@slicedearth/whoisleuth-cli 2.2.0 → 2.3.0

package/lib/evidence-export.mjs

@@ -119,6 +119,7 @@ const LOOKUP_AVAILABILITY_PORTABLE_NESTED_KEYS = new Set([
     'scanMode', 'durationMs', 'complete', 'truncated', 'limitations',
     'diagnostics', 'detail', 'error', 'count', 'total', 'discarded', 'summary',
     'findings', 'id', 'label', 'tone', 'category', 'confidence', 'compatibility', 'role', 'roles', 'evidence',
+    'description',
     'value', 'values', 'name', 'type', 'types', 'mode', 'owner', 'target',
     'url', 'uri', 'href',
     'priority', 'ttl', 'records',
@@ -147,7 +148,8 @@ const LOOKUP_AVAILABILITY_PORTABLE_NESTED_KEYS = new Set([
     'chain', 'chainTruncated', 'standardName', 'size', 'subject', 'issuer',
     'serialNumber', 'validFrom', 'validTo', 'fingerprintSha1',
     'fingerprintSha256', 'isCertificateAuthority', 'subjectAltNames',
-    'dnsNames', 'ipAddresses', 'otherNames', 'publicKey', 'bits', 'curve',
+    'dnsNames', 'ipAddresses', 'otherNames', 'classes', 'dns', 'ip', 'directoryName',
+    'registeredId', 'otherName', 'publicKey', 'bits', 'curve',
     'signature', 'oid', 'extendedKeyUsage', 'authorityInformationAccess',
     'ocsp', 'caIssuers', 'unknownMethods', 'extensionProfile', 'parsed', 'partial',
     'certificatePolicies', 'crlDistributionPoints', 'commonNames',
@@ -161,7 +163,7 @@ const LOOKUP_AVAILABILITY_PORTABLE_NESTED_KEYS = new Set([
     'externalOrigins', 'embeddedOrigins', 'contactDomains', 'downloads',
     'explicitCount', 'riskyCount', 'riskyFileTypes', 'trackingIdentifiers',
     'fingerprints', 'fingerprintVersion', 'exact', 'normalizedHtml',
-    'visibleText', 'domStructure', 'formStructure', 'resourceHosts',
+    'visibleText', 'domStructure', 'similarity', 'formStructure', 'resourceHosts',
     'identifiers', 'featureCount', 'nodeCount', 'formCount', 'controlCount',
     'parser', 'tokenCount', 'tagsExamined', 'discardedUrls', 'formsObserved',
     'relationshipTagsExamined', 'relationshipUrlsDiscarded',
@@ -197,6 +199,9 @@ const LOOKUP_AVAILABILITY_PORTABLE_NESTED_KEYS = new Set([
 const LOOKUP_AVAILABILITY_CREDENTIAL_CATEGORY_KEYS = new Set([
     'password', 'email', 'username', 'one_time_code', 'payment',
 ]);
+const LOOKUP_AVAILABILITY_TLS_SAN_CLASS_KEYS = new Set([
+    'dns', 'ip', 'email', 'uri', 'directoryName', 'registeredId', 'otherName', 'unclassified',
+]);
 const LOOKUP_AVAILABILITY_VALUE_PATHS = new Set([
     'dns.records.caa',
     'dns.caaPolicy.records',
@@ -328,12 +333,12 @@ function projectLookupEvidencePrivacySafeTreeValue(value, state, depth) {
 export function projectLookupEvidencePrivacySafeTree(value) {
     return projectLookupEvidencePrivacySafeTreeValue(value, { entries: 0 }, 0);
 }
-function projectLookupEvidenceAvailabilityPublicValue(value, parentKey, state, depth) {
+function projectLookupEvidenceAvailabilityPublicValue(value, path, state, depth) {
     consumePortableProjectionEntry(state, depth);
     if (value === null || typeof value === 'boolean' || typeof value === 'number')
         return value;
     if (typeof value === 'string') {
-        const normalizedParent = normalizedEvidenceKey(parentKey || '');
+        const normalizedParent = normalizedEvidenceKey(path.at(-1) || '');
         if (PORTABLE_URL_KEYS.has(normalizedParent))
             return portableUri(value);
         if (PORTABLE_ORIGIN_COLLECTION_KEYS.has(normalizedParent))
@@ -342,7 +347,7 @@ function projectLookupEvidenceAvailabilityPublicValue(value, parentKey, state, d
     }
     if (Array.isArray(value)) {
         return value.slice(0, LOOKUP_EVIDENCE_PORTABLE_MAX_ARRAY_ITEMS)
-            .map((item) => projectLookupEvidenceAvailabilityPublicValue(item, parentKey, state, depth + 1));
+            .map((item) => projectLookupEvidenceAvailabilityPublicValue(item, path, state, depth + 1));
     }
     const source = recordOrNull(value);
     if (!source)
@@ -352,7 +357,31 @@ function projectLookupEvidenceAvailabilityPublicValue(value, parentKey, state, d
         if (!LOOKUP_AVAILABILITY_PORTABLE_NESTED_KEYS.has(key)
             || privateEvidenceKey(key, item))
             continue;
-        output[key] = projectLookupEvidenceAvailabilityPublicValue(item, key, state, depth + 1);
+        const parentPath = path.join('.');
+        const sanClassCount = parentPath === 'tls.certificate.subjectAltNames.classes'
+            && LOOKUP_AVAILABILITY_TLS_SAN_CLASS_KEYS.has(key)
+            && Number.isSafeInteger(item)
+            && Number(item) >= 0
+            && Number(item) <= LOOKUP_EVIDENCE_PORTABLE_MAX_ARRAY_ITEMS;
+        if (['dns', 'ip', 'directoryName', 'registeredId', 'otherName'].includes(key)
+            && !sanClassCount)
+            continue;
+        if (parentPath === 'tls.certificate.subjectAltNames.classes'
+            && LOOKUP_AVAILABILITY_TLS_SAN_CLASS_KEYS.has(key)
+            && !sanClassCount)
+            continue;
+        if (key === 'classes'
+            && (parentPath !== 'tls.certificate.subjectAltNames' || !recordOrNull(item)))
+            continue;
+        if (key === 'similarity'
+            && (parentPath !== 'pageIdentity.fingerprints.domStructure'
+                || (item !== null && !recordOrNull(item))))
+            continue;
+        if (key === 'description'
+            && (parentPath !== 'technologyProfile.findings.evidence'
+                || typeof item !== 'string'))
+            continue;
+        output[key] = projectLookupEvidenceAvailabilityPublicValue(item, [...path, key], state, depth + 1);
     }
     return output;
 }
@@ -381,11 +410,31 @@ function projectLookupEvidenceAvailabilityValue(value, path, state, depth) {
             || privateEvidenceKey(key, item))
             continue;
         const parentPath = path.join('.');
+        const boundedCount = Number.isSafeInteger(item)
+            && Number(item) >= 0
+            && Number(item) <= LOOKUP_EVIDENCE_PORTABLE_MAX_ARRAY_ITEMS;
+        const credentialCategoryCount = parentPath === 'credentialSurfaceProfile.inputs.categories'
+            && boundedCount;
+        const sanClassCount = parentPath === 'tls.certificate.subjectAltNames.classes'
+            && LOOKUP_AVAILABILITY_TLS_SAN_CLASS_KEYS.has(key)
+            && boundedCount;
         if (LOOKUP_AVAILABILITY_CREDENTIAL_CATEGORY_KEYS.has(key)
-            && (parentPath !== 'credentialSurfaceProfile.inputs.categories'
-                || !Number.isSafeInteger(item)
-                || Number(item) < 0
-                || Number(item) > LOOKUP_EVIDENCE_PORTABLE_MAX_ARRAY_ITEMS))
+            && !credentialCategoryCount
+            && !sanClassCount)
+            continue;
+        if (['dns', 'ip', 'directoryName', 'registeredId', 'otherName'].includes(key)
+            && !sanClassCount)
+            continue;
+        if (key === 'classes'
+            && (parentPath !== 'tls.certificate.subjectAltNames' || !recordOrNull(item)))
+            continue;
+        if (key === 'similarity'
+            && (parentPath !== 'pageIdentity.fingerprints.domStructure'
+                || (item !== null && !recordOrNull(item))))
+            continue;
+        if (key === 'description'
+            && (parentPath !== 'technologyProfile.findings.evidence'
+                || typeof item !== 'string'))
             continue;
         if (key === 'owner'
             && (!LOOKUP_AVAILABILITY_OWNER_PATHS.has(parentPath) || typeof item !== 'string'))
@@ -419,7 +468,7 @@ function projectLookupEvidenceAvailabilityWithKeys(value, rootKeys, registryCont
             continue;
         output[key] = currentPrivacyRules
             ? projectLookupEvidenceAvailabilityValue(item, [key], state, 1)
-            : projectLookupEvidenceAvailabilityPublicValue(item, key, state, 1);
+            : projectLookupEvidenceAvailabilityPublicValue(item, [key], state, 1);
     }
     if (registryContactsExcluded)
         output.registryContactsExcluded = true;

package/lib/evidence-report.mjs

@@ -331,7 +331,7 @@ function buildLookupEvidenceReport(document, options = {}) {
         : [];
     return {
         title: cleanReportText(titleTarget),
-        notice: 'Human-readable summary. The versioned JSON export remains the full-fidelity evidence package; raw RDAP JSON and WHOIS response bodies are deliberately omitted here.',
+        notice: 'Human-readable summary of the bounded, privacy-minimised JSON evidence package. Raw RDAP JSON, WHOIS response bodies, contact records, and other excluded collection data are not included in either artefact.',
         metadata: [
             reportField('Generated', report.generatedAt),
             reportField('Generator', application.version ? `${application.name || 'WHOISleuth'} ${application.version}` : application.name || 'WHOISleuth'),
@@ -432,7 +432,7 @@ function buildLookupEvidenceReport(document, options = {}) {
             'This report summarises point-in-time observations and registry publications. It does not prove ownership, activity, availability, or maliciousness.',
             'Missing, skipped, partial, unsupported, or failed sources are inconclusive rather than negative evidence.',
             'The Risk score is a versioned heuristic review priority, not a probability or determination of maliciousness. Review its listed factors and the underlying source states.',
-            'Raw registry payloads and full WHOIS referral responses are available only in the JSON evidence package and may contain public contact data.',
+            'The JSON evidence package is a bounded, privacy-minimised projection. It excludes raw registry and WHOIS payloads, contact records, authentication and session material, and unreviewed fields.',
             ...(networkContext.contextVersion === 1 ? [
                 'Observed network registration describes one point-in-time public endpoint. It may identify an edge or shared network rather than the origin host and does not prove control, ownership, intent, or maliciousness.',
             ] : []),

package/lib/html-signals.mjs

@@ -16,7 +16,6 @@ import { analyzeStaticHtml } from "./static-html-analysis.mjs";
 import { analyzeStructuredDataIdentity } from "./structured-data-identity.mjs";
 import { analyzeWebsiteTechnology } from "./website-technology.mjs";
 import { PAGE_PUBLICATION_LIMITATIONS, PAGE_PUBLICATION_METADATA_VERSION, } from "./homepage-metadata-contract.mjs";
-const MAX_TITLE_LENGTH = 200;
 const MAX_EXTERNAL_ASSET_HOSTS = 20;
 const MAX_IDENTITY_TAGS = 512;
 const MAX_IDENTITY_TAG_LENGTH = 4096;
@@ -37,10 +36,6 @@ const MAX_URLS_PER_TAG = 20;
 const PAGE_IDENTITY_VERSION = 3;
 const CONTROL_CHARACTER_RE = /[\u0000-\u001f\u007f-\u009f]|\p{Default_Ignorable_Code_Point}/gu;
 const HAS_CONTROL_CHARACTER_RE = /[\u0000-\u001f\u007f-\u009f]|\p{Default_Ignorable_Code_Point}/u;
-const TITLE_RE = /<title[^>]*>([\s\S]*?)<\/title>/i;
-// A password input is the single strongest static-HTML tell that a page is
-// asking for credentials, regardless of what it claims to be.
-const PASSWORD_FIELD_RE = /<input\b[^>]*\btype\s*=\s*["']?password["']?/i;
 // <img>/<script>/<link> tags loading a resource from an absolute, external
 // URL - a common phishing-kit tell is hotlinking the real brand's own logo/
 // CSS/JS instead of copying it. Relative URLs (the common case, same
@@ -102,12 +97,6 @@ function extractExternalAssetHosts(html, ownDomain) {
     }
     return [...hosts];
 }
-function extractPageTitle(html) {
-    const match = html.match(TITLE_RE);
-    if (!match)
-        return null;
-    return boundedHtmlText(match[1], MAX_TITLE_LENGTH, true);
-}
 function parseAttributes(tag) {
     const start = tag.search(/\s/);
     if (start === -1)
@@ -307,9 +296,10 @@ function trackingIdentifiers(html) {
     };
 }
 function extractPageRelationships(html, domain, options = {}) {
-    const baseUrl = resolvedBaseUrl(domain, options.baseUrl);
+    const documentUrl = resolvedBaseUrl(domain, options.baseUrl);
+    const baseUrl = resolvedBaseUrl(domain, options.effectiveBaseUrl ?? documentUrl);
     const markup = typeof options.tagMarkup === 'string' ? options.tagMarkup : markupForTagParsing(html);
-    const baseOrigin = new URL(baseUrl).origin;
+    const baseOrigin = options.documentOrigin ?? new URL(documentUrl).origin;
     const resourceKeys = new Set();
     const resourceOrigins = new Set();
     const embeddedOrigins = new Set();
@@ -454,11 +444,16 @@ function metaRefreshTarget(content) {
     return match ? (match[1] ?? match[2] ?? match[3] ?? '').trim() : null;
 }
 function extractPageIdentity(html, domain, options = {}) {
-    const baseUrl = resolvedBaseUrl(domain, options.baseUrl);
+    const documentUrl = resolvedBaseUrl(domain, options.baseUrl);
+    const baseAnalysis = options.effectiveBaseUrl === undefined
+        ? analyzeStaticHtml(html, { baseUrl: documentUrl })
+        : null;
+    const baseUrl = resolvedBaseUrl(domain, options.effectiveBaseUrl ?? baseAnalysis?.effectiveBaseUrl ?? documentUrl);
+    const baseHrefState = options.baseHrefState ?? baseAnalysis?.baseHrefState ?? 'absent';
     const tagMarkup = markupForTagParsing(html);
-    const parsedBase = new URL(baseUrl);
-    const baseOrigin = parsedBase.origin;
-    const baseUsesHttps = parsedBase.protocol === 'https:';
+    const parsedDocument = new URL(documentUrl);
+    const baseOrigin = options.documentOrigin ?? parsedDocument.origin;
+    const baseUsesHttps = parsedDocument.protocol === 'https:';
     const externalFormOrigins = new Set();
     let documentLanguage = null;
     let canonical = null;
@@ -556,20 +551,25 @@ function extractPageIdentity(html, domain, options = {}) {
     const queryOmitted = [canonical, metaRefresh, openGraphUrl].some((item) => item?.queryOmitted);
     const pathTruncated = [canonical, metaRefresh, openGraphUrl].some((item) => item?.pathTruncated);
     const sourceTruncated = options.sourceTruncated === true;
-    const relationships = extractPageRelationships(html, domain, { baseUrl, tagMarkup });
+    const relationships = extractPageRelationships(html, domain, { baseUrl: documentUrl, effectiveBaseUrl: baseUrl, documentOrigin: baseOrigin, tagMarkup });
     const fingerprints = createPageFingerprints(html, {
-        baseUrl,
+        // Retained fingerprint algorithms pre-date document-base handling. Keep
+        // their response-URL normalization stable until a versioned fingerprint
+        // migration is intentionally introduced.
+        baseUrl: documentUrl,
         exactBodyHash: options.exactBodyHash,
         sourceTruncated,
         resources: relationships.resources,
         trackingIdentifiers: relationships.trackingIdentifiers,
         identifiersTruncated: relationships.diagnostics.trackingIdentifiersTruncated === true,
     });
-    const truncated = sourceTruncated || tagLimitReached || formLimitReached || originLimitReached
+    const truncated = sourceTruncated || baseHrefState === 'invalid' || tagLimitReached || formLimitReached || originLimitReached
         || pathTruncated || relationships.truncated || fingerprints.truncated;
     const limitations = ['Static HTML metadata only; JavaScript-rendered changes are not evaluated.'];
     if (sourceTruncated)
         limitations.push('Homepage body capture reached its byte limit; identity fields may be incomplete.');
+    if (baseHrefState === 'invalid')
+        limitations.push('The first bounded document base URL was invalid; relative URL relationships use the response URL and remain partial.');
     if (tagLimitReached)
         limitations.push(`Page identity parsing reached the ${MAX_IDENTITY_TAGS}-tag or ${MAX_IDENTITY_TAG_LENGTH}-character tag limit.`);
     if (formLimitReached)
@@ -697,33 +697,37 @@ function buildPagePublicationMetadata(analysis, sourceTruncated) {
     };
 }
 function extractHtmlSignals(html, domain, options = {}) {
-    const pageIdentity = options.includePageIdentity === false ? null : extractPageIdentity(html, domain, options);
+    const documentUrl = resolvedBaseUrl(domain, options.baseUrl);
+    const htmlAnalysis = analyzeStaticHtml(html, { baseUrl: documentUrl, includeVisibleText: true });
+    const effectiveBaseUrl = htmlAnalysis.effectiveBaseUrl ?? documentUrl;
+    const documentOrigin = new URL(documentUrl).origin;
+    const pageIdentity = options.includePageIdentity === false ? null : extractPageIdentity(html, domain, {
+        ...options,
+        baseUrl: documentUrl,
+        effectiveBaseUrl,
+        documentOrigin,
+        baseHrefState: htmlAnalysis.baseHrefState,
+    });
     const includeCredentialSurfaceProfile = pageIdentity && options.includeCredentialSurfaceProfile === true;
     const includeStructuredDataIdentity = pageIdentity && options.includeStructuredDataIdentity !== false;
     const includeTechnologyProfile = pageIdentity && options.includeTechnologyProfile !== false;
     const includeDerivedPageProfiles = Boolean(pageIdentity);
-    const baseUrl = resolvedBaseUrl(domain, options.baseUrl);
-    const htmlAnalysis = includeCredentialSurfaceProfile || includeStructuredDataIdentity || includeTechnologyProfile || includeDerivedPageProfiles
-        ? analyzeStaticHtml(html, { baseUrl, includeVisibleText: true })
-        : null;
     const pageIdentityOutput = pageIdentity && htmlAnalysis && options.includePublicationMetadata !== false
         ? {
             ...pageIdentity,
             publicationMetadata: buildPagePublicationMetadata(htmlAnalysis.publicationMetadata, options.sourceTruncated === true),
         }
         : pageIdentity;
-    const pageLanguageSignal = detectPageLanguageSignal(html, pageIdentity?.documentLanguage, htmlAnalysis ?? undefined);
+    const pageLanguageSignal = detectPageLanguageSignal(html, pageIdentity?.documentLanguage, htmlAnalysis);
     return {
-        pageTitle: extractPageTitle(html),
-        hasPasswordField: PASSWORD_FIELD_RE.test(html),
+        pageTitle: htmlAnalysis.title,
+        hasPasswordField: htmlAnalysis.forms.categories.password > 0,
         phishingLanguageMatch: pageLanguageSignal?.label ?? null,
         hasExternalFormAction: pageIdentity
             ? pageIdentity.forms.externalActionOrigins.length > 0
             : null,
         externalAssetHosts: extractExternalAssetHosts(html, domain),
-        cspMetaPolicy: htmlAnalysis
-            ? analyzeCspMetaPolicies(htmlAnalysis.cspMetaPolicies, htmlAnalysis.cspMetaLimitReached)
-            : null,
+        cspMetaPolicy: analyzeCspMetaPolicies(htmlAnalysis.cspMetaPolicies, htmlAnalysis.cspMetaLimitReached),
         pageIdentity: pageIdentityOutput,
         credentialSurfaceProfile: includeCredentialSurfaceProfile && htmlAnalysis ? analyzeCredentialSurfaceProfile({
             htmlAnalysis,
@@ -732,7 +736,7 @@ function extractHtmlSignals(html, domain, options = {}) {
         }) : null,
         structuredDataIdentity: includeStructuredDataIdentity && htmlAnalysis ? analyzeStructuredDataIdentity({
             htmlAnalysis,
-            baseUrl,
+            baseUrl: effectiveBaseUrl,
             observedAt: options.observedAt,
             sourceTruncated: options.sourceTruncated,
         }) : null,
@@ -742,12 +746,14 @@ function extractHtmlSignals(html, domain, options = {}) {
             httpServer: options.httpServer,
             responseHeaders: options.responseHeaders,
             resourceOrigins: pageIdentity.resources.externalOrigins,
+            effectiveBaseUrl,
+            documentOrigin,
             observedAt: options.observedAt,
             sourceTruncated: options.sourceTruncated,
         }) : null,
         pageRoleProfile: includeDerivedPageProfiles && htmlAnalysis ? analyzePageRole({
             htmlAnalysis,
-            pageTitle: extractPageTitle(html),
+            pageTitle: htmlAnalysis.title,
             activityStatus: options.activityStatus,
             observedAt: options.observedAt,
             sourceTruncated: options.sourceTruncated,

package/lib/local-geoip-evidence.mjs

@@ -45,14 +45,30 @@ function buildLocalGeoIpDatabase(value) {
     }
     const truncated = rows.length > MAX_GEOIP_RECORDS;
     const normalized = rows.slice(0, MAX_GEOIP_RECORDS).map(normalizeGeoIpEntry);
-    const records = normalized.filter((item) => item !== null)
-        .sort((left, right) => right.parsedNetwork.length - left.parsedNetwork.length);
+    const byNetwork = new Map();
+    const sameAttribution = (left, right) => (left.countryCode === right.countryCode
+        && left.region === right.region
+        && left.city === right.city
+        && left.asn === right.asn
+        && left.asName === right.asName);
+    for (const item of normalized) {
+        if (!item)
+            continue;
+        const existing = byNetwork.get(item.network);
+        if (existing && !sameAttribution(existing, item)) {
+            throw new TypeError(`A local GeoIP database must not assign conflicting evidence to canonical prefix ${item.network}.`);
+        }
+        if (!existing)
+            byNetwork.set(item.network, item);
+    }
+    const records = [...byNetwork.values()]
+        .sort((left, right) => right.parsedNetwork.length - left.parsedNetwork.length || left.network.localeCompare(right.network));
     return Object.freeze({
         sourceLabel,
         databaseVersion,
         license,
         records: Object.freeze(records),
-        rejectedCount: normalized.length - records.length + Math.max(0, rows.length - MAX_GEOIP_RECORDS),
+        rejectedCount: normalized.filter((item) => item === null).length + Math.max(0, rows.length - MAX_GEOIP_RECORDS),
         truncated,
     });
 }

package/lib/lookup-response.mjs

@@ -124,11 +124,12 @@ async function buildUnifiedLookupResponse(context) {
             const result = availabilityResult.value;
             availability = {
                 applicable: true,
-                domain: classified.value,
-                inputHostname: classified.inputHostname,
-                registrableDomain: classified.registrableDomain,
-                isSubdomain: classified.isSubdomain,
                 ...result,
+                // Every observation nested in the availability envelope is collected
+                // against this registrable target. Request context remains on the
+                // top-level response; exact-host sources such as security.txt retain
+                // their own requested/final URL attribution.
+                domain: classified.value,
             };
         }
         else {

package/lib/lookup-source-progress.mjs

@@ -2,6 +2,7 @@
 // Lookup. These deliberately exclude raw RDAP/WHOIS bodies, contacts, URLs,
 // provider payloads, and request errors. The ordinary final Lookup response
 // remains the only authoritative and persistable result.
+import { THREAT_INTELLIGENCE_CONTRACT_VERSION, THREAT_INTELLIGENCE_RESULT_STATES, THREAT_INTELLIGENCE_SCHEMA, } from "./threat-intelligence-types.mjs";
 const RESULT_STATES = new Set([
     'available',
     'expiring',
@@ -19,6 +20,12 @@ const DIRECT_STATES = new Set([
     'unavailable',
     'rate_limited',
 ]);
+const THREAT_INTELLIGENCE_SOURCES = new Set([
+    'external_intelligence',
+    'malware_host_intelligence',
+    'malware_ioc_intelligence',
+]);
+const THREAT_INTELLIGENCE_STATES = new Set(THREAT_INTELLIGENCE_RESULT_STATES);
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value)
         ? value
@@ -63,6 +70,15 @@ function normalizedState(source, outcome, value) {
     if (source === 'domain_evidence') {
         return record(value).deepScanComplete === false ? 'partial' : 'success';
     }
+    if (THREAT_INTELLIGENCE_SOURCES.has(source)) {
+        const intelligence = record(value);
+        return intelligence.schema === THREAT_INTELLIGENCE_SCHEMA
+            && intelligence.version === THREAT_INTELLIGENCE_CONTRACT_VERSION
+            && typeof intelligence.state === 'string'
+            && THREAT_INTELLIGENCE_STATES.has(intelligence.state)
+            ? intelligence.state
+            : 'error';
+    }
     const status = record(value).status;
     if (typeof status === 'string' && DIRECT_STATES.has(status)) {
         return status;
@@ -76,15 +92,22 @@ function normalizedState(source, outcome, value) {
 function normalizeLookupSourceSettlement(source, outcome, value) {
     const state = normalizedState(source, outcome, value);
     const sourceRecord = record(value);
+    const threatObservation = THREAT_INTELLIGENCE_SOURCES.has(source)
+        ? record(sourceRecord.observation)
+        : null;
     const resultState = source === 'domain_evidence'
         && typeof sourceRecord.state === 'string'
         && RESULT_STATES.has(sourceRecord.state)
         ? sourceRecord.state
         : null;
-    const complete = !['partial', 'error', 'unavailable', 'rate_limited'].includes(state);
-    const truncated = sourceRecord.truncated === true
-        || sourceRecord.recordsTruncated === true
-        || sourceRecord.bodyTruncated === true;
+    const complete = threatObservation
+        ? state !== 'error' && threatObservation.complete === true
+        : !['partial', 'error', 'unavailable', 'rate_limited'].includes(state);
+    const truncated = threatObservation
+        ? threatObservation.truncated === true
+        : sourceRecord.truncated === true
+            || sourceRecord.recordsTruncated === true
+            || sourceRecord.bodyTruncated === true;
     const limitation = outcome === 'rejected'
         ? 'This source did not complete. No absence or safety conclusion was inferred.'
         : state === 'skipped'

package/lib/nameserver-preflight-review.mjs

@@ -116,6 +116,7 @@ export function reviewNameserverPreflight(inputRaw, generatedAtValue = new Date(
             && authorityState === 'authoritative'
             && servedSetState === 'aligned'
             && soaState === 'observed'
+            && addressState !== 'non_public'
             && (!inBailiwick || addressState === 'ready');
         return Object.freeze({
             nameserver,

package/lib/rdap-capabilities.mjs

@@ -245,7 +245,7 @@ export function inspectRdapCapabilities(parsedValue, status) {
             break;
     }
     const declarations = [...unique].sort().map((value) => {
-        const entry = EXTENSION_CATALOG[value];
+        const entry = Object.hasOwn(EXTENSION_CATALOG, value) ? EXTENSION_CATALOG[value] : undefined;
         return entry
             ? {
                 identifier: value,

package/lib/registry-insights.mjs

@@ -137,21 +137,22 @@ function disclosure(source, parsedValue, status) {
         detail: 'The source completed without a usable registrant contact or an explicit disclosure marker.',
     };
 }
-function lifecycle(statusesValue) {
+function lifecycle(statusesValue, evidenceState) {
     const rawStatuses = strings(statusesValue);
     const normalized = rawStatuses.map(normalizedStatus);
     const has = (value) => normalized.includes(value);
-    const pendingDelete = has('pendingdelete');
-    const redemption = has('redemptionperiod');
-    const pendingTransfer = has('pendingtransfer');
-    const serverHold = has('serverhold');
-    const clientHold = has('clienthold');
+    const observedState = (value) => has(value) ? true : evidenceState === 'complete' ? false : null;
+    const pendingDelete = observedState('pendingdelete');
+    const redemption = observedState('redemptionperiod');
+    const pendingTransfer = observedState('pendingtransfer');
+    const serverHold = observedState('serverhold');
+    const clientHold = observedState('clienthold');
     const serverLocks = normalized.filter((value) => /^server(?:delete|renew|transfer|update)prohibited$/u.test(value));
     const clientLocks = normalized.filter((value) => /^client(?:delete|renew|transfer|update)prohibited$/u.test(value));
-    let stage = 'registered';
-    let label = 'Registered';
-    let acquisitionPath = ['Continue monitoring registry status and expiry.'];
-    if (pendingDelete) {
+    let stage = 'unknown';
+    let label = 'Lifecycle unavailable';
+    let acquisitionPath = ['Obtain a qualifying registry or WHOIS publication before interpreting lifecycle or lock state.'];
+    if (pendingDelete === true) {
         stage = 'pending_delete';
         label = 'Pending delete';
         acquisitionPath = [
@@ -160,7 +161,7 @@ function lifecycle(statusesValue) {
             'Use a registrar or registry-supported acquisition path when policy permits.',
         ];
     }
-    else if (redemption) {
+    else if (redemption === true) {
         stage = 'redemption';
         label = 'Redemption period';
         acquisitionPath = [
@@ -169,16 +170,21 @@ function lifecycle(statusesValue) {
             'Do not treat the domain as available or guaranteed to drop.',
         ];
     }
-    else if (pendingTransfer) {
+    else if (pendingTransfer === true) {
         stage = 'pending_transfer';
         label = 'Pending transfer';
         acquisitionPath = ['A registrar transfer is pending; this is not an availability signal.'];
     }
-    else if (serverHold || clientHold) {
+    else if (serverHold === true || clientHold === true) {
         stage = 'hold';
         label = 'Registration hold';
         acquisitionPath = ['A hold affects delegation or publication; it does not mean the registration is available.'];
     }
+    else if (evidenceState === 'complete' || rawStatuses.length > 0) {
+        stage = 'registered';
+        label = 'Registered';
+        acquisitionPath = ['Continue monitoring registry status and expiry.'];
+    }
     return {
         stage,
         label,
@@ -188,8 +194,8 @@ function lifecycle(statusesValue) {
         pendingTransfer,
         hold: { client: clientHold, server: serverHold },
         locks: {
-            client: clientLocks.length > 0,
-            server: serverLocks.length > 0,
+            client: clientLocks.length > 0 ? true : evidenceState === 'complete' ? false : null,
+            server: serverLocks.length > 0 ? true : evidenceState === 'complete' ? false : null,
             clientStatuses: clientLocks,
             serverStatuses: serverLocks,
         },
@@ -271,7 +277,18 @@ export function buildRegistryInsights(input) {
                 : counts.equivalent
                     ? 'consistent'
                     : 'unavailable';
-    const statuses = strings(rdap.statuses).length ? rdap.statuses : whois.statuses;
+    const publications = [
+        publicationDiagnostic('registry_rdap', input.rdapParsed, input.rdapStatus, input.rdapFetchedAt),
+        publicationDiagnostic('whois', input.whoisParsed, input.whoisStatus, input.whoisQueriedAt),
+        publicationDiagnostic('registrar_rdap', input.registrarRdapParsed, input.registrarRdapStatus, input.registrarRdapFetchedAt),
+    ];
+    const lifecycleCandidates = [
+        { statuses: strings(rdap.statuses), state: publications[0].state },
+        { statuses: strings(whois.statuses), state: publications[1].state },
+    ].filter((candidate) => candidate.state !== 'unavailable');
+    const lifecycleSource = lifecycleCandidates.find((candidate) => candidate.statuses.length)
+        ?? lifecycleCandidates[0]
+        ?? { statuses: [], state: 'unavailable' };
     const routes = [
         ...contactRoute('registry', rdap.abuse, 'Registry RDAP abuse entity'),
         ...contactRoute('registrar', rdap.registrar, 'Registry RDAP registrar entity'),
@@ -294,7 +311,7 @@ export function buildRegistryInsights(input) {
             whois: disclosure('whois', input.whoisParsed, input.whoisStatus),
             limitation: 'Disclosure state describes what each point-in-time source published. It does not infer the identity, intent, reachability, or legal status of a registrant.',
         },
-        lifecycle: lifecycle(statuses),
+        lifecycle: lifecycle(lifecycleSource.statuses, lifecycleSource.state),
         reconciliation: {
             state: reconciliationState,
             conflictCount,
@@ -312,11 +329,7 @@ export function buildRegistryInsights(input) {
                             ? 'The comparable fields are normalised as equivalent.'
                             : 'No comparable fields were available.',
         },
-        publications: [
-            publicationDiagnostic('registry_rdap', input.rdapParsed, input.rdapStatus, input.rdapFetchedAt),
-            publicationDiagnostic('whois', input.whoisParsed, input.whoisStatus, input.whoisQueriedAt),
-            publicationDiagnostic('registrar_rdap', input.registrarRdapParsed, input.registrarRdapStatus, input.registrarRdapFetchedAt),
-        ],
+        publications,
         rdapCapabilities: {
             registry: inspectRdapCapabilities(input.rdapParsed, input.rdapStatus),
             registrar: inspectRdapCapabilities(input.registrarRdapParsed, input.registrarRdapStatus),

package/lib/risk-calibration-summary.mjs

@@ -109,9 +109,7 @@ function thresholdMetrics(value, label, expectedThreshold, expectedTotal, expect
     const recall = ratio(truePositive, truePositive + falseNegative);
     const specificity = ratio(trueNegative, trueNegative + falsePositive);
     const falsePositiveRate = ratio(falsePositive, falsePositive + trueNegative);
-    const f1 = precision === null || recall === null || precision + recall === 0
-        ? null
-        : Number(((2 * precision * recall) / (precision + recall)).toFixed(4));
+    const f1 = ratio(2 * truePositive, 2 * truePositive + falsePositive + falseNegative);
     const balancedAccuracy = recall === null || specificity === null
         ? null
         : Number(((recall + specificity) / 2).toFixed(4));

package/lib/security-txt.mjs

@@ -50,6 +50,38 @@ function normalizedPublishedUri(value, schemes) {
             return null;
         if (url.protocol === 'https:' && !url.hostname)
             return null;
+        if (url.protocol === 'mailto:') {
+            let recipients;
+            try {
+                recipients = decodeURIComponent(url.pathname).split(',');
+            }
+            catch {
+                return null;
+            }
+            if (!recipients.length || recipients.some((recipient) => {
+                const separator = recipient.lastIndexOf('@');
+                if (separator <= 0 || separator === recipient.length - 1)
+                    return true;
+                const local = recipient.slice(0, separator);
+                const mailDomain = recipient.slice(separator + 1).toLowerCase();
+                return !/^[a-z0-9.!#$%&'*+/=?^_`{|}~-]+$/iu.test(local)
+                    || local.startsWith('.') || local.endsWith('.') || local.includes('..')
+                    || !canonicalHostname(mailDomain);
+            }))
+                return null;
+        }
+        if (url.protocol === 'tel:') {
+            let number;
+            try {
+                number = decodeURIComponent(url.pathname);
+            }
+            catch {
+                return null;
+            }
+            if (!/^\+?[0-9(). -]+(?:;[a-z0-9-]+=[a-z0-9.-]+)*$/iu.test(number)
+                || (number.match(/[0-9]/gu)?.length ?? 0) < 3)
+                return null;
+        }
         url.search = '';
         url.hash = '';
         return url.toString().slice(0, MAX_SECURITY_TXT_URL_LENGTH);
@@ -211,7 +243,7 @@ function parseSecurityTxt(text, options = {}) {
     const finalComparisonUrl = options.finalUrl ? normalizedCanonicalComparisonUrl(options.finalUrl) : null;
     const canonicalMatches = boundedCanonical.values.length && finalUrl && finalComparisonUrl
         ? canonicalComparison.slice(0, MAX_SECURITY_TXT_VALUES)
-            .some((value) => value.toLowerCase() === finalComparisonUrl.toLowerCase())
+            .some((value) => value === finalComparisonUrl)
         : null;
     const stale = Boolean(expiresAt && Date.parse(expiresAt) <= (options.now ?? Date.now()));
     const requiredMalformed = boundedContacts.values.length === 0 || expires.length !== 1;