dexterm-cli 0.0.0-stage → 0.1.2

package/dist/packages/data/src/larp/evidence.js

@@ -0,0 +1,288 @@
+// LARP detector — mechanical evidence signals (task-1315). Pure + deterministic
+// given fetched bytes; no network except through an injected fetcher. These are
+// SIGNALS, never verdicts: the analyst weighs them. HTML is parsed with regex
+// only (zero-dep, and we never execute it) because the page is untrusted data.
+import { classifyLink, parseHttpUrl } from "./links.js";
+const DRAINER_SIGNATURES = [
+    [/setApprovalForAll/i, 'setApprovalForAll (ERC-721/1155 approval drainer)'],
+    [/permit2|permit\(/i, 'permit/permit2 signature grab'],
+    [/eth_sendTransaction|window\.ethereum/i, 'EVM wallet calls on a Solana token (chain mismatch)'],
+    [/eval\s*\(\s*atob\s*\(/i, 'eval(atob( obfuscated script'],
+    [/Function\s*\(\s*atob/i, 'Function(atob( obfuscated script'],
+    [/drainer|seaport\.js|inferno|monkey-drainer|pink-drainer/i, 'known drainer-kit string'],
+    [/signAllTransactions[\s\S]{0,400}(SystemProgram\.transfer|createTransferInstruction)/i, 'sign-all then transfer-all pattern'],
+];
+const BUILDER_SIGNATURES = [
+    [/\.carrd\.co|data-carrd|cardScript/i, 'carrd'],
+    [/static\.wixstatic\.com|X-Wix-|wix\.com/i, 'wix'],
+    [/squarespace\.com|static1\.squarespace/i, 'squarespace'],
+    [/framerusercontent\.com|framer\.com|data-framer/i, 'framer'],
+    [/assets\.website-files\.com|webflow\.(io|com)|data-wf-/i, 'webflow'],
+    [/cdn\.durable\.co|durable\.co/i, 'durable'],
+    [/\.github\.io|github-pages/i, 'github-pages'],
+    [/vercel\.app|_next\/static/i, 'vercel/next'],
+    [/netlify\.app|netlify/i, 'netlify'],
+    [/dorik|data-dorik/i, 'dorik'],
+];
+const DEFAULT_PAGE_SIGNATURES = [
+    [/there isn.?t a github pages site here|404\.html/i, 'github-pages 404'],
+    [/the deployment could not be found|deployment_not_found|welcome to vercel/i, 'vercel default/missing'],
+    [/this (domain|site) is (for sale|parked)|buy this domain|parkingcrew|sedoparking|godaddy\.com\/domainfind/i, 'parked domain'],
+    [/future home of something|default web page|it works!|apache2 (ubuntu|debian) default/i, 'web-server default page'],
+    [/site not found|no such app|there's nothing here/i, 'host placeholder (missing app)'],
+    [/this site can.?t be reached|dns_probe_finished/i, 'unreachable'],
+    [/^\s*(coming soon|under construction)\s*$/i, 'coming-soon stub'],
+];
+function firstMatch(html, table) {
+    for (const [re, name] of table)
+        if (re.test(html))
+            return name;
+    return null;
+}
+function allMatches(html, table) {
+    const out = [];
+    for (const [re, name] of table)
+        if (re.test(html))
+            out.push(name);
+    return out;
+}
+function tag(html, re) {
+    const m = re.exec(html);
+    return m ? m[1].replace(/\s+/g, ' ').trim() : null;
+}
+/** Strip tags/scripts/styles to a rough visible-text approximation. */
+function visibleText(html) {
+    return html
+        .replace(/<script[\s\S]*?<\/script>/gi, ' ')
+        .replace(/<style[\s\S]*?<\/style>/gi, ' ')
+        .replace(/<!--[\s\S]*?-->/g, ' ')
+        .replace(/<[^>]+>/g, ' ')
+        .replace(/&[a-z#0-9]+;/gi, ' ')
+        .replace(/\s+/g, ' ')
+        .trim();
+}
+/** Every absolute http(s) href/src on the page. */
+export function extractUrls(html, baseUrl) {
+    const out = new Set();
+    const re = /(?:href|src)\s*=\s*["']([^"']+)["']/gi;
+    let m;
+    while ((m = re.exec(html)) !== null) {
+        const raw = m[1];
+        let abs;
+        try {
+            abs = new URL(raw, baseUrl ?? undefined).toString();
+        }
+        catch {
+            abs = null;
+        }
+        const p = abs ? parseHttpUrl(abs) : null;
+        if (p)
+            out.add(p.toString());
+    }
+    return [...out];
+}
+function hostOf(url) {
+    const u = parseHttpUrl(url);
+    return u ? u.hostname.toLowerCase().replace(/^www\./, '') : null;
+}
+/**
+ * Compute mechanical signals from a fetched page. `symbol`/`name` enable the "does the site even
+ * mention this token" check. Returns a `fetched:false` bundle (with the block reason) when the
+ * fetch failed, so the analyst can report it as a missing-data fact rather than guess.
+ */
+export function pageSignals(res, opts = {}) {
+    const base = {
+        fetched: res.ok, status: res.status, finalUrl: res.ok ? res.finalUrl : null, blocked: res.blocked,
+        title: null, description: null, generator: null, siteBuilder: null, defaultPage: null,
+        textLength: 0, linkCount: 0, externalHosts: [], hasApp: false, hasDocs: false, hasWhitepaper: false,
+        hasGithub: false, walletConnect: false, drainerFlags: [], scriptHosts: [], mentionsSymbol: null, mentionsName: null, excerpt: '',
+        links: [], teamClaim: false, stockTextSignals: [],
+    };
+    if (!res.ok || !res.body)
+        return base;
+    const html = res.body;
+    const finalHost = hostOf(res.finalUrl);
+    const title = tag(html, /<title[^>]*>([\s\S]*?)<\/title>/i);
+    const description = tag(html, /<meta[^>]+name=["']description["'][^>]*content=["']([^"']*)["']/i)
+        ?? tag(html, /<meta[^>]+property=["']og:description["'][^>]*content=["']([^"']*)["']/i);
+    const generator = tag(html, /<meta[^>]+name=["']generator["'][^>]*content=["']([^"']*)["']/i);
+    const text = visibleText(html);
+    const urls = extractUrls(html, res.finalUrl);
+    const externalHosts = [...new Set(urls.map(hostOf).filter((h) => !!h && h !== finalHost))];
+    const scriptRe = /<script[^>]+src\s*=\s*["']([^"']+)["']/gi;
+    const scriptHosts = new Set();
+    let sm;
+    while ((sm = scriptRe.exec(html)) !== null) {
+        const h = hostOf(sm[1].startsWith('http') ? sm[1] : new URL(sm[1], res.finalUrl ?? 'https://x/').toString());
+        if (h && h !== finalHost)
+            scriptHosts.add(h);
+    }
+    const kinds = new Set(urls.map((u) => { const p = parseHttpUrl(u); return p ? classifyLink(p) : 'other'; }));
+    const lowerHtml = html.toLowerCase();
+    const hasApp = /\b(launch app|open app|dapp|\/app\b|app\.|demo|try (it|now)|get started)\b/i.test(text) || /href=["'][^"']*\/(app|dapp|demo)\b/i.test(html);
+    const sym = (opts.symbol ?? '').replace(/^\$/, '').toLowerCase();
+    const name = (opts.name ?? '').toLowerCase();
+    const lowerText = text.toLowerCase();
+    return {
+        ...base,
+        title: title ? title.slice(0, 160) : null,
+        description: description ? description.slice(0, 300) : null,
+        generator: generator ? generator.slice(0, 80) : null,
+        siteBuilder: firstMatch(html, BUILDER_SIGNATURES) ?? (generator ? generator.split(/[\s(]/)[0].toLowerCase() : null),
+        defaultPage: firstMatch(text, DEFAULT_PAGE_SIGNATURES) ?? (text.length < 40 ? 'near-empty page' : null),
+        textLength: text.length,
+        linkCount: urls.length,
+        externalHosts: externalHosts.slice(0, 30),
+        hasApp,
+        hasDocs: kinds.has('docs') || /\bdocs?\b|documentation|whitepaper|litepaper/i.test(text),
+        hasWhitepaper: /whitepaper|litepaper/i.test(lowerHtml),
+        hasGithub: kinds.has('github'),
+        walletConnect: /connect\s*wallet|walletconnect|@solana\/wallet-adapter|window\.solana|phantom|solflare/i.test(html),
+        drainerFlags: allMatches(html, DRAINER_SIGNATURES),
+        scriptHosts: [...scriptHosts].slice(0, 20),
+        mentionsSymbol: sym ? lowerText.includes(sym) : null,
+        mentionsName: name ? lowerText.includes(name) : null,
+        excerpt: text.slice(0, 1200),
+        links: urls.slice(0, 24).map((url) => ({ url, kind: classifyLink(new URL(url)) })),
+        teamClaim: /\b(our team|founder|co-founder|meet the team)\b/i.test(text),
+        stockTextSignals: allMatches(text, [[/lorem ipsum/i, 'lorem ipsum placeholder'], [/your (company|brand|business) (name|here)/i, 'template placeholder'], [/insert (text|copy|title) here/i, 'unfilled template']]),
+    };
+}
+/** Exact advertised domain, stripping only www. Without a PSL, never attribute
+ * a public suffix's registration (co.uk) to a project (docs.coin.co.uk).
+ * RDAP may refuse a subdomain; that is missing data, not an invented age. */
+export function registrableDomain(url) {
+    const u = parseHttpUrl(url);
+    if (!u)
+        return null;
+    const host = u.hostname.toLowerCase().replace(/^www\./, '');
+    if (/^\d/.test(host) || host.includes(':'))
+        return null; // IP literal
+    const parts = host.split('.');
+    if (parts.length < 2)
+        return null;
+    return host;
+}
+/** Domain registration age + registrar via RDAP (rdap.org bootstrap). Keyless. */
+export async function domainAgeViaRdap(url, fetchText, now = () => Date.now()) {
+    const domain = registrableDomain(url);
+    const base = { domain: domain ?? '', registeredAt: null, ageDays: null, registrar: null, privacy: null, source: 'rdap', error: null };
+    if (!domain)
+        return { ...base, error: 'no registrable domain' };
+    let r;
+    try {
+        r = await fetchText(`https://rdap.org/domain/${encodeURIComponent(domain)}`);
+    }
+    catch (e) {
+        return { ...base, error: `rdap fetch failed: ${e.message}` };
+    }
+    if (!r.ok)
+        return { ...base, error: `rdap status ${r.status}` };
+    let data;
+    try {
+        data = JSON.parse(r.body);
+    }
+    catch {
+        return { ...base, error: 'rdap: invalid json' };
+    }
+    const events = data.events ?? [];
+    const reg = events.find((e) => e.eventAction === 'registration')?.eventDate ?? null;
+    const entities = data.entities ?? [];
+    const registrar = entities.find((e) => e.roles?.includes('registrar'))?.vcardArray ? vcardName(entities.find((e) => e.roles?.includes('registrar')).vcardArray) : null;
+    const registrant = entities.find((e) => e.roles?.includes('registrant'));
+    const privacy = registrant ? /redact|privacy|protect|withheld|gdpr/i.test(JSON.stringify(registrant)) : null;
+    const ageDays = reg ? Math.max(0, Math.round((now() - Date.parse(reg)) / 86_400_000)) : null;
+    return { domain, registeredAt: reg, ageDays: Number.isFinite(ageDays) ? ageDays : null, registrar, privacy, source: 'rdap', error: null };
+}
+function vcardName(vcardArray) {
+    // vCard jCard: ["vcard", [ ["fn", {}, "text", "Name"], ... ]]
+    try {
+        const entries = vcardArray[1];
+        const fn = entries.find((e) => e[0] === 'fn');
+        return fn ? String(fn[3]).slice(0, 80) : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Parse github.com/<owner>/<repo> from a URL. */
+export function parseGithubRepo(url) {
+    const u = parseHttpUrl(url);
+    if (!u || u.hostname.toLowerCase().replace(/^www\./, '') !== 'github.com')
+        return null;
+    const parts = u.pathname.split('/').filter(Boolean);
+    if (parts.length < 2)
+        return null;
+    const owner = parts[0];
+    const repo = parts[1].replace(/\.git$/, '');
+    if (/^(orgs|sponsors|features|about|topics|collections|marketplace)$/i.test(owner))
+        return null;
+    return { owner, repo };
+}
+/** Repo creation/last-push/stars via the keyless GitHub REST API (60 req/hr unauth). */
+export async function githubRepoActivity(url, fetchText, now = () => Date.now()) {
+    const r = parseGithubRepo(url);
+    if (!r)
+        return null;
+    const base = { owner: r.owner, repo: r.repo, createdAt: null, pushedAt: null, daysSincePush: null, stars: null, openIssues: null, archived: null, fork: null, description: null, error: null };
+    let res;
+    try {
+        res = await fetchText(`https://api.github.com/repos/${encodeURIComponent(r.owner)}/${encodeURIComponent(r.repo)}`);
+    }
+    catch (e) {
+        return { ...base, error: `github fetch failed: ${e.message}` };
+    }
+    if (!res.ok)
+        return { ...base, error: res.status === 404 ? 'repo not found' : `github status ${res.status}` };
+    let d;
+    try {
+        d = JSON.parse(res.body);
+    }
+    catch {
+        return { ...base, error: 'github: invalid json' };
+    }
+    const pushedAt = typeof d.pushed_at === 'string' ? d.pushed_at : null;
+    const daysSincePush = pushedAt ? Math.max(0, Math.round((now() - Date.parse(pushedAt)) / 86_400_000)) : null;
+    const commits = [];
+    let historyError = null;
+    try {
+        const history = await fetchText(`https://api.github.com/repos/${encodeURIComponent(r.owner)}/${encodeURIComponent(r.repo)}/commits?per_page=5`);
+        const parsed = history.ok ? JSON.parse(history.body) : null;
+        if (!Array.isArray(parsed))
+            historyError = `commit history unavailable (${history.status})`;
+        else
+            for (const item of parsed.slice(0, 5)) {
+                if (typeof item?.sha === 'string' && /^[a-f0-9]{40}$/.test(item.sha))
+                    commits.push({ sha: item.sha, date: typeof item.commit?.committer?.date === 'string' ? item.commit.committer.date : null });
+            }
+    }
+    catch {
+        historyError = 'commit history unavailable';
+    }
+    return {
+        owner: r.owner, repo: r.repo,
+        createdAt: typeof d.created_at === 'string' ? d.created_at : null,
+        pushedAt, daysSincePush,
+        stars: typeof d.stargazers_count === 'number' ? d.stargazers_count : null,
+        openIssues: typeof d.open_issues_count === 'number' ? d.open_issues_count : null,
+        archived: typeof d.archived === 'boolean' ? d.archived : null,
+        fork: typeof d.fork === 'boolean' ? d.fork : null,
+        description: typeof d.description === 'string' ? d.description.slice(0, 200) : null,
+        commits, historyError,
+        error: null,
+    };
+}
+/** Reachability of a small set of advertised links (broken-link signal). Caller caps the list. */
+export async function probeLinks(urls, fetchProbe, max = 8) {
+    const out = [];
+    for (const url of urls.slice(0, max)) {
+        try {
+            const r = await fetchProbe(url);
+            out.push({ url, ok: r.ok, status: r.status, blocked: r.blocked });
+        }
+        catch (e) {
+            out.push({ url, ok: false, status: 0, blocked: e.message });
+        }
+    }
+    return out;
+}

package/dist/packages/data/src/larp/link-baseline.js

@@ -0,0 +1,196 @@
+// LARP check — links-only baseline grade (task-1401). Pure, offline, deterministic.
+//
+// The LARP check (skill `larp-check`) judges a coin's product from fetched pages, the domain and GitHub. That
+// model stage cannot be replayed on history: the pages are gone or have changed since. What CAN be replayed is
+// the part of the evidence the recorder keeps point-in-time: the website / X / Telegram links a coin advertised
+// (DexScreener `info` + Jupiter metadata, the same fields `get_links` reads). This module turns those three links
+// into named signals and a baseline grade, so the same function scores the backtest eval set and the live
+// `get_links` result the skill starts from.
+//
+// What the grade is: a RISK FLAG from link shape alone, never a verdict on the product. It uses only the skill's
+// verdict names it can honestly reach: `LARP` (the link shape contradicts a product claim: a social or launchpad
+// page posing as the website, a placeholder host, a tweet instead of an account), `UNVERIFIABLE` (no website at
+// all, nothing to vet) and `EARLY_BUT_REAL` (an own-domain site with nothing contradicting it). It never says
+// `REAL_PRODUCT`: links alone cannot show a reachable product. Weights are tuned on the TRAIN split of the
+// recorded eval set only (packages/packs/eval/README.md); the measured test-split numbers ship with the rubric.
+import { parseHttpUrl } from "./links.js";
+/** The named signals a rubric weighs. All are LARP-direction (a weight > 0 pushes toward `LARP`). */
+export const LINK_SIGNALS = [
+    'site_is_social', 'site_is_launchpad', 'site_linktree', 'site_free_host', 'site_no_name_match',
+    'cheap_tld', 'x_not_profile', 'no_x', 'no_tg',
+];
+/**
+ * v0: the pre-tuning rubric, written from the larp-check skill text BEFORE any backtest (task-1401): a social or
+ * launchpad page posing as the website and a tweet/community link instead of an account are the link-visible
+ * LARP signals the skill names; a placeholder host, a link hub, and a site whose domain does not name the coin
+ * count one point each. This is the "before" the tuned rubric is compared with.
+ */
+export const LINK_RUBRIC_V0 = {
+    id: 'larp-links-v0',
+    weights: { site_is_social: 2, site_is_launchpad: 2, site_linktree: 1, site_free_host: 1, site_no_name_match: 1, cheap_tld: 0, x_not_profile: 1, no_x: 0, no_tg: 0 },
+    threshold: 2,
+    provenance: 'hand-written from the larp-check skill text before the backtest (task-1401)',
+};
+/**
+ * v1: tuned on the TRAIN split of packages/packs/eval/skills-eval.json (grid search over weights 0..2 and
+ * threshold 1..5, objective MCC of LARP→bad, ties to the smaller weight sum). Test-split numbers:
+ * packages/packs/eval/skills-backtest.json. Regenerate with `dexterm backtest --subject skills --tune`.
+ */
+export const LINK_RUBRIC_V1 = {
+    id: 'larp-links-v1',
+    weights: { site_is_social: 0, site_is_launchpad: 0, site_linktree: 0, site_free_host: 1, site_no_name_match: 1, cheap_tld: 1, x_not_profile: 2, no_x: 1, no_tg: 1 },
+    threshold: 4,
+    provenance: 'tuned on the train split of the task-1401 eval set (see packages/packs/eval/README.md)',
+};
+/**
+ * The held-out TEST-split counts for LINK_RUBRIC_V1 (packages/packs/eval/skills-backtest.json `larp.after.test`).
+ * A test asserts these match the committed report, so a re-tune cannot ship stale numbers.
+ */
+export const LINK_RUBRIC_MEASURED = {
+    rubric: 'larp-links-v1',
+    eval: 'task-1401 eval set, 2026-10-16',
+    horizon: '72h',
+    test: {
+        n: 328, bad: 61,
+        by_grade: { LARP: { n: 14, bad: 4 }, UNVERIFIABLE: { n: 130, bad: 38 }, EARLY_BUT_REAL: { n: 184, bad: 19 } },
+    },
+};
+/** The rubric the live `get_links` baseline uses. */
+export const DEFAULT_LINK_RUBRIC = LINK_RUBRIC_V1;
+const SOCIAL_HOSTS = new Set([
+    'x.com', 'twitter.com', 'mobile.twitter.com', 't.me', 'telegram.me', 'telegram.dog', 'discord.gg', 'discord.com',
+    'discordapp.com', 'instagram.com', 'tiktok.com', 'youtube.com', 'm.youtube.com', 'youtu.be', 'facebook.com', 'fb.com',
+    'reddit.com', 'threads.net', 'warpcast.com', 'truthsocial.com', 'kick.com', 'twitch.tv',
+]);
+const LAUNCHPAD_HOSTS = new Set([
+    'pump.fun', 'dexscreener.com', 'birdeye.so', 'solscan.io', 'jup.ag', 'raydium.io', 'meteora.ag', 'letsbonk.fun',
+    'bonk.fun', 'moonshot.money', 'believe.app', 'bags.fm', 'gmgn.ai', 'axiom.trade', 'dextools.io', 'coingecko.com',
+    'coinmarketcap.com', 'photon-sol.tinyastro.io', 'geckoterminal.com', 'rugcheck.xyz', 'solana.fm', 'heaven.xyz',
+]);
+const LINKHUB_HOSTS = new Set(['linktr.ee', 'linktree.com', 'link3.to', 'bio.link', 'beacons.ai', 'campsite.bio', 'solo.to', 'lnk.bio', 'hoo.be', 'allmylinks.com']);
+const FREE_HOST_SUFFIXES = [
+    'vercel.app', 'netlify.app', 'github.io', 'carrd.co', 'wixsite.com', 'webflow.io', 'framer.website', 'framer.app',
+    'framer.ai', 'notion.site', 'gitbook.io', 'substack.com', 'pages.dev', 'web.app', 'firebaseapp.com', 'herokuapp.com',
+    'replit.app', 'repl.co', 'glitch.me', 'weebly.com', 'wordpress.com', 'blogspot.com', 'mystrikingly.com',
+    'godaddysites.com', 'squarespace.com', 'medium.com', 'durable.co', 'lovable.app', 'onrender.com', 'surge.sh',
+    'webnode.page', 'site123.me', 'tilda.ws', 'super.site', 'my.canva.site', 'canva.site', 'bolt.host', 'netlify.com',
+];
+const FREE_HOST_EXACT = new Set(['sites.google.com', 'docs.google.com', 'drive.google.com', 'telegra.ph', 'pastebin.com', 'medium.com']);
+const CHEAP_TLDS = new Set(['fun', 'xyz', 'lol', 'meme', 'site', 'online', 'club', 'top', 'vip', 'wtf', 'space', 'icu', 'buzz', 'cfd', 'sbs', 'click', 'live', 'world', 'today', 'pw', 'cc', 'monster', 'rest', 'bond', 'cyou']);
+const X_RESERVED = new Set(['home', 'search', 'explore', 'i', 'hashtag', 'intent', 'share', 'messages', 'notifications', 'settings', 'compose']);
+const hostOf = (u) => u.hostname.toLowerCase().replace(/^www\./, '').replace(/\.$/, '');
+const endsWithHost = (host, suffix) => host === suffix || host.endsWith(`.${suffix}`);
+const norm = (s) => s.toLowerCase().normalize('NFKD').replace(/[^a-z0-9]/g, '');
+function webKind(raw) {
+    if (raw === null || raw === undefined || String(raw).trim() === '')
+        return { kind: 'none', url: null };
+    const u = parseHttpUrl(raw);
+    if (!u)
+        return { kind: 'invalid', url: null };
+    const host = hostOf(u);
+    if ([...SOCIAL_HOSTS].some((h) => endsWithHost(host, h)))
+        return { kind: 'social', url: u };
+    if ([...LAUNCHPAD_HOSTS].some((h) => endsWithHost(host, h)))
+        return { kind: 'launchpad', url: u };
+    if (LINKHUB_HOSTS.has(host))
+        return { kind: 'linktree', url: u };
+    if (FREE_HOST_EXACT.has(host) || FREE_HOST_SUFFIXES.some((s) => host.endsWith(`.${s}`)))
+        return { kind: 'free-host', url: u };
+    return { kind: 'own-domain', url: u };
+}
+function xKind(raw) {
+    if (raw === null || raw === undefined || String(raw).trim() === '')
+        return 'none';
+    const u = parseHttpUrl(raw);
+    if (!u)
+        return 'other';
+    const host = hostOf(u);
+    if (!['x.com', 'twitter.com', 'mobile.twitter.com'].includes(host))
+        return 'other';
+    const parts = u.pathname.split('/').filter(Boolean).map((p) => p.toLowerCase());
+    if (parts[0] === 'i' && parts[1] === 'communities')
+        return 'community';
+    if (!parts.length || X_RESERVED.has(parts[0]))
+        return 'other';
+    if (parts[1] === 'status' || parts[1] === 'statuses')
+        return 'status';
+    if (parts.length === 1 && /^[a-z0-9_]{1,15}$/.test(parts[0]))
+        return 'profile';
+    return 'other';
+}
+/** Does the site's domain carry the token's symbol or name? Symbol ≥ 3 chars, name compacted or a ≥ 4-char word. */
+function domainMatches(u, symbol, name) {
+    const sym = norm(String(symbol ?? '').replace(/^\$/, ''));
+    const nm = norm(String(name ?? ''));
+    const words = String(name ?? '').toLowerCase().split(/[^a-z0-9]+/).filter((w) => w.length >= 4);
+    if (!sym && !nm)
+        return null;
+    const host = hostOf(u);
+    const labels = host.split('.');
+    const body = norm(labels.length > 1 ? labels.slice(0, -1).join('') : host);
+    if (!body)
+        return false;
+    if (sym.length >= 3 && body.includes(sym))
+        return true;
+    if (nm.length >= 3 && body.includes(nm))
+        return true;
+    return words.some((w) => body.includes(norm(w)));
+}
+/**
+ * Derive the URL-free features from the three primary links (the store's merge: Jupiter first, then DexScreener's
+ * first website / first X / first Telegram). `symbol`/`name` enable the domain-match signal; they are not kept.
+ */
+export function linkFeatures(input) {
+    const w = webKind(input.web);
+    return {
+        web: w.kind,
+        x: xKind(input.x),
+        tg: !!(input.tg && String(input.tg).trim()),
+        webMatchesToken: w.url && (w.kind === 'own-domain' || w.kind === 'free-host') ? domainMatches(w.url, input.symbol, input.name) : null,
+        cheapTld: w.url && w.kind === 'own-domain' ? CHEAP_TLDS.has(hostOf(w.url).split('.').pop() ?? '') : null,
+    };
+}
+/** The signals present in a feature set. */
+export function linkSignals(f) {
+    const s = [];
+    if (f.web === 'social')
+        s.push('site_is_social');
+    if (f.web === 'launchpad')
+        s.push('site_is_launchpad');
+    if (f.web === 'linktree')
+        s.push('site_linktree');
+    if (f.web === 'free-host' || f.web === 'invalid')
+        s.push('site_free_host');
+    if (f.webMatchesToken === false)
+        s.push('site_no_name_match');
+    if (f.cheapTld === true)
+        s.push('cheap_tld');
+    if (f.x === 'status' || f.x === 'community' || f.x === 'other')
+        s.push('x_not_profile');
+    if (f.x === 'none')
+        s.push('no_x');
+    if (!f.tg)
+        s.push('no_tg');
+    return s;
+}
+/** Grade one coin's links with a rubric. No website at all is `UNVERIFIABLE` (fixed rule, never tuned). */
+export function gradeLinks(f, rubric = DEFAULT_LINK_RUBRIC) {
+    const signals = linkSignals(f);
+    const score = signals.reduce((a, s) => a + (rubric.weights[s] ?? 0), 0);
+    const grade = f.web === 'none' ? 'UNVERIFIABLE' : score >= rubric.threshold ? 'LARP' : 'EARLY_BUT_REAL';
+    return { rubric: rubric.id, grade, score, signals };
+}
+/**
+ * The store's primary-link merge (packages/data/src/store.ts: Jupiter first, then DexScreener), so the live
+ * baseline reads the same three links the recorder's cache holds for the eval set.
+ */
+export function primaryLinks(src) {
+    const info = src.dexscreener?.info;
+    const dsX = info?.socials?.find((s) => s?.type === 'twitter' || s?.type === 'x')?.url ?? null;
+    const dsTg = info?.socials?.find((s) => s?.type === 'telegram')?.url ?? null;
+    return {
+        web: src.jupiter?.website ?? info?.websites?.[0]?.url ?? null,
+        x: src.jupiter?.twitter ?? dsX,
+        tg: src.jupiter?.telegram ?? dsTg,
+    };
+}

package/dist/packages/data/src/larp/links.js

@@ -0,0 +1,137 @@
+// LARP detector — link extraction (task-1315). Pure, offline, deterministic.
+// Collects every website/social link a coin advertises from the three keyless
+// sources we already read — DexScreener token `info` (websites[] + socials[]),
+// Jupiter token metadata (website/twitter/telegram) and the pump.fun metadata
+// URI JSON — then classifies and de-duplicates them. No network here: callers
+// pass already-fetched raw shapes. Only http/https links survive; mailto:,
+// javascript:, data: and relative links are dropped.
+const MAX_LINKS = 24;
+/** Parse to a URL only if it is a syntactically valid absolute http(s) link. */
+export function parseHttpUrl(raw) {
+    if (typeof raw !== 'string')
+        return null;
+    const s = raw.trim();
+    if (!s || s.length > 2048)
+        return null;
+    let u;
+    try {
+        u = new URL(s);
+    }
+    catch {
+        return null;
+    }
+    if (u.protocol !== 'http:' && u.protocol !== 'https:')
+        return null;
+    if (u.username || u.password)
+        return null;
+    if (!u.hostname)
+        return null;
+    return u;
+}
+/** Lower-cased host with any leading `www.` removed. */
+function bareHost(u) {
+    return u.hostname.toLowerCase().replace(/^www\./, '');
+}
+/** Classify a link by host (and path for docs). Host is the source of truth, not any label. */
+export function classifyLink(u) {
+    const host = bareHost(u);
+    const path = u.pathname.toLowerCase();
+    if (host === 'twitter.com' || host === 'x.com' || host === 'fxtwitter.com' || host === 'nitter.net' || host === 't.co')
+        return 'x';
+    if (host === 't.me' || host === 'telegram.me' || host === 'telegram.dog')
+        return 'telegram';
+    if (host === 'discord.gg' || host === 'discord.com' || host === 'discordapp.com')
+        return 'discord';
+    if (host === 'github.com' || host === 'raw.githubusercontent.com')
+        return 'github';
+    if (host === 'medium.com' || host.endsWith('.medium.com'))
+        return 'medium';
+    if (host === 'youtube.com' || host === 'youtu.be' || host.endsWith('.youtube.com'))
+        return 'youtube';
+    if (host === 'reddit.com' || host.endsWith('.reddit.com'))
+        return 'reddit';
+    if (host === 'instagram.com' || host.endsWith('.instagram.com'))
+        return 'instagram';
+    if (host === 'tiktok.com' || host.endsWith('.tiktok.com'))
+        return 'tiktok';
+    if (host === 'facebook.com' || host === 'fb.com' || host.endsWith('.facebook.com'))
+        return 'facebook';
+    if (host === 'linktr.ee' || host === 'linktree.com')
+        return 'linktree';
+    if (host.endsWith('.gitbook.io') || host === 'gitbook.io' || host.startsWith('docs.') || path.startsWith('/docs') || path.startsWith('/whitepaper'))
+        return 'docs';
+    return 'website';
+}
+/** A short, injection-inert label for the link list (host; DexScreener website labels when sane). */
+function labelFor(u, rawLabel, kind) {
+    const host = bareHost(u);
+    if (kind === 'website' && rawLabel) {
+        const clean = rawLabel.replace(/[\u0000-\u001F\u007F]/g, '').replace(/\s+/g, ' ').trim().slice(0, 24);
+        if (clean)
+            return clean;
+    }
+    return host;
+}
+/** Map a DexScreener social `type` to our kind when the host is ambiguous (host still wins). */
+function socialTypeKind(type) {
+    switch ((type ?? '').toLowerCase()) {
+        case 'twitter':
+        case 'x': return 'x';
+        case 'telegram': return 'telegram';
+        case 'discord': return 'discord';
+        case 'github': return 'github';
+        case 'medium': return 'medium';
+        case 'youtube': return 'youtube';
+        case 'reddit': return 'reddit';
+        case 'instagram': return 'instagram';
+        case 'tiktok': return 'tiktok';
+        case 'facebook': return 'facebook';
+        default: return null;
+    }
+}
+/** De-dup key: scheme-insensitive host + path (ignores trailing slash and query). */
+function dedupKey(u) {
+    return `${bareHost(u)}${u.pathname.replace(/\/+$/, '')}`.toLowerCase();
+}
+/**
+ * Extract and classify every advertised link for a token. Source order sets priority for the
+ * primary website/x/telegram picks and for de-duplication (the first occurrence wins its label).
+ */
+export function extractLinks(src) {
+    const out = [];
+    const seen = new Set();
+    const add = (raw, source, typeHint, rawLabel) => {
+        if (out.length >= MAX_LINKS)
+            return;
+        const u = parseHttpUrl(raw);
+        if (!u)
+            return;
+        const key = dedupKey(u);
+        if (seen.has(key))
+            return;
+        seen.add(key);
+        // Host classification wins; the DexScreener `type` only disambiguates a generic host.
+        let kind = classifyLink(u);
+        if (kind === 'website') {
+            const hinted = socialTypeKind(typeHint);
+            if (hinted)
+                kind = hinted;
+        }
+        out.push({ kind, url: u.toString(), label: labelFor(u, rawLabel, kind), source });
+    };
+    // 1) DexScreener info: explicit websites[] then socials[].
+    for (const w of src.dexscreener?.info?.websites ?? [])
+        add(w?.url, 'dexscreener', undefined, w?.label);
+    for (const s of src.dexscreener?.info?.socials ?? [])
+        add(s?.url, 'dexscreener', s?.type, s?.label);
+    // 2) Jupiter flat fields.
+    add(src.jupiter?.website, 'jupiter');
+    add(src.jupiter?.twitter, 'jupiter', 'twitter');
+    add(src.jupiter?.telegram, 'jupiter', 'telegram');
+    // 3) pump.fun metadata URI JSON.
+    add(src.pumpfun?.website, 'pumpfun');
+    add(src.pumpfun?.twitter ?? src.pumpfun?.x, 'pumpfun', 'twitter');
+    add(src.pumpfun?.telegram, 'pumpfun', 'telegram');
+    const first = (k) => out.find((l) => l.kind === k)?.url ?? null;
+    return { website: first('website'), x: first('x'), telegram: first('telegram'), all: out };
+}