@postalsys/otp-detect 0.0.0-stage → 0.1.0

package/dist/cjs/features.js

@@ -0,0 +1,320 @@
+"use strict";
+// Turns each candidate into a fixed-length vector of numbers for the scorer. FEATURE_NAMES is the
+// contract with the trained model: training records the names it was fit on, and the model refuses
+// to load against a different list. Add features at the end and retrain; never reorder.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FEATURE_NAMES = void 0;
+exports.messageContext = messageContext;
+exports.docContext = docContext;
+exports.candidateFeatures = candidateFeatures;
+const doc_js_1 = require("./doc.js");
+const keywords_js_1 = require("./keywords.js");
+exports.FEATURE_NAMES = [
+    // shape
+    'len',
+    'digits',
+    'upper',
+    'lower',
+    'isDigits',
+    'isUpperAlpha',
+    'isMixedCase',
+    'kindGrouped',
+    'kindSpaced',
+    'kindDashedPart',
+    'hasDash',
+    'leadingZero',
+    'distinctRatio',
+    'trivialSequence',
+    'looksYear',
+    // characters around it
+    'colonBefore',
+    'hashBefore',
+    'currencyNear',
+    'plusOrParenBefore',
+    'digitNearby',
+    'percentAfter',
+    // keywords, distances in characters, capped
+    'strongBefore',
+    'strongAfter',
+    'weakBefore',
+    'weakAfter',
+    'cueBefore',
+    'cueAfter',
+    'negBefore',
+    'negAfter',
+    'strongInLine',
+    'weakInLine',
+    'negInLine',
+    'strongRank',
+    // layout and style
+    'lineLen',
+    'aloneOnLine',
+    'blockLen',
+    'aloneInBlock',
+    'fontSize',
+    'fontRatio',
+    'isLargestFont',
+    'bold',
+    'letterSpacing',
+    'link',
+    'heading',
+    'mono',
+    'hidden',
+    'quoted',
+    'relPosition',
+    'fromHtml',
+    // message
+    'occurrences',
+    'inOtherDoc',
+    'inSubject',
+    'subjectStrong',
+    'subjectWeak',
+    'subjectNeg',
+    'docStrong',
+    'docCue',
+    'docLen',
+    'candidates',
+    'distinctCodes',
+    'candidateIndex',
+    // codes that prove nothing: promotions, referrals, invitations
+    'promoBefore',
+    'promoAfter',
+    'promoInLine',
+    'docPromo',
+    'subjectPromo',
+    // letters-only codes are random (QWKZT), words in capitals are not (WEBINAR)
+    'vowelRatio',
+    // identifiers from code and prose (loginFailedError, retry2fa) have word-like letter runs
+    'longestLetterRun',
+    'caseChanges'
+];
+const FAR = 1000;
+const CURRENCY_RE = /[€$£¥₽]|\b(?:eur|usd|gbp|sek|nok|dkk|rub)\b/i;
+function messageContext(subject, otherText, distinctCodes) {
+    return {
+        subject,
+        otherText,
+        distinctCodes,
+        subjectStrong: (0, keywords_js_1.matches)(keywords_js_1.STRONG, subject),
+        subjectWeak: (0, keywords_js_1.matches)(keywords_js_1.WEAK, subject),
+        subjectNeg: (0, keywords_js_1.matches)(keywords_js_1.NEGATIVE, subject),
+        subjectPromo: (0, keywords_js_1.matches)(keywords_js_1.PROMO, subject)
+    };
+}
+// Hits come from one global regex, so they are sorted and do not overlap: starts and ends both
+// increase, and every lookup below is a binary search instead of a scan of an uncapped list.
+/** Index of the first hit whose `key` is at least `pos`, hits.length if none */
+function firstAtLeast(hits, key, pos) {
+    let lo = 0;
+    let hi = hits.length;
+    while (lo < hi) {
+        const mid = Math.floor((lo + hi) / 2);
+        if (hits[mid][key] < pos) {
+            lo = mid + 1;
+        }
+        else {
+            hi = mid;
+        }
+    }
+    return lo;
+}
+/** Distance from the end of the closest hit that ends at or before pos */
+function distanceBefore(hits, pos) {
+    const i = firstAtLeast(hits, 'end', pos + 1) - 1;
+    return i >= 0 ? Math.min(FAR, pos - hits[i].end) : FAR;
+}
+/** Distance to the start of the first hit that starts at or after pos */
+function distanceAfter(hits, pos) {
+    const i = firstAtLeast(hits, 'start', pos);
+    return i < hits.length ? Math.min(FAR, hits[i].start - pos) : FAR;
+}
+/** Whether a whole hit lies within [from, to]; the first hit starting at from has the smallest end */
+function inRange(hits, from, to) {
+    const i = firstAtLeast(hits, 'start', from);
+    return i < hits.length && hits[i].end <= to;
+}
+function dominantFontSize(doc) {
+    const chars = new Map();
+    for (const span of doc.spans) {
+        if (!span.style.hidden) {
+            const size = Math.round(span.style.fontSize);
+            chars.set(size, (chars.get(size) ?? 0) + span.end - span.start);
+        }
+    }
+    let best = 16;
+    let most = 0;
+    for (const [size, count] of chars) {
+        if (count > most) {
+            best = size;
+            most = count;
+        }
+    }
+    return best;
+}
+function rankByStrongDistance(strong, candidates) {
+    // Keys computed once; the sort is stable, so equal distances keep document order
+    const keyed = candidates.map(c => ({ c, key: Math.min(distanceBefore(strong, c.start), distanceAfter(strong, c.end)) }));
+    keyed.sort((a, b) => a.key - b.key);
+    return new Map(keyed.map((k, i) => [k.c, i]));
+}
+function docContext(doc, candidates) {
+    const strong = (0, keywords_js_1.findAll)(keywords_js_1.STRONG, doc.text);
+    const codeCounts = new Map();
+    for (const c of candidates) {
+        codeCounts.set(c.code, (codeCounts.get(c.code) ?? 0) + 1);
+    }
+    return {
+        doc,
+        strong,
+        weak: (0, keywords_js_1.findAll)(keywords_js_1.WEAK, doc.text),
+        cue: (0, keywords_js_1.findAll)(keywords_js_1.CUE, doc.text),
+        neg: (0, keywords_js_1.findAll)(keywords_js_1.NEGATIVE, doc.text),
+        promo: (0, keywords_js_1.findAll)(keywords_js_1.PROMO, doc.text),
+        dominantFont: dominantFontSize(doc),
+        maxCandidateFont: Math.max(0, ...candidates.map(c => (0, doc_js_1.styleAt)(doc, c.start).fontSize)),
+        candidates,
+        strongRanks: rankByStrongDistance(strong, candidates),
+        codeCounts
+    };
+}
+function lineOf(text, c) {
+    const start = text.lastIndexOf('\n', c.start - 1) + 1;
+    const nl = text.indexOf('\n', c.end);
+    const end = nl < 0 ? text.length : nl;
+    return { start, end, text: text.slice(start, end) };
+}
+function shapeFeatures(c) {
+    const code = c.code;
+    const digits = (code.match(/\d/g) ?? []).length;
+    const upper = (code.match(/[A-Z]/g) ?? []).length;
+    const lower = (code.match(/[a-z]/g) ?? []).length;
+    const trivial = /^(\d)\1+$/.test(code) || '0123456789'.includes(code) || '9876543210'.includes(code);
+    return [
+        code.length,
+        digits,
+        upper,
+        lower,
+        Number(digits === code.length),
+        Number(upper === code.length),
+        Number(upper > 0 && lower > 0),
+        Number(c.kind === 'grouped'),
+        Number(c.kind === 'spaced'),
+        Number(c.kind === 'dashed-part'),
+        Number(c.raw.includes('-')),
+        Number(code.startsWith('0')),
+        new Set(code).size / code.length,
+        Number(trivial),
+        Number(/^(?:19|20)\d\d$/.test(code))
+    ];
+}
+function surroundingFeatures(text, c) {
+    const before = text.slice(Math.max(0, c.start - 4), c.start);
+    const after = text.slice(c.end, c.end + 4);
+    return [
+        Number(/:\s*$/.test(before)),
+        Number(/#\s*$/.test(before)),
+        Number(CURRENCY_RE.test(before) || CURRENCY_RE.test(after)),
+        Number(/[+(]\s*$/.test(before)),
+        Number(/\d/.test(text.slice(Math.max(0, c.start - 3), c.start)) || /\d/.test(text.slice(c.end, c.end + 3))),
+        Number(/^\s*%/.test(after))
+    ];
+}
+function keywordFeatures(ctx, c, line) {
+    return [
+        distanceBefore(ctx.strong, c.start),
+        distanceAfter(ctx.strong, c.end),
+        distanceBefore(ctx.weak, c.start),
+        distanceAfter(ctx.weak, c.end),
+        distanceBefore(ctx.cue, c.start),
+        distanceAfter(ctx.cue, c.end),
+        distanceBefore(ctx.neg, c.start),
+        distanceAfter(ctx.neg, c.end),
+        Number(inRange(ctx.strong, line.start, line.end)),
+        Number(inRange(ctx.weak, line.start, line.end)),
+        Number(inRange(ctx.neg, line.start, line.end)),
+        ctx.strongRanks.get(c)
+    ];
+}
+function layoutFeatures(ctx, c, line) {
+    const { doc } = ctx;
+    const style = (0, doc_js_1.styleAt)(doc, c.start);
+    const block = (0, doc_js_1.blockAround)(doc, c.start, c.end);
+    const blockText = doc.text.slice(block.start, block.end).trim();
+    const lineText = line.text.trim();
+    return [
+        lineText.length,
+        Number(lineText === c.raw),
+        blockText.length,
+        Number(blockText === c.raw),
+        style.fontSize,
+        style.fontSize / (ctx.dominantFont || 16),
+        Number(style.fontSize >= ctx.maxCandidateFont),
+        Number(style.bold),
+        Number(style.letterSpacing),
+        Number(style.link),
+        Number(style.heading),
+        Number(style.mono),
+        Number(style.hidden),
+        Number(style.quote || c.start >= doc.quoteStart),
+        doc.text.length ? c.start / doc.text.length : 0,
+        Number(doc.source === 'html')
+    ];
+}
+function vowelRatio(code) {
+    const letters = code.match(/[A-Za-z]/g) ?? [];
+    if (!letters.length) {
+        return -1;
+    }
+    return letters.filter(ch => /[aeiouy]/i.test(ch)).length / letters.length;
+}
+function promoFeatures(ctx, msg, c, line) {
+    return [
+        distanceBefore(ctx.promo, c.start),
+        distanceAfter(ctx.promo, c.end),
+        Number(inRange(ctx.promo, line.start, line.end)),
+        ctx.promo.length,
+        Number(msg.subjectPromo)
+    ];
+}
+function messageFeatures(ctx, msg, c, index) {
+    return [
+        ctx.codeCounts.get(c.code),
+        Number(msg.otherText.includes(c.raw) || msg.otherText.includes(c.code)),
+        Number(msg.subject.includes(c.raw) || msg.subject.includes(c.code)),
+        Number(msg.subjectStrong),
+        Number(msg.subjectWeak),
+        Number(msg.subjectNeg),
+        ctx.strong.length,
+        Number(ctx.cue.length > 0),
+        Math.log1p(ctx.doc.text.length),
+        ctx.candidates.length,
+        msg.distinctCodes,
+        index
+    ];
+}
+function codeTextFeatures(code) {
+    return [
+        vowelRatio(code),
+        Math.max(0, ...(code.match(/[A-Za-z]+/g) ?? []).map(run => run.length)),
+        (code.match(/[a-z](?=[A-Z])|[A-Z](?=[a-z])/g) ?? []).length
+    ];
+}
+/** The feature vector of the candidate at `index` in ctx.candidates */
+function candidateFeatures(ctx, msg, index) {
+    const c = ctx.candidates[index];
+    const text = ctx.doc.text;
+    const line = lineOf(text, c);
+    const row = [
+        ...shapeFeatures(c),
+        ...surroundingFeatures(text, c),
+        ...keywordFeatures(ctx, c, line),
+        ...layoutFeatures(ctx, c, line),
+        ...messageFeatures(ctx, msg, c, index),
+        ...promoFeatures(ctx, msg, c, line),
+        ...codeTextFeatures(c.code)
+    ];
+    if (row.length !== exports.FEATURE_NAMES.length) {
+        throw new Error(`feature vector has ${row.length} values, expected ${exports.FEATURE_NAMES.length}`);
+    }
+    return row;
+}

package/dist/cjs/html.d.ts

@@ -0,0 +1,3 @@
+import type { Doc } from './doc.js';
+export declare function decodeEntities(input: string): string;
+export declare function renderHtml(html: string): Doc;

package/dist/cjs/html.js

@@ -0,0 +1,341 @@
+"use strict";
+// Renders HTML into plain text while remembering how each piece of text was styled, because the
+// way a code is presented (big, bold, letter spaced, alone in its own cell) is the strongest
+// signal that a number is the one-time code and not an order number.
+//
+// This is not a browser. It walks the tags in a single linear pass, applies the handful of inline
+// styles and elements that change how text looks, and treats everything else as a container.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decodeEntities = decodeEntities;
+exports.renderHtml = renderHtml;
+const doc_js_1 = require("./doc.js");
+// Comments, doctype and processing instructions, tags (quoted attribute values may contain `>`),
+// text. A tag never spans a `<` outside quotes, so an unclosed tag costs a scan to the next `<`
+// instead of one scan to the end of the input per `<`.
+const TOKEN_RE = /<!--[\s\S]*?(?:-->|$)|<![^<>]*>|<\?[^<>]*>|<(\/?)([a-zA-Z][a-zA-Z0-9:-]*)((?:[^>"'<]|"[^"]*"|'[^']*')*)>|[^<]+|</g;
+const SKIP_CONTENT = new Set(['head', 'script', 'style', 'title', 'noscript', 'template', 'svg', 'math', 'xml']);
+const VOID = new Set(['br', 'img', 'hr', 'meta', 'link', 'input', 'wbr', 'col', 'area', 'base', 'source', 'track', 'embed', 'param']);
+const BLOCK = new Set([
+    'p',
+    'div',
+    'td',
+    'th',
+    'tr',
+    'li',
+    'ul',
+    'ol',
+    'table',
+    'tbody',
+    'thead',
+    'tfoot',
+    'h1',
+    'h2',
+    'h3',
+    'h4',
+    'h5',
+    'h6',
+    'section',
+    'article',
+    'header',
+    'footer',
+    'main',
+    'nav',
+    'aside',
+    'blockquote',
+    'center',
+    'pre',
+    'dd',
+    'dt',
+    'dl',
+    'address',
+    'form',
+    'fieldset',
+    'figure',
+    'figcaption',
+    'hr',
+    'caption'
+]);
+const MONO_TAGS = new Set(['code', 'pre', 'tt', 'kbd', 'samp']);
+const HEADING_SIZE = { h1: 32, h2: 24, h3: 19, h4: 16, h5: 13, h6: 11 };
+// <font size="1"> to <font size="7"> in pixels, as browsers map them
+const FONT_TAG_SIZE = [0, 10, 13, 16, 18, 24, 32, 48];
+const NAMED_ENTITIES = {
+    amp: '&',
+    lt: '<',
+    gt: '>',
+    quot: '"',
+    apos: "'",
+    nbsp: ' ',
+    ensp: ' ',
+    emsp: ' ',
+    thinsp: ' ',
+    zwnj: '',
+    zwj: '',
+    shy: '',
+    copy: '©',
+    reg: '®',
+    trade: '™',
+    hellip: '…',
+    mdash: '-',
+    ndash: '-',
+    laquo: '«',
+    raquo: '»',
+    lsquo: "'",
+    rsquo: "'",
+    ldquo: '"',
+    rdquo: '"',
+    bdquo: '"',
+    bull: '•',
+    middot: '·',
+    euro: '€',
+    pound: '£',
+    yen: '¥',
+    cent: '¢',
+    sect: '§',
+    deg: '°',
+    times: '×',
+    auml: 'ä',
+    ouml: 'ö',
+    uuml: 'ü',
+    otilde: 'õ',
+    Auml: 'Ä',
+    Ouml: 'Ö',
+    Uuml: 'Ü',
+    Otilde: 'Õ',
+    scaron: 'š',
+    Scaron: 'Š',
+    zcaron: 'ž',
+    Zcaron: 'Ž',
+    szlig: 'ß',
+    aacute: 'á',
+    eacute: 'é',
+    iacute: 'í',
+    oacute: 'ó',
+    uacute: 'ú',
+    agrave: 'à',
+    egrave: 'è',
+    ecirc: 'ê',
+    ccedil: 'ç',
+    ntilde: 'ñ',
+    aring: 'å',
+    Aring: 'Å',
+    oslash: 'ø',
+    Oslash: 'Ø',
+    aelig: 'æ',
+    AElig: 'Æ'
+};
+const ENTITY_RE = /&(?:#(\d{1,7})|#[xX]([0-9a-fA-F]{1,6})|([a-zA-Z][a-zA-Z0-9]{1,31}));?/g;
+function decodeEntities(input) {
+    if (!input.includes('&')) {
+        return input;
+    }
+    return input.replace(ENTITY_RE, (match, dec, hex, name) => {
+        if (name !== undefined) {
+            return NAMED_ENTITIES[name] ?? match;
+        }
+        const code = dec !== undefined ? parseInt(dec, 10) : parseInt(hex, 16);
+        if (code === 0 || code > 0x10ffff || (code >= 0xd800 && code <= 0xdfff)) {
+            return '\ufffd';
+        }
+        return String.fromCodePoint(code);
+    });
+}
+// The attributes elementStyle reads, compiled once instead of on every tag
+const ATTR_RE = Object.fromEntries(['href', 'size', 'hidden', 'style', 'class', 'type'].map(name => [name, new RegExp(`(?:^|\\s)${name}\\s*=\\s*(?:"([^"]*)"|'([^']*)'|([^\\s"'>]+))`, 'i')]));
+function attr(attrs, name) {
+    const m = ATTR_RE[name].exec(attrs);
+    return m ? decodeEntities(m[1] ?? m[2] ?? m[3] ?? '') : undefined;
+}
+function cssLength(value, parentSize) {
+    const m = /^\s*(-?[\d.]+)\s*(px|pt|em|rem|%)?/i.exec(value);
+    if (!m) {
+        return /^\s*0\b/.test(value) ? 0 : undefined;
+    }
+    const n = parseFloat(m[1]);
+    if (!Number.isFinite(n)) {
+        return undefined;
+    }
+    switch ((m[2] || 'px').toLowerCase()) {
+        case 'pt':
+            return n * (4 / 3);
+        case 'em':
+            return n * parentSize;
+        case 'rem':
+            return n * doc_js_1.DEFAULT_FONT_SIZE;
+        case '%':
+            return (n / 100) * parentSize;
+        default:
+            return n;
+    }
+}
+const KEYWORD_SIZES = {
+    'xx-small': 9,
+    'x-small': 10,
+    small: 13,
+    medium: 16,
+    large: 18,
+    'x-large': 24,
+    'xx-large': 32,
+    'xxx-large': 48
+};
+// Applies the inline CSS declarations that change how a code would look
+function applyCss(style, css, parentSize) {
+    for (const decl of css.split(';')) {
+        const colon = decl.indexOf(':');
+        if (colon < 0) {
+            continue;
+        }
+        const prop = decl.slice(0, colon).trim().toLowerCase();
+        const value = decl
+            .slice(colon + 1)
+            .replace(/!important/i, '')
+            .trim()
+            .toLowerCase();
+        applyDeclaration(style, prop, value, parentSize);
+    }
+}
+function applyDeclaration(style, prop, value, parentSize) {
+    switch (prop) {
+        case 'font-size': {
+            const size = KEYWORD_SIZES[value] ?? cssLength(value, parentSize);
+            if (size !== undefined) {
+                style.fontSize = size;
+                style.hidden ||= size <= 1;
+            }
+            break;
+        }
+        case 'font-weight':
+            style.bold = value === 'bold' || value === 'bolder' || parseInt(value, 10) >= 600;
+            break;
+        case 'letter-spacing': {
+            const spacing = cssLength(value, parentSize);
+            style.letterSpacing = spacing !== undefined && spacing >= 1;
+            break;
+        }
+        case 'font-family':
+            style.mono ||= /mono|courier|consolas|menlo/.test(value);
+            break;
+        case 'display':
+            style.hidden ||= value === 'none';
+            break;
+        case 'visibility':
+            style.hidden ||= value === 'hidden';
+            break;
+        case 'opacity':
+            style.hidden ||= parseFloat(value) === 0;
+            break;
+        case 'max-height':
+        case 'height':
+            style.hidden ||= /^0(?:px)?$/.test(value);
+            break;
+        default:
+            break;
+    }
+}
+function elementStyle(tag, attrs, parent) {
+    const style = { ...parent };
+    if (tag === 'b' || tag === 'strong') {
+        style.bold = true;
+    }
+    else if (tag in HEADING_SIZE) {
+        style.heading = true;
+        style.bold = true;
+        style.fontSize = HEADING_SIZE[tag];
+    }
+    else if (tag === 'a' && attr(attrs, 'href')) {
+        style.link = true;
+    }
+    else if (tag === 'blockquote') {
+        style.quote = true;
+    }
+    else if (MONO_TAGS.has(tag)) {
+        style.mono = true;
+    }
+    else if (tag === 'font') {
+        const size = parseInt(attr(attrs, 'size') ?? '', 10);
+        if (size >= 1 && size <= 7) {
+            style.fontSize = FONT_TAG_SIZE[size];
+        }
+    }
+    if (attr(attrs, 'hidden') !== undefined) {
+        style.hidden = true;
+    }
+    const css = attr(attrs, 'style');
+    if (css) {
+        applyCss(style, css, parent.fontSize);
+    }
+    // Quoted reply history in the common clients
+    const cls = attr(attrs, 'class') ?? '';
+    if (/\bgmail_quote\b|\byahoo_quoted\b|\bmoz-cite-prefix\b/i.test(cls) || attr(attrs, 'type')?.toLowerCase() === 'cite') {
+        style.quote = true;
+    }
+    return style;
+}
+function renderHtml(html) {
+    const doc = new doc_js_1.DocBuilder('html');
+    const stack = [];
+    let skipUntil = null;
+    const current = () => (stack.length ? stack[stack.length - 1].style : doc_js_1.DEFAULT_STYLE);
+    TOKEN_RE.lastIndex = 0;
+    for (let m = TOKEN_RE.exec(html); m; m = TOKEN_RE.exec(html)) {
+        const token = m[0];
+        const tag = m[2]?.toLowerCase();
+        if (skipUntil) {
+            if (tag === skipUntil && m[1] === '/') {
+                skipUntil = null;
+            }
+            continue;
+        }
+        if (tag === undefined) {
+            if (token[0] !== '<' || token === '<') {
+                doc.text(decodeEntities(token), current());
+            }
+            continue;
+        }
+        if (m[1] === '/') {
+            closeTag(doc, stack, tag);
+            continue;
+        }
+        const attrs = m[3] ?? '';
+        const selfClosing = /\/\s*$/.test(attrs);
+        if (SKIP_CONTENT.has(tag) && !selfClosing) {
+            skipUntil = tag;
+            continue;
+        }
+        openTag(doc, stack, tag, attrs, selfClosing, current());
+    }
+    return doc.finish();
+}
+function openTag(doc, stack, tag, attrs, selfClosing, parent) {
+    if (tag === 'br') {
+        doc.newline();
+        return;
+    }
+    const block = BLOCK.has(tag);
+    if (VOID.has(tag) || selfClosing) {
+        if (block) {
+            doc.newline();
+        }
+        return;
+    }
+    if (block) {
+        doc.openBlock();
+    }
+    stack.push({ tag, style: elementStyle(tag, attrs, parent), block });
+}
+function closeTag(doc, stack, tag) {
+    // Close up to the matching element; a stray close tag with no match is ignored
+    let i = stack.length - 1;
+    while (i >= 0 && stack[i].tag !== tag) {
+        i--;
+    }
+    if (i < 0) {
+        return;
+    }
+    while (stack.length > i) {
+        const open = stack.pop();
+        if (open.block) {
+            doc.closeBlock();
+        }
+    }
+}

package/dist/cjs/index.d.ts

@@ -0,0 +1,36 @@
+import type { MessageInput } from './analyze.js';
+import type { Model } from './model.js';
+export type { MessageInput } from './analyze.js';
+export type { Model } from './model.js';
+export type OtpCandidate = {
+    /** The code as it should be typed */
+    code: string;
+    /** The code as printed in the message */
+    raw: string;
+    /** Probability, 0 to 1, that this is the one-time code */
+    score: number;
+    /** Which body the best occurrence was found in */
+    source: 'html' | 'text';
+};
+export type DetectOptions = {
+    /** Minimum score for a code to be returned. Defaults to the threshold the model was tuned with */
+    threshold?: number;
+    /** Use a different trained model */
+    model?: Model;
+};
+/**
+ * Every code-like token in the message with its score, best first. Meant for debugging and for
+ * callers that want to apply their own rules.
+ */
+export declare function scoreCandidates(input: MessageInput, options?: DetectOptions): OtpCandidate[];
+/**
+ * Finds the one-time code in a parsed email, or returns null. The message is not trusted: check
+ * that it is authenticated (DKIM aligned with the sender) before offering the code to a user.
+ * Codes from an `OTP-Token` header (postal-mime `message.otp`) should be preferred when present.
+ */
+export declare function detectOtp(input: MessageInput, options?: DetectOptions): OtpCandidate | null;
+declare const _default: {
+    detectOtp: typeof detectOtp;
+    scoreCandidates: typeof scoreCandidates;
+};
+export default _default;