@slicedearth/whoisleuth-cli 1.45.0 → 2.0.0

package/lib/threat-intelligence-runtime.mjs

@@ -3,24 +3,14 @@
 // network requests and contains no provider credentials. Adapters added later
 // must declare exact input exposure, reviewed terms, and bounded request and
 // output budgets before producing separately attributed normalized evidence.
-import { createObservation } from "./observation.mjs";
+import { createObservation } from "../packages/evidence/observation.mjs";
+import { THREAT_INTELLIGENCE_CONTRACT_VERSION, THREAT_INTELLIGENCE_CATEGORIES, THREAT_INTELLIGENCE_ENVELOPE_VERSION, THREAT_INTELLIGENCE_RESULT_STATES, THREAT_INTELLIGENCE_SCHEMA, } from "./threat-intelligence-types.mjs";
 import { assertCuratedConnectorDefinition, assertThreatIntelligenceProvider, } from "./threat-intelligence-definition-registry.mjs";
 import { boundedHttpsUrl, boundedString, isRecord, isoTimestamp, strictBoundedString, } from "./bounded-contract-normalizers.mjs";
 import { CURATED_CONNECTOR_ENTITY_TYPES, MAX_THREAT_INTELLIGENCE_URL_LENGTH, normalizeCuratedConnectorTarget, normalizeThreatIntelligenceTarget, } from "./threat-intelligence-targets.mjs";
-const THREAT_INTELLIGENCE_CONTRACT_VERSION = 1;
-const THREAT_INTELLIGENCE_SCHEMA = 'whoisleuth.threat-intelligence-result';
 const CURATED_CONNECTOR_CONTRACT_VERSION = 1;
 const CURATED_CONNECTOR_RESULT_SCHEMA = 'whoisleuth.curated-connector-result';
-const RESULT_STATES = new Set([
-    'success',
-    'partial',
-    'not_found',
-    'unsupported',
-    'skipped',
-    'rate_limited',
-    'unavailable',
-    'error',
-]);
+const RESULT_STATES = new Set(THREAT_INTELLIGENCE_RESULT_STATES);
 const TERMINAL_STATES_WITHOUT_FINDINGS = new Set([
     'not_found',
     'unsupported',
@@ -29,7 +19,7 @@ const TERMINAL_STATES_WITHOUT_FINDINGS = new Set([
     'unavailable',
     'error',
 ]);
-const CATEGORIES = new Set(['phishing', 'malware', 'spam', 'suspicious', 'abuse', 'unknown']);
+const CATEGORIES = new Set(THREAT_INTELLIGENCE_CATEGORIES);
 const SEVERITIES = new Set(['critical', 'high', 'medium', 'low', 'unknown']);
 const CONFIDENCES = new Set(['high', 'medium', 'low', 'unknown']);
 const CONNECTOR_RELATIONSHIP_TYPES = new Set([
@@ -658,4 +648,4 @@ function createCuratedConnectorResult(connector, target, input = {}, observedAt
         }),
     };
 }
-export { THREAT_INTELLIGENCE_CONTRACT_VERSION, THREAT_INTELLIGENCE_SCHEMA, CURATED_CONNECTOR_CONTRACT_VERSION, CURATED_CONNECTOR_RESULT_SCHEMA, MAX_FINDINGS, MAX_INPUT_FINDINGS, MAX_TIMEOUT_MS, MAX_RESPONSE_BYTES, MAX_CACHE_TTL_MS, MAX_CONNECTOR_ENTITIES, MAX_CONNECTOR_RELATIONSHIPS, MAX_CONNECTOR_INPUT_ENTITIES, MAX_CONNECTOR_INPUT_RELATIONSHIPS, normalizeThreatIntelligenceTarget, normalizeCuratedConnectorTarget, createThreatIntelligenceResult, createCuratedConnectorResult, };
+export { THREAT_INTELLIGENCE_CONTRACT_VERSION, THREAT_INTELLIGENCE_ENVELOPE_VERSION, THREAT_INTELLIGENCE_SCHEMA, CURATED_CONNECTOR_CONTRACT_VERSION, CURATED_CONNECTOR_RESULT_SCHEMA, MAX_FINDINGS, MAX_INPUT_FINDINGS, MAX_TIMEOUT_MS, MAX_RESPONSE_BYTES, MAX_CACHE_TTL_MS, MAX_CONNECTOR_ENTITIES, MAX_CONNECTOR_RELATIONSHIPS, MAX_CONNECTOR_INPUT_ENTITIES, MAX_CONNECTOR_INPUT_RELATIONSHIPS, normalizeThreatIntelligenceTarget, normalizeCuratedConnectorTarget, createThreatIntelligenceResult, createCuratedConnectorResult, };

package/lib/threat-intelligence-types.mjs

@@ -1,3 +1,23 @@
 // Provider-neutral types shared by threat-intelligence and curated connector
 // manifests, fixture harnesses, normalizers, and result builders.
-export {};
+export const THREAT_INTELLIGENCE_SCHEMA = 'whoisleuth.threat-intelligence-result';
+export const THREAT_INTELLIGENCE_CONTRACT_VERSION = 1;
+export const THREAT_INTELLIGENCE_ENVELOPE_VERSION = 1;
+export const THREAT_INTELLIGENCE_CATEGORIES = Object.freeze([
+    'phishing',
+    'malware',
+    'spam',
+    'suspicious',
+    'abuse',
+    'unknown',
+]);
+export const THREAT_INTELLIGENCE_RESULT_STATES = Object.freeze([
+    'success',
+    'partial',
+    'not_found',
+    'unsupported',
+    'skipped',
+    'rate_limited',
+    'unavailable',
+    'error',
+]);

package/lib/threatfox-intelligence.mjs

@@ -6,6 +6,7 @@ import { safeFetchDetailed, readTextCapped } from "./safe-fetch.mjs";
 import { whoisleuthRequestHeaders } from "./outbound-identity.mjs";
 import { providerPolicyAdmission } from "./provider-policy-admission.mjs";
 import { createThreatIntelligenceResult, defineThreatIntelligenceProvider, normalizeThreatIntelligenceTarget, } from "./threat-intelligence-contract.mjs";
+import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
 const THREATFOX_SEARCH_ENDPOINT = 'https://threatfox-api.abuse.ch/api/v1/';
 const THREATFOX_MAX_RESULTS = 20;
 const THREATFOX_MAX_INPUT_RESULTS = 100;
@@ -75,8 +76,7 @@ function isoTimestamp(value) {
     const normalized = /^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}(?: UTC)?$/u.test(raw)
         ? `${raw.slice(0, 10)}T${raw.slice(11, 19)}Z`
         : raw;
-    const timestamp = Date.parse(normalized);
-    return Number.isFinite(timestamp) ? new Date(timestamp).toISOString() : null;
+    return normalizeExplicitIsoTimestamp(normalized);
 }
 function normalizedTags(value) {
     if (!Array.isArray(value))
@@ -112,7 +112,11 @@ function normalizeIocFinding(value, targetDomain) {
     if (!id || !/^\d{1,32}$/u.test(id) || ioc !== targetDomain || iocType !== 'domain' || !threatType)
         return null;
     const firstObservedAt = isoTimestamp(value.first_seen);
-    const lastObservedAt = isoTimestamp(value.last_seen) || firstObservedAt;
+    const parsedLastObservedAt = isoTimestamp(value.last_seen);
+    if ((value.first_seen !== undefined && value.first_seen !== null && !firstObservedAt)
+        || (value.last_seen !== undefined && value.last_seen !== null && !parsedLastObservedAt))
+        return null;
+    const lastObservedAt = parsedLastObservedAt || firstObservedAt;
     const tags = normalizedTags(value.tags);
     tags.push(`role:${threatType}`);
     if (malware)

package/lib/tls-intelligence.mjs

@@ -1,4 +1,4 @@
-// Bounded, one-connection TLS and certificate intelligence for deep scans.
+// Bounded, one-connection TLS and certificate evidence for deep scans.
 //
 // The collector resolves the submitted hostname once through the same public-
 // address guard used by safe-fetch, validates every returned address again at
@@ -10,19 +10,20 @@ import * as crypto from 'node:crypto';
 import * as net from 'node:net';
 import * as tls from 'node:tls';
 import { domainToASCII } from 'node:url';
-import { createObservation } from "./observation.mjs";
+import { createObservation } from "../packages/evidence/observation.mjs";
+import { MAX_LOOKUP_TLS_ALT_NAMES, MAX_LOOKUP_TLS_CHAIN_CERTIFICATES, MAX_LOOKUP_TLS_FINDINGS, MAX_LOOKUP_TLS_NAME_VALUES, } from "./lookup-network-evidence-bounds.mjs";
 import { isPrivateAddress, resolvePublicAddresses } from "./safe-fetch.mjs";
 import { parseCertificateExtensionProfile, } from "./certificate-extension-profile.mjs";
 const TLS_PROFILE_VERSION = 3;
 const TLS_PORT = 443;
 const TLS_TIMEOUT_MS = 5000;
 const MAX_RESOLVED_ADDRESSES = 64;
-const MAX_CHAIN_CERTIFICATES = 8;
-const MAX_ALT_NAMES = 50;
+const MAX_CHAIN_CERTIFICATES = MAX_LOOKUP_TLS_CHAIN_CERTIFICATES;
+const MAX_ALT_NAMES = MAX_LOOKUP_TLS_ALT_NAMES;
 const MAX_SAN_ENTRIES = 100;
 const MAX_EXTENDED_KEY_USAGES = 16;
 const MAX_AIA_LOCATIONS = 32;
-const MAX_NAME_VALUES = 4;
+const MAX_NAME_VALUES = MAX_LOOKUP_TLS_NAME_VALUES;
 const MAX_TEXT_LENGTH = 256;
 const MAX_ERROR_LENGTH = 240;
 const MAX_SERIAL_LENGTH = 128;
@@ -577,7 +578,7 @@ function tlsFindings(profile) {
         findings.push({ id: 'hostname_mismatch', tone: 'warning', label: 'Hostname mismatch', detail: 'The observed leaf certificate did not match the SNI hostname.' });
     if (profile.certificate?.subjectAltNames?.dnsNames.some((name) => name.startsWith('*.')))
         findings.push({ id: 'wildcard_certificate', tone: 'neutral', label: 'Wildcard certificate', detail: 'The leaf certificate includes at least one wildcard DNS name. Wildcard use is common and is not inherently suspicious.' });
-    return findings;
+    return findings.slice(0, MAX_LOOKUP_TLS_FINDINGS);
 }
 function buildTlsObservation(handshake = {}, options = {}) {
     const state = tracker();
@@ -590,7 +591,9 @@ function buildTlsObservation(handshake = {}, options = {}) {
     const authorized = typeof handshake.authorized === 'boolean' ? handshake.authorized : null;
     const hostnameMatches = typeof handshake.hostnameMatches === 'boolean' ? handshake.hostnameMatches : null;
     const authorizationError = authorized === false
-        ? boundedString(handshake.authorizationError, MAX_ERROR_LENGTH, state)
+        ? boundedString(handshake.authorizationError instanceof Error
+            ? handshake.authorizationError.message
+            : handshake.authorizationError, MAX_ERROR_LENGTH, state)
         : null;
     const hostnameError = hostnameMatches === false
         ? boundedString(handshake.hostnameError, MAX_ERROR_LENGTH, state)
@@ -668,7 +671,7 @@ function failedTlsObservation(error, options = {}) {
             source: 'tls',
             durationMs: options.durationMs,
             complete: false,
-            limitations: ['TLS intelligence was inconclusive; DNS, connection, timeout, policy, or handshake failure is not proof that no TLS service exists.'],
+            limitations: ['TLS evidence collection was inconclusive; DNS, connection, timeout, policy, or handshake failure is not proof that no TLS service exists.'],
             diagnostics: { connectionAttempts: options.connectionAttempts || 0, error: detail },
         }),
         profileVersion: TLS_PROFILE_VERSION,
@@ -689,7 +692,7 @@ function failedTlsObservation(error, options = {}) {
         findings: [],
     };
 }
-function skippedTlsObservation(detail = 'TLS intelligence is disabled by deployment policy.') {
+function skippedTlsObservation(detail = 'TLS evidence collection is disabled by deployment policy.') {
     return {
         ...failedTlsObservation(detail, { connectionAttempts: 0 }),
         ...createObservation({
@@ -780,6 +783,9 @@ async function collectTlsIntelligence(hostname, options = {}) {
                 port: TLS_PORT,
                 servername: normalizedHostname,
                 rejectUnauthorized: false,
+                // Keep runtime CA-path authorization independent from the separately
+                // recorded endpoint-identity comparison below.
+                checkServerIdentity: () => undefined,
                 ALPNProtocols: ['h2', 'http/1.1'],
             }, () => {
                 try {

package/lib/tlsa-evidence.mjs

@@ -128,7 +128,15 @@ function analyzeTlsaEvidence(input) {
     const normalized = raw.slice(0, MAX_TLSA_RECORDS).map(normalizeTlsaRecord);
     const rejectedCount = normalized.filter((item) => item === null).length + Math.max(0, raw.length - MAX_TLSA_RECORDS);
     const records = normalized.filter((item) => item !== null);
+    const smtpRelayService = service.port === 25 && service.transport === 'tcp';
     const results = records.map((item) => {
+        if (smtpRelayService && (item.usage === 0 || item.usage === 1)) {
+            return Object.freeze({
+                ...item,
+                state: 'unsupported',
+                reason: 'PKIX-TA and PKIX-EE certificate usages are not treated as usable TLSA records for SMTP relay on port 25.',
+            });
+        }
         const materials = item.usage === 0 || item.usage === 2
             ? authorityMaterials
             : leafMaterial ? [leafMaterial] : [];
@@ -147,6 +155,7 @@ function analyzeTlsaEvidence(input) {
     const hasMatch = results.some((item) => item.state === 'matched');
     const hasDifferent = results.some((item) => item.state === 'different');
     const hasUnavailable = results.some((item) => item.state === 'unavailable');
+    const hasUnsupported = results.some((item) => item.state === 'unsupported');
     const limitations = [
         'This offline comparison does not connect to the target, retrieve DNS, negotiate SMTP STARTTLS, or validate a DNSSEC chain.',
         'A TLSA match is usable as DANE evidence only when the DNSSEC state was independently validated for the same observation.',
@@ -155,24 +164,45 @@ function analyzeTlsaEvidence(input) {
     if (dnssecState !== 'validated' && hasMatch) {
         limitations.push('Certificate material matched, but DNSSEC was not validated, so the result remains partial.');
     }
-    const matchedPkixDependent = results.some((item) => item.state === 'matched' && (item.usage === 0 || item.usage === 1));
-    const matchedDaneOnly = results.some((item) => item.state === 'matched' && (item.usage === 2 || item.usage === 3));
+    if (smtpRelayService && hasUnsupported) {
+        limitations.push('RFC 7672 leaves SMTP relay treatment of PKIX-TA usage 0 and PKIX-EE usage 1 undefined; this review treats those records as unusable and they cannot complete SMTP DANE assurance.');
+    }
+    const matchedPkixTa = results.some((item) => item.state === 'matched' && item.usage === 0);
+    const matchedPkixEe = results.some((item) => item.state === 'matched' && item.usage === 1);
+    const matchedPkixDependent = matchedPkixTa || matchedPkixEe;
+    const matchedDaneEe = results.some((item) => item.state === 'matched' && item.usage === 3);
+    const hasPkixTaAssociation = results.some((item) => item.usage === 0);
+    const hasDaneTaAssociation = results.some((item) => item.usage === 2);
     if (matchedPkixDependent && pkixValidationState !== 'validated') {
         limitations.push('A PKIX-dependent association matched, but a validated PKIX path was not supplied, so the result is not complete.');
     }
     if (authorityMaterialRejectedCount > 0 || authorityMaterialTruncated) {
         limitations.push('Authority certificate material was malformed or exceeded the review bound, so an unmatched trust-anchor association remains partial.');
     }
+    if (hasPkixTaAssociation) {
+        limitations.push('PKIX-TA usage 0 association bytes were compared, but the supplied authority material was not proven to be part of the independently validated leaf path, so the usage-0 association cannot complete PKIX-TA assurance.');
+    }
+    if (hasDaneTaAssociation) {
+        limitations.push('DANE-TA usage 2 association bytes were compared, but no certificate path from the observed leaf to the supplied trust-anchor material was constructed or validated, so the usage-2 association cannot complete DANE-TA assurance.');
+    }
+    if (hasUnavailable || rejectedCount > 0 || truncated) {
+        limitations.push('Some TLSA associations or required certificate material were unavailable, malformed, or beyond the review bound, so the comparison remains incomplete.');
+    }
+    const comparisonMaterialComplete = !hasUnavailable
+        && rejectedCount === 0
+        && !truncated
+        && authorityMaterialRejectedCount === 0
+        && !authorityMaterialTruncated;
     const trustedMatch = dnssecState === 'validated'
-        && (matchedDaneOnly || matchedPkixDependent && pkixValidationState === 'validated');
+        && (matchedDaneEe || matchedPkixEe && pkixValidationState === 'validated');
     const state = results.length === 0
         ? 'unavailable'
-        : hasDifferent && !hasMatch && rejectedCount === 0 && !truncated
-            && authorityMaterialRejectedCount === 0 && !authorityMaterialTruncated
+        : dnssecState === 'validated' && hasDifferent && !hasMatch && comparisonMaterialComplete
+            && !hasPkixTaAssociation && !hasDaneTaAssociation
             ? 'different'
-            : hasMatch && (dnssecState === 'bogus' || matchedPkixDependent && pkixValidationState === 'failed' && !matchedDaneOnly)
+            : hasMatch && (dnssecState === 'bogus' || matchedPkixDependent && pkixValidationState === 'failed' && !matchedDaneEe)
                 ? 'untrusted'
-                : trustedMatch && !hasUnavailable && rejectedCount === 0 && !truncated
+                : trustedMatch && comparisonMaterialComplete
                     ? 'matched'
                     : 'partial';
     return Object.freeze({

package/lib/urlhaus-intelligence.mjs

@@ -9,6 +9,7 @@ import { safeFetchDetailed, readTextCapped } from "./safe-fetch.mjs";
 import { whoisleuthRequestHeaders } from "./outbound-identity.mjs";
 import { providerPolicyAdmission } from "./provider-policy-admission.mjs";
 import { createThreatIntelligenceResult, defineThreatIntelligenceProvider, normalizeThreatIntelligenceTarget, } from "./threat-intelligence-contract.mjs";
+import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
 const URLHAUS_HOST_ENDPOINT = 'https://urlhaus-api.abuse.ch/v1/host/';
 const URLHAUS_MAX_RESULTS = 20;
 const URLHAUS_MAX_INPUT_RESULTS = 100;
@@ -82,8 +83,7 @@ function isoTimestamp(value) {
     const normalized = /^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}(?: UTC)?$/u.test(trimmed)
         ? `${trimmed.slice(0, 10)}T${trimmed.slice(11, 19)}Z`
         : trimmed;
-    const timestamp = Date.parse(normalized);
-    return Number.isFinite(timestamp) ? new Date(timestamp).toISOString() : null;
+    return normalizeExplicitIsoTimestamp(normalized);
 }
 function retryAfterSeconds(response) {
     const value = response.headers.get('retry-after');
@@ -151,6 +151,8 @@ function normalizeHostFinding(value, targetDomain) {
         || exactDomainFromUrl(value.url) !== targetDomain)
         return null;
     const observedAt = isoTimestamp(value.date_added);
+    if (value.date_added !== undefined && value.date_added !== null && !observedAt)
+        return null;
     const tags = normalizedTags(value.tags);
     tags.push(`url-status:${status}`);
     return {

package/lib/urlscan-intelligence.mjs

@@ -7,6 +7,7 @@ import { safeFetchDetailed, readTextCapped } from "./safe-fetch.mjs";
 import { whoisleuthRequestHeaders } from "./outbound-identity.mjs";
 import { providerPolicyAdmission } from "./provider-policy-admission.mjs";
 import { createThreatIntelligenceResult, defineThreatIntelligenceProvider, normalizeThreatIntelligenceTarget, } from "./threat-intelligence-contract.mjs";
+import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
 const URLSCAN_SEARCH_ENDPOINT = 'https://urlscan.io/api/v1/search/';
 const URLSCAN_SEARCH_DAYS = 90;
 const URLSCAN_MAX_RESULTS = 20;
@@ -80,10 +81,7 @@ function boundedText(value, maxLength) {
     return normalized ? normalized.slice(0, maxLength) : null;
 }
 function isoTimestamp(value) {
-    if (typeof value !== 'string' || value.length > 64 || /[\u0000-\u001f\u007f]/u.test(value))
-        return null;
-    const timestamp = Date.parse(value);
-    return Number.isFinite(timestamp) ? new Date(timestamp).toISOString() : null;
+    return normalizeExplicitIsoTimestamp(value);
 }
 function retryAfterSeconds(response) {
     for (const name of ['retry-after', 'x-rate-limit-reset-after']) {
@@ -148,7 +146,10 @@ function normalizeSearchFinding(value, targetDomain) {
     if (verdicts.malicious !== true)
         return undefined;
     const categories = normalizedCategories(verdicts.categories);
-    const observedAt = isoTimestamp(task.time) || isoTimestamp(value.date);
+    const rawObservedAt = task.time ?? value.date;
+    const observedAt = isoTimestamp(rawObservedAt);
+    if (rawObservedAt !== undefined && rawObservedAt !== null && !observedAt)
+        return null;
     const title = boundedText(page.title, 180);
     return {
         id,

package/lib/website-security-posture.mjs

@@ -2,7 +2,7 @@
 // HTTP, static page, TLS, and DNS evidence already collected by a deep Lookup.
 // Findings use fixed explanatory text and bounded counts; upstream header
 // values, certificate errors, URLs, and DNS record contents are not copied.
-import { createObservation } from "./observation.mjs";
+import { createObservation } from "../packages/evidence/observation.mjs";
 const WEBSITE_SECURITY_POSTURE_VERSION = 2;
 const MAX_SECURITY_POSTURE_FINDINGS = 32;
 const MAX_RETAINED_ORIGINS = 30;

package/lib/website-technology.mjs

@@ -5,7 +5,7 @@
 // markup, header values, URL paths, and arbitrary upstream strings are never
 // retained.
 import { analyzeBrowserLibraries } from "./browser-library-profile.mjs";
-import { createObservation } from "./observation.mjs";
+import { createObservation } from "../packages/evidence/observation.mjs";
 import { MAX_STATIC_HTML_CHARS, MAX_TAG_LENGTH, MAX_TECHNOLOGY_TAGS, analyzeStaticHtml, } from "./static-html-analysis.mjs";
 const TECHNOLOGY_PROFILE_VERSION = 10;
 const MAX_TECHNOLOGY_HTML_CHARS = MAX_STATIC_HTML_CHARS;

package/lib/whois-authority.mjs

@@ -1,10 +1,21 @@
-// Authority-aware interpretation of WHOIS referral chains. The first
-// definitive non-root response decides existence; later registrar output is
-// diagnostic and cannot override the registry.
+// Authority-aware interpretation of WHOIS referral chains. Only the first
+// registry response referred by IANA can decide existence; later registrar
+// output is diagnostic and cannot replace an inconclusive registry result.
 import { normalizeWhoisChain } from "./whois-normalization.mjs";
 import { parseIndentedWhoisValue, whoisFieldLimit, } from "./whois-values.mjs";
-const NOT_FOUND_RE = /no match for|no match\b|not found|no entries found|domain not found|no object found|not registered|status\s*:\s*(?:available|free)\b|registered\s*:\s*(?:no|false)\b|is available for registration/i;
 const LINE_NOT_FOUND_PATTERNS = Object.freeze([
+    /^[ \t]*(?:%{1,2}[ \t]*)?(?:error(?::\d+)?[ \t:.-]*)?no match(?:[ \t]+for(?:[ \t]+domain)?(?:[ \t]+["']?[a-z0-9.-]{1,253}["']?)?)?[.!]?[ \t]*$/im,
+    /^[ \t]*(?:%{1,2}[ \t]*)?(?:error(?::\d+)?[ \t:.-]*)?no entries found(?:[ \t]+(?:for(?:[ \t]+(?:the[ \t]+)?(?:selected source\(s\)|this query|query[ \t]+["']?[a-z0-9.-]{1,253}["']?))|in[ \t]+the[ \t]+\.[a-z0-9-]{1,63}[ \t]+database))?[.!]?[ \t]*$/im,
+    /^[ \t]*[a-z0-9.-]{1,253}[ \t]*:[ \t]*no entries found\.?[ \t]*$/im,
+    /^[ \t]*(?:%{1,2}[ \t]*)?(?:domain[ \t]+)?not found(?::[ \t]*[a-z0-9.-]{1,253})?[.!]?[ \t]*$/im,
+    /^[ \t]*(?:the[ \t]+)?domain[ \t]+["']?[a-z0-9.-]{1,253}["']?[ \t]+(?:was[ \t]+)?not found\.?[ \t]*$/im,
+    /^[ \t]*(?:domain[ \t]+status|the queried object does not exist)[ \t]*:[ \t]*(?:domain[ \t]+not found|no object found)[.!]?[ \t]*$/im,
+    /^[ \t]*no object found!?[ \t]*$/im,
+    /^[ \t]*(?:%{1,2}[ \t]*)?(?:error(?::\d+)?[ \t:.-]*)?(?:the[ \t]+)?domain(?:[ \t]+is|[ \t]+has)?[ \t]+not[ \t]+(?:been[ \t]+)?registered\.?[ \t]*$/im,
+    /^[ \t]*(?:domain[ \t]+)?status[ \t]*:[ \t]*(?:available|free)[ \t]*$/im,
+    /^[ \t]*registration[ \t]+status[ \t]*:[ \t]*available[ \t]*$/im,
+    /^[ \t]*registered[ \t]*:[ \t]*(?:no|false)[ \t]*$/im,
+    /^[ \t]*[a-z0-9.-]{1,253}[ \t]+is[ \t]+(?:available[ \t]+for[ \t]+(?:purchase|registration)|free)[.!]?[ \t]*$/im,
     /^[ \t]*%[ \t]*nothing found[ \t]*$/im,
     /^[ \t]*[a-z0-9](?:[a-z0-9.-]{0,252})[ \t]+is free[ \t]*$/im,
     /^[ \t]*el dominio no se encuentra registrado en nic argentina[ \t]*$/im,
@@ -48,8 +59,7 @@ function classifyHopEvidence(hop, index) {
         return 'rate_limited';
     if (NZ_NOT_FOUND_RE.test(text))
         return 'negative';
-    if (NOT_FOUND_RE.test(text)
-        || LINE_NOT_FOUND_PATTERNS.some((pattern) => pattern.test(text))) {
+    if (LINE_NOT_FOUND_PATTERNS.some((pattern) => pattern.test(text))) {
         return 'negative';
     }
     if (index > 0
@@ -62,6 +72,26 @@ function classifyHopEvidence(hop, index) {
     }
     return 'inconclusive';
 }
+function normalizedWhoisServer(value) {
+    if (typeof value !== 'string')
+        return null;
+    const normalized = value.trim().toLowerCase().replace(/\.+$/u, '');
+    return /^[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?$/u.test(normalized) ? normalized : null;
+}
+function ianaRegistryReferral(hop) {
+    if (!hop || normalizedWhoisServer(hop.server) !== 'whois.iana.org' || typeof hop.response !== 'string')
+        return null;
+    for (const pattern of [
+        /^[ \t]*refer:[ \t]*([a-zA-Z0-9.\-]+)/mi,
+        /^[ \t]*ReferralServer:[ \t]*whois:\/\/([a-zA-Z0-9.\-]+)/mi,
+        /^[ \t]*whois:[ \t]*([a-zA-Z0-9.\-]+)/mi,
+    ]) {
+        const referral = normalizedWhoisServer(hop.response.match(pattern)?.[1]);
+        if (referral)
+            return referral;
+    }
+    return null;
+}
 export function analyzeWhoisChainAuthority(chain) {
     const source = normalizeWhoisChain(chain);
     const evidence = source.map((hop, index) => ({
@@ -70,8 +100,13 @@ export function analyzeWhoisChainAuthority(chain) {
         kind: classifyHopEvidence(hop, index),
     }));
     const failed = evidence.filter((item) => item.kind === 'error' || item.kind === 'rate_limited');
-    const authoritative = evidence.find((item) => item.index > 0
-        && (item.kind === 'positive' || item.kind === 'negative'));
+    const registryReferral = ianaRegistryReferral(source[0]);
+    const registryServer = normalizedWhoisServer(source[1]?.server);
+    const registryEvidence = registryReferral && registryServer === registryReferral ? evidence[1] : null;
+    const authoritative = registryEvidence
+        && (registryEvidence.kind === 'positive' || registryEvidence.kind === 'negative')
+        ? registryEvidence
+        : null;
     const conflict = authoritative
         ? evidence.find((item) => item.index > authoritative.index
             && (item.kind === 'positive' || item.kind === 'negative')

package/lib/whois-chain.mjs

@@ -8,6 +8,17 @@ import { whoisQuery } from "./whois-transport.mjs";
 const IANA_WHOIS = 'whois.iana.org';
 const WHOIS_HOP_DEADLINE_MS = 12_000;
 const WHOIS_CHAIN_DEADLINE_MS = 25_000;
+const MAX_WHOIS_QUERY_HOPS = 6;
+function incompleteReferralHop(server, reason) {
+    return {
+        server,
+        queryProfile: 'not-issued',
+        responseEncoding: 'utf-8',
+        error: reason === 'hop_limit'
+            ? 'WHOIS referral chain reached the bounded hop limit; this referral was not queried.'
+            : 'WHOIS referral chain repeated a previously queried server; this referral was not queried.',
+    };
+}
 const WHOIS_QUERY_FORMATTERS = {
     'plain-domain': (domain) => domain,
     'denic-domain-ace': (domain) => `-T dn,ace ${domain}`,
@@ -65,9 +76,11 @@ export async function buildWhoisChainUncached(query, options = {}) {
     const visited = new Set();
     let currentServer = IANA_WHOIS;
     const startedAt = now();
-    for (let hop = 0; hop < 6; hop += 1) {
-        if (visited.has(currentServer.toLowerCase()))
+    for (let hop = 0; hop < MAX_WHOIS_QUERY_HOPS; hop += 1) {
+        if (visited.has(currentServer.toLowerCase())) {
+            chain.push(incompleteReferralHop(currentServer, 'referral_loop'));
             break;
+        }
         visited.add(currentServer.toLowerCase());
         const transport = whoisTransportForHop(query, hop);
         const remainingMs = chainDeadlineMs - (now() - startedAt);
@@ -112,8 +125,17 @@ export async function buildWhoisChainUncached(query, options = {}) {
             response: responseText,
         });
         const referral = extractReferral(responseText);
-        if (!referral || referral.toLowerCase() === currentServer.toLowerCase())
+        if (!referral)
             break;
+        const referralKey = referral.toLowerCase();
+        if (visited.has(referralKey)) {
+            chain.push(incompleteReferralHop(referral, 'referral_loop'));
+            break;
+        }
+        if (hop + 1 >= MAX_WHOIS_QUERY_HOPS) {
+            chain.push(incompleteReferralHop(referral, 'hop_limit'));
+            break;
+        }
         currentServer = referral;
     }
     return chain;

package/lib/whois-normalization.mjs

@@ -2,7 +2,9 @@
 // Keeping this separate lets authority analysis and field parsing share the
 // exact same defensive input boundary.
 import { MAX_WHOIS_BYTES } from "./whois-transport.mjs";
-const MAX_WHOIS_HOPS = 6;
+// Collection performs at most six network queries and may retain one seventh,
+// non-issued hop explaining a loop or hop-limit termination.
+const MAX_WHOIS_HOPS = 7;
 export function normalizeWhoisChain(value) {
     if (!Array.isArray(value))
         return [];

package/lib/whois-transport.mjs

@@ -47,9 +47,18 @@ function queryWhoisAddress(address, server, query, { port = 43, timeoutMs = 1000
             }
             chunks.push(buffer);
         });
-        const responseText = () => Buffer.concat(chunks, totalBytes).toString('utf8');
-        socket.on('end', () => settle(resolve, responseText()));
-        socket.on('close', () => settle(resolve, responseText()));
+        const settleResponse = () => {
+            try {
+                const responseText = new TextDecoder('utf-8', { fatal: true })
+                    .decode(Buffer.concat(chunks, totalBytes));
+                settle(resolve, responseText);
+            }
+            catch {
+                settle(reject, new Error(`WHOIS response from ${server} was not valid UTF-8`));
+            }
+        };
+        socket.on('end', settleResponse);
+        socket.on('close', settleResponse);
         socket.on('timeout', () => {
             socket.destroy();
             settle(reject, new Error(`WHOIS request to ${server} timed out`));

package/lib/zone-intent-review.mjs

@@ -175,7 +175,7 @@ export function normaliseRdata(type, rawValue, origin, nameMode = 'absolute') {
         };
     }
     if (type === 'CDNSKEY') {
-        if (tokens.length !== 4 || !/^[a-z0-9+/=]{1,4096}$/iu.test(tokens[3] ?? ''))
+        if (tokens.length !== 4 || !/^[A-Za-z0-9+/=]{1,4096}$/u.test(tokens[3] ?? ''))
             throw new TypeError('CDNSKEY data is invalid.');
         return {
             value: `${integerToken(tokens[0], 0, 65_535, 'CDNSKEY flags')} ${integerToken(tokens[1], 0, 255, 'CDNSKEY protocol')} ${integerToken(tokens[2], 0, 255, 'CDNSKEY algorithm')} ${tokens[3]}`,

package/package.json

@@ -33,20 +33,28 @@
   "bugs": {
     "url": "https://github.com/slicedearth/whoisleuth/issues"
   },
-  "version": "1.45.0",
+  "version": "2.0.0",
   "dependencies": {
     "@peculiar/x509": "2.0.0",
     "maxmind": "5.0.7",
     "parse5": "8.0.1",
     "reflect-metadata": "0.2.2",
-    "tldts": "7.4.10",
-    "undici": "8.9.0"
+    "tldts": "7.4.11",
+    "undici": "8.10.0"
   },
   "files": [
     "bin/**/*.mjs",
     "cli/**/*.mjs",
     "lib/**/*.mjs",
-    "frontend/src/lib/analysis/**/*.js",
+    "frontend/src/lib/**/*.js",
+    "packages/cases/**/*.mjs",
+    "packages/comparison/**/*.mjs",
+    "packages/contracts/**/*.mjs",
+    "packages/evidence/**/*.mjs",
+    "packages/interchange/**/*.mjs",
+    "packages/investigation/**/*.mjs",
+    "packages/monitoring/**/*.mjs",
+    "packages/workspace/**/*.mjs",
     "docs/cli.md",
     "docs/cli-reference.md",
     "DISCLOSURE",

package/packages/cases/case-brand-profile-references.mjs

@@ -0,0 +1,85 @@
+import { MAX_CASE_BRAND_PROFILE_ID_CANDIDATES, MAX_CASE_BRAND_PROFILE_IDS, } from "./case-record-contracts.mjs";
+import { normalizeOpaqueReferenceId } from "./opaque-reference-id.mjs";
+/**
+ * Reads an untrusted stored or imported reference list without repairing any
+ * identifier. At most 32 candidates are inspected and at most eight unique,
+ * exact identifiers are retained.
+ */
+export function inspectCaseBrandProfileIds(value) {
+    if (!Array.isArray(value))
+        return { ids: [], omitted: 0 };
+    const ids = [];
+    const seen = new Set();
+    let omitted = Math.max(0, value.length - MAX_CASE_BRAND_PROFILE_ID_CANDIDATES);
+    for (const candidate of value.slice(0, MAX_CASE_BRAND_PROFILE_ID_CANDIDATES)) {
+        const id = normalizeOpaqueReferenceId(candidate);
+        if (!id || seen.has(id))
+            continue;
+        seen.add(id);
+        if (ids.length < MAX_CASE_BRAND_PROFILE_IDS)
+            ids.push(id);
+        else
+            omitted += 1;
+    }
+    return { ids, omitted };
+}
+/** Current-store recovery is bounded and lenient, but never repairs ids. */
+export function normalizeCaseBrandProfileIds(value) {
+    return inspectCaseBrandProfileIds(value).ids;
+}
+/** Explicit analyst edits replace the complete set and fail closed. */
+export function assertCaseBrandProfileIds(value) {
+    if (!Array.isArray(value)) {
+        throw new Error('Brand Profile associations must be an array of opaque identifiers.');
+    }
+    if (value.length > MAX_CASE_BRAND_PROFILE_IDS) {
+        throw new Error(`Each case is limited to ${MAX_CASE_BRAND_PROFILE_IDS} Brand Profile associations.`);
+    }
+    const ids = [];
+    const seen = new Set();
+    for (const candidate of value) {
+        const id = normalizeOpaqueReferenceId(candidate);
+        if (!id)
+            throw new Error('A Brand Profile association identifier is invalid.');
+        if (seen.has(id))
+            throw new Error('Brand Profile association identifiers must be unique.');
+        seen.add(id);
+        ids.push(id);
+    }
+    return ids;
+}
+/** Add one exact association without accepting a stale whole-list snapshot. */
+export function addCaseBrandProfileId(value, profileId) {
+    const ids = assertCaseBrandProfileIds(value);
+    const [id] = assertCaseBrandProfileIds([profileId]);
+    if (!id || ids.includes(id))
+        return [...ids];
+    if (ids.length >= MAX_CASE_BRAND_PROFILE_IDS) {
+        throw new Error(`Each case is limited to ${MAX_CASE_BRAND_PROFILE_IDS} Brand Profile associations.`);
+    }
+    return [...ids, id];
+}
+/** Remove one exact association while preserving every unrelated reference. */
+export function removeCaseBrandProfileId(value, profileId) {
+    const ids = assertCaseBrandProfileIds(value);
+    const [id] = assertCaseBrandProfileIds([profileId]);
+    return id ? ids.filter((candidate) => candidate !== id) : [...ids];
+}
+/** Import unions are existing-first so omission can never clear a local ref. */
+export function unionCaseBrandProfileIds(existingValue, importedValue) {
+    const existing = normalizeCaseBrandProfileIds(existingValue);
+    const imported = normalizeCaseBrandProfileIds(importedValue);
+    const ids = [...existing];
+    const seen = new Set(ids);
+    let omitted = 0;
+    for (const id of imported) {
+        if (seen.has(id))
+            continue;
+        seen.add(id);
+        if (ids.length < MAX_CASE_BRAND_PROFILE_IDS)
+            ids.push(id);
+        else
+            omitted += 1;
+    }
+    return { ids, omitted };
+}