@slicedearth/whoisleuth-cli 1.34.0 → 1.36.1

package/lib/registry-capabilities.mjs

@@ -90,6 +90,36 @@ function registryAccessDiagnosticFor(value) {
         authority: 'context_only',
     };
 }
+function registryServiceAdmissionFor(value, service) {
+    const capability = registryCapabilityFor(value);
+    if (!capability || (service !== 'rdap' && service !== 'whois'))
+        return null;
+    if (service === 'rdap') {
+        const allowed = capability.rdapAccessProfile === 'iana-bootstrap';
+        return {
+            service,
+            state: allowed ? 'allowed' : 'unsupported',
+            allowed,
+            limitation: capability.limitation,
+        };
+    }
+    if (capability.whoisAccessProfile === 'iana-referral') {
+        return {
+            service,
+            state: 'allowed',
+            allowed: true,
+            limitation: capability.limitation,
+        };
+    }
+    const permissionRequired = capability.whoisAccessProfile === 'registry-policy-restricted'
+        || capability.whoisAccessProfile === 'source-ip-authorization-required';
+    return {
+        service,
+        state: permissionRequired ? 'permission_required' : 'unsupported',
+        allowed: false,
+        limitation: capability.limitation,
+    };
+}
 function listRegistryCapabilities() {
     return EXPLICIT_CAPABILITIES.map((capability) => cloneCapability(capability));
 }
@@ -114,4 +144,4 @@ function registryCompatibilityMatrix() {
     })))
         .sort((left, right) => (left.suffixes[0] ?? '').localeCompare(right.suffixes[0] ?? ''));
 }
-export { REGISTRY_CAPABILITIES_VERSION, VERSION_26_NO_RDAP_SUFFIXES, VERSION_27_RDAP_ONLY_GENERIC_SUFFIXES, registryCapabilityFor, registryCompatibilityMatrix, listRegistryCapabilities, registryAccessDiagnosticFor, registryStandardsCoverageSnapshot, };
+export { REGISTRY_CAPABILITIES_VERSION, VERSION_26_NO_RDAP_SUFFIXES, VERSION_27_RDAP_ONLY_GENERIC_SUFFIXES, registryCapabilityFor, registryCompatibilityMatrix, listRegistryCapabilities, registryAccessDiagnosticFor, registryServiceAdmissionFor, registryStandardsCoverageSnapshot, };

package/lib/registry-capability-catalogue.mjs

@@ -1,15 +1,16 @@
 // Registry compatibility metadata. IANA bootstrap and referral discovery
 // remain authoritative. Explicit query profiles may alter only the first
 // referred registry query after a fixture-backed adapter is integrated.
-const REGISTRY_CAPABILITIES_VERSION = 27;
+const REGISTRY_CAPABILITIES_VERSION = 28;
 const MAX_CAPABILITY_INPUT_LENGTH = 253;
 const REGISTRY_STANDARDS_COVERAGE_SNAPSHOT = Object.freeze({
     schema: 'whoisleuth.registry-standards-coverage',
     version: 1,
-    verifiedAt: '2026-08-01',
+    verifiedAt: '2026-08-03',
     sources: Object.freeze({
-        rootZoneVersion: '2026073100',
-        rootZoneLastUpdatedAt: '2026-07-31T07:07:01.000Z',
+        rootZoneVersion: '2026080200',
+        rootZoneLastUpdatedAt: '2026-08-02T07:07:01.000Z',
+        rootZoneTldSetSha256: 'aa0a75a9860b2cba07d7fe8172f4546d981be3674bf6764fb0d5f39a45940d25',
         rdapBootstrapPublication: '2026-07-23T02:00:03.000Z',
         rdapBootstrapVersion: '1.0',
         urls: Object.freeze([
@@ -158,7 +159,6 @@ const DEFAULT_CAPABILITY = freezeCapability({
     whoisQueryScope: 'first-referral',
     whoisEncodingProfile: 'utf-8',
     whoisParserProfile: 'generic-colon',
-    fallbackProfile: null,
     whoisAccessProfile: 'iana-referral',
     rdapAccessProfile: 'iana-bootstrap',
     coverageState: 'discovery_only',
@@ -661,10 +661,12 @@ const EXPLICIT_CAPABILITY_SEEDS = [
         ],
     },
     {
-        id: 'gt-registry-web', suffixes: ['gt'], registryClass: 'country-code',
-        whoisParserProfile: 'generic-colon', fallbackProfile: 'gt-registry-web',
-        fixtureScenarios: ['registered', 'not_found', 'unavailable'],
-        verificationFiles: ['test/whois-gt-fallback.test.mts'],
+        id: 'gt-no-iana-service', suffixes: ['gt'], registryClass: 'country-code',
+        whoisParserProfile: 'generic-colon', fixtureScenarios: [],
+        coverageState: 'access_documented', whoisAccessProfile: 'no-iana-service',
+        rdapAccessProfile: 'no-iana-service', verificationFiles: [],
+        documentationUrls: ['https://www.iana.org/domains/root/db/gt.html'],
+        limitation: 'IANA publishes no RDAP service or domain WHOIS service for this suffix. WHOISleuth does not automate the registry website.',
     },
     {
         id: 'carnet-icann-colon', suffixes: ['hr'], registryClass: 'country-code',
@@ -1179,7 +1181,6 @@ const EXPLICIT_CAPABILITIES = EXPLICIT_CAPABILITY_SEEDS.map((entry) => {
     const rdapAccessProfile = resolvedSeedRdapAccessProfile(entry);
     return freezeCapability({
         ...entry,
-        fallbackProfile: entry.fallbackProfile || null,
         rdapDiscovery: 'iana-bootstrap',
         whoisDiscovery: 'iana-referral',
         whoisQueryProfile: entry.whoisQueryProfile || 'plain-domain',

package/lib/response-policy.mjs

@@ -1,8 +1,9 @@
 // Privacy-minimized interpretation of selected response policies. Header and
 // cookie values are read transiently from the already-selected homepage
 // response and reduced to fixed signal identifiers plus bounded counts.
-export const RESPONSE_POLICY_VERSION = 1;
+export const RESPONSE_POLICY_VERSION = 2;
 export const MAX_RESPONSE_POLICY_HEADER_BYTES = 8 * 1024;
+export const MAX_CSP_META_POLICIES = 4;
 export const MAX_RESPONSE_POLICY_DIRECTIVES = 64;
 export const MAX_RESPONSE_POLICY_TOKENS = 128;
 export const MAX_RESPONSE_COOKIES = 32;
@@ -56,7 +57,7 @@ function unavailableHeaderState(header) {
 }
 function analyzeCsp(header, signals) {
     if (header.state !== 'present' || !header.value) {
-        return unavailableHeaderState(header);
+        return { state: unavailableHeaderState(header), inlineControl: 'unknown' };
     }
     const directives = new Map();
     let tokenCount = 0;
@@ -68,7 +69,7 @@ function analyzeCsp(header, signals) {
         const [rawName = '', ...rawTokens] = normalized.split(/\s+/u);
         const name = rawName.toLowerCase();
         if (!DIRECTIVE_NAME_RE.test(name))
-            return 'malformed';
+            return { state: 'malformed', inlineControl: 'unknown' };
         if (directives.has(name))
             continue;
         if (directives.size >= MAX_RESPONSE_POLICY_DIRECTIVES) {
@@ -83,7 +84,7 @@ function analyzeCsp(header, signals) {
         directives.set(name, tokens);
     }
     if (!directives.size)
-        return 'malformed';
+        return { state: 'malformed', inlineControl: 'unknown' };
     const defaultSources = directives.get('default-src');
     const scriptSources = directives.get('script-src') || defaultSources;
     if (!defaultSources)
@@ -92,6 +93,7 @@ function analyzeCsp(header, signals) {
         addSignal(signals, 'csp_base_uri_missing');
     if (!directives.has('object-src') && !defaultSources)
         addSignal(signals, 'csp_object_source_unbounded');
+    let inlineControl = scriptSources ? 'restricted' : 'uncontrolled';
     if (scriptSources) {
         if (scriptSources.some((token) => ['*', 'http:', 'https:', 'data:', 'blob:'].includes(token))) {
             addSignal(signals, 'csp_permissive_script_source');
@@ -101,9 +103,79 @@ function analyzeCsp(header, signals) {
         if (scriptSources.includes("'unsafe-inline'")
             && !scriptSources.some((token) => CSP_NONCE_OR_HASH_RE.test(token))) {
             addSignal(signals, 'csp_unsafe_inline');
+            inlineControl = 'unqualified';
+        }
+    }
+    return {
+        state: partial ? 'partial' : 'parsed',
+        inlineControl: partial ? 'unknown' : inlineControl,
+    };
+}
+export function analyzeCspMetaPolicies(value, sourceTruncated = false) {
+    const candidates = Array.isArray(value) ? value : [];
+    const policies = candidates.slice(0, MAX_CSP_META_POLICIES);
+    let policiesParsed = 0;
+    let inlineScriptConstrained = false;
+    let truncated = sourceTruncated || candidates.length > MAX_CSP_META_POLICIES;
+    for (const rawPolicy of policies) {
+        const policy = rawPolicy && typeof rawPolicy === 'object' && !Array.isArray(rawPolicy)
+            ? rawPolicy
+            : null;
+        if (!policy || typeof policy.content !== 'string') {
+            truncated = true;
+            continue;
+        }
+        const policyContent = policy.content;
+        const content = readHeader({ get: () => policyContent }, 'content-security-policy');
+        const analysis = analyzeCsp(content, []);
+        if (analysis.state !== 'parsed') {
+            truncated = true;
+            continue;
         }
+        policiesParsed += 1;
+        if (policy.beforeScript === true && analysis.inlineControl === 'restricted') {
+            inlineScriptConstrained = true;
+        }
+    }
+    return {
+        cspMetaPolicyVersion: 1,
+        policiesObserved: boundedCount(candidates.length, MAX_CSP_META_POLICIES),
+        policiesParsed,
+        inlineScriptConstrained,
+        truncated,
+    };
+}
+export function qualifyResponsePolicyWithCspMeta(value, meta) {
+    if (!value || !meta || meta.cspMetaPolicyVersion !== 1)
+        return value;
+    const constrained = meta.inlineScriptConstrained
+        && value.signals.some((signal) => signal.id === 'csp_unsafe_inline');
+    const signals = constrained
+        ? [
+            ...value.signals.filter((signal) => signal.id !== 'csp_unsafe_inline'),
+            { id: 'csp_inline_constrained_by_meta' },
+        ]
+        : [...value.signals];
+    const limitations = [...value.limitations];
+    if (meta.policiesObserved > 0) {
+        limitations.push(constrained
+            ? 'A bounded CSP meta policy observed before page scripts further constrained inline script allowed by the response header.'
+            : 'CSP meta policy observations did not qualify the selected response-header finding; policies after scripts, malformed policies, and capped policies remain non-authoritative for this comparison.');
     }
-    return partial ? 'partial' : 'parsed';
+    if (meta.truncated)
+        limitations.push('CSP meta policy analysis reached a configured count, position, or byte boundary.');
+    return {
+        ...value,
+        signals: signals.slice(0, 16),
+        diagnostics: {
+            ...value.diagnostics,
+            signalCount: Math.min(signals.length, 16),
+            cspMetaPoliciesObserved: boundedCount(meta.policiesObserved, MAX_CSP_META_POLICIES),
+            cspMetaPoliciesParsed: boundedCount(meta.policiesParsed, MAX_CSP_META_POLICIES),
+            cspMetaPoliciesTruncated: meta.truncated,
+        },
+        limitations,
+    };
 }
 function analyzeHsts(header, signals) {
     if (header.state !== 'present' || !header.value) {
@@ -221,7 +293,7 @@ function analyzeCookies(headers, signals) {
 }
 export function analyzeResponsePolicyHeaders(headers) {
     const signals = [];
-    const contentSecurityPolicy = analyzeCsp(readHeader(headers, 'content-security-policy'), signals);
+    const contentSecurityPolicy = analyzeCsp(readHeader(headers, 'content-security-policy'), signals).state;
     const strictTransportSecurity = analyzeHsts(readHeader(headers, 'strict-transport-security'), signals);
     const referrerPolicy = analyzeReferrerPolicy(readHeader(headers, 'referrer-policy'), signals);
     const cookies = analyzeCookies(headers, signals);
@@ -250,6 +322,9 @@ export function analyzeResponsePolicyHeaders(headers) {
             signalCount: Math.min(signals.length, 16),
             cookieCount: boundedCount(cookies.count, MAX_RESPONSE_COOKIES),
             cookiesTruncated: cookies.truncated,
+            cspMetaPoliciesObserved: 0,
+            cspMetaPoliciesParsed: 0,
+            cspMetaPoliciesTruncated: false,
         },
         limitations,
     };

package/lib/rpki-evidence.mjs

@@ -0,0 +1,105 @@
+import { parseIpPrefix, prefixContains } from "./ip-prefix.mjs";
+const RPKI_EVIDENCE_SCHEMA = 'whoisleuth.rpki-route-review';
+const RPKI_EVIDENCE_VERSION = 1;
+const MAX_RPKI_RECORDS = 100_000;
+const MAX_RPKI_MATCHES = 50;
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : null;
+}
+function normalizeAsn(value) {
+    const text = typeof value === 'string' ? value.trim().replace(/^AS/iu, '') : value;
+    const number = Number(text);
+    return Number.isInteger(number) && number >= 0 && number <= 4_294_967_295 ? number : null;
+}
+function normalizeAuthorization(value) {
+    const source = record(value);
+    if (!source)
+        return null;
+    const prefix = typeof source.prefix === 'string' ? source.prefix : typeof source.route === 'string' ? source.route : '';
+    const parsedPrefix = parseIpPrefix(prefix);
+    const asn = normalizeAsn(source.asn ?? source.asID ?? source.origin);
+    const maxLengthValue = source.maxLength ?? source.max_length ?? parsedPrefix?.length;
+    const maxLength = Number(maxLengthValue);
+    const maximum = parsedPrefix?.family === 4 ? 32 : 128;
+    if (!parsedPrefix || asn === null || !Number.isInteger(maxLength)
+        || maxLength < parsedPrefix.length || maxLength > maximum)
+        return null;
+    return Object.freeze({ prefix: `${parsedPrefix.address}/${parsedPrefix.length}`, parsedPrefix, maxLength, asn });
+}
+function authorizationRows(value) {
+    if (Array.isArray(value))
+        return value;
+    const source = record(value);
+    if (!source)
+        return null;
+    if (Array.isArray(source.roas))
+        return source.roas;
+    if (Array.isArray(source.vrps))
+        return source.vrps;
+    if (Array.isArray(source.validated_route_origins))
+        return source.validated_route_origins;
+    return null;
+}
+function reviewRpkiRoute(input) {
+    const route = parseIpPrefix(input.routePrefix);
+    const originAsn = normalizeAsn(input.originAsn);
+    const rows = authorizationRows(input.authorizations);
+    const baseLimitations = Object.freeze([
+        'This offline review evaluates an explicitly supplied route prefix and origin ASN against an analyst-supplied VRP snapshot.',
+        'It does not collect BGP announcements, establish route ownership, or prove that the snapshot was current or complete.',
+    ]);
+    if (!route || originAsn === null || !rows) {
+        return Object.freeze({
+            schema: RPKI_EVIDENCE_SCHEMA,
+            version: RPKI_EVIDENCE_VERSION,
+            state: 'invalid_input',
+            routePrefix: null,
+            originAsn,
+            coveringAuthorizationCount: 0,
+            matchingAuthorizationCount: 0,
+            rejectedCount: 0,
+            truncated: false,
+            matches: Object.freeze([]),
+            limitations: baseLimitations,
+        });
+    }
+    const truncated = rows.length > MAX_RPKI_RECORDS;
+    const normalized = rows.slice(0, MAX_RPKI_RECORDS).map(normalizeAuthorization);
+    const rejectedCount = normalized.filter((item) => item === null).length + Math.max(0, rows.length - MAX_RPKI_RECORDS);
+    const authorizations = normalized.filter((item) => item !== null);
+    const covering = authorizations.filter((item) => prefixContains(item.parsedPrefix, route));
+    const matches = covering
+        .sort((left, right) => right.parsedPrefix.length - left.parsedPrefix.length || left.asn - right.asn)
+        .slice(0, MAX_RPKI_MATCHES)
+        .map((item) => Object.freeze({
+        prefix: item.prefix,
+        maxLength: item.maxLength,
+        asn: item.asn,
+        state: item.asn !== originAsn ? 'asn_mismatch'
+            : route.length > item.maxLength ? 'max_length_exceeded'
+                : 'valid',
+    }));
+    const matchingAuthorizationCount = matches.filter((item) => item.state === 'valid').length;
+    const state = covering.length === 0
+        ? 'not_found'
+        : matchingAuthorizationCount > 0
+            ? truncated || rejectedCount > 0 || covering.length > MAX_RPKI_MATCHES ? 'partial'
+                : 'valid'
+            : 'invalid';
+    return Object.freeze({
+        schema: RPKI_EVIDENCE_SCHEMA,
+        version: RPKI_EVIDENCE_VERSION,
+        state,
+        routePrefix: `${route.address}/${route.length}`,
+        originAsn,
+        coveringAuthorizationCount: covering.length,
+        matchingAuthorizationCount,
+        rejectedCount,
+        truncated,
+        matches: Object.freeze(matches),
+        limitations: baseLimitations,
+    });
+}
+export { MAX_RPKI_RECORDS, RPKI_EVIDENCE_SCHEMA, RPKI_EVIDENCE_VERSION, reviewRpkiRoute, };

package/lib/safe-fetch.mjs

@@ -22,7 +22,8 @@ import { promises as dns } from 'node:dns';
 import * as net from 'node:net';
 import * as crypto from 'node:crypto';
 import { Agent, fetch as undiciFetch } from 'undici';
-const MAX_REDIRECTS = 5;
+import { MAX_OUTBOUND_REDIRECTS } from "./outbound-request-bounds.mjs";
+const MAX_REDIRECTS = MAX_OUTBOUND_REDIRECTS;
 const MAX_SAFE_FETCH_URL_LENGTH = 4096;
 const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
 async function defaultSafeFetchRequest(url, options) {

package/lib/semantic-version.mjs

@@ -0,0 +1,54 @@
+// Dependency-free semantic-version validation shared by release tooling,
+// runtime identity, and the frontend build. Callers provide a bounded label so
+// errors retain their local context without reimplementing SemVer parsing.
+export const MAX_SEMANTIC_VERSION_LENGTH = 128;
+function fail(label, detail) {
+    throw new TypeError(`${label} ${detail}`);
+}
+function validateIdentifierList(value, label, kind, forbidNumericLeadingZero) {
+    const identifiers = value.split('.');
+    if (identifiers.some((identifier) => identifier.length === 0)) {
+        fail(label, `${kind} contains an empty identifier.`);
+    }
+    for (const identifier of identifiers) {
+        if (!/^[0-9A-Za-z-]+$/u.test(identifier)) {
+            fail(label, `${kind} contains an invalid identifier.`);
+        }
+        if (forbidNumericLeadingZero && /^[0-9]+$/u.test(identifier) && identifier.length > 1 && identifier.startsWith('0')) {
+            fail(label, `${kind} numeric identifiers must not contain leading zeroes.`);
+        }
+    }
+}
+export function normalizeBoundedSemanticVersion(value, label = 'Semantic') {
+    if (typeof value !== 'string'
+        || value.length === 0
+        || value.length > MAX_SEMANTIC_VERSION_LENGTH
+        || value.trim() !== value) {
+        fail(label, 'version must be a bounded semantic-version string.');
+    }
+    const buildParts = value.split('+');
+    if (buildParts.length > 2)
+        fail(label, 'version contains more than one build-metadata separator.');
+    const [precedence, buildMetadata] = buildParts;
+    if (!precedence)
+        fail(label, 'version must include numeric precedence.');
+    const prereleaseSeparator = precedence.indexOf('-');
+    const core = prereleaseSeparator === -1 ? precedence : precedence.slice(0, prereleaseSeparator);
+    const prerelease = prereleaseSeparator === -1 ? undefined : precedence.slice(prereleaseSeparator + 1);
+    const coreParts = core.split('.');
+    if (coreParts.length !== 3 || coreParts.some((part) => !/^(?:0|[1-9][0-9]*)$/u.test(part))) {
+        fail(label, 'version must contain major, minor, and patch numbers without leading zeroes.');
+    }
+    if (prerelease !== undefined)
+        validateIdentifierList(prerelease, label, 'prerelease', true);
+    if (buildMetadata !== undefined)
+        validateIdentifierList(buildMetadata, label, 'build metadata', false);
+    return value;
+}
+export function normalizeBoundedStableSemanticVersion(value, label = 'Stable semantic') {
+    const version = normalizeBoundedSemanticVersion(value, label);
+    if (version.includes('-') || version.includes('+')) {
+        fail(label, 'version must not include prerelease or build identifiers.');
+    }
+    return version;
+}

package/lib/static-html-analysis.mjs

@@ -3,6 +3,7 @@
 // so deeply nested hostile markup cannot create an unbounded element tree.
 // Only normalized start-tag markup and capped script indicators are retained.
 import { Tokenizer, TokenizerMode } from 'parse5';
+import { MAX_CSP_META_POLICIES, MAX_RESPONSE_POLICY_HEADER_BYTES, } from "./response-policy.mjs";
 const MAX_STATIC_HTML_CHARS = 300_000;
 const MAX_STATIC_HTML_TAGS = 8_192;
 const MAX_STATIC_STRUCTURE_TOKENS = 4_096;
@@ -192,6 +193,7 @@ function analyzeStaticHtml(value, options = {}) {
     const markup = [];
     const structureTokens = [];
     const scripts = [];
+    const cspMetaPolicies = [];
     const forms = {
         formsObserved: 0,
         inputsObserved: 0,
@@ -209,6 +211,9 @@ function analyzeStaticHtml(value, options = {}) {
     let structureLimitReached = false;
     let scriptLimitReached = false;
     let inlineLimitReached = false;
+    let cspMetaLimitReached = false;
+    let insideExplicitHead = false;
+    let scriptElementSeen = false;
     function appendInlineScript(chars) {
         if (!activeInlineScript || !chars)
             return;
@@ -242,6 +247,23 @@ function analyzeStaticHtml(value, options = {}) {
             }
             tagsExamined += 1;
             appendStructureToken(token.selfClosing || VOID_TAGS.has(tagName) ? `${tagName}/` : tagName);
+            if (tagName === 'head')
+                insideExplicitHead = true;
+            if (tagName === 'meta' && insideExplicitHead) {
+                const httpEquiv = attributeValue(token.attrs, 'http-equiv', 64);
+                if (httpEquiv.value === 'content-security-policy') {
+                    const content = attributeValue(token.attrs, 'content', MAX_RESPONSE_POLICY_HEADER_BYTES);
+                    if (content.value === null || !content.value) {
+                        cspMetaLimitReached = cspMetaLimitReached || content.present || content.truncated;
+                    }
+                    else if (cspMetaPolicies.length >= MAX_CSP_META_POLICIES) {
+                        cspMetaLimitReached = true;
+                    }
+                    else {
+                        cspMetaPolicies.push({ content: content.value, beforeScript: !scriptElementSeen });
+                    }
+                }
+            }
             if (markup.length < MAX_TECHNOLOGY_TAGS) {
                 const serialized = serializedStartTag(tagName, token.attrs);
                 if (serialized.limitReached)
@@ -287,6 +309,7 @@ function analyzeStaticHtml(value, options = {}) {
                 activeInlineScript = null;
                 return;
             }
+            scriptElementSeen = true;
             if (scripts.length >= MAX_SCRIPT_ELEMENTS) {
                 scriptLimitReached = true;
                 activeInlineScript = null;
@@ -305,6 +328,8 @@ function analyzeStaticHtml(value, options = {}) {
             const tagName = token.tagName.toLowerCase();
             if (tagName === 'script')
                 activeInlineScript = null;
+            if (tagName === 'head')
+                insideExplicitHead = false;
             if (!VOID_TAGS.has(tagName))
                 appendStructureToken(`/${tagName}`);
         },
@@ -327,6 +352,8 @@ function analyzeStaticHtml(value, options = {}) {
         markup: markup.join('\n'),
         structureTokens,
         scripts,
+        cspMetaPolicies,
+        cspMetaLimitReached,
         forms,
         inputLimitReached,
         tagLimitReached,

package/lib/threatfox-intelligence.mjs

@@ -3,6 +3,8 @@
 // sample. The adapter is disabled unless explicitly enabled and credentialed.
 import { abusechAuthKey } from "./abusech-auth.mjs";
 import { safeFetchDetailed, readTextCapped } from "./safe-fetch.mjs";
+import { whoisleuthRequestHeaders } from "./outbound-identity.mjs";
+import { providerPolicyAdmission } from "./provider-policy-admission.mjs";
 import { createThreatIntelligenceResult, defineThreatIntelligenceProvider, normalizeThreatIntelligenceTarget, } from "./threat-intelligence-contract.mjs";
 const THREATFOX_SEARCH_ENDPOINT = 'https://threatfox-api.abuse.ch/api/v1/';
 const THREATFOX_MAX_RESULTS = 20;
@@ -46,15 +48,18 @@ function threatfoxConfiguration(env = process.env) {
     const source = env && typeof env === 'object' ? env : {};
     const enabled = enabledValue(source.WHOISLEUTH_ENABLE_THREATFOX);
     const authKey = abusechAuthKey(source);
+    const policy = providerPolicyAdmission(THREATFOX_PROVIDER.terms, source);
     return {
         enabled,
-        configured: enabled && authKey !== null,
+        configured: enabled && policy.allowed && authKey !== null,
         authKey: enabled ? authKey : null,
         reason: !enabled
             ? 'Malware-IOC intelligence is not enabled for this deployment.'
-            : authKey
-                ? null
-                : 'Malware-IOC intelligence is enabled but its API credential is unavailable or malformed.',
+            : !policy.allowed
+                ? policy.reason
+                : authKey
+                    ? null
+                    : 'Malware-IOC intelligence is enabled but its API credential is unavailable or malformed.',
     };
 }
 function boundedText(value, maxLength) {
@@ -192,7 +197,7 @@ function createThreatfoxIntelligenceAdapter(dependencies = {}) {
                     accept: 'application/json',
                     'auth-key': configuration.authKey,
                     'content-type': 'application/json',
-                    'user-agent': 'WHOISleuth/1.0',
+                    ...whoisleuthRequestHeaders(),
                 },
                 body,
                 signal: AbortSignal.timeout(THREATFOX_PROVIDER.limits.timeoutMs),