spamscanner 7.0.1 → 7.0.3

package/dist/esm/index.js

@@ -7,9 +7,581 @@ import { simpleParser as simpleParser2 } from "mailparser";
 // src/attachments.js
 import { Buffer } from "node:buffer";
 
+// src/linear.js
+import { createRequire } from "node:module";
+function loadRe2(load = createRequire(import.meta.url)) {
+  try {
+    return load("re2");
+  } catch {
+    return null;
+  }
+}
+var RE2 = loadRe2();
+var BOUNDED = /{([01]),(\d{2,})}/g;
+var WHITESPACE = String.raw`\t\n\x0B\f\r \x{A0}\x{1680}\x{2000}-\x{200A}\x{2028}\x{2029}\x{202F}\x{205F}\x{3000}\x{FEFF}`;
+function re2Source(source) {
+  let out = "";
+  let inClass = false;
+  for (let i = 0; i < source.length; i++) {
+    const char = source[i];
+    if (char === "\\") {
+      const next = source[++i] ?? "";
+      if (next === "s") {
+        out += inClass ? WHITESPACE : `[${WHITESPACE}]`;
+      } else if (next === "S") {
+        if (inClass) {
+          throw new TypeError(String.raw`\S inside a character class has no RE2 equivalent here`);
+        }
+        out += `[^${WHITESPACE}]`;
+      } else {
+        out += `\\${next}`;
+      }
+      continue;
+    }
+    if (char === "[" && !inClass) {
+      inClass = true;
+    } else if (char === "]" && inClass) {
+      inClass = false;
+    }
+    out += char;
+  }
+  return out.replaceAll(BOUNDED, (_, min) => min === "0" ? "*" : "+");
+}
+function linear(source, flags = "", Engine = RE2) {
+  return Engine ? new Engine(re2Source(source), flags) : new RegExp(source, flags);
+}
+function trimEndOf(value, characters) {
+  let end = value.length;
+  while (end > 0 && characters.includes(value[end - 1])) {
+    end--;
+  }
+  return value.slice(0, end);
+}
+function replaceTags(html, replacement = " ") {
+  let out = "";
+  let from = 0;
+  let open = html.indexOf("<");
+  while (open !== -1) {
+    const close = html.indexOf(">", open + 1);
+    if (close === -1) {
+      break;
+    }
+    out += `${html.slice(from, open)}${replacement}`;
+    from = close + 1;
+    open = html.indexOf("<", from);
+  }
+  return out + html.slice(from);
+}
+function caseless(word) {
+  return [...word].map((letter) => `[${letter}${letter.toUpperCase()}]`).join("");
+}
+var FOLDS_TO_ASCII = /[\u017F\u212A]/g;
+function foldToAscii(text) {
+  return text.replaceAll(FOLDS_TO_ASCII, (character) => character === "\u017F" ? "s" : "k");
+}
+var OPENER = linear(String.raw`<(${caseless("script")}|${caseless("style")})\b`, "g");
+var CLOSERS = {
+  script: linear(String.raw`<\/${caseless("script")}\s*>`, "g"),
+  style: linear(String.raw`<\/${caseless("style")}\s*>`, "g")
+};
+
 // src/tokenizer.js
 import { parse as parseDomain } from "tldts";
 
+// src/html.js
+var LATIN1 = "nbsp iexcl cent pound curren yen brvbar sect uml copy ordf laquo not shy reg macr deg plusmn sup2 sup3 acute micro para middot cedil sup1 ordm raquo frac14 frac12 frac34 iquest Agrave Aacute Acirc Atilde Auml Aring AElig Ccedil Egrave Eacute Ecirc Euml Igrave Iacute Icirc Iuml ETH Ntilde Ograve Oacute Ocirc Otilde Ouml times Oslash Ugrave Uacute Ucirc Uuml Yacute THORN szlig agrave aacute acirc atilde auml aring aelig ccedil egrave eacute ecirc euml igrave iacute icirc iuml eth ntilde ograve oacute ocirc otilde ouml divide oslash ugrave uacute ucirc uuml yacute thorn yuml".split(" ");
+var ENTITIES = new Map([
+  ...LATIN1.map((name, index) => [name, String.fromCodePoint(160 + index)]),
+  ["amp", "&"],
+  ["lt", "<"],
+  ["gt", ">"],
+  ["quot", '"'],
+  ["apos", "'"],
+  ["AMP", "&"],
+  ["LT", "<"],
+  ["GT", ">"],
+  ["QUOT", '"'],
+  ["COPY", "\xA9"],
+  ["REG", "\xAE"],
+  ["OElig", "\u0152"],
+  ["oelig", "\u0153"],
+  ["Scaron", "\u0160"],
+  ["scaron", "\u0161"],
+  ["Yuml", "\u0178"],
+  ["fnof", "\u0192"],
+  ["circ", "\u02C6"],
+  ["tilde", "\u02DC"],
+  ["ensp", "\u2002"],
+  ["emsp", "\u2003"],
+  ["thinsp", "\u2009"],
+  ["zwnj", "\u200C"],
+  ["zwj", "\u200D"],
+  ["lrm", "\u200E"],
+  ["rlm", "\u200F"],
+  ["ndash", "\u2013"],
+  ["mdash", "\u2014"],
+  ["lsquo", "\u2018"],
+  ["rsquo", "\u2019"],
+  ["sbquo", "\u201A"],
+  ["ldquo", "\u201C"],
+  ["rdquo", "\u201D"],
+  ["bdquo", "\u201E"],
+  ["dagger", "\u2020"],
+  ["Dagger", "\u2021"],
+  ["bull", "\u2022"],
+  ["hellip", "\u2026"],
+  ["permil", "\u2030"],
+  ["prime", "\u2032"],
+  ["Prime", "\u2033"],
+  ["lsaquo", "\u2039"],
+  ["rsaquo", "\u203A"],
+  ["euro", "\u20AC"],
+  ["trade", "\u2122"],
+  ["larr", "\u2190"],
+  ["uarr", "\u2191"],
+  ["rarr", "\u2192"],
+  ["darr", "\u2193"],
+  ["hearts", "\u2665"],
+  ["check", "\u2713"]
+]);
+var LEGACY = [...LATIN1, "amp", "lt", "gt", "quot", "AMP", "LT", "GT", "QUOT", "COPY", "REG"].sort((a, b) => b.length - a.length);
+var WINDOWS_1252 = [8364, 129, 8218, 402, 8222, 8230, 8224, 8225, 710, 8240, 352, 8249, 338, 141, 381, 143, 144, 8216, 8217, 8220, 8221, 8226, 8211, 8212, 732, 8482, 353, 8250, 339, 157, 382, 376];
+var REFERENCE = /&(?:#([xX])([\da-fA-F]+)|#(\d+)|([a-zA-Z][a-zA-Z\d]{0,31}))(;?)/g;
+function fromCode(code) {
+  if (code === 0 || code > 1114111 || code >= 55296 && code <= 57343) {
+    return "\uFFFD";
+  }
+  if (code >= 128 && code <= 159) {
+    return String.fromCodePoint(WINDOWS_1252[code - 128]);
+  }
+  return String.fromCodePoint(code);
+}
+function decodeEntities(value, { attribute = false } = {}) {
+  return value.replaceAll(REFERENCE, (...found) => {
+    const [match, , hex, decimal, name, semicolon, offset] = found;
+    if (hex !== void 0 || decimal !== void 0) {
+      return fromCode(hex === void 0 ? Number.parseInt(decimal, 10) : Number.parseInt(hex, 16));
+    }
+    if (semicolon) {
+      return ENTITIES.get(name) ?? match;
+    }
+    const legacy = LEGACY.find((known) => name.startsWith(known));
+    if (!legacy) {
+      return match;
+    }
+    const rest = match.slice(legacy.length + 1);
+    const next = rest[0] ?? value[offset + match.length] ?? "";
+    if (attribute && /[\da-zA-Z=]/.test(next)) {
+      return match;
+    }
+    return ENTITIES.get(legacy) + rest;
+  });
+}
+var UNSHOWN = /* @__PURE__ */ new Set(["script", "style", "title", "noembed", "noframes", "iframe"]);
+var RAW_SHOWN = /* @__PURE__ */ new Set(["textarea", "xmp"]);
+var RAW_END = Object.fromEntries([...UNSHOWN, ...RAW_SHOWN].map((name) => [name, linear(String.raw`<\/${caseless(name)}[\s/>]`, "g")]));
+var BREAKS = /* @__PURE__ */ new Set(["address", "applet", "area", "article", "aside", "audio", "blockquote", "body", "br", "button", "canvas", "caption", "center", "col", "colgroup", "dd", "details", "dialog", "dir", "div", "dl", "dt", "embed", "fieldset", "figcaption", "figure", "footer", "form", "frame", "frameset", "h1", "h2", "h3", "h4", "h5", "h6", "head", "header", "hgroup", "hr", "html", "iframe", "image", "img", "input", "keygen", "legend", "li", "listing", "main", "marquee", "math", "menu", "meter", "nav", "object", "ol", "optgroup", "option", "p", "picture", "plaintext", "pre", "progress", "section", "select", "summary", "svg", "table", "tbody", "td", "textarea", "tfoot", "th", "thead", "tr", "ul", "video", "xmp"]);
+var SPECIAL = /* @__PURE__ */ new Set(["address", "applet", "area", "article", "aside", "base", "blockquote", "body", "button", "caption", "center", "col", "colgroup", "dd", "details", "dir", "div", "dl", "dt", "fieldset", "figcaption", "figure", "footer", "form", "frameset", "h1", "h2", "h3", "h4", "h5", "h6", "head", "header", "hgroup", "html", "iframe", "li", "listing", "main", "marquee", "menu", "nav", "object", "ol", "p", "plaintext", "pre", "section", "select", "summary", "table", "tbody", "td", "template", "textarea", "tfoot", "th", "thead", "tr", "ul", "xmp"]);
+var FORMATTING = /* @__PURE__ */ new Set(["a", "b", "big", "code", "em", "font", "i", "nobr", "s", "small", "strike", "strong", "tt", "u"]);
+var LINE = /* @__PURE__ */ new Set(["br", "p", "div", "tr", "li", "h1", "h2", "h3", "h4", "h5", "h6", "table", "blockquote", "pre"]);
+var VOID = /* @__PURE__ */ new Set(["area", "base", "basefont", "bgsound", "br", "col", "command", "embed", "frame", "hr", "image", "img", "input", "keygen", "link", "meta", "param", "source", "track", "wbr"]);
+var CLOSES_PARAGRAPH = /* @__PURE__ */ new Set(["address", "article", "aside", "blockquote", "center", "dd", "details", "dialog", "dir", "div", "dl", "dt", "fieldset", "figcaption", "figure", "footer", "form", "h1", "h2", "h3", "h4", "h5", "h6", "header", "hgroup", "hr", "li", "main", "menu", "nav", "ol", "p", "pre", "section", "table", "ul", "xmp"]);
+var PARAGRAPH = [/* @__PURE__ */ new Set(["p"]), /* @__PURE__ */ new Set(["button", "table", "td", "th", "caption", "marquee", "object", "applet", "html"])];
+var IMPLIED = {
+  li: [/* @__PURE__ */ new Set(["li"]), /* @__PURE__ */ new Set(["ul", "ol", "menu"])],
+  dt: [/* @__PURE__ */ new Set(["dt", "dd"]), /* @__PURE__ */ new Set(["dl"])],
+  dd: [/* @__PURE__ */ new Set(["dt", "dd"]), /* @__PURE__ */ new Set(["dl"])],
+  td: [/* @__PURE__ */ new Set(["td", "th"]), /* @__PURE__ */ new Set(["tr", "table"])],
+  th: [/* @__PURE__ */ new Set(["td", "th"]), /* @__PURE__ */ new Set(["tr", "table"])],
+  tr: [/* @__PURE__ */ new Set(["tr"]), /* @__PURE__ */ new Set(["table", "tbody", "thead", "tfoot"])],
+  tbody: [/* @__PURE__ */ new Set(["tbody", "thead", "tfoot"]), /* @__PURE__ */ new Set(["table"])],
+  thead: [/* @__PURE__ */ new Set(["tbody", "thead", "tfoot"]), /* @__PURE__ */ new Set(["table"])],
+  tfoot: [/* @__PURE__ */ new Set(["tbody", "thead", "tfoot"]), /* @__PURE__ */ new Set(["table"])],
+  option: [/* @__PURE__ */ new Set(["option"]), /* @__PURE__ */ new Set(["select", "datalist", "optgroup"])],
+  optgroup: [/* @__PURE__ */ new Set(["optgroup", "option"]), /* @__PURE__ */ new Set(["select"])]
+};
+var MAX_OPEN = 1024;
+var MAX_SEARCH = 64;
+var MAX_ATTRIBUTES = 64;
+var MAX_STYLE = 1e4;
+var COMMENT_END = linear("--!?>", "g");
+var WHITESPACE2 = /* @__PURE__ */ new Set([" ", "	", "\n", "\r", "\f"]);
+function readTag(html, start) {
+  const closing = html[start + 1] === "/";
+  let i = start + (closing ? 2 : 1);
+  const nameStart = i;
+  while (i < html.length && !WHITESPACE2.has(html[i]) && html[i] !== "/" && html[i] !== ">") {
+    i++;
+  }
+  const name = html.slice(nameStart, Math.min(i, nameStart + 64)).toLowerCase();
+  const attributes = /* @__PURE__ */ new Map();
+  let slash = false;
+  while (i < html.length) {
+    const char = html[i];
+    if (char === ">") {
+      return {
+        end: i + 1,
+        name,
+        closing,
+        attributes,
+        selfClosing: slash
+      };
+    }
+    if (WHITESPACE2.has(char) || char === "/") {
+      slash = char === "/" || slash && WHITESPACE2.has(char);
+      i++;
+      continue;
+    }
+    slash = false;
+    const attributeStart = i++;
+    while (i < html.length && !WHITESPACE2.has(html[i]) && html[i] !== "/" && html[i] !== ">" && html[i] !== "=") {
+      i++;
+    }
+    const attribute = html.slice(attributeStart, i).toLowerCase();
+    while (WHITESPACE2.has(html[i])) {
+      i++;
+    }
+    let value = "";
+    if (html[i] === "=") {
+      i++;
+      while (WHITESPACE2.has(html[i])) {
+        i++;
+      }
+      if (html[i] === '"' || html[i] === "'") {
+        const close = html.indexOf(html[i], i + 1);
+        if (close === -1) {
+          break;
+        }
+        value = html.slice(i + 1, close);
+        i = close + 1;
+      } else {
+        const valueStart = i;
+        while (i < html.length && !WHITESPACE2.has(html[i]) && html[i] !== ">") {
+          i++;
+        }
+        value = html.slice(valueStart, i);
+      }
+    }
+    if (!attributes.has(attribute) && attributes.size < MAX_ATTRIBUTES) {
+      attributes.set(attribute, value);
+    }
+  }
+  return { end: -1 };
+}
+function declarations(style) {
+  let css = "";
+  let from = 0;
+  const text = style.slice(0, MAX_STYLE);
+  while (from < text.length) {
+    const open = text.indexOf("/*", from);
+    if (open === -1) {
+      css += text.slice(from);
+      break;
+    }
+    css += text.slice(from, open);
+    const close = text.indexOf("*/", open + 2);
+    if (close === -1) {
+      break;
+    }
+    from = close + 2;
+  }
+  const found = /* @__PURE__ */ new Map();
+  for (const declaration of css.split(";")) {
+    const colon = declaration.indexOf(":");
+    if (colon === -1) {
+      continue;
+    }
+    const property = declaration.slice(0, colon).trim().toLowerCase();
+    let value = declaration.slice(colon + 1).trim().toLowerCase();
+    const important = /!\s*important$/.test(value);
+    if (important) {
+      value = value.replace(/!\s*important$/, "").trim();
+    }
+    const before = found.get(property);
+    if (!before || important || !before.important) {
+      found.set(property, { value, important });
+    }
+  }
+  return found;
+}
+var MAX_VALUE = 64;
+var LENGTH = /^([+-]?(?:\d+(?:\.\d*)?|\.\d+)(?:e[+-]?\d+)?)(px|pt|pc|in|cm|mm|q|em|rem|%|ex|ch|)$/;
+var UNITS = {
+  px: 1,
+  pt: 4 / 3,
+  pc: 16,
+  in: 96,
+  cm: 96 / 2.54,
+  mm: 96 / 25.4,
+  q: 96 / 101.6,
+  rem: 16
+};
+var SIZE_KEYWORDS = {
+  "xx-small": 9,
+  "x-small": 10,
+  small: 13,
+  medium: 16,
+  large: 18,
+  "x-large": 24,
+  "xx-large": 32,
+  "xxx-large": 48
+};
+function pixels(value, parent) {
+  const length = value.length > MAX_VALUE ? null : LENGTH.exec(value);
+  if (!length) {
+    return null;
+  }
+  const number = Number(length[1]);
+  if (!Number.isFinite(number)) {
+    return null;
+  }
+  const unit = length[2];
+  if (unit === "em") {
+    return number * parent;
+  }
+  if (unit === "%") {
+    return number * parent / 100;
+  }
+  if (unit === "ex" || unit === "ch") {
+    return number * parent / 2;
+  }
+  return number * (UNITS[unit] ?? 1);
+}
+function fontSize(value, parent) {
+  if (Object.hasOwn(SIZE_KEYWORDS, value)) {
+    return SIZE_KEYWORDS[value];
+  }
+  if (value === "smaller") {
+    return parent / 1.2;
+  }
+  if (value === "larger") {
+    return parent * 1.2;
+  }
+  const size = pixels(value, parent);
+  return size === null || size < 0 ? null : size;
+}
+function shorthandSize(value, parent) {
+  for (const token of value.slice(0, MAX_STYLE).split(/\s+/)) {
+    const [size, lineHeight] = token.split("/");
+    if (lineHeight === void 0 && /^[+-]?[\d.]+$/.test(size)) {
+      continue;
+    }
+    const pixelSize = fontSize(size, parent);
+    if (pixelSize !== null) {
+      return pixelSize;
+    }
+  }
+  return null;
+}
+function isTransparent(color) {
+  if (color === "transparent") {
+    return true;
+  }
+  const hex = /^#(?:[\da-f]{3}(0)|[\da-f]{6}(00))$/.exec(color);
+  if (hex) {
+    return true;
+  }
+  const functional = /^(?:rgb|hsl)a?\((.*)\)$/.exec(color);
+  if (!functional) {
+    return false;
+  }
+  const slash = functional[1].lastIndexOf("/");
+  const parts = functional[1].split(",");
+  if (slash === -1 && parts.length < 4) {
+    return false;
+  }
+  const alpha = (slash === -1 ? parts.at(-1) : functional[1].slice(slash + 1)).trim();
+  return ZERO_NUMBER.test(alpha);
+}
+var ZERO_NUMBER = /^[+-]?(?:0+(?:\.0*)?|\.0+)%?$/;
+var isZero = (value) => {
+  const size = pixels(value, 16);
+  return size !== null && size <= 0;
+};
+function styleState(style, parent) {
+  const css = declarations(style);
+  const value = (property) => css.get(property)?.value;
+  const opacity = value("opacity");
+  const overflow = [value("overflow"), value("overflow-x"), value("overflow-y")].some((item) => item === "hidden" || item === "clip");
+  const noHeight = (isZero(value("height") ?? "1") || isZero(value("max-height") ?? "1")) && isZero(value("min-height") ?? "0");
+  const noWidth = (isZero(value("width") ?? "1") || isZero(value("max-width") ?? "1")) && isZero(value("min-width") ?? "0");
+  const indent = pixels(value("text-indent") ?? "0", parent.size);
+  const offPage = ["absolute", "fixed"].includes(value("position")) && ["left", "top"].some((side) => (pixels(value(side) ?? "0", parent.size) ?? 0) <= -999);
+  const hides = value("display") === "none" || opacity !== void 0 && (ZERO_NUMBER.test(opacity) || opacity.length <= MAX_VALUE && Number.parseFloat(opacity) < 0) || overflow && (noHeight || noWidth) || indent !== null && indent <= -999 || offPage;
+  const visibility = value("visibility");
+  const color = value("color");
+  const size = value("font-size") === void 0 ? value("font") === void 0 ? null : shorthandSize(value("font"), parent.size) : fontSize(value("font-size"), parent.size);
+  return {
+    hides,
+    display: value("display"),
+    visible: visibility === "hidden" || visibility === "collapse" ? false : visibility === "visible" ? true : parent.visible,
+    transparent: color === void 0 ? parent.transparent : isTransparent(color),
+    size: size ?? parent.size
+  };
+}
+var ROOT = {
+  visible: true,
+  transparent: false,
+  size: 16,
+  hides: false
+};
+function visibleText(html) {
+  if (typeof html !== "string" || html === "") {
+    return { text: "", hidden: 0 };
+  }
+  const parts = [];
+  let hidden = 0;
+  const stack = [];
+  const open = /* @__PURE__ */ new Map();
+  let hiding = 0;
+  let collapsed = 0;
+  const state = () => stack.at(-1) ?? ROOT;
+  const shown = () => hiding === 0 && collapsed === 0 && state().visible && !state().transparent && state().size > 1;
+  const write = (text) => {
+    if (text === "") {
+      return;
+    }
+    if (shown()) {
+      parts.push(text);
+    } else {
+      hidden += text.replaceAll(/\s+/g, "").length;
+    }
+  };
+  const popTo = (index) => {
+    while (stack.length > index) {
+      const element = stack.pop();
+      open.set(element.name, open.get(element.name) - 1);
+      if (element.hides) {
+        hiding--;
+      }
+      collapsed -= (element.collapses ? 1 : 0) - (element.reveals ? 1 : 0);
+    }
+  };
+  const closeImplied = ([names, limits]) => {
+    for (let i = stack.length - 1; i >= Math.max(0, stack.length - MAX_SEARCH); i--) {
+      if (names.has(stack[i].name)) {
+        popTo(i);
+        return;
+      }
+      if (limits.has(stack[i].name)) {
+        return;
+      }
+    }
+  };
+  let from = 0;
+  while (from < html.length) {
+    const lt = html.indexOf("<", from);
+    if (lt === -1) {
+      write(decodeEntities(html.slice(from)));
+      break;
+    }
+    write(decodeEntities(html.slice(from, lt)));
+    from = lt + 1;
+    const next = html[lt + 1] ?? "";
+    if (html.startsWith("<!--", lt)) {
+      if (html.startsWith(">", lt + 4) || html.startsWith("->", lt + 4)) {
+        from = html.indexOf(">", lt + 4) + 1;
+        continue;
+      }
+      COMMENT_END.lastIndex = lt + 4;
+      const end = COMMENT_END.exec(html);
+      from = end === null ? html.length : end.index + end[0].length;
+      continue;
+    }
+    const closingTag = next === "/";
+    const letter = /[a-zA-Z]/.test(closingTag ? html[lt + 2] ?? "" : next);
+    if (!letter) {
+      if (closingTag && lt + 2 >= html.length) {
+        write("</");
+        break;
+      }
+      if (next === "!" || next === "?" || closingTag && html[lt + 2] !== ">") {
+        const end = html.indexOf(">", lt + 2);
+        from = end === -1 ? html.length : end + 1;
+      } else if (closingTag) {
+        from = lt + 3;
+      } else {
+        write("<");
+      }
+      continue;
+    }
+    const tag = readTag(html, lt);
+    if (tag.end === -1) {
+      break;
+    }
+    from = tag.end;
+    const { name } = tag;
+    if (tag.closing) {
+      const through = SPECIAL.has(name) || FORMATTING.has(name);
+      const limit = through ? 0 : Math.max(0, stack.length - MAX_SEARCH);
+      for (let i = stack.length - 1; open.get(name) > 0 && i >= limit; i--) {
+        if (stack[i].name === name) {
+          popTo(i);
+          break;
+        }
+        if (!through && SPECIAL.has(stack[i].name)) {
+          break;
+        }
+      }
+    } else {
+      if (CLOSES_PARAGRAPH.has(name)) {
+        closeImplied(PARAGRAPH);
+      }
+      if (IMPLIED[name]) {
+        closeImplied(IMPLIED[name]);
+      }
+      const foreign = (open.get("svg") ?? 0) + (open.get("math") ?? 0) > 0;
+      if (!VOID.has(name) && !(foreign && tag.selfClosing)) {
+        if (stack.length >= MAX_OPEN) {
+          popTo(stack.length - 1);
+        }
+        const style = tag.attributes.get("style");
+        const parent = state();
+        const element = {
+          ...style === void 0 ? {
+            visible: parent.visible,
+            transparent: parent.transparent,
+            size: parent.size,
+            hides: false
+          } : styleState(decodeEntities(style, { attribute: true }), parent),
+          name
+        };
+        if (tag.attributes.has("hidden") && (element.display === void 0 || element.display === "none") || name === "template") {
+          element.hides = true;
+        }
+        element.collapses = name === "details" && !tag.attributes.has("open");
+        element.reveals = name === "summary" && parent.collapses === true;
+        stack.push(element);
+        open.set(name, (open.get(name) ?? 0) + 1);
+        if (element.hides) {
+          hiding++;
+        }
+        collapsed += (element.collapses ? 1 : 0) - (element.reveals ? 1 : 0);
+      }
+      if (name === "plaintext") {
+        parts.push("\n");
+        write(html.slice(tag.end));
+        break;
+      }
+      if ((UNSHOWN.has(name) || RAW_SHOWN.has(name)) && !(foreign && tag.selfClosing)) {
+        const closer = RAW_END[name];
+        closer.lastIndex = tag.end;
+        const close = closer.exec(html);
+        const end = close === null ? html.length : close.index;
+        if (RAW_SHOWN.has(name)) {
+          const raw = html.slice(tag.end, end);
+          write(name === "textarea" ? decodeEntities(raw) : raw);
+        }
+        from = end;
+      }
+    }
+    if (BREAKS.has(name)) {
+      parts.push(LINE.has(name) ? "\n" : " ");
+    }
+  }
+  return { text: parts.join(""), hidden };
+}
+
 // src/language.js
 import { franc } from "franc";
 var SCRIPTS = [
@@ -415,13 +987,30 @@ var LEET = {
   8: "b"
 };
 var UNSPACED = /* @__PURE__ */ new Set(["Han", "Hiragana", "Katakana", "Thai", "Lao", "Khmer", "Myanmar"]);
-var URL_PATTERN = /\b(?:https?:\/\/|www\.)[^\s<>"'`]+|\b[a-z\d][a-z\d-]*(?:\.[a-z\d-]+)*\.[a-z]{2,24}\/[^\s<>"'`]*/giu;
-var EMAIL_PATTERN = new RegExp("[\\p{L}\\p{N}._%+-]+@[\\p{L}\\p{N}-]+(?:\\.[\\p{L}\\p{N}-]+)*\\.\\p{L}{2,24}", "gu");
-var PHONE_PATTERN = /(?:\+|0{2})\d[\d\s().-]{7,}\d|\(\d{3}\)\s?\d{3}[\s.-]\d{4}|\b(?:\d{3}[.-]){2}\d{4}\b/g;
-var IP_PATTERN = /\b(?:25[0-5]|2[0-4]\d|1?\d?\d)(?:\.(?:25[0-5]|2[0-4]\d|1?\d?\d)){3}\b/g;
-var MONEY_PATTERN = /[$€£¥₹₽₩₺₦]\s?\d|\d\s?(?:[$€£¥₹₽₩₺₦]|usd|eur|gbp|dollars?|euros?)\b/giu;
-var BITCOIN_PATTERN = /\b(?:bc1[ac-hj-np-z02-9]{25,60}|[13][a-km-zA-HJ-NP-Z1-9]{25,34})\b/g;
-var CARD_PATTERN = /\b(?:\d[ -]?){13,19}\b/g;
+var URL_PATTERN = linear(String.raw`\b(?:https?:\/\/|www\.)[^\s<>"'\x60]+|\b[a-z\d][a-z\d-]{0,62}(?:\.[a-z\d-]{1,63}){0,10}\.[a-z]{2,24}\/[^\s<>"'\x60]*`, "giu");
+var EMAIL_SOURCE = String.raw`[\p{L}\p{N}._%+-]{1,64}@([\p{L}\p{N}-]{1,63}(?:\.[\p{L}\p{N}-]{1,63}){0,10}\.\p{L}{2,24})`;
+var EMAIL_PATTERN = linear(EMAIL_SOURCE, "gu");
+var PHONE_PATTERN = linear(String.raw`(?:\+|0{2})\d[\d\s().-]{7,}\d|\(\d{3}\)\s?\d{3}[\s.-]\d{4}|\b(?:\d{3}[.-]){2}\d{4}\b`, "g");
+var IP_PATTERN = linear(String.raw`\b(?:25[0-5]|2[0-4]\d|1?\d?\d)(?:\.(?:25[0-5]|2[0-4]\d|1?\d?\d)){3}\b`, "g");
+var MONEY_PATTERN = linear(String.raw`[$€£¥₹₽₩₺₦]\s?\d|\d\s?(?:[$€£¥₹₽₩₺₦]|usd|eur|gbp|dollars?|euros?)\b`, "giu");
+var BITCOIN_PATTERN = linear(String.raw`\b(?:bc1[ac-hj-np-z02-9]{25,60}|[13][a-km-zA-HJ-NP-Z1-9]{25,34})\b`, "g");
+var CARD_PATTERN = linear(String.raw`\b(?:\d[ -]?){13,19}\b`, "g");
+var ANCHOR_START = linear(String.raw`<a\b`, "gi");
+var HREF = linear(String.raw`\bhref\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+))`, "i");
+var ANCHOR_CLOSE = linear(String.raw`<\/a\s*>`, "gi");
+var SHOWN_URL = linear(String.raw`^(?:https?:\/\/|www\.)\S+$|^[a-z\d-]{1,63}(?:\.[a-z\d-]{1,63}){1,10}(?:\/\S*)?$`, "i");
+var IMG_PIXEL = linear(String.raw`<img\b[^<>]*\b(?:width|height)\s*=\s*["']?[01]["'\s>]`, "i");
+var IMG = linear(String.raw`<img\b`, "gi");
+var BARE_HOST = linear(String.raw`\b[a-z\d][a-z\d-]{0,62}(?:\.[a-z\d-]{1,63}){0,9}\.[a-z]{2,24}\b`, "gi");
+var MAX_BARE_HOSTS = 50;
+var NAME_END = /[\p{L}\p{N}\p{M}_]$/u;
+function continuesName(text, index) {
+  if (NAME_END.test(text.slice(Math.max(0, index - 2), index))) {
+    return true;
+  }
+  return (text[index - 1] === "." || text[index - 1] === "-") && NAME_END.test(text.slice(Math.max(0, index - 3), index - 1));
+}
+var FILE_TLDS = /* @__PURE__ */ new Set(["ai", "app", "md", "mov", "pm", "ps", "py", "rs", "sh", "so", "zip"]);
 var SHORTENERS = /* @__PURE__ */ new Set(["bit.ly", "tinyurl.com", "goo.gl", "t.co", "ow.ly", "is.gd", "buff.ly", "rebrand.ly", "cutt.ly", "shorturl.at", "tiny.cc", "rb.gy", "bit.do", "v.gd", "s.id", "t.ly", "lnkd.in", "qrco.de", "shorturl.asia", "urlz.fr"]);
 var FREEMAIL = /* @__PURE__ */ new Set(["gmail.com", "googlemail.com", "yahoo.com", "ymail.com", "hotmail.com", "outlook.com", "live.com", "msn.com", "aol.com", "icloud.com", "me.com", "mail.com", "gmx.com", "gmx.de", "gmx.net", "web.de", "yandex.ru", "yandex.com", "mail.ru", "qq.com", "163.com", "126.com", "proton.me", "protonmail.com", "zoho.com", "naver.com", "daum.net", "rediffmail.com", "libero.it", "orange.fr", "laposte.net", "wp.pl", "o2.pl", "seznam.cz", "rambler.ru", "tutanota.com", "tuta.com"]);
 var segmenters = /* @__PURE__ */ new Map();
@@ -456,6 +1045,9 @@ function chunk(text, size = 1e3) {
   }
   return pieces;
 }
+function readableText(text) {
+  return typeof text === "string" ? text.replaceAll(OBFUSCATING, "").normalize("NFKC") : "";
+}
 function normalizeText(text) {
   if (typeof text !== "string" || text === "") {
     return { text: "", invisible: 0, styled: false };
@@ -523,6 +1115,24 @@ function segmentWords(text, options = {}) {
     leet
   };
 }
+var LATIN = new RegExp("\\p{Script=Latin}", "u");
+var CYRILLIC_OR_GREEK = /[\p{Script=Cyrillic}\p{Script=Greek}]/u;
+function obfuscationOf(text, options = {}) {
+  const { maxLength = 1e5 } = options;
+  const normalized = normalizeText(typeof text === "string" ? text.slice(0, maxLength) : "");
+  let mixed = 0;
+  for (const piece of chunk(normalized.text)) {
+    if (!LATIN.test(piece) || !CYRILLIC_OR_GREEK.test(piece)) {
+      continue;
+    }
+    for (const { segment, isWordLike } of segmenter().segment(piece)) {
+      if (isWordLike && mixedScripts(segment)) {
+        mixed++;
+      }
+    }
+  }
+  return { invisible: normalized.invisible, mixed, styled: normalized.styled };
+}
 function bucket(n, steps) {
   let i = 0;
   while (i < steps.length && n > steps[i]) {
@@ -535,10 +1145,12 @@ function registrableDomain(host) {
   return parsed.domain || parsed.hostname || host;
 }
 function extractLinks(text, html) {
+  text = typeof text === "string" ? foldToAscii(text) : text;
+  html = typeof html === "string" ? foldToAscii(html) : html;
   const links = [];
   const seen = /* @__PURE__ */ new Set();
   const add = (raw, shown = null) => {
-    let href = raw.trim().replace(/[).,;:!?'"\]]+$/, "");
+    let href = trimEndOf(raw.trim(), `).,;:!?'"]`);
     if (/^www\./i.test(href)) {
       href = `http://${href}`;
     }
@@ -563,15 +1175,12 @@ ${shown || ""}`;
     links.push({ url: url.href, host: url.hostname.toLowerCase().replace(/\.$/, ""), text: shown });
   };
   if (typeof html === "string" && html) {
-    const anchor = /<a\b[^>]{0,2000}?\bhref\s*=\s*(?:"([^"]{1,4000})"|'([^']{1,4000})'|([^\s>]{1,4000}))[^>]{0,2000}>([\s\S]{0,2000}?)<\/a\s*>/gi;
-    for (const match of html.matchAll(anchor)) {
-      const href = decodeEntities(match[1] || match[2] || match[3]);
-      const inner = decodeEntities(match[4].replaceAll(/<[^>]*>/g, "")).trim();
-      const shown = /^(?:https?:\/\/|www\.)\S+$|^[a-z\d-]+(?:\.[a-z\d-]+)+(?:\/\S*)?$/i.test(inner) ? inner : null;
+    for (const { href, inner } of anchors(html)) {
+      const shown = SHOWN_URL.test(inner) ? inner : null;
       add(href, shown);
     }
   }
-  for (const source of [text, typeof html === "string" ? html.replaceAll(/<a\b[^>]*>/gi, " ") : ""]) {
+  for (const source of [text, typeof html === "string" ? withoutAnchorTags(html) : ""]) {
     if (typeof source === "string" && source) {
       for (const match of source.slice(0, 5e5).matchAll(URL_PATTERN)) {
         add(match[0]);
@@ -580,22 +1189,97 @@ ${shown || ""}`;
   }
   return links;
 }
-var ENTITIES = {
-  amp: "&",
-  lt: "<",
-  gt: ">",
-  quot: '"',
-  apos: "'",
-  nbsp: " "
-};
-function decodeEntities(value) {
-  return value.replaceAll(/&(#x[\da-f]+|#\d+|[a-z]+);/gi, (match, entity) => {
-    if (entity[0] === "#") {
-      const code = entity[1] === "x" || entity[1] === "X" ? Number.parseInt(entity.slice(2), 16) : Number.parseInt(entity.slice(1), 10);
-      return code > 0 && code <= 1114111 ? String.fromCodePoint(code) : match;
+function tagEnd(html, start) {
+  const limit = Math.min(html.length, start + 6e3);
+  let quote = null;
+  for (let i = start + 1; i < limit; i++) {
+    const char = html[i];
+    if (quote) {
+      if (char === quote) {
+        quote = null;
+      }
+    } else if (char === ">") {
+      return i + 1;
+    } else if (char === '"' || char === "'") {
+      quote = char;
     }
-    return ENTITIES[entity.toLowerCase()] ?? match;
-  });
+  }
+  const close = html.indexOf(">", start + 1);
+  return close === -1 ? -1 : close + 1;
+}
+function withoutAnchorTags(html) {
+  let out = "";
+  let from = 0;
+  ANCHOR_START.lastIndex = 0;
+  let match;
+  while ((match = ANCHOR_START.exec(html)) !== null) {
+    const close = html.indexOf(">", match.index + 2);
+    if (close === -1) {
+      break;
+    }
+    out += `${html.slice(from, match.index)} `;
+    from = close + 1;
+    ANCHOR_START.lastIndex = from;
+  }
+  return out + html.slice(from);
+}
+function anchors(html) {
+  const found = [];
+  ANCHOR_START.lastIndex = 0;
+  ANCHOR_CLOSE.lastIndex = 0;
+  let close = null;
+  let exhausted = false;
+  let match;
+  while ((match = ANCHOR_START.exec(html)) !== null) {
+    const end = tagEnd(html, match.index);
+    if (end === -1) {
+      break;
+    }
+    const attribute = end - match.index <= 6e3 ? HREF.exec(html.slice(match.index, end)) : null;
+    const value = attribute ? attribute[1] ?? attribute[2] ?? attribute[3] : "";
+    if (!value || value.length > 4e3) {
+      ANCHOR_START.lastIndex = end;
+      continue;
+    }
+    if (close !== null && close.index < end) {
+      close = null;
+    }
+    if (close === null && !exhausted) {
+      ANCHOR_CLOSE.lastIndex = Math.max(ANCHOR_CLOSE.lastIndex, end);
+      close = ANCHOR_CLOSE.exec(html);
+      exhausted = close === null;
+    }
+    if (close === null || close.index - end > 2e3) {
+      ANCHOR_START.lastIndex = end;
+      continue;
+    }
+    found.push({ href: foldToAscii(decodeEntities(value, { attribute: true })), inner: foldToAscii(decodeEntities(replaceTags(html.slice(end, close.index), ""))).trim() });
+    ANCHOR_START.lastIndex = close.index + close[0].length;
+    close = null;
+  }
+  return found;
+}
+function extractHosts(text, known = /* @__PURE__ */ new Set()) {
+  const hosts = /* @__PURE__ */ new Set();
+  if (typeof text !== "string" || text === "") {
+    return [];
+  }
+  text = foldToAscii(text);
+  BARE_HOST.lastIndex = 0;
+  let match;
+  while ((match = BARE_HOST.exec(text)) !== null && hosts.size < MAX_BARE_HOSTS) {
+    const [host] = match;
+    const next = text[match.index + host.length];
+    if (continuesName(text, match.index) || host !== host.toLowerCase() || next === "@" || next === "+" || known.has(host) || hosts.has(host)) {
+      continue;
+    }
+    const parsed = parseDomain(host);
+    const file = !parsed.subdomain && FILE_TLDS.has(parsed.publicSuffix) && !host.startsWith("xn--");
+    if (parsed.isIcann && parsed.domain && !file) {
+      hosts.add(host);
+    }
+  }
+  return [...hosts];
 }
 function isDeceptiveLink(link) {
   if (!link.text) {
@@ -614,11 +1298,13 @@ function isDeceptiveLink(link) {
 }
 function addressDomain(address2) {
   const at = address2.lastIndexOf("@");
-  return at === -1 ? "" : address2.slice(at + 1).toLowerCase().replace(/[>\s]+$/, "");
+  return at === -1 ? "" : trimEndOf(address2.slice(at + 1).toLowerCase(), "> 	\r\n\f\v");
 }
 function firstAddress(field) {
   return field?.value?.find((entry) => entry.address) || null;
 }
+var ADDRESS_SOURCE = String.raw`[\p{L}\p{N}._%+-]{1,64}@([\p{L}\p{N}-]{1,63}(?:\.[\p{L}\p{N}-]{1,63}){1,10})`;
+var NAMED_ADDRESS = linear(ADDRESS_SOURCE, "u");
 function headerValue(mail, name) {
   const value = mail.headers?.get?.(name);
   if (value === void 0 || value === null) {
@@ -633,7 +1319,7 @@ function headerValue(mail, name) {
   return value.value ?? value.text ?? String(value);
 }
 function addPatternFeatures(text, add) {
-  let body = text;
+  let body = foldToAscii(text);
   const patterns = [
     ["url", URL_PATTERN],
     ["email", EMAIL_PATTERN],
@@ -760,7 +1446,7 @@ function addSenderFeatures(mail, add) {
     }
   }
   const name = typeof from.name === "string" ? from.name : "";
-  const named = name.match(/[\p{L}\p{N}._%+-]+@([\p{L}\p{N}-]+(?:\.[\p{L}\p{N}-]+)+)/u);
+  const named = name.match(NAMED_ADDRESS);
   if (named && registrableDomain(named[1].toLowerCase()) !== registrableDomain(domain)) {
     add("from:name_has_other_address");
   }
@@ -775,13 +1461,50 @@ function addSenderFeatures(mail, add) {
     }
   }
 }
+function isHtmlOnly(mail) {
+  const contentType = mail.headers?.get?.("content-type");
+  return !(typeof mail.text === "string" && mail.text) || (contentType?.value ?? contentType) === "text/html";
+}
+var MIN_SHOWN_WORDS = 20;
+var PART_WORD = /[\p{L}\p{N}]{2,}/gu;
+function partWords(text) {
+  const words = /* @__PURE__ */ new Set();
+  for (const [word] of normalizeText(text.slice(0, 5e4)).text.matchAll(PART_WORD)) {
+    words.add(word);
+    if (words.size >= 2e3) {
+      break;
+    }
+  }
+  return words;
+}
+function addPartFeatures({ visible, text, plain, alternative }, add) {
+  if (visible.hidden > 0) {
+    add("html:hidden_text");
+    add(`html:hidden_text:${bucket(visible.hidden, [1, 50, 500])}`);
+  }
+  if (!alternative) {
+    return;
+  }
+  const shown = partWords(text);
+  const other = partWords(plain);
+  if (shown.size < MIN_SHOWN_WORDS || other.size < MIN_SHOWN_WORDS) {
+    return;
+  }
+  let shared = 0;
+  for (const word of other) {
+    if (shown.has(word)) {
+      shared++;
+    }
+  }
+  if (shared < Math.min(shown.size, other.size) / 5) {
+    add("html:text_mismatch");
+  }
+}
 function addHtmlFeatures(mail, html, words, add) {
   if (!html) {
     return;
   }
-  const contentType = mail.headers?.get?.("content-type");
-  const htmlOnly = !(typeof mail.text === "string" && mail.text) || (contentType?.value ?? contentType) === "text/html";
-  add(htmlOnly ? "html:only" : "html:alternative");
+  add(isHtmlOnly(mail) ? "html:only" : "html:alternative");
   if (/<form\b/i.test(html)) {
     add("html:form");
   }
@@ -794,14 +1517,14 @@ function addHtmlFeatures(mail, html, words, add) {
   if (/display\s*:\s*none|visibility\s*:\s*hidden|font-size\s*:\s*[01](?:\.\d+)?(?:px|pt)?\s*[;"']/i.test(html)) {
     add("html:hidden");
   }
-  const images = (html.match(/<img\b/gi) || []).length;
+  const images = (html.match(IMG) || []).length;
   if (images > 0) {
     add(`html:img:${bucket(images, [1, 5, 20])}`);
     if (words.length < 20) {
       add("html:img_little_text");
     }
   }
-  if (/<img\b[^>]*\b(?:width|height)\s*=\s*["']?[01]["'\s>]/i.test(html)) {
+  if (IMG_PIXEL.test(html)) {
     add("html:pixel");
   }
 }
@@ -855,14 +1578,21 @@ function getFeatures(mail = {}, options = {}) {
   const { maxLength = 1e5, maxBigrams = 3e3 } = options;
   const features = /* @__PURE__ */ new Set();
   const add = (feature) => features.add(feature);
-  const html = typeof mail.html === "string" ? mail.html : "";
-  let text = typeof mail.text === "string" ? mail.text : "";
-  if (!text && html) {
-    text = decodeEntities(html.replaceAll(/<(script|style)\b[\s\S]*?<\/\1\s*>/gi, " ").replaceAll(/<[^>]*>/g, " "));
+  const html = typeof mail.html === "string" ? mail.html.slice(0, maxLength * 2) : "";
+  const plain = typeof mail.text === "string" ? mail.text.slice(0, maxLength) : "";
+  const visible = html ? visibleText(html) : { text: plain, hidden: 0 };
+  const alternative = Boolean(html && plain && !isHtmlOnly(mail));
+  let text = visible.text.slice(0, maxLength);
+  if (alternative && segmentWords(text.slice(0, 4e3)).words.length < MIN_SHOWN_WORDS) {
+    text = `${text}
+${plain}`.slice(0, maxLength);
   }
-  text = text.slice(0, maxLength);
   const subject = typeof mail.subject === "string" ? mail.subject : "";
-  const links = extractLinks(text, html.slice(0, maxLength * 2));
+  const links = extractLinks(html ? `${plain}
+${text}` : text, html);
+  const hosts = extractHosts(`${subject}
+${text}${alternative ? `
+${plain}` : ""}`, new Set(links.map((link) => link.host)));
   const body = addPatternFeatures(text, add);
   const detected = detectLanguage(`${subject}
 ${body}`);
@@ -884,6 +1614,12 @@ ${body}`);
   addLinkFeatures(links, add);
   addSenderFeatures(mail, add);
   addHtmlFeatures(mail, html, segmented.words, add);
+  addPartFeatures({
+    visible,
+    text,
+    plain,
+    alternative
+  }, add);
   addAttachmentFeatures(mail, add);
   addHeaderFeatures(mail, add);
   return {
@@ -891,7 +1627,12 @@ ${body}`);
     words: segmented.words,
     language: detected.language,
     script: detected.script,
-    links
+    links,
+    hosts,
+    // (the text shown, as read for the words, and how many characters of
+    //  text the HTML hides)
+    text,
+    hidden: visible.hidden
   };
 }
 
@@ -1053,7 +1794,7 @@ function sniff(buffer) {
   const at = (offset, bytes) => buffer.length >= offset + bytes.length && bytes.every((byte, i) => buffer[offset + i] === byte);
   const ascii = (offset, text) => at(offset, [...Buffer.from(text, "latin1")]);
   const result = (type, executable = false) => ({ type, executable, archive: ARCHIVE_TYPES.has(type) });
-  if (ascii(0, "MZ")) {
+  if (ascii(0, "MZ") && buffer.length >= 64 && at(buffer.readUInt32LE(60), [80, 69, 0, 0])) {
     return result("exe", true);
   }
   if (at(0, [127, 69, 76, 70])) {
@@ -1073,7 +1814,7 @@ function sniff(buffer) {
     return result("ole");
   }
   if (at(0, [80, 75, 3, 4]) || at(0, [80, 75, 5, 6])) {
-    const names = zipEntries(buffer).map((entry) => entry.name);
+    const names = entriesOf(buffer).map((entry) => entry.name);
     if (names.includes("AndroidManifest.xml") || names.includes("classes.dex")) {
       return result("apk", true);
     }
@@ -1139,25 +1880,65 @@ function sniff(buffer) {
   }
   return null;
 }
+var ZIP_FAMILY = /* @__PURE__ */ new Set(["zip", "docx", "xlsx", "pptx"]);
+var OFFICE_TYPES = /* @__PURE__ */ new Set(["docx", "xlsx", "pptx"]);
+var OFFICE_EMBEDDED = /* @__PURE__ */ new Set([...MACRO_EXTENSIONS, "cer", "der"]);
+var ENTRIES = /* @__PURE__ */ new WeakMap();
+function entriesOf(buffer) {
+  let entries = ENTRIES.get(buffer);
+  if (!entries) {
+    entries = zipEntries(buffer);
+    ENTRIES.set(buffer, entries);
+  }
+  return entries;
+}
 function zipEntries(buffer, limit = 2e3) {
-  const entries = [];
   const start = Math.max(0, buffer.length - 65557);
-  let eocd = -1;
+  const records = [];
   for (let i = buffer.length - 22; i >= start; i--) {
-    if (buffer.readUInt32LE(i) === 101010256) {
-      eocd = i;
-      break;
+    if (buffer.readUInt32LE(i) === 101010256 && (records.length === 0 || i + 22 + buffer.readUInt16LE(i + 20) === buffer.length)) {
+      records.push(i);
     }
   }
-  if (eocd === -1) {
-    return entries;
+  const entries = [];
+  const read = /* @__PURE__ */ new Set();
+  for (const eocd of records) {
+    const offset = directoryOf(buffer, eocd);
+    if (offset !== -1 && !read.has(offset)) {
+      read.add(offset);
+      readDirectory(buffer, offset, limit - entries.length, entries);
+    }
   }
-  const count = buffer.readUInt16LE(eocd + 10);
+  return entries;
+}
+var DIRECTORY = 33639248;
+var isDirectory = (buffer, offset) => offset >= 0 && offset + 46 <= buffer.length && buffer.readUInt32LE(offset) === DIRECTORY;
+function directoryOf(buffer, eocd) {
   let offset = buffer.readUInt32LE(eocd + 16);
-  for (let n = 0; n < Math.min(count, limit); n++) {
-    if (offset + 46 > buffer.length || buffer.readUInt32LE(offset) !== 33639248) {
-      break;
+  let size = buffer.readUInt32LE(eocd + 12);
+  const locator = eocd - 20;
+  if ((offset === 4294967295 || size === 4294967295) && locator >= 0 && buffer.readUInt32LE(locator) === 117853008) {
+    const stated = Number(buffer.readBigUInt64LE(locator + 8));
+    const isRecord = (at) => at >= 0 && at + 56 <= locator && buffer.readUInt32LE(at) === 101075792;
+    const record = isRecord(stated) ? stated : locator - 56;
+    if (isRecord(record)) {
+      size = Number(buffer.readBigUInt64LE(record + 40));
+      offset = Number(buffer.readBigUInt64LE(record + 48));
     }
+  }
+  if (isDirectory(buffer, offset)) {
+    return offset;
+  }
+  for (const end of [eocd, locator - 56]) {
+    const directory = end - size;
+    if (directory < end && isDirectory(buffer, directory)) {
+      return directory;
+    }
+  }
+  return -1;
+}
+function readDirectory(buffer, offset, count, entries) {
+  for (let n = 0; n < count && isDirectory(buffer, offset); n++) {
     const flags = buffer.readUInt16LE(offset + 8);
     const size = buffer.readUInt32LE(offset + 24);
     const nameLength = buffer.readUInt16LE(offset + 28);
@@ -1167,10 +1948,9 @@ function zipEntries(buffer, limit = 2e3) {
     entries.push({ name, encrypted: (flags & 1) === 1, size });
     offset += 46 + nameLength + extraLength + commentLength;
   }
-  return entries;
 }
 function extensionOf(name) {
-  const base = String(name).toLowerCase().split(/[/\\]/).pop();
+  const base = trimEndOf(String(name).toLowerCase().split(/[/\\]/).pop(), ". ");
   const dot = base.lastIndexOf(".");
   return dot === -1 ? "" : base.slice(dot + 1).trim();
 }
@@ -1178,7 +1958,7 @@ function oleHasMacros(buffer) {
   const names = ["_VBA_PROJECT", "VBA", "Macros"].map((name) => Buffer.from(name, "utf16le"));
   return names.some((name) => buffer.includes(name));
 }
-var PDF_ACTIVE = /\/(?:JavaScript|JS|Launch|EmbeddedFile|OpenAction\s*<<[^>]*\/(?:JS|JavaScript))\b/;
+var PDF_ACTIVE = linear(String.raw`\/(?:JavaScript|JS|Launch|EmbeddedFile)\b`);
 function inspectAttachments(attachments = []) {
   const findings = [];
   for (const attachment of attachments) {
@@ -1196,14 +1976,15 @@ function inspectAttachments(attachments = []) {
     if (BIDI_CONTROLS.test(filename)) {
       add("rtl_override", `Attachment "${name}" uses a right-to-left override to hide its real extension`);
     }
-    const parts = filename.toLowerCase().split(".");
+    const parts = trimEndOf(filename.toLowerCase(), ". ").split(".");
     if (parts.length >= 3 && EXECUTABLE_EXTENSIONS.has(extension) && DOCUMENT_EXTENSIONS.has(parts.at(-2))) {
       add("double_extension", `Attachment "${name}" has a document extension followed by a program extension`, { extension });
     }
-    if (EXECUTABLE_EXTENSIONS.has(extension) && !MACRO_EXTENSIONS.has(extension)) {
+    const byName = EXECUTABLE_EXTENSIONS.has(extension) && !MACRO_EXTENSIONS.has(extension);
+    if (detected?.executable && (detected.type !== "script" || !byName)) {
+      add(extension && !EXECUTABLE_EXTENSIONS.has(extension) ? "disguised_executable" : "executable", `Attachment "${name}" contains a program (${detected.type})${extension && extension !== detected.type ? ` but is named .${extension}` : ""}`, { extension: detected.type });
+    } else if (byName) {
       add("executable", `Attachment "${name}" is a file type that runs code (.${extension})`, { extension });
-    } else if (detected?.executable) {
-      add(extension && !EXECUTABLE_EXTENSIONS.has(extension) ? "disguised_executable" : "executable", `Attachment "${name}" contains a program (${detected.type})${extension ? ` but is named .${extension}` : ""}`, { extension: detected.type });
     }
     if (!content) {
       if (MACRO_EXTENSIONS.has(extension)) {
@@ -1211,21 +1992,23 @@ function inspectAttachments(attachments = []) {
       }
       continue;
     }
-    if (detected?.type === "zip" || detected?.type === "docx" || detected?.type === "xlsx" || detected?.type === "pptx") {
-      const entries = zipEntries(content);
+    const zipFamily = ZIP_FAMILY.has(detected?.type) || extension === "zip" && !detected?.executable && entriesOf(content).length > 0;
+    if (zipFamily) {
+      const entries = entriesOf(content);
+      const office = OFFICE_TYPES.has(detected?.type);
       if (entries.some((entry) => /(?:^|\/)vbaproject\.bin$/i.test(entry.name))) {
         add("macro", `Attachment "${name}" is an Office document with a VBA macro project`, { extension });
       } else if (MACRO_EXTENSIONS.has(extension)) {
         add("macro", `Attachment "${name}" is an Office document type that holds macros (.${extension})`, { extension });
+      } else if (office && entries.some((entry) => MACRO_EXTENSIONS.has(extensionOf(entry.name)))) {
+        add("macro", `Attachment "${name}" is an Office document holding another with macros`, { extension });
       }
-      if (detected.type === "zip") {
-        const inner = entries.filter((entry) => EXECUTABLE_EXTENSIONS.has(extensionOf(entry.name)));
-        if (inner.length > 0) {
-          add("executable_in_archive", `Archive "${name}" contains ${inner.length === 1 ? "a program" : `${inner.length} programs`} (${inner.slice(0, 3).map((entry) => entry.name.split("/").pop()).join(", ")})`, { extension: extensionOf(inner[0].name) });
-        }
-        if (entries.some((entry) => entry.encrypted)) {
-          add("encrypted_archive", `Archive "${name}" is password protected, so its contents cannot be scanned`, { extension });
-        }
+      const inner = entries.filter((entry) => EXECUTABLE_EXTENSIONS.has(extensionOf(entry.name)) && !(office && OFFICE_EMBEDDED.has(extensionOf(entry.name))));
+      if (inner.length > 0) {
+        add("executable_in_archive", `Archive "${name}" contains ${inner.length === 1 ? "a program" : `${inner.length} programs`} (${inner.slice(0, 3).map((entry) => entry.name.split("/").pop()).join(", ")})`, { extension: extensionOf(inner[0].name), extensions: [...new Set(inner.map((entry) => extensionOf(entry.name)))] });
+      }
+      if ((detected?.type === "zip" || !ZIP_FAMILY.has(detected?.type)) && entries.some((entry) => entry.encrypted)) {
+        add("encrypted_archive", `Archive "${name}" is password protected, so its contents cannot be scanned`, { extension });
       }
     } else if (detected?.type === "ole") {
       if (oleHasMacros(content)) {
@@ -2010,6 +2793,42 @@ var DnsChecker = class {
 // src/homograph.js
 import { domainToUnicode } from "node:url";
 import { parse as parseDomain2 } from "tldts";
+var INTERNATIONAL_BRANDS = [
+  "alipay",
+  "auspost",
+  "bancolombia",
+  "bnpparibas",
+  "bradesco",
+  "caixabank",
+  "canadapost",
+  "commerzbank",
+  "coupang",
+  "creditagricole",
+  "deutschebank",
+  "flipkart",
+  "gosuslugi",
+  "japanpost",
+  "kakaobank",
+  "klarna",
+  "kucoin",
+  "lazada",
+  "mercadolibre",
+  "mercadolivre",
+  "mercadopago",
+  "mercari",
+  "natwest",
+  "nubank",
+  "phonepe",
+  "postbank",
+  "rakuten",
+  "sberbank",
+  "swisscom",
+  "trustwallet",
+  "unicredit",
+  "vodafone",
+  "wechat",
+  "yandex"
+];
 var BRANDS = [
   "adobe",
   "airbnb",
@@ -2109,8 +2928,76 @@ var BRANDS = [
   "xfinity",
   "yahoo",
   "zelle",
-  "zoom"
+  "zoom",
+  ...INTERNATIONAL_BRANDS
+];
+var PHISHING_WORDS = ["account", "accounts", "alert", "alerts", "auth", "authentication", "billing", "confirm", "login", "logon", "password", "recovery", "refund", "secure", "security", "signin", "signon", "suspended", "unlock", "update", "validate", "verification", "verify"];
+var WORD_BRANDS = /* @__PURE__ */ new Set(["apple", "blockchain", "booking", "chase", "discord", "kraken", "ledger", "office", "proton", "slack", "steam", "stripe"]);
+var SWAPPED_WORDS = /* @__PURE__ */ new Set([
+  "akuten",
+  "alzada",
+  "appel",
+  "applied",
+  "auslost",
+  "azada",
+  "coupant",
+  "gechat",
+  "klara",
+  "lanada",
+  "lanzada",
+  "lapada",
+  "latada",
+  "lavada",
+  "mazada",
+  "mercar",
+  "mercati",
+  "pazada",
+  "phoneme",
+  "postbak",
+  "raketen",
+  "rauten",
+  "razada",
+  "stirpe",
+  "vazada",
+  "venom",
+  "webchat"
+]);
+var OFFICIAL_DOMAINS = [
+  "adobelogin.com",
+  "amazon-adsystem.com",
+  "apple-cloudkit.com",
+  "apple-dns.net",
+  "bnpparibas-am.com",
+  "canadapost-postescanada.ca",
+  "cdn-apple.com",
+  "cloudflare-dns.com",
+  "credit-agricole.com",
+  "credit-agricole.fr",
+  "deutsche-bank.de",
+  "google-analytics.com",
+  "icloud-content.com",
+  "images-amazon.com",
+  "instagram-engineering.com",
+  "media-amazon.com",
+  "okta-emea.com",
+  "paypal-community.com",
+  "paypal-objects.com",
+  "paypal-prepaid.com",
+  "paypal-status.com",
+  "rakuten-bank.co.jp",
+  "rakuten-card.co.jp",
+  "rakuten-sec.co.jp",
+  "sberbank-ast.ru",
+  "slack-edge.com",
+  "slack-msgs.com",
+  "ssl-images-amazon.com",
+  "t-mobile.com",
+  "yahoo-corp.jp",
+  "yandex-team.ru"
 ];
+var SUFFIX_DASH = /^(?:com|net|org|gov|edu)-/;
+var OTHER_SUFFIX_DASH = /^(?:co|info|biz|io|app|us|uk|de|fr|es|it|ca|au|jp|br|in)-/;
+var SECOND_SUFFIX_DASH = /^(?:co|com)-(?:uk|jp|au|nz|za|in|kr|br)\b/;
 var CONFUSABLE = {
   \u0430: "a",
   \u04D3: "a",
@@ -2254,10 +3141,17 @@ function skeleton(label) {
   }
   return out;
 }
+var MAX_VARIANTS = 256;
 function trickVariants(label) {
   const variants = /* @__PURE__ */ new Set([label]);
   for (const [pattern, letter] of ASCII_TRICKS) {
+    if (!label.includes(pattern.source)) {
+      continue;
+    }
     for (const value of variants) {
+      if (variants.size >= MAX_VARIANTS / 2) {
+        break;
+      }
       variants.add(value.replace(pattern, letter));
     }
   }
@@ -2271,6 +3165,7 @@ function editDistance(a, b, max = 2) {
   if (Math.abs(a.length - b.length) > max) {
     return max + 1;
   }
+  let before = null;
   let previous = Array.from({ length: b.length + 1 }, (_, i) => i);
   for (let i = 1; i <= a.length; i++) {
     const current = [i];
@@ -2278,15 +3173,35 @@ function editDistance(a, b, max = 2) {
     for (let j = 1; j <= b.length; j++) {
       const cost = a[i - 1] === b[j - 1] ? 0 : 1;
       current[j] = Math.min(previous[j] + 1, current[j - 1] + 1, previous[j - 1] + cost);
+      if (before && i > 1 && j > 1 && a[i - 1] === b[j - 2] && a[i - 2] === b[j - 1]) {
+        current[j] = Math.min(current[j], before[j - 2] + 1);
+      }
       best = Math.min(best, current[j]);
     }
     if (best > max) {
       return max + 1;
     }
+    before = previous;
     previous = current;
   }
   return previous[b.length];
 }
+function brandWithPhishingWord(name, brands) {
+  for (const word of PHISHING_WORDS) {
+    if (name.length <= word.length + 4) {
+      continue;
+    }
+    const before = name.endsWith(word) ? name.slice(0, -word.length) : null;
+    if (before && before.length >= 5 && brands.has(before) && !WORD_BRANDS.has(before)) {
+      return before;
+    }
+    const after = name.startsWith(word) ? name.slice(word.length) : null;
+    if (after && after.length >= 5 && brands.has(after) && !WORD_BRANDS.has(after)) {
+      return after;
+    }
+  }
+  return null;
+}
 function labelScripts(label) {
   const scripts = /* @__PURE__ */ new Set();
   for (const char of label) {
@@ -2314,7 +3229,7 @@ var HomographDetector = class {
   constructor(options = {}) {
     this.options = options;
     this.brands = new Set([...options.brands || BRANDS, ...options.extraBrands || []].map((brand) => brand.toLowerCase()));
-    this.allowlist = new Set((options.allowlist || []).map((domain) => domain.toLowerCase()));
+    this.allowlist = new Set([...OFFICIAL_DOMAINS, ...options.allowlist || []].map((domain) => domain.toLowerCase()));
     this.cache = /* @__PURE__ */ new Map();
   }
   /**
@@ -2370,29 +3285,36 @@ var HomographDetector = class {
     if (viaConfusable) {
       flag(0.95, `"${unicode}" imitates ${viaConfusable} with lookalike letters`, viaConfusable);
     } else if (/^[a-z\d-]+$/.test(folded)) {
-      const trick = [...trickVariants(folded)].find((variant) => this.brands.has(variant));
+      const variants = trickVariants(folded);
+      const trick = [...variants].find((variant) => this.brands.has(variant));
       if (trick) {
         flag(0.85, `"${unicode}" imitates ${trick} by swapping characters`, trick);
-      } else if (folded.length >= 5) {
+      } else if (folded.length >= 5 && !SWAPPED_WORDS.has(folded)) {
         const near = [...this.brands].find((brand) => brand.length >= 5 && editDistance(folded, brand, 1) === 1);
         if (near) {
           flag(0.5, `"${unicode}" is one letter away from ${near}`, near);
         }
       }
-      if (folded.includes("-")) {
-        for (const piece of folded.split("-")) {
-          if (piece.length < 4) {
-            continue;
-          }
-          if (this.brands.has(piece)) {
-            flag(0.6, `"${unicode}" puts ${piece} inside another domain name`, piece);
-            break;
-          }
-          const disguised = [...trickVariants(piece)].find((variant) => this.brands.has(variant));
-          if (disguised) {
-            flag(0.85, `"${unicode}" imitates ${disguised} by swapping characters`, disguised);
-            break;
-          }
+      const pieces = folded.includes("-") ? folded.split("-") : [];
+      for (const piece of pieces) {
+        if (piece.length < 4) {
+          continue;
+        }
+        if (this.brands.has(piece)) {
+          flag(0.6, `"${unicode}" puts ${piece} inside another domain name`, piece);
+          break;
+        }
+        const disguised = [...trickVariants(piece)].find((variant) => this.brands.has(variant));
+        if (disguised) {
+          flag(0.85, `"${unicode}" imitates ${disguised} by swapping characters`, disguised);
+          break;
+        }
+      }
+      for (const value of [folded, ...pieces, ...variants]) {
+        const joined = brandWithPhishingWord(value, this.brands);
+        if (joined) {
+          flag(0.6, `"${unicode}" joins ${joined} to a phishing word`, joined);
+          break;
         }
       }
     }
@@ -2401,6 +3323,11 @@ var HomographDetector = class {
     if (brandLabel && (this.options.strictMode || subdomain.length >= 2)) {
       flag(0.6, `"${unicode}" puts ${brandLabel} in front of another domain`, brandLabel);
     }
+    const last = subdomain.length > 0 ? skeleton(subdomain.at(-1)) : "";
+    if (last.length >= 3 && this.brands.has(last) && (SUFFIX_DASH.test(folded) || OTHER_SUFFIX_DASH.test(folded))) {
+      const strong = SUFFIX_DASH.test(folded) || SECOND_SUFFIX_DASH.test(folded) || PHISHING_WORDS.some((word) => folded.includes(word));
+      flag(strong ? 0.85 : 0.6, `"${unicode}" starts with ${last}'s address and continues into another domain`, last);
+    }
     result.confidence = result.riskScore;
     if (result.riskScore >= 0.5) {
       result.recommendations.push(result.brand ? `Do not sign in from this link; go to ${result.brand}'s site directly` : "Treat links to this domain as untrusted");
@@ -2496,7 +3423,7 @@ ${html.slice(0, 1e5)}`)) {
   if (from) {
     const fromRoot = session.originalFromAddressRootDomain;
     const name = typeof from.name === "string" ? from.name.toLowerCase() : "";
-    const claimed = name.match(/[\p{L}\p{N}._%+-]+@([\p{L}\p{N}-]+(?:\.[\p{L}\p{N}-]+)+)/u);
+    const claimed = name.match(NAMED_ADDRESS);
     if (claimed && registrableDomain(claimed[1]) !== fromRoot) {
       hit("FROM_NAME_OTHER_ADDRESS", 2.5, `Display name shows ${claimed[0]} but the message is from ${from.address}`, "SPOOFING");
     }
@@ -2881,7 +3808,7 @@ function resolveConfig(options = {}, env = process.env) {
   if (!baseUrl) {
     throw new TypeError(`LLM provider "${providerName}" needs a base URL (baseUrl, or host and port)`);
   }
-  baseUrl = baseUrl.replace(/\/+$/, "");
+  baseUrl = trimEndOf(baseUrl, "/");
   const model = options.model || preset.model;
   if (!model && preset.api !== "classifier") {
     throw new TypeError(`LLM provider "${providerName}" needs a model name`);
@@ -2992,18 +3919,59 @@ function authHeaders(config) {
   return headers;
 }
 var REDACTIONS = [
-  [/[\p{L}\p{N}._%+-]+@([\p{L}\p{N}-]+(?:\.[\p{L}\p{N}-]+)+)/gu, "[email]@$1"],
-  [/\b(?:\d[ -]?){13,19}\b/g, "[number]"],
-  [/(?:\+|00)\d[\d\s().-]{7,}\d/g, "[phone]"],
-  [/\b\d{3}-\d{2}-\d{4}\b/g, "[number]"],
-  [/([?&][^=\s&#]+=)[^\s&#]+/g, "$1[redacted]"]
+  [linear(ADDRESS_SOURCE, "gu"), "[email]@$1"],
+  [linear(String.raw`\b(?:\d[ -]?){13,19}\b`, "g"), "[number]"],
+  [linear(String.raw`(?:\+|00)\d[\d\s().-]{7,}\d`, "g"), "[phone]"],
+  [linear(String.raw`\b\d{3}-\d{2}-\d{4}\b`, "g"), "[number]"],
+  [linear(String.raw`([?&][^=\s&#]{1,256}=)[^\s&#]+`, "g"), "$1[redacted]"]
 ];
+var THINK_OPEN = linear(`<${caseless("think")}>`, "g");
+var THINK_CLOSE = linear(String.raw`<\/${caseless("think")}>`, "g");
+function withoutThinking(text) {
+  let out = "";
+  let from = 0;
+  THINK_OPEN.lastIndex = 0;
+  let open;
+  while ((open = THINK_OPEN.exec(text)) !== null) {
+    THINK_CLOSE.lastIndex = open.index + open[0].length;
+    const close = THINK_CLOSE.exec(text);
+    if (close === null) {
+      break;
+    }
+    out += text.slice(from, open.index);
+    from = close.index + close[0].length;
+    THINK_OPEN.lastIndex = from;
+  }
+  return out + text.slice(from);
+}
 function redact(text) {
   let out = text;
   for (const [pattern, replacement] of REDACTIONS) {
     out = out.replace(pattern, replacement);
   }
-  return out;
+  return withoutLocalParts(out);
+}
+var LOCAL_CHARACTER = /^[\p{L}\p{N}._%+-]$/u;
+function withoutLocalParts(text) {
+  let out = "";
+  let from = 0;
+  let at = text.indexOf("[email]@");
+  while (at !== -1) {
+    let start = at;
+    while (start > from) {
+      if (start - 2 >= from && LOCAL_CHARACTER.test(text.slice(start - 2, start))) {
+        start -= 2;
+      } else if (LOCAL_CHARACTER.test(text[start - 1])) {
+        start--;
+      } else {
+        break;
+      }
+    }
+    out += text.slice(from, start);
+    from = at;
+    at = text.indexOf("[email]@", at + 8);
+  }
+  return out + text.slice(from);
 }
 function addressList(field) {
   if (!field?.value) {
@@ -3025,7 +3993,8 @@ function describeMessage(mail, context = {}, options = {}) {
   if (context.authentication) {
     lines2.push(`Authentication: ${context.authentication}`);
   }
-  const links = (context.links || []).slice(0, 15);
+  const seen = /* @__PURE__ */ new Set();
+  const links = [...context.links || []].sort((a, b) => Number(isDeceptiveLink(b)) - Number(isDeceptiveLink(a))).filter((link) => !seen.has(link.url) && seen.add(link.url)).slice(0, 15);
   if (links.length > 0) {
     lines2.push("Links:");
     for (const link of links) {
@@ -3036,7 +4005,17 @@ function describeMessage(mail, context = {}, options = {}) {
   if (attachments.length > 0) {
     lines2.push(`Attachments: ${attachments.map((a) => `${a.filename || "unnamed"} (${a.contentType || "unknown type"})`).join(", ")}`);
   }
-  let body = typeof mail.text === "string" && mail.text.trim() ? mail.text : typeof mail.html === "string" ? mail.html.replaceAll(/<style[\s\S]*?<\/style>|<script[\s\S]*?<\/script>/gi, " ").replaceAll(/<[^>]+>/g, " ") : "";
+  if (context.hidden >= 200) {
+    lines2.push(`Hidden text: ${context.hidden} characters the message does not show`);
+  }
+  const read = Math.max(1e5, maxInputChars * 50);
+  let shown = typeof mail.text === "string" ? mail.text : "";
+  if (typeof context.text === "string") {
+    shown = context.text;
+  } else if (typeof mail.html === "string" && mail.html) {
+    shown = visibleText(mail.html.slice(0, read)).text;
+  }
+  let body = readableText(shown.slice(0, read));
   body = body.replaceAll(/[ \t]+/g, " ").replaceAll(/\n\s*\n+/g, "\n\n").trim();
   let text = `${lines2.join("\n")}
 
@@ -3087,7 +4066,8 @@ function objectEnd(text, start) {
   return -1;
 }
 function* jsonObjects(text) {
-  for (let start = text.indexOf("{"); start !== -1; start = text.indexOf("{", start + 1)) {
+  let starts = 0;
+  for (let start = text.indexOf("{"); start !== -1 && starts++ < 64; start = text.indexOf("{", start + 1)) {
     const end = objectEnd(text, start);
     if (end !== -1) {
       yield text.slice(start, end + 1);
@@ -3098,7 +4078,7 @@ function parseVerdict(text) {
   if (typeof text !== "string") {
     return null;
   }
-  const visible = text.replaceAll(/<think>[\s\S]*?<\/think>/gi, "");
+  const visible = withoutThinking(text).slice(0, 2e4);
   for (const candidate of jsonObjects(visible)) {
     try {
       const result = normalizeVerdict(JSON.parse(candidate));
@@ -3444,7 +4424,7 @@ import {
   writeFileSync,
   mkdirSync
 } from "node:fs";
-import { createRequire } from "node:module";
+import { createRequire as createRequire2 } from "node:module";
 import path from "node:path";
 import process2 from "node:process";
 import { fileURLToPath } from "node:url";
@@ -3469,7 +4449,7 @@ function embeddedModel(sea = loadSea()) {
     return null;
   }
 }
-function loadSea(load = createRequire(import.meta.url)) {
+function loadSea(load = createRequire2(import.meta.url)) {
   try {
     return load("node:sea");
   } catch {
@@ -3868,7 +4848,7 @@ function scoreResults(results = {}, options = {}) {
 var package_default = {
   name: "spamscanner",
   description: "Spam, phishing and malware filter for email in any language: a trainable classifier, link and attachment checks, SPF/DKIM/DMARC, and an optional AI second opinion from any LLM, including local Ollama models. Works as a library, CLI, Postfix milter or HTTP API.",
-  version: "7.0.1",
+  version: "7.0.3",
   author: "Forward Email (https://forwardemail.net)",
   bin: {
     spamscanner: "./dist/esm/cli.js"
@@ -3971,6 +4951,9 @@ var package_default = {
   license: "BUSL-1.1",
   main: "./dist/cjs/index.cjs",
   module: "./dist/esm/index.js",
+  optionalDependencies: {
+    re2: "^1.22.1"
+  },
   packageManager: "pnpm@10.34.6",
   repository: {
     type: "git",
@@ -5333,6 +6316,7 @@ function mergeLegacyOptions(options) {
   }
   return config;
 }
+var MAX_LOOKALIKE_HOSTS = 1e3;
 var SpamScanner = class {
   /**
    * @param {object} [options] - see DEFAULTS
@@ -5481,28 +6465,22 @@ var SpamScanner = class {
   async scanFile(file, options) {
     return this.scan(await readFile(file), options);
   }
-  async checkLinks(links, config) {
+  async checkLinks(links, config, hosts = []) {
     const phishing = [];
     const homographs = [];
     const seenHosts = /* @__PURE__ */ new Set();
-    for (const link of links) {
-      if (isDeceptiveLink(link)) {
-        phishing.push(finding({
-          type: "deceptive_link",
-          url: link.url,
-          text: link.text,
-          message: `A link shows "${link.text}" but goes to ${link.host}`
-        }));
-      }
-      if (seenHosts.has(link.host)) {
-        continue;
+    const analysed = /* @__PURE__ */ new Set();
+    const lookalike = (host, extra) => {
+      if (analysed.has(host) || analysed.size >= MAX_LOOKALIKE_HOSTS) {
+        return;
       }
-      seenHosts.add(link.host);
-      const analysis = this.homograph.detectHomographAttack(link.host);
-      if (analysis.riskScore >= 0.5) {
+      analysed.add(host);
+      const analysis = this.homograph.detectHomographAttack(host);
+      const counts = extra.source === "text" ? analysis.riskScore >= 0.95 || analysis.riskScore >= 0.85 && analysis.brand.length >= 5 : analysis.riskScore >= 0.5;
+      if (counts) {
         const item = finding({
           type: "homograph",
-          url: link.url,
+          ...extra,
           domain: analysis.domain,
           unicode: analysis.unicode,
           brand: analysis.brand,
@@ -5514,11 +6492,28 @@ var SpamScanner = class {
         phishing.push(item);
         homographs.push(item);
       }
+    };
+    for (const link of links) {
+      if (isDeceptiveLink(link)) {
+        phishing.push(finding({
+          type: "deceptive_link",
+          url: link.url,
+          text: link.text,
+          message: `A link shows "${link.text}" but goes to ${link.host}`
+        }));
+      }
+      seenHosts.add(link.host);
+    }
+    for (const link of [...links.filter((link2) => link2.text), ...links.filter((link2) => !link2.text)]) {
+      lookalike(link.host, { url: link.url });
+    }
+    for (const host of hosts) {
+      lookalike(host, { source: "text" });
     }
-    const hosts = [...seenHosts].slice(0, config.phishing.maxHosts);
-    const domains = [...new Set(hosts.map((host) => registrableDomain(host)))];
+    const checked = [...seenHosts].slice(0, config.phishing.maxHosts);
+    const domains = [...new Set(checked.map((host) => registrableDomain(host)))];
     const [blocked, listed] = await Promise.all([
-      config.phishing.cloudflare && hosts.length > 0 ? withTimeout(this.dns.checkCloudflare(hosts, { adult: config.phishing.adult }), config.timeout, []) : [],
+      config.phishing.cloudflare && checked.length > 0 ? withTimeout(this.dns.checkCloudflare(checked, { adult: config.phishing.adult }), config.timeout, []) : [],
       config.dnsbl.domain?.length > 0 && domains.length > 0 ? withTimeout(this.dns.checkDomains(domains, config.dnsbl.domain), config.timeout, []) : []
     ]);
     for (const { host, category } of blocked) {
@@ -5532,7 +6527,7 @@ var SpamScanner = class {
         message: `Link domain ${value} is listed in ${zone}`
       }));
     }
-    return { phishing, homographs };
+    return { phishing, homographs, uncheckedHosts: seenHosts.size - checked.length };
   }
   async scanViruses(mail, config) {
     const settings = config.clamav === true ? {} : config.clamav;
@@ -5604,6 +6599,10 @@ var SpamScanner = class {
    * @param {object} [options.session] - what the receiving server knows:
    *   remoteAddress (client IP), resolvedClientHostname (verified reverse
    *   DNS), helo, and envelope { mailFrom: {address}, rcptTo: [{address}] }
+   * @param {object} [options.authenticationResults] - SPF, DKIM, DMARC and
+   *   ARC results the receiving server already has, as mailauth's
+   *   authenticate() gives them ({spf, dkim: {results}, dmarc, arc}): scored
+   *   as if checked here, without checking again
    * @returns {Promise<object>} isSpam, score, threshold, action ("accept",
    *   "tag" or "reject"), message, tests, results (per detector), links,
    *   language, tokens, mail and metrics
@@ -5622,13 +6621,12 @@ var SpamScanner = class {
     const { raw, mail } = await this.parse(source);
     const extracted = this.getFeatures(mail);
     const classification = this.getClassification(extracted.features);
-    const body = segmentWords(`${mail.subject || ""}
+    const obfuscation = obfuscationOf(`${mail.subject || ""}
 ${typeof mail.text === "string" ? mail.text : ""}`, { maxLength: config.maxLength });
-    const obfuscation = { invisible: body.invisible, mixed: body.mixed, styled: body.styled };
     const attachments = config.attachments === false ? [] : inspectAttachments(mail.attachments).filter((item) => config.macros !== false || !["macro", "pdf_active", "rtf_object"].includes(item.type)).map((item) => finding(item));
     const [links, authentication, reputation, dnsbl, viruses, toxicity, nsfw] = await Promise.all([
-      this.checkLinks(extracted.links, config),
-      config.authentication && session.remoteAddress ? authenticate(raw, {
+      this.checkLinks(extracted.links, config, extracted.hosts),
+      config.authenticationResults && typeof config.authenticationResults === "object" ? normalizeAuthOutput(config.authenticationResults) : config.authentication && session.remoteAddress ? authenticate(raw, {
         ip: session.remoteAddress,
         helo: session.helo,
         sender: session.envelope?.mailFrom?.address,
@@ -5677,7 +6675,12 @@ ${typeof mail.text === "string" ? mail.text : ""}`, { maxLength: config.maxLengt
       const close = scored.score >= low && scored.score < high;
       if (mode === "always" || mode === "auto" && (close || classification.category === "unsure" || classification.category === "disabled")) {
         try {
-          results.llm = await llm.classify(mail, { links: extracted.links, authentication: authentication ? summarizeAuth(authentication) : null });
+          results.llm = await llm.classify(mail, {
+            links: extracted.links,
+            text: extracted.text,
+            hidden: extracted.hidden,
+            authentication: authentication ? summarizeAuth(authentication) : null
+          });
         } catch (error) {
           debug2("LLM check failed: %s", error.message);
           results.llm = {
@@ -5711,6 +6714,8 @@ ${typeof mail.text === "string" ? mail.text : ""}`, { maxLength: config.maxLengt
         // Grouped as in earlier versions.
         executables: attachments.filter((item) => ["executable", "disguised_executable", "double_extension", "rtl_override", "executable_in_archive"].includes(item.type)),
         macros: attachments.filter((item) => ["macro", "pdf_active", "rtf_object"].includes(item.type)),
+        // Link hosts beyond phishing.maxHosts, which were not looked up.
+        uncheckedHosts: links.uncheckedHosts,
         idnHomographAttack: {
           detected: links.homographs.length > 0,
           domains: links.homographs,