@slicedearth/whoisleuth-cli 1.34.0 → 1.39.1

package/lib/scoring-evidence-quality.mjs

@@ -0,0 +1,107 @@
+export const SCORE_EVIDENCE_QUALITY_VERSION = 1;
+const MAX_SOURCES = 24;
+const MAX_FAMILIES = 12;
+const SOURCE_ID_RE = /^[a-z][a-z0-9_-]{0,63}$/u;
+const COMPLETE_STATES = new Set(['complete', 'not_found', 'success']);
+const LIMITED_STATES = new Set(['partial', 'unknown']);
+const UNAVAILABLE_STATES = new Set(['error', 'rate_limited', 'unavailable']);
+const SKIPPED_STATES = new Set(['skipped', 'unsupported']);
+const ACCEPTED_SOURCE_STATES = new Set([
+    ...COMPLETE_STATES,
+    ...LIMITED_STATES,
+    ...UNAVAILABLE_STATES,
+    ...SKIPPED_STATES,
+]);
+function boundedFamilyList(value) {
+    const output = new Set();
+    for (const item of value.slice(0, MAX_FAMILIES * 2)) {
+        const normalized = String(item).trim().toLowerCase().replace(/[^a-z0-9_-]+/gu, '-').slice(0, 64);
+        if (SOURCE_ID_RE.test(normalized))
+            output.add(normalized);
+        if (output.size >= MAX_FAMILIES)
+            break;
+    }
+    return [...output].sort();
+}
+function sourceCoverage(value) {
+    if (!Array.isArray(value))
+        return [];
+    const output = [];
+    const seen = new Set();
+    for (const candidate of value.slice(0, MAX_SOURCES * 4)) {
+        if (!candidate || typeof candidate !== 'object' || Array.isArray(candidate))
+            continue;
+        const item = candidate;
+        const source = typeof item.source === 'string' ? item.source.trim().toLowerCase() : '';
+        const state = typeof item.state === 'string' ? item.state.trim().toLowerCase() : '';
+        if (!SOURCE_ID_RE.test(source) || seen.has(source))
+            continue;
+        if (!ACCEPTED_SOURCE_STATES.has(state))
+            continue;
+        seen.add(source);
+        output.push({ source, state });
+        if (output.length >= MAX_SOURCES)
+            break;
+    }
+    return output;
+}
+function scanDepth(value) {
+    return value === 'deep' || value === 'fast' ? value : 'unknown';
+}
+function observedFreshness(value) {
+    if (typeof value !== 'string' || value.length > 64)
+        return 'unknown';
+    return Number.isFinite(Date.parse(value)) ? 'observed' : 'unknown';
+}
+export function buildScoreEvidenceQuality(input, options) {
+    const depth = scanDepth(input.scanDepth);
+    const coverage = sourceCoverage(input.sourceCoverage);
+    const completeSources = coverage.filter((item) => COMPLETE_STATES.has(item.state)).length;
+    const limitedSources = coverage.filter((item) => LIMITED_STATES.has(item.state)).length;
+    const unavailableSources = coverage.filter((item) => UNAVAILABLE_STATES.has(item.state)).length;
+    const skippedSources = coverage.filter((item) => SKIPPED_STATES.has(item.state)).length;
+    const observedFamilies = boundedFamilyList(options.observedFamilies ?? []);
+    const expectedFamilies = boundedFamilyList(options.expectedFamilies ?? []);
+    const observedSet = new Set(observedFamilies);
+    const missingFamilies = expectedFamilies.filter((family) => !observedSet.has(family));
+    const limitations = [];
+    let state = 'complete';
+    if (!coverage.length || depth === 'unknown')
+        state = 'unknown';
+    else if (unavailableSources || limitedSources)
+        state = 'partial';
+    else if (options.expectedDepth === 'deep' && depth !== 'deep')
+        state = 'limited';
+    if (missingFamilies.length && state === 'complete')
+        state = 'limited';
+    if (options.expectedDepth === 'deep' && depth !== 'deep') {
+        limitations.push('A fast or unknown-depth observation does not evaluate every website and mail scoring family.');
+    }
+    if (limitedSources || unavailableSources) {
+        limitations.push('One or more score-relevant sources were partial, unavailable, or indeterminate.');
+    }
+    if (skippedSources) {
+        limitations.push('One or more reported sources were skipped or unsupported and did not contribute to the score.');
+    }
+    if (!coverage.length)
+        limitations.push('Source-level coverage was not supplied with this score.');
+    if (missingFamilies.length)
+        limitations.push(`No usable observation was supplied for: ${missingFamilies.join(', ')}.`);
+    const boundedLimitations = [
+        ...limitations.slice(0, 5),
+        'Evidence coverage qualifies the score; it never adds points or turns missing evidence into a negative finding.',
+    ];
+    return Object.freeze({
+        version: SCORE_EVIDENCE_QUALITY_VERSION,
+        state,
+        scanDepth: depth,
+        freshness: observedFreshness(input.observedAt),
+        completeSources,
+        limitedSources,
+        unavailableSources,
+        skippedSources,
+        observedFamilies: Object.freeze(observedFamilies),
+        missingFamilies: Object.freeze(missingFamilies),
+        limitations: Object.freeze(boundedLimitations),
+    });
+}

package/lib/security-txt.mjs

@@ -202,7 +202,7 @@ function parseSecurityTxt(text, options = {}) {
     const limitations = [
         ...(signedPayload.signed ? ['A cleartext signature was present but was not cryptographically verified.'] : []),
         ...(canonicalMatches === false ? ['The fetched URL was not listed by the file as a Canonical location.'] : []),
-        ...(valuesTruncated ? ['The response or normalized field set exceeded a collection bound.'] : []),
+        ...(valuesTruncated ? ['The response or normalised field set exceeded a collection bound.'] : []),
     ];
     const detail = state === 'malformed'
         ? 'The file did not contain at least one valid Contact field and exactly one valid Expires field.'
@@ -314,7 +314,7 @@ async function collectSecurityTxt(hostname, dependencies = {}) {
             }
             if (response.status === 404 || response.status === 410) {
                 await response.body?.cancel().catch(() => { });
-                return emptyResult('absent', 'No security.txt file was published at the standardized location for this hostname.', {
+                return emptyResult('absent', 'No security.txt file was published at the standardised location for this hostname.', {
                     observedAt, requestedUrl, finalUrl: result.finalUrl, httpStatus: response.status, durationMs: now() - startedAt,
                 });
             }
@@ -328,7 +328,7 @@ async function collectSecurityTxt(hostname, dependencies = {}) {
             const charset = contentType.match(/;\s*charset\s*=\s*"?([^;"\s]+)/iu)?.[1]?.toLowerCase() || null;
             if (!/^text\/plain(?:\s*;|$)/iu.test(contentType) || (charset !== null && charset !== 'utf-8')) {
                 await response.body?.cancel().catch(() => { });
-                return emptyResult('unsupported', 'The standardized endpoint did not return a UTF-8 text/plain security.txt document.', {
+                return emptyResult('unsupported', 'The standardised endpoint did not return a UTF-8 text/plain security.txt document.', {
                     observedAt, requestedUrl, finalUrl: result.finalUrl, httpStatus: response.status, durationMs: now() - startedAt,
                 });
             }

package/lib/semantic-version.mjs

@@ -0,0 +1,54 @@
+// Dependency-free semantic-version validation shared by release tooling,
+// runtime identity, and the frontend build. Callers provide a bounded label so
+// errors retain their local context without reimplementing SemVer parsing.
+export const MAX_SEMANTIC_VERSION_LENGTH = 128;
+function fail(label, detail) {
+    throw new TypeError(`${label} ${detail}`);
+}
+function validateIdentifierList(value, label, kind, forbidNumericLeadingZero) {
+    const identifiers = value.split('.');
+    if (identifiers.some((identifier) => identifier.length === 0)) {
+        fail(label, `${kind} contains an empty identifier.`);
+    }
+    for (const identifier of identifiers) {
+        if (!/^[0-9A-Za-z-]+$/u.test(identifier)) {
+            fail(label, `${kind} contains an invalid identifier.`);
+        }
+        if (forbidNumericLeadingZero && /^[0-9]+$/u.test(identifier) && identifier.length > 1 && identifier.startsWith('0')) {
+            fail(label, `${kind} numeric identifiers must not contain leading zeroes.`);
+        }
+    }
+}
+export function normalizeBoundedSemanticVersion(value, label = 'Semantic') {
+    if (typeof value !== 'string'
+        || value.length === 0
+        || value.length > MAX_SEMANTIC_VERSION_LENGTH
+        || value.trim() !== value) {
+        fail(label, 'version must be a bounded semantic-version string.');
+    }
+    const buildParts = value.split('+');
+    if (buildParts.length > 2)
+        fail(label, 'version contains more than one build-metadata separator.');
+    const [precedence, buildMetadata] = buildParts;
+    if (!precedence)
+        fail(label, 'version must include numeric precedence.');
+    const prereleaseSeparator = precedence.indexOf('-');
+    const core = prereleaseSeparator === -1 ? precedence : precedence.slice(0, prereleaseSeparator);
+    const prerelease = prereleaseSeparator === -1 ? undefined : precedence.slice(prereleaseSeparator + 1);
+    const coreParts = core.split('.');
+    if (coreParts.length !== 3 || coreParts.some((part) => !/^(?:0|[1-9][0-9]*)$/u.test(part))) {
+        fail(label, 'version must contain major, minor, and patch numbers without leading zeroes.');
+    }
+    if (prerelease !== undefined)
+        validateIdentifierList(prerelease, label, 'prerelease', true);
+    if (buildMetadata !== undefined)
+        validateIdentifierList(buildMetadata, label, 'build metadata', false);
+    return value;
+}
+export function normalizeBoundedStableSemanticVersion(value, label = 'Stable semantic') {
+    const version = normalizeBoundedSemanticVersion(value, label);
+    if (version.includes('-') || version.includes('+')) {
+        fail(label, 'version must not include prerelease or build identifiers.');
+    }
+    return version;
+}

package/lib/static-html-analysis.mjs

@@ -3,6 +3,7 @@
 // so deeply nested hostile markup cannot create an unbounded element tree.
 // Only normalized start-tag markup and capped script indicators are retained.
 import { Tokenizer, TokenizerMode } from 'parse5';
+import { MAX_CSP_META_POLICIES, MAX_RESPONSE_POLICY_HEADER_BYTES, } from "./response-policy.mjs";
 const MAX_STATIC_HTML_CHARS = 300_000;
 const MAX_STATIC_HTML_TAGS = 8_192;
 const MAX_STATIC_STRUCTURE_TOKENS = 4_096;
@@ -192,6 +193,7 @@ function analyzeStaticHtml(value, options = {}) {
     const markup = [];
     const structureTokens = [];
     const scripts = [];
+    const cspMetaPolicies = [];
     const forms = {
         formsObserved: 0,
         inputsObserved: 0,
@@ -209,6 +211,9 @@ function analyzeStaticHtml(value, options = {}) {
     let structureLimitReached = false;
     let scriptLimitReached = false;
     let inlineLimitReached = false;
+    let cspMetaLimitReached = false;
+    let insideExplicitHead = false;
+    let scriptElementSeen = false;
     function appendInlineScript(chars) {
         if (!activeInlineScript || !chars)
             return;
@@ -242,6 +247,23 @@ function analyzeStaticHtml(value, options = {}) {
             }
             tagsExamined += 1;
             appendStructureToken(token.selfClosing || VOID_TAGS.has(tagName) ? `${tagName}/` : tagName);
+            if (tagName === 'head')
+                insideExplicitHead = true;
+            if (tagName === 'meta' && insideExplicitHead) {
+                const httpEquiv = attributeValue(token.attrs, 'http-equiv', 64);
+                if (httpEquiv.value === 'content-security-policy') {
+                    const content = attributeValue(token.attrs, 'content', MAX_RESPONSE_POLICY_HEADER_BYTES);
+                    if (content.value === null || !content.value) {
+                        cspMetaLimitReached = cspMetaLimitReached || content.present || content.truncated;
+                    }
+                    else if (cspMetaPolicies.length >= MAX_CSP_META_POLICIES) {
+                        cspMetaLimitReached = true;
+                    }
+                    else {
+                        cspMetaPolicies.push({ content: content.value, beforeScript: !scriptElementSeen });
+                    }
+                }
+            }
             if (markup.length < MAX_TECHNOLOGY_TAGS) {
                 const serialized = serializedStartTag(tagName, token.attrs);
                 if (serialized.limitReached)
@@ -287,6 +309,7 @@ function analyzeStaticHtml(value, options = {}) {
                 activeInlineScript = null;
                 return;
             }
+            scriptElementSeen = true;
             if (scripts.length >= MAX_SCRIPT_ELEMENTS) {
                 scriptLimitReached = true;
                 activeInlineScript = null;
@@ -305,6 +328,8 @@ function analyzeStaticHtml(value, options = {}) {
             const tagName = token.tagName.toLowerCase();
             if (tagName === 'script')
                 activeInlineScript = null;
+            if (tagName === 'head')
+                insideExplicitHead = false;
             if (!VOID_TAGS.has(tagName))
                 appendStructureToken(`/${tagName}`);
         },
@@ -327,6 +352,8 @@ function analyzeStaticHtml(value, options = {}) {
         markup: markup.join('\n'),
         structureTokens,
         scripts,
+        cspMetaPolicies,
+        cspMetaLimitReached,
         forms,
         inputLimitReached,
         tagLimitReached,

package/lib/threat-intelligence-manifests.mjs

@@ -352,7 +352,7 @@ function normalizeConnectorOutputs(value) {
         throw new TypeError('Connector outputs must be unique');
     }
     if (!entities.length) {
-        throw new TypeError('Connector outputs require at least one normalized entity type');
+        throw new TypeError('Connector outputs require at least one normalised entity type');
     }
     const entityTypes = new Set(entities);
     for (const relationship of relationships) {

package/lib/threatfox-intelligence.mjs

@@ -3,6 +3,8 @@
 // sample. The adapter is disabled unless explicitly enabled and credentialed.
 import { abusechAuthKey } from "./abusech-auth.mjs";
 import { safeFetchDetailed, readTextCapped } from "./safe-fetch.mjs";
+import { whoisleuthRequestHeaders } from "./outbound-identity.mjs";
+import { providerPolicyAdmission } from "./provider-policy-admission.mjs";
 import { createThreatIntelligenceResult, defineThreatIntelligenceProvider, normalizeThreatIntelligenceTarget, } from "./threat-intelligence-contract.mjs";
 const THREATFOX_SEARCH_ENDPOINT = 'https://threatfox-api.abuse.ch/api/v1/';
 const THREATFOX_MAX_RESULTS = 20;
@@ -46,15 +48,18 @@ function threatfoxConfiguration(env = process.env) {
     const source = env && typeof env === 'object' ? env : {};
     const enabled = enabledValue(source.WHOISLEUTH_ENABLE_THREATFOX);
     const authKey = abusechAuthKey(source);
+    const policy = providerPolicyAdmission(THREATFOX_PROVIDER.terms, source);
     return {
         enabled,
-        configured: enabled && authKey !== null,
+        configured: enabled && policy.allowed && authKey !== null,
         authKey: enabled ? authKey : null,
         reason: !enabled
             ? 'Malware-IOC intelligence is not enabled for this deployment.'
-            : authKey
-                ? null
-                : 'Malware-IOC intelligence is enabled but its API credential is unavailable or malformed.',
+            : !policy.allowed
+                ? policy.reason
+                : authKey
+                    ? null
+                    : 'Malware-IOC intelligence is enabled but its API credential is unavailable or malformed.',
     };
 }
 function boundedText(value, maxLength) {
@@ -192,7 +197,7 @@ function createThreatfoxIntelligenceAdapter(dependencies = {}) {
                     accept: 'application/json',
                     'auth-key': configuration.authKey,
                     'content-type': 'application/json',
-                    'user-agent': 'WHOISleuth/1.0',
+                    ...whoisleuthRequestHeaders(),
                 },
                 body,
                 signal: AbortSignal.timeout(THREATFOX_PROVIDER.limits.timeoutMs),
@@ -277,7 +282,7 @@ function createThreatfoxIntelligenceAdapter(dependencies = {}) {
                 truncated,
                 detail: findings.length
                     ? `Found ${findings.length} bounded malware-IOC record${findings.length === 1 ? '' : 's'} for this domain${truncated ? '; additional provider records may exist' : ''}.`
-                    : 'The provider reported a match but no returned record could be safely normalized.',
+                    : 'The provider reported a match but no returned record could be safely normalised.',
                 upstreamStatus,
                 findings,
                 limitations: [

package/lib/tls-intelligence.mjs

@@ -12,7 +12,8 @@ import * as tls from 'node:tls';
 import { domainToASCII } from 'node:url';
 import { createObservation } from "./observation.mjs";
 import { isPrivateAddress, resolvePublicAddresses } from "./safe-fetch.mjs";
-const TLS_PROFILE_VERSION = 2;
+import { parseCertificateExtensionProfile, } from "./certificate-extension-profile.mjs";
+const TLS_PROFILE_VERSION = 3;
 const TLS_PORT = 443;
 const TLS_TIMEOUT_MS = 5000;
 const MAX_RESOLVED_ADDRESSES = 64;
@@ -486,6 +487,15 @@ function normalizeCertificate(value, state, options = {}) {
         };
         certificate.extendedKeyUsage = certificatePurposes(parsedCertificate?.keyUsage || record.ext_key_usage, state);
         certificate.authorityInformationAccess = authorityInformationAccess(parsedCertificate?.infoAccess || record.infoAccess, state);
+        const extensionProfile = parseCertificateExtensionProfile(record.raw);
+        if (extensionProfile.parsed || extensionProfile.partial) {
+            certificate.extensionProfile = extensionProfile;
+            if (extensionProfile.partial)
+                state.discarded += 1;
+            if (extensionProfile.certificatePolicies.truncated || extensionProfile.crlDistributionPoints.truncated) {
+                state.truncated = true;
+            }
+        }
     }
     return certificate;
 }
@@ -562,7 +572,7 @@ function tlsFindings(profile) {
     if (profile.validity.status === 'not_yet_valid')
         findings.push({ id: 'certificate_not_yet_valid', tone: 'warning', label: 'Certificate not yet valid', detail: 'The leaf certificate validity period had not started at observation time.' });
     if (profile.authorization.authorized === false)
-        findings.push({ id: 'certificate_unauthorized', tone: 'warning', label: 'Certificate not authorized', detail: 'The runtime trust store did not authorize the observed certificate chain. This can reflect an incomplete chain, private CA, self-signed certificate, expiry, or another validation failure.' });
+        findings.push({ id: 'certificate_unauthorized', tone: 'warning', label: 'Certificate not authorised', detail: 'The runtime trust store did not authorise the observed certificate chain. This can reflect an incomplete chain, private CA, self-signed certificate, expiry, or another validation failure.' });
     if (profile.hostname.matches === false)
         findings.push({ id: 'hostname_mismatch', tone: 'warning', label: 'Hostname mismatch', detail: 'The observed leaf certificate did not match the SNI hostname.' });
     if (profile.certificate?.subjectAltNames?.dnsNames.some((name) => name.startsWith('*.')))
@@ -631,7 +641,7 @@ function buildTlsObservation(handshake = {}, options = {}) {
             truncated: state.truncated,
             limitations: [
                 'This is a point-in-time TLS handshake to one validated public address; other addresses or edge locations may present different results.',
-                'Authorization reflects the certificate authorities and verification behavior available to this runtime.',
+                'Authorisation reflects the certificate authorities and verification behaviour available to this runtime.',
                 'The profile records the negotiated connection only and does not enumerate supported TLS versions or cipher suites.',
                 ...(state.truncated ? ['One or more certificate fields or chain entries reached a retention limit.'] : []),
             ],

package/lib/tlsa-evidence.mjs

@@ -0,0 +1,194 @@
+import { Buffer } from 'node:buffer';
+import { createHash } from 'node:crypto';
+import { domainToASCII } from 'node:url';
+const TLSA_EVIDENCE_SCHEMA = 'whoisleuth.tlsa-evidence';
+const TLSA_EVIDENCE_VERSION = 1;
+const MAX_TLSA_RECORDS = 50;
+const MAX_CERTIFICATE_BYTES = 256 * 1024;
+const MAX_AUTHORITY_MATERIALS = 10;
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : null;
+}
+function integer(value, minimum, maximum) {
+    return Number.isInteger(value) && Number(value) >= minimum && Number(value) <= maximum
+        ? Number(value)
+        : null;
+}
+function hex(value) {
+    if (typeof value !== 'string')
+        return null;
+    const normalized = value.replace(/\s+/gu, '').toLowerCase();
+    return normalized && normalized.length % 2 === 0 && /^[0-9a-f]+$/u.test(normalized) ? normalized : null;
+}
+function normalizeTlsaRecord(value) {
+    const source = record(value);
+    if (!source)
+        return null;
+    const usage = integer(source.usage, 0, 3);
+    const selector = integer(source.selector, 0, 1);
+    const matchingType = integer(source.matchingType, 0, 2);
+    const associationData = hex(source.associationData);
+    if (usage === null || selector === null || matchingType === null || !associationData)
+        return null;
+    if (matchingType === 1 && associationData.length !== 64)
+        return null;
+    if (matchingType === 2 && associationData.length !== 128)
+        return null;
+    if (matchingType === 0 && associationData.length > MAX_CERTIFICATE_BYTES * 2)
+        return null;
+    return Object.freeze({ usage, selector, matchingType, associationData });
+}
+function decodeBoundedBase64(value) {
+    if (typeof value !== 'string' || value.length > MAX_CERTIFICATE_BYTES * 2 || !/^[A-Za-z0-9+/]+={0,2}$/u.test(value))
+        return null;
+    const decoded = Buffer.from(value, 'base64');
+    return decoded.length > 0 && decoded.length <= MAX_CERTIFICATE_BYTES && decoded.toString('base64') === value ? decoded : null;
+}
+function normalizeTlsaServiceName(value) {
+    if (typeof value !== 'string' || value.length > 270)
+        return null;
+    const match = /^_(\d{1,5})\._(tcp|udp)\.(.+)$/iu.exec(value.trim().replace(/\.$/u, ''));
+    if (!match)
+        return null;
+    const port = Number(match[1]);
+    const transport = match[2]?.toLowerCase();
+    const hostname = domainToASCII(String(match[3] ?? '').toLowerCase());
+    if (!Number.isInteger(port) || port < 1 || port > 65_535 || (transport !== 'tcp' && transport !== 'udp'))
+        return null;
+    if (!hostname || hostname.length > 253 || hostname.split('.').some((label) => !/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/u.test(label)))
+        return null;
+    return Object.freeze({ ownerName: `_${port}._${transport}.${hostname}`, port, transport, hostname });
+}
+function normalizeCertificateMaterial(value) {
+    const source = record(value);
+    if (!source)
+        return null;
+    const certificateDer = decodeBoundedBase64(source.certificateDerBase64);
+    const spkiDer = decodeBoundedBase64(source.spkiDerBase64);
+    return certificateDer || spkiDer ? Object.freeze({ certificateDer, spkiDer }) : null;
+}
+function selectedValues(recordValue, materials) {
+    return materials.flatMap((material) => {
+        const selected = recordValue.selector === 0 ? material.certificateDer : material.spkiDer;
+        if (!selected)
+            return [];
+        if (recordValue.matchingType === 0)
+            return [selected.toString('hex')];
+        if (recordValue.matchingType === 1)
+            return [createHash('sha256').update(selected).digest('hex')];
+        return [createHash('sha512').update(selected).digest('hex')];
+    });
+}
+function normalizeDnssecState(value) {
+    return value === 'validated' || value === 'insecure' || value === 'bogus' ? value : 'unavailable';
+}
+function normalizePkixValidationState(value) {
+    return value === 'validated' || value === 'failed' ? value : 'unavailable';
+}
+function analyzeTlsaEvidence(input) {
+    const service = normalizeTlsaServiceName(input.serviceName);
+    const dnssecState = normalizeDnssecState(input.dnssecState);
+    const pkixValidationState = normalizePkixValidationState(input.pkixValidationState);
+    const leafMaterial = normalizeCertificateMaterial({
+        certificateDerBase64: input.certificateDerBase64,
+        spkiDerBase64: input.spkiDerBase64,
+    });
+    const rawAuthorityMaterials = Array.isArray(input.authorityMaterials) ? input.authorityMaterials : [];
+    const normalizedAuthorityMaterials = rawAuthorityMaterials
+        .slice(0, MAX_AUTHORITY_MATERIALS)
+        .map(normalizeCertificateMaterial);
+    const authorityMaterials = normalizedAuthorityMaterials
+        .filter((item) => item !== null);
+    const authorityMaterialRejectedCount = normalizedAuthorityMaterials.length - authorityMaterials.length;
+    const authorityMaterialTruncated = rawAuthorityMaterials.length > MAX_AUTHORITY_MATERIALS;
+    const raw = Array.isArray(input.records) ? input.records : null;
+    if (!raw || !service) {
+        return Object.freeze({
+            schema: TLSA_EVIDENCE_SCHEMA,
+            version: TLSA_EVIDENCE_VERSION,
+            state: 'invalid',
+            dnssecState,
+            pkixValidationState,
+            service,
+            authorityMaterialCount: authorityMaterials.length,
+            authorityMaterialRejectedCount,
+            authorityMaterialTruncated,
+            records: Object.freeze([]),
+            rejectedCount: 0,
+            truncated: false,
+            limitations: Object.freeze([
+                ...(!raw ? ['TLSA evidence must be supplied as a bounded record array.'] : []),
+                ...(!service ? ['TLSA evidence must be bound to a valid _port._transport.hostname service name.'] : []),
+            ]),
+        });
+    }
+    const truncated = raw.length > MAX_TLSA_RECORDS;
+    const normalized = raw.slice(0, MAX_TLSA_RECORDS).map(normalizeTlsaRecord);
+    const rejectedCount = normalized.filter((item) => item === null).length + Math.max(0, raw.length - MAX_TLSA_RECORDS);
+    const records = normalized.filter((item) => item !== null);
+    const results = records.map((item) => {
+        const materials = item.usage === 0 || item.usage === 2
+            ? authorityMaterials
+            : leafMaterial ? [leafMaterial] : [];
+        const selected = selectedValues(item, materials);
+        if (!selected.length) {
+            const role = item.usage === 0 || item.usage === 2 ? 'authority' : 'leaf';
+            return Object.freeze({ ...item, state: 'unavailable', reason: `No bounded ${role} ${item.selector === 0 ? 'certificate' : 'SPKI'} bytes were supplied for comparison.` });
+        }
+        const matched = selected.includes(item.associationData);
+        return Object.freeze({
+            ...item,
+            state: matched ? 'matched' : 'different',
+            reason: matched ? 'The supplied certificate material matched this TLSA association.' : 'The supplied certificate material differed from this TLSA association.',
+        });
+    });
+    const hasMatch = results.some((item) => item.state === 'matched');
+    const hasDifferent = results.some((item) => item.state === 'different');
+    const hasUnavailable = results.some((item) => item.state === 'unavailable');
+    const limitations = [
+        'This offline comparison does not connect to the target, retrieve DNS, negotiate SMTP STARTTLS, or validate a DNSSEC chain.',
+        'A TLSA match is usable as DANE evidence only when the DNSSEC state was independently validated for the same observation.',
+        'PKIX-TA and PKIX-EE usages require an independently validated PKIX path; association matching alone does not establish that prerequisite.',
+    ];
+    if (dnssecState !== 'validated' && hasMatch) {
+        limitations.push('Certificate material matched, but DNSSEC was not validated, so the result remains partial.');
+    }
+    const matchedPkixDependent = results.some((item) => item.state === 'matched' && (item.usage === 0 || item.usage === 1));
+    const matchedDaneOnly = results.some((item) => item.state === 'matched' && (item.usage === 2 || item.usage === 3));
+    if (matchedPkixDependent && pkixValidationState !== 'validated') {
+        limitations.push('A PKIX-dependent association matched, but a validated PKIX path was not supplied, so the result is not complete.');
+    }
+    if (authorityMaterialRejectedCount > 0 || authorityMaterialTruncated) {
+        limitations.push('Authority certificate material was malformed or exceeded the review bound, so an unmatched trust-anchor association remains partial.');
+    }
+    const trustedMatch = dnssecState === 'validated'
+        && (matchedDaneOnly || matchedPkixDependent && pkixValidationState === 'validated');
+    const state = results.length === 0
+        ? 'unavailable'
+        : hasDifferent && !hasMatch && rejectedCount === 0 && !truncated
+            && authorityMaterialRejectedCount === 0 && !authorityMaterialTruncated
+            ? 'different'
+            : hasMatch && (dnssecState === 'bogus' || matchedPkixDependent && pkixValidationState === 'failed' && !matchedDaneOnly)
+                ? 'untrusted'
+                : trustedMatch && !hasUnavailable && rejectedCount === 0 && !truncated
+                    ? 'matched'
+                    : 'partial';
+    return Object.freeze({
+        schema: TLSA_EVIDENCE_SCHEMA,
+        version: TLSA_EVIDENCE_VERSION,
+        state,
+        dnssecState,
+        pkixValidationState,
+        service,
+        authorityMaterialCount: authorityMaterials.length,
+        authorityMaterialRejectedCount,
+        authorityMaterialTruncated,
+        records: Object.freeze(results),
+        rejectedCount,
+        truncated,
+        limitations: Object.freeze(limitations),
+    });
+}
+export { MAX_TLSA_RECORDS, MAX_AUTHORITY_MATERIALS, TLSA_EVIDENCE_SCHEMA, TLSA_EVIDENCE_VERSION, analyzeTlsaEvidence, normalizeTlsaRecord, normalizeTlsaServiceName, };

package/lib/urlhaus-intelligence.mjs

@@ -6,6 +6,8 @@
 import { classifyQuery } from "./classify.mjs";
 import { abusechAuthKey } from "./abusech-auth.mjs";
 import { safeFetchDetailed, readTextCapped } from "./safe-fetch.mjs";
+import { whoisleuthRequestHeaders } from "./outbound-identity.mjs";
+import { providerPolicyAdmission } from "./provider-policy-admission.mjs";
 import { createThreatIntelligenceResult, defineThreatIntelligenceProvider, normalizeThreatIntelligenceTarget, } from "./threat-intelligence-contract.mjs";
 const URLHAUS_HOST_ENDPOINT = 'https://urlhaus-api.abuse.ch/v1/host/';
 const URLHAUS_MAX_RESULTS = 20;
@@ -53,15 +55,18 @@ function urlhausConfiguration(env = process.env) {
     const source = env && typeof env === 'object' ? env : {};
     const enabled = enabledValue(source.WHOISLEUTH_ENABLE_URLHAUS);
     const authKey = abusechAuthKey(source);
+    const policy = providerPolicyAdmission(URLHAUS_PROVIDER.terms, source);
     return {
         enabled,
-        configured: enabled && authKey !== null,
+        configured: enabled && policy.allowed && authKey !== null,
         authKey: enabled ? authKey : null,
         reason: !enabled
             ? 'Malware-host intelligence is not enabled for this deployment.'
-            : authKey
-                ? null
-                : 'Malware-host intelligence is enabled but its API credential is unavailable or malformed.',
+            : !policy.allowed
+                ? policy.reason
+                : authKey
+                    ? null
+                    : 'Malware-host intelligence is enabled but its API credential is unavailable or malformed.',
     };
 }
 function boundedText(value, maxLength) {
@@ -231,7 +236,7 @@ function createUrlhausIntelligenceAdapter(dependencies = {}) {
                     accept: 'application/json',
                     'auth-key': configuration.authKey,
                     'content-type': 'application/x-www-form-urlencoded;charset=UTF-8',
-                    'user-agent': 'WHOISleuth/1.0',
+                    ...whoisleuthRequestHeaders(),
                 },
                 body,
                 signal: AbortSignal.timeout(URLHAUS_PROVIDER.limits.timeoutMs),
@@ -328,7 +333,7 @@ function createUrlhausIntelligenceAdapter(dependencies = {}) {
                 truncated,
                 detail: findings.length
                     ? `Found ${findings.length} bounded malware-distribution record${findings.length === 1 ? '' : 's'} for this host${truncated ? '; additional provider records may exist' : ''}.`
-                    : 'The provider reported this host but no returned record could be safely normalized.',
+                    : 'The provider reported this host but no returned record could be safely normalised.',
                 upstreamStatus,
                 findings,
                 limitations: [

package/lib/urlscan-intelligence.mjs

@@ -4,6 +4,8 @@
 // key; credentials are sent only in a header to the fixed HTTPS endpoint.
 import { classifyQuery } from "./classify.mjs";
 import { safeFetchDetailed, readTextCapped } from "./safe-fetch.mjs";
+import { whoisleuthRequestHeaders } from "./outbound-identity.mjs";
+import { providerPolicyAdmission } from "./provider-policy-admission.mjs";
 import { createThreatIntelligenceResult, defineThreatIntelligenceProvider, normalizeThreatIntelligenceTarget, } from "./threat-intelligence-contract.mjs";
 const URLSCAN_SEARCH_ENDPOINT = 'https://urlscan.io/api/v1/search/';
 const URLSCAN_SEARCH_DAYS = 90;
@@ -57,15 +59,18 @@ function urlscanConfiguration(env = process.env) {
     const source = env && typeof env === 'object' ? env : {};
     const enabled = enabledValue(source.WHOISLEUTH_ENABLE_URLSCAN);
     const apiKey = normalizedApiKey(source.URLSCAN_API_KEY);
+    const policy = providerPolicyAdmission(URLSCAN_PROVIDER.terms, source);
     return {
         enabled,
-        configured: enabled && apiKey !== null,
+        configured: enabled && policy.allowed && apiKey !== null,
         apiKey: enabled ? apiKey : null,
         reason: !enabled
             ? 'Archived URLscan verdict search is not enabled for this deployment.'
-            : apiKey
-                ? null
-                : 'Archived URLscan verdict search is enabled but its API credential is unavailable or malformed.',
+            : !policy.allowed
+                ? policy.reason
+                : apiKey
+                    ? null
+                    : 'Archived URLscan verdict search is enabled but its API credential is unavailable or malformed.',
     };
 }
 function boundedText(value, maxLength) {
@@ -230,7 +235,7 @@ function createUrlscanIntelligenceAdapter(dependencies = {}) {
                 headers: {
                     accept: 'application/json',
                     'api-key': configuration.apiKey,
-                    'user-agent': 'WHOISleuth/1.0',
+                    ...whoisleuthRequestHeaders(),
                 },
                 signal: AbortSignal.timeout(URLSCAN_PROVIDER.limits.timeoutMs),
             }, { maxRedirects: 0 });