@slicedearth/whoisleuth-cli 1.47.4 → 2.0.0

package/lib/availability.mjs

@@ -32,10 +32,24 @@ function errorRecord(value) {
         ? value
         : {};
 }
+function registryStatusToken(value) {
+    return value.toLowerCase().replace(/[^a-z0-9]+/gu, '');
+}
 function rdapEventDate(events, action) {
     const date = events.find((event) => event.action === action)?.date;
     return typeof date === 'string' ? date : null;
 }
+function withoutHttpDeliveryMetadata(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return value;
+    const output = { ...value };
+    if (output.response && typeof output.response === 'object' && !Array.isArray(output.response)) {
+        const response = { ...output.response };
+        delete response.deliveryMetadata;
+        output.response = response;
+    }
+    return output;
+}
 // No marketplace (Afternic/Sedo/Dan.com/GoDaddy Auctions/etc.) offers a
 // free, no-auth API to check "is this specific domain listed for sale" -
 // what's checkable without credentials is the parking/landing-page
@@ -448,40 +462,39 @@ async function checkDomainAvailability(domain, options = {}) {
                     source: 'whois',
                 };
             }
-            if (parsed.nameservers.length)
-                nameservers = parsed.nameservers;
-            if (parsed.statuses.length)
-                statuses = parsed.statuses.map((status) => status.toLowerCase());
-            if (parsed.registrar) {
-                registrar = {
-                    handle: null,
-                    ianaId: parsed.registrarIanaId || null,
-                    name: parsed.registrar,
-                    org: null,
-                    email: parsed.abuseEmail || null,
-                    phone: parsed.abusePhone || null,
-                };
-            }
-            if (parsed.registrantName || parsed.registrantOrg || parsed.registrantEmail || parsed.registrantPhone) {
-                registrant = {
-                    handle: null,
-                    name: parsed.registrantName || null,
-                    org: parsed.registrantOrg || null,
-                    email: parsed.registrantEmail || null,
-                    phone: parsed.registrantPhone || null,
-                };
-            }
-            if (parsed.abuseEmail || parsed.abusePhone) {
-                abuse = { handle: null, name: null, org: parsed.registrar || null, email: parsed.abuseEmail || null, phone: parsed.abusePhone || null };
-            }
-            createdDate = parsed.createdDate || null;
-            expiryDate = parsed.expiryDate || null;
-            createdDateIso = parsed.createdDateIso || parsed.lifecycle?.createdDateIso || registryDateIso(createdDate);
-            expiryDateIso = parsed.expiryDateIso || parsed.lifecycle?.expiryDateIso || registryDateIso(expiryDate);
-            if (!dnssec)
-                dnssec = parsed.dnssec || null;
-            if (parsed.registrationStatus === 'registered'
-                || registrar || createdDate || expiryDate || nameservers.length > 0 || statuses.length > 0) {
+            if (parsed.registrationStatus === 'registered') {
+                if (parsed.nameservers.length)
+                    nameservers = parsed.nameservers;
+                if (parsed.statuses.length)
+                    statuses = parsed.statuses.map((status) => status.toLowerCase());
+                if (parsed.registrar) {
+                    registrar = {
+                        handle: null,
+                        ianaId: parsed.registrarIanaId || null,
+                        name: parsed.registrar,
+                        org: null,
+                        email: parsed.abuseEmail || null,
+                        phone: parsed.abusePhone || null,
+                    };
+                }
+                if (parsed.registrantName || parsed.registrantOrg || parsed.registrantEmail || parsed.registrantPhone) {
+                    registrant = {
+                        handle: null,
+                        name: parsed.registrantName || null,
+                        org: parsed.registrantOrg || null,
+                        email: parsed.registrantEmail || null,
+                        phone: parsed.registrantPhone || null,
+                    };
+                }
+                if (parsed.abuseEmail || parsed.abusePhone) {
+                    abuse = { handle: null, name: null, org: parsed.registrar || null, email: parsed.abuseEmail || null, phone: parsed.abusePhone || null };
+                }
+                createdDate = parsed.createdDate || null;
+                expiryDate = parsed.expiryDate || null;
+                createdDateIso = parsed.createdDateIso || parsed.lifecycle?.createdDateIso || registryDateIso(createdDate);
+                expiryDateIso = parsed.expiryDateIso || parsed.lifecycle?.expiryDateIso || registryDateIso(expiryDate);
+                if (!dnssec)
+                    dnssec = parsed.dnssec || null;
                 registrationSource = 'whois';
             }
         }
@@ -493,9 +506,7 @@ async function checkDomainAvailability(domain, options = {}) {
     // registration evidence either - e.g. the registry answered inconclusively
     // or every referral hop failed/rate-limited. Report "unknown" rather than
     // fabricating "registered" from an empty record.
-    const hasWhoisRegistrationData = whoisParsed?.registrationStatus === 'registered'
-        || Boolean(registrar) || Boolean(createdDate) || Boolean(expiryDate)
-        || nameservers.length > 0 || statuses.length > 0;
+    const hasWhoisRegistrationData = whoisParsed?.registrationStatus === 'registered';
     let dnsDelegated = false;
     if (!rdapFound && !hasWhoisRegistrationData && dnsDelegationPromise) {
         const delegation = await dnsDelegationPromise;
@@ -549,7 +560,10 @@ async function checkDomainAvailability(domain, options = {}) {
         dnssec,
         source: registrationSource,
     };
-    if (statuses.some((s) => s.includes('pendingdelete') || s.includes('redemptionperiod'))) {
+    if (statuses.some((status) => {
+        const normalizedStatus = registryStatusToken(status);
+        return normalizedStatus.includes('pendingdelete') || normalizedStatus.includes('redemptionperiod');
+    })) {
         return {
             state: 'expiring',
             confidence: 'medium',
@@ -648,6 +662,7 @@ async function checkDomainAvailability(domain, options = {}) {
                 responseHeaders: homepage.technologyHeaders,
                 activityStatus,
                 includePageIdentity: pageIdentityEligible,
+                includePublicationMetadata: options.includePublicationMetadata !== false,
                 ...(options.includeCredentialSurfaceProfile !== undefined
                     ? { includeCredentialSurfaceProfile: options.includeCredentialSurfaceProfile }
                     : {}),
@@ -661,6 +676,9 @@ async function checkDomainAvailability(domain, options = {}) {
         }
     }
     const responsePolicy = qualifyResponsePolicyWithCspMeta(homepage.responsePolicy, htmlSignals.cspMetaPolicy);
+    const retainedHttp = options.includeDeliveryMetadata === false
+        ? withoutHttpDeliveryMetadata(homepage.http)
+        : homepage.http;
     const { cspMetaPolicy: _cspMetaPolicy, ...retainedHtmlSignals } = htmlSignals;
     const securityPosture = options.includeSecurityPosture === false ? null : analyzeWebsiteSecurityPosture({
         http: homepage.http,
@@ -694,7 +712,7 @@ async function checkDomainAvailability(domain, options = {}) {
             activityStatus,
             websiteProbeStatus,
             websiteProbeDetail,
-            http: homepage.http,
+            http: retainedHttp,
             deepScanComplete,
             faviconHash,
             faviconPHash,
@@ -718,7 +736,7 @@ async function checkDomainAvailability(domain, options = {}) {
         activityStatus,
         websiteProbeStatus,
         websiteProbeDetail,
-        http: homepage.http,
+        http: retainedHttp,
         deepScanComplete,
         faviconHash,
         faviconPHash,

package/lib/bounded-contract-normalizers.mjs

@@ -2,6 +2,7 @@
 // not infer missing values and keep every string, object, enum, and counter
 // bounded before a provider or connector result reaches its public model.
 import { domainToASCII } from 'node:url';
+import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
 export function isRecord(value) {
     return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
 }
@@ -26,10 +27,7 @@ export function strictBoundedString(value, maxLength) {
     return normalized && normalized.length <= maxLength ? normalized : null;
 }
 export function isoTimestamp(value) {
-    if (typeof value !== 'string' || value.length > 64 || /[\u0000-\u001f\u007f]/u.test(value))
-        return null;
-    const timestamp = Date.parse(value);
-    return Number.isFinite(timestamp) ? new Date(timestamp).toISOString() : null;
+    return normalizeExplicitIsoTimestamp(value);
 }
 export function boundedHttpsUrl(value, maxLength) {
     const raw = strictBoundedString(value, maxLength);

package/lib/bounded-file.mjs

@@ -1,5 +1,6 @@
 import { constants } from 'node:fs';
-import { open } from 'node:fs/promises';
+import { lstat, open, realpath } from 'node:fs/promises';
+import path from 'node:path';
 const MAX_BOUNDED_FILE_BYTES = 64 * 1024 * 1024;
 function boundedSize(value, fallback) {
     return Number.isSafeInteger(value) && Number(value) >= 0 && Number(value) <= MAX_BOUNDED_FILE_BYTES
@@ -13,7 +14,7 @@ function throwIfAborted(signal) {
         ? signal.reason
         : new DOMException('The operation was aborted.', 'AbortError');
 }
-export async function readBoundedRegularFile(filePath, options, dependencies = {}) {
+async function readBoundedRegularFileIdentity(filePath, options, dependencies = {}) {
     const label = options.label?.trim().slice(0, 120) || 'Input file';
     const maximumBytes = boundedSize(options.maximumBytes, 0);
     const minimumBytes = boundedSize(options.minimumBytes, 0);
@@ -70,13 +71,86 @@ export async function readBoundedRegularFile(filePath, options, dependencies = {
             || after.ctimeMs !== before.ctimeMs) {
             throw new TypeError(`${label} changed while it was being read.`);
         }
-        return Buffer.from(storage.subarray(0, offset));
+        return {
+            bytes: Buffer.from(storage.subarray(0, offset)),
+            device: before.dev,
+            inode: before.ino,
+        };
     }
     finally {
         await handle.close();
     }
 }
+export async function readBoundedRegularFile(filePath, options, dependencies = {}) {
+    return (await readBoundedRegularFileIdentity(filePath, options, dependencies)).bytes;
+}
+/**
+ * Decode admitted bytes without replacement-character normalisation.  The BOM
+ * is deliberately retained so re-encoding the returned string preserves the
+ * exact bytes used by artefact identity and manifest checks.
+ */
+export function decodeBoundedUtf8(bytes, label = 'Input') {
+    try {
+        return new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(bytes);
+    }
+    catch {
+        throw new TypeError(`${label.trim().slice(0, 120) || 'Input'} must contain valid UTF-8 text.`);
+    }
+}
 export async function readBoundedRegularTextFile(filePath, options, dependencies = {}) {
-    return (await readBoundedRegularFile(filePath, options, dependencies)).toString('utf8');
+    return decodeBoundedUtf8(await readBoundedRegularFile(filePath, options, dependencies), options.label);
+}
+function safeRelativeFilePath(value, label) {
+    if (!value || path.isAbsolute(value) || value.includes('\\')
+        || value.split('/').some((part) => !part || part === '.' || part === '..')) {
+        throw new TypeError(`${label} must be a safe relative file path.`);
+    }
+    return value;
+}
+/**
+ * Reads one regular file beneath a canonical root while rejecting final and
+ * intermediate symbolic links. The ordinary descriptor-level size/change
+ * checks still apply after path confinement is established.
+ */
+export async function readBoundedRegularFileWithin(rootDirectory, relativeFilePath, options, dependencies = {}) {
+    const label = options.label?.trim().slice(0, 120) || 'Input file';
+    const relativePath = safeRelativeFilePath(relativeFilePath, label);
+    const canonicalRoot = await realpath(rootDirectory);
+    const targetPath = path.resolve(canonicalRoot, relativePath);
+    const confined = path.relative(canonicalRoot, targetPath);
+    if (!confined || confined.startsWith(`..${path.sep}`) || confined === '..' || path.isAbsolute(confined)) {
+        throw new TypeError(`${label} escapes its configured root.`);
+    }
+    let cursor = canonicalRoot;
+    const components = relativePath.split('/');
+    let admittedDevice = -1;
+    let admittedInode = -1;
+    for (const [index, component] of components.entries()) {
+        cursor = path.join(cursor, component);
+        const metadata = await lstat(cursor);
+        if (metadata.isSymbolicLink())
+            throw new TypeError(`${label} must not traverse a symbolic link.`);
+        if (index === components.length - 1) {
+            admittedDevice = metadata.dev;
+            admittedInode = metadata.ino;
+        }
+    }
+    const canonicalTarget = await realpath(targetPath);
+    if (canonicalTarget !== targetPath)
+        throw new TypeError(`${label} must not traverse a symbolic link.`);
+    const identity = await readBoundedRegularFileIdentity(targetPath, {
+        ...options,
+        allowSymbolicLink: false,
+    }, dependencies);
+    const finalMetadata = await lstat(targetPath);
+    if (finalMetadata.isSymbolicLink()
+        || identity.device !== admittedDevice
+        || identity.inode !== admittedInode
+        || identity.device !== finalMetadata.dev
+        || identity.inode !== finalMetadata.ino
+        || await realpath(targetPath) !== canonicalTarget) {
+        throw new TypeError(`${label} changed while it was being read.`);
+    }
+    return identity.bytes;
 }
 export { MAX_BOUNDED_FILE_BYTES };

package/lib/bounded-json.mjs

@@ -36,27 +36,62 @@ export function assertBoundedJsonStructure(value, label = 'JSON value', limits =
             throw new TypeError(`${label} contains a non-JSON value.`);
         if (ancestors.has(current))
             throw new TypeError(`${label} contains a cyclic object reference.`);
+        let prototype;
+        let ownKeys;
+        let descriptors;
+        try {
+            prototype = Object.getPrototypeOf(current);
+            ownKeys = Reflect.ownKeys(current);
+            descriptors = Object.getOwnPropertyDescriptors(current);
+        }
+        catch {
+            throw new TypeError(`${label} could not be inspected safely.`);
+        }
+        if (ownKeys.some((key) => typeof key !== 'string')) {
+            throw new TypeError(`${label} contains a symbol key.`);
+        }
+        if (ownKeys.some((key) => {
+            const descriptor = descriptors[String(key)];
+            return !descriptor || !Object.hasOwn(descriptor, 'value');
+        })) {
+            throw new TypeError(`${label} contains an accessor property.`);
+        }
         ancestors.add(current);
         if (Array.isArray(current)) {
-            if (current.length > maximumContainerItems) {
+            if (prototype !== Array.prototype) {
+                throw new TypeError(`${label} contains an array with a custom prototype.`);
+            }
+            const length = descriptors.length?.value;
+            if (!Number.isSafeInteger(length) || length < 0 || length > maximumContainerItems) {
                 throw new TypeError(`${label} contains a container with more than ${maximumContainerItems} items.`);
             }
-            for (const item of current)
-                visit(item, depth + 1);
+            const indexes = ownKeys.filter((key) => key !== 'length');
+            if (indexes.length !== length
+                || indexes.some((key, index) => key !== String(index) || descriptors[key]?.enumerable !== true)) {
+                throw new TypeError(`${label} contains a sparse, extended, or non-enumerable array.`);
+            }
+            for (const key of indexes)
+                visit(descriptors[key].value, depth + 1);
         }
         else {
-            const entries = Object.entries(current);
-            if (entries.length > maximumContainerItems) {
+            if (prototype !== Object.prototype && prototype !== null) {
+                throw new TypeError(`${label} contains an object with a custom prototype.`);
+            }
+            const objectKeys = ownKeys;
+            if (objectKeys.length > maximumContainerItems) {
                 throw new TypeError(`${label} contains a container with more than ${maximumContainerItems} items.`);
             }
-            keys += entries.length;
+            if (objectKeys.some((key) => descriptors[key]?.enumerable !== true)) {
+                throw new TypeError(`${label} contains a non-enumerable object property.`);
+            }
+            keys += objectKeys.length;
             if (keys > maximumKeys) {
                 throw new TypeError(`${label} exceeds the ${maximumKeys}-key limit.`);
             }
-            for (const [key, item] of entries) {
+            for (const key of objectKeys) {
                 if (!isSafeJsonObjectKey(key))
                     throw new TypeError(`${label} contains an unsafe object key.`);
-                visit(item, depth + 1);
+                visit(descriptors[key].value, depth + 1);
             }
         }
         ancestors.delete(current);
@@ -226,7 +261,7 @@ export function scanBoundedJson(raw, limits = {}) {
     if (index !== raw.length)
         syntaxError();
 }
-export function parseBoundedJsonObject(raw, options) {
+export function parseBoundedJson(raw, options) {
     const label = options.label ?? 'Artefact input';
     if (typeof raw !== 'string')
         throw new TypeError(`${label} must be UTF-8 JSON text.`);
@@ -234,14 +269,17 @@ export function parseBoundedJsonObject(raw, options) {
     if (bytes < 1 || bytes > options.maximumBytes) {
         throw new TypeError(`${label} must be between 1 byte and ${options.maximumBytes} bytes.`);
     }
-    scanBoundedJson(raw);
-    let parsed;
+    scanBoundedJson(raw, options.limits);
     try {
-        parsed = JSON.parse(raw);
+        return JSON.parse(raw);
     }
     catch {
-        syntaxError();
+        return syntaxError();
     }
+}
+export function parseBoundedJsonObject(raw, options) {
+    const label = options.label ?? 'Artefact input';
+    const parsed = parseBoundedJson(raw, options);
     if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
         throw new TypeError(`${label} must contain one JSON object.`);
     }

package/lib/browser-library-profile.mjs

@@ -7,7 +7,7 @@ import { createHash } from 'node:crypto';
 import { Worker } from 'node:worker_threads';
 import { RETIRE_BROWSER_CATALOG } from "./generated/retire-browser-catalog.mjs";
 import { CISA_KEV_CATALOG } from "./generated/cisa-kev-catalog.mjs";
-import { createObservation } from "./observation.mjs";
+import { createObservation } from "../packages/evidence/observation.mjs";
 import { MAX_INLINE_SCRIPT_CHARS, MAX_INLINE_SCRIPT_TOTAL_CHARS, MAX_SCRIPT_ELEMENTS, MAX_STATIC_HTML_CHARS, analyzeStaticHtml, } from "./static-html-analysis.mjs";
 // Catalogue expressions are reviewed third-party inputs. Keep every individual
 // regular-expression evaluation and the aggregate inline-signature work small

package/lib/classify.mjs

@@ -14,7 +14,9 @@
 // original input hostname and the resolved registrable domain are returned so
 // callers can look up the latter while still showing the user what they typed.
 import { isIP } from 'node:net';
+import { domainToASCII } from 'node:url';
 import { parse } from 'tldts';
+import { canonicalRegistrableDomain } from "./registrable-domain.mjs";
 // A CR/LF here would let one query become multiple lines once it reaches
 // lib/whois.mts's raw `socket.write(query + '\r\n')` - a normal URL-encoded
 // query string (?q=example.com%0D%0AHELP) decodes back into literal control
@@ -24,6 +26,9 @@ const CONTROL_CHAR_RE = /[\x00-\x1f\x7f]/;
 // 32-bit ASN ceiling (RFC 6793 four-octet ASNs). AS0 and AS4294967295 are
 // reserved but syntactically valid; anything above is not an ASN at all.
 const MAX_ASN = 4294967295;
+const MAX_DIRECT_LOOKUP_TARGET_LENGTH = 1024;
+const DIRECT_LOOKUP_RESERVED_SUFFIXES = new Set(['example', 'test']);
+const DIRECT_LOOKUP_EXCLUDED_PUBLIC_SUFFIXES = new Set(['onion']);
 // A registrable-domain label: LDH (letter/digit/hyphen), 1-63 characters, no
 // leading or trailing hyphen. tldts already rejects empty labels, over-long
 // labels, leading/trailing hyphens, and public-suffix-only inputs (all yield
@@ -33,6 +38,52 @@ const MAX_ASN = 4294967295;
 function isValidRegistrableLabel(label) {
     return /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i.test(label);
 }
+// Direct CLI shorthand is deliberately narrower than normal query
+// classification. classifyQuery() accepts pasted URLs and other convenient
+// input forms after normalisation, while a value occupying command position
+// must be unambiguously a target before it may select the networked Lookup
+// command. This predicate therefore accepts only a complete hostname, literal
+// IP address, or bounded ASN and never attempts to repair URL-like input.
+function isDirectLookupTarget(raw) {
+    if (typeof raw !== 'string'
+        || !raw
+        || raw.length > MAX_DIRECT_LOOKUP_TARGET_LENGTH
+        || raw.startsWith('-')
+        || raw.trim() !== raw
+        || /\s/u.test(raw)
+        || CONTROL_CHAR_RE.test(raw)) {
+        return false;
+    }
+    if (isIP(raw) !== 0)
+        return !raw.includes('%') && !raw.startsWith('[');
+    const asnMatch = raw.match(/^(?:AS)?(\d+)$/i);
+    if (asnMatch) {
+        const number = Number(asnMatch[1]);
+        return Number.isInteger(number) && number >= 0 && number <= MAX_ASN;
+    }
+    if (/[\\/@:?#%\[\]]/u.test(raw) || raw.endsWith('..'))
+        return false;
+    const hostname = raw.endsWith('.') ? raw.slice(0, -1) : raw;
+    if (!hostname.includes('.'))
+        return false;
+    const ascii = domainToASCII(hostname).toLowerCase();
+    if (!ascii || ascii.length > 253 || !ascii.split('.').every(isValidRegistrableLabel))
+        return false;
+    const parsed = parse(ascii);
+    const publicSuffix = parsed.publicSuffix || '';
+    if (DIRECT_LOOKUP_EXCLUDED_PUBLIC_SUFFIXES.has(publicSuffix)
+        || publicSuffix === 'arpa'
+        || publicSuffix.endsWith('.arpa'))
+        return false;
+    if (parsed.isIcann !== true && !DIRECT_LOOKUP_RESERVED_SUFFIXES.has(publicSuffix))
+        return false;
+    try {
+        return classifyQuery(raw).type === 'domain';
+    }
+    catch {
+        return false;
+    }
+}
 function classifyQuery(raw) {
     const trimmed = raw.trim();
     if (CONTROL_CHAR_RE.test(trimmed)) {
@@ -75,13 +126,13 @@ function classifyQuery(raw) {
     if (!inputHostname || !inputHostname.includes('.') || inputHostname.length > 253) {
         throw new Error(`"${trimmed}" is not a valid domain, IP, or ASN.`);
     }
-    const registrableDomain = parse(inputHostname).domain;
+    if (!inputHostname.split('.').every(isValidRegistrableLabel)) {
+        throw new Error(`"${trimmed}" contains an invalid domain label (underscores, empty, or malformed labels are not registrable).`);
+    }
+    const registrableDomain = canonicalRegistrableDomain(inputHostname);
     if (!registrableDomain) {
         throw new Error(`"${trimmed}" is not a registrable domain (no public-suffix match).`);
     }
-    if (!registrableDomain.split('.').every(isValidRegistrableLabel)) {
-        throw new Error(`"${trimmed}" contains an invalid domain label (underscores, empty, or malformed labels are not registrable).`);
-    }
     return {
         type: 'domain',
         value: registrableDomain,
@@ -90,4 +141,4 @@ function classifyQuery(raw) {
         isSubdomain: inputHostname !== registrableDomain,
     };
 }
-export { classifyQuery, MAX_ASN };
+export { classifyQuery, isDirectLookupTarget, MAX_ASN };

package/lib/client-behavior-profile.mjs

@@ -2,7 +2,7 @@
 // HTML tokenizer pass. Scripts are never fetched or executed. Only fixed
 // indicator identifiers, descriptions, evidence classes, and bounded counts
 // leave this module; script references and contents are discarded.
-import { createObservation } from "./observation.mjs";
+import { createObservation } from "../packages/evidence/observation.mjs";
 import { analyzeStaticHtml, } from "./static-html-analysis.mjs";
 const CLIENT_BEHAVIOR_PROFILE_VERSION = 1;
 const MAX_CLIENT_BEHAVIOR_INDICATORS = 12;

package/lib/credential-surface-profile.mjs

@@ -3,7 +3,7 @@
 // shared tokenizer projects only fixed categories and bounded counts; field
 // names, values, labels, placeholders, arbitrary attributes, and action URLs
 // never enter this profile.
-import { createObservation } from "./observation.mjs";
+import { createObservation } from "../packages/evidence/observation.mjs";
 import { MAX_STATIC_FORMS, MAX_STATIC_INPUTS, analyzeStaticHtml, } from "./static-html-analysis.mjs";
 const CREDENTIAL_SURFACE_PROFILE_VERSION = 1;
 function analyzeCredentialSurfaceProfile(input = {}) {

package/lib/cryptographic-assurance.mjs

@@ -1,9 +1,11 @@
 import { validateDnssecEvidence } from "./dnssec-evidence-validation.mjs";
 import { reviewRpkiRoute } from "./rpki-evidence.mjs";
 import { analyzeTlsaEvidence } from "./tlsa-evidence.mjs";
+import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
 const CRYPTOGRAPHIC_ASSURANCE_INPUT_SCHEMA = 'whoisleuth.cryptographic-assurance.input';
 const CRYPTOGRAPHIC_ASSURANCE_SCHEMA = 'whoisleuth.cryptographic-assurance.review';
-const CRYPTOGRAPHIC_ASSURANCE_VERSION = 1;
+const CRYPTOGRAPHIC_ASSURANCE_INPUT_VERSION = 1;
+const CRYPTOGRAPHIC_ASSURANCE_REVIEW_VERSION = 2;
 function exactRecord(value, keys, label) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
         throw new TypeError(`${label} must be one object.`);
@@ -22,10 +24,11 @@ function sourceLabel(value, label) {
     return normalized;
 }
 function observationTime(value, label) {
-    if (typeof value !== 'string' || value.length > 64 || !Number.isFinite(Date.parse(value))) {
+    const normalized = normalizeExplicitIsoTimestamp(value);
+    if (!normalized) {
         throw new TypeError(`${label}.observedAt must be one ISO-compatible timestamp.`);
     }
-    return new Date(value).toISOString();
+    return normalized;
 }
 function suppliedEvidence(value, label) {
     if (value === null || value === undefined)
@@ -59,7 +62,16 @@ function dnssecCompleteness(report) {
         : report.state === 'invalid' ? 'unavailable' : 'partial';
 }
 function rpkiCompleteness(report) {
-    return report.state === 'partial' ? 'partial' : report.state === 'invalid_input' ? 'unavailable' : 'complete';
+    return report.state === 'invalid_input' ? 'unavailable' : 'partial';
+}
+function rpkiCardState(report) {
+    if (report.state === 'valid')
+        return 'matches_supplied_rows';
+    if (report.state === 'invalid')
+        return 'differs_from_supplied_rows';
+    if (report.state === 'not_found')
+        return 'not_found_in_supplied_rows';
+    return report.state;
 }
 function tlsaCompleteness(report) {
     const comparisonMaterialComplete = !report.truncated
@@ -74,8 +86,8 @@ function tlsaCompleteness(report) {
 }
 function buildCryptographicAssuranceReview(inputValue, generatedAt = new Date().toISOString()) {
     const input = exactRecord(inputValue, new Set(['schema', 'version', 'dnssec', 'routeOrigin', 'tlsa']), 'Cryptographic assurance input');
-    if (input.schema !== CRYPTOGRAPHIC_ASSURANCE_INPUT_SCHEMA || input.version !== CRYPTOGRAPHIC_ASSURANCE_VERSION) {
-        throw new TypeError(`Cryptographic assurance input must use ${CRYPTOGRAPHIC_ASSURANCE_INPUT_SCHEMA} version ${CRYPTOGRAPHIC_ASSURANCE_VERSION}.`);
+    if (input.schema !== CRYPTOGRAPHIC_ASSURANCE_INPUT_SCHEMA || input.version !== CRYPTOGRAPHIC_ASSURANCE_INPUT_VERSION) {
+        throw new TypeError(`Cryptographic assurance input must use ${CRYPTOGRAPHIC_ASSURANCE_INPUT_SCHEMA} version ${CRYPTOGRAPHIC_ASSURANCE_INPUT_VERSION}.`);
     }
     const dnssecInput = suppliedEvidence(input.dnssec, 'dnssec');
     const routeInput = suppliedEvidence(input.routeOrigin, 'routeOrigin');
@@ -97,8 +109,8 @@ function buildCryptographicAssuranceReview(inputValue, generatedAt = new Date().
     }) : null;
     const tlsa = tlsaInput ? analyzeTlsaEvidence({
         serviceName: tlsaInput.evidence.serviceName,
-        dnssecState: tlsaInput.evidence.dnssecState,
-        pkixValidationState: tlsaInput.evidence.pkixValidationState,
+        dnssecState: 'unavailable',
+        pkixValidationState: 'unavailable',
         records: tlsaInput.evidence.records,
         certificateDerBase64: tlsaInput.evidence.certificateDerBase64,
         spkiDerBase64: tlsaInput.evidence.spkiDerBase64,
@@ -119,29 +131,35 @@ function buildCryptographicAssuranceReview(inputValue, generatedAt = new Date().
         routeOrigin && routeInput ? Object.freeze({
             family: 'route_origin_authorisation',
             label: 'Route-origin authorisation',
-            authority: 'Analyst-supplied validated route-origin snapshot',
+            authority: 'Analyst-supplied route-origin rows',
             source: routeInput.source,
             observedAt: routeInput.observedAt,
-            state: routeOrigin.state,
+            state: rpkiCardState(routeOrigin),
             completeness: rpkiCompleteness(routeOrigin),
             result: routeOrigin,
-            limitations: routeOrigin.limitations,
-        }) : unavailableCard('route_origin_authorisation', 'Route-origin authorisation', 'Analyst-supplied validated route-origin snapshot'),
+            limitations: Object.freeze([
+                ...routeOrigin.limitations,
+                'The supplied rows do not include bounded validator provenance, implementation identity, validation time, or a complete authenticated snapshot, so this card reports only their local comparison and remains partial.',
+            ]),
+        }) : unavailableCard('route_origin_authorisation', 'Route-origin authorisation', 'Analyst-supplied route-origin rows'),
         tlsa && tlsaInput ? Object.freeze({
             family: 'dane_tlsa',
             label: 'DANE and TLSA evidence review',
-            authority: 'Supplied TLSA, DNSSEC, PKIX, and certificate material',
+            authority: 'Supplied TLSA and certificate association material',
             source: tlsaInput.source,
             observedAt: tlsaInput.observedAt,
             state: tlsa.state,
             completeness: tlsaCompleteness(tlsa),
             result: tlsa,
-            limitations: tlsa.limitations,
-        }) : unavailableCard('dane_tlsa', 'DANE and TLSA evidence review', 'Supplied TLSA, DNSSEC, PKIX, and certificate material'),
+            limitations: Object.freeze([
+                ...tlsa.limitations,
+                'Caller-provided DNSSEC and PKIX state labels are not accepted as validator evidence. Positive DANE state requires separately validated prerequisite artefacts from an explicit collector.',
+            ]),
+        }) : unavailableCard('dane_tlsa', 'DANE and TLSA evidence review', 'Supplied TLSA and certificate association material'),
     ];
     return Object.freeze({
         schema: CRYPTOGRAPHIC_ASSURANCE_SCHEMA,
-        version: CRYPTOGRAPHIC_ASSURANCE_VERSION,
+        version: CRYPTOGRAPHIC_ASSURANCE_REVIEW_VERSION,
         generatedAt: observationTime(generatedAt, 'generatedAt'),
         cards: Object.freeze(cards),
         combinedState: null,
@@ -152,4 +170,4 @@ function buildCryptographicAssuranceReview(inputValue, generatedAt = new Date().
         ]),
     });
 }
-export { CRYPTOGRAPHIC_ASSURANCE_INPUT_SCHEMA, CRYPTOGRAPHIC_ASSURANCE_SCHEMA, CRYPTOGRAPHIC_ASSURANCE_VERSION, buildCryptographicAssuranceReview, };
+export { CRYPTOGRAPHIC_ASSURANCE_INPUT_SCHEMA, CRYPTOGRAPHIC_ASSURANCE_INPUT_VERSION, CRYPTOGRAPHIC_ASSURANCE_REVIEW_VERSION, CRYPTOGRAPHIC_ASSURANCE_SCHEMA, buildCryptographicAssuranceReview, };

package/lib/ct-query.mjs

@@ -1,7 +1,7 @@
 const MAX_CT_QUERY_LENGTH = 200;
 const CT_QUERY_ERROR_CODE = 'INVALID_CT_QUERY';
-const CT_QUERY_ERROR_MESSAGE = `Certificate Transparency query must be at most ${MAX_CT_QUERY_LENGTH} characters and contain no control characters.`;
-const CONTROL_CHARACTER_RE = /[\u0000-\u001f\u007f]/u;
+const CT_QUERY_ERROR_MESSAGE = `Certificate Transparency query must be at most ${MAX_CT_QUERY_LENGTH} characters and contain no control or invisible formatting characters.`;
+const UNSAFE_QUERY_CHARACTER_RE = /[\u0000-\u001f\u007f-\u009f]|\p{Default_Ignorable_Code_Point}/u;
 class CtQueryError extends Error {
     code = CT_QUERY_ERROR_CODE;
     constructor() {
@@ -14,7 +14,7 @@ function normalizeCtQuery(value) {
         return '';
     if (typeof value !== 'string'
         || value.length > MAX_CT_QUERY_LENGTH
-        || CONTROL_CHARACTER_RE.test(value)) {
+        || UNSAFE_QUERY_CHARACTER_RE.test(value)) {
         throw new CtQueryError();
     }
     return value.trim();