@slicedearth/whoisleuth-cli 1.36.1 → 1.43.0

package/lib/domain-control-manifest.mjs

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto';
 import { domainToASCII } from 'node:url';
 import { canonicalArtifactJson } from "../frontend/src/lib/analysis/artifact-integrity.js";
+import { exactKeys } from "./bounded-contract-normalizers.mjs";
 export const DOMAIN_CONTROL_MANIFEST_INPUT_SCHEMA = 'whoisleuth.domain-control-manifest-input';
 export const DOMAIN_CONTROL_MANIFEST_SCHEMA = 'whoisleuth.domain-control-manifest';
 export const DOMAIN_CONTROL_MANIFEST_VERSION = 1;
@@ -9,6 +10,18 @@ export const DOMAIN_CONTROL_REVIEW_SCHEMA = 'whoisleuth.domain-control-review';
 export const DOMAIN_CONTROL_REVIEW_VERSION = 1;
 export const MAX_DOMAIN_CONTROL_ENTRIES = 100;
 export const MAX_DOMAIN_CONTROL_RECORDS = 32;
+const MANIFEST_KEYS = new Set(['schema', 'version', 'generatedAt', 'expiresAt', 'entries', 'limitations', 'integrity']);
+const MANIFEST_ENTRY_KEYS = new Set(['domain', 'nameservers', 'ds', 'mx', 'caa', 'tlsIssuer', 'tlsSpkiSha256', 'registrarLock', 'renewalReviewAt', 'note']);
+const MANIFEST_INTEGRITY_KEYS = new Set(['algorithm', 'canonicalization', 'digestSha256']);
+const MANIFEST_INPUT_KEYS = new Set(['schema', 'version', 'expiresAt', 'entries']);
+const REVIEW_INPUT_KEYS = new Set(['schema', 'version', 'manifest', 'observations']);
+const OBSERVATION_KEYS = new Set(['domain', 'fields']);
+const OBSERVATION_FIELDS = new Set(['nameservers', 'ds', 'mx', 'caa', 'tlsIssuer', 'tlsSpkiSha256', 'registrarLock']);
+const OBSERVATION_FIELD_KEYS = new Set(['state', 'values', 'source', 'observedAt']);
+const DOMAIN_CONTROL_LIMITATIONS = Object.freeze([
+    'This analyst-authored manifest records intended domain-control state. It does not collect evidence or change registrar, DNS, mail, or certificate configuration.',
+    'Empty desired fields are unconfigured rather than claims that a record should be absent.',
+]);
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value)
         ? value
@@ -89,6 +102,7 @@ export function buildDomainControlManifest(input, generatedAtValue = new Date().
     if (!source || source.schema !== DOMAIN_CONTROL_MANIFEST_INPUT_SCHEMA || source.version !== 1) {
         throw new TypeError(`Domain control manifest input must use ${DOMAIN_CONTROL_MANIFEST_INPUT_SCHEMA} version 1.`);
     }
+    exactKeys(source, MANIFEST_INPUT_KEYS, 'Domain control manifest input');
     const generatedAt = timestamp(generatedAtValue);
     const expiresAt = timestamp(source.expiresAt);
     if (!generatedAt || !expiresAt || Date.parse(expiresAt) <= Date.parse(generatedAt)) {
@@ -97,7 +111,10 @@ export function buildDomainControlManifest(input, generatedAtValue = new Date().
     if (!Array.isArray(source.entries) || source.entries.length < 1 || source.entries.length > MAX_DOMAIN_CONTROL_ENTRIES) {
         throw new TypeError(`Domain control manifest input must contain between 1 and ${MAX_DOMAIN_CONTROL_ENTRIES} entries.`);
     }
-    const entries = source.entries.map(normalizeEntry);
+    const entries = source.entries.map((entry, index) => {
+        exactKeys(entry, MANIFEST_ENTRY_KEYS, `Domain control manifest input entry ${index + 1}`);
+        return normalizeEntry(entry);
+    });
     if (entries.some((entry) => entry === null))
         throw new TypeError('Domain control manifest contains an invalid entry.');
     const normalizedEntries = entries;
@@ -110,10 +127,7 @@ export function buildDomainControlManifest(input, generatedAtValue = new Date().
         generatedAt,
         expiresAt,
         entries: Object.freeze([...normalizedEntries].sort((left, right) => left.domain.localeCompare(right.domain))),
-        limitations: Object.freeze([
-            'This analyst-authored manifest records intended domain-control state. It does not collect evidence or change registrar, DNS, mail, or certificate configuration.',
-            'Empty desired fields are unconfigured rather than claims that a record should be absent.',
-        ]),
+        limitations: DOMAIN_CONTROL_LIMITATIONS,
     });
     return Object.freeze({
         ...base,
@@ -134,6 +148,8 @@ export function verifyDomainControlManifest(value) {
         || source.entries.length < 1
         || source.entries.length > MAX_DOMAIN_CONTROL_ENTRIES
         || !Array.isArray(source.limitations)
+        || source.limitations.length !== DOMAIN_CONTROL_LIMITATIONS.length
+        || source.limitations.some((limitation, index) => limitation !== DOMAIN_CONTROL_LIMITATIONS[index])
         || !integrity
         || integrity.algorithm !== 'SHA-256'
         || integrity.canonicalization !== 'sorted-json-v1'
@@ -141,18 +157,41 @@ export function verifyDomainControlManifest(value) {
         || !/^sha256:[a-f0-9]{64}$/u.test(integrity.digestSha256)) {
         throw new TypeError('Domain control manifest has an unsupported or malformed structure.');
     }
+    exactKeys(source, MANIFEST_KEYS, 'Domain control manifest');
+    exactKeys(integrity, MANIFEST_INTEGRITY_KEYS, 'Domain control manifest integrity');
+    for (const [index, entry] of source.entries.entries()) {
+        exactKeys(entry, MANIFEST_ENTRY_KEYS, `Domain control manifest entry ${index + 1}`);
+    }
     const generatedAt = timestamp(source.generatedAt);
     const expiresAt = timestamp(source.expiresAt);
     const entries = source.entries.map(normalizeEntry);
     if (!generatedAt || !expiresAt || Date.parse(expiresAt) <= Date.parse(generatedAt) || entries.some((entry) => entry === null)) {
-        throw new TypeError('Domain control manifest has invalid normalized content.');
+        throw new TypeError('Domain control manifest has invalid normalised content.');
     }
     const normalizedEntries = entries;
     if (new Set(normalizedEntries.map((entry) => entry.domain)).size !== normalizedEntries.length) {
         throw new TypeError('Domain control manifest entries must use unique domains.');
     }
     const { integrity: _integrity, ...unsigned } = source;
-    if (integrityDigest(unsigned) !== integrity.digestSha256) {
+    const canonical = Object.freeze({
+        schema: DOMAIN_CONTROL_MANIFEST_SCHEMA,
+        version: DOMAIN_CONTROL_MANIFEST_VERSION,
+        generatedAt,
+        expiresAt,
+        entries: Object.freeze([...normalizedEntries].sort((left, right) => left.domain.localeCompare(right.domain))),
+        limitations: DOMAIN_CONTROL_LIMITATIONS,
+    });
+    let suppliedCanonical;
+    try {
+        suppliedCanonical = canonicalArtifactJson(unsigned);
+    }
+    catch {
+        throw new TypeError('Domain control manifest has invalid normalised content.');
+    }
+    if (suppliedCanonical !== canonicalArtifactJson(canonical)) {
+        throw new TypeError('Domain control manifest must use its canonical normalised content.');
+    }
+    if (`sha256:${createHash('sha256').update(suppliedCanonical).digest('hex')}` !== integrity.digestSha256) {
         throw new TypeError('Domain control manifest failed its SHA-256 integrity check.');
     }
     return source;
@@ -176,11 +215,14 @@ function normalizeObservation(value) {
     const rawFields = record(source?.fields);
     if (!source || !normalizedDomain || !rawFields)
         return null;
+    exactKeys(source, OBSERVATION_KEYS, 'Domain control observation');
+    exactKeys(rawFields, OBSERVATION_FIELDS, 'Domain control observation fields');
     const fields = {};
     for (const field of ['nameservers', 'ds', 'mx', 'caa', 'tlsIssuer', 'tlsSpkiSha256', 'registrarLock']) {
         const raw = record(rawFields[field]);
         if (!raw)
             continue;
+        exactKeys(raw, OBSERVATION_FIELD_KEYS, `Domain control observation field ${field}`);
         const state = raw.state;
         if (state !== 'observed' && state !== 'partial' && state !== 'unavailable' && state !== 'unsupported')
             return null;
@@ -260,6 +302,7 @@ export function reviewDomainControlManifest(input, generatedAtValue = new Date()
     if (!source || source.schema !== DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA || source.version !== 1) {
         throw new TypeError(`Domain control review input must use ${DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA} version 1.`);
     }
+    exactKeys(source, REVIEW_INPUT_KEYS, 'Domain control review input');
     const generatedAt = timestamp(generatedAtValue);
     if (!generatedAt)
         throw new TypeError('Domain control review time is invalid.');

package/lib/domain-portfolio-review.mjs

@@ -0,0 +1,151 @@
+import { exactKeys, requireBoundedString, requireDomainName, requireIsoTimestamp, requireRecord, } from "./bounded-contract-normalizers.mjs";
+export const DOMAIN_PORTFOLIO_INPUT_SCHEMA = 'whoisleuth.domain-portfolio.input';
+export const DOMAIN_PORTFOLIO_REVIEW_SCHEMA = 'whoisleuth.domain-portfolio.review';
+export const DOMAIN_PORTFOLIO_REVIEW_VERSION = 1;
+export const MAX_PORTFOLIO_ASSETS = 500;
+const ROOT_KEYS = new Set(['schema', 'version', 'portfolioLabel', 'assets']);
+const ASSET_KEYS = new Set([
+    'domain', 'criticality', 'registrar', 'registrarAccount', 'expiresAt', 'autoRenew', 'dnsProviders', 'mailProviders',
+    'certificateProviders', 'recoveryDomains', 'reviewedAt',
+]);
+function text(value, label, maximum = 160) {
+    return requireBoundedString(value, label, maximum);
+}
+function optionalText(value, label, maximum = 160) {
+    if (value === null || value === undefined || value === '')
+        return null;
+    return text(value, label, maximum);
+}
+function timestamp(value, label, optional = false) {
+    if (optional && (value === null || value === undefined || value === ''))
+        return null;
+    return requireIsoTimestamp(value, label);
+}
+function domain(value, label) {
+    return requireDomainName(value, label);
+}
+function textList(value, label) {
+    if (!Array.isArray(value) || value.length > 16)
+        throw new TypeError(`${label} must contain no more than 16 labels.`);
+    return [...new Set(value.map((item, index) => text(item, `${label}[${index}]`, 120)))].sort();
+}
+function domainList(value, label) {
+    if (!Array.isArray(value) || value.length > 16)
+        throw new TypeError(`${label} must contain no more than 16 domains.`);
+    return [...new Set(value.map((item, index) => domain(item, `${label}[${index}]`)))].sort();
+}
+function nullableBoolean(value, label) {
+    if (value === null || value === undefined)
+        return null;
+    if (typeof value !== 'boolean')
+        throw new TypeError(`${label} must be true, false, or null.`);
+    return value;
+}
+export function reviewDomainPortfolio(inputRaw, generatedAtValue = new Date().toISOString()) {
+    const input = requireRecord(inputRaw, 'Domain portfolio input');
+    if (input.schema !== DOMAIN_PORTFOLIO_INPUT_SCHEMA || input.version !== 1)
+        throw new TypeError(`Domain portfolio input must use ${DOMAIN_PORTFOLIO_INPUT_SCHEMA} version 1.`);
+    exactKeys(input, ROOT_KEYS, 'Domain portfolio input');
+    if (!Array.isArray(input.assets) || input.assets.length < 1 || input.assets.length > MAX_PORTFOLIO_ASSETS) {
+        throw new TypeError(`Domain portfolio input must contain from 1 to ${MAX_PORTFOLIO_ASSETS} assets.`);
+    }
+    const portfolioLabel = text(input.portfolioLabel, 'portfolioLabel', 120);
+    const assets = input.assets.map((raw, index) => {
+        const item = requireRecord(raw, `assets[${index}]`);
+        exactKeys(item, ASSET_KEYS, `assets[${index}]`);
+        const criticality = item.criticality;
+        if (criticality !== 'low' && criticality !== 'standard' && criticality !== 'high' && criticality !== 'critical') {
+            throw new TypeError(`assets[${index}].criticality is unsupported.`);
+        }
+        return Object.freeze({
+            domain: domain(item.domain, `assets[${index}].domain`),
+            criticality,
+            registrar: optionalText(item.registrar, `assets[${index}].registrar`, 120),
+            registrarAccount: optionalText(item.registrarAccount, `assets[${index}].registrarAccount`, 120),
+            expiresAt: timestamp(item.expiresAt, `assets[${index}].expiresAt`, true),
+            autoRenew: nullableBoolean(item.autoRenew, `assets[${index}].autoRenew`),
+            dnsProviders: Object.freeze(textList(item.dnsProviders ?? [], `assets[${index}].dnsProviders`)),
+            mailProviders: Object.freeze(textList(item.mailProviders ?? [], `assets[${index}].mailProviders`)),
+            certificateProviders: Object.freeze(textList(item.certificateProviders ?? [], `assets[${index}].certificateProviders`)),
+            recoveryDomains: Object.freeze(domainList(item.recoveryDomains ?? [], `assets[${index}].recoveryDomains`)),
+            reviewedAt: timestamp(item.reviewedAt, `assets[${index}].reviewedAt`),
+        });
+    }).sort((left, right) => left.domain.localeCompare(right.domain));
+    if (new Set(assets.map((asset) => asset.domain)).size !== assets.length)
+        throw new TypeError('Domain portfolio assets must use unique domains.');
+    const dependencyRows = [];
+    for (const asset of assets) {
+        const critical = asset.criticality === 'critical' || asset.criticality === 'high';
+        if (asset.registrar)
+            dependencyRows.push({ type: 'registrar', provider: asset.registrar, domain: asset.domain, critical });
+        for (const provider of asset.dnsProviders)
+            dependencyRows.push({ type: 'dns', provider, domain: asset.domain, critical });
+        for (const provider of asset.mailProviders)
+            dependencyRows.push({ type: 'mail', provider, domain: asset.domain, critical });
+        for (const provider of asset.certificateProviders)
+            dependencyRows.push({ type: 'certificate', provider, domain: asset.domain, critical });
+        for (const provider of asset.recoveryDomains)
+            dependencyRows.push({ type: 'recovery', provider, domain: asset.domain, critical });
+    }
+    const grouped = new Map();
+    for (const row of dependencyRows) {
+        const key = `${row.type}\u0000${row.provider.toLowerCase()}`;
+        grouped.set(key, [...(grouped.get(key) ?? []), row]);
+    }
+    const simulations = [...grouped.values()].map((rows) => Object.freeze({
+        dependencyType: rows[0].type,
+        provider: rows[0].provider,
+        affectedDomains: Object.freeze([...new Set(rows.map((row) => row.domain))].sort()),
+        affectedCriticalDomains: Object.freeze([...new Set(rows.filter((row) => row.critical).map((row) => row.domain))].sort()),
+        share: Math.round((new Set(rows.map((row) => row.domain)).size / assets.length) * 1000) / 10,
+    })).sort((left, right) => (right.affectedDomains.length - left.affectedDomains.length
+        || left.dependencyType.localeCompare(right.dependencyType)
+        || left.provider.localeCompare(right.provider)));
+    const now = Date.parse(timestamp(generatedAtValue, 'generatedAt'));
+    const renewalQueue = assets.flatMap((asset) => {
+        const expiry = asset.expiresAt ? Date.parse(asset.expiresAt) : Number.NaN;
+        const days = Number.isFinite(expiry) ? Math.ceil((expiry - now) / 86_400_000) : null;
+        const reasons = [
+            ...(days === null ? ['Expiry is unavailable.'] : days <= 90 ? [`Expiry is ${days < 0 ? `${Math.abs(days)} days overdue` : `due in ${days} days`}.`] : []),
+            ...(asset.autoRenew === false ? ['Auto-renew is recorded as disabled.'] : asset.autoRenew === null ? ['Auto-renew state is unavailable.'] : []),
+            ...(!asset.registrarAccount ? ['Registrar account label is unavailable.'] : []),
+        ];
+        return reasons.length ? [Object.freeze({ domain: asset.domain, criticality: asset.criticality, expiresAt: asset.expiresAt, daysUntilExpiry: days, reasons: Object.freeze(reasons) })] : [];
+    }).sort((left, right) => ((left.daysUntilExpiry ?? Number.MAX_SAFE_INTEGER) - (right.daysUntilExpiry ?? Number.MAX_SAFE_INTEGER)
+        || left.domain.localeCompare(right.domain)));
+    const owned = new Set(assets.map((asset) => asset.domain));
+    const recoveryCycles = assets.flatMap((asset) => asset.recoveryDomains
+        .filter((recoveryDomain) => owned.has(recoveryDomain))
+        .map((recoveryDomain) => Object.freeze({
+        protectedDomain: asset.domain,
+        recoveryDomain,
+        reciprocal: assets.find((candidate) => candidate.domain === recoveryDomain)?.recoveryDomains.includes(asset.domain) ?? false,
+    })));
+    const unknownCounts = Object.freeze({
+        registrar: assets.filter((asset) => !asset.registrar).length,
+        registrarAccount: assets.filter((asset) => !asset.registrarAccount).length,
+        expiry: assets.filter((asset) => !asset.expiresAt).length,
+        autoRenew: assets.filter((asset) => asset.autoRenew === null).length,
+        dns: assets.filter((asset) => !asset.dnsProviders.length).length,
+        mail: assets.filter((asset) => !asset.mailProviders.length).length,
+        certificate: assets.filter((asset) => !asset.certificateProviders.length).length,
+        recovery: assets.filter((asset) => !asset.recoveryDomains.length).length,
+    });
+    return Object.freeze({
+        schema: DOMAIN_PORTFOLIO_REVIEW_SCHEMA,
+        version: DOMAIN_PORTFOLIO_REVIEW_VERSION,
+        generatedAt: new Date(now).toISOString(),
+        portfolioLabel,
+        assets: Object.freeze(assets),
+        simulations: Object.freeze(simulations),
+        renewalQueue: Object.freeze(renewalQueue),
+        recoveryCycles: Object.freeze(recoveryCycles),
+        unknownCounts,
+        limitations: Object.freeze([
+            'This local review uses analyst-supplied portfolio assertions and makes no registrar, DNS, mail, certificate, account, or recovery request.',
+            'Provider and account labels are not proof of current configuration, ownership, control, availability, or contractual responsibility.',
+            'Failure simulations show exact supplied dependency concentration only; they do not predict an outage or establish that providers share infrastructure.',
+            'Do not include credentials, recovery codes, personal contact details, account identifiers, or other secrets in this input.',
+        ]),
+    });
+}

package/lib/domain-posture.mjs

@@ -94,7 +94,7 @@ function spfCheck(query, expansion) {
     const parsed = parseSpfRecords(query.records);
     if (parsed.records.length === 0) {
         return check('spf', 'SPF', 'warning', 'No SPF policy published', {
-            remediation: 'Publish one SPF TXT record that authorizes every legitimate sender and ends in -all once verified.',
+            remediation: 'Publish one SPF TXT record that authorises every legitimate sender and ends in -all once verified.',
         });
     }
     if (!parsed.valid) {
@@ -119,7 +119,7 @@ function spfCheck(query, expansion) {
         ...parsed.issues,
     ];
     if (parsed.terminalPolicy === 'pass') {
-        return check('spf', 'SPF', 'danger', 'Policy authorizes every sender (+all)', {
+        return check('spf', 'SPF', 'danger', 'Policy authorises every sender (+all)', {
             detail: details.join(' '), records: parsed.records,
             remediation: 'Replace +all with an explicit sender allowlist and a restrictive terminal policy.',
         });
@@ -143,7 +143,7 @@ function spfCheck(query, expansion) {
     return check('spf', 'SPF', 'warning', `Policy ends in ${parsed.terminalPolicy || 'an unknown result'}`, {
         detail: details.join(' '), records: parsed.records,
         remediation: parsed.terminalPolicy === 'softfail'
-            ? 'Move from ~all to -all after confirming every legitimate sending service is authorized.'
+            ? 'Move from ~all to -all after confirming every legitimate sending service is authorised.'
             : 'Add a restrictive -all terminal policy after confirming every legitimate sending service.',
     });
 }
@@ -198,7 +198,7 @@ function dmarcCheck(query, authorizations = []) {
         return check('dmarc', 'DMARC', 'warning', `Enforced at p=${parsed.policy}; external reporting authorization is incomplete`, {
             detail: `${details.join(' ')} ${unresolvedExternal.map((authorization) => `${authorization.destination}: ${authorization.state}.`).join(' ')}`,
             records: parsed.records,
-            remediation: 'Publish the required external reporting authorization record or remove the unavailable destination.',
+            remediation: 'Publish the required external reporting authorisation record or remove the unavailable destination.',
         });
     }
     if (!parsed.aggregateReporting) {
@@ -252,7 +252,7 @@ function dnssecCheck(input) {
 function dnssecDelegationConsistencyCheck(input, registry) {
     if (registry.error) {
         return check('dnssec_delegation_consistency', 'DNSSEC delegation consistency', 'info', 'Registry evidence is unavailable', {
-            detail: 'DNSSEC delegation and retained DS records could not be compared because normalized registry evidence was unavailable.',
+            detail: 'DNSSEC delegation and retained DS records could not be compared because normalised registry evidence was unavailable.',
         });
     }
     if (input.error) {
@@ -274,7 +274,7 @@ function dnssecDelegationConsistencyCheck(input, registry) {
     }
     if (registry.dsDataTruncated) {
         return check('dnssec_delegation_consistency', 'DNSSEC delegation consistency', 'info', 'Retained DS evidence is incomplete', {
-            detail: 'The normalized registry response reported truncated DS data, so apparent disagreement is inconclusive.',
+            detail: 'The normalised registry response reported truncated DS data, so apparent disagreement is inconclusive.',
         });
     }
     if (value === 'signed' && !hasDsRecords) {
@@ -414,7 +414,7 @@ function bimiCheck(query, dmarcQuery) {
         && (dmarc.legacyPct === null || dmarc.legacyPct === 100);
     if (!enforcementReady) {
         return check('bimi', 'BIMI', 'warning', 'Record exists but DMARC is not BIMI-ready', {
-            detail: 'BIMI display generally requires enforced DMARC for the organizational domain and subdomains. Mailbox providers apply additional requirements.',
+            detail: 'BIMI display generally requires enforced DMARC for the organisational domain and subdomains. Mailbox providers apply additional requirements.',
             records: parsed.records,
             remediation: 'Enforce DMARC at quarantine or reject for the domain and subdomains before relying on BIMI.',
         });
@@ -534,7 +534,7 @@ function registrationLockCheck(registry) {
     const statuses = registry.statuses.map((status) => status.toLowerCase().replace(/[^a-z]/gu, ''));
     if (statuses.length === 0) {
         return check('registration_lock', 'Registration controls', 'info', 'Registry lock state is unavailable', {
-            detail: 'No normalized EPP status was returned. This does not describe registrar account security.',
+            detail: 'No normalised EPP status was returned. This does not describe registrar account security.',
         });
     }
     const transferLocks = statuses.filter((status) => ['clienttransferprohibited', 'servertransferprohibited'].includes(status));
@@ -706,7 +706,7 @@ async function checkDomainPosture(domain, { dkimSelectors = [], retiredDkimSelec
             nameservers: [],
             dsRecordCount: 0,
             dsDataTruncated: false,
-            error: rdap && 'error' in rdap ? rdap.error : 'RDAP did not return normalized domain evidence.',
+            error: rdap && 'error' in rdap ? rdap.error : 'RDAP did not return normalised domain evidence.',
         };
     const externalDependencies = buildExternalDependencies({
         domain,

package/lib/encrypted-dns-contract.mjs

@@ -75,7 +75,7 @@ function planEncryptedDnsQuery(adapter, input) {
             recipient: new URL(adapter.endpoint).hostname,
             queryRetention: adapter.queryRetention,
         }),
-        limitation: 'This plan does not execute a request. Provider availability, answer authority, validation, filtering, retention, and regional behavior remain untested.',
+        limitation: 'This plan does not execute a request. Provider availability, answer authority, validation, filtering, retention, and regional behaviour remain untested.',
     });
 }
 export { ENCRYPTED_DNS_CONTRACT_SCHEMA, ENCRYPTED_DNS_CONTRACT_VERSION, normalizeEncryptedDnsAdapter, planEncryptedDnsQuery, };

package/lib/evidence-export.mjs

@@ -3,7 +3,7 @@ import { buildRegistryInsights } from "./registry-insights.mjs";
 import { WHOISLEUTH_SOURCE_REPOSITORY_URL } from "./project-metadata.mjs";
 import { normalizeBoundedSemanticVersion } from "./semantic-version.mjs";
 export const LOOKUP_EVIDENCE_SCHEMA = 'whoisleuth.lookup-evidence';
-export const LOOKUP_EVIDENCE_SCHEMA_VERSION = 24;
+export const LOOKUP_EVIDENCE_SCHEMA_VERSION = 25;
 const REGISTRAR_RDAP_STATUSES = new Set([
     'success', 'partial', 'error', 'unsupported', 'not_found', 'skipped', 'disabled',
 ]);

package/lib/evidence-report-markdown.mjs

@@ -38,7 +38,7 @@ function formatLookupEvidenceMarkdown(document, options = {}) {
     lines.push('', '## Registry-source comparison');
     appendFields(lines, report.comparison.health);
     if (!report.comparison.fields.length) {
-        lines.push('- No comparable normalized fields were published.');
+        lines.push('- No comparable normalised fields were published.');
     }
     else {
         for (const field of report.comparison.fields) {

package/lib/evidence-report.mjs

@@ -378,7 +378,7 @@ function buildLookupEvidenceReport(document, options = {}) {
             ...registryAccessFields,
         ],
         limitations: [
-            'This report summarizes point-in-time observations and registry publications. It does not prove ownership, activity, availability, or maliciousness.',
+            'This report summarises point-in-time observations and registry publications. It does not prove ownership, activity, availability, or maliciousness.',
             'Missing, skipped, partial, unsupported, or failed sources are inconclusive rather than negative evidence.',
             'The Risk score is a versioned heuristic review priority, not a probability or determination of maliciousness. Review its listed factors and the underlying source states.',
             'Raw registry payloads and full WHOIS referral responses are available only in the JSON evidence package and may contain public contact data.',