@slicedearth/whoisleuth-cli 1.47.4 → 2.0.1

package/lib/rdap-transport.mjs

@@ -8,7 +8,7 @@ async function fetchRdapWithTimeout(url, options, timeoutMs, dependencies = {})
     const timeout = setTimeout(() => controller.abort(), timeoutMs);
     try {
         const response = await (dependencies.fetch ?? safeFetch)(url, { ...options, signal: controller.signal });
-        const { text, truncated } = await (dependencies.readText ?? readTextCapped)(response, MAX_RDAP_BYTES);
+        const { text, truncated } = await (dependencies.readText ?? readTextCapped)(response, MAX_RDAP_BYTES, { fatalUtf8: true });
         if (truncated)
             throw new Error(`Response from ${url} exceeded ${MAX_RDAP_BYTES} bytes`);
         return { status: response.status, ok: response.ok, text };
@@ -22,7 +22,7 @@ async function fetchRdapDetailedWithTimeout(url, options, timeoutMs, dependencie
     const timeout = setTimeout(() => controller.abort(), timeoutMs);
     try {
         const result = await (dependencies.fetchDetailed ?? safeFetchDetailed)(url, { ...options, signal: controller.signal });
-        const { text, truncated } = await (dependencies.readText ?? readTextCapped)(result.response, MAX_RDAP_BYTES);
+        const { text, truncated } = await (dependencies.readText ?? readTextCapped)(result.response, MAX_RDAP_BYTES, { fatalUtf8: true });
         if (truncated)
             throw new Error(`Response from ${url} exceeded ${MAX_RDAP_BYTES} bytes`);
         return {

package/lib/rdap-validation.mjs

@@ -1,24 +1,75 @@
-import net from 'node:net';
+import { isIP } from 'node:net';
 import { domainToASCII } from 'node:url';
-import { ipv4ToLong, ipv6ToBigInt } from "./rdap-bootstrap.mjs";
+import { admitRdapEndpoint, ipv4ToLong, ipv6ToBigInt } from "./rdap-bootstrap.mjs";
 export function canonicalRdapDomain(value) {
     if (typeof value !== 'string')
         return null;
     const ascii = domainToASCII(value.trim().replace(/\.+$/, ''));
     return ascii ? ascii.toLowerCase() : null;
 }
-function ipv6ToComparableBigInt(ip) {
-    let normalized = ip;
-    if (ip.includes('.')) {
-        const lastColon = ip.lastIndexOf(':');
-        const embedded = ip.slice(lastColon + 1);
-        if (net.isIP(embedded) !== 4)
+function decodedTerminalPathParts(value) {
+    try {
+        const parts = new URL(value).pathname.split('/').filter(Boolean);
+        if (parts.length < 2)
             return null;
-        const value = ipv4ToLong(embedded);
-        normalized = `${ip.slice(0, lastColon)}:${(value >>> 16).toString(16)}:${(value & 0xffff).toString(16)}`;
+        const objectType = decodeURIComponent(parts.at(-2) ?? '');
+        const objectValue = decodeURIComponent(parts.at(-1) ?? '');
+        return objectType && objectValue ? [objectType, objectValue] : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Admit final RDAP provenance only when its terminal path still identifies the
+ * requested object. Safe redirect transport proves where bytes came from; this
+ * binding separately prevents a redirected response for another object from
+ * deciding a lookup, especially when a bodyless 404 is otherwise authoritative.
+ */
+export function admitRdapObjectEndpoint(type, requestedValue, value) {
+    const admitted = admitRdapEndpoint(value);
+    if (!admitted)
+        return null;
+    const terminal = decodedTerminalPathParts(admitted);
+    if (!terminal)
+        return null;
+    const [objectType, objectValue] = terminal;
+    if (type === 'domain') {
+        const requested = canonicalRdapDomain(requestedValue);
+        const selected = canonicalRdapDomain(objectValue);
+        return objectType === 'domain' && requested && selected === requested ? admitted : null;
     }
+    if (type === 'ipv4' || type === 'ipv6') {
+        const version = type === 'ipv4' ? 4 : 6;
+        if (objectType !== 'ip' || isIP(requestedValue) !== version || isIP(objectValue) !== version)
+            return null;
+        try {
+            const convert = version === 4 ? ipv4ToLong : ipv6ToBigInt;
+            return convert(requestedValue) === convert(objectValue) ? admitted : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    if (type === 'asn') {
+        const requestedMatch = /^(?:AS)?([0-9]{1,10})$/iu.exec(requestedValue);
+        if (objectType !== 'autnum' || !requestedMatch || !/^[0-9]{1,10}$/u.test(objectValue))
+            return null;
+        const requested = Number(requestedMatch[1]);
+        const selected = Number(objectValue);
+        return Number.isSafeInteger(requested)
+            && requested >= 0
+            && requested <= 4_294_967_295
+            && selected === requested
+            && objectValue === String(selected)
+            ? admitted
+            : null;
+    }
+    return null;
+}
+function ipv6ToComparableBigInt(ip) {
     try {
-        return ipv6ToBigInt(normalized);
+        return ipv6ToBigInt(ip);
     }
     catch {
         return null;
@@ -71,11 +122,11 @@ export function validateRdapResponse(type, requestedValue, parsed) {
     const version = type === 'ipv4' ? 4 : 6;
     const startAddress = parsed.startAddress;
     const endAddress = parsed.endAddress;
-    if (net.isIP(requestedValue) !== version ||
+    if (isIP(requestedValue) !== version ||
         typeof startAddress !== 'string' ||
-        net.isIP(startAddress) !== version ||
+        isIP(startAddress) !== version ||
         typeof endAddress !== 'string' ||
-        net.isIP(endAddress) !== version) {
+        isIP(endAddress) !== version) {
         return { valid: false, detail: 'The response did not contain a compatible IP range.' };
     }
     const convert = version === 4 ? ipv4ToLong : ipv6ToComparableBigInt;

package/lib/rdap.mjs

@@ -3,9 +3,9 @@ import { BOOTSTRAP_STALE_TTL_MS, BOOTSTRAP_TTL_MS, clearRdapBootstrapCache, fetc
 import { fetchRdapFromBasesWithParser, fetchRdapRecordWithParser, } from "./rdap-client.mjs";
 import { normalizeRdapEvents, parseRdap, summarizeLifecycle, } from "./rdap-normalization.mjs";
 import { fetchRegistrarRdapRecordWithParser, selectRegistrarRdapLink, } from "./rdap-registrar.mjs";
-import { fetchRdapWithTimeout, } from "./rdap-transport.mjs";
+import { fetchRdapDetailedWithTimeout, } from "./rdap-transport.mjs";
 import { registryServiceAdmissionFor } from "./registry-capabilities.mjs";
-async function fetchRdapFromBases(type, value, bases, fetchUpstream = fetchRdapWithTimeout) {
+async function fetchRdapFromBases(type, value, bases, fetchUpstream = fetchRdapDetailedWithTimeout) {
     return fetchRdapFromBasesWithParser(type, value, bases, parseRdap, fetchUpstream);
 }
 async function fetchRdapRecord(type, value, options = {}) {

package/lib/registrable-domain.mjs

@@ -0,0 +1,36 @@
+import { getDomain } from 'tldts';
+import { isValidAsciiDomainName } from "./hostname.mjs";
+// Returns one canonical registrable-domain identity for an already public DNS
+// hostname. Callers retain the original hostname separately when subdomain
+// context matters; authority, evidence binding and scoring use this value.
+export function canonicalRegistrableDomain(value) {
+    if (typeof value !== 'string')
+        return null;
+    const trimmed = value.trim();
+    if (!trimmed || /[\u0000-\u001f\u007f]/u.test(trimmed))
+        return null;
+    const withoutScheme = trimmed.replace(/^[a-z]+:\/\//iu, '').split(/[/?#]/u)[0] ?? '';
+    if (withoutScheme.endsWith('..'))
+        return null;
+    const candidate = withoutScheme.replace(/\.$/u, '');
+    if (!candidate)
+        return null;
+    let hostname;
+    try {
+        hostname = new URL(`https://${candidate}/`).hostname.toLowerCase().replace(/\.$/u, '');
+    }
+    catch {
+        return null;
+    }
+    if (!isValidAsciiDomainName(hostname, { requireDot: true, requireLowercase: true }))
+        return null;
+    // Keep this boundary identical to classifyQuery() and the collection
+    // runtime: registrable identity follows the ICANN Public Suffix List, while
+    // privately operated suffixes remain ordinary host context.
+    const domain = getDomain(hostname);
+    return domain
+        && isValidAsciiDomainName(domain, { requireDot: true, requireLowercase: true })
+        && (hostname === domain || hostname.endsWith(`.${domain}`))
+        ? domain
+        : null;
+}

package/lib/registry-insights.mjs

@@ -87,6 +87,13 @@ function disclosure(source, parsedValue, status) {
         };
     }
     const parsed = record(parsedValue);
+    if (parsed.contactsExcluded === true) {
+        return {
+            source,
+            state: 'unavailable',
+            detail: 'Contact fields are deliberately excluded from this portable projection, so publication disclosure remains unavailable.',
+        };
+    }
     const partial = source === 'whois'
         ? parsed.chainStatus === 'partial' || strings(parsed.fieldsTruncated, 20).length > 0
         : parsed.serverTruncated === true

package/lib/response-policy.mjs

@@ -184,9 +184,23 @@ function analyzeHsts(header, signals) {
     const directives = header.value.split(';').map((part) => part.trim()).filter(Boolean);
     if (directives.length > MAX_RESPONSE_POLICY_DIRECTIVES)
         return 'partial';
-    const maxAge = directives
-        .map((part) => part.match(/^max-age\s*=\s*(\d+)$/iu)?.[1] || null)
-        .find((value) => value !== null);
+    const seen = new Set();
+    let maxAge = null;
+    for (const directive of directives) {
+        const match = /^([a-z][a-z0-9-]{0,63})(?:\s*=\s*(.*))?$/iu.exec(directive);
+        if (!match)
+            return 'malformed';
+        const name = match[1]?.toLowerCase() ?? '';
+        if (seen.has(name))
+            return 'malformed';
+        seen.add(name);
+        if (name === 'max-age') {
+            const value = match[2];
+            if (!value || !/^\d+$/u.test(value))
+                return 'malformed';
+            maxAge = value;
+        }
+    }
     if (!maxAge || maxAge.length > 12)
         return 'malformed';
     const seconds = Number(maxAge);
@@ -256,10 +270,15 @@ function analyzeCookies(headers, signals) {
     let missingHttpOnly = 0;
     let missingSameSite = 0;
     let sameSiteNoneWithoutSecure = 0;
+    let attributesTruncated = false;
     for (const value of result.values) {
         const segments = value.split(';');
         if (!segments[0]?.includes('='))
             return { state: 'malformed', count: result.values.length, truncated: result.truncated };
+        if (segments.length - 1 > MAX_RESPONSE_POLICY_TOKENS) {
+            attributesTruncated = true;
+            continue;
+        }
         const attributes = new Map();
         for (const rawAttribute of segments.slice(1, MAX_RESPONSE_POLICY_TOKENS + 1)) {
             const [rawName = '', ...rawValue] = rawAttribute.trim().split('=');
@@ -289,7 +308,11 @@ function analyzeCookies(headers, signals) {
     if (sameSiteNoneWithoutSecure) {
         addSignal(signals, 'cookies_same_site_none_without_secure', sameSiteNoneWithoutSecure);
     }
-    return { state: result.state, count: result.values.length, truncated: result.truncated };
+    return {
+        state: result.state === 'partial' || attributesTruncated ? 'partial' : result.state,
+        count: result.values.length,
+        truncated: result.truncated || attributesTruncated,
+    };
 }
 export function analyzeResponsePolicyHeaders(headers) {
     const signals = [];

package/lib/risk-calibration-summary.mjs

@@ -1,35 +1,25 @@
 import { ANALYST_REVIEW_REASON_VALUES } from "./analyst-taxonomy.mjs";
 import { scanBoundedJson } from "./bounded-json.mjs";
 import { RISK_REVIEW_THRESHOLD } from "./risk-scoring.mjs";
-export const RISK_CALIBRATION_SUMMARY_SCHEMA = 'whoisleuth.cli.risk-calibration';
-export const RISK_CALIBRATION_SUMMARY_VERSION = 3;
-export const RISK_CALIBRATION_SUMMARY_MAX_BYTES = 512 * 1024;
-export const RISK_CALIBRATION_SUMMARY_MAX_RECORDS = 500;
+import { MAX_RISK_CALIBRATION_RECORDS, MAX_RISK_CALIBRATION_JSON_CONTAINER_ITEMS, MAX_RISK_CALIBRATION_JSON_DEPTH, MAX_RISK_CALIBRATION_JSON_KEYS, MAX_RISK_CALIBRATION_JSON_VALUES, MAX_RISK_CALIBRATION_MODEL_VERSION, MAX_RISK_CALIBRATION_REVIEW_REASON_LENGTH, MAX_RISK_CALIBRATION_SUMMARY_BYTES, MAX_RISK_CALIBRATION_SUMMARY_STRATA, MAX_RISK_CALIBRATION_TIMESTAMP_LENGTH, RISK_CALIBRATION_DATASET_SCHEMA, RISK_CALIBRATION_REPORT_CONFIDENCE_KEYS, RISK_CALIBRATION_REPORT_DATASET_KEYS, RISK_CALIBRATION_REPORT_INTERPRETATION_KEYS, RISK_CALIBRATION_REPORT_INTERVAL_KEYS, RISK_CALIBRATION_REPORT_METRIC_KEYS, RISK_CALIBRATION_REPORT_MODEL_COMPARISON_KEYS, RISK_CALIBRATION_REPORT_PRIVACY_KEYS, RISK_CALIBRATION_REPORT_SCHEMA, RISK_CALIBRATION_REPORT_SCORE_BAND_KEYS, RISK_CALIBRATION_REPORT_STRATUM_KEYS, RISK_CALIBRATION_REPORT_SUMMARY_KEYS, RISK_CALIBRATION_REPORT_VERSION, RISK_CALIBRATION_REPORT_V3_SUMMARY_ROOT_KEYS, SUPPORTED_RISK_CALIBRATION_DATASET_VERSIONS, } from "../packages/contracts/risk-calibration.mjs";
+export const RISK_CALIBRATION_SUMMARY_SCHEMA = RISK_CALIBRATION_REPORT_SCHEMA;
+export const RISK_CALIBRATION_SUMMARY_VERSION = RISK_CALIBRATION_REPORT_VERSION;
+export const RISK_CALIBRATION_SUMMARY_MAX_BYTES = MAX_RISK_CALIBRATION_SUMMARY_BYTES;
+export const RISK_CALIBRATION_SUMMARY_MAX_RECORDS = MAX_RISK_CALIBRATION_RECORDS;
 export const RISK_CALIBRATION_SUMMARY_MIN_STRATUM_SAMPLE = 20;
 export const RISK_CALIBRATION_SUMMARY_THRESHOLDS = Object.freeze([...new Set([40, 50, 60, RISK_REVIEW_THRESHOLD, 80, 90])].sort((left, right) => left - right));
 export const RISK_CALIBRATION_SUMMARY_INTERPRETATION = 'This offline replay compares heuristic Risk scores with analyst dispositions. It does not prove maliciousness or safety.';
-const ROOT_KEYS = new Set([
-    'schema', 'version', 'mode', 'generatedAt', 'dataset', 'riskModelVersion',
-    'currentReviewThreshold', 'summary', 'thresholds', 'strata',
-    'modelComparison', 'privacy', 'interpretation',
-]);
-const DATASET_KEYS = new Set(['schema', 'version', 'recordCount']);
-const SUMMARY_KEYS = new Set(['total', 'positive', 'negative', 'excluded', 'scoreBands']);
-const SCORE_BAND_KEYS = new Set(['not_scored', '0_39', '40_69', '70_100']);
-const METRIC_KEYS = new Set([
-    'threshold', 'truePositive', 'falsePositive', 'trueNegative', 'falseNegative',
-    'precision', 'recall', 'specificity', 'falsePositiveRate', 'f1',
-    'balancedAccuracy', 'confidence95',
-]);
-const CONFIDENCE_KEYS = new Set(['precision', 'recall', 'specificity']);
-const INTERVAL_KEYS = new Set(['lower', 'upper']);
-const STRATUM_KEYS = new Set(['dimension', 'value', 'sampleCount', 'insufficientSample', 'metrics']);
-const MODEL_COMPARISON_KEYS = new Set([
-    'available', 'previousModelVersion', 'currentModelVersion', 'scoresChanged',
-    'bandsChanged', 'thresholdClassificationsChanged',
-]);
-const PRIVACY_KEYS = new Set(['targetsRetained', 'identifiersRetained', 'rawEvidenceRetained']);
-const INTERPRETATION_KEYS = new Set(['authority', 'statement', 'automaticTuning', 'networkRequests', 'persisted']);
+const ROOT_KEYS = new Set(RISK_CALIBRATION_REPORT_V3_SUMMARY_ROOT_KEYS);
+const DATASET_KEYS = new Set(RISK_CALIBRATION_REPORT_DATASET_KEYS);
+const SUMMARY_KEYS = new Set(RISK_CALIBRATION_REPORT_SUMMARY_KEYS);
+const SCORE_BAND_KEYS = new Set(RISK_CALIBRATION_REPORT_SCORE_BAND_KEYS);
+const METRIC_KEYS = new Set(RISK_CALIBRATION_REPORT_METRIC_KEYS);
+const CONFIDENCE_KEYS = new Set(RISK_CALIBRATION_REPORT_CONFIDENCE_KEYS);
+const INTERVAL_KEYS = new Set(RISK_CALIBRATION_REPORT_INTERVAL_KEYS);
+const STRATUM_KEYS = new Set(RISK_CALIBRATION_REPORT_STRATUM_KEYS);
+const MODEL_COMPARISON_KEYS = new Set(RISK_CALIBRATION_REPORT_MODEL_COMPARISON_KEYS);
+const PRIVACY_KEYS = new Set(RISK_CALIBRATION_REPORT_PRIVACY_KEYS);
+const INTERPRETATION_KEYS = new Set(RISK_CALIBRATION_REPORT_INTERPRETATION_KEYS);
 const REVIEW_REASON_VALUES = new Set([...ANALYST_REVIEW_REASON_VALUES, 'not_recorded']);
 const SCAN_DEPTH_VALUES = new Set(['deep', 'fast', 'unknown']);
 const CONTROL_RE = /[\x00-\x1f\x7f]/u;
@@ -51,13 +41,15 @@ function boundedCount(value, label, maximum = RISK_CALIBRATION_SUMMARY_MAX_RECOR
     return Number(value);
 }
 function modelVersion(value, label) {
-    if (!Number.isSafeInteger(value) || Number(value) < 1 || Number(value) > 100) {
+    if (!Number.isSafeInteger(value) || Number(value) < 1 || Number(value) > MAX_RISK_CALIBRATION_MODEL_VERSION) {
         throw new Error(`${label} must be a supported positive model version.`);
     }
     return Number(value);
 }
 function canonicalTimestamp(value, label) {
-    if (typeof value !== 'string' || value.length > 64 || !Number.isFinite(Date.parse(value))) {
+    if (typeof value !== 'string'
+        || value.length > MAX_RISK_CALIBRATION_TIMESTAMP_LENGTH
+        || !Number.isFinite(Date.parse(value))) {
         throw new Error(`${label} must be a valid date and time.`);
     }
     const canonical = new Date(value).toISOString();
@@ -154,7 +146,12 @@ export function parseRiskCalibrationSummaryReport(raw) {
     let parsed;
     try {
         const withoutBom = raw.replace(/^\uFEFF/u, '');
-        scanBoundedJson(withoutBom);
+        scanBoundedJson(withoutBom, {
+            maximumDepth: MAX_RISK_CALIBRATION_JSON_DEPTH,
+            maximumKeys: MAX_RISK_CALIBRATION_JSON_KEYS,
+            maximumValues: MAX_RISK_CALIBRATION_JSON_VALUES,
+            maximumContainerItems: MAX_RISK_CALIBRATION_JSON_CONTAINER_ITEMS,
+        });
         parsed = JSON.parse(withoutBom);
     }
     catch (reason) {
@@ -172,7 +169,9 @@ export function parseRiskCalibrationSummaryReport(raw) {
     }
     const dataset = object(root.dataset, 'Risk calibration dataset metadata');
     exactKeys(dataset, DATASET_KEYS, 'Risk calibration dataset metadata');
-    if (dataset.schema !== 'whoisleuth.risk-calibration-dataset' || (dataset.version !== 1 && dataset.version !== 2)) {
+    if (dataset.schema !== RISK_CALIBRATION_DATASET_SCHEMA
+        || typeof dataset.version !== 'number'
+        || !SUPPORTED_RISK_CALIBRATION_DATASET_VERSIONS.includes(dataset.version)) {
         throw new Error('Risk calibration dataset metadata has an unsupported schema or version.');
     }
     const recordCount = boundedCount(dataset.recordCount, 'Risk calibration dataset record count');
@@ -210,7 +209,7 @@ export function parseRiskCalibrationSummaryReport(raw) {
         throw new Error('Risk calibration summary must contain the fixed threshold set exactly once.');
     }
     const thresholds = Object.freeze(root.thresholds.map((value, index) => thresholdMetrics(value, `Threshold ${index + 1}`, RISK_CALIBRATION_SUMMARY_THRESHOLDS[index], positive + negative, positive, negative)));
-    if (!Array.isArray(root.strata) || root.strata.length > 32) {
+    if (!Array.isArray(root.strata) || root.strata.length > MAX_RISK_CALIBRATION_SUMMARY_STRATA) {
         throw new Error('Risk calibration strata must be a bounded array.');
     }
     const seenStrata = new Set();
@@ -221,7 +220,10 @@ export function parseRiskCalibrationSummaryReport(raw) {
         if (stratum.dimension !== 'review_reason' && stratum.dimension !== 'scan_depth') {
             throw new Error(`${label} has an unsupported dimension.`);
         }
-        if (typeof stratum.value !== 'string' || !stratum.value || stratum.value.length > 64 || CONTROL_RE.test(stratum.value)) {
+        if (typeof stratum.value !== 'string'
+            || !stratum.value
+            || stratum.value.length > MAX_RISK_CALIBRATION_REVIEW_REASON_LENGTH
+            || CONTROL_RE.test(stratum.value)) {
             throw new Error(`${label} has an invalid value.`);
         }
         const allowedValues = stratum.dimension === 'review_reason' ? REVIEW_REASON_VALUES : SCAN_DEPTH_VALUES;
@@ -290,7 +292,7 @@ export function parseRiskCalibrationSummaryReport(raw) {
         mode: 'summary',
         generatedAt: canonicalTimestamp(root.generatedAt, 'Risk calibration generation time'),
         dataset: Object.freeze({
-            schema: 'whoisleuth.risk-calibration-dataset',
+            schema: RISK_CALIBRATION_DATASET_SCHEMA,
             version: dataset.version,
             recordCount,
         }),

package/lib/risk-scoring.mjs

@@ -97,8 +97,9 @@ function scoreQuality(input) {
     if ([input.hasPasswordField, input.hasExternalFormAction].some(hasBoolean) || typeof input.phishingLanguageMatch === 'string') {
         observedFamilies.push('credential-lure');
     }
-    if (input.threatIntelligence !== undefined && input.threatIntelligence !== null)
+    if (calibrateExternalIntelligenceRisk(input.threatIntelligence, input.domain).eligibleProviderCount > 0) {
         observedFamilies.push('external-intelligence');
+    }
     if ([input.hasMx, input.hasSpf, input.hasDmarc].some(hasBoolean)
         || typeof input.activityStatus === 'string'
         || typeof input.domainAgeDays === 'number')
@@ -156,7 +157,7 @@ function explainRiskScoreInternal(input, excludedFamily) {
     else if (input.hasExternalFormAction === true) {
         add('credential-lure', 'External form destination observed without a password field', 0);
     }
-    const external = calibrateExternalIntelligenceRisk(input.threatIntelligence);
+    const external = calibrateExternalIntelligenceRisk(input.threatIntelligence, input.domain);
     if (external.factor)
         add('external-intelligence', external.factor.label, external.contribution);
     const primaryFamilies = ['domain-resemblance', 'brand-presentation', 'credential-lure', 'external-intelligence']
@@ -279,7 +280,7 @@ export function explainRiskScoreV6(input) {
     }
     if (contextual.size >= 2)
         add('corroboration', `Corroborating context across ${contextual.size} distinct evidence families`, contextual.size >= 3 ? 20 : 10);
-    const external = calibrateExternalIntelligenceRisk(input.threatIntelligence);
+    const external = calibrateExternalIntelligenceRisk(input.threatIntelligence, input.domain);
     if (external.factor)
         add('external-intelligence', external.factor.label, external.contribution);
     if (input.activityStatus === 'active')

package/lib/safe-fetch.mjs

@@ -434,34 +434,43 @@ async function readTextCapped(res, maxBytes, options = {}) {
         throw new Error('Response body does not expose a bounded readable stream');
     }
     const reader = res.body.getReader();
-    const decoder = new TextDecoder();
+    const decoder = new TextDecoder('utf-8', { fatal: options.fatalUtf8 === true });
     let text = '';
     let received = 0;
     let truncated = false;
-    while (received < maxBytes) {
-        const { done, value } = await reader.read();
-        if (done)
-            break;
-        const remaining = maxBytes - received;
-        const captured = value.subarray(0, remaining);
-        hasher?.update(captured);
-        received += captured.byteLength;
-        text += decoder.decode(captured, { stream: true });
-        if (captured.byteLength < value.byteLength) {
-            truncated = true;
-            break;
+    try {
+        while (received < maxBytes) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            const remaining = maxBytes - received;
+            const captured = value.subarray(0, remaining);
+            hasher?.update(captured);
+            received += captured.byteLength;
+            text += decoder.decode(captured, { stream: true });
+            if (captured.byteLength < value.byteLength) {
+                truncated = true;
+                break;
+            }
+        }
+        // If the cap was hit, one more read() tells us whether there was actually
+        // more data left (truncated) or the body just happened to end right there.
+        if (!truncated && received >= maxBytes) {
+            const { done } = await reader.read();
+            if (!done)
+                truncated = true;
         }
+        text += decoder.decode();
+        return result(text, truncated, received);
     }
-    // If the cap was hit, one more read() tells us whether there was actually
-    // more data left (truncated) or the body just happened to end right there.
-    if (!truncated && received >= maxBytes) {
-        const { done } = await reader.read();
-        if (!done)
-            truncated = true;
+    finally {
+        try {
+            reader.cancel().catch(() => { });
+        }
+        finally {
+            reader.releaseLock();
+        }
     }
-    reader.cancel().catch(() => { });
-    text += decoder.decode();
-    return result(text, truncated, received);
 }
 // Binary-safe counterpart to readTextCapped, for a response body that isn't
 // text (a favicon image) - collects raw bytes into a Buffer instead of
@@ -476,26 +485,39 @@ async function readBytesCapped(res, maxBytes) {
     const chunks = [];
     let received = 0;
     let truncated = false;
-    while (received < maxBytes) {
-        const { done, value } = await reader.read();
-        if (done)
-            break;
-        const remaining = maxBytes - received;
-        const captured = value.subarray(0, remaining);
-        received += captured.byteLength;
-        chunks.push(Buffer.from(captured));
-        if (captured.byteLength < value.byteLength) {
-            truncated = true;
-            break;
+    // Cancel unread body data and release the exclusive reader lock on every
+    // exit path, exactly as readTextCapped does. A mid-stream read failure (an
+    // upstream reset while fetching an untrusted favicon) must not leave the
+    // response locked to this reader.
+    try {
+        while (received < maxBytes) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            const remaining = maxBytes - received;
+            const captured = value.subarray(0, remaining);
+            received += captured.byteLength;
+            chunks.push(Buffer.from(captured));
+            if (captured.byteLength < value.byteLength) {
+                truncated = true;
+                break;
+            }
+        }
+        // Same "one more read() to check for leftover data" trick as readTextCapped.
+        if (!truncated && received >= maxBytes) {
+            const { done } = await reader.read();
+            if (!done)
+                truncated = true;
         }
+        return { bytes: Buffer.concat(chunks), truncated, bytesRead: received };
     }
-    // Same "one more read() to check for leftover data" trick as readTextCapped.
-    if (!truncated && received >= maxBytes) {
-        const { done } = await reader.read();
-        if (!done)
-            truncated = true;
+    finally {
+        try {
+            reader.cancel().catch(() => { });
+        }
+        finally {
+            reader.releaseLock();
+        }
     }
-    reader.cancel().catch(() => { });
-    return { bytes: Buffer.concat(chunks), truncated, bytesRead: received };
 }
 export { MAX_REDIRECTS, MAX_SAFE_FETCH_URL_LENGTH, MAX_SAFE_FETCH_ADDRESS_CANDIDATES, safeFetch, safeFetchDetailed, readTextCapped, readBytesCapped, isPrivateAddress, resolvePublicAddresses, };

package/lib/security-txt.mjs

@@ -4,7 +4,7 @@
 // Risk. Published contact and policy values are normalized into a small,
 // bounded record; the response body itself is discarded after parsing.
 import { safeFetchDetailed, readTextCapped } from "./safe-fetch.mjs";
-import { createObservation } from "./observation.mjs";
+import { createObservation } from "../packages/evidence/observation.mjs";
 const SECURITY_TXT_VERSION = 1;
 const SECURITY_TXT_PATH = '/.well-known/security.txt';
 const SECURITY_TXT_TIMEOUT_MS = 6_000;

package/lib/smtp-transport-review.mjs

@@ -11,6 +11,7 @@ import * as tls from 'node:tls';
 import { DNS_TYPE_A, DNS_TYPE_AAAA, DNS_TYPE_CNAME, DNS_TYPE_TLSA, DnssecQuerySession, collectValidatedRrset, normalizeDnsName, normalizeResolverEndpoint, parseDnssecTrustAnchor, validateDnssecChainWithContext, } from "./dnssec-chain-validation.mjs";
 import { isPrivateAddress } from "./safe-fetch.mjs";
 import { analyzeTlsaEvidence } from "./tlsa-evidence.mjs";
+import { normalizeExplicitIsoTimestamp, normalizeLegacyIsoTimestamp } from "../packages/evidence/observation.mjs";
 const MAIL_TRANSPORT_INPUT_SCHEMA = 'whoisleuth.mail-transport.input';
 const MAIL_TRANSPORT_INPUT_VERSION = 1;
 const MAIL_TRANSPORT_REVIEW_SCHEMA = 'whoisleuth.cli.mail-transport-review';
@@ -45,10 +46,12 @@ function exactRecord(value, keys, label) {
         throw new TypeError(`${label} contains unsupported field "${unexpected}".`);
     return record;
 }
-function timestamp(value, label) {
-    if (typeof value !== 'string' || value.length > 64 || !Number.isFinite(Date.parse(value)))
-        throw new TypeError(`${label} must be one ISO-compatible timestamp.`);
-    return new Date(value).toISOString();
+function timestamp(value, label, legacy = false) {
+    const normalized = normalizeExplicitIsoTimestamp(value)
+        ?? (legacy ? normalizeLegacyIsoTimestamp(value) : null);
+    if (!normalized)
+        throw new TypeError(`${label} must be one bounded ISO timestamp${legacy ? '' : ' with an explicit timezone'}.`);
+    return normalized;
 }
 function text(value, label, maximum = 160) {
     if (typeof value !== 'string' || value.length > maximum * 4)
@@ -70,7 +73,7 @@ function policyEvidence(value, label) {
     if (!allowedStates.includes(state) || !['complete', 'partial', 'unavailable'].includes(completeness))
         throw new TypeError(`policyContext.${label} has an unsupported state or completeness.`);
     const source = record.source === null ? null : text(record.source, `policyContext.${label}.source`, 160);
-    const observedAt = record.observedAt === null ? null : timestamp(record.observedAt, `policyContext.${label}.observedAt`);
+    const observedAt = record.observedAt === null ? null : timestamp(record.observedAt, `policyContext.${label}.observedAt`, true);
     const unavailable = completeness === 'unavailable';
     if ((unavailable && (source !== null || observedAt !== null)) || (!unavailable && (source === null || observedAt === null))) {
         throw new TypeError(`policyContext.${label} unavailable evidence must omit source and time; retained evidence requires both.`);

package/lib/sslbl-intelligence.mjs

@@ -3,6 +3,8 @@
 // positive match, but a stale miss remains inconclusive.
 import { SSLBL_CERTIFICATE_SNAPSHOT } from "./sslbl-certificates.generated.mjs";
 import { createHash } from 'node:crypto';
+import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
+import { SSLBL_SNAPSHOT_SCHEMA, SSLBL_SNAPSHOT_VERSION, } from "../packages/contracts/sslbl-snapshot.mjs";
 export const SSLBL_INTELLIGENCE_VERSION = 1;
 export const SSLBL_SNAPSHOT_MAX_AGE_MS = 14 * 24 * 60 * 60 * 1000;
 export const SSLBL_SNAPSHOT_EXPIRED_AGE_MS = 45 * 24 * 60 * 60 * 1000;
@@ -11,7 +13,6 @@ export const MAX_SSLBL_FINGERPRINT_CHUNKS = 1_000;
 export const SSLBL_SOURCE_PAGE = 'https://sslbl.abuse.ch/blacklist/';
 const SHA1_RE = /^[a-f0-9]{40}$/u;
 const SHA256_RE = /^[a-f0-9]{64}$/u;
-const SNAPSHOT_SCHEMA = 'whoisleuth.sslbl-certificate-snapshot';
 const SNAPSHOT_SOURCE = 'https://sslbl.abuse.ch/blacklist/sslblacklist.csv';
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value)
@@ -19,10 +20,7 @@ function record(value) {
         : {};
 }
 function timestamp(value) {
-    if (typeof value !== 'string' || value.length > 64)
-        return null;
-    const parsed = Date.parse(value);
-    return Number.isFinite(parsed) ? new Date(parsed).toISOString() : null;
+    return normalizeExplicitIsoTimestamp(value);
 }
 function normalizedFingerprint(value) {
     if (typeof value !== 'string')
@@ -39,8 +37,8 @@ function validateSnapshot(value) {
     const candidate = record(value);
     const sourceUpdatedAt = timestamp(candidate.sourceUpdatedAt);
     const generatedAt = timestamp(candidate.generatedAt);
-    if (candidate.schema !== SNAPSHOT_SCHEMA
-        || candidate.version !== 1
+    if (candidate.schema !== SSLBL_SNAPSHOT_SCHEMA
+        || candidate.version !== SSLBL_SNAPSHOT_VERSION
         || candidate.source !== SNAPSHOT_SOURCE
         || !sourceUpdatedAt
         || !generatedAt
@@ -95,7 +93,7 @@ function effectiveNow(value) {
         : typeof value === 'number'
             ? value
             : typeof value === 'string'
-                ? Date.parse(value)
+                ? Date.parse(normalizeExplicitIsoTimestamp(value) ?? '')
                 : Date.now();
     return Number.isFinite(candidate) ? candidate : Date.now();
 }