856404; }
+  .badge-unchanged { background: #e2e3e5; color: #383d41; }
+  table { width: 100%; border-collapse: collapse; margin: 1rem 0; background: #fff; border-radius: 8px; overflow: hidden; box-shadow: 0 1px 3px rgba(0,0,0,0.1); }
+  th, td { padding: 0.75rem 1rem; text-align: left; border-bottom: 1px solid #e0e0e0; }
+  th { background: #f1f3f5; font-weight: 600; font-size: 0.85rem; text-transform: uppercase; color: #495057; }
+  tr:last-child td { border-bottom: none; }
+  .change-detail { font-size: 0.85rem; color: #495057; }
+  .old-value { color: #721c24; text-decoration: line-through; }
+  .new-value { color: #155724; font-weight: 500; }
+  .section { margin-bottom: 2rem; }
+  .empty-section { color: #6c757d; font-style: italic; padding: 1rem; }
+  ul.change-list { list-style: none; padding: 0; }
+  ul.change-list li { padding: 0.5rem 0; border-bottom: 1px solid #f0f0f0; }
+  ul.change-list li:last-child { border-bottom: none; }
+`;
+function badge(type) {
+  return `<span class="badge badge-${type}">${type}</span>`;
+}
+function summaryCard(title, counts) {
+  const total = counts.added + counts.removed + counts.changed;
+  return `
+    <div class="summary-card">
+      <h3>${escapeHtml(title)}</h3>
+      <div class="count">${total}</div>
+      <div class="change-detail">
+        ${counts.added > 0 ? `${badge("added")} ${counts.added}` : ""}
+        ${counts.removed > 0 ? `${badge("removed")} ${counts.removed}` : ""}
+        ${counts.changed > 0 ? `${badge("changed")} ${counts.changed}` : ""}
+        ${counts.unchanged > 0 ? `${badge("unchanged")} ${counts.unchanged}` : ""}
+      </div>
+    </div>`;
+}
+function renderRoutesSection(diff) {
+  const { sitemap } = diff;
+  const hasContent = sitemap.added.length + sitemap.removed.length + sitemap.changed.length > 0;
+  if (!hasContent) {
+    return `
+      <div class="section">
+        <h2>Routes</h2>
+        <p class="empty-section">No route changes detected.</p>
+      </div>`;
+  }
+  let html = `<div class="section"><h2>Routes</h2>`;
+  if (sitemap.added.length > 0) {
+    html += `<h3>${badge("added")} Added Routes (${sitemap.added.length})</h3>`;
+    html += `<table><thead><tr><th>URL</th><th>Title</th><th>Status</th></tr></thead><tbody>`;
+    for (const route of sitemap.added) {
+      html += `<tr><td>${escapeHtml(route.url)}</td><td>${escapeHtml(route.title)}</td><td>${route.statusCode}</td></tr>`;
+    }
+    html += `</tbody></table>`;
+  }
+  if (sitemap.removed.length > 0) {
+    html += `<h3>${badge("removed")} Removed Routes (${sitemap.removed.length})</h3>`;
+    html += `<table><thead><tr><th>URL</th><th>Title</th><th>Status</th></tr></thead><tbody>`;
+    for (const route of sitemap.removed) {
+      html += `<tr><td>${escapeHtml(route.url)}</td><td>${escapeHtml(route.title)}</td><td>${route.statusCode}</td></tr>`;
+    }
+    html += `</tbody></table>`;
+  }
+  if (sitemap.changed.length > 0) {
+    html += `<h3>${badge("changed")} Modified Routes (${sitemap.changed.length})</h3>`;
+    html += `<table><thead><tr><th>URL</th><th>Changes</th></tr></thead><tbody>`;
+    for (const change of sitemap.changed) {
+      const changeDescs = [];
+      if (change.changes.title) {
+        changeDescs.push(
+          `Title: <span class="old-value">${escapeHtml(change.changes.title.old)}</span> &rarr; <span class="new-value">${escapeHtml(change.changes.title.new)}</span>`
+        );
+      }
+      if (change.changes.statusCode) {
+        changeDescs.push(
+          `Status: <span class="old-value">${change.changes.statusCode.old}</span> &rarr; <span class="new-value">${change.changes.statusCode.new}</span>`
+        );
+      }
+      if (change.changes.contentHash) {
+        changeDescs.push(`Content changed (hash differs)`);
+      }
+      html += `<tr><td>${escapeHtml(change.url)}</td><td class="change-detail">${changeDescs.join("<br>")}</td></tr>`;
+    }
+    html += `</tbody></table>`;
+  }
+  html += `</div>`;
+  return html;
+}
+function renderFormsSection2(diff) {
+  const { forms } = diff;
+  const hasContent = forms.added.length + forms.removed.length + forms.changed.length > 0;
+  if (!hasContent) {
+    return `
+      <div class="section">
+        <h2>Forms</h2>
+        <p class="empty-section">No form changes detected.</p>
+      </div>`;
+  }
+  let html = `<div class="section"><h2>Forms</h2>`;
+  if (forms.added.length > 0) {
+    html += `<h3>${badge("added")} Added Forms (${forms.added.length})</h3>`;
+    html += `<table><thead><tr><th>Action</th><th>Method</th><th>Fields</th></tr></thead><tbody>`;
+    for (const form of forms.added) {
+      const fieldNames = form.fields.map((f) => escapeHtml(f.name)).join(", ");
+      html += `<tr><td>${escapeHtml(form.action)}</td><td>${escapeHtml(form.method)}</td><td>${fieldNames}</td></tr>`;
+    }
+    html += `</tbody></table>`;
+  }
+  if (forms.removed.length > 0) {
+    html += `<h3>${badge("removed")} Removed Forms (${forms.removed.length})</h3>`;
+    html += `<table><thead><tr><th>Action</th><th>Method</th><th>Fields</th></tr></thead><tbody>`;
+    for (const form of forms.removed) {
+      const fieldNames = form.fields.map((f) => escapeHtml(f.name)).join(", ");
+      html += `<tr><td>${escapeHtml(form.action)}</td><td>${escapeHtml(form.method)}</td><td>${fieldNames}</td></tr>`;
+    }
+    html += `</tbody></table>`;
+  }
+  if (forms.changed.length > 0) {
+    html += `<h3>${badge("changed")} Modified Forms (${forms.changed.length})</h3>`;
+    html += `<ul class="change-list">`;
+    for (const change of forms.changed) {
+      html += `<li><strong>${escapeHtml(change.formId)}</strong>`;
+      const descs = [];
+      if (change.changes.fieldsAdded?.length) {
+        descs.push(`Fields added: ${change.changes.fieldsAdded.map((f) => escapeHtml(f.name)).join(", ")}`);
+      }
+      if (change.changes.fieldsRemoved?.length) {
+        descs.push(`Fields removed: ${change.changes.fieldsRemoved.map((f) => escapeHtml(f.name)).join(", ")}`);
+      }
+      if (change.changes.actionChanged) {
+        descs.push(`Action: <span class="old-value">${escapeHtml(change.changes.actionChanged.old)}</span> &rarr; <span class="new-value">${escapeHtml(change.changes.actionChanged.new)}</span>`);
+      }
+      if (change.changes.methodChanged) {
+        descs.push(`Method: <span class="old-value">${escapeHtml(change.changes.methodChanged.old)}</span> &rarr; <span class="new-value">${escapeHtml(change.changes.methodChanged.new)}</span>`);
+      }
+      html += `<div class="change-detail">${descs.join("<br>")}</div></li>`;
+    }
+    html += `</ul>`;
+  }
+  html += `</div>`;
+  return html;
+}
+function renderApiSection2(diff) {
+  const { api } = diff;
+  const hasContent = api.added.length + api.removed.length + api.changed.length > 0;
+  if (!hasContent) {
+    return `
+      <div class="section">
+        <h2>API Endpoints</h2>
+        <p class="empty-section">No API endpoint changes detected.</p>
+      </div>`;
+  }
+  let html = `<div class="section"><h2>API Endpoints</h2>`;
+  if (api.added.length > 0) {
+    html += `<h3>${badge("added")} Added Endpoints (${api.added.length})</h3>`;
+    html += `<table><thead><tr><th>Method</th><th>Pattern</th><th>Status Codes</th></tr></thead><tbody>`;
+    for (const ep of api.added) {
+      html += `<tr><td>${escapeHtml(ep.method)}</td><td>${escapeHtml(ep.pattern)}</td><td>${ep.observedStatusCodes.join(", ")}</td></tr>`;
+    }
+    html += `</tbody></table>`;
+  }
+  if (api.removed.length > 0) {
+    html += `<h3>${badge("removed")} Removed Endpoints (${api.removed.length})</h3>`;
+    html += `<table><thead><tr><th>Method</th><th>Pattern</th><th>Status Codes</th></tr></thead><tbody>`;
+    for (const ep of api.removed) {
+      html += `<tr><td>${escapeHtml(ep.method)}</td><td>${escapeHtml(ep.pattern)}</td><td>${ep.observedStatusCodes.join(", ")}</td></tr>`;
+    }
+    html += `</tbody></table>`;
+  }
+  if (api.changed.length > 0) {
+    html += `<h3>${badge("changed")} Modified Endpoints (${api.changed.length})</h3>`;
+    html += `<ul class="change-list">`;
+    for (const change of api.changed) {
+      html += `<li><strong>${escapeHtml(change.endpointId)}</strong>`;
+      const descs = [];
+      if (change.changes.statusCodesAdded?.length) {
+        descs.push(`New status codes: ${change.changes.statusCodesAdded.join(", ")}`);
+      }
+      if (change.changes.statusCodesRemoved?.length) {
+        descs.push(`Removed status codes: ${change.changes.statusCodesRemoved.join(", ")}`);
+      }
+      if (change.changes.contentTypeChanged) {
+        descs.push(`Content-Type: <span class="old-value">${escapeHtml(change.changes.contentTypeChanged.old)}</span> &rarr; <span class="new-value">${escapeHtml(change.changes.contentTypeChanged.new)}</span>`);
+      }
+      if (change.changes.bodySizeChange) {
+        descs.push(`Body size: ${change.changes.bodySizeChange.old}B &rarr; ${change.changes.bodySizeChange.new}B (${change.changes.bodySizeChange.percentChange}%)`);
+      }
+      html += `<div class="change-detail">${descs.join("<br>")}</div></li>`;
+    }
+    html += `</ul>`;
+  }
+  html += `</div>`;
+  return html;
+}
+function renderScreenshotsSection2(diff) {
+  const { screenshots } = diff;
+  const hasContent = screenshots.added.length + screenshots.removed.length + screenshots.changed.length > 0;
+  if (!hasContent) {
+    return `
+      <div class="section">
+        <h2>Screenshots</h2>
+        <p class="empty-section">No screenshot changes detected.</p>
+      </div>`;
+  }
+  let html = `<div class="section"><h2>Screenshots</h2>`;
+  if (screenshots.added.length > 0) {
+    html += `<h3>${badge("added")} New Screenshots (${screenshots.added.length})</h3>`;
+    html += `<table><thead><tr><th>URL</th></tr></thead><tbody>`;
+    for (const ss of screenshots.added) {
+      html += `<tr><td>${escapeHtml(ss.url)}</td></tr>`;
+    }
+    html += `</tbody></table>`;
+  }
+  if (screenshots.removed.length > 0) {
+    html += `<h3>${badge("removed")} Removed Screenshots (${screenshots.removed.length})</h3>`;
+    html += `<table><thead><tr><th>URL</th></tr></thead><tbody>`;
+    for (const ss of screenshots.removed) {
+      html += `<tr><td>${escapeHtml(ss.url)}</td></tr>`;
+    }
+    html += `</tbody></table>`;
+  }
+  if (screenshots.changed.length > 0) {
+    html += `<h3>${badge("changed")} Changed Screenshots (${screenshots.changed.length})</h3>`;
+    html += `<table><thead><tr><th>URL</th><th>Diff</th></tr></thead><tbody>`;
+    for (const ss of screenshots.changed) {
+      html += `<tr><td>${escapeHtml(ss.url)}</td><td>${ss.diffPercentage}% changed</td></tr>`;
+    }
+    html += `</tbody></table>`;
+  }
+  html += `</div>`;
+  return html;
+}
+function generateDiffReportHtml(diff) {
+  const { meta, summary, hasChanges } = diff;
+  const summarySection = `
+    <div class="summary">
+      ${summaryCard("Routes", summary.routes)}
+      ${summaryCard("Forms", summary.forms)}
+      ${summaryCard("API Endpoints", summary.api)}
+      ${summaryCard("Screenshots", summary.screenshots)}
+    </div>`;
+  const noChangesNotice = !hasChanges ? `<div class="no-changes">No changes detected between bundles.</div>` : "";
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  ${CSP_META2}
+  <title>Diff Report \u2014 playwright-archaeologist</title>
+  <style>${STYLES}</style>
+</head>
+<body>
+  <h1>Regression Diff Report</h1>
+  <div class="meta">
+    <p>Old bundle: ${escapeHtml(meta.oldBundle.targetUrl || meta.oldBundle.path)} (${escapeHtml(meta.oldBundle.createdAt)})</p>
+    <p>New bundle: ${escapeHtml(meta.newBundle.targetUrl || meta.newBundle.path)} (${escapeHtml(meta.newBundle.createdAt)})</p>
+    <p>Compared at: ${escapeHtml(meta.comparedAt)}</p>
+  </div>
+
+  ${summarySection}
+  ${noChangesNotice}
+
+  ${renderRoutesSection(diff)}
+  ${renderFormsSection2(diff)}
+  ${renderApiSection2(diff)}
+  ${renderScreenshotsSection2(diff)}
+</body>
+</html>`;
+}
+
+// src/bundle/bundle-creator.ts
+import { createHash as createHash2 } from "crypto";
+import {
+  readdir,
+  readFile as readFile3,
+  stat as stat2,
+  mkdir as mkdir4,
+  copyFile,
+  writeFile as writeFile3
+} from "fs/promises";
+import { join as join4, basename as basename2, extname as extname2 } from "path";
+function classifyFile(filePath) {
+  const ext = extname2(filePath).toLowerCase();
+  switch (ext) {
+    case ".json":
+      return "json";
+    case ".png":
+    case ".jpg":
+    case ".jpeg":
+    case ".webp":
+      return "screenshot";
+    case ".har":
+      return "api-snapshot";
+    case ".html":
+      return "json";
+    // HTML report stored alongside data
+    default:
+      return null;
+  }
+}
+async function computeSha2562(filePath) {
+  const content = await readFile3(filePath);
+  return createHash2("sha256").update(content).digest("hex");
+}
+async function collectFiles(dir) {
+  const results = [];
+  let entries;
+  try {
+    entries = await readdir(dir, { withFileTypes: true });
+  } catch {
+    return results;
+  }
+  for (const entry of entries) {
+    const fullPath = join4(dir, entry.name);
+    if (entry.isDirectory()) {
+      const nested = await collectFiles(fullPath);
+      results.push(...nested);
+    } else if (entry.isFile()) {
+      results.push(fullPath);
+    }
+  }
+  return results;
+}
+function targetSubdir(filePath) {
+  const ext = extname2(filePath).toLowerCase();
+  const name = basename2(filePath).toLowerCase();
+  if (name === "report.html") return "";
+  if ([".png", ".jpg", ".jpeg", ".webp"].includes(ext)) return "screenshots";
+  if ([".json", ".har", ".html"].includes(ext)) return "data";
+  return "data";
+}
+async function loadStats(outputDir) {
+  const defaults = {
+    pagesVisited: 0,
+    formsFound: 0,
+    apiEndpoints: 0,
+    screenshotCount: 0,
+    duration: 0
+  };
+  try {
+    const sitemapPath = join4(outputDir, "sitemap.json");
+    const sitemapContent = await readFile3(sitemapPath, "utf-8");
+    const sitemap = JSON.parse(sitemapContent);
+    if (Array.isArray(sitemap)) {
+      defaults.pagesVisited = sitemap.length;
+    }
+  } catch {
+  }
+  try {
+    const formsPath = join4(outputDir, "forms.json");
+    const formsContent = await readFile3(formsPath, "utf-8");
+    const forms = JSON.parse(formsContent);
+    if (Array.isArray(forms)) {
+      defaults.formsFound = forms.length;
+    }
+  } catch {
+  }
+  try {
+    const apiPath = join4(outputDir, "api-map.json");
+    const apiContent = await readFile3(apiPath, "utf-8");
+    const api = JSON.parse(apiContent);
+    if (Array.isArray(api)) {
+      defaults.apiEndpoints = api.length;
+    }
+  } catch {
+  }
+  return defaults;
+}
+async function loadConfig(outputDir) {
+  const defaults = {
+    targetUrl: "",
+    depth: 0,
+    viewport: { width: 1280, height: 720 },
+    concurrency: 1,
+    maxPages: 100,
+    followExternal: false,
+    deepClick: false
+  };
+  try {
+    const metaPath = join4(outputDir, "meta.json");
+    const content = await readFile3(metaPath, "utf-8");
+    const meta = JSON.parse(content);
+    if (typeof meta.targetUrl === "string") defaults.targetUrl = meta.targetUrl;
+    if (typeof meta.depth === "number") defaults.depth = meta.depth;
+    if (typeof meta.duration === "number") {
+    }
+    if (meta.viewport && typeof meta.viewport === "object" && "width" in meta.viewport && "height" in meta.viewport) {
+      defaults.viewport = meta.viewport;
+    }
+  } catch {
+  }
+  return defaults;
+}
+async function createBundle(outputDir, bundlePath) {
+  try {
+    const outputStat = await stat2(outputDir);
+    if (!outputStat.isDirectory()) {
+      throw new BundleError(
+        "create_failed",
+        `Output path is not a directory: ${outputDir}`,
+        bundlePath
+      );
+    }
+  } catch (err) {
+    if (err instanceof BundleError) throw err;
+    throw new BundleError(
+      "create_failed",
+      `Output directory not found: ${outputDir}`,
+      bundlePath,
+      { cause: err }
+    );
+  }
+  await mkdir4(join4(bundlePath, "screenshots"), { recursive: true });
+  await mkdir4(join4(bundlePath, "data"), { recursive: true });
+  const allFiles = await collectFiles(outputDir);
+  const fileEntries = [];
+  let screenshotCount = 0;
+  for (const filePath of allFiles) {
+    const fileType = classifyFile(filePath);
+    if (fileType === null) continue;
+    const fileName = basename2(filePath);
+    const subdir = targetSubdir(filePath);
+    const bundleRelPath = subdir ? join4(subdir, fileName) : fileName;
+    const destPath = join4(bundlePath, bundleRelPath);
+    await copyFile(filePath, destPath);
+    const sha256 = await computeSha2562(filePath);
+    const fileStat = await stat2(filePath);
+    if (fileType === "screenshot") {
+      screenshotCount++;
+    }
+    fileEntries.push({
+      path: bundleRelPath.replace(/\\/g, "/"),
+      // normalize to forward slashes
+      sha256,
+      size: fileStat.size,
+      type: fileType
+    });
+  }
+  const [stats, config] = await Promise.all([
+    loadStats(outputDir),
+    loadConfig(outputDir)
+  ]);
+  stats.screenshotCount = screenshotCount;
+  const manifest = {
+    version: 1,
+    tool: "playwright-archaeologist",
+    toolVersion: "0.1.0",
+    // TODO: read from package.json at build time
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    config,
+    stats,
+    files: fileEntries
+  };
+  const manifestPath = join4(bundlePath, "manifest.json");
+  await writeFile3(manifestPath, JSON.stringify(manifest, null, 2), "utf-8");
+  return manifest;
+}
+
+export {
+  ViewportSchema,
+  parseViewport,
+  normalizeEntryUrl,
+  CrawlConfigSchema,
+  DiffConfigSchema,
+  ArchaeologistError,
+  ConfigError,
+  AuthError,
+  CrawlError,
+  NavigationError,
+  CollectorError,
+  DiffError,
+  BundleError,
+  Logger,
+  logger,
+  Frontier,
+  captureScreenshots,
+  probeForms,
+  createNetworkLogger,
+  groupEndpoints,
+  detectCycles,
+  buildFlowGraph,
+  generateMermaidDefinition,
+  generateOpenApiSpec,
+  writeOpenApiSpec,
+  escapeHtml,
+  escapeAttribute,
+  escapeJsonInHtml,
+  generateReportHtml,
+  dig,
+  diffBundles,
+  generateDiffReportHtml,
+  createBundle
+};
+//# sourceMappingURL=chunk-F5WCXM7I.js.map