@aglyn/shared-util-email 1.0.0-beta.219 → 1.0.0-beta.221

package/src/lib/link-reputation.d.ts

@@ -0,0 +1,74 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { PhishingScreenSignal } from './outbound-phishing-screen';
+/** The threat lists a host is looked up against. */
+export type LinkThreatType = 'SOCIAL_ENGINEERING' | 'MALWARE' | 'UNWANTED_SOFTWARE';
+export declare const LINK_THREAT_TYPES: readonly LinkThreatType[];
+/** A host the list names, and what it names it for. */
+export interface HostReputationHit {
+    host: string;
+    threats: LinkThreatType[];
+}
+/** What one lookup answered, host by host. */
+export interface LinkReputationAnswer {
+    /** Hosts the list names. */
+    hits: HostReputationHit[];
+    /** Hosts the list does not name. */
+    clean: string[];
+    /** Hosts nobody could answer for: an error, a timeout, a switched-off lookup. */
+    unknown: string[];
+}
+export interface LinkReputationLookupOptions {
+    /** How long the caller will wait, overall. */
+    deadlineMs?: number;
+}
+export type LinkReputationLookup = (hosts: readonly string[], options?: LinkReputationLookupOptions) => Promise<LinkReputationAnswer>;
+/** The most foreign hosts one page, message or redirect is looked up for. */
+export declare const MAX_REPUTATION_HOSTS_PER_LOOKUP = 20;
+/** Installs the lookup. Called once, from `@aglyn/tenant-data-admin`. */
+export declare function setLinkReputationLookup(lookup: LinkReputationLookup | null): void;
+/** The installed lookup, or null. */
+export declare function getLinkReputationLookup(): LinkReputationLookup | null;
+/** Test seam: forget any installed lookup. */
+export declare function resetLinkReputationLookupForTests(): void;
+/** A host as the lookup takes it, or null for anything that is not one. */
+export declare function normalizeReputationHost(host: string): string | null;
+/**
+ * The hosts worth asking about: foreign ones. Not the workspace's own, not
+ * a domain under one of `excludeDomains` (the platform's own), not a listed
+ * brand's own domain and not a common social, maps or review link — those
+ * are judged by the screen's rules, and asking about them would only spend
+ * lookups. Deduplicated, in the order found, at most
+ * {@link MAX_REPUTATION_HOSTS_PER_LOOKUP} unless `max` says otherwise.
+ */
+export declare function foreignHostsForReputation(hosts: readonly string[], options?: {
+    ownDomains?: readonly (string | null | undefined)[];
+    excludeDomains?: readonly (string | null | undefined)[];
+    max?: number;
+}): string[];
+/** A listing, as the screen's signal. */
+export declare function webRiskSignals(hits: readonly HostReputationHit[]): PhishingScreenSignal[];
+/**
+ * Look the foreign hosts up through the installed lookup and answer the
+ * signals they carry. Nothing installed, nothing foreign, an error: no
+ * signals. Never throws.
+ */
+export declare function linkReputationSignals(hosts: readonly string[], options?: {
+    ownDomains?: readonly (string | null | undefined)[];
+    excludeDomains?: readonly (string | null | undefined)[];
+    deadlineMs?: number;
+}): Promise<PhishingScreenSignal[]>;

package/src/lib/link-reputation.js

@@ -0,0 +1,123 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /*==========================================
+ * LINK REPUTATION (AGL-3451): what the phishing screen asks about a host
+ * nobody's rules can judge.
+ *
+ * The screen's own rules catch a page or a message that LOOKS like a lure —
+ * a brand's lookalike host, a password field, a brand beside a sign-in. The
+ * 2026-10-01 harvesters linked to `temps-juenes.com` and
+ * `conservascaorvi.com`, which wear no brand at all, so nothing held them.
+ * A host already known to be bad anywhere is caught here instead: every
+ * FOREIGN host a page, an email or a redirect points at is looked up against
+ * a reputation list (Google Web Risk), and a listed one is a
+ * `web-risk-link` signal — STRONG, so it holds for every workspace.
+ *
+ * Split like the send seam's gate: the pure half lives here (which hosts are
+ * foreign, how a listing becomes a signal), and the lookup — a network call
+ * and a cache — is installed by `@aglyn/tenant-data-admin`
+ * (`web-risk.ts`) through {@link setLinkReputationLookup}. Nothing installed
+ * means nothing looked up.
+ *
+ * ## Not evidence when it fails
+ *
+ * A lookup that errors or times out says nothing about the host. It never
+ * holds by itself; the lookup reports the host as unknown and logs a warning.
+ *
+ * ## Only the host
+ *
+ * The lookup sees `https://<host>/` and nothing else: never the path, the
+ * query, the page or the message. A host is enough to catch a domain that
+ * exists to harvest, and it is the least a third party can be told.
+ *=========================================*/ import { isAnyOfficialBrandDomain, isCommonLinkDomain, registrableDomain } from "./outbound-phishing-screen.js";
+export const LINK_THREAT_TYPES = [
+    'SOCIAL_ENGINEERING',
+    'MALWARE',
+    'UNWANTED_SOFTWARE'
+];
+/** The most foreign hosts one page, message or redirect is looked up for. */ export const MAX_REPUTATION_HOSTS_PER_LOOKUP = 20;
+let installedLookup = null;
+/** Installs the lookup. Called once, from `@aglyn/tenant-data-admin`. */ export function setLinkReputationLookup(lookup) {
+    installedLookup = lookup;
+}
+/** The installed lookup, or null. */ export function getLinkReputationLookup() {
+    return installedLookup;
+}
+/** Test seam: forget any installed lookup. */ export function resetLinkReputationLookupForTests() {
+    installedLookup = null;
+}
+const HOST_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?)+$/;
+/** A host as the lookup takes it, or null for anything that is not one. */ export function normalizeReputationHost(host) {
+    const value = String(host != null ? host : '').trim().toLowerCase().replace(/\.+$/, '');
+    return value.length <= 253 && HOST_PATTERN.test(value) ? value : null;
+}
+/**
+ * The hosts worth asking about: foreign ones. Not the workspace's own, not
+ * a domain under one of `excludeDomains` (the platform's own), not a listed
+ * brand's own domain and not a common social, maps or review link — those
+ * are judged by the screen's rules, and asking about them would only spend
+ * lookups. Deduplicated, in the order found, at most
+ * {@link MAX_REPUTATION_HOSTS_PER_LOOKUP} unless `max` says otherwise.
+ */ export function foreignHostsForReputation(hosts, options = {}) {
+    var _options_max;
+    const under = (list)=>(list != null ? list : []).map((domain)=>normalizeReputationHost(String(domain != null ? domain : ''))).filter((domain)=>Boolean(domain));
+    const own = [
+        ...under(options.ownDomains),
+        ...under(options.excludeDomains)
+    ];
+    const max = (_options_max = options.max) != null ? _options_max : MAX_REPUTATION_HOSTS_PER_LOOKUP;
+    const out = [];
+    for (const raw of hosts){
+        if (out.length >= max) break;
+        const host = normalizeReputationHost(raw);
+        if (!host || out.includes(host)) continue;
+        if (own.some((domain)=>host === domain || host.endsWith(`.${domain}`))) continue;
+        const registrable = registrableDomain(host);
+        if (isAnyOfficialBrandDomain(registrable) || isCommonLinkDomain(registrable)) continue;
+        out.push(host);
+    }
+    return out;
+}
+/** A listing, as the screen's signal. */ export function webRiskSignals(hits) {
+    return hits.map((hit)=>({
+            code: 'web-risk-link',
+            host: hit.host,
+            threats: [
+                ...new Set(hit.threats)
+            ].sort()
+        }));
+}
+/**
+ * Look the foreign hosts up through the installed lookup and answer the
+ * signals they carry. Nothing installed, nothing foreign, an error: no
+ * signals. Never throws.
+ */ export async function linkReputationSignals(hosts, options = {}) {
+    const lookup = installedLookup;
+    if (!lookup) return [];
+    const foreign = foreignHostsForReputation(hosts, options);
+    if (!foreign.length) return [];
+    try {
+        const answer = await lookup(foreign, {
+            deadlineMs: options.deadlineMs
+        });
+        return webRiskSignals(answer.hits.filter((hit)=>foreign.includes(hit.host)));
+    } catch (error) {
+        console.warn('[link-reputation] the lookup failed — no signal', error);
+        return [];
+    }
+}
+
+//# sourceMappingURL=link-reputation.js.map

package/src/lib/link-reputation.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/shared/util/email/src/lib/link-reputation.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*==========================================\n * LINK REPUTATION (AGL-3451): what the phishing screen asks about a host\n * nobody's rules can judge.\n *\n * The screen's own rules catch a page or a message that LOOKS like a lure —\n * a brand's lookalike host, a password field, a brand beside a sign-in. The\n * 2026-10-01 harvesters linked to `temps-juenes.com` and\n * `conservascaorvi.com`, which wear no brand at all, so nothing held them.\n * A host already known to be bad anywhere is caught here instead: every\n * FOREIGN host a page, an email or a redirect points at is looked up against\n * a reputation list (Google Web Risk), and a listed one is a\n * `web-risk-link` signal — STRONG, so it holds for every workspace.\n *\n * Split like the send seam's gate: the pure half lives here (which hosts are\n * foreign, how a listing becomes a signal), and the lookup — a network call\n * and a cache — is installed by `@aglyn/tenant-data-admin`\n * (`web-risk.ts`) through {@link setLinkReputationLookup}. Nothing installed\n * means nothing looked up.\n *\n * ## Not evidence when it fails\n *\n * A lookup that errors or times out says nothing about the host. It never\n * holds by itself; the lookup reports the host as unknown and logs a warning.\n *\n * ## Only the host\n *\n * The lookup sees `https://<host>/` and nothing else: never the path, the\n * query, the page or the message. A host is enough to catch a domain that\n * exists to harvest, and it is the least a third party can be told.\n *=========================================*/\n\nimport type { PhishingScreenSignal } from './outbound-phishing-screen'\nimport {\n  isAnyOfficialBrandDomain,\n  isCommonLinkDomain,\n  registrableDomain,\n} from './outbound-phishing-screen'\n\n/** The threat lists a host is looked up against. */\nexport type LinkThreatType = 'SOCIAL_ENGINEERING' | 'MALWARE' | 'UNWANTED_SOFTWARE'\n\nexport const LINK_THREAT_TYPES: readonly LinkThreatType[] = [\n  'SOCIAL_ENGINEERING',\n  'MALWARE',\n  'UNWANTED_SOFTWARE',\n]\n\n/** A host the list names, and what it names it for. */\nexport interface HostReputationHit {\n  host: string\n  threats: LinkThreatType[]\n}\n\n/** What one lookup answered, host by host. */\nexport interface LinkReputationAnswer {\n  /** Hosts the list names. */\n  hits: HostReputationHit[]\n  /** Hosts the list does not name. */\n  clean: string[]\n  /** Hosts nobody could answer for: an error, a timeout, a switched-off lookup. */\n  unknown: string[]\n}\n\nexport interface LinkReputationLookupOptions {\n  /** How long the caller will wait, overall. */\n  deadlineMs?: number\n}\n\nexport type LinkReputationLookup = (\n  hosts: readonly string[],\n  options?: LinkReputationLookupOptions,\n) => Promise<LinkReputationAnswer>\n\n/** The most foreign hosts one page, message or redirect is looked up for. */\nexport const MAX_REPUTATION_HOSTS_PER_LOOKUP = 20\n\nlet installedLookup: LinkReputationLookup | null = null\n\n/** Installs the lookup. Called once, from `@aglyn/tenant-data-admin`. */\nexport function setLinkReputationLookup(lookup: LinkReputationLookup | null): void {\n  installedLookup = lookup\n}\n\n/** The installed lookup, or null. */\nexport function getLinkReputationLookup(): LinkReputationLookup | null {\n  return installedLookup\n}\n\n/** Test seam: forget any installed lookup. */\nexport function resetLinkReputationLookupForTests(): void {\n  installedLookup = null\n}\n\nconst HOST_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?)+$/\n\n/** A host as the lookup takes it, or null for anything that is not one. */\nexport function normalizeReputationHost(host: string): string | null {\n  const value = String(host ?? '')\n    .trim()\n    .toLowerCase()\n    .replace(/\\.+$/, '')\n  return value.length <= 253 && HOST_PATTERN.test(value) ? value : null\n}\n\n/**\n * The hosts worth asking about: foreign ones. Not the workspace's own, not\n * a domain under one of `excludeDomains` (the platform's own), not a listed\n * brand's own domain and not a common social, maps or review link — those\n * are judged by the screen's rules, and asking about them would only spend\n * lookups. Deduplicated, in the order found, at most\n * {@link MAX_REPUTATION_HOSTS_PER_LOOKUP} unless `max` says otherwise.\n */\nexport function foreignHostsForReputation(\n  hosts: readonly string[],\n  options: {\n    ownDomains?: readonly (string | null | undefined)[]\n    excludeDomains?: readonly (string | null | undefined)[]\n    max?: number\n  } = {},\n): string[] {\n  const under = (list: readonly (string | null | undefined)[] | undefined) =>\n    (list ?? [])\n      .map((domain) => normalizeReputationHost(String(domain ?? '')))\n      .filter((domain): domain is string => Boolean(domain))\n  const own = [...under(options.ownDomains), ...under(options.excludeDomains)]\n  const max = options.max ?? MAX_REPUTATION_HOSTS_PER_LOOKUP\n  const out: string[] = []\n  for (const raw of hosts) {\n    if (out.length >= max) break\n    const host = normalizeReputationHost(raw)\n    if (!host || out.includes(host)) continue\n    if (own.some((domain) => host === domain || host.endsWith(`.${domain}`))) continue\n    const registrable = registrableDomain(host)\n    if (isAnyOfficialBrandDomain(registrable) || isCommonLinkDomain(registrable)) continue\n    out.push(host)\n  }\n  return out\n}\n\n/** A listing, as the screen's signal. */\nexport function webRiskSignals(hits: readonly HostReputationHit[]): PhishingScreenSignal[] {\n  return hits.map((hit) => ({\n    code: 'web-risk-link' as const,\n    host: hit.host,\n    threats: [...new Set(hit.threats)].sort(),\n  }))\n}\n\n/**\n * Look the foreign hosts up through the installed lookup and answer the\n * signals they carry. Nothing installed, nothing foreign, an error: no\n * signals. Never throws.\n */\nexport async function linkReputationSignals(\n  hosts: readonly string[],\n  options: {\n    ownDomains?: readonly (string | null | undefined)[]\n    excludeDomains?: readonly (string | null | undefined)[]\n    deadlineMs?: number\n  } = {},\n): Promise<PhishingScreenSignal[]> {\n  const lookup = installedLookup\n  if (!lookup) return []\n  const foreign = foreignHostsForReputation(hosts, options)\n  if (!foreign.length) return []\n  try {\n    const answer = await lookup(foreign, { deadlineMs: options.deadlineMs })\n    return webRiskSignals(answer.hits.filter((hit) => foreign.includes(hit.host)))\n  } catch (error) {\n    console.warn('[link-reputation] the lookup failed — no signal', error)\n    return []\n  }\n}\n"],"names":["isAnyOfficialBrandDomain","isCommonLinkDomain","registrableDomain","LINK_THREAT_TYPES","MAX_REPUTATION_HOSTS_PER_LOOKUP","installedLookup","setLinkReputationLookup","lookup","getLinkReputationLookup","resetLinkReputationLookupForTests","HOST_PATTERN","normalizeReputationHost","host","value","String","trim","toLowerCase","replace","length","test","foreignHostsForReputation","hosts","options","under","list","map","domain","filter","Boolean","own","ownDomains","excludeDomains","max","out","raw","includes","some","endsWith","registrable","push","webRiskSignals","hits","hit","code","threats","Set","sort","linkReputationSignals","foreign","answer","deadlineMs","error","console","warn"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2CA6B2C,GAG3C,SACEA,wBAAwB,EACxBC,kBAAkB,EAClBC,iBAAiB,QACZ,gCAA4B;AAKnC,OAAO,MAAMC,oBAA+C;IAC1D;IACA;IACA;CACD,CAAA;AA4BD,2EAA2E,GAC3E,OAAO,MAAMC,kCAAkC,GAAE;AAEjD,IAAIC,kBAA+C;AAEnD,uEAAuE,GACvE,OAAO,SAASC,wBAAwBC,MAAmC;IACzEF,kBAAkBE;AACpB;AAEA,mCAAmC,GACnC,OAAO,SAASC;IACd,OAAOH;AACT;AAEA,4CAA4C,GAC5C,OAAO,SAASI;IACdJ,kBAAkB;AACpB;AAEA,MAAMK,eAAe;AAErB,yEAAyE,GACzE,OAAO,SAASC,wBAAwBC,IAAY;IAClD,MAAMC,QAAQC,OAAOF,eAAAA,OAAQ,IAC1BG,IAAI,GACJC,WAAW,GACXC,OAAO,CAAC,QAAQ;IACnB,OAAOJ,MAAMK,MAAM,IAAI,OAAOR,aAAaS,IAAI,CAACN,SAASA,QAAQ;AACnE;AAEA;;;;;;;CAOC,GACD,OAAO,SAASO,0BACdC,KAAwB,EACxBC,UAII,CAAC,CAAC;QAOMA;IALZ,MAAMC,QAAQ,CAACC,OACb,CAACA,eAAAA,OAAQ,EAAE,EACRC,GAAG,CAAC,CAACC,SAAWf,wBAAwBG,OAAOY,iBAAAA,SAAU,MACzDC,MAAM,CAAC,CAACD,SAA6BE,QAAQF;IAClD,MAAMG,MAAM;WAAIN,MAAMD,QAAQQ,UAAU;WAAMP,MAAMD,QAAQS,cAAc;KAAE;IAC5E,MAAMC,OAAMV,eAAAA,QAAQU,GAAG,YAAXV,eAAelB;IAC3B,MAAM6B,MAAgB,EAAE;IACxB,KAAK,MAAMC,OAAOb,MAAO;QACvB,IAAIY,IAAIf,MAAM,IAAIc,KAAK;QACvB,MAAMpB,OAAOD,wBAAwBuB;QACrC,IAAI,CAACtB,QAAQqB,IAAIE,QAAQ,CAACvB,OAAO;QACjC,IAAIiB,IAAIO,IAAI,CAAC,CAACV,SAAWd,SAASc,UAAUd,KAAKyB,QAAQ,CAAC,CAAC,CAAC,EAAEX,QAAQ,IAAI;QAC1E,MAAMY,cAAcpC,kBAAkBU;QACtC,IAAIZ,yBAAyBsC,gBAAgBrC,mBAAmBqC,cAAc;QAC9EL,IAAIM,IAAI,CAAC3B;IACX;IACA,OAAOqB;AACT;AAEA,uCAAuC,GACvC,OAAO,SAASO,eAAeC,IAAkC;IAC/D,OAAOA,KAAKhB,GAAG,CAAC,CAACiB,MAAS,CAAA;YACxBC,MAAM;YACN/B,MAAM8B,IAAI9B,IAAI;YACdgC,SAAS;mBAAI,IAAIC,IAAIH,IAAIE,OAAO;aAAE,CAACE,IAAI;QACzC,CAAA;AACF;AAEA;;;;CAIC,GACD,OAAO,eAAeC,sBACpB1B,KAAwB,EACxBC,UAII,CAAC,CAAC;IAEN,MAAMf,SAASF;IACf,IAAI,CAACE,QAAQ,OAAO,EAAE;IACtB,MAAMyC,UAAU5B,0BAA0BC,OAAOC;IACjD,IAAI,CAAC0B,QAAQ9B,MAAM,EAAE,OAAO,EAAE;IAC9B,IAAI;QACF,MAAM+B,SAAS,MAAM1C,OAAOyC,SAAS;YAAEE,YAAY5B,QAAQ4B,UAAU;QAAC;QACtE,OAAOV,eAAeS,OAAOR,IAAI,CAACd,MAAM,CAAC,CAACe,MAAQM,QAAQb,QAAQ,CAACO,IAAI9B,IAAI;IAC7E,EAAE,OAAOuC,OAAO;QACdC,QAAQC,IAAI,CAAC,mDAAmDF;QAChE,OAAO,EAAE;IACX;AACF"}

package/src/lib/outbound-phishing-screen.d.ts

@@ -58,9 +58,22 @@ export interface PhishingScreenBrand {
 }
 export declare const PHISHING_SCREEN_BRANDS: readonly PhishingScreenBrand[];
 /**
- * Account-action and credential phrasing — the half of a lure that asks the
- * reader to DO something with an account. Only ever counted beside a brand
- * AND a foreign link; alone, several of these are ordinary transactional copy.
+ * Account and credential phrasing: the lure that asks the reader to DO
+ * something with an account — verify it, confirm it, sign in to it.
+ */
+export declare const ACCOUNT_LURE_PATTERNS: readonly RegExp[];
+/**
+ * Document-share phrasing (AGL-3447): the lure that says a file is waiting
+ * behind a secure door — "Secure Document Access Portal", "Continue to
+ * Document", "shared a file with you", "encrypted message". The credential
+ * harvest is on the far side of the button, so these are the words the page
+ * or the mail itself carries.
+ */
+export declare const DOCUMENT_SHARE_LURE_PATTERNS: readonly RegExp[];
+/**
+ * Every lure — the half of the three-part lure that asks the reader to act.
+ * Only ever counted beside a brand AND a foreign link; alone, several of
+ * these are ordinary transactional copy.
  */
 export declare const PHISHING_LURE_PATTERNS: readonly RegExp[];
 /** A signal the screen found. */
@@ -97,6 +110,65 @@ export type PhishingScreenSignal = {
     code: 'brand-action-page';
     brand: string;
     action: string;
+}
+/**
+ * The same, read over the page as a WHOLE (AGL-3447): a brand that is not
+ * the workspace's anywhere on a page that carries an account or
+ * document-share lure anywhere, or whose call to action leaves the site
+ * worded as one, and that links away (`hosted-page-screen.ts`). Soft.
+ */
+ | {
+    code: 'brand-lure-page';
+    brand: string;
+    lure: string;
+    host: string;
+}
+/**
+ * A published page's call to action — its only one, or one worded as an
+ * account or document action — sends visitors to a host that is not the
+ * site's, a listed brand's or a common link, on a page that carries an
+ * account or document-share lure (`hosted-page-screen.ts`, AGL-3447). No
+ * brand needed. Soft.
+ */
+ | {
+    code: 'offsite-action-page';
+    action: string;
+    lure: string;
+    host: string;
+}
+/**
+ * A site redirect whose path reads as an account or document-share lure
+ * sends visitors to such a host (`screenSiteRedirect`, AGL-3447). Soft.
+ */
+ | {
+    code: 'offsite-redirect';
+    source: string;
+    lure: string;
+    host: string;
+}
+/**
+ * Account or password phrasing beside a link elsewhere that carries the
+ * reader's own address (AGL-3453). STRONG when the address is the whole
+ * fragment (`#victim@example.com`), which only a landing page's script
+ * reads; soft when it is a query parameter or part of a longer fragment.
+ * The address itself is never stored.
+ */
+ | {
+    code: 'recipient-prefill-link';
+    host: string;
+    lure: string;
+    place: 'fragment' | 'parameter';
+}
+/**
+ * A link, embed, redirect or form action whose host Google Web Risk lists
+ * as phishing, malware or unwanted software (AGL-3451,
+ * `link-reputation.ts`). Strong: a harvester already known to be bad
+ * anywhere is bad whatever page or message surrounds it.
+ */
+ | {
+    code: 'web-risk-link';
+    host: string;
+    threats: string[];
 };
 export interface PhishingScreenInput {
     subject?: string | null;
@@ -163,6 +235,21 @@ declare function isAnyOfficialDomain(registrable: string): boolean;
 export declare const MEDIA_EMBED_HOSTS: ReadonlySet<string>;
 /** The brand a host impersonates, or null. */
 export declare function lookalikeBrandForHost(host: string): PhishingScreenBrand | null;
+/**
+ * What a reader SEES in a body (AGL-3453): its text with the markup taken
+ * out, the way a mail client or a browser draws it.
+ *
+ * A kit splits every letter of a brand and a lure with a tag —
+ * `G<SPAN class=…>o<SPAN …>o…gle`, `P<SPAN …>a<SPAN …>s…word E<SPAN …>x…pired`
+ * — so the raw HTML never contains the word a reader reads. Tags are
+ * therefore removed with NO separator, which rejoins the letters; `<style>`,
+ * `<script>` and `<head>` are dropped with their contents; comments and
+ * zero-width characters are dropped; entities are decoded; whitespace is
+ * collapsed. A second reading that puts a space where a line or block
+ * breaks is added when it differs, so two words in two paragraphs are still
+ * two words. Links are NOT read from this: an href lives inside a tag.
+ */
+export declare function visibleTextOf(html: string | null | undefined): string;
 /** The hosts every link in the text points at, lowercased. */
 export declare function linkHostsIn(text: string): string[];
 /** Lowercased alphanumerics only, so "Wells-Fargo Advisors" contains `wellsfargo`. */
@@ -183,6 +270,8 @@ export declare function isCommonLinkDomain(registrable: string): boolean;
 export declare function screenOutboundEmail(input: PhishingScreenInput): PhishingScreenVerdict;
 /** The brand's label for a stored id, for the staff surface. */
 export declare function phishingScreenBrandLabel(id: string): string;
+/** "phishing or social engineering and malware", from Web Risk's threat types. */
+export declare function describeLinkThreats(threats: readonly string[]): string;
 /** One line per signal, in words staff read on the review row. */
 export declare function describePhishingScreenSignals(signals: readonly PhishingScreenSignal[]): string[];
 /** A workspace younger than this many days has the soft rules applied. */
@@ -202,6 +291,7 @@ export declare const ACCOUNT_SUBDOMAIN_HOSTS: ReadonlySet<string>;
 export declare function phishingSignalTier(signal: {
     code: string;
     host?: string;
+    place?: string;
 }): PhishingSignalTier;
 /** Is a workspace of this age (days, `null` = unreadable) screened by the soft rules? */
 export declare function isYoungWorkspaceAge(ageDays: number | null | undefined): boolean;