disarm 0.12.0 → 0.14.0

package/binding.d.ts

@@ -29,6 +29,13 @@ export declare class Pipeline {
   process(text: string): string
 }
 
+/**
+ * Analyze a hostname for Unicode homoglyph spoofing, returning the full
+ * [`HostnameAnalysis`] (verdict + granular signals). `isSuspiciousHostname` is
+ * the boolean shorthand for `.suspicious`.
+ */
+export declare function analyzeHostname(host: string, contractions: boolean): HostnameAnalysis
+
 /** Structured anomaly report. */
 export interface AnomalyReport {
   /** Whether any token tripped (the same value `hasAnomalies` returns). */
@@ -64,6 +71,14 @@ export declare function catalogKey(text: string, lang: string | undefined | null
 
 export declare function collapseWhitespace(text: string): string
 
+/**
+ * The Unicode `confusables.txt` release the bundled confusable tables were folded
+ * from (#560). Deliberately not called a "Unicode version": disarm's other tables
+ * track different releases (see docs/provenance.md), so this answers one question —
+ * how current is the confusables fold?
+ */
+export declare function confusablesVersion(): string
+
 /** Replace emoji with their plain names; `strip_modifiers` drops skin-tone marks. */
 export declare function demojize(text: string, stripModifiers: boolean): string
 
@@ -89,6 +104,18 @@ export interface Finding {
   reason: string
 }
 
+/**
+ * Which of `values` reduce to the same identity key under `key` (#620).
+ *
+ * `key` is one of `"fold_case"`, `"search_key"`, `"catalog_key"`,
+ * `"canonicalize"`, `"canonicalize_strict"`, `"normalize_confusables"`. There is
+ * no default: the choice is the policy.
+ */
+export declare function findKeyCollisions(values: Array<string>, key: string, lang?: string | undefined | null): Array<KeyCollision>
+
+/** Scan `text` for confusable sources the bundled `target` table does not fold (#563). */
+export declare function findUnmappedConfusables(text: string, target: string): Array<UnmappedConfusable>
+
 /** Characters with no romanization, as `{ char, offset }` (byte offset), in order. */
 export declare function findUntranslatable(text: string, scheme: string, lang?: string | undefined | null): Array<Untranslatable>
 
@@ -123,6 +150,61 @@ export declare function hasAnomalies(text: string, lexicon: Array<string> | Lexi
  */
 export declare function hasBidiConflict(text: string): boolean
 
+/**
+ * Findings from a hostname homoglyph analysis (#549). Factual signals only — a
+ * `suspicious == false` result is not a safety guarantee.
+ */
+export interface HostnameAnalysis {
+  /**
+   * Overall verdict — a **maximally conservative screen** (any non-Latin
+   * confusable trips it), not a precise verdict.
+   */
+  suspicious: boolean
+  /** Scripts across all labels, first-appearance order (Common/Inherited excluded). */
+  scripts: Array<string>
+  /** Whether any single label mixes more than one script. */
+  mixedScript: boolean
+  /** Whether any label contains a character confusable with a Latin one. */
+  hasConfusables: boolean
+  /**
+   * Whether the decoded hostname mixes strong LTR and RTL characters (the
+   * "BiDi Swap" precondition). Folded into `suspicious`.
+   */
+  bidiConflict: boolean
+  /**
+   * Whether the decoded hostname contains a UAX #9 bidi control character —
+   * override, embedding, isolate or directional mark (#603). Disjoint from
+   * `bidiConflict`, which reads strong-direction letters only. Folded into
+   * `suspicious`; the characters are stripped from `canonical`.
+   */
+  bidiControl: boolean
+  /**
+   * Whether the decoded hostname contains a zero-width or invisible-format
+   * character — `U+200B`-`U+200D`, `U+2060`-`U+2064`, `U+FEFF`, `U+180E` (#605).
+   * Disjoint from `bidiControl`: these carry no direction at all. Folded into
+   * `suspicious`; the characters are stripped before any other field is computed,
+   * so they never reach `scripts`, `mixedScript` or `canonical`.
+   */
+  hasInvisible: boolean
+  /**
+   * Whether the labels span more than one script. Broader/noisier than
+   * `bidiConflict`; NOT folded into `suspicious`.
+   */
+  crossLabelScript: boolean
+  /** Per-label resolved scripts, left to right. */
+  labelScripts: Array<Array<string>>
+  /**
+   * Whether any label is a whole-script confusable (single-script, non-Latin,
+   * skeletoning to all-Latin, e.g. `аррӏе`→`apple`). A graded **signal, not a
+   * verdict** — NOT folded into `suspicious` (fires on `ру`→`py`, `оса`→`oca`).
+   */
+  wholeScriptConfusable: boolean
+  /** Per-label whole-script-confusable flags, parallel to `labelScripts`. */
+  labelWholeScriptConfusable: Array<boolean>
+  /** The Latin-normalized (canonical) form of the hostname. */
+  canonical: string
+}
+
 /**
  * `inspectAnomalies(text, lexicon)` — full analysis with per-token findings.
  * `lexicon` is either an array of common words or a prebuilt `Lexicon` handle.
@@ -132,6 +214,12 @@ export declare function inspectAnomalies(text: string, lexicon: Array<string> |
 /** Explain how auto-language detection resolves `text`. */
 export declare function inspectAutoLang(text: string): AutoLangInspection
 
+/**
+ * Whether case folding and simple lowercasing agree, so the value is a stable
+ * identity key (#619).
+ */
+export declare function isCaseFoldStable(text: string): boolean
+
 /** Whether `text` contains a character confusable with `target`. */
 export declare function isConfusable(text: string, target: string): boolean
 
@@ -151,6 +239,20 @@ export declare function isSuspiciousHostname(host: string): boolean
 
 export declare function isZalgo(text: string, threshold: number): boolean
 
+/** One group of distinct inputs that reduce to the same key (#620). */
+export interface KeyCollision {
+  /** The reduced form every member of the group shares. */
+  key: string
+  /** The distinct inputs that reduce to it, in order of first appearance. */
+  values: Array<string>
+  /**
+   * Every position in the input array that belongs to this group, ascending.
+   * Not parallel to `values`: a value repeated verbatim appears once there and
+   * once per occurrence here.
+   */
+  indices: Array<number>
+}
+
 /**
  * Look up static facts about a language `code`. An unknown code raises a
  * `DisarmInvalidArgument`-tagged error.
@@ -175,11 +277,21 @@ export declare function listContextLangs(): Array<string>
 /** Every Unicode script name known to the transliteration tables. */
 export declare function listScripts(): Array<string>
 
+/**
+ * ML/NLP normalization: NFKC → emoji→text → transliterate → strip accents →
+ * [case fold] → strip control → strip zero-width → collapse whitespace.
+ *
+ * `fold_case` defaults to `true`. Pass `false` in front of a CASED model: the fold is
+ * destructive, cannot be undone downstream, and an uncased evaluation harness cannot
+ * measure what it cost. It restores case, not diacritics — `strip_accents` still runs.
+ */
+export declare function mlNormalize(text: string, lang: string | undefined | null, emojiStyle: string, foldCase: boolean): string
+
 /** Apply a normalization form: `"NFC"` | `"NFD"` | `"NFKC"` | `"NFKD"`. */
 export declare function normalize(text: string, form: string): string
 
 /** Fold cross-script confusables toward `target` (`"latin"` | `"cyrillic"`). */
-export declare function normalizeConfusables(text: string, target: string): string
+export declare function normalizeConfusables(text: string, target: string, digitPolicy: string): string
 
 /** Reverse-transliterate Latin → native script. `lang` is `"el"` | `"ru"` | `"uk"`. */
 export declare function reverseTransliterate(text: string, lang: string): string
@@ -274,6 +386,20 @@ export declare function transliterate(text: string): string
  */
 export declare function transliterateOpts(text: string, scheme: string, lang?: string | undefined | null): string
 
+/**
+ * An upstream confusable source the bundled table does not fold, located in the
+ * input (#563). Mirrors `Untranslatable`, its transliteration analogue.
+ */
+export interface UnmappedConfusable {
+  /** The unmapped character. */
+  char: string
+  /** Its byte offset in the input string. */
+  offset: number
+}
+
+/** Every upstream confusable source the bundled `target` table does not fold (#563). */
+export declare function unmappedConfusables(target: string): Array<string>
+
 /** A character with no transliteration, located in the input. */
 export interface Untranslatable {
   /** The untranslatable character. */

package/binding.js

@@ -77,8 +77,8 @@ function requireNative() {
       try {
         const binding = require('disarm-android-arm64')
         const bindingPackageVersion = require('disarm-android-arm64/package.json').version
-        if (bindingPackageVersion !== '0.12.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.12.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.14.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.14.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -93,8 +93,8 @@ function requireNative() {
       try {
         const binding = require('disarm-android-arm-eabi')
         const bindingPackageVersion = require('disarm-android-arm-eabi/package.json').version
-        if (bindingPackageVersion !== '0.12.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.12.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.14.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.14.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -114,8 +114,8 @@ function requireNative() {
       try {
         const binding = require('disarm-win32-x64-gnu')
         const bindingPackageVersion = require('disarm-win32-x64-gnu/package.json').version
-        if (bindingPackageVersion !== '0.12.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.12.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.14.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.14.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -130,8 +130,8 @@ function requireNative() {
       try {
         const binding = require('disarm-win32-x64-msvc')
         const bindingPackageVersion = require('disarm-win32-x64-msvc/package.json').version
-        if (bindingPackageVersion !== '0.12.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.12.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.14.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.14.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -147,8 +147,8 @@ function requireNative() {
       try {
         const binding = require('disarm-win32-ia32-msvc')
         const bindingPackageVersion = require('disarm-win32-ia32-msvc/package.json').version
-        if (bindingPackageVersion !== '0.12.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.12.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.14.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.14.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -163,8 +163,8 @@ function requireNative() {
       try {
         const binding = require('disarm-win32-arm64-msvc')
         const bindingPackageVersion = require('disarm-win32-arm64-msvc/package.json').version
-        if (bindingPackageVersion !== '0.12.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.12.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.14.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.14.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -182,8 +182,8 @@ function requireNative() {
     try {
       const binding = require('disarm-darwin-universal')
       const bindingPackageVersion = require('disarm-darwin-universal/package.json').version
-      if (bindingPackageVersion !== '0.12.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-        throw new Error(`Native binding package version mismatch, expected 0.12.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+      if (bindingPackageVersion !== '0.14.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+        throw new Error(`Native binding package version mismatch, expected 0.14.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
       }
       return binding
     } catch (e) {
@@ -198,8 +198,8 @@ function requireNative() {
       try {
         const binding = require('disarm-darwin-x64')
         const bindingPackageVersion = require('disarm-darwin-x64/package.json').version
-        if (bindingPackageVersion !== '0.12.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.12.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.14.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.14.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -214,8 +214,8 @@ function requireNative() {
       try {
         const binding = require('disarm-darwin-arm64')
         const bindingPackageVersion = require('disarm-darwin-arm64/package.json').version
-        if (bindingPackageVersion !== '0.12.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.12.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.14.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.14.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -234,8 +234,8 @@ function requireNative() {
       try {
         const binding = require('disarm-freebsd-x64')
         const bindingPackageVersion = require('disarm-freebsd-x64/package.json').version
-        if (bindingPackageVersion !== '0.12.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.12.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.14.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.14.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -250,8 +250,8 @@ function requireNative() {
       try {
         const binding = require('disarm-freebsd-arm64')
         const bindingPackageVersion = require('disarm-freebsd-arm64/package.json').version
-        if (bindingPackageVersion !== '0.12.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.12.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.14.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.14.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -271,8 +271,8 @@ function requireNative() {
         try {
           const binding = require('disarm-linux-x64-musl')
           const bindingPackageVersion = require('disarm-linux-x64-musl/package.json').version
-          if (bindingPackageVersion !== '0.12.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.12.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.14.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.14.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -287,8 +287,8 @@ function requireNative() {
         try {
           const binding = require('disarm-linux-x64-gnu')
           const bindingPackageVersion = require('disarm-linux-x64-gnu/package.json').version
-          if (bindingPackageVersion !== '0.12.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.12.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.14.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.14.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -305,8 +305,8 @@ function requireNative() {
         try {
           const binding = require('disarm-linux-arm64-musl')
           const bindingPackageVersion = require('disarm-linux-arm64-musl/package.json').version
-          if (bindingPackageVersion !== '0.12.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.12.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.14.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.14.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -321,8 +321,8 @@ function requireNative() {
         try {
           const binding = require('disarm-linux-arm64-gnu')
           const bindingPackageVersion = require('disarm-linux-arm64-gnu/package.json').version
-          if (bindingPackageVersion !== '0.12.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.12.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.14.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.14.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -339,8 +339,8 @@ function requireNative() {
         try {
           const binding = require('disarm-linux-arm-musleabihf')
           const bindingPackageVersion = require('disarm-linux-arm-musleabihf/package.json').version
-          if (bindingPackageVersion !== '0.12.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.12.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.14.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.14.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -355,8 +355,8 @@ function requireNative() {
         try {
           const binding = require('disarm-linux-arm-gnueabihf')
           const bindingPackageVersion = require('disarm-linux-arm-gnueabihf/package.json').version
-          if (bindingPackageVersion !== '0.12.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.12.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.14.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.14.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -373,8 +373,8 @@ function requireNative() {
         try {
           const binding = require('disarm-linux-loong64-musl')
           const bindingPackageVersion = require('disarm-linux-loong64-musl/package.json').version
-          if (bindingPackageVersion !== '0.12.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.12.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.14.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.14.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -389,8 +389,8 @@ function requireNative() {
         try {
           const binding = require('disarm-linux-loong64-gnu')
           const bindingPackageVersion = require('disarm-linux-loong64-gnu/package.json').version
-          if (bindingPackageVersion !== '0.12.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.12.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.14.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.14.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -407,8 +407,8 @@ function requireNative() {
         try {
           const binding = require('disarm-linux-riscv64-musl')
           const bindingPackageVersion = require('disarm-linux-riscv64-musl/package.json').version
-          if (bindingPackageVersion !== '0.12.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.12.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.14.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.14.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -423,8 +423,8 @@ function requireNative() {
         try {
           const binding = require('disarm-linux-riscv64-gnu')
           const bindingPackageVersion = require('disarm-linux-riscv64-gnu/package.json').version
-          if (bindingPackageVersion !== '0.12.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.12.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.14.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.14.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -440,8 +440,8 @@ function requireNative() {
       try {
         const binding = require('disarm-linux-ppc64-gnu')
         const bindingPackageVersion = require('disarm-linux-ppc64-gnu/package.json').version
-        if (bindingPackageVersion !== '0.12.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.12.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.14.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.14.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -456,8 +456,8 @@ function requireNative() {
       try {
         const binding = require('disarm-linux-s390x-gnu')
         const bindingPackageVersion = require('disarm-linux-s390x-gnu/package.json').version
-        if (bindingPackageVersion !== '0.12.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.12.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.14.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.14.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -476,8 +476,8 @@ function requireNative() {
       try {
         const binding = require('disarm-openharmony-arm64')
         const bindingPackageVersion = require('disarm-openharmony-arm64/package.json').version
-        if (bindingPackageVersion !== '0.12.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.12.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.14.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.14.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -492,8 +492,8 @@ function requireNative() {
       try {
         const binding = require('disarm-openharmony-x64')
         const bindingPackageVersion = require('disarm-openharmony-x64/package.json').version
-        if (bindingPackageVersion !== '0.12.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.12.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.14.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.14.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -508,8 +508,8 @@ function requireNative() {
       try {
         const binding = require('disarm-openharmony-arm')
         const bindingPackageVersion = require('disarm-openharmony-arm/package.json').version
-        if (bindingPackageVersion !== '0.12.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.12.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.14.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.14.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -589,11 +589,15 @@ if (!nativeBinding) {
 module.exports = nativeBinding
 module.exports.Lexicon = nativeBinding.Lexicon
 module.exports.Pipeline = nativeBinding.Pipeline
+module.exports.analyzeHostname = nativeBinding.analyzeHostname
 module.exports.canonicalize = nativeBinding.canonicalize
 module.exports.catalogKey = nativeBinding.catalogKey
 module.exports.collapseWhitespace = nativeBinding.collapseWhitespace
+module.exports.confusablesVersion = nativeBinding.confusablesVersion
 module.exports.demojize = nativeBinding.demojize
 module.exports.detectScripts = nativeBinding.detectScripts
+module.exports.findKeyCollisions = nativeBinding.findKeyCollisions
+module.exports.findUnmappedConfusables = nativeBinding.findUnmappedConfusables
 module.exports.findUntranslatable = nativeBinding.findUntranslatable
 module.exports.foldCase = nativeBinding.foldCase
 module.exports.getPipeline = nativeBinding.getPipeline
@@ -605,6 +609,7 @@ module.exports.hasAnomalies = nativeBinding.hasAnomalies
 module.exports.hasBidiConflict = nativeBinding.hasBidiConflict
 module.exports.inspectAnomalies = nativeBinding.inspectAnomalies
 module.exports.inspectAutoLang = nativeBinding.inspectAutoLang
+module.exports.isCaseFoldStable = nativeBinding.isCaseFoldStable
 module.exports.isConfusable = nativeBinding.isConfusable
 module.exports.isMixedScript = nativeBinding.isMixedScript
 module.exports.isNormalized = nativeBinding.isNormalized
@@ -613,6 +618,7 @@ module.exports.isZalgo = nativeBinding.isZalgo
 module.exports.langInfo = nativeBinding.langInfo
 module.exports.listContextLangs = nativeBinding.listContextLangs
 module.exports.listScripts = nativeBinding.listScripts
+module.exports.mlNormalize = nativeBinding.mlNormalize
 module.exports.normalize = nativeBinding.normalize
 module.exports.normalizeConfusables = nativeBinding.normalizeConfusables
 module.exports.reverseTransliterate = nativeBinding.reverseTransliterate
@@ -634,3 +640,4 @@ module.exports.stripZeroWidthChars = nativeBinding.stripZeroWidthChars
 module.exports.terminalWidth = nativeBinding.terminalWidth
 module.exports.transliterate = nativeBinding.transliterate
 module.exports.transliterateOpts = nativeBinding.transliterateOpts
+module.exports.unmappedConfusables = nativeBinding.unmappedConfusables

package/index.d.ts

@@ -1,6 +1,9 @@
 import { Lexicon, Pipeline } from './binding';
-import type { Untranslatable, AutoLangInspection, LangMeta, ScriptMeta, Finding as NativeFinding, AnomalyReport as NativeAnomalyReport } from './binding';
-export type { Untranslatable, AutoLangInspection, LangMeta, ScriptMeta };
+import type { Untranslatable, UnmappedConfusable, AutoLangInspection, KeyCollision, LangMeta, ScriptMeta, Finding as NativeFinding, AnomalyReport as NativeAnomalyReport, HostnameAnalysis as NativeHostnameAnalysis } from './binding';
+export type { Untranslatable, UnmappedConfusable, AutoLangInspection, KeyCollision, LangMeta, ScriptMeta, };
+/** Findings from {@link analyzeHostname}. `suspicious` is a maximally
+ * conservative screen, not a precise verdict (#549). */
+export type HostnameAnalysis = NativeHostnameAnalysis;
 /**
  * A reusable, opaque lexicon handle (HAI-SDLC 6.1). `hasAnomalies` /
  * `inspectAnomalies` rebuild an internal set from the caller's word array on
@@ -22,7 +25,7 @@ export { Lexicon };
  */
 export { Pipeline };
 /** The anomaly branch that fired for a finding. */
-export type AnomalyKind = 'invisible' | 'bidi' | 'zalgo' | 'mixed_script' | 'leet' | 'segmentation';
+export type AnomalyKind = 'invisible' | 'bidi' | 'bidi_mixed' | 'zalgo' | 'mixed_script' | 'leet' | 'segmentation' | 'control' | 'compat_fold';
 /**
  * One reason a token is anomalous. Re-typed over the generated {@link NativeFinding}
  * so `kind` is the {@link AnomalyKind} string-union rather than a bare `string`.
@@ -46,6 +49,21 @@ export declare class DisarmInvalidArgument extends DisarmError {
 export type Scheme = 'default' | 'strict_iso9' | 'gost7034';
 /** Confusable-folding target script. */
 export type TargetScript = 'latin' | 'cyrillic';
+/**
+ * How the fold treats non-Latin digits.
+ *
+ * `'numeric'` (default) sends them to the ASCII digit — `०` becomes `0` — which is right
+ * for prose. `'tr39'` uses upstream's targets, which send most of them to a Latin letter
+ * (`०` → `o`), and that is what an identifier *skeleton* wants. The two differ on 45 rows.
+ *
+ * Three of those rows do not land on a letter: `٠` and `۰` fold to `.`, and `𑣣` folds to
+ * the two characters `rn`. A skeleton feeding a label- or path-shaped key has to allow
+ * for that extra `.`.
+ *
+ * Scoped to `target: 'latin'`: the override rows are generated from the Latin table and
+ * carry TR39's Latin-script targets, so with `target: 'cyrillic'` the option is a no-op.
+ */
+export type DigitPolicy = 'numeric' | 'tr39';
 /** Unicode normalization form. */
 export type NormalizationForm = 'NFC' | 'NFD' | 'NFKC' | 'NFKD';
 /** Filename-safety platform ruleset. */
@@ -69,11 +87,31 @@ export declare function findUntranslatable(text: string, options?: Transliterate
 /** Fold cross-script confusables toward `target` (default `'latin'`). */
 export declare function normalizeConfusables(text: string, options?: {
     target?: TargetScript;
+    digitPolicy?: DigitPolicy;
 }): string;
 /** Whether `text` contains a character confusable with `target` (default `'latin'`). */
 export declare function isConfusable(text: string, options?: {
     target?: TargetScript;
 }): boolean;
+/**
+ * Every upstream confusable source the bundled `target` table does not fold.
+ *
+ * Read as exposure, not as a score — this is where an adaptive attacker goes when the
+ * mapped sources stop working. Note it includes five ASCII characters (`%`, `0`, `1`,
+ * `I`, `m`): TR39 is a skeleton transform, and disarm deliberately does not apply those
+ * rows because folding a legitimate `m` to `rn` corrupts prose.
+ */
+export declare function unmappedConfusables(options?: {
+    target?: TargetScript;
+}): Set<string>;
+/**
+ * Confusable sources in `text` the bundled `target` table does not fold, as
+ * `{ char, offset }` (byte offset), in order — the confusables analogue of
+ * {@link findUntranslatable}.
+ */
+export declare function findUnmappedConfusables(text: string, options?: {
+    target?: TargetScript;
+}): UnmappedConfusable[];
 export interface SlugifyOptions {
     separator?: string;
     lowercase?: boolean;
@@ -94,6 +132,39 @@ export declare function slugify(text: string, options?: SlugifyOptions): string;
 export declare function stripAccents(text: string): string;
 /** Full Unicode case fold — more aggressive than `String.toLowerCase()`. */
 export declare function foldCase(text: string): string;
+/**
+ * Whether `text` is a stable identity key under case folding — that is, whether
+ * {@link foldCase} and `String.toLowerCase()` agree on it (#619).
+ *
+ * `false` means some *other* string folds to the same value, so a table keyed on
+ * this one can collide: `'groß.txt'` and `'gross.txt'` are the pair node-tar
+ * collided on (CVE-2026-23950). It is a fact about the string and not an
+ * accusation — `groß` is an ordinary German word — so it is deliberately not
+ * folded into {@link hasAnomalies}.
+ */
+export declare function isCaseFoldStable(text: string): boolean;
+/** Which reducer {@link findKeyCollisions} builds its keys with. No default: the
+ * choice is the policy. */
+export type CollisionKey = 'fold_case' | 'search_key' | 'catalog_key' | 'canonicalize' | 'canonicalize_strict' | 'normalize_confusables';
+/**
+ * Which of `values` are the same name under `key` (#620).
+ *
+ * Every other disarm detector is a single-string predicate, and a collision is not
+ * a property of a single string — `groß.txt` is an ordinary German filename, and
+ * `аdmin` is only a problem next to `admin`. This is the set-shaped question that
+ * node-tar's `PathReservations` guard failed to ask before extracting two paths in
+ * parallel (CVE-2026-23950).
+ *
+ * A stronger `key` finds more collisions, including ones nobody attacked:
+ * `search_key` collides `Muller` with `Müller`. That is the cost of the key you
+ * chose, not a false positive. A group is reported only when two or more *distinct*
+ * inputs share a key; the same name twice is the same name twice.
+ *
+ * `options.lang` reaches `search_key` and `catalog_key` and is ignored by the rest.
+ */
+export declare function findKeyCollisions(values: string[], key: CollisionKey, options?: {
+    lang?: string;
+}): KeyCollision[];
 /** Replace emoji with their plain names. `stripModifiers` drops skin-tone/variation marks. */
 export declare function demojize(text: string, options?: {
     stripModifiers?: boolean;
@@ -198,6 +269,29 @@ export declare function catalogKey(text: string, options?: {
     lang?: string;
     strictIso9?: boolean;
 }): string;
+/** Options for {@link mlNormalize}. */
+export interface MlNormalizeOptions {
+    /** Language code selecting the transliteration table; omit for none. */
+    lang?: string;
+    /** `'cldr'` (default) expands emoji to CLDR short names; `'none'` leaves them. */
+    emojiStyle?: 'cldr' | 'none';
+    /**
+     * Apply Unicode case folding (default `true`).
+     *
+     * Pass `false` in front of a **cased** model: folding is destructive, cannot be undone
+     * downstream, and an uncased evaluation harness cannot measure what it cost. It
+     * restores case, not diacritics — accents are still stripped.
+     */
+    foldCase?: boolean;
+}
+/**
+ * ML/NLP normalization: NFKC → emoji→text → transliterate → strip accents →
+ * [case fold] → strip control → strip zero-width → collapse whitespace.
+ *
+ * Note this folds no confusables — it is not a homoglyph defence at any setting. Put
+ * {@link normalizeConfusables} in front of it when a model needs both.
+ */
+export declare function mlNormalize(text: string, options?: MlNormalizeOptions): string;
 /** Number of grapheme clusters (user-perceived characters). */
 export declare function graphemeLen(text: string): number;
 /** Split `text` into grapheme-cluster strings. */
@@ -214,6 +308,14 @@ export declare function terminalWidth(text: string, options?: {
 }): number;
 /** Whether the hostname looks like a mixed-script / confusable IDN spoof (a `false` is not a safety guarantee). */
 export declare function isSuspiciousHostname(host: string): boolean;
+/**
+ * Analyze a hostname for Unicode homoglyph spoofing, returning the full
+ * {@link HostnameAnalysis} (verdict + granular signals). `isSuspiciousHostname`
+ * is the boolean shorthand for `.suspicious`.
+ */
+export declare function analyzeHostname(host: string, options?: {
+    contractions?: boolean;
+}): HostnameAnalysis;
 /** The Unicode scripts present, in first-appearance order (Common/Inherited excluded). */
 export declare function detectScripts(text: string): string[];
 /** Whether `text` mixes characters from more than one script. */
@@ -239,6 +341,15 @@ export declare function langInfo(code: string): LangMeta;
  * unknown name throws {@link DisarmInvalidArgument}.
  */
 export declare function scriptInfo(name: string): ScriptMeta;
+/**
+ * The Unicode `confusables.txt` release the bundled confusable tables were folded
+ * from, e.g. `"17.0.0"`.
+ *
+ * Not a Unicode version for the library as a whole — disarm's case-folding and width
+ * tables track different releases (see docs/provenance.md). Use this to answer "is my
+ * confusables fold stale?" without inferring it from behaviour.
+ */
+export declare function confusablesVersion(): string;
 /** Every Unicode script name known to the transliteration tables. */
 export declare function listScripts(): string[];
 /** Every language code that has a context-aware transliteration profile. */

package/index.js

@@ -39,9 +39,13 @@ exports.reverseTransliterate = reverseTransliterate;
 exports.findUntranslatable = findUntranslatable;
 exports.normalizeConfusables = normalizeConfusables;
 exports.isConfusable = isConfusable;
+exports.unmappedConfusables = unmappedConfusables;
+exports.findUnmappedConfusables = findUnmappedConfusables;
 exports.slugify = slugify;
 exports.stripAccents = stripAccents;
 exports.foldCase = foldCase;
+exports.isCaseFoldStable = isCaseFoldStable;
+exports.findKeyCollisions = findKeyCollisions;
 exports.demojize = demojize;
 exports.normalize = normalize;
 exports.isNormalized = isNormalized;
@@ -63,18 +67,21 @@ exports.sanitizeFilename = sanitizeFilename;
 exports.searchKey = searchKey;
 exports.sortKey = sortKey;
 exports.catalogKey = catalogKey;
+exports.mlNormalize = mlNormalize;
 exports.graphemeLen = graphemeLen;
 exports.graphemeSplit = graphemeSplit;
 exports.graphemeTruncate = graphemeTruncate;
 exports.graphemeWidth = graphemeWidth;
 exports.terminalWidth = terminalWidth;
 exports.isSuspiciousHostname = isSuspiciousHostname;
+exports.analyzeHostname = analyzeHostname;
 exports.detectScripts = detectScripts;
 exports.isMixedScript = isMixedScript;
 exports.hasBidiConflict = hasBidiConflict;
 exports.inspectAutoLang = inspectAutoLang;
 exports.langInfo = langInfo;
 exports.scriptInfo = scriptInfo;
+exports.confusablesVersion = confusablesVersion;
 exports.listScripts = listScripts;
 exports.listContextLangs = listContextLangs;
 exports.hasAnomalies = hasAnomalies;
@@ -153,12 +160,31 @@ function findUntranslatable(text, options = {}) {
 // ── Confusables (TR39) ──────────────────────────────────────────────────────
 /** Fold cross-script confusables toward `target` (default `'latin'`). */
 function normalizeConfusables(text, options = {}) {
-    return call(() => native.normalizeConfusables(text, options.target ?? 'latin'));
+    return call(() => native.normalizeConfusables(text, options.target ?? 'latin', options.digitPolicy ?? 'numeric'));
 }
 /** Whether `text` contains a character confusable with `target` (default `'latin'`). */
 function isConfusable(text, options = {}) {
     return call(() => native.isConfusable(text, options.target ?? 'latin'));
 }
+/**
+ * Every upstream confusable source the bundled `target` table does not fold.
+ *
+ * Read as exposure, not as a score — this is where an adaptive attacker goes when the
+ * mapped sources stop working. Note it includes five ASCII characters (`%`, `0`, `1`,
+ * `I`, `m`): TR39 is a skeleton transform, and disarm deliberately does not apply those
+ * rows because folding a legitimate `m` to `rn` corrupts prose.
+ */
+function unmappedConfusables(options = {}) {
+    return new Set(call(() => native.unmappedConfusables(options.target ?? 'latin')));
+}
+/**
+ * Confusable sources in `text` the bundled `target` table does not fold, as
+ * `{ char, offset }` (byte offset), in order — the confusables analogue of
+ * {@link findUntranslatable}.
+ */
+function findUnmappedConfusables(text, options = {}) {
+    return call(() => native.findUnmappedConfusables(text, options.target ?? 'latin'));
+}
 /** Generate a URL-safe slug. Mirrors the core's `SlugConfig` defaults. */
 function slugify(text, options = {}) {
     return call(() => native.slugify(text, {
@@ -185,6 +211,38 @@ function stripAccents(text) {
 function foldCase(text) {
     return native.foldCase(text);
 }
+/**
+ * Whether `text` is a stable identity key under case folding — that is, whether
+ * {@link foldCase} and `String.toLowerCase()` agree on it (#619).
+ *
+ * `false` means some *other* string folds to the same value, so a table keyed on
+ * this one can collide: `'groß.txt'` and `'gross.txt'` are the pair node-tar
+ * collided on (CVE-2026-23950). It is a fact about the string and not an
+ * accusation — `groß` is an ordinary German word — so it is deliberately not
+ * folded into {@link hasAnomalies}.
+ */
+function isCaseFoldStable(text) {
+    return native.isCaseFoldStable(text);
+}
+/**
+ * Which of `values` are the same name under `key` (#620).
+ *
+ * Every other disarm detector is a single-string predicate, and a collision is not
+ * a property of a single string — `groß.txt` is an ordinary German filename, and
+ * `аdmin` is only a problem next to `admin`. This is the set-shaped question that
+ * node-tar's `PathReservations` guard failed to ask before extracting two paths in
+ * parallel (CVE-2026-23950).
+ *
+ * A stronger `key` finds more collisions, including ones nobody attacked:
+ * `search_key` collides `Muller` with `Müller`. That is the cost of the key you
+ * chose, not a false positive. A group is reported only when two or more *distinct*
+ * inputs share a key; the same name twice is the same name twice.
+ *
+ * `options.lang` reaches `search_key` and `catalog_key` and is ignored by the rest.
+ */
+function findKeyCollisions(values, key, options = {}) {
+    return call(() => native.findKeyCollisions(values, key, options.lang));
+}
 /** Replace emoji with their plain names. `stripModifiers` drops skin-tone/variation marks. */
 function demojize(text, options = {}) {
     return native.demojize(text, options.stripModifiers ?? false);
@@ -311,6 +369,16 @@ function sortKey(text, options = {}) {
 function catalogKey(text, options = {}) {
     return call(() => native.catalogKey(text, options.lang ?? undefined, options.strictIso9 ?? false));
 }
+/**
+ * ML/NLP normalization: NFKC → emoji→text → transliterate → strip accents →
+ * [case fold] → strip control → strip zero-width → collapse whitespace.
+ *
+ * Note this folds no confusables — it is not a homoglyph defence at any setting. Put
+ * {@link normalizeConfusables} in front of it when a model needs both.
+ */
+function mlNormalize(text, options = {}) {
+    return call(() => native.mlNormalize(text, options.lang ?? undefined, options.emojiStyle ?? 'cldr', options.foldCase ?? true));
+}
 // ── Grapheme clusters ───────────────────────────────────────────────────────
 /** Number of grapheme clusters (user-perceived characters). */
 function graphemeLen(text) {
@@ -337,6 +405,14 @@ function terminalWidth(text, options = {}) {
 function isSuspiciousHostname(host) {
     return native.isSuspiciousHostname(host);
 }
+/**
+ * Analyze a hostname for Unicode homoglyph spoofing, returning the full
+ * {@link HostnameAnalysis} (verdict + granular signals). `isSuspiciousHostname`
+ * is the boolean shorthand for `.suspicious`.
+ */
+function analyzeHostname(host, options = {}) {
+    return call(() => native.analyzeHostname(host, options.contractions ?? false));
+}
 /** The Unicode scripts present, in first-appearance order (Common/Inherited excluded). */
 function detectScripts(text) {
     return native.detectScripts(text);
@@ -375,6 +451,17 @@ function langInfo(code) {
 function scriptInfo(name) {
     return call(() => native.scriptInfo(name));
 }
+/**
+ * The Unicode `confusables.txt` release the bundled confusable tables were folded
+ * from, e.g. `"17.0.0"`.
+ *
+ * Not a Unicode version for the library as a whole — disarm's case-folding and width
+ * tables track different releases (see docs/provenance.md). Use this to answer "is my
+ * confusables fold stale?" without inferring it from behaviour.
+ */
+function confusablesVersion() {
+    return native.confusablesVersion();
+}
 /** Every Unicode script name known to the transliteration tables. */
 function listScripts() {
     return native.listScripts();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "disarm",
-  "version": "0.12.0",
+  "version": "0.14.0",
   "description": "Unicode confusable/text-security building blocks, powered by Rust",
   "main": "index.js",
   "types": "index.d.ts",