@slicedearth/whoisleuth-cli 1.45.0 → 2.0.0

package/lib/perceptual-hash.mjs

@@ -406,18 +406,26 @@ function dHash(image) {
  * back to the exact hash.
  */
 function faviconPerceptualHash(buf) {
+    return inspectDecodedImage(buf).perceptualHash;
+}
+function inspectDecodedImage(buf) {
     try {
         const image = decodeImage(buf);
         if (!image)
-            return null;
-        return dHash(image);
+            return Object.freeze({ decodable: false, width: null, height: null, perceptualHash: null });
+        return Object.freeze({
+            decodable: true,
+            width: image.width,
+            height: image.height,
+            perceptualHash: dHash(image),
+        });
     }
     catch {
-        return null;
+        return Object.freeze({ decodable: false, width: null, height: null, perceptualHash: null });
     }
 }
 // The same bounded decoder is also suitable for fixed-size PNG screenshots
 // produced by the optional local capture package. Keep the generic name as an
 // alias so the evidence contract does not imply that a screenshot is a favicon.
 const imagePerceptualHash = faviconPerceptualHash;
-export { faviconPerceptualHash, hammingDistanceHex, imagePerceptualHash };
+export { faviconPerceptualHash, hammingDistanceHex, imagePerceptualHash, inspectDecodedImage };

package/lib/portable-generator.mjs

@@ -0,0 +1,29 @@
+import { WHOISLEUTH_SOURCE_REPOSITORY_URL, } from "./project-metadata.mjs";
+import { normalizeBoundedSemanticVersion } from "./semantic-version.mjs";
+const URI_LABEL_UNSAFE_GLOBAL_RE = /[\u0000-\u001f\u007f-\u009f]|\p{Default_Ignorable_Code_Point}/gu;
+const URI_LABEL_SCHEME_RE = /^[A-Za-z][A-Za-z0-9+.-]*:(?:\/\/|[^\s])/u;
+export function isUriShapedLabel(value) {
+    if (typeof value !== 'string')
+        return false;
+    const candidate = value.replace(URI_LABEL_UNSAFE_GLOBAL_RE, '').trim();
+    return URI_LABEL_SCHEME_RE.test(candidate);
+}
+export function buildPortableGeneratorMetadata(applicationVersion) {
+    let version = null;
+    if (applicationVersion !== null && applicationVersion !== undefined && applicationVersion !== '') {
+        try {
+            version = normalizeBoundedSemanticVersion(applicationVersion, 'Portable report application');
+        }
+        catch {
+            version = null;
+        }
+    }
+    return Object.freeze({
+        name: 'WHOISleuth',
+        version,
+        projectUrl: WHOISLEUTH_SOURCE_REPOSITORY_URL,
+    });
+}
+export function portableGeneratorAttribution(generator) {
+    return `Generated with ${generator.name}${generator.version ? ` ${generator.version}` : ''} · Source: ${generator.projectUrl}`;
+}

package/lib/provider-policy-admission.mjs

@@ -1,4 +1,6 @@
+import { normalizeLegacyIsoTimestamp } from "../packages/evidence/observation.mjs";
 export const PROVIDER_POLICY_MAX_REVIEW_AGE_DAYS = 180;
+export const PROVIDER_POLICY_MAX_FUTURE_SKEW_MS = 5 * 60 * 1000;
 export const DEPLOYMENT_PURPOSES = ['personal', 'internal', 'commercial'];
 function deploymentPurpose(value) {
     const normalized = String(value ?? '').trim().toLowerCase();
@@ -6,13 +8,18 @@ function deploymentPurpose(value) {
         ? normalized
         : null;
 }
+export function providerPolicyReviewAgeDays(reviewedAtValue, now) {
+    const normalizedReviewedAt = normalizeLegacyIsoTimestamp(reviewedAtValue);
+    const reviewedAt = normalizedReviewedAt ? Date.parse(normalizedReviewedAt) : Number.NaN;
+    if (!Number.isFinite(reviewedAt) || !Number.isFinite(now) || reviewedAt > now + PROVIDER_POLICY_MAX_FUTURE_SKEW_MS) {
+        return null;
+    }
+    return Math.max(0, Math.floor((now - reviewedAt) / 86_400_000));
+}
 export function providerPolicyAdmission(terms, env = process.env, now = Date.now()) {
     const source = env && typeof env === 'object' ? env : {};
     const purpose = deploymentPurpose(source.WHOISLEUTH_DEPLOYMENT_PURPOSE);
-    const reviewedAt = Date.parse(terms.reviewedAt);
-    const reviewAgeDays = Number.isFinite(reviewedAt)
-        ? Math.max(0, Math.floor((now - reviewedAt) / 86_400_000))
-        : null;
+    const reviewAgeDays = providerPolicyReviewAgeDays(terms.reviewedAt, now);
     if (!purpose) {
         return {
             allowed: false,

package/lib/rdap-bootstrap.mjs

@@ -1,5 +1,6 @@
 // IANA RDAP bootstrap retrieval, bounded stale caching, and authority
 // selection for domain, IP, and ASN queries.
+import net from 'node:net';
 import { fetchRdapDetailedWithTimeout, } from "./rdap-transport.mjs";
 const BOOTSTRAP_TTL_MS = 60 * 60 * 1000;
 const BOOTSTRAP_STALE_TTL_MS = 7 * 24 * 60 * 60 * 1000;
@@ -8,29 +9,71 @@ const BOOTSTRAP_FETCH_TIMEOUT_MS = 7000;
 const MAX_RDAP_ENDPOINT_LENGTH = 2048;
 const bootstrapCache = new Map();
 const bootstrapInflight = new Map();
+function admitRdapEndpoint(value, options = {}) {
+    if (typeof value !== 'string'
+        || !value
+        || value !== value.trim()
+        || value.length > MAX_RDAP_ENDPOINT_LENGTH
+        || /[\u0000-\u001f\u007f]/u.test(value))
+        return null;
+    try {
+        const parsed = new URL(value);
+        if (!['http:', 'https:'].includes(parsed.protocol)
+            || !parsed.hostname
+            || parsed.username
+            || parsed.password
+            || parsed.port
+            || parsed.hash
+            || (!options.allowQuery && parsed.search))
+            return null;
+        return value;
+    }
+    catch {
+        return null;
+    }
+}
 function ipv4ToLong(ip) {
     return ip.split('.').reduce((accumulator, octet) => (accumulator << 8) + (parseInt(octet, 10) & 0xff), 0) >>> 0;
 }
 function ipInCidrV4(ip, cidr) {
-    const [range, bitsString] = cidr.split('/');
-    if (!range)
+    const parts = cidr.split('/');
+    if (parts.length > 2)
+        return false;
+    const [range, bitsString] = parts;
+    if (!range || net.isIP(ip) !== 4 || net.isIP(range) !== 4)
+        return false;
+    const bits = bitsString === undefined || /^\d{1,2}$/u.test(bitsString)
+        ? Number(bitsString ?? 32)
+        : -1;
+    if (!Number.isSafeInteger(bits) || bits < 0 || bits > 32)
         return false;
-    const bits = bitsString !== undefined ? parseInt(bitsString, 10) : 32;
     const mask = bits === 0 ? 0 : (0xffffffff << (32 - bits)) >>> 0;
     return (ipv4ToLong(ip) & mask) === (ipv4ToLong(range) & mask);
 }
 function expandIpv6(ip) {
-    let head = ip;
+    let normalized = ip;
+    if (normalized.includes('.')) {
+        const lastColon = normalized.lastIndexOf(':');
+        const embedded = normalized.slice(lastColon + 1);
+        if (lastColon < 0 || net.isIP(embedded) !== 4) {
+            throw new TypeError('Invalid IPv4-embedded IPv6 address.');
+        }
+        const value = ipv4ToLong(embedded);
+        normalized = `${normalized.slice(0, lastColon)}:${(value >>> 16).toString(16)}:${(value & 0xffff).toString(16)}`;
+    }
+    if (net.isIP(normalized) !== 6)
+        throw new TypeError('Invalid IPv6 address.');
+    let head = normalized;
     let tail = '';
-    if (ip.includes('::')) {
-        const [headPart = '', tailPart = ''] = ip.split('::');
+    if (normalized.includes('::')) {
+        const [headPart = '', tailPart = ''] = normalized.split('::');
         head = headPart;
         tail = tailPart;
     }
     const headParts = head ? head.split(':').filter(Boolean) : [];
     const tailParts = tail ? tail.split(':').filter(Boolean) : [];
     const missing = 8 - headParts.length - tailParts.length;
-    const parts = ip.includes('::')
+    const parts = normalized.includes('::')
         ? [...headParts, ...Array(Math.max(missing, 0)).fill('0'), ...tailParts]
         : headParts;
     while (parts.length < 8)
@@ -41,13 +84,25 @@ function ipv6ToBigInt(ip) {
     return expandIpv6(ip).reduce((accumulator, part) => (accumulator << 16n) + BigInt(parseInt(part || '0', 16)), 0n);
 }
 function ipInCidrV6(ip, cidr) {
-    const [range, bitsString] = cidr.split('/');
+    const parts = cidr.split('/');
+    if (parts.length > 2)
+        return false;
+    const [range, bitsString] = parts;
     if (!range)
         return false;
-    const bits = bitsString !== undefined ? parseInt(bitsString, 10) : 128;
+    const bits = bitsString === undefined || /^\d{1,3}$/u.test(bitsString)
+        ? Number(bitsString ?? 128)
+        : -1;
+    if (!Number.isSafeInteger(bits) || bits < 0 || bits > 128)
+        return false;
     const full = (1n << 128n) - 1n;
     const mask = bits === 0 ? 0n : (full << BigInt(128 - bits)) & full;
-    return (ipv6ToBigInt(ip) & mask) === (ipv6ToBigInt(range) & mask);
+    try {
+        return (ipv6ToBigInt(ip) & mask) === (ipv6ToBigInt(range) & mask);
+    }
+    catch {
+        return false;
+    }
 }
 function validBootstrap(data) {
     const record = data && typeof data === 'object' && !Array.isArray(data)
@@ -74,7 +129,12 @@ async function fetchBootstrap(kind, options = {}) {
         return inflight;
     const request = (async () => {
         try {
-            const response = await fetchUpstream(`https://data.iana.org/rdap/${kind}.json`, {}, BOOTSTRAP_FETCH_TIMEOUT_MS);
+            const requestedEndpoint = `https://data.iana.org/rdap/${kind}.json`;
+            const response = await fetchUpstream(requestedEndpoint, {}, BOOTSTRAP_FETCH_TIMEOUT_MS);
+            const finalEndpoint = admitRdapEndpoint(response.finalUrl ?? requestedEndpoint);
+            if (finalEndpoint !== requestedEndpoint) {
+                throw new Error(`IANA bootstrap redirected outside its fixed source endpoint for ${kind}`);
+            }
             if (!response.ok) {
                 throw new Error(`IANA bootstrap fetch failed for ${kind} (${response.status})`);
             }
@@ -112,10 +172,10 @@ function clearRdapBootstrapCache() {
 function uniqueRdapBases(urls) {
     const seen = new Set();
     return (Array.isArray(urls) ? urls : [])
-        .filter((url) => typeof url === 'string'
-        && url.length <= MAX_RDAP_ENDPOINT_LENGTH
-        && !/[\u0000-\u001f\u007f]/.test(url)
-        && /^https?:\/\//i.test(url))
+        .flatMap((url) => {
+        const admitted = admitRdapEndpoint(url);
+        return admitted ? [admitted] : [];
+    })
         .sort((left, right) => Number(/^http:\/\//i.test(left)) - Number(/^http:\/\//i.test(right)))
         .filter((url) => {
         const key = url.replace(/\/$/, '').toLowerCase();
@@ -170,4 +230,4 @@ async function findRdapBases(type, value) {
     }
     return [];
 }
-export { BOOTSTRAP_STALE_TTL_MS, BOOTSTRAP_TTL_MS, MAX_RDAP_ENDPOINT_LENGTH, clearRdapBootstrapCache, fetchBootstrap, findRdapBases, ipv4ToLong, ipv6ToBigInt, uniqueRdapBases, };
+export { BOOTSTRAP_STALE_TTL_MS, BOOTSTRAP_TTL_MS, MAX_RDAP_ENDPOINT_LENGTH, admitRdapEndpoint, clearRdapBootstrapCache, fetchBootstrap, findRdapBases, ipv4ToLong, ipv6ToBigInt, uniqueRdapBases, };

package/lib/rdap-client.mjs

@@ -1,8 +1,8 @@
 import { cached } from "./lookup-cache.mjs";
 import { findRdapBases, uniqueRdapBases, } from "./rdap-bootstrap.mjs";
 import { rdapAttempt, rdapFailure } from "./rdap-attempts.mjs";
-import { fetchRdapWithTimeout, } from "./rdap-transport.mjs";
-import { validateRdapResponse } from "./rdap-validation.mjs";
+import { fetchRdapDetailedWithTimeout, } from "./rdap-transport.mjs";
+import { admitRdapObjectEndpoint, validateRdapResponse, } from "./rdap-validation.mjs";
 const UPSTREAM_TIMEOUT_MS = 7_000;
 const UPSTREAM_TOTAL_DEADLINE_MS = 12_000;
 const MAX_RDAP_ENDPOINTS = 3;
@@ -24,7 +24,7 @@ function rdapPathFor(type, value) {
  * Query the bounded bootstrap candidate set while retaining every attempted
  * endpoint as separately attributed transport evidence.
  */
-export async function fetchRdapFromBasesWithParser(type, value, bases, parseRdap, fetchUpstream = fetchRdapWithTimeout) {
+export async function fetchRdapFromBasesWithParser(type, value, bases, parseRdap, fetchUpstream = fetchRdapDetailedWithTimeout) {
     const candidates = uniqueRdapBases(bases).slice(0, MAX_RDAP_ENDPOINTS);
     if (candidates.length === 0)
         return null;
@@ -38,13 +38,21 @@ export async function fetchRdapFromBasesWithParser(type, value, bases, parseRdap
         const url = `${base.replace(/\/$/, '')}/${rdapPathFor(type, value)}`;
         try {
             const upstream = await fetchUpstream(url, { headers: { Accept: 'application/rdap+json' } }, Math.min(UPSTREAM_TIMEOUT_MS, remaining));
+            const selectedEndpoint = admitRdapObjectEndpoint(type, value, upstream.finalUrl ?? url);
+            if (!selectedEndpoint) {
+                attempts.push(rdapAttempt(url, 'invalid_response', {
+                    status: upstream.status,
+                    detail: 'The endpoint returned final URL provenance for an invalid or different RDAP object.',
+                }));
+                continue;
+            }
             if (upstream.status !== 404 && !upstream.ok) {
                 const outcome = upstream.status === 429
                     ? 'rate_limited'
                     : upstream.status >= 500
                         ? 'server_error'
                         : 'client_error';
-                attempts.push(rdapAttempt(url, outcome, {
+                attempts.push(rdapAttempt(selectedEndpoint, outcome, {
                     status: upstream.status,
                     detail: `The endpoint returned HTTP ${upstream.status}.`,
                 }));
@@ -55,21 +63,21 @@ export async function fetchRdapFromBasesWithParser(type, value, bases, parseRdap
                 data = JSON.parse(upstream.text);
             }
             catch {
-                attempts.push(rdapAttempt(url, 'invalid_json', {
+                attempts.push(rdapAttempt(selectedEndpoint, 'invalid_json', {
                     status: upstream.status,
                     detail: 'The endpoint returned invalid JSON.',
                 }));
                 continue;
             }
             if (upstream.status === 404) {
-                attempts.push(rdapAttempt(url, 'not_found', {
+                attempts.push(rdapAttempt(selectedEndpoint, 'not_found', {
                     status: upstream.status,
                     detail: 'The authoritative endpoint reported no matching object.',
                     selected: true,
                 }));
                 return {
-                    rdapServer: url,
-                    transportSecurity: /^https:\/\//i.test(url) ? 'https' : 'http',
+                    rdapServer: selectedEndpoint,
+                    transportSecurity: /^https:\/\//i.test(selectedEndpoint) ? 'https' : 'http',
                     upstreamStatus: upstream.status,
                     fetchedAt: new Date().toISOString(),
                     data,
@@ -80,20 +88,20 @@ export async function fetchRdapFromBasesWithParser(type, value, bases, parseRdap
             const parsed = parseRdap(type, data);
             const validation = validateRdapResponse(type, value, parsed);
             if (!validation.valid) {
-                attempts.push(rdapAttempt(url, 'invalid_response', {
+                attempts.push(rdapAttempt(selectedEndpoint, 'invalid_response', {
                     status: upstream.status,
                     detail: validation.detail,
                 }));
                 continue;
             }
-            attempts.push(rdapAttempt(url, 'success', {
+            attempts.push(rdapAttempt(selectedEndpoint, 'success', {
                 status: upstream.status,
                 detail: 'The endpoint returned the requested RDAP object.',
                 selected: true,
             }));
             return {
-                rdapServer: url,
-                transportSecurity: /^https:\/\//i.test(url) ? 'https' : 'http',
+                rdapServer: selectedEndpoint,
+                transportSecurity: /^https:\/\//i.test(selectedEndpoint) ? 'https' : 'http',
                 upstreamStatus: upstream.status,
                 fetchedAt: new Date().toISOString(),
                 data,