@slicedearth/whoisleuth-cli 2.0.1 → 2.1.0

package/lib/lookup.mjs

@@ -6,136 +6,21 @@
 // just performed. This module fetches each registration source once and feeds
 // those exact results into availability classification.
 import { fetchRdapRecord, fetchRegistrarRdapRecord } from "./rdap.mjs";
-import { buildWhoisChain, parseWhoisChain } from "./whois.mjs";
-import { OPERATION_BUDGET_ERROR_CODE } from "./operation-budget.mjs";
+import { buildWhoisChain } from "./whois.mjs";
 import { checkDomainAvailability } from "./availability.mjs";
 import { abortable } from "./abort.mjs";
-import { collectDnsIntelligence, collectReverseDnsIntelligence, failedReverseDnsIntelligence, skippedReverseDnsIntelligence, } from "./dns-intelligence.mjs";
+import { collectDnsIntelligence, collectReverseDnsIntelligence, } from "./dns-intelligence.mjs";
 import { createSelectedDnsResolvers } from "./dns-resolver-selection.mjs";
 import { collectObservedNetworkContext } from "./observed-network-context.mjs";
-import { collectSecurityTxt, securityTxtUnavailable } from "./security-txt.mjs";
-import { registryAccessDiagnosticFor } from "./registry-capabilities.mjs";
-import { FEATURE_DISABLED_ERROR_CODE, featureDecision, networkFeaturePolicy } from "./feature-policy.mjs";
+import { collectSecurityTxt } from "./security-txt.mjs";
+import { featureDecision, networkFeaturePolicy } from "./feature-policy.mjs";
 import { lookupUrlscanDomain } from "./urlscan-intelligence.mjs";
 import { lookupUrlhausDomain } from "./urlhaus-intelligence.mjs";
 import { lookupThreatfoxDomain } from "./threatfox-intelligence.mjs";
-import { THREATFOX_PROVIDER, URLHAUS_PROVIDER, URLSCAN_PROVIDER, } from "./lookup-threat-provider-inventory.mjs";
-import { createThreatIntelligenceResult } from "./threat-intelligence-contract.mjs";
-import { THREAT_INTELLIGENCE_ENVELOPE_VERSION } from "./threat-intelligence-types.mjs";
-import { buildRegistryInsights } from "./registry-insights.mjs";
 import { inspectSslblCertificate } from "./sslbl-intelligence.mjs";
 import { normalizeLookupSourceSettlement, plannedLookupProgressSources, } from "./lookup-source-progress.mjs";
-import { buildBulkComparisonEvidence } from "./bulk-comparison-evidence.mjs";
-const LOOKUP_DIAGNOSTICS_VERSION = 8;
-const LOOKUP_LEGACY_DIAGNOSTICS_VERSION = 7;
-const LOOKUP_TIMING_VERSION = 1;
-const MAX_LOOKUP_TIMING_MS = 120_000;
-const LOOKUP_TIMING_SOURCE_ORDER = Object.freeze([
-    'rdap',
-    'whois',
-    'domain_evidence',
-    'reverse_dns',
-    'registrar_rdap',
-    'network_context',
-    'security_txt',
-    'external_intelligence',
-    'malware_host_intelligence',
-    'malware_ioc_intelligence',
-]);
-const LOOKUP_ERROR_CODES = Object.freeze({
-    AUTH_REQUIRED: 'AUTH_REQUIRED',
-    RATE_LIMITED: 'RATE_LIMITED',
-    CONCURRENCY_LIMITED: OPERATION_BUDGET_ERROR_CODE,
-    FEATURE_DISABLED: FEATURE_DISABLED_ERROR_CODE,
-    MISSING_QUERY: 'MISSING_QUERY',
-    INVALID_QUERY: 'INVALID_QUERY',
-    LOOKUP_FAILED: 'LOOKUP_FAILED',
-    RDAP_UPSTREAM_FAILED: 'RDAP_UPSTREAM_FAILED',
-    RDAP_UNSUPPORTED: 'RDAP_UNSUPPORTED',
-    WHOIS_UPSTREAM_FAILED: 'WHOIS_UPSTREAM_FAILED',
-    AVAILABILITY_CHECK_FAILED: 'AVAILABILITY_CHECK_FAILED',
-});
-function errorMessage(err, fallback) {
-    const message = err && typeof err === 'object' && 'message' in err
-        ? err.message
-        : null;
-    return String(message || fallback);
-}
-function boundedSourceDetail(err, fallback) {
-    return errorMessage(err, fallback)
-        .replace(/[\u0000-\u001f\u007f]+/g, ' ')
-        .replace(/\s+/g, ' ')
-        .trim()
-        .slice(0, 240) || fallback;
-}
-function withoutNestedPublicationMetadata(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        return value;
-    const output = { ...value };
-    delete output.publicationMetadata;
-    return output;
-}
-function withoutNestedDeliveryMetadata(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        return value;
-    const output = { ...value };
-    if (output.response && typeof output.response === 'object' && !Array.isArray(output.response)) {
-        const response = { ...output.response };
-        delete response.deliveryMetadata;
-        output.response = response;
-    }
-    return output;
-}
-function boundedTimingMs(value) {
-    if (!Number.isFinite(value))
-        return 0;
-    return Math.min(MAX_LOOKUP_TIMING_MS, Math.max(0, Math.round(value)));
-}
-function createLookupTimingTracker(enabled, now) {
-    const lookupStartedAt = now();
-    const entries = new Map();
-    function measure(source, operation) {
-        const sourceStartedAt = now();
-        return Promise.resolve()
-            .then(operation)
-            .then((value) => {
-            const finishedAt = now();
-            entries.set(source, {
-                source,
-                outcome: 'fulfilled',
-                durationMs: boundedTimingMs(finishedAt - sourceStartedAt),
-                completedAfterMs: boundedTimingMs(finishedAt - lookupStartedAt),
-            });
-            return value;
-        }, (error) => {
-            const finishedAt = now();
-            entries.set(source, {
-                source,
-                outcome: 'rejected',
-                durationMs: boundedTimingMs(finishedAt - sourceStartedAt),
-                completedAfterMs: boundedTimingMs(finishedAt - lookupStartedAt),
-            });
-            throw error;
-        });
-    }
-    return {
-        measure(source, operation) {
-            return enabled ? measure(source, operation) : Promise.resolve().then(operation);
-        },
-        snapshot() {
-            if (!enabled)
-                return null;
-            const totalMs = boundedTimingMs(now() - lookupStartedAt);
-            return {
-                version: LOOKUP_TIMING_VERSION,
-                totalMs,
-                sources: LOOKUP_TIMING_SOURCE_ORDER
-                    .map((source) => entries.get(source))
-                    .filter((entry) => Boolean(entry)),
-            };
-        },
-    };
-}
+import { buildUnifiedLookupResponse } from "./lookup-response.mjs";
+import { createLookupTimingTracker } from "./lookup-diagnostics.mjs";
 async function runUnifiedLookup(classified, options = {}) {
     const fetchRdap = options.fetchRdapRecord || fetchRdapRecord;
     const fetchRegistrarRdap = options.fetchRegistrarRdapRecord || fetchRegistrarRdapRecord;
@@ -286,330 +171,30 @@ async function runUnifiedLookup(classified, options = {}) {
             void Promise.resolve(sourcePromise).then((value) => notify(source, 'fulfilled', value), (error) => notify(source, 'rejected', error));
         }
     }
-    const [rdapResult, whoisResult, availabilityResult, reverseDnsResult, registrarRdapResult, networkContextResult, securityTxtResult, urlscanIntelligenceResult, urlhausIntelligenceResult, threatfoxIntelligenceResult] = await Promise.allSettled([
-        rdapPromise,
-        whoisPromise,
+    return buildUnifiedLookupResponse({
+        availabilityEnabled,
         availabilityPromise,
-        reverseDnsPromise,
-        registrarRdapPromise,
+        classified,
+        compact,
+        dnsIntelligenceEnabled,
+        fast,
+        inspectCertificateWarningData,
         networkContextPromise,
+        options,
+        rdapEnabled,
+        rdapPromise,
+        registrarRdapPromise,
+        reverseDnsEligible,
+        reverseDnsPromise,
         securityTxtPromise,
-        urlscanIntelligencePromise,
-        urlhausIntelligencePromise,
+        skipWhois,
         threatfoxIntelligencePromise,
-    ]);
-    options.signal?.throwIfAborted();
-    const rdapRecord = rdapResult.status === 'fulfilled' ? rdapResult.value : null;
-    const whoisChain = whoisResult.status === 'fulfilled' ? whoisResult.value : null;
-    const rdapAttempts = rdapRecord && Array.isArray(rdapRecord.attempts)
-        ? rdapRecord.attempts
-        : rdapResult.status === 'rejected' && Array.isArray(rdapResult.reason?.attempts)
-            ? rdapResult.reason.attempts
-            : [];
-    let registrarRdap = null;
-    const registryRdapUsable = rdapRecord && rdapRecord.upstreamStatus === 200 && rdapRecord.parsed;
-    if (classified.type === 'domain' && rdapEnabled && !compact && registryRdapUsable) {
-        if (fast) {
-            registrarRdap = {
-                status: 'skipped',
-                detail: 'Registrar RDAP is omitted in fast RDAP-only mode.',
-                endpoint: null,
-                transportSecurity: null,
-                upstreamStatus: null,
-                fetchedAt: null,
-                attempt: null,
-            };
-        }
-        else if (registrarRdapResult.status === 'fulfilled') {
-            registrarRdap = registrarRdapResult.value;
-        }
-        else {
-            registrarRdap = registrarRdapResult.reason?.registrarRdap || {
-                status: 'error',
-                detail: boundedSourceDetail(registrarRdapResult.reason, 'Registrar RDAP lookup failed'),
-                endpoint: null,
-                transportSecurity: null,
-                upstreamStatus: null,
-                fetchedAt: null,
-                attempt: null,
-            };
-        }
-    }
-    const rdap = !rdapEnabled
-        ? { skipped: true, detail: 'RDAP is disabled by deployment policy.' }
-        : rdapRecord
-            ? { ...rdapRecord, ...(registrarRdap ? { registrarRdap } : {}) }
-            : {
-                error: rdapResult.status === 'rejected'
-                    ? boundedSourceDetail(rdapResult.reason, 'RDAP lookup failed')
-                    : 'No RDAP registry found for this query via IANA bootstrap',
-                attempts: rdapAttempts,
-            };
-    let whois;
-    if (!whoisEnabled) {
-        whois = { skipped: true, detail: 'WHOIS is disabled by deployment policy.' };
-    }
-    else if (skipWhois) {
-        whois = { skipped: true, detail: 'WHOIS is omitted in fast RDAP-only mode.' };
-    }
-    else if (Array.isArray(whoisChain)) {
-        whois = { chain: whoisChain, parsed: parseWhoisChain(whoisChain) };
-    }
-    else {
-        whois = {
-            error: whoisResult.status === 'rejected'
-                ? boundedSourceDetail(whoisResult.reason, 'WHOIS lookup failed')
-                : 'WHOIS returned no referral chain',
-        };
-    }
-    let availability = { applicable: false, type: classified.type };
-    if (classified.type === 'domain') {
-        if (!availabilityEnabled) {
-            availability = {
-                applicable: true,
-                domain: classified.value,
-                state: 'unknown',
-                confidence: 'low',
-                disabled: true,
-                detail: 'Availability analysis is disabled by deployment policy.',
-            };
-        }
-        else if (availabilityResult.status === 'fulfilled') {
-            const result = availabilityResult.value;
-            availability = {
-                applicable: true,
-                domain: classified.value,
-                inputHostname: classified.inputHostname,
-                registrableDomain: classified.registrableDomain,
-                isSubdomain: classified.isSubdomain,
-                ...result,
-            };
-        }
-        else {
-            availability = {
-                applicable: true,
-                domain: classified.value,
-                state: 'unknown',
-                confidence: 'low',
-                detail: errorMessage(availabilityResult.reason, 'Availability lookup failed'),
-            };
-        }
-    }
-    const rdapStatus = !rdapEnabled
-        ? 'disabled'
-        : rdapResult.status === 'rejected'
-            ? 'error'
-            : !rdapRecord
-                ? 'unsupported'
-                : rdapRecord.upstreamStatus === 404 ? 'not_found' : 'success';
-    const whoisStatus = !whoisEnabled
-        ? 'disabled'
-        : skipWhois
-            ? 'skipped'
-            : whoisResult.status === 'rejected' || !Array.isArray(whoisChain)
-                ? 'error'
-                : whoisChain.length === 1
-                    ? 'unsupported'
-                    : whois.parsed && whois.parsed.chainStatus === 'complete' ? 'complete' : 'partial';
-    const availabilityStatus = classified.type !== 'domain'
-        ? 'not_applicable'
-        : !availabilityEnabled ? 'disabled'
-            : availabilityResult.status === 'rejected' ? 'error' : 'complete';
-    const reverseDns = reverseDnsEligible
-        ? !dnsIntelligenceEnabled
-            ? skippedReverseDnsIntelligence()
-            : reverseDnsResult.status === 'fulfilled' && reverseDnsResult.value
-                ? reverseDnsResult.value
-                : failedReverseDnsIntelligence(reverseDnsResult.status === 'rejected'
-                    ? reverseDnsResult.reason
-                    : 'Reverse DNS lookup returned no result')
-        : null;
-    // This is static access-policy context only. It performs no network work and
-    // is deliberately excluded from compact Bulk responses and from every
-    // availability input.
-    const registryAccess = classified.type === 'domain' && !compact
-        ? registryAccessDiagnosticFor(classified.value)
-        : null;
-    const networkContext = networkContextPromise && networkContextResult.status === 'fulfilled'
-        ? networkContextResult.value
-        : null;
-    const securityTxt = securityTxtPromise
-        ? securityTxtResult.status === 'fulfilled'
-            ? securityTxtResult.value
-            : securityTxtUnavailable(classified.inputHostname, securityTxtResult.reason)
-        : null;
-    // SSLBL comparison is an exact, local, deep-only enrichment over the leaf
-    // certificate already observed by the bounded TLS collector. It performs no
-    // request, never contributes to availability, and is omitted from compact
-    // Bulk and monitoring responses.
-    const sslbl = classified.type === 'domain' && !fast && !compact
-        ? inspectCertificateWarningData(availability && typeof availability.tls === 'object' ? availability.tls : null, {
-            ...(options.sslblSnapshot === undefined ? {} : { snapshot: options.sslblSnapshot }),
-            ...(options.sslblNow === undefined ? {} : { now: options.sslblNow }),
-        })
-        : null;
-    const networkContextRdap = networkContext && typeof networkContext.rdap === 'object' && networkContext.rdap
-        ? networkContext.rdap
-        : null;
-    const networkContextEndpoint = networkContext && typeof networkContext.endpoint === 'object' && networkContext.endpoint
-        ? networkContext.endpoint
-        : null;
-    const lookupTiming = timing.snapshot();
-    const diagnostics = {
-        version: lookupTiming ? LOOKUP_DIAGNOSTICS_VERSION : LOOKUP_LEGACY_DIAGNOSTICS_VERSION,
-        ...(lookupTiming ? { timing: lookupTiming } : {}),
-        ...(registryAccess ? { registryAccess } : {}),
-        rdap: {
-            status: rdapStatus,
-            errorCode: rdapStatus === 'disabled'
-                ? LOOKUP_ERROR_CODES.FEATURE_DISABLED
-                : rdapStatus === 'error'
-                    ? LOOKUP_ERROR_CODES.RDAP_UPSTREAM_FAILED
-                    : rdapStatus === 'unsupported' ? LOOKUP_ERROR_CODES.RDAP_UNSUPPORTED : null,
-            endpoint: rdapRecord ? rdapRecord.rdapServer || null : null,
-            transportSecurity: rdapRecord ? rdapRecord.transportSecurity || null : null,
-            httpStatus: rdapRecord ? rdapRecord.upstreamStatus ?? null : null,
-            fetchedAt: rdapRecord ? rdapRecord.fetchedAt || null : null,
-            attempts: rdapAttempts,
-            ...(registrarRdap ? {
-                registrar: {
-                    status: registrarRdap.status,
-                    endpoint: registrarRdap.endpoint || null,
-                    transportSecurity: registrarRdap.transportSecurity || null,
-                    httpStatus: registrarRdap.upstreamStatus ?? null,
-                    fetchedAt: registrarRdap.fetchedAt || null,
-                    attempt: registrarRdap.attempt || null,
-                },
-            } : {}),
-        },
-        whois: {
-            status: whoisStatus,
-            errorCode: whoisStatus === 'disabled'
-                ? LOOKUP_ERROR_CODES.FEATURE_DISABLED
-                : whoisStatus === 'error' ? LOOKUP_ERROR_CODES.WHOIS_UPSTREAM_FAILED : null,
-            queriedAt: Array.isArray(whoisChain) && whoisChain[0] ? whoisChain[0].queriedAt || null : null,
-            authoritativeHop: whois.parsed ? whois.parsed.authoritativeHop || null : null,
-            failedHop: whois.parsed ? whois.parsed.failedHop || null : null,
-            conflictingHop: whois.parsed ? whois.parsed.conflictingHop || null : null,
-        },
-        availability: {
-            status: availabilityStatus,
-            errorCode: availabilityStatus === 'disabled'
-                ? LOOKUP_ERROR_CODES.FEATURE_DISABLED
-                : availabilityStatus === 'error' ? LOOKUP_ERROR_CODES.AVAILABILITY_CHECK_FAILED : null,
-            resultState: availability.applicable === true ? availability.state || 'unknown' : null,
-        },
-        ...(reverseDns ? {
-            reverseDns: {
-                status: reverseDns.status,
-                observedAt: reverseDns.observedAt,
-                complete: reverseDns.complete,
-                truncated: reverseDns.truncated,
-            },
-        } : {}),
-        ...(networkContext ? {
-            network: {
-                status: networkContext.status,
-                address: networkContextEndpoint?.address || null,
-                family: networkContextEndpoint?.family || null,
-                addressSource: networkContextEndpoint?.selectedFrom || null,
-                endpoint: networkContextRdap?.endpoint || null,
-                transportSecurity: networkContextRdap?.transportSecurity || null,
-                httpStatus: networkContextRdap?.httpStatus ?? null,
-                fetchedAt: networkContextRdap?.fetchedAt || null,
-                attempts: networkContextRdap?.attempts || [],
-            },
-        } : {}),
-        ...(securityTxt ? {
-            securityTxt: {
-                status: securityTxt.status,
-                state: securityTxt.state,
-                endpoint: securityTxt.finalUrl,
-                httpStatus: securityTxt.httpStatus,
-                observedAt: securityTxt.observedAt,
-                complete: securityTxt.complete,
-                truncated: securityTxt.truncated,
-            },
-        } : {}),
-        ...(sslbl ? {
-            sslbl: {
-                status: sslbl.status,
-                verdict: sslbl.verdict,
-                observedAt: sslbl.observedAt,
-                complete: sslbl.complete,
-                snapshotUpdatedAt: sslbl.snapshot.sourceUpdatedAt,
-            },
-        } : {}),
-    };
-    // Bulk triage only consumes the derived availability evidence and source
-    // diagnostics. Omitting raw RDAP JSON and multi-hop WHOIS bodies from that
-    // opt-in response prevents large scans from downloading and retaining the
-    // same registry payloads the backend already used to build `availability`.
-    if (compact) {
-        const bulkComparison = !fast
-            ? buildBulkComparisonEvidence(availability)
-            : null;
-        const { credentialSurfaceProfile: _credentialSurfaceProfile, structuredDataIdentity: _structuredDataIdentity, technologyProfile: _technologyProfile, pageRoleProfile: _pageRoleProfile, clientBehaviorProfile: _clientBehaviorProfile, securityPosture: _securityPosture, pageIdentity: richPageIdentity, http: richHttp, ...compactAvailability } = availability;
-        return {
-            availability: {
-                ...compactAvailability,
-                ...(richPageIdentity !== undefined ? { pageIdentity: withoutNestedPublicationMetadata(richPageIdentity) } : {}),
-                ...(richHttp !== undefined ? { http: withoutNestedDeliveryMetadata(richHttp) } : {}),
-                ...(bulkComparison ? { bulkComparison } : {}),
-            },
-            diagnostics,
-        };
-    }
-    const targetDomain = classified.registrableDomain || classified.value;
-    const threatIntelligenceProviders = [];
-    if (urlscanIntelligencePromise) {
-        threatIntelligenceProviders.push(urlscanIntelligenceResult.status === 'fulfilled' && urlscanIntelligenceResult.value
-            ? urlscanIntelligenceResult.value
-            : createThreatIntelligenceResult(URLSCAN_PROVIDER, { type: 'domain', value: targetDomain }, { state: 'error', detail: 'Archived provider intelligence could not be completed.' }));
-    }
-    if (urlhausIntelligencePromise) {
-        threatIntelligenceProviders.push(urlhausIntelligenceResult.status === 'fulfilled' && urlhausIntelligenceResult.value
-            ? urlhausIntelligenceResult.value
-            : createThreatIntelligenceResult(URLHAUS_PROVIDER, { type: 'domain', value: targetDomain }, { state: 'error', detail: 'Malware-host intelligence could not be completed.' }));
-    }
-    if (threatfoxIntelligencePromise) {
-        threatIntelligenceProviders.push(threatfoxIntelligenceResult.status === 'fulfilled' && threatfoxIntelligenceResult.value
-            ? threatfoxIntelligenceResult.value
-            : createThreatIntelligenceResult(THREATFOX_PROVIDER, { type: 'domain', value: targetDomain }, { state: 'error', detail: 'Malware-IOC intelligence could not be completed.' }));
-    }
-    const threatIntelligence = threatIntelligenceProviders.length
-        ? { version: THREAT_INTELLIGENCE_ENVELOPE_VERSION, providers: threatIntelligenceProviders }
-        : null;
-    const registrarRdapParsed = registrarRdap
-        && typeof registrarRdap.parsed === 'object'
-        && registrarRdap.parsed
-        && !Array.isArray(registrarRdap.parsed)
-        ? registrarRdap.parsed
-        : null;
-    const registryInsights = classified.type === 'domain' && !fast && !compact
-        ? buildRegistryInsights({
-            rdapParsed: rdapRecord?.parsed,
-            rdapStatus,
-            rdapFetchedAt: rdapRecord?.fetchedAt,
-            whoisParsed: whois.parsed,
-            whoisStatus,
-            whoisQueriedAt: Array.isArray(whoisChain) && whoisChain[0] ? whoisChain[0].queriedAt : null,
-            registrarRdapParsed,
-            registrarRdapStatus: registrarRdap?.status,
-            registrarRdapFetchedAt: registrarRdap?.fetchedAt,
-        })
-        : null;
-    return {
-        rdap,
-        whois,
-        availability,
-        diagnostics,
-        ...(registryInsights ? { registryInsights } : {}),
-        ...(reverseDns ? { reverseDns } : {}),
-        ...(networkContext ? { networkContext } : {}),
-        ...(securityTxt ? { securityTxt } : {}),
-        ...(sslbl ? { sslbl } : {}),
-        ...(threatIntelligence ? { threatIntelligence } : {}),
-    };
+        timing,
+        urlhausIntelligencePromise,
+        urlscanIntelligencePromise,
+        whoisEnabled,
+        whoisPromise,
+    });
 }
-export { runUnifiedLookup, LOOKUP_DIAGNOSTICS_VERSION, LOOKUP_LEGACY_DIAGNOSTICS_VERSION, LOOKUP_TIMING_VERSION, MAX_LOOKUP_TIMING_MS, LOOKUP_ERROR_CODES, };
+export { runUnifiedLookup };
+export { LOOKUP_DIAGNOSTICS_VERSION, LOOKUP_LEGACY_DIAGNOSTICS_VERSION, LOOKUP_TIMING_VERSION, MAX_LOOKUP_TIMING_MS, LOOKUP_ERROR_CODES, } from "./lookup-diagnostics.mjs";

package/lib/page-role-profile.mjs

@@ -3,10 +3,8 @@
 // descriptions only; it does not retain page text, arbitrary attributes, URLs,
 // or matched markup, and it never treats a role as proof of intent or safety.
 import { createObservation } from "../packages/evidence/observation.mjs";
+import { MAX_PAGE_ROLE_EVIDENCE, MAX_PAGE_ROLE_FINDINGS, PAGE_ROLE_PROFILE_VERSION, } from "./lookup-child-profile-contract.mjs";
 import { analyzeStaticHtml, } from "./static-html-analysis.mjs";
-const PAGE_ROLE_PROFILE_VERSION = 1;
-const MAX_PAGE_ROLE_FINDINGS = 4;
-const MAX_PAGE_ROLE_EVIDENCE = 4;
 const MAX_ROLE_TITLE_CHARS = 200;
 const CONTROL_CHARACTER_RE = /[\u0000-\u001f\u007f]/;
 function boundedLowercase(value, maximum) {

package/lib/registrar-standing-catalogue-contract.mjs

@@ -0,0 +1,70 @@
+import { defineSchemaCompatibility } from "../packages/contracts/schema-compatibility.mjs";
+export const REGISTRAR_STANDING_CATALOGUE_SCHEMA = 'whoisleuth.registrar-standing-catalogue';
+export const REGISTRAR_STANDING_CATALOGUE_VERSION = 1;
+export const MAX_REGISTRAR_STANDING_CATALOGUE_BYTES = 512 * 1024;
+export const REGISTRAR_STANDING_MAX_AGE_DAYS = 14;
+export const REGISTRAR_STANDING_MAX_FUTURE_SKEW_MS = 5 * 60 * 1_000;
+export const IANA_REGISTRAR_SOURCE_URL = 'https://www.iana.org/assignments/registrar-ids/registrar-ids-1.csv';
+export const ICANN_COMPLIANCE_SOURCE_URL = 'https://www.icann.org/compliance/notices';
+export const REGISTRAR_STANDING_AUDIT_SCHEMA = 'whoisleuth.registrar-standing-drift-audit';
+export const REGISTRAR_STANDING_AUDIT_VERSION = 1;
+export const MAX_REGISTRAR_STANDING_AUDIT_BYTES = 32 * 1024;
+export function registrarStandingOfficialSourceUrl(value, source, noticeId = null) {
+    if (typeof value !== 'string' || value.length > 2_048)
+        return null;
+    try {
+        const parsed = new URL(value);
+        if (parsed.protocol !== 'https:'
+            || parsed.username
+            || parsed.password
+            || parsed.port
+            || parsed.search
+            || parsed.hash)
+            return null;
+        if (source === 'iana_catalogue') {
+            return parsed.href === IANA_REGISTRAR_SOURCE_URL ? parsed.href : null;
+        }
+        if (source === 'icann_index') {
+            return parsed.href === ICANN_COMPLIANCE_SOURCE_URL ? parsed.href : null;
+        }
+        const identifier = typeof noticeId === 'string'
+            ? /^notice-([1-9]\d{0,7})$/u.exec(noticeId)?.[1]
+            : null;
+        return identifier
+            && parsed.hostname === 'www.icann.org'
+            && new RegExp(`^/uploads/compliance_notice/attachment/${identifier}/[A-Za-z0-9._~-]+\\.pdf$`, 'u').test(parsed.pathname)
+            ? parsed.href
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+export const REGISTRAR_STANDING_CATALOGUE_COMPATIBILITY = defineSchemaCompatibility({
+    id: 'derived.registrar-standing-catalogue',
+    kind: 'derived',
+    schema: REGISTRAR_STANDING_CATALOGUE_SCHEMA,
+    currentVersion: REGISTRAR_STANDING_CATALOGUE_VERSION,
+    supportedVersions: [REGISTRAR_STANDING_CATALOGUE_VERSION],
+    acceptsUnversionedLegacy: false,
+    futureVersionBehavior: 'reject',
+    migration: 'exact_current_only',
+    writeSemantics: 'normalized_rewrite',
+    byteBudget: MAX_REGISTRAR_STANDING_CATALOGUE_BYTES,
+    owner: 'lib/registrar-standing-catalogue-contract.mts',
+    note: 'Checked-in target-free IANA accreditation and current-year ICANN compliance projection refreshed only by the bounded maintainer command.',
+});
+export const REGISTRAR_STANDING_AUDIT_COMPATIBILITY = defineSchemaCompatibility({
+    id: 'maintainer.registrar-standing-drift-audit',
+    kind: 'cli_document',
+    schema: REGISTRAR_STANDING_AUDIT_SCHEMA,
+    currentVersion: REGISTRAR_STANDING_AUDIT_VERSION,
+    supportedVersions: [REGISTRAR_STANDING_AUDIT_VERSION],
+    acceptsUnversionedLegacy: false,
+    futureVersionBehavior: 'not_applicable',
+    migration: 'read_only',
+    writeSemantics: 'read_only',
+    byteBudget: MAX_REGISTRAR_STANDING_AUDIT_BYTES,
+    owner: 'lib/registrar-standing-catalogue-contract.mts',
+    note: 'Target-free two-source drift report that compares bounded normalized official projections without modifying the checked-in catalogue.',
+});