a1d2.org — a link compressor that skips the confirmation screen

Build spec — a1d2.org mirror + behavioural teardown

Slug: a1d2 · Status: done · Date: 21 Oct 2026 · Origin: https://a1d2.org

Goal

Mirror a1d2.org — registered 2026-09-12, one project, a fork of p2r3's ha.mr compressor (MIT) — as an offline-working copy, and audit the running site against its own code and DNS: separate what the site says from what its code does, then write the gap up with the evidence that proves each claim.

Do not assert who operates the domain. The registrant is redacted, there is no MX, and nothing on the site names a person. Describe what is observable and stop there — no “this is the author's own site”, no guessing at intent from the Chinese-first copy.

Deliverables

Scope

Static, same-origin only: /, /style.css, /q/, /q/main.js, /q/compress.js, /q/alphabets.js, /q/lean-qr/lean-qr.js, /q/stats, /q/stats.js, /q/LICENSE, /q/lean-qr/LICENSE, and the 404 page. No attempts at origin discovery — no historical DNS, no subdomain brute force, no certificate mining for bypass. The site is behind Cloudflare on purpose; the deliverable is the honest “what the domain does and doesn't publish”, not an origin hunt.

Rewrite rules

index.html needed nothing — it already used relative refs. q/index.html and q/stats referenced root-absolute paths (/q/main.js, /q/stats.js, /q/LICENSE), rewritten to ./… so the mirror works under /portfolio/demos/a1d2-mirror/. Everything else is byte-identical, including the Cloudflare Web Analytics beacon — it 404s locally, and that 404 is part of the finding.

Verification

1. Serve the folder; load / and /q/ in headless Chromium; assert 0 page errors.
2. Functional, not visual: type a URL into #input-link with real keystrokes, wait for the debounced

#output-link, capture the payload; paste it into #input-reverse and assert it round-trips.

3. Behavioural: navigate to q/#<payload> for a payload pointing at example.com and record what

actually happens (does an interstitial appear?). This is the step that overturned the upstream README.

4. Endpoint probes: GET /stats.json, POST /a with several content types, GET /a.
5. DNS/RDAP/CT: dig A/MX/TXT, RDAP for the registrar + redaction state, certspotter for subdomains.

What the checks found (why they were worth running)

• main.js:317 — “Redirect straight through - no confirmation screen”, then location.replace(). The

upstream project has an interstitial; this fork deleted it. Verified in a browser, not inferred.

• The browser test also showed location.replace leaves no history entry.
• /q/stats copy still claims a confirmation screen, and main.js contains no fetch at all: the

counter's client half is gone, /stats.json is 404, POST /a is 405.

• Cloudflare Web Analytics is injected on all three pages → the site is not third-party-free.
• No MX, no TXT → the advertised [email protected] cannot receive mail, and there is no SPF/DMARC.

Pitfalls hit on this build

• Blind "/q/" → "./q/" rewriting on a page that lives inside /q/ deletes the = in href="./q/x"

when done as a raw string replace. Rewrite attributes with a regex that keeps the =, and re-diff against the origin afterwards.

• The compressor is debounced and gated on module load: a Playwright fill() can race ahead of

#content becoming interactive (pointer-events:none until the module's last lines run). Wait for the output element to change, don't sleep.

• QR payloads go in the path (/q/PAYLOAD), not the fragment, so /q/anything is a 200 — a mirror

that 404s unknown /q/ paths is broken.

Honest limits

The mirror cannot demonstrate the counter (endpoints absent) and cannot show the beacon working (it 404s locally). “Where it is hosted” stays unanswered: anycast + redacted RDAP + no origin leak in CT logs means the only truthful statement is that the origin is unknown.