@de-otio/bibcheck 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Richard Myers
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,147 @@
+# bibcheck
+
+Catch citations an LLM invented — fabricated DOIs, non-existent ISBNs,
+plausible-but-wrong identifiers — before they reach your bibliography or your
+readers. bibcheck verifies that the works your sources describe actually exist
+in scholarly databases, that their identifiers are well-formed, and that URLs
+for pre-DOI primary sources point to trusted canonical editions.
+
+> **Status: v0.1 — initial release.** CLI surface, JSON output schema, and
+> configuration grammar are stable within the v0.x major; minor bumps are
+> additive.
+
+## Installation
+
+Requires Node.js >= 20.
+
+```sh
+# one-off, no install
+npx @de-otio/bibcheck check
+
+# or install globally
+npm install -g @de-otio/bibcheck
+bibcheck check
+```
+
+bibcheck looks for a `bibcheck.toml` in the working directory (it also runs with
+sensible defaults and none at all). See [docs/usage.md](docs/usage.md) for a
+quick start and [docs/configuration.md](docs/configuration.md) for the config
+reference.
+
+## Why bibcheck
+
+AI-assisted research workflows regularly produce citations that look real but
+aren't: a DOI where the last four digits are transposed, an ISBN whose check
+digit is wrong, a journal article that was never published. These hallucinations
+pass a spell-check and a format linter. They do not pass bibcheck.
+
+bibcheck's existence check is default-gating: if a DOI or ISBN that your
+bibliography records is absent from CrossRef, OpenAlex, and OpenLibrary, the
+build fails. A malformed identifier — one that fails the structural rules
+before any network call — fails even faster. The aim is to make fabricated
+citations fail CI before they reach a reader.
+
+## Verification boundary
+
+**"Verified" means**: the work exists in CrossRef/OpenAlex/OpenLibrary and its
+recorded metadata (title, first author) agrees with what your bibliography
+says. That is a necessary check, not a sufficient one.
+
+**bibcheck does not check** whether the cited source supports the claim your
+prose is making. That is a human judgment, and bibcheck surfaces it as a manual
+worklist item (`notCheckedFor: ["claim-support"]` in the JSON output). The
+worklist is the bridge between automated and manual verification.
+
+There are no numeric confidence scores anywhere in bibcheck's output. The
+output carries a defined evidence vocabulary (`exists-metadata-match`,
+`exists-metadata-mismatch`, `absent`, `unverifiable`) so downstream consumers
+— including LLM agents — cannot read `"verified"` as "the citation's claim is
+sound."
+
+## What it does
+
+- **Existence verification (default-gating).** For each bibliography entry,
+  checks DOI/ISBN/title against CrossRef, OpenAlex, and OpenLibrary. Absence
+  from all applicable databases is treated as a fabrication signal and fails
+  `bibcheck check` by default.
+- **Identifier well-formedness (default-gating, pre-network).** Validates DOI
+  structure, ISBN check digits, and URL scheme locally, before any network
+  call. A malformed identifier short-circuits the existence lookup and is a
+  strong, cheap fabrication signal.
+- **Canonical-edition URL verification.** For pre-DOI primary sources, checks
+  that each entry carries a `url:` pointing to a trusted canonical-edition host
+  (HathiTrust, Internet Archive, Liberty Fund OLL, Stanford Encyclopedia of
+  Philosophy archives, PhilPapers, national-library catalogues) and that the
+  URL is live.
+- **Pandoc-citeproc-style linkage check.** Every `@citekey` reference in your
+  markdown documents resolves to an entry in the bibliography (handling the
+  full citation grammar — `[@a; @b, p. 5]`, author-suppression `-@key`,
+  locators). Deterministic CI-safe alternative to `pandoc --citeproc`'s
+  render-time warning. Also flags **orphaned entries** — bibliography entries
+  never cited in any document — as an informational (non-gating) signal that an
+  LLM may have padded the reference list.
+- **Structured human-triage worklist.** Emits manual-verification items —
+  direct quotations, page-cited paraphrases, citations to contested-coverage
+  source types, non-canonical editions — with pre-filled verification URLs and
+  explicit `notCheckedFor: ["claim-support"]` annotations.
+- **Versioned structured output.** JSON / Markdown / SARIF, schema versioned at
+  `0.3.0`. Designed for LLM agents, CI pipelines, and editor extensions.
+
+bibcheck also exposes an **opt-in phrase denylist** (`bibcheck phrases`): a
+regex pass over prose against patterns the project supplies via
+`[phrases] file = "..."` in `bibcheck.toml`. Useful for style-guide
+deprecations, retracted-source wording, or in-house terminology drift.
+bibcheck does not ship a curated baseline — the feature is a configurable
+lint, not curated guidance. Acknowledge an intentional match with
+`<!-- bibcheck-allow: <key> -->` in the prose.
+
+## What it does not do
+
+- Render bibliography output. Use `pandoc --citeproc` or `citation-js` directly.
+- Take PDF input. Use FiCi / ValiRef / cite_verify_cli for that.
+- Verify quotation wording or whether the cited source supports the prose's
+  claim. This is surfaced as a manual worklist item, not automated.
+- Run without a network connection. bibcheck requires internet access to
+  perform existence checks. See [docs/usage.md](docs/usage.md) for the failure
+  mode.
+- Edit bibliography or docs. Reports findings; does not modify files.
+
+## Internet required
+
+bibcheck requires a live internet connection to verify existence. Running
+without network access produces a clear error (transport failure logged
+against affected entries); it does not silently degrade to "unverifiable."
+
+## Status
+
+v0.1. All seven subcommands are implemented. The output schema is at `0.3.0`.
+See [docs/usage.md](docs/usage.md) for usage and
+[docs/output-schema.md](docs/output-schema.md) for the JSON contract.
+
+## Documentation
+
+- [docs/usage.md](docs/usage.md) — installation, quick start, subcommands, CI
+  integration, exit codes, suppression workflow.
+- [docs/configuration.md](docs/configuration.md) — full `bibcheck.toml`
+  reference including gating rules and per-entry suppression.
+- [docs/output-schema.md](docs/output-schema.md) — JSON output schema contract
+  for downstream consumers (schema `0.3.0`).
+- [docs/extending.md](docs/extending.md) — adding database clients, output
+  formats, and subcommands.
+- [SECURITY.md](SECURITY.md) — security policy, data handling, and
+  vulnerability reporting.
+- [RELEASING.md](RELEASING.md) — maintainer release checklist including
+  OIDC/npm Trusted Publishing notes.
+
+## Development
+
+```sh
+npm install
+npm run build       # compile TypeScript to dist/
+npm test            # run vitest
+npm run typecheck   # tsc --noEmit
+```
+
+## License
+
+[MIT](LICENSE).

package/dist/cache/fs-cache.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Filesystem-backed TTL cache for external API responses.
+ *
+ * Uses keyv + keyv-file for persistence. Every stored value is wrapped in an
+ * envelope that carries a schema version and an explicit expiresAt timestamp so
+ * that version mismatches and TTL expiry are enforced independently of keyv's
+ * own TTL mechanism. This lets us invalidate the entire cache by bumping the
+ * version constant without touching the backing file.
+ *
+ * Known limitation: two concurrent bibcheck runs writing to the same cache
+ * directory race on the underlying JSON file. keyv-file uses a write-delay
+ * debounce rather than an atomic rename, so the last writer wins. This is
+ * acceptable for v0.1; a future task may add file locking.
+ */
+export interface Logger {
+    warn(event: string, ctx?: Record<string, unknown>): void;
+}
+export interface Cache {
+    get<T>(key: string, signal?: AbortSignal): Promise<T | null>;
+    set<T>(key: string, value: T, opts?: {
+        ttlMs?: number;
+    }): Promise<void>;
+    invalidate(key: string): Promise<void>;
+    clear(): Promise<void>;
+}
+export interface FsCacheOptions {
+    /** Base directory for the cache file. Created on first write. */
+    dir: string;
+    /** Default TTL in milliseconds. Defaults to 30 days. */
+    defaultTtlMs?: number;
+    /** Maximum total size of the cache file in megabytes. null = unlimited. */
+    maxSizeMb?: number | null;
+    /** Injectable clock for deterministic tests. */
+    clock?: {
+        now(): number;
+    };
+    /** Cache schema version. Bumping this invalidates all existing entries. */
+    version?: string;
+    /** Optional logger for operational warnings. */
+    logger?: Logger;
+}
+export declare class CacheError extends Error {
+    name: "CacheError";
+    constructor(message: string, options?: ErrorOptions);
+}
+export declare function createFsCache(opts: FsCacheOptions): Cache;
+export declare function createMemoryCache(opts?: {
+    defaultTtlMs?: number;
+    clock?: {
+        now(): number;
+    };
+}): Cache;
+/** Remove all files inside a cache directory (not the directory itself). */
+export declare function clearCacheDir(dir: string): Promise<void>;
+//# sourceMappingURL=fs-cache.d.ts.map

package/dist/cache/fs-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs-cache.d.ts","sourceRoot":"","sources":["../../src/cache/fs-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAaH,MAAM,WAAW,MAAM;IACrB,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC1D;AAMD,MAAM,WAAW,KAAK;IACpB,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC7D,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAMD,MAAM,WAAW,cAAc;IAC7B,iEAAiE;IACjE,GAAG,EAAE,MAAM,CAAC;IACZ,wDAAwD;IACxD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,gDAAgD;IAChD,KAAK,CAAC,EAAE;QAAE,GAAG,IAAI,MAAM,CAAA;KAAE,CAAC;IAC1B,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gDAAgD;IAChD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAMD,qBAAa,UAAW,SAAQ,KAAK;IAC1B,IAAI,EAAG,YAAY,CAAU;gBAC1B,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY;CAGpD;AA6BD,wBAAgB,aAAa,CAAC,IAAI,EAAE,cAAc,GAAG,KAAK,CAuGzD;AA2GD,wBAAgB,iBAAiB,CAAC,IAAI,CAAC,EAAE;IACvC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE;QAAE,GAAG,IAAI,MAAM,CAAA;KAAE,CAAC;CAC3B,GAAG,KAAK,CAiCR;AAMD,4EAA4E;AAC5E,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAU9D"}

package/dist/cache/fs-cache.js

@@ -0,0 +1,264 @@
+/**
+ * Filesystem-backed TTL cache for external API responses.
+ *
+ * Uses keyv + keyv-file for persistence. Every stored value is wrapped in an
+ * envelope that carries a schema version and an explicit expiresAt timestamp so
+ * that version mismatches and TTL expiry are enforced independently of keyv's
+ * own TTL mechanism. This lets us invalidate the entire cache by bumping the
+ * version constant without touching the backing file.
+ *
+ * Known limitation: two concurrent bibcheck runs writing to the same cache
+ * directory race on the underlying JSON file. keyv-file uses a write-delay
+ * debounce rather than an atomic rename, so the last writer wins. This is
+ * acceptable for v0.1; a future task may add file locking.
+ */
+import { createHash } from 'node:crypto';
+import { stat, readFile, readdir, rm } from 'node:fs/promises';
+import path from 'node:path';
+import { Keyv } from 'keyv';
+import { KeyvFile } from 'keyv-file';
+// ---------------------------------------------------------------------------
+// Error
+// ---------------------------------------------------------------------------
+export class CacheError extends Error {
+    name = 'CacheError';
+    constructor(message, options) {
+        super(message, options);
+    }
+}
+// ---------------------------------------------------------------------------
+// Internal types
+// ---------------------------------------------------------------------------
+const DEFAULT_TTL_MS = 30 * 24 * 60 * 60 * 1000; // 30 days
+const DEFAULT_VERSION = '1';
+function hashKey(key) {
+    return createHash('sha256').update(key).digest('hex');
+}
+function checkAbort(signal) {
+    if (signal?.aborted === true) {
+        throw signal.reason;
+    }
+}
+// ---------------------------------------------------------------------------
+// createFsCache
+// ---------------------------------------------------------------------------
+export function createFsCache(opts) {
+    const { dir, defaultTtlMs = DEFAULT_TTL_MS, maxSizeMb = null, clock = { now: () => Date.now() }, version = DEFAULT_VERSION, logger, } = opts;
+    const filename = path.join(dir, 'cache.json');
+    const store = new KeyvFile({ filename, writeDelay: 0 });
+    const keyv = new Keyv({ store, useKeyPrefix: false });
+    async function get(key, signal) {
+        checkAbort(signal);
+        const hash = hashKey(key);
+        let raw;
+        try {
+            raw = await keyv.get(hash);
+        }
+        catch (err) {
+            logger?.warn('cache.get.error', { key, error: String(err) });
+            return null;
+        }
+        if (raw === undefined || raw === null) {
+            return null;
+        }
+        // Validate envelope shape — if keyv-file holds corrupt/non-envelope data,
+        // treat it as a miss and clean up.
+        if (!isEnvelope(raw)) {
+            logger?.warn('cache.corrupt', { key });
+            await keyv.delete(hash).catch(() => undefined);
+            return null;
+        }
+        const envelope = raw;
+        if (envelope.version !== version) {
+            logger?.warn('cache.version_mismatch', {
+                key,
+                stored: envelope.version,
+                expected: version,
+            });
+            await keyv.delete(hash).catch(() => undefined);
+            return null;
+        }
+        if (clock.now() > envelope.expiresAt) {
+            await keyv.delete(hash).catch(() => undefined);
+            return null;
+        }
+        return envelope.value;
+    }
+    async function set(key, value, setOpts) {
+        checkAbort(undefined);
+        const ttlMs = setOpts?.ttlMs ?? defaultTtlMs;
+        const hash = hashKey(key);
+        const expiresAt = clock.now() + ttlMs;
+        const envelope = { version, value, expiresAt };
+        try {
+            // Pass ttlMs to keyv so it can handle native expiry via keyv-file; our
+            // envelope's expiresAt is the authoritative TTL guard on read.
+            await keyv.set(hash, envelope, ttlMs);
+        }
+        catch (err) {
+            throw new CacheError(`Failed to write cache entry for key "${key}"`, { cause: err });
+        }
+        // LRU-style size eviction: simple "if over cap, clear half" sweep.
+        // A proper LRU would track access order; for v0.1 we just evict the
+        // oldest half by expiresAt when the file exceeds maxSizeMb.
+        if (maxSizeMb !== null && maxSizeMb > 0) {
+            await maybeSweep(filename, maxSizeMb, keyv, clock);
+        }
+    }
+    async function invalidate(key) {
+        checkAbort(undefined);
+        const hash = hashKey(key);
+        try {
+            await keyv.delete(hash);
+        }
+        catch (err) {
+            throw new CacheError(`Failed to invalidate cache entry for key "${key}"`, { cause: err });
+        }
+    }
+    async function clear() {
+        try {
+            await keyv.clear();
+        }
+        catch (err) {
+            throw new CacheError('Failed to clear cache', { cause: err });
+        }
+    }
+    return { get, set, invalidate, clear };
+}
+// ---------------------------------------------------------------------------
+// Size eviction helper
+// ---------------------------------------------------------------------------
+async function maybeSweep(filename, maxSizeMb, keyv, clock) {
+    let fileStat;
+    try {
+        fileStat = await stat(filename);
+    }
+    catch {
+        // File not yet written; nothing to sweep.
+        return;
+    }
+    const sizeMb = fileStat.size / (1024 * 1024);
+    if (sizeMb <= maxSizeMb) {
+        return;
+    }
+    // Collect all entries and sort oldest-first by expiresAt; evict the bottom
+    // half.  Simple strategy: O(n) scan, O(n log n) sort, O(n/2) deletes.
+    //
+    // We read the backing JSON file directly because keyv-file's iterator
+    // filters by namespace, which conflicts with useKeyPrefix:false (our keys
+    // are raw SHA-256 hashes and never contain the 'keyv' namespace token).
+    const entries = [];
+    try {
+        const raw = await readFile(filename, 'utf8');
+        // keyv-file serialises the store as { cache: [[key, wrappedValue], ...], lastExpire: number }.
+        const parsed = JSON.parse(raw);
+        if (typeof parsed === 'object' &&
+            parsed !== null &&
+            Array.isArray(parsed['cache'])) {
+            for (const item of parsed['cache']) {
+                if (!Array.isArray(item) || item.length < 2)
+                    continue;
+                const [key, wrapped] = item;
+                if (typeof key !== 'string')
+                    continue;
+                // keyv-file wraps values as { value: serialised-string, expire?: number }
+                // The inner 'value' is a JSON string produced by @keyv/serialize.
+                let innerValue = null;
+                if (typeof wrapped === 'object' &&
+                    wrapped !== null &&
+                    'value' in wrapped) {
+                    const wv = wrapped['value'];
+                    if (typeof wv === 'string') {
+                        try {
+                            const decoded = JSON.parse(wv);
+                            // @keyv/serialize wraps as { value: actualData, expires?: number }
+                            innerValue = decoded['value'] ?? decoded;
+                        }
+                        catch {
+                            innerValue = wv;
+                        }
+                    }
+                    else {
+                        innerValue = wv;
+                    }
+                }
+                if (isEnvelope(innerValue)) {
+                    entries.push({ key, expiresAt: innerValue.expiresAt });
+                }
+                else {
+                    entries.push({ key, expiresAt: clock.now() - 1 });
+                }
+            }
+        }
+    }
+    catch {
+        // Parse or read failure; skip sweep.
+        return;
+    }
+    if (entries.length === 0)
+        return;
+    entries.sort((a, b) => a.expiresAt - b.expiresAt);
+    const evictCount = Math.max(1, Math.floor(entries.length / 2));
+    const toEvict = entries.slice(0, evictCount);
+    for (const { key } of toEvict) {
+        await keyv.delete(key).catch(() => undefined);
+    }
+}
+// ---------------------------------------------------------------------------
+// Type guard for stored envelopes
+// ---------------------------------------------------------------------------
+function isEnvelope(val) {
+    if (typeof val !== 'object' || val === null)
+        return false;
+    const v = val;
+    return (typeof v['version'] === 'string' &&
+        typeof v['expiresAt'] === 'number' &&
+        'value' in v);
+}
+// ---------------------------------------------------------------------------
+// createMemoryCache
+// ---------------------------------------------------------------------------
+export function createMemoryCache(opts) {
+    const defaultTtlMs = opts?.defaultTtlMs ?? DEFAULT_TTL_MS;
+    const clock = opts?.clock ?? { now: () => Date.now() };
+    const store = new Map();
+    async function get(key, signal) {
+        checkAbort(signal);
+        const entry = store.get(key);
+        if (entry === undefined)
+            return null;
+        if (clock.now() > entry.expiresAt) {
+            store.delete(key);
+            return null;
+        }
+        return entry.value;
+    }
+    async function set(key, value, setOpts) {
+        checkAbort(undefined);
+        const ttlMs = setOpts?.ttlMs ?? defaultTtlMs;
+        store.set(key, { value, expiresAt: clock.now() + ttlMs });
+    }
+    async function invalidate(key) {
+        checkAbort(undefined);
+        store.delete(key);
+    }
+    async function clear() {
+        store.clear();
+    }
+    return { get, set, invalidate, clear };
+}
+// ---------------------------------------------------------------------------
+// Re-export dir cleanup helper for tests
+// ---------------------------------------------------------------------------
+/** Remove all files inside a cache directory (not the directory itself). */
+export async function clearCacheDir(dir) {
+    let entries;
+    try {
+        entries = await readdir(dir);
+    }
+    catch {
+        return;
+    }
+    await Promise.all(entries.map((entry) => rm(path.join(dir, entry), { recursive: true, force: true })));
+}
+//# sourceMappingURL=fs-cache.js.map

package/dist/cache/fs-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs-cache.js","sourceRoot":"","sources":["../../src/cache/fs-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAyCrC,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAE9E,MAAM,OAAO,UAAW,SAAQ,KAAK;IAC1B,IAAI,GAAG,YAAqB,CAAC;IACtC,YAAY,OAAe,EAAE,OAAsB;QACjD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1B,CAAC;CACF;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,UAAU;AAC3D,MAAM,eAAe,GAAG,GAAG,CAAC;AAQ5B,SAAS,OAAO,CAAC,GAAW;IAC1B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,UAAU,CAAC,MAA+B;IACjD,IAAI,MAAM,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;QAC7B,MAAM,MAAM,CAAC,MAAe,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,MAAM,UAAU,aAAa,CAAC,IAAoB;IAChD,MAAM,EACJ,GAAG,EACH,YAAY,GAAG,cAAc,EAC7B,SAAS,GAAG,IAAI,EAChB,KAAK,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,EACjC,OAAO,GAAG,eAAe,EACzB,MAAM,GACP,GAAG,IAAI,CAAC;IAET,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAE9C,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IAEtD,KAAK,UAAU,GAAG,CAAI,GAAW,EAAE,MAAoB;QACrD,UAAU,CAAC,MAAM,CAAC,CAAC;QAEnB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAU,IAAI,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,EAAE,IAAI,CAAC,iBAAiB,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC7D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,0EAA0E;QAC1E,mCAAmC;QACnC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YACvC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC/C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,CAAC;QAErB,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YACjC,MAAM,EAAE,IAAI,CAAC,wBAAwB,EAAE;gBACrC,GAAG;gBACH,MAAM,EAAE,QAAQ,CAAC,OAAO;gBACxB,QAAQ,EAAE,OAAO;aAClB,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC/C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,KAAK,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC/C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,QAAQ,CAAC,KAAU,CAAC;IAC7B,CAAC;IAED,KAAK,UAAU,GAAG,CAAI,GAAW,EAAE,KAAQ,EAAE,OAA4B;QACvE,UAAU,CAAC,SAAS,CAAC,CAAC;QAEtB,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,YAAY,CAAC;QAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QAEtC,MAAM,QAAQ,GAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAEzD,IAAI,CAAC;YACH,uEAAuE;YACvE,+DAA+D;YAC/D,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,UAAU,CAAC,wCAAwC,GAAG,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvF,CAAC;QAED,mEAAmE;QACnE,oEAAoE;QACpE,4DAA4D;QAC5D,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YACxC,MAAM,UAAU,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,KAAK,UAAU,UAAU,CAAC,GAAW;QACnC,UAAU,CAAC,SAAS,CAAC,CAAC;QACtB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,UAAU,CAAC,6CAA6C,GAAG,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IAED,KAAK,UAAU,KAAK;QAClB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,UAAU,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AACzC,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,KAAK,UAAU,UAAU,CACvB,QAAgB,EAChB,SAAiB,EACjB,IAAU,EACV,KAAwB;IAExB,IAAI,QAA0C,CAAC;IAC/C,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,0CAA0C;QAC1C,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAC7C,IAAI,MAAM,IAAI,SAAS,EAAE,CAAC;QACxB,OAAO;IACT,CAAC;IAED,2EAA2E;IAC3E,sEAAsE;IACtE,EAAE;IACF,sEAAsE;IACtE,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,OAAO,GAA8C,EAAE,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC7C,+FAA+F;QAC/F,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IACE,OAAO,MAAM,KAAK,QAAQ;YAC1B,MAAM,KAAK,IAAI;YACf,KAAK,CAAC,OAAO,CAAE,MAAkC,CAAC,OAAO,CAAC,CAAC,EAC3D,CAAC;YACD,KAAK,MAAM,IAAI,IAAK,MAA+B,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;oBAAE,SAAS;gBACtD,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,IAA0B,CAAC;gBAClD,IAAI,OAAO,GAAG,KAAK,QAAQ;oBAAE,SAAS;gBACtC,0EAA0E;gBAC1E,kEAAkE;gBAClE,IAAI,UAAU,GAAY,IAAI,CAAC;gBAC/B,IACE,OAAO,OAAO,KAAK,QAAQ;oBAC3B,OAAO,KAAK,IAAI;oBAChB,OAAO,IAAK,OAAmC,EAC/C,CAAC;oBACD,MAAM,EAAE,GAAI,OAAmC,CAAC,OAAO,CAAC,CAAC;oBACzD,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;wBAC3B,IAAI,CAAC;4BACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAA4B,CAAC;4BAC1D,mEAAmE;4BACnE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC;wBAC3C,CAAC;wBAAC,MAAM,CAAC;4BACP,UAAU,GAAG,EAAE,CAAC;wBAClB,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,UAAU,GAAG,EAAE,CAAC;oBAClB,CAAC;gBACH,CAAC;gBACD,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC3B,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;gBACzD,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qCAAqC;QACrC,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEjC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAE7C,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,OAAO,EAAE,CAAC;QAC9B,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,kCAAkC;AAClC,8EAA8E;AAE9E,SAAS,UAAU,CAAC,GAAY;IAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,OAAO,CACL,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ;QAChC,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,QAAQ;QAClC,OAAO,IAAI,CAAC,CACb,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,MAAM,UAAU,iBAAiB,CAAC,IAGjC;IACC,MAAM,YAAY,GAAG,IAAI,EAAE,YAAY,IAAI,cAAc,CAAC;IAC1D,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IAEvD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAiD,CAAC;IAEvE,KAAK,UAAU,GAAG,CAAI,GAAW,EAAE,MAAoB;QACrD,UAAU,CAAC,MAAM,CAAC,CAAC;QACnB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACrC,IAAI,KAAK,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;YAClC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC,KAAU,CAAC;IAC1B,CAAC;IAED,KAAK,UAAU,GAAG,CAAI,GAAW,EAAE,KAAQ,EAAE,OAA4B;QACvE,UAAU,CAAC,SAAS,CAAC,CAAC;QACtB,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,YAAY,CAAC;QAC7C,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,UAAU,UAAU,CAAC,GAAW;QACnC,UAAU,CAAC,SAAS,CAAC,CAAC;QACtB,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IAED,KAAK,UAAU,KAAK;QAClB,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AACzC,CAAC;AAED,8EAA8E;AAC9E,yCAAyC;AACzC,8EAA8E;AAE9E,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW;IAC7C,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,MAAM,OAAO,CAAC,GAAG,CACf,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CACpF,CAAC;AACJ,CAAC"}

package/dist/canonical.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Canonical-edition URL verification subcommand.
+ *
+ * For each bibliography entry that lacks a DOI or ISBN (pre-DOI primary
+ * sources), verifies that the entry's `url` field points to a trusted
+ * canonical-edition host and that the URL is live.
+ *
+ * Injects `headCheck` for testability; defaults to the real implementation.
+ */
+import { headCheck as defaultHeadCheck } from './http.js';
+import type { HttpClient } from './http.js';
+import type { Cache } from './cache/fs-cache.js';
+import type { CslEntry } from './schema/csl.js';
+import type { Entry } from './schema/output.js';
+import type { Config } from './config.js';
+export interface RunCanonicalDeps {
+    config: Config;
+    bibliography: CslEntry[];
+    http: HttpClient;
+    cache?: Cache;
+    signal: AbortSignal;
+    /** Injectable for tests; defaults to the real headCheck from ./http.js */
+    headCheck?: typeof defaultHeadCheck;
+}
+export interface RunCanonicalResult {
+    entries: Array<Pick<Entry, 'citekey' | 'canonical'>>;
+}
+export declare function runCanonical(deps: RunCanonicalDeps): Promise<RunCanonicalResult>;
+//# sourceMappingURL=canonical.d.ts.map

package/dist/canonical.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.d.ts","sourceRoot":"","sources":["../src/canonical.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,SAAS,IAAI,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,KAAK,EAAE,KAAK,EAAkB,MAAM,oBAAoB,CAAC;AAChE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAoD1C,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,QAAQ,EAAE,CAAC;IACzB,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,MAAM,EAAE,WAAW,CAAC;IACpB,0EAA0E;IAC1E,SAAS,CAAC,EAAE,OAAO,gBAAgB,CAAC;CACrC;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC;CACtD;AAMD,wBAAsB,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAoBtF"}

package/dist/canonical.js

@@ -0,0 +1,132 @@
+/**
+ * Canonical-edition URL verification subcommand.
+ *
+ * For each bibliography entry that lacks a DOI or ISBN (pre-DOI primary
+ * sources), verifies that the entry's `url` field points to a trusted
+ * canonical-edition host and that the URL is live.
+ *
+ * Injects `headCheck` for testability; defaults to the real implementation.
+ */
+import { headCheck as defaultHeadCheck } from './http.js';
+// ---------------------------------------------------------------------------
+// Edition-discipline host mapping (v0.1 compile-time inline)
+// ---------------------------------------------------------------------------
+const CANONICAL_EDITION_HOSTS = {
+    'akademie-ausgabe': ['korpora.zim.uni-duisburg-essen.de', 'archive.org'],
+    'glasgow': ['oll.libertyfund.org'],
+    'clarendon': ['oll.libertyfund.org', 'global.oup.com'],
+    'toronto-cw': ['oll.libertyfund.org'],
+};
+/**
+ * Detect a canonical-edition signal in a note string. Returns the edition key
+ * or null if no known signal is found.
+ */
+function detectEdition(note) {
+    if (/Ak\.\s*[IVXLCDM]+/i.test(note) || /Akademie-Ausgabe/i.test(note)) {
+        return 'akademie-ausgabe';
+    }
+    if (/Glasgow\s+(WN|TMS|LJ)/i.test(note) || /Glasgow Edition/i.test(note)) {
+        return 'glasgow';
+    }
+    if (/Clarendon Edition/i.test(note)) {
+        return 'clarendon';
+    }
+    if (/Toronto\s+CW/i.test(note) || /Collected\s+Works\s+of\s+John\s+Stuart\s+Mill/i.test(note)) {
+        return 'toronto-cw';
+    }
+    return null;
+}
+/**
+ * Return true if `host` is among the allowed hosts for the given edition
+ * (suffix matching: `archive.org` matches `web.archive.org`).
+ */
+function isEditionHostAllowed(host, allowedHosts) {
+    const h = host.toLowerCase();
+    for (const allowed of allowedHosts) {
+        const lw = allowed.toLowerCase();
+        if (h === lw || h.endsWith('.' + lw))
+            return true;
+    }
+    return false;
+}
+// ---------------------------------------------------------------------------
+// runCanonical
+// ---------------------------------------------------------------------------
+export async function runCanonical(deps) {
+    const { config, bibliography, http, cache, signal } = deps;
+    const doHeadCheck = deps.headCheck ?? defaultHeadCheck;
+    if (signal.aborted) {
+        throw signal.reason;
+    }
+    const results = [];
+    for (const entry of bibliography) {
+        if (signal.aborted) {
+            throw signal.reason;
+        }
+        const canonical = await processEntry(entry, config, http, cache, signal, doHeadCheck);
+        results.push({ citekey: entry.citekey, canonical });
+    }
+    return { entries: results };
+}
+// ---------------------------------------------------------------------------
+// Per-entry processing
+// ---------------------------------------------------------------------------
+async function processEntry(entry, config, http, cache, signal, doHeadCheck) {
+    // Step 1: applicability check
+    if (entry.doi !== undefined || entry.isbn !== undefined) {
+        return { status: 'not-applicable', url: entry.url ?? null };
+    }
+    // Step 2: no-URL case
+    if (entry.url === undefined) {
+        return { status: 'no-url-on-pre-doi-entry', url: null };
+    }
+    const url = entry.url;
+    // Step 3: URL liveness via headCheck (per-entry errors are caught)
+    let checkResult;
+    try {
+        checkResult = await doHeadCheck(url, {
+            http,
+            cache,
+            trustedHosts: config.trusted_hosts.hosts,
+        }, signal);
+    }
+    catch (err) {
+        // AbortSignal abort — rethrow so the entire run aborts
+        if (signal.aborted)
+            throw err;
+        // Any other unexpected error → dead-url
+        return { status: 'dead-url', url, redirectChain: [] };
+    }
+    if (!checkResult.ok) {
+        switch (checkResult.reason) {
+            case 'wrong-host':
+                return { status: 'wrong-host', url, redirectChain: [] };
+            case 'dead-url':
+            case 'too-many-redirects':
+            case 'timeout':
+            case 'network-error':
+                return { status: 'dead-url', url, redirectChain: [] };
+        }
+    }
+    // checkResult.ok === true
+    const { finalUrl, redirectChain, host } = checkResult;
+    // Step 4: SEP archived-snapshot rule
+    if (host === 'plato.stanford.edu') {
+        if (!finalUrl.includes('/archives/')) {
+            return { status: 'live-url-not-archived-snapshot', url: finalUrl, redirectChain };
+        }
+    }
+    // Step 5: Edition-discipline check
+    if (entry.note !== undefined) {
+        const edition = detectEdition(entry.note);
+        if (edition !== null) {
+            const allowedHosts = CANONICAL_EDITION_HOSTS[edition];
+            if (allowedHosts !== undefined && !isEditionHostAllowed(host, allowedHosts)) {
+                return { status: 'wrong-host', url: finalUrl, redirectChain };
+            }
+        }
+    }
+    // Step 6: verified canonical
+    return { status: 'verified-canonical', url: finalUrl, redirectChain };
+}
+//# sourceMappingURL=canonical.js.map