@slicedearth/whoisleuth-cli 2.3.0 → 2.4.0

package/lib/registry-dates.mjs

@@ -1,190 +1,2 @@
-// Deterministic normalization for lifecycle dates published by RDAP and
-// WHOIS services. Raw upstream strings remain the provenance source; these
-// helpers only produce additive Date/ISO companions for comparison, storage,
-// and presentation.
-const REGISTRY_MONTHS = Object.freeze({
-    jan: 1, feb: 2, mar: 3, apr: 4, may: 5, jun: 6,
-    jul: 7, aug: 8, sep: 9, oct: 10, nov: 11, dec: 12,
-});
-const REGISTRY_MONTH_NAMES = Object.freeze({
-    january: 1, february: 2, march: 3, april: 4, may: 5, june: 6,
-    july: 7, august: 8, september: 9, october: 10, november: 11, december: 12,
-});
-function utcDateFromParts(year, month, day, hour = 0, minute = 0, second = 0, millisecond = 0) {
-    if (![year, month, day, hour, minute, second, millisecond].every(Number.isInteger))
-        return null;
-    if (year < 1000 || year > 9999 || month < 1 || month > 12 || day < 1
-        || hour < 0 || hour > 23 || minute < 0 || minute > 59
-        || second < 0 || second > 59 || millisecond < 0 || millisecond > 999)
-        return null;
-    const date = new Date(Date.UTC(year, month - 1, day, hour, minute, second, millisecond));
-    if (date.getUTCFullYear() !== year || date.getUTCMonth() !== month - 1 || date.getUTCDate() !== day
-        || date.getUTCHours() !== hour || date.getUTCMinutes() !== minute
-        || date.getUTCSeconds() !== second || date.getUTCMilliseconds() !== millisecond)
-        return null;
-    return date;
-}
-// Parse the explicit non-ISO formats observed across supported ccTLD WHOIS
-// services before considering ISO-shaped input. Runtime Date parsing treats
-// dotted dates ambiguously and timezone-less timestamps in the host's local
-// timezone, so every accepted shape is validated and normalized through UTC.
-function parseRegistryDate(input) {
-    if (typeof input !== 'string')
-        return null;
-    // The documented .nz WHOIS examples place one space before the RFC3339
-    // `T` separator. Canonicalize that registry-specific presentation quirk
-    // before applying the existing strict ISO-shaped parser.
-    const value = input.trim()
-        .replace(/^(\d{4}-\d{2}-\d{2})[ ]+[Tt](?=\d{2}:)/, '$1T')
-        // The .ee WHOIS service separates an otherwise ISO-shaped numeric
-        // timezone from its clock with one space.
-        .replace(/^(\d{4}-\d{2}-\d{2}[Tt ]\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?)[ ]+([+-]\d{2}:?\d{2})$/, '$1$2');
-    if (!value)
-        return null;
-    // DD.MM.YYYY[ HH:MM:SS] - e.g. 14.03.2024 10:46:48
-    let match = value.match(/^(\d{1,2})\.(\d{1,2})\.(\d{4})(?:\s+(\d{1,2}):(\d{2}):(\d{2}))?$/);
-    if (match) {
-        const [, day = '', month = '', year = '', hour = '0', minute = '0', second = '0'] = match;
-        return utcDateFromParts(+year, +month, +day, +(hour || 0), +(minute || 0), +(second || 0));
-    }
-    // YYYY. MM. DD. - e.g. 2006. 09. 18.
-    match = value.match(/^(\d{4})\.\s*(\d{1,2})\.\s*(\d{1,2})\.?$/);
-    if (match) {
-        const [, year = '', month = '', day = ''] = match;
-        return utcDateFromParts(+year, +month, +day);
-    }
-    // YYYY.MM.DD HH:MM:SS - used by NASK's .pl WHOIS service.
-    match = value.match(/^(\d{4})\.(\d{1,2})\.(\d{1,2})\s+(\d{1,2}):(\d{2}):(\d{2})$/);
-    if (match) {
-        const [, year = '', month = '', day = '', hour = '', minute = '', second = ''] = match;
-        return utcDateFromParts(+year, +month, +day, +hour, +minute, +second);
-    }
-    // YYYY/MM/DD - an unambiguous year-first form used by CIRA WHOIS.
-    match = value.match(/^(\d{4})\/(\d{1,2})\/(\d{1,2})$/);
-    if (match) {
-        const [, year = '', month = '', day = ''] = match;
-        return utcDateFromParts(+year, +month, +day);
-    }
-    // YYYYMMDD with an optional time or Registro.br contact-reference suffix.
-    // The raw value remains available as provenance while the validated date
-    // and optional clock time are projected into the additive ISO companion.
-    match = value.match(/^(\d{4})(\d{2})(\d{2})(?:\s+(\d{1,2}):(\d{2}):(\d{2})|\s+#[0-9]{1,20})?$/);
-    if (match) {
-        const [, year = '', month = '', day = '', hour = '0', minute = '0', second = '0'] = match;
-        return utcDateFromParts(+year, +month, +day, +(hour || 0), +(minute || 0), +(second || 0));
-    }
-    // YYYY-Mon-DD. - e.g. 1999-Feb-16.
-    match = value.match(/^(\d{4})-([A-Za-z]{3})-(\d{1,2})\.?$/);
-    if (match) {
-        const month = REGISTRY_MONTHS[(match[2] ?? '').toLowerCase()];
-        return month ? utcDateFromParts(+(match[1] ?? ''), month, +(match[3] ?? '')) : null;
-    }
-    // DD-Mon-YYYY[ HH:MM:SS] - used by several ICANN-style ccTLD services.
-    match = value.match(/^(\d{1,2})-([A-Za-z]{3})-(\d{4})(?:\s+(\d{1,2}):(\d{2}):(\d{2}))?$/);
-    if (match) {
-        const month = REGISTRY_MONTHS[(match[2] ?? '').toLowerCase()];
-        return month
-            ? utcDateFromParts(+(match[3] ?? ''), month, +(match[1] ?? ''), +(match[4] || 0), +(match[5] || 0), +(match[6] || 0))
-            : null;
-    }
-    // DD-MM-YYYY - the day-first form published by the currently profiled
-    // registries that use bare numeric hyphen dates. A future month-first
-    // source must receive its own marker-gated parser rather than reusing this
-    // global shape. The four-digit final year remains distinct from ISO below.
-    match = value.match(/^(\d{1,2})-(\d{1,2})-(\d{4})$/);
-    if (match) {
-        const [, day = '', month = '', year = ''] = match;
-        return utcDateFromParts(+year, +month, +day);
-    }
-    // YYYY-MM-DD HH:MM:SS (GMT+H:MM) - the explicit offset form published by
-    // the Kazakhstan registry. Parentheses and the GMT marker are required so
-    // unrelated prose is not accepted as a lifecycle timestamp.
-    match = value.match(/^(\d{4})-(\d{2})-(\d{2})\s+(\d{2}):(\d{2}):(\d{2})\s+\(GMT([+-])(\d{1,2}):(\d{2})\)$/i);
-    if (match) {
-        const [, year = '', month = '', day = '', hour = '', minute = '', second = '', sign = '', offsetHours = '', offsetMinutes = '',] = match;
-        const local = utcDateFromParts(+year, +month, +day, +hour, +minute, +second);
-        if (!local || +offsetHours > 23 || +offsetMinutes > 59)
-            return null;
-        const offsetMs = (+offsetHours * 60 + +offsetMinutes) * 60000;
-        return new Date(local.getTime() + (sign === '+' ? -offsetMs : offsetMs));
-    }
-    // DD-MM-YYYY HH:MM:SS GMT+H - the Tunisian registry's bounded local-time
-    // presentation. Accept an optional minute component but require the GMT
-    // marker and validate the calendar and offset before normalization.
-    match = value.match(/^(\d{1,2})-(\d{1,2})-(\d{4})\s+(\d{2}):(\d{2}):(\d{2})\s+GMT([+-])(\d{1,2})(?::(\d{2}))?$/i);
-    if (match) {
-        const [, day = '', month = '', year = '', hour = '', minute = '', second = '', sign = '', offsetHours = '', offsetMinutes = '0',] = match;
-        const local = utcDateFromParts(+year, +month, +day, +hour, +minute, +second);
-        if (!local || +offsetHours > 23 || +offsetMinutes > 59)
-            return null;
-        const offsetMs = (+offsetHours * 60 + +offsetMinutes) * 60000;
-        return new Date(local.getTime() + (sign === '+' ? -offsetMs : offsetMs));
-    }
-    // DD Mon YYYY - the compact English month form published by THNIC.
-    match = value.match(/^(\d{1,2})\s+([A-Za-z]{3})\s+(\d{4})$/);
-    if (match) {
-        const month = REGISTRY_MONTHS[(match[2] ?? '').toLowerCase()];
-        return month ? utcDateFromParts(+(match[3] ?? ''), month, +(match[1] ?? '')) : null;
-    }
-    // Ordinal-day Month YYYY[ at HH:MM:SS.sss] - the English form published
-    // by the Channel Islands registry. The suffix and `at` token are required
-    // so ordinary prose containing a month name is not accepted as lifecycle
-    // evidence.
-    match = value.match(/^(\d{1,2})(st|nd|rd|th)\s+([A-Za-z]{3,9})\s+(\d{4})(?:\s+at\s+(\d{1,2}):(\d{2}):(\d{2})(?:\.(\d{1,3}))?)?$/i);
-    if (match) {
-        const day = +(match[1] ?? '');
-        const suffix = (match[2] ?? '').toLowerCase();
-        const expectedSuffix = day % 100 >= 11 && day % 100 <= 13
-            ? 'th'
-            : ({ 1: 'st', 2: 'nd', 3: 'rd' }[day % 10] || 'th');
-        if (suffix !== expectedSuffix)
-            return null;
-        const monthText = (match[3] ?? '').toLowerCase();
-        const month = REGISTRY_MONTH_NAMES[monthText] || REGISTRY_MONTHS[monthText];
-        const millisecond = match[8] ? Number(`${match[8]}00`.slice(0, 3)) : 0;
-        return month
-            ? utcDateFromParts(+(match[4] ?? ''), month, day, +(match[5] || 0), +(match[6] || 0), +(match[7] || 0), millisecond)
-            : null;
-    }
-    // Ddd Mon DD YYYY[ HH:MM:SS] - the English textual form used by the
-    // Belgian registry. Weekday text is presentation-only; the validated
-    // calendar components determine the canonical UTC companion.
-    match = value.match(/^(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun)\s+([A-Za-z]{3})\s+(\d{1,2})\s+(\d{4})(?:\s+(\d{1,2}):(\d{2}):(\d{2}))?$/i);
-    if (match) {
-        const month = REGISTRY_MONTHS[(match[1] ?? '').toLowerCase()];
-        return month
-            ? utcDateFromParts(+(match[3] ?? ''), month, +(match[2] ?? ''), +(match[4] || 0), +(match[5] || 0), +(match[6] || 0))
-            : null;
-    }
-    // Month DD YYYY - ISNIC publishes English month names with variable
-    // spacing and no timezone. Keep the accepted shape narrow and accept only
-    // the twelve exact English names from a fixed table.
-    match = value.match(/^([A-Za-z]{3,9})\s+(\d{1,2})\s+(\d{4})$/);
-    if (match) {
-        const month = REGISTRY_MONTH_NAMES[(match[1] ?? '').toLowerCase()];
-        return month ? utcDateFromParts(+(match[3] ?? ''), month, +(match[2] ?? '')) : null;
-    }
-    // ISO 8601-shaped dates and timestamps. A missing timezone is deliberately
-    // interpreted as UTC so Express and function deployments agree.
-    match = value.match(/^(\d{4})-(\d{2})-(\d{2})(?:[Tt ](\d{2}):(\d{2})(?::(\d{2})(?:\.(\d{1,9}))?)?(?:([Zz])|([+-])(\d{2}):?(\d{2}))?)?$/);
-    if (!match)
-        return null;
-    const [, year = '', month = '', day = '', hour = '0', minute = '0', second = '0', fraction, zulu, offsetSign, offsetHours = '0', offsetMinutes = '0',] = match;
-    const millisecond = fraction ? Number(`${fraction}000`.slice(0, 3)) : 0;
-    const local = utcDateFromParts(+year, +month, +day, +(hour || 0), +(minute || 0), +(second || 0), millisecond);
-    if (!local)
-        return null;
-    if (!offsetSign || zulu)
-        return local;
-    const offsetHour = +offsetHours;
-    const offsetMinute = +offsetMinutes;
-    if (offsetHour > 23 || offsetMinute > 59)
-        return null;
-    const offsetMs = (offsetHour * 60 + offsetMinute) * 60000;
-    return new Date(local.getTime() + (offsetSign === '+' ? -offsetMs : offsetMs));
-}
-function registryDateIso(value) {
-    const date = parseRegistryDate(value);
-    return date ? date.toISOString() : null;
-}
-export { parseRegistryDate, registryDateIso };
+// Stable source-facing entry point; portable consumers use the evidence owner.
+export { parseRegistryDate, registryDateIso } from "../packages/evidence/registry-dates.mjs";

package/lib/registry-insights.mjs

@@ -7,6 +7,8 @@
 import { compareRegistrySources } from "./registry-comparison.mjs";
 import { inspectRdapCapabilities } from "./rdap-capabilities.mjs";
 import { isRecord, recordOrEmpty } from "./json-record.mjs";
+import { MAX_RDAP_REDACTIONS, MAX_RDAP_STATUSES } from "./rdap-types.mjs";
+import { MAX_WHOIS_STATUSES } from "./whois-contracts.mjs";
 export const REGISTRY_INSIGHTS_VERSION = 1;
 export const MAX_REGISTRY_INSIGHT_STATUSES = 40;
 export const MAX_REGISTRY_INSIGHT_ISSUES = 12;
@@ -37,6 +39,20 @@ function strings(value, maximum = MAX_REGISTRY_INSIGHT_STATUSES) {
 function normalizedStatus(value) {
     return text(value, 160).toLowerCase().replace(/[^\p{L}\p{N}]+/gu, '');
 }
+function statusInventory(value, maximum) {
+    if (!Array.isArray(value))
+        return { values: [], partial: value !== undefined };
+    const unique = new Set();
+    let partial = value.length > maximum;
+    for (const item of value.slice(0, maximum)) {
+        if (typeof item !== 'string' || item.length > 160 || CONTROL_RE.test(item) || !item.trim()) {
+            partial = true;
+            continue;
+        }
+        unique.add(item.trim());
+    }
+    return { values: [...unique], partial };
+}
 function sourceState(status, partial) {
     if (partial || status === 'partial')
         return 'partial';
@@ -45,9 +61,13 @@ function sourceState(status, partial) {
         ? 'complete'
         : 'unavailable';
 }
-function redactionBlob(parsed) {
-    const redactions = Array.isArray(parsed.redactions) ? parsed.redactions.slice(0, 50) : [];
-    return redactions.map((item) => {
+function registrantRedactionBlob(parsed) {
+    const redactions = Array.isArray(parsed.redactions) ? parsed.redactions.slice(0, MAX_RDAP_REDACTIONS) : [];
+    return redactions.filter((item) => {
+        // A path or reason can mention a role without selecting it. Do not infer
+        // registrant scope from arbitrary JSONPath expressions or other prose.
+        return /^(?:registry )?registrant(?:\b|$)/iu.test(text(record(item).name, 240));
+    }).map((item) => {
         const value = record(item);
         return [
             value.name,
@@ -92,7 +112,8 @@ function disclosure(source, parsedValue, status) {
         ? parsed.chainStatus === 'partial' || strings(parsed.fieldsTruncated, 20).length > 0
         : parsed.serverTruncated === true
             || parsed.entitiesTruncated === true
-            || parsed.statusesTruncated === true;
+            || parsed.statusesTruncated === true
+            || parsed.redactionsTruncated === true;
     const publicationState = sourceState(status, partial);
     if (publicationState === 'unavailable') {
         return {
@@ -110,7 +131,7 @@ function disclosure(source, parsedValue, status) {
             parsed.registrantPhone,
             parsed.registrantAddress,
         ].map((part) => text(part, 320)).filter(Boolean).join(' ');
-    const redactions = redactionBlob(parsed);
+    const redactions = registrantRedactionBlob(parsed);
     const combined = `${registrant} ${redactions}`.trim();
     if (WITHHELD_RE.test(combined)) {
         return { source, state: 'withheld', detail: 'The publication indicates that registrant data was withheld or not disclosed.' };
@@ -124,6 +145,13 @@ function disclosure(source, parsedValue, status) {
     if (registrant) {
         return { source, state: 'public', detail: 'The source published at least one usable registrant contact field.' };
     }
+    if (Array.isArray(parsed.redactions) && parsed.redactions.length > 0) {
+        return {
+            source,
+            state: 'unavailable',
+            detail: 'Redaction declarations do not establish registrant scope, so missing registrant fields remain unclassified.',
+        };
+    }
     if (publicationState === 'partial') {
         return {
             source,
@@ -137,9 +165,9 @@ function disclosure(source, parsedValue, status) {
         detail: 'The source completed without a usable registrant contact or an explicit disclosure marker.',
     };
 }
-function lifecycle(statusesValue, evidenceState) {
-    const rawStatuses = strings(statusesValue);
-    const normalized = rawStatuses.map(normalizedStatus);
+function lifecycle(statuses, evidenceState) {
+    const rawStatuses = statuses.slice(0, MAX_REGISTRY_INSIGHT_STATUSES);
+    const normalized = statuses.map(normalizedStatus);
     const has = (value) => normalized.includes(value);
     const observedState = (value) => has(value) ? true : evidenceState === 'complete' ? false : null;
     const pendingDelete = observedState('pendingdelete');
@@ -200,16 +228,20 @@ function lifecycle(statusesValue, evidenceState) {
             serverStatuses: serverLocks,
         },
         acquisitionPath,
-        limitation: 'EPP statuses describe the current registry lifecycle. They do not guarantee deletion, release timing, transfer completion, eligibility, price, or acquisition success.',
+        limitation: 'EPP statuses describe the current registry lifecycle. They do not guarantee deletion, release timing, transfer completion, eligibility, price, or acquisition success.'
+            + (statuses.length > rawStatuses.length ? ` The display lists ${rawStatuses.length} of ${statuses.length} distinct statuses; lifecycle decisions use the full admitted inventory.` : ''),
     };
 }
-function publicationDiagnostic(source, parsedValue, status, observedAt) {
+function publicationDiagnostic(source, parsedValue, status, observedAt, statuses) {
     const usablePublication = isRecord(parsedValue);
     const parsed = record(parsedValue);
     const partial = parsed.serverTruncated === true
         || parsed.chainStatus === 'partial'
         || parsed.entitiesTruncated === true
         || parsed.statusesTruncated === true
+        || statuses.partial
+        || parsed.eventsTruncated === true
+        || parsed.redactionsTruncated === true
         || strings(parsed.fieldsTruncated, 20).length > 0;
     const state = usablePublication ? sourceState(status, partial) : 'unavailable';
     const issues = [];
@@ -219,14 +251,18 @@ function publicationDiagnostic(source, parsedValue, status, observedAt) {
         issues.push('The RDAP server declared a truncated response.');
     if (parsed.entitiesTruncated === true)
         issues.push('The normalised entity inventory was capped.');
-    if (parsed.statusesTruncated === true)
-        issues.push('The normalised status inventory was capped.');
+    if (parsed.statusesTruncated === true || statuses.partial)
+        issues.push('The normalised status inventory contains omitted or rejected values.');
+    if (parsed.eventsTruncated === true)
+        issues.push('The normalised event inventory contains omitted or rejected fields.');
+    if (parsed.redactionsTruncated === true)
+        issues.push('The normalised redaction inventory contains omitted or rejected declarations.');
     if (strings(parsed.fieldsTruncated, 20).length)
         issues.push('One or more normalised WHOIS fields were capped.');
     if (parsed.chainStatus === 'partial')
         issues.push('The WHOIS referral chain was incomplete or conflicting.');
     const conformance = strings(parsed.conformance, 30);
-    const redactions = Array.isArray(parsed.redactions) ? parsed.redactions.slice(0, 50) : [];
+    const redactions = Array.isArray(parsed.redactions) ? parsed.redactions.slice(0, MAX_RDAP_REDACTIONS) : [];
     return {
         source,
         state,
@@ -277,14 +313,16 @@ export function buildRegistryInsights(input) {
                 : counts.equivalent
                     ? 'consistent'
                     : 'unavailable';
+    const rdapStatuses = statusInventory(rdap.statuses, MAX_RDAP_STATUSES);
+    const whoisStatuses = statusInventory(whois.statuses, MAX_WHOIS_STATUSES);
     const publications = [
-        publicationDiagnostic('registry_rdap', input.rdapParsed, input.rdapStatus, input.rdapFetchedAt),
-        publicationDiagnostic('whois', input.whoisParsed, input.whoisStatus, input.whoisQueriedAt),
-        publicationDiagnostic('registrar_rdap', input.registrarRdapParsed, input.registrarRdapStatus, input.registrarRdapFetchedAt),
+        publicationDiagnostic('registry_rdap', input.rdapParsed, input.rdapStatus, input.rdapFetchedAt, rdapStatuses),
+        publicationDiagnostic('whois', input.whoisParsed, input.whoisStatus, input.whoisQueriedAt, whoisStatuses),
+        publicationDiagnostic('registrar_rdap', input.registrarRdapParsed, input.registrarRdapStatus, input.registrarRdapFetchedAt, statusInventory(registrarRdap.statuses, MAX_RDAP_STATUSES)),
     ];
     const lifecycleCandidates = [
-        { statuses: strings(rdap.statuses), state: publications[0].state },
-        { statuses: strings(whois.statuses), state: publications[1].state },
+        { statuses: rdapStatuses.values, state: publications[0].state },
+        { statuses: whoisStatuses.values, state: publications[1].state },
     ].filter((candidate) => candidate.state !== 'unavailable');
     const lifecycleSource = lifecycleCandidates.find((candidate) => candidate.statuses.length)
         ?? lifecycleCandidates[0]

package/lib/response-policy.mjs

@@ -1,7 +1,7 @@
 // Privacy-minimized interpretation of selected response policies. Header and
 // cookie values are read transiently from the already-selected homepage
 // response and reduced to fixed signal identifiers plus bounded counts.
-export const RESPONSE_POLICY_VERSION = 2;
+export const RESPONSE_POLICY_VERSION = 3;
 export const MAX_RESPONSE_POLICY_HEADER_BYTES = 8 * 1024;
 export const MAX_CSP_META_POLICIES = 4;
 export const MAX_RESPONSE_POLICY_DIRECTIVES = 64;
@@ -13,7 +13,9 @@ export const MIN_RECOMMENDED_HSTS_SECONDS = 180 * 24 * 60 * 60;
 const CONTROL_RE = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/;
 const DIRECTIVE_NAME_RE = /^[a-z][a-z0-9-]{0,63}$/;
 const ATTRIBUTE_NAME_RE = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]{1,128}$/;
-const CSP_NONCE_OR_HASH_RE = /^'(?:nonce-[^']+|sha(?:256|384|512)-[^']+)'$/i;
+// CSP source-list grammar, not an entropy or digest-strength judgement. Invalid
+// source expressions are ignored by browsers and cannot suppress unsafe-inline.
+const CSP_NONCE_OR_HASH_RE = /^'(?:nonce-|sha(?:256|384|512)-)[A-Za-z0-9+/_-]+={0,2}'$/i;
 const REFERRER_POLICIES = new Set([
     'no-referrer',
     'no-referrer-when-downgrade',
@@ -42,7 +44,8 @@ function readHeader(headers, name) {
         return { state: 'absent', value: null };
     if (CONTROL_RE.test(raw))
         return { state: 'malformed', value: null };
-    if (new TextEncoder().encode(raw).byteLength > MAX_RESPONSE_POLICY_HEADER_BYTES) {
+    if (raw.length > MAX_RESPONSE_POLICY_HEADER_BYTES
+        || new TextEncoder().encode(raw).byteLength > MAX_RESPONSE_POLICY_HEADER_BYTES) {
         return { state: 'partial', value: null };
     }
     return { state: 'present', value: raw.trim() };
@@ -55,61 +58,96 @@ function addSignal(signals, id, count) {
 function unavailableHeaderState(header) {
     return header.state === 'present' ? 'malformed' : header.state;
 }
-function analyzeCsp(header, signals) {
+function inlineControl(sources, scriptsBlocked) {
+    if (scriptsBlocked)
+        return 'restricted';
+    if (!sources)
+        return 'uncontrolled';
+    return sources.includes("'unsafe-inline'")
+        && !sources.includes("'strict-dynamic'")
+        && !sources.some((token) => CSP_NONCE_OR_HASH_RE.test(token))
+        ? 'unqualified'
+        : 'restricted';
+}
+function intersectInlineControls(controls) {
+    if (controls.includes('restricted'))
+        return 'restricted';
+    if (controls.includes('unknown'))
+        return 'unknown';
+    return controls.includes('unqualified') ? 'unqualified' : 'uncontrolled';
+}
+function analyzeCsp(header, signals, fromMeta = false) {
     if (header.state !== 'present' || !header.value) {
         return { state: unavailableHeaderState(header), inlineControl: 'unknown' };
     }
-    const directives = new Map();
+    // Fetch combines repeated policy headers with commas. Each policy is
+    // independently enforced; later policies cannot loosen an earlier one.
+    const policies = [];
+    let directiveCount = 0;
     let tokenCount = 0;
-    let partial = false;
-    for (const rawDirective of header.value.split(';')) {
-        const normalized = rawDirective.trim();
-        if (!normalized)
-            continue;
-        const [rawName = '', ...rawTokens] = normalized.split(/\s+/u);
-        const name = rawName.toLowerCase();
-        if (!DIRECTIVE_NAME_RE.test(name))
-            return { state: 'malformed', inlineControl: 'unknown' };
-        if (directives.has(name))
-            continue;
-        if (directives.size >= MAX_RESPONSE_POLICY_DIRECTIVES) {
-            partial = true;
-            break;
+    for (const rawPolicy of (fromMeta ? [header.value] : header.value.split(','))) {
+        const directives = new Map();
+        for (const rawDirective of rawPolicy.split(';')) {
+            const normalized = rawDirective.trim();
+            if (!normalized)
+                continue;
+            const [rawName = '', ...rawTokens] = normalized.split(/[\t\n\f\r ]+/u);
+            const name = rawName.toLowerCase();
+            if (!DIRECTIVE_NAME_RE.test(name))
+                return { state: 'malformed', inlineControl: 'unknown' };
+            // Duplicate directives use their first value. Count even ignored input
+            // against the aggregate work bound rather than resetting per policy.
+            directiveCount += 1;
+            tokenCount += rawTokens.length;
+            if (directiveCount > MAX_RESPONSE_POLICY_DIRECTIVES || tokenCount > MAX_RESPONSE_POLICY_TOKENS) {
+                return { state: 'partial', inlineControl: 'unknown' };
+            }
+            if (!directives.has(name))
+                directives.set(name, rawTokens.map((token) => token.toLowerCase()));
         }
-        const remaining = Math.max(0, MAX_RESPONSE_POLICY_TOKENS - tokenCount);
-        const tokens = rawTokens.slice(0, remaining).map((token) => token.toLowerCase());
-        if (tokens.length !== rawTokens.length)
-            partial = true;
-        tokenCount += tokens.length;
-        directives.set(name, tokens);
+        if (directives.size)
+            policies.push(directives);
     }
-    if (!directives.size)
+    if (!policies.length)
         return { state: 'malformed', inlineControl: 'unknown' };
-    const defaultSources = directives.get('default-src');
-    const scriptSources = directives.get('script-src') || defaultSources;
-    if (!defaultSources)
+    if (policies.every((policy) => !policy.has('default-src')))
         addSignal(signals, 'csp_default_source_missing');
-    if (!directives.has('base-uri'))
+    if (policies.every((policy) => !policy.has('base-uri')))
         addSignal(signals, 'csp_base_uri_missing');
-    if (!directives.has('object-src') && !defaultSources)
+    if (policies.every((policy) => !policy.has('object-src') && !policy.has('default-src'))) {
         addSignal(signals, 'csp_object_source_unbounded');
-    let inlineControl = scriptSources ? 'restricted' : 'uncontrolled';
-    if (scriptSources) {
-        if (scriptSources.some((token) => ['*', 'http:', 'https:', 'data:', 'blob:'].includes(token))) {
-            addSignal(signals, 'csp_permissive_script_source');
-        }
-        if (scriptSources.includes("'unsafe-eval'"))
-            addSignal(signals, 'csp_unsafe_eval');
-        if (scriptSources.includes("'unsafe-inline'")
-            && !scriptSources.some((token) => CSP_NONCE_OR_HASH_RE.test(token))) {
-            addSignal(signals, 'csp_unsafe_inline');
-            inlineControl = 'unqualified';
-        }
     }
-    return {
-        state: partial ? 'partial' : 'parsed',
-        inlineControl: partial ? 'unknown' : inlineControl,
-    };
+    const contexts = policies.map((policy) => {
+        const scripts = policy.get('script-src') ?? policy.get('default-src');
+        const elements = policy.get('script-src-elem') ?? scripts;
+        const attributes = policy.get('script-src-attr') ?? scripts;
+        const sandbox = fromMeta ? undefined : policy.get('sandbox');
+        const scriptsBlocked = sandbox !== undefined && !sandbox.includes('allow-scripts');
+        return {
+            blocks: inlineControl(elements, scriptsBlocked),
+            attributes: inlineControl(attributes, scriptsBlocked),
+            // script-src-elem/attr never govern evaluation, even when they contain
+            // an unsafe-eval token. An absent script/default source is uncontrolled.
+            evaluation: !scriptsBlocked && (!scripts || scripts.includes("'unsafe-eval'")),
+            declaresEvaluation: scripts?.includes("'unsafe-eval'") === true,
+            broadSource: !scriptsBlocked && (!elements || (!elements.includes("'strict-dynamic'")
+                && elements.some((token) => ['*', 'http:', 'https:', 'data:', 'blob:'].includes(token)))),
+            declaresBroadSource: elements !== undefined,
+        };
+    });
+    if (contexts.every((context) => context.broadSource) && contexts.some((context) => context.declaresBroadSource)) {
+        addSignal(signals, 'csp_permissive_script_source');
+    }
+    if (contexts.every((context) => context.evaluation) && contexts.some((context) => context.declaresEvaluation)) {
+        addSignal(signals, 'csp_unsafe_eval');
+    }
+    const blocks = intersectInlineControls(contexts.map((context) => context.blocks));
+    if (blocks === 'unqualified')
+        addSignal(signals, 'csp_unsafe_inline');
+    if (intersectInlineControls(contexts.map((context) => context.attributes)) === 'unqualified') {
+        addSignal(signals, 'csp_unsafe_inline_attributes');
+    }
+    return { state: 'parsed', inlineControl: blocks };
 }
 export function analyzeCspMetaPolicies(value, sourceTruncated = false) {
     const candidates = Array.isArray(value) ? value : [];
@@ -127,7 +165,7 @@ export function analyzeCspMetaPolicies(value, sourceTruncated = false) {
         }
         const policyContent = policy.content;
         const content = readHeader({ get: () => policyContent }, 'content-security-policy');
-        const analysis = analyzeCsp(content, []);
+        const analysis = analyzeCsp(content, [], true);
         if (analysis.state !== 'parsed') {
             truncated = true;
             continue;

package/lib/risk-calibration-summary.mjs

@@ -207,6 +207,15 @@ export function parseRiskCalibrationSummaryReport(raw) {
         throw new Error('Risk calibration summary must contain the fixed threshold set exactly once.');
     }
     const thresholds = Object.freeze(root.thresholds.map((value, index) => thresholdMetrics(value, `Threshold ${index + 1}`, RISK_CALIBRATION_SUMMARY_THRESHOLDS[index], positive + negative, positive, negative)));
+    for (let index = 1; index < thresholds.length; index += 1) {
+        const lower = thresholds[index - 1];
+        const higher = thresholds[index];
+        // The population and class totals are already fixed by thresholdMetrics.
+        // Raising the threshold can remove positive classifications, never add them.
+        if (higher.truePositive > lower.truePositive || higher.falsePositive > lower.falsePositive) {
+            throw new Error('Risk calibration positive classifications increase at a higher threshold.');
+        }
+    }
     if (!Array.isArray(root.strata) || root.strata.length > MAX_RISK_CALIBRATION_SUMMARY_STRATA) {
         throw new Error('Risk calibration strata must be a bounded array.');
     }
@@ -243,13 +252,18 @@ export function parseRiskCalibrationSummaryReport(raw) {
             metrics: thresholdMetrics(stratum.metrics, `${label} metrics`, currentReviewThreshold, sampleCount),
         });
     }));
+    const currentMetrics = thresholds.find((metric) => metric.threshold === currentReviewThreshold);
     for (const dimension of ['review_reason', 'scan_depth']) {
-        const dimensionTotal = strata
-            .filter((stratum) => stratum.dimension === dimension)
-            .reduce((sum, stratum) => sum + stratum.sampleCount, 0);
+        const members = strata.filter((stratum) => stratum.dimension === dimension);
+        const dimensionTotal = members.reduce((sum, stratum) => sum + stratum.sampleCount, 0);
         if (dimensionTotal !== positive + negative) {
             throw new Error(`Risk calibration ${dimension.replace('_', '-')} strata do not cover every included label exactly once.`);
         }
+        for (const field of ['truePositive', 'falsePositive', 'trueNegative', 'falseNegative']) {
+            if (members.reduce((sum, stratum) => sum + stratum.metrics[field], 0) !== currentMetrics[field]) {
+                throw new Error(`Risk calibration ${dimension.replace('_', '-')} strata disagree with the current-threshold confusion counts.`);
+            }
+        }
     }
     const comparison = object(root.modelComparison, 'Risk model comparison');
     exactKeys(comparison, MODEL_COMPARISON_KEYS, 'Risk model comparison');

package/lib/rpki-evidence.mjs

@@ -9,9 +9,10 @@ function record(value) {
         : null;
 }
 function normalizeAsn(value) {
-    const text = typeof value === 'string' ? value.trim().replace(/^AS/iu, '') : value;
-    const number = Number(text);
-    return Number.isInteger(number) && number >= 0 && number <= 4_294_967_295 ? number : null;
+    const number = typeof value === 'number' ? value
+        : typeof value === 'string' && value.length <= 16 && /^(?:AS)?\d{1,10}$/iu.test(value.trim())
+            ? Number(value.trim().replace(/^AS/iu, '')) : NaN;
+    return Number.isSafeInteger(number) && number >= 0 && number <= 4_294_967_295 ? number : null;
 }
 function normalizeAuthorization(value) {
     const source = record(value);
@@ -21,7 +22,8 @@ function normalizeAuthorization(value) {
     const parsedPrefix = parseIpPrefix(prefix);
     const asn = normalizeAsn(source.asn ?? source.asID ?? source.origin);
     const maxLengthValue = source.maxLength ?? source.max_length ?? parsedPrefix?.length;
-    const maxLength = Number(maxLengthValue);
+    const maxLength = typeof maxLengthValue === 'number' ? maxLengthValue
+        : typeof maxLengthValue === 'string' && /^\d{1,3}$/u.test(maxLengthValue) ? Number(maxLengthValue) : NaN;
     const maximum = parsedPrefix?.family === 4 ? 32 : 128;
     if (!parsedPrefix || asn === null || !Number.isInteger(maxLength)
         || maxLength < parsedPrefix.length || maxLength > maximum)
@@ -49,8 +51,9 @@ function reviewRpkiRoute(input) {
     const baseLimitations = Object.freeze([
         'This offline review evaluates an explicitly supplied route prefix and origin ASN against an analyst-supplied VRP snapshot.',
         'It does not collect BGP announcements, establish route ownership, or prove that the snapshot was current or complete.',
+        'AS0 authorisations do not authorise an announcement. An AS0 route origin is invalid input; snapshot validation and signature verification remain external to this review.',
     ]);
-    if (!route || originAsn === null || !rows) {
+    if (!route || originAsn === null || originAsn === 0 || !rows) {
         return Object.freeze({
             schema: RPKI_EVIDENCE_SCHEMA,
             version: RPKI_EVIDENCE_VERSION,