@slicedearth/whoisleuth-cli 1.32.2 → 1.36.1

package/lib/tlsa-evidence.mjs

@@ -0,0 +1,194 @@
+import { Buffer } from 'node:buffer';
+import { createHash } from 'node:crypto';
+import { domainToASCII } from 'node:url';
+const TLSA_EVIDENCE_SCHEMA = 'whoisleuth.tlsa-evidence';
+const TLSA_EVIDENCE_VERSION = 1;
+const MAX_TLSA_RECORDS = 50;
+const MAX_CERTIFICATE_BYTES = 256 * 1024;
+const MAX_AUTHORITY_MATERIALS = 10;
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : null;
+}
+function integer(value, minimum, maximum) {
+    return Number.isInteger(value) && Number(value) >= minimum && Number(value) <= maximum
+        ? Number(value)
+        : null;
+}
+function hex(value) {
+    if (typeof value !== 'string')
+        return null;
+    const normalized = value.replace(/\s+/gu, '').toLowerCase();
+    return normalized && normalized.length % 2 === 0 && /^[0-9a-f]+$/u.test(normalized) ? normalized : null;
+}
+function normalizeTlsaRecord(value) {
+    const source = record(value);
+    if (!source)
+        return null;
+    const usage = integer(source.usage, 0, 3);
+    const selector = integer(source.selector, 0, 1);
+    const matchingType = integer(source.matchingType, 0, 2);
+    const associationData = hex(source.associationData);
+    if (usage === null || selector === null || matchingType === null || !associationData)
+        return null;
+    if (matchingType === 1 && associationData.length !== 64)
+        return null;
+    if (matchingType === 2 && associationData.length !== 128)
+        return null;
+    if (matchingType === 0 && associationData.length > MAX_CERTIFICATE_BYTES * 2)
+        return null;
+    return Object.freeze({ usage, selector, matchingType, associationData });
+}
+function decodeBoundedBase64(value) {
+    if (typeof value !== 'string' || value.length > MAX_CERTIFICATE_BYTES * 2 || !/^[A-Za-z0-9+/]+={0,2}$/u.test(value))
+        return null;
+    const decoded = Buffer.from(value, 'base64');
+    return decoded.length > 0 && decoded.length <= MAX_CERTIFICATE_BYTES && decoded.toString('base64') === value ? decoded : null;
+}
+function normalizeTlsaServiceName(value) {
+    if (typeof value !== 'string' || value.length > 270)
+        return null;
+    const match = /^_(\d{1,5})\._(tcp|udp)\.(.+)$/iu.exec(value.trim().replace(/\.$/u, ''));
+    if (!match)
+        return null;
+    const port = Number(match[1]);
+    const transport = match[2]?.toLowerCase();
+    const hostname = domainToASCII(String(match[3] ?? '').toLowerCase());
+    if (!Number.isInteger(port) || port < 1 || port > 65_535 || (transport !== 'tcp' && transport !== 'udp'))
+        return null;
+    if (!hostname || hostname.length > 253 || hostname.split('.').some((label) => !/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/u.test(label)))
+        return null;
+    return Object.freeze({ ownerName: `_${port}._${transport}.${hostname}`, port, transport, hostname });
+}
+function normalizeCertificateMaterial(value) {
+    const source = record(value);
+    if (!source)
+        return null;
+    const certificateDer = decodeBoundedBase64(source.certificateDerBase64);
+    const spkiDer = decodeBoundedBase64(source.spkiDerBase64);
+    return certificateDer || spkiDer ? Object.freeze({ certificateDer, spkiDer }) : null;
+}
+function selectedValues(recordValue, materials) {
+    return materials.flatMap((material) => {
+        const selected = recordValue.selector === 0 ? material.certificateDer : material.spkiDer;
+        if (!selected)
+            return [];
+        if (recordValue.matchingType === 0)
+            return [selected.toString('hex')];
+        if (recordValue.matchingType === 1)
+            return [createHash('sha256').update(selected).digest('hex')];
+        return [createHash('sha512').update(selected).digest('hex')];
+    });
+}
+function normalizeDnssecState(value) {
+    return value === 'validated' || value === 'insecure' || value === 'bogus' ? value : 'unavailable';
+}
+function normalizePkixValidationState(value) {
+    return value === 'validated' || value === 'failed' ? value : 'unavailable';
+}
+function analyzeTlsaEvidence(input) {
+    const service = normalizeTlsaServiceName(input.serviceName);
+    const dnssecState = normalizeDnssecState(input.dnssecState);
+    const pkixValidationState = normalizePkixValidationState(input.pkixValidationState);
+    const leafMaterial = normalizeCertificateMaterial({
+        certificateDerBase64: input.certificateDerBase64,
+        spkiDerBase64: input.spkiDerBase64,
+    });
+    const rawAuthorityMaterials = Array.isArray(input.authorityMaterials) ? input.authorityMaterials : [];
+    const normalizedAuthorityMaterials = rawAuthorityMaterials
+        .slice(0, MAX_AUTHORITY_MATERIALS)
+        .map(normalizeCertificateMaterial);
+    const authorityMaterials = normalizedAuthorityMaterials
+        .filter((item) => item !== null);
+    const authorityMaterialRejectedCount = normalizedAuthorityMaterials.length - authorityMaterials.length;
+    const authorityMaterialTruncated = rawAuthorityMaterials.length > MAX_AUTHORITY_MATERIALS;
+    const raw = Array.isArray(input.records) ? input.records : null;
+    if (!raw || !service) {
+        return Object.freeze({
+            schema: TLSA_EVIDENCE_SCHEMA,
+            version: TLSA_EVIDENCE_VERSION,
+            state: 'invalid',
+            dnssecState,
+            pkixValidationState,
+            service,
+            authorityMaterialCount: authorityMaterials.length,
+            authorityMaterialRejectedCount,
+            authorityMaterialTruncated,
+            records: Object.freeze([]),
+            rejectedCount: 0,
+            truncated: false,
+            limitations: Object.freeze([
+                ...(!raw ? ['TLSA evidence must be supplied as a bounded record array.'] : []),
+                ...(!service ? ['TLSA evidence must be bound to a valid _port._transport.hostname service name.'] : []),
+            ]),
+        });
+    }
+    const truncated = raw.length > MAX_TLSA_RECORDS;
+    const normalized = raw.slice(0, MAX_TLSA_RECORDS).map(normalizeTlsaRecord);
+    const rejectedCount = normalized.filter((item) => item === null).length + Math.max(0, raw.length - MAX_TLSA_RECORDS);
+    const records = normalized.filter((item) => item !== null);
+    const results = records.map((item) => {
+        const materials = item.usage === 0 || item.usage === 2
+            ? authorityMaterials
+            : leafMaterial ? [leafMaterial] : [];
+        const selected = selectedValues(item, materials);
+        if (!selected.length) {
+            const role = item.usage === 0 || item.usage === 2 ? 'authority' : 'leaf';
+            return Object.freeze({ ...item, state: 'unavailable', reason: `No bounded ${role} ${item.selector === 0 ? 'certificate' : 'SPKI'} bytes were supplied for comparison.` });
+        }
+        const matched = selected.includes(item.associationData);
+        return Object.freeze({
+            ...item,
+            state: matched ? 'matched' : 'different',
+            reason: matched ? 'The supplied certificate material matched this TLSA association.' : 'The supplied certificate material differed from this TLSA association.',
+        });
+    });
+    const hasMatch = results.some((item) => item.state === 'matched');
+    const hasDifferent = results.some((item) => item.state === 'different');
+    const hasUnavailable = results.some((item) => item.state === 'unavailable');
+    const limitations = [
+        'This offline comparison does not connect to the target, retrieve DNS, negotiate SMTP STARTTLS, or validate a DNSSEC chain.',
+        'A TLSA match is usable as DANE evidence only when the DNSSEC state was independently validated for the same observation.',
+        'PKIX-TA and PKIX-EE usages require an independently validated PKIX path; association matching alone does not establish that prerequisite.',
+    ];
+    if (dnssecState !== 'validated' && hasMatch) {
+        limitations.push('Certificate material matched, but DNSSEC was not validated, so the result remains partial.');
+    }
+    const matchedPkixDependent = results.some((item) => item.state === 'matched' && (item.usage === 0 || item.usage === 1));
+    const matchedDaneOnly = results.some((item) => item.state === 'matched' && (item.usage === 2 || item.usage === 3));
+    if (matchedPkixDependent && pkixValidationState !== 'validated') {
+        limitations.push('A PKIX-dependent association matched, but a validated PKIX path was not supplied, so the result is not complete.');
+    }
+    if (authorityMaterialRejectedCount > 0 || authorityMaterialTruncated) {
+        limitations.push('Authority certificate material was malformed or exceeded the review bound, so an unmatched trust-anchor association remains partial.');
+    }
+    const trustedMatch = dnssecState === 'validated'
+        && (matchedDaneOnly || matchedPkixDependent && pkixValidationState === 'validated');
+    const state = results.length === 0
+        ? 'unavailable'
+        : hasDifferent && !hasMatch && rejectedCount === 0 && !truncated
+            && authorityMaterialRejectedCount === 0 && !authorityMaterialTruncated
+            ? 'different'
+            : hasMatch && (dnssecState === 'bogus' || matchedPkixDependent && pkixValidationState === 'failed' && !matchedDaneOnly)
+                ? 'untrusted'
+                : trustedMatch && !hasUnavailable && rejectedCount === 0 && !truncated
+                    ? 'matched'
+                    : 'partial';
+    return Object.freeze({
+        schema: TLSA_EVIDENCE_SCHEMA,
+        version: TLSA_EVIDENCE_VERSION,
+        state,
+        dnssecState,
+        pkixValidationState,
+        service,
+        authorityMaterialCount: authorityMaterials.length,
+        authorityMaterialRejectedCount,
+        authorityMaterialTruncated,
+        records: Object.freeze(results),
+        rejectedCount,
+        truncated,
+        limitations: Object.freeze(limitations),
+    });
+}
+export { MAX_TLSA_RECORDS, MAX_AUTHORITY_MATERIALS, TLSA_EVIDENCE_SCHEMA, TLSA_EVIDENCE_VERSION, analyzeTlsaEvidence, normalizeTlsaRecord, normalizeTlsaServiceName, };

package/lib/urlhaus-intelligence.mjs

@@ -6,6 +6,8 @@
 import { classifyQuery } from "./classify.mjs";
 import { abusechAuthKey } from "./abusech-auth.mjs";
 import { safeFetchDetailed, readTextCapped } from "./safe-fetch.mjs";
+import { whoisleuthRequestHeaders } from "./outbound-identity.mjs";
+import { providerPolicyAdmission } from "./provider-policy-admission.mjs";
 import { createThreatIntelligenceResult, defineThreatIntelligenceProvider, normalizeThreatIntelligenceTarget, } from "./threat-intelligence-contract.mjs";
 const URLHAUS_HOST_ENDPOINT = 'https://urlhaus-api.abuse.ch/v1/host/';
 const URLHAUS_MAX_RESULTS = 20;
@@ -53,15 +55,18 @@ function urlhausConfiguration(env = process.env) {
     const source = env && typeof env === 'object' ? env : {};
     const enabled = enabledValue(source.WHOISLEUTH_ENABLE_URLHAUS);
     const authKey = abusechAuthKey(source);
+    const policy = providerPolicyAdmission(URLHAUS_PROVIDER.terms, source);
     return {
         enabled,
-        configured: enabled && authKey !== null,
+        configured: enabled && policy.allowed && authKey !== null,
         authKey: enabled ? authKey : null,
         reason: !enabled
             ? 'Malware-host intelligence is not enabled for this deployment.'
-            : authKey
-                ? null
-                : 'Malware-host intelligence is enabled but its API credential is unavailable or malformed.',
+            : !policy.allowed
+                ? policy.reason
+                : authKey
+                    ? null
+                    : 'Malware-host intelligence is enabled but its API credential is unavailable or malformed.',
     };
 }
 function boundedText(value, maxLength) {
@@ -231,7 +236,7 @@ function createUrlhausIntelligenceAdapter(dependencies = {}) {
                     accept: 'application/json',
                     'auth-key': configuration.authKey,
                     'content-type': 'application/x-www-form-urlencoded;charset=UTF-8',
-                    'user-agent': 'WHOISleuth/1.0',
+                    ...whoisleuthRequestHeaders(),
                 },
                 body,
                 signal: AbortSignal.timeout(URLHAUS_PROVIDER.limits.timeoutMs),

package/lib/urlscan-intelligence.mjs

@@ -4,6 +4,8 @@
 // key; credentials are sent only in a header to the fixed HTTPS endpoint.
 import { classifyQuery } from "./classify.mjs";
 import { safeFetchDetailed, readTextCapped } from "./safe-fetch.mjs";
+import { whoisleuthRequestHeaders } from "./outbound-identity.mjs";
+import { providerPolicyAdmission } from "./provider-policy-admission.mjs";
 import { createThreatIntelligenceResult, defineThreatIntelligenceProvider, normalizeThreatIntelligenceTarget, } from "./threat-intelligence-contract.mjs";
 const URLSCAN_SEARCH_ENDPOINT = 'https://urlscan.io/api/v1/search/';
 const URLSCAN_SEARCH_DAYS = 90;
@@ -57,15 +59,18 @@ function urlscanConfiguration(env = process.env) {
     const source = env && typeof env === 'object' ? env : {};
     const enabled = enabledValue(source.WHOISLEUTH_ENABLE_URLSCAN);
     const apiKey = normalizedApiKey(source.URLSCAN_API_KEY);
+    const policy = providerPolicyAdmission(URLSCAN_PROVIDER.terms, source);
     return {
         enabled,
-        configured: enabled && apiKey !== null,
+        configured: enabled && policy.allowed && apiKey !== null,
         apiKey: enabled ? apiKey : null,
         reason: !enabled
             ? 'Archived URLscan verdict search is not enabled for this deployment.'
-            : apiKey
-                ? null
-                : 'Archived URLscan verdict search is enabled but its API credential is unavailable or malformed.',
+            : !policy.allowed
+                ? policy.reason
+                : apiKey
+                    ? null
+                    : 'Archived URLscan verdict search is enabled but its API credential is unavailable or malformed.',
     };
 }
 function boundedText(value, maxLength) {
@@ -230,7 +235,7 @@ function createUrlscanIntelligenceAdapter(dependencies = {}) {
                 headers: {
                     accept: 'application/json',
                     'api-key': configuration.apiKey,
-                    'user-agent': 'WHOISleuth/1.0',
+                    ...whoisleuthRequestHeaders(),
                 },
                 signal: AbortSignal.timeout(URLSCAN_PROVIDER.limits.timeoutMs),
             }, { maxRedirects: 0 });

package/lib/website-security-posture.mjs

@@ -91,8 +91,15 @@ const RESPONSE_POLICY_FINDINGS = Object.freeze({
         detail: () => "The effective selected script source included 'unsafe-eval'.",
     },
     csp_unsafe_inline: {
-        label: 'CSP permits unqualified inline script',
-        detail: () => "The effective selected script source included 'unsafe-inline' without an observed nonce or hash source in that directive.",
+        label: 'Response CSP header permits unqualified inline script',
+        detail: () => "The selected response header included 'unsafe-inline' without a nonce or hash source in that directive. A separate page policy was not observed early enough to qualify this response-scoped finding.",
+    },
+    csp_inline_constrained_by_meta: {
+        label: 'Page CSP further constrains inline script',
+        detail: () => 'A bounded CSP meta policy appeared before page scripts and further constrained the inline-script allowance in the selected response header. Browsers enforce both policies.',
+        state: 'observed',
+        tone: 'configured',
+        evidence: ['Selected HTTP response headers', 'Static page CSP meta policy'],
     },
     hsts_disabled: {
         label: 'HSTS disabled by selected response',
@@ -125,7 +132,7 @@ const RESPONSE_POLICY_FINDINGS = Object.freeze({
 });
 function responsePolicyFindings(value) {
     const policy = record(value);
-    if (policy.responsePolicyVersion !== 1)
+    if (![1, 2].includes(Number(policy.responsePolicyVersion)))
         return [];
     const findings = [];
     const components = record(policy.components);
@@ -147,7 +154,7 @@ function responsePolicyFindings(value) {
         if (!definition || findings.some((item) => item.id === id))
             continue;
         const count = boundedCount(signal.count, 32);
-        findings.push(finding(id, 'response headers', 'potential_exposure', 'review', definition.label, definition.detail(count), ['Transient selected response-policy analysis']));
+        findings.push(finding(id, 'response headers', definition.state ?? 'potential_exposure', definition.tone ?? 'review', definition.label, definition.detail(count), definition.evidence ?? ['Transient selected response-policy analysis']));
     }
     return findings;
 }

package/lib/whois-chain.mjs

@@ -1,15 +1,13 @@
 // WHOIS referral-chain orchestration. Transport remains isolated in
-// whois-transport.mts; this module applies registry query profiles, follows
-// bounded referrals, and adapts the registry-web fallback into WHOIS text.
+// whois-transport.mts; this module applies registry query profiles and follows
+// bounded referrals.
 import { domainToUnicode } from 'node:url';
 import { cached } from "./lookup-cache.mjs";
-import { registryCapabilityFor } from "./registry-capabilities.mjs";
-import { readTextCapped, safeFetch } from "./safe-fetch.mjs";
+import { registryCapabilityFor, registryServiceAdmissionFor, } from "./registry-capabilities.mjs";
 import { whoisQuery } from "./whois-transport.mjs";
 const IANA_WHOIS = 'whois.iana.org';
 const WHOIS_HOP_DEADLINE_MS = 12_000;
 const WHOIS_CHAIN_DEADLINE_MS = 25_000;
-const MAX_GT_REGISTRY_HTML_BYTES = 500_000;
 const WHOIS_QUERY_FORMATTERS = {
     'plain-domain': (domain) => domain,
     'denic-domain-ace': (domain) => `-T dn,ace ${domain}`,
@@ -48,134 +46,19 @@ function extractReferral(whoisText) {
     }
     return null;
 }
-function stripTags(html) {
-    return html
-        .replace(/<[^>]+>/g, ' ')
-        .replace(/&nbsp;/g, ' ')
-        .replace(/\s+/g, ' ')
-        .trim();
-}
-function sectionBetween(html, startRe, endRes) {
-    const startMatch = html.match(startRe);
-    if (!startMatch)
-        return '';
-    const rest = html.slice((startMatch.index ?? 0) + startMatch[0].length);
-    let endIndex = rest.length;
-    for (const endRe of endRes) {
-        const match = rest.match(endRe);
-        if (!match)
-            continue;
-        const matchIndex = match.index ?? 0;
-        const index = match[0].startsWith('>') ? matchIndex + 1 : matchIndex;
-        if (index < endIndex)
-            endIndex = index;
-    }
-    return rest.slice(0, endIndex);
-}
-function extractIconFields(html, iconMap) {
-    let marked = html;
-    for (const [icon, key] of Object.entries(iconMap)) {
-        marked = marked.replace(new RegExp(`<i[^>]*\\b${icon}\\b[^>]*></i>`, 'gi'), `\n@@${key}@@\n`);
-    }
-    const parts = stripTags(marked).split(/@@(\w+)@@/);
-    const fields = {};
-    for (let index = 1; index < parts.length; index += 2) {
-        const value = (parts[index + 1] || '').trim();
-        const key = parts[index];
-        if (key && value && !fields[key])
-            fields[key] = value;
-    }
-    return fields;
-}
-export async function fetchGtRegistryWhois(domain, { fetcher = safeFetch, } = {}) {
-    const url = `https://www.gt/sitio/whois.php?dn=${encodeURIComponent(domain)}.&lang=en`;
-    const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), 8_000);
-    try {
-        const response = await fetcher(url, {
-            headers: { 'User-Agent': 'Mozilla/5.0 (compatible; DomainStatusChecker/1.0)' },
-            signal: controller.signal,
-        });
-        if (!response.ok) {
-            await response.body?.cancel().catch(() => { });
-            return null;
-        }
-        const body = await readTextCapped(response, MAX_GT_REGISTRY_HTML_BYTES);
-        if (body.truncated)
-            return null;
-        const html = body.text;
-        if (/is not registered/i.test(html))
-            return { registered: false };
-        const statusMatch = html.match(/<i class="fas fa-bell fa-fw"><\/i>\s*([A-Za-z]+)/i);
-        const expiryMatch = html.match(/Expiration:\s*([0-9]{4}-[A-Za-z]{3}-[0-9]{2}[^<]*)/i);
-        const orgSection = sectionBetween(html, /Entitled Organization/i, [/Servers\s*<\/h4>/i]);
-        const org = extractIconFields(orgSection, {
-            'fa-building': 'org',
-            'fa-address-card': 'address',
-            'fa-phone': 'phone',
-        });
-        const adminSection = sectionBetween(html, />\s*ADMINISTRATIVE\s*</i, [/>\s*TECHNICAL\s*</i, />\s*BILLING\s*</i]);
-        const admin = extractIconFields(adminSection, {
-            'fa-user': 'name',
-            'fa-envelope': 'email',
-            'fa-address-card': 'address',
-            'fa-building': 'org',
-        });
-        const serversSection = sectionBetween(html, /Servers\s*<\/h4>/i, [
-            /<div class="span6">/i,
-        ]);
-        const nameservers = [
-            ...serversSection.matchAll(/<strong>\s*([a-zA-Z0-9.\-]+)\.?\s*<\/strong>/gi),
-        ]
-            .map((match) => match[1]?.trim())
-            .filter((value) => Boolean(value));
-        return {
-            registered: true,
-            status: statusMatch?.[1]?.trim() || null,
-            expiryDate: expiryMatch?.[1]?.trim() || null,
-            registrantOrg: org.org || null,
-            registrantAddress: org.address || null,
-            registrantPhone: org.phone || null,
-            adminName: admin.name || null,
-            adminOrg: admin.org || null,
-            adminEmail: admin.email || null,
-            nameservers,
-        };
-    }
-    catch {
-        return null;
-    }
-    finally {
-        clearTimeout(timeout);
-    }
-}
-function formatGtResultAsText(domain, result) {
-    if (!result.registered)
-        return `No match for domain ${domain.toUpperCase()}.`;
-    const lines = [`Domain Name: ${domain.toUpperCase()}`];
-    if (result.status)
-        lines.push(`Domain Status: ${result.status}`);
-    if (result.expiryDate)
-        lines.push(`Registry Expiry Date: ${result.expiryDate}`);
-    if (result.registrantOrg)
-        lines.push(`Registrant Organization: ${result.registrantOrg}`);
-    if (result.registrantAddress)
-        lines.push(`Registrant Address: ${result.registrantAddress}`);
-    if (result.registrantPhone)
-        lines.push(`Registrant Phone: ${result.registrantPhone}`);
-    if (result.adminName)
-        lines.push(`Admin Name: ${result.adminName}`);
-    if (result.adminOrg)
-        lines.push(`Admin Organization: ${result.adminOrg}`);
-    if (result.adminEmail)
-        lines.push(`Admin Email: ${result.adminEmail}`);
-    for (const nameserver of result.nameservers)
-        lines.push(`Name Server: ${nameserver}`);
-    return lines.join('\n');
-}
 export async function buildWhoisChainUncached(query, options = {}) {
+    const admission = registryServiceAdmissionFor(query, 'whois');
+    if (admission && !admission.allowed) {
+        return [{
+                server: 'registry capability policy',
+                queryProfile: 'not-issued',
+                responseEncoding: 'utf-8',
+                error: admission.state === 'permission_required'
+                    ? 'WHOIS collection requires registry permission or source authorization; no socket was opened.'
+                    : 'IANA publishes no domain WHOIS service for this suffix; no socket was opened.',
+            }];
+    }
     const queryWhois = options.whoisQuery || whoisQuery;
-    const fetchGtWhois = options.fetchGtRegistryWhois || fetchGtRegistryWhois;
     const now = options.now || Date.now;
     const chainDeadlineMs = options.chainDeadlineMs || WHOIS_CHAIN_DEADLINE_MS;
     const chain = [];
@@ -233,27 +116,6 @@ export async function buildWhoisChainUncached(query, options = {}) {
             break;
         currentServer = referral;
     }
-    const firstHop = chain[0];
-    if (query.toLowerCase().endsWith('.gt') &&
-        chain.length === 1 &&
-        firstHop &&
-        !('error' in firstHop)) {
-        try {
-            const result = await fetchGtWhois(query);
-            if (result) {
-                chain.push({
-                    server: 'www.gt (registry website - .gt has no WHOIS:43 server)',
-                    queriedAt: new Date().toISOString(),
-                    queryProfile: 'gt-registry-web',
-                    responseEncoding: 'utf-8',
-                    response: formatGtResultAsText(query, result),
-                });
-            }
-        }
-        catch {
-            // Best-effort registry fallback. The IANA hop remains explicit on failure.
-        }
-    }
     return chain;
 }
 export async function buildWhoisChain(query) {

package/lib/whois.mjs

@@ -4,7 +4,7 @@
 import { domainToASCII } from 'node:url';
 import { registryDateIso } from "./registry-dates.mjs";
 import { queryWhoisAddress, whoisQuery, } from "./whois-transport.mjs";
-import { buildWhoisChain, buildWhoisChainUncached, fetchGtRegistryWhois, } from "./whois-chain.mjs";
+import { buildWhoisChain, buildWhoisChainUncached, } from "./whois-chain.mjs";
 import { analyzeWhoisChainAuthority, hasNicKgRegistrationEvidence, } from "./whois-authority.mjs";
 import { parseIndentedContactBlock, resolveFredContact, resolveIrnicContact, resolveIsnicRole, } from "./whois-contacts.mjs";
 import { normalizeWhoisChain } from "./whois-normalization.mjs";
@@ -1184,4 +1184,4 @@ function parseWhoisChain(chain) {
         ...authority,
     };
 }
-export { buildWhoisChain, parseWhoisChain, analyzeWhoisChainAuthority, whoisQuery, queryWhoisAddress, buildWhoisChainUncached, fetchGtRegistryWhois, };
+export { buildWhoisChain, parseWhoisChain, analyzeWhoisChainAuthority, whoisQuery, queryWhoisAddress, buildWhoisChainUncached, };

package/package.json

@@ -2,6 +2,7 @@
   "name": "@slicedearth/whoisleuth-cli",
   "type": "module",
   "license": "AGPL-3.0-only",
+  "author": "slicedearth",
   "contentPolicy": {
     "class": "dual-use"
   },
@@ -26,17 +27,17 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/slicedearth/whoisleuth.git"
+    "url": "git+https://github.com/slicedearth/whoisleuth.git"
   },
   "homepage": "https://whoisleuth.com/",
   "bugs": {
     "url": "https://github.com/slicedearth/whoisleuth/issues"
   },
-  "version": "1.32.2",
+  "version": "1.36.1",
   "dependencies": {
-    "parse5": "^8.0.1",
-    "tldts": "^7.4.9",
-    "undici": "^8.7.0"
+    "parse5": "8.0.1",
+    "tldts": "7.4.10",
+    "undici": "8.9.0"
   },
   "files": [
     "bin/**/*.mjs",
@@ -49,6 +50,7 @@
     "LICENSES/*.txt",
     "NOTICE",
     "README.md",
+    "SECURITY.md",
     "TRADEMARKS.md",
     "third-party-notices.txt"
   ],

package/third-party-notices.txt

@@ -5130,7 +5130,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
 FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
 DEALINGS IN THE SOFTWARE.
 ================================================================================
-tldts@7.4.9
+tldts@7.4.10
 Relationship: direct production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -5149,7 +5149,7 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
  WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 ================================================================================
-tldts-core@7.4.9
+tldts-core@7.4.10
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: LICENSE