spamscanner 7.0.11 → 7.0.13

package/dist/cjs/index.cjs

@@ -1784,7 +1784,7 @@ var init_entities = __esm({
       ",itilde=129,iukcy=456,iuml=ef,jcirc=135,jcy=439,jfr=1d527,jmath=237,jopf=1d55b,jscr=1d4bf,jsercy=458",
       ",jukcy=454,kappa=3ba,kappav=3f0,kcedil=137,kcy=43a,kfr=1d528,kgreen=138,khcy=445,kjcy=45c,kopf=1d55c",
       ",kscr=1d4c0,lAarr=21da,lArr=21d0,lAtail=291b,lBarr=290e,lE=2266,lEg=2a8b,lHar=2962,lacute=13a,laempt",
-      "yv=29b4,lagran=2112,lambda=3bb,lang=2329,langd=2991,langle=27e8,lap=2a85,laquo=ab,larr=2190,larrb=21",
+      "yv=29b4,lagran=2112,lambda=3bb,lang=27e8,langd=2991,langle=27e8,lap=2a85,laquo=ab,larr=2190,larrb=21",
       "e4,larrbfs=291f,larrfs=291d,larrhk=21a9,larrlp=21ab,larrpl=2939,larrsim=2973,larrtl=21a2,lat=2aab,la",
       "tail=2919,late=2aad,lates=2aad.fe00,lbarr=290c,lbbrk=2772,lbrace=7b,lbrack=5b,lbrke=298b,lbrksld=298",
       "f,lbrkslu=298d,lcaron=13e,lcedil=13c,lceil=2308,lcub=7b,lcy=43b,ldca=2936,ldquo=201c,ldquor=201e,ldr",
@@ -1842,7 +1842,7 @@ var init_entities = __esm({
       "line=2312,profsurf=2313,prop=221d,propto=221d,prsim=227e,prurel=22b0,pscr=1d4c5,psi=3c8,puncsp=2008,",
       "qfr=1d52e,qint=2a0c,qopf=1d562,qprime=2057,qscr=1d4c6,quaternions=210d,quatint=2a16,quest=3f,questeq",
       "=225f,quot=22,rAarr=21db,rArr=21d2,rAtail=291c,rBarr=290f,rHar=2964,race=223d.331,racute=155,radic=2",
-      "21a,raemptyv=29b3,rang=232a,rangd=2992,range=29a5,rangle=27e9,raquo=bb,rarr=2192,rarrap=2975,rarrb=2",
+      "21a,raemptyv=29b3,rang=27e9,rangd=2992,range=29a5,rangle=27e9,raquo=bb,rarr=2192,rarrap=2975,rarrb=2",
       "1e5,rarrbfs=2920,rarrc=2933,rarrfs=291e,rarrhk=21aa,rarrlp=21ac,rarrpl=2945,rarrsim=2974,rarrtl=21a3",
       ",rarrw=219d,ratail=291a,ratio=2236,rationals=211a,rbarr=290d,rbbrk=2773,rbrace=7d,rbrack=5d,rbrke=29",
       "8c,rbrksld=298e,rbrkslu=2990,rcaron=159,rcedil=157,rceil=2309,rcub=7d,rcy=440,rdca=2937,rdldhar=2969",
@@ -2697,6 +2697,31 @@ function continuesName(text, index) {
   }
   return (text[index - 1] === "." || text[index - 1] === "-") && NAME_END.test(text.slice(Math.max(0, index - 3), index - 1));
 }
+function boundedUrl(address2) {
+  const text = String(address2).replaceAll(/[\t\n\r]/g, "");
+  const colon = text.indexOf(":");
+  let start = colon === -1 ? 0 : colon + 1;
+  while (start < text.length && (text[start] === "/" || text[start] === "\\")) {
+    start++;
+  }
+  AUTHORITY_END.lastIndex = start;
+  const end = AUTHORITY_END.exec(text)?.index ?? text.length;
+  const file = /^[\0- ]*file:/i.test(text);
+  const at = file ? start : Math.max(start, text.lastIndexOf("@", end - 1) + 1);
+  const bracket = text.lastIndexOf("]", end - 1);
+  const port = text.lastIndexOf(":", end - 1);
+  let host = text.slice(at, !file && port > Math.max(at - 1, bracket) ? port : end);
+  if (host.length > MAX_URL_HOST && host.includes("%")) {
+    try {
+      host = decodeURIComponent(host);
+    } catch {
+    }
+  }
+  if (host.length > MAX_URL_HOST && host.replaceAll(IGNORED_IN_HOST, "").length > MAX_URL_HOST) {
+    throw new TypeError("Invalid URL: host too long");
+  }
+  return new URL(text);
+}
 function isClickTracker(url) {
   const host = url.hostname.toLowerCase();
   return CLICK_TRACKERS.some((domain) => isUnder(host, domain)) || host === "substack.com" && url.pathname.startsWith("/redirect/");
@@ -2723,7 +2748,7 @@ function gatewayTarget(url) {
 function unwrapLink(address2) {
   let url;
   try {
-    url = new URL(address2);
+    url = boundedUrl(address2);
   } catch {
     return null;
   }
@@ -2734,7 +2759,7 @@ function unwrapLink(address2) {
     }
     let next;
     try {
-      next = new URL(target);
+      next = boundedUrl(target);
     } catch {
       break;
     }
@@ -2996,7 +3021,7 @@ function extractLinks(text, html2, { maxLength = 5e5, bareHosts: bareHosts2 = fa
     }
     let url;
     try {
-      url = new URL(href);
+      url = boundedUrl(href);
     } catch {
       return;
     }
@@ -3309,7 +3334,7 @@ function isDeceptiveLink(link, { from } = {}) {
   }
   let shownUrl;
   try {
-    shownUrl = new URL(/^https?:\/\//i.test(link.text) ? link.text : `http://${link.text}`);
+    shownUrl = boundedUrl(/^https?:\/\//i.test(link.text) ? link.text : `http://${link.text}`);
   } catch {
     return false;
   }
@@ -3667,7 +3692,7 @@ ${body}`);
     hidden: visible.hidden
   };
 }
-var import_tldts2, INVISIBLE, OBFUSCATING, JOINERS, INVISIBLE_OR_JOINER, ZERO_WIDTH_SPACE, ZERO_WIDTH_JOINERS, LATIN_END, LATIN_START, ZWSP_SCRIPTS, ZWSP_SCRIPT_END, ZWSP_SCRIPT_START, SOFT_HYPHEN, BIDI, RIGHT_TO_LEFT, LETTER_END, LETTER_START, DIGIT_END, DIGIT_START, STYLED_LETTERS, WIDE_LETTERS, CJK, LOOKALIKES, UNIT_LETTERS, UNIT_WORD, LEET, LEET_DIGITS, UNSPACED, URL_PATTERN, EMAIL_SOURCE, EMAIL_PATTERN, PHONE_PATTERN, IP_PATTERN, MONEY_PATTERN, BITCOIN_PATTERN, CARD_PATTERN, ANCHOR_START, MAX_LINK_TEXT, MAX_URL, SHOWN_URL, IMG_PIXEL, IMG, BARE_HOST, MAX_BARE_HOSTS, NAME_END, FILE_TLDS, LINK_FILE_TLDS, CLICK_TRACKERS, isUnder, MAX_GATEWAYS, BRAND_NAMES, SHORTENERS, FREEMAIL, segmenters, LATIN_LOOKALIKES, LATIN, CYRILLIC_OR_GREEK, INLINE_TAG, HOST_CHAR, MAX_SHOWN_HTML, IN_WORD, MAX_BARE_NAME, LINKED_BRANDS, SIGN_IN_PART, signInPath, SENDING_DOMAINS, ADDRESS_SOURCE, NAMED_ADDRESS, MIN_SHOWN_WORDS, PART_WORD;
+var import_tldts2, INVISIBLE, OBFUSCATING, JOINERS, INVISIBLE_OR_JOINER, ZERO_WIDTH_SPACE, ZERO_WIDTH_JOINERS, LATIN_END, LATIN_START, ZWSP_SCRIPTS, ZWSP_SCRIPT_END, ZWSP_SCRIPT_START, SOFT_HYPHEN, BIDI, RIGHT_TO_LEFT, LETTER_END, LETTER_START, DIGIT_END, DIGIT_START, STYLED_LETTERS, WIDE_LETTERS, CJK, LOOKALIKES, UNIT_LETTERS, UNIT_WORD, LEET, LEET_DIGITS, UNSPACED, URL_PATTERN, EMAIL_SOURCE, EMAIL_PATTERN, PHONE_PATTERN, IP_PATTERN, MONEY_PATTERN, BITCOIN_PATTERN, CARD_PATTERN, ANCHOR_START, MAX_LINK_TEXT, MAX_URL, SHOWN_URL, IMG_PIXEL, IMG, BARE_HOST, MAX_BARE_HOSTS, NAME_END, FILE_TLDS, LINK_FILE_TLDS, CLICK_TRACKERS, MAX_URL_HOST, AUTHORITY_END, IGNORED_IN_HOST, isUnder, MAX_GATEWAYS, BRAND_NAMES, SHORTENERS, FREEMAIL, segmenters, LATIN_LOOKALIKES, LATIN, CYRILLIC_OR_GREEK, INLINE_TAG, HOST_CHAR, MAX_SHOWN_HTML, IN_WORD, MAX_BARE_NAME, LINKED_BRANDS, SIGN_IN_PART, signInPath, SENDING_DOMAINS, ADDRESS_SOURCE, NAMED_ADDRESS, MIN_SHOWN_WORDS, PART_WORD;
 var init_tokenizer = __esm({
   "src/tokenizer.js"() {
     import_tldts2 = require("tldts");
@@ -3773,6 +3798,9 @@ var init_tokenizer = __esm({
     FILE_TLDS = /* @__PURE__ */ new Set(["ai", "app", "md", "mov", "pm", "ps", "py", "rs", "sh", "so", "zip"]);
     LINK_FILE_TLDS = /* @__PURE__ */ new Set(["md", "mov", "pm", "ps", "py", "rs", "sh", "so", "zip"]);
     CLICK_TRACKERS = ["sendgrid.net", "list-manage.com", "mandrillapp.com", "awstrack.me", "pstmrk.it", "hubspotlinks.com", "rs6.net", "klclick.com", "mjt.lu", "exacttarget.com", "convertkit-mail.com", "convertkit-mail2.com", "kit-mail3.com", "sendibt2.com", "sendibt3.com", "createsend1.com", "cmail20.com", "clicks.mlsend.com", "acemlnb.com", "link.mail.beehiiv.com", "bhclick.com", "safelinks.protection.outlook.com", "urldefense.com", "urldefense.proofpoint.com", "mimecast.com", "mimecastprotect.com", "cudasvc.com", "secure-web.cisco.com"];
+    MAX_URL_HOST = 4096;
+    AUTHORITY_END = /[/\\?#]/g;
+    IGNORED_IN_HOST = /[\u00AD\u034F\u180B-\u180D\u180F\u200B\u2060\u2064\uFE00-\uFE0F\uFEFF]|\uD82F[\uDCA0-\uDCA3]|\uDB40[\uDD00-\uDDEF]/g;
     isUnder = (host, domain) => host === domain || host.endsWith(`.${domain}`);
     MAX_GATEWAYS = 16;
     BRAND_NAMES = new Set(BRANDS);
@@ -4612,7 +4640,7 @@ async function parseWithin(raw, parse = parseMessage, deadline = Date.now() + PA
   }
 }
 async function expandAttachments(attachments = [], errors = [], parse = parseMessage, gets = {}) {
-  const { unopened = [], mails = [] } = Array.isArray(gets) ? { unopened: gets } : gets;
+  const { unopened = [], mails = [] } = Array.isArray(gets) ? { unopened: gets } : gets ?? {};
   const all = [];
   const deadline = Date.now() + PARSE_TIMEOUT;
   let budget = MAX_NESTED_BYTES;
@@ -4761,6 +4789,10 @@ var init_parse = __esm({
 });
 
 // src/dnsbl.js
+function lastLabels(name) {
+  const separators = [...name.matchAll(LABEL_SEPARATOR)];
+  return separators.length < 128 ? 0 : separators.at(-128).index + 1;
+}
 function lookupName(host) {
   if (typeof host !== "string") {
     return null;
@@ -4771,6 +4803,7 @@ function lookupName(host) {
   }
   let name = host.slice(0, end).toLowerCase();
   if (/[\u0080-\u{10FFFF}]/u.test(name)) {
+    name = name.slice(lastLabels(name));
     name = (0, import_node_url2.domainToASCII)(name) || name;
   }
   if ((0, import_node_net.isIP)(name.replaceAll(/^\[|]$/g, "")) !== 0) {
@@ -4870,7 +4903,7 @@ function isListedAnswer(address2, zone) {
   }
   return true;
 }
-var import_node_dns, import_node_net, import_node_url2, import_tldts3, LOOKUP_LABEL, CLOUDFLARE_MALWARE, CLOUDFLARE_FAMILY, DnsChecker;
+var import_node_dns, import_node_net, import_node_url2, import_tldts3, LOOKUP_LABEL, LABEL_SEPARATOR, CLOUDFLARE_MALWARE, CLOUDFLARE_FAMILY, DnsChecker;
 var init_dnsbl = __esm({
   "src/dnsbl.js"() {
     import_node_dns = __toESM(require("node:dns"), 1);
@@ -4878,6 +4911,7 @@ var init_dnsbl = __esm({
     import_node_url2 = require("node:url");
     import_tldts3 = require("tldts");
     LOOKUP_LABEL = /^[a-z\d_-]{1,63}$/;
+    LABEL_SEPARATOR = /[.\u3002\uFF0E\uFF61]/g;
     CLOUDFLARE_MALWARE = ["1.1.1.2", "1.0.0.2"];
     CLOUDFLARE_FAMILY = ["1.1.1.3", "1.0.0.3"];
     DnsChecker = class {
@@ -5117,7 +5151,7 @@ function asciiHostname(value) {
     return null;
   }
   const lower = value.normalize("NFKC").toLowerCase().replace(/\.$/, "");
-  if (lower === "" || /[\0-,/:-^`{-\u007F]/.test(lower)) {
+  if (lower === "" || lower.length > 1024 || /[\0-,/:-^`{-\u007F]/.test(lower)) {
     return null;
   }
   const ascii = (0, import_node_url3.domainToASCII)(lower);
@@ -5190,8 +5224,8 @@ function trustReputation(result, trusted = []) {
   for (const value of result.checkedValues.filter((item) => allowed.has(item))) {
     const signers = allowed.get(value);
     const counts = (entry) => Boolean(entry) && (signers === null || signers.some((signer) => vouches(normalizeEntry(entry), signer)));
-    const detail = result.details[value];
-    const listed = result.allowlisted[value] || (detail?.isAllowlisted ? detail.allowlistValue : null);
+    const detail = Object.hasOwn(result.details, value) ? result.details[value] : void 0;
+    const listed = Object.hasOwn(result.allowlisted, value) && result.allowlisted[value] || (detail?.isAllowlisted ? detail.allowlistValue : null);
     if (counts(listed) && !out.isAllowlisted) {
       out.isAllowlisted = true;
       out.allowlistValue = listed;
@@ -6234,7 +6268,7 @@ function urlOf(value) {
     return null;
   }
   try {
-    return new URL(href);
+    return boundedUrl(href);
   } catch {
     return null;
   }
@@ -6324,7 +6358,23 @@ function* attributesOf(html2) {
     TAG_START.lastIndex = Math.max(i, match.index + 1);
   }
 }
-function linksOf(name, value, add, embed) {
+function isCut(value) {
+  if (value.length <= MAX_VALUE2) {
+    return false;
+  }
+  let references = 0;
+  for (let index = value.indexOf("&"); index !== -1; index = value.indexOf("&", index + 1)) {
+    if (++references > MAX_REFERENCES) {
+      return true;
+    }
+  }
+  return false;
+}
+function linksOf(name, value, { add, embed, cut }) {
+  if (isCut(value)) {
+    cut();
+    value = value.slice(0, MAX_VALUE2);
+  }
   const decoded = decodeEntities(value, { attribute: true });
   switch (name) {
     case "srcdoc": {
@@ -6363,7 +6413,7 @@ function linksOf(name, value, add, embed) {
     }
   }
 }
-function lenientLinks(html2, add, done, embed) {
+function lenientLinks(html2, done, reader) {
   LENIENT.lastIndex = 0;
   let match;
   while (!done() && (match = LENIENT.exec(html2)) !== null) {
@@ -6379,8 +6429,8 @@ function lenientLinks(html2, add, done, embed) {
       }
       if (end < html2.length && html2[end] !== quote) {
         const close = html2.indexOf(quote, end);
-        if (close !== -1 && close - i <= MAX_LENIENT_VALUE) {
-          linksOf(name, html2.slice(i, close), add, embed);
+        if (close !== -1 && close - i <= MAX_LENIENT_VALUE && !reader.spend(close - i)) {
+          linksOf(name, html2.slice(i, close), reader);
         }
       }
     } else {
@@ -6388,7 +6438,10 @@ function lenientLinks(html2, add, done, embed) {
         end++;
       }
     }
-    linksOf(name, html2.slice(i, end), add, embed);
+    if (reader.spend(end - i)) {
+      break;
+    }
+    linksOf(name, html2.slice(i, end), reader);
   }
 }
 function endsLink2(text, i) {
@@ -6559,8 +6612,17 @@ function* chunksOf(html2) {
         cutStart = false;
         continue;
       }
-      yield { text: html2.slice(start, end), cutStart, cutEnd: true };
-      start = end - CHUNK_OVERLAP;
+      let hard = end;
+      while (hard > start + CHUNK_OVERLAP + 1 && /[\dA-Za-z#]/.test(html2[hard - 1])) {
+        hard--;
+      }
+      if (hard < end && html2[hard - 1] === "&" && hard - 1 > start + CHUNK_OVERLAP) {
+        hard--;
+      } else {
+        hard = end;
+      }
+      yield { text: html2.slice(start, hard), cutStart, cutEnd: true };
+      start = hard - CHUNK_OVERLAP;
       cutStart = true;
       continue;
     }
@@ -6774,40 +6836,50 @@ function htmlDescriptions(text) {
   }
   return html2.join("\n");
 }
-function withoutBinaryValues(text) {
+function withoutBinaryValues(text, limit = Number.POSITIVE_INFINITY) {
   if (!/base64|binary|encoding\s*=\s*"?b|;\s*b\s*[;:]/i.test(text)) {
     return text;
   }
   const lines2 = text.split(LINE_BREAK);
   const out = [];
+  let length = 0;
+  const push = (line) => {
+    out.push(line);
+    length += line.length + 1;
+  };
   for (let i = 0; i < lines2.length; i++) {
+    if (length > limit) {
+      break;
+    }
     const line = lines2[i];
     const colon = valueColon(line);
     if (colon === -1 || !BINARY.test(line.slice(0, colon))) {
-      out.push(line);
+      push(line);
       continue;
     }
-    const value = [line.slice(colon + 1)];
+    let base64 = /^[\w+/=\s]*$/.test(line.slice(colon + 1));
     let next = i + 1;
     while (next < lines2.length && (lines2[next].startsWith(" ") || lines2[next].startsWith("	"))) {
-      value.push(lines2[next++]);
+      base64 &&= /^[\w+/=\s]*$/.test(lines2[next]);
+      next++;
     }
-    if (!value.every((part) => /^[\w+/=\s]*$/.test(part))) {
+    if (!base64) {
       for (let index = i; index < next; index++) {
-        out.push(lines2[index]);
+        push(lines2[index]);
       }
       i = next - 1;
       continue;
     }
     while (next < lines2.length && lines2[next] !== "" && /^[\w+/=]+$/.test(lines2[next])) {
-      value.push(lines2[next++]);
+      next++;
     }
+    const end = next;
     if (next < lines2.length && lines2[next] === "") {
       next++;
     }
-    i = next - 1;
     const name = line.slice(0, colon).split(";")[0].split(".").pop().trim().toLowerCase();
-    out.push(MEDIA_PROPERTIES.has(name) ? line.slice(0, colon + 1) : line.slice(0, colon + 1) + import_node_buffer7.Buffer.from(value.join("").replaceAll(/\s/g, ""), "base64").toString("utf8"));
+    push(MEDIA_PROPERTIES.has(name) ? line.slice(0, colon + 1) : line.slice(0, colon + 1) + import_node_buffer7.Buffer.from([line.slice(colon + 1), ...lines2.slice(i + 1, end)].join("").replaceAll(/\s/g, ""), "base64").toString("utf8"));
+    i = next - 1;
   }
   return out.join("\n");
 }
@@ -6841,58 +6913,75 @@ function charsetOf(attachment) {
   const charset = headers && typeof headers.get === "function" ? headers.get("content-type")?.params?.charset : null;
   return typeof charset === "string" ? charset.toLowerCase() : "";
 }
-function documentsOf(attachments, until) {
-  const documents = [];
+function kindOf(attachment) {
+  const { content } = attachment ?? {};
+  if (!import_node_buffer7.Buffer.isBuffer(content) || content.length === 0) {
+    return null;
+  }
+  const type = typeof attachment.contentType === "string" ? attachment.contentType.toLowerCase() : "";
+  const extensions = extensionsOf(attachment);
+  const has = (set) => [...extensions].some((name) => set.has(name));
+  if (MESSAGE_TYPES.has(type) || extensions.has("eml") || extensions.has("u8msg")) {
+    return null;
+  }
+  const isHtml = HTML_TYPES.has(type) || has(HTML_EXTENSIONS);
+  const isCard = !isHtml && (CARD_TYPES.has(type) || has(CARD_EXTENSIONS));
+  const isText = isCard || !isHtml && type === "text/plain";
+  return isHtml || isText ? { isHtml, isText, isCard } : null;
+}
+function* documentsOf(attachments, state, late) {
+  const read = [];
   let bytes = 0;
   let opened = 0;
   for (const attachment of attachments) {
-    const { content } = attachment ?? {};
-    if (!import_node_buffer7.Buffer.isBuffer(content) || content.length === 0) {
-      continue;
-    }
-    const type = typeof attachment.contentType === "string" ? attachment.contentType.toLowerCase() : "";
-    const extensions = extensionsOf(attachment);
-    const has = (set) => [...extensions].some((name) => set.has(name));
-    if (MESSAGE_TYPES.has(type) || extensions.has("eml") || extensions.has("u8msg")) {
-      continue;
-    }
-    const isHtml = HTML_TYPES.has(type) || has(HTML_EXTENSIONS);
-    const isCard = !isHtml && (CARD_TYPES.has(type) || has(CARD_EXTENSIONS));
-    const isText = isCard || !isHtml && type === "text/plain";
-    if (!isHtml && !isText) {
+    const kind = kindOf(attachment);
+    if (!kind) {
       continue;
     }
-    if (!isText && ++opened > MAX_ATTACHED || bytes + content.length > MAX_ATTACHED_BYTES) {
-      documents.tooComplex = true;
-      return documents;
+    if (!kind.isText && ++opened > MAX_ATTACHED || bytes + attachment.content.length > MAX_ATTACHED_BYTES) {
+      state.tooComplex = true;
+      break;
     }
-    if (Date.now() > until) {
-      documents.incomplete = true;
-      return documents;
+    bytes += attachment.content.length;
+    read.push({ attachment, kind });
+  }
+  for (const { attachment, kind: { isHtml, isCard } } of read) {
+    if (late()) {
+      state.incomplete = true;
+      return;
     }
-    bytes += content.length;
-    const text = decodeText(content, charsetOf(attachment));
+    const text = decodeText(attachment.content, charsetOf(attachment));
     if (isHtml) {
-      documents.push({ html: text });
+      yield { html: text };
       continue;
     }
     if (!isCard) {
-      documents.push({ text });
+      yield { text };
       continue;
     }
-    const readable = withoutBinaryValues(text);
+    let readable = withoutBinaryValues(text, MAX_CARD_TEXT);
+    if (readable.length > MAX_CARD_TEXT) {
+      state.tooComplex = true;
+      readable = readable.slice(0, MAX_CARD_TEXT);
+    }
     const full = readable.length <= MAX_SHOWN_BYTES;
     if (!full && hasQuotedPrintable(readable)) {
-      documents.tooComplex = true;
-      continue;
+      state.tooComplex = true;
+    }
+    if (late()) {
+      state.incomplete = true;
+      return;
+    }
+    yield { text: shownText(readable, full) };
+    if (late()) {
+      state.incomplete = true;
+      return;
     }
-    documents.push({ text: shownText(readable, full) });
     const html2 = htmlDescriptions(readable);
     if (html2 !== "") {
-      documents.push({ html: html2 });
+      yield { html: html2 };
     }
   }
-  return documents;
 }
 function carriedLinkHosts(mail, {
   mails = [],
@@ -6906,40 +6995,45 @@ function carriedLinkHosts(mail, {
   const seenBare = /* @__PURE__ */ new Set();
   const seenLoose = /* @__PURE__ */ new Set();
   let more = false;
-  let tooComplex = false;
-  const done = () => more;
-  const looseDone = () => more || loose.size > maxHosts;
+  let full = false;
+  const domains = /* @__PURE__ */ new Set();
+  const state = { tooComplex: false, incomplete: false };
+  const until = Date.now() + MAX_READ_TIME;
+  const late = () => {
+    if (!state.incomplete && Date.now() > until) {
+      state.incomplete = true;
+    }
+    return state.incomplete;
+  };
+  let calls = 0;
+  const done = () => full || state.incomplete || ++calls % LATE_EVERY === 0 && late();
+  const looseDone = () => done() || loose.size > maxHosts;
   const addLoose = (host) => {
     if (!looseDone()) {
       loose.add(host);
     }
   };
-  const until = Date.now() + MAX_READ_TIME;
-  let incomplete = false;
-  const late = () => {
-    if (!incomplete && Date.now() > until) {
-      incomplete = true;
-    }
-    return incomplete;
-  };
-  const carried = documentsOf(attachments, until);
-  tooComplex = Boolean(carried.tooComplex);
-  incomplete = Boolean(carried.incomplete);
-  const queue = [mail, ...mails, ...carried].map((document) => ({ document, depth: 0 }));
+  const queue = [mail, ...mails].map((document) => ({ document, depth: 0 }));
+  const carried = documentsOf(attachments, state, late);
   let depth = 0;
   let embedded = 0;
   let embeddedLength = 0;
+  const embeddedSeen = /* @__PURE__ */ new Set();
   const embed = (html2) => {
+    if (html2 === "" || embeddedSeen.has(html2)) {
+      return;
+    }
     if (depth >= MAX_EMBED_DEPTH || embedded >= MAX_EMBEDDED || embeddedLength + html2.length > MAX_EMBEDDED_LENGTH) {
-      tooComplex = true;
+      state.tooComplex = true;
       return;
     }
+    embeddedSeen.add(html2);
     embedded++;
     embeddedLength += html2.length;
     queue.push({ document: { html: html2 }, depth: depth + 1 });
   };
   const add = (value) => {
-    if (more || typeof value !== "string" || value === "" || seen.has(value)) {
+    if (full || typeof value !== "string" || value === "" || seen.has(value)) {
       return;
     }
     if (seen.size < MAX_SEEN) {
@@ -6954,34 +7048,64 @@ function carriedLinkHosts(mail, {
     }
     const found = hostsOf(value);
     if (found.unresolved) {
-      tooComplex = true;
+      state.tooComplex = true;
     }
     for (const host of found) {
       if (hosts.has(host)) {
         continue;
       }
-      if (hosts.size >= maxHosts) {
-        more = true;
+      const domain = registrableDomain(host);
+      if (hosts.size < maxHosts || !domains.has(domain) && domains.size < maxHosts) {
+        hosts.add(host);
+        domains.add(domain);
+        continue;
+      }
+      more = true;
+      if (domains.size >= maxHosts) {
+        full = true;
         return;
       }
-      hosts.add(host);
     }
   };
-  const readText = (source, { cutStart = false, cutEnd = false } = {}) => {
+  let spent = 0;
+  const spend = (length) => {
+    spent += length;
+    if (spent < LONG_VALUE) {
+      return false;
+    }
+    spent = 0;
+    return late();
+  };
+  const reader = {
+    add,
+    embed,
+    spend,
+    cut() {
+      state.tooComplex = true;
+    }
+  };
+  const readText = (source, { cutStart = false, cutEnd = false, exact = false } = {}) => {
     for (const match of source.matchAll(URL_START)) {
-      if (more) {
+      if (done()) {
         break;
       }
       if (cutStart && match.index === 0) {
         continue;
       }
       if (cutEnd && match.index + match[0].length === source.length) {
+        if (exact && source.length - match.index < CHUNK_OVERLAP) {
+          continue;
+        }
         const value = match[0];
         const at = /^www\./i.test(value) ? 0 : value.indexOf("//") + 2;
-        if (/[/?#\\]/.test(value.slice(at))) {
-          add(value);
-        } else if (source.length - match.index > CHUNK_OVERLAP) {
-          tooComplex = true;
+        if (!/[/?#\\]/.test(value.slice(at))) {
+          state.tooComplex = true;
+          continue;
+        }
+        add(value);
+        const url = urlOf(value);
+        if (url && isClickTracker(url)) {
+          state.tooComplex = true;
         }
         continue;
       }
@@ -7003,42 +7127,61 @@ function carriedLinkHosts(mail, {
       });
     }
   };
-  for (const element of queue) {
-    if (more || late()) {
+  for (let index = 0; ; index++) {
+    if (full || late()) {
       break;
     }
-    ({ depth } = element);
-    const { document } = element;
+    if (index >= queue.length) {
+      const next = carried.next();
+      if (next.done) {
+        break;
+      }
+      queue.push({ document: next.value, depth: 0 });
+    }
+    ({ depth } = queue[index]);
+    const { document } = queue[index];
     const html2 = withoutNul(typeof document?.html === "string" ? document.html : "");
     const text = withoutNul(typeof document?.text === "string" ? document.text : "");
     for (const [name, value] of attributesOf(html2)) {
-      if (more) {
+      if (done()) {
         break;
       }
-      if (LINK_ATTRIBUTES.has(name)) {
-        linksOf(name, value, add, embed);
+      if (!LINK_ATTRIBUTES.has(name)) {
+        continue;
+      }
+      if (spend(value.length)) {
+        break;
       }
+      linksOf(name, value, reader);
     }
-    lenientLinks(html2, add, done, embed);
+    lenientLinks(html2, done, reader);
     for (const pattern of [CSS_URL, CSS_IMPORT]) {
       for (const [, link] of html2.matchAll(pattern)) {
-        if (more) {
+        if (done() || spend(link.length)) {
           break;
         }
-        add(decodeEntities(link, { attribute: true }));
+        const cut = isCut(link);
+        if (cut) {
+          state.tooComplex = true;
+        }
+        add(decodeEntities(cut ? link.slice(0, MAX_VALUE2) : link, { attribute: true }));
       }
     }
-    if (!more) {
-      readText(text);
+    for (const chunk2 of chunksOf(text)) {
+      if (full || late()) {
+        break;
+      }
+      readText(chunk2.text, { ...chunk2, exact: true });
     }
     for (const chunk2 of chunksOf(html2)) {
-      if (more || late()) {
+      if (full || late()) {
         break;
       }
-      readText(decodeEntities(chunk2.text), chunk2);
+      const decoded = decodeEntities(chunk2.text);
+      readText(decoded, { ...chunk2, exact: decoded.endsWith(chunk2.text.slice(-CHUNK_OVERLAP)) });
     }
   }
-  if (!more && !incomplete) {
+  if (!more && !state.incomplete) {
     for (const name of loose) {
       if (hosts.size >= maxHosts) {
         break;
@@ -7052,11 +7195,11 @@ function carriedLinkHosts(mail, {
   return {
     hosts: [...hosts],
     more,
-    tooComplex,
-    incomplete
+    tooComplex: state.tooComplex,
+    incomplete: state.incomplete
   };
 }
-var import_node_buffer7, import_node_net4, import_tldts4, LINK_ATTRIBUTES, TAG_START, URL_START, CSS_URL, CSS_IMPORT, LENIENT, IN_WORD2, NAMESPACES, MAX_HOST, MAX_SEEN, TRAILING, DECODE_CHUNK, CHUNK_OVERLAP, MAX_EMBED_DEPTH, MAX_EMBEDDED, MAX_EMBEDDED_LENGTH, MAX_ATTACHED, MAX_ATTACHED_BYTES, MAX_READ_TIME, MAX_SHOWN_BYTES, MAX_LENIENT_VALUE, UNQUOTED_END, UTF16LE, UTF16BE, DATA_DOCUMENT, LINE_BREAK, FOLD, QUOTED_PRINTABLE, MEDIA_PROPERTIES, HTML_PROPERTIES, BINARY, HTML_TYPES, HTML_EXTENSIONS, CARD_TYPES, CARD_EXTENSIONS, MESSAGE_TYPES;
+var import_node_buffer7, import_node_net4, import_tldts4, LINK_ATTRIBUTES, TAG_START, URL_START, CSS_URL, CSS_IMPORT, LENIENT, IN_WORD2, NAMESPACES, MAX_HOST, MAX_SEEN, TRAILING, DECODE_CHUNK, CHUNK_OVERLAP, MAX_EMBED_DEPTH, MAX_EMBEDDED, MAX_EMBEDDED_LENGTH, MAX_ATTACHED, MAX_ATTACHED_BYTES, MAX_READ_TIME, MAX_SHOWN_BYTES, MAX_CARD_TEXT, MAX_VALUE2, MAX_REFERENCES, LONG_VALUE, MAX_LENIENT_VALUE, UNQUOTED_END, UTF16LE, UTF16BE, DATA_DOCUMENT, LINE_BREAK, FOLD, QUOTED_PRINTABLE, MEDIA_PROPERTIES, HTML_PROPERTIES, BINARY, HTML_TYPES, HTML_EXTENSIONS, CARD_TYPES, CARD_EXTENSIONS, MESSAGE_TYPES, LATE_EVERY;
 var init_links = __esm({
   "src/links.js"() {
     import_node_buffer7 = require("node:buffer");
@@ -7103,7 +7246,11 @@ var init_links = __esm({
     MAX_ATTACHED = 100;
     MAX_ATTACHED_BYTES = 50 * 1024 * 1024;
     MAX_READ_TIME = 5e3;
-    MAX_SHOWN_BYTES = 4 * 1024 * 1024;
+    MAX_SHOWN_BYTES = 1024 * 1024;
+    MAX_CARD_TEXT = 8 * 1024 * 1024;
+    MAX_VALUE2 = 1024 * 1024;
+    MAX_REFERENCES = 64 * 1024;
+    LONG_VALUE = 64 * 1024;
     MAX_LENIENT_VALUE = 4096;
     UNQUOTED_END = /* @__PURE__ */ new Set(["<", ">", '"', "'", "`", "="]);
     UTF16LE = /* @__PURE__ */ new Set(["csunicode", "iso-10646-ucs-2", "ucs-2", "unicode", "unicodefeff", "utf-16", "utf-16le"]);
@@ -7120,6 +7267,7 @@ var init_links = __esm({
     CARD_TYPES = /* @__PURE__ */ new Set(["text/calendar", "text/x-vcalendar", "application/ics", "text/vcard", "text/x-vcard", "text/directory"]);
     CARD_EXTENSIONS = /* @__PURE__ */ new Set(["ics", "ical", "ifb", "vcs", "vcf", "vcard"]);
     MESSAGE_TYPES = /* @__PURE__ */ new Set(["message/rfc822", "message/global"]);
+    LATE_EVERY = 1024;
   }
 });
 
@@ -8784,7 +8932,7 @@ var init_package = __esm({
     package_default = {
       name: "spamscanner",
       description: "Spam, phishing and malware filter for email in any language: a trainable classifier, link and attachment checks, SPF/DKIM/DMARC, and an optional AI second opinion from any LLM, including local Ollama models. Works as a library, CLI, Postfix milter or HTTP API.",
-      version: "7.0.11",
+      version: "7.0.13",
       author: "Forward Email (https://forwardemail.net)",
       bin: {
         spamscanner: "./dist/esm/cli.js"
@@ -9050,9 +9198,12 @@ function rewriteMessage(source, headers = [], options = {}) {
     }
   }
   const added = headers.map(([name, value]) => foldHeader(name, import_node_buffer9.Buffer.from(String(value), "utf8").toString("latin1"), newline));
-  const mbox = kept.length > 0 && kept[0][0].startsWith("From ") ? kept.shift() : [];
+  const mbox = kept.length > 0 && kept[0][0].startsWith("From ") ? kept.shift().slice(0, 1) : [];
+  if (kept.length > 0 && /^[ \t]/.test(kept[0][0])) {
+    kept.shift();
+  }
   const head = [...mbox, ...added, ...kept.map((field) => field.join(newline))].join(newline);
-  return import_node_buffer9.Buffer.concat([import_node_buffer9.Buffer.from(head === "" && header === "" ? newline : `${head}${newline}${newline}`, "latin1"), body]);
+  return import_node_buffer9.Buffer.concat([import_node_buffer9.Buffer.from(head === "" ? newline : `${head}${newline}${newline}`, "latin1"), body]);
 }
 var import_node_buffer9, ENCODED_BYTES, PLAIN_WORD, ENCODED_LINE, MAX_LINE2, ENCODED_WORD, ENCODED_START;
 var init_headers = __esm({
@@ -9414,7 +9565,12 @@ var init_train = __esm({
 
 // src/server.js
 function serializeResult(result, options = {}) {
-  const { mail, tokens, ...rest } = result;
+  const {
+    mail,
+    tokens,
+    attached,
+    ...rest
+  } = result;
   const output = {
     ...rest,
     results: { ...result.results }
@@ -10099,7 +10255,7 @@ function report(result) {
     "",
     " pts rule name              description",
     "---- ---------------------- --------------------------------------------------",
-    ...result.tests.map((test) => `${test.score.toFixed(1).padStart(4)} ${test.name.padEnd(22)} ${test.description}`)
+    ...result.tests.map((test) => `${test.score.toFixed(1).padStart(4)} ${oneLine2(test.name).padEnd(22)} ${oneLine2(test.description)}`)
   ];
   return `${lines2.join("\r\n")}\r
 `;
@@ -10245,7 +10401,7 @@ function createSpamdServer(scanner, options = {}) {
   server.maxConnections = settings.maxConnections;
   return server;
 }
-var import_node_buffer13, import_node_net7, EX_OK, EX_USAGE, EX_DATAERR, EX_SOFTWARE, EX_PROTOCOL, EX_NOPERM, COMMANDS2;
+var import_node_buffer13, import_node_net7, EX_OK, EX_USAGE, EX_DATAERR, EX_SOFTWARE, EX_PROTOCOL, EX_NOPERM, COMMANDS2, oneLine2;
 var init_spamd = __esm({
   "src/spamd.js"() {
     import_node_buffer13 = require("node:buffer");
@@ -10260,6 +10416,7 @@ var init_spamd = __esm({
     EX_PROTOCOL = 76;
     EX_NOPERM = 77;
     COMMANDS2 = /* @__PURE__ */ new Set(["CHECK", "SYMBOLS", "REPORT", "REPORT_IFSPAM", "PROCESS", "HEADERS", "PING", "SKIP", "TELL"]);
+    oneLine2 = (text) => String(text ?? "").replaceAll(/[\p{Cc}\u061C\u200E\u200F\u2028\u2029\u202A-\u202E\u2066-\u2069]+/gu, " ");
   }
 });
 
@@ -10824,7 +10981,7 @@ var init_src = __esm({
       // (`from`: the sender's domain; `carried`: the link hosts of the whole
       //  message and of what it carries, see carriedLinkHosts)
       async checkLinks(links, config, hosts = [], options = {}) {
-        const { from = "", carried = null } = typeof options === "string" ? { from: options } : options;
+        const { from = "", carried = null } = typeof options === "string" ? { from: options } : options ?? {};
         const phishing = [];
         const homographs = [];
         const seenHosts = /* @__PURE__ */ new Set();
@@ -10884,15 +11041,15 @@ var init_src = __esm({
         for (const host of carriedHosts) {
           seenHosts.add(host);
         }
-        const ordered = [.../* @__PURE__ */ new Set([...[...found.filter((link) => link.text), ...found.filter((link) => !link.text), ...bare].map((link) => lookupName(destination(link))).filter(Boolean), ...carriedHosts])];
+        const own3 = [...found.filter((link) => link.text), ...found.filter((link) => !link.text), ...bare].map((link) => lookupName(destination(link))).filter(Boolean);
         const firsts = /* @__PURE__ */ new Map();
-        for (const host of ordered) {
+        for (const host of [...own3, ...carriedHosts]) {
           const domain = registrableDomain(host);
           if (!firsts.has(domain)) {
             firsts.set(domain, host);
           }
         }
-        const checked = [.../* @__PURE__ */ new Set([...firsts.values(), ...ordered])].slice(0, config.phishing.maxHosts);
+        const checked = [.../* @__PURE__ */ new Set([...firsts.values(), ...own3, ...carriedHosts])].slice(0, config.phishing.maxHosts);
         const domains = [...new Set(checked.map((host) => registrableDomain(host)))];
         const blocked = [];
         let answered = 0;