RHR Map Lead Pro v5.0 — AI Google Maps Lead Extractor
Developed by Rubel Hasan Rokib · https://rubelhasanrokib.com
==========================================================

INSTALL / UPDATE (Chrome / Edge / Brave / Opera)
1. Unzip — you get the "MapLeadsPro" folder.
2. Open chrome://extensions → turn on "Developer mode".
3. Updating from v4 or older? Click "Remove" on the old version first (saved leads & settings stay), then
   click "Load unpacked" and select the new MapLeadsPro folder.
4. Pin "RHR Map Lead Pro" and click it to open the side panel.

NEW IN v5
1. GOOGLE ADS DETECTION (Search → Advanced → "Check if they already run Google Ads")
   - "Sponsored" listing on Google Maps results          → Running now
   - Google Ads Transparency Center (ads by their domain) → Running now (ad seen in last 30 days)
                                                            / Ran before (last date) / Has run
   - Google Ads tag (AW-…) on the website or inside their Google Tag Manager → Likely running
   - Sheet columns (orange headers): Google Ads Status, Evidence, Ads Count, Last Ad Seen,
     Advertiser Name, Ads Tag ID, Ads Transparency Link, Meta Ad Library Link
   - Leads tab filter "💰 Runs Google Ads". Leads running ads get +10 score (they have budget).
   - Pitch & AI switch automatically: running ads → "lower cost per lead / conversion tracking",
     stopped ads → "restart profitably", none → normal pitch.
2. EMAIL MATCH ACROSS SOURCES
   - New column "Email Match (all sources)": "✓ Same email on all 3 sources (Website, Facebook,
     Google Profile)" or which source shows a different email. The most-used valid email is always
     in "Best Email".
3. SECURITY HARDENING (see SECURITY below)

NEW IN v4
1. EMAILS FROM EVERYWHERE
   - Website: all crawled pages + hidden page source (JSON, scripts, @-encoded,
     Cloudflare-protected, "name [at] domain [dot] com"), plus Contact / Privacy / Imprint pages
     and security.txt when no own-domain email is found
   - Google Business Profile text (description / "From the business")
   - Facebook page (About), Instagram business email & bio, TikTok bio
     (uses your logged-in browser session — stay logged in to Facebook/Instagram for best results)
2. MOST-USED VALID CONTACT FIRST
   - Every email / phone is counted across all sources. The one used on the most places is shown first.
   - Emails must pass validation (format → fake/typo/disposable removal → DNS/MX → domain trust).
   - New columns: Email Found On, Phone Found On (e.g. "Website (3×), Google Profile, Facebook").
3. WHATSAPP
   - Real wa.me / api.whatsapp.com links and chat widgets (Joinchat, Click-to-Chat…) = "✓ WhatsApp link"
   - Otherwise the most-used mobile number = "Mobile · likely WhatsApp"
   - Columns: WhatsApp Number, WhatsApp Link, WhatsApp Source
4. AI BUSINESS ANALYST (Settings → AI business analyst)
   - Providers: Google Gemini (free tier), OpenAI, Anthropic Claude. Paste your API key → Test AI → Save.
   - For every lead the AI decides: Lead Fit (High / Medium / Low) + reason
   - Writes: Core Business, Key Points for Email, Target Customers, USP, Pain Points, Pitch Angle,
     Personalized First Line, Email Subject and a spam-safe Email Draft with your signature.
   - "What you sell" and "Email signature" fields let the AI choose the best service for each lead.
   - Already-collected leads: Leads tab → "🤖 Analyse with AI".
   - No API key? The built-in engine still writes "Key Points for Email", pitch, first line and subject.

HOW TO USE — 4 STEPS
1. Keywords (one per line)  2. Cities (one per line)  3. Lead type  4. How many → Start collecting.
Keep the Google Maps tab open and visible while it runs.

EXPORT
- Excel (green headers = contacts, navy headers = AI/outreach), CSV, Copy for Sheets, Direct to Google Sheet.
- v4 has new columns — the Sheets script automatically writes into a new tab (e.g. "Leads v2").

TIPS
- Gemini free tier: keep "Requests / minute" at 10–12.
- "Safe" speed reduces Google blocks. Keep each run under ~300–500 leads.
- "Valid" email = domain-level verification (browsers cannot ping mailboxes). Follow local anti-spam rules.

SECURITY (audited for v5)
- No remote code: every script ships inside the extension; strict Content Security Policy
  (script-src 'self', object-src 'none'). No eval / new Function. Google Fonts removed (no external requests on open).
- Scraped websites can't run code: pages are read as inert text (DOMParser), every value shown in
  the panel is HTML-escaped, and only http(s) links are ever rendered or exported (javascript:/data: blocked).
- Website crawling never sends your cookies (credentials: omit) and never touches local/private
  network addresses (localhost, 192.168.x.x, 10.x.x.x…). Pages over 4 MB are skipped.
- Social checks send cookies only to facebook.com / instagram.com / tiktok.com (URLs are rebuilt, not trusted).
- Messages between the Maps tab and the panel are accepted only from this extension.
- Google Sheet: the Apps Script now contains a private random token — only your extension can write
  to your sheet. Formulas in scraped text are neutralised (no =IMPORTXML tricks). After updating,
  copy the NEW code from Settings → paste in Apps Script → Deploy → Manage deployments → Edit → New version.
- AI keys stay in this browser (chrome.storage.local); the Gemini key is sent in a header, not the URL.
  The AI is told to ignore any instructions hidden inside scraped websites.
- Bundled xlsx library 0.18.5: its known CVEs affect only READING spreadsheet files; this extension only writes them.
- Only install from this folder (Load unpacked). Never install a copy someone else modified.
