dsh-sherlock 0.0.0-stage → 0.1.1

package/CHANGELOG.md

@@ -0,0 +1,15 @@
+# Changelog
+
+## 0.1.1 — 2026-11-08
+
+- Initial public release (npm staged-publish path).
+- `sherlock_check` and `sherlock_sites` tools over a pinned Sherlock manifest.
+- Six result states with confidence and evidence.
+- Random negative-control verification for claimed results.
+- Per-host rate limiting, bounded response bodies, cancellation, and an in-memory cache.
+- Optional `sherlock-osint` skill.
+- 481-site data snapshot, 45 curated core names (41 effective), 47 exclusions.
+
+## 0.1.0 — 2026-11-08
+
+- Internal packaging iteration; not published to npm.

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,11 @@
+dsh-sherlock
+Copyright 2026 PerryLink
+
+This product includes site manifest data derived from the Sherlock project
+(https://github.com/sherlock-project/sherlock), which is licensed under the
+MIT License. The upstream license text is reproduced in
+data/SHERLOCK-LICENSE.
+
+dsh-sherlock is an independent integration and is not affiliated with or
+endorsed by the Sherlock project. The Sherlock name is used only to describe
+compatibility with its site-manifest format.

package/README.md

@@ -1,3 +1,136 @@
-# Temporary Holding Version
+# dsh-sherlock
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Sherlock-compatible public username checks for [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) (DSH).
+
+It turns the [Sherlock](https://github.com/sherlock-project/sherlock) site manifest into a DSH-native bundle with two tools and an on-demand skill. It is deliberately **not** a 1:1 port of the Python CLI: blocked, unknown, and unreliable results stay separate from claimed and available ones.
+
+> Not affiliated with or endorsed by the Sherlock project. The name describes compatibility with its site-manifest format.
+
+## What it does
+
+- `sherlock_check` checks one public handle across a pinned snapshot of 481 sites.
+- `sherlock_sites` lists site names, detector types, and reliability tiers so the model can choose targets.
+- `sherlock-osint` skill explains the six result states, verification, reporting, and boundaries.
+
+Default scope is a curated **core set of 41 effective sites** (45 names minus 4 exclusions). `scope: "all"` broadens the sample, but a single call is capped at **120** sites. NSFW sites are off by default.
+
+## Install
+
+```bash
+# npm
+dsh plugin --profile <profile> add dsh-sherlock
+
+# GitHub (no build step, no allowBuilds)
+dsh plugin --profile <profile> add github:PerryLink/dsh-sherlock#<40-hex-sha>
+
+# local checkout
+dsh plugin --profile <profile> add ./dsh-sherlock
+```
+
+Verify the layer:
+
+```bash
+dsh --profile <profile> --dump-config | grep -A2 dsh-sherlock
+```
+
+Then ask DSH:
+
+```text
+Check whether the handle "alice" exists on the core sites and summarize the leads.
+```
+
+Or call the tool directly in PTC:
+
+```js
+await tools.sherlock_check({ username: 'alice', scope: 'core' })
+```
+
+## Result states
+
+| State | Meaning | How to treat it |
+|---|---|---|
+| `claimed` | A profile-shaped response | A lead, not proof of identity |
+| `available` | The site's not-found signal | Not proof the handle is unused everywhere |
+| `unknown` | Timeout, DNS/TLS, 5xx, detector mismatch | Could not check; do not infer absence |
+| `blocked` | 401/403/429/999 or WAF | Blocked; do not infer absence |
+| `illegal` | Handle fails the site's `regexCheck` | Site does not allow this format |
+| `unreliable` | The random control handle was also "claimed" | Site rule is broken for this query |
+
+`confidence` is `high`, `medium`, or `low`; `evidence` records the HTTP status, detector, redirects, and control result without returning page HTML.
+
+## Configuration
+
+Set config on the plugin row in your profile patch:
+
+```yaml
+- insert:
+    - id: dsh-sherlock
+      name: dsh-sherlock
+      config:
+        defaultScope: core
+        maxSites: 120
+        concurrency: 10
+        perHostDelayMs: 350
+        timeoutMs: 10000
+        toolTimeoutMs: 180000
+        maxResponseBytes: 524288
+        maxVerify: 30
+        cacheTtlMs: 600000
+        includeNsfw: false
+        honorExclusions: true
+```
+
+| Key | Default | Notes |
+|---|---|---|
+| `defaultScope` | `core` | `core` or `all` |
+| `maxSites` | `120` | Hard cap |
+| `concurrency` | `10` | 1–50 |
+| `perHostDelayMs` | `350` | Per-host serialization + delay |
+| `timeoutMs` | `10000` | Per request |
+| `toolTimeoutMs` | `180000` | Cooperative tool deadline |
+| `maxResponseBytes` | `524288` | Body cap; message matching stops at the cap |
+| `maxVerify` | `30` | Random negative-control probes for claimed results |
+| `cacheTtlMs` | `600000` | Claimed/available; blocked/unknown use at most 60s |
+| `includeNsfw` | `false` | Deployment default |
+| `honorExclusions` | `true` | Upstream false-positive exclusions |
+| `userAgent` | package UA | Transparent by default |
+| `manifestPath` | bundled data | Advanced/testing; no model-supplied URL |
+
+Network proxies are handled by DSH: export `HTTPS_PROXY` / `HTTP_PROXY` before launching `dsh`; the plugin uses plain `fetch` and inherits the process-wide dispatcher. Do not pass a proxy from the model.
+
+## Safety
+
+- Public pages only; no login, paywall, captcha bypass, or credential use.
+- The tool never returns raw HTML; fetch a profile page separately with `web_fetch` if you need to verify it.
+- URL templates are vendored and validated; redirects are checked; private/loopback destinations are rejected unless a test explicitly enables them.
+- Header allowlist: `Cookie`, `Authorization`, and `Host` are dropped.
+- Per-host rate limiting, a 512 KB body cap, and bounded concurrency are on by default.
+- No bulk scanning, WAF evasion, or high-impact decision support.
+
+Use responsibly and follow the target sites' terms and applicable law.
+
+## Data
+
+`data/sites.json` is a normalized snapshot of the Sherlock manifest. It records the upstream commit, raw SHA-256, and counts in `data/SOURCE.json`. The data is MIT-licensed; see `data/SHERLOCK-LICENSE` and `NOTICE`.
+
+The data is pinned so installs are reproducible. Update it with `scripts/sync-sherlock.mjs` (maintainers) and publish a patch release after review. Do not fetch the manifest at model-call time.
+
+## Development
+
+Requires Node 24.9+.
+
+```bash
+npm test                 # node --test, fixture server only
+npm run check            # data-pack validation
+npm run pack:check       # npm pack --dry-run
+```
+
+Tests cover status codes, messages, response URLs, WAF, redirects, POST payloads, custom headers, timeouts, body caps, exclusions, negative controls, caching, tool schemas, and data integrity. The real DSH schema validator can be used with:
+
+```bash
+DSH_TOOLS_PATH=/path/to/dsh-tools/lib/index.js npm test
+```
+
+## License
+
+Apache-2.0 for the plugin code; MIT for the Sherlock-derived data. See `LICENSE`, `NOTICE`, and `data/SHERLOCK-LICENSE`.

package/README.zh.md

@@ -0,0 +1,136 @@
+# dsh-sherlock
+
+面向 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness)（DSH）的 Sherlock 兼容用户名检查插件。
+
+它把 [Sherlock](https://github.com/sherlock-project/sherlock) 的站点清单变成一个 DSH 原生 bundle：两个工具 + 一个按需加载的 skill。它不是 Python CLI 的 1:1 移植——**被拦截、未知、不可信**会和已占用、可用明确分开。
+
+> 与 Sherlock 项目无隶属或背书关系；名字只表示兼容其站点清单格式。
+
+## 能做什么
+
+- `sherlock_check`：用固定快照检查一个公开 handle，覆盖 481 个站点。
+- `sherlock_sites`：列出站点名、检测器类型和可靠性，供模型选择目标。
+- `sherlock-osint` skill：解释六态、复核、报告模板和边界。
+
+默认范围是 curated **core 41 个有效站点**（45 个名字扣除 4 个排除项）。`scope: "all"` 扩大范围，但单次最多 **120** 个站点；NSFW 默认关闭。
+
+## 安装
+
+```bash
+# npm
+dsh plugin --profile <profile> add dsh-sherlock
+
+# GitHub（无构建步骤，不需要 allowBuilds）
+dsh plugin --profile <profile> add github:PerryLink/dsh-sherlock#<40-hex-sha>
+
+# 本地
+dsh plugin --profile <profile> add ./dsh-sherlock
+```
+
+验证：
+
+```bash
+dsh --profile <profile> --dump-config | grep -A2 dsh-sherlock
+```
+
+然后对 DSH 说：
+
+```text
+检查 handle "alice" 在 core 站点上是否存在，并总结线索。
+```
+
+PTC 里也可以直接调用：
+
+```js
+await tools.sherlock_check({ username: 'alice', scope: 'core' })
+```
+
+## 六态
+
+| 状态 | 含义 | 应该怎么用 |
+|---|---|---|
+| `claimed` | 检测到 profile 形状 | 是线索，不是身份证明 |
+| `available` | 命中站点的 not-found 信号 | 不代表全网不存在 |
+| `unknown` | 超时/DNS/TLS/5xx/检测器不匹配 | 没查成，不能推断不存在 |
+| `blocked` | 401/403/429/999 或 WAF | 被拦截，不能推断不存在 |
+| `illegal` | 不匹配站点 `regexCheck` | 该站点不允许这个格式 |
+| `unreliable` | 随机对照 handle 也被 claimed | 站点规则失效，这个 lead 不可信 |
+
+`confidence` 为 `high`/`medium`/`low`；`evidence` 记录 HTTP 状态、检测器、重定向和对照结果，不返回页面 HTML。
+
+## 配置
+
+在 profile patch 的插件行上配置：
+
+```yaml
+- insert:
+    - id: dsh-sherlock
+      name: dsh-sherlock
+      config:
+        defaultScope: core
+        maxSites: 120
+        concurrency: 10
+        perHostDelayMs: 350
+        timeoutMs: 10000
+        toolTimeoutMs: 180000
+        maxResponseBytes: 524288
+        maxVerify: 30
+        cacheTtlMs: 600000
+        includeNsfw: false
+        honorExclusions: true
+```
+
+| 配置 | 默认 | 说明 |
+|---|---|---|
+| `defaultScope` | `core` | `core` 或 `all` |
+| `maxSites` | `120` | 硬上限 |
+| `concurrency` | `10` | 1–50 |
+| `perHostDelayMs` | `350` | 同一 host 串行 + 间隔 |
+| `timeoutMs` | `10000` | 单请求 |
+| `toolTimeoutMs` | `180000` | 工具截止时间 |
+| `maxResponseBytes` | `524288` | 响应体上限；匹配到上限为止 |
+| `maxVerify` | `30` | claimed 的随机负样本上限 |
+| `cacheTtlMs` | `600000` | claimed/available；blocked/unknown 最多 60s |
+| `includeNsfw` | `false` | 部署级默认 |
+| `honorExclusions` | `true` | 上游 false-positive 排除项 |
+| `userAgent` | 包默认 UA | 默认透明 |
+| `manifestPath` | 包内数据 | 高级/测试用；不接受模型给 URL |
+
+网络代理由 DSH 处理：启动 `dsh` 前 export `HTTPS_PROXY` / `HTTP_PROXY`，插件用 plain `fetch` 自动继承进程级 dispatcher；不要让模型传 proxy。
+
+## 安全边界
+
+- 只查公开页面；不登录、不绕付费墙/验证码、不使用凭据。
+- 工具不返回原始 HTML；需要看 profile 页面时单独用 `web_fetch`。
+- URL 模板来自包内数据并校验；重定向逐跳检查；默认拒绝私有/回环地址（测试开关除外）。
+- Header allowlist：丢弃 `Cookie`、`Authorization`、`Host`。
+- 默认 per-host 限速、512 KB body cap、并发上限。
+- 不做批量扫号、WAF 绕过或高风险决策。
+
+请遵守目标站点条款和适用法律。
+
+## 数据
+
+`data/sites.json` 是 Sherlock manifest 的归一化快照；`data/SOURCE.json` 记录 upstream commit、raw SHA-256 和计数。数据为 MIT；见 `data/SHERLOCK-LICENSE` 与 `NOTICE`。
+
+数据固定随包发布，保证可复现；维护者用 `scripts/sync-sherlock.mjs` 更新、review 后发 patch 版本。不要在模型调用时拉取 manifest。
+
+## 开发
+
+需要 Node 24.9+。
+
+```bash
+npm test                 # node --test，只用本地 fixture
+npm run check            # 数据校验
+npm run pack:check       # npm pack --dry-run
+```
+
+测试覆盖状态码、message、response_url、WAF、重定向、POST payload、自定义 header、超时、body cap、排除项、负样本、缓存、工具 schema 和数据完整性。真实 DSH schema 校验：
+
+```bash
+DSH_TOOLS_PATH=/path/to/dsh-tools/lib/index.js npm test
+```
+
+## 许可
+
+插件代码 Apache-2.0；Sherlock 派生数据 MIT。见 `LICENSE`、`NOTICE`、`data/SHERLOCK-LICENSE`。

package/cordis.patch.yml

@@ -0,0 +1,3 @@
+- insert:
+    - id: dsh-sherlock
+      name: dsh-sherlock

package/data/SHERLOCK-LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2019 Sherlock Project
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/data/SOURCE.json

@@ -0,0 +1,14 @@
+{
+  "project": "sherlock-project/sherlock",
+  "upstreamCommit": "c588d7c8b476df9f9c84912a05d1430fb8cdcdae",
+  "fetchedAt": "2026-11-08T10:29:51.582Z",
+  "rawSha256": "3fdfc6694c5cd99798881215554b09e617c6d5284a6219fae309882566a9fb30",
+  "rawSites": 481,
+  "exportedSites": 481,
+  "excluded": 47,
+  "nsfw": 19,
+  "core": 45,
+  "effectiveDefault": 417,
+  "license": "MIT",
+  "licenseFile": "data/SHERLOCK-LICENSE"
+}

package/data/curation.json

@@ -0,0 +1,87 @@
+{
+  "schemaVersion": 1,
+  "lastReviewed": "2026-11-08",
+  "core": [
+    "About.me",
+    "AllMyLinks",
+    "Bandcamp",
+    "Behance",
+    "BitBucket",
+    "Blogger",
+    "Bluesky",
+    "BuyMeACoffee",
+    "Codeberg",
+    "Codecademy",
+    "Docker Hub",
+    "Dribbble",
+    "Duolingo",
+    "Flickr",
+    "GitBook",
+    "GitHub",
+    "GitLab",
+    "Gitea",
+    "Gitee",
+    "GoodReads",
+    "Gravatar",
+    "HackerNews",
+    "HackerRank",
+    "Hugging Face",
+    "Kaggle",
+    "Keybase",
+    "LeetCode",
+    "Letterboxd",
+    "Linktree",
+    "Medium",
+    "Patreon",
+    "Pinterest",
+    "ProductHunt",
+    "PyPi",
+    "Reddit",
+    "SoundCloud",
+    "Spotify",
+    "Telegram",
+    "Twitch",
+    "Vimeo",
+    "WordPress",
+    "YouTube",
+    "last.fm",
+    "mastodon.social",
+    "npm"
+  ],
+  "lowReliability": [
+    "APClips",
+    "AdmireMe.Vip",
+    "All Things Worn",
+    "BongaCams",
+    "ChaturBate",
+    "Discord",
+    "Dribbble",
+    "Erome",
+    "Forum Ophilia",
+    "Heavy-R",
+    "Image Fap",
+    "Instagram",
+    "LinkedIn",
+    "LushStories",
+    "Medium",
+    "Motherless",
+    "PocketStars",
+    "Pornhub",
+    "RedTube",
+    "Reddit",
+    "RocketTube",
+    "TikTok",
+    "TnAFlix",
+    "Twitch",
+    "Twitter",
+    "Xvideos",
+    "YouPorn",
+    "YouTube",
+    "threads",
+    "xHamster"
+  ],
+  "notes": {
+    "core": "Curated default set: broad, public, and likely to survive a plain HTTP client. Excluded names are filtered at runtime.",
+    "lowReliability": "Heuristic: WAF/login wall or fragile detector. Results are still returned, but confidence is capped by the engine."
+  }
+}

package/data/exclusions.txt

@@ -0,0 +1,47 @@
+Airliners
+Apple Developer
+Apple Discussions
+Archive.org
+Blogger
+Championat
+Chatujme.cz
+Codolio
+DeviantArt
+Discord.bio
+GaiaOnline
+GeeksforGeeks
+HackerNews
+Hashnode
+Hubski
+HudsonRock
+Instapaper
+Minecraft
+ObservableHQ
+Odysee
+PCGamer
+Rarible
+Realmeye
+Reddit
+ReverbNation
+RocketTube
+Scribd
+Shelf
+SlideShare
+Splice
+Spotify
+TnAFlix
+Trakt
+TryHackMe
+Velomania
+Vero
+YandexMusic
+authorSTREAM
+dailykos
+fixya
+hunting
+igromania
+interpals
+mercadolivre
+opennet
+phpRU
+social.tchncs.de