@linkforty/core 1.25.3 → 1.26.0

package/dist/lib/launchpad.test.js

@@ -0,0 +1,200 @@
+import { describe, it, expect } from 'vitest';
+import { defaultLaunchpadContent, launchpadContentSecurityPolicy, readLaunchpadLinkMode, readLaunchpadSettings, renderLaunchpadPage, shouldServeLaunchpadOnDesktop, } from './launchpad.js';
+describe('shouldServeLaunchpadOnDesktop', () => {
+    /** The full decision table: link mode × workspace mode × whether a destination exists. */
+    const table = [
+        ['defaults, no destination → page', { hasWebDestination: false }, true],
+        ['defaults, destination → redirect', { hasWebDestination: true }, false],
+        ['org always, destination → page', { hasWebDestination: true, orgMode: 'always' }, true],
+        ['org off, no destination → plain page', { hasWebDestination: false, orgMode: 'off' }, false],
+        ['org no-destination, destination → redirect', { hasWebDestination: true, orgMode: 'no-destination' }, false],
+        ['link on beats org default', { hasWebDestination: true, linkMode: 'on' }, true],
+        ['link on beats org off', { hasWebDestination: false, orgMode: 'off', linkMode: 'on' }, true],
+        ['link off beats org always', { hasWebDestination: true, orgMode: 'always', linkMode: 'off' }, false],
+        ['link off beats no destination', { hasWebDestination: false, linkMode: 'off' }, false],
+        ['link inherit follows org', { hasWebDestination: true, orgMode: 'always', linkMode: 'inherit' }, true],
+    ];
+    for (const [name, input, expected] of table) {
+        it(name, () => expect(shouldServeLaunchpadOnDesktop(input)).toBe(expected));
+    }
+});
+describe('readLaunchpadSettings', () => {
+    it('returns {} for anything that is not a settings object', () => {
+        expect(readLaunchpadSettings(null)).toEqual({});
+        expect(readLaunchpadSettings({})).toEqual({});
+        expect(readLaunchpadSettings({ launchpad: 'always' })).toEqual({});
+    });
+    it('keeps known values and drops the rest', () => {
+        expect(readLaunchpadSettings({
+            launchpad: {
+                desktop: 'always',
+                mobile: 'page',
+                appName: '  Demo App  ',
+                appIconUrl: 'https://cdn.example/icon.png',
+                accentColor: '#ff8800',
+                templateId: 'hero',
+                extra: 'ignored',
+            },
+        })).toEqual({
+            desktop: 'always',
+            mobile: 'page',
+            appName: 'Demo App',
+            appIconUrl: 'https://cdn.example/icon.png',
+            accentColor: '#ff8800',
+            templateId: 'hero',
+        });
+    });
+    it('rejects an unknown mode, a non-hex colour and a non-http icon', () => {
+        expect(readLaunchpadSettings({
+            launchpad: { desktop: 'sometimes', mobile: 42, accentColor: 'red', appIconUrl: 'javascript:alert(1)' },
+        })).toEqual({});
+    });
+});
+describe('readLaunchpadLinkMode', () => {
+    it('normalises anything unexpected to inherit', () => {
+        expect(readLaunchpadLinkMode('on')).toBe('on');
+        expect(readLaunchpadLinkMode('off')).toBe('off');
+        expect(readLaunchpadLinkMode(undefined)).toBe('inherit');
+        expect(readLaunchpadLinkMode('always')).toBe('inherit');
+    });
+});
+describe('defaultLaunchpadContent', () => {
+    it('prefers og fields, then plain fields, then the app name, then a constant', () => {
+        expect(defaultLaunchpadContent({ og_title: 'OG', title: 'T' }, {}).title).toBe('OG');
+        expect(defaultLaunchpadContent({ title: 'T' }, {}).title).toBe('T');
+        expect(defaultLaunchpadContent({}, { appName: 'Demo' }).title).toBe('Demo');
+        expect(defaultLaunchpadContent({}, {}).title).toBe('Open in the app');
+        expect(defaultLaunchpadContent({ og_description: 'D1', description: 'D2' }, {}).description).toBe('D1');
+    });
+    it('drops a non-http image', () => {
+        expect(defaultLaunchpadContent({ og_image_url: 'data:image/png;base64,AAAA' }, {}).imageUrl).toBeNull();
+        expect(defaultLaunchpadContent({ og_image_url: 'https://cdn.example/a.png' }, {}).imageUrl).toBe('https://cdn.example/a.png');
+    });
+});
+describe('launchpadContentSecurityPolicy', () => {
+    it('nonces scripts, allows inline styles, and forbids everything else by default', () => {
+        const csp = launchpadContentSecurityPolicy('abc');
+        expect(csp).toContain("default-src 'none'");
+        expect(csp).toContain("script-src 'nonce-abc'");
+        expect(csp).toContain("style-src 'unsafe-inline'");
+        expect(csp).toContain("connect-src 'self'");
+        expect(csp).toContain("base-uri 'none'");
+        expect(csp).toContain("form-action 'none'");
+    });
+    it('admits an absolute beacon origin in connect-src', () => {
+        expect(launchpadContentSecurityPolicy('abc', 'https://events.example/v1/lp')).toContain("connect-src 'self' https://events.example");
+        expect(launchpadContentSecurityPolicy('abc', '/api/lp/event')).toContain("connect-src 'self';");
+    });
+});
+describe('renderLaunchpadPage', () => {
+    const base = {
+        content: {
+            title: 'A title',
+            description: 'A description',
+            imageUrl: 'https://cdn.example/hero.png',
+            theme: { appName: 'Demo App', appIconUrl: 'https://cdn.example/icon.png', accentColor: '#ff8800' },
+        },
+        linkId: 'link-1',
+        pageUrl: 'https://go.example/abc',
+        iosUrl: 'https://apps.apple.com/app/id1',
+        androidUrl: 'https://play.google.com/store/apps/details?id=demo',
+        schemeUrl: null,
+        showQr: true,
+        nonce: 'n0nce',
+    };
+    it('renders the head, the hero, both store buttons and the QR block', () => {
+        const html = renderLaunchpadPage(base);
+        expect(html).toContain('<title>A title</title>');
+        expect(html).toContain('<meta name="robots" content="noindex, nofollow">');
+        expect(html).toContain('<meta property="og:image" content="https://cdn.example/hero.png">');
+        expect(html).toContain('<meta name="twitter:card" content="summary_large_image">');
+        expect(html).toContain('<h1>A title</h1>');
+        expect(html).toContain('Download on the App Store');
+        expect(html).toContain('Get it on Google Play');
+        expect(html).toContain('/api/links/link-1/qr?format=svg&amp;size=264');
+        expect(html).toContain('<span>Demo App</span>');
+        expect(html).toContain('--lp-accent: #ff8800; --lp-accent-ink: #ffffff;');
+    });
+    it('ships no script when there is nothing for one to do', () => {
+        expect(renderLaunchpadPage(base)).not.toContain('<script');
+    });
+    it('renders the Open in app button with the scheme URL and the fragment-preserving script', () => {
+        const html = renderLaunchpadPage({ ...base, schemeUrl: 'demo://product/1?x=1' });
+        expect(html).toContain('id="lp-open"');
+        expect(html).toContain('data-scheme="demo://product/1?x=1"');
+        expect(html).toContain('href="demo://product/1?x=1"');
+        expect(html).toContain('<script nonce="n0nce">');
+        expect(html).toContain('window.location.hash');
+        expect(html).not.toContain('setTimeout');
+        expect(html).not.toContain('location.replace');
+    });
+    it('adds the beacon attributes and markers only when a beacon URL is set', () => {
+        const without = renderLaunchpadPage(base);
+        expect(without).not.toContain('data-beacon');
+        expect(without).not.toContain('sendBeacon');
+        const html = renderLaunchpadPage({ ...base, beaconUrl: '/api/lp/event' });
+        expect(html).toContain('data-beacon="/api/lp/event"');
+        expect(html.match(/navigator\.sendBeacon\(/g)).toHaveLength(1);
+        expect(html).toContain('data-lp-cta="cta_ios"');
+        expect(html).toContain('data-lp-cta="cta_android"');
+        expect(html).not.toContain('data-lp-cta="cta_open"');
+    });
+    it('escapes every value that reaches the document', () => {
+        const html = renderLaunchpadPage({
+            ...base,
+            content: {
+                title: `<script>alert("xss")</script> & 'q'`,
+                description: '"><img src=x onerror=alert(1)>',
+                imageUrl: 'https://cdn.example/a.png?x="y"',
+                theme: { appName: '<b>App</b>' },
+            },
+            iosUrl: 'https://apps.apple.com/app?a=1&b=2',
+            pageUrl: 'https://go.example/abc?"',
+        });
+        expect(html).not.toContain('<script>alert');
+        expect(html).not.toContain('<img src=x');
+        expect(html).toContain('&lt;script&gt;alert(&quot;xss&quot;)&lt;/script&gt; &amp; &#39;q&#39;');
+        expect(html).toContain('&quot;&gt;&lt;img src=x onerror=alert(1)&gt;');
+        expect(html).toContain('content="https://cdn.example/a.png?x=&quot;y&quot;"');
+        expect(html).toContain('href="https://apps.apple.com/app?a=1&amp;b=2"');
+        expect(html).toContain('&lt;b&gt;App&lt;/b&gt;');
+        expect(html).toContain('og:url" content="https://go.example/abc?&quot;"');
+    });
+    it('drops non-http URLs rather than rendering them', () => {
+        const html = renderLaunchpadPage({
+            ...base,
+            content: { ...base.content, imageUrl: 'javascript:alert(1)', theme: { appIconUrl: 'data:text/html,x' } },
+            iosUrl: 'javascript:alert(2)',
+            androidUrl: null,
+        });
+        expect(html).not.toContain('javascript:');
+        expect(html).not.toContain('data:text');
+        expect(html).not.toContain('Download on the App Store');
+    });
+    it('inserts heroHtml verbatim in place of the default hero', () => {
+        const html = renderLaunchpadPage({
+            ...base,
+            content: { ...base.content, heroHtml: '<div class="custom-hero"><em>rendered by host</em></div>' },
+        });
+        expect(html).toContain('<div class="custom-hero"><em>rendered by host</em></div>');
+        expect(html).not.toContain('<h1>A title</h1>');
+        // The head still carries the escaped title for the tab and the unfurl.
+        expect(html).toContain('<title>A title</title>');
+    });
+    it('omits the QR block, the icon row and the description when there is nothing to show', () => {
+        const html = renderLaunchpadPage({
+            ...base,
+            showQr: false,
+            content: { title: 'T', description: '', imageUrl: null, theme: {} },
+        });
+        expect(html).not.toContain('class="lp-qr"');
+        expect(html).not.toContain('class="lp-app"');
+        expect(html).not.toContain('meta name="description"');
+        expect(html).toContain('<meta name="twitter:card" content="summary">');
+    });
+    it('uses dark button text on a light accent', () => {
+        const html = renderLaunchpadPage({ ...base, content: { ...base.content, theme: { accentColor: '#ffe066' } } });
+        expect(html).toContain('--lp-accent: #ffe066; --lp-accent-ink: #16181d;');
+    });
+});
+//# sourceMappingURL=launchpad.test.js.map

package/dist/lib/launchpad.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"launchpad.test.js","sourceRoot":"","sources":["../../src/lib/launchpad.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,uBAAuB,EACvB,8BAA8B,EAC9B,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,EACnB,6BAA6B,GAE9B,MAAM,gBAAgB,CAAC;AAExB,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,0FAA0F;IAC1F,MAAM,KAAK,GAAkF;QAC3F,CAAC,iCAAiC,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC;QACvE,CAAC,kCAAkC,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,EAAE,KAAK,CAAC;QACxE,CAAC,gCAAgC,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,IAAI,CAAC;QACxF,CAAC,sCAAsC,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,CAAC;QAC7F,CAAC,4CAA4C,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,KAAK,CAAC;QAC7G,CAAC,2BAA2B,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC;QAChF,CAAC,uBAAuB,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC;QAC7F,CAAC,2BAA2B,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,KAAK,CAAC;QACrG,CAAC,+BAA+B,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,KAAK,CAAC;QACvF,CAAC,0BAA0B,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC;KACxG,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC;QAC5C,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,6BAA6B,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAChD,MAAM,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC9C,MAAM,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CACJ,qBAAqB,CAAC;YACpB,SAAS,EAAE;gBACT,OAAO,EAAE,QAAQ;gBACjB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,cAAc;gBACvB,UAAU,EAAE,8BAA8B;gBAC1C,WAAW,EAAE,SAAS;gBACtB,UAAU,EAAE,MAAM;gBAClB,KAAK,EAAE,SAAS;aACjB;SACF,CAAC,CACH,CAAC,OAAO,CAAC;YACR,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,8BAA8B;YAC1C,WAAW,EAAE,SAAS;YACtB,UAAU,EAAE,MAAM;SACnB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,CACJ,qBAAqB,CAAC;YACpB,SAAS,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,qBAAqB,EAAE;SACvG,CAAC,CACH,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzD,MAAM,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,CAAC,uBAAuB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrF,MAAM,CAAC,uBAAuB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpE,MAAM,CAAC,uBAAuB,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5E,MAAM,CAAC,uBAAuB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACtE,MAAM,CAAC,uBAAuB,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1G,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,MAAM,CAAC,uBAAuB,CAAC,EAAE,YAAY,EAAE,4BAA4B,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;QACxG,MAAM,CAAC,uBAAuB,CAAC,EAAE,YAAY,EAAE,2BAA2B,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAChI,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,EAAE,CAAC,8EAA8E,EAAE,GAAG,EAAE;QACtF,MAAM,GAAG,GAAG,8BAA8B,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;QAChD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;QACnD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,CAAC,8BAA8B,CAAC,KAAK,EAAE,8BAA8B,CAAC,CAAC,CAAC,SAAS,CACrF,2CAA2C,CAC5C,CAAC;QACF,MAAM,CAAC,8BAA8B,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;IAClG,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,MAAM,IAAI,GAAyB;QACjC,OAAO,EAAE;YACP,KAAK,EAAE,SAAS;YAChB,WAAW,EAAE,eAAe;YAC5B,QAAQ,EAAE,8BAA8B;YACxC,KAAK,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,8BAA8B,EAAE,WAAW,EAAE,SAAS,EAAE;SACnG;QACD,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,wBAAwB;QACjC,MAAM,EAAE,gCAAgC;QACxC,UAAU,EAAE,oDAAoD;QAChE,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,OAAO;KACf,CAAC;IAEF,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,kDAAkD,CAAC,CAAC;QAC3E,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,mEAAmE,CAAC,CAAC;QAC5F,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,0DAA0D,CAAC,CAAC;QACnF,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,8CAA8C,CAAC,CAAC;QACvE,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,iDAAiD,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uFAAuF,EAAE,GAAG,EAAE;QAC/F,MAAM,IAAI,GAAG,mBAAmB,CAAC,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACjF,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;QAC7D,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QAC/C,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QAC7C,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAE5C,MAAM,IAAI,GAAG,mBAAmB,CAAC,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC;QAC1E,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC/D,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,IAAI,GAAG,mBAAmB,CAAC;YAC/B,GAAG,IAAI;YACP,OAAO,EAAE;gBACP,KAAK,EAAE,qCAAqC;gBAC5C,WAAW,EAAE,gCAAgC;gBAC7C,QAAQ,EAAE,iCAAiC;gBAC3C,KAAK,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE;aACjC;YACD,MAAM,EAAE,oCAAoC;YAC5C,OAAO,EAAE,0BAA0B;SACpC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,uEAAuE,CAAC,CAAC;QAChG,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,8CAA8C,CAAC,CAAC;QACvE,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,qDAAqD,CAAC,CAAC;QAC9E,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,+CAA+C,CAAC,CAAC;QACxE,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,iDAAiD,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,IAAI,GAAG,mBAAmB,CAAC;YAC/B,GAAG,IAAI;YACP,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,qBAAqB,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,kBAAkB,EAAE,EAAE;YACxG,MAAM,EAAE,qBAAqB;YAC7B,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,IAAI,GAAG,mBAAmB,CAAC;YAC/B,GAAG,IAAI;YACP,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,0DAA0D,EAAE;SACnG,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,0DAA0D,CAAC,CAAC;QACnF,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAC/C,uEAAuE;QACvE,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oFAAoF,EAAE,GAAG,EAAE;QAC5F,MAAM,IAAI,GAAG,mBAAmB,CAAC;YAC/B,GAAG,IAAI;YACP,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;SACpE,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,8CAA8C,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,IAAI,GAAG,mBAAmB,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/G,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,iDAAiD,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/lib/link-safety.d.ts

@@ -9,11 +9,34 @@
  *               confirmed, this is strictly better than a hard block: a false
  *               positive still lets the visitor through, while a true positive
  *               still breaks the one-click flow a malicious link depends on.
- *   - `block` — behave as if the link does not exist.
+ *   - `block` — do not resolve.
  *
- * `block` deliberately produces the same response as an unknown short code. A
- * distinct "this link was disabled" response would confirm to whoever is probing
- * that the code was real, and would leak that its owner is under a restriction.
+ * A `block` used to be indistinguishable from an unknown short code, on the
+ * reasoning that a distinct response would confirm the code was real and leak that
+ * its owner is under a restriction.
+ *
+ * Two things were wrong with that. The secrecy was close to nil — whoever created
+ * the links already knows their own short codes, and a live link answers 302 while
+ * a dead one does not, so "real but withdrawn" was already distinguishable by the
+ * only party it was meant to be hidden from. And the response it produced was a raw
+ * JSON error, rendered on whatever branded domain the short link was served from.
+ *
+ * So a block caused by an explicit decision now answers 410 with a plain page —
+ * `blockCauseIsAbuse()` and `generateBlockedLinkHTML()` below. 410 rather than 404
+ * because the code existed and was withdrawn, which is a different fact from never
+ * having existed and is worth stating to anything reading the status.
+ *
+ * **The page says nothing about why.** It makes no claim about the link, its
+ * destination, or whoever created it. That is deliberate: a page on a short-link
+ * domain is not the place to characterise a user's content, and any claim made
+ * there would be wrong — and hard to withdraw — the first time a link is disabled
+ * in error.
+ *
+ * **The carve-out is deliberately narrow, and must stay narrow.** It applies only
+ * to an explicit disable or an owner restriction. A link that is merely inactive —
+ * expired, or switched off by the person who made it — keeps the old opaque
+ * response. Its cause is ambiguous, nobody decided anything about it, and there is
+ * nothing to say.
  */
 export type LinkSafetyOutcome = 'allow' | 'warn' | 'block';
 export interface LinkSafetyInput {
@@ -27,12 +50,55 @@ export interface LinkSafetyInput {
      * restriction simply never pass it.
      */
     ownerSuspendedAt?: Date | string | null;
+    /**
+     * Set when the link was explicitly taken out of resolution.
+     *
+     * This is the field that separates "someone decided to stop this link" from
+     * "this link is off", and the distinction carries the whole notice below. An
+     * expiry sweep sets `isActive` and leaves this null; so does a person switching
+     * their own link off. Only a deliberate removal sets it.
+     *
+     * Never infer the cause from `isActive` instead. The two disagree far more often
+     * than they agree — most inactive links in a mature deployment expired or were
+     * switched off, and none of those visitors should be told they were phished.
+     */
+    disabledAt?: Date | string | null;
+}
+/** Why a link was blocked. Only the first two are an abuse decision. */
+export type LinkBlockCause = 'owner_suspended' | 'disabled' | 'inactive';
+export interface LinkSafetyDecision {
+    outcome: LinkSafetyOutcome;
+    /** Present only when `outcome` is `block`. */
+    cause?: LinkBlockCause;
 }
 /**
- * Decide what to do with a link that was found.
+ * Whether a block cause represents a decision someone made about abuse, as opposed
+ * to a link that is simply not live.
+ *
+ * The gate for the notice. Kept as a named predicate rather than an inline
+ * comparison so there is exactly one place to look when asking "who sees this
+ * page", and so widening it is a visible edit rather than an incidental one.
+ */
+export declare function blockCauseIsAbuse(cause: LinkBlockCause | undefined): boolean;
+/**
+ * Decide what to do with a link that was found, and say why.
  *
- * Order matters: owner restriction and inactivity both beat `warn`. A link whose
- * owner is restricted must be unreachable even if it was only flagged to warn.
+ * Order matters, and it is not the same as the order of severity. Owner
+ * restriction and an explicit disable both beat `warn`: a link whose owner is
+ * restricted must be unreachable even if it was only flagged to warn.
+ *
+ * `disabled` is tested before the bare `isActive` check so that an abuse disable
+ * keeps its cause. Both set `isActive` to false in practice, and whichever is
+ * tested first wins — putting `isActive` first would silently collapse every
+ * abuse disable into `inactive` and the notice would never be served. There is a
+ * test for exactly that ordering.
+ */
+export declare function evaluateLinkSafetyDecision(input: LinkSafetyInput): LinkSafetyDecision;
+/**
+ * The outcome alone.
+ *
+ * Retained with its original signature because it is part of this package's public
+ * surface; callers that only branch on allow/warn/block need no change.
  */
 export declare function evaluateLinkSafety(input: LinkSafetyInput): LinkSafetyOutcome;
 /**
@@ -69,6 +135,29 @@ export declare function escapeHtml(value: string): string;
 export declare function generateWarningLinkHTML(destination: string, options?: {
     reportUrl?: string;
 }): string;
+/**
+ * Page served when a link was blocked by an explicit decision.
+ *
+ * Four things are deliberately absent, and each was a decision rather than an
+ * omission:
+ *
+ *  - **Any statement of why.** See BLOCKED_COPY above.
+ *  - **No way to continue.** The warning interstitial offers one because a `warn`
+ *    link is only suspected. Here there is nowhere to send anyone, and an escape
+ *    hatch would defeat the block.
+ *  - **No destination, owner, or other link detail.** The visitor is not entitled
+ *    to another party's details, and a withheld destination cannot be re-followed.
+ *  - **Next to no branding.** Whoever reads this has no relationship with whatever
+ *    is hosting the link.
+ *
+ * Takes no arguments, so nothing from the link can reach it. That is the property
+ * worth preserving: adding a parameter here is how a destination or an owner ends
+ * up rendered to a stranger. There is a test asserting the arity stays zero.
+ *
+ * No JavaScript and no external assets, so it renders on a bare redirect host and
+ * under a strict content-security policy.
+ */
+export declare function generateBlockedLinkHTML(): string;
 /**
  * Build a memoised probe for owner-restriction support.
  *

package/dist/lib/link-safety.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"link-safety.d.ts","sourceRoot":"","sources":["../../src/lib/link-safety.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;AAE3D,MAAM,WAAW,eAAe;IAC9B,yEAAyE;IACzE,QAAQ,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IAC1B,qEAAqE;IACrE,MAAM,CAAC,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC;IAC9B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC;CACzC;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,eAAe,GAAG,iBAAiB,CAK5E;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQ3D;AAED,6EAA6E;AAC7E,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOhD;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GACnC,MAAM,CA4DR;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC,CAAC;IACrD,WAAW,CAAC,EAAE,MAAM,IAAI,CAAC;CAC1B,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAkBxB"}
+{"version":3,"file":"link-safety.d.ts","sourceRoot":"","sources":["../../src/lib/link-safety.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;AAE3D,MAAM,WAAW,eAAe;IAC9B,yEAAyE;IACzE,QAAQ,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IAC1B,qEAAqE;IACrE,MAAM,CAAC,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC;IAC9B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC;IACxC;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,wEAAwE;AACxE,MAAM,MAAM,cAAc,GAAG,iBAAiB,GAAG,UAAU,GAAG,UAAU,CAAC;AAEzE,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,iBAAiB,CAAC;IAC3B,8CAA8C;IAC9C,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,cAAc,GAAG,SAAS,GAAG,OAAO,CAE5E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,eAAe,GAAG,kBAAkB,CAMrF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,eAAe,GAAG,iBAAiB,CAE5E;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQ3D;AAED,6EAA6E;AAC7E,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOhD;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GACnC,MAAM,CA4DR;AAoBD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CA+BhD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC,CAAC;IACrD,WAAW,CAAC,EAAE,MAAM,IAAI,CAAC;CAC1B,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAkBxB"}

package/dist/lib/link-safety.js

@@ -1,17 +1,46 @@
 /**
- * Decide what to do with a link that was found.
+ * Whether a block cause represents a decision someone made about abuse, as opposed
+ * to a link that is simply not live.
  *
- * Order matters: owner restriction and inactivity both beat `warn`. A link whose
- * owner is restricted must be unreachable even if it was only flagged to warn.
+ * The gate for the notice. Kept as a named predicate rather than an inline
+ * comparison so there is exactly one place to look when asking "who sees this
+ * page", and so widening it is a visible edit rather than an incidental one.
  */
-export function evaluateLinkSafety(input) {
+export function blockCauseIsAbuse(cause) {
+    return cause === 'owner_suspended' || cause === 'disabled';
+}
+/**
+ * Decide what to do with a link that was found, and say why.
+ *
+ * Order matters, and it is not the same as the order of severity. Owner
+ * restriction and an explicit disable both beat `warn`: a link whose owner is
+ * restricted must be unreachable even if it was only flagged to warn.
+ *
+ * `disabled` is tested before the bare `isActive` check so that an abuse disable
+ * keeps its cause. Both set `isActive` to false in practice, and whichever is
+ * tested first wins — putting `isActive` first would silently collapse every
+ * abuse disable into `inactive` and the notice would never be served. There is a
+ * test for exactly that ordering.
+ */
+export function evaluateLinkSafetyDecision(input) {
     if (input.ownerSuspendedAt != null)
-        return 'block';
+        return { outcome: 'block', cause: 'owner_suspended' };
+    if (input.disabledAt != null)
+        return { outcome: 'block', cause: 'disabled' };
     if (input.isActive === false)
-        return 'block';
+        return { outcome: 'block', cause: 'inactive' };
     if (input.warnAt != null)
-        return 'warn';
-    return 'allow';
+        return { outcome: 'warn' };
+    return { outcome: 'allow' };
+}
+/**
+ * The outcome alone.
+ *
+ * Retained with its original signature because it is part of this package's public
+ * surface; callers that only branch on allow/warn/block need no change.
+ */
+export function evaluateLinkSafety(input) {
+    return evaluateLinkSafetyDecision(input).outcome;
 }
 /**
  * A destination is only safe to put in an `href` if it is http(s).
@@ -120,6 +149,77 @@ export function generateWarningLinkHTML(destination, options = {}) {
 </body>
 </html>`;
 }
+/**
+ * Copy for the page, separated from the markup.
+ *
+ * A structure rather than inline strings so a translation is a data addition and
+ * not a rewrite.
+ *
+ * Deliberately states only that the link is gone. Earlier drafts explained why and
+ * told the visitor what to do if they had entered a password — useful to someone
+ * who followed a hostile link, but it puts an accusation about a user's content on
+ * a page we serve, and makes a claim that would be false the first time a link is
+ * disabled in error. Nothing here is a claim about anything.
+ */
+const BLOCKED_COPY = {
+    title: 'This link is no longer available',
+    heading: 'This link is no longer available',
+    body: 'It was removed and no longer goes anywhere.',
+};
+/**
+ * Page served when a link was blocked by an explicit decision.
+ *
+ * Four things are deliberately absent, and each was a decision rather than an
+ * omission:
+ *
+ *  - **Any statement of why.** See BLOCKED_COPY above.
+ *  - **No way to continue.** The warning interstitial offers one because a `warn`
+ *    link is only suspected. Here there is nowhere to send anyone, and an escape
+ *    hatch would defeat the block.
+ *  - **No destination, owner, or other link detail.** The visitor is not entitled
+ *    to another party's details, and a withheld destination cannot be re-followed.
+ *  - **Next to no branding.** Whoever reads this has no relationship with whatever
+ *    is hosting the link.
+ *
+ * Takes no arguments, so nothing from the link can reach it. That is the property
+ * worth preserving: adding a parameter here is how a destination or an owner ends
+ * up rendered to a stranger. There is a test asserting the arity stays zero.
+ *
+ * No JavaScript and no external assets, so it renders on a bare redirect host and
+ * under a strict content-security policy.
+ */
+export function generateBlockedLinkHTML() {
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<meta name="robots" content="noindex,nofollow">
+<title>${BLOCKED_COPY.title}</title>
+<style>
+  :root { color-scheme: light dark; }
+  body { margin:0; min-height:100vh; display:flex; align-items:center; justify-content:center;
+         background:#f6f7f8; color:#16191d; padding:24px;
+         font:16px/1.55 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,sans-serif; }
+  .card { max-width:30rem; width:100%; background:#fff; border:1px solid #e3e6ea;
+          border-radius:10px; padding:28px; text-align:center; }
+  h1 { margin:0 0 10px; font-size:1.25rem; line-height:1.3; }
+  p { margin:0; color:#5b636d; }
+  @media (prefers-color-scheme: dark) {
+    body { background:#14171a; color:#e8eaed; }
+    .card { background:#1d2126; border-color:#2c3238; }
+    p { color:#98a1ab; }
+  }
+</style>
+</head>
+<body>
+  <main class="card">
+    <h1>${BLOCKED_COPY.heading}</h1>
+    <p>${BLOCKED_COPY.body}</p>
+  </main>
+</body>
+</html>`;
+}
 /**
  * Build a memoised probe for owner-restriction support.
  *

package/dist/lib/link-safety.js.map

@@ -1 +1 @@
-{"version":3,"file":"link-safety.js","sourceRoot":"","sources":["../../src/lib/link-safety.ts"],"names":[],"mappings":"AAgCA;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAsB;IACvD,IAAI,KAAK,CAAC,gBAAgB,IAAI,IAAI;QAAE,OAAO,OAAO,CAAC;IACnD,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK;QAAE,OAAO,OAAO,CAAC;IAC7C,IAAI,KAAK,CAAC,MAAM,IAAI,IAAI;QAAE,OAAO,MAAM,CAAC;IACxC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,QAAQ,CAAC,WAAmB;IAC1C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;AACpF,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,MAAM,CAAC,KAAK,CAAC;SACjB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CACrC,WAAmB,EACnB,UAAkC,EAAE;IAEpC,MAAM,KAAK,GAAG,WAAW,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC;IACxG,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxD,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAM,cAAc,GAAG,IAAI;QACzB,CAAC,CAAC,uBAAuB,UAAU,CAAC,IAAI,CAAC,0DAA0D;QACnG,CAAC,CAAC,mGAAmG,CAAC;IACxG,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS;QAClC,CAAC,CAAC,8BAA8B,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,oDAAoD;QACjH,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBAuCgB,KAAK;;;;MAIxB,cAAc;MACd,UAAU;;;QAGR,CAAC;AACT,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAG3C;IACC,IAAI,KAAK,GAA2B,IAAI,CAAC;IACzC,OAAO,GAAG,EAAE;QACV,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,IAAI;iBACT,KAAK,CACJ;+EACqE,CACtE;iBACA,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;gBACV,MAAM,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;gBACpC,IAAI,SAAS;oBAAE,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBACpC,OAAO,SAAS,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,CAAC,CAAC;iBACD,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACrB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"link-safety.js","sourceRoot":"","sources":["../../src/lib/link-safety.ts"],"names":[],"mappings":"AA6EA;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAiC;IACjE,OAAO,KAAK,KAAK,iBAAiB,IAAI,KAAK,KAAK,UAAU,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAsB;IAC/D,IAAI,KAAK,CAAC,gBAAgB,IAAI,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC1F,IAAI,KAAK,CAAC,UAAU,IAAI,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC7E,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC7E,IAAI,KAAK,CAAC,MAAM,IAAI,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IACrD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAsB;IACvD,OAAO,0BAA0B,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,QAAQ,CAAC,WAAmB;IAC1C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;AACpF,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,MAAM,CAAC,KAAK,CAAC;SACjB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CACrC,WAAmB,EACnB,UAAkC,EAAE;IAEpC,MAAM,KAAK,GAAG,WAAW,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC;IACxG,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxD,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAM,cAAc,GAAG,IAAI;QACzB,CAAC,CAAC,uBAAuB,UAAU,CAAC,IAAI,CAAC,0DAA0D;QACnG,CAAC,CAAC,mGAAmG,CAAC;IACxG,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS;QAClC,CAAC,CAAC,8BAA8B,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,oDAAoD;QACjH,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBAuCgB,KAAK;;;;MAIxB,cAAc;MACd,UAAU;;;QAGR,CAAC;AACT,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,YAAY,GAAG;IACnB,KAAK,EAAE,kCAAkC;IACzC,OAAO,EAAE,kCAAkC;IAC3C,IAAI,EAAE,6CAA6C;CAC3C,CAAC;AAEX;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO;;;;;;SAMA,YAAY,CAAC,KAAK;;;;;;;;;;;;;;;;;;;UAmBjB,YAAY,CAAC,OAAO;SACrB,YAAY,CAAC,IAAI;;;QAGlB,CAAC;AACT,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAG3C;IACC,IAAI,KAAK,GAA2B,IAAI,CAAC;IACzC,OAAO,GAAG,EAAE;QACV,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,IAAI;iBACT,KAAK,CACJ;+EACqE,CACtE;iBACA,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;gBACV,MAAM,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;gBACpC,IAAI,SAAS;oBAAE,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBACpC,OAAO,SAAS,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,CAAC,CAAC;iBACD,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACrB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}

package/dist/lib/link-safety.test.js

@@ -1,5 +1,5 @@
 import { describe, it, expect } from 'vitest';
-import { evaluateLinkSafety, generateWarningLinkHTML, escapeHtml, safeHref } from './link-safety.js';
+import { evaluateLinkSafety, generateWarningLinkHTML, escapeHtml, safeHref, evaluateLinkSafetyDecision, blockCauseIsAbuse, generateBlockedLinkHTML, } from './link-safety.js';
 describe('evaluateLinkSafety', () => {
     it('allows a plain healthy link', () => {
         expect(evaluateLinkSafety({ isActive: true })).toBe('allow');
@@ -114,4 +114,98 @@ describe('safeHref', () => {
         expect(safeHref('')).toBeNull();
     });
 });
+describe('evaluateLinkSafetyDecision — why a link was blocked', () => {
+    const T = '2026-08-10T00:00:00Z';
+    it('reports owner restriction as an abuse cause', () => {
+        const d = evaluateLinkSafetyDecision({ ownerSuspendedAt: T });
+        expect(d).toEqual({ outcome: 'block', cause: 'owner_suspended' });
+        expect(blockCauseIsAbuse(d.cause)).toBe(true);
+    });
+    it('reports an explicit disable as an abuse cause', () => {
+        const d = evaluateLinkSafetyDecision({ isActive: false, disabledAt: T });
+        expect(d).toEqual({ outcome: 'block', cause: 'disabled' });
+        expect(blockCauseIsAbuse(d.cause)).toBe(true);
+    });
+    /**
+     * The distinction the whole notice rests on. An expiry sweep and a person
+     * switching their own link off both land here, and neither of their visitors was
+     * targeted by anything.
+     */
+    it('reports a merely inactive link as NOT an abuse cause', () => {
+        const d = evaluateLinkSafetyDecision({ isActive: false });
+        expect(d).toEqual({ outcome: 'block', cause: 'inactive' });
+        expect(blockCauseIsAbuse(d.cause)).toBe(false);
+    });
+    /**
+     * Ordering guard. An abuse disable sets `isActive: false` as well, so testing
+     * `isActive` first would collapse every abuse disable into `inactive` and the
+     * notice would never be served to anyone. Every route test would still pass on
+     * the owner-restriction path, so this is the only place that catches it.
+     */
+    it('keeps the disable cause even though the link is also inactive', () => {
+        expect(evaluateLinkSafetyDecision({ isActive: false, disabledAt: T }).cause).toBe('disabled');
+    });
+    it('lets owner restriction outrank an explicit disable', () => {
+        expect(evaluateLinkSafetyDecision({ ownerSuspendedAt: T, isActive: false, disabledAt: T }).cause).toBe('owner_suspended');
+    });
+    it('carries no cause when the link is fine or only warned', () => {
+        expect(evaluateLinkSafetyDecision({})).toEqual({ outcome: 'allow' });
+        expect(evaluateLinkSafetyDecision({ warnAt: T })).toEqual({ outcome: 'warn' });
+    });
+    it('agrees with evaluateLinkSafety on every outcome', () => {
+        for (const input of [
+            {},
+            { warnAt: T },
+            { isActive: false },
+            { disabledAt: T },
+            { ownerSuspendedAt: T },
+            { warnAt: T, ownerSuspendedAt: T },
+        ]) {
+            expect(evaluateLinkSafety(input)).toBe(evaluateLinkSafetyDecision(input).outcome);
+        }
+    });
+});
+describe('generateBlockedLinkHTML', () => {
+    const html = generateBlockedLinkHTML();
+    it('says only that the link is gone', () => {
+        expect(html).toContain('This link is no longer available');
+        expect(html).toContain('It was removed and no longer goes anywhere.');
+    });
+    /**
+     * The guard on the decision, not on the wording.
+     *
+     * The page must not characterise the link, its destination, or whoever made it.
+     * An earlier draft explained that the link had been reported for trying to obtain
+     * passwords and payment details — useful to a victim, but it is an accusation
+     * about a user's content published on a domain we serve, and it would be false
+     * the first time a link is disabled in error. If any of these words come back,
+     * that decision is being reversed and it should be a deliberate edit here first.
+     */
+    it('makes no claim about the link or whoever created it', () => {
+        for (const word of [
+            'phishing', 'fraud', 'fraudulent', 'scam', 'malicious', 'malware', 'abuse',
+            'reported', 'trick', 'steal', 'suspended', 'restricted', 'violat', 'blocked',
+            'password', 'bank', 'card details',
+        ]) {
+            expect(html.toLowerCase(), `page must not mention "${word}"`).not.toContain(word);
+        }
+    });
+    it('contains no link out at all', () => {
+        expect(html).not.toMatch(/<a\s/i);
+    });
+    it('contains no script and no external asset', () => {
+        expect(html).not.toMatch(/<script/i);
+        expect(html).not.toMatch(/https?:\/\//);
+    });
+    it('asks not to be indexed', () => {
+        expect(html).toContain('noindex');
+    });
+    /**
+     * Arity is the real containment. Adding a parameter is how a destination or an
+     * owner ends up rendered to a stranger, so it fails here before it fails in review.
+     */
+    it('takes no input, so it cannot carry anything from the link', () => {
+        expect(generateBlockedLinkHTML.length).toBe(0);
+    });
+});
 //# sourceMappingURL=link-safety.test.js.map