@aglyn/shared-util-email 1.0.0-beta.199 → 1.0.0-beta.201

package/src/lib/outbound-phishing-screen.js

@@ -0,0 +1,719 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /*==========================================
+ * THE OUTBOUND PHISHING SCREEN (AGL-3356).
+ *
+ * A fraud actor signed up, paid with a card that never met 3-D Secure, and
+ * used a workspace to send two kinds of mail: a campaign of Booking.com-style
+ * "guest feedback regarding your property" lures to hotels, and a workflow
+ * that mailed "Poshmark Order — one of the items from your Seller Account has
+ * finally sold", linking to `poshmark.id63835663.shop`.
+ *
+ * This module answers one question about a message a YOUNG workspace is
+ * about to send: does its content carry a STRONG phishing signal? The caller
+ * decides who is young and what happens to a positive answer — the answer is
+ * a hold for staff review, never a drop.
+ *
+ * ## Conservative by construction
+ *
+ * A false positive costs a real merchant's first campaign a wait for a
+ * human; a miss costs strangers their bank logins. Both are real, so only
+ * three shapes hold, and each is one a legitimate merchant essentially never
+ * produces:
+ *
+ * 1. **A lookalike link** — a link or reply address whose host carries a
+ *    brand's name without being the brand's own domain: the brand as a label
+ *    of an unrelated registrable domain (`poshmark.id63835663.shop`), hyphen-
+ *    joined to one (`paypal-secure.com`, `secure-paypal.net`), the brand's
+ *    real domain embedded in a longer host (`booking.com.guest-review.top`),
+ *    or leetspeak for it (`paypa1.com`). Holds on its own.
+ * 2. **A brand in the sender's display name** that is not the workspace's
+ *    own name — mail that says it is FROM PayPal.
+ * 3. **The three-part lure**: a brand named in the copy, AND credential or
+ *    account-action phrasing ("verify your account", "has finally sold",
+ *    "feedback regarding your property"), AND a link to a domain that is
+ *    neither the brand's, nor the workspace's, nor a common social or maps
+ *    link. Any two of the three are ordinary marketing — "our book is on
+ *    Amazon", "sign in to your account", a link to the shop — and pass.
+ *
+ * Mentioning a brand, alone, never holds.
+ *
+ * ## The brand list is small on purpose
+ *
+ * The brands phishing kits most often wear, plus the two in the incident. A
+ * brand is added when it has been seen impersonated, not because it is big:
+ * every entry is a set of words that can now hold somebody's newsletter.
+ * Each carries its REAL domains, so a link to the brand itself is never
+ * suspicious, and host tokens chosen so a common word (`booking`, `apple`,
+ * `outlook`) does not match an unrelated host by itself.
+ *
+ * Pure: no DNS, no store, no clock. Everything the caller knows about the
+ * workspace arrives as input.
+ *=========================================*/ /** One brand the screen recognizes. */ export const PHISHING_SCREEN_BRANDS = [
+    {
+        id: 'poshmark',
+        label: 'Poshmark',
+        mention: /\bposhmark\b/i,
+        hostTokens: [
+            'poshmark'
+        ],
+        officialDomains: [
+            'poshmark.com',
+            'posh.mk'
+        ]
+    },
+    {
+        id: 'booking',
+        label: 'Booking.com',
+        // Never the bare word: "booking" is every hotel's and every salon's.
+        mention: /\bbooking\.com\b/i,
+        hostTokens: [
+            'bookingcom',
+            'booking-com'
+        ],
+        officialDomains: [
+            'booking.com',
+            'bstatic.com'
+        ]
+    },
+    {
+        id: 'airbnb',
+        label: 'Airbnb',
+        mention: /\bairbnb\b/i,
+        hostTokens: [
+            'airbnb'
+        ],
+        officialDomains: [
+            'airbnb.com',
+            'abnb.me',
+            'muscache.com'
+        ],
+        countryDomains: true
+    },
+    {
+        id: 'paypal',
+        label: 'PayPal',
+        mention: /\bpay\s?pal\b/i,
+        hostTokens: [
+            'paypal'
+        ],
+        officialDomains: [
+            'paypal.com',
+            'paypal.me',
+            'paypalobjects.com'
+        ],
+        countryDomains: true
+    },
+    {
+        id: 'amazon',
+        label: 'Amazon',
+        mention: /\bamazon\b/i,
+        hostTokens: [
+            'amazon',
+            'amzn'
+        ],
+        wordToken: true,
+        officialDomains: [
+            'amazon.com',
+            'amzn.to',
+            'amzn.com',
+            'amazonaws.com',
+            'media-amazon.com',
+            'ssl-images-amazon.com'
+        ],
+        countryDomains: true
+    },
+    {
+        id: 'apple',
+        label: 'Apple',
+        // The fruit is on every bakery's menu; the account is what gets phished.
+        mention: /\bapple\s?(?:id|support|account)\b|\bicloud\b|\bitunes\b/i,
+        hostTokens: [
+            'apple',
+            'appleid',
+            'icloud',
+            'itunes'
+        ],
+        wordToken: true,
+        officialDomains: [
+            'apple.com',
+            'icloud.com',
+            'apple.co',
+            'itunes.com',
+            'me.com',
+            'mzstatic.com'
+        ],
+        countryDomains: true
+    },
+    {
+        id: 'microsoft',
+        label: 'Microsoft',
+        mention: /\bmicrosoft\b|\boffice\s?365\b|\bonedrive\b|\bsharepoint\b/i,
+        hostTokens: [
+            'microsoft',
+            'office365',
+            'onedrive',
+            'sharepoint',
+            'microsoftonline',
+            'msonline'
+        ],
+        officialDomains: [
+            'microsoft.com',
+            'office.com',
+            'office365.com',
+            'live.com',
+            'outlook.com',
+            'microsoftonline.com',
+            'sharepoint.com',
+            'onedrive.com',
+            '1drv.ms',
+            'aka.ms'
+        ]
+    },
+    {
+        id: 'docusign',
+        label: 'DocuSign',
+        mention: /\bdocu\s?sign\b/i,
+        hostTokens: [
+            'docusign'
+        ],
+        officialDomains: [
+            'docusign.com',
+            'docusign.net'
+        ]
+    },
+    {
+        id: 'netflix',
+        label: 'Netflix',
+        mention: /\bnetflix\b/i,
+        hostTokens: [
+            'netflix'
+        ],
+        officialDomains: [
+            'netflix.com',
+            'nflxext.com',
+            'nflximg.net'
+        ]
+    },
+    {
+        id: 'wellsfargo',
+        label: 'Wells Fargo',
+        mention: /\bwells\s?fargo\b/i,
+        hostTokens: [
+            'wellsfargo',
+            'wells-fargo'
+        ],
+        officialDomains: [
+            'wellsfargo.com'
+        ]
+    },
+    {
+        id: 'bankofamerica',
+        label: 'Bank of America',
+        mention: /\bbank\s+of\s+america\b/i,
+        hostTokens: [
+            'bankofamerica',
+            'bofa'
+        ],
+        officialDomains: [
+            'bankofamerica.com',
+            'bofa.com'
+        ]
+    },
+    {
+        id: 'coinbase',
+        label: 'Coinbase',
+        mention: /\bcoinbase\b/i,
+        hostTokens: [
+            'coinbase'
+        ],
+        officialDomains: [
+            'coinbase.com'
+        ]
+    },
+    {
+        id: 'usps',
+        label: 'USPS',
+        mention: /\busps\b/i,
+        hostTokens: [
+            'usps'
+        ],
+        officialDomains: [
+            'usps.com'
+        ]
+    },
+    {
+        id: 'fedex',
+        label: 'FedEx',
+        mention: /\bfed\s?ex\b/i,
+        hostTokens: [
+            'fedex'
+        ],
+        officialDomains: [
+            'fedex.com'
+        ]
+    },
+    {
+        id: 'dhl',
+        label: 'DHL',
+        mention: /\bdhl\b/i,
+        hostTokens: [
+            'dhl'
+        ],
+        officialDomains: [
+            'dhl.com'
+        ],
+        countryDomains: true
+    }
+];
+/**
+ * Account-action and credential phrasing — the half of a lure that asks the
+ * reader to DO something with an account. Only ever counted beside a brand
+ * AND a foreign link; alone, several of these are ordinary transactional copy.
+ */ export const PHISHING_LURE_PATTERNS = [
+    /\bverify\s+your\s+(?:account|identity|information|details|payment|email)\b/i,
+    /\bconfirm\s+your\s+(?:account|identity|details|payment|password|billing|information)\b/i,
+    /\b(?:account|payment|card)\s+(?:has\s+been\s+|is\s+|was\s+)?(?:suspended|locked|limited|restricted|disabled|on\s+hold)\b/i,
+    /\bunusual\s+(?:sign[-\s]?in|login|activity)\b/i,
+    /\bupdate\s+your\s+(?:payment|billing|card|account)\s*(?:details|information|method)?\b/i,
+    /\b(?:sign|log)\s?in\s+to\s+(?:your|view|confirm|claim|release)\b/i,
+    /\b(?:has|have)\s+(?:finally\s+)?sold\b/i,
+    /\bseller\s+account\b/i,
+    /\b(?:guest|customer)\s+(?:complaint|review|feedback)\b/i,
+    /\bfeedback\s+regarding\s+your\s+(?:property|listing|stay|booking|reservation)\b/i,
+    /\b(?:document|invoice|agreement)s?\s+(?:is\s+|are\s+)?(?:ready|waiting|pending)\s+(?:for\s+)?(?:your\s+)?(?:review|signature|to\s+sign)\b/i,
+    /\bpassword\s+(?:will\s+)?expire/i,
+    /\bclaim\s+your\s+(?:refund|reward|prize|package|payment|funds)\b/i,
+    /\b(?:delivery|shipment)\s+(?:failed|attempt|suspended|on\s+hold)\b/i,
+    /\b(?:package|parcel)\s+(?:is\s+)?(?:on\s+hold|held|awaiting|undeliverable)\b/i,
+    /\bsecurity\s+alert\b/i
+];
+/**
+ * Link targets a merchant's mail ordinarily carries that are not theirs:
+ * social profiles, maps, review sites, video. Counted as neither foreign nor
+ * suspicious in the three-part lure, so "leave us a review on Google" with a
+ * brand named elsewhere does not become a hold. Never consulted by the
+ * lookalike check, which holds on the host's own shape.
+ */ const COMMON_LINK_DOMAINS = new Set([
+    'facebook.com',
+    'fb.com',
+    'instagram.com',
+    'x.com',
+    'twitter.com',
+    'linkedin.com',
+    'youtube.com',
+    'youtu.be',
+    'tiktok.com',
+    'pinterest.com',
+    'google.com',
+    'goo.gl',
+    'g.page',
+    'yelp.com',
+    'tripadvisor.com',
+    'wa.me',
+    'whatsapp.com'
+]);
+/**
+ * Two-label public suffixes, so `evil.co.uk` registers as `evil.co.uk` and
+ * not as `co.uk`. Deliberately a short list of the ones mail actually
+ * arrives from rather than the whole public suffix list: a suffix missing
+ * here makes the registrable domain one label too short, which can only
+ * widen what counts as "the same domain" for a link — never invent a brand
+ * label that is not in the host.
+ */ const TWO_LABEL_SUFFIXES = new Set([
+    'co.uk',
+    'org.uk',
+    'ac.uk',
+    'gov.uk',
+    'me.uk',
+    'com.au',
+    'net.au',
+    'org.au',
+    'co.nz',
+    'co.jp',
+    'co.kr',
+    'co.in',
+    'co.za',
+    'co.il',
+    'co.id',
+    'co.th',
+    'com.br',
+    'com.mx',
+    'com.ar',
+    'com.tr',
+    'com.cn',
+    'com.hk',
+    'com.sg',
+    'com.tw',
+    'com.my',
+    'com.ph',
+    'com.co',
+    'com.pe',
+    'com.sa',
+    'com.eg'
+]);
+/** The registrable domain of a host: `a.b.evil.co.uk` → `evil.co.uk`. */ export function registrableDomain(host) {
+    const labels = String(host != null ? host : '').toLowerCase().replace(/\.+$/, '').split('.').filter(Boolean);
+    if (labels.length <= 2) return labels.join('.');
+    const lastTwo = labels.slice(-2).join('.');
+    return TWO_LABEL_SUFFIXES.has(lastTwo) ? labels.slice(-3).join('.') : lastTwo;
+}
+/** `<label>.<suffix>` of a registrable domain, split once. */ function splitRegistrable(registrable) {
+    const dot = registrable.indexOf('.');
+    return dot < 0 ? {
+        label: registrable,
+        suffix: ''
+    } : {
+        label: registrable.slice(0, dot),
+        suffix: registrable.slice(dot + 1)
+    };
+}
+function isOfficialDomain(brand, registrable) {
+    if (brand.officialDomains.includes(registrable)) return true;
+    if (!brand.countryDomains) return false;
+    const base = splitRegistrable(brand.officialDomains[0]).label;
+    const { label, suffix } = splitRegistrable(registrable);
+    return label === base && (/^[a-z]{2}$/.test(suffix) || TWO_LABEL_SUFFIXES.has(suffix));
+}
+/** Every brand's real domains, for "is this link just the brand itself". */ function isAnyOfficialDomain(registrable) {
+    return PHISHING_SCREEN_BRANDS.some((brand)=>isOfficialDomain(brand, registrable));
+}
+/** Leetspeak folded, so `paypa1` reads as `paypal`. */ function foldLeet(label) {
+    return label.replace(/0/g, 'o').replace(/1/g, 'l').replace(/3/g, 'e').replace(/4/g, 'a').replace(/5/g, 's').replace(/7/g, 't');
+}
+/** Does one host label name the brand — whole, or hyphen-joined? */ function labelNamesBrand(label, token, wordToken) {
+    if (wordToken) return label === token;
+    for (const candidate of new Set([
+        label,
+        foldLeet(label)
+    ])){
+        if (candidate === token) return true;
+        const parts = candidate.split('-');
+        // A hyphen-joined token (`booking-com`) spans parts, so it is matched
+        // as a run of parts rather than one of them.
+        const tokenParts = token.split('-');
+        for(let at = 0; at + tokenParts.length <= parts.length; at += 1){
+            if (tokenParts.every((part, offset)=>parts[at + offset] === part)) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+/** The brand a host impersonates, or null. */ export function lookalikeBrandForHost(host) {
+    const normalized = String(host != null ? host : '').toLowerCase().replace(/\.+$/, '');
+    if (!normalized.includes('.')) return null;
+    const registrable = registrableDomain(normalized);
+    for (const brand of PHISHING_SCREEN_BRANDS){
+        if (isOfficialDomain(brand, registrable)) continue;
+        const labels = normalized.split('.');
+        if (labels.some((label)=>brand.hostTokens.some((token)=>labelNamesBrand(label, token, brand.wordToken === true)))) {
+            return brand;
+        }
+        // The brand's primary domain embedded in a longer, different one:
+        // `booking.com.guest-review.top`, `paypal.com-secure.net`. Only the
+        // primary: a short secondary (`me.com`, `aka.ms`) would match too much.
+        const primary = brand.officialDomains[0];
+        if (normalized.startsWith(`${primary}.`) || normalized.startsWith(`${primary}-`) || normalized.includes(`.${primary}.`) || normalized.includes(`.${primary}-`)) {
+            return brand;
+        }
+    }
+    return null;
+}
+/**
+ * The few entity forms a phishing kit uses to keep a URL away from a naive
+ * scanner (`&#46;` for a dot, `&amp;` inside a query). Decoded before links
+ * are read; everything else is left alone.
+ */ function decodeEntities(text) {
+    return text.replace(/&#x([0-9a-f]{1,6});/gi, (_, hex)=>safeCodePoint(parseInt(hex, 16))).replace(/&#(\d{1,7});/g, (_, dec)=>safeCodePoint(parseInt(dec, 10))).replace(/&amp;/gi, '&');
+}
+function safeCodePoint(value) {
+    return Number.isFinite(value) && value > 0 && value <= 0x10ffff ? String.fromCodePoint(value) : '';
+}
+const URL_PATTERN = /\b(?:https?:\/\/|www\.)[^\s"'<>()\\[\]{}]+/gi;
+/** The hosts every link in the text points at, lowercased. */ export function linkHostsIn(text) {
+    var _decodeEntities_match;
+    const hosts = new Set();
+    for (const match of (_decodeEntities_match = decodeEntities(String(text != null ? text : '')).match(URL_PATTERN)) != null ? _decodeEntities_match : []){
+        let rest = match.replace(/^https?:\/\//i, '');
+        rest = rest.split(/[/?#]/)[0];
+        // `https://paypal.com@evil.top/` resolves to evil.top — and the part
+        // before the `@` is exactly the disguise, so it is kept as a host too.
+        const at = rest.lastIndexOf('@');
+        const disguise = at >= 0 ? rest.slice(0, at) : '';
+        rest = at >= 0 ? rest.slice(at + 1) : rest;
+        for (const candidate of [
+            rest,
+            disguise
+        ]){
+            const host = candidate.replace(/:\d+$/, '').replace(/\.+$/, '').toLowerCase();
+            // A merge tag inside a URL is not a host anybody can visit yet.
+            if (host && host.includes('.') && !host.includes('{') && !host.includes('%7b')) {
+                hosts.add(host);
+            }
+        }
+    }
+    return [
+        ...hosts
+    ];
+}
+const ADDRESS_HOST_PATTERN = /[a-z0-9._%+-]+@([a-z0-9-]+(?:\.[a-z0-9-]+)+)/gi;
+/** The host of every email address in the text — a reply-to, a `mailto:`. */ function addressHostsIn(text) {
+    const hosts = new Set();
+    for (const match of decodeEntities(String(text != null ? text : '')).matchAll(ADDRESS_HOST_PATTERN)){
+        hosts.add(match[1].toLowerCase().replace(/\.+$/, ''));
+    }
+    return [
+        ...hosts
+    ];
+}
+/** Lowercased alphanumerics only, so "Wells-Fargo Advisors" contains `wellsfargo`. */ function squash(text) {
+    return text.toLowerCase().replace(/[^a-z0-9]/g, '');
+}
+/** Is this brand the workspace's own, by name or by a domain it holds? */ function isOwnBrand(brand, ownNames, ownRegistrables) {
+    const labels = [
+        brand.id,
+        squash(brand.label),
+        ...brand.hostTokens.map(squash)
+    ];
+    if (labels.some((label)=>label && ownNames.includes(label))) return true;
+    return [
+        ...ownRegistrables
+    ].some((registrable)=>isOfficialDomain(brand, registrable));
+}
+/*
+ * The same judgements, for the other surfaces that read content with this
+ * screen's data (`hosted-page-screen.ts`). Exported under these names rather
+ * than copied, so a page and an email can never disagree about what a
+ * brand's own domain is or whose brand a name is.
+ */ /** `squash`: lowercased alphanumerics, the form own-name matching reads. */ export const squashScreenText = squash;
+/** Is this brand the workspace's own, by name (squashed) or by a domain it holds? */ export const isWorkspaceOwnBrand = isOwnBrand;
+/** Is this registrable domain one of any listed brand's own? */ export const isAnyOfficialBrandDomain = isAnyOfficialDomain;
+/** Is this registrable domain a social, maps or review link merchants ordinarily carry? */ export function isCommonLinkDomain(registrable) {
+    return COMMON_LINK_DOMAINS.has(registrable);
+}
+/**
+ * Screen one outbound message. See the module header for what holds and why.
+ */ export function screenOutboundEmail(input) {
+    var _input_ownNames, _input_ownDomains, _input_bodies, _input_replyTo, _input_fromAddress, _input_fromName;
+    const signals = [];
+    const ownNames = squash(((_input_ownNames = input.ownNames) != null ? _input_ownNames : []).filter(Boolean).join(' '));
+    const ownHosts = ((_input_ownDomains = input.ownDomains) != null ? _input_ownDomains : []).map((domain)=>String(domain != null ? domain : '').trim().toLowerCase().replace(/\.+$/, '')).filter((domain)=>domain.includes('.'));
+    const ownRegistrables = new Set(ownHosts.map(registrableDomain));
+    const isOwnHost = (host)=>ownHosts.some((own)=>host === own || host.endsWith(`.${own}`));
+    const copy = [
+        input.subject,
+        input.preheader,
+        ...(_input_bodies = input.bodies) != null ? _input_bodies : []
+    ].filter((part)=>typeof part === 'string' && part.length > 0).join('\n');
+    const decodedCopy = decodeEntities(copy);
+    const replyTo = Array.isArray(input.replyTo) ? input.replyTo.join(' ') : String((_input_replyTo = input.replyTo) != null ? _input_replyTo : '');
+    const linkHosts = linkHostsIn(copy);
+    // 1. A lookalike host, anywhere a recipient could click, write back, or
+    //    read as the sender.
+    const seenLookalike = new Set();
+    const fromAddress = String((_input_fromAddress = input.fromAddress) != null ? _input_fromAddress : '');
+    for (const host of [
+        ...linkHosts,
+        ...addressHostsIn(`${copy}\n${replyTo}\n${fromAddress}`)
+    ]){
+        if (seenLookalike.has(host)) continue;
+        const brand = lookalikeBrandForHost(host);
+        if (brand) {
+            seenLookalike.add(host);
+            signals.push({
+                code: 'lookalike-link',
+                brand: brand.id,
+                host
+            });
+        }
+    }
+    // 2. A brand in the sender's display name that is not the workspace's.
+    const fromName = String((_input_fromName = input.fromName) != null ? _input_fromName : '').trim();
+    if (fromName) {
+        for (const brand of PHISHING_SCREEN_BRANDS){
+            if (brand.mention.test(fromName) && !isOwnBrand(brand, ownNames, ownRegistrables)) {
+                signals.push({
+                    code: 'brand-sender',
+                    brand: brand.id,
+                    fromName: fromName.slice(0, 120)
+                });
+            }
+        }
+    }
+    // 3. Brand + lure + a link to somewhere that is nobody's we know.
+    const lure = PHISHING_LURE_PATTERNS.map((pattern)=>{
+        var _decodedCopy_match;
+        return (_decodedCopy_match = decodedCopy.match(pattern)) == null ? void 0 : _decodedCopy_match[0];
+    }).find(Boolean);
+    if (lure) {
+        const foreign = linkHosts.find((host)=>{
+            if (isOwnHost(host)) return false;
+            const registrable = registrableDomain(host);
+            return !isAnyOfficialDomain(registrable) && !COMMON_LINK_DOMAINS.has(registrable);
+        });
+        if (foreign) {
+            const namedInCopy = `${decodedCopy}\n${fromName}`;
+            for (const brand of PHISHING_SCREEN_BRANDS){
+                if (brand.mention.test(namedInCopy) && !isOwnBrand(brand, ownNames, ownRegistrables)) {
+                    signals.push({
+                        code: 'brand-lure-link',
+                        brand: brand.id,
+                        lure: lure.slice(0, 120),
+                        host: foreign
+                    });
+                    break;
+                }
+            }
+        }
+    }
+    return {
+        hold: signals.length > 0,
+        signals
+    };
+}
+/** The brand's label for a stored id, for the staff surface. */ export function phishingScreenBrandLabel(id) {
+    var _ref;
+    var _PHISHING_SCREEN_BRANDS_find;
+    return (_ref = (_PHISHING_SCREEN_BRANDS_find = PHISHING_SCREEN_BRANDS.find((brand)=>brand.id === id)) == null ? void 0 : _PHISHING_SCREEN_BRANDS_find.label) != null ? _ref : id;
+}
+/** One line per signal, in words staff read on the review row. */ export function describePhishingScreenSignals(signals) {
+    return signals.map((signal)=>{
+        const brand = 'brand' in signal ? phishingScreenBrandLabel(signal.brand) : '';
+        switch(signal.code){
+            case 'lookalike-link':
+                return `Links to ${signal.host}, which wears the ${brand} name but is not ${brand}'s domain.`;
+            case 'brand-sender':
+                return `Sends as "${signal.fromName}", naming ${brand}, which is not this workspace.`;
+            case 'brand-lure-link':
+                return `Names ${brand}, asks the reader to act ("${signal.lure}"), and links to ${signal.host}.`;
+            case 'credential-field':
+                return `Asks for a ${signal.field === 'card' ? 'card number' : signal.field === 'otp' ? 'one-time code' : 'password'} in its own field ("${signal.label}"), outside the platform's sign-in and checkout elements.`;
+            case 'brand-action-page':
+                return `Names ${brand} beside a call to action ("${signal.action}"), and this workspace is not ${brand}.`;
+            default:
+                return 'Phishing signal.';
+        }
+    });
+}
+/*==========================================
+ * RISK TIERS: who a signal holds for (AGL-3356, widened to every surface).
+ *
+ * The screen above finds signals; this decides which of them hold, the same
+ * way on every surface that asks — an email at the send seam, a campaign
+ * before it is claimed, a page at publish, a subdomain at creation.
+ *
+ * - STRONG: a lookalike host. A link to `poshmark.id63835663.shop` or
+ *   `paypa1.com` is a disguise whoever wears it and however old the
+ *   workspace is, so it holds for EVERY workspace, on every message and
+ *   page, transactional mail included. A merchant has no ordinary reason to
+ *   link to a host shaped like somebody else's brand.
+ * - SOFT: a brand in the sender name, the three-part lure, a brand's name
+ *   beside a sign-in or payment call to action on a page. Each is shaped
+ *   like phishing but also like a clumsy legitimate message, so they hold
+ *   only for a workspace in its first {@link OUTBOUND_REVIEW_YOUNG_DAYS}
+ *   days — the incident's window — and NEVER for mail the recipient's own
+ *   act made owed ({@link OutboundScreenPolicy.owed}).
+ *
+ * A credential-harvest page (a password, card or one-time-code field that
+ * is not one of the platform's own sign-in or checkout elements) is STRONG:
+ * see `hosted-page-screen.ts`.
+ *=========================================*/ /** A workspace younger than this many days has the soft rules applied. */ export const OUTBOUND_REVIEW_YOUNG_DAYS = 14;
+/** The signal codes that hold for every workspace. */ export const STRONG_PHISHING_SIGNAL_CODES = new Set([
+    'lookalike-link',
+    'credential-field'
+]);
+export function phishingSignalTier(signal) {
+    return STRONG_PHISHING_SIGNAL_CODES.has(signal == null ? void 0 : signal.code) ? 'strong' : 'soft';
+}
+/** Is a workspace of this age (days, `null` = unreadable) screened by the soft rules? */ export function isYoungWorkspaceAge(ageDays) {
+    return typeof ageDays === 'number' && Number.isFinite(ageDays) && ageDays < OUTBOUND_REVIEW_YOUNG_DAYS;
+}
+/** The signals that HOLD under the tiers, for this workspace and message. */ export function signalsThatHold(signals, policy) {
+    const soft = isYoungWorkspaceAge(policy.ageDays) && !policy.owed;
+    return signals.filter((signal)=>phishingSignalTier(signal) === 'strong' || soft);
+}
+/**
+ * The same brand, lookalike and tier logic applied to a HOST NAME a workspace
+ * asks for — a subdomain on the tenant apex, or a custom domain it attaches.
+ *
+ * Words a brand's impersonator hyphen-joins to its name. A subdomain that
+ * joins a brand's word to one of these (`booking-review`, `apple-support`,
+ * `amazon-account`) is the incident's shape even where the brand's word is
+ * an ordinary one — which the lookalike rule alone deliberately lets pass,
+ * so a salon can be `tanyas-booking` and a bakery `apple-pie-co`.
+ */ export const BRAND_IMPERSONATION_WORDS = new Set([
+    'account',
+    'accounts',
+    'auth',
+    'billing',
+    'help',
+    'helpdesk',
+    'id',
+    'login',
+    'logon',
+    'order',
+    'orders',
+    'pay',
+    'payment',
+    'payments',
+    'refund',
+    'resolution',
+    'review',
+    'reviews',
+    'secure',
+    'security',
+    'seller',
+    'service',
+    'signin',
+    'support',
+    'update',
+    'verify',
+    'verification',
+    'wallet'
+]);
+/**
+ * The brand a requested subdomain label wears, or null.
+ *
+ * Refused for EVERY workspace, at creation and at rename — the tier is
+ * strong, because nothing is lost by asking a real bakery to pick
+ * `apple-pie-co` instead of `apple-support`, and a brand's name on our apex
+ * is a disguise that outlives every later screen. Two shapes:
+ *
+ * 1. the label is a lookalike host label ({@link lookalikeBrandForHost} on
+ *    `<label>.<apex>`): `poshmark`, `paypal-secure`, `paypa1`, `appleid`;
+ * 2. a brand's word hyphen-joined to an impersonation word
+ *    ({@link BRAND_IMPERSONATION_WORDS}): `booking-review`, `apple-support`.
+ */ export function brandForSubdomainLabel(label, apex = 'example.invalid') {
+    const normalized = String(label != null ? label : '').trim().toLowerCase();
+    if (!normalized) return null;
+    const byHost = lookalikeBrandForHost(`${normalized}.${apex}`);
+    if (byHost) return byHost;
+    const parts = foldLeet(normalized).split('-').filter(Boolean);
+    if (parts.length < 2 || !parts.some((part)=>BRAND_IMPERSONATION_WORDS.has(part))) {
+        return null;
+    }
+    for (const brand of PHISHING_SCREEN_BRANDS){
+        const words = [
+            brand.id,
+            ...brand.hostTokens
+        ].filter((word)=>!word.includes('-'));
+        if (parts.some((part)=>words.includes(part))) return brand;
+    }
+    return null;
+}
+
+//# sourceMappingURL=outbound-phishing-screen.js.map