@sdxc/spam 0.0.0-pre.1

package/dist/rules/language.js

@@ -0,0 +1,84 @@
+/** The Unicode scripts each ISO 15924 code `Intl.Locale#maximize` reports is written in. */
+const SCRIPTS_BY_CODE = {
+    Latn: ["Latin"],
+    Cyrl: ["Cyrillic"],
+    Grek: ["Greek"],
+    Arab: ["Arabic"],
+    Hebr: ["Hebrew"],
+    Hans: ["Han"],
+    Hant: ["Han"],
+    Jpan: ["Han", "Hiragana", "Katakana"],
+    Kore: ["Hangul", "Han"],
+    Thai: ["Thai"],
+    Deva: ["Devanagari"],
+    Beng: ["Bengali"],
+    Taml: ["Tamil"],
+    Armn: ["Armenian"],
+    Geor: ["Georgian"],
+    Ethi: ["Ethiopic"],
+};
+/** Every script this rule can attribute letters to, each with the pattern matching its letters. */
+const SCRIPT_PATTERNS = [
+    ...new Set(Object.values(SCRIPTS_BY_CODE).flat()),
+].map((script) => [script, new RegExp(`\\p{Script=${script}}`, "u")]);
+/**
+ * Scores content whose letters are mostly (over `ratio` of at least `minLetters`) in scripts none
+ * of {@link Submission.languages} is written in. A submission without `languages`, or with a tag
+ * whose script is unknown, draws nothing.
+ *
+ * @example language({ ratio: 0.8 })
+ */
+export function language(options = {}) {
+    let ratio = options.ratio ?? 0.5;
+    let minLetters = options.minLetters ?? 20;
+    let score = options.score ?? 5;
+    return {
+        name: "language",
+        stage: "local",
+        check(submission) {
+            let expected = expectedScripts(submission.languages ?? []);
+            if (expected === null)
+                return [];
+            let letters = 0;
+            let foreign = 0;
+            for (let character of submission.content) {
+                if (!/\p{L}/u.test(character))
+                    continue;
+                letters++;
+                let script = SCRIPT_PATTERNS.find(([, pattern]) => pattern.test(character))?.[0];
+                if (script !== undefined && !expected.has(script))
+                    foreign++;
+            }
+            if (letters < minLetters || foreign / letters <= ratio)
+                return [];
+            return [
+                {
+                    check: "language.script",
+                    score,
+                    detail: `${Math.round((foreign / letters) * 100)}% of letters in a script the site does not use`,
+                },
+            ];
+        },
+    };
+}
+/** The scripts `tags` are written in, or `null` when there are none or one is unknown. */
+function expectedScripts(tags) {
+    if (tags.length === 0)
+        return null;
+    let scripts = new Set();
+    for (let tag of tags) {
+        let code;
+        try {
+            code = new Intl.Locale(tag).maximize().script;
+        }
+        catch {
+            return null;
+        }
+        let known = code === undefined ? undefined : SCRIPTS_BY_CODE[code];
+        if (known === undefined)
+            return null;
+        for (let script of known)
+            scripts.add(script);
+    }
+    return scripts;
+}

package/dist/rules/link-syntax.d.ts

@@ -0,0 +1,28 @@
+/**
+ * The link-syntax rule: markup a field does not render. BBCode belongs to forum software few
+ * sites run, and HTML or Markdown pasted into a plain-text field shows up as literal markup, so
+ * posting it there is what a bot aiming at every kind of form does.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+import type { SpamCheck } from "../check.js";
+/**
+ * Scores BBCode links in any format, HTML anchors outside `html`, and Markdown links in `text`.
+ * Each kind scores once however many links use it.
+ *
+ * @example linkSyntax({ markdownScore: 0 }) // for a text field whose readers write Markdown
+ */
+export declare function linkSyntax(options?: linkSyntax.Options): SpamCheck;
+/** The options {@link linkSyntax} takes. */
+export declare namespace linkSyntax {
+    /** Weights for the link-syntax rule. */
+    interface Options {
+        /** @default 8 */
+        bbcodeScore?: number;
+        /** @default 8 */
+        htmlScore?: number;
+        /** @default 3 */
+        markdownScore?: number;
+    }
+}

package/dist/rules/link-syntax.js

@@ -0,0 +1,48 @@
+/** A BBCode link, `[url=…]` or `[url]…[/url]`. */
+const BBCODE_LINK = /\[url(?:=[^\]]*)?\]/i;
+/** An HTML anchor with an `href`. */
+const HTML_LINK = /<a\s[^>]*href\s*=/i;
+/** A Markdown inline link to an absolute URL. */
+const MARKDOWN_LINK = /\[[^\]]+\]\(\s*https?:\/\//i;
+/**
+ * Scores BBCode links in any format, HTML anchors outside `html`, and Markdown links in `text`.
+ * Each kind scores once however many links use it.
+ *
+ * @example linkSyntax({ markdownScore: 0 }) // for a text field whose readers write Markdown
+ */
+export function linkSyntax(options = {}) {
+    let bbcodeScore = options.bbcodeScore ?? 8;
+    let htmlScore = options.htmlScore ?? 8;
+    let markdownScore = options.markdownScore ?? 3;
+    return {
+        name: "link-syntax",
+        stage: "local",
+        check(submission) {
+            let format = submission.format ?? "text";
+            let content = submission.content;
+            let signals = [];
+            if (BBCODE_LINK.test(content)) {
+                signals.push({
+                    check: "link-syntax.bbcode",
+                    score: bbcodeScore,
+                    detail: "BBCode link markup",
+                });
+            }
+            if (format !== "html" && HTML_LINK.test(content)) {
+                signals.push({
+                    check: "link-syntax.html",
+                    score: htmlScore,
+                    detail: `HTML anchors in a ${format} field`,
+                });
+            }
+            if (format === "text" && MARKDOWN_LINK.test(content)) {
+                signals.push({
+                    check: "link-syntax.markdown",
+                    score: markdownScore,
+                    detail: "Markdown links in a text field",
+                });
+            }
+            return signals;
+        },
+    };
+}

package/dist/rules/link-targets.d.ts

@@ -0,0 +1,41 @@
+/**
+ * The link-target rule: where links point. Shorteners hide the destination, raw IP addresses skip
+ * the domain a blocklist would catch, punycode hosts can imitate a brand, and a few top-level
+ * domains carry a disproportionate share of abuse.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+import type { SpamCheck } from "../check.js";
+/** Hosts of widely used URL shorteners. */
+export declare const URL_SHORTENERS: readonly string[];
+/** Top-level domains that abuse reports rank far above their share of registrations. */
+export declare const ABUSED_TLDS: readonly string[];
+/**
+ * Scores every link in the content and the author's URL by its host: a shortener, an IPv4 or
+ * IPv6 literal, a punycode label, or an abused top-level domain. The total is capped at
+ * `maxScore`, so a long list of shortened links cannot outweigh every other rule.
+ *
+ * @example linkTargets({ shorteners: [...URL_SHORTENERS, "go.example"] })
+ */
+export declare function linkTargets(options?: linkTargets.Options): SpamCheck;
+/** The options {@link linkTargets} takes. */
+export declare namespace linkTargets {
+    /** Lists and weights for the link-target rule. */
+    interface Options {
+        /** Replaces {@link URL_SHORTENERS}. */
+        shorteners?: readonly string[];
+        /** Replaces {@link ABUSED_TLDS}. */
+        abusedTlds?: readonly string[];
+        /** @default 3 */
+        shortenerScore?: number;
+        /** @default 5 */
+        ipScore?: number;
+        /** @default 2 */
+        punycodeScore?: number;
+        /** @default 1 */
+        tldScore?: number;
+        /** @default 12 */
+        maxScore?: number;
+    }
+}

package/dist/rules/link-targets.js

@@ -0,0 +1,87 @@
+import { extractLinks } from "../lib/text.js";
+/** Hosts of widely used URL shorteners. */
+export const URL_SHORTENERS = [
+    "bit.ly",
+    "bitly.com",
+    "buff.ly",
+    "cutt.ly",
+    "goo.gl",
+    "is.gd",
+    "ow.ly",
+    "rb.gy",
+    "rebrand.ly",
+    "s.id",
+    "shorturl.at",
+    "t.co",
+    "t.ly",
+    "tiny.cc",
+    "tinyurl.com",
+    "v.gd",
+];
+/** Top-level domains that abuse reports rank far above their share of registrations. */
+export const ABUSED_TLDS = [
+    "bond",
+    "cfd",
+    "click",
+    "cyou",
+    "icu",
+    "lol",
+    "monster",
+    "quest",
+    "rest",
+    "sbs",
+    "top",
+    "xyz",
+    "zip",
+];
+/**
+ * Scores every link in the content and the author's URL by its host: a shortener, an IPv4 or
+ * IPv6 literal, a punycode label, or an abused top-level domain. The total is capped at
+ * `maxScore`, so a long list of shortened links cannot outweigh every other rule.
+ *
+ * @example linkTargets({ shorteners: [...URL_SHORTENERS, "go.example"] })
+ */
+export function linkTargets(options = {}) {
+    let shorteners = new Set(options.shorteners ?? URL_SHORTENERS);
+    let abusedTlds = new Set(options.abusedTlds ?? ABUSED_TLDS);
+    let shortenerScore = options.shortenerScore ?? 3;
+    let ipScore = options.ipScore ?? 5;
+    let punycodeScore = options.punycodeScore ?? 2;
+    let tldScore = options.tldScore ?? 1;
+    let maxScore = options.maxScore ?? 12;
+    return {
+        name: "link-targets",
+        stage: "local",
+        check(submission) {
+            let authorUrl = submission.author?.url ?? "";
+            let urls = extractLinks(`${submission.content} ${authorUrl}`);
+            let signals = [];
+            let total = 0;
+            let add = (check, score, host) => {
+                let capped = Math.min(score, maxScore - total);
+                if (capped <= 0)
+                    return;
+                total += capped;
+                signals.push({ check: `link-targets.${check}`, score: capped, detail: host });
+            };
+            for (let url of urls) {
+                let host = url.hostname.toLowerCase();
+                if (shorteners.has(host))
+                    add("shortener", shortenerScore, host);
+                else if (isIpLiteral(host))
+                    add("ip-address", ipScore, host);
+                else if (host.split(".").some((label) => label.startsWith("xn--"))) {
+                    add("punycode", punycodeScore, host);
+                }
+                else if (abusedTlds.has(host.slice(host.lastIndexOf(".") + 1))) {
+                    add("abused-tld", tldScore, host);
+                }
+            }
+            return signals;
+        },
+    };
+}
+/** Whether a URL's `hostname` is an IP address rather than a name. */
+function isIpLiteral(host) {
+    return host.startsWith("[") || /^\d{1,3}(?:\.\d{1,3}){3}$/.test(host);
+}

package/dist/rules/links.d.ts

@@ -0,0 +1,32 @@
+/**
+ * The link-count rule: spam exists to place links, so each link past the first adds weight, and a
+ * text that is mostly links adds more. A person citing one source draws nothing.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+import type { SpamCheck } from "../check.js";
+/**
+ * Scores the distinct links in the content: `perExtraLink` for each one past `freeLinks`, capped
+ * at `maxCountScore`, and `densityScore` once when there is at least one link for every
+ * `wordsPerLink` words and more than one link.
+ *
+ * @example links({ freeLinks: 3 })
+ */
+export declare function links(options?: links.Options): SpamCheck;
+/** The options {@link links} takes. */
+export declare namespace links {
+    /** Limits and weights for the link-count rule. */
+    interface Options {
+        /** Links a submission may carry before any scores. @default 1 */
+        freeLinks?: number;
+        /** @default 2 */
+        perExtraLink?: number;
+        /** @default 10 */
+        maxCountScore?: number;
+        /** The fewest words per link that count as prose rather than a link list. @default 4 */
+        wordsPerLink?: number;
+        /** @default 3 */
+        densityScore?: number;
+    }
+}

package/dist/rules/links.js

@@ -0,0 +1,39 @@
+import { extractLinks, extractWords } from "../lib/text.js";
+/**
+ * Scores the distinct links in the content: `perExtraLink` for each one past `freeLinks`, capped
+ * at `maxCountScore`, and `densityScore` once when there is at least one link for every
+ * `wordsPerLink` words and more than one link.
+ *
+ * @example links({ freeLinks: 3 })
+ */
+export function links(options = {}) {
+    let freeLinks = options.freeLinks ?? 1;
+    let perExtraLink = options.perExtraLink ?? 2;
+    let maxCountScore = options.maxCountScore ?? 10;
+    let wordsPerLink = options.wordsPerLink ?? 4;
+    let densityScore = options.densityScore ?? 3;
+    return {
+        name: "links",
+        stage: "local",
+        check(submission) {
+            let count = extractLinks(submission.content).length;
+            let signals = [];
+            if (count > freeLinks) {
+                signals.push({
+                    check: "links.count",
+                    score: Math.min((count - freeLinks) * perExtraLink, maxCountScore),
+                    detail: `${count} links`,
+                });
+            }
+            let words = extractWords(submission.content).length;
+            if (count > 1 && words <= count * wordsPerLink) {
+                signals.push({
+                    check: "links.density",
+                    score: densityScore,
+                    detail: `${count} links in ${words} words`,
+                });
+            }
+            return signals;
+        },
+    };
+}

package/dist/rules/shouting.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The shouting rule: advertising copy written to grab attention, with text in capitals, runs of
+ * one character, a phrase said over and over, and emoji outnumbering words. Each is mild alone.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+import type { SpamCheck } from "../check.js";
+/**
+ * Scores capitals (over `capsRatio` of at least 20 cased letters), a run of one character, a
+ * three-word phrase appearing three times, and at least 8 emoji outnumbering the words.
+ *
+ * @example shouting({ capsScore: 1 })
+ */
+export declare function shouting(options?: shouting.Options): SpamCheck;
+/** The options {@link shouting} takes. */
+export declare namespace shouting {
+    /** Limits and weights for the shouting rule. */
+    interface Options {
+        /** @default 0.7 */
+        capsRatio?: number;
+        /** @default 2 */
+        capsScore?: number;
+        /** @default 1 */
+        runScore?: number;
+        /** @default 2 */
+        repetitionScore?: number;
+        /** @default 2 */
+        emojiScore?: number;
+    }
+}

package/dist/rules/shouting.js

@@ -0,0 +1,60 @@
+import { extractWords } from "../lib/text.js";
+/** The same non-space character six or more times in a row. */
+const CHARACTER_RUN = /(\S)\1{5,}/u;
+/** One emoji, counting a joined sequence as each of its parts. */
+const EMOJI = /\p{Extended_Pictographic}/gu;
+/**
+ * Scores capitals (over `capsRatio` of at least 20 cased letters), a run of one character, a
+ * three-word phrase appearing three times, and at least 8 emoji outnumbering the words.
+ *
+ * @example shouting({ capsScore: 1 })
+ */
+export function shouting(options = {}) {
+    let capsRatio = options.capsRatio ?? 0.7;
+    let capsScore = options.capsScore ?? 2;
+    let runScore = options.runScore ?? 1;
+    let repetitionScore = options.repetitionScore ?? 2;
+    let emojiScore = options.emojiScore ?? 2;
+    return {
+        name: "shouting",
+        stage: "local",
+        check(submission) {
+            let content = submission.content;
+            let signals = [];
+            let upper = content.match(/\p{Lu}/gu)?.length ?? 0;
+            let lower = content.match(/\p{Ll}/gu)?.length ?? 0;
+            if (upper + lower >= 20 && upper / (upper + lower) > capsRatio) {
+                signals.push({ check: "shouting.caps", score: capsScore, detail: "written in capitals" });
+            }
+            let run = content.match(CHARACTER_RUN);
+            if (run) {
+                signals.push({ check: "shouting.run", score: runScore, detail: `a run of "${run[1]}"` });
+            }
+            let phrase = repeatedPhrase(extractWords(content.toLowerCase()));
+            if (phrase !== null) {
+                signals.push({
+                    check: "shouting.repetition",
+                    score: repetitionScore,
+                    detail: `"${phrase}" repeated`,
+                });
+            }
+            let emoji = content.match(EMOJI)?.length ?? 0;
+            if (emoji >= 8 && emoji > extractWords(content).length) {
+                signals.push({ check: "shouting.emoji", score: emojiScore, detail: `${emoji} emoji` });
+            }
+            return signals;
+        },
+    };
+}
+/** The first three-word phrase that appears three or more times, or `null`. */
+function repeatedPhrase(words) {
+    let counts = new Map();
+    for (let index = 0; index + 3 <= words.length; index++) {
+        let phrase = words.slice(index, index + 3).join(" ");
+        let count = (counts.get(phrase) ?? 0) + 1;
+        if (count >= 3)
+            return phrase;
+        counts.set(phrase, count);
+    }
+    return null;
+}

package/dist/rules/timing.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The timing rule: people take seconds to read and type, and bots post the instant a form loads
+ * or replay one captured long ago. It needs a render time the visitor cannot forge.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+import type { SpamCheck } from "../check.js";
+/**
+ * Scores a submission sent too soon after its form rendered, a render time in the future or long
+ * past. A submission without `renderedAt` draws nothing.
+ *
+ * @example timing({ minSeconds: 5 })
+ */
+export declare function timing(options?: timing.Options): SpamCheck;
+/** The options {@link timing} takes. */
+export declare namespace timing {
+    /** Limits and weights for the timing rule. */
+    interface Options {
+        /** @default 3 */
+        minSeconds?: number;
+        /** @default 86400 */
+        maxAgeSeconds?: number;
+        /** Scored for a submission faster than `minSeconds` or rendered in the future. @default 6 */
+        fastScore?: number;
+        /** Scored for a submission older than `maxAgeSeconds`. @default 2 */
+        staleScore?: number;
+    }
+}

package/dist/rules/timing.js

@@ -0,0 +1,46 @@
+/**
+ * Scores a submission sent too soon after its form rendered, a render time in the future or long
+ * past. A submission without `renderedAt` draws nothing.
+ *
+ * @example timing({ minSeconds: 5 })
+ */
+export function timing(options = {}) {
+    let minSeconds = options.minSeconds ?? 3;
+    let maxAgeSeconds = options.maxAgeSeconds ?? 86_400;
+    let fastScore = options.fastScore ?? 6;
+    let staleScore = options.staleScore ?? 2;
+    return {
+        name: "timing",
+        stage: "local",
+        check(submission) {
+            if (submission.renderedAt === undefined)
+                return [];
+            let submittedAt = submission.submittedAt ?? new Date();
+            let seconds = (submittedAt.getTime() - submission.renderedAt.getTime()) / 1000;
+            if (seconds < 0) {
+                return [
+                    { check: "timing.future", score: fastScore, detail: "rendered after it was submitted" },
+                ];
+            }
+            if (seconds < minSeconds) {
+                return [
+                    {
+                        check: "timing.fast",
+                        score: fastScore,
+                        detail: `submitted ${seconds.toFixed(1)}s after the form rendered`,
+                    },
+                ];
+            }
+            if (seconds > maxAgeSeconds) {
+                return [
+                    {
+                        check: "timing.stale",
+                        score: staleScore,
+                        detail: `submitted ${Math.round(seconds / 3600)}h after the form rendered`,
+                    },
+                ];
+            }
+            return [];
+        },
+    };
+}

package/dist/rules/unicode.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The Unicode obfuscation rule: characters that look like ordinary text to a reader but not to a
+ * keyword filter. Spam uses them to slip a brand name or a banned word past naive matching.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+import type { SpamCheck } from "../check.js";
+/**
+ * Scores homoglyph words, invisible separators, styled letters (at least `minStyledLetters` of
+ * them) and stacked combining marks. Each kind scores once.
+ *
+ * @example unicode({ mixedScriptScore: 3 })
+ */
+export declare function unicode(options?: unicode.Options): SpamCheck;
+/** The options {@link unicode} takes. */
+export declare namespace unicode {
+    /** Limits and weights for the Unicode obfuscation rule. */
+    interface Options {
+        /** @default 5 */
+        mixedScriptScore?: number;
+        /** @default 5 */
+        hiddenScore?: number;
+        /** @default 5 */
+        styledScore?: number;
+        /** @default 3 */
+        minStyledLetters?: number;
+        /** @default 3 */
+        markStackScore?: number;
+    }
+}

package/dist/rules/unicode.js

@@ -0,0 +1,66 @@
+/**
+ * A word mixing Latin letters with Cyrillic or Greek ones, the shape of a homoglyph substitution
+ * such as a Cyrillic `а` inside `Paypal`.
+ */
+const MIXED_SCRIPT_WORD = /(?=[\p{L}]*\p{Script=Latin})(?=[\p{L}]*[\p{Script=Cyrillic}\p{Script=Greek}])[\p{L}]+/u;
+/**
+ * An invisible character between two letters or digits. Zero-width joiners and non-joiners count
+ * only between Latin letters, since emoji sequences and several scripts use them legitimately.
+ */
+const HIDDEN_SEPARATOR = /[\p{L}\p{N}][​⁠­][\p{L}\p{N}]|\p{Script=Latin}[‌‍]\p{Script=Latin}/u;
+/** Mathematical alphanumeric symbols and fullwidth Latin letters, which render as styled text. */
+const STYLED_LETTER = /[\u{1D400}-\u{1D7FF}Ａ-Ｚａ-ｚ]/gu;
+/** Five or more combining marks stacked on one character, as "Zalgo" text does. */
+const MARK_STACK = /\p{M}{5,}/u;
+/**
+ * Scores homoglyph words, invisible separators, styled letters (at least `minStyledLetters` of
+ * them) and stacked combining marks. Each kind scores once.
+ *
+ * @example unicode({ mixedScriptScore: 3 })
+ */
+export function unicode(options = {}) {
+    let mixedScriptScore = options.mixedScriptScore ?? 5;
+    let hiddenScore = options.hiddenScore ?? 5;
+    let styledScore = options.styledScore ?? 5;
+    let minStyledLetters = options.minStyledLetters ?? 3;
+    let markStackScore = options.markStackScore ?? 3;
+    return {
+        name: "unicode",
+        stage: "local",
+        check(submission) {
+            let content = submission.content;
+            let signals = [];
+            let mixed = content.match(MIXED_SCRIPT_WORD);
+            if (mixed) {
+                signals.push({
+                    check: "unicode.mixed-script",
+                    score: mixedScriptScore,
+                    detail: `"${mixed[0]}" mixes Latin with Cyrillic or Greek letters`,
+                });
+            }
+            if (HIDDEN_SEPARATOR.test(content)) {
+                signals.push({
+                    check: "unicode.hidden",
+                    score: hiddenScore,
+                    detail: "invisible characters inside words",
+                });
+            }
+            let styled = content.match(STYLED_LETTER)?.length ?? 0;
+            if (styled >= minStyledLetters) {
+                signals.push({
+                    check: "unicode.styled",
+                    score: styledScore,
+                    detail: `${styled} mathematical or fullwidth letters`,
+                });
+            }
+            if (MARK_STACK.test(content)) {
+                signals.push({
+                    check: "unicode.mark-stack",
+                    score: markStackScore,
+                    detail: "stacked combining marks",
+                });
+            }
+            return signals;
+        },
+    };
+}