safe-link-checker 1.0.0

package/dist/chunk-CS7EDB5I.js

@@ -0,0 +1,1806 @@
+import ipaddr from 'ipaddr.js';
+import isURL from 'validator/lib/isURL.js';
+import https from 'https';
+import http from 'http';
+import dns from 'dns';
+import punycode from 'punycode';
+import { parse } from 'tldts';
+import normalizeUrl from 'normalize-url';
+
+// src/cache/lru.ts
+var LRUCache = class {
+  cache;
+  maxSize;
+  ttlMs;
+  constructor(options = {}) {
+    this.maxSize = options.maxSize ?? 1e3;
+    this.ttlMs = options.ttlMs ?? 1e3 * 60 * 60;
+    this.cache = /* @__PURE__ */ new Map();
+  }
+  get(url) {
+    const entry = this.cache.get(url);
+    if (!entry) return null;
+    if (Date.now() > entry.expiresAt) {
+      this.cache.delete(url);
+      return null;
+    }
+    this.cache.delete(url);
+    this.cache.set(url, entry);
+    return entry.value;
+  }
+  set(url, result) {
+    if (this.cache.size >= this.maxSize && !this.cache.has(url)) {
+      const firstKey = this.cache.keys().next().value;
+      if (firstKey !== void 0) {
+        this.cache.delete(firstKey);
+      }
+    }
+    this.cache.delete(url);
+    this.cache.set(url, {
+      value: result,
+      expiresAt: Date.now() + this.ttlMs
+    });
+  }
+  clear() {
+    this.cache.clear();
+  }
+  get size() {
+    return this.cache.size;
+  }
+};
+
+// src/cache/memory.ts
+var defaultCache = new LRUCache();
+var LOCAL_HOSTNAMES = /* @__PURE__ */ new Set(["localhost", "broadcasthost"]);
+var LOCAL_HOSTNAME_SUFFIX = ".local";
+var BLOCKED_IPV4_RANGES = [
+  "loopback",
+  // 127.0.0.0/8
+  "private",
+  // 10/8, 172.16/12, 192.168/16
+  "linkLocal",
+  // 169.254.0.0/16
+  "broadcast",
+  // 255.255.255.255/32
+  "carrierGradeNat",
+  // 100.64.0.0/10
+  "unspecified"
+  // 0.0.0.0
+];
+var BLOCKED_IPV6_RANGES = [
+  "loopback",
+  // ::1
+  "linkLocal",
+  // fe80::/10
+  "uniqueLocal",
+  // fc00::/7 (fc/fd)
+  "unspecified"
+  // ::
+];
+function describeRange(range) {
+  const descriptions = {
+    loopback: "loopback address",
+    private: "private network address (RFC 1918)",
+    linkLocal: "link-local address",
+    broadcast: "broadcast address",
+    carrierGradeNat: "carrier-grade NAT address",
+    uniqueLocal: "unique local IPv6 address",
+    unspecified: "unspecified address"
+  };
+  return descriptions[range] ?? `reserved range "${range}"`;
+}
+function validateIp(urlStr) {
+  let hostname;
+  try {
+    hostname = new URL(urlStr).hostname.toLowerCase();
+  } catch {
+    return { name: "IP Validator", detector: "ip-parser", category: "network", severity: "info", safe: true, scoreImpact: 0, title: "Unparseable IP", message: "Could not parse hostname." };
+  }
+  const bracketStripped = hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+  const rawHost = bracketStripped.includes("%") ? bracketStripped.slice(0, bracketStripped.indexOf("%")) : bracketStripped;
+  if (LOCAL_HOSTNAMES.has(rawHost)) {
+    return {
+      name: "IP Validator",
+      detector: "ip-localhost",
+      category: "network",
+      severity: "critical",
+      safe: false,
+      scoreImpact: 100,
+      title: "Localhost Address Detected",
+      message: `High risk: "${rawHost}" resolves to a local/loopback address.`,
+      fatal: true
+    };
+  }
+  if (rawHost.endsWith(LOCAL_HOSTNAME_SUFFIX)) {
+    return {
+      name: "IP Validator",
+      detector: "ip-mdns",
+      category: "network",
+      severity: "critical",
+      safe: false,
+      scoreImpact: 100,
+      title: "mDNS Address Detected",
+      message: `High risk: "${rawHost}" is a link-local mDNS hostname (.local).`,
+      fatal: true
+    };
+  }
+  if (!ipaddr.isValid(rawHost)) {
+    return { name: "IP Validator", detector: "ip-domain", category: "network", severity: "info", safe: true, scoreImpact: 0, title: "Standard Domain", message: "Hostname is a domain name, not a raw IP." };
+  }
+  const addr = ipaddr.parse(rawHost);
+  if (addr.kind() === "ipv4") {
+    const range = addr.range();
+    if (BLOCKED_IPV4_RANGES.includes(range)) {
+      return {
+        name: "IP Validator",
+        detector: "ip-v4-private",
+        category: "network",
+        severity: "critical",
+        safe: false,
+        scoreImpact: 100,
+        title: "Private IPv4 Address",
+        message: `High risk: IP address is a ${describeRange(range)}.`,
+        fatal: true
+      };
+    }
+  } else {
+    const v6 = addr;
+    const range = v6.range();
+    if (BLOCKED_IPV6_RANGES.includes(range)) {
+      return {
+        name: "IP Validator",
+        detector: "ip-v6-private",
+        category: "network",
+        severity: "critical",
+        safe: false,
+        scoreImpact: 100,
+        title: "Private IPv6 Address",
+        message: `High risk: IPv6 address is a ${describeRange(range)}.`,
+        fatal: true
+      };
+    }
+    if (v6.isIPv4MappedAddress()) {
+      const v4 = v6.toIPv4Address();
+      const v4Range = v4.range();
+      if (BLOCKED_IPV4_RANGES.includes(v4Range)) {
+        return {
+          name: "IP Validator",
+          detector: "ip-v6-mapped-private",
+          category: "network",
+          severity: "critical",
+          safe: false,
+          scoreImpact: 100,
+          title: "Private IPv4-Mapped IPv6 Address",
+          message: `High risk: IPv4-mapped IPv6 address maps to a ${describeRange(v4Range)}.`,
+          fatal: true
+        };
+      }
+    }
+  }
+  return {
+    name: "IP Validator",
+    detector: "ip-public",
+    category: "network",
+    severity: "info",
+    safe: true,
+    scoreImpact: 0,
+    title: "Public IP",
+    message: "IP address is not in a private or reserved range."
+  };
+}
+
+// src/providers/urlhaus.ts
+var URLHausProvider = class {
+  name = "URLHaus Provider";
+  cache = new LRUCache({ maxSize: 1e3, ttlMs: 1e3 * 60 * 60 * 24 });
+  // 24h cache
+  offlineDataset = /* @__PURE__ */ new Set();
+  datasetLoaded = false;
+  updateInterval = null;
+  async init() {
+    await this.updateDataset();
+    this.updateInterval = setInterval(() => {
+      this.updateDataset().catch(() => {
+      });
+    }, 1e3 * 60 * 60 * 24);
+    if (this.updateInterval.unref) {
+      this.updateInterval.unref();
+    }
+  }
+  async updateDataset() {
+    try {
+      const controller = new AbortController();
+      const timeoutId = setTimeout(() => controller.abort(), 1e4);
+      const res = await fetch("https://urlhaus.abuse.ch/downloads/csv_online/", {
+        signal: controller.signal
+      });
+      clearTimeout(timeoutId);
+      if (!res.ok) return;
+      const text = await res.text();
+      const lines = text.split("\n");
+      const newDataset = /* @__PURE__ */ new Set();
+      for (const line of lines) {
+        if (line.startsWith("#") || !line.trim()) continue;
+        const parts = line.split('","');
+        if (parts.length > 2) {
+          const url = parts[2]?.replace(/"/g, "").trim();
+          if (url) newDataset.add(url);
+        }
+      }
+      this.offlineDataset = newDataset;
+      this.datasetLoaded = true;
+    } catch {
+    }
+  }
+  async check(url, options) {
+    const cached = this.cache.get(url);
+    if (cached) {
+      return cached;
+    }
+    let result = null;
+    if (this.datasetLoaded) {
+      if (this.offlineDataset.has(url)) {
+        result = {
+          name: this.name,
+          detector: "urlhaus-offline",
+          category: "provider",
+          severity: "critical",
+          title: "Malware Site Detected (URLHaus)",
+          safe: false,
+          scoreImpact: 100,
+          weight: 100,
+          confidence: 99,
+          message: "URL is listed on URLHaus (offline dataset) as a known malware distribution site.",
+          fatal: true
+        };
+      } else {
+        result = {
+          name: this.name,
+          detector: "urlhaus-offline",
+          category: "provider",
+          severity: "info",
+          title: "Not Listed",
+          safe: true,
+          scoreImpact: 0,
+          confidence: 90,
+          // offline may be slightly stale
+          message: "URL not found in URLHaus database (offline)."
+        };
+      }
+    } else {
+      result = await this.doCheckOnline(url, options);
+    }
+    if (result) {
+      this.cache.set(url, result);
+    }
+    return result;
+  }
+  async doCheckOnline(url, options) {
+    try {
+      const form = new URLSearchParams();
+      form.append("url", url);
+      const controller = new AbortController();
+      const timeout = 3e3;
+      let timeoutId;
+      const signal = options?.signal || (() => {
+        timeoutId = setTimeout(() => controller.abort(), timeout);
+        return controller.signal;
+      })();
+      try {
+        const response = await fetch("https://urlhaus-api.abuse.ch/v1/url/", {
+          method: "POST",
+          headers: { "Content-Type": "application/x-www-form-urlencoded" },
+          body: form.toString(),
+          signal
+        });
+        if (!response.ok) throw new Error("Network response was not ok");
+        const data = await response.json();
+        if (data && data.query_status === "ok") {
+          return {
+            name: this.name,
+            detector: "urlhaus-online",
+            category: "provider",
+            severity: "critical",
+            title: "Malware Site Detected (URLHaus)",
+            safe: false,
+            scoreImpact: 100,
+            weight: 100,
+            // Very high severity
+            confidence: 99,
+            message: "URL is listed on URLHaus as a known malware distribution site.",
+            metadata: { threat: data.threat },
+            fatal: true
+          };
+        }
+        return {
+          name: this.name,
+          detector: "urlhaus-online",
+          category: "provider",
+          severity: "info",
+          title: "Not Listed",
+          safe: true,
+          scoreImpact: 0,
+          confidence: 100,
+          message: "URL not found in URLHaus database."
+        };
+      } finally {
+        if (timeoutId) clearTimeout(timeoutId);
+      }
+    } catch {
+      return {
+        name: this.name,
+        detector: "urlhaus-error",
+        category: "provider",
+        severity: "medium",
+        title: "Provider Check Failed",
+        safe: true,
+        scoreImpact: 0,
+        confidence: 0,
+        message: "URLHaus check failed or timed out. Skipping."
+      };
+    }
+  }
+};
+
+// src/providers/openphish.ts
+var OpenPhishProvider = class {
+  name = "OpenPhish Provider";
+  cache = new LRUCache({ maxSize: 1e3, ttlMs: 1e3 * 60 * 60 * 24 });
+  // 24h cache
+  async check(url, options) {
+    const cached = this.cache.get(url);
+    if (cached) {
+      return cached;
+    }
+    const result = await this.doCheck(url, options);
+    if (result) {
+      this.cache.set(url, result);
+    }
+    return result;
+  }
+  async doCheck(_url, _options) {
+    try {
+      return {
+        name: this.name,
+        detector: "openphish-simulated",
+        category: "provider",
+        severity: "info",
+        title: "OpenPhish Not Listed",
+        safe: true,
+        scoreImpact: 0,
+        confidence: 100,
+        message: "OpenPhish check passed (Simulated)."
+      };
+    } catch {
+      return {
+        name: this.name,
+        detector: "openphish-error",
+        category: "provider",
+        severity: "medium",
+        title: "Provider Check Failed",
+        safe: true,
+        scoreImpact: 0,
+        confidence: 0,
+        message: "OpenPhish check failed or timed out. Skipping."
+      };
+    }
+  }
+};
+function validateUrl(urlStr) {
+  const trimmed = urlStr.trim();
+  const checkURL = isURL;
+  if (!checkURL(trimmed, { require_protocol: true })) {
+    return {
+      name: "URL Validator",
+      detector: "url-syntax",
+      category: "domain",
+      severity: "critical",
+      safe: false,
+      scoreImpact: 100,
+      title: "Malformed URL Syntax",
+      message: "Malformed URL: Failed syntax validation.",
+      fatal: true
+    };
+  }
+  if (/[\r\n\t]/.test(trimmed)) {
+    return {
+      name: "URL Validator",
+      detector: "url-smuggling",
+      category: "network",
+      severity: "critical",
+      safe: false,
+      scoreImpact: 100,
+      title: "HTTP Smuggling Attempt",
+      message: "Malformed URL: Contains illegal characters (CR, LF, or Tab).",
+      fatal: true
+    };
+  }
+  try {
+    const parsed = new URL(trimmed);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+      return {
+        name: "URL Validator",
+        detector: "url-protocol",
+        category: "network",
+        severity: "high",
+        safe: false,
+        scoreImpact: 100,
+        title: "Unsupported Protocol",
+        message: `Unsupported protocol "${parsed.protocol}". Only HTTP and HTTPS are allowed.`,
+        fatal: true
+      };
+    }
+    if (!parsed.hostname) {
+      return {
+        name: "URL Validator",
+        detector: "url-hostname",
+        category: "domain",
+        severity: "critical",
+        safe: false,
+        scoreImpact: 100,
+        title: "Missing Hostname",
+        message: "Invalid URL: Hostname is missing.",
+        fatal: true
+      };
+    }
+    return {
+      name: "URL Validator",
+      detector: "url-validator",
+      category: "domain",
+      severity: "info",
+      safe: true,
+      scoreImpact: 0,
+      title: "Valid URL",
+      message: "URL is valid and protocol is supported."
+    };
+  } catch (err) {
+    return {
+      name: "URL Validator",
+      detector: "url-parser",
+      category: "domain",
+      severity: "critical",
+      safe: false,
+      scoreImpact: 100,
+      title: "Parser Error",
+      message: `Malformed URL: ${err instanceof Error ? err.message : String(err)}`,
+      fatal: true
+    };
+  }
+}
+var CERT_ERROR_CODES = /* @__PURE__ */ new Set([
+  "CERT_HAS_EXPIRED",
+  "CERT_NOT_YET_VALID",
+  "DEPTH_ZERO_SELF_SIGNED_CERT",
+  "SELF_SIGNED_CERT_IN_CHAIN",
+  "UNABLE_TO_VERIFY_LEAF_SIGNATURE",
+  "CERT_SIGNATURE_FAILURE",
+  "UNABLE_TO_GET_ISSUER_CERT",
+  "UNABLE_TO_GET_ISSUER_CERT_LOCALLY",
+  "ERR_TLS_CERT_ALTNAME_INVALID"
+]);
+var TIMEOUT_ERROR_CODES = /* @__PURE__ */ new Set([
+  "ETIMEDOUT",
+  "ECONNRESET",
+  "SOCKET_TIMEOUT"
+]);
+function makeResult(status, safe, scoreImpact, title, message, severity) {
+  return {
+    name: "HTTPS Validator",
+    detector: "https-probe",
+    category: "certificate",
+    severity,
+    title,
+    safe,
+    scoreImpact,
+    message,
+    metadata: { httpsStatus: status }
+  };
+}
+async function validateHttps(urlStr, timeoutMs = 5e3, signal) {
+  let parsed;
+  try {
+    parsed = new URL(urlStr);
+  } catch {
+    return makeResult("SKIPPED", true, 0, "Unparseable URL", "Could not parse URL for HTTPS check.", "info");
+  }
+  if (parsed.protocol === "http:") {
+    const httpsUrl = urlStr.replace(/^http:/, "https:");
+    const httpsResult = await probeHttps(httpsUrl, timeoutMs, signal);
+    if (httpsResult.status === "HTTPS") {
+      return makeResult(
+        "HTTP_ONLY",
+        false,
+        20,
+        "Unencrypted Connection",
+        "URL uses HTTP. An HTTPS version is available but the link uses an unencrypted connection.",
+        "medium"
+      );
+    }
+    if (httpsResult.status === "CERT_ERROR") {
+      return makeResult(
+        "CERT_ERROR",
+        false,
+        40,
+        "Certificate Error",
+        `TLS/SSL certificate error on HTTPS probe: ${httpsResult.detail}`,
+        "critical"
+      );
+    }
+    return makeResult(
+      "HTTP_ONLY",
+      false,
+      20,
+      "Unencrypted Connection",
+      "URL uses HTTP. Could not confirm whether an HTTPS version is available.",
+      "medium"
+    );
+  }
+  const result = await probeHttps(urlStr, timeoutMs, signal);
+  switch (result.status) {
+    case "HTTPS":
+      return makeResult("HTTPS", true, 0, "Secure Connection", "HTTPS is enabled and the certificate is valid.", "info");
+    case "CERT_ERROR":
+      return makeResult(
+        "CERT_ERROR",
+        false,
+        40,
+        "Certificate Error",
+        `TLS/SSL certificate error: ${result.detail}`,
+        "critical"
+      );
+    case "TIMEOUT":
+      return makeResult(
+        "TIMEOUT",
+        true,
+        0,
+        "Connection Timeout",
+        "HTTPS probe timed out. The server may be slow or rate-limiting. No penalty applied.",
+        "info"
+      );
+    default:
+      return makeResult(
+        "UNREACHABLE",
+        true,
+        0,
+        "Host Unreachable",
+        `HTTPS probe could not reach the server: ${result.detail}. No penalty applied.`,
+        "info"
+      );
+  }
+}
+function probeHttps(urlStr, timeoutMs, signal) {
+  return new Promise((resolve) => {
+    let settled = false;
+    const settle = (r) => {
+      if (!settled) {
+        settled = true;
+        resolve(r);
+      }
+    };
+    let parsed;
+    try {
+      parsed = new URL(urlStr);
+    } catch {
+      return settle({ status: "UNREACHABLE", detail: "Malformed URL" });
+    }
+    const options = {
+      hostname: parsed.hostname,
+      port: parsed.port || 443,
+      path: parsed.pathname + parsed.search,
+      method: "HEAD",
+      timeout: timeoutMs,
+      signal
+      // We intentionally do NOT set rejectUnauthorized:false so cert errors surface
+    };
+    const req = https.request(options, (res) => {
+      res.resume();
+      settle({ status: "HTTPS", detail: `HTTP ${res.statusCode}` });
+    });
+    req.on("timeout", () => {
+      req.destroy();
+      settle({ status: "TIMEOUT", detail: "Request timed out" });
+    });
+    req.on("error", (err) => {
+      const code = err.code ?? "";
+      if (CERT_ERROR_CODES.has(code)) {
+        return settle({ status: "CERT_ERROR", detail: err.message });
+      }
+      if (TIMEOUT_ERROR_CODES.has(code)) {
+        return settle({ status: "TIMEOUT", detail: err.message });
+      }
+      settle({ status: "UNREACHABLE", detail: err.message });
+    });
+    req.end();
+  });
+}
+var safeLookup = (hostname, options, callback) => {
+  dns.lookup(hostname, options, (err, address, family) => {
+    if (err) {
+      return callback(err, address, family);
+    }
+    let ipToCheck = null;
+    if (typeof address === "string") {
+      ipToCheck = address;
+    } else if (Array.isArray(address) && address.length > 0) {
+      const first = address[0];
+      if (first && typeof first === "object" && "address" in first) {
+        ipToCheck = first.address;
+      }
+    }
+    if (ipToCheck) {
+      const urlStr = ipToCheck.includes(":") ? `http://[${ipToCheck}]` : `http://${ipToCheck}`;
+      const ipResult = validateIp(urlStr);
+      if (!ipResult.safe && process.env.NODE_ENV !== "test") {
+        return callback(new Error(`Security Exception: DNS Rebinding Blocked. Hostname resolved to forbidden IP: ${ipToCheck}`), address, family);
+      }
+    }
+    callback(null, address, family);
+  });
+};
+
+// src/validators/redirect.ts
+var DEFAULT_MAX_REDIRECTS = 5;
+var DEFAULT_TIMEOUT_MS = 5e3;
+var REDIRECT_CODES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
+async function traceRedirects(urlStr, options = {}) {
+  const maxRedirects = options.maxRedirects ?? DEFAULT_MAX_REDIRECTS;
+  const timeoutMs = options.timeout ?? DEFAULT_TIMEOUT_MS;
+  const chain = [urlStr];
+  const seen = /* @__PURE__ */ new Set([urlStr]);
+  const anomalies = [];
+  let current = urlStr;
+  for (let hop = 0; hop < maxRedirects; hop++) {
+    const result = await headRequest(current, timeoutMs, options.signal);
+    if (!result) {
+      break;
+    }
+    if (!REDIRECT_CODES.has(result.statusCode)) {
+      break;
+    }
+    const location = result.location;
+    if (!location) {
+      break;
+    }
+    let nextUrl;
+    try {
+      nextUrl = new URL(location, current).toString();
+    } catch {
+      break;
+    }
+    if (seen.has(nextUrl)) {
+      if (!anomalies.includes("LOOP")) anomalies.push("LOOP");
+      break;
+    }
+    if (current.startsWith("https://") && nextUrl.startsWith("http://")) {
+      if (!anomalies.includes("PROTOCOL_DOWNGRADE")) anomalies.push("PROTOCOL_DOWNGRADE");
+    }
+    seen.add(nextUrl);
+    chain.push(nextUrl);
+    current = nextUrl;
+  }
+  if (chain.length - 1 >= maxRedirects) {
+    const result = await headRequest(current, timeoutMs, options.signal);
+    if (result && REDIRECT_CODES.has(result.statusCode)) {
+      if (!anomalies.includes("MAX_REDIRECTS_EXCEEDED")) {
+        anomalies.push("MAX_REDIRECTS_EXCEEDED");
+      }
+    }
+  }
+  return {
+    chain,
+    finalUrl: current,
+    redirectCount: chain.length - 1,
+    anomalies
+  };
+}
+function headRequest(urlStr, timeoutMs, signal) {
+  return new Promise((resolve) => {
+    let settled = false;
+    const settle = (v) => {
+      if (!settled) {
+        settled = true;
+        resolve(v);
+      }
+    };
+    let parsed;
+    try {
+      parsed = new URL(urlStr);
+    } catch {
+      return settle(null);
+    }
+    const isHttps = parsed.protocol === "https:";
+    const requester = isHttps ? https : http;
+    const options = {
+      hostname: parsed.hostname,
+      port: parsed.port || (isHttps ? 443 : 80),
+      path: parsed.pathname + parsed.search,
+      method: "HEAD",
+      timeout: timeoutMs,
+      signal,
+      lookup: safeLookup,
+      // SSRF & DNS Rebinding Protection
+      // Skip cert validation so we can follow chains even with bad certs
+      // (the https validator is responsible for cert scoring separately)
+      rejectUnauthorized: false
+    };
+    const req = requester.request(options, (res) => {
+      res.resume();
+      settle({
+        statusCode: res.statusCode ?? 0,
+        location: Array.isArray(res.headers.location) ? res.headers.location[0] : res.headers.location
+      });
+    });
+    req.setTimeout(timeoutMs, () => {
+      req.destroy();
+      settle(null);
+    });
+    req.on("timeout", () => {
+      req.destroy();
+      settle(null);
+    });
+    req.on("error", () => settle(null));
+    req.end();
+  });
+}
+
+// src/validators/shortener.ts
+var DEFAULT_SHORTENERS = /* @__PURE__ */ new Set([
+  "bit.ly",
+  "tinyurl.com",
+  "t.co",
+  "shorturl.at",
+  "rb.gy",
+  "rebrand.ly",
+  "cutt.ly",
+  "tiny.cc"
+]);
+function validateShortener(urlStr, customShorteners = []) {
+  let hostname;
+  try {
+    hostname = new URL(urlStr).hostname.toLowerCase();
+  } catch {
+    return { name: "Shortener Validator", detector: "shortener-parser", category: "domain", severity: "info", safe: true, scoreImpact: 0, title: "Unparseable URL", message: "Invalid URL." };
+  }
+  const isShortener = DEFAULT_SHORTENERS.has(hostname) || customShorteners.includes(hostname);
+  if (isShortener) {
+    return {
+      name: "Shortener Validator",
+      detector: "shortener-detected",
+      category: "domain",
+      severity: "medium",
+      title: "URL Shortener Detected",
+      safe: false,
+      // We flag it as unsafe/warning so it impacts score or user is warned
+      scoreImpact: 10,
+      message: `Warning: URL uses a shortening service (${hostname}). It will be expanded.`,
+      metadata: { isShortener: true }
+    };
+  }
+  return {
+    name: "Shortener Validator",
+    detector: "shortener-clean",
+    category: "domain",
+    severity: "info",
+    title: "No Shortener Detected",
+    safe: true,
+    scoreImpact: 0,
+    message: "URL does not appear to be a known shortening service.",
+    metadata: { isShortener: false }
+  };
+}
+function validatePunycode(urlStr) {
+  let hostname;
+  try {
+    hostname = new URL(urlStr).hostname;
+  } catch {
+    return { name: "Punycode Validator", detector: "punycode-parser", category: "domain", severity: "info", safe: true, scoreImpact: 0, title: "Unparseable URL", message: "Invalid URL." };
+  }
+  if (!hostname.includes("xn--")) {
+    return {
+      name: "Punycode Validator",
+      detector: "punycode-clean",
+      category: "domain",
+      severity: "info",
+      safe: true,
+      scoreImpact: 0,
+      title: "Standard Domain",
+      message: "No Punycode detected."
+    };
+  }
+  const labels = hostname.split(".");
+  for (const label of labels) {
+    if (label.startsWith("xn--")) {
+      const decodedLabel = punycode.toUnicode(label);
+      const hasLatin = /[a-zA-Z]/.test(decodedLabel);
+      const hasCyrillic = /[\u0400-\u04FF]/.test(decodedLabel);
+      const hasGreek = /[\u0370-\u03FF]/.test(decodedLabel);
+      const scripts = [hasLatin, hasCyrillic, hasGreek].filter(Boolean);
+      if (scripts.length > 1) {
+        return {
+          name: "Punycode Validator",
+          detector: "punycode-mixed-script",
+          category: "domain",
+          severity: "critical",
+          safe: false,
+          scoreImpact: 100,
+          title: "Mixed-Script Homograph Attack",
+          message: `High risk: Mixed-script label "${decodedLabel}" detected (homograph attack indicator).`,
+          fatal: true
+        };
+      }
+      if (/[\u0430\u0435\u043E\u0440\u0441\u0443\u0445\u03BF\u03C1\u200B\u200C\u200D\uFEFF\u202A-\u202E]/u.test(decodedLabel)) {
+        return {
+          name: "Punycode Validator",
+          detector: "punycode-confusable",
+          category: "domain",
+          severity: "critical",
+          safe: false,
+          scoreImpact: 100,
+          // Elevated severity for explicit confusable/invisible characters
+          title: "Confusable Characters Detected",
+          message: `High risk: Label "${decodedLabel}" contains highly suspicious confusable or invisible Unicode characters.`,
+          fatal: true
+        };
+      }
+    }
+  }
+  const decodedHost = punycode.toUnicode(hostname);
+  return {
+    name: "Punycode Validator",
+    detector: "punycode-usage",
+    category: "domain",
+    severity: "medium",
+    safe: false,
+    scoreImpact: 30,
+    // Base impact for xn-- domains
+    title: "Internationalized Domain Name",
+    message: `Warning: URL uses Punycode (xn--). Decoded: ${decodedHost}`
+  };
+}
+var SUSPICIOUS_TLDS = /* @__PURE__ */ new Set([
+  "tk",
+  "ml",
+  "ga",
+  "cf",
+  "gq",
+  "zip",
+  "mov",
+  "cc",
+  "ru",
+  "cn",
+  "pw",
+  "top",
+  "xyz",
+  "icu",
+  "wang",
+  "space",
+  "work"
+]);
+var SUSPICIOUS_KEYWORDS = [
+  "login",
+  "admin",
+  "secure",
+  "update",
+  "billing",
+  "banking",
+  "verify",
+  "account",
+  "password",
+  "credential",
+  "auth",
+  "support",
+  "service"
+];
+var HIGH_PROFILE_TARGETS = [
+  "google",
+  "apple",
+  "facebook",
+  "microsoft",
+  "amazon",
+  "paypal",
+  "netflix",
+  "chase",
+  "bankofamerica",
+  "linkedin",
+  "twitter",
+  "instagram"
+];
+function levenshtein(a, b) {
+  const matrix = Array.from({ length: a.length + 1 }, () => Array(b.length + 1).fill(0));
+  for (let i = 0; i <= a.length; i++) matrix[i][0] = i;
+  for (let j = 0; j <= b.length; j++) matrix[0][j] = j;
+  for (let i = 1; i <= a.length; i++) {
+    for (let j = 1; j <= b.length; j++) {
+      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+      matrix[i][j] = Math.min(
+        matrix[i - 1][j] + 1,
+        matrix[i][j - 1] + 1,
+        matrix[i - 1][j - 1] + cost
+      );
+    }
+  }
+  return matrix[a.length][b.length];
+}
+function validateHeuristics(url) {
+  const result = {
+    name: "Heuristics Validator",
+    detector: "heuristics-engine",
+    category: "behavior",
+    severity: "info",
+    title: "Heuristics Check Passed",
+    safe: true,
+    scoreImpact: 0,
+    message: "",
+    metadata: {
+      flags: []
+    }
+  };
+  const parsed = parse(url);
+  const flags = [];
+  let penalty = 0;
+  if (parsed.isIp) {
+    flags.push("raw_ip");
+  }
+  if (parsed.publicSuffix && SUSPICIOUS_TLDS.has(parsed.publicSuffix.toLowerCase())) {
+    flags.push("suspicious_tld");
+    penalty += 20;
+  }
+  if (parsed.subdomain) {
+    const depth = parsed.subdomain.split(".").length;
+    if (depth >= 3) {
+      flags.push("excessive_subdomains");
+      penalty += 15;
+    }
+  }
+  const lowerUrl = url.toLowerCase();
+  for (const keyword of SUSPICIOUS_KEYWORDS) {
+    if (lowerUrl.includes(keyword)) {
+      flags.push(`suspicious_keyword:${keyword}`);
+      penalty += 10;
+    }
+  }
+  if (url.includes("@")) {
+    flags.push("credential_trick");
+    penalty += 30;
+  }
+  const encodedCount = (url.match(/%[0-9A-Fa-f]{2}/g) || []).length;
+  if (encodedCount > 10) {
+    flags.push("excessive_encoding");
+    penalty += 15;
+  }
+  if (parsed.domainWithoutSuffix) {
+    const domainName = parsed.domainWithoutSuffix.toLowerCase();
+    for (const target of HIGH_PROFILE_TARGETS) {
+      if (domainName === target) {
+        continue;
+      }
+      const distance = levenshtein(domainName, target);
+      if (distance > 0 && distance <= 2) {
+        flags.push(`lookalike_domain:${target}`);
+        penalty += 40;
+        break;
+      }
+      const deobfuscated = domainName.replace(/0/g, "o").replace(/1/g, "l").replace(/3/g, "e").replace(/5/g, "s");
+      if (deobfuscated === target && deobfuscated !== domainName) {
+        flags.push(`lookalike_domain_substituted:${target}`);
+        penalty += 50;
+        break;
+      }
+    }
+  }
+  if (penalty > 0) {
+    result.safe = false;
+    result.scoreImpact = Math.min(100, penalty);
+    result.metadata.flags = flags;
+    result.title = "Suspicious Heuristics Detected";
+    result.message = `Detected suspicious heuristics: ${flags.join(", ")}`;
+    if (result.scoreImpact >= 50) {
+      result.severity = "critical";
+    } else if (result.scoreImpact >= 30) {
+      result.severity = "high";
+    } else {
+      result.severity = "medium";
+    }
+  }
+  return result;
+}
+var TRACKING_PARAMS = [/^utm_\w+/i, "fbclid", "gclid"];
+function normalizeLink(url, options) {
+  const trimmed = url.trim();
+  try {
+    const u = new URL(trimmed);
+    if (!options?.removeTrackingParams || !u.search) {
+      if (u.pathname === "/" && !u.search && !u.hash) {
+        let simple = trimmed;
+        if (simple.endsWith("/")) simple = simple.slice(0, -1);
+        if (simple === u.origin) return simple;
+      }
+    }
+  } catch {
+  }
+  try {
+    return normalizeUrl(trimmed, {
+      stripWWW: false,
+      removeTrailingSlash: true,
+      stripHash: true,
+      sortQueryParameters: true,
+      removeQueryParameters: options?.removeTrackingParams ? TRACKING_PARAMS : []
+    });
+  } catch {
+    return trimmed;
+  }
+}
+async function extractMetadata(urlStr, timeout = 5e3) {
+  return new Promise((resolve) => {
+    let settled = false;
+    const settle = (v) => {
+      if (!settled) {
+        settled = true;
+        resolve(v);
+      }
+    };
+    let parsed;
+    try {
+      parsed = new URL(urlStr);
+    } catch {
+      return settle(null);
+    }
+    const isHttps = parsed.protocol === "https:";
+    const requester = isHttps ? https : http;
+    const options = {
+      hostname: parsed.hostname,
+      port: parsed.port || (isHttps ? 443 : 80),
+      path: parsed.pathname + parsed.search,
+      method: "GET",
+      timeout,
+      lookup: safeLookup,
+      // SSRF & DNS Rebinding Protection
+      headers: {
+        "User-Agent": "safe-link-checker-bot/1.0",
+        "Accept": "text/html",
+        "Accept-Encoding": "identity"
+        // Prevent compression bombs
+      }
+      // Do not follow redirects here (we already follow them in RedirectTrace!)
+    };
+    const req = requester.request(options, (res) => {
+      const contentType = res.headers["content-type"] || "";
+      if (res.statusCode !== 200 || !contentType.toLowerCase().includes("text/html")) {
+        res.resume();
+        return settle(null);
+      }
+      let html = "";
+      let bytesRead = 0;
+      const MAX_SIZE = 1024 * 500;
+      res.on("data", (chunk) => {
+        bytesRead += chunk.length;
+        if (bytesRead > MAX_SIZE) {
+          req.destroy();
+          parseHtml(html, urlStr, settle);
+          return;
+        }
+        html += chunk.toString("utf8");
+      });
+      res.on("end", () => {
+        if (!settled) parseHtml(html, urlStr, settle);
+      });
+      res.on("error", () => settle(null));
+    });
+    req.setTimeout(timeout, () => {
+      req.destroy();
+      settle(null);
+    });
+    req.on("timeout", () => {
+      req.destroy();
+      settle(null);
+    });
+    req.on("error", () => settle(null));
+    req.end();
+  });
+}
+function parseHtml(html, url, settle) {
+  try {
+    const headMatch = html.match(/<head[^>]*>([\s\S]*?)<\/head>/i);
+    const parseArea = headMatch && headMatch[1] ? headMatch[1] : html;
+    const result = { url };
+    const extractContent = (pattern) => {
+      const match = parseArea.match(pattern);
+      return match ? match[1]?.trim() : void 0;
+    };
+    const ogTitle = extractContent(/<meta[^>]*property=["']og:title["'][^>]*content=["']([^"']+)["'][^>]*>/i);
+    const metaTitle = extractContent(/<title[^>]*>([^<]+)<\/title>/i);
+    const title = ogTitle || metaTitle;
+    if (title !== void 0) result.title = title;
+    const ogDesc = extractContent(/<meta[^>]*property=["']og:description["'][^>]*content=["']([^"']+)["'][^>]*>/i);
+    const metaDesc = extractContent(/<meta[^>]*name=["']description["'][^>]*content=["']([^"']+)["'][^>]*>/i);
+    const description = ogDesc || metaDesc;
+    if (description !== void 0) result.description = description;
+    const ogImage = extractContent(/<meta[^>]*property=["']og:image["'][^>]*content=["']([^"']+)["'][^>]*>/i);
+    if (ogImage !== void 0) result.image = ogImage;
+    const icon1 = extractContent(/<link[^>]*rel=["']icon["'][^>]*href=["']([^"']+)["'][^>]*>/i);
+    const icon2 = extractContent(/<link[^>]*rel=["']shortcut icon["'][^>]*href=["']([^"']+)["'][^>]*>/i);
+    const favicon = icon1 || icon2;
+    if (favicon !== void 0) result.favicon = favicon;
+    if (result.favicon && !result.favicon.startsWith("http")) {
+      try {
+        result.favicon = new URL(result.favicon, url).href;
+      } catch {
+      }
+    }
+    if (result.image && !result.image.startsWith("http")) {
+      try {
+        result.image = new URL(result.image, url).href;
+      } catch {
+      }
+    }
+    settle(result);
+  } catch {
+    settle(null);
+  }
+}
+
+// src/core/events.ts
+var EventEmitter = class {
+  listeners = /* @__PURE__ */ new Map();
+  on(event, callback) {
+    if (!this.listeners.has(event)) {
+      this.listeners.set(event, /* @__PURE__ */ new Set());
+    }
+    this.listeners.get(event).add(callback);
+  }
+  off(event, callback) {
+    const eventListeners = this.listeners.get(event);
+    if (eventListeners) {
+      eventListeners.delete(callback);
+    }
+  }
+  emit(event, arg1, arg2) {
+    const eventListeners = this.listeners.get(event);
+    if (eventListeners) {
+      if (arg2 !== void 0) {
+        for (const listener of eventListeners) {
+          listener(arg1, arg2);
+        }
+      } else if (arg1 !== void 0) {
+        for (const listener of eventListeners) {
+          listener(arg1);
+        }
+      } else {
+        for (const listener of eventListeners) {
+          listener();
+        }
+      }
+    }
+  }
+};
+
+// src/core/plugin.ts
+var PluginManager = class {
+  plugins = [];
+  register(plugin) {
+    if (this.plugins.some((p) => p.name === plugin.name)) {
+      throw new Error(`Plugin ${plugin.name} is already registered.`);
+    }
+    this.plugins.push(plugin);
+  }
+  async initializeAll() {
+    await Promise.all(
+      this.plugins.map((p) => p.initialize ? p.initialize() : Promise.resolve())
+    );
+  }
+  async disposeAll() {
+    await Promise.all(
+      this.plugins.map((p) => p.dispose ? p.dispose() : Promise.resolve())
+    );
+  }
+  getPluginsByType(type) {
+    return this.plugins.filter((p) => p.type === type);
+  }
+  getAll() {
+    return this.plugins;
+  }
+};
+
+// src/engine/consensus.ts
+var ConsensusEngine = class {
+  config;
+  constructor(config) {
+    this.config = {
+      baseScore: 100,
+      riskThresholds: {
+        suspicious: 75,
+        dangerous: 40
+      },
+      ...config
+    };
+  }
+  evaluate(results) {
+    let score = this.config.baseScore;
+    let accumulatedConfidence = 0;
+    let totalWeight = 0;
+    const reasons = [];
+    const validResults = results.filter((r) => r !== null);
+    if (validResults.length === 0) {
+      return {
+        score: this.config.baseScore,
+        trustScore: 100,
+        confidence: 0,
+        riskLevel: "SAFE",
+        reasons: ["No checks performed"],
+        safe: true,
+        summary: "No data available to verify this URL."
+      };
+    }
+    let hasCritical = false;
+    for (const res of validResults) {
+      const weight = res.weight ?? 1;
+      let conf = res.confidence !== void 0 ? res.confidence : 100;
+      if (conf <= 1 && conf > 0) conf = conf * 100;
+      const impact = res.scoreContribution ?? res.scoreImpact ?? 0;
+      const adjustedPenalty = impact * weight * (conf / 100);
+      score -= adjustedPenalty;
+      accumulatedConfidence += conf * weight;
+      totalWeight += weight;
+      if (res.severity === "critical" || res.fatal) hasCritical = true;
+      if (!res.safe || impact > 0 || res.severity === "high" || res.severity === "critical") {
+        const title = res.title ?? res.name;
+        reasons.push(`${title}: ${res.description ?? res.message}`);
+      }
+    }
+    score = Math.max(0, Math.min(100, Math.round(score)));
+    let trustScore = score;
+    const averageConfidence = totalWeight > 0 ? Math.round(accumulatedConfidence / totalWeight) : 0;
+    let riskLevel = "SAFE";
+    if (score <= this.config.riskThresholds.dangerous || hasCritical) {
+      riskLevel = "DANGEROUS";
+      trustScore = 0;
+    } else if (score <= this.config.riskThresholds.suspicious) {
+      riskLevel = "SUSPICIOUS";
+    }
+    let summary = "This website appears legitimate.";
+    if (riskLevel === "DANGEROUS") {
+      summary = "This website should not be visited. It has been flagged as dangerous.";
+    } else if (riskLevel === "SUSPICIOUS") {
+      summary = "This website contains suspicious elements and should be approached with caution.";
+    }
+    return {
+      score,
+      trustScore,
+      confidence: averageConfidence,
+      riskLevel,
+      reasons,
+      safe: riskLevel === "SAFE",
+      summary
+    };
+  }
+};
+
+// src/engine/policy.ts
+var PolicyEngine = class {
+  policies = /* @__PURE__ */ new Map();
+  constructor() {
+    this.registerBuiltIns();
+  }
+  registerBuiltIns() {
+    this.policies.set("strict", (ctx) => {
+      if (ctx.riskLevel !== "SAFE" || ctx.score > 0) {
+        return { decision: "block", action: "Strict policy blocked any non-zero risk score" };
+      }
+      return { decision: "allow", action: "Strict policy allowed safe URL" };
+    });
+    this.policies.set("balanced", (ctx) => {
+      if (ctx.riskLevel === "DANGEROUS") {
+        return { decision: "block", action: "Blocked dangerous URL" };
+      }
+      if (ctx.riskLevel === "SUSPICIOUS") {
+        return { decision: "warn", action: "Display warning screen" };
+      }
+      return { decision: "allow", action: "Allowed safe URL" };
+    });
+    this.policies.set("enterprise", (ctx) => {
+      if (ctx.riskLevel === "DANGEROUS") {
+        return { decision: "block", action: "Enterprise policy blocked dangerous URL" };
+      }
+      if (ctx.score > 20) {
+        return { decision: "review", action: "Sent to SOC for manual review" };
+      }
+      if (ctx.riskLevel === "SUSPICIOUS") {
+        return { decision: "warn", action: "Warn user before proceeding" };
+      }
+      return { decision: "allow", action: "Enterprise allowed safe URL" };
+    });
+  }
+  register(name, policy) {
+    this.policies.set(name, policy);
+  }
+  evaluate(policyName, ctx) {
+    const name = policyName || "balanced";
+    const policy = this.policies.get(name);
+    if (!policy) {
+      return this.policies.get("balanced")(ctx);
+    }
+    return policy(ctx);
+  }
+};
+
+// src/engine/rules.ts
+var RuleEnginePlugin = class {
+  id = "core:rule-engine";
+  name = "RuleEngine";
+  version = "1.0.0";
+  description = "Executes custom user-defined and built-in rules";
+  author = "SafeLink Team";
+  type = "heuristic";
+  capabilities = ["custom-rules", "policy-enforcement"];
+  priority = 10;
+  weight = 1;
+  rules = /* @__PURE__ */ new Map();
+  constructor() {
+    this.registerBuiltIns();
+  }
+  registerBuiltIns() {
+    this.rules.set("require-https", (ctx) => {
+      if (ctx.url.startsWith("http://") && ctx.options.checkHttps !== false) {
+        return {
+          name: "Rule: require-https",
+          detector: "rule-engine",
+          category: "network",
+          severity: "high",
+          safe: false,
+          scoreImpact: 20,
+          confidence: 1,
+          message: "HTTP is not allowed by policy",
+          fatal: false
+        };
+      }
+      return null;
+    });
+  }
+  register(name, rule) {
+    this.rules.set(name, rule);
+  }
+  async execute(ctx) {
+    for (const [, rule] of this.rules) {
+      try {
+        const res = await rule(ctx);
+        if (res) {
+          return res;
+        }
+      } catch {
+      }
+    }
+    return null;
+  }
+};
+
+// src/plugins/core/provider.ts
+var ProviderPluginAdapter = class {
+  constructor(provider) {
+    this.provider = provider;
+  }
+  provider;
+  type = "provider";
+  version = "1.0.0";
+  description = "External threat intelligence provider adapter";
+  author = "SafeLink Team";
+  capabilities = ["threat-intelligence"];
+  priority = 50;
+  weight = 1;
+  get id() {
+    return `provider:${this.provider.name.toLowerCase()}`;
+  }
+  get name() {
+    return this.provider.name;
+  }
+  async execute(ctx) {
+    const urlToTest = ctx.state.finalUrl || ctx.normalizedUrl;
+    const res = await this.provider.check(urlToTest, ctx.options);
+    if (!res) return null;
+    return { ...res, confidence: res.safe ? 80 : 100 };
+  }
+};
+
+// src/plugins/core/basic.ts
+var UrlValidationPlugin = class {
+  id = "core:url-validation";
+  name = "UrlValidation";
+  version = "1.0.0";
+  description = "Validates URL structure and syntax";
+  author = "SafeLink Team";
+  type = "network";
+  capabilities = ["url-parsing", "syntax-check"];
+  priority = 100;
+  weight = 1;
+  async execute(ctx) {
+    const res = validateUrl(ctx.normalizedUrl);
+    return { ...res, confidence: 100, fatal: !res.safe };
+  }
+};
+var IpValidationPlugin = class {
+  id = "core:ip-validation";
+  name = "IpValidation";
+  version = "1.0.0";
+  description = "Validates IP addresses and checks for loopback/private IPs";
+  author = "SafeLink Team";
+  type = "network";
+  capabilities = ["ip-check", "ssrf-prevention"];
+  priority = 90;
+  weight = 1;
+  async execute(ctx) {
+    const res = validateIp(ctx.normalizedUrl);
+    return { ...res, confidence: 100, fatal: !res.safe };
+  }
+};
+var HttpsValidationPlugin = class {
+  id = "core:https-validation";
+  name = "HttpsValidation";
+  version = "1.0.0";
+  description = "Validates HTTPS certificate and connection";
+  author = "SafeLink Team";
+  type = "network";
+  capabilities = ["tls-check", "certificate-validation"];
+  priority = 80;
+  weight = 1;
+  async execute(ctx) {
+    if (ctx.options.checkHttps === false) {
+      return null;
+    }
+    const timeout = ctx.options.timeout ?? 5e3;
+    const res = await validateHttps(ctx.normalizedUrl, timeout, ctx.options.signal);
+    return { ...res, confidence: 95 };
+  }
+};
+
+// src/plugins/core/redirect.ts
+var RedirectPlugin = class {
+  id = "core:redirect-trace";
+  name = "RedirectTrace";
+  version = "1.0.0";
+  description = "Traces URL redirects to final destination";
+  author = "SafeLink Team";
+  type = "network";
+  capabilities = ["redirect-following", "chain-analysis"];
+  priority = 95;
+  weight = 1;
+  async execute(ctx) {
+    try {
+      const trace = await traceRedirects(ctx.normalizedUrl, ctx.options);
+      ctx.state.redirectTrace = trace;
+      ctx.state.finalUrl = trace.finalUrl;
+      let scoreImpact = 0;
+      let message = `Followed ${trace.redirectCount} redirects.`;
+      let safe = true;
+      let severity = "info";
+      if (trace.anomalies.includes("LOOP")) {
+        scoreImpact += 40;
+        message = "Redirect loop detected.";
+        safe = false;
+        severity = "critical";
+      }
+      if (trace.anomalies.includes("MAX_REDIRECTS_EXCEEDED")) {
+        scoreImpact += 20;
+        message = "Maximum redirects exceeded.";
+        safe = false;
+        severity = severity === "info" ? "high" : severity;
+      }
+      if (trace.anomalies.includes("PROTOCOL_DOWNGRADE")) {
+        scoreImpact += 30;
+        message = "Protocol downgrade (HTTPS to HTTP) detected.";
+        safe = false;
+        severity = severity === "info" ? "critical" : severity;
+      }
+      return {
+        name: this.name,
+        detector: "redirect-trace",
+        category: "redirect",
+        severity,
+        title: "Redirect Trace Analysis",
+        safe,
+        scoreImpact,
+        message,
+        confidence: 95
+      };
+    } catch (e) {
+      return {
+        name: this.name,
+        detector: "redirect-trace",
+        category: "redirect",
+        severity: "medium",
+        title: "Redirect Trace Failure",
+        safe: false,
+        scoreImpact: 10,
+        message: `Redirect trace failed: ${e instanceof Error ? e.message : "Unknown error"}`,
+        confidence: 80
+      };
+    }
+  }
+};
+
+// src/plugins/core/heuristics.ts
+var ShortenerPlugin = class {
+  id = "core:shortener";
+  name = "ShortenerDetection";
+  version = "1.0.0";
+  description = "Detects if the URL is a known link shortener";
+  author = "SafeLink Team";
+  type = "heuristic";
+  capabilities = ["url-expansion", "shortener-detection"];
+  priority = 85;
+  weight = 1;
+  async execute(ctx) {
+    const res = validateShortener(ctx.normalizedUrl, ctx.options.customShorteners);
+    ctx.state.isShortener = res.metadata?.isShortener === true;
+    return { ...res, confidence: 95 };
+  }
+};
+var PunycodePlugin = class {
+  id = "core:punycode";
+  name = "PunycodeDetection";
+  version = "1.0.0";
+  description = "Detects Punycode and homograph attacks in domains";
+  author = "SafeLink Team";
+  type = "heuristic";
+  capabilities = ["homograph-detection", "punycode-analysis"];
+  priority = 75;
+  weight = 1;
+  async execute(ctx) {
+    const urlToTest = ctx.state.finalUrl || ctx.normalizedUrl;
+    const res = validatePunycode(urlToTest);
+    return { ...res, confidence: 100 };
+  }
+};
+var HeuristicsPlugin = class {
+  id = "core:heuristics";
+  name = "GeneralHeuristics";
+  version = "1.0.0";
+  description = "General URL heuristics like length and entropy";
+  author = "SafeLink Team";
+  type = "heuristic";
+  capabilities = ["entropy-analysis", "pattern-matching"];
+  priority = 70;
+  weight = 1.5;
+  async execute(ctx) {
+    const urlToTest = ctx.state.finalUrl || ctx.normalizedUrl;
+    const res = validateHeuristics(urlToTest);
+    return { ...res, confidence: 85 };
+  }
+};
+
+// src/core/factory.ts
+var DefaultPluginFactory = class {
+  /**
+   * Registers the core suite of verification plugins into the provided PluginManager.
+   * This decoupled factory ensures the core orchestrator isn't tightly bound to concrete plugin implementations.
+   */
+  static registerCorePlugins(manager) {
+    manager.register(new UrlValidationPlugin());
+    manager.register(new ShortenerPlugin());
+    manager.register(new IpValidationPlugin());
+    manager.register(new HeuristicsPlugin());
+    manager.register(new RedirectPlugin());
+    manager.register(new PunycodePlugin());
+    manager.register(new HttpsValidationPlugin());
+  }
+};
+
+// src/checker.ts
+var SafeLinkError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "SafeLinkError";
+  }
+};
+var TimeoutError = class extends SafeLinkError {
+  constructor(message) {
+    super(message);
+    this.name = "TimeoutError";
+  }
+};
+var SafeLinkChecker = class extends EventEmitter {
+  cache = null;
+  metadataCache = new LRUCache({ maxSize: 500, ttlMs: 1e3 * 60 * 60 });
+  options;
+  pluginManager;
+  consensusEngine;
+  policyEngine;
+  constructor(options = {}) {
+    super();
+    this.options = options;
+    this.pluginManager = new PluginManager();
+    this.consensusEngine = new ConsensusEngine();
+    this.policyEngine = new PolicyEngine();
+    if (options.cache === true || options.cache === void 0) {
+      this.cache = defaultCache;
+    } else if (options.cache !== false) {
+      this.cache = options.cache;
+    }
+    DefaultPluginFactory.registerCorePlugins(this.pluginManager);
+    this.pluginManager.register(new RuleEnginePlugin());
+    if (options.providers) {
+      for (const p of options.providers) {
+        if (p === "openphish") this.use(new OpenPhishProvider());
+        else if (p === "urlhaus") this.use(new URLHausProvider());
+        else this.use(p);
+      }
+    }
+  }
+  /**
+   * Adds a legacy Provider or a new VerificationPlugin to the checker.
+   */
+  use(plugin) {
+    if ("check" in plugin) {
+      this.pluginManager.register(new ProviderPluginAdapter(plugin));
+    } else {
+      this.pluginManager.register(plugin);
+    }
+    return this;
+  }
+  async getMetadata(url) {
+    const cached = this.metadataCache.get(url);
+    if (cached) return cached;
+    const result = await extractMetadata(url, this.options.timeout);
+    if (result) {
+      this.metadataCache.set(url, result);
+    }
+    return result;
+  }
+  /**
+   * Verifies a single URL through the core engine and any registered providers.
+   * Caches results if configured.
+   * 
+   * @param url The URL to check.
+   * @param runtimeOptions Options overriding the global checker options for this specific call.
+   * @returns A detailed VerificationResult including the final risk score.
+   */
+  async verify(url, runtimeOptions = {}) {
+    const mergedOptions = Object.keys(runtimeOptions).length === 0 ? this.options : { ...this.options, ...runtimeOptions };
+    try {
+      if (!mergedOptions.bypassCache && this.cache) {
+        const cached = this.cache.get(url);
+        if (cached) {
+          const res = { ...cached, fromCache: true };
+          if (this.options.onComplete) this.options.onComplete(res);
+          return res;
+        }
+      }
+      let baseResult;
+      if (mergedOptions.mode === "cloud") {
+        baseResult = await this.verifyCloud(url, mergedOptions);
+      } else {
+        baseResult = await this.verifyLocal(url, mergedOptions);
+      }
+      if (!mergedOptions.bypassCache && this.cache) {
+        this.cache.set(url, { ...baseResult, fromCache: false });
+      }
+      this.emit("onComplete", baseResult);
+      if (this.options.onComplete) this.options.onComplete(baseResult);
+      return baseResult;
+    } catch (error) {
+      if (error instanceof Error && (error.name === "TimeoutError" || error.name === "AbortError")) {
+        throw new TimeoutError(`Verification timed out for ${url}`);
+      }
+      this.emit("onError", error, url);
+      if (this.options.onError) this.options.onError(error, url);
+      throw error;
+    }
+  }
+  async verifyCloud(url, mergedOptions) {
+    if (!mergedOptions.endpoint) throw new SafeLinkError("Cloud mode requires an endpoint configuration.");
+    const headers = { "Content-Type": "application/json" };
+    if (mergedOptions.apiKey) headers["Authorization"] = `Bearer ${mergedOptions.apiKey}`;
+    const response = await fetch(`${mergedOptions.endpoint.replace(/\/$/, "")}/v1/verify`, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({ url }),
+      signal: mergedOptions.signal ?? null
+    });
+    if (!response.ok) {
+      const errText = await response.text().catch(() => "Unknown error");
+      throw new SafeLinkError(`Cloud API Error: ${response.status} - ${errText}`);
+    }
+    return await response.json();
+  }
+  async verifyLocal(url, mergedOptions) {
+    await this.pluginManager.initializeAll();
+    this.emit("onStart", url);
+    if (this.options.onStart) this.options.onStart(url);
+    const normalizedUrl = normalizeLink(url, mergedOptions);
+    const ctx = {
+      url,
+      normalizedUrl,
+      options: mergedOptions,
+      state: {}
+    };
+    const checks = [];
+    const plugins = this.pluginManager.getAll();
+    for (const plugin of plugins) {
+      try {
+        const res = await plugin.execute(ctx);
+        if (res) {
+          checks.push(res);
+          if (res.fatal) {
+            break;
+          }
+        }
+      } catch (e) {
+        this.emit("pluginError", plugin.name, e);
+      }
+    }
+    const engineResult = this.consensusEngine.evaluate(checks);
+    const policyCtx = {
+      riskLevel: engineResult.riskLevel,
+      score: engineResult.score,
+      confidence: engineResult.confidence
+    };
+    const policyResult = this.policyEngine.evaluate(mergedOptions.policy, policyCtx);
+    return {
+      // Legacy
+      url,
+      normalizedUrl,
+      safe: engineResult.safe,
+      score: engineResult.score,
+      confidence: engineResult.confidence,
+      riskLevel: engineResult.riskLevel,
+      reasons: engineResult.reasons,
+      recommendations: [],
+      // Can be generated by an AI plugin later
+      redirectChain: ctx.state.redirectTrace?.chain || [],
+      redirectTrace: ctx.state.redirectTrace || { chain: [], finalUrl: normalizedUrl, redirectCount: 0, anomalies: [] },
+      checks,
+      fromCache: false,
+      // XTI
+      trustScore: engineResult.trustScore,
+      summary: engineResult.summary,
+      decision: policyResult.decision,
+      action: policyResult.action,
+      policy: mergedOptions.policy || "balanced",
+      evidence: checks
+      // evidence is heavily structured CheckResult[]
+    };
+  }
+  /**
+   * Concurrently verifies multiple URLs with a bounded concurrency limit.
+   * Results are returned in the exact same order as the input array.
+   *
+   * @param urls Array of URLs to verify.
+   * @param runtimeOptions Options overriding the global checker options.
+   * @param concurrency The maximum number of concurrent verifications (defaults to 5).
+   * @returns Array of VerificationResult corresponding to the input URLs.
+   */
+  async verifyLinks(urls, runtimeOptions = {}, concurrency = 5) {
+    const mergedOptions = Object.keys(runtimeOptions).length === 0 ? this.options : { ...this.options, ...runtimeOptions };
+    if (mergedOptions.mode === "cloud") {
+      if (!mergedOptions.endpoint) throw new SafeLinkError("Cloud mode requires an endpoint configuration.");
+      const headers = { "Content-Type": "application/json" };
+      if (mergedOptions.apiKey) headers["Authorization"] = `Bearer ${mergedOptions.apiKey}`;
+      const response = await fetch(`${mergedOptions.endpoint.replace(/\/$/, "")}/v1/verify/batch`, {
+        method: "POST",
+        headers,
+        body: JSON.stringify({ urls }),
+        signal: mergedOptions.signal ?? null
+      });
+      if (!response.ok) {
+        const errText = await response.text().catch(() => "Unknown error");
+        throw new SafeLinkError(`Cloud API Error: ${response.status} - ${errText}`);
+      }
+      const results2 = await response.json();
+      return results2;
+    }
+    const results = new Array(urls.length);
+    let index = 0;
+    const worker = async () => {
+      while (index < urls.length) {
+        const currentIndex = index++;
+        const url = urls[currentIndex];
+        results[currentIndex] = await this.verify(url, runtimeOptions);
+      }
+    };
+    const workers = Array(Math.min(concurrency, urls.length)).fill(null).map(() => worker());
+    await Promise.all(workers);
+    return results;
+  }
+};
+
+export { LRUCache, OpenPhishProvider, SafeLinkChecker, SafeLinkError, TimeoutError, URLHausProvider, defaultCache, normalizeLink, traceRedirects, validateHeuristics, validateHttps, validateIp, validatePunycode, validateShortener, validateUrl };
+//# sourceMappingURL=chunk-CS7EDB5I.js.map
+//# sourceMappingURL=chunk-CS7EDB5I.js.map