@slicedearth/whoisleuth-cli 1.36.1 → 1.39.1

package/lib/rdap-search-workbench.mjs

@@ -2,10 +2,16 @@ const RDAP_SEARCH_WORKBENCH_SCHEMA = 'whoisleuth.rdap-search-workbench';
 const RDAP_SEARCH_WORKBENCH_VERSION = 1;
 const MAX_HELP_ENTRIES = 64;
 const MAX_QUERY_VALUE_LENGTH = 254;
-const SEARCHABLE_RESOURCE_TYPES = new Set(['domains', 'nameservers', 'entities', 'ips', 'autnums']);
-const RELATED_RESOURCE_TYPES = new Set(['domains', 'nameservers', 'entities', 'ips', 'autnums']);
+const SEARCHABLE_RESOURCE_TYPES = new Set(['domains', 'nameservers', 'entities']);
+const RELATED_RESOURCE_TYPES = new Set(['entity']);
 const RECOGNIZED_PROPERTIES = new Set(['handle', 'fn', 'email', 'role']);
 const SENSITIVE_PROPERTIES = new Set(['fn', 'email']);
+const REGISTERED_PROPERTY_PATHS = Object.freeze({
+    email: Object.freeze(["$.entities[*].vcardArray[1][?(@[0]=='email')][3]"]),
+    fn: Object.freeze(["$.entities[*].vcardArray[1][?(@[0]=='fn')][3]"]),
+    handle: Object.freeze(['$.entities[*].handle']),
+    role: Object.freeze(['$.entities[*].roles']),
+});
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value)
         ? value
@@ -136,14 +142,13 @@ function planRdapReverseSearch(help, requested) {
             limitation: 'The supplied help response did not advertise this exact reverse-search tuple.',
         });
     }
-    const parameter = `${relatedResourceType}_${property}`;
     const contactDisclosure = capability.disclosure === 'contact';
     return Object.freeze({
         schema: RDAP_SEARCH_WORKBENCH_SCHEMA,
         version: RDAP_SEARCH_WORKBENCH_VERSION,
         state: 'ready',
-        requestPath: `/${searchableResourceType}`,
-        query: Object.freeze({ [parameter]: value }),
+        requestPath: `/${searchableResourceType}/reverse_search/${relatedResourceType}`,
+        query: Object.freeze({ [property]: value }),
         disclosure: Object.freeze({
             class: capability.disclosure,
             summary: contactDisclosure
@@ -154,4 +159,89 @@ function planRdapReverseSearch(help, requested) {
         limitation: 'This is an offline request plan. It neither sends the query nor establishes result authority, completeness, or currentness.',
     });
 }
-export { MAX_HELP_ENTRIES, MAX_QUERY_VALUE_LENGTH, RDAP_SEARCH_WORKBENCH_SCHEMA, RDAP_SEARCH_WORKBENCH_VERSION, normalizeRdapSearchHelp, planRdapReverseSearch, };
+function inspectRdapReverseSearchResponse(value, requestedProperties = []) {
+    const document = record(value);
+    if (!document) {
+        return Object.freeze({
+            schema: RDAP_SEARCH_WORKBENCH_SCHEMA,
+            version: RDAP_SEARCH_WORKBENCH_VERSION,
+            state: 'invalid',
+            mappings: Object.freeze([]),
+            missingProperties: Object.freeze([]),
+            rejectedCount: 0,
+            truncated: false,
+            limitations: Object.freeze(['The reverse-search response was not an object.']),
+        });
+    }
+    const requested = [...new Set(requestedProperties
+            .map(boundedToken)
+            .filter((property) => Boolean(property)))]
+        .slice(0, RECOGNIZED_PROPERTIES.size);
+    const raw = document.reverse_search_properties_mapping;
+    if (!Array.isArray(raw)) {
+        return Object.freeze({
+            schema: RDAP_SEARCH_WORKBENCH_SCHEMA,
+            version: RDAP_SEARCH_WORKBENCH_VERSION,
+            state: 'invalid',
+            mappings: Object.freeze([]),
+            missingProperties: Object.freeze(requested),
+            rejectedCount: raw === undefined ? 0 : 1,
+            truncated: false,
+            limitations: Object.freeze([
+                'The response did not provide a valid reverse-search property mapping, so its result fields cannot be reconciled with the requested predicates.',
+            ]),
+        });
+    }
+    const mappings = [];
+    const seen = new Set();
+    let rejectedCount = 0;
+    const truncated = raw.length > MAX_HELP_ENTRIES;
+    for (const entry of raw.slice(0, MAX_HELP_ENTRIES)) {
+        const candidate = record(entry);
+        const property = boundedToken(candidate?.property);
+        const propertyPath = typeof candidate?.propertyPath === 'string'
+            ? candidate.propertyPath.trim().slice(0, 512)
+            : '';
+        if (!property || !propertyPath || /[\x00-\x1f\x7f]/u.test(propertyPath)) {
+            rejectedCount += 1;
+            continue;
+        }
+        const key = `${property}\u0000${propertyPath}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        mappings.push(Object.freeze({
+            property,
+            propertyPath,
+            state: REGISTERED_PROPERTY_PATHS[property]?.includes(propertyPath)
+                ? 'registered'
+                : 'unrecognized',
+        }));
+    }
+    if (truncated)
+        rejectedCount += raw.length - MAX_HELP_ENTRIES;
+    const mappedProperties = new Set(mappings.map((mapping) => mapping.property));
+    const missingProperties = requested.filter((property) => !mappedProperties.has(property));
+    const limitations = [];
+    if (missingProperties.length) {
+        limitations.push(`The response omitted mappings for requested properties: ${missingProperties.join(', ')}.`);
+    }
+    if (mappings.some((mapping) => mapping.state === 'unrecognized')) {
+        limitations.push('At least one mapping differs from the locally reviewed IANA registration and requires manual specification review.');
+    }
+    if (rejectedCount)
+        limitations.push(`${rejectedCount} malformed or excess mapping entr${rejectedCount === 1 ? 'y was' : 'ies were'} not used.`);
+    if (!mappings.length)
+        limitations.push('No usable reverse-search property mapping was retained.');
+    return Object.freeze({
+        schema: RDAP_SEARCH_WORKBENCH_SCHEMA,
+        version: RDAP_SEARCH_WORKBENCH_VERSION,
+        state: mappings.length && !limitations.length ? 'complete' : mappings.length ? 'partial' : 'invalid',
+        mappings: Object.freeze(mappings),
+        missingProperties: Object.freeze(missingProperties),
+        rejectedCount,
+        truncated,
+        limitations: Object.freeze(limitations),
+    });
+}
+export { MAX_HELP_ENTRIES, MAX_QUERY_VALUE_LENGTH, RDAP_SEARCH_WORKBENCH_SCHEMA, RDAP_SEARCH_WORKBENCH_VERSION, normalizeRdapSearchHelp, planRdapReverseSearch, inspectRdapReverseSearchResponse, };

package/lib/registry-access.mjs

@@ -3,7 +3,7 @@ const REGISTRY_ACCESS_PROFILE_LABELS = Object.freeze({
     'iana-referral': 'IANA referral discovery',
     'no-iana-service': 'No service published by IANA',
     'registry-policy-restricted': 'Registry policy restricted',
-    'source-ip-authorization-required': 'Source-IP authorization required',
+    'source-ip-authorization-required': 'Source-IP authorisation required',
 });
 const WHOIS_REGISTRY_ACCESS_PROFILES = new Set([
     'iana-referral',

package/lib/registry-capability-catalogue.mjs

@@ -51,9 +51,9 @@ const REGISTRY_STANDARDS_COVERAGE_SNAPSHOT = Object.freeze({
     ]),
     interpretation: 'This official-source snapshot describes published service coverage at the verification date. It does not test current reachability or decide registration, availability, ownership, safety, or maliciousness.',
 });
-const DISCOVERY_LIMITATION = 'IANA discovery is available, but no suffix-specific query, encoding, or parser behavior is fixture-verified.';
+const DISCOVERY_LIMITATION = 'IANA discovery is available, but no suffix-specific query, encoding, or parser behaviour is fixture-verified.';
 const FIXTURE_LIMITATION = 'Synthetic fixtures verify the current parser profile; they do not prove current live-registry reachability, policy, or field publication.';
-const ES_ACCESS_LIMITATION = 'The registry WHOIS service requires advance source-IP authorization. A failed or unavailable query is not evidence that the domain is unregistered.';
+const ES_ACCESS_LIMITATION = 'The registry WHOIS service requires advance source-IP authorisation. A failed or unavailable query is not evidence that the domain is unregistered.';
 const SWITCH_ACCESS_LIMITATION = 'The registry directs public domain searches to its official lookup. Its non-standard-port Domain Check is not integrated, and IANA publishes no RDAP service. Missing registry data is not evidence that the domain is unregistered.';
 const VN_ACCESS_LIMITATION = 'IANA publishes no domain WHOIS or RDAP service for this suffix. The official browser lookup is not integrated, and missing registry data is not evidence that the domain is unregistered.';
 const UK_TRANSITION_LIMITATION = 'Synthetic fixtures verify the documented sectioned port-43 response while that WHOIS service is phased out. RDAP remains the preferred registry source, and fixture coverage does not prove current reachability or field publication.';
@@ -64,8 +64,8 @@ const SHARED_WHOIS_NO_RDAP_LIMITATION = 'Synthetic fixture reuse is limited to a
 const WHOIS_ONLY_FIXTURE_LIMITATION = 'Synthetic fixtures verify the current WHOIS parser profile. IANA publishes no RDAP bootstrap service for this suffix, and missing registry data is not evidence that the domain is unregistered.';
 const NEGATIVE_ONLY_FIXTURE_LIMITATION = 'Synthetic fixtures verify only the authoritative no-record dialect; registered-field compatibility is not claimed, and fixture coverage does not prove current live-registry reachability or policy.';
 const WHOIS_ONLY_NEGATIVE_FIXTURE_LIMITATION = 'Synthetic fixtures verify only the authoritative WHOIS no-record dialect; registered-field compatibility is not claimed, IANA publishes no RDAP bootstrap service, and missing registry data is not evidence that the domain is unregistered.';
-const UNVERIFIED_WHOIS_REFERRAL_LIMITATION = 'IANA publishes a domain WHOIS referral, but its response behavior is not fixture-verified. A failed, restricted, prohibited, reserved, or otherwise inconclusive response is not evidence that the domain is unregistered, and IANA publishes no RDAP bootstrap service for this suffix.';
-const UNVERIFIED_WHOIS_WITH_RDAP_LIMITATION = 'IANA publishes domain WHOIS and RDAP discovery, but the WHOIS response behavior is not fixture-verified. A failed, restricted, prohibited, reserved, or otherwise inconclusive WHOIS response is not evidence that the domain is unregistered; RDAP remains separately attributed.';
+const UNVERIFIED_WHOIS_REFERRAL_LIMITATION = 'IANA publishes a domain WHOIS referral, but its response behaviour is not fixture-verified. A failed, restricted, prohibited, reserved, or otherwise inconclusive response is not evidence that the domain is unregistered, and IANA publishes no RDAP bootstrap service for this suffix.';
+const UNVERIFIED_WHOIS_WITH_RDAP_LIMITATION = 'IANA publishes domain WHOIS and RDAP discovery, but the WHOIS response behaviour is not fixture-verified. A failed, restricted, prohibited, reserved, or otherwise inconclusive WHOIS response is not evidence that the domain is unregistered; RDAP remains separately attributed.';
 const NORID_CLOSED_SUFFIX_LIMITATION = 'The registry has not opened this suffix for registrations, and IANA publishes no domain WHOIS or RDAP service. Missing registry data is contextual only and must not be interpreted as a live availability result.';
 const MIL_ACCESS_LIMITATION = 'IANA publishes no public domain WHOIS or RDAP service for this sponsored suffix. Missing registry data is contextual only and is not evidence that a name is unregistered or available.';
 const ARPA_ACCESS_LIMITATION = 'This infrastructure suffix is not ordinary public registration space. IANA publishes WHOIS metadata but no RDAP bootstrap service, and missing or non-domain-shaped data must not be interpreted as registration availability.';

package/lib/registry-insights.mjs

@@ -83,7 +83,7 @@ function disclosure(source, parsedValue, status) {
         return {
             source,
             state: 'unavailable',
-            detail: 'The source did not provide a usable normalized publication.',
+            detail: 'The source did not provide a usable normalised publication.',
         };
     }
     const parsed = record(parsedValue);
@@ -211,11 +211,11 @@ function publicationDiagnostic(source, parsedValue, status, observedAt) {
     if (parsed.serverTruncated === true)
         issues.push('The RDAP server declared a truncated response.');
     if (parsed.entitiesTruncated === true)
-        issues.push('The normalized entity inventory was capped.');
+        issues.push('The normalised entity inventory was capped.');
     if (parsed.statusesTruncated === true)
-        issues.push('The normalized status inventory was capped.');
+        issues.push('The normalised status inventory was capped.');
     if (strings(parsed.fieldsTruncated, 20).length)
-        issues.push('One or more normalized WHOIS fields were capped.');
+        issues.push('One or more normalised WHOIS fields were capped.');
     if (parsed.chainStatus === 'partial')
         issues.push('The WHOIS referral chain was incomplete or conflicting.');
     const conformance = strings(parsed.conformance, 30);
@@ -306,9 +306,9 @@ export function buildRegistryInsights(input) {
                 : unavailableCount
                     ? 'The comparison is partial because at least one publication was unavailable or incomplete.'
                     : sourceOnlyCount || redactedCount
-                        ? 'The sources differ in publication or disclosure without a normalized conflict.'
+                        ? 'The sources differ in publication or disclosure without a normalised conflict.'
                         : counts.equivalent
-                            ? 'The comparable fields are normalized as equivalent.'
+                            ? 'The comparable fields are normalised as equivalent.'
                             : 'No comparable fields were available.',
         },
         publications: [

package/lib/risk-scoring.mjs

@@ -1,22 +1,27 @@
 import { calibrateExternalIntelligenceRisk } from "./external-intelligence-risk.mjs";
+import { buildScoreEvidenceQuality, } from "./scoring-evidence-quality.mjs";
 const RISK_STATES = new Set(['registered', 'for_sale', 'expiring']);
 const STATE_LABELS = Object.freeze({
     for_sale: 'for sale',
     expiring: 'expiring/pending delete',
     registered: 'registered',
 });
-// Version 6 preserves the grouped external-evidence factor and recognizes the
-// newly generated addition, plural, embedded-TLD, advanced Unicode, and
-// analyst-directed token-replacement families conservatively. Older scores
-// remain readable, while case and watchlist comparisons gate numeric changes
-// on matching model versions so formula changes are not mistaken for changes
-// in the observed domain.
-export const RISK_MODEL_VERSION = 6;
+// Version 7 caps each independent evidence family, treats generic operational
+// properties as supporting context, and reports collection quality separately
+// from the heuristic score. Missing evidence never contributes points.
+export const RISK_MODEL_VERSION = 7;
 export const RISK_REVIEW_THRESHOLD = 70;
 const RISK_STATE_BASE = Object.freeze({
-    registered: 10,
-    for_sale: 5,
-    expiring: 8,
+    registered: 6,
+    for_sale: 4,
+    expiring: 5,
+});
+const FAMILY_CAPS = Object.freeze({
+    'domain-resemblance': 20,
+    'brand-presentation': 24,
+    'credential-lure': 18,
+    'external-intelligence': 18,
+    'operational-support': 12,
 });
 const HIGH_CONTEXT_MUTATIONS = new Set([
     'unicode_homoglyph',
@@ -49,7 +54,7 @@ export function normalizeRiskModelVersion(value) {
 }
 function formatAge(days) {
     if (days < 60)
-        return `${days}d old`;
+        return `${Math.round(days)}d old`;
     const years = days / 365.25;
     return years < 1 ? `${Math.round(days / 30)}mo old` : `${years.toFixed(1)}y old`;
 }
@@ -68,83 +73,201 @@ function mutationContext(mutationTypes) {
     }
     return null;
 }
+function hasBoolean(value) {
+    return typeof value === 'boolean';
+}
+function scoreQuality(input) {
+    const observedFamilies = ['registration'];
+    const expectedFamilies = ['registration', 'operational-support'];
+    if (Array.isArray(input.mutationTypes) || hasBoolean(input.idnReferenceMatch))
+        observedFamilies.push('domain-resemblance');
+    if (input.hasActiveBrandProfile === true)
+        expectedFamilies.push('domain-resemblance', 'brand-presentation');
+    if ([input.faviconMatch, input.faviconNearMatch, input.reusesOfficialAssets, input.pageBaselineMatch].some(hasBoolean)) {
+        observedFamilies.push('brand-presentation');
+    }
+    if ([input.hasPasswordField, input.hasExternalFormAction].some(hasBoolean) || typeof input.phishingLanguageMatch === 'string') {
+        observedFamilies.push('credential-lure');
+    }
+    if (input.threatIntelligence !== undefined && input.threatIntelligence !== null)
+        observedFamilies.push('external-intelligence');
+    if ([input.hasMx, input.hasSpf, input.hasDmarc].some(hasBoolean)
+        || typeof input.activityStatus === 'string'
+        || typeof input.domainAgeDays === 'number')
+        observedFamilies.push('operational-support');
+    if (input.scanDepth === 'deep')
+        expectedFamilies.push('credential-lure');
+    return buildScoreEvidenceQuality(input, {
+        expectedDepth: 'deep',
+        observedFamilies,
+        expectedFamilies,
+    });
+}
 // Risk prioritizes a registered lookalike/typosquat domain for analyst review.
 // It is a heuristic indicator, never a maliciousness or safety verdict.
-export function explainRiskScore(r) {
-    const state = r.availability ?? r.state;
+export function explainRiskScore(input) {
+    const state = input.availability ?? input.state;
     if (typeof state !== 'string' || !RISK_STATES.has(state))
         return null;
-    const base = RISK_STATE_BASE[state] ?? 0;
-    const factors = [{ label: `Base score for "${STATE_LABELS[state] || state}"`, delta: base }];
-    let score = base;
-    const contextualFamilies = new Set();
-    const addContextualFactor = (family, label, delta) => {
-        contextualFamilies.add(family);
-        factors.push({ label, delta });
-        score += delta;
+    const factors = [];
+    const familyTotals = new Map();
+    const add = (family, label, requestedDelta) => {
+        const current = familyTotals.get(family) ?? 0;
+        const cap = FAMILY_CAPS[family] ?? Number.POSITIVE_INFINITY;
+        const delta = Math.max(0, Math.min(requestedDelta, Math.max(0, cap - current)));
+        const capped = delta !== requestedDelta;
+        factors.push({ family, label: capped ? `${label} (family cap reached)` : label, delta });
+        familyTotals.set(family, current + delta);
+        return delta;
+    };
+    add('registration', `Base context for “${STATE_LABELS[state] ?? state}”`, RISK_STATE_BASE[state] ?? 0);
+    const mutation = mutationContext(input.mutationTypes);
+    if (mutation)
+        add('domain-resemblance', mutation.label, mutation.delta);
+    if (input.idnReferenceMatch === true)
+        add('domain-resemblance', 'IDN skeleton matches an official Brand Profile domain', 20);
+    if (input.faviconMatch === true)
+        add('brand-presentation', 'Favicon matches an official Brand Profile site', 18);
+    else if (input.faviconNearMatch === true)
+        add('brand-presentation', 'Favicon resembles an official Brand Profile site', 14);
+    if (input.reusesOfficialAssets === true)
+        add('brand-presentation', 'Official asset-host relationship observed', 6);
+    if (input.pageBaselineMatch === true)
+        add('brand-presentation', 'Multiple independently compared page-identity components match the official baseline', 14);
+    if (typeof input.phishingLanguageMatch === 'string' && input.phishingLanguageMatch.trim()) {
+        add('credential-lure', 'Suspicious urgency language observed', 8);
+    }
+    if (input.hasPasswordField === true && input.hasExternalFormAction === true) {
+        add('credential-lure', 'Password form submits to an external origin', 10);
+    }
+    else if (input.hasPasswordField === true) {
+        add('credential-lure', 'Login/password form present', 5);
+    }
+    else if (input.hasExternalFormAction === true) {
+        add('credential-lure', 'External form destination observed without a password field', 0);
+    }
+    const external = calibrateExternalIntelligenceRisk(input.threatIntelligence);
+    if (external.factor)
+        add('external-intelligence', external.factor.label, external.contribution);
+    const primaryFamilies = ['domain-resemblance', 'brand-presentation', 'credential-lure', 'external-intelligence']
+        .filter((family) => (familyTotals.get(family) ?? 0) > 0);
+    if (primaryFamilies.length >= 2) {
+        add('corroboration', `Corroborating context across ${primaryFamilies.length} independent evidence families`, primaryFamilies.length >= 3 ? 18 : 10);
+    }
+    const hasIndependentContext = primaryFamilies.length > 0;
+    const supporting = (label, delta) => {
+        add('operational-support', hasIndependentContext ? label : `${label}; neutral without independent suspicious context`, hasIndependentContext ? delta : 0);
+    };
+    if (input.activityStatus === 'active')
+        supporting('Active website observed', 4);
+    if (input.hasMx === true)
+        supporting('Mail server configured', 4);
+    if (input.hasSpf === true && input.hasDmarc === true)
+        supporting('SPF and DMARC records present', 1);
+    else if (input.hasSpf === true || input.hasDmarc === true)
+        supporting('SPF or DMARC record present', 0);
+    if (typeof input.domainAgeDays === 'number' && Number.isFinite(input.domainAgeDays) && input.domainAgeDays >= 0) {
+        if (input.domainAgeDays < 90)
+            supporting(`Recently registered (${formatAge(input.domainAgeDays)})`, 6);
+        else if (input.domainAgeDays < 365)
+            supporting(`Registered under a year ago (${formatAge(input.domainAgeDays)})`, 2);
+    }
+    if (typeof input.privacyProtected === 'boolean') {
+        add('registration', 'Registration privacy is neutral context', 0);
+    }
+    const rawScore = Math.round(factors.reduce((total, factor) => total + factor.delta, 0));
+    const score = Math.max(0, Math.min(100, rawScore));
+    const familyOrder = [
+        'registration', 'domain-resemblance', 'brand-presentation', 'credential-lure',
+        'external-intelligence', 'corroboration', 'operational-support',
+    ];
+    return {
+        modelVersion: RISK_MODEL_VERSION,
+        score,
+        rawScore,
+        capped: score !== rawScore,
+        factors,
+        families: familyOrder
+            .filter((id) => familyTotals.has(id))
+            .map((id) => ({ id, contribution: familyTotals.get(id) ?? 0, cap: FAMILY_CAPS[id] ?? null })),
+        evidenceQuality: scoreQuality(input),
     };
-    const context = mutationContext(r.mutationTypes);
-    if (context)
-        addContextualFactor('domain-resemblance', context.label, context.delta);
-    if (r.faviconMatch === true) {
-        addContextualFactor('brand-presentation', 'Favicon matches your Brand Profile official site', 18);
-    }
-    else if (r.faviconNearMatch === true) {
-        addContextualFactor('brand-presentation', 'Favicon resembles your official site (perceptual match)', 14);
-    }
-    if (r.reusesOfficialAssets === true) {
-        addContextualFactor('brand-presentation', 'Official asset host relationship observed', 6);
-    }
-    if (typeof r.phishingLanguageMatch === 'string' && r.phishingLanguageMatch.trim()) {
-        addContextualFactor('credential-lure', 'Suspicious urgency language observed', 8);
-    }
-    if (r.hasPasswordField === true) {
-        addContextualFactor('credential-lure', 'Login/password form present', 5);
-    }
-    if (contextualFamilies.size >= 2) {
-        const bonus = contextualFamilies.size >= 3 ? 20 : 10;
-        factors.push({ label: `Corroborating context across ${contextualFamilies.size} distinct evidence families`, delta: bonus });
-        score += bonus;
-    }
-    const externalEvidence = calibrateExternalIntelligenceRisk(r.threatIntelligence);
-    if (externalEvidence.factor) {
-        factors.push(externalEvidence.factor);
-        score += externalEvidence.contribution;
-    }
-    if (r.activityStatus === 'active') {
-        factors.push({ label: 'Active site in use', delta: 8 });
-        score += 8;
-    }
-    if (r.hasMx === true) {
-        factors.push({ label: 'Mail server configured', delta: 8 });
-        score += 8;
-    }
-    if (r.hasSpf === true && r.hasDmarc === true) {
-        factors.push({ label: 'SPF + DMARC records present', delta: 3 });
-        score += 3;
-    }
-    else if (r.hasSpf === true || r.hasDmarc === true) {
-        factors.push({ label: 'SPF or DMARC record present', delta: 1 });
-        score += 1;
-    }
-    if (r.privacyProtected === true) {
-        factors.push({ label: 'WHOIS privacy protected', delta: 3 });
-        score += 3;
-    }
-    if (typeof r.domainAgeDays === 'number' && Number.isFinite(r.domainAgeDays) && r.domainAgeDays >= 0) {
-        if (r.domainAgeDays < 90) {
-            factors.push({ label: `Recently registered (${formatAge(r.domainAgeDays)})`, delta: 10 });
-            score += 10;
-        }
-        else if (r.domainAgeDays < 365) {
-            factors.push({ label: `Registered under a year ago (${formatAge(r.domainAgeDays)})`, delta: 4 });
-            score += 4;
-        }
-    }
-    return { modelVersion: RISK_MODEL_VERSION, score: Math.max(0, Math.min(100, Math.round(score))), factors };
 }
-export function computeRiskScore(r) {
-    return explainRiskScore(r)?.score ?? null;
+export function computeRiskScore(input) {
+    return explainRiskScore(input)?.score ?? null;
+}
+// Retained only for deterministic offline comparison of reviewed calibration
+// datasets. Runtime lookups always use the current model above.
+export function explainRiskScoreV6(input) {
+    const state = input.availability ?? input.state;
+    if (typeof state !== 'string' || !RISK_STATES.has(state))
+        return null;
+    const legacyBase = { registered: 10, for_sale: 5, expiring: 8 };
+    const factors = [];
+    const totals = new Map();
+    const add = (family, label, delta) => {
+        factors.push({ family, label, delta });
+        totals.set(family, (totals.get(family) ?? 0) + delta);
+    };
+    add('registration', `Base score for “${STATE_LABELS[state] ?? state}”`, legacyBase[state] ?? 0);
+    const contextual = new Set();
+    const context = mutationContext(input.mutationTypes);
+    if (context) {
+        add('domain-resemblance', context.label, context.delta);
+        contextual.add('domain-resemblance');
+    }
+    if (input.faviconMatch === true) {
+        add('brand-presentation', 'Favicon matches an official Brand Profile site', 18);
+        contextual.add('brand-presentation');
+    }
+    else if (input.faviconNearMatch === true) {
+        add('brand-presentation', 'Favicon resembles an official Brand Profile site', 14);
+        contextual.add('brand-presentation');
+    }
+    if (input.reusesOfficialAssets === true) {
+        add('brand-presentation', 'Official asset-host relationship observed', 6);
+        contextual.add('brand-presentation');
+    }
+    if (typeof input.phishingLanguageMatch === 'string' && input.phishingLanguageMatch.trim()) {
+        add('credential-lure', 'Suspicious urgency language observed', 8);
+        contextual.add('credential-lure');
+    }
+    if (input.hasPasswordField === true) {
+        add('credential-lure', 'Login/password form present', 5);
+        contextual.add('credential-lure');
+    }
+    if (contextual.size >= 2)
+        add('corroboration', `Corroborating context across ${contextual.size} distinct evidence families`, contextual.size >= 3 ? 20 : 10);
+    const external = calibrateExternalIntelligenceRisk(input.threatIntelligence);
+    if (external.factor)
+        add('external-intelligence', external.factor.label, external.contribution);
+    if (input.activityStatus === 'active')
+        add('operational-support', 'Active site in use', 8);
+    if (input.hasMx === true)
+        add('operational-support', 'Mail server configured', 8);
+    if (input.hasSpf === true && input.hasDmarc === true)
+        add('operational-support', 'SPF and DMARC records present', 3);
+    else if (input.hasSpf === true || input.hasDmarc === true)
+        add('operational-support', 'SPF or DMARC record present', 1);
+    if (input.privacyProtected === true)
+        add('registration', 'WHOIS privacy protected', 3);
+    if (typeof input.domainAgeDays === 'number' && Number.isFinite(input.domainAgeDays) && input.domainAgeDays >= 0) {
+        if (input.domainAgeDays < 90)
+            add('operational-support', `Recently registered (${formatAge(input.domainAgeDays)})`, 10);
+        else if (input.domainAgeDays < 365)
+            add('operational-support', `Registered under a year ago (${formatAge(input.domainAgeDays)})`, 4);
+    }
+    const rawScore = Math.round(factors.reduce((total, factor) => total + factor.delta, 0));
+    const score = Math.max(0, Math.min(100, rawScore));
+    return {
+        modelVersion: 6,
+        score,
+        rawScore,
+        capped: score !== rawScore,
+        factors,
+        families: [...totals].map(([id, contribution]) => ({ id, contribution, cap: null })),
+        evidenceQuality: scoreQuality(input),
+    };
 }
 export function riskTone(score) {
     if (score === null)
@@ -159,6 +282,6 @@ export function formatScoreBreakdown(explained, separator = '\n') {
     if (!explained)
         return '';
     const parts = explained.factors.map((factor) => `${factor.label} ${factor.delta >= 0 ? '+' : ''}${Math.round(factor.delta)}`);
-    parts.push(`Total ${explained.score}`);
+    parts.push(`Total ${explained.score} · Risk model v${explained.modelVersion} · evidence ${explained.evidenceQuality.state}`);
     return parts.join(separator);
 }

package/lib/scoring-evidence-quality.mjs

@@ -0,0 +1,107 @@
+export const SCORE_EVIDENCE_QUALITY_VERSION = 1;
+const MAX_SOURCES = 24;
+const MAX_FAMILIES = 12;
+const SOURCE_ID_RE = /^[a-z][a-z0-9_-]{0,63}$/u;
+const COMPLETE_STATES = new Set(['complete', 'not_found', 'success']);
+const LIMITED_STATES = new Set(['partial', 'unknown']);
+const UNAVAILABLE_STATES = new Set(['error', 'rate_limited', 'unavailable']);
+const SKIPPED_STATES = new Set(['skipped', 'unsupported']);
+const ACCEPTED_SOURCE_STATES = new Set([
+    ...COMPLETE_STATES,
+    ...LIMITED_STATES,
+    ...UNAVAILABLE_STATES,
+    ...SKIPPED_STATES,
+]);
+function boundedFamilyList(value) {
+    const output = new Set();
+    for (const item of value.slice(0, MAX_FAMILIES * 2)) {
+        const normalized = String(item).trim().toLowerCase().replace(/[^a-z0-9_-]+/gu, '-').slice(0, 64);
+        if (SOURCE_ID_RE.test(normalized))
+            output.add(normalized);
+        if (output.size >= MAX_FAMILIES)
+            break;
+    }
+    return [...output].sort();
+}
+function sourceCoverage(value) {
+    if (!Array.isArray(value))
+        return [];
+    const output = [];
+    const seen = new Set();
+    for (const candidate of value.slice(0, MAX_SOURCES * 4)) {
+        if (!candidate || typeof candidate !== 'object' || Array.isArray(candidate))
+            continue;
+        const item = candidate;
+        const source = typeof item.source === 'string' ? item.source.trim().toLowerCase() : '';
+        const state = typeof item.state === 'string' ? item.state.trim().toLowerCase() : '';
+        if (!SOURCE_ID_RE.test(source) || seen.has(source))
+            continue;
+        if (!ACCEPTED_SOURCE_STATES.has(state))
+            continue;
+        seen.add(source);
+        output.push({ source, state });
+        if (output.length >= MAX_SOURCES)
+            break;
+    }
+    return output;
+}
+function scanDepth(value) {
+    return value === 'deep' || value === 'fast' ? value : 'unknown';
+}
+function observedFreshness(value) {
+    if (typeof value !== 'string' || value.length > 64)
+        return 'unknown';
+    return Number.isFinite(Date.parse(value)) ? 'observed' : 'unknown';
+}
+export function buildScoreEvidenceQuality(input, options) {
+    const depth = scanDepth(input.scanDepth);
+    const coverage = sourceCoverage(input.sourceCoverage);
+    const completeSources = coverage.filter((item) => COMPLETE_STATES.has(item.state)).length;
+    const limitedSources = coverage.filter((item) => LIMITED_STATES.has(item.state)).length;
+    const unavailableSources = coverage.filter((item) => UNAVAILABLE_STATES.has(item.state)).length;
+    const skippedSources = coverage.filter((item) => SKIPPED_STATES.has(item.state)).length;
+    const observedFamilies = boundedFamilyList(options.observedFamilies ?? []);
+    const expectedFamilies = boundedFamilyList(options.expectedFamilies ?? []);
+    const observedSet = new Set(observedFamilies);
+    const missingFamilies = expectedFamilies.filter((family) => !observedSet.has(family));
+    const limitations = [];
+    let state = 'complete';
+    if (!coverage.length || depth === 'unknown')
+        state = 'unknown';
+    else if (unavailableSources || limitedSources)
+        state = 'partial';
+    else if (options.expectedDepth === 'deep' && depth !== 'deep')
+        state = 'limited';
+    if (missingFamilies.length && state === 'complete')
+        state = 'limited';
+    if (options.expectedDepth === 'deep' && depth !== 'deep') {
+        limitations.push('A fast or unknown-depth observation does not evaluate every website and mail scoring family.');
+    }
+    if (limitedSources || unavailableSources) {
+        limitations.push('One or more score-relevant sources were partial, unavailable, or indeterminate.');
+    }
+    if (skippedSources) {
+        limitations.push('One or more reported sources were skipped or unsupported and did not contribute to the score.');
+    }
+    if (!coverage.length)
+        limitations.push('Source-level coverage was not supplied with this score.');
+    if (missingFamilies.length)
+        limitations.push(`No usable observation was supplied for: ${missingFamilies.join(', ')}.`);
+    const boundedLimitations = [
+        ...limitations.slice(0, 5),
+        'Evidence coverage qualifies the score; it never adds points or turns missing evidence into a negative finding.',
+    ];
+    return Object.freeze({
+        version: SCORE_EVIDENCE_QUALITY_VERSION,
+        state,
+        scanDepth: depth,
+        freshness: observedFreshness(input.observedAt),
+        completeSources,
+        limitedSources,
+        unavailableSources,
+        skippedSources,
+        observedFamilies: Object.freeze(observedFamilies),
+        missingFamilies: Object.freeze(missingFamilies),
+        limitations: Object.freeze(boundedLimitations),
+    });
+}