@slicedearth/whoisleuth-cli 1.43.0 → 1.47.4

package/lib/lookup.mjs

@@ -320,7 +320,7 @@ async function runUnifiedLookup(classified, options = {}) {
             ? { ...rdapRecord, ...(registrarRdap ? { registrarRdap } : {}) }
             : {
                 error: rdapResult.status === 'rejected'
-                    ? errorMessage(rdapResult.reason, 'RDAP lookup failed')
+                    ? boundedSourceDetail(rdapResult.reason, 'RDAP lookup failed')
                     : 'No RDAP registry found for this query via IANA bootstrap',
                 attempts: rdapAttempts,
             };
@@ -337,7 +337,7 @@ async function runUnifiedLookup(classified, options = {}) {
     else {
         whois = {
             error: whoisResult.status === 'rejected'
-                ? errorMessage(whoisResult.reason, 'WHOIS lookup failed')
+                ? boundedSourceDetail(whoisResult.reason, 'WHOIS lookup failed')
                 : 'WHOIS returned no referral chain',
         };
     }

package/lib/observation.mjs

@@ -12,9 +12,10 @@ const STATUSES = new Set([
     'not_applicable',
 ]);
 const SCAN_MODES = new Set(['fast', 'deep']);
-const MAX_LIMITATIONS = 10;
-const MAX_LIMITATION_LENGTH = 300;
-const MAX_DIAGNOSTICS = 20;
+const MAX_OBSERVATION_LIMITATIONS = 10;
+const MAX_OBSERVATION_LIMITATION_LENGTH = 300;
+const MAX_OBSERVATION_DIAGNOSTICS = 20;
+const MAX_DIAGNOSTICS = MAX_OBSERVATION_DIAGNOSTICS;
 const MAX_DIAGNOSTIC_KEY = 40;
 const MAX_DIAGNOSTIC_STRING = 240;
 const MAX_DURATION_MS = 120_000;
@@ -76,9 +77,9 @@ function createObservation(input = {}) {
     const observedAt = isoTimestamp(input.observedAt) || new Date().toISOString();
     const duration = Number(input.durationMs);
     const limitations = [...new Set((Array.isArray(input.limitations) ? input.limitations : [])
-            .map((item) => safeString(item, MAX_LIMITATION_LENGTH))
+            .map((item) => safeString(item, MAX_OBSERVATION_LIMITATION_LENGTH))
             .filter((item) => item !== null))]
-        .slice(0, MAX_LIMITATIONS);
+        .slice(0, MAX_OBSERVATION_LIMITATIONS);
     return {
         version: OBSERVATION_VERSION,
         status,
@@ -111,4 +112,4 @@ function readObservationEnvelope(value) {
     }
     return { state: 'supported', observation: createObservation(record) };
 }
-export { OBSERVATION_VERSION, createObservation, readObservationEnvelope, };
+export { MAX_OBSERVATION_DIAGNOSTICS, MAX_OBSERVATION_LIMITATIONS, MAX_OBSERVATION_LIMITATION_LENGTH, OBSERVATION_VERSION, createObservation, readObservationEnvelope, };

package/lib/outbound-identity.mjs

@@ -1,8 +1,7 @@
-import packageDocument from '../package.json' with { type: 'json' };
+import { WHOISLEUTH_APPLICATION_VERSION } from "./application-version.mjs";
 import { WHOISLEUTH_PROJECT_URL, WHOISLEUTH_REQUEST_POLICY_URL, } from "./project-metadata.mjs";
-import { normalizeBoundedSemanticVersion } from "./semantic-version.mjs";
 export { WHOISLEUTH_PROJECT_URL, WHOISLEUTH_REQUEST_POLICY_URL };
-export const WHOISLEUTH_USER_AGENT_VERSION = normalizeBoundedSemanticVersion(packageDocument.version, 'Application manifest');
+export const WHOISLEUTH_USER_AGENT_VERSION = WHOISLEUTH_APPLICATION_VERSION;
 export const WHOISLEUTH_USER_AGENT = `WHOISleuth/${WHOISLEUTH_USER_AGENT_VERSION} (+${WHOISLEUTH_REQUEST_POLICY_URL})`;
 export function whoisleuthRequestHeaders(headers = {}) {
     return { ...headers, 'User-Agent': WHOISLEUTH_USER_AGENT };

package/lib/perceptual-hash.mjs

@@ -406,18 +406,26 @@ function dHash(image) {
  * back to the exact hash.
  */
 function faviconPerceptualHash(buf) {
+    return inspectDecodedImage(buf).perceptualHash;
+}
+function inspectDecodedImage(buf) {
     try {
         const image = decodeImage(buf);
         if (!image)
-            return null;
-        return dHash(image);
+            return Object.freeze({ decodable: false, width: null, height: null, perceptualHash: null });
+        return Object.freeze({
+            decodable: true,
+            width: image.width,
+            height: image.height,
+            perceptualHash: dHash(image),
+        });
     }
     catch {
-        return null;
+        return Object.freeze({ decodable: false, width: null, height: null, perceptualHash: null });
     }
 }
 // The same bounded decoder is also suitable for fixed-size PNG screenshots
 // produced by the optional local capture package. Keep the generic name as an
 // alias so the evidence contract does not imply that a screenshot is a favicon.
 const imagePerceptualHash = faviconPerceptualHash;
-export { faviconPerceptualHash, hammingDistanceHex, imagePerceptualHash };
+export { faviconPerceptualHash, hammingDistanceHex, imagePerceptualHash, inspectDecodedImage };

package/lib/portable-generator.mjs

@@ -0,0 +1,21 @@
+import { WHOISLEUTH_SOURCE_REPOSITORY_URL, } from "./project-metadata.mjs";
+import { normalizeBoundedSemanticVersion } from "./semantic-version.mjs";
+export function buildPortableGeneratorMetadata(applicationVersion) {
+    let version = null;
+    if (applicationVersion !== null && applicationVersion !== undefined && applicationVersion !== '') {
+        try {
+            version = normalizeBoundedSemanticVersion(applicationVersion, 'Portable report application');
+        }
+        catch {
+            version = null;
+        }
+    }
+    return Object.freeze({
+        name: 'WHOISleuth',
+        version,
+        projectUrl: WHOISLEUTH_SOURCE_REPOSITORY_URL,
+    });
+}
+export function portableGeneratorAttribution(generator) {
+    return `Generated with ${generator.name}${generator.version ? ` ${generator.version}` : ''} · Source: ${generator.projectUrl}`;
+}

package/lib/provider-policy-admission.mjs

@@ -1,4 +1,5 @@
 export const PROVIDER_POLICY_MAX_REVIEW_AGE_DAYS = 180;
+export const PROVIDER_POLICY_MAX_FUTURE_SKEW_MS = 5 * 60 * 1000;
 export const DEPLOYMENT_PURPOSES = ['personal', 'internal', 'commercial'];
 function deploymentPurpose(value) {
     const normalized = String(value ?? '').trim().toLowerCase();
@@ -6,13 +7,17 @@ function deploymentPurpose(value) {
         ? normalized
         : null;
 }
+export function providerPolicyReviewAgeDays(reviewedAtValue, now) {
+    const reviewedAt = typeof reviewedAtValue === 'string' ? Date.parse(reviewedAtValue) : Number.NaN;
+    if (!Number.isFinite(reviewedAt) || !Number.isFinite(now) || reviewedAt > now + PROVIDER_POLICY_MAX_FUTURE_SKEW_MS) {
+        return null;
+    }
+    return Math.max(0, Math.floor((now - reviewedAt) / 86_400_000));
+}
 export function providerPolicyAdmission(terms, env = process.env, now = Date.now()) {
     const source = env && typeof env === 'object' ? env : {};
     const purpose = deploymentPurpose(source.WHOISLEUTH_DEPLOYMENT_PURPOSE);
-    const reviewedAt = Date.parse(terms.reviewedAt);
-    const reviewAgeDays = Number.isFinite(reviewedAt)
-        ? Math.max(0, Math.floor((now - reviewedAt) / 86_400_000))
-        : null;
+    const reviewAgeDays = providerPolicyReviewAgeDays(terms.reviewedAt, now);
     if (!purpose) {
         return {
             allowed: false,

package/lib/rdap-normalization.mjs

@@ -564,12 +564,25 @@ function parseRdapObject(type, data) {
                     : {};
                 const v4 = Array.isArray(ipAddresses.v4) ? ipAddresses.v4 : [];
                 const v6 = Array.isArray(ipAddresses.v6) ? ipAddresses.v6 : [];
-                if (v4.length + v6.length > 20)
+                const maximumCandidates = 200;
+                const maximumAddresses = 20;
+                const addresses = [];
+                let visited = 0;
+                for (const [candidates, family] of [[v4, 4], [v6, 6]]) {
+                    for (let index = 0; index < candidates.length; index += 1) {
+                        if (visited >= maximumCandidates || addresses.length >= maximumAddresses)
+                            break;
+                        visited += 1;
+                        const address = boundedString(candidates[index], 80);
+                        if (address && net.isIP(address) === family)
+                            addresses.push(address);
+                    }
+                    if (visited >= maximumCandidates || addresses.length >= maximumAddresses)
+                        break;
+                }
+                if (v4.length + v6.length > visited || v4.length + v6.length > maximumAddresses) {
                     nameserverAddressesTruncated = true;
-                const addresses = [
-                    ...v4.map((address) => boundedString(address, 80)).filter((address) => address && net.isIP(address) === 4),
-                    ...v6.map((address) => boundedString(address, 80)).filter((address) => address && net.isIP(address) === 6),
-                ].slice(0, 20);
+                }
                 return {
                     name: boundedString(nameserver.ldhName || nameserver.unicodeName, 253),
                     addresses,

package/lib/rdap-registrar.mjs

@@ -85,11 +85,14 @@ export function selectRegistrarRdapLink(domain, links, registryEndpoint = null)
     }
     return null;
 }
+function registrarRdapTransport(override, safeDefault = fetchRdapDetailedWithTimeout) {
+    return override ?? safeDefault;
+}
 export async function fetchRegistrarRdapRecordWithParser(domain, registryRecord, parseRdap, options = {}) {
     const canonical = canonicalRdapDomain(domain);
     if (!canonical)
         throw new Error('A valid domain is required for registrar RDAP.');
-    const fetchUpstream = options.fetchUpstream || fetchRdapDetailedWithTimeout;
+    const fetchUpstream = registrarRdapTransport(options.fetchUpstream);
     return cached(`rdap-registrar:domain:${canonical}`, async () => {
         const registryParsed = recordOrNull(registryRecord?.parsed);
         const registryEndpoint = typeof registryRecord?.rdapServer === 'string' ? registryRecord.rdapServer : null;
@@ -194,3 +197,4 @@ export async function fetchRegistrarRdapRecordWithParser(domain, registryRecord,
         };
     });
 }
+export { registrarRdapTransport };

package/lib/rdap-transport.mjs

@@ -3,12 +3,12 @@
 // lib/rdap.mts.
 import { readTextCapped, safeFetch, safeFetchDetailed } from "./safe-fetch.mjs";
 const MAX_RDAP_BYTES = 2000000;
-async function fetchRdapWithTimeout(url, options, timeoutMs) {
+async function fetchRdapWithTimeout(url, options, timeoutMs, dependencies = {}) {
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), timeoutMs);
     try {
-        const response = await safeFetch(url, { ...options, signal: controller.signal });
-        const { text, truncated } = await readTextCapped(response, MAX_RDAP_BYTES);
+        const response = await (dependencies.fetch ?? safeFetch)(url, { ...options, signal: controller.signal });
+        const { text, truncated } = await (dependencies.readText ?? readTextCapped)(response, MAX_RDAP_BYTES);
         if (truncated)
             throw new Error(`Response from ${url} exceeded ${MAX_RDAP_BYTES} bytes`);
         return { status: response.status, ok: response.ok, text };
@@ -17,12 +17,12 @@ async function fetchRdapWithTimeout(url, options, timeoutMs) {
         clearTimeout(timeout);
     }
 }
-async function fetchRdapDetailedWithTimeout(url, options, timeoutMs) {
+async function fetchRdapDetailedWithTimeout(url, options, timeoutMs, dependencies = {}) {
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), timeoutMs);
     try {
-        const result = await safeFetchDetailed(url, { ...options, signal: controller.signal });
-        const { text, truncated } = await readTextCapped(result.response, MAX_RDAP_BYTES);
+        const result = await (dependencies.fetchDetailed ?? safeFetchDetailed)(url, { ...options, signal: controller.signal });
+        const { text, truncated } = await (dependencies.readText ?? readTextCapped)(result.response, MAX_RDAP_BYTES);
         if (truncated)
             throw new Error(`Response from ${url} exceeded ${MAX_RDAP_BYTES} bytes`);
         return {

package/lib/registry-capabilities.mjs

@@ -86,6 +86,9 @@ function registryAccessDiagnosticFor(value) {
         coverageState: capability.coverageState,
         whoisAccessProfile: capability.whoisAccessProfile,
         rdapAccessProfile: capability.rdapAccessProfile,
+        ...(capability.officialLookupUrl
+            ? { officialLookupUrl: capability.officialLookupUrl }
+            : {}),
         limitation: capability.limitation,
         authority: 'context_only',
     };

package/lib/registry-capability-catalogue.mjs

@@ -1,7 +1,7 @@
 // Registry compatibility metadata. IANA bootstrap and referral discovery
 // remain authoritative. Explicit query profiles may alter only the first
 // referred registry query after a fixture-backed adapter is integrated.
-const REGISTRY_CAPABILITIES_VERSION = 28;
+const REGISTRY_CAPABILITIES_VERSION = 29;
 const MAX_CAPABILITY_INPUT_LENGTH = 253;
 const REGISTRY_STANDARDS_COVERAGE_SNAPSHOT = Object.freeze({
     schema: 'whoisleuth.registry-standards-coverage',
@@ -165,6 +165,7 @@ const DEFAULT_CAPABILITY = freezeCapability({
     fixtureScenarios: ['registered', 'not_found', 'rate_limited'],
     verificationFiles: ['fixtures/whois-registry-fixtures.mts'],
     documentationUrls: [],
+    officialLookupUrl: null,
     limitation: DISCOVERY_LIMITATION,
 });
 const EXPLICIT_CAPABILITY_SEEDS = [
@@ -260,6 +261,7 @@ const EXPLICIT_CAPABILITY_SEEDS = [
             'https://www.iana.org/domains/root/db/ch.html',
             'https://www.iana.org/domains/root/db/li.html',
         ],
+        officialLookupUrl: 'https://www.nic.ch/whois/',
         limitation: SWITCH_ACCESS_LIMITATION,
     },
     {
@@ -644,9 +646,11 @@ const EXPLICIT_CAPABILITY_SEEDS = [
         coverageState: 'access_documented', whoisAccessProfile: 'source-ip-authorization-required',
         rdapAccessProfile: 'no-iana-service', verificationFiles: [],
         documentationUrls: [
+            'https://www.dominios.es/es',
             'https://www.iana.org/domains/root/db/es.html',
             'https://www.dominios.es/es/sobre-dominios/valores-anadidos/whois-43',
         ],
+        officialLookupUrl: 'https://www.dominios.es/es',
         limitation: ES_ACCESS_LIMITATION,
     },
     {
@@ -665,7 +669,11 @@ const EXPLICIT_CAPABILITY_SEEDS = [
         whoisParserProfile: 'generic-colon', fixtureScenarios: [],
         coverageState: 'access_documented', whoisAccessProfile: 'no-iana-service',
         rdapAccessProfile: 'no-iana-service', verificationFiles: [],
-        documentationUrls: ['https://www.iana.org/domains/root/db/gt.html'],
+        documentationUrls: [
+            'https://www.gt/sitio/',
+            'https://www.iana.org/domains/root/db/gt.html',
+        ],
+        officialLookupUrl: 'https://www.gt/sitio/',
         limitation: 'IANA publishes no RDAP service or domain WHOIS service for this suffix. WHOISleuth does not automate the registry website.',
     },
     {
@@ -1166,6 +1174,7 @@ const EXPLICIT_CAPABILITY_SEEDS = [
             'https://www.iana.org/domains/root/db/vn.html',
             'https://whois.vnnic.vn/',
         ],
+        officialLookupUrl: 'https://whois.vnnic.vn/',
         limitation: VN_ACCESS_LIMITATION,
     },
 ];
@@ -1191,6 +1200,7 @@ const EXPLICIT_CAPABILITIES = EXPLICIT_CAPABILITY_SEEDS.map((entry) => {
         coverageState: entry.coverageState || 'fixture_verified',
         verificationFiles: entry.verificationFiles || ['fixtures/whois-registry-fixtures.mts'],
         documentationUrls: entry.documentationUrls || [],
+        officialLookupUrl: entry.officialLookupUrl || null,
         limitation: entry.limitation || (rdapAccessProfile === 'no-iana-service'
             ? WHOIS_ONLY_FIXTURE_LIMITATION
             : FIXTURE_LIMITATION),

package/lib/registry-comparison.mjs

@@ -107,10 +107,11 @@ function normalizeRdapPublicationStatus(value) {
 function normalizeNameserver(value) {
     return normalizeDomain(value);
 }
-function normalizeSet(values, normalizeItem) {
+function normalizeSet(values, normalizeItem, maximum = 200) {
     if (!Array.isArray(values))
         return [];
-    return [...new Set(values.map(normalizeItem).filter((value) => Boolean(value)))].sort();
+    return [...new Set(values.slice(0, maximum).map(normalizeItem)
+            .filter((value) => Boolean(value)))].sort();
 }
 function sameNormalizedValue(left, right) {
     if (Array.isArray(left) || Array.isArray(right)) {
@@ -138,14 +139,20 @@ function displayValue(value, state, status) {
             return 'Disabled by deployment policy';
         return 'Source unavailable';
     }
-    if (Array.isArray(value))
-        return value.join(', ');
-    return String(value);
+    if (Array.isArray(value)) {
+        return value.slice(0, 200)
+            .filter((item) => typeof item === 'string')
+            .map((item) => item.slice(0, 253))
+            .join(', ');
+    }
+    return typeof value === 'string' || typeof value === 'number' || typeof value === 'boolean'
+        ? String(value).slice(0, 1_024)
+        : 'Not published';
 }
 function findRdapEvent(rdap, action) {
     if (!Array.isArray(rdap.events))
         return null;
-    const event = rdap.events.map(record).find((item) => item.action === action);
+    const event = rdap.events.slice(0, 100).map(record).find((item) => item.action === action);
     return event?.date || null;
 }
 function rdapLifecycleDate(rdap, field, fallbackAction) {
@@ -223,8 +230,8 @@ export function compareRegistrySources(rdapParsed, whoisParsed, options = {}) {
         dateField('Expires', 'expiryDate', 'expiration'),
         dateField('Last updated', 'updatedDate', 'last changed'),
         compareField('DNSSEC', rdap.dnssec, whois.dnssec, normalizeDnssec, sourceHealth),
-        compareField('Statuses', rdap.statuses, whois.statuses, (values) => normalizeSet(values, statusNormalizer), sourceHealth),
-        compareField('Name servers', rdap.nameservers, whois.nameservers, (values) => normalizeSet(values, normalizeNameserver), sourceHealth),
+        compareField('Statuses', rdap.statuses, whois.statuses, (values) => normalizeSet(values, statusNormalizer, 100), sourceHealth),
+        compareField('Name servers', rdap.nameservers, whois.nameservers, (values) => normalizeSet(values, normalizeNameserver, 200), sourceHealth),
     ].filter((field) => field !== null);
     const counts = {
         equivalent: 0, conflict: 0, rdap_only: 0, whois_only: 0,
@@ -265,7 +272,17 @@ export function compareRdapPublications(registryParsed, registrarParsed, options
     const registry = record(registryParsed);
     const registrar = record(registrarParsed);
     const registrarLifecycle = record(registrar.lifecycle);
-    const comparison = compareRegistrySources({ ...registry, handle: null }, {
+    const comparison = compareRegistrySources({
+        domain: registry.domain,
+        registrar: registry.registrar,
+        registrarIanaId: registry.registrarIanaId,
+        lifecycle: registry.lifecycle,
+        events: Array.isArray(registry.events) ? registry.events.slice(0, 100) : [],
+        dnssec: registry.dnssec,
+        statuses: Array.isArray(registry.statuses) ? registry.statuses.slice(0, 100) : [],
+        nameservers: Array.isArray(registry.nameservers) ? registry.nameservers.slice(0, 200) : [],
+        handle: null,
+    }, {
         domainName: registrar.domain,
         registrar: registrarValue(registrar.registrar),
         registrarIanaId: registrar.registrarIanaId,
@@ -276,8 +293,8 @@ export function compareRdapPublications(registryParsed, registrarParsed, options
         updatedDate: registrarLifecycle.updatedDate,
         updatedDateIso: registrarLifecycle.updatedDateIso,
         dnssec: registrar.dnssec,
-        statuses: registrar.statuses,
-        nameservers: registrar.nameservers,
+        statuses: Array.isArray(registrar.statuses) ? registrar.statuses.slice(0, 100) : [],
+        nameservers: Array.isArray(registrar.nameservers) ? registrar.nameservers.slice(0, 200) : [],
     }, {
         rdapStatus: options.registryStatus,
         whoisStatus: options.registrarStatus,