Defang / Refang — TypeScript source

// Pure defang/refang - makes indicator text safe to paste (no clickable links)
// and reverses it. Zero deps - the unit-test surface for the Defang/Refang tool.

/**
 * Defang text so URLs, IPs, and emails are no longer clickable or auto-linked.
 *
 * Replaces `https://` and `http://` schemes with `hxxps[://]` / `hxxp[://]`,
 * then brackets EVERY dot as `[.]` and every at-sign as `[@]` - the standard
 * indicator-defanging convention used in threat-intel and phishing analysis.
 *
 * Scheme replacements run FIRST so the dots and colon inside the resulting
 * `[://]` marker are not themselves re-bracketed (which would corrupt the
 * scheme marker). Note: ALL dots are bracketed, not just the domain separator.
 */
export function defang(input: string): string {
  return input
    .replaceAll('https://', 'hxxps[://]')
    .replaceAll('http://', 'hxxp[://]')
    .replaceAll('.', '[.]')
    .replaceAll('@', '[@]');
}

/**
 * Reverse defanging - restore `hxxps[://]` / `hxxp[://]` to real schemes and
 * unbracket `[.]` / `[@]`. Exact inverse of {@link defang}: for typical URLs,
 * IPs, emails, and plain text, `refang(defang(x)) === x`.
 *
 * Scheme markers are restored before `[.]`/`[@]` are unbracketed, so a marker
 * like `hxxps[://]` is reassembled into `https://` rather than being split by
 * an earlier dot/at substitution.
 */
export function refang(input: string): string {
  return input
    .replaceAll('hxxps[://]', 'https://')
    .replaceAll('hxxp[://]', 'http://')
    .replaceAll('[.]', '.')
    .replaceAll('[@]', '@');
}