@slicedearth/whoisleuth-cli 1.45.0 → 2.0.0

package/lib/rdap-registrar.mjs

@@ -85,11 +85,14 @@ export function selectRegistrarRdapLink(domain, links, registryEndpoint = null)
     }
     return null;
 }
+function registrarRdapTransport(override, safeDefault = fetchRdapDetailedWithTimeout) {
+    return override ?? safeDefault;
+}
 export async function fetchRegistrarRdapRecordWithParser(domain, registryRecord, parseRdap, options = {}) {
     const canonical = canonicalRdapDomain(domain);
     if (!canonical)
         throw new Error('A valid domain is required for registrar RDAP.');
-    const fetchUpstream = options.fetchUpstream || fetchRdapDetailedWithTimeout;
+    const fetchUpstream = registrarRdapTransport(options.fetchUpstream);
     return cached(`rdap-registrar:domain:${canonical}`, async () => {
         const registryParsed = recordOrNull(registryRecord?.parsed);
         const registryEndpoint = typeof registryRecord?.rdapServer === 'string' ? registryRecord.rdapServer : null;
@@ -194,3 +197,4 @@ export async function fetchRegistrarRdapRecordWithParser(domain, registryRecord,
         };
     });
 }
+export { registrarRdapTransport };

package/lib/rdap-transport.mjs

@@ -8,7 +8,7 @@ async function fetchRdapWithTimeout(url, options, timeoutMs, dependencies = {})
     const timeout = setTimeout(() => controller.abort(), timeoutMs);
     try {
         const response = await (dependencies.fetch ?? safeFetch)(url, { ...options, signal: controller.signal });
-        const { text, truncated } = await (dependencies.readText ?? readTextCapped)(response, MAX_RDAP_BYTES);
+        const { text, truncated } = await (dependencies.readText ?? readTextCapped)(response, MAX_RDAP_BYTES, { fatalUtf8: true });
         if (truncated)
             throw new Error(`Response from ${url} exceeded ${MAX_RDAP_BYTES} bytes`);
         return { status: response.status, ok: response.ok, text };
@@ -22,7 +22,7 @@ async function fetchRdapDetailedWithTimeout(url, options, timeoutMs, dependencie
     const timeout = setTimeout(() => controller.abort(), timeoutMs);
     try {
         const result = await (dependencies.fetchDetailed ?? safeFetchDetailed)(url, { ...options, signal: controller.signal });
-        const { text, truncated } = await (dependencies.readText ?? readTextCapped)(result.response, MAX_RDAP_BYTES);
+        const { text, truncated } = await (dependencies.readText ?? readTextCapped)(result.response, MAX_RDAP_BYTES, { fatalUtf8: true });
         if (truncated)
             throw new Error(`Response from ${url} exceeded ${MAX_RDAP_BYTES} bytes`);
         return {

package/lib/rdap-validation.mjs

@@ -1,24 +1,75 @@
-import net from 'node:net';
+import { isIP } from 'node:net';
 import { domainToASCII } from 'node:url';
-import { ipv4ToLong, ipv6ToBigInt } from "./rdap-bootstrap.mjs";
+import { admitRdapEndpoint, ipv4ToLong, ipv6ToBigInt } from "./rdap-bootstrap.mjs";
 export function canonicalRdapDomain(value) {
     if (typeof value !== 'string')
         return null;
     const ascii = domainToASCII(value.trim().replace(/\.+$/, ''));
     return ascii ? ascii.toLowerCase() : null;
 }
-function ipv6ToComparableBigInt(ip) {
-    let normalized = ip;
-    if (ip.includes('.')) {
-        const lastColon = ip.lastIndexOf(':');
-        const embedded = ip.slice(lastColon + 1);
-        if (net.isIP(embedded) !== 4)
+function decodedTerminalPathParts(value) {
+    try {
+        const parts = new URL(value).pathname.split('/').filter(Boolean);
+        if (parts.length < 2)
             return null;
-        const value = ipv4ToLong(embedded);
-        normalized = `${ip.slice(0, lastColon)}:${(value >>> 16).toString(16)}:${(value & 0xffff).toString(16)}`;
+        const objectType = decodeURIComponent(parts.at(-2) ?? '');
+        const objectValue = decodeURIComponent(parts.at(-1) ?? '');
+        return objectType && objectValue ? [objectType, objectValue] : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Admit final RDAP provenance only when its terminal path still identifies the
+ * requested object. Safe redirect transport proves where bytes came from; this
+ * binding separately prevents a redirected response for another object from
+ * deciding a lookup, especially when a bodyless 404 is otherwise authoritative.
+ */
+export function admitRdapObjectEndpoint(type, requestedValue, value) {
+    const admitted = admitRdapEndpoint(value);
+    if (!admitted)
+        return null;
+    const terminal = decodedTerminalPathParts(admitted);
+    if (!terminal)
+        return null;
+    const [objectType, objectValue] = terminal;
+    if (type === 'domain') {
+        const requested = canonicalRdapDomain(requestedValue);
+        const selected = canonicalRdapDomain(objectValue);
+        return objectType === 'domain' && requested && selected === requested ? admitted : null;
     }
+    if (type === 'ipv4' || type === 'ipv6') {
+        const version = type === 'ipv4' ? 4 : 6;
+        if (objectType !== 'ip' || isIP(requestedValue) !== version || isIP(objectValue) !== version)
+            return null;
+        try {
+            const convert = version === 4 ? ipv4ToLong : ipv6ToBigInt;
+            return convert(requestedValue) === convert(objectValue) ? admitted : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    if (type === 'asn') {
+        const requestedMatch = /^(?:AS)?([0-9]{1,10})$/iu.exec(requestedValue);
+        if (objectType !== 'autnum' || !requestedMatch || !/^[0-9]{1,10}$/u.test(objectValue))
+            return null;
+        const requested = Number(requestedMatch[1]);
+        const selected = Number(objectValue);
+        return Number.isSafeInteger(requested)
+            && requested >= 0
+            && requested <= 4_294_967_295
+            && selected === requested
+            && objectValue === String(selected)
+            ? admitted
+            : null;
+    }
+    return null;
+}
+function ipv6ToComparableBigInt(ip) {
     try {
-        return ipv6ToBigInt(normalized);
+        return ipv6ToBigInt(ip);
     }
     catch {
         return null;
@@ -71,11 +122,11 @@ export function validateRdapResponse(type, requestedValue, parsed) {
     const version = type === 'ipv4' ? 4 : 6;
     const startAddress = parsed.startAddress;
     const endAddress = parsed.endAddress;
-    if (net.isIP(requestedValue) !== version ||
+    if (isIP(requestedValue) !== version ||
         typeof startAddress !== 'string' ||
-        net.isIP(startAddress) !== version ||
+        isIP(startAddress) !== version ||
         typeof endAddress !== 'string' ||
-        net.isIP(endAddress) !== version) {
+        isIP(endAddress) !== version) {
         return { valid: false, detail: 'The response did not contain a compatible IP range.' };
     }
     const convert = version === 4 ? ipv4ToLong : ipv6ToComparableBigInt;

package/lib/rdap.mjs

@@ -3,9 +3,9 @@ import { BOOTSTRAP_STALE_TTL_MS, BOOTSTRAP_TTL_MS, clearRdapBootstrapCache, fetc
 import { fetchRdapFromBasesWithParser, fetchRdapRecordWithParser, } from "./rdap-client.mjs";
 import { normalizeRdapEvents, parseRdap, summarizeLifecycle, } from "./rdap-normalization.mjs";
 import { fetchRegistrarRdapRecordWithParser, selectRegistrarRdapLink, } from "./rdap-registrar.mjs";
-import { fetchRdapWithTimeout, } from "./rdap-transport.mjs";
+import { fetchRdapDetailedWithTimeout, } from "./rdap-transport.mjs";
 import { registryServiceAdmissionFor } from "./registry-capabilities.mjs";
-async function fetchRdapFromBases(type, value, bases, fetchUpstream = fetchRdapWithTimeout) {
+async function fetchRdapFromBases(type, value, bases, fetchUpstream = fetchRdapDetailedWithTimeout) {
     return fetchRdapFromBasesWithParser(type, value, bases, parseRdap, fetchUpstream);
 }
 async function fetchRdapRecord(type, value, options = {}) {

package/lib/registrable-domain.mjs

@@ -0,0 +1,36 @@
+import { getDomain } from 'tldts';
+import { isValidAsciiDomainName } from "./hostname.mjs";
+// Returns one canonical registrable-domain identity for an already public DNS
+// hostname. Callers retain the original hostname separately when subdomain
+// context matters; authority, evidence binding and scoring use this value.
+export function canonicalRegistrableDomain(value) {
+    if (typeof value !== 'string')
+        return null;
+    const trimmed = value.trim();
+    if (!trimmed || /[\u0000-\u001f\u007f]/u.test(trimmed))
+        return null;
+    const withoutScheme = trimmed.replace(/^[a-z]+:\/\//iu, '').split(/[/?#]/u)[0] ?? '';
+    if (withoutScheme.endsWith('..'))
+        return null;
+    const candidate = withoutScheme.replace(/\.$/u, '');
+    if (!candidate)
+        return null;
+    let hostname;
+    try {
+        hostname = new URL(`https://${candidate}/`).hostname.toLowerCase().replace(/\.$/u, '');
+    }
+    catch {
+        return null;
+    }
+    if (!isValidAsciiDomainName(hostname, { requireDot: true, requireLowercase: true }))
+        return null;
+    // Keep this boundary identical to classifyQuery() and the collection
+    // runtime: registrable identity follows the ICANN Public Suffix List, while
+    // privately operated suffixes remain ordinary host context.
+    const domain = getDomain(hostname);
+    return domain
+        && isValidAsciiDomainName(domain, { requireDot: true, requireLowercase: true })
+        && (hostname === domain || hostname.endsWith(`.${domain}`))
+        ? domain
+        : null;
+}

package/lib/registry-capabilities.mjs

@@ -86,6 +86,9 @@ function registryAccessDiagnosticFor(value) {
         coverageState: capability.coverageState,
         whoisAccessProfile: capability.whoisAccessProfile,
         rdapAccessProfile: capability.rdapAccessProfile,
+        ...(capability.officialLookupUrl
+            ? { officialLookupUrl: capability.officialLookupUrl }
+            : {}),
         limitation: capability.limitation,
         authority: 'context_only',
     };

package/lib/registry-capability-catalogue.mjs

@@ -1,7 +1,7 @@
 // Registry compatibility metadata. IANA bootstrap and referral discovery
 // remain authoritative. Explicit query profiles may alter only the first
 // referred registry query after a fixture-backed adapter is integrated.
-const REGISTRY_CAPABILITIES_VERSION = 28;
+const REGISTRY_CAPABILITIES_VERSION = 29;
 const MAX_CAPABILITY_INPUT_LENGTH = 253;
 const REGISTRY_STANDARDS_COVERAGE_SNAPSHOT = Object.freeze({
     schema: 'whoisleuth.registry-standards-coverage',
@@ -165,6 +165,7 @@ const DEFAULT_CAPABILITY = freezeCapability({
     fixtureScenarios: ['registered', 'not_found', 'rate_limited'],
     verificationFiles: ['fixtures/whois-registry-fixtures.mts'],
     documentationUrls: [],
+    officialLookupUrl: null,
     limitation: DISCOVERY_LIMITATION,
 });
 const EXPLICIT_CAPABILITY_SEEDS = [
@@ -260,6 +261,7 @@ const EXPLICIT_CAPABILITY_SEEDS = [
             'https://www.iana.org/domains/root/db/ch.html',
             'https://www.iana.org/domains/root/db/li.html',
         ],
+        officialLookupUrl: 'https://www.nic.ch/whois/',
         limitation: SWITCH_ACCESS_LIMITATION,
     },
     {
@@ -644,9 +646,11 @@ const EXPLICIT_CAPABILITY_SEEDS = [
         coverageState: 'access_documented', whoisAccessProfile: 'source-ip-authorization-required',
         rdapAccessProfile: 'no-iana-service', verificationFiles: [],
         documentationUrls: [
+            'https://www.dominios.es/es',
             'https://www.iana.org/domains/root/db/es.html',
             'https://www.dominios.es/es/sobre-dominios/valores-anadidos/whois-43',
         ],
+        officialLookupUrl: 'https://www.dominios.es/es',
         limitation: ES_ACCESS_LIMITATION,
     },
     {
@@ -665,7 +669,11 @@ const EXPLICIT_CAPABILITY_SEEDS = [
         whoisParserProfile: 'generic-colon', fixtureScenarios: [],
         coverageState: 'access_documented', whoisAccessProfile: 'no-iana-service',
         rdapAccessProfile: 'no-iana-service', verificationFiles: [],
-        documentationUrls: ['https://www.iana.org/domains/root/db/gt.html'],
+        documentationUrls: [
+            'https://www.gt/sitio/',
+            'https://www.iana.org/domains/root/db/gt.html',
+        ],
+        officialLookupUrl: 'https://www.gt/sitio/',
         limitation: 'IANA publishes no RDAP service or domain WHOIS service for this suffix. WHOISleuth does not automate the registry website.',
     },
     {
@@ -1166,6 +1174,7 @@ const EXPLICIT_CAPABILITY_SEEDS = [
             'https://www.iana.org/domains/root/db/vn.html',
             'https://whois.vnnic.vn/',
         ],
+        officialLookupUrl: 'https://whois.vnnic.vn/',
         limitation: VN_ACCESS_LIMITATION,
     },
 ];
@@ -1191,6 +1200,7 @@ const EXPLICIT_CAPABILITIES = EXPLICIT_CAPABILITY_SEEDS.map((entry) => {
         coverageState: entry.coverageState || 'fixture_verified',
         verificationFiles: entry.verificationFiles || ['fixtures/whois-registry-fixtures.mts'],
         documentationUrls: entry.documentationUrls || [],
+        officialLookupUrl: entry.officialLookupUrl || null,
         limitation: entry.limitation || (rdapAccessProfile === 'no-iana-service'
             ? WHOIS_ONLY_FIXTURE_LIMITATION
             : FIXTURE_LIMITATION),

package/lib/registry-comparison.mjs

@@ -107,10 +107,11 @@ function normalizeRdapPublicationStatus(value) {
 function normalizeNameserver(value) {
     return normalizeDomain(value);
 }
-function normalizeSet(values, normalizeItem) {
+function normalizeSet(values, normalizeItem, maximum = 200) {
     if (!Array.isArray(values))
         return [];
-    return [...new Set(values.map(normalizeItem).filter((value) => Boolean(value)))].sort();
+    return [...new Set(values.slice(0, maximum).map(normalizeItem)
+            .filter((value) => Boolean(value)))].sort();
 }
 function sameNormalizedValue(left, right) {
     if (Array.isArray(left) || Array.isArray(right)) {
@@ -138,14 +139,20 @@ function displayValue(value, state, status) {
             return 'Disabled by deployment policy';
         return 'Source unavailable';
     }
-    if (Array.isArray(value))
-        return value.join(', ');
-    return String(value);
+    if (Array.isArray(value)) {
+        return value.slice(0, 200)
+            .filter((item) => typeof item === 'string')
+            .map((item) => item.slice(0, 253))
+            .join(', ');
+    }
+    return typeof value === 'string' || typeof value === 'number' || typeof value === 'boolean'
+        ? String(value).slice(0, 1_024)
+        : 'Not published';
 }
 function findRdapEvent(rdap, action) {
     if (!Array.isArray(rdap.events))
         return null;
-    const event = rdap.events.map(record).find((item) => item.action === action);
+    const event = rdap.events.slice(0, 100).map(record).find((item) => item.action === action);
     return event?.date || null;
 }
 function rdapLifecycleDate(rdap, field, fallbackAction) {
@@ -223,8 +230,8 @@ export function compareRegistrySources(rdapParsed, whoisParsed, options = {}) {
         dateField('Expires', 'expiryDate', 'expiration'),
         dateField('Last updated', 'updatedDate', 'last changed'),
         compareField('DNSSEC', rdap.dnssec, whois.dnssec, normalizeDnssec, sourceHealth),
-        compareField('Statuses', rdap.statuses, whois.statuses, (values) => normalizeSet(values, statusNormalizer), sourceHealth),
-        compareField('Name servers', rdap.nameservers, whois.nameservers, (values) => normalizeSet(values, normalizeNameserver), sourceHealth),
+        compareField('Statuses', rdap.statuses, whois.statuses, (values) => normalizeSet(values, statusNormalizer, 100), sourceHealth),
+        compareField('Name servers', rdap.nameservers, whois.nameservers, (values) => normalizeSet(values, normalizeNameserver, 200), sourceHealth),
     ].filter((field) => field !== null);
     const counts = {
         equivalent: 0, conflict: 0, rdap_only: 0, whois_only: 0,
@@ -265,7 +272,17 @@ export function compareRdapPublications(registryParsed, registrarParsed, options
     const registry = record(registryParsed);
     const registrar = record(registrarParsed);
     const registrarLifecycle = record(registrar.lifecycle);
-    const comparison = compareRegistrySources({ ...registry, handle: null }, {
+    const comparison = compareRegistrySources({
+        domain: registry.domain,
+        registrar: registry.registrar,
+        registrarIanaId: registry.registrarIanaId,
+        lifecycle: registry.lifecycle,
+        events: Array.isArray(registry.events) ? registry.events.slice(0, 100) : [],
+        dnssec: registry.dnssec,
+        statuses: Array.isArray(registry.statuses) ? registry.statuses.slice(0, 100) : [],
+        nameservers: Array.isArray(registry.nameservers) ? registry.nameservers.slice(0, 200) : [],
+        handle: null,
+    }, {
         domainName: registrar.domain,
         registrar: registrarValue(registrar.registrar),
         registrarIanaId: registrar.registrarIanaId,
@@ -276,8 +293,8 @@ export function compareRdapPublications(registryParsed, registrarParsed, options
         updatedDate: registrarLifecycle.updatedDate,
         updatedDateIso: registrarLifecycle.updatedDateIso,
         dnssec: registrar.dnssec,
-        statuses: registrar.statuses,
-        nameservers: registrar.nameservers,
+        statuses: Array.isArray(registrar.statuses) ? registrar.statuses.slice(0, 100) : [],
+        nameservers: Array.isArray(registrar.nameservers) ? registrar.nameservers.slice(0, 200) : [],
     }, {
         rdapStatus: options.registryStatus,
         whoisStatus: options.registrarStatus,

package/lib/registry-insights.mjs

@@ -87,6 +87,13 @@ function disclosure(source, parsedValue, status) {
         };
     }
     const parsed = record(parsedValue);
+    if (parsed.contactsExcluded === true) {
+        return {
+            source,
+            state: 'unavailable',
+            detail: 'Contact fields are deliberately excluded from this portable projection, so publication disclosure remains unavailable.',
+        };
+    }
     const partial = source === 'whois'
         ? parsed.chainStatus === 'partial' || strings(parsed.fieldsTruncated, 20).length > 0
         : parsed.serverTruncated === true

package/lib/response-policy.mjs

@@ -184,9 +184,23 @@ function analyzeHsts(header, signals) {
     const directives = header.value.split(';').map((part) => part.trim()).filter(Boolean);
     if (directives.length > MAX_RESPONSE_POLICY_DIRECTIVES)
         return 'partial';
-    const maxAge = directives
-        .map((part) => part.match(/^max-age\s*=\s*(\d+)$/iu)?.[1] || null)
-        .find((value) => value !== null);
+    const seen = new Set();
+    let maxAge = null;
+    for (const directive of directives) {
+        const match = /^([a-z][a-z0-9-]{0,63})(?:\s*=\s*(.*))?$/iu.exec(directive);
+        if (!match)
+            return 'malformed';
+        const name = match[1]?.toLowerCase() ?? '';
+        if (seen.has(name))
+            return 'malformed';
+        seen.add(name);
+        if (name === 'max-age') {
+            const value = match[2];
+            if (!value || !/^\d+$/u.test(value))
+                return 'malformed';
+            maxAge = value;
+        }
+    }
     if (!maxAge || maxAge.length > 12)
         return 'malformed';
     const seconds = Number(maxAge);
@@ -256,10 +270,15 @@ function analyzeCookies(headers, signals) {
     let missingHttpOnly = 0;
     let missingSameSite = 0;
     let sameSiteNoneWithoutSecure = 0;
+    let attributesTruncated = false;
     for (const value of result.values) {
         const segments = value.split(';');
         if (!segments[0]?.includes('='))
             return { state: 'malformed', count: result.values.length, truncated: result.truncated };
+        if (segments.length - 1 > MAX_RESPONSE_POLICY_TOKENS) {
+            attributesTruncated = true;
+            continue;
+        }
         const attributes = new Map();
         for (const rawAttribute of segments.slice(1, MAX_RESPONSE_POLICY_TOKENS + 1)) {
             const [rawName = '', ...rawValue] = rawAttribute.trim().split('=');
@@ -289,7 +308,11 @@ function analyzeCookies(headers, signals) {
     if (sameSiteNoneWithoutSecure) {
         addSignal(signals, 'cookies_same_site_none_without_secure', sameSiteNoneWithoutSecure);
     }
-    return { state: result.state, count: result.values.length, truncated: result.truncated };
+    return {
+        state: result.state === 'partial' || attributesTruncated ? 'partial' : result.state,
+        count: result.values.length,
+        truncated: result.truncated || attributesTruncated,
+    };
 }
 export function analyzeResponsePolicyHeaders(headers) {
     const signals = [];