@slicedearth/whoisleuth-cli 1.34.0 → 1.39.1

package/lib/registry-insights.mjs

@@ -83,7 +83,7 @@ function disclosure(source, parsedValue, status) {
         return {
             source,
             state: 'unavailable',
-            detail: 'The source did not provide a usable normalized publication.',
+            detail: 'The source did not provide a usable normalised publication.',
         };
     }
     const parsed = record(parsedValue);
@@ -211,11 +211,11 @@ function publicationDiagnostic(source, parsedValue, status, observedAt) {
     if (parsed.serverTruncated === true)
         issues.push('The RDAP server declared a truncated response.');
     if (parsed.entitiesTruncated === true)
-        issues.push('The normalized entity inventory was capped.');
+        issues.push('The normalised entity inventory was capped.');
     if (parsed.statusesTruncated === true)
-        issues.push('The normalized status inventory was capped.');
+        issues.push('The normalised status inventory was capped.');
     if (strings(parsed.fieldsTruncated, 20).length)
-        issues.push('One or more normalized WHOIS fields were capped.');
+        issues.push('One or more normalised WHOIS fields were capped.');
     if (parsed.chainStatus === 'partial')
         issues.push('The WHOIS referral chain was incomplete or conflicting.');
     const conformance = strings(parsed.conformance, 30);
@@ -306,9 +306,9 @@ export function buildRegistryInsights(input) {
                 : unavailableCount
                     ? 'The comparison is partial because at least one publication was unavailable or incomplete.'
                     : sourceOnlyCount || redactedCount
-                        ? 'The sources differ in publication or disclosure without a normalized conflict.'
+                        ? 'The sources differ in publication or disclosure without a normalised conflict.'
                         : counts.equivalent
-                            ? 'The comparable fields are normalized as equivalent.'
+                            ? 'The comparable fields are normalised as equivalent.'
                             : 'No comparable fields were available.',
         },
         publications: [

package/lib/response-policy.mjs

@@ -1,8 +1,9 @@
 // Privacy-minimized interpretation of selected response policies. Header and
 // cookie values are read transiently from the already-selected homepage
 // response and reduced to fixed signal identifiers plus bounded counts.
-export const RESPONSE_POLICY_VERSION = 1;
+export const RESPONSE_POLICY_VERSION = 2;
 export const MAX_RESPONSE_POLICY_HEADER_BYTES = 8 * 1024;
+export const MAX_CSP_META_POLICIES = 4;
 export const MAX_RESPONSE_POLICY_DIRECTIVES = 64;
 export const MAX_RESPONSE_POLICY_TOKENS = 128;
 export const MAX_RESPONSE_COOKIES = 32;
@@ -56,7 +57,7 @@ function unavailableHeaderState(header) {
 }
 function analyzeCsp(header, signals) {
     if (header.state !== 'present' || !header.value) {
-        return unavailableHeaderState(header);
+        return { state: unavailableHeaderState(header), inlineControl: 'unknown' };
     }
     const directives = new Map();
     let tokenCount = 0;
@@ -68,7 +69,7 @@ function analyzeCsp(header, signals) {
         const [rawName = '', ...rawTokens] = normalized.split(/\s+/u);
         const name = rawName.toLowerCase();
         if (!DIRECTIVE_NAME_RE.test(name))
-            return 'malformed';
+            return { state: 'malformed', inlineControl: 'unknown' };
         if (directives.has(name))
             continue;
         if (directives.size >= MAX_RESPONSE_POLICY_DIRECTIVES) {
@@ -83,7 +84,7 @@ function analyzeCsp(header, signals) {
         directives.set(name, tokens);
     }
     if (!directives.size)
-        return 'malformed';
+        return { state: 'malformed', inlineControl: 'unknown' };
     const defaultSources = directives.get('default-src');
     const scriptSources = directives.get('script-src') || defaultSources;
     if (!defaultSources)
@@ -92,6 +93,7 @@ function analyzeCsp(header, signals) {
         addSignal(signals, 'csp_base_uri_missing');
     if (!directives.has('object-src') && !defaultSources)
         addSignal(signals, 'csp_object_source_unbounded');
+    let inlineControl = scriptSources ? 'restricted' : 'uncontrolled';
     if (scriptSources) {
         if (scriptSources.some((token) => ['*', 'http:', 'https:', 'data:', 'blob:'].includes(token))) {
             addSignal(signals, 'csp_permissive_script_source');
@@ -101,9 +103,79 @@ function analyzeCsp(header, signals) {
         if (scriptSources.includes("'unsafe-inline'")
             && !scriptSources.some((token) => CSP_NONCE_OR_HASH_RE.test(token))) {
             addSignal(signals, 'csp_unsafe_inline');
+            inlineControl = 'unqualified';
+        }
+    }
+    return {
+        state: partial ? 'partial' : 'parsed',
+        inlineControl: partial ? 'unknown' : inlineControl,
+    };
+}
+export function analyzeCspMetaPolicies(value, sourceTruncated = false) {
+    const candidates = Array.isArray(value) ? value : [];
+    const policies = candidates.slice(0, MAX_CSP_META_POLICIES);
+    let policiesParsed = 0;
+    let inlineScriptConstrained = false;
+    let truncated = sourceTruncated || candidates.length > MAX_CSP_META_POLICIES;
+    for (const rawPolicy of policies) {
+        const policy = rawPolicy && typeof rawPolicy === 'object' && !Array.isArray(rawPolicy)
+            ? rawPolicy
+            : null;
+        if (!policy || typeof policy.content !== 'string') {
+            truncated = true;
+            continue;
+        }
+        const policyContent = policy.content;
+        const content = readHeader({ get: () => policyContent }, 'content-security-policy');
+        const analysis = analyzeCsp(content, []);
+        if (analysis.state !== 'parsed') {
+            truncated = true;
+            continue;
         }
+        policiesParsed += 1;
+        if (policy.beforeScript === true && analysis.inlineControl === 'restricted') {
+            inlineScriptConstrained = true;
+        }
+    }
+    return {
+        cspMetaPolicyVersion: 1,
+        policiesObserved: boundedCount(candidates.length, MAX_CSP_META_POLICIES),
+        policiesParsed,
+        inlineScriptConstrained,
+        truncated,
+    };
+}
+export function qualifyResponsePolicyWithCspMeta(value, meta) {
+    if (!value || !meta || meta.cspMetaPolicyVersion !== 1)
+        return value;
+    const constrained = meta.inlineScriptConstrained
+        && value.signals.some((signal) => signal.id === 'csp_unsafe_inline');
+    const signals = constrained
+        ? [
+            ...value.signals.filter((signal) => signal.id !== 'csp_unsafe_inline'),
+            { id: 'csp_inline_constrained_by_meta' },
+        ]
+        : [...value.signals];
+    const limitations = [...value.limitations];
+    if (meta.policiesObserved > 0) {
+        limitations.push(constrained
+            ? 'A bounded CSP meta policy observed before page scripts further constrained inline script allowed by the response header.'
+            : 'CSP meta policy observations did not qualify the selected response-header finding; policies after scripts, malformed policies, and capped policies remain non-authoritative for this comparison.');
     }
-    return partial ? 'partial' : 'parsed';
+    if (meta.truncated)
+        limitations.push('CSP meta policy analysis reached a configured count, position, or byte boundary.');
+    return {
+        ...value,
+        signals: signals.slice(0, 16),
+        diagnostics: {
+            ...value.diagnostics,
+            signalCount: Math.min(signals.length, 16),
+            cspMetaPoliciesObserved: boundedCount(meta.policiesObserved, MAX_CSP_META_POLICIES),
+            cspMetaPoliciesParsed: boundedCount(meta.policiesParsed, MAX_CSP_META_POLICIES),
+            cspMetaPoliciesTruncated: meta.truncated,
+        },
+        limitations,
+    };
 }
 function analyzeHsts(header, signals) {
     if (header.state !== 'present' || !header.value) {
@@ -221,7 +293,7 @@ function analyzeCookies(headers, signals) {
 }
 export function analyzeResponsePolicyHeaders(headers) {
     const signals = [];
-    const contentSecurityPolicy = analyzeCsp(readHeader(headers, 'content-security-policy'), signals);
+    const contentSecurityPolicy = analyzeCsp(readHeader(headers, 'content-security-policy'), signals).state;
     const strictTransportSecurity = analyzeHsts(readHeader(headers, 'strict-transport-security'), signals);
     const referrerPolicy = analyzeReferrerPolicy(readHeader(headers, 'referrer-policy'), signals);
     const cookies = analyzeCookies(headers, signals);
@@ -250,6 +322,9 @@ export function analyzeResponsePolicyHeaders(headers) {
             signalCount: Math.min(signals.length, 16),
             cookieCount: boundedCount(cookies.count, MAX_RESPONSE_COOKIES),
             cookiesTruncated: cookies.truncated,
+            cspMetaPoliciesObserved: 0,
+            cspMetaPoliciesParsed: 0,
+            cspMetaPoliciesTruncated: false,
         },
         limitations,
     };

package/lib/risk-scoring.mjs

@@ -1,22 +1,27 @@
 import { calibrateExternalIntelligenceRisk } from "./external-intelligence-risk.mjs";
+import { buildScoreEvidenceQuality, } from "./scoring-evidence-quality.mjs";
 const RISK_STATES = new Set(['registered', 'for_sale', 'expiring']);
 const STATE_LABELS = Object.freeze({
     for_sale: 'for sale',
     expiring: 'expiring/pending delete',
     registered: 'registered',
 });
-// Version 6 preserves the grouped external-evidence factor and recognizes the
-// newly generated addition, plural, embedded-TLD, advanced Unicode, and
-// analyst-directed token-replacement families conservatively. Older scores
-// remain readable, while case and watchlist comparisons gate numeric changes
-// on matching model versions so formula changes are not mistaken for changes
-// in the observed domain.
-export const RISK_MODEL_VERSION = 6;
+// Version 7 caps each independent evidence family, treats generic operational
+// properties as supporting context, and reports collection quality separately
+// from the heuristic score. Missing evidence never contributes points.
+export const RISK_MODEL_VERSION = 7;
 export const RISK_REVIEW_THRESHOLD = 70;
 const RISK_STATE_BASE = Object.freeze({
-    registered: 10,
-    for_sale: 5,
-    expiring: 8,
+    registered: 6,
+    for_sale: 4,
+    expiring: 5,
+});
+const FAMILY_CAPS = Object.freeze({
+    'domain-resemblance': 20,
+    'brand-presentation': 24,
+    'credential-lure': 18,
+    'external-intelligence': 18,
+    'operational-support': 12,
 });
 const HIGH_CONTEXT_MUTATIONS = new Set([
     'unicode_homoglyph',
@@ -49,7 +54,7 @@ export function normalizeRiskModelVersion(value) {
 }
 function formatAge(days) {
     if (days < 60)
-        return `${days}d old`;
+        return `${Math.round(days)}d old`;
     const years = days / 365.25;
     return years < 1 ? `${Math.round(days / 30)}mo old` : `${years.toFixed(1)}y old`;
 }
@@ -68,83 +73,201 @@ function mutationContext(mutationTypes) {
     }
     return null;
 }
+function hasBoolean(value) {
+    return typeof value === 'boolean';
+}
+function scoreQuality(input) {
+    const observedFamilies = ['registration'];
+    const expectedFamilies = ['registration', 'operational-support'];
+    if (Array.isArray(input.mutationTypes) || hasBoolean(input.idnReferenceMatch))
+        observedFamilies.push('domain-resemblance');
+    if (input.hasActiveBrandProfile === true)
+        expectedFamilies.push('domain-resemblance', 'brand-presentation');
+    if ([input.faviconMatch, input.faviconNearMatch, input.reusesOfficialAssets, input.pageBaselineMatch].some(hasBoolean)) {
+        observedFamilies.push('brand-presentation');
+    }
+    if ([input.hasPasswordField, input.hasExternalFormAction].some(hasBoolean) || typeof input.phishingLanguageMatch === 'string') {
+        observedFamilies.push('credential-lure');
+    }
+    if (input.threatIntelligence !== undefined && input.threatIntelligence !== null)
+        observedFamilies.push('external-intelligence');
+    if ([input.hasMx, input.hasSpf, input.hasDmarc].some(hasBoolean)
+        || typeof input.activityStatus === 'string'
+        || typeof input.domainAgeDays === 'number')
+        observedFamilies.push('operational-support');
+    if (input.scanDepth === 'deep')
+        expectedFamilies.push('credential-lure');
+    return buildScoreEvidenceQuality(input, {
+        expectedDepth: 'deep',
+        observedFamilies,
+        expectedFamilies,
+    });
+}
 // Risk prioritizes a registered lookalike/typosquat domain for analyst review.
 // It is a heuristic indicator, never a maliciousness or safety verdict.
-export function explainRiskScore(r) {
-    const state = r.availability ?? r.state;
+export function explainRiskScore(input) {
+    const state = input.availability ?? input.state;
     if (typeof state !== 'string' || !RISK_STATES.has(state))
         return null;
-    const base = RISK_STATE_BASE[state] ?? 0;
-    const factors = [{ label: `Base score for "${STATE_LABELS[state] || state}"`, delta: base }];
-    let score = base;
-    const contextualFamilies = new Set();
-    const addContextualFactor = (family, label, delta) => {
-        contextualFamilies.add(family);
-        factors.push({ label, delta });
-        score += delta;
+    const factors = [];
+    const familyTotals = new Map();
+    const add = (family, label, requestedDelta) => {
+        const current = familyTotals.get(family) ?? 0;
+        const cap = FAMILY_CAPS[family] ?? Number.POSITIVE_INFINITY;
+        const delta = Math.max(0, Math.min(requestedDelta, Math.max(0, cap - current)));
+        const capped = delta !== requestedDelta;
+        factors.push({ family, label: capped ? `${label} (family cap reached)` : label, delta });
+        familyTotals.set(family, current + delta);
+        return delta;
+    };
+    add('registration', `Base context for “${STATE_LABELS[state] ?? state}”`, RISK_STATE_BASE[state] ?? 0);
+    const mutation = mutationContext(input.mutationTypes);
+    if (mutation)
+        add('domain-resemblance', mutation.label, mutation.delta);
+    if (input.idnReferenceMatch === true)
+        add('domain-resemblance', 'IDN skeleton matches an official Brand Profile domain', 20);
+    if (input.faviconMatch === true)
+        add('brand-presentation', 'Favicon matches an official Brand Profile site', 18);
+    else if (input.faviconNearMatch === true)
+        add('brand-presentation', 'Favicon resembles an official Brand Profile site', 14);
+    if (input.reusesOfficialAssets === true)
+        add('brand-presentation', 'Official asset-host relationship observed', 6);
+    if (input.pageBaselineMatch === true)
+        add('brand-presentation', 'Multiple independently compared page-identity components match the official baseline', 14);
+    if (typeof input.phishingLanguageMatch === 'string' && input.phishingLanguageMatch.trim()) {
+        add('credential-lure', 'Suspicious urgency language observed', 8);
+    }
+    if (input.hasPasswordField === true && input.hasExternalFormAction === true) {
+        add('credential-lure', 'Password form submits to an external origin', 10);
+    }
+    else if (input.hasPasswordField === true) {
+        add('credential-lure', 'Login/password form present', 5);
+    }
+    else if (input.hasExternalFormAction === true) {
+        add('credential-lure', 'External form destination observed without a password field', 0);
+    }
+    const external = calibrateExternalIntelligenceRisk(input.threatIntelligence);
+    if (external.factor)
+        add('external-intelligence', external.factor.label, external.contribution);
+    const primaryFamilies = ['domain-resemblance', 'brand-presentation', 'credential-lure', 'external-intelligence']
+        .filter((family) => (familyTotals.get(family) ?? 0) > 0);
+    if (primaryFamilies.length >= 2) {
+        add('corroboration', `Corroborating context across ${primaryFamilies.length} independent evidence families`, primaryFamilies.length >= 3 ? 18 : 10);
+    }
+    const hasIndependentContext = primaryFamilies.length > 0;
+    const supporting = (label, delta) => {
+        add('operational-support', hasIndependentContext ? label : `${label}; neutral without independent suspicious context`, hasIndependentContext ? delta : 0);
+    };
+    if (input.activityStatus === 'active')
+        supporting('Active website observed', 4);
+    if (input.hasMx === true)
+        supporting('Mail server configured', 4);
+    if (input.hasSpf === true && input.hasDmarc === true)
+        supporting('SPF and DMARC records present', 1);
+    else if (input.hasSpf === true || input.hasDmarc === true)
+        supporting('SPF or DMARC record present', 0);
+    if (typeof input.domainAgeDays === 'number' && Number.isFinite(input.domainAgeDays) && input.domainAgeDays >= 0) {
+        if (input.domainAgeDays < 90)
+            supporting(`Recently registered (${formatAge(input.domainAgeDays)})`, 6);
+        else if (input.domainAgeDays < 365)
+            supporting(`Registered under a year ago (${formatAge(input.domainAgeDays)})`, 2);
+    }
+    if (typeof input.privacyProtected === 'boolean') {
+        add('registration', 'Registration privacy is neutral context', 0);
+    }
+    const rawScore = Math.round(factors.reduce((total, factor) => total + factor.delta, 0));
+    const score = Math.max(0, Math.min(100, rawScore));
+    const familyOrder = [
+        'registration', 'domain-resemblance', 'brand-presentation', 'credential-lure',
+        'external-intelligence', 'corroboration', 'operational-support',
+    ];
+    return {
+        modelVersion: RISK_MODEL_VERSION,
+        score,
+        rawScore,
+        capped: score !== rawScore,
+        factors,
+        families: familyOrder
+            .filter((id) => familyTotals.has(id))
+            .map((id) => ({ id, contribution: familyTotals.get(id) ?? 0, cap: FAMILY_CAPS[id] ?? null })),
+        evidenceQuality: scoreQuality(input),
     };
-    const context = mutationContext(r.mutationTypes);
-    if (context)
-        addContextualFactor('domain-resemblance', context.label, context.delta);
-    if (r.faviconMatch === true) {
-        addContextualFactor('brand-presentation', 'Favicon matches your Brand Profile official site', 18);
-    }
-    else if (r.faviconNearMatch === true) {
-        addContextualFactor('brand-presentation', 'Favicon resembles your official site (perceptual match)', 14);
-    }
-    if (r.reusesOfficialAssets === true) {
-        addContextualFactor('brand-presentation', 'Official asset host relationship observed', 6);
-    }
-    if (typeof r.phishingLanguageMatch === 'string' && r.phishingLanguageMatch.trim()) {
-        addContextualFactor('credential-lure', 'Suspicious urgency language observed', 8);
-    }
-    if (r.hasPasswordField === true) {
-        addContextualFactor('credential-lure', 'Login/password form present', 5);
-    }
-    if (contextualFamilies.size >= 2) {
-        const bonus = contextualFamilies.size >= 3 ? 20 : 10;
-        factors.push({ label: `Corroborating context across ${contextualFamilies.size} distinct evidence families`, delta: bonus });
-        score += bonus;
-    }
-    const externalEvidence = calibrateExternalIntelligenceRisk(r.threatIntelligence);
-    if (externalEvidence.factor) {
-        factors.push(externalEvidence.factor);
-        score += externalEvidence.contribution;
-    }
-    if (r.activityStatus === 'active') {
-        factors.push({ label: 'Active site in use', delta: 8 });
-        score += 8;
-    }
-    if (r.hasMx === true) {
-        factors.push({ label: 'Mail server configured', delta: 8 });
-        score += 8;
-    }
-    if (r.hasSpf === true && r.hasDmarc === true) {
-        factors.push({ label: 'SPF + DMARC records present', delta: 3 });
-        score += 3;
-    }
-    else if (r.hasSpf === true || r.hasDmarc === true) {
-        factors.push({ label: 'SPF or DMARC record present', delta: 1 });
-        score += 1;
-    }
-    if (r.privacyProtected === true) {
-        factors.push({ label: 'WHOIS privacy protected', delta: 3 });
-        score += 3;
-    }
-    if (typeof r.domainAgeDays === 'number' && Number.isFinite(r.domainAgeDays) && r.domainAgeDays >= 0) {
-        if (r.domainAgeDays < 90) {
-            factors.push({ label: `Recently registered (${formatAge(r.domainAgeDays)})`, delta: 10 });
-            score += 10;
-        }
-        else if (r.domainAgeDays < 365) {
-            factors.push({ label: `Registered under a year ago (${formatAge(r.domainAgeDays)})`, delta: 4 });
-            score += 4;
-        }
-    }
-    return { modelVersion: RISK_MODEL_VERSION, score: Math.max(0, Math.min(100, Math.round(score))), factors };
 }
-export function computeRiskScore(r) {
-    return explainRiskScore(r)?.score ?? null;
+export function computeRiskScore(input) {
+    return explainRiskScore(input)?.score ?? null;
+}
+// Retained only for deterministic offline comparison of reviewed calibration
+// datasets. Runtime lookups always use the current model above.
+export function explainRiskScoreV6(input) {
+    const state = input.availability ?? input.state;
+    if (typeof state !== 'string' || !RISK_STATES.has(state))
+        return null;
+    const legacyBase = { registered: 10, for_sale: 5, expiring: 8 };
+    const factors = [];
+    const totals = new Map();
+    const add = (family, label, delta) => {
+        factors.push({ family, label, delta });
+        totals.set(family, (totals.get(family) ?? 0) + delta);
+    };
+    add('registration', `Base score for “${STATE_LABELS[state] ?? state}”`, legacyBase[state] ?? 0);
+    const contextual = new Set();
+    const context = mutationContext(input.mutationTypes);
+    if (context) {
+        add('domain-resemblance', context.label, context.delta);
+        contextual.add('domain-resemblance');
+    }
+    if (input.faviconMatch === true) {
+        add('brand-presentation', 'Favicon matches an official Brand Profile site', 18);
+        contextual.add('brand-presentation');
+    }
+    else if (input.faviconNearMatch === true) {
+        add('brand-presentation', 'Favicon resembles an official Brand Profile site', 14);
+        contextual.add('brand-presentation');
+    }
+    if (input.reusesOfficialAssets === true) {
+        add('brand-presentation', 'Official asset-host relationship observed', 6);
+        contextual.add('brand-presentation');
+    }
+    if (typeof input.phishingLanguageMatch === 'string' && input.phishingLanguageMatch.trim()) {
+        add('credential-lure', 'Suspicious urgency language observed', 8);
+        contextual.add('credential-lure');
+    }
+    if (input.hasPasswordField === true) {
+        add('credential-lure', 'Login/password form present', 5);
+        contextual.add('credential-lure');
+    }
+    if (contextual.size >= 2)
+        add('corroboration', `Corroborating context across ${contextual.size} distinct evidence families`, contextual.size >= 3 ? 20 : 10);
+    const external = calibrateExternalIntelligenceRisk(input.threatIntelligence);
+    if (external.factor)
+        add('external-intelligence', external.factor.label, external.contribution);
+    if (input.activityStatus === 'active')
+        add('operational-support', 'Active site in use', 8);
+    if (input.hasMx === true)
+        add('operational-support', 'Mail server configured', 8);
+    if (input.hasSpf === true && input.hasDmarc === true)
+        add('operational-support', 'SPF and DMARC records present', 3);
+    else if (input.hasSpf === true || input.hasDmarc === true)
+        add('operational-support', 'SPF or DMARC record present', 1);
+    if (input.privacyProtected === true)
+        add('registration', 'WHOIS privacy protected', 3);
+    if (typeof input.domainAgeDays === 'number' && Number.isFinite(input.domainAgeDays) && input.domainAgeDays >= 0) {
+        if (input.domainAgeDays < 90)
+            add('operational-support', `Recently registered (${formatAge(input.domainAgeDays)})`, 10);
+        else if (input.domainAgeDays < 365)
+            add('operational-support', `Registered under a year ago (${formatAge(input.domainAgeDays)})`, 4);
+    }
+    const rawScore = Math.round(factors.reduce((total, factor) => total + factor.delta, 0));
+    const score = Math.max(0, Math.min(100, rawScore));
+    return {
+        modelVersion: 6,
+        score,
+        rawScore,
+        capped: score !== rawScore,
+        factors,
+        families: [...totals].map(([id, contribution]) => ({ id, contribution, cap: null })),
+        evidenceQuality: scoreQuality(input),
+    };
 }
 export function riskTone(score) {
     if (score === null)
@@ -159,6 +282,6 @@ export function formatScoreBreakdown(explained, separator = '\n') {
     if (!explained)
         return '';
     const parts = explained.factors.map((factor) => `${factor.label} ${factor.delta >= 0 ? '+' : ''}${Math.round(factor.delta)}`);
-    parts.push(`Total ${explained.score}`);
+    parts.push(`Total ${explained.score} · Risk model v${explained.modelVersion} · evidence ${explained.evidenceQuality.state}`);
     return parts.join(separator);
 }

package/lib/rpki-evidence.mjs

@@ -0,0 +1,105 @@
+import { parseIpPrefix, prefixContains } from "./ip-prefix.mjs";
+const RPKI_EVIDENCE_SCHEMA = 'whoisleuth.rpki-route-review';
+const RPKI_EVIDENCE_VERSION = 1;
+const MAX_RPKI_RECORDS = 100_000;
+const MAX_RPKI_MATCHES = 50;
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : null;
+}
+function normalizeAsn(value) {
+    const text = typeof value === 'string' ? value.trim().replace(/^AS/iu, '') : value;
+    const number = Number(text);
+    return Number.isInteger(number) && number >= 0 && number <= 4_294_967_295 ? number : null;
+}
+function normalizeAuthorization(value) {
+    const source = record(value);
+    if (!source)
+        return null;
+    const prefix = typeof source.prefix === 'string' ? source.prefix : typeof source.route === 'string' ? source.route : '';
+    const parsedPrefix = parseIpPrefix(prefix);
+    const asn = normalizeAsn(source.asn ?? source.asID ?? source.origin);
+    const maxLengthValue = source.maxLength ?? source.max_length ?? parsedPrefix?.length;
+    const maxLength = Number(maxLengthValue);
+    const maximum = parsedPrefix?.family === 4 ? 32 : 128;
+    if (!parsedPrefix || asn === null || !Number.isInteger(maxLength)
+        || maxLength < parsedPrefix.length || maxLength > maximum)
+        return null;
+    return Object.freeze({ prefix: `${parsedPrefix.address}/${parsedPrefix.length}`, parsedPrefix, maxLength, asn });
+}
+function authorizationRows(value) {
+    if (Array.isArray(value))
+        return value;
+    const source = record(value);
+    if (!source)
+        return null;
+    if (Array.isArray(source.roas))
+        return source.roas;
+    if (Array.isArray(source.vrps))
+        return source.vrps;
+    if (Array.isArray(source.validated_route_origins))
+        return source.validated_route_origins;
+    return null;
+}
+function reviewRpkiRoute(input) {
+    const route = parseIpPrefix(input.routePrefix);
+    const originAsn = normalizeAsn(input.originAsn);
+    const rows = authorizationRows(input.authorizations);
+    const baseLimitations = Object.freeze([
+        'This offline review evaluates an explicitly supplied route prefix and origin ASN against an analyst-supplied VRP snapshot.',
+        'It does not collect BGP announcements, establish route ownership, or prove that the snapshot was current or complete.',
+    ]);
+    if (!route || originAsn === null || !rows) {
+        return Object.freeze({
+            schema: RPKI_EVIDENCE_SCHEMA,
+            version: RPKI_EVIDENCE_VERSION,
+            state: 'invalid_input',
+            routePrefix: null,
+            originAsn,
+            coveringAuthorizationCount: 0,
+            matchingAuthorizationCount: 0,
+            rejectedCount: 0,
+            truncated: false,
+            matches: Object.freeze([]),
+            limitations: baseLimitations,
+        });
+    }
+    const truncated = rows.length > MAX_RPKI_RECORDS;
+    const normalized = rows.slice(0, MAX_RPKI_RECORDS).map(normalizeAuthorization);
+    const rejectedCount = normalized.filter((item) => item === null).length + Math.max(0, rows.length - MAX_RPKI_RECORDS);
+    const authorizations = normalized.filter((item) => item !== null);
+    const covering = authorizations.filter((item) => prefixContains(item.parsedPrefix, route));
+    const matches = covering
+        .sort((left, right) => right.parsedPrefix.length - left.parsedPrefix.length || left.asn - right.asn)
+        .slice(0, MAX_RPKI_MATCHES)
+        .map((item) => Object.freeze({
+        prefix: item.prefix,
+        maxLength: item.maxLength,
+        asn: item.asn,
+        state: item.asn !== originAsn ? 'asn_mismatch'
+            : route.length > item.maxLength ? 'max_length_exceeded'
+                : 'valid',
+    }));
+    const matchingAuthorizationCount = matches.filter((item) => item.state === 'valid').length;
+    const state = covering.length === 0
+        ? 'not_found'
+        : matchingAuthorizationCount > 0
+            ? truncated || rejectedCount > 0 || covering.length > MAX_RPKI_MATCHES ? 'partial'
+                : 'valid'
+            : 'invalid';
+    return Object.freeze({
+        schema: RPKI_EVIDENCE_SCHEMA,
+        version: RPKI_EVIDENCE_VERSION,
+        state,
+        routePrefix: `${route.address}/${route.length}`,
+        originAsn,
+        coveringAuthorizationCount: covering.length,
+        matchingAuthorizationCount,
+        rejectedCount,
+        truncated,
+        matches: Object.freeze(matches),
+        limitations: baseLimitations,
+    });
+}
+export { MAX_RPKI_RECORDS, RPKI_EVIDENCE_SCHEMA, RPKI_EVIDENCE_VERSION, reviewRpkiRoute, };

package/lib/safe-fetch.mjs

@@ -22,7 +22,8 @@ import { promises as dns } from 'node:dns';
 import * as net from 'node:net';
 import * as crypto from 'node:crypto';
 import { Agent, fetch as undiciFetch } from 'undici';
-const MAX_REDIRECTS = 5;
+import { MAX_OUTBOUND_REDIRECTS } from "./outbound-request-bounds.mjs";
+const MAX_REDIRECTS = MAX_OUTBOUND_REDIRECTS;
 const MAX_SAFE_FETCH_URL_LENGTH = 4096;
 const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
 async function defaultSafeFetchRequest(url, options) {