@slicedearth/whoisleuth-cli 1.39.1 → 1.45.0

package/lib/domain-portfolio-review.mjs

@@ -0,0 +1,151 @@
+import { exactKeys, requireBoundedString, requireDomainName, requireIsoTimestamp, requireRecord, } from "./bounded-contract-normalizers.mjs";
+export const DOMAIN_PORTFOLIO_INPUT_SCHEMA = 'whoisleuth.domain-portfolio.input';
+export const DOMAIN_PORTFOLIO_REVIEW_SCHEMA = 'whoisleuth.domain-portfolio.review';
+export const DOMAIN_PORTFOLIO_REVIEW_VERSION = 1;
+export const MAX_PORTFOLIO_ASSETS = 500;
+const ROOT_KEYS = new Set(['schema', 'version', 'portfolioLabel', 'assets']);
+const ASSET_KEYS = new Set([
+    'domain', 'criticality', 'registrar', 'registrarAccount', 'expiresAt', 'autoRenew', 'dnsProviders', 'mailProviders',
+    'certificateProviders', 'recoveryDomains', 'reviewedAt',
+]);
+function text(value, label, maximum = 160) {
+    return requireBoundedString(value, label, maximum);
+}
+function optionalText(value, label, maximum = 160) {
+    if (value === null || value === undefined || value === '')
+        return null;
+    return text(value, label, maximum);
+}
+function timestamp(value, label, optional = false) {
+    if (optional && (value === null || value === undefined || value === ''))
+        return null;
+    return requireIsoTimestamp(value, label);
+}
+function domain(value, label) {
+    return requireDomainName(value, label);
+}
+function textList(value, label) {
+    if (!Array.isArray(value) || value.length > 16)
+        throw new TypeError(`${label} must contain no more than 16 labels.`);
+    return [...new Set(value.map((item, index) => text(item, `${label}[${index}]`, 120)))].sort();
+}
+function domainList(value, label) {
+    if (!Array.isArray(value) || value.length > 16)
+        throw new TypeError(`${label} must contain no more than 16 domains.`);
+    return [...new Set(value.map((item, index) => domain(item, `${label}[${index}]`)))].sort();
+}
+function nullableBoolean(value, label) {
+    if (value === null || value === undefined)
+        return null;
+    if (typeof value !== 'boolean')
+        throw new TypeError(`${label} must be true, false, or null.`);
+    return value;
+}
+export function reviewDomainPortfolio(inputRaw, generatedAtValue = new Date().toISOString()) {
+    const input = requireRecord(inputRaw, 'Domain portfolio input');
+    if (input.schema !== DOMAIN_PORTFOLIO_INPUT_SCHEMA || input.version !== 1)
+        throw new TypeError(`Domain portfolio input must use ${DOMAIN_PORTFOLIO_INPUT_SCHEMA} version 1.`);
+    exactKeys(input, ROOT_KEYS, 'Domain portfolio input');
+    if (!Array.isArray(input.assets) || input.assets.length < 1 || input.assets.length > MAX_PORTFOLIO_ASSETS) {
+        throw new TypeError(`Domain portfolio input must contain from 1 to ${MAX_PORTFOLIO_ASSETS} assets.`);
+    }
+    const portfolioLabel = text(input.portfolioLabel, 'portfolioLabel', 120);
+    const assets = input.assets.map((raw, index) => {
+        const item = requireRecord(raw, `assets[${index}]`);
+        exactKeys(item, ASSET_KEYS, `assets[${index}]`);
+        const criticality = item.criticality;
+        if (criticality !== 'low' && criticality !== 'standard' && criticality !== 'high' && criticality !== 'critical') {
+            throw new TypeError(`assets[${index}].criticality is unsupported.`);
+        }
+        return Object.freeze({
+            domain: domain(item.domain, `assets[${index}].domain`),
+            criticality,
+            registrar: optionalText(item.registrar, `assets[${index}].registrar`, 120),
+            registrarAccount: optionalText(item.registrarAccount, `assets[${index}].registrarAccount`, 120),
+            expiresAt: timestamp(item.expiresAt, `assets[${index}].expiresAt`, true),
+            autoRenew: nullableBoolean(item.autoRenew, `assets[${index}].autoRenew`),
+            dnsProviders: Object.freeze(textList(item.dnsProviders ?? [], `assets[${index}].dnsProviders`)),
+            mailProviders: Object.freeze(textList(item.mailProviders ?? [], `assets[${index}].mailProviders`)),
+            certificateProviders: Object.freeze(textList(item.certificateProviders ?? [], `assets[${index}].certificateProviders`)),
+            recoveryDomains: Object.freeze(domainList(item.recoveryDomains ?? [], `assets[${index}].recoveryDomains`)),
+            reviewedAt: timestamp(item.reviewedAt, `assets[${index}].reviewedAt`),
+        });
+    }).sort((left, right) => left.domain.localeCompare(right.domain));
+    if (new Set(assets.map((asset) => asset.domain)).size !== assets.length)
+        throw new TypeError('Domain portfolio assets must use unique domains.');
+    const dependencyRows = [];
+    for (const asset of assets) {
+        const critical = asset.criticality === 'critical' || asset.criticality === 'high';
+        if (asset.registrar)
+            dependencyRows.push({ type: 'registrar', provider: asset.registrar, domain: asset.domain, critical });
+        for (const provider of asset.dnsProviders)
+            dependencyRows.push({ type: 'dns', provider, domain: asset.domain, critical });
+        for (const provider of asset.mailProviders)
+            dependencyRows.push({ type: 'mail', provider, domain: asset.domain, critical });
+        for (const provider of asset.certificateProviders)
+            dependencyRows.push({ type: 'certificate', provider, domain: asset.domain, critical });
+        for (const provider of asset.recoveryDomains)
+            dependencyRows.push({ type: 'recovery', provider, domain: asset.domain, critical });
+    }
+    const grouped = new Map();
+    for (const row of dependencyRows) {
+        const key = `${row.type}\u0000${row.provider.toLowerCase()}`;
+        grouped.set(key, [...(grouped.get(key) ?? []), row]);
+    }
+    const simulations = [...grouped.values()].map((rows) => Object.freeze({
+        dependencyType: rows[0].type,
+        provider: rows[0].provider,
+        affectedDomains: Object.freeze([...new Set(rows.map((row) => row.domain))].sort()),
+        affectedCriticalDomains: Object.freeze([...new Set(rows.filter((row) => row.critical).map((row) => row.domain))].sort()),
+        share: Math.round((new Set(rows.map((row) => row.domain)).size / assets.length) * 1000) / 10,
+    })).sort((left, right) => (right.affectedDomains.length - left.affectedDomains.length
+        || left.dependencyType.localeCompare(right.dependencyType)
+        || left.provider.localeCompare(right.provider)));
+    const now = Date.parse(timestamp(generatedAtValue, 'generatedAt'));
+    const renewalQueue = assets.flatMap((asset) => {
+        const expiry = asset.expiresAt ? Date.parse(asset.expiresAt) : Number.NaN;
+        const days = Number.isFinite(expiry) ? Math.ceil((expiry - now) / 86_400_000) : null;
+        const reasons = [
+            ...(days === null ? ['Expiry is unavailable.'] : days <= 90 ? [`Expiry is ${days < 0 ? `${Math.abs(days)} days overdue` : `due in ${days} days`}.`] : []),
+            ...(asset.autoRenew === false ? ['Auto-renew is recorded as disabled.'] : asset.autoRenew === null ? ['Auto-renew state is unavailable.'] : []),
+            ...(!asset.registrarAccount ? ['Registrar account label is unavailable.'] : []),
+        ];
+        return reasons.length ? [Object.freeze({ domain: asset.domain, criticality: asset.criticality, expiresAt: asset.expiresAt, daysUntilExpiry: days, reasons: Object.freeze(reasons) })] : [];
+    }).sort((left, right) => ((left.daysUntilExpiry ?? Number.MAX_SAFE_INTEGER) - (right.daysUntilExpiry ?? Number.MAX_SAFE_INTEGER)
+        || left.domain.localeCompare(right.domain)));
+    const owned = new Set(assets.map((asset) => asset.domain));
+    const recoveryCycles = assets.flatMap((asset) => asset.recoveryDomains
+        .filter((recoveryDomain) => owned.has(recoveryDomain))
+        .map((recoveryDomain) => Object.freeze({
+        protectedDomain: asset.domain,
+        recoveryDomain,
+        reciprocal: assets.find((candidate) => candidate.domain === recoveryDomain)?.recoveryDomains.includes(asset.domain) ?? false,
+    })));
+    const unknownCounts = Object.freeze({
+        registrar: assets.filter((asset) => !asset.registrar).length,
+        registrarAccount: assets.filter((asset) => !asset.registrarAccount).length,
+        expiry: assets.filter((asset) => !asset.expiresAt).length,
+        autoRenew: assets.filter((asset) => asset.autoRenew === null).length,
+        dns: assets.filter((asset) => !asset.dnsProviders.length).length,
+        mail: assets.filter((asset) => !asset.mailProviders.length).length,
+        certificate: assets.filter((asset) => !asset.certificateProviders.length).length,
+        recovery: assets.filter((asset) => !asset.recoveryDomains.length).length,
+    });
+    return Object.freeze({
+        schema: DOMAIN_PORTFOLIO_REVIEW_SCHEMA,
+        version: DOMAIN_PORTFOLIO_REVIEW_VERSION,
+        generatedAt: new Date(now).toISOString(),
+        portfolioLabel,
+        assets: Object.freeze(assets),
+        simulations: Object.freeze(simulations),
+        renewalQueue: Object.freeze(renewalQueue),
+        recoveryCycles: Object.freeze(recoveryCycles),
+        unknownCounts,
+        limitations: Object.freeze([
+            'This local review uses analyst-supplied portfolio assertions and makes no registrar, DNS, mail, certificate, account, or recovery request.',
+            'Provider and account labels are not proof of current configuration, ownership, control, availability, or contractual responsibility.',
+            'Failure simulations show exact supplied dependency concentration only; they do not predict an outage or establish that providers share infrastructure.',
+            'Do not include credentials, recovery codes, personal contact details, account identifiers, or other secrets in this input.',
+        ]),
+    });
+}

package/lib/evidence-export.mjs

@@ -3,7 +3,7 @@ import { buildRegistryInsights } from "./registry-insights.mjs";
 import { WHOISLEUTH_SOURCE_REPOSITORY_URL } from "./project-metadata.mjs";
 import { normalizeBoundedSemanticVersion } from "./semantic-version.mjs";
 export const LOOKUP_EVIDENCE_SCHEMA = 'whoisleuth.lookup-evidence';
-export const LOOKUP_EVIDENCE_SCHEMA_VERSION = 24;
+export const LOOKUP_EVIDENCE_SCHEMA_VERSION = 25;
 const REGISTRAR_RDAP_STATUSES = new Set([
     'success', 'partial', 'error', 'unsupported', 'not_found', 'skipped', 'disabled',
 ]);

package/lib/html-signals.mjs

@@ -9,13 +9,13 @@ import { analyzeCredentialSurfaceProfile } from "./credential-surface-profile.mj
 import { analyzeClientBehavior } from "./client-behavior-profile.mjs";
 import { createObservation } from "./observation.mjs";
 import { createPageFingerprints } from "./page-fingerprints.mjs";
+import { detectPageLanguageSignal } from "./page-language-signals.mjs";
 import { analyzePageRole } from "./page-role-profile.mjs";
 import { analyzeCspMetaPolicies } from "./response-policy.mjs";
 import { analyzeStaticHtml } from "./static-html-analysis.mjs";
 import { analyzeStructuredDataIdentity } from "./structured-data-identity.mjs";
 import { analyzeWebsiteTechnology } from "./website-technology.mjs";
 const MAX_TITLE_LENGTH = 200;
-const MAX_PHISHING_MATCH_LENGTH = 200;
 const MAX_EXTERNAL_ASSET_HOSTS = 20;
 const MAX_IDENTITY_TAGS = 512;
 const MAX_IDENTITY_TAG_LENGTH = 4096;
@@ -40,12 +40,6 @@ const TITLE_RE = /<title[^>]*>([\s\S]*?)<\/title>/i;
 // A password input is the single strongest static-HTML tell that a page is
 // asking for credentials, regardless of what it claims to be.
 const PASSWORD_FIELD_RE = /<input\b[^>]*\btype\s*=\s*["']?password["']?/i;
-// Common urgency/social-engineering phrasing used to pressure a visitor
-// into entering credentials - not exhaustive, and legitimate sites
-// occasionally use similar language too, so this is one signal among
-// several, not a verdict on its own (same framing as FOR_SALE_TEXT_RE in
-// availability.js).
-const PHISHING_LANGUAGE_RE = /(verify your account|confirm your identity|unusual (?:sign-?in|login) activity|account has been (?:suspended|limited|locked|restricted)|your account will be (?:suspended|closed|locked|terminated)|click here to (?:verify|confirm|update|restore)|security alert|immediate action required|re-?activate your account|unauthorized access detected|update your (?:payment|billing) (?:information|details)|confirm your password|your password (?:has expired|will expire soon)|connect your wallet|enter your (?:seed|recovery) phrase|verify your (?:seed|recovery) phrase|enter your private key)/i;
 // <img>/<script>/<link> tags loading a resource from an absolute, external
 // URL - a common phishing-kit tell is hotlinking the real brand's own logo/
 // CSS/JS instead of copying it. Relative URLs (the common case, same
@@ -625,7 +619,6 @@ function extractPageIdentity(html, domain, options = {}) {
     };
 }
 function extractHtmlSignals(html, domain, options = {}) {
-    const phishingMatch = html.match(PHISHING_LANGUAGE_RE);
     const pageIdentity = options.includePageIdentity === false ? null : extractPageIdentity(html, domain, options);
     const includeCredentialSurfaceProfile = pageIdentity && options.includeCredentialSurfaceProfile === true;
     const includeStructuredDataIdentity = pageIdentity && options.includeStructuredDataIdentity !== false;
@@ -633,12 +626,13 @@ function extractHtmlSignals(html, domain, options = {}) {
     const includeDerivedPageProfiles = Boolean(pageIdentity);
     const baseUrl = resolvedBaseUrl(domain, options.baseUrl);
     const htmlAnalysis = includeCredentialSurfaceProfile || includeStructuredDataIdentity || includeTechnologyProfile || includeDerivedPageProfiles
-        ? analyzeStaticHtml(html, { baseUrl })
+        ? analyzeStaticHtml(html, { baseUrl, includeVisibleText: true })
         : null;
+    const pageLanguageSignal = detectPageLanguageSignal(html, pageIdentity?.documentLanguage, htmlAnalysis ?? undefined);
     return {
         pageTitle: extractPageTitle(html),
         hasPasswordField: PASSWORD_FIELD_RE.test(html),
-        phishingLanguageMatch: phishingMatch ? boundedHtmlText(phishingMatch[0], MAX_PHISHING_MATCH_LENGTH) : null,
+        phishingLanguageMatch: pageLanguageSignal?.label ?? null,
         hasExternalFormAction: pageIdentity
             ? pageIdentity.forms.externalActionOrigins.length > 0
             : null,
@@ -681,4 +675,4 @@ function extractHtmlSignals(html, domain, options = {}) {
         }) : null,
     };
 }
-export { PAGE_IDENTITY_VERSION, MAX_IDENTITY_TAGS, MAX_FORMS, MAX_FORM_ACTION_ORIGINS, MAX_RESOURCE_TAGS, MAX_RESOURCE_ORIGINS, MAX_EMBEDDED_ORIGINS, MAX_CONTACT_DOMAINS, MAX_TRACKING_IDENTIFIERS, extractHtmlSignals, extractPageIdentity, extractPageRelationships, };
+export { PAGE_IDENTITY_VERSION, MAX_IDENTITY_TAGS, MAX_FORMS, MAX_FORM_ACTION_ORIGINS, MAX_RESOURCE_TAGS, MAX_RESOURCE_ORIGINS, MAX_EMBEDDED_ORIGINS, MAX_CONTACT_DOMAINS, MAX_TRACKING_IDENTIFIERS, extractHtmlSignals, extractPageIdentity, };

package/lib/lookup-cache.mjs

@@ -42,7 +42,7 @@ function approxByteSize(value) {
         return Buffer.byteLength(JSON.stringify(value));
     }
     catch {
-        return 0;
+        return null;
     }
 }
 function deleteEntry(key) {
@@ -76,6 +76,10 @@ function setCached(key, value) {
     sweepExpiredEntries(Date.now());
     deleteEntry(key); // avoid double-counting bytes if this key is already cached
     const size = approxByteSize(value);
+    // A value whose serialized size cannot be measured cannot participate in a
+    // byte-bounded cache. Return it to the current caller without retaining it.
+    if (size === null)
+        return;
     store.set(key, { value, expiresAt: Date.now() + TTL_MS, size });
     totalBytes += size;
     while (store.size > 0 && (store.size > MAX_ENTRIES || totalBytes > MAX_TOTAL_BYTES)) {

package/lib/nameserver-preflight-review.mjs

@@ -0,0 +1,159 @@
+import { isIP } from 'node:net';
+import { exactKeys, requireBoundedString, requireDomainName, requireIsoTimestamp, requireRecord, } from "./bounded-contract-normalizers.mjs";
+import { isPrivateAddress } from "./safe-fetch.mjs";
+export const NAMESERVER_PREFLIGHT_INPUT_SCHEMA = 'whoisleuth.nameserver-preflight.input';
+export const NAMESERVER_PREFLIGHT_REVIEW_SCHEMA = 'whoisleuth.nameserver-preflight.review';
+export const NAMESERVER_PREFLIGHT_REVIEW_VERSION = 1;
+export const MAX_PREFLIGHT_NAMESERVERS = 8;
+export const MAX_PREFLIGHT_ADDRESSES = 4;
+const ROOT_KEYS = new Set(['schema', 'version', 'domain', 'intendedNameservers', 'observations']);
+const OBSERVATION_KEYS = new Set(['nameserver', 'state', 'source', 'observedAt', 'addresses', 'authoritative', 'servedNameservers', 'soaPrimary', 'soaSerial']);
+function text(value, label, maximum = 240) {
+    return requireBoundedString(value, label, maximum);
+}
+function hostname(value, label) {
+    return requireDomainName(value, label, 'hostname');
+}
+function timestamp(value, label) {
+    return requireIsoTimestamp(value, label);
+}
+function state(value, label) {
+    if (value !== 'observed' && value !== 'partial' && value !== 'unavailable')
+        throw new TypeError(`${label} is unsupported.`);
+    return value;
+}
+function uniqueHostnames(value, label, minimum = 1) {
+    if (!Array.isArray(value) || value.length < minimum || value.length > MAX_PREFLIGHT_NAMESERVERS) {
+        throw new TypeError(`${label} must contain from ${minimum} to ${MAX_PREFLIGHT_NAMESERVERS} hostnames.`);
+    }
+    const names = value.map((item, index) => hostname(item, `${label}[${index}]`));
+    if (new Set(names).size !== names.length)
+        throw new TypeError(`${label} must not contain duplicate hostnames.`);
+    return Object.freeze(names.sort());
+}
+function addresses(value, label) {
+    if (!Array.isArray(value) || value.length > MAX_PREFLIGHT_ADDRESSES)
+        throw new TypeError(`${label} must contain no more than ${MAX_PREFLIGHT_ADDRESSES} addresses.`);
+    const normalised = value.map((item, index) => {
+        const supplied = text(item, `${label}[${index}]`, 80).toLowerCase();
+        if (!isIP(supplied) || supplied.includes('%'))
+            throw new TypeError(`${label}[${index}] must be an IPv4 or IPv6 address without a zone identifier.`);
+        return supplied;
+    });
+    return Object.freeze([...new Set(normalised)].sort());
+}
+function sameSet(left, right) {
+    return left.length === right.length && left.every((item, index) => item === right[index]);
+}
+export function reviewNameserverPreflight(inputRaw, generatedAtValue = new Date().toISOString()) {
+    const input = requireRecord(inputRaw, 'Nameserver preflight input');
+    if (input.schema !== NAMESERVER_PREFLIGHT_INPUT_SCHEMA || input.version !== 1) {
+        throw new TypeError(`Nameserver preflight input must use ${NAMESERVER_PREFLIGHT_INPUT_SCHEMA} version 1.`);
+    }
+    exactKeys(input, ROOT_KEYS, 'Nameserver preflight input');
+    const domain = hostname(input.domain, 'domain');
+    const intendedNameservers = uniqueHostnames(input.intendedNameservers, 'intendedNameservers');
+    if (!Array.isArray(input.observations) || input.observations.length > MAX_PREFLIGHT_NAMESERVERS) {
+        throw new TypeError(`observations must contain no more than ${MAX_PREFLIGHT_NAMESERVERS} entries.`);
+    }
+    const observations = input.observations.map((raw, index) => {
+        const item = requireRecord(raw, `observations[${index}]`);
+        exactKeys(item, OBSERVATION_KEYS, `observations[${index}]`);
+        const observationState = state(item.state, `observations[${index}].state`);
+        const nameserver = hostname(item.nameserver, `observations[${index}].nameserver`);
+        const observedAddresses = addresses(item.addresses ?? [], `observations[${index}].addresses`);
+        const servedNameservers = item.servedNameservers === undefined || item.servedNameservers === null
+            ? Object.freeze([])
+            : uniqueHostnames(item.servedNameservers, `observations[${index}].servedNameservers`, 0);
+        const authoritative = item.authoritative === null || item.authoritative === undefined
+            ? null
+            : typeof item.authoritative === 'boolean'
+                ? item.authoritative
+                : (() => { throw new TypeError(`observations[${index}].authoritative must be true, false, or null.`); })();
+        const soaPrimary = item.soaPrimary === null || item.soaPrimary === undefined ? null : hostname(item.soaPrimary, `observations[${index}].soaPrimary`);
+        const soaSerial = item.soaSerial === null || item.soaSerial === undefined
+            ? null
+            : Number.isSafeInteger(item.soaSerial) && Number(item.soaSerial) >= 0 && Number(item.soaSerial) <= 0xffff_ffff
+                ? Number(item.soaSerial)
+                : (() => { throw new TypeError(`observations[${index}].soaSerial is outside its supported range.`); })();
+        if (observationState === 'unavailable' && (observedAddresses.length || servedNameservers.length || authoritative !== null || soaPrimary !== null || soaSerial !== null)) {
+            throw new TypeError(`observations[${index}] cannot contain observed values when unavailable.`);
+        }
+        return Object.freeze({
+            nameserver,
+            state: observationState,
+            source: text(item.source, `observations[${index}].source`, 240),
+            observedAt: timestamp(item.observedAt, `observations[${index}].observedAt`),
+            addresses: observedAddresses,
+            authoritative,
+            servedNameservers,
+            soaPrimary,
+            soaSerial,
+        });
+    });
+    if (new Set(observations.map((item) => item.nameserver)).size !== observations.length)
+        throw new TypeError('observations must use unique nameservers.');
+    if (observations.some((item) => !intendedNameservers.includes(item.nameserver)))
+        throw new TypeError('observations can describe only intended nameservers.');
+    const rows = intendedNameservers.map((nameserver) => {
+        const observation = observations.find((item) => item.nameserver === nameserver) ?? null;
+        const inBailiwick = nameserver === domain || nameserver.endsWith(`.${domain}`);
+        const publicAddresses = observation?.addresses.filter((address) => !isPrivateAddress(address)) ?? [];
+        const addressState = !observation || observation.state === 'unavailable'
+            ? 'unknown'
+            : !observation.addresses.length
+                ? inBailiwick ? 'missing' : 'not_supplied'
+                : publicAddresses.length ? 'ready' : 'non_public';
+        const authorityState = !observation || observation.state !== 'observed' || observation.authoritative === null
+            ? 'unknown'
+            : observation.authoritative ? 'authoritative' : 'not_authoritative';
+        const servedSetState = !observation || observation.state !== 'observed' || !observation.servedNameservers.length
+            ? 'unknown'
+            : sameSet(observation.servedNameservers, intendedNameservers) ? 'aligned' : 'different';
+        const soaState = !observation || observation.state !== 'observed' || !observation.soaPrimary || observation.soaSerial === null
+            ? 'unknown' : 'observed';
+        const ready = observation?.state === 'observed'
+            && authorityState === 'authoritative'
+            && servedSetState === 'aligned'
+            && soaState === 'observed'
+            && (!inBailiwick || addressState === 'ready');
+        return Object.freeze({
+            nameserver,
+            inBailiwick,
+            observationState: observation?.state ?? 'not_supplied',
+            addressState,
+            authorityState,
+            servedSetState,
+            soaState,
+            publicAddresses: Object.freeze(publicAddresses),
+            ready,
+            source: observation?.source ?? null,
+            observedAt: observation?.observedAt ?? null,
+        });
+    });
+    const reasons = rows.flatMap((row) => [
+        ...(!row.ready && row.observationState !== 'observed' ? [`${row.nameserver} evidence is ${row.observationState}.`] : []),
+        ...(row.addressState === 'missing' ? [`${row.nameserver} is in-bailiwick but no glue address was supplied.`] : []),
+        ...(row.addressState === 'non_public' ? [`${row.nameserver} has no observed public address suitable for delegation.`] : []),
+        ...(row.authorityState !== 'authoritative' ? [`${row.nameserver} authoritative service is ${row.authorityState}.`] : []),
+        ...(row.servedSetState !== 'aligned' ? [`${row.nameserver} served NS set is ${row.servedSetState}.`] : []),
+        ...(row.soaState !== 'observed' ? [`${row.nameserver} SOA evidence is ${row.soaState}.`] : []),
+    ]);
+    const pass = rows.every((row) => row.ready);
+    return Object.freeze({
+        schema: NAMESERVER_PREFLIGHT_REVIEW_SCHEMA,
+        version: NAMESERVER_PREFLIGHT_REVIEW_VERSION,
+        generatedAt: timestamp(generatedAtValue, 'generatedAt'),
+        domain,
+        state: pass ? 'ready' : 'review',
+        intendedNameservers,
+        rows: Object.freeze(rows),
+        gate: Object.freeze({ pass, reasons: Object.freeze(reasons) }),
+        limitations: Object.freeze([
+            'This local preflight uses only analyst-supplied observations and makes no DNS or registry request.',
+            'A ready result describes the supplied collection moment; it does not apply a delegation, publish glue, or prove continued reachability.',
+            'Partial, unavailable, and omitted observations remain unknown and cannot satisfy the preflight gate.',
+            'Only in-bailiwick nameservers require supplied public glue evidence in this review; registry-specific policy must be checked separately.',
+        ]),
+    });
+}

package/lib/page-language-signals.mjs

@@ -0,0 +1,124 @@
+// Reviewed, bounded language packs for static homepage text already retained by
+// Deep Lookup. Matching emits fixed labels only: no page phrase, surrounding
+// text, or arbitrary markup is returned or stored.
+import { analyzeStaticHtml, MAX_STATIC_HTML_CHARS, } from "./static-html-analysis.mjs";
+export const PAGE_LANGUAGE_SIGNAL_VERSION = 1;
+export const MAX_PAGE_LANGUAGE_SIGNAL_CHARS = MAX_STATIC_HTML_CHARS;
+const CONTROL_CHARACTER_RE = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/u;
+const CATEGORY_LABELS = Object.freeze({
+    account_verification: 'account-verification',
+    account_restriction: 'account-restriction',
+    payment_update: 'payment-update',
+    recovery_secret: 'wallet or recovery-secret',
+    urgent_action: 'urgent-action',
+});
+const PAGE_LANGUAGE_PACKS = Object.freeze([
+    {
+        id: 'en-reviewed-v1', language: 'en', label: 'English', patterns: [
+            { category: 'account_verification', expression: /(?:verify your account|confirm your identity|unusual (?:sign-?in|login) activity|click here to (?:verify|confirm|update|restore)|confirm your password)/iu },
+            { category: 'account_restriction', expression: /(?:account has been (?:suspended|limited|locked|restricted)|your account will be (?:suspended|closed|locked|terminated)|re-?activate your account|unauthorized access detected|your password (?:has expired|will expire soon))/iu },
+            { category: 'urgent_action', expression: /(?:security alert|immediate action required)/iu },
+            { category: 'payment_update', expression: /update your (?:payment|billing) (?:information|details)/iu },
+            { category: 'recovery_secret', expression: /(?:(?:connect|verify) your wallet|(?:enter|verify) your (?:seed|recovery) phrase|enter your private key)/iu },
+        ],
+    },
+    {
+        id: 'es-reviewed-v1', language: 'es', label: 'Spanish', patterns: [
+            { category: 'account_verification', expression: /(?:verifica (?:tu|su) cuenta|confirma (?:tu|su) identidad)/iu },
+            { category: 'account_restriction', expression: /(?:tu|su) cuenta (?:ha sido|será) (?:suspendida|bloqueada|limitada|restringida)/iu },
+            { category: 'urgent_action', expression: /(?:acción inmediata requerida|alerta de seguridad)/iu },
+            { category: 'payment_update', expression: /actualiza (?:tu|su) (?:información|datos) de pago/iu },
+            { category: 'recovery_secret', expression: /(?:introduce|ingrese) (?:tu|su) frase de recuperación/iu },
+        ],
+    },
+    {
+        id: 'fr-reviewed-v1', language: 'fr', label: 'French', patterns: [
+            { category: 'account_verification', expression: /(?:vérifiez votre compte|confirmez votre identité|veuillez confirmer votre identité)/iu },
+            { category: 'account_restriction', expression: /votre compte (?:a été|sera) (?:suspendu|bloqué|limité|restreint)/iu },
+            { category: 'urgent_action', expression: /(?:action immédiate requise|alerte de sécurité)/iu },
+            { category: 'payment_update', expression: /mettez à jour vos (?:informations|coordonnées) de paiement/iu },
+            { category: 'recovery_secret', expression: /saisissez votre phrase de récupération/iu },
+        ],
+    },
+    {
+        id: 'de-reviewed-v1', language: 'de', label: 'German', patterns: [
+            { category: 'account_verification', expression: /(?:bestätigen sie ihr konto|bestätigen sie ihre identität)/iu },
+            { category: 'account_restriction', expression: /ihr konto wurde (?:gesperrt|eingeschränkt|suspendiert)/iu },
+            { category: 'urgent_action', expression: /(?:sofortiges handeln erforderlich|sicherheitswarnung)/iu },
+            { category: 'payment_update', expression: /aktualisieren sie ihre zahlungsdaten/iu },
+            { category: 'recovery_secret', expression: /geben sie ihre wiederherstellungsphrase ein/iu },
+        ],
+    },
+    {
+        id: 'pt-reviewed-v1', language: 'pt', label: 'Portuguese', patterns: [
+            { category: 'account_verification', expression: /(?:verifique sua conta|confirme sua identidade)/iu },
+            { category: 'account_restriction', expression: /sua conta (?:foi|será) (?:suspensa|bloqueada|limitada|restrita)/iu },
+            { category: 'urgent_action', expression: /(?:ação imediata necessária|alerta de segurança)/iu },
+            { category: 'payment_update', expression: /atualize suas informações de pagamento/iu },
+            { category: 'recovery_secret', expression: /insira sua frase de recuperação/iu },
+        ],
+    },
+    {
+        id: 'it-reviewed-v1', language: 'it', label: 'Italian', patterns: [
+            { category: 'account_verification', expression: /(?:verifica il tuo account|conferma la tua identità)/iu },
+            { category: 'account_restriction', expression: /il tuo account (?:è stato|sarà) (?:sospeso|bloccato|limitato)/iu },
+            { category: 'urgent_action', expression: /(?:azione immediata richiesta|avviso di sicurezza)/iu },
+            { category: 'payment_update', expression: /aggiorna (?:i tuoi dati|le tue informazioni) di pagamento/iu },
+            { category: 'recovery_secret', expression: /inserisci la (?:tua )?frase di recupero/iu },
+        ],
+    },
+    {
+        id: 'nl-reviewed-v1', language: 'nl', label: 'Dutch', patterns: [
+            { category: 'account_verification', expression: /(?:verifieer uw account|bevestig uw identiteit)/iu },
+            { category: 'account_restriction', expression: /uw account (?:is|wordt) (?:geblokkeerd|beperkt|opgeschort)/iu },
+            { category: 'urgent_action', expression: /(?:onmiddellijke actie vereist|beveiligingswaarschuwing)/iu },
+            { category: 'payment_update', expression: /werk uw betalingsgegevens bij/iu },
+            { category: 'recovery_secret', expression: /voer uw herstelzin in/iu },
+        ],
+    },
+]);
+function preferredPacks(documentLanguage) {
+    if (typeof documentLanguage !== 'string')
+        return PAGE_LANGUAGE_PACKS;
+    const primary = documentLanguage.trim().toLowerCase().split('-', 1)[0];
+    if (!primary)
+        return PAGE_LANGUAGE_PACKS;
+    const declared = PAGE_LANGUAGE_PACKS.filter((pack) => pack.language === primary);
+    return declared.length
+        ? Object.freeze([...declared, ...PAGE_LANGUAGE_PACKS.filter((pack) => pack.language !== primary)])
+        : PAGE_LANGUAGE_PACKS;
+}
+export function detectPageLanguageSignal(input, documentLanguage, suppliedAnalysis) {
+    if (typeof input !== 'string' || !input || input.length > MAX_PAGE_LANGUAGE_SIGNAL_CHARS || CONTROL_CHARACTER_RE.test(input)) {
+        return null;
+    }
+    const analysis = suppliedAnalysis ?? analyzeStaticHtml(input, { includeVisibleText: true });
+    if (analysis.inputLimitReached || analysis.visibleTextLimitReached)
+        return null;
+    const visibleText = analysis.visibleText
+        .replace(/\s+/gu, ' ')
+        .trim();
+    if (!visibleText)
+        return null;
+    for (const pack of preferredPacks(documentLanguage)) {
+        for (const pattern of pack.patterns) {
+            if (!pattern.expression.test(visibleText))
+                continue;
+            return Object.freeze({
+                version: PAGE_LANGUAGE_SIGNAL_VERSION,
+                packId: pack.id,
+                language: pack.language,
+                category: pattern.category,
+                label: `Reviewed ${pack.label} ${CATEGORY_LABELS[pattern.category]} language`,
+            });
+        }
+    }
+    return null;
+}
+export function pageLanguagePackCatalogue() {
+    return Object.freeze(PAGE_LANGUAGE_PACKS.map((pack) => Object.freeze({
+        id: pack.id,
+        language: pack.language,
+        categories: Object.freeze([...new Set(pack.patterns.map((pattern) => pattern.category))]),
+    })));
+}

package/lib/rdap-transport.mjs

@@ -3,12 +3,12 @@
 // lib/rdap.mts.
 import { readTextCapped, safeFetch, safeFetchDetailed } from "./safe-fetch.mjs";
 const MAX_RDAP_BYTES = 2000000;
-async function fetchRdapWithTimeout(url, options, timeoutMs) {
+async function fetchRdapWithTimeout(url, options, timeoutMs, dependencies = {}) {
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), timeoutMs);
     try {
-        const response = await safeFetch(url, { ...options, signal: controller.signal });
-        const { text, truncated } = await readTextCapped(response, MAX_RDAP_BYTES);
+        const response = await (dependencies.fetch ?? safeFetch)(url, { ...options, signal: controller.signal });
+        const { text, truncated } = await (dependencies.readText ?? readTextCapped)(response, MAX_RDAP_BYTES);
         if (truncated)
             throw new Error(`Response from ${url} exceeded ${MAX_RDAP_BYTES} bytes`);
         return { status: response.status, ok: response.ok, text };
@@ -17,12 +17,12 @@ async function fetchRdapWithTimeout(url, options, timeoutMs) {
         clearTimeout(timeout);
     }
 }
-async function fetchRdapDetailedWithTimeout(url, options, timeoutMs) {
+async function fetchRdapDetailedWithTimeout(url, options, timeoutMs, dependencies = {}) {
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), timeoutMs);
     try {
-        const result = await safeFetchDetailed(url, { ...options, signal: controller.signal });
-        const { text, truncated } = await readTextCapped(result.response, MAX_RDAP_BYTES);
+        const result = await (dependencies.fetchDetailed ?? safeFetchDetailed)(url, { ...options, signal: controller.signal });
+        const { text, truncated } = await (dependencies.readText ?? readTextCapped)(result.response, MAX_RDAP_BYTES);
         if (truncated)
             throw new Error(`Response from ${url} exceeded ${MAX_RDAP_BYTES} bytes`);
         return {

package/lib/risk-scoring.mjs

@@ -23,6 +23,14 @@ const FAMILY_CAPS = Object.freeze({
     'external-intelligence': 18,
     'operational-support': 12,
 });
+const REMOVABLE_RISK_FAMILY_MAP = Object.freeze({
+    'brand-presentation': true,
+    'credential-lure': true,
+    'domain-resemblance': true,
+    'external-intelligence': true,
+    'operational-support': true,
+});
+const REMOVABLE_RISK_FAMILIES = Object.freeze(Object.keys(REMOVABLE_RISK_FAMILY_MAP));
 const HIGH_CONTEXT_MUTATIONS = new Set([
     'unicode_homoglyph',
     'unicode_homoglyph_depth_2',
@@ -105,13 +113,15 @@ function scoreQuality(input) {
 }
 // Risk prioritizes a registered lookalike/typosquat domain for analyst review.
 // It is a heuristic indicator, never a maliciousness or safety verdict.
-export function explainRiskScore(input) {
+function explainRiskScoreInternal(input, excludedFamily) {
     const state = input.availability ?? input.state;
     if (typeof state !== 'string' || !RISK_STATES.has(state))
         return null;
     const factors = [];
     const familyTotals = new Map();
     const add = (family, label, requestedDelta) => {
+        if (family === excludedFamily)
+            return 0;
         const current = familyTotals.get(family) ?? 0;
         const cap = FAMILY_CAPS[family] ?? Number.POSITIVE_INFINITY;
         const delta = Math.max(0, Math.min(requestedDelta, Math.max(0, cap - current)));
@@ -193,6 +203,37 @@ export function explainRiskScore(input) {
         evidenceQuality: scoreQuality(input),
     };
 }
+export function explainRiskScore(input) {
+    return explainRiskScoreInternal(input, null);
+}
+export function buildRiskScoreSensitivity(input) {
+    const baseline = explainRiskScoreInternal(input, null);
+    if (!baseline)
+        return null;
+    const removableFamilies = REMOVABLE_RISK_FAMILIES
+        .filter((family) => baseline.families.some((item) => item.id === family && item.contribution > 0));
+    const scenarios = removableFamilies.map((excludedFamily) => {
+        const result = explainRiskScoreInternal(input, excludedFamily);
+        const score = result?.score ?? baseline.score;
+        return Object.freeze({ excludedFamily, score, difference: score - baseline.score });
+    }).sort((left, right) => left.score - right.score || left.excludedFamily.localeCompare(right.excludedFamily));
+    const minimumScenarioScore = scenarios[0]?.score ?? baseline.score;
+    const thresholdState = baseline.score < RISK_REVIEW_THRESHOLD
+        ? 'below'
+        : minimumScenarioScore < RISK_REVIEW_THRESHOLD ? 'crosses' : 'stable_above';
+    return Object.freeze({
+        version: 1,
+        baselineScore: baseline.score,
+        reviewThreshold: RISK_REVIEW_THRESHOLD,
+        minimumScenarioScore,
+        thresholdState,
+        scenarios: Object.freeze(scenarios),
+        limitations: Object.freeze([
+            'Each scenario removes one observed evidence family and recalculates family caps and corroboration; it does not predict missing evidence.',
+            'The sensitivity review qualifies prioritisation only and does not determine maliciousness, safety, ownership, or intent.',
+        ]),
+    });
+}
 export function computeRiskScore(input) {
     return explainRiskScore(input)?.score ?? null;
 }