@ai-ecoverse/slicc-browsers 1.18.20 → 1.18.22

package/catalog.json

@@ -642,7 +642,7 @@
   "seven": {
     "originScheme": "https",
     "originHostPattern": "^([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)\\.sliccy\\.ai$",
-    "excludedLabels": ["www", "vault", "vault-preview", "get", "mcpcat", "echo"],
+    "excludedLabels": ["vault", "vault-preview", "get", "mcpcat", "echo"],
     "excludedLabelPrefixes": ["vault-"],
     "sitePattern": "[*.]sliccy.ai",
     "switches": [

package/corpus.json

@@ -763,6 +763,11 @@
                   "id": "P1",
                   "url": "https://lars.sliccy.ai",
                   "title": "https://lars.sliccy.ai"
+                },
+                {
+                  "id": "P3",
+                  "url": "https://www.sliccy.ai",
+                  "title": "https://www.sliccy.ai"
                 }
               ],
               "tabs": [
@@ -2105,7 +2110,7 @@
     {
       "name": "seven-tabs",
       "case": {
-        "description": "sevenOpen needs a page target on https://<label>.sliccy.ai other than www; www, the apex, other schemes, nested labels and non-page targets don't count",
+        "description": "sevenOpen needs a page target on https://<label>.sliccy.ai, including www; excluded labels such as vault, the apex, other schemes, nested labels and non-page targets don't count",
         "needs": [
           "flag"
         ],
@@ -2180,6 +2185,13 @@
                 "url": "https://lars.sliccy.ai/",
                 "title": "worker",
                 "webSocketDebuggerUrl": "ws://127.0.0.1/devtools/page/T8"
+              },
+              {
+                "id": "T9",
+                "type": "page",
+                "url": "https://vault.sliccy.ai/",
+                "title": "vault",
+                "webSocketDebuggerUrl": "ws://127.0.0.1/devtools/page/T9"
               }
             ]
           },
@@ -2255,6 +2267,11 @@
                   "url": "https://lars.sliccy.ai",
                   "title": "https://lars.sliccy.ai"
                 },
+                {
+                  "id": "T2",
+                  "url": "https://www.sliccy.ai",
+                  "title": "https://www.sliccy.ai"
+                },
                 {
                   "id": "T6",
                   "url": "https://seven.sliccy.ai",
@@ -2264,14 +2281,14 @@
             }
           },
           {
-            "id": "cdp:127.0.0.1:9323",
+            "id": "cdp:127.0.0.1:9322",
             "kind": "endpoint",
             "tier": 1,
             "name": "Chrome",
             "version": "154.0.8037.98",
             "endpoint": {
-              "cdp": "http://127.0.0.1:9323",
-              "webSocketDebuggerUrl": "ws://127.0.0.1:9323/devtools/browser/s3",
+              "cdp": "http://127.0.0.1:9322",
+              "webSocketDebuggerUrl": "ws://127.0.0.1:9322/devtools/browser/s2",
               "name": "Chrome",
               "version": "154.0.8037.98",
               "product": "Chrome/154.0.8037.98",
@@ -2280,29 +2297,35 @@
               "sevenOpen": true,
               "sevenTabs": [
                 {
-                  "id": "V1",
-                  "url": "https://team-7.sliccy.ai",
-                  "title": "https://team-7.sliccy.ai"
+                  "id": "U1",
+                  "url": "https://www.sliccy.ai",
+                  "title": "https://www.sliccy.ai"
                 }
               ]
             }
           },
           {
-            "id": "cdp:127.0.0.1:9322",
+            "id": "cdp:127.0.0.1:9323",
             "kind": "endpoint",
-            "tier": 2,
+            "tier": 1,
             "name": "Chrome",
             "version": "154.0.8037.98",
             "endpoint": {
-              "cdp": "http://127.0.0.1:9322",
-              "webSocketDebuggerUrl": "ws://127.0.0.1:9322/devtools/browser/s2",
+              "cdp": "http://127.0.0.1:9323",
+              "webSocketDebuggerUrl": "ws://127.0.0.1:9323/devtools/browser/s3",
               "name": "Chrome",
               "version": "154.0.8037.98",
               "product": "Chrome/154.0.8037.98",
               "userAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.8037.98 Safari/537.36",
               "source": "flag",
-              "sevenOpen": false,
-              "sevenTabs": []
+              "sevenOpen": true,
+              "sevenTabs": [
+                {
+                  "id": "V1",
+                  "url": "https://team-7.sliccy.ai",
+                  "title": "https://team-7.sliccy.ai"
+                }
+              ]
             }
           }
         ]

package/guard-vectors.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "setVersion": "1.18.20",
+  "setVersion": "1.18.22",
   "sources": [
     {
       "repo": "ai-ecoverse/slicc-cli",
@@ -1200,7 +1200,7 @@
           }
         },
         "eventsRedacted": {
-          "means": "protected error-page recover: every discovery event for the tab shows, decoded as often as it takes and without the characters the URL parser ignores, the failed URL's origin only, a masked or absent url, or a url off the protected host, wrappers such as blob: unwrapped, that names no other origin on that host, with a title that names the protected host, if at all, only as that bare origin, and no url or title carries the failed URL, its path, query or fragment; no discovery event for another or no target carries the row's tag; reporting no event for the tab also passes",
+          "means": "protected error-page recover: every discovery event for the tab shows, decoded as often as it takes and without the characters the URL parser ignores, the failed URL's origin only, a masked or absent url, or a url off the protected host, wrappers such as blob: unwrapped, that names no other origin on that host, with a title that names the protected host, in any spelling the URL parser maps to it, if at all, only as that bare origin, and no url or title carries the failed URL, its path, query or fragment; no discovery event for another or no target carries the row's tag; reporting no event for the tab also passes",
           "requires": ["discovery"],
           "check": {
             "result": "errorPage",
@@ -1349,7 +1349,7 @@
           }
         },
         "eventsRedacted": {
-          "means": "protected error-page recover (query): every discovery event for the tab shows, decoded as often as it takes and without the characters the URL parser ignores, the failed URL's origin only, a masked or absent url, or a url off the protected host, wrappers such as blob: unwrapped, that names no other origin on that host, with a title that names the protected host, if at all, only as that bare origin, and no url or title carries the failed URL, its path, query or fragment; no discovery event for another or no target carries the row's tag; reporting no event for the tab also passes",
+          "means": "protected error-page recover (query): every discovery event for the tab shows, decoded as often as it takes and without the characters the URL parser ignores, the failed URL's origin only, a masked or absent url, or a url off the protected host, wrappers such as blob: unwrapped, that names no other origin on that host, with a title that names the protected host, in any spelling the URL parser maps to it, if at all, only as that bare origin, and no url or title carries the failed URL, its path, query or fragment; no discovery event for another or no target carries the row's tag; reporting no event for the tab also passes",
           "requires": ["discovery"],
           "check": {
             "result": "errorPage",
@@ -1498,7 +1498,7 @@
           }
         },
         "eventsRedacted": {
-          "means": "protected error-page recover (fragment): every discovery event for the tab shows, decoded as often as it takes and without the characters the URL parser ignores, the failed URL's origin only, a masked or absent url, or a url off the protected host, wrappers such as blob: unwrapped, that names no other origin on that host, with a title that names the protected host, if at all, only as that bare origin, and no url or title carries the failed URL, its path, query or fragment; no discovery event for another or no target carries the row's tag; reporting no event for the tab also passes",
+          "means": "protected error-page recover (fragment): every discovery event for the tab shows, decoded as often as it takes and without the characters the URL parser ignores, the failed URL's origin only, a masked or absent url, or a url off the protected host, wrappers such as blob: unwrapped, that names no other origin on that host, with a title that names the protected host, in any spelling the URL parser maps to it, if at all, only as that bare origin, and no url or title carries the failed URL, its path, query or fragment; no discovery event for another or no target carries the row's tag; reporting no event for the tab also passes",
           "requires": ["discovery"],
           "check": {
             "result": "errorPage",
@@ -1646,7 +1646,7 @@
           }
         },
         "eventsRedacted": {
-          "means": "protected error-page restore: every discovery event for the tab shows, decoded as often as it takes and without the characters the URL parser ignores, the failed URL's origin only, a masked or absent url, or a url off the protected host, wrappers such as blob: unwrapped, that names no other origin on that host, with a title that names the protected host, if at all, only as that bare origin, and no url or title carries the failed URL, its path, query or fragment; no discovery event for another or no target carries the row's tag; reporting no event for the tab also passes",
+          "means": "protected error-page restore: every discovery event for the tab shows, decoded as often as it takes and without the characters the URL parser ignores, the failed URL's origin only, a masked or absent url, or a url off the protected host, wrappers such as blob: unwrapped, that names no other origin on that host, with a title that names the protected host, in any spelling the URL parser maps to it, if at all, only as that bare origin, and no url or title carries the failed URL, its path, query or fragment; no discovery event for another or no target carries the row's tag; reporting no event for the tab also passes",
           "requires": ["discovery"],
           "check": {
             "result": "errorPage",
@@ -1827,7 +1827,7 @@
           }
         },
         "eventsRedacted": {
-          "means": "protected error-page sticky: every discovery event for the tab shows, decoded as often as it takes and without the characters the URL parser ignores, the failed URL's origin only, a masked or absent url, or a url off the protected host, wrappers such as blob: unwrapped, that names no other origin on that host, with a title that names the protected host, if at all, only as that bare origin, and no url or title carries the failed URL, its path, query or fragment; no discovery event for another or no target carries the row's tag; reporting no event for the tab also passes",
+          "means": "protected error-page sticky: every discovery event for the tab shows, decoded as often as it takes and without the characters the URL parser ignores, the failed URL's origin only, a masked or absent url, or a url off the protected host, wrappers such as blob: unwrapped, that names no other origin on that host, with a title that names the protected host, in any spelling the URL parser maps to it, if at all, only as that bare origin, and no url or title carries the failed URL, its path, query or fragment; no discovery event for another or no target carries the row's tag; reporting no event for the tab also passes",
           "requires": ["discovery"],
           "check": {
             "result": "errorPage",
@@ -2020,7 +2020,7 @@
           }
         },
         "eventsRedacted": {
-          "means": "protected error-page sticky (query): every discovery event for the tab shows, decoded as often as it takes and without the characters the URL parser ignores, the failed URL's origin only, a masked or absent url, or a url off the protected host, wrappers such as blob: unwrapped, that names no other origin on that host, with a title that names the protected host, if at all, only as that bare origin, and no url or title carries the failed URL, its path, query or fragment; no discovery event for another or no target carries the row's tag; reporting no event for the tab also passes",
+          "means": "protected error-page sticky (query): every discovery event for the tab shows, decoded as often as it takes and without the characters the URL parser ignores, the failed URL's origin only, a masked or absent url, or a url off the protected host, wrappers such as blob: unwrapped, that names no other origin on that host, with a title that names the protected host, in any spelling the URL parser maps to it, if at all, only as that bare origin, and no url or title carries the failed URL, its path, query or fragment; no discovery event for another or no target carries the row's tag; reporting no event for the tab also passes",
           "requires": ["discovery"],
           "check": {
             "result": "errorPage",
@@ -2213,7 +2213,7 @@
           }
         },
         "eventsRedacted": {
-          "means": "protected error-page sticky (fragment): every discovery event for the tab shows, decoded as often as it takes and without the characters the URL parser ignores, the failed URL's origin only, a masked or absent url, or a url off the protected host, wrappers such as blob: unwrapped, that names no other origin on that host, with a title that names the protected host, if at all, only as that bare origin, and no url or title carries the failed URL, its path, query or fragment; no discovery event for another or no target carries the row's tag; reporting no event for the tab also passes",
+          "means": "protected error-page sticky (fragment): every discovery event for the tab shows, decoded as often as it takes and without the characters the URL parser ignores, the failed URL's origin only, a masked or absent url, or a url off the protected host, wrappers such as blob: unwrapped, that names no other origin on that host, with a title that names the protected host, in any spelling the URL parser maps to it, if at all, only as that bare origin, and no url or title carries the failed URL, its path, query or fragment; no discovery event for another or no target carries the row's tag; reporting no event for the tab also passes",
           "requires": ["discovery"],
           "check": {
             "result": "errorPage",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-browsers",
-  "version": "1.18.20",
+  "version": "1.18.22",
   "description": "SLICC's shared browser catalog, JSON schemas and discovery conformance corpus",
   "type": "module",
   "license": "Apache-2.0",
@@ -68,7 +68,7 @@
     "validate": "node scripts/validate.mjs",
     "lint": "slicc-lint && test -z \"$(gofmt -l .)\" && go mod tidy -diff && go vet ./... && GOOS=darwin go vet ./... && GOOS=windows go vet ./... && golangci-lint run && cargo fmt --check && cargo clippy --all-features --all-targets -- -D warnings && cargo check --target wasm32-wasip1 --no-default-features && cargo check --target wasm32-wasip1 --features serde && cargo check --target wasm32-wasip1 --all-features",
     "format": "biome check --write . && gofmt -w . && cargo fmt",
-    "test": "export PATH=\"$HOME/.cargo/bin:$PATH\" && node --test --test-concurrency=1 test/integration/self-contained.test.mjs test/integration/browser-runner.test.mjs test/integration/fixture-client.test.mjs test/integration/guard-redirect-carrier.test.mjs test/integration/guard-redirect-session-end.test.mjs test/integration/guard-redirect-history.test.mjs test/integration/guard-redirect-iframe.test.mjs test/integration/guard-incomplete.test.mjs test/integration/guard-unparseable-wipe.test.mjs test/integration/guard-browser-ui.test.mjs test/integration/guard-snapshot-settle.test.mjs test/integration/guard-stall.test.mjs test/integration/guard-forged.test.mjs test/integration/guard-exit-steps.test.mjs test/integration/guard-exit-refusal.test.mjs test/integration/guard-frame-read.test.mjs test/integration/guard-bfcache.test.mjs test/integration/guard-bfcache-marker.test.mjs test/integration/guard-bfcache-history.test.mjs test/integration/guard-bfcache-review.test.mjs test/integration/guard-bfcache-quarantine.test.mjs test/integration/guard-error-page-navigation.test.mjs test/integration/guard-error-page-events.test.mjs test/integration/guard-error-page-reload.test.mjs test/integration/guard-world-paint.test.mjs test/integration/gates.test.mjs test/integration/validate.test.mjs test/integration/go.test.mjs test/integration/cargo.test.mjs test/integration/workflows.test.mjs test/integration/guard-sweep-union.test.mjs && node --test --test-concurrency=2 test/integration/guard-lifecycle.test.mjs test/integration/chromium-launch.test.mjs test/integration/guard-fit.test.mjs test/integration/guard-chain.test.mjs test/integration/guard-validation.test.mjs test/integration/guard-liveness.test.mjs test/integration/guard-observations.test.mjs test/integration/guard-child-latency.test.mjs test/integration/guard-adoption.test.mjs test/integration/guard-scoping.test.mjs test/integration/guard-late-pause.test.mjs test/integration/guard-legs.test.mjs test/integration/guard-fetch-enable.test.mjs test/integration/guard-diagnostics.test.mjs test/integration/guard-chrome.test.mjs test/integration/guard-worlds.test.mjs test/integration/guard-world-discovery.test.mjs test/integration/guard-world-guesses.test.mjs test/integration/guard-unparseable.test.mjs test/integration/guard-redirect-secret.test.mjs test/integration/guard-error-page.test.mjs test/integration/guard-discovery.test.mjs test/integration/guard-bfcache-chrome.test.mjs test/integration/guard-browser-page.test.mjs test/integration/guard-scales.test.mjs test/integration/guard-shared-log.test.mjs test/integration/guard-pre-beacon.test.mjs test/integration/guard-world-pause.test.mjs test/integration/guard-parallel.test.mjs test/integration/guard-client-exit.test.mjs test/integration/guard-runner.test.mjs test/integration/guard-sweep-ordinary.test.mjs test/integration/guard-sweep-seven.test.mjs test/integration/guard-sweep-vault.test.mjs test/integration/guard-sweep-vault-x.test.mjs test/integration/guard-sweep-apex.test.mjs test/integration/guard-sweep-others.test.mjs",
+    "test": "export PATH=\"$HOME/.cargo/bin:$PATH\" && node --test --test-concurrency=1 test/integration/self-contained.test.mjs test/integration/seven-corpus.test.mjs test/integration/browser-runner.test.mjs test/integration/fixture-client.test.mjs test/integration/guard-redirect-carrier.test.mjs test/integration/guard-redirect-session-end.test.mjs test/integration/guard-redirect-history.test.mjs test/integration/guard-redirect-iframe.test.mjs test/integration/guard-incomplete.test.mjs test/integration/guard-unparseable-wipe.test.mjs test/integration/guard-browser-ui.test.mjs test/integration/guard-snapshot-settle.test.mjs test/integration/guard-stall.test.mjs test/integration/guard-forged.test.mjs test/integration/guard-exit-steps.test.mjs test/integration/guard-exit-refusal.test.mjs test/integration/guard-frame-read.test.mjs test/integration/guard-bfcache.test.mjs test/integration/guard-bfcache-marker.test.mjs test/integration/guard-bfcache-history.test.mjs test/integration/guard-bfcache-review.test.mjs test/integration/guard-bfcache-quarantine.test.mjs test/integration/guard-error-page-navigation.test.mjs test/integration/guard-error-page-events.test.mjs test/integration/guard-error-page-reload.test.mjs test/integration/guard-world-paint.test.mjs test/integration/gates.test.mjs test/integration/validate.test.mjs test/integration/go.test.mjs test/integration/cargo.test.mjs test/integration/workflows.test.mjs test/integration/guard-sweep-union.test.mjs && node --test --test-concurrency=2 test/integration/guard-lifecycle.test.mjs test/integration/chromium-launch.test.mjs test/integration/guard-fit.test.mjs test/integration/guard-chain.test.mjs test/integration/guard-validation.test.mjs test/integration/guard-liveness.test.mjs test/integration/guard-observations.test.mjs test/integration/guard-child-latency.test.mjs test/integration/guard-adoption.test.mjs test/integration/guard-scoping.test.mjs test/integration/guard-late-pause.test.mjs test/integration/guard-legs.test.mjs test/integration/guard-fetch-enable.test.mjs test/integration/guard-diagnostics.test.mjs test/integration/guard-chrome.test.mjs test/integration/guard-worlds.test.mjs test/integration/guard-world-discovery.test.mjs test/integration/guard-world-guesses.test.mjs test/integration/guard-unparseable.test.mjs test/integration/guard-redirect-secret.test.mjs test/integration/guard-error-page.test.mjs test/integration/guard-discovery.test.mjs test/integration/guard-bfcache-chrome.test.mjs test/integration/guard-browser-page.test.mjs test/integration/guard-scales.test.mjs test/integration/guard-shared-log.test.mjs test/integration/guard-pre-beacon.test.mjs test/integration/guard-world-pause.test.mjs test/integration/guard-parallel.test.mjs test/integration/guard-client-exit.test.mjs test/integration/guard-runner.test.mjs test/integration/guard-sweep-ordinary.test.mjs test/integration/guard-sweep-seven.test.mjs test/integration/guard-sweep-vault.test.mjs test/integration/guard-sweep-vault-x.test.mjs test/integration/guard-sweep-apex.test.mjs test/integration/guard-sweep-others.test.mjs",
     "test:unit": "mkdir -p coverage/unit && node --experimental-test-coverage --test --test-concurrency=1 --test-reporter=lcov --test-reporter-destination=coverage/unit/lcov.info test/unit/*.test.mjs && go test -race -cover ./...",
     "build": "go build ./... && cargo build --all-features && cargo build --target wasm32-wasip1 --all-features && npm pack --dry-run",
     "prepublishOnly": "node scripts/set-crate-version.mjs \"$npm_package_version\"",
@@ -79,9 +79,9 @@
     "test:unit:guard": "mkdir -p coverage/unit && node --experimental-vm-modules --no-warnings --experimental-test-coverage --test --test-concurrency=1 --test-coverage-include=guard-runner.mjs --test-coverage-include=guard-driver.mjs --test-coverage-include=fixture-server.mjs --test-coverage-include=fixture-client.mjs --test-coverage-include=observer-target.mjs --test-coverage-include=frame-read.mjs --test-coverage-include=bfcache-restore.mjs --test-coverage-include=protected-error-page.mjs --test-coverage-include=unparseable-url.mjs --test-coverage-include=scripts/browser-runner.mjs --test-coverage-include=scripts/validate.mjs --test-reporter=lcov --test-reporter-destination=coverage/unit/guard.lcov test/unit/guard-*.test.mjs && slicc-diff-cover coverage/unit/guard.lcov"
   },
   "devDependencies": {
-    "@ai-ecoverse/slicc-cdp": "1.42.4",
-    "@ai-ecoverse/slicc-shared-web": "2.13.6",
-    "@biomejs/biome": "2.6.2",
+    "@ai-ecoverse/slicc-cdp": "1.44.2",
+    "@ai-ecoverse/slicc-shared-web": "2.13.8",
+    "@biomejs/biome": "2.6.3",
     "ajv": "8.20.0",
     "ajv-formats": "3.0.1",
     "lefthook": "2.2.2",

package/protected-error-page.mjs

@@ -80,6 +80,19 @@ const readings = (value) =>
     return out;
   });
 const layers = (value) => readings(value).flat();
+const inner = (u) => (u && !u.host ? inner(parseURL(u.pathname)) : u);
+const pattern = /(?:[a-z][a-z\d+.-]*:)+[\\/]*[^\\/?#&\s]*|[\\/]{2}[^\\/?#&\s]*/g;
+const spaced = (form) => Array.from(form, (c) => (c > ' ' ? c : ' ')).join('');
+const mapped = new Map();
+const hostChar = (c) => {
+  if (!mapped.has(c)) {
+    const host = parseURL(`http://a${c}a/`)?.hostname;
+    mapped.set(c, host && !host.includes('xn--') ? host.slice(1, -1) : c);
+  }
+  return mapped.get(c);
+};
+const folded = (form) =>
+  Array.from(form, (c) => (c.charCodeAt(0) < 128 ? c : hostChar(c))).join('');
 const unschemed = (value) => value.replace(/^[a-z][a-z\d+.-]*:\/\//, '');
 
 const encoded = (url) =>
@@ -107,41 +120,40 @@ function failureRules({ failedURL, tag }) {
     .filter((part) => part && part !== '/')
     .map(plain);
   const leaks = (value) => layers(value).some((form) => parts.some((part) => form.includes(part)));
-  const names = (value) =>
-    layers(value).some((form) => form.includes(hostname)) || parseURL(value)?.origin === origin;
+  const onHost = (u) => u?.hostname.replace(/\.$/, '') === hostname;
+  const refs = (text) =>
+    Array.from(text.matchAll(pattern), ([ref]) =>
+      inner(parseURL(ref, /^[\\/]/.test(ref) ? origin : undefined))
+    );
+  const mentions = (form) =>
+    folded(form).includes(hostname) || [form, spaced(form)].some((text) => refs(text).some(onHost));
+  const names = (value) => layers(value).some(mentions) || parseURL(value)?.origin === origin;
   const carries = (value) => layers(value).some((form) => form.includes(plain(tag)));
-  return { failed, leaks, names, carries };
+  return { failed, leaks, names, carries, mentions, onHost, refs };
 }
 
 function discoveryRules({ failedURL, tag, trigger }) {
-  const { failed, leaks, names, carries } = failureRules({ failedURL, tag });
+  const { failed, leaks, names, carries, mentions, onHost, refs } = failureRules({
+    failedURL,
+    tag,
+  });
   const { origin, host, hostname } = failed;
   const named = [hostname, host, origin];
   const cleanTitle = ({ title, url }) =>
     !leaks(title) &&
     (!names(title) ||
       named.includes(lower(title)) ||
-      (!layers(url).includes(origin) && referenced(title)));
+      (!layers(url).some((form) => onHost(inner(parseURL(form)))) && referenced(title)));
   const ownTitle = ({ url, title }) =>
     plain(title) !== '' && [plain(url), unschemed(plain(url))].includes(plain(title));
-  const inner = (u) => (u && !u.host ? inner(parseURL(u.pathname)) : u);
-  const onHost = (u) => u?.hostname.replace(/\.$/, '') === hostname;
-  const pattern = /(?:[a-z][a-z\d+.-]*:)+[\\/]*[^\\/?#&\s]*|[\\/]{2}[^\\/?#&\s]*/g;
-  const spaced = (form) => Array.from(form, (c) => (c > ' ' ? c : ' ')).join('');
-  const resolve = (ref) => inner(parseURL(ref, /^[\\/]/.test(ref) ? origin : undefined));
-  const fine = (text) =>
-    Array.from(text.matchAll(pattern), ([ref]) => resolve(ref)).every(
-      (u) => !onHost(u) || u.origin === origin
-    );
+  const fine = (text) => refs(text).every((u) => !onHost(u) || u.origin === origin);
   const exact = (form) =>
     form === origin || (!onHost(inner(parseURL(form))) && fine(form) && fine(spaced(form)));
   const only = (ref, at, text) =>
     parseURL(ref, /^[\\/]/.test(ref) ? origin : undefined)?.href === `${origin}/` &&
     !/[\\/?#]/.test(text[at + ref.length] ?? '');
   const bare = (form) =>
-    !spaced(form)
-      .replace(pattern, (ref, at, text) => (only(ref, at, text) ? ref.replace(hostname, ' ') : ref))
-      .includes(hostname);
+    !mentions(spaced(form).replace(pattern, (ref, at, text) => (only(ref, at, text) ? ' ' : ref)));
   const referenced = (title) =>
     layers(title).every(exact) && readings(title).every((read) => bare(read.at(-1)));
   const cleanURL = (url) => !leaks(url) && layers(url).every(exact);