spamscanner 7.0.6 → 7.0.8

package/dist/cjs/index.cjs

@@ -2541,6 +2541,9 @@ function unwrapLink(address2) {
   }
   for (let depth = 0; depth < 3; depth++) {
     const target = gatewayTarget(url);
+    if (!target) {
+      break;
+    }
     let next;
     try {
       next = new URL(target);
@@ -2787,13 +2790,15 @@ function endsInsideTag(html2, end, link) {
   const joined = trimEndOf(link.replace(/^https?:\/\//i, "") + after, ".-");
   return joined !== host && (!isHost(host) || isHost(joined) && registrableDomain(joined) !== registrableDomain(host));
 }
-function extractLinks(text, html2, { maxLength = 5e5 } = {}) {
+function extractLinks(text, html2, { maxLength = 5e5, bareHosts = false } = {}) {
   text = typeof text === "string" ? foldToAscii(text) : text;
   html2 = typeof html2 === "string" ? foldToAscii(html2) : html2;
   const links = [];
   const seen = /* @__PURE__ */ new Set();
+  const linkHosts = /* @__PURE__ */ new Set();
+  const bareFound = [];
   const names = /* @__PURE__ */ new Map();
-  const add = (raw, shown = null) => {
+  const add = (raw, shown = null, bare = false) => {
     let href = trimEndOf(trimControls(raw.replaceAll(/[\t\n\r]/g, "")).trim(), `).,;:!?'"]`);
     if (/^www\./i.test(href)) {
       href = `http://${href}`;
@@ -2817,11 +2822,13 @@ ${shown || ""}`;
     }
     seen.add(key);
     const host = url.hostname.toLowerCase().replace(/\.$/, "").replace(/^\[(.*)]$/, "$1");
+    linkHosts.add(host);
     links.push({
       url: url.href.slice(0, MAX_URL),
       host,
       text: shown,
-      userinfo: Boolean(url.username || url.password)
+      userinfo: Boolean(url.username || url.password),
+      ...bare && { bare: true }
     });
   };
   if (typeof html2 === "string" && html2) {
@@ -2850,10 +2857,90 @@ ${shown || ""}`;
         }
         add(link);
       }
+      if (bareHosts && index < 2) {
+        bareLinkHosts(read, (host) => {
+          bareFound.push(host);
+        });
+      }
+    }
+  }
+  for (const host of bareFound) {
+    if (!linkHosts.has(host)) {
+      add(`http://${host}/`, null, true);
     }
   }
   return links;
 }
+function isHostCode(code) {
+  return code >= 97 && code <= 122 || code >= 65 && code <= 90 || code >= 48 && code <= 57 || code === 45 || code === 46;
+}
+function endsLink(char) {
+  return /[\s<>"'\u0060]/u.test(char);
+}
+function bareLinkHosts(text, add) {
+  const found = /* @__PURE__ */ new Set();
+  let previous = -1;
+  let read = 0;
+  let space = -1;
+  let scheme = -1;
+  for (let slash = text.indexOf("/"); slash !== -1; slash = text.indexOf("/", slash + 1)) {
+    const floor = Math.max(previous + 1, slash - MAX_BARE_NAME);
+    previous = slash;
+    let end = slash;
+    while (end > floor && text.codePointAt(end - 1) >= 48 && text.codePointAt(end - 1) <= 57) {
+      end--;
+    }
+    end = end > floor && text[end - 1] === ":" ? end - 1 : slash;
+    let start = end;
+    while (start > floor && isHostCode(text.codePointAt(start - 1))) {
+      start--;
+    }
+    if (start === end || start > 0 && (text[start - 1] === "/" || IN_WORD.test(text[start - 1]))) {
+      continue;
+    }
+    for (; read < start; read++) {
+      if (endsLink(text[read])) {
+        space = read;
+      } else if (text[read] === "/" && text[read - 1] === "/" && text[read - 2] === ":") {
+        scheme = read;
+      }
+    }
+    if (scheme > space) {
+      continue;
+    }
+    while (end > start && text[end - 1] === ".") {
+      end--;
+    }
+    const labels = text.slice(start, end).split(".");
+    const tld = labels.pop();
+    if (!/^(?:[a-z]{2,24}|xn--[a-z\d-]{1,59})$/i.test(tld)) {
+      continue;
+    }
+    const parts = [];
+    while (labels.length > 0 && parts.length < 11) {
+      const label = labels.pop();
+      if (!/^[a-z\d-]{1,63}$/i.test(label)) {
+        break;
+      }
+      parts.unshift(label);
+    }
+    if (parts.length === 0) {
+      continue;
+    }
+    parts[0] = parts[0].replace(/^-+/, "");
+    if (!parts[0]) {
+      continue;
+    }
+    const host = `${parts.join(".")}.${tld}`.toLowerCase();
+    if (found.has(host)) {
+      continue;
+    }
+    found.add(host);
+    if (isHost(host)) {
+      add(host);
+    }
+  }
+}
 function hostOf(link) {
   const authority = link.replace(/^https?:\/\//i, "").split(/[/?#\\]/)[0];
   return trimEndOf(authority.slice(authority.lastIndexOf("@") + 1).replace(/:\d*$/, ""), `).,;:!?'"]`);
@@ -3392,7 +3479,7 @@ ${body}`);
     hidden: visible.hidden
   };
 }
-var import_tldts2, INVISIBLE, OBFUSCATING, JOINERS, INVISIBLE_OR_JOINER, ZERO_WIDTH_SPACE, ZERO_WIDTH_JOINERS, LATIN_END, LATIN_START, ZWSP_SCRIPTS, ZWSP_SCRIPT_END, ZWSP_SCRIPT_START, SOFT_HYPHEN, BIDI, RIGHT_TO_LEFT, LETTER_END, LETTER_START, DIGIT_END, DIGIT_START, STYLED_LETTERS, WIDE_LETTERS, CJK, LOOKALIKES, UNIT_LETTERS, UNIT_WORD, LEET, LEET_DIGITS, UNSPACED, URL_PATTERN, EMAIL_SOURCE, EMAIL_PATTERN, PHONE_PATTERN, IP_PATTERN, MONEY_PATTERN, BITCOIN_PATTERN, CARD_PATTERN, ANCHOR_START, MAX_LINK_TEXT, MAX_URL, SHOWN_URL, IMG_PIXEL, IMG, BARE_HOST, MAX_BARE_HOSTS, NAME_END, FILE_TLDS, LINK_FILE_TLDS, CLICK_TRACKERS, isUnder, BRAND_NAMES, SHORTENERS, FREEMAIL, segmenters, LATIN_LOOKALIKES, LATIN, CYRILLIC_OR_GREEK, INLINE_TAG, HOST_CHAR, MAX_SHOWN_HTML, LINKED_BRANDS, SIGN_IN_PART, signInPath, SENDING_DOMAINS, ADDRESS_SOURCE, NAMED_ADDRESS, MIN_SHOWN_WORDS, PART_WORD;
+var import_tldts2, INVISIBLE, OBFUSCATING, JOINERS, INVISIBLE_OR_JOINER, ZERO_WIDTH_SPACE, ZERO_WIDTH_JOINERS, LATIN_END, LATIN_START, ZWSP_SCRIPTS, ZWSP_SCRIPT_END, ZWSP_SCRIPT_START, SOFT_HYPHEN, BIDI, RIGHT_TO_LEFT, LETTER_END, LETTER_START, DIGIT_END, DIGIT_START, STYLED_LETTERS, WIDE_LETTERS, CJK, LOOKALIKES, UNIT_LETTERS, UNIT_WORD, LEET, LEET_DIGITS, UNSPACED, URL_PATTERN, EMAIL_SOURCE, EMAIL_PATTERN, PHONE_PATTERN, IP_PATTERN, MONEY_PATTERN, BITCOIN_PATTERN, CARD_PATTERN, ANCHOR_START, MAX_LINK_TEXT, MAX_URL, SHOWN_URL, IMG_PIXEL, IMG, BARE_HOST, MAX_BARE_HOSTS, NAME_END, FILE_TLDS, LINK_FILE_TLDS, CLICK_TRACKERS, isUnder, BRAND_NAMES, SHORTENERS, FREEMAIL, segmenters, LATIN_LOOKALIKES, LATIN, CYRILLIC_OR_GREEK, INLINE_TAG, HOST_CHAR, MAX_SHOWN_HTML, IN_WORD, MAX_BARE_NAME, LINKED_BRANDS, SIGN_IN_PART, signInPath, SENDING_DOMAINS, ADDRESS_SOURCE, NAMED_ADDRESS, MIN_SHOWN_WORDS, PART_WORD;
 var init_tokenizer = __esm({
   "src/tokenizer.js"() {
     import_tldts2 = require("tldts");
@@ -3515,6 +3602,8 @@ var init_tokenizer = __esm({
     INLINE_TAG = /^<\/?(?:abbr|b|bdi|bdo|big|cite|code|data|del|dfn|em|font|i|ins|kbd|mark|nobr|q|s|samp|small|span|strike|strong|sub|sup|time|tt|u|var|wbr)(?=[\t\n\f\r />])|^<!/i;
     HOST_CHAR = /[\p{L}\p{N}.-]/u;
     MAX_SHOWN_HTML = 2e5;
+    IN_WORD = /[\p{L}\p{N}\p{M}_%]/u;
+    MAX_BARE_NAME = 760;
     LINKED_BRANDS = /* @__PURE__ */ new Set(["airbnb", "aliexpress", "alibaba", "bestbuy", "booking", "costco", "discord", "ebay", "facebook", "github", "gitlab", "instagram", "linkedin", "roblox", "shopify", "skype", "spotify", "steam", "telegram", "tiktok", "twitter", "uber", "walmart", "whatsapp", "zoom"]);
     SIGN_IN_PART = /^(?:your|my|service|secure)?(?:login|logon|signin|signon|accounts?|verify|verification|security|secure|auth|authenticate|authorize|oauth2?|billing|password|recover|recovery|unlock|confirm|update|wallet|webscr)(?:verification|payment|info|help|page|\d{1,2})?$/;
     signInPath = (path4) => path4.toLowerCase().replaceAll(/\b(log|sign)-(in|on)\b/g, "$1$2").split(/[/?&=._-]/).some((part) => SIGN_IN_PART.test(part));
@@ -4314,24 +4403,38 @@ async function parseWithin(raw, parse = parseMessage, deadline = Date.now() + PA
     }
   }
 }
-async function expandAttachments(attachments = [], errors = [], parse = parseMessage) {
+async function expandAttachments(attachments = [], errors = [], parse = parseMessage, unopened = []) {
   const all = [];
   const deadline = Date.now() + PARSE_TIMEOUT;
   let budget = MAX_NESTED_BYTES;
   let nested = 0;
+  let tooMany = false;
   const visit = async (list, prefix, depth) => {
     for (const attachment of list) {
       if (prefix) {
         if (nested >= MAX_ATTACHMENTS) {
+          if (!tooMany) {
+            tooMany = true;
+            unopened.push({ filename: prefix, reason: `more than ${MAX_ATTACHMENTS} attachments in attached messages` });
+          }
           return;
         }
         nested++;
       }
       const name = attachment.filename || (prefix ? "unnamed attachment" : "");
+      const filename = prefix ? `${prefix}/${name}` : name || "attached message";
       all.push(prefix ? { ...attachment, filename: `${prefix}/${name}` } : attachment);
       const { content } = attachment;
       const attached = attachment.contentType === "message/rfc822" || /\.eml$/i.test(attachment.filename || "");
-      if (attached && depth < MAX_NESTED_DEPTH && import_node_buffer2.Buffer.isBuffer(content) && content.length <= budget) {
+      if (attached && import_node_buffer2.Buffer.isBuffer(content) && depth >= MAX_NESTED_DEPTH) {
+        unopened.push({ filename, reason: `nested more than ${MAX_NESTED_DEPTH} deep` });
+        continue;
+      }
+      if (attached && import_node_buffer2.Buffer.isBuffer(content) && content.length > budget) {
+        unopened.push({ filename, reason: `past ${MAX_NESTED_BYTES / 1024 / 1024} MB of attached messages` });
+        continue;
+      }
+      if (attached && import_node_buffer2.Buffer.isBuffer(content)) {
         budget -= content.length;
         let inner;
         try {
@@ -4441,12 +4544,39 @@ var init_parse = __esm({
 });
 
 // src/dnsbl.js
-function isLookupName(name) {
-  if (typeof name !== "string") {
-    return false;
+function lookupName(host) {
+  if (typeof host !== "string") {
+    return null;
+  }
+  let end = host.length;
+  while (end > 0 && host[end - 1] === ".") {
+    end--;
+  }
+  let name = host.slice(0, end).toLowerCase();
+  if (/[\u0080-\u{10FFFF}]/u.test(name)) {
+    name = (0, import_node_url2.domainToASCII)(name) || name;
+  }
+  if ((0, import_node_net.isIP)(name.replaceAll(/^\[|]$/g, "")) !== 0) {
+    return null;
+  }
+  const labels = name.split(".");
+  let start = labels.length;
+  let length = -1;
+  while (start > 0 && LOOKUP_LABEL.test(labels[start - 1]) && length + 1 + labels[start - 1].length <= 253) {
+    start--;
+    length += 1 + labels[start].length;
+  }
+  if (start === labels.length) {
+    return null;
   }
-  const host = name.replaceAll(/^\[|]$/g, "").replace(/\.$/, "");
-  return host !== "" && (0, import_node_net.isIP)(host) === 0 && host.length <= 253 && host.split(".").every((label) => label.length > 0 && label.length <= 63);
+  if (start === 0) {
+    return name;
+  }
+  const suffix = labels.slice(start).join(".");
+  if (start === labels.length - 1 || (0, import_tldts3.getPublicSuffix)(suffix, { allowPrivateDomains: true }) === suffix) {
+    return null;
+  }
+  return suffix;
 }
 function ipv6Groups(address2) {
   const expanded = address2.replace(/(\d+)\.(\d+)\.(\d+)\.(\d+)$/, (...match) => {
@@ -4523,11 +4653,14 @@ function isListedAnswer(address2, zone) {
   }
   return true;
 }
-var import_node_dns, import_node_net, CLOUDFLARE_MALWARE, CLOUDFLARE_FAMILY, DnsChecker;
+var import_node_dns, import_node_net, import_node_url2, import_tldts3, LOOKUP_LABEL, CLOUDFLARE_MALWARE, CLOUDFLARE_FAMILY, DnsChecker;
 var init_dnsbl = __esm({
   "src/dnsbl.js"() {
     import_node_dns = __toESM(require("node:dns"), 1);
     import_node_net = require("node:net");
+    import_node_url2 = require("node:url");
+    import_tldts3 = require("tldts");
+    LOOKUP_LABEL = /^[a-z\d_-]{1,63}$/;
     CLOUDFLARE_MALWARE = ["1.1.1.2", "1.0.0.2"];
     CLOUDFLARE_FAMILY = ["1.1.1.3", "1.0.0.3"];
     DnsChecker = class {
@@ -4650,9 +4783,10 @@ var init_dnsbl = __esm({
         return results.filter(Boolean);
       }
       /**
-       * Ask Cloudflare's filtering resolvers about host names. A name blocked by
-       * the malware resolver is "malware"; one blocked only by the family
-       * resolver is "adult". The hosts that got no answer (from the malware
+       * Ask Cloudflare's filtering resolvers about host names, each by the name
+       * it is looked up as (see lookupName), once; the findings name it. A name
+       * blocked by the malware resolver is "malware"; one blocked only by the
+       * family resolver is "adult". The hosts that got no answer (from the malware
        * resolver, or from the family resolver when asked) are listed in the
        * result's (non-enumerable) `unanswered` property.
        * @param {string[]} hosts
@@ -4665,10 +4799,8 @@ var init_dnsbl = __esm({
       async checkCloudflare(hosts = [], options = {}) {
         const { adult = true, malwareServers = CLOUDFLARE_MALWARE, familyServers = CLOUDFLARE_FAMILY } = options;
         const unanswered = [];
-        const results = await Promise.all(hosts.map(async (host) => {
-          if (!isLookupName(host)) {
-            return null;
-          }
+        const names = [...new Set(hosts.map((host) => lookupName(host)).filter(Boolean))];
+        const results = await Promise.all(names.map(async (host) => {
           const malware = await this.answer(host, malwareServers);
           if (malware?.includes("0.0.0.0")) {
             return { host, category: "malware" };
@@ -4771,7 +4903,7 @@ function asciiHostname(value) {
   if (lower === "" || /[\0-,/:-^`{-\u007F]/.test(lower)) {
     return null;
   }
-  const ascii = (0, import_node_url2.domainToASCII)(lower);
+  const ascii = (0, import_node_url3.domainToASCII)(lower);
   return ascii.length <= 253 && /^[\w-]{1,63}(?:\.[\w-]{1,63})*$/.test(ascii) ? ascii : null;
 }
 function normalizeEntry(value) {
@@ -4920,11 +5052,11 @@ function trustedReputationValues(mail = {}, session = {}, authentication = null)
     envelope: trustedSender ? { mailFrom: { address: sender } } : void 0
   }), ...fromValues];
 }
-var import_node_net2, import_node_url2, EMPTY, ReputationChecker, domainOf, sameDomain;
+var import_node_net2, import_node_url3, EMPTY, ReputationChecker, domainOf, sameDomain;
 var init_reputation = __esm({
   "src/reputation.js"() {
     import_node_net2 = require("node:net");
-    import_node_url2 = require("node:url");
+    import_node_url3 = require("node:url");
     init_dnsbl();
     init_http();
     init_tokenizer();
@@ -5920,13 +6052,13 @@ function joinsDisplay(brand, display, name) {
   return false;
 }
 function isOfficial({ brand, official }, domain, display, shared = true) {
-  const parsed = (0, import_tldts3.parse)(domain);
+  const parsed = (0, import_tldts4.parse)(domain);
   const name = parsed.domainWithoutSuffix ?? "";
   const compact = brand.replaceAll(" ", "");
   if (parsed.publicSuffix === compact || compact.length >= 5 && joinsDisplay(brand, display, name) && !JOINED_WORDS.some((word) => name.slice(compact.length).includes(word))) {
     return true;
   }
-  return official.some((entry) => entry instanceof RegExp ? entry.test(registrableDomain(domain)) : entry.includes(".") ? (shared || (0, import_tldts3.parse)(entry).domain !== null) && (domain === entry || domain.endsWith(`.${entry}`)) : name === entry);
+  return official.some((entry) => entry instanceof RegExp ? entry.test(registrableDomain(domain)) : entry.includes(".") ? (shared || (0, import_tldts4.parse)(entry).domain !== null) && (domain === entry || domain.endsWith(`.${entry}`)) : name === entry);
 }
 function headerString(mail, name) {
   const value = mail.headers?.get?.(name);
@@ -6025,7 +6157,7 @@ ${withoutHelp(markup)}`) || attributeText(markup).some(({ text: text2, start, en
       }
     } else if (claimed && isWholeName(name, claimed)) {
       const domain = claimed[1];
-      const brand = MAILBOXES.has((0, import_tldts3.parse)(domain).domainWithoutSuffix) ? null : DISPLAY_BRANDS.find((entry) => isOfficial(entry, domain, "", false) && !isOfficial(entry, session.originalFromAddressDomain, ""));
+      const brand = MAILBOXES.has((0, import_tldts4.parse)(domain).domainWithoutSuffix) ? null : DISPLAY_BRANDS.find((entry) => isOfficial(entry, domain, "", false) && !isOfficial(entry, session.originalFromAddressDomain, ""));
       if (brand) {
         hit("FROM_NAME_BRAND", 2, `Display name is an address of "${brand.brand}" but the message is from ${fromRoot}`, "PHISHING");
       }
@@ -6058,10 +6190,10 @@ ${withoutHelp(markup)}`) || attributeText(markup).some(({ text: text2, start, en
     category
   };
 }
-var import_tldts3, GTUBE, BLOCKED_SUBJECT, HACKED_SUBJECT, COIN, CODE, CURRENCY, MONEY, CRYPTOCURRENCY, AMOUNT_DEMAND, AMOUNT_GIVEN, HARM_VERB, HARMED, RECORDING, THREAT, HOURS, COUNT, DEADLINE, isPaymentDemand, BITCOIN_ADDRESS, IGNORE_INSTRUCTIONS, AI_ACTION, AI_OBJECT, AI_ACTION_OBJECT, AI_NEAR, VERDICT, VERDICT_WORD, VERDICT_ORDER, VERDICT_CLAIM, CLASSIFY, SYSTEM_PROMPT, YOU_ARE, QUOTE, CONDITION, DISCUSSED, DISCUSSED_SHOWN, DISCUSSED_NEAR, isDiscussed, isInjection, QUOTE_OR_SPACE, SHOWN_NEAR, isOrder, PAYPAL_DOMAIN, PAYPAL_SPAM_TYPE_IDS, PAYPAL_OWN_REQUEST, PAYPAL_INVOICE_SUBJECT, MS_SPAM_VERDICT, MS_SPAM_CATEGORY, APPLE_NEXT, APPLE_FILLER, APPLE_STRONG, APPLE_BUSINESS, APPLE_ALONE, APPLE_BESIDE, APPLE_PART, NEXT_WORD, MAX_AFTER, APPLE, DISPLAY_BRANDS, ADDRESSES, LIST_HOSTS, VIA_LIST, MAILBOXES, BEFORE_ADDRESS, AFTER_ADDRESS, isWholeName, JOINED_WORDS, MAX_DISPLAY;
+var import_tldts4, GTUBE, BLOCKED_SUBJECT, HACKED_SUBJECT, COIN, CODE, CURRENCY, MONEY, CRYPTOCURRENCY, AMOUNT_DEMAND, AMOUNT_GIVEN, HARM_VERB, HARMED, RECORDING, THREAT, HOURS, COUNT, DEADLINE, isPaymentDemand, BITCOIN_ADDRESS, IGNORE_INSTRUCTIONS, AI_ACTION, AI_OBJECT, AI_ACTION_OBJECT, AI_NEAR, VERDICT, VERDICT_WORD, VERDICT_ORDER, VERDICT_CLAIM, CLASSIFY, SYSTEM_PROMPT, YOU_ARE, QUOTE, CONDITION, DISCUSSED, DISCUSSED_SHOWN, DISCUSSED_NEAR, isDiscussed, isInjection, QUOTE_OR_SPACE, SHOWN_NEAR, isOrder, PAYPAL_DOMAIN, PAYPAL_SPAM_TYPE_IDS, PAYPAL_OWN_REQUEST, PAYPAL_INVOICE_SUBJECT, MS_SPAM_VERDICT, MS_SPAM_CATEGORY, APPLE_NEXT, APPLE_FILLER, APPLE_STRONG, APPLE_BUSINESS, APPLE_ALONE, APPLE_BESIDE, APPLE_PART, NEXT_WORD, MAX_AFTER, APPLE, DISPLAY_BRANDS, ADDRESSES, LIST_HOSTS, VIA_LIST, MAILBOXES, BEFORE_ADDRESS, AFTER_ADDRESS, isWholeName, JOINED_WORDS, MAX_DISPLAY;
 var init_is_arbitrary = __esm({
   "src/is-arbitrary.js"() {
-    import_tldts3 = require("tldts");
+    import_tldts4 = require("tldts");
     init_homograph();
     init_html();
     init_linear();
@@ -7195,7 +7327,7 @@ Answer with exactly one word: ham, spam, phishing, scam or malware.`;
 
 // src/model.js
 function moduleDirectory() {
-  return import_node_path.default.dirname((0, import_node_url3.fileURLToPath)(__importMetaUrl));
+  return import_node_path.default.dirname((0, import_node_url4.fileURLToPath)(__importMetaUrl));
 }
 function defaultModelPath(here = moduleDirectory()) {
   if (import_node_process2.default.env.SPAMSCANNER_MODEL) {
@@ -7276,7 +7408,7 @@ function saveModel(classifier, file, options = {}) {
   }
   loaded.delete(resolved);
 }
-var import_node_fs2, import_node_crypto3, import_node_module2, import_node_path, import_node_process2, import_node_url3, loaded;
+var import_node_fs2, import_node_crypto3, import_node_module2, import_node_path, import_node_process2, import_node_url4, loaded;
 var init_model = __esm({
   "src/model.js"() {
     import_node_fs2 = require("node:fs");
@@ -7284,7 +7416,7 @@ var init_model = __esm({
     import_node_module2 = require("node:module");
     import_node_path = __toESM(require("node:path"), 1);
     import_node_process2 = __toESM(require("node:process"), 1);
-    import_node_url3 = require("node:url");
+    import_node_url4 = require("node:url");
     init_classifier();
     loaded = /* @__PURE__ */ new Map();
   }
@@ -7514,7 +7646,7 @@ var init_package = __esm({
     package_default = {
       name: "spamscanner",
       description: "Spam, phishing and malware filter for email in any language: a trainable classifier, link and attachment checks, SPF/DKIM/DMARC, and an optional AI second opinion from any LLM, including local Ollama models. Works as a library, CLI, Postfix milter or HTTP API.",
-      version: "7.0.6",
+      version: "7.0.8",
       author: "Forward Email (https://forwardemail.net)",
       bin: {
         spamscanner: "./dist/esm/cli.js"
@@ -9165,7 +9297,8 @@ __export(src_exports, {
   scoreResults: () => scoreResults,
   segmentWords: () => segmentWords,
   spamHeaders: () => spamHeaders,
-  train: () => train
+  train: () => train,
+  unwrapLink: () => unwrapLink
 });
 function finding(fields) {
   Object.defineProperty(fields, "toString", {
@@ -9434,14 +9567,16 @@ var init_src = __esm({
        * a header field ("Name: value", or an mbox "From " line) is read as the
        * body of a message with no header, so its text is the input; other
        * input mailparser cannot read gives a message with no text. Other errors
-       * are thrown.
+       * are thrown. `error` is the parser's limit the message exceeds, so that
+       * only its first parts were read (as scan() reports it, see parseError),
+       * or null.
        * @param {Buffer|string|Uint8Array|AsyncIterable} source
-       * @returns {Promise<{raw: Buffer, mail: object}>}
+       * @returns {Promise<{raw: Buffer, mail: object, error: string|null}>}
        */
       async parse(source) {
         const raw = await toBuffer(source);
-        const { mail } = await parseWithin(withHeader(raw));
-        return { raw, mail };
+        const { mail, error } = await parseWithin(withHeader(raw));
+        return { raw, mail, error: error ?? null };
       }
       /**
        * Classifier features of a parsed message.
@@ -9574,15 +9709,23 @@ var init_src = __esm({
               message: `A link shows "${link.text}" but goes to ${link.host}`
             }));
           }
-          seenHosts.add(destination(link));
+          const name = lookupName(destination(link));
+          if (name) {
+            seenHosts.add(name);
+          }
         }
-        for (const link of [...links.filter((link2) => link2.text), ...links.filter((link2) => !link2.text)]) {
+        const found = links.filter((link) => !link.bare);
+        const bare = links.filter((link) => link.bare);
+        for (const link of [...found.filter((link2) => link2.text), ...found.filter((link2) => !link2.text)]) {
           lookalike(destination(link), { url: link.url });
         }
+        for (const link of bare) {
+          lookalike(link.host, { source: "text" });
+        }
         for (const host of hosts) {
           lookalike(host, { source: "text" });
         }
-        const ordered = [...new Set([...links.filter((link) => link.text), ...links.filter((link) => !link.text)].map((link) => destination(link)))];
+        const ordered = [...new Set([...found.filter((link) => link.text), ...found.filter((link) => !link.text), ...bare].map((link) => lookupName(destination(link))).filter(Boolean))];
         const firsts = /* @__PURE__ */ new Map();
         for (const host of ordered) {
           const domain = registrableDomain(host);
@@ -9596,9 +9739,9 @@ var init_src = __esm({
         let answered = 0;
         const cloudflare = async () => {
           await withTimeout(Promise.all(checked.map(async (host) => {
-            const found = await this.dns.checkCloudflare([host], { adult: config.phishing.adult });
-            blocked.push(...found);
-            if (!found.unanswered?.length) {
+            const found2 = await this.dns.checkCloudflare([host], { adult: config.phishing.adult });
+            blocked.push(...found2);
+            if (!found2.unanswered?.length) {
               answered++;
             }
           })), config.timeout, null);
@@ -9782,7 +9925,7 @@ var init_src = __esm({
         const linkLength = Number.isFinite(config.phishing.maxLength) && config.phishing.maxLength > 0 ? config.phishing.maxLength : 1e6;
         const text = typeof mail.text === "string" ? mail.text : "";
         const html2 = typeof mail.html === "string" ? mail.html : "";
-        const checkedLinks = extractLinks(text.slice(0, linkLength), html2.slice(0, linkLength * 2), { maxLength: linkLength * 2 });
+        const checkedLinks = extractLinks(text.slice(0, linkLength), html2.slice(0, linkLength * 2), { maxLength: linkLength * 2, bareHosts: true });
         const linksTruncated = text.length > linkLength || html2.length > linkLength * 2;
         const plainObfuscation = obfuscationOf(`${mail.subject || ""}
 ${typeof mail.text === "string" ? mail.text : ""}`, { maxLength: config.maxLength });
@@ -9793,7 +9936,8 @@ ${visibleText(html2.slice(0, config.maxLength * 2)).text}`, { maxLength: config.
           mixed: Math.max(plainObfuscation.mixed, shownObfuscation.mixed),
           styled: plainObfuscation.styled || shownObfuscation.styled
         };
-        const attached = await expandAttachments(mail.attachments, parseErrors);
+        const unopened = [];
+        const attached = await expandAttachments(mail.attachments, parseErrors, void 0, unopened);
         const attachments = config.attachments === false ? [] : inspectAttachments(attached).filter((item) => config.macros !== false || !["macro", "pdf_active", "rtf_object"].includes(item.type)).map((item) => finding(item));
         const [links, authentication, checkedReputation, dnsbl, virusScan, toxicity, nsfw] = await Promise.all([
           this.checkLinks(checkedLinks, config, extracted.hosts, fromDomain(mail)),
@@ -9914,6 +10058,13 @@ ${visibleText(html2.slice(0, config.maxLength * 2)).text}`, { maxLength: config.
             // scanned, as {filename, reason}: the same on every try, so not a
             // failure.
             virusScanSkipped: virusScan.skipped,
+            // Attached messages not opened, past the limits attached messages
+            // are read within (nested more than three deep, more than 100
+            // attachments in them, or more than 25 MB of them), as
+            // {filename, reason}: their attachments were not inspected. Not
+            // scored (forwarded messages can be nested so), for a caller that
+            // needs a message read whole, e.g. to block what it carries.
+            unopenedAttachments: unopened,
             // Whether the message has more text than phishing.maxLength, whose
             // links were not read.
             linksTruncated,
@@ -9923,7 +10074,8 @@ ${visibleText(html2.slice(0, config.maxLength * 2)).text}`, { maxLength: config.
               riskScore: Math.max(0, ...links.homographs.map((item) => item.riskScore))
             }
           },
-          links: checkedLinks.map((link) => link.url),
+          // (the links of the message, not hosts found without one)
+          links: checkedLinks.filter((link) => !link.bare).map((link) => link.url),
           language: extracted.language,
           tokens: extracted.words,
           mail,