@namingsignal/mcp 0.2.0

package/dist/core/export.js

@@ -0,0 +1,235 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.exportDecisionJson = exportDecisionJson;
+exports.exportDecisionMarkdown = exportDecisionMarkdown;
+const LEGAL_NOTICE = "This decision record is business research, not legal advice or trademark clearance. Names are primarily a trademark and likelihood-of-confusion issue; a qualified professional should review serious launch candidates.";
+function stableValue(value) {
+    if (Array.isArray(value))
+        return value.map(stableValue);
+    if (value && typeof value === "object" && !(value instanceof Date)) {
+        return Object.fromEntries(Object.entries(value)
+            .filter(([, item]) => item !== undefined)
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([key, item]) => [key, stableValue(item)]));
+    }
+    return value;
+}
+function exportEnvelope(record, options) {
+    const createdAt = record.createdAt ?? options.now?.().toISOString() ?? new Date().toISOString();
+    const envelope = {
+        ...record,
+    };
+    envelope.schema = "naming-signal.decision/v1";
+    envelope.version = record.version ?? "1.0";
+    envelope.createdAt = createdAt;
+    envelope.legalNotice = LEGAL_NOTICE;
+    return envelope;
+}
+function exportDecisionJson(record, options = {}) {
+    if (!record || typeof record !== "object")
+        throw new TypeError("A decision record is required.");
+    return `${JSON.stringify(stableValue(exportEnvelope(record, options)), null, options.pretty === false ? 0 : 2)}\n`;
+}
+function text(value) {
+    return String(value ?? "").replace(/\r?\n/g, " ").trim();
+}
+function cell(value) {
+    return text(value).replace(/\\/g, "\\\\").replace(/\|/g, "\\|");
+}
+function heading(value) {
+    return text(value).replace(/[#*_`[\]]/g, "").trim();
+}
+function safeLink(url, label) {
+    try {
+        const parsed = new URL(url);
+        if (parsed.protocol !== "http:" && parsed.protocol !== "https:")
+            return cell(label);
+        return `[${cell(label)}](${parsed.toString().replace(/\)/g, "%29")})`;
+    }
+    catch {
+        return cell(label);
+    }
+}
+function scoreOf(item) {
+    return item.score?.overall;
+}
+function domainsOf(item) {
+    return item.domains ?? [];
+}
+function namespacesOf(item) {
+    return "namespaces" in item ? item.namespaces ?? [] : [];
+}
+function evidenceOf(item) {
+    if ("evidence" in item && item.evidence)
+        return item.evidence;
+    return [...domainsOf(item).map((domain) => domain.evidence), ...namespacesOf(item).map((namespace) => namespace.evidence)];
+}
+function bestDomain(domains) {
+    if (!domains.length)
+        return "Not checked";
+    const priority = ["likely_available", "premium", "parked", "registered", "active", "unknown", "unsupported"];
+    const sorted = [...domains].sort((left, right) => priority.indexOf(left.status) - priority.indexOf(right.status));
+    return `${sorted[0].domain} — ${sorted[0].status.replace(/_/g, " ")}`;
+}
+function domainSignals(domains) {
+    if (!domains.length)
+        return "Not checked";
+    return domains.map((item) => `${item.domain} — ${item.status.replace(/_/g, " ")}`).join("; ");
+}
+function namespaceSignals(namespaces) {
+    if (!namespaces.length)
+        return "Not checked";
+    return namespaces.map((item) => `${item.label || item.namespace} — ${item.status.replace(/_/g, " ")}`).join("; ");
+}
+function table(lines, headers, rows) {
+    lines.push(`| ${headers.join(" | ")} |`);
+    lines.push(`| ${headers.map(() => "---").join(" | ")} |`);
+    for (const row of rows)
+        lines.push(`| ${row.map(cell).join(" | ")} |`);
+    lines.push("");
+}
+function writeEvidence(lines, evidence) {
+    if (!evidence.length) {
+        lines.push("No source-backed evidence was recorded.", "");
+        return;
+    }
+    table(lines, ["Finding", "State", "Confidence", "Source", "Checked"], evidence.map((item) => [
+        item.label || item.detail || item.provider,
+        item.status,
+        item.confidence,
+        safeLink(item.sourceUrl, item.provider),
+        item.checkedAt,
+    ]));
+}
+/** Produce a portable decision record with evidence and unresolved actions kept visible. */
+function exportDecisionMarkdown(record, options = {}) {
+    if (!record || typeof record !== "object")
+        throw new TypeError("A decision record is required.");
+    const generatedAt = record.createdAt ?? options.now?.().toISOString() ?? new Date().toISOString();
+    const lines = [];
+    const title = options.title ?? (record.project ? `${record.project} naming decision` : "Naming decision record");
+    lines.push(`# ${heading(title)}`, "", `Generated: ${generatedAt}`, "", `> ${LEGAL_NOTICE}`, "");
+    if (record.selectedName || record.recommendation) {
+        lines.push("## Decision", "");
+        if (record.selectedName)
+            lines.push(`**Selected name:** ${text(record.selectedName)}`, "");
+        if (record.recommendation)
+            lines.push(text(record.recommendation), "");
+    }
+    if (record.brief) {
+        lines.push("## Naming brief", "");
+        table(lines, ["Field", "Current understanding"], [
+            ["Product", record.brief.product || "Unknown"],
+            ["Primary user", record.brief.primaryUser || "Unknown"],
+            ["Pain", record.brief.pain || "Unknown"],
+            ["Outcome", record.brief.outcome || "Unknown"],
+            ["Mechanism", record.brief.mechanism || "Unknown"],
+            ["Platforms", record.brief.platform.join(", ") || "Unknown"],
+            ["Acquisition", record.brief.acquisitionChannels.join(", ") || "Unknown"],
+            ["Tone", record.brief.brandTone.join(", ") || "Unknown"],
+            ["Future scope", record.brief.futureExpansion || "Unknown"],
+            ["Domain requirements", record.brief.domainRequirements.join(", ") || "Unknown"],
+            ["Avoid", record.brief.avoid.join(", ") || "None supplied"],
+        ]);
+        if (record.brief.uncertainties.length) {
+            lines.push("### Brief uncertainties", "", ...record.brief.uncertainties.map((item) => `- ${text(item)}`), "");
+        }
+    }
+    const shortlist = record.shortlist ?? [];
+    if (shortlist.length) {
+        lines.push("## Shortlist", "");
+        table(lines, ["Name", "Direction", "Score", "Best domain signal", "Rationale"], shortlist.map((item) => [
+            item.name,
+            "vein" in item ? item.vein : "finalist",
+            scoreOf(item) === undefined ? "Unscored" : `${scoreOf(item)}/100`,
+            bestDomain(domainsOf(item)),
+            "rationale" in item ? item.rationale ?? "" : item.strongestReasonFor ?? item.rationale ?? "",
+        ]));
+    }
+    if (record.candidates?.length) {
+        lines.push("## Checked candidate ledger", "");
+        table(lines, ["Name", "Direction", "Score", "All domain checks", "All namespace checks", "Rationale"], record.candidates.map((item) => [
+            item.name,
+            item.vein,
+            scoreOf(item) === undefined ? "Unscored" : `${scoreOf(item)}/100`,
+            domainSignals(domainsOf(item)),
+            namespaceSignals(namespacesOf(item)),
+            item.rationale,
+        ]));
+    }
+    if (record.finalists?.length) {
+        lines.push("## Finalist diligence", "");
+        for (const finalist of record.finalists) {
+            lines.push(`### ${heading(finalist.name)}`, "", `**Preliminary score:** ${finalist.score.overall}/100 — ${text(finalist.score.label)}`, "");
+            if (finalist.founderResonance !== undefined) {
+                lines.push(`**Founder resonance:** ${finalist.founderResonance}/10`, "");
+            }
+            if (finalist.strongestReasonFor)
+                lines.push(`**Strongest reason for:** ${text(finalist.strongestReasonFor)}`, "");
+            if (finalist.strongestReasonAgainst)
+                lines.push(`**Strongest reason against:** ${text(finalist.strongestReasonAgainst)}`, "");
+            if (finalist.score.hardBlockers.length) {
+                lines.push("**Hard blockers (the score does not override these):**", "", ...finalist.score.hardBlockers.map((item) => `- ${text(item)}`), "");
+            }
+            if (finalist.score.warnings.length) {
+                lines.push("**Warnings and unknowns:**", "", ...finalist.score.warnings.map((item) => `- ${text(item)}`), "");
+            }
+            table(lines, ["Dimension", "Score", "Weight", "Basis"], finalist.score.dimensions.map((item) => [item.label, `${item.score}/100`, item.weight, item.note]));
+            if (finalist.domains?.length) {
+                lines.push("#### Domains", "");
+                table(lines, ["Domain", "State", "Evidence state", "Source", "Checked"], finalist.domains.map((item) => [
+                    item.domain,
+                    item.status,
+                    item.evidence.status,
+                    safeLink(item.evidence.sourceUrl, item.provider),
+                    item.checkedAt,
+                ]));
+            }
+            if (finalist.namespaces?.length) {
+                lines.push("#### Namespaces", "");
+                table(lines, ["Namespace", "State", "Evidence state", "Source"], finalist.namespaces.map((item) => [
+                    item.label,
+                    item.status,
+                    item.evidence.status,
+                    safeLink(item.evidence.sourceUrl, item.evidence.provider),
+                ]));
+            }
+            lines.push("#### Evidence ledger", "");
+            writeEvidence(lines, evidenceOf(finalist));
+            if (finalist.manualLinks?.length) {
+                lines.push("#### Manual verification", "", ...finalist.manualLinks.map((item) => `- ${safeLink(item.url, item.label)}${item.reason ? ` — ${text(item.reason)}` : ""}`), "");
+            }
+        }
+    }
+    if (record.rejected?.length) {
+        lines.push("## Rejected-name ledger", "");
+        table(lines, ["Name", "Reason", "Rejected"], record.rejected.map((item) => [item.name, item.reason, item.rejectedAt ?? "Time not recorded"]));
+    }
+    const actions = record.humanActions ?? [];
+    lines.push("## Human actions before commitment", "");
+    const requiredActions = [
+        ...actions,
+        "Recheck the chosen domain at a registrar immediately before purchase.",
+        "Run spoken dictation/caption tests when word of mouth, audio, or creator video matters.",
+        "Have appropriate counsel perform a comprehensive trademark clearance search for a serious launch.",
+    ];
+    lines.push(...[...new Set(requiredActions)].map((item) => `- ${text(item)}`), "");
+    if (record.notes?.length)
+        lines.push("## Notes", "", ...record.notes.map((item) => `- ${text(item)}`), "");
+    if (record.usage) {
+        lines.push("## Request usage", "");
+        table(lines, ["Metric", "Value"], [
+            ["Model calls", record.usage.modelCalls],
+            ["Input tokens", record.usage.inputTokens],
+            ["Cached input tokens", record.usage.cachedInputTokens],
+            ["Reasoning tokens", record.usage.reasoningTokens],
+            ["Output tokens", record.usage.outputTokens],
+            ["Domain requests", record.usage.domainRequests],
+            ["Namespace requests", record.usage.namespaceRequests],
+            ["Search queries", record.usage.searchQueries],
+            ["Cache hits", record.usage.cacheHits],
+            ["Estimated USD", `$${record.usage.estimatedUsd.toFixed(6)}`],
+        ]);
+    }
+    return `${lines.join("\n").replace(/\n{3,}/g, "\n\n").trim()}\n`;
+}

package/dist/core/import-safety.js

@@ -0,0 +1,298 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateImportText = validateImportText;
+exports.validatePublicUrl = validatePublicUrl;
+const DENIED_FILE_PATTERNS = [
+    [/(?:^|\/)\.env(?:\.|$)/i, "Environment files are excluded by default."],
+    [/(?:^|\/)(?:id_rsa|id_ed25519|credentials|secrets?)(?:\.|$)/i, "Credential and secret files are excluded."],
+    [/\.(?:pem|key|p12|pfx|jks|keystore)$/i, "Certificate and private-key containers are excluded."],
+    [/\.(?:zip|tar|gz|tgz|bz2|xz|7z|rar|dmg|iso)$/i, "Archives are not accepted as text imports."],
+    [/\.(?:png|jpe?g|gif|webp|heic|pdf|mp[34]|mov|avi|woff2?|ttf|ico)$/i, "Binary media is not accepted as a text import."],
+    [/(?:^|\/)(?:package-lock\.json|pnpm-lock\.yaml|yarn\.lock|poetry\.lock|Cargo\.lock)$/i, "Lockfiles are excluded from naming context."],
+    [/\.(?:map|min\.js)$/i, "Generated files are excluded from naming context."],
+];
+const SECRET_PATTERNS = [
+    { kind: "private_key", pattern: /-----BEGIN (?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----/g },
+    { kind: "openai_style_key", pattern: /\bsk-(?:proj-)?[A-Za-z0-9_-]{16,}\b/g },
+    { kind: "github_token", pattern: /\b(?:gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,})\b/g },
+    { kind: "aws_access_key", pattern: /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g },
+    { kind: "jwt", pattern: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g },
+    {
+        kind: "credential_assignment",
+        pattern: /\b(?:api[_-]?key|access[_-]?token|auth[_-]?token|client[_-]?secret|password|passwd|secret)\s*[:=]\s*["']?(?!\s|["']?(?:your|example|placeholder|changeme|todo|none|null)\b)[^\s,"']{8,}["']?/gi,
+    },
+    {
+        kind: "credential_url",
+        pattern: /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis):\/\/[^\s/:]+:[^\s/@]{4,}@[^\s]+/gi,
+    },
+];
+const INJECTION_PATTERNS = [
+    {
+        kind: "instruction_override",
+        pattern: /\bignore (?:all |any )?(?:previous|prior|system|developer) instructions?\b/i,
+        message: "Instruction-override language is preserved only as quoted project data.",
+    },
+    {
+        kind: "role_impersonation",
+        pattern: /\b(?:system|developer|assistant)\s*(?:message|prompt)?\s*:/i,
+        message: "Role-like text is not promoted to an instruction.",
+    },
+    {
+        kind: "secret_exfiltration",
+        pattern: /\b(?:reveal|print|return|upload|exfiltrate)\b.{0,40}\b(?:secret|token|credential|system prompt)\b/i,
+        message: "A possible data-exfiltration instruction was treated as inert text.",
+    },
+    {
+        kind: "tool_instruction",
+        pattern: /\b(?:call|invoke|run|execute)\b.{0,30}\b(?:tool|shell|command|curl|fetch)\b/i,
+        message: "Tool-execution language is treated as content and is never executed by the compiler.",
+    },
+];
+function byteLength(value) {
+    return new TextEncoder().encode(value).byteLength;
+}
+function estimatedTokens(value) {
+    const words = value.trim() ? value.trim().split(/\s+/).length : 0;
+    return Math.ceil(Math.max(value.length / 4, words * 1.28));
+}
+function redactLine(line, findingKinds) {
+    let output = line;
+    for (const item of SECRET_PATTERNS) {
+        item.pattern.lastIndex = 0;
+        if (!findingKinds.has(item.kind))
+            continue;
+        output = output.replace(item.pattern, `[REDACTED:${item.kind}]`);
+    }
+    return output;
+}
+/** Validate arbitrary text before it can become provider input. */
+function validateImportText(text, options = {}) {
+    const maxBytes = options.maxBytes ?? 250_000;
+    const maxTokens = options.maxTokens ?? 12_000;
+    const errors = [];
+    const warnings = [];
+    const secretFindings = [];
+    const injectionSignals = [];
+    if (typeof text !== "string") {
+        return {
+            ok: false,
+            valid: false,
+            sanitizedText: "",
+            safeText: "",
+            byteLength: 0,
+            estimatedTokens: 0,
+            errors: ["Import must be text."],
+            warnings,
+            secretFindings,
+            injectionSignals,
+            source: options.source,
+        };
+    }
+    const normalized = text.normalize("NFKC").replace(/\r\n?/g, "\n");
+    const bytes = byteLength(normalized);
+    const tokens = estimatedTokens(normalized);
+    if (!normalized.trim())
+        errors.push("Import is empty.");
+    if (bytes > maxBytes)
+        errors.push(`Import is ${bytes} bytes; the limit is ${maxBytes} bytes.`);
+    if (tokens > maxTokens)
+        errors.push(`Import is approximately ${tokens} tokens; the model-input limit is ${maxTokens}.`);
+    if (/\0/.test(normalized) || (normalized.match(/\uFFFD/g)?.length ?? 0) > Math.max(2, normalized.length / 100)) {
+        errors.push("Import appears to contain binary or undecodable content.");
+    }
+    if (options.fileName) {
+        for (const [pattern, message] of DENIED_FILE_PATTERNS) {
+            if (pattern.test(options.fileName))
+                errors.push(message);
+        }
+    }
+    const lines = normalized.split("\n");
+    const sanitizedLines = [];
+    for (let index = 0; index < lines.length; index += 1) {
+        const line = lines[index];
+        const kindsOnLine = new Set();
+        for (const secret of SECRET_PATTERNS) {
+            secret.pattern.lastIndex = 0;
+            if (secret.pattern.test(line)) {
+                kindsOnLine.add(secret.kind);
+                secretFindings.push({
+                    kind: secret.kind,
+                    line: index + 1,
+                    message: `Possible ${secret.kind.replace(/_/g, " ")} excluded on line ${index + 1}; the value is not returned.`,
+                });
+            }
+        }
+        for (const injection of INJECTION_PATTERNS) {
+            if (injection.pattern.test(line)) {
+                injectionSignals.push({ kind: injection.kind, line: index + 1, message: injection.message });
+            }
+        }
+        sanitizedLines.push(options.redactSecrets === false ? line : redactLine(line, kindsOnLine));
+    }
+    if (secretFindings.length) {
+        errors.push(`Import contains ${secretFindings.length} possible secret${secretFindings.length === 1 ? "" : "s"}; remove them before transmission.`);
+    }
+    if (injectionSignals.length) {
+        warnings.push(`${injectionSignals.length} instruction-like line${injectionSignals.length === 1 ? " was" : "s were"} detected and will be treated only as data.`);
+    }
+    if (!options.fileName)
+        warnings.push("No filename was supplied, so path-based secret exclusions could not be applied.");
+    const sanitizedText = sanitizedLines.join("\n");
+    return {
+        ok: errors.length === 0,
+        valid: errors.length === 0,
+        sanitizedText,
+        safeText: sanitizedText,
+        byteLength: bytes,
+        estimatedTokens: tokens,
+        errors: [...new Set(errors)],
+        warnings: [...new Set(warnings)],
+        secretFindings,
+        injectionSignals,
+        source: options.source ?? options.fileName,
+    };
+}
+function parseIpv4(hostname) {
+    const parts = hostname.split(".");
+    if (parts.length !== 4 || parts.some((part) => !/^\d{1,3}$/.test(part)))
+        return undefined;
+    const numbers = parts.map(Number);
+    return numbers.every((part) => part >= 0 && part <= 255) ? numbers : undefined;
+}
+function isBlockedIpv4(parts) {
+    const [a, b] = parts;
+    return (a === 0 ||
+        a === 10 ||
+        a === 127 ||
+        (a === 100 && b >= 64 && b <= 127) ||
+        (a === 169 && b === 254) ||
+        (a === 172 && b >= 16 && b <= 31) ||
+        (a === 192 && b === 0) ||
+        (a === 192 && b === 168) ||
+        (a === 198 && (b === 18 || b === 19 || b === 51)) ||
+        (a === 203 && b === 0) ||
+        a >= 224);
+}
+function parseIpv6(address) {
+    let value = address.toLowerCase();
+    const dotted = value.match(/(\d+\.\d+\.\d+\.\d+)$/)?.[1];
+    if (dotted) {
+        const ipv4 = parseIpv4(dotted);
+        if (!ipv4)
+            return undefined;
+        value = value.slice(0, -dotted.length) + `${((ipv4[0] << 8) | ipv4[1]).toString(16)}:${((ipv4[2] << 8) | ipv4[3]).toString(16)}`;
+    }
+    if ((value.match(/::/g)?.length ?? 0) > 1)
+        return undefined;
+    const [leftRaw, rightRaw = ""] = value.split("::");
+    const left = leftRaw ? leftRaw.split(":") : [];
+    const right = rightRaw ? rightRaw.split(":") : [];
+    const missing = 8 - left.length - right.length;
+    if ((value.includes("::") && missing < 1) || (!value.includes("::") && missing !== 0))
+        return undefined;
+    const groups = [...left, ...Array.from({ length: missing }, () => "0"), ...right];
+    if (groups.length !== 8 || groups.some((group) => !/^[0-9a-f]{1,4}$/i.test(group)))
+        return undefined;
+    return groups.map((group) => Number.parseInt(group, 16));
+}
+function isBlockedAddress(address) {
+    const value = address.toLowerCase().replace(/^\[|\]$/g, "").split("%")[0];
+    const ipv4 = parseIpv4(value);
+    if (ipv4)
+        return isBlockedIpv4(ipv4);
+    if (!value.includes(":"))
+        return false;
+    const groups = parseIpv6(value);
+    if (!groups)
+        return true;
+    const [first, second, third, fourth, fifth, sixth, seventh, eighth] = groups;
+    if (groups.every((group) => group === 0) || groups.slice(0, 7).every((group) => group === 0) && eighth === 1)
+        return true;
+    if ((first & 0xfe00) === 0xfc00 || (first & 0xffc0) === 0xfe80 || (first & 0xff00) === 0xff00)
+        return true;
+    if (first === 0x2001 && second === 0x0db8)
+        return true;
+    if (first === 0x0064 && second === 0xff9b)
+        return true;
+    if (first === 0x0100 && second === 0 && third === 0 && fourth === 0)
+        return true;
+    if (first === 0x2002)
+        return true;
+    // IPv4-mapped and IPv4-compatible addresses can otherwise conceal loopback,
+    // link-local, metadata, or RFC1918 destinations in hexadecimal form.
+    if (first === 0 && second === 0 && third === 0 && fourth === 0 && fifth === 0 && (sixth === 0 || sixth === 0xffff)) {
+        return isBlockedIpv4([seventh >> 8, seventh & 0xff, eighth >> 8, eighth & 0xff]);
+    }
+    return false;
+}
+const BLOCKED_HOST = /^(?:localhost|localhost\.localdomain|metadata|metadata\.google\.internal|instance-data|kubernetes\.default\.svc)$/i;
+const BLOCKED_SUFFIX = /\.(?:localhost|local|internal|home|lan|corp|test|invalid|example|onion)$/i;
+/**
+ * Validate each URL and redirect before server-side fetching. Callers should
+ * provide resolveHost in production and pin/recheck the chosen address at fetch
+ * time to close DNS-rebinding gaps.
+ */
+async function validatePublicUrl(input, options = {}) {
+    const errors = [];
+    const warnings = [];
+    const resolvedAddresses = [];
+    let parsed;
+    try {
+        parsed = new URL(input);
+    }
+    catch {
+        errors.push("URL is not valid.");
+    }
+    if (!parsed) {
+        return { ok: false, valid: false, errors, warnings, resolvedAddresses, requiresDnsVerification: false };
+    }
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:")
+        errors.push("Only HTTP and HTTPS URLs are allowed.");
+    if (parsed.protocol === "http:" && options.allowHttp === false)
+        errors.push("Plain HTTP URLs are disabled.");
+    else if (parsed.protocol === "http:")
+        warnings.push("Plain HTTP content is unauthenticated; prefer HTTPS.");
+    if (parsed.username || parsed.password)
+        errors.push("URLs containing credentials are not allowed.");
+    const allowedPorts = options.allowedPorts ?? [80, 443];
+    if (parsed.port && !allowedPorts.includes(Number(parsed.port)))
+        errors.push(`Port ${parsed.port} is not allowed.`);
+    const hostname = parsed.hostname.toLowerCase().replace(/^\[|\]$/g, "").replace(/\.$/, "");
+    if (!hostname || BLOCKED_HOST.test(hostname) || BLOCKED_SUFFIX.test(hostname))
+        errors.push("Private or local hostnames are not allowed.");
+    if (hostname === "169.254.169.254" || hostname === "100.100.100.200")
+        errors.push("Cloud metadata endpoints are not allowed.");
+    if (isBlockedAddress(hostname))
+        errors.push("Private, loopback, link-local, documentation, or reserved IP addresses are not allowed.");
+    if (!hostname.includes(".") && !hostname.includes(":"))
+        errors.push("Single-label hostnames are not allowed.");
+    const literalIp = Boolean(parseIpv4(hostname) || hostname.includes(":"));
+    if (!errors.length && options.resolveHost && !literalIp) {
+        try {
+            const addresses = await options.resolveHost(hostname);
+            resolvedAddresses.push(...new Set(addresses.map((address) => address.trim()).filter(Boolean)));
+            if (!resolvedAddresses.length)
+                errors.push("Hostname did not resolve to a public address.");
+            if (resolvedAddresses.some(isBlockedAddress))
+                errors.push("Hostname resolves to a private or reserved address.");
+        }
+        catch {
+            errors.push("Hostname resolution failed; URL fetch was denied.");
+        }
+    }
+    const requiresDnsVerification = !literalIp && !options.resolveHost;
+    if (requiresDnsVerification && !errors.length) {
+        warnings.push("Resolve and verify the hostname again at fetch time; syntax validation alone does not prevent DNS rebinding.");
+    }
+    parsed.hash = "";
+    return {
+        ok: errors.length === 0,
+        valid: errors.length === 0,
+        url: errors.length ? undefined : parsed.toString(),
+        hostname,
+        errors: [...new Set(errors)],
+        warnings: [...new Set(warnings)],
+        resolvedAddresses,
+        requiresDnsVerification,
+    };
+}

package/dist/core/index.js

@@ -0,0 +1,31 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./types"), exports);
+__exportStar(require("./normalize"), exports);
+__exportStar(require("./brief"), exports);
+__exportStar(require("./candidates"), exports);
+__exportStar(require("./candidate-sort"), exports);
+__exportStar(require("./brief-constraints"), exports);
+__exportStar(require("./namesake"), exports);
+__exportStar(require("./editorial-review"), exports);
+__exportStar(require("./scoring"), exports);
+__exportStar(require("./domain"), exports);
+__exportStar(require("./namespaces"), exports);
+__exportStar(require("./import-safety"), exports);
+__exportStar(require("./url-input"), exports);
+__exportStar(require("./export"), exports);
+__exportStar(require("./usage"), exports);

package/dist/core/namesake.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.classifyNamesakeSources = classifyNamesakeSources;
+const normalize_1 = require("./normalize");
+const CATEGORY_PROFILES = [
+    [/(?:product naming|naming decision|brand name|name generator|domain.*name|trademark)/i, /(?:product naming|naming decision|brand name|name generator|domain|trademark|social handle|name validation)/i],
+    [/(?:workout|exercise|fitness|reps?|sets?|cadence|bodyweight)/i, /(?:workout|exercise|fitness|training|interval timer|reps?|sets?|bodyweight)/i],
+    [/(?:developer|software|api|cli|code|programming)/i, /(?:developer|software|api|cli|code|programming|documentation)/i],
+    [/(?:bookkeep|accounting|expense|invoice)/i, /(?:bookkeep|accounting|expense|invoice|finance)/i],
+];
+function semanticNameKey(value) {
+    return value.replace(/^naming/, "name");
+}
+function sourceHost(url) {
+    try {
+        return new URL(url).hostname.toLowerCase().replace(/^www\./, "");
+    }
+    catch {
+        return "";
+    }
+}
+function classifyNamesakeSources(name, brief, sources) {
+    const nameKey = (0, normalize_1.comparisonKey)(name);
+    const briefText = [brief?.product, brief?.pain, brief?.outcome, brief?.mechanism].filter(Boolean).join(" ");
+    return sources.map((source) => {
+        const host = sourceHost(source.url);
+        const sourceText = [source.title, source.url, ...(source.highlights ?? []), source.excerpt ?? ""].join(" ");
+        const sourceWords = new Set((0, normalize_1.normalizeName)(sourceText).split(" ").map(normalize_1.comparisonKey).filter(Boolean));
+        const exactName = sourceWords.has(nameKey) || host.split(".")[0] === nameKey;
+        const nearName = !exactName && ([...sourceWords].some((word) => semanticNameKey(word) === semanticNameKey(nameKey)) ||
+            semanticNameKey(host.split(".")[0]) === semanticNameKey(nameKey));
+        const lexicalNear = !exactName && [...sourceWords].some((word) => word.length > nameKey.length && nameKey.length >= 5 && word.startsWith(nameKey));
+        const profile = CATEGORY_PROFILES.find(([briefPattern]) => briefPattern.test(briefText));
+        const sameCategory = profile ? profile[1].test(sourceText) : false;
+        const codeTokenNoise = !sameCategory && /\b(?:api documentation|programming reference|class|method|symbol|code token)\b/i.test(sourceText);
+        const trustedStore = host === "play.google.com" || host === "apps.apple.com" || host === "appstore.com";
+        const officialMatchingHost = host.split(".")[0] === nameKey;
+        const activeProductSignal = (exactName || nearName) && (trustedStore || officialMatchingHost || /\b(?:app|product|company|service|platform|validation)\b/i.test(source.title));
+        const blocker = (exactName || nearName) && sameCategory && activeProductSignal;
+        const semanticClass = exactName && blocker
+            ? "exact_active_same_category"
+            : nearName && blocker
+                ? "near_active_same_category"
+                : exactName && sameCategory
+                    ? "exact_same_category"
+                    : exactName && !codeTokenNoise
+                        ? "exact_other_category"
+                        : lexicalNear
+                            ? "lexical_near_match"
+                            : "unrelated";
+        return { ...source, semanticClass, exactName, nearName, sameCategory, activeProductSignal, blocker };
+    });
+}