@sdxc/spam 0.0.0-pre.1

package/dist/check.d.ts

@@ -0,0 +1,116 @@
+/**
+ * The contract every spam check implements, local rule or remote provider alike: a check reads
+ * a submission and answers weighted signals, so the filter can add evidence from any source and
+ * explain a verdict by the signals behind it.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+import type { Result } from "@sdxc/result";
+/**
+ * One piece of user-generated content and what is known about who sent it. Only `content` is
+ * required; every other field enables more checks, and a check whose input is absent adds nothing.
+ */
+export interface Submission {
+    content: string;
+    /**
+     * How `content` is written. In `text`, Markdown and HTML link syntax count as a signal, since
+     * a plain-text field renders them literally and only a bot pastes them there.
+     *
+     * @default "text"
+     */
+    format?: "text" | "markdown" | "html";
+    author?: Submission.Author;
+    /** When the form was rendered, from a source the visitor cannot forge, such as a signed field. */
+    renderedAt?: Date;
+    /** @default the time of the check */
+    submittedAt?: Date;
+    /** The languages the site expects, as BCP 47 tags such as `en` or `pt-BR`. */
+    languages?: string[];
+}
+/** The types describing a {@link Submission}. */
+export declare namespace Submission {
+    /** What the form or the session knows about the submission's author. */
+    interface Author {
+        name?: string;
+        email?: string;
+        /** The website the author entered, as a comment form's "website" field collects it. */
+        url?: string;
+        ip?: string;
+        userAgent?: string;
+    }
+}
+/** Whether a submission is spam, as a moderator decided it or a filter scored it. */
+export type Label = "spam" | "ham";
+/**
+ * One piece of evidence. Positive scores point to spam and negative ones to ham, so a provider
+ * vouching for a known author can pull a submission back below a threshold.
+ */
+export interface Signal {
+    /** A stable identifier, the check's name and the finding, such as `links.count`. */
+    check: string;
+    score: number;
+    /** What was found, written for a moderator reading why a submission was held. */
+    detail?: string;
+}
+/**
+ * A source of signals. The filter runs `local` checks first, in order and without a timeout, so a
+ * local check reads only the app's own data; `remote` checks run in parallel under a timeout, and
+ * `escalation` checks only for a submission still in the unsure band.
+ */
+export interface SpamCheck {
+    /** Identifies the check in a failure report; signals carry their own `check` identifier. */
+    readonly name: string;
+    readonly stage: SpamCheck.Stage;
+    /**
+     * Scores one submission, answering signals directly or, when it reads storage or a network, a
+     * `Result` whose failure means no evidence either way, never a verdict.
+     *
+     * @param submission - The submission to score
+     * @param options - The abort signal bounding the call and the score earlier stages reached
+     */
+    check(submission: Submission, options: SpamCheck.Options): Signal[] | Promise<Result<Signal[], SpamCheckError>>;
+    /**
+     * Learns from a moderator's decision, for checks that train on them or forward them to a
+     * provider. A check without it ignores reports.
+     *
+     * @param submission - The submission as it was checked
+     * @param label - What the moderator decided it is
+     */
+    report?(submission: Submission, label: Label): Promise<Result<void, SpamCheckError>>;
+}
+/** The types shared by every {@link SpamCheck}. */
+export declare namespace SpamCheck {
+    /** When a check runs; see {@link SpamCheck}. */
+    type Stage = "local" | "remote" | "escalation";
+    /** What the filter passes to every call. */
+    interface Options {
+        /** Aborts when the check's timeout elapses; a remote check passes it to `fetch`. */
+        signal: AbortSignal;
+        /** The total of every signal from earlier stages. */
+        score: number;
+        /** The signals earlier stages produced, so an escalation check can weigh the evidence. */
+        signals: readonly Signal[];
+    }
+    /**
+     * Why a check produced no evidence. `unavailable` is the provider failing, `timeout` is the
+     * filter's deadline passing, `misconfigured` is a key or option the provider refused, and
+     * `invalid-response` is an answer in a shape the check cannot read.
+     */
+    type ErrorCode = "unavailable" | "timeout" | "misconfigured" | "invalid-response";
+}
+/**
+ * A check that produced no evidence. `code` is what to branch on and log; the message carries
+ * the provider's own detail.
+ *
+ * @example if (error.code === "misconfigured") log.error("spam.misconfigured", { message: error.message });
+ */
+export declare class SpamCheckError extends Error {
+    name: string;
+    readonly code: SpamCheck.ErrorCode;
+    /**
+     * @param code - The reason, the value to branch on
+     * @param message - The provider's detail, for logs
+     */
+    constructor(code: SpamCheck.ErrorCode, message?: string);
+}

package/dist/check.js

@@ -0,0 +1,20 @@
+/**
+ * A check that produced no evidence. `code` is what to branch on and log; the message carries
+ * the provider's own detail.
+ *
+ * @example if (error.code === "misconfigured") log.error("spam.misconfigured", { message: error.message });
+ */
+export class SpamCheckError extends Error {
+    name = "SpamCheckError";
+    code;
+    /**
+     * @param code - The reason, the value to branch on
+     * @param message - The provider's detail, for logs
+     */
+    constructor(code, message) {
+        super(message === undefined
+            ? `Spam check failed: ${code}`
+            : `Spam check failed: ${code} (${message})`);
+        this.code = code;
+    }
+}

package/dist/corpus.fixtures.d.ts

@@ -0,0 +1,20 @@
+/**
+ * A hand-written, labelled corpus of submissions: the acceptance criterion the default rules are
+ * tuned against. Every entry is invented, so no real submission or personal data ships here; the
+ * hard ham cases are the ones a careless rule would hold.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+import type { Submission } from "./check.js";
+import type { SpamFilter } from "./filter.js";
+/** One labelled submission, with the verdict the default rules must reach and why. */
+export interface CorpusEntry {
+    name: string;
+    expected: SpamFilter.Verdict;
+    submission: Submission;
+}
+/** Real people writing, including every shape a careless rule would mistake for spam. */
+export declare const HAM: CorpusEntry[];
+/** Spam as it arrives, from the crude to the careful. */
+export declare const SPAM: CorpusEntry[];

package/dist/corpus.fixtures.js

@@ -0,0 +1,233 @@
+/** The moment every timed submission is rendered at. */
+const RENDERED_AT = new Date("2026-09-28T12:00:00Z");
+/** A submission sent `seconds` after {@link RENDERED_AT}. */
+function after(seconds) {
+    return {
+        renderedAt: RENDERED_AT,
+        submittedAt: new Date(RENDERED_AT.getTime() + seconds * 1000),
+    };
+}
+/** Real people writing, including every shape a careless rule would mistake for spam. */
+export const HAM = [
+    {
+        name: "a short thank-you",
+        expected: "ham",
+        submission: { content: "Thanks, this was exactly what I needed!", ...after(40) },
+    },
+    {
+        name: "a reply with one reference link",
+        expected: "ham",
+        submission: {
+            content: "I hit the same problem last week. The fix is described in the MDN article on AbortSignal: https://developer.mozilla.org/en-US/docs/Web/API/AbortSignal/timeout_static",
+            ...after(120),
+        },
+    },
+    {
+        name: "a Markdown comment with two links in a Markdown field",
+        expected: "ham",
+        submission: {
+            format: "markdown",
+            content: "Nice write-up. For anyone comparing, [the spec](https://www.w3.org/TR/webmention/) and [this test suite](https://webmention.rocks/) helped me more than any tutorial.",
+            ...after(95),
+        },
+    },
+    {
+        name: "an excited comment with exclamation marks and an emoji",
+        expected: "ham",
+        submission: {
+            content: "This is AMAZING!!! Finally someone explains it properly 🎉",
+            ...after(30),
+        },
+    },
+    {
+        name: "a support request with a phone number",
+        expected: "ham",
+        submission: {
+            content: "Hi, my order hasn't arrived and the tracking page shows nothing. You can reach me at +1 415 555 0134 during business hours. Order number 48213.",
+            author: { name: "Dana Whitfield", email: "dana@example.com" },
+            ...after(180),
+        },
+    },
+    {
+        name: "a question with a code sample",
+        expected: "ham",
+        submission: {
+            format: "markdown",
+            content: "Does this still work if the handler is async?\n\n```ts\nlet response = await fetch(url, { signal: AbortSignal.timeout(5000) });\n```",
+            ...after(75),
+        },
+    },
+    {
+        name: "a Spanish comment on a site expecting Spanish",
+        expected: "ham",
+        submission: {
+            content: "Muy buen artículo, me ayudó a entender cómo funcionan los Durable Objects.",
+            languages: ["es", "en"],
+            ...after(60),
+        },
+    },
+    {
+        name: "a Russian comment on a site expecting Russian",
+        expected: "ham",
+        submission: {
+            content: "Спасибо за статью, очень понятно объяснено, как работает кэширование.",
+            languages: ["ru"],
+            ...after(50),
+        },
+    },
+    {
+        name: "a Japanese comment on a site expecting Japanese",
+        expected: "ham",
+        submission: {
+            content: "とても分かりやすい記事でした。ありがとうございます。",
+            languages: ["ja"],
+            ...after(45),
+        },
+    },
+    {
+        name: "a comment whose author entered a personal website",
+        expected: "ham",
+        submission: {
+            content: "I wrote a follow-up on this with benchmarks, happy to hear what you think.",
+            author: { name: "Priya N.", url: "https://priya.example.dev" },
+            ...after(90),
+        },
+    },
+    {
+        name: "a long, thoughtful comment",
+        expected: "ham",
+        submission: {
+            content: "I disagree with the second point. Caching at the edge is great until you need per-user data, and then every cache key has to include the session, which kills the hit rate. What worked for us was splitting the page into a cached shell and a small personalized fragment fetched after load. It is more moving parts, but the shell is served from cache 98% of the time.",
+            ...after(400),
+        },
+    },
+    {
+        name: "a comment mentioning an Ethereum concept without a wallet",
+        expected: "ham",
+        submission: {
+            content: "How does this compare to storing hashes on Ethereum? Genuinely curious about the trade-offs.",
+            ...after(70),
+        },
+    },
+    {
+        name: "a comment typed in all caps by a short word",
+        expected: "ham",
+        submission: { content: "OK, THANKS", ...after(20) },
+    },
+    {
+        name: "a submission with no timing or author data",
+        expected: "ham",
+        submission: { content: "Could you add an RSS feed for the tutorials section?" },
+    },
+];
+/** Spam as it arrives, from the crude to the careful. */
+export const SPAM = [
+    {
+        name: "a link dump",
+        expected: "spam",
+        submission: {
+            content: "cheap watches https://watches.example/a https://watches.example/b https://watches.example/c https://watches.example/d https://watches.example/e",
+            ...after(30),
+        },
+    },
+    {
+        name: "BBCode links in a plain-text field",
+        expected: "spam",
+        submission: {
+            content: "Nice site! [url=https://pills.example]buy pills online[/url] [url=https://pills.example/2]discount[/url]",
+            ...after(30),
+        },
+    },
+    {
+        name: "HTML links pasted into a plain-text field",
+        expected: "spam",
+        submission: {
+            content: 'Very informative. <a href="https://loans.example">fast loans</a> and <a href="https://loans.example/b">no credit check</a>',
+            ...after(25),
+        },
+    },
+    {
+        name: "a submission sent a second after the form rendered",
+        expected: "unsure",
+        submission: { content: "Great article, thanks for writing it.", ...after(1) },
+    },
+    {
+        name: "a crypto recovery scam with messaging handles",
+        expected: "spam",
+        submission: {
+            content: "Lost your crypto? Our team recovers stolen funds in 24 hours. Contact us on Telegram @recover_fast_team or WhatsApp +44 7700 900123. Send a small fee to 0x52908400098527886E0F7030069857D2E4169EE7 to start.",
+            ...after(20),
+        },
+    },
+    {
+        name: "shortened links behind a vague compliment",
+        expected: "spam",
+        submission: {
+            content: "Wow what a post, check this out https://bit.ly/3xYz12a and https://tinyurl.com/deal-now",
+            ...after(15),
+        },
+    },
+    {
+        name: "a link to a raw IP address",
+        expected: "unsure",
+        submission: {
+            content: "Download the full version here: http://203.0.113.45/setup.exe",
+            ...after(30),
+        },
+    },
+    {
+        name: "Cyrillic homoglyphs disguising a brand",
+        expected: "unsure",
+        submission: {
+            content: "Your Pаypаl account is on hold, verify now at the link in our profile.",
+            ...after(30),
+        },
+    },
+    {
+        name: "mathematical letters dodging keyword filters",
+        expected: "unsure",
+        submission: { content: "𝗙𝗥𝗘𝗘 𝗙𝗢𝗟𝗟𝗢𝗪𝗘𝗥𝗦 𝗡𝗢𝗪 click the link in bio", ...after(30) },
+    },
+    {
+        name: "zero-width characters splitting keywords",
+        expected: "unsure",
+        submission: { content: "Get c​h​e​a​p v​i​a​g​r​a today", ...after(30) },
+    },
+    {
+        name: "shouting and repetition",
+        expected: "unsure",
+        submission: {
+            content: "BEST PRICES GUARANTEED BEST PRICES GUARANTEED BEST PRICES GUARANTEED ORDER TODAY!!!!!!!! $$$$$$$$",
+            ...after(30),
+        },
+    },
+    {
+        name: "Russian SEO spam on an English-only site",
+        expected: "unsure",
+        submission: {
+            content: "Продвижение сайтов в топ поисковых систем недорого, пишите нам сегодня.",
+            languages: ["en"],
+            ...after(30),
+        },
+    },
+    {
+        name: "an author name stuffed with keywords and a URL",
+        expected: "spam",
+        submission: {
+            content: "Great content, keep it up. Visit us for the best deals https://casino.example",
+            author: {
+                name: "Best Online Casino Bonus 2026 casino.example",
+                url: "https://bit.ly/casino-bonus",
+            },
+            ...after(10),
+        },
+    },
+    {
+        name: "a fast link dump with emoji",
+        expected: "spam",
+        submission: {
+            content: "🔥🔥🔥💰💰💰🚀🚀🚀✅ earn money https://earn.example/1 https://earn.example/2 https://earn.example/3",
+            ...after(2),
+        },
+    },
+];

package/dist/filter.d.ts

@@ -0,0 +1,70 @@
+import type { Label, Signal, SpamCheck, Submission } from "./check.js";
+import { SpamCheckError } from "./check.js";
+/** Scores a submission and forwards moderators' decisions to the checks that learn from them. */
+export interface SpamFilter {
+    /**
+     * Scores one submission. Local checks run first; when they already reach the spam threshold,
+     * no remote or escalation check runs. Escalation runs only in the unsure band.
+     */
+    check(submission: Submission): Promise<SpamFilter.Assessment>;
+    /**
+     * Sends a moderator's decision to every check that implements `report`, in parallel.
+     *
+     * @returns The checks whose report failed; empty when every one succeeded
+     */
+    report(submission: Submission, label: Label): Promise<SpamFilter.Failure[]>;
+}
+/** The types a {@link SpamFilter} reads and returns. */
+export declare namespace SpamFilter {
+    /** How a filter is built. */
+    interface Options {
+        checks: readonly SpamCheck[];
+        /**
+         * The totals where a submission becomes `unsure` and `spam`. A total at or above `spam` is
+         * spam, at or above `unsure` is unsure, and anything lower is ham.
+         *
+         * @default { unsure: 5, spam: 10 }
+         */
+        thresholds?: Thresholds;
+        /**
+         * Milliseconds each remote or escalation check may take before it fails with `timeout`.
+         *
+         * @default 1500
+         */
+        timeout?: number;
+    }
+    /** See {@link Options.thresholds}. */
+    interface Thresholds {
+        unsure: number;
+        spam: number;
+    }
+    /** The verdict and every piece of evidence behind it. */
+    interface Assessment {
+        verdict: Verdict;
+        /** The sum of every signal's score. */
+        score: number;
+        signals: Signal[];
+        /** Checks that ran and failed, so the verdict lacks their evidence. */
+        failures: Failure[];
+    }
+    /** `unsure` is the band a moderator reviews. */
+    type Verdict = "ham" | "unsure" | "spam";
+    /** A check that produced no evidence, with the reason. */
+    interface Failure {
+        check: string;
+        error: SpamCheckError;
+    }
+}
+/** The thresholds a filter uses when none are given. */
+export declare const DEFAULT_THRESHOLDS: SpamFilter.Thresholds;
+/**
+ * Builds a filter over `checks`. Their order within a stage has no effect on the verdict.
+ *
+ * @example let filter = createSpamFilter({ checks: DEFAULT_RULES });
+ */
+export declare function createSpamFilter(options: SpamFilter.Options): SpamFilter;
+/**
+ * Maps a total onto a verdict. With `unsure` at or above `spam` the unsure band is empty, and
+ * every total is either ham or spam.
+ */
+export declare function verdictFor(score: number, thresholds: SpamFilter.Thresholds): SpamFilter.Verdict;

package/dist/filter.js

@@ -0,0 +1,122 @@
+import { failure, isFailure, success } from "@sdxc/result";
+import { SpamCheckError } from "./check.js";
+/** The thresholds a filter uses when none are given. */
+export const DEFAULT_THRESHOLDS = { unsure: 5, spam: 10 };
+/** Milliseconds a remote or escalation check gets by default. */
+const DEFAULT_TIMEOUT_MS = 1500;
+/**
+ * Builds a filter over `checks`. Their order within a stage has no effect on the verdict.
+ *
+ * @example let filter = createSpamFilter({ checks: DEFAULT_RULES });
+ */
+export function createSpamFilter(options) {
+    let thresholds = options.thresholds ?? DEFAULT_THRESHOLDS;
+    let timeout = options.timeout ?? DEFAULT_TIMEOUT_MS;
+    let byStage = (stage) => options.checks.filter((c) => c.stage === stage);
+    return {
+        async check(submission) {
+            let signals = [];
+            let failures = [];
+            let total = () => signals.reduce((sum, signal) => sum + signal.score, 0);
+            for (let check of byStage("local")) {
+                let outcome = await runCheck(check, submission, [...signals], undefined);
+                if (isFailure(outcome))
+                    failures.push({ check: check.name, error: outcome.error });
+                else
+                    signals.push(...outcome.data);
+            }
+            let stages = [
+                { stage: "remote", runs: (score) => score < thresholds.spam },
+                {
+                    stage: "escalation",
+                    runs: (score) => score >= thresholds.unsure && score < thresholds.spam,
+                },
+            ];
+            for (let { stage, runs } of stages) {
+                let earlier = [...signals];
+                if (!runs(total()))
+                    continue;
+                let outcomes = await Promise.all(byStage(stage).map(async (check) => ({
+                    check,
+                    outcome: await runCheck(check, submission, earlier, timeout),
+                })));
+                for (let { check, outcome } of outcomes) {
+                    if (isFailure(outcome))
+                        failures.push({ check: check.name, error: outcome.error });
+                    else
+                        signals.push(...outcome.data);
+                }
+            }
+            let score = total();
+            return { verdict: verdictFor(score, thresholds), score, signals, failures };
+        },
+        async report(submission, label) {
+            let outcomes = await Promise.all(options.checks.map(async (check) => {
+                if (check.report === undefined)
+                    return null;
+                let report = check.report.bind(check);
+                return { check, outcome: await settle(() => report(submission, label)) };
+            }));
+            return outcomes.flatMap((entry) => entry !== null && isFailure(entry.outcome)
+                ? [{ check: entry.check.name, error: entry.outcome.error }]
+                : []);
+        },
+    };
+}
+/**
+ * Maps a total onto a verdict. With `unsure` at or above `spam` the unsure band is empty, and
+ * every total is either ham or spam.
+ */
+export function verdictFor(score, thresholds) {
+    if (score >= thresholds.spam)
+        return "spam";
+    if (score >= thresholds.unsure)
+        return "unsure";
+    return "ham";
+}
+/**
+ * Runs one check under `timeoutMs`, racing it against the deadline so a check that ignores its
+ * signal still yields. A thrown error or rejected promise becomes `unavailable`.
+ */
+async function runCheck(check, submission, earlier, timeoutMs) {
+    let controller = new AbortController();
+    let timer;
+    let deadline = new Promise((resolve) => {
+        if (timeoutMs === undefined)
+            return;
+        timer = setTimeout(() => {
+            controller.abort();
+            resolve(failure(new SpamCheckError("timeout", `exceeded ${timeoutMs}ms`)));
+        }, timeoutMs);
+    });
+    let run = settle(async () => {
+        let score = earlier.reduce((sum, signal) => sum + signal.score, 0);
+        let answer = await check.check(submission, {
+            signal: controller.signal,
+            score,
+            signals: earlier,
+        });
+        return Array.isArray(answer) ? success(answer) : answer;
+    });
+    try {
+        return await Promise.race([run, deadline]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * Calls `work`, turning a throw or rejection into an `unavailable` failure so a third-party
+ * check's bug degrades to missing evidence.
+ *
+ * @template T - The value a successful call carries.
+ */
+async function settle(work) {
+    try {
+        return await work();
+    }
+    catch (error) {
+        let message = error instanceof Error ? error.message : String(error);
+        return failure(new SpamCheckError("unavailable", message));
+    }
+}

package/dist/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Spam scoring for user-generated submissions: the check contract, the filter that adds up the
+ * signals of every check into a verdict, and the built-in local rules. Remote providers, the
+ * classifier and the test check live under their own export paths.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+export type { Label, Signal, SpamCheck, Submission } from "./check.js";
+export type { SpamFilter } from "./filter.js";
+export { SpamCheckError } from "./check.js";
+export { createSpamFilter, DEFAULT_THRESHOLDS, verdictFor } from "./filter.js";
+export { ABUSED_TLDS, authorName, contactBait, DEFAULT_RULES, language, links, linkSyntax, linkTargets, shouting, timing, unicode, URL_SHORTENERS, } from "./rules/index.js";

package/dist/index.js

@@ -0,0 +1,11 @@
+/**
+ * Spam scoring for user-generated submissions: the check contract, the filter that adds up the
+ * signals of every check into a verdict, and the built-in local rules. Remote providers, the
+ * classifier and the test check live under their own export paths.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+export { SpamCheckError } from "./check.js";
+export { createSpamFilter, DEFAULT_THRESHOLDS, verdictFor } from "./filter.js";
+export { ABUSED_TLDS, authorName, contactBait, DEFAULT_RULES, language, links, linkSyntax, linkTargets, shouting, timing, unicode, URL_SHORTENERS, } from "./rules/index.js";

package/dist/lib/text.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Text measurements the rules share: the links a submission carries and its words. Every rule
+ * reads the same extraction, so two rules never disagree about how many links a text holds.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+/**
+ * The distinct links in `text`, parsed. A `www.` link is read as `http://`; a match that fails to
+ * parse is dropped, so every entry has a host.
+ *
+ * @example extractLinks("see https://example.com/a.").map((url) => url.hostname); // ["example.com"]
+ */
+export declare function extractLinks(text: string): URL[];
+/** The words of `text` with its links removed, split on anything that is not a letter or digit. */
+export declare function extractWords(text: string): string[];

package/dist/lib/text.js

@@ -0,0 +1,43 @@
+/**
+ * Text measurements the rules share: the links a submission carries and its words. Every rule
+ * reads the same extraction, so two rules never disagree about how many links a text holds.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+/**
+ * An absolute `http(s)` URL or a `www.` host, stopping at whitespace, quotes, angle brackets and
+ * the brackets that close Markdown and BBCode link syntax. A bracketed IPv6 host is read whole.
+ */
+const URL_PATTERN = /\b(?:https?:\/\/(?:\[[0-9a-f:.]+\])?|www\.)[^\s"'<>()[\]]*/gi;
+/** Punctuation a sentence puts after a URL, which is never part of it. */
+const TRAILING_PUNCTUATION = /[.,;:!?]+$/;
+/**
+ * The distinct links in `text`, parsed. A `www.` link is read as `http://`; a match that fails to
+ * parse is dropped, so every entry has a host.
+ *
+ * @example extractLinks("see https://example.com/a.").map((url) => url.hostname); // ["example.com"]
+ */
+export function extractLinks(text) {
+    let seen = new Set();
+    let links = [];
+    for (let match of text.matchAll(URL_PATTERN)) {
+        let raw = match[0].replace(TRAILING_PUNCTUATION, "");
+        let href = /^www\./i.test(raw) ? `http://${raw}` : raw;
+        if (!URL.canParse(href))
+            continue;
+        let url = new URL(href);
+        if (seen.has(url.href))
+            continue;
+        seen.add(url.href);
+        links.push(url);
+    }
+    return links;
+}
+/** The words of `text` with its links removed, split on anything that is not a letter or digit. */
+export function extractWords(text) {
+    return text
+        .replace(URL_PATTERN, " ")
+        .split(/[^\p{L}\p{N}'’]+/u)
+        .filter((word) => word.length > 0);
+}