@slicedearth/whoisleuth-cli 2.0.1 → 2.2.0

package/lib/lookup-contract-primitives.mjs

@@ -0,0 +1,98 @@
+// Shared strict primitives for the Lookup response envelope and its owned
+// child-profile contracts. These checks validate without normalising or
+// copying untrusted values.
+import { MAX_OBSERVATION_DIAGNOSTICS } from "../packages/evidence/observation.mjs";
+import { MAX_HTTP_PROVENANCE_URL } from "./http-evidence-bounds.mjs";
+const LOOKUP_CONTROL_CHAR_RE = /[\u0000-\u001f\u007f-\u009f]|\p{Default_Ignorable_Code_Point}/u;
+const MAX_LOOKUP_CONTRACT_HOST_LENGTH = 253;
+function isJsonObject(value) {
+    return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+}
+function validBoundedString(value, maximum, allowEmpty = false) {
+    return typeof value === 'string'
+        && (allowEmpty || Boolean(value))
+        && value.length <= maximum
+        && !LOOKUP_CONTROL_CHAR_RE.test(value);
+}
+function validUint(value, maximum) {
+    return Number.isSafeInteger(value) && Number(value) >= 0 && Number(value) <= maximum;
+}
+function validStringArray(value, maximumItems, maximumLength) {
+    return Array.isArray(value)
+        && value.length <= maximumItems
+        && value.every((item) => validBoundedString(item, maximumLength));
+}
+function validOptionalNullableText(value, maximumLength) {
+    return value === undefined || value === null || validBoundedString(value, maximumLength);
+}
+function validHttpProvenanceUrl(value) {
+    if (typeof value !== 'string'
+        || !value
+        || value.length > MAX_HTTP_PROVENANCE_URL
+        || LOOKUP_CONTROL_CHAR_RE.test(value))
+        return false;
+    try {
+        const parsed = new URL(value);
+        return ['http:', 'https:'].includes(parsed.protocol)
+            && Boolean(parsed.hostname)
+            && !parsed.username
+            && !parsed.password
+            && !parsed.search
+            && !parsed.hash
+            && parsed.href === value;
+    }
+    catch {
+        return false;
+    }
+}
+function normalizedDomain(value) {
+    if (typeof value !== 'string'
+        || !value.trim()
+        || value.length > MAX_LOOKUP_CONTRACT_HOST_LENGTH
+        || LOOKUP_CONTROL_CHAR_RE.test(value)
+        || /[\s/?#@\\:]/u.test(value)) {
+        return null;
+    }
+    try {
+        const parsed = new URL(`https://${value.trim().replace(/\.$/u, '')}/`);
+        const hostname = parsed.hostname.toLowerCase().replace(/\.$/u, '');
+        const labels = hostname.split('.');
+        return labels.length >= 2
+            && hostname.length <= MAX_LOOKUP_CONTRACT_HOST_LENGTH
+            && labels.every((label) => (label.length <= 63
+                && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/u.test(label)))
+            ? hostname
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+function validObservationDiagnosticValue(value, depth = 0) {
+    if (typeof value === 'boolean')
+        return true;
+    if (typeof value === 'number')
+        return Number.isFinite(value);
+    if (typeof value === 'string') {
+        return value.length <= 240 && !LOOKUP_CONTROL_CHAR_RE.test(value);
+    }
+    if (!isJsonObject(value) || depth >= 2)
+        return false;
+    const keys = Object.keys(value);
+    return keys.length <= 6
+        && keys.every((key) => ['status', 'error', 'detail', 'truncated', 'discarded', 'count'].includes(key))
+        && keys.every((key) => validObservationDiagnosticValue(value[key], depth + 1));
+}
+function validObservationDiagnostics(value) {
+    if (value === undefined)
+        return true;
+    if (!isJsonObject(value))
+        return false;
+    const entries = Object.entries(value);
+    return entries.length <= MAX_OBSERVATION_DIAGNOSTICS
+        && entries.every(([key, item]) => (Boolean(key)
+            && key.length <= 40
+            && /^[a-z0-9_-]+$/iu.test(key)
+            && validObservationDiagnosticValue(item)));
+}
+export { LOOKUP_CONTROL_CHAR_RE, isJsonObject, normalizedDomain, validBoundedString, validHttpProvenanceUrl, validObservationDiagnostics, validOptionalNullableText, validStringArray, validUint, };

package/lib/lookup-diagnostics.mjs

@@ -0,0 +1,96 @@
+// Lookup diagnostics, bounded source errors and optional deep-lookup timing.
+import { OPERATION_BUDGET_ERROR_CODE } from "./operation-budget.mjs";
+import { FEATURE_DISABLED_ERROR_CODE } from "./feature-policy.mjs";
+const LOOKUP_DIAGNOSTICS_VERSION = 8;
+const LOOKUP_LEGACY_DIAGNOSTICS_VERSION = 7;
+const LOOKUP_TIMING_VERSION = 1;
+const MAX_LOOKUP_TIMING_MS = 120_000;
+const LOOKUP_TIMING_SOURCE_ORDER = Object.freeze([
+    'rdap',
+    'whois',
+    'domain_evidence',
+    'reverse_dns',
+    'registrar_rdap',
+    'network_context',
+    'security_txt',
+    'external_intelligence',
+    'malware_host_intelligence',
+    'malware_ioc_intelligence',
+]);
+const LOOKUP_ERROR_CODES = Object.freeze({
+    AUTH_REQUIRED: 'AUTH_REQUIRED',
+    RATE_LIMITED: 'RATE_LIMITED',
+    CONCURRENCY_LIMITED: OPERATION_BUDGET_ERROR_CODE,
+    FEATURE_DISABLED: FEATURE_DISABLED_ERROR_CODE,
+    MISSING_QUERY: 'MISSING_QUERY',
+    INVALID_QUERY: 'INVALID_QUERY',
+    LOOKUP_FAILED: 'LOOKUP_FAILED',
+    RDAP_UPSTREAM_FAILED: 'RDAP_UPSTREAM_FAILED',
+    RDAP_UNSUPPORTED: 'RDAP_UNSUPPORTED',
+    WHOIS_UPSTREAM_FAILED: 'WHOIS_UPSTREAM_FAILED',
+    AVAILABILITY_CHECK_FAILED: 'AVAILABILITY_CHECK_FAILED',
+});
+function errorMessage(err, fallback) {
+    const message = err && typeof err === 'object' && 'message' in err
+        ? err.message
+        : null;
+    return String(message || fallback);
+}
+function boundedSourceDetail(err, fallback) {
+    return errorMessage(err, fallback)
+        .replace(/[\u0000-\u001f\u007f]+/g, ' ')
+        .replace(/\s+/g, ' ')
+        .trim()
+        .slice(0, 240) || fallback;
+}
+function boundedTimingMs(value) {
+    if (!Number.isFinite(value))
+        return 0;
+    return Math.min(MAX_LOOKUP_TIMING_MS, Math.max(0, Math.round(value)));
+}
+function createLookupTimingTracker(enabled, now) {
+    const lookupStartedAt = now();
+    const entries = new Map();
+    function measure(source, operation) {
+        const sourceStartedAt = now();
+        return Promise.resolve()
+            .then(operation)
+            .then((value) => {
+            const finishedAt = now();
+            entries.set(source, {
+                source,
+                outcome: 'fulfilled',
+                durationMs: boundedTimingMs(finishedAt - sourceStartedAt),
+                completedAfterMs: boundedTimingMs(finishedAt - lookupStartedAt),
+            });
+            return value;
+        }, (error) => {
+            const finishedAt = now();
+            entries.set(source, {
+                source,
+                outcome: 'rejected',
+                durationMs: boundedTimingMs(finishedAt - sourceStartedAt),
+                completedAfterMs: boundedTimingMs(finishedAt - lookupStartedAt),
+            });
+            throw error;
+        });
+    }
+    return {
+        measure(source, operation) {
+            return enabled ? measure(source, operation) : Promise.resolve().then(operation);
+        },
+        snapshot() {
+            if (!enabled)
+                return null;
+            const totalMs = boundedTimingMs(now() - lookupStartedAt);
+            return {
+                version: LOOKUP_TIMING_VERSION,
+                totalMs,
+                sources: LOOKUP_TIMING_SOURCE_ORDER
+                    .map((source) => entries.get(source))
+                    .filter((entry) => Boolean(entry)),
+            };
+        },
+    };
+}
+export { LOOKUP_DIAGNOSTICS_VERSION, LOOKUP_LEGACY_DIAGNOSTICS_VERSION, LOOKUP_TIMING_VERSION, MAX_LOOKUP_TIMING_MS, LOOKUP_ERROR_CODES, boundedSourceDetail, createLookupTimingTracker, errorMessage, };

package/lib/lookup-network-evidence-bounds.mjs

@@ -2,6 +2,7 @@
 // the Lookup response trust boundary, and the display projection.
 export const MAX_LOOKUP_DNS_RECORDS_PER_TYPE = 16;
 export const MAX_LOOKUP_REVERSE_DNS_PTR_RECORDS = 8;
+export const TLS_PROFILE_VERSION = 3;
 export const MAX_LOOKUP_TLS_CHAIN_CERTIFICATES = 8;
 export const MAX_LOOKUP_TLS_ALT_NAMES = 50;
 export const MAX_LOOKUP_TLS_NAME_VALUES = 4;

package/lib/lookup-response.mjs

@@ -0,0 +1,367 @@
+// Lookup result shaping after the source plan has settled. This module starts no
+// collection and preserves compact, diagnostics and enrichment response shapes.
+import { buildBulkComparisonEvidence } from "./bulk-comparison-evidence.mjs";
+import { failedReverseDnsIntelligence, skippedReverseDnsIntelligence, } from "./dns-intelligence.mjs";
+import { LOOKUP_DIAGNOSTICS_VERSION, LOOKUP_ERROR_CODES, LOOKUP_LEGACY_DIAGNOSTICS_VERSION, boundedSourceDetail, errorMessage, } from "./lookup-diagnostics.mjs";
+import { createThreatIntelligenceResult } from "./threat-intelligence-contract.mjs";
+import { THREATFOX_PROVIDER, URLHAUS_PROVIDER, URLSCAN_PROVIDER, } from "./lookup-threat-provider-inventory.mjs";
+import { THREAT_INTELLIGENCE_ENVELOPE_VERSION } from "./threat-intelligence-types.mjs";
+import { registryAccessDiagnosticFor } from "./registry-capabilities.mjs";
+import { buildRegistryInsights } from "./registry-insights.mjs";
+import { buildRegistrarStanding } from "./registrar-standing.mjs";
+import { resolveRegistrarIanaId } from "./registrar-standing-contract.mjs";
+import { securityTxtUnavailable } from "./security-txt.mjs";
+import { parseWhoisChain } from "./whois.mjs";
+function withoutNestedPublicationMetadata(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return value;
+    const output = { ...value };
+    delete output.publicationMetadata;
+    return output;
+}
+function withoutNestedDeliveryMetadata(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return value;
+    const output = { ...value };
+    if (output.response && typeof output.response === 'object' && !Array.isArray(output.response)) {
+        const response = { ...output.response };
+        delete response.deliveryMetadata;
+        output.response = response;
+    }
+    return output;
+}
+async function buildUnifiedLookupResponse(context) {
+    const { availabilityEnabled, availabilityPromise, classified, compact, dnsIntelligenceEnabled, fast, inspectCertificateWarningData, networkContextPromise, options, rdapEnabled, rdapPromise, registrarRdapPromise, reverseDnsEligible, reverseDnsPromise, securityTxtPromise, skipWhois, threatfoxIntelligencePromise, timing, urlhausIntelligencePromise, urlscanIntelligencePromise, whoisEnabled, whoisPromise, } = context;
+    const [rdapResult, whoisResult, availabilityResult, reverseDnsResult, registrarRdapResult, networkContextResult, securityTxtResult, urlscanIntelligenceResult, urlhausIntelligenceResult, threatfoxIntelligenceResult] = await Promise.allSettled([
+        rdapPromise,
+        whoisPromise,
+        availabilityPromise,
+        reverseDnsPromise,
+        registrarRdapPromise,
+        networkContextPromise,
+        securityTxtPromise,
+        urlscanIntelligencePromise,
+        urlhausIntelligencePromise,
+        threatfoxIntelligencePromise,
+    ]);
+    options.signal?.throwIfAborted();
+    const rdapRecord = rdapResult.status === 'fulfilled' ? rdapResult.value : null;
+    const whoisChain = whoisResult.status === 'fulfilled' ? whoisResult.value : null;
+    const rdapAttempts = rdapRecord && Array.isArray(rdapRecord.attempts)
+        ? rdapRecord.attempts
+        : rdapResult.status === 'rejected' && Array.isArray(rdapResult.reason?.attempts)
+            ? rdapResult.reason.attempts
+            : [];
+    let registrarRdap = null;
+    const registryRdapUsable = rdapRecord && rdapRecord.upstreamStatus === 200 && rdapRecord.parsed;
+    if (classified.type === 'domain' && rdapEnabled && !compact && registryRdapUsable) {
+        if (fast) {
+            registrarRdap = {
+                status: 'skipped',
+                detail: 'Registrar RDAP is omitted in fast RDAP-only mode.',
+                endpoint: null,
+                transportSecurity: null,
+                upstreamStatus: null,
+                fetchedAt: null,
+                attempt: null,
+            };
+        }
+        else if (registrarRdapResult.status === 'fulfilled') {
+            registrarRdap = registrarRdapResult.value;
+        }
+        else {
+            registrarRdap = registrarRdapResult.reason?.registrarRdap || {
+                status: 'error',
+                detail: boundedSourceDetail(registrarRdapResult.reason, 'Registrar RDAP lookup failed'),
+                endpoint: null,
+                transportSecurity: null,
+                upstreamStatus: null,
+                fetchedAt: null,
+                attempt: null,
+            };
+        }
+    }
+    const rdap = !rdapEnabled
+        ? { skipped: true, detail: 'RDAP is disabled by deployment policy.' }
+        : rdapRecord
+            ? { ...rdapRecord, ...(registrarRdap ? { registrarRdap } : {}) }
+            : {
+                error: rdapResult.status === 'rejected'
+                    ? boundedSourceDetail(rdapResult.reason, 'RDAP lookup failed')
+                    : 'No RDAP registry found for this query via IANA bootstrap',
+                attempts: rdapAttempts,
+            };
+    let whois;
+    if (!whoisEnabled) {
+        whois = { skipped: true, detail: 'WHOIS is disabled by deployment policy.' };
+    }
+    else if (skipWhois) {
+        whois = { skipped: true, detail: 'WHOIS is omitted in fast RDAP-only mode.' };
+    }
+    else if (Array.isArray(whoisChain)) {
+        whois = { chain: whoisChain, parsed: parseWhoisChain(whoisChain) };
+    }
+    else {
+        whois = {
+            error: whoisResult.status === 'rejected'
+                ? boundedSourceDetail(whoisResult.reason, 'WHOIS lookup failed')
+                : 'WHOIS returned no referral chain',
+        };
+    }
+    let availability = { applicable: false, type: classified.type };
+    if (classified.type === 'domain') {
+        if (!availabilityEnabled) {
+            availability = {
+                applicable: true,
+                domain: classified.value,
+                state: 'unknown',
+                confidence: 'low',
+                disabled: true,
+                detail: 'Availability analysis is disabled by deployment policy.',
+            };
+        }
+        else if (availabilityResult.status === 'fulfilled') {
+            const result = availabilityResult.value;
+            availability = {
+                applicable: true,
+                domain: classified.value,
+                inputHostname: classified.inputHostname,
+                registrableDomain: classified.registrableDomain,
+                isSubdomain: classified.isSubdomain,
+                ...result,
+            };
+        }
+        else {
+            availability = {
+                applicable: true,
+                domain: classified.value,
+                state: 'unknown',
+                confidence: 'low',
+                detail: errorMessage(availabilityResult.reason, 'Availability lookup failed'),
+            };
+        }
+    }
+    const rdapStatus = !rdapEnabled
+        ? 'disabled'
+        : rdapResult.status === 'rejected'
+            ? 'error'
+            : !rdapRecord
+                ? 'unsupported'
+                : rdapRecord.upstreamStatus === 404 ? 'not_found' : 'success';
+    const whoisStatus = !whoisEnabled
+        ? 'disabled'
+        : skipWhois
+            ? 'skipped'
+            : whoisResult.status === 'rejected' || !Array.isArray(whoisChain)
+                ? 'error'
+                : whoisChain.length === 1
+                    ? 'unsupported'
+                    : whois.parsed && whois.parsed.chainStatus === 'complete' ? 'complete' : 'partial';
+    const availabilityStatus = classified.type !== 'domain'
+        ? 'not_applicable'
+        : !availabilityEnabled ? 'disabled'
+            : availabilityResult.status === 'rejected' ? 'error' : 'complete';
+    const reverseDns = reverseDnsEligible
+        ? !dnsIntelligenceEnabled
+            ? skippedReverseDnsIntelligence()
+            : reverseDnsResult.status === 'fulfilled' && reverseDnsResult.value
+                ? reverseDnsResult.value
+                : failedReverseDnsIntelligence(reverseDnsResult.status === 'rejected'
+                    ? reverseDnsResult.reason
+                    : 'Reverse DNS lookup returned no result')
+        : null;
+    // This is static access-policy context only. It performs no network work and
+    // is deliberately excluded from compact Bulk responses and from every
+    // availability input.
+    const registryAccess = classified.type === 'domain' && !compact
+        ? registryAccessDiagnosticFor(classified.value)
+        : null;
+    const networkContext = networkContextPromise && networkContextResult.status === 'fulfilled'
+        ? networkContextResult.value
+        : null;
+    const securityTxt = securityTxtPromise
+        ? securityTxtResult.status === 'fulfilled'
+            ? securityTxtResult.value
+            : securityTxtUnavailable(classified.inputHostname, securityTxtResult.reason)
+        : null;
+    // SSLBL comparison is an exact, local, deep-only enrichment over the leaf
+    // certificate already observed by the bounded TLS collector. It performs no
+    // request, never contributes to availability, and is omitted from compact
+    // Bulk and monitoring responses.
+    const sslbl = classified.type === 'domain' && !fast && !compact
+        ? inspectCertificateWarningData(availability && typeof availability.tls === 'object' ? availability.tls : null, {
+            ...(options.sslblSnapshot === undefined ? {} : { snapshot: options.sslblSnapshot }),
+            ...(options.sslblNow === undefined ? {} : { now: options.sslblNow }),
+        })
+        : null;
+    const networkContextRdap = networkContext && typeof networkContext.rdap === 'object' && networkContext.rdap
+        ? networkContext.rdap
+        : null;
+    const networkContextEndpoint = networkContext && typeof networkContext.endpoint === 'object' && networkContext.endpoint
+        ? networkContext.endpoint
+        : null;
+    const lookupTiming = timing.snapshot();
+    const diagnostics = {
+        version: lookupTiming ? LOOKUP_DIAGNOSTICS_VERSION : LOOKUP_LEGACY_DIAGNOSTICS_VERSION,
+        ...(lookupTiming ? { timing: lookupTiming } : {}),
+        ...(registryAccess ? { registryAccess } : {}),
+        rdap: {
+            status: rdapStatus,
+            errorCode: rdapStatus === 'disabled'
+                ? LOOKUP_ERROR_CODES.FEATURE_DISABLED
+                : rdapStatus === 'error'
+                    ? LOOKUP_ERROR_CODES.RDAP_UPSTREAM_FAILED
+                    : rdapStatus === 'unsupported' ? LOOKUP_ERROR_CODES.RDAP_UNSUPPORTED : null,
+            endpoint: rdapRecord ? rdapRecord.rdapServer || null : null,
+            transportSecurity: rdapRecord ? rdapRecord.transportSecurity || null : null,
+            httpStatus: rdapRecord ? rdapRecord.upstreamStatus ?? null : null,
+            fetchedAt: rdapRecord ? rdapRecord.fetchedAt || null : null,
+            attempts: rdapAttempts,
+            ...(registrarRdap ? {
+                registrar: {
+                    status: registrarRdap.status,
+                    endpoint: registrarRdap.endpoint || null,
+                    transportSecurity: registrarRdap.transportSecurity || null,
+                    httpStatus: registrarRdap.upstreamStatus ?? null,
+                    fetchedAt: registrarRdap.fetchedAt || null,
+                    attempt: registrarRdap.attempt || null,
+                },
+            } : {}),
+        },
+        whois: {
+            status: whoisStatus,
+            errorCode: whoisStatus === 'disabled'
+                ? LOOKUP_ERROR_CODES.FEATURE_DISABLED
+                : whoisStatus === 'error' ? LOOKUP_ERROR_CODES.WHOIS_UPSTREAM_FAILED : null,
+            queriedAt: Array.isArray(whoisChain) && whoisChain[0] ? whoisChain[0].queriedAt || null : null,
+            authoritativeHop: whois.parsed ? whois.parsed.authoritativeHop || null : null,
+            failedHop: whois.parsed ? whois.parsed.failedHop || null : null,
+            conflictingHop: whois.parsed ? whois.parsed.conflictingHop || null : null,
+        },
+        availability: {
+            status: availabilityStatus,
+            errorCode: availabilityStatus === 'disabled'
+                ? LOOKUP_ERROR_CODES.FEATURE_DISABLED
+                : availabilityStatus === 'error' ? LOOKUP_ERROR_CODES.AVAILABILITY_CHECK_FAILED : null,
+            resultState: availability.applicable === true ? availability.state || 'unknown' : null,
+        },
+        ...(reverseDns ? {
+            reverseDns: {
+                status: reverseDns.status,
+                observedAt: reverseDns.observedAt,
+                complete: reverseDns.complete,
+                truncated: reverseDns.truncated,
+            },
+        } : {}),
+        ...(networkContext ? {
+            network: {
+                status: networkContext.status,
+                address: networkContextEndpoint?.address || null,
+                family: networkContextEndpoint?.family || null,
+                addressSource: networkContextEndpoint?.selectedFrom || null,
+                endpoint: networkContextRdap?.endpoint || null,
+                transportSecurity: networkContextRdap?.transportSecurity || null,
+                httpStatus: networkContextRdap?.httpStatus ?? null,
+                fetchedAt: networkContextRdap?.fetchedAt || null,
+                attempts: networkContextRdap?.attempts || [],
+            },
+        } : {}),
+        ...(securityTxt ? {
+            securityTxt: {
+                status: securityTxt.status,
+                state: securityTxt.state,
+                endpoint: securityTxt.finalUrl,
+                httpStatus: securityTxt.httpStatus,
+                observedAt: securityTxt.observedAt,
+                complete: securityTxt.complete,
+                truncated: securityTxt.truncated,
+            },
+        } : {}),
+        ...(sslbl ? {
+            sslbl: {
+                status: sslbl.status,
+                verdict: sslbl.verdict,
+                observedAt: sslbl.observedAt,
+                complete: sslbl.complete,
+                snapshotUpdatedAt: sslbl.snapshot.sourceUpdatedAt,
+            },
+        } : {}),
+    };
+    // Bulk triage only consumes the derived availability evidence and source
+    // diagnostics. Omitting raw RDAP JSON and multi-hop WHOIS bodies from that
+    // opt-in response prevents large scans from downloading and retaining the
+    // same registry payloads the backend already used to build `availability`.
+    if (compact) {
+        const bulkComparison = !fast
+            ? buildBulkComparisonEvidence(availability)
+            : null;
+        const { credentialSurfaceProfile: _credentialSurfaceProfile, structuredDataIdentity: _structuredDataIdentity, technologyProfile: _technologyProfile, pageRoleProfile: _pageRoleProfile, clientBehaviorProfile: _clientBehaviorProfile, securityPosture: _securityPosture, pageIdentity: richPageIdentity, http: richHttp, ...compactAvailability } = availability;
+        return {
+            availability: {
+                ...compactAvailability,
+                ...(richPageIdentity !== undefined ? { pageIdentity: withoutNestedPublicationMetadata(richPageIdentity) } : {}),
+                ...(richHttp !== undefined ? { http: withoutNestedDeliveryMetadata(richHttp) } : {}),
+                ...(bulkComparison ? { bulkComparison } : {}),
+            },
+            diagnostics,
+        };
+    }
+    const targetDomain = classified.registrableDomain || classified.value;
+    const threatIntelligenceProviders = [];
+    if (urlscanIntelligencePromise) {
+        threatIntelligenceProviders.push(urlscanIntelligenceResult.status === 'fulfilled' && urlscanIntelligenceResult.value
+            ? urlscanIntelligenceResult.value
+            : createThreatIntelligenceResult(URLSCAN_PROVIDER, { type: 'domain', value: targetDomain }, { state: 'error', detail: 'Archived provider intelligence could not be completed.' }));
+    }
+    if (urlhausIntelligencePromise) {
+        threatIntelligenceProviders.push(urlhausIntelligenceResult.status === 'fulfilled' && urlhausIntelligenceResult.value
+            ? urlhausIntelligenceResult.value
+            : createThreatIntelligenceResult(URLHAUS_PROVIDER, { type: 'domain', value: targetDomain }, { state: 'error', detail: 'Malware-host intelligence could not be completed.' }));
+    }
+    if (threatfoxIntelligencePromise) {
+        threatIntelligenceProviders.push(threatfoxIntelligenceResult.status === 'fulfilled' && threatfoxIntelligenceResult.value
+            ? threatfoxIntelligenceResult.value
+            : createThreatIntelligenceResult(THREATFOX_PROVIDER, { type: 'domain', value: targetDomain }, { state: 'error', detail: 'Malware-IOC intelligence could not be completed.' }));
+    }
+    const threatIntelligence = threatIntelligenceProviders.length
+        ? { version: THREAT_INTELLIGENCE_ENVELOPE_VERSION, providers: threatIntelligenceProviders }
+        : null;
+    const registrarRdapParsed = registrarRdap
+        && typeof registrarRdap.parsed === 'object'
+        && registrarRdap.parsed
+        && !Array.isArray(registrarRdap.parsed)
+        ? registrarRdap.parsed
+        : null;
+    const registryInsights = classified.type === 'domain' && !fast && !compact
+        ? buildRegistryInsights({
+            rdapParsed: rdapRecord?.parsed,
+            rdapStatus,
+            rdapFetchedAt: rdapRecord?.fetchedAt,
+            whoisParsed: whois.parsed,
+            whoisStatus,
+            whoisQueriedAt: Array.isArray(whoisChain) && whoisChain[0] ? whoisChain[0].queriedAt : null,
+            registrarRdapParsed,
+            registrarRdapStatus: registrarRdap?.status,
+            registrarRdapFetchedAt: registrarRdap?.fetchedAt,
+        })
+        : null;
+    const registrarStanding = classified.type === 'domain' && !compact
+        ? buildRegistrarStanding({
+            registrarIanaId: resolveRegistrarIanaId(rdapRecord?.parsed, whois.parsed),
+        })
+        : null;
+    return {
+        rdap,
+        whois,
+        availability,
+        diagnostics,
+        ...(registryInsights ? { registryInsights } : {}),
+        ...(registrarStanding ? { registrarStanding } : {}),
+        ...(reverseDns ? { reverseDns } : {}),
+        ...(networkContext ? { networkContext } : {}),
+        ...(securityTxt ? { securityTxt } : {}),
+        ...(sslbl ? { sslbl } : {}),
+        ...(threatIntelligence ? { threatIntelligence } : {}),
+    };
+}
+export { buildUnifiedLookupResponse };