@slicedearth/whoisleuth-cli 2.2.0 → 2.4.0

package/lib/registry-dates.mjs

@@ -1,190 +1,2 @@
-// Deterministic normalization for lifecycle dates published by RDAP and
-// WHOIS services. Raw upstream strings remain the provenance source; these
-// helpers only produce additive Date/ISO companions for comparison, storage,
-// and presentation.
-const REGISTRY_MONTHS = Object.freeze({
-    jan: 1, feb: 2, mar: 3, apr: 4, may: 5, jun: 6,
-    jul: 7, aug: 8, sep: 9, oct: 10, nov: 11, dec: 12,
-});
-const REGISTRY_MONTH_NAMES = Object.freeze({
-    january: 1, february: 2, march: 3, april: 4, may: 5, june: 6,
-    july: 7, august: 8, september: 9, october: 10, november: 11, december: 12,
-});
-function utcDateFromParts(year, month, day, hour = 0, minute = 0, second = 0, millisecond = 0) {
-    if (![year, month, day, hour, minute, second, millisecond].every(Number.isInteger))
-        return null;
-    if (year < 1000 || year > 9999 || month < 1 || month > 12 || day < 1
-        || hour < 0 || hour > 23 || minute < 0 || minute > 59
-        || second < 0 || second > 59 || millisecond < 0 || millisecond > 999)
-        return null;
-    const date = new Date(Date.UTC(year, month - 1, day, hour, minute, second, millisecond));
-    if (date.getUTCFullYear() !== year || date.getUTCMonth() !== month - 1 || date.getUTCDate() !== day
-        || date.getUTCHours() !== hour || date.getUTCMinutes() !== minute
-        || date.getUTCSeconds() !== second || date.getUTCMilliseconds() !== millisecond)
-        return null;
-    return date;
-}
-// Parse the explicit non-ISO formats observed across supported ccTLD WHOIS
-// services before considering ISO-shaped input. Runtime Date parsing treats
-// dotted dates ambiguously and timezone-less timestamps in the host's local
-// timezone, so every accepted shape is validated and normalized through UTC.
-function parseRegistryDate(input) {
-    if (typeof input !== 'string')
-        return null;
-    // The documented .nz WHOIS examples place one space before the RFC3339
-    // `T` separator. Canonicalize that registry-specific presentation quirk
-    // before applying the existing strict ISO-shaped parser.
-    const value = input.trim()
-        .replace(/^(\d{4}-\d{2}-\d{2})[ ]+[Tt](?=\d{2}:)/, '$1T')
-        // The .ee WHOIS service separates an otherwise ISO-shaped numeric
-        // timezone from its clock with one space.
-        .replace(/^(\d{4}-\d{2}-\d{2}[Tt ]\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?)[ ]+([+-]\d{2}:?\d{2})$/, '$1$2');
-    if (!value)
-        return null;
-    // DD.MM.YYYY[ HH:MM:SS] - e.g. 14.03.2024 10:46:48
-    let match = value.match(/^(\d{1,2})\.(\d{1,2})\.(\d{4})(?:\s+(\d{1,2}):(\d{2}):(\d{2}))?$/);
-    if (match) {
-        const [, day = '', month = '', year = '', hour = '0', minute = '0', second = '0'] = match;
-        return utcDateFromParts(+year, +month, +day, +(hour || 0), +(minute || 0), +(second || 0));
-    }
-    // YYYY. MM. DD. - e.g. 2006. 09. 18.
-    match = value.match(/^(\d{4})\.\s*(\d{1,2})\.\s*(\d{1,2})\.?$/);
-    if (match) {
-        const [, year = '', month = '', day = ''] = match;
-        return utcDateFromParts(+year, +month, +day);
-    }
-    // YYYY.MM.DD HH:MM:SS - used by NASK's .pl WHOIS service.
-    match = value.match(/^(\d{4})\.(\d{1,2})\.(\d{1,2})\s+(\d{1,2}):(\d{2}):(\d{2})$/);
-    if (match) {
-        const [, year = '', month = '', day = '', hour = '', minute = '', second = ''] = match;
-        return utcDateFromParts(+year, +month, +day, +hour, +minute, +second);
-    }
-    // YYYY/MM/DD - an unambiguous year-first form used by CIRA WHOIS.
-    match = value.match(/^(\d{4})\/(\d{1,2})\/(\d{1,2})$/);
-    if (match) {
-        const [, year = '', month = '', day = ''] = match;
-        return utcDateFromParts(+year, +month, +day);
-    }
-    // YYYYMMDD with an optional time or Registro.br contact-reference suffix.
-    // The raw value remains available as provenance while the validated date
-    // and optional clock time are projected into the additive ISO companion.
-    match = value.match(/^(\d{4})(\d{2})(\d{2})(?:\s+(\d{1,2}):(\d{2}):(\d{2})|\s+#[0-9]{1,20})?$/);
-    if (match) {
-        const [, year = '', month = '', day = '', hour = '0', minute = '0', second = '0'] = match;
-        return utcDateFromParts(+year, +month, +day, +(hour || 0), +(minute || 0), +(second || 0));
-    }
-    // YYYY-Mon-DD. - e.g. 1999-Feb-16.
-    match = value.match(/^(\d{4})-([A-Za-z]{3})-(\d{1,2})\.?$/);
-    if (match) {
-        const month = REGISTRY_MONTHS[(match[2] ?? '').toLowerCase()];
-        return month ? utcDateFromParts(+(match[1] ?? ''), month, +(match[3] ?? '')) : null;
-    }
-    // DD-Mon-YYYY[ HH:MM:SS] - used by several ICANN-style ccTLD services.
-    match = value.match(/^(\d{1,2})-([A-Za-z]{3})-(\d{4})(?:\s+(\d{1,2}):(\d{2}):(\d{2}))?$/);
-    if (match) {
-        const month = REGISTRY_MONTHS[(match[2] ?? '').toLowerCase()];
-        return month
-            ? utcDateFromParts(+(match[3] ?? ''), month, +(match[1] ?? ''), +(match[4] || 0), +(match[5] || 0), +(match[6] || 0))
-            : null;
-    }
-    // DD-MM-YYYY - the day-first form published by the currently profiled
-    // registries that use bare numeric hyphen dates. A future month-first
-    // source must receive its own marker-gated parser rather than reusing this
-    // global shape. The four-digit final year remains distinct from ISO below.
-    match = value.match(/^(\d{1,2})-(\d{1,2})-(\d{4})$/);
-    if (match) {
-        const [, day = '', month = '', year = ''] = match;
-        return utcDateFromParts(+year, +month, +day);
-    }
-    // YYYY-MM-DD HH:MM:SS (GMT+H:MM) - the explicit offset form published by
-    // the Kazakhstan registry. Parentheses and the GMT marker are required so
-    // unrelated prose is not accepted as a lifecycle timestamp.
-    match = value.match(/^(\d{4})-(\d{2})-(\d{2})\s+(\d{2}):(\d{2}):(\d{2})\s+\(GMT([+-])(\d{1,2}):(\d{2})\)$/i);
-    if (match) {
-        const [, year = '', month = '', day = '', hour = '', minute = '', second = '', sign = '', offsetHours = '', offsetMinutes = '',] = match;
-        const local = utcDateFromParts(+year, +month, +day, +hour, +minute, +second);
-        if (!local || +offsetHours > 23 || +offsetMinutes > 59)
-            return null;
-        const offsetMs = (+offsetHours * 60 + +offsetMinutes) * 60000;
-        return new Date(local.getTime() + (sign === '+' ? -offsetMs : offsetMs));
-    }
-    // DD-MM-YYYY HH:MM:SS GMT+H - the Tunisian registry's bounded local-time
-    // presentation. Accept an optional minute component but require the GMT
-    // marker and validate the calendar and offset before normalization.
-    match = value.match(/^(\d{1,2})-(\d{1,2})-(\d{4})\s+(\d{2}):(\d{2}):(\d{2})\s+GMT([+-])(\d{1,2})(?::(\d{2}))?$/i);
-    if (match) {
-        const [, day = '', month = '', year = '', hour = '', minute = '', second = '', sign = '', offsetHours = '', offsetMinutes = '0',] = match;
-        const local = utcDateFromParts(+year, +month, +day, +hour, +minute, +second);
-        if (!local || +offsetHours > 23 || +offsetMinutes > 59)
-            return null;
-        const offsetMs = (+offsetHours * 60 + +offsetMinutes) * 60000;
-        return new Date(local.getTime() + (sign === '+' ? -offsetMs : offsetMs));
-    }
-    // DD Mon YYYY - the compact English month form published by THNIC.
-    match = value.match(/^(\d{1,2})\s+([A-Za-z]{3})\s+(\d{4})$/);
-    if (match) {
-        const month = REGISTRY_MONTHS[(match[2] ?? '').toLowerCase()];
-        return month ? utcDateFromParts(+(match[3] ?? ''), month, +(match[1] ?? '')) : null;
-    }
-    // Ordinal-day Month YYYY[ at HH:MM:SS.sss] - the English form published
-    // by the Channel Islands registry. The suffix and `at` token are required
-    // so ordinary prose containing a month name is not accepted as lifecycle
-    // evidence.
-    match = value.match(/^(\d{1,2})(st|nd|rd|th)\s+([A-Za-z]{3,9})\s+(\d{4})(?:\s+at\s+(\d{1,2}):(\d{2}):(\d{2})(?:\.(\d{1,3}))?)?$/i);
-    if (match) {
-        const day = +(match[1] ?? '');
-        const suffix = (match[2] ?? '').toLowerCase();
-        const expectedSuffix = day % 100 >= 11 && day % 100 <= 13
-            ? 'th'
-            : ({ 1: 'st', 2: 'nd', 3: 'rd' }[day % 10] || 'th');
-        if (suffix !== expectedSuffix)
-            return null;
-        const monthText = (match[3] ?? '').toLowerCase();
-        const month = REGISTRY_MONTH_NAMES[monthText] || REGISTRY_MONTHS[monthText];
-        const millisecond = match[8] ? Number(`${match[8]}00`.slice(0, 3)) : 0;
-        return month
-            ? utcDateFromParts(+(match[4] ?? ''), month, day, +(match[5] || 0), +(match[6] || 0), +(match[7] || 0), millisecond)
-            : null;
-    }
-    // Ddd Mon DD YYYY[ HH:MM:SS] - the English textual form used by the
-    // Belgian registry. Weekday text is presentation-only; the validated
-    // calendar components determine the canonical UTC companion.
-    match = value.match(/^(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun)\s+([A-Za-z]{3})\s+(\d{1,2})\s+(\d{4})(?:\s+(\d{1,2}):(\d{2}):(\d{2}))?$/i);
-    if (match) {
-        const month = REGISTRY_MONTHS[(match[1] ?? '').toLowerCase()];
-        return month
-            ? utcDateFromParts(+(match[3] ?? ''), month, +(match[2] ?? ''), +(match[4] || 0), +(match[5] || 0), +(match[6] || 0))
-            : null;
-    }
-    // Month DD YYYY - ISNIC publishes English month names with variable
-    // spacing and no timezone. Keep the accepted shape narrow and accept only
-    // the twelve exact English names from a fixed table.
-    match = value.match(/^([A-Za-z]{3,9})\s+(\d{1,2})\s+(\d{4})$/);
-    if (match) {
-        const month = REGISTRY_MONTH_NAMES[(match[1] ?? '').toLowerCase()];
-        return month ? utcDateFromParts(+(match[3] ?? ''), month, +(match[2] ?? '')) : null;
-    }
-    // ISO 8601-shaped dates and timestamps. A missing timezone is deliberately
-    // interpreted as UTC so Express and function deployments agree.
-    match = value.match(/^(\d{4})-(\d{2})-(\d{2})(?:[Tt ](\d{2}):(\d{2})(?::(\d{2})(?:\.(\d{1,9}))?)?(?:([Zz])|([+-])(\d{2}):?(\d{2}))?)?$/);
-    if (!match)
-        return null;
-    const [, year = '', month = '', day = '', hour = '0', minute = '0', second = '0', fraction, zulu, offsetSign, offsetHours = '0', offsetMinutes = '0',] = match;
-    const millisecond = fraction ? Number(`${fraction}000`.slice(0, 3)) : 0;
-    const local = utcDateFromParts(+year, +month, +day, +(hour || 0), +(minute || 0), +(second || 0), millisecond);
-    if (!local)
-        return null;
-    if (!offsetSign || zulu)
-        return local;
-    const offsetHour = +offsetHours;
-    const offsetMinute = +offsetMinutes;
-    if (offsetHour > 23 || offsetMinute > 59)
-        return null;
-    const offsetMs = (offsetHour * 60 + offsetMinute) * 60000;
-    return new Date(local.getTime() + (offsetSign === '+' ? -offsetMs : offsetMs));
-}
-function registryDateIso(value) {
-    const date = parseRegistryDate(value);
-    return date ? date.toISOString() : null;
-}
-export { parseRegistryDate, registryDateIso };
+// Stable source-facing entry point; portable consumers use the evidence owner.
+export { parseRegistryDate, registryDateIso } from "../packages/evidence/registry-dates.mjs";

package/lib/registry-insights.mjs

@@ -7,6 +7,8 @@
 import { compareRegistrySources } from "./registry-comparison.mjs";
 import { inspectRdapCapabilities } from "./rdap-capabilities.mjs";
 import { isRecord, recordOrEmpty } from "./json-record.mjs";
+import { MAX_RDAP_REDACTIONS, MAX_RDAP_STATUSES } from "./rdap-types.mjs";
+import { MAX_WHOIS_STATUSES } from "./whois-contracts.mjs";
 export const REGISTRY_INSIGHTS_VERSION = 1;
 export const MAX_REGISTRY_INSIGHT_STATUSES = 40;
 export const MAX_REGISTRY_INSIGHT_ISSUES = 12;
@@ -37,6 +39,20 @@ function strings(value, maximum = MAX_REGISTRY_INSIGHT_STATUSES) {
 function normalizedStatus(value) {
     return text(value, 160).toLowerCase().replace(/[^\p{L}\p{N}]+/gu, '');
 }
+function statusInventory(value, maximum) {
+    if (!Array.isArray(value))
+        return { values: [], partial: value !== undefined };
+    const unique = new Set();
+    let partial = value.length > maximum;
+    for (const item of value.slice(0, maximum)) {
+        if (typeof item !== 'string' || item.length > 160 || CONTROL_RE.test(item) || !item.trim()) {
+            partial = true;
+            continue;
+        }
+        unique.add(item.trim());
+    }
+    return { values: [...unique], partial };
+}
 function sourceState(status, partial) {
     if (partial || status === 'partial')
         return 'partial';
@@ -45,9 +61,13 @@ function sourceState(status, partial) {
         ? 'complete'
         : 'unavailable';
 }
-function redactionBlob(parsed) {
-    const redactions = Array.isArray(parsed.redactions) ? parsed.redactions.slice(0, 50) : [];
-    return redactions.map((item) => {
+function registrantRedactionBlob(parsed) {
+    const redactions = Array.isArray(parsed.redactions) ? parsed.redactions.slice(0, MAX_RDAP_REDACTIONS) : [];
+    return redactions.filter((item) => {
+        // A path or reason can mention a role without selecting it. Do not infer
+        // registrant scope from arbitrary JSONPath expressions or other prose.
+        return /^(?:registry )?registrant(?:\b|$)/iu.test(text(record(item).name, 240));
+    }).map((item) => {
         const value = record(item);
         return [
             value.name,
@@ -92,7 +112,8 @@ function disclosure(source, parsedValue, status) {
         ? parsed.chainStatus === 'partial' || strings(parsed.fieldsTruncated, 20).length > 0
         : parsed.serverTruncated === true
             || parsed.entitiesTruncated === true
-            || parsed.statusesTruncated === true;
+            || parsed.statusesTruncated === true
+            || parsed.redactionsTruncated === true;
     const publicationState = sourceState(status, partial);
     if (publicationState === 'unavailable') {
         return {
@@ -110,7 +131,7 @@ function disclosure(source, parsedValue, status) {
             parsed.registrantPhone,
             parsed.registrantAddress,
         ].map((part) => text(part, 320)).filter(Boolean).join(' ');
-    const redactions = redactionBlob(parsed);
+    const redactions = registrantRedactionBlob(parsed);
     const combined = `${registrant} ${redactions}`.trim();
     if (WITHHELD_RE.test(combined)) {
         return { source, state: 'withheld', detail: 'The publication indicates that registrant data was withheld or not disclosed.' };
@@ -124,6 +145,13 @@ function disclosure(source, parsedValue, status) {
     if (registrant) {
         return { source, state: 'public', detail: 'The source published at least one usable registrant contact field.' };
     }
+    if (Array.isArray(parsed.redactions) && parsed.redactions.length > 0) {
+        return {
+            source,
+            state: 'unavailable',
+            detail: 'Redaction declarations do not establish registrant scope, so missing registrant fields remain unclassified.',
+        };
+    }
     if (publicationState === 'partial') {
         return {
             source,
@@ -137,21 +165,22 @@ function disclosure(source, parsedValue, status) {
         detail: 'The source completed without a usable registrant contact or an explicit disclosure marker.',
     };
 }
-function lifecycle(statusesValue) {
-    const rawStatuses = strings(statusesValue);
-    const normalized = rawStatuses.map(normalizedStatus);
+function lifecycle(statuses, evidenceState) {
+    const rawStatuses = statuses.slice(0, MAX_REGISTRY_INSIGHT_STATUSES);
+    const normalized = statuses.map(normalizedStatus);
     const has = (value) => normalized.includes(value);
-    const pendingDelete = has('pendingdelete');
-    const redemption = has('redemptionperiod');
-    const pendingTransfer = has('pendingtransfer');
-    const serverHold = has('serverhold');
-    const clientHold = has('clienthold');
+    const observedState = (value) => has(value) ? true : evidenceState === 'complete' ? false : null;
+    const pendingDelete = observedState('pendingdelete');
+    const redemption = observedState('redemptionperiod');
+    const pendingTransfer = observedState('pendingtransfer');
+    const serverHold = observedState('serverhold');
+    const clientHold = observedState('clienthold');
     const serverLocks = normalized.filter((value) => /^server(?:delete|renew|transfer|update)prohibited$/u.test(value));
     const clientLocks = normalized.filter((value) => /^client(?:delete|renew|transfer|update)prohibited$/u.test(value));
-    let stage = 'registered';
-    let label = 'Registered';
-    let acquisitionPath = ['Continue monitoring registry status and expiry.'];
-    if (pendingDelete) {
+    let stage = 'unknown';
+    let label = 'Lifecycle unavailable';
+    let acquisitionPath = ['Obtain a qualifying registry or WHOIS publication before interpreting lifecycle or lock state.'];
+    if (pendingDelete === true) {
         stage = 'pending_delete';
         label = 'Pending delete';
         acquisitionPath = [
@@ -160,7 +189,7 @@ function lifecycle(statusesValue) {
             'Use a registrar or registry-supported acquisition path when policy permits.',
         ];
     }
-    else if (redemption) {
+    else if (redemption === true) {
         stage = 'redemption';
         label = 'Redemption period';
         acquisitionPath = [
@@ -169,16 +198,21 @@ function lifecycle(statusesValue) {
             'Do not treat the domain as available or guaranteed to drop.',
         ];
     }
-    else if (pendingTransfer) {
+    else if (pendingTransfer === true) {
         stage = 'pending_transfer';
         label = 'Pending transfer';
         acquisitionPath = ['A registrar transfer is pending; this is not an availability signal.'];
     }
-    else if (serverHold || clientHold) {
+    else if (serverHold === true || clientHold === true) {
         stage = 'hold';
         label = 'Registration hold';
         acquisitionPath = ['A hold affects delegation or publication; it does not mean the registration is available.'];
     }
+    else if (evidenceState === 'complete' || rawStatuses.length > 0) {
+        stage = 'registered';
+        label = 'Registered';
+        acquisitionPath = ['Continue monitoring registry status and expiry.'];
+    }
     return {
         stage,
         label,
@@ -188,22 +222,26 @@ function lifecycle(statusesValue) {
         pendingTransfer,
         hold: { client: clientHold, server: serverHold },
         locks: {
-            client: clientLocks.length > 0,
-            server: serverLocks.length > 0,
+            client: clientLocks.length > 0 ? true : evidenceState === 'complete' ? false : null,
+            server: serverLocks.length > 0 ? true : evidenceState === 'complete' ? false : null,
             clientStatuses: clientLocks,
             serverStatuses: serverLocks,
         },
         acquisitionPath,
-        limitation: 'EPP statuses describe the current registry lifecycle. They do not guarantee deletion, release timing, transfer completion, eligibility, price, or acquisition success.',
+        limitation: 'EPP statuses describe the current registry lifecycle. They do not guarantee deletion, release timing, transfer completion, eligibility, price, or acquisition success.'
+            + (statuses.length > rawStatuses.length ? ` The display lists ${rawStatuses.length} of ${statuses.length} distinct statuses; lifecycle decisions use the full admitted inventory.` : ''),
     };
 }
-function publicationDiagnostic(source, parsedValue, status, observedAt) {
+function publicationDiagnostic(source, parsedValue, status, observedAt, statuses) {
     const usablePublication = isRecord(parsedValue);
     const parsed = record(parsedValue);
     const partial = parsed.serverTruncated === true
         || parsed.chainStatus === 'partial'
         || parsed.entitiesTruncated === true
         || parsed.statusesTruncated === true
+        || statuses.partial
+        || parsed.eventsTruncated === true
+        || parsed.redactionsTruncated === true
         || strings(parsed.fieldsTruncated, 20).length > 0;
     const state = usablePublication ? sourceState(status, partial) : 'unavailable';
     const issues = [];
@@ -213,14 +251,18 @@ function publicationDiagnostic(source, parsedValue, status, observedAt) {
         issues.push('The RDAP server declared a truncated response.');
     if (parsed.entitiesTruncated === true)
         issues.push('The normalised entity inventory was capped.');
-    if (parsed.statusesTruncated === true)
-        issues.push('The normalised status inventory was capped.');
+    if (parsed.statusesTruncated === true || statuses.partial)
+        issues.push('The normalised status inventory contains omitted or rejected values.');
+    if (parsed.eventsTruncated === true)
+        issues.push('The normalised event inventory contains omitted or rejected fields.');
+    if (parsed.redactionsTruncated === true)
+        issues.push('The normalised redaction inventory contains omitted or rejected declarations.');
     if (strings(parsed.fieldsTruncated, 20).length)
         issues.push('One or more normalised WHOIS fields were capped.');
     if (parsed.chainStatus === 'partial')
         issues.push('The WHOIS referral chain was incomplete or conflicting.');
     const conformance = strings(parsed.conformance, 30);
-    const redactions = Array.isArray(parsed.redactions) ? parsed.redactions.slice(0, 50) : [];
+    const redactions = Array.isArray(parsed.redactions) ? parsed.redactions.slice(0, MAX_RDAP_REDACTIONS) : [];
     return {
         source,
         state,
@@ -271,7 +313,20 @@ export function buildRegistryInsights(input) {
                 : counts.equivalent
                     ? 'consistent'
                     : 'unavailable';
-    const statuses = strings(rdap.statuses).length ? rdap.statuses : whois.statuses;
+    const rdapStatuses = statusInventory(rdap.statuses, MAX_RDAP_STATUSES);
+    const whoisStatuses = statusInventory(whois.statuses, MAX_WHOIS_STATUSES);
+    const publications = [
+        publicationDiagnostic('registry_rdap', input.rdapParsed, input.rdapStatus, input.rdapFetchedAt, rdapStatuses),
+        publicationDiagnostic('whois', input.whoisParsed, input.whoisStatus, input.whoisQueriedAt, whoisStatuses),
+        publicationDiagnostic('registrar_rdap', input.registrarRdapParsed, input.registrarRdapStatus, input.registrarRdapFetchedAt, statusInventory(registrarRdap.statuses, MAX_RDAP_STATUSES)),
+    ];
+    const lifecycleCandidates = [
+        { statuses: rdapStatuses.values, state: publications[0].state },
+        { statuses: whoisStatuses.values, state: publications[1].state },
+    ].filter((candidate) => candidate.state !== 'unavailable');
+    const lifecycleSource = lifecycleCandidates.find((candidate) => candidate.statuses.length)
+        ?? lifecycleCandidates[0]
+        ?? { statuses: [], state: 'unavailable' };
     const routes = [
         ...contactRoute('registry', rdap.abuse, 'Registry RDAP abuse entity'),
         ...contactRoute('registrar', rdap.registrar, 'Registry RDAP registrar entity'),
@@ -294,7 +349,7 @@ export function buildRegistryInsights(input) {
             whois: disclosure('whois', input.whoisParsed, input.whoisStatus),
             limitation: 'Disclosure state describes what each point-in-time source published. It does not infer the identity, intent, reachability, or legal status of a registrant.',
         },
-        lifecycle: lifecycle(statuses),
+        lifecycle: lifecycle(lifecycleSource.statuses, lifecycleSource.state),
         reconciliation: {
             state: reconciliationState,
             conflictCount,
@@ -312,11 +367,7 @@ export function buildRegistryInsights(input) {
                             ? 'The comparable fields are normalised as equivalent.'
                             : 'No comparable fields were available.',
         },
-        publications: [
-            publicationDiagnostic('registry_rdap', input.rdapParsed, input.rdapStatus, input.rdapFetchedAt),
-            publicationDiagnostic('whois', input.whoisParsed, input.whoisStatus, input.whoisQueriedAt),
-            publicationDiagnostic('registrar_rdap', input.registrarRdapParsed, input.registrarRdapStatus, input.registrarRdapFetchedAt),
-        ],
+        publications,
         rdapCapabilities: {
             registry: inspectRdapCapabilities(input.rdapParsed, input.rdapStatus),
             registrar: inspectRdapCapabilities(input.registrarRdapParsed, input.registrarRdapStatus),

package/lib/response-policy.mjs

@@ -1,7 +1,7 @@
 // Privacy-minimized interpretation of selected response policies. Header and
 // cookie values are read transiently from the already-selected homepage
 // response and reduced to fixed signal identifiers plus bounded counts.
-export const RESPONSE_POLICY_VERSION = 2;
+export const RESPONSE_POLICY_VERSION = 3;
 export const MAX_RESPONSE_POLICY_HEADER_BYTES = 8 * 1024;
 export const MAX_CSP_META_POLICIES = 4;
 export const MAX_RESPONSE_POLICY_DIRECTIVES = 64;
@@ -13,7 +13,9 @@ export const MIN_RECOMMENDED_HSTS_SECONDS = 180 * 24 * 60 * 60;
 const CONTROL_RE = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/;
 const DIRECTIVE_NAME_RE = /^[a-z][a-z0-9-]{0,63}$/;
 const ATTRIBUTE_NAME_RE = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]{1,128}$/;
-const CSP_NONCE_OR_HASH_RE = /^'(?:nonce-[^']+|sha(?:256|384|512)-[^']+)'$/i;
+// CSP source-list grammar, not an entropy or digest-strength judgement. Invalid
+// source expressions are ignored by browsers and cannot suppress unsafe-inline.
+const CSP_NONCE_OR_HASH_RE = /^'(?:nonce-|sha(?:256|384|512)-)[A-Za-z0-9+/_-]+={0,2}'$/i;
 const REFERRER_POLICIES = new Set([
     'no-referrer',
     'no-referrer-when-downgrade',
@@ -42,7 +44,8 @@ function readHeader(headers, name) {
         return { state: 'absent', value: null };
     if (CONTROL_RE.test(raw))
         return { state: 'malformed', value: null };
-    if (new TextEncoder().encode(raw).byteLength > MAX_RESPONSE_POLICY_HEADER_BYTES) {
+    if (raw.length > MAX_RESPONSE_POLICY_HEADER_BYTES
+        || new TextEncoder().encode(raw).byteLength > MAX_RESPONSE_POLICY_HEADER_BYTES) {
         return { state: 'partial', value: null };
     }
     return { state: 'present', value: raw.trim() };
@@ -55,61 +58,96 @@ function addSignal(signals, id, count) {
 function unavailableHeaderState(header) {
     return header.state === 'present' ? 'malformed' : header.state;
 }
-function analyzeCsp(header, signals) {
+function inlineControl(sources, scriptsBlocked) {
+    if (scriptsBlocked)
+        return 'restricted';
+    if (!sources)
+        return 'uncontrolled';
+    return sources.includes("'unsafe-inline'")
+        && !sources.includes("'strict-dynamic'")
+        && !sources.some((token) => CSP_NONCE_OR_HASH_RE.test(token))
+        ? 'unqualified'
+        : 'restricted';
+}
+function intersectInlineControls(controls) {
+    if (controls.includes('restricted'))
+        return 'restricted';
+    if (controls.includes('unknown'))
+        return 'unknown';
+    return controls.includes('unqualified') ? 'unqualified' : 'uncontrolled';
+}
+function analyzeCsp(header, signals, fromMeta = false) {
     if (header.state !== 'present' || !header.value) {
         return { state: unavailableHeaderState(header), inlineControl: 'unknown' };
     }
-    const directives = new Map();
+    // Fetch combines repeated policy headers with commas. Each policy is
+    // independently enforced; later policies cannot loosen an earlier one.
+    const policies = [];
+    let directiveCount = 0;
     let tokenCount = 0;
-    let partial = false;
-    for (const rawDirective of header.value.split(';')) {
-        const normalized = rawDirective.trim();
-        if (!normalized)
-            continue;
-        const [rawName = '', ...rawTokens] = normalized.split(/\s+/u);
-        const name = rawName.toLowerCase();
-        if (!DIRECTIVE_NAME_RE.test(name))
-            return { state: 'malformed', inlineControl: 'unknown' };
-        if (directives.has(name))
-            continue;
-        if (directives.size >= MAX_RESPONSE_POLICY_DIRECTIVES) {
-            partial = true;
-            break;
+    for (const rawPolicy of (fromMeta ? [header.value] : header.value.split(','))) {
+        const directives = new Map();
+        for (const rawDirective of rawPolicy.split(';')) {
+            const normalized = rawDirective.trim();
+            if (!normalized)
+                continue;
+            const [rawName = '', ...rawTokens] = normalized.split(/[\t\n\f\r ]+/u);
+            const name = rawName.toLowerCase();
+            if (!DIRECTIVE_NAME_RE.test(name))
+                return { state: 'malformed', inlineControl: 'unknown' };
+            // Duplicate directives use their first value. Count even ignored input
+            // against the aggregate work bound rather than resetting per policy.
+            directiveCount += 1;
+            tokenCount += rawTokens.length;
+            if (directiveCount > MAX_RESPONSE_POLICY_DIRECTIVES || tokenCount > MAX_RESPONSE_POLICY_TOKENS) {
+                return { state: 'partial', inlineControl: 'unknown' };
+            }
+            if (!directives.has(name))
+                directives.set(name, rawTokens.map((token) => token.toLowerCase()));
         }
-        const remaining = Math.max(0, MAX_RESPONSE_POLICY_TOKENS - tokenCount);
-        const tokens = rawTokens.slice(0, remaining).map((token) => token.toLowerCase());
-        if (tokens.length !== rawTokens.length)
-            partial = true;
-        tokenCount += tokens.length;
-        directives.set(name, tokens);
+        if (directives.size)
+            policies.push(directives);
     }
-    if (!directives.size)
+    if (!policies.length)
         return { state: 'malformed', inlineControl: 'unknown' };
-    const defaultSources = directives.get('default-src');
-    const scriptSources = directives.get('script-src') || defaultSources;
-    if (!defaultSources)
+    if (policies.every((policy) => !policy.has('default-src')))
         addSignal(signals, 'csp_default_source_missing');
-    if (!directives.has('base-uri'))
+    if (policies.every((policy) => !policy.has('base-uri')))
         addSignal(signals, 'csp_base_uri_missing');
-    if (!directives.has('object-src') && !defaultSources)
+    if (policies.every((policy) => !policy.has('object-src') && !policy.has('default-src'))) {
         addSignal(signals, 'csp_object_source_unbounded');
-    let inlineControl = scriptSources ? 'restricted' : 'uncontrolled';
-    if (scriptSources) {
-        if (scriptSources.some((token) => ['*', 'http:', 'https:', 'data:', 'blob:'].includes(token))) {
-            addSignal(signals, 'csp_permissive_script_source');
-        }
-        if (scriptSources.includes("'unsafe-eval'"))
-            addSignal(signals, 'csp_unsafe_eval');
-        if (scriptSources.includes("'unsafe-inline'")
-            && !scriptSources.some((token) => CSP_NONCE_OR_HASH_RE.test(token))) {
-            addSignal(signals, 'csp_unsafe_inline');
-            inlineControl = 'unqualified';
-        }
     }
-    return {
-        state: partial ? 'partial' : 'parsed',
-        inlineControl: partial ? 'unknown' : inlineControl,
-    };
+    const contexts = policies.map((policy) => {
+        const scripts = policy.get('script-src') ?? policy.get('default-src');
+        const elements = policy.get('script-src-elem') ?? scripts;
+        const attributes = policy.get('script-src-attr') ?? scripts;
+        const sandbox = fromMeta ? undefined : policy.get('sandbox');
+        const scriptsBlocked = sandbox !== undefined && !sandbox.includes('allow-scripts');
+        return {
+            blocks: inlineControl(elements, scriptsBlocked),
+            attributes: inlineControl(attributes, scriptsBlocked),
+            // script-src-elem/attr never govern evaluation, even when they contain
+            // an unsafe-eval token. An absent script/default source is uncontrolled.
+            evaluation: !scriptsBlocked && (!scripts || scripts.includes("'unsafe-eval'")),
+            declaresEvaluation: scripts?.includes("'unsafe-eval'") === true,
+            broadSource: !scriptsBlocked && (!elements || (!elements.includes("'strict-dynamic'")
+                && elements.some((token) => ['*', 'http:', 'https:', 'data:', 'blob:'].includes(token)))),
+            declaresBroadSource: elements !== undefined,
+        };
+    });
+    if (contexts.every((context) => context.broadSource) && contexts.some((context) => context.declaresBroadSource)) {
+        addSignal(signals, 'csp_permissive_script_source');
+    }
+    if (contexts.every((context) => context.evaluation) && contexts.some((context) => context.declaresEvaluation)) {
+        addSignal(signals, 'csp_unsafe_eval');
+    }
+    const blocks = intersectInlineControls(contexts.map((context) => context.blocks));
+    if (blocks === 'unqualified')
+        addSignal(signals, 'csp_unsafe_inline');
+    if (intersectInlineControls(contexts.map((context) => context.attributes)) === 'unqualified') {
+        addSignal(signals, 'csp_unsafe_inline_attributes');
+    }
+    return { state: 'parsed', inlineControl: blocks };
 }
 export function analyzeCspMetaPolicies(value, sourceTruncated = false) {
     const candidates = Array.isArray(value) ? value : [];
@@ -127,7 +165,7 @@ export function analyzeCspMetaPolicies(value, sourceTruncated = false) {
         }
         const policyContent = policy.content;
         const content = readHeader({ get: () => policyContent }, 'content-security-policy');
-        const analysis = analyzeCsp(content, []);
+        const analysis = analyzeCsp(content, [], true);
         if (analysis.state !== 'parsed') {
             truncated = true;
             continue;