@nifrajs/link-safety 0.1.0

package/dist/corpus.d.ts

@@ -0,0 +1,7 @@
+import type { LinkCorpus } from "./types.js";
+export interface MemoryCorpusOptions {
+    readonly version?: string;
+}
+export declare function createMemoryCorpus(entries: readonly unknown[], options?: MemoryCorpusOptions): LinkCorpus;
+export declare function parseCorpusJsonl(input: string, options?: MemoryCorpusOptions): LinkCorpus;
+//# sourceMappingURL=corpus.d.ts.map

package/dist/corpus.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"corpus.d.ts","sourceRoot":"","sources":["../src/corpus.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAMV,UAAU,EAEX,MAAM,YAAY,CAAC;AAuBpB,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,SAAS,OAAO,EAAE,EAC3B,OAAO,GAAE,mBAAwB,GAChC,UAAU,CAuCZ;AAED,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,mBAAwB,GAChC,UAAU,CAoBZ"}

package/dist/corpus.js

@@ -0,0 +1,167 @@
+import { normalizeLink } from "./normalize.js";
+const MAX_CORPUS_BYTES = 64 * 1024 * 1024;
+const MAX_CORPUS_ENTRIES = 100_000;
+const MAX_LINE_BYTES = 32 * 1024;
+const MAX_ID_LENGTH = 128;
+const MAX_INDICATOR_LENGTH = 4096;
+const MAX_TEXT_LENGTH = 256;
+const LABELS = new Set(["benign", "suspicious", "malicious"]);
+const INDICATOR_TYPES = new Set([
+    "hostname",
+    "hostname_path_prefix",
+    "url_prefix",
+]);
+export function createMemoryCorpus(entries, options = {}) {
+    if (!Array.isArray(entries) || entries.length > MAX_CORPUS_ENTRIES) {
+        throw new RangeError("corpus: too many entries");
+    }
+    const version = validateText(options.version ?? "memory", "version", 128);
+    const ids = new Set();
+    const indexed = [];
+    for (const [index, raw] of entries.entries()) {
+        const entry = validateEntry(raw, index);
+        if (ids.has(entry.id))
+            throw new TypeError("corpus: duplicate entry id");
+        ids.add(entry.id);
+        indexed.push(indexEntry(entry));
+    }
+    return Object.freeze({
+        version,
+        lookup: async (link) => {
+            const matches = indexed
+                .filter((item) => matchesLink(item, link))
+                .map((item) => Object.freeze({
+                entry: item.entry,
+                matchType: item.entry.indicatorType,
+            }));
+            return Object.freeze(matches);
+        },
+        examples: async (link, exampleOptions = {}) => {
+            const limit = validateLimit(exampleOptions.limit);
+            const hostMatches = indexed
+                .filter((item) => item.host === link.hostname)
+                .slice(0, limit)
+                .map((item) => item.entry);
+            return Object.freeze(hostMatches);
+        },
+    });
+}
+export function parseCorpusJsonl(input, options = {}) {
+    if (typeof input !== "string")
+        throw new TypeError("corpus: input is invalid");
+    if (new TextEncoder().encode(input).byteLength > MAX_CORPUS_BYTES) {
+        throw new RangeError("corpus: input is too large");
+    }
+    const entries = [];
+    for (const [index, line] of input.split(/\r?\n/u).entries()) {
+        if (line.trim() === "")
+            continue;
+        if (new TextEncoder().encode(line).byteLength > MAX_LINE_BYTES) {
+            throw new RangeError(`corpus: line ${index + 1} is too large`);
+        }
+        let value;
+        try {
+            value = JSON.parse(line);
+        }
+        catch {
+            throw new TypeError(`corpus: line ${index + 1} is not valid JSON`);
+        }
+        entries.push(value);
+    }
+    return createMemoryCorpus(entries, options);
+}
+function validateEntry(value, index) {
+    if (!isRecord(value))
+        throw new TypeError(`corpus: entry ${index + 1} is invalid`);
+    const id = validateText(value.id, "entry id", MAX_ID_LENGTH);
+    const indicatorType = value.indicatorType;
+    if (typeof indicatorType !== "string" ||
+        !INDICATOR_TYPES.has(indicatorType)) {
+        throw new TypeError(`corpus: entry ${index + 1} has an invalid indicator type`);
+    }
+    const indicator = validateText(value.indicator, "indicator", MAX_INDICATOR_LENGTH);
+    const label = value.label;
+    if (typeof label !== "string" || !LABELS.has(label)) {
+        throw new TypeError(`corpus: entry ${index + 1} has an invalid label`);
+    }
+    const category = optionalText(value.category, "category", MAX_TEXT_LENGTH);
+    const source = optionalText(value.source, "source", MAX_TEXT_LENGTH);
+    const updatedAt = optionalText(value.updatedAt, "updatedAt", 64);
+    const entry = {
+        id,
+        indicatorType: indicatorType,
+        indicator,
+        label: label,
+        ...(category === undefined ? {} : { category }),
+        ...(source === undefined ? {} : { source }),
+        ...(updatedAt === undefined ? {} : { updatedAt }),
+    };
+    return Object.freeze(entry);
+}
+function indexEntry(entry) {
+    if (entry.indicatorType === "hostname") {
+        return Object.freeze({ entry, host: normalizeHost(entry.indicator) });
+    }
+    if (entry.indicatorType === "hostname_path_prefix") {
+        const slash = entry.indicator.indexOf("/");
+        if (slash <= 0) {
+            throw new TypeError("corpus: hostname path indicator is invalid");
+        }
+        const host = normalizeHost(entry.indicator.slice(0, slash));
+        const pathPrefix = normalizePathPrefix(entry.indicator.slice(slash));
+        return Object.freeze({ entry, host, pathPrefix });
+    }
+    const normalized = normalizeLink(entry.indicator);
+    if (!normalized.ok)
+        throw new TypeError("corpus: URL indicator is invalid");
+    return Object.freeze({
+        entry,
+        host: normalized.link.hostname,
+        canonicalPrefix: normalized.link.canonical,
+    });
+}
+function matchesLink(item, link) {
+    if (item.host !== link.hostname)
+        return false;
+    if (item.pathPrefix !== undefined && !link.pathname.startsWith(item.pathPrefix)) {
+        return false;
+    }
+    return (item.canonicalPrefix === undefined ||
+        link.canonical.startsWith(item.canonicalPrefix));
+}
+function normalizeHost(value) {
+    const host = value.trim().toLowerCase().replace(/\.$/u, "");
+    if (host.length === 0 || host.includes("/") || host.includes("@")) {
+        throw new TypeError("corpus: hostname indicator is invalid");
+    }
+    return host;
+}
+function normalizePathPrefix(value) {
+    if (!value.startsWith("/") || value.length > 2048) {
+        throw new TypeError("corpus: path prefix is invalid");
+    }
+    return value;
+}
+function validateText(value, label, maxLength) {
+    if (typeof value !== "string" || value.trim() === "" || value.length > maxLength) {
+        throw new TypeError(`corpus: ${label} is invalid`);
+    }
+    return value;
+}
+function optionalText(value, label, maxLength) {
+    if (value === undefined)
+        return undefined;
+    return validateText(value, label, maxLength);
+}
+function validateLimit(value) {
+    if (value === undefined)
+        return 8;
+    if (!Number.isSafeInteger(value) || value < 0 || value > 32) {
+        throw new RangeError("corpus: example limit must be between 0 and 32");
+    }
+    return value;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=corpus.js.map

package/dist/corpus.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"corpus.js","sourceRoot":"","sources":["../src/corpus.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAW/C,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAC1C,MAAM,kBAAkB,GAAG,OAAO,CAAC;AACnC,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,CAAC;AACjC,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAClC,MAAM,eAAe,GAAG,GAAG,CAAC;AAE5B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAc,CAAC,QAAQ,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC;AAC3E,MAAM,eAAe,GAAG,IAAI,GAAG,CAAsB;IACnD,UAAU;IACV,sBAAsB;IACtB,YAAY;CACb,CAAC,CAAC;AAaH,MAAM,UAAU,kBAAkB,CAChC,OAA2B,EAC3B,UAA+B,EAAE;IAEjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;QACnE,MAAM,IAAI,UAAU,CAAC,0BAA0B,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,IAAI,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACxC,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,4BAA4B,CAAC,CAAC;QACzE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IAClC,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO;QACP,MAAM,EAAE,KAAK,EAAE,IAAoB,EAAmC,EAAE;YACtE,MAAM,OAAO,GAAG,OAAO;iBACpB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;iBACzC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACZ,MAAM,CAAC,MAAM,CAAC;gBACZ,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa;aACpC,CAAC,CACH,CAAC;YACJ,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC;QACD,QAAQ,EAAE,KAAK,EACb,IAAoB,EACpB,iBAAwC,EAAE,EACT,EAAE;YACnC,MAAM,KAAK,GAAG,aAAa,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAClD,MAAM,WAAW,GAAG,OAAO;iBACxB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,QAAQ,CAAC;iBAC7C,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;iBACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC7B,OAAO,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACpC,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,KAAa,EACb,UAA+B,EAAE;IAEjC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,SAAS,CAAC,0BAA0B,CAAC,CAAC;IAC/E,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,UAAU,GAAG,gBAAgB,EAAE,CAAC;QAClE,MAAM,IAAI,UAAU,CAAC,4BAA4B,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,OAAO,GAAc,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5D,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,SAAS;QACjC,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,GAAG,cAAc,EAAE,CAAC;YAC/D,MAAM,IAAI,UAAU,CAAC,gBAAgB,KAAK,GAAG,CAAC,eAAe,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,SAAS,CAAC,gBAAgB,KAAK,GAAG,CAAC,oBAAoB,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,KAAa;IAClD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,iBAAiB,KAAK,GAAG,CAAC,aAAa,CAAC,CAAC;IACnF,MAAM,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;IAC7D,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;IAC1C,IACE,OAAO,aAAa,KAAK,QAAQ;QACjC,CAAC,eAAe,CAAC,GAAG,CAAC,aAAoC,CAAC,EAC1D,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,iBAAiB,KAAK,GAAG,CAAC,gCAAgC,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,oBAAoB,CAAC,CAAC;IACnF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAoB,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,SAAS,CAAC,iBAAiB,KAAK,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;IACjE,MAAM,KAAK,GAAgB;QACzB,EAAE;QACF,aAAa,EAAE,aAAoC;QACnD,SAAS;QACT,KAAK,EAAE,KAAoB;QAC3B,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3C,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;KAClD,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,UAAU,CAAC,KAAkB;IACpC,IAAI,KAAK,CAAC,aAAa,KAAK,UAAU,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,KAAK,sBAAsB,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YACf,MAAM,IAAI,SAAS,CAAC,4CAA4C,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;QAC5D,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAClD,IAAI,CAAC,UAAU,CAAC,EAAE;QAAE,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,CAAC;IAC5E,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK;QACL,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,QAAQ;QAC9B,eAAe,EAAE,UAAU,CAAC,IAAI,CAAC,SAAS;KAC3C,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,IAAkB,EAAE,IAAoB;IAC3D,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAChF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CACL,IAAI,CAAC,eAAe,KAAK,SAAS;QAClC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAChD,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,SAAS,CAAC,gCAAgC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,KAAa,EAAE,SAAiB;IACpE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QACjF,MAAM,IAAI,SAAS,CAAC,WAAW,KAAK,aAAa,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CACnB,KAAc,EACd,KAAa,EACb,SAAiB;IAEjB,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,aAAa,CAAC,KAAyB;IAC9C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,EAAE,EAAE,CAAC;QAC5D,MAAM,IAAI,UAAU,CAAC,gDAAgD,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export { createMemoryCorpus, parseCorpusJsonl } from "./corpus.js";
+export { normalizeLink } from "./normalize.js";
+export { createLinkSafetyScanner, scanLink } from "./scan.js";
+export type { ClassifiedLinkVerdict, CorpusEntry, CorpusExamplesOptions, CorpusIndicatorType, CorpusLabel, CorpusMatch, LinkClassifier, LinkClassifierFailure, LinkClassifierInput, LinkClassifierResult, LinkClassifierSuccess, LinkCorpus, LinkSafetyAction, LinkSafetyErrorCode, LinkSafetyPolicy, LinkSafetyReason, LinkSafetyScanner, LinkSafetyVerdict, LinkScanEvidence, LinkScanFailure, LinkScanOptions, LinkScanResult, LinkScanSuccess, NormalizedLink, } from "./types.js";
+export { LINK_SAFETY_ACTIONS, LINK_SAFETY_ERROR_CODES, LINK_SAFETY_REASONS, LINK_SAFETY_VERDICTS, } from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,uBAAuB,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC9D,YAAY,EACV,qBAAqB,EACrB,WAAW,EACX,qBAAqB,EACrB,mBAAmB,EACnB,WAAW,EACX,WAAW,EACX,cAAc,EACd,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,UAAU,EACV,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,cAAc,EACd,eAAe,EACf,cAAc,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,5 @@
+export { createMemoryCorpus, parseCorpusJsonl } from "./corpus.js";
+export { normalizeLink } from "./normalize.js";
+export { createLinkSafetyScanner, scanLink } from "./scan.js";
+export { LINK_SAFETY_ACTIONS, LINK_SAFETY_ERROR_CODES, LINK_SAFETY_REASONS, LINK_SAFETY_VERDICTS, } from "./types.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,uBAAuB,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AA2B9D,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,YAAY,CAAC"}

package/dist/normalize.d.ts

@@ -0,0 +1,10 @@
+import type { LinkSafetyErrorCode, NormalizedLink } from "./types.js";
+export type NormalizeResult = {
+    readonly ok: true;
+    readonly link: NormalizedLink;
+} | {
+    readonly ok: false;
+    readonly error: LinkSafetyErrorCode;
+};
+export declare function normalizeLink(input: unknown): NormalizeResult;
+//# sourceMappingURL=normalize.d.ts.map

package/dist/normalize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../src/normalize.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAoB,cAAc,EAAE,MAAM,YAAY,CAAC;AASxF,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;CAAE,GACpD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAA;CAAE,CAAC;AAEhE,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CAgE7D"}

package/dist/normalize.js

@@ -0,0 +1,108 @@
+const MAX_URL_LENGTH = 4096;
+const MAX_PATH_LENGTH = 2048;
+const MAX_QUERY_LENGTH = 4096;
+const IPV4 = /^(?:\d{1,3}\.){3}\d{1,3}$/;
+const IPV6 = /^\[[0-9a-f:]+\]$/i;
+export function normalizeLink(input) {
+    if (typeof input !== "string")
+        return { ok: false, error: "invalid_url" };
+    const value = input.trim();
+    if (value.length === 0 || value.length > MAX_URL_LENGTH) {
+        return { ok: false, error: "invalid_url" };
+    }
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        return { ok: false, error: "invalid_url" };
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+        return { ok: false, error: "invalid_url" };
+    }
+    if (parsed.username || parsed.password || parsed.hostname.length === 0) {
+        return { ok: false, error: "invalid_url" };
+    }
+    if (parsed.pathname.length > MAX_PATH_LENGTH ||
+        parsed.search.length > MAX_QUERY_LENGTH) {
+        return { ok: false, error: "invalid_url" };
+    }
+    const hostname = parsed.hostname.toLowerCase().replace(/\.$/u, "");
+    const pathname = parsed.pathname.length === 0 ? "/" : parsed.pathname;
+    const port = parsed.port === "" ? undefined : Number(parsed.port);
+    if (port !== undefined && (!Number.isSafeInteger(port) || port < 1 || port > 65535)) {
+        return { ok: false, error: "invalid_url" };
+    }
+    const flags = [];
+    if (hostname.includes("xn--"))
+        flags.push("punycode_hostname");
+    if (isIpLiteral(hostname))
+        flags.push("ip_literal");
+    if (isPrivateAddress(hostname))
+        flags.push("private_network_candidate");
+    if (port !== undefined && port !== (parsed.protocol === "https:" ? 443 : 80)) {
+        flags.push("non_default_port");
+    }
+    if (hostname.length > 100)
+        flags.push("long_hostname");
+    if (hostname.split(".").length > 5)
+        flags.push("many_subdomains");
+    if (/%(?:2f|5c)/i.test(pathname))
+        flags.push("encoded_path_separator");
+    if (pathname.length > 1024)
+        flags.push("long_path");
+    if (parsed.search.length > 0)
+        flags.push("query_present");
+    const canonical = `${parsed.protocol}//${hostname}${port === undefined ? "" : `:${port}`}${pathname}`;
+    return {
+        ok: true,
+        link: Object.freeze({
+            protocol: parsed.protocol === "https:" ? "https" : "http",
+            hostname,
+            ...(port === undefined ? {} : { port }),
+            pathname,
+            canonical,
+            hasQuery: parsed.search.length > 0,
+            queryParameterCount: countQueryParameters(parsed.search),
+            queryLength: parsed.search.length,
+            flags: Object.freeze(flags),
+        }),
+    };
+}
+function countQueryParameters(search) {
+    if (search.length === 0)
+        return 0;
+    try {
+        return [...new URLSearchParams(search)].length;
+    }
+    catch {
+        return 0;
+    }
+}
+function isIpLiteral(hostname) {
+    return IPV4.test(hostname) || IPV6.test(hostname);
+}
+function isPrivateAddress(hostname) {
+    const unwrapped = hostname.replace(/^\[/, "").replace(/\]$/u, "");
+    if (unwrapped === "localhost" ||
+        unwrapped === "::1" ||
+        unwrapped.startsWith("fc") ||
+        unwrapped.startsWith("fd") ||
+        unwrapped.startsWith("fe80:")) {
+        return true;
+    }
+    if (!IPV4.test(unwrapped))
+        return false;
+    const octets = unwrapped.split(".").map(Number);
+    if (octets.some((octet) => !Number.isInteger(octet) || octet < 0 || octet > 255)) {
+        return false;
+    }
+    const first = octets[0] ?? -1;
+    const second = octets[1] ?? -1;
+    return (first === 10 ||
+        first === 127 ||
+        (first === 169 && second === 254) ||
+        (first === 172 && second >= 16 && second <= 31) ||
+        (first === 192 && second === 168));
+}
+//# sourceMappingURL=normalize.js.map

package/dist/normalize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize.js","sourceRoot":"","sources":["../src/normalize.ts"],"names":[],"mappings":"AAEA,MAAM,cAAc,GAAG,IAAI,CAAC;AAC5B,MAAM,eAAe,GAAG,IAAI,CAAC;AAC7B,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAE9B,MAAM,IAAI,GAAG,2BAA2B,CAAC;AACzC,MAAM,IAAI,GAAG,mBAAmB,CAAC;AAMjC,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;IAC1E,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;QACxD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;IAC7C,CAAC;IAED,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;IAC7C,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;IAC7C,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;IAC7C,CAAC;IACD,IACE,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,eAAe;QACxC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,gBAAgB,EACvC,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;IAC7C,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;IACtE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAClE,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;QACpF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;IAC7C,CAAC;IAED,MAAM,KAAK,GAAuB,EAAE,CAAC;IACrC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC/D,IAAI,WAAW,CAAC,QAAQ,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACpD,IAAI,gBAAgB,CAAC,QAAQ,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACxE,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC7E,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACvD,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAClE,IAAI,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACvE,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACpD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAE1D,MAAM,SAAS,GAAG,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,GAC/C,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EACpC,GAAG,QAAQ,EAAE,CAAC;IACd,OAAO;QACL,EAAE,EAAE,IAAI;QACR,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;YAClB,QAAQ,EAAE,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;YACzD,QAAQ;YACR,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YACvC,QAAQ;YACR,SAAS;YACT,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YAClC,mBAAmB,EAAE,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC;YACxD,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;YACjC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;SAC5B,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAc;IAC1C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC;QACH,OAAO,CAAC,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB;IACnC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClE,IACE,SAAS,KAAK,WAAW;QACzB,SAAS,KAAK,KAAK;QACnB,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,EAC7B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,GAAG,CAAC,EAAE,CAAC;QACjF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/B,OAAO,CACL,KAAK,KAAK,EAAE;QACZ,KAAK,KAAK,GAAG;QACb,CAAC,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;QACjC,CAAC,KAAK,KAAK,GAAG,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE,CAAC;QAC/C,CAAC,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC,CAClC,CAAC;AACJ,CAAC"}

package/dist/scan.d.ts

@@ -0,0 +1,6 @@
+import type { LinkScanOptions, LinkScanResult } from "./types.js";
+export declare function createLinkSafetyScanner(defaults?: LinkScanOptions): {
+    scan(input: unknown, options?: LinkScanOptions): Promise<LinkScanResult>;
+};
+export declare function scanLink(input: unknown, options?: LinkScanOptions): Promise<LinkScanResult>;
+//# sourceMappingURL=scan.d.ts.map

package/dist/scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAWV,eAAe,EACf,cAAc,EAGf,MAAM,YAAY,CAAC;AAOpB,wBAAgB,uBAAuB,CAAC,QAAQ,GAAE,eAAoB,GAAG;IACvE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC1E,CAKA;AAED,wBAAsB,QAAQ,CAC5B,KAAK,EAAE,OAAO,EACd,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,cAAc,CAAC,CAuEzB"}

package/dist/scan.js

@@ -0,0 +1,299 @@
+import { normalizeLink } from "./normalize.js";
+import { LINK_SAFETY_ERROR_CODES, LINK_SAFETY_REASONS } from "./types.js";
+const DEFAULT_MINIMUM_CONFIDENCE = 0.92;
+const ERROR_CODE_SET = new Set(LINK_SAFETY_ERROR_CODES);
+const REASON_SET = new Set(LINK_SAFETY_REASONS);
+export function createLinkSafetyScanner(defaults = {}) {
+    return Object.freeze({
+        scan: (input, options = {}) => scanLink(input, mergeOptions(defaults, options)),
+    });
+}
+export async function scanLink(input, options = {}) {
+    const startedAt = Date.now();
+    const normalized = normalizeLink(input);
+    if (!normalized.ok)
+        return failure(normalized.error, startedAt);
+    const signal = options.signal ?? new AbortController().signal;
+    if (signal.aborted)
+        return failure("cancelled", startedAt, normalized.link);
+    const policyResult = validatePolicy(options.policy);
+    if (!policyResult.ok)
+        return failure("policy_invalid", startedAt, normalized.link);
+    const policy = policyResult.policy;
+    let matches = [];
+    let corpusVersion;
+    if (options.corpus !== undefined) {
+        if (!isValidCorpus(options.corpus)) {
+            return failure("corpus_invalid", startedAt, normalized.link);
+        }
+        corpusVersion = options.corpus.version;
+        try {
+            matches = await options.corpus.lookup(normalized.link);
+        }
+        catch {
+            return failure("corpus_unavailable", startedAt, normalized.link);
+        }
+    }
+    if (signal.aborted)
+        return failure("cancelled", startedAt, normalized.link);
+    const deterministic = deterministicClassification(normalized.link, matches);
+    const hardMalicious = matches.some((match) => match.entry.label === "malicious");
+    let semantic;
+    let examples = [];
+    if (options.classifier !== undefined && !hardMalicious) {
+        if (!isValidClassifier(options.classifier)) {
+            return failure("classifier_response_invalid", startedAt, normalized.link);
+        }
+        if (options.corpus?.examples !== undefined) {
+            try {
+                examples = await options.corpus.examples(normalized.link, { limit: 8 });
+            }
+            catch {
+                return failure("corpus_unavailable", startedAt, normalized.link);
+            }
+        }
+        try {
+            semantic = validateClassifierResult(await options.classifier.classify({
+                link: normalized.link,
+                matches,
+                examples,
+                signal,
+            }));
+        }
+        catch {
+            return failure(signal.aborted ? "cancelled" : "classifier_unavailable", startedAt, normalized.link);
+        }
+        if (!semantic.ok)
+            return failure(semantic.error, startedAt, normalized.link);
+    }
+    if (signal.aborted)
+        return failure("cancelled", startedAt, normalized.link);
+    return combineClassification(normalized.link, matches, semantic?.ok === true ? semantic : undefined, deterministic, policy, corpusVersion, options.classifier?.id, startedAt);
+}
+function combineClassification(link, matches, semantic, deterministic, policy, corpusVersion, classifierId, startedAt) {
+    const labels = new Set(matches.map((match) => match.entry.label));
+    const conflict = labels.size > 1;
+    const reasons = new Set(deterministic.reasons);
+    let verdict = deterministic.verdict;
+    let confidence = deterministic.confidence;
+    let riskScore = deterministic.riskScore;
+    let provider;
+    let model;
+    if (semantic !== undefined) {
+        provider = semantic.provider ?? classifierId;
+        model = semantic.model;
+        reasons.add("semantic_classifier");
+        for (const reason of semantic.reasons ?? [])
+            reasons.add(reason);
+        riskScore = Math.max(riskScore, semantic.riskScore);
+        confidence = semantic.confidence;
+        verdict = semantic.verdict;
+        if (deterministic.verdict === "malicious" || conflict) {
+            verdict = conflict ? "suspicious" : "malicious";
+        }
+        else if (deterministic.riskScore >= 0.65 && semantic.verdict === "benign") {
+            verdict = "suspicious";
+        }
+    }
+    if (conflict) {
+        reasons.add("corpus_conflict");
+        verdict = "suspicious";
+        confidence = Math.min(confidence, 0.5);
+    }
+    const policyDecision = recommendedAction(verdict, confidence, policy, matches, conflict);
+    const evidence = Object.freeze({
+        ...(corpusVersion === undefined ? {} : { corpusVersion }),
+        corpusMatchCount: matches.length,
+        ...(provider === undefined ? {} : { provider }),
+        ...(model === undefined ? {} : { model }),
+        deterministicReasons: Object.freeze([...deterministic.reasons]),
+        latencyMs: Math.max(0, Date.now() - startedAt),
+    });
+    return Object.freeze({
+        ok: true,
+        link,
+        verdict,
+        riskScore: clampUnit(riskScore),
+        confidence: clampUnit(confidence),
+        reasons: Object.freeze([...reasons]),
+        recommendedAction: policyDecision.action,
+        policyReason: policyDecision.reason,
+        evidence,
+    });
+}
+function deterministicClassification(link, matches) {
+    const reasons = new Set(link.flags);
+    const labels = new Set(matches.map((match) => match.entry.label));
+    if (labels.has("malicious"))
+        reasons.add("corpus_malicious_match");
+    if (labels.has("suspicious"))
+        reasons.add("corpus_suspicious_match");
+    if (labels.has("benign"))
+        reasons.add("corpus_benign_match");
+    if (labels.size > 1)
+        reasons.add("corpus_conflict");
+    if (labels.size > 1) {
+        return {
+            verdict: "suspicious",
+            riskScore: 0.75,
+            confidence: 0.5,
+            reasons: [...reasons],
+        };
+    }
+    if (labels.has("malicious")) {
+        return { verdict: "malicious", riskScore: 1, confidence: 1, reasons: [...reasons] };
+    }
+    if (labels.has("suspicious")) {
+        return {
+            verdict: "suspicious",
+            riskScore: 0.75,
+            confidence: 1,
+            reasons: [...reasons],
+        };
+    }
+    if (labels.has("benign") && link.flags.length === 0) {
+        return { verdict: "benign", riskScore: 0.05, confidence: 1, reasons: [...reasons] };
+    }
+    const riskScore = heuristicRisk(link);
+    return {
+        verdict: riskScore >= 0.65 ? "suspicious" : "unknown",
+        riskScore,
+        confidence: riskScore >= 0.65 ? 0.6 : 0,
+        reasons: [...reasons],
+    };
+}
+function heuristicRisk(link) {
+    const weights = {
+        punycode_hostname: 0.3,
+        ip_literal: 0.25,
+        private_network_candidate: 0.4,
+        non_default_port: 0.12,
+        long_hostname: 0.12,
+        many_subdomains: 0.12,
+        encoded_path_separator: 0.3,
+        long_path: 0.08,
+    };
+    return clampUnit(link.flags.reduce((total, flag) => total + (weights[flag] ?? 0), 0));
+}
+function recommendedAction(verdict, confidence, policy, matches, conflict) {
+    if (!policy.allowAct) {
+        return { action: "review", reason: "automatic_action_not_enabled" };
+    }
+    if (conflict)
+        return { action: "review", reason: "conflicting_signals" };
+    const knownMalicious = matches.some((match) => match.entry.label === "malicious");
+    if (verdict === "malicious" &&
+        (knownMalicious
+            ? policy.blockKnownMalicious
+            : confidence >= policy.minimumConfidence)) {
+        return { action: "block", reason: "passed" };
+    }
+    if (verdict === "benign" && confidence >= policy.minimumConfidence) {
+        return { action: "allow", reason: "passed" };
+    }
+    if (verdict === "unknown")
+        return { action: "review", reason: "no_reliable_signal" };
+    return { action: "review", reason: "confidence_below_threshold" };
+}
+function validatePolicy(policy) {
+    const value = policy ?? {};
+    const minimumConfidence = value.minimumConfidence ?? DEFAULT_MINIMUM_CONFIDENCE;
+    if (typeof minimumConfidence !== "number" ||
+        !Number.isFinite(minimumConfidence) ||
+        minimumConfidence < 0 ||
+        minimumConfidence > 1) {
+        return { ok: false };
+    }
+    return {
+        ok: true,
+        policy: {
+            allowAct: value.allowAct === true,
+            minimumConfidence,
+            blockKnownMalicious: value.blockKnownMalicious !== false,
+        },
+    };
+}
+function validateClassifierResult(result) {
+    if (!isRecord(result) || typeof result.ok !== "boolean") {
+        return { ok: false, error: "classifier_response_invalid" };
+    }
+    if (!result.ok) {
+        return {
+            ok: false,
+            error: isLinkSafetyErrorCode(result.error)
+                ? result.error
+                : "classifier_response_invalid",
+        };
+    }
+    if (result.verdict !== "benign" &&
+        result.verdict !== "suspicious" &&
+        result.verdict !== "malicious") {
+        return { ok: false, error: "classifier_response_invalid" };
+    }
+    if (!isUnit(result.riskScore) || !isUnit(result.confidence)) {
+        return { ok: false, error: "classifier_response_invalid" };
+    }
+    const reasons = result.reasons;
+    if (reasons !== undefined &&
+        (!Array.isArray(reasons) ||
+            reasons.length > 16 ||
+            reasons.some((reason) => !isReason(reason)))) {
+        return { ok: false, error: "classifier_response_invalid" };
+    }
+    return {
+        ok: true,
+        verdict: result.verdict,
+        riskScore: result.riskScore,
+        confidence: result.confidence,
+        ...(reasons === undefined ? {} : { reasons: Object.freeze([...reasons]) }),
+        ...(typeof result.provider === "string" && result.provider.length <= 128
+            ? { provider: result.provider }
+            : {}),
+        ...(typeof result.model === "string" && result.model.length <= 128
+            ? { model: result.model }
+            : {}),
+    };
+}
+function isValidCorpus(value) {
+    return (isRecord(value) &&
+        typeof value.version === "string" &&
+        typeof value.lookup === "function");
+}
+function isValidClassifier(value) {
+    return (isRecord(value) &&
+        typeof value.id === "string" &&
+        value.id.length > 0 &&
+        typeof value.classify === "function");
+}
+function mergeOptions(defaults, options) {
+    return {
+        ...defaults,
+        ...options,
+        policy: { ...defaults.policy, ...options.policy },
+    };
+}
+function failure(error, startedAt, link) {
+    return Object.freeze({
+        ok: false,
+        error,
+        recommendedAction: "review",
+        ...(link === undefined ? {} : { link }),
+        latencyMs: Math.max(0, Date.now() - startedAt),
+    });
+}
+function isLinkSafetyErrorCode(value) {
+    return typeof value === "string" && ERROR_CODE_SET.has(value);
+}
+function isReason(value) {
+    return typeof value === "string" && REASON_SET.has(value);
+}
+function isUnit(value) {
+    return (typeof value === "number" && Number.isFinite(value) && value >= 0 && value <= 1);
+}
+function clampUnit(value) {
+    return Math.max(0, Math.min(1, Number.isFinite(value) ? value : 0));
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=scan.js.map