Validate returned research platform URLs consistently
Research URL normalization currently accepts HTTP/credential-bearing links, and an invalid url can hide a valid later href. The public handler also returns unfiltered link entries. Share one HTTPS/hostname/no-credentials rule across provider normalization and GET response formatting; select the first qualifying url/link/href without duplicating chosen fields under generic keys.
Preserve valid existing {domain,url} arrays as well as maps. This intentionally avoids the retired branch formatter's drop-all-arrays behavior. Authentication/credit short circuits, research error statuses, provider selection and charging path remain unchanged. This checks returned link syntax; it does not fetch links, establish domain reputation, or provide SSRF protection for another fetch path.
Current-main successor for API642, exact oldhead481ec02d503d435a64b41034f148c1e5b94ee67d, under Mono358. Original ten-file patch compared with main934bbe57; the relevant helpers/formatter/fallback were absent. Existing API1006 changes separate Context enrichment paths. Original PR remains untouched; no bulk triage, provider expansion, catalog contract, schema/permissions or held stream/SDK/App work changed.
Validation after current-main refresh: all404focused research/contract tests pass across61files and full lint/format/whitespace pass. Main adds only the published-docs fixture; all eight research TypeScript files are byte-identical to prior reviewedf5570bcb. The verification note records the new base. Prior source red probes:5failbefore; prior whole-repository TypeScript had211byte-identical baseline/candidate errors, with no additions. Those old full-CI/typecheck results remain historical, not final new-head evidence. Fresh exact-head CI passes all4requiredchecks,7,081tests/15skips across1,282passingfiles/13skippedfiles and response-contract typecheck. Previewpasses. Exact refreshed-head/tree independent delta review has no findings/no execution.
All external account/provider/credit operations in new tests are mocked. No customer/database/provider request, payment, credential inspection, package change or manual deployment occurred. docs/verification/research-url-validation.md records the original intent and map/legacyarray compatibility. Coordinator owns qualifying merge and any old-PR disposition; Records original-acceptance review stays separate.
Current candidate e23fde747a33398192102ddc2c03a24c757112b4, tree f38da0cc20b4abd5244a531497344dd257707b1d, baseactualmain 934bbe57fc163bfecc14f618a0e8c56c60623378. This supersedesf5570bcb. No merge/deploymentclaim.
Final base remains currentmain934bbe57 atcheck. Newheade23fde74/treef38da0cc is the sole release candidate; priorf557CIhistorical. Expanded404tests/61files and fulllint rerunpass. No merge/deploymentclaim; coordinator/Records originalacceptance and qualifyingrelease remain separate.