@recursiv/sdk 0.7.70 → 0.7.71

package/dist/resources/discovery-safety.js

@@ -0,0 +1,521 @@
+// ──────────────────────────────────────────────────────────────────────────
+// What a Discover client never shows first, and masks unless the member shows
+// sensitive content: a post flagged or tagged NSFW, or one that links a porn
+// site. Open-network posts carry no NSFW flag, so for them the link is the
+// only signal. The server's promotion floor (PromotionSafetyFloor's
+// adultSiteLink, displayedText.ts and markerFold.ts) withholds such posts
+// from Discover; this is the same rule on the client, for one that slipped
+// through and for the lead of a first screen (composeFirstScreen).
+//
+// Ported from the Minds app (lib/contentVisibility, 2026-10-04) as its native
+// build reads a text: the SDK has no DOM, so a legacy HTML body is read with
+// its tags stripped and its references decoded the app's own way, never
+// through a browser's parser.
+// ──────────────────────────────────────────────────────────────────────────
+const SENSITIVE_TAGS = new Set(['nsfw', 'nude', 'nudity', 'explicit', 'porn', 'pornography', 'xxx']);
+function tagName(tag) {
+    const value = tag && typeof tag === 'object' ? tag.name ?? tag.slug : tag;
+    return String(value ?? '').replace(/^#/, '').trim().toLowerCase();
+}
+/** A tag (a `Tag`, `{ slug }` or a bare name, with or without `#`) that marks a post sensitive: exact aliases only. */
+export function isSensitiveTag(tag) {
+    return SENSITIVE_TAGS.has(tagName(tag));
+}
+/**
+ * A porn site by its address: a link whose host is named for one of the big
+ * tube, cam and subscription sites ("xhamster.com", "de.xhamster.com",
+ * "xvideos.co.uk") or sits on an adult-only top-level domain ("rule34.xxx").
+ *
+ * The address decides, not the words. Only a link counts: a scheme or "//"
+ * or "www." in front, or a bare host with a path ("onlyfans.com/someone"). A
+ * domain named in a sentence is the news ("Aylo, which owns Pornhub.com,
+ * settles with the FTC"), a missing space a typo ("motherless.Now"), a bare
+ * ".xxx" a sign-off. And only the host counts: what comes before the last "@"
+ * is a user name, and a path or a longer host that starts with a site's name
+ * ("https://pornhub.com.example.org/a") is somewhere else.
+ */
+const ADULT_SITE_NAME = /^(?:xhamster\d*|pornhub|xvideos\d*|xnxx|redtube|youporn|tube8|spankbang|eporner|youjizz|motherless|tnaflix|drtuber|porntrex|hqporner|beeg|brazzers|bangbros|realitykings|chaturbate|stripchat|bongacams|livejasmin|camsoda|myfreecams|onlyfans|fansly|manyvids|clips4sale|nhentai|hanime|rule34video)$/;
+const ADULT_TLDS = new Set(['xxx', 'porn', 'sex', 'adult']);
+/** The labels a country's registry puts between a site's own name and the country ("xvideos.co.uk"). */
+const REGISTRY_LABELS = new Set(['co', 'com', 'net', 'org']);
+/**
+ * A link as written, to the end of its address; never from inside a word, an
+ * address or an email. A scheme is read to 63 characters: unbounded, a run of
+ * scheme characters with no ":" ("a+a+a+…//") was scanned to its end from
+ * every "+".
+ */
+export const DISCOVERY_LINK_TOKEN = /(?:^|[^a-z0-9.@/_-])((?:[a-z][a-z0-9+.-]{0,63}:)?\/\/[^\s"'<>()[\]]+|www\.[^\s"'<>()[\]]+|(?:[a-z0-9-]+\.)+[a-z][a-z0-9-]*\/[^\s"'<>()[\]]*)/g;
+/** DISCOVERY_LINK_TOKEN, once: the first link in a run of a link's characters, which the token reads to the run's end. */
+const RUN_LINK = /(?:^|[^a-z0-9.@/_-])((?:[a-z][a-z0-9+.-]{0,63}:)?\/\/[^\s"'<>()[\]]+|www\.[^\s"'<>()[\]]+|(?:[a-z0-9-]+\.)+[a-z][a-z0-9-]*\/[^\s"'<>()[\]]*)/;
+const SPACE = /\s/;
+/** A character a link never holds: whitespace, a quote, an angle bracket, a bracket or a parenthesis. */
+function endsRun(char) {
+    const code = char.charCodeAt(0);
+    if (code <= 32)
+        return code === 32 || (code >= 9 && code <= 13);
+    if (code < 127)
+        return code === 34 || code === 39 || code === 40 || code === 41 || code === 60 || code === 62 || code === 91 || code === 93;
+    return SPACE.test(char);
+}
+/** A host's own character in a bare link's labels. */
+const isLabelChar = (code) => (code >= 97 && code <= 122) || (code >= 48 && code <= 57) || code === 45;
+/**
+ * Each link DISCOVERY_LINK_TOKEN finds in a text, found without trying it at
+ * every character. A link runs to the end of its run of link characters, so
+ * a run holds one at most, and every one holds "//", "www." or a bare host's
+ * "label.label/": only a run holding one of those is read, from its start.
+ * The same tokens in the same order as text.matchAll(DISCOVERY_LINK_TOKEN).
+ */
+export function discoveryLinkTokens(text) {
+    const tokens = [];
+    let runEnd = -1;
+    const read = (at) => {
+        if (at < runEnd)
+            return;
+        let start = at;
+        while (start > 0 && !endsRun(text[start - 1]))
+            start--;
+        let end = at;
+        while (end < text.length && !endsRun(text[end]))
+            end++;
+        runEnd = end;
+        const found = RUN_LINK.exec(text.slice(start, end));
+        if (found)
+            tokens.push(found[1]);
+    };
+    let slash = text.indexOf('/');
+    let www = text.indexOf('www.');
+    while (slash !== -1 || www !== -1) {
+        if (www !== -1 && (slash === -1 || www < slash)) {
+            read(www);
+            www = text.indexOf('www.', www + 4);
+            continue;
+        }
+        const at = slash;
+        slash = text.indexOf('/', at + 1);
+        if (text[at + 1] === '/')
+            read(at);
+        else {
+            let label = at - 1;
+            while (label >= 0 && isLabelChar(text.charCodeAt(label)))
+                label--;
+            if (label < at - 1 && label >= 0 && text[label] === '.')
+                read(at);
+        }
+    }
+    return tokens;
+}
+/** Cherokee capitals that print as a Latin letter (CONFUSABLES). */
+const CHEROKEE = {
+    '\u13a0': 'D', '\u13a1': 'R', '\u13a2': 'T', '\u13a5': 'i', '\u13aa': 'A', '\u13ab': 'J', '\u13ac': 'E', '\u13b3': 'W', '\u13b7': 'M',
+    '\u13bb': 'H', '\u13c0': 'G', '\u13c2': 'h', '\u13c3': 'Z', '\u13cf': 'b', '\u13d2': 'R', '\u13d4': 'W', '\u13d5': 'S', '\u13d9': 'V',
+    '\u13da': 'S', '\u13de': 'L', '\u13df': 'C', '\u13e2': 'P', '\u13e6': 'K', '\u13f4': 'B',
+};
+/**
+ * Letters that print as a Latin one and that compatibility decomposition
+ * leaves alone, read as that Latin letter: "https://pornhub.com" written with
+ * a Cyrillic "o" (U+043E) shows the reader Pornhub's address. The same map as
+ * the server's markerFold.ts CONFUSABLES, key for key. A capital reads as a
+ * capital; a lowercase letter that looks like no Latin one stays as it is.
+ */
+const CONFUSABLES = {
+    // Cyrillic.
+    '\u0430': 'a', '\u0435': 'e', '\u043e': 'o', '\u0440': 'p', '\u0441': 'c', '\u0443': 'y', '\u0445': 'x', '\u0456': 'i', '\u0455': 's', '\u0458': 'j',
+    '\u04bb': 'h', '\u051b': 'q', '\u051d': 'w', '\u04af': 'y', '\u04cf': 'l', '\u0501': 'd', '\u0461': 'w',
+    '\u0410': 'A', '\u0415': 'E', '\u041e': 'O', '\u0420': 'P', '\u0421': 'C', '\u0423': 'Y', '\u0425': 'X', '\u0406': 'I', '\u0405': 'S', '\u0408': 'J',
+    '\u041d': 'H', '\u041a': 'K', '\u041c': 'M', '\u0422': 'T', '\u0412': 'B', '\u04ae': 'Y', '\u04c0': 'I', '\u051a': 'Q', '\u051c': 'W',
+    // Greek.
+    '\u03b1': 'a', '\u03b5': 'e', '\u03bf': 'o', '\u03c1': 'p', '\u03b9': 'i', '\u03ba': 'k', '\u03bd': 'v', '\u03c4': 't', '\u03c5': 'u', '\u03c7': 'x',
+    '\u03f3': 'j',
+    '\u0391': 'A', '\u0392': 'B', '\u0395': 'E', '\u0396': 'Z', '\u0397': 'H', '\u0399': 'I', '\u039a': 'K', '\u039c': 'M', '\u039d': 'N', '\u039f': 'O',
+    '\u03a1': 'P', '\u03a4': 'T', '\u03a5': 'Y', '\u03a7': 'X',
+    // Armenian.
+    '\u0561': 'w', '\u0566': 'q', '\u0570': 'h', '\u0578': 'n', '\u057d': 'u', '\u0581': 'g', '\u0585': 'o', '\u053c': 'L', '\u054d': 'U', '\u0555': 'O',
+    // Latin letters past ASCII: dotless i and j, alpha, script g, iota, kra.
+    '\u0131': 'i', '\u0237': 'j', '\u0251': 'a', '\u0261': 'g', '\u0269': 'i', '\u0138': 'k',
+    // Latin small capitals: read lowercase.
+    '\u1d00': 'a', '\u0299': 'b', '\u1d04': 'c', '\u1d05': 'd', '\u1d07': 'e', '\ua730': 'f', '\u0262': 'g', '\u029c': 'h', '\u026a': 'i', '\u1d0a': 'j',
+    '\u1d0b': 'k', '\u029f': 'l', '\u1d0d': 'm', '\u0274': 'n', '\u1d0f': 'o', '\u1d18': 'p', '\ua7af': 'q', '\u0280': 'r', '\ua731': 's', '\u1d1b': 't',
+    '\u1d1c': 'u', '\u1d20': 'v', '\u1d21': 'w', '\u028f': 'y', '\u1d22': 'z',
+    // Cherokee: each capital, and its small letter as the lowercase letter.
+    ...CHEROKEE,
+    ...Object.fromEntries(Object.entries(CHEROKEE).map(([letter, latin]) => [letter.toLowerCase(), latin.toLowerCase()])),
+};
+/** Every character past ASCII, as a plain range: each CONFUSABLES key is in it, and every other character is kept as it is. */
+const PAST_ASCII = /[\u0080-\uffff]/g;
+const HAS_PAST_ASCII = /[\u0080-\uffff]/;
+/**
+ * What prints as nothing, or only decorates the letter before it, which IDNA
+ * drops from a host: nonspacing and enclosing marks, format characters, the
+ * Hangul fillers and the reserved default-ignorables. The same class as the
+ * server's markerFold.ts.
+ */
+const PRINTS_AS_NOTHING = /[\p{Mn}\p{Me}\p{Cf}\u115f\u1160\u2065\u3164\uffa0\ufff0-\ufff8\u{E0000}-\u{E0FFF}]/gu;
+/**
+ * The text as a browser reads an address in it, through the same fold as the
+ * server's promotion floor: compatibility-decomposed, what prints as nothing
+ * gone, look-alike letters read as Latin, then lowercased.
+ */
+function readAsAddress(text) {
+    if (!HAS_PAST_ASCII.test(text))
+        return text.toLowerCase();
+    return text.normalize('NFKD').replace(PRINTS_AS_NOTHING, '').replace(PAST_ASCII, char => CONFUSABLES[char] ?? char).toLowerCase();
+}
+/** An ideographic, fullwidth or halfwidth full stop between two of a host's characters is the dot IDNA maps it to. */
+const HOST_DOT = /(?<=[a-z0-9])[\u3002\uff0e\uff61](?=[a-z0-9])/g;
+/** A percent escape, which a browser decodes in a host ("porn%68ub.com"). */
+const ESCAPE = /%([0-9a-f]{2})/gi;
+/** What carries a label on past its ASCII: the host is then an IDN, not the site ("https://www.sexólogo.es"). */
+const LABEL_GOES_ON = /^[\p{L}\p{M}\p{N}%]/u;
+/** A host's own characters, from the start; a dot only where no second dot follows it (an ellipsis ends the host). */
+const HOST = /^(?:[a-z0-9_-]|\.(?!\.))*/;
+/**
+ * A link's host: after the scheme and any user name, escapes of a host's own
+ * characters decoded, up to the first character a host cannot hold, with the
+ * dots, hyphens and underscores a host never ends on cut. A label that goes
+ * on in another script is no host of ours: "". The server's linkHost is the same rule.
+ */
+function linkHost(link) {
+    const authority = link.replace(/^(?:[a-z][a-z0-9+.-]*:)?\/\//, '').split(/[/?#\\]/, 1)[0] ?? '';
+    const named = authority.slice(authority.lastIndexOf('@') + 1).replace(ESCAPE, (encoded, hex) => {
+        const char = String.fromCharCode(Number.parseInt(hex, 16)).toLowerCase();
+        return /^[a-z0-9._-]$/.test(char) ? char : encoded;
+    });
+    const host = HOST.exec(named)?.[0] ?? '';
+    if (LABEL_GOES_ON.test(named.slice(host.length)))
+        return '';
+    return host.replace(/[._-]+$/, '');
+}
+/**
+ * A porn site's host: its own name is one, or it sits on an adult-only
+ * top-level domain, except that TLD's registry's own "www.<tld>" (ICANN
+ * reserves it; no porn site has that address).
+ */
+function adultHost(host) {
+    const labels = host.split('.');
+    if (labels.length < 2 || labels.some(label => !/^[a-z0-9_-]+$/.test(label)))
+        return false;
+    const tld = labels[labels.length - 1];
+    if (ADULT_TLDS.has(tld))
+        return labels.length > 2 || labels[0] !== 'www';
+    const name = labels.length > 2 && tld.length === 2 && REGISTRY_LABELS.has(labels[labels.length - 2]) ? labels[labels.length - 3] : labels[labels.length - 2];
+    return ADULT_SITE_NAME.test(name);
+}
+/** Passes of decoding: ActivityPub text is decoded twice (the server, then the app). The server's DISPLAY_DECODE_PASSES is the same bound. */
+const DISPLAY_DECODE_PASSES = 4;
+const NAMED_REFERENCES = { amp: '&', apos: "'", gt: '>', lt: '<', nbsp: ' ', quot: '"' };
+/** One layer of character references, as the Minds app decodes a text before showing it: numbers and six names. */
+function decodeReferencesOnce(text) {
+    if (!text)
+        return '';
+    return text.replace(/&(#x[\da-f]+|#\d+|amp|apos|gt|lt|nbsp|quot);/gi, (match, entity) => {
+        if (entity[0] !== '#')
+            return NAMED_REFERENCES[entity.toLowerCase()] ?? match;
+        const hex = entity[1]?.toLowerCase() === 'x';
+        const codePoint = Number.parseInt(entity.slice(hex ? 2 : 1), hex ? 16 : 10);
+        if (!Number.isFinite(codePoint) || codePoint < 0 || codePoint > 0x10ffff)
+            return match;
+        try {
+            const decoded = String.fromCodePoint(codePoint);
+            return decoded === '\u00a0' ? ' ' : decoded;
+        }
+        catch {
+            return match;
+        }
+    });
+}
+/** The text after each pass of decoding, to its fixed point and within DISPLAY_DECODE_PASSES: every reading a surface shows. */
+function decodedReadings(text) {
+    const readings = [];
+    let decoded = text;
+    for (let pass = 0; pass < DISPLAY_DECODE_PASSES && decoded.includes('&'); pass++) {
+        const next = decodeReferencesOnce(decoded);
+        if (next === decoded)
+            break;
+        readings.push(next);
+        decoded = next;
+    }
+    return readings;
+}
+/** A legacy blog body's markup: the first tag start decides, with any ">" after it. */
+const LEGACY_HTML_TAG_START = /<\/?(p|div|a|img|br|h[1-6]|ul|ol|li|blockquote|strong|em|b|i|u|s|span|figure|figcaption|pre|code|hr)\b/i;
+function looksLikeLegacyHtml(text) {
+    if (!text)
+        return false;
+    const start = LEGACY_HTML_TAG_START.exec(text);
+    return !!start && text.indexOf('>', start.index) !== -1;
+}
+/** HTML with its tags stripped, a line break at each block's end, and its character references left as written. */
+function stripHtmlTags(html) {
+    if (!html)
+        return '';
+    // Every tag the passes below remove ends at a ">", so they read the text up to its last ">" only.
+    const closed = html.lastIndexOf('>') + 1;
+    const open = html.slice(closed);
+    let out = html.slice(0, closed).replace(/<(br|\/p|\/div|\/li|\/h[1-6]|\/blockquote)[^>]*>/gi, '\n').replace(/<li\b[^>]*>/gi, '\u2022 ');
+    // To a fixed point: one pass lets "<scr<script>ipt>" form a tag again from the residue.
+    let prev;
+    do {
+        prev = out;
+        out = out.replace(/<[^>]*>/g, '');
+    } while (out !== prev);
+    return (out + open).replace(/<[a-z/][^<]*$/gi, '');
+}
+/** Where markup and markdown put a link's target, which a browser opens through its URL parser rather than as the text reads. */
+const ATTRIBUTE_TARGET = /\b(?:href|src)[\t\n\f\r ]*=[\t\n\f\r ]*(?:"([^"]*)|'([^']*)|([^\t\n\f\r "'<>`=]+))/g;
+/** An autolink to a site: openedAddress reads no other scheme. */
+const AUTOLINK_START = /<(?:https?|wss?|ftp|file):/;
+const MARKDOWN_TARGET = /\]\([\t\n\f\r ]*(?:<([^>)]*)|([^)]*))|^ {0,3}\[[^\]\n]+\]:[\t ]*<?([^\s>]+)|<([a-z][a-z0-9+.-]*:[^\s<>]*)>/gm;
+/** Each link target in a text, as written. `text`: read as an address. */
+function linkTargets(text) {
+    const targets = [];
+    if (text.includes('href') || text.includes('src'))
+        for (const match of text.matchAll(ATTRIBUTE_TARGET))
+            targets.push(match[1] ?? match[2] ?? match[3] ?? '');
+    if (text.includes('](') || text.includes(']:') || (text.includes('<') && AUTOLINK_START.test(text))) {
+        for (const match of text.matchAll(MARKDOWN_TARGET))
+            targets.push(match[1] ?? match[2] ?? match[3] ?? match[4] ?? '');
+    }
+    return targets;
+}
+/** The URL parser's special schemes (WHATWG URL): after one, any run of slashes, "/" or "\", leads to the host. */
+const SPECIAL_SCHEME = /^(?:https?|wss?|ftp|file):$/;
+/**
+ * The address a browser opens for a link's target, read as its URL parser
+ * reads one: the controls and spaces around it stripped, every tab and
+ * newline in it removed, and after a special scheme any run of slashes of
+ * either kind skipped. Null when it opens no other site.
+ */
+function openedAddress(target) {
+    let start = 0;
+    let end = target.length;
+    while (start < end && target.charCodeAt(start) <= 0x20)
+        start++;
+    while (end > start && target.charCodeAt(end - 1) <= 0x20)
+        end--;
+    const url = target.slice(start, end).replace(/[\t\n\r]/g, '');
+    const scheme = /^[a-z][a-z0-9+.-]*:/.exec(url)?.[0];
+    if (scheme ? !SPECIAL_SCHEME.test(scheme) : !/^[/\\]{2}/.test(url))
+        return null;
+    return `${scheme ?? 'https:'}//${url.slice(scheme?.length ?? 0).replace(/^[/\\]+/, '')}`;
+}
+/** An escape or a letter past ASCII in an address, which the URL parser decodes and maps before it reads the host. */
+const PARSER_READS_MORE = /[%\u0080-\uffff]/;
+/** The hosts an opened address names: as linkHost reads it and, where it may read more, as the runtime's URL parser does. */
+function openedHosts(address) {
+    const hosts = [linkHost(address)];
+    if (!PARSER_READS_MORE.test(address))
+        return hosts;
+    try {
+        const host = new URL(address).hostname.replace(/\.+$/, '');
+        if (!/(?:^|\.)xn--/.test(host))
+            hosts.push(host);
+    }
+    catch {
+        // Not an address the parser reads: linkHost's reading stands.
+    }
+    return hosts;
+}
+/** A target the URL parser reads as the text reads it: the link token has read it already, to the same host. */
+const PLAIN_TARGET = /^[a-z][a-z0-9+.-]*:\/\/[^\s\\%\u0080-\uffff]*$/;
+/** A link's authority with a user name in it, which may hold what ends a link as the text reads it ("(", "'", "["). */
+const USERINFO_LINK = /[/\\]{2}[^\s/\\?#@]*@[^\s/\\?#]*/g;
+/** A link or a link's target opens a porn site, read as a browser opens it. */
+function opensAdultSite(target) {
+    const address = openedAddress(target);
+    return address !== null && openedHosts(address).some(adultHost);
+}
+/** The reading (already read as an address) links a porn site: a link in its text, or a link target in its markup or markdown. */
+function readingLinksAdultSite(address) {
+    const text = address.replace(HOST_DOT, '.');
+    for (const link of discoveryLinkTokens(text)) {
+        if (adultHost(linkHost(link)) || (PARSER_READS_MORE.test(link) && opensAdultSite(link)))
+            return true;
+    }
+    for (const target of linkTargets(text))
+        if (!PLAIN_TARGET.test(target) && opensAdultSite(target))
+            return true;
+    if (text.includes('@'))
+        for (const match of text.matchAll(USERINFO_LINK))
+            if (opensAdultSite(match[0]))
+                return true;
+    return false;
+}
+/** How much of a text is rendered and decoded: four times the 5,000 characters a post may hold. The stored text is still read whole. */
+const DISPLAY_SCAN_CHARS = 20_000;
+/** Where decoding can change a text: "&" before "#" or a letter. */
+const REFERENCE_START = /&[#a-zA-Z]/;
+/**
+ * The start of each reference a reading can change a link at. The others
+ * decode, in every reading, to a character with no part in a link (an
+ * "&amp;" before no second reference, dashes, quotes, an ellipsis, a no-break
+ * space, currency), so a host ends at it as it ends at the stored "&".
+ */
+const CHANGING_REFERENCE = /(?<!=[\t\n\f\r ]*)&(?!amp;(?!#|(?:[aA][mM][pP]|[aA][pP][oO][sS]|[gG][tT]|[lL][tT]|[nN][bB][sS][pP]|[qQ][uU][oO][tT]);)|(?:quot|apos|#39|#34|mdash|ndash|hellip|rsquo|lsquo|rdquo|ldquo|nbsp|copy|reg|pound|euro|laquo|raquo|bull|middot|deg|#8211|#8212|#8216|#8217|#8220|#8221|#8230|#160|#169|#174);)[#a-zA-Z]|(?<==[\t\n\f\r ]*)&[#a-zA-Z]/g;
+/** A run of tags with no whitespace either side, which stripping a legacy body joins into one word unless it is a break. */
+const GLUED_TAG_RUN = /(?<=[^\s>])(?:<[^<>]*>)+(?=[^\s<])/g;
+/** A tag stripping turns into a line break or a bullet: the words either side stay apart. */
+const SPLITTING_TAG = /<(?:br|\/p|\/div|\/li|\/h[1-6]|\/blockquote|li\b)/i;
+/** What a link needs somewhere in its word: a slash, a backslash, a scheme's colon, or a dot between two of a host's characters. */
+const HOST_SHAPED = /[/\\]|[a-z0-9]:[a-z0-9]|[a-z0-9_-][.\u3002][a-z0-9]/i;
+/** A tag with no attributes: its slash is no link's, and it holds no href or src. */
+const BARE_TAG = /<\/?[a-z][a-z0-9]*\s*\/?>/gi;
+const WHITESPACE = /\s/;
+function isSpace(char) {
+    const code = char.charCodeAt(0);
+    return code === 32 || (code >= 9 && code <= 13) || (code > 127 && WHITESPACE.test(char));
+}
+/** Words kept on each side of a change, so a markdown label or an attribute's name comes with its target. */
+const CONTEXT_WORDS = 2;
+/** Between two windows: what ends a line, a quoted value, a destination or an autolink, so no link runs from one window into the next. */
+const WINDOW_BREAK = '\n)"\'>\n';
+function wordStart(text, at, back) {
+    let i = at;
+    while (i > 0 && !isSpace(text[i - 1]))
+        i--;
+    for (let word = 0; word < back && i > 0; word++) {
+        while (i > 0 && isSpace(text[i - 1]))
+            i--;
+        while (i > 0 && !isSpace(text[i - 1]))
+            i--;
+    }
+    return i;
+}
+function wordEnd(text, at, ahead) {
+    let i = at;
+    while (i < text.length && !isSpace(text[i]))
+        i++;
+    for (let word = 0; word < ahead && i < text.length; word++) {
+        while (i < text.length && isSpace(text[i]))
+            i++;
+        while (i < text.length && !isSpace(text[i]))
+            i++;
+    }
+    return i;
+}
+/** The words mayHoldHost has read last, and its answer for each. */
+const HOST_WORDS = new Map();
+const HOST_WORDS_KEPT = 2048;
+/** A word, as written or in some reading of it, could hold a host. Words repeat ("&amp;", "can&#39;t"), so each answer is kept. */
+function mayHoldHost(word, legacy) {
+    const own = legacy && word.includes('<') ? word.replace(BARE_TAG, ' ') : word;
+    if (HOST_SHAPED.test(own))
+        return true;
+    const key = legacy ? `\u0000legacy ${own}` : own;
+    const known = HOST_WORDS.get(key);
+    if (known !== undefined)
+        return known;
+    const holds = decodedReadings(own).some(reading => HOST_SHAPED.test(HAS_PAST_ASCII.test(reading) ? readAsAddress(reading) : reading));
+    if (HOST_WORDS.size >= HOST_WORDS_KEPT)
+        HOST_WORDS.delete(HOST_WORDS.keys().next().value);
+    HOST_WORDS.set(key, holds);
+    return holds;
+}
+/**
+ * The parts of a text where a reading can differ from the stored text, each
+ * with CONTEXT_WORDS words either side, joined by WINDOW_BREAK: every word
+ * with a character reference that reads as part of a host once decoded, and,
+ * in a legacy HTML body, every run of tags that stripping joins into one word.
+ * Empty when no reading can differ.
+ */
+function changedWindows(head, legacy) {
+    const spans = [];
+    let readTo = -1;
+    CHANGING_REFERENCE.lastIndex = 0;
+    for (let match = CHANGING_REFERENCE.exec(head); match; match = CHANGING_REFERENCE.exec(head)) {
+        const at = match.index;
+        if (at < readTo)
+            continue;
+        const start = wordStart(head, at, 0);
+        const end = wordEnd(head, at, 0);
+        readTo = end;
+        if (!mayHoldHost(head.slice(start, end), legacy))
+            continue;
+        spans.push([wordStart(head, at, CONTEXT_WORDS), wordEnd(head, at, CONTEXT_WORDS)]);
+    }
+    if (legacy) {
+        let spannedTo = -1;
+        GLUED_TAG_RUN.lastIndex = 0;
+        for (let match = GLUED_TAG_RUN.exec(head); match; match = GLUED_TAG_RUN.exec(head)) {
+            const from = match.index;
+            const to = from + match[0].length;
+            if (from < spannedTo || SPLITTING_TAG.test(match[0]))
+                continue;
+            spannedTo = wordEnd(head, to, CONTEXT_WORDS);
+            spans.push([wordStart(head, from - 1, CONTEXT_WORDS), spannedTo]);
+        }
+    }
+    if (!spans.length)
+        return '';
+    spans.sort((a, b) => a[0] - b[0]);
+    const windows = [];
+    let [from, to] = spans[0];
+    for (const [start, end] of spans.slice(1)) {
+        if (start <= to)
+            to = Math.max(to, end);
+        else {
+            windows.push(head.slice(from, to));
+            [from, to] = [start, end];
+        }
+    }
+    windows.push(head.slice(from, to));
+    return windows.join(WINDOW_BREAK);
+}
+/**
+ * The readings a member can see besides the stored text, read on the parts of
+ * its first DISPLAY_SCAN_CHARS where they differ from it: each pass of
+ * decoding, and for a legacy HTML body its tags stripped and each pass of
+ * decoding that, as the Minds app's native build shows it.
+ */
+function derivedReadings(text) {
+    const head = text.length > DISPLAY_SCAN_CHARS ? text.slice(0, DISPLAY_SCAN_CHARS) : text;
+    const legacy = text.includes('<') && looksLikeLegacyHtml(text);
+    if (!legacy && !REFERENCE_START.test(head))
+        return [];
+    const windows = changedWindows(head, legacy);
+    if (!windows)
+        return [];
+    const readings = decodedReadings(windows);
+    if (legacy) {
+        const stripped = stripHtmlTags(windows);
+        readings.push(stripped, ...decodedReadings(stripped));
+    }
+    return readings;
+}
+/**
+ * The text links a porn site, as stored or as a member sees it: a link in it
+ * (read through look-alike letters, hidden characters, IDNA dots and escapes),
+ * a link target in its markup or markdown as a browser opens it, or either
+ * once its character references are decoded or a legacy body's tags stripped.
+ */
+export function linksAdultSite(text) {
+    if (typeof text !== 'string' || !text)
+        return false;
+    return readingLinksAdultSite(readAsAddress(text)) || derivedReadings(text).some(reading => readingLinksAdultSite(readAsAddress(reading)));
+}
+/** Each post read last, with the body and title read and whether either links a porn site: a post whose text is the same is not read again. */
+const POST_LINKS = new WeakMap();
+function postLinksAdultSite(post) {
+    const kept = POST_LINKS.get(post);
+    if (kept && kept.content === post.content && kept.title === post.title)
+        return kept.links;
+    const links = linksAdultSite(post.content) || linksAdultSite(post.title);
+    POST_LINKS.set(post, { content: post.content, title: post.title, links });
+    return links;
+}
+/**
+ * A Minds post to mask unless the member shows sensitive content: flagged NSFW
+ * (`is_nsfw` or `isNsfw`), tagged so, or linking a porn site in its content or
+ * title. Live on 2026-09-27 a visitor's Discover All showed "I think she likes
+ * it. https://xhamster.com/videos/…" with the video's explicit thumbnail as its
+ * picture: its author never flagged it.
+ */
+export function isSensitivePost(post) {
+    if (!post || typeof post !== 'object')
+        return false;
+    const value = post;
+    return value.is_nsfw === true
+        || value.isNsfw === true
+        || (Array.isArray(value.tags) && value.tags.some(isSensitiveTag))
+        || postLinksAdultSite(value);
+}