@slicedearth/whoisleuth-cli 1.45.0 → 1.47.4

package/frontend/src/lib/analysis/lookup-claim-readiness.js

@@ -0,0 +1,280 @@
+export const LOOKUP_CLAIM_READINESS_VERSION = 2;
+export const LOOKUP_CLAIM_IDS = [
+    'registration-state',
+    'current-web-observation',
+    'brand-resemblance',
+    'controlled-change',
+    'incident-response',
+    'network-context',
+];
+export const LOOKUP_CLAIM_REQUIREMENT_IDS = [
+    'authority-aware-availability',
+    'registry-rdap',
+    'registry-whois',
+    'registry-control-selection',
+    'dns-observation',
+    'http-observation',
+    'tls-observation',
+    'page-identity-observation',
+    'reviewed-brand-profile',
+    'reviewed-case-recipient',
+    'authoritative-rdap',
+];
+const MAX_TEXT = 320;
+const MAX_DIAGNOSTICS = 12;
+const CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/gu;
+const LIMITED_STATES = new Set(['partial', 'unavailable', 'unknown']);
+const ABSENT_STATES = new Set(['skipped', 'unsupported']);
+export const LOOKUP_CLAIM_REQUIREMENTS = Object.freeze({
+    'authority-aware-availability': Object.freeze({ id: 'authority-aware-availability', label: 'Authority-aware availability decision', evidenceId: 'availability', mode: 'network_collection', href: '#registry' }),
+    'registry-rdap': Object.freeze({ id: 'registry-rdap', label: 'Registry RDAP evidence', evidenceId: 'rdap', mode: 'network_collection', href: '#registry' }),
+    'registry-whois': Object.freeze({ id: 'registry-whois', label: 'Registry WHOIS evidence', evidenceId: 'whois', mode: 'network_collection', href: '#registry' }),
+    'registry-control-selection': Object.freeze({ id: 'registry-control-selection', label: 'Registry control evidence selected by the availability authority', evidenceId: null, mode: 'network_collection', href: '#registry' }),
+    'dns-observation': Object.freeze({ id: 'dns-observation', label: 'DNS observation', evidenceId: 'dns', mode: 'network_collection', href: '#evidence-dns' }),
+    'http-observation': Object.freeze({ id: 'http-observation', label: 'HTTP observation', evidenceId: 'http', mode: 'network_collection', href: '#evidence-http' }),
+    'tls-observation': Object.freeze({ id: 'tls-observation', label: 'TLS observation', evidenceId: 'tls', mode: 'network_collection', href: '#evidence-tls' }),
+    'page-identity-observation': Object.freeze({ id: 'page-identity-observation', label: 'Page identity observation', evidenceId: 'page-identity', mode: 'network_collection', href: '#evidence-page' }),
+    'reviewed-brand-profile': Object.freeze({ id: 'reviewed-brand-profile', label: 'Reviewed Brand Profile', evidenceId: null, mode: 'local_review', href: '#case-response' }),
+    'reviewed-case-recipient': Object.freeze({ id: 'reviewed-case-recipient', label: 'Reviewed case and recipient route', evidenceId: null, mode: 'local_review', href: '#case-response' }),
+    'authoritative-rdap': Object.freeze({ id: 'authoritative-rdap', label: 'Authoritative RDAP evidence', evidenceId: 'rdap', mode: 'network_collection', href: '#registry' }),
+});
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : {};
+}
+function text(value, maximum = MAX_TEXT) {
+    return String(value ?? '')
+        .replace(CONTROL_CHARACTERS, ' ')
+        .replace(/\s+/gu, ' ')
+        .trim()
+        .slice(0, maximum);
+}
+function timestamp(value) {
+    if (typeof value !== 'string')
+        return null;
+    const parsed = Date.parse(value);
+    return Number.isFinite(parsed) ? parsed : null;
+}
+function evaluateRequirements(requirements) {
+    const missing = requirements.filter((requirement) => requirement.state !== 'complete');
+    const limitations = missing.flatMap((requirement) => {
+        const detail = requirement.limitations[0] || requirement.state.replaceAll('_', ' ');
+        return [`${requirement.label}: ${detail}`];
+    }).slice(0, 8);
+    if (!missing.length) {
+        return {
+            state: 'ready',
+            requiredEvidence: requirements.map((item) => item.label),
+            missingEvidence: [],
+            requiredEvidenceIds: requirements.map((item) => item.id),
+            missingEvidenceIds: [],
+            limitations,
+            requirements,
+        };
+    }
+    const observedCount = requirements.filter((requirement) => !ABSENT_STATES.has(requirement.state) && requirement.state !== 'unknown').length;
+    const hasLimited = requirements.some((requirement) => LIMITED_STATES.has(requirement.state));
+    return {
+        state: observedCount > 0 && hasLimited ? 'limited' : 'not_ready',
+        requiredEvidence: requirements.map((item) => item.label),
+        missingEvidence: missing.map((item) => item.label),
+        requiredEvidenceIds: requirements.map((item) => item.id),
+        missingEvidenceIds: missing.map((item) => item.id),
+        limitations,
+        requirements,
+    };
+}
+function requirement(id, coverage, override) {
+    const definition = LOOKUP_CLAIM_REQUIREMENTS[id];
+    const evidence = definition.evidenceId ? coverage.get(definition.evidenceId) : undefined;
+    const state = override?.state ?? evidence?.state ?? 'unknown';
+    const limitations = override?.limitation
+        ? [override.limitation]
+        : evidence?.limitations.length
+            ? evidence.limitations.slice(0, 8)
+            : state === 'complete'
+                ? []
+                : [evidence?.statusLabel || 'Not supplied'];
+    return Object.freeze({ ...definition, state, limitations: Object.freeze(limitations) });
+}
+function readinessEntry(input) {
+    const evaluated = evaluateRequirements(input.requirements);
+    return { id: input.id, label: input.label, conclusion: input.conclusion, href: input.href, ...evaluated };
+}
+function comparisonDiagnostics(comparison, sourceLabel, observedAt) {
+    const source = record(comparison);
+    const fields = Array.isArray(source.fields) ? source.fields.slice(0, 32) : [];
+    const registryTime = timestamp(observedAt.registry);
+    const comparedTime = timestamp(observedAt.compared);
+    const timeGapHours = registryTime !== null && comparedTime !== null
+        ? Math.round(Math.abs(registryTime - comparedTime) / 3_600_000)
+        : null;
+    const output = [];
+    for (const item of fields) {
+        const field = record(item);
+        if (text(field.status, 64) !== 'conflict')
+            continue;
+        const label = text(field.label, 100) || 'Registration field';
+        const normalizedLabel = label.toLowerCase();
+        let hypothesis = 'Different source publication scope or update timing';
+        let detail = `Registry RDAP and ${sourceLabel} published different normalized values. Review the exact values and source timestamps.`;
+        const basis = ['Material normalized-value difference'];
+        if (timeGapHours !== null && timeGapHours >= 1) {
+            hypothesis = 'Collection-time or publication-lag difference';
+            detail = `The sources were observed about ${timeGapHours} hour${timeGapHours === 1 ? '' : 's'} apart. A change or publication delay could explain the difference, but this is not established.`;
+            basis.push('Different observation times');
+        }
+        else if (/contact|registrant|administrative|technical|abuse/u.test(normalizedLabel)) {
+            hypothesis = 'Disclosure or source-role difference';
+            detail = `Registration contact publications can differ by source role, disclosure policy, privacy service, or update timing. The available evidence does not identify which explanation applies.`;
+            basis.push('Contact-related field');
+        }
+        else if (/status|nameserver|name server|dnssec/u.test(normalizedLabel)) {
+            hypothesis = 'Registry and delegated-service publication difference';
+            detail = `Operational and registry publications can update at different times or represent different layers. Directly review the current authoritative evidence before treating this as a configuration change.`;
+            basis.push('Operational registration field');
+        }
+        else if (/registrar|sponsor/u.test(normalizedLabel)) {
+            hypothesis = 'Sponsorship publication or transfer timing difference';
+            detail = `A transfer, reseller relationship, source normalisation, or publication delay could explain the difference. None is proven by this comparison alone.`;
+            basis.push('Registrar-related field');
+        }
+        output.push({
+            id: `${sourceLabel === 'WHOIS' ? 'whois' : 'registrar-rdap'}-${normalizedLabel.replace(/[^a-z0-9]+/gu, '-').replace(/^-|-$/gu, '') || output.length}`,
+            field: label,
+            hypothesis,
+            detail,
+            basis,
+        });
+    }
+    return output;
+}
+export function buildLookupClaimReadiness(input) {
+    const coverage = new Map(input.coverage.entries.map((entry) => [entry.id, entry]));
+    const targetType = text(input.targetType, 20);
+    const settledAvailability = !['', 'unknown', 'inconclusive', 'error'].includes(text(input.availabilityState, 40));
+    const observedAvailability = requirement('authority-aware-availability', coverage);
+    const registrationRequirements = [settledAvailability
+            ? observedAvailability
+            : Object.freeze({
+                ...observedAvailability,
+                state: observedAvailability.state === 'complete' ? 'partial' : observedAvailability.state,
+                limitations: Object.freeze([
+                    ...observedAvailability.limitations,
+                    'The authority-aware availability state is not settled.',
+                ].slice(0, 8)),
+            })];
+    const availabilitySource = text(input.availabilitySource, 24).toLowerCase();
+    const controlledRegistrationRequirements = availabilitySource === 'rdap'
+        ? [requirement('registry-rdap', coverage)]
+        : availabilitySource === 'whois'
+            ? [requirement('registry-whois', coverage)]
+            : [requirement('registry-control-selection', coverage, {
+                    state: 'unknown',
+                    limitation: 'The availability authority did not select a registry control source.',
+                })];
+    const webRequirements = [requirement('http-observation', coverage), requirement('tls-observation', coverage)];
+    const entries = [];
+    if (targetType === 'domain') {
+        entries.push(readinessEntry({
+            id: 'registration-state',
+            label: 'Registration-state statement',
+            conclusion: 'Whether an authority-aware registered, available, or inconclusive statement can be made.',
+            requirements: registrationRequirements,
+            href: '#registry',
+        }));
+        entries.push(readinessEntry({
+            id: 'current-web-observation',
+            label: 'Current website statement',
+            conclusion: 'Whether the current HTTP and TLS observation is complete enough to describe what responded.',
+            requirements: webRequirements,
+            href: '#web-evidence',
+        }));
+        if (input.task === 'brand' || input.hasActiveProfile) {
+            entries.push(readinessEntry({
+                id: 'brand-resemblance',
+                label: 'Brand-resemblance assessment',
+                conclusion: 'Whether reviewed brand context and page identity evidence support a bounded resemblance assessment.',
+                requirements: [
+                    requirement('page-identity-observation', coverage),
+                    requirement('reviewed-brand-profile', coverage, {
+                        state: input.profileSourceState === 'unavailable'
+                            ? 'unavailable'
+                            : input.hasActiveProfile === true
+                                ? 'complete'
+                                : 'unknown',
+                        ...(input.profileSourceState === 'unavailable'
+                            ? { limitation: 'The browser-local Brand Profile source is unavailable.' }
+                            : input.hasActiveProfile === true
+                                ? {}
+                                : { limitation: 'No reviewed Brand Profile is active.' }),
+                    }),
+                ],
+                href: '#evidence-page',
+            }));
+        }
+        if (input.task === 'owned' || input.task === 'acquisition') {
+            entries.push(readinessEntry({
+                id: 'controlled-change',
+                label: 'Controlled-change planning',
+                conclusion: 'Whether registration and DNS evidence are complete enough to prepare a reviewed change plan.',
+                requirements: [...registrationRequirements, ...controlledRegistrationRequirements, requirement('dns-observation', coverage)],
+                href: '#evidence-dns',
+            }));
+        }
+        if (input.task === 'incident') {
+            entries.push(readinessEntry({
+                id: 'incident-response',
+                label: 'Incident response handoff',
+                conclusion: 'Whether current web evidence and a reviewed recipient route are present for a response packet.',
+                requirements: [
+                    requirement('http-observation', coverage),
+                    requirement('page-identity-observation', coverage),
+                    requirement('reviewed-case-recipient', coverage, {
+                        state: input.hasCaseSection === true && (input.responseRecipientCount ?? 0) > 0 ? 'complete' : 'unknown',
+                        ...(input.hasCaseSection === true && (input.responseRecipientCount ?? 0) > 0
+                            ? {}
+                            : { limitation: 'A reviewed case and recipient route are not both available.' }),
+                    }),
+                ],
+                href: '#case-response',
+            }));
+        }
+    }
+    else if (targetType === 'ip' || targetType === 'ipv4' || targetType === 'ipv6' || targetType === 'asn') {
+        entries.push(readinessEntry({
+            id: 'network-context',
+            label: 'Network registration statement',
+            conclusion: 'Whether the observed network registration context is complete enough to describe the resource.',
+            requirements: [requirement('authoritative-rdap', coverage)],
+            href: '#registry',
+        }));
+    }
+    const disagreements = [
+        ...comparisonDiagnostics(input.registryComparison, 'WHOIS', {
+            registry: input.observedAt?.registry,
+            compared: input.observedAt?.whois,
+        }),
+        ...comparisonDiagnostics(input.registrarPublicationComparison, 'Registrar RDAP', {
+            registry: input.observedAt?.registry,
+            compared: input.observedAt?.registrar,
+        }),
+    ].slice(0, MAX_DIAGNOSTICS);
+    const counts = {
+        ready: 0,
+        limited: 0,
+        not_ready: 0,
+    };
+    for (const entry of entries)
+        counts[entry.state] += 1;
+    return {
+        version: LOOKUP_CLAIM_READINESS_VERSION,
+        entries,
+        disagreements,
+        counts,
+        limitation: input.decisionSupport.counts.conflicts
+            ? 'Readiness describes evidence sufficiency, not truth. Registration-source explanations are bounded hypotheses and require review of the original observations.'
+            : 'Readiness describes evidence sufficiency, not truth, ownership, intent, safety, or eligibility.',
+    };
+}

package/frontend/src/lib/analysis/lookup-decision-support.js

@@ -2,6 +2,21 @@ const CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/gu;
 const MAX_TEXT = 320;
 const MAX_ENTRIES = 24;
 const MAX_ACTIONS = 6;
+export const MAX_LOOKUP_PRESENTED_ACTIONS = 3;
+const LOOKUP_TASK_EVIDENCE_KINDS = new Set([
+    'delegation', 'dependency', 'dns', 'form', 'http', 'identity', 'mail', 'page',
+    'posture', 'ptr', 'redirect', 'tls',
+]);
+const TASK_ACTION_ID = Object.freeze({
+    acquisition: 'review-acquisition-dependencies',
+    brand: 'review-page-identity',
+    owned: 'review-owned-posture',
+});
+const ACTION_PRIORITY = Object.freeze({
+    high: 0,
+    medium: 1,
+    low: 2,
+});
 const TASK_GUIDANCE = Object.freeze({
     general: Object.freeze({
         label: 'General investigation',
@@ -338,12 +353,40 @@ function prioritizeEntries(entries, task) {
     return [...entries].sort((left, right) => {
         const leftBoost = taskBoost[task].some((prefix) => left.id.startsWith(prefix)) ? -1 : 0;
         const rightBoost = taskBoost[task].some((prefix) => right.id.startsWith(prefix)) ? -1 : 0;
-        return leftBoost - rightBoost
-            || importance[left.importance] - importance[right.importance]
+        return importance[left.importance] - importance[right.importance]
+            || leftBoost - rightBoost
             || left.title.localeCompare(right.title);
     }).slice(0, 16);
 }
+function normalizedTaskEvidenceKinds(values) {
+    return new Set((values ?? [])
+        .slice(0, 24)
+        .filter((value) => (typeof value === 'string' && LOOKUP_TASK_EVIDENCE_KINDS.has(value))));
+}
+function supportsDecisionDestination(href, evidence) {
+    if (href === '#evidence-tls')
+        return evidence.has('tls');
+    if (href === '#evidence-http')
+        return evidence.has('http') || evidence.has('redirect');
+    if (href === '#evidence-page') {
+        return evidence.has('page') || evidence.has('identity') || evidence.has('form');
+    }
+    if (href === '#evidence-certificate-policy')
+        return evidence.has('tls') || evidence.has('dns');
+    return true;
+}
+function supportsTaskAction(task, targetType, evidence) {
+    if (targetType !== 'domain')
+        return false;
+    const requiredKinds = {
+        acquisition: ['dns', 'mail', 'tls', 'http', 'page', 'dependency'],
+        brand: ['page', 'identity', 'form', 'redirect'],
+        owned: ['delegation', 'mail', 'tls', 'posture'],
+    };
+    return requiredKinds[task]?.some((kind) => evidence.has(kind)) ?? false;
+}
 export function buildLookupDecisionSupport(input) {
+    const availableEvidence = normalizedTaskEvidenceKinds(input.availableEvidence);
     const entries = prioritizeEntries([
         ...comparisonEntries(input.registryComparison, 'registry-whois'),
         ...comparisonEntries(input.registrarPublicationComparison, 'registry-registrar'),
@@ -351,7 +394,8 @@ export function buildLookupDecisionSupport(input) {
         ...certificatePolicyEntries(input.certificatePolicyReview),
     ], input.task);
     const actions = [];
-    const firstConflict = entries.find((entry) => entry.state === 'conflict');
+    const firstConflict = entries.find((entry) => entry.state === 'conflict'
+        && supportsDecisionDestination(entry.href, availableEvidence));
     if (firstConflict) {
         actions.push({
             id: 'review-priority-conflict',
@@ -383,7 +427,7 @@ export function buildLookupDecisionSupport(input) {
             priority: 'medium',
         });
     }
-    if (input.task === 'brand') {
+    if (supportsTaskAction(input.task, input.targetType, availableEvidence) && input.task === 'brand') {
         actions.push({
             id: 'review-page-identity',
             label: 'Review identity and credential evidence',
@@ -393,7 +437,7 @@ export function buildLookupDecisionSupport(input) {
             priority: 'medium',
         });
     }
-    else if (input.task === 'acquisition') {
+    else if (supportsTaskAction(input.task, input.targetType, availableEvidence) && input.task === 'acquisition') {
         actions.push({
             id: 'review-acquisition-dependencies',
             label: 'Review transfer dependencies',
@@ -403,7 +447,7 @@ export function buildLookupDecisionSupport(input) {
             priority: 'medium',
         });
     }
-    else if (input.task === 'owned') {
+    else if (supportsTaskAction(input.task, input.targetType, availableEvidence) && input.task === 'owned') {
         actions.push({
             id: 'review-owned-posture',
             label: 'Review delegation and posture evidence',
@@ -435,6 +479,17 @@ export function buildLookupDecisionSupport(input) {
         },
     };
 }
+export function projectLookupNextActions(actions, task) {
+    const taskActionId = TASK_ACTION_ID[task];
+    return actions
+        .slice(0, MAX_ACTIONS)
+        .map((action, index) => ({ action, index }))
+        .sort((left, right) => (ACTION_PRIORITY[left.action.priority] - ACTION_PRIORITY[right.action.priority]
+        || Number(right.action.id === taskActionId) - Number(left.action.id === taskActionId)
+        || left.index - right.index))
+        .slice(0, MAX_LOOKUP_PRESENTED_ACTIONS)
+        .map(({ action }) => action);
+}
 function timingByEvidence(timing) {
     const output = new Map();
     if (!timing)

package/frontend/src/lib/analysis/lookup-presentation.js

@@ -1,5 +1,6 @@
 export const LOOKUP_PRESENTATION_STORAGE_KEY = 'whoisleuth:lookup-presentation:v1';
 export const MAX_LOOKUP_PRESENTATION_SERIALIZED_BYTES = 1_024;
+export const MAX_LOOKUP_URL_QUERY_LENGTH = 4_096;
 export const LOOKUP_TASK_VIEWS = Object.freeze([
     Object.freeze({ id: 'general', label: 'General investigation' }),
     Object.freeze({ id: 'acquisition', label: 'Acquisition review' }),
@@ -8,11 +9,72 @@ export const LOOKUP_TASK_VIEWS = Object.freeze([
     Object.freeze({ id: 'owned', label: 'Owned-domain posture' }),
 ]);
 const TASKS = new Set(LOOKUP_TASK_VIEWS.map((option) => option.id));
+const CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/u;
+export function parseLookupTaskContext(value) {
+    if (typeof value !== 'string' || value.length > 16)
+        return null;
+    return TASKS.has(value) ? value : null;
+}
 export function normalizeLookupTaskView(value) {
     return typeof value === 'string' && TASKS.has(value)
         ? value
         : 'general';
 }
+function lookupUrlQuery(value) {
+    if (value === null || value.length > MAX_LOOKUP_URL_QUERY_LENGTH || CONTROL_CHARACTERS.test(value))
+        return null;
+    const normalized = value.trim();
+    return normalized ? normalized : null;
+}
+function lookupUrlDepth(value) {
+    return value === 'fast' || value === 'deep' ? value : null;
+}
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : null;
+}
+export function lookupResultDepth(value, fallback = null) {
+    const result = record(value);
+    if (!result)
+        return fallback;
+    const availability = record(result.availability);
+    if (availability?.deepScanComplete === false)
+        return 'fast';
+    if (availability?.deepScanComplete === true)
+        return 'deep';
+    const whois = record(result.whois);
+    if (whois?.skipped === true
+        && typeof whois.detail === 'string'
+        && /fast rdap-only mode/iu.test(whois.detail))
+        return 'fast';
+    const scanModes = [
+        record(result.reverseDns)?.scanMode,
+        record(availability?.dns)?.scanMode,
+        record(availability?.http)?.scanMode,
+    ];
+    if (scanModes.includes('deep'))
+        return 'deep';
+    if (scanModes.includes('fast'))
+        return 'fast';
+    return fallback;
+}
+export function reconcileLookupUrlState(current, searchParams, preferredTask) {
+    const explicitQuery = lookupUrlQuery(searchParams.get('q'));
+    const explicitDepth = lookupUrlDepth(searchParams.get('depth'));
+    const queryChanged = explicitQuery !== null && explicitQuery !== current.query;
+    const depthChanged = explicitDepth !== null && explicitDepth !== current.depth;
+    const conflictsWithResult = current.result !== null && ((explicitQuery !== null && explicitQuery !== current.completedTarget)
+        || (explicitDepth !== null && explicitDepth !== current.retainedResultDepth));
+    return {
+        query: explicitQuery ?? current.query,
+        depth: explicitDepth ?? current.depth,
+        task: parseLookupTaskContext(searchParams.get('task')) ?? normalizeLookupTaskView(preferredTask),
+        result: conflictsWithResult ? null : current.result,
+        completedTarget: conflictsWithResult ? '' : current.completedTarget,
+        error: conflictsWithResult || queryChanged || depthChanged ? '' : current.error,
+    };
+}
 export function readLookupPresentation(storage) {
     try {
         const serialized = storage.getItem(LOOKUP_PRESENTATION_STORAGE_KEY);

package/frontend/src/lib/analysis/opaque-reference-id.js

@@ -0,0 +1,9 @@
+// Opaque browser-local identifiers shared by independently owned record
+// models. Validation is intentionally exact: callers must not trim, case-fold,
+// repair, resolve, or otherwise reinterpret an identifier.
+export const OPAQUE_REFERENCE_ID_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
+export function normalizeOpaqueReferenceId(value) {
+    return typeof value === 'string' && OPAQUE_REFERENCE_ID_PATTERN.test(value)
+        ? value
+        : null;
+}

package/frontend/src/lib/analysis/utils.js

@@ -151,6 +151,10 @@ function splitDelimitedLine(line, delimiter = ',') {
     return result.map((s) => s.trim());
 }
 const DOMAIN_HEADER_NAMES = ['domain', 'domain_name', 'domain name', 'hostname', 'name'];
+export const MAX_DOMAIN_INPUT_CHARACTERS = 2 * 1024 * 1024;
+export const MAX_DOMAIN_INPUT_BYTES = 2 * 1024 * 1024;
+export const MAX_DOMAIN_INPUT_LINES = 10_000;
+export const MAX_DOMAIN_INPUT_SEPARATORS = 20_000;
 function detectDelimiter(line) {
     const candidates = [',', ';', '\t'];
     let best = null;
@@ -182,10 +186,29 @@ function looksLikeLookupToken(value) {
     }
 }
 export function parseDomainInput(text) {
-    const normalized = String(text || '').replace(/^\uFEFF/, '');
+    const source = String(text || '');
+    if (source.length > MAX_DOMAIN_INPUT_CHARACTERS) {
+        return { entries: [], duplicates: 0, usedHeader: false, tooLarge: true };
+    }
+    if (new TextEncoder().encode(source).byteLength > MAX_DOMAIN_INPUT_BYTES) {
+        return { entries: [], duplicates: 0, usedHeader: false, tooLarge: true };
+    }
+    let lineCount = 1;
+    let separatorCount = 0;
+    for (let index = 0; index < source.length; index += 1) {
+        const character = source[index];
+        if (character === '\n')
+            lineCount += 1;
+        if (character === ',' || character === ';' || character === '\t')
+            separatorCount += 1;
+        if (lineCount > MAX_DOMAIN_INPUT_LINES || separatorCount > MAX_DOMAIN_INPUT_SEPARATORS) {
+            return { entries: [], duplicates: 0, usedHeader: false, tooLarge: true };
+        }
+    }
+    const normalized = source.replace(/^\uFEFF/, '');
     const lines = normalized.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
     if (lines.length === 0)
-        return { entries: [], duplicates: 0, usedHeader: false };
+        return { entries: [], duplicates: 0, usedHeader: false, tooLarge: false };
     const firstLine = lines[0] ?? '';
     const delimiter = detectDelimiter(firstLine);
     const firstCells = delimiter ? splitDelimitedLine(firstLine, delimiter) : [firstLine];
@@ -228,5 +251,5 @@ export function parseDomainInput(text) {
         seen.add(key);
         entries.push(value);
     }
-    return { entries, duplicates, usedHeader };
+    return { entries, duplicates, usedHeader, tooLarge: false };
 }