@slicedearth/whoisleuth-cli 2.3.0 → 2.4.0

package/lib/threat-intelligence-manifests.mjs

@@ -1,5 +1,7 @@
 import { registerCuratedConnector, registerThreatIntelligenceProvider, isCuratedConnectorDefinition, isThreatIntelligenceProvider, } from "./threat-intelligence-definition-registry.mjs";
 import { CURATED_CONNECTOR_CONTRACT_VERSION, MAX_CACHE_TTL_MS, MAX_CONNECTOR_ENTITIES, MAX_CONNECTOR_RELATIONSHIPS, MAX_RESPONSE_BYTES, MAX_TIMEOUT_MS, THREAT_INTELLIGENCE_CONTRACT_VERSION, } from "./threat-intelligence-runtime.mjs";
+import { boundedInteger, boundedHttpsUrl, enumValue, exactKeys, isRecord, strictBoundedString, } from "./bounded-contract-normalizers.mjs";
+import { THREAT_INTELLIGENCE_CAPABILITIES, THREAT_INTELLIGENCE_TARGET_EXPOSURES, CURATED_CONNECTOR_KINDS, CURATED_CONNECTOR_COLLECTIONS, CURATED_CONNECTOR_CREDENTIAL_MODES, CURATED_CONNECTOR_ENTITY_VALUES, CURATED_CONNECTOR_RELATIONSHIP_TYPES, CURATED_CONNECTOR_TARGET_EXPOSURES, CURATED_CONNECTOR_RELATIONSHIP_ENDPOINTS as CONNECTOR_RELATIONSHIP_ENDPOINTS, } from "./threat-intelligence-types.mjs";
 import { normalizeLegacyIsoTimestamp } from "../packages/evidence/observation.mjs";
 const MAX_PROVIDER_ID_LENGTH = 40;
 const MAX_PROVIDER_LABEL_LENGTH = 100;
@@ -7,17 +9,8 @@ const MAX_URL_LENGTH = 2_048;
 const MAX_REQUEST_BUDGET = 1_000_000;
 const MAX_CONNECTOR_SCOPES = 20;
 const MAX_CONNECTOR_SCOPE_LENGTH = 80;
-const CAPABILITIES = new Set([
-    'domain_lookup',
-    'url_lookup',
-    'indicator_search',
-]);
-const URL_EXPOSURES = new Set([
-    'registrable_domain',
-    'hostname',
-    'origin',
-    'full_url',
-]);
+const CAPABILITIES = new Set(THREAT_INTELLIGENCE_CAPABILITIES);
+const URL_EXPOSURES = new Set(THREAT_INTELLIGENCE_TARGET_EXPOSURES);
 const COMMERCIAL_USE = new Set(['allowed', 'restricted', 'unknown']);
 const ATTRIBUTION = new Set(['required', 'not_required', 'unknown']);
 const CACHING = new Set([
@@ -39,137 +32,16 @@ const REDISTRIBUTION = new Set([
     'prohibited',
     'unknown',
 ]);
-const CONNECTOR_KINDS = new Set([
-    'discovery',
-    'enrichment',
-]);
-const CONNECTOR_COLLECTIONS = new Set([
-    'passive',
-    'active',
-    'third_party',
-]);
-const CONNECTOR_CREDENTIAL_MODES = new Set([
-    'none',
-    'optional',
-    'required',
-]);
-const CONNECTOR_ENTITY_TYPES = new Set([
-    'domain',
-    'hostname',
-    'url',
-    'ipv4',
-    'ipv6',
-    'asn',
-    'certificate',
-]);
-const CONNECTOR_RELATIONSHIP_TYPES = new Set([
-    'domain_resolves_to_ip',
-    'domain_uses_nameserver',
-    'domain_uses_mail_server',
-    'domain_presented_certificate',
-    'certificate_names_domain',
-    'ip_hosts_domain',
-    'domain_related_to_domain',
-]);
-const CONNECTOR_TARGET_EXPOSURES = Object.freeze({
-    domain: new Set(['registrable_domain']),
-    hostname: new Set(['hostname']),
-    url: new Set([
-        'registrable_domain',
-        'hostname',
-        'origin',
-        'full_url',
-    ]),
-    ipv4: new Set(['ip_address']),
-    ipv6: new Set(['ip_address']),
-    asn: new Set(['asn']),
-    certificate: new Set([
-        'certificate_fingerprint',
-    ]),
-});
-const CONNECTOR_RELATIONSHIP_ENDPOINTS = Object.freeze({
-    domain_resolves_to_ip: {
-        from: new Set(['domain', 'hostname']),
-        to: new Set(['ipv4', 'ipv6']),
-    },
-    domain_uses_nameserver: {
-        from: new Set(['domain']),
-        to: new Set(['hostname']),
-    },
-    domain_uses_mail_server: {
-        from: new Set(['domain']),
-        to: new Set(['hostname']),
-    },
-    domain_presented_certificate: {
-        from: new Set(['domain', 'hostname']),
-        to: new Set(['certificate']),
-    },
-    certificate_names_domain: {
-        from: new Set(['certificate']),
-        to: new Set(['domain', 'hostname']),
-    },
-    ip_hosts_domain: {
-        from: new Set(['ipv4', 'ipv6']),
-        to: new Set(['domain', 'hostname']),
-    },
-    domain_related_to_domain: {
-        from: new Set(['domain', 'hostname']),
-        to: new Set(['domain', 'hostname']),
-    },
-});
-function isRecord(value) {
-    return Boolean(value && typeof value === 'object' && !Array.isArray(value));
-}
-function exactKeys(value, allowed, label) {
-    if (!isRecord(value))
-        throw new TypeError(`${label} must be an object`);
-    const unknown = Object.keys(value).find((key) => !allowed.has(key));
-    if (unknown) {
-        throw new TypeError(`${label} contains an unknown field: ${unknown}`);
-    }
-}
-function strictBoundedString(value, maximum) {
-    if (typeof value !== 'string' ||
-        value.length > maximum ||
-        /[\u0000-\u001f\u007f]/u.test(value)) {
-        return null;
-    }
-    const normalized = value.trim().replace(/\s+/gu, ' ');
-    return normalized && normalized.length <= maximum ? normalized : null;
-}
+const CONNECTOR_KINDS = new Set(CURATED_CONNECTOR_KINDS);
+const CONNECTOR_COLLECTIONS = new Set(CURATED_CONNECTOR_COLLECTIONS);
+const CONNECTOR_CREDENTIAL_MODES = new Set(CURATED_CONNECTOR_CREDENTIAL_MODES);
+const CONNECTOR_ENTITY_TYPES = new Set(CURATED_CONNECTOR_ENTITY_VALUES);
+const CONNECTOR_RELATIONSHIP_TYPES = new Set(CURATED_CONNECTOR_RELATIONSHIP_TYPES);
 function isoTimestamp(value) {
     return normalizeLegacyIsoTimestamp(value);
 }
 function httpsUrl(value) {
-    const raw = strictBoundedString(value, MAX_URL_LENGTH);
-    if (!raw)
-        return null;
-    try {
-        const parsed = new URL(raw);
-        if (parsed.protocol !== 'https:' || parsed.username || parsed.password) {
-            return null;
-        }
-        const normalized = parsed.toString();
-        return normalized.length <= MAX_URL_LENGTH ? normalized : null;
-    }
-    catch {
-        return null;
-    }
-}
-function enumValue(value, allowed, label) {
-    if (typeof value !== 'string' || !allowed.has(value)) {
-        throw new TypeError(`${label} is invalid`);
-    }
-    return value;
-}
-function boundedInteger(value, minimum, maximum, label) {
-    if (typeof value !== 'number' ||
-        !Number.isSafeInteger(value) ||
-        value < minimum ||
-        value > maximum) {
-        throw new TypeError(`${label} must be an integer between ${minimum} and ${maximum}`);
-    }
-    return value;
+    return boundedHttpsUrl(value, MAX_URL_LENGTH);
 }
 function normalizeTargets(value) {
     exactKeys(value, new Set(['domain', 'url']), 'Provider targets');
@@ -323,7 +195,7 @@ function normalizeConnectorInputs(value) {
     const inputs = value.map((item) => {
         exactKeys(item, new Set(['type', 'exposure']), 'Connector input');
         const type = enumValue(item.type, CONNECTOR_ENTITY_TYPES, 'Connector input type');
-        const exposure = enumValue(item.exposure, CONNECTOR_TARGET_EXPOSURES[type], 'Connector input exposure');
+        const exposure = enumValue(item.exposure, new Set(CURATED_CONNECTOR_TARGET_EXPOSURES[type]), 'Connector input exposure');
         if (seen.has(type)) {
             throw new TypeError('Connector input types must be unique');
         }

package/lib/threat-intelligence-runtime.mjs

@@ -4,7 +4,8 @@
 // must declare exact input exposure, reviewed terms, and bounded request and
 // output budgets before producing separately attributed normalized evidence.
 import { createObservation } from "../packages/evidence/observation.mjs";
-import { THREAT_INTELLIGENCE_CONTRACT_VERSION, THREAT_INTELLIGENCE_CATEGORIES, THREAT_INTELLIGENCE_CONFIDENCES, THREAT_INTELLIGENCE_ENVELOPE_VERSION, THREAT_INTELLIGENCE_RESULT_STATES, THREAT_INTELLIGENCE_SCHEMA, THREAT_INTELLIGENCE_SEVERITIES, } from "./threat-intelligence-types.mjs";
+import { latestObservationCohort } from "../packages/evidence/latest-observations.mjs";
+import { CURATED_CONNECTOR_RELATIONSHIP_TYPES, CURATED_CONNECTOR_RELATIONSHIP_CLASSIFICATIONS, CURATED_CONNECTOR_RELATIONSHIP_ENDPOINTS as CONNECTOR_RELATIONSHIP_ENDPOINTS, THREAT_INTELLIGENCE_CONTRACT_VERSION, THREAT_INTELLIGENCE_CATEGORIES, THREAT_INTELLIGENCE_CONFIDENCES, THREAT_INTELLIGENCE_ENVELOPE_VERSION, THREAT_INTELLIGENCE_RESULT_STATES, THREAT_INTELLIGENCE_SCHEMA, THREAT_INTELLIGENCE_SEVERITIES, } from "./threat-intelligence-types.mjs";
 import { assertCuratedConnectorDefinition, assertThreatIntelligenceProvider, } from "./threat-intelligence-definition-registry.mjs";
 import { boundedHttpsUrl, boundedString, isRecord, isoTimestamp, strictBoundedString, } from "./bounded-contract-normalizers.mjs";
 import { CURATED_CONNECTOR_ENTITY_TYPES, MAX_THREAT_INTELLIGENCE_URL_LENGTH, normalizeCuratedConnectorTarget, normalizeThreatIntelligenceTarget, } from "./threat-intelligence-targets.mjs";
@@ -22,50 +23,8 @@ const TERMINAL_STATES_WITHOUT_FINDINGS = new Set([
 const CATEGORIES = new Set(THREAT_INTELLIGENCE_CATEGORIES);
 const SEVERITIES = new Set(THREAT_INTELLIGENCE_SEVERITIES);
 const CONFIDENCES = new Set(THREAT_INTELLIGENCE_CONFIDENCES);
-const CONNECTOR_RELATIONSHIP_TYPES = new Set([
-    'domain_resolves_to_ip',
-    'domain_uses_nameserver',
-    'domain_uses_mail_server',
-    'domain_presented_certificate',
-    'certificate_names_domain',
-    'ip_hosts_domain',
-    'domain_related_to_domain',
-]);
-const CONNECTOR_RELATIONSHIP_CLASSIFICATIONS = new Set([
-    'direct',
-    'normalized',
-    'derived',
-]);
-const CONNECTOR_RELATIONSHIP_ENDPOINTS = Object.freeze({
-    domain_resolves_to_ip: {
-        from: new Set(['domain', 'hostname']),
-        to: new Set(['ipv4', 'ipv6']),
-    },
-    domain_uses_nameserver: {
-        from: new Set(['domain']),
-        to: new Set(['hostname']),
-    },
-    domain_uses_mail_server: {
-        from: new Set(['domain']),
-        to: new Set(['hostname']),
-    },
-    domain_presented_certificate: {
-        from: new Set(['domain', 'hostname']),
-        to: new Set(['certificate']),
-    },
-    certificate_names_domain: {
-        from: new Set(['certificate']),
-        to: new Set(['domain', 'hostname']),
-    },
-    ip_hosts_domain: {
-        from: new Set(['ipv4', 'ipv6']),
-        to: new Set(['domain', 'hostname']),
-    },
-    domain_related_to_domain: {
-        from: new Set(['domain', 'hostname']),
-        to: new Set(['domain', 'hostname']),
-    },
-});
+const CONNECTOR_RELATIONSHIP_TYPES = new Set(CURATED_CONNECTOR_RELATIONSHIP_TYPES);
+const CONNECTOR_RELATIONSHIP_CLASSIFICATIONS = new Set(CURATED_CONNECTOR_RELATIONSHIP_CLASSIFICATIONS);
 // createObservation() retains at most 40 source characters, so provider IDs use
 // the same ceiling and can never be truncated at the provenance boundary.
 const MAX_PROVIDER_LABEL_LENGTH = 100;
@@ -247,7 +206,7 @@ function normalizeConnectorRelationship(value, allowedTypes, entitiesByKey) {
     const lastObservedAt = value.lastObservedAt == null ? null : isoTimestamp(value.lastObservedAt);
     const endpoints = type ? CONNECTOR_RELATIONSHIP_ENDPOINTS[type] : null;
     if (!type || !fromEntity || !toEntity || fromEntity.id === toEntity.id
-        || !endpoints?.from.has(fromEntity.type) || !endpoints.to.has(toEntity.type)
+        || !endpoints?.from.includes(fromEntity.type) || !endpoints.to.includes(toEntity.type)
         || !classification || !method
         || (value.firstObservedAt != null && !firstObservedAt)
         || (value.lastObservedAt != null && !lastObservedAt)
@@ -381,13 +340,24 @@ function createThreatIntelligenceResult(provider, target, input = {}, observedAt
     }
     normalizedFindings.sort(compareFindings);
     const findings = [];
-    const seen = new Set();
+    const byIdentity = new Map();
     for (const finding of normalizedFindings) {
         const key = findingKey(finding);
-        if (seen.has(key))
+        const group = byIdentity.get(key) ?? [];
+        group.push(finding);
+        byIdentity.set(key, group);
+    }
+    let conflictingIdentities = 0;
+    for (const group of byIdentity.values()) {
+        const cohort = latestObservationCohort(group, (finding) => finding.lastObservedAt);
+        const candidates = [...cohort.latest, ...cohort.undated];
+        if (new Set(candidates.map((finding) => JSON.stringify(finding))).size > 1) {
+            conflictingIdentities += 1;
+            discarded += candidates.length;
             continue;
-        seen.add(key);
-        findings.push(finding);
+        }
+        if (candidates[0])
+            findings.push(candidates[0]);
     }
     if (findings.length > MAX_FINDINGS) {
         discarded += findings.length - MAX_FINDINGS;
@@ -398,14 +368,16 @@ function createThreatIntelligenceResult(provider, target, input = {}, observedAt
     if (TERMINAL_STATES_WITHOUT_FINDINGS.has(state) && findings.length)
         state = 'partial';
     if (state === 'success' && findings.length === 0)
-        state = 'error';
+        state = conflictingIdentities > 0 ? 'partial' : 'error';
     if ((discarded > 0 || sourceTruncated) && !['error', 'unavailable', 'rate_limited'].includes(state))
         state = 'partial';
     const limitations = normalizeLimitations(resultInput.limitations);
     if (state === 'not_found')
         limitations.unshift(NO_MATCH_LIMITATION);
     if (discarded > 0)
-        limitations.unshift(`${discarded} invalid or over-limit provider finding${discarded === 1 ? ' was' : 's were'} omitted.`);
+        limitations.unshift(`${discarded} invalid, conflicting or over-limit provider finding${discarded === 1 ? ' was' : 's were'} omitted.`);
+    if (conflictingIdentities > 0)
+        limitations.unshift(`${conflictingIdentities} provider identit${conflictingIdentities === 1 ? 'y has' : 'ies have'} conflicting records at the latest or unknown observation time. No stronger record was selected from those conflicts.`);
     limitations.unshift(BASE_LIMITATION);
     const boundedLimitations = [...new Set(limitations)].slice(0, MAX_LIMITATIONS);
     const complete = ['success', 'not_found'].includes(state) && discarded === 0 && !sourceTruncated;

package/lib/threat-intelligence-targets.mjs

@@ -2,41 +2,13 @@
 // and curated connectors. These helpers never perform network requests.
 import { classifyQuery } from "./classify.mjs";
 import { enumValue, exactKeys, strictBoundedString, } from "./bounded-contract-normalizers.mjs";
+import { CURATED_CONNECTOR_ENTITY_VALUES, CURATED_CONNECTOR_TARGET_EXPOSURES, THREAT_INTELLIGENCE_TARGET_EXPOSURES, } from "./threat-intelligence-types.mjs";
 export const MAX_THREAT_INTELLIGENCE_URL_LENGTH = 2048;
 const TARGET_EXPOSURES = Object.freeze({
-    domain: new Set(['registrable_domain']),
-    url: new Set([
-        'registrable_domain',
-        'hostname',
-        'origin',
-        'full_url',
-    ]),
-});
-export const CURATED_CONNECTOR_ENTITY_TYPES = new Set([
-    'domain',
-    'hostname',
-    'url',
-    'ipv4',
-    'ipv6',
-    'asn',
-    'certificate',
-]);
-const CONNECTOR_TARGET_EXPOSURES = Object.freeze({
-    domain: new Set(['registrable_domain']),
-    hostname: new Set(['hostname']),
-    url: new Set([
-        'registrable_domain',
-        'hostname',
-        'origin',
-        'full_url',
-    ]),
-    ipv4: new Set(['ip_address']),
-    ipv6: new Set(['ip_address']),
-    asn: new Set(['asn']),
-    certificate: new Set([
-        'certificate_fingerprint',
-    ]),
+    domain: Object.freeze(['registrable_domain']),
+    url: THREAT_INTELLIGENCE_TARGET_EXPOSURES,
 });
+export const CURATED_CONNECTOR_ENTITY_TYPES = new Set(CURATED_CONNECTOR_ENTITY_VALUES);
 function normalizeCertificateFingerprint(value) {
     const raw = strictBoundedString(value, 128);
     if (!raw || !/^[0-9a-f:]+$/iu.test(raw))
@@ -49,7 +21,7 @@ export function normalizeThreatIntelligenceTarget(input, exposure) {
     const type = input.type;
     if ((type !== 'domain' && type !== 'url')
         || typeof exposure !== 'string'
-        || !TARGET_EXPOSURES[type].has(exposure)) {
+        || !TARGET_EXPOSURES[type].includes(exposure)) {
         throw new TypeError('Threat-intelligence target exposure is invalid');
     }
     if (type === 'domain') {
@@ -103,7 +75,7 @@ export function normalizeThreatIntelligenceTarget(input, exposure) {
 export function normalizeCuratedConnectorTarget(input, exposure) {
     exactKeys(input, new Set(['type', 'value']), 'Connector target');
     const type = enumValue(input.type, CURATED_CONNECTOR_ENTITY_TYPES, 'Connector target type');
-    const normalizedExposure = enumValue(exposure, CONNECTOR_TARGET_EXPOSURES[type], 'Connector target exposure');
+    const normalizedExposure = enumValue(exposure, new Set(CURATED_CONNECTOR_TARGET_EXPOSURES[type]), 'Connector target exposure');
     if (type === 'url') {
         const normalized = normalizeThreatIntelligenceTarget({ type: 'url', value: input.value }, normalizedExposure);
         return Object.freeze({

package/lib/threat-intelligence-types.mjs

@@ -3,6 +3,12 @@
 export const THREAT_INTELLIGENCE_SCHEMA = 'whoisleuth.threat-intelligence-result';
 export const THREAT_INTELLIGENCE_CONTRACT_VERSION = 1;
 export const THREAT_INTELLIGENCE_ENVELOPE_VERSION = 1;
+export const THREAT_INTELLIGENCE_TARGET_EXPOSURES = Object.freeze([
+    'registrable_domain', 'hostname', 'origin', 'full_url',
+]);
+export const THREAT_INTELLIGENCE_CAPABILITIES = Object.freeze([
+    'domain_lookup', 'url_lookup', 'indicator_search',
+]);
 export const THREAT_INTELLIGENCE_CATEGORIES = Object.freeze([
     'phishing',
     'malware',
@@ -34,3 +40,36 @@ export const THREAT_INTELLIGENCE_RESULT_STATES = Object.freeze([
     'unavailable',
     'error',
 ]);
+export const CURATED_CONNECTOR_KINDS = Object.freeze(['discovery', 'enrichment']);
+export const CURATED_CONNECTOR_COLLECTIONS = Object.freeze(['passive', 'active', 'third_party']);
+export const CURATED_CONNECTOR_CREDENTIAL_MODES = Object.freeze(['none', 'optional', 'required']);
+export const CURATED_CONNECTOR_ENTITY_VALUES = Object.freeze([
+    'domain', 'hostname', 'url', 'ipv4', 'ipv6', 'asn', 'certificate',
+]);
+export const CURATED_CONNECTOR_RELATIONSHIP_TYPES = Object.freeze([
+    'domain_resolves_to_ip', 'domain_uses_nameserver', 'domain_uses_mail_server',
+    'domain_presented_certificate', 'certificate_names_domain', 'ip_hosts_domain',
+    'domain_related_to_domain',
+]);
+export const CURATED_CONNECTOR_RELATIONSHIP_CLASSIFICATIONS = Object.freeze(['direct', 'normalized', 'derived']);
+export const CURATED_CONNECTOR_TARGET_EXPOSURES = Object.freeze({
+    domain: Object.freeze(['registrable_domain']),
+    hostname: Object.freeze(['hostname']),
+    url: THREAT_INTELLIGENCE_TARGET_EXPOSURES,
+    ipv4: Object.freeze(['ip_address']),
+    ipv6: Object.freeze(['ip_address']),
+    asn: Object.freeze(['asn']),
+    certificate: Object.freeze(['certificate_fingerprint']),
+});
+function relationshipEndpoints(from, to) {
+    return Object.freeze({ from: Object.freeze(from), to: Object.freeze(to) });
+}
+export const CURATED_CONNECTOR_RELATIONSHIP_ENDPOINTS = Object.freeze({
+    domain_resolves_to_ip: relationshipEndpoints(['domain', 'hostname'], ['ipv4', 'ipv6']),
+    domain_uses_nameserver: relationshipEndpoints(['domain'], ['hostname']),
+    domain_uses_mail_server: relationshipEndpoints(['domain'], ['hostname']),
+    domain_presented_certificate: relationshipEndpoints(['domain', 'hostname'], ['certificate']),
+    certificate_names_domain: relationshipEndpoints(['certificate'], ['domain', 'hostname']),
+    ip_hosts_domain: relationshipEndpoints(['ipv4', 'ipv6'], ['domain', 'hostname']),
+    domain_related_to_domain: relationshipEndpoints(['domain', 'hostname'], ['domain', 'hostname']),
+});

package/lib/typosquat-generator.mjs

@@ -2,6 +2,8 @@
 // objects so a later scan can explain why each domain was generated; callers
 // that only need the historical string list can use the compatibility wrapper.
 import { advancedConfusableVariantsForAscii, confusableCharactersForAscii, estimateAdvancedConfusableVariants, MAX_ADVANCED_CONFUSABLE_VARIANTS, wholeLabelConfusableVariantsForAscii, } from "./idn-confusables.mjs";
+import { canonicalRegistrableDomain, normalizeDiscoverySuffix } from "./registrable-domain.mjs";
+import { MAX_DOMAIN_NAME_LENGTH, MAX_DOMAIN_LABEL_LENGTH } from "../packages/contracts/domain-name.mjs";
 export { MAX_ADVANCED_CONFUSABLE_VARIANTS };
 function buildKeyboardAdjacency(rows) {
     const positions = new Map();
@@ -109,16 +111,15 @@ const TLD_TYPOS = {
 export const MAX_GENERATION_TLDS = 20;
 export const MAX_NAME_VARIANTS = 1_500;
 export const MAX_GENERATED_CANDIDATES = 2_000;
-export const MAX_GENERATION_INPUT_LENGTH = 253;
+export const MAX_GENERATION_INPUT_LENGTH = MAX_DOMAIN_NAME_LENGTH;
 export const MAX_CUSTOM_DICTIONARY_TERMS = 100;
 export const MAX_CUSTOM_DICTIONARY_TERM_LENGTH = 32;
 export const MAX_CUSTOM_DICTIONARY_TEXT_LENGTH = 4_096;
-const MAX_LABEL_LENGTH = 63;
+const MAX_LABEL_LENGTH = MAX_DOMAIN_LABEL_LENGTH;
 const MAX_TLD_INPUTS_INSPECTED = MAX_GENERATION_TLDS * 4;
 const MAX_CUSTOM_DICTIONARY_INPUTS_INSPECTED = MAX_CUSTOM_DICTIONARY_TERMS * 4;
 const CONTROL_CHARACTER_RE = /[\x00-\x1f\x7f]/;
 const DOMAIN_LABEL_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
-const TLD_RE = /^[a-z]{2,63}$/;
 const CUSTOM_DICTIONARY_TERM_RE = /^[a-z0-9](?:[a-z0-9-]{0,30}[a-z0-9])?$/;
 const FAMILY_NEW_VARIANT_LIMITS = Object.freeze({
     character_addition: 128,
@@ -246,10 +247,11 @@ function splitDomainParts(input) {
     if (!trimmed)
         return null;
     if (trimmed.includes('.')) {
-        const match = trimmed.match(/^([a-z0-9-]+)\.([a-z]+)$/);
-        const name = match?.[1];
-        const tld = match?.[2];
-        if (!isValidDomainLabel(name) || typeof tld !== 'string' || !TLD_RE.test(tld))
+        const separator = trimmed.indexOf('.');
+        const name = trimmed.slice(0, separator);
+        const suffix = trimmed.slice(separator + 1);
+        const tld = normalizeDiscoverySuffix(suffix);
+        if (!isValidDomainLabel(name) || !tld || tld !== suffix || canonicalRegistrableDomain(trimmed) !== trimmed)
             return null;
         const tokens = name.split('-');
         return { name, tld, wordTokens: tokens.length >= 2 && tokens.length <= 4 && tokens.every(Boolean) ? tokens : [] };
@@ -294,17 +296,15 @@ function distinctWordOrders(tokens) {
     visit();
     return orders;
 }
-function normalizeTlds(values) {
+export function normalizeGenerationTlds(values) {
     if (!Array.isArray(values))
         return { values: [], truncated: false };
     const normalized = [];
     const seen = new Set();
     let truncated = values.length > MAX_TLD_INPUTS_INSPECTED;
     for (const raw of values.slice(0, MAX_TLD_INPUTS_INSPECTED)) {
-        if (typeof raw !== 'string' || raw.length > MAX_LABEL_LENGTH + 1 || CONTROL_CHARACTER_RE.test(raw))
-            continue;
-        const value = raw.trim().toLowerCase().replace(/^\./, '');
-        if (!TLD_RE.test(value) || seen.has(value))
+        const value = normalizeDiscoverySuffix(raw);
+        if (!value || seen.has(value))
             continue;
         if (normalized.length >= MAX_GENERATION_TLDS) {
             truncated = true;
@@ -415,7 +415,7 @@ function selectCandidateTlds(sourceTld, fallbackTlds, enabledFamilies) {
     if (sourceTld && !enabledFamilies.has('tld_substitution')) {
         return { values: [sourceTld], truncated: false };
     }
-    const normalizedFallbackTlds = normalizeTlds(fallbackTlds);
+    const normalizedFallbackTlds = normalizeGenerationTlds(fallbackTlds);
     const combinedTlds = sourceTld
         ? [sourceTld, ...normalizedFallbackTlds.values.filter((value) => value !== sourceTld)]
         : normalizedFallbackTlds.values;
@@ -673,8 +673,8 @@ export function generateTyposquatCandidateSet(rawInput, fallbackTlds, options =
             addVariant(state, variant, 'pluralization');
     }
     if (enabledFamilies.has('tld_embedding') && tld) {
-        addVariant(state, `${name}${tld}`, 'tld_embedding');
-        addVariant(state, `${name}-${tld}`, 'tld_embedding');
+        addVariant(state, `${name}${tld.replaceAll('.', '')}`, 'tld_embedding');
+        addVariant(state, `${name}-${tld.replaceAll('.', '-')}`, 'tld_embedding');
     }
     if (enabledFamilies.has('www_prefix')) {
         addVariant(state, `ww${name}`, 'www_prefix');
@@ -821,6 +821,10 @@ export function generateTyposquatCandidateSet(rawInput, fallbackTlds, options =
     const byDomain = new Map();
     const source = tld ? `${name}.${tld}` : name;
     function addCandidate(domain, candidateTld, mutationTypes) {
+        if (domain.length > MAX_DOMAIN_NAME_LENGTH) {
+            state.rejectedVariantCount += 1;
+            return;
+        }
         const existing = byDomain.get(domain);
         if (existing) {
             for (const mutationType of mutationTypes) {

package/lib/urlhaus-intelligence.mjs

@@ -74,6 +74,11 @@ function boundedText(value, maxLength) {
     const normalized = value.trim().replace(/\s+/gu, ' ');
     return normalized ? normalized.slice(0, maxLength) : null;
 }
+function identityText(value, maxLength) {
+    if (typeof value !== 'string' || value.length > maxLength || /[\u0000-\u0020\u007f]/u.test(value))
+        return null;
+    return value || null;
+}
 function isoTimestamp(value) {
     if (typeof value !== 'string' || value.length > 64 || /[\u0000-\u001f\u007f]/u.test(value))
         return null;
@@ -91,7 +96,7 @@ function retryAfterSeconds(response) {
     return Number.isSafeInteger(seconds) && seconds >= 1 && seconds <= 86_400 ? seconds : null;
 }
 function exactDomainFromUrl(value) {
-    const raw = boundedText(value, 2_048);
+    const raw = identityText(value, 2_048);
     if (!raw)
         return null;
     try {
@@ -106,7 +111,7 @@ function exactDomainFromUrl(value) {
     }
 }
 function exactDomain(value) {
-    const raw = boundedText(value, 253);
+    const raw = identityText(value, 253);
     if (!raw)
         return null;
     try {
@@ -138,7 +143,7 @@ function normalizedUrlCount(value) {
 function normalizeHostFinding(value, targetDomain) {
     if (!isRecord(value))
         return null;
-    const id = boundedText(value.id, MAX_URL_ID_LENGTH);
+    const id = identityText(value.id, MAX_URL_ID_LENGTH);
     const status = boundedText(value.url_status, 16)?.toLowerCase();
     const threat = boundedText(value.threat, 64)?.toLowerCase();
     if (!id

package/lib/urlscan-intelligence.mjs

@@ -299,7 +299,7 @@ function createUrlscanIntelligenceAdapter(dependencies = {}) {
             const overLimit = parsed.results.length > URLSCAN_MAX_RESULTS || parsed.has_more === true;
             const invalid = normalized.filter((item) => item === null).length;
             const reviewed = rawResults.length - invalid;
-            if (!findings.length && parsed.results.length === 0) {
+            if (parsed.results.length === 0 && !overLimit) {
                 return result(targetDomain, {
                     state: 'not_found',
                     detail: `No archived malicious-verdict match was returned for the last ${URLSCAN_SEARCH_DAYS} days.`,

package/lib/website-security-posture.mjs

@@ -3,7 +3,27 @@
 // Findings use fixed explanatory text and bounded counts; upstream header
 // values, certificate errors, URLs, and DNS record contents are not copied.
 import { createObservation } from "../packages/evidence/observation.mjs";
+import { RESPONSE_POLICY_VERSION } from "./response-policy.mjs";
 import { MAX_SECURITY_POSTURE_FINDINGS, WEBSITE_SECURITY_POSTURE_VERSION, } from "./lookup-child-profile-contract.mjs";
+// Observation state and review significance are separate. These presentation
+// projections leave retained findings, wire counts and model versions intact.
+function securityPostureReview(value) {
+    const item = record(value);
+    if (item.state !== 'observed' && item.state !== 'potential_exposure' && item.state !== 'observed_absence') {
+        return { kind: 'unavailable', label: 'Could not assess' };
+    }
+    if (item.state === 'potential_exposure' || item.tone === 'review') {
+        return { kind: 'needsReview', label: 'Needs review' };
+    }
+    return { kind: 'otherFindings', label: null };
+}
+function summarizeSecurityPostureReview(value) {
+    const counts = { needsReview: 0, otherFindings: 0, unavailable: 0 };
+    for (const item of (Array.isArray(value) ? value : []).slice(0, MAX_SECURITY_POSTURE_FINDINGS)) {
+        counts[securityPostureReview(item).kind] += 1;
+    }
+    return counts;
+}
 const MAX_RETAINED_ORIGINS = 30;
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
@@ -86,12 +106,16 @@ const RESPONSE_POLICY_FINDINGS = Object.freeze({
         detail: () => 'The effective selected script source included a wildcard or broad scheme source. This fixed observation does not establish that an unsafe script is reachable.',
     },
     csp_unsafe_eval: {
-        label: 'CSP permits unsafe evaluation',
-        detail: () => "The effective selected script source included 'unsafe-eval'.",
+        label: 'CSP evaluation allowance observed',
+        detail: () => "The selected response policies allow evaluation through script-src or default-src. Element and attribute directives do not govern this allowance; other browser controls were not evaluated.",
     },
     csp_unsafe_inline: {
-        label: 'Response CSP header permits unqualified inline script',
-        detail: () => "The selected response header included 'unsafe-inline' without a nonce or hash source in that directive. A separate page policy was not observed early enough to qualify this response-scoped finding.",
+        label: 'Response CSP allows unqualified inline script blocks',
+        detail: () => "The selected response policies allow inline script blocks through script-src-elem, script-src or default-src without a valid nonce/hash source or strict-dynamic suppressing unsafe-inline. No earlier page policy qualified this response-scoped finding.",
+    },
+    csp_unsafe_inline_attributes: {
+        label: 'Response CSP allows unqualified inline event handlers',
+        detail: () => 'The selected response policies allow inline event attributes through script-src-attr, script-src or default-src. This header-only observation does not establish whether a handler exists or executes; page-policy timing was not evaluated for attributes.',
     },
     csp_inline_constrained_by_meta: {
         label: 'Page CSP further constrains inline script',
@@ -131,7 +155,7 @@ const RESPONSE_POLICY_FINDINGS = Object.freeze({
 });
 function responsePolicyFindings(value) {
     const policy = record(value);
-    if (![1, 2].includes(Number(policy.responsePolicyVersion)))
+    if (![1, 2, RESPONSE_POLICY_VERSION].includes(Number(policy.responsePolicyVersion)))
         return [];
     const findings = [];
     const components = record(policy.components);
@@ -328,4 +352,4 @@ function analyzeWebsiteSecurityPosture(input = {}) {
         findings,
     };
 }
-export { MAX_SECURITY_POSTURE_FINDINGS, WEBSITE_SECURITY_POSTURE_VERSION, analyzeWebsiteSecurityPosture, };
+export { MAX_SECURITY_POSTURE_FINDINGS, WEBSITE_SECURITY_POSTURE_VERSION, analyzeWebsiteSecurityPosture, securityPostureReview, summarizeSecurityPostureReview, };