@slicedearth/whoisleuth-cli 2.3.0 → 2.5.1

package/lib/generated/{unicode-confusables-17.mjs → unicode-confusables.mjs}

@@ -1,11 +1,11 @@
 // Generated by tools/unicode-confusable-audit.mts from the pinned Unicode
 // UTS #39 data file. Do not edit this projection by hand.
-export const GENERATED_CONFUSABLE_MAPPING_VERSION = "tr39-17.0.0-bounded-ascii-v3";
+export const GENERATED_CONFUSABLE_MAPPING_VERSION = "tr39-18.0.0-bounded-ascii-v3";
 export const GENERATED_CONFUSABLE_SOURCE = Object.freeze({
     "standard": "Unicode UTS #39",
-    "unicodeVersion": "17.0.0",
-    "url": "https://www.unicode.org/Public/17.0.0/security/confusables.txt",
-    "sha256": "091c7f82fc39ef208faf8f94d29c244de99254675e09de163160c810d13ef22a",
+    "unicodeVersion": "18.0.0",
+    "url": "https://www.unicode.org/Public/18.0.0/security/confusables.txt",
+    "sha256": "6ed3ee967c9dfdf6677d563c9985182fbc50a2efb7d6059cd57b2e2ce18f5b92",
     "license": "Unicode-3.0"
 });
 export const GENERATED_CONFUSABLE_POLICY = Object.freeze({
@@ -24,33 +24,33 @@ export const GENERATED_CONFUSABLE_POLICY = Object.freeze({
     "totalMappings": 312
 });
 export const GENERATED_CONFUSABLE_STATS = Object.freeze({
-    "sourceBytes": 745683,
-    "sourceLines": 9995,
-    "parsedMappings": 6565,
-    "eligibleMappings": 232,
-    "projectedMappings": 111,
-    "generationMappings": 101,
+    "sourceBytes": 763128,
+    "sourceLines": 9863,
+    "parsedMappings": 6712,
+    "eligibleMappings": 255,
+    "projectedMappings": 126,
+    "generationMappings": 115,
     "rejectedMalformedLines": 0,
-    "rejectedOutsidePolicy": 5695,
+    "rejectedOutsidePolicy": 5780,
     "skeletonCapHits": 0,
-    "generationCapHits": 3
+    "generationCapHits": 4
 });
 export const GENERATED_CONFUSABLE_GROUPS = Object.freeze({
-    a: "аαɑ",
-    b: "ьƄ",
-    c: "сϲⅽᴄⲥ𐐽",
-    d: "ԁⅾꓒ",
+    a: "аαɑꭤ",
+    b: "ьƄ𝈇",
+    c: "сϲⅽᴄⲥ𐐽ᲃ",
+    d: "ԁⅾꓒ𐆋",
     e: "еεҽꬲ",
-    f: "ϝꞙƒẝꬵք",
+    f: "ϝꞙƒʄẝꬵ𐅾ք",
     g: "ɡƍᶃց",
     h: "һհ",
     i: "іιıɪɩⲓꙇւ",
-    j: "јϳ",
+    j: "јϳȷյ",
     k: "κк",
-    l: "ӏⅼǀꓲ",
-    m: "мⅿ",
+    l: "ӏⅼǀꓲꞁꟾ",
+    m: "мⅿՠ",
     n: "ոռ",
-    o: "оοօᴏⲟᴑꬽσϭ𐐬",
+    o: "оοօᴏⲟᴑꬽᲂσϭ𐐬",
     p: "рρϱⲣþƿϸⳏ",
     q: "ԛգզ",
     r: "гꭇꭈᴦⲅ",
@@ -58,25 +58,25 @@ export const GENERATED_CONFUSABLE_GROUPS = Object.freeze({
     t: "тτ",
     u: "υսᴜꭎʋꞟꭒ",
     v: "ѵνᴠ",
-    w: "ԝաᴡшɯѡⲽ",
+    w: "ԝաᴡшɯꟺѡⲽ",
     x: "хχ",
     y: "уүʏγⲩɣᶌỿꭚ",
-    z: "ᴢ",
+    z: "ᴢⱬⲍ",
 });
 export const GENERATED_GENERATION_CONFUSABLE_GROUPS = Object.freeze({
-    a: "аαɑ",
-    b: "ь",
-    c: "сᴄⲥ𐐽",
-    d: "ԁꓒ",
+    a: "аαɑꭤ",
+    b: "ь𝈇",
+    c: "сᴄⲥ𐐽ᲃ",
+    d: "ԁꓒ𐆋",
     e: "еεҽꬲ",
-    f: "ϝꞙƒẝꬵք",
+    f: "ϝꞙƒʄẝꬵ𐅾ք",
     g: "ɡƍᶃց",
     h: "һհ",
     i: "іιıɪɩⲓꙇւ",
-    j: "јϳ",
+    j: "јϳȷյ",
     k: "κк",
-    l: "ӏǀꓲ",
-    m: "м",
+    l: "ӏǀꓲꞁꟾ",
+    m: "мՠ",
     n: "ոռ",
     o: "оοօᴏⲟᴑꬽσ",
     p: "рρⲣþƿϸⳏ",
@@ -86,8 +86,8 @@ export const GENERATED_GENERATION_CONFUSABLE_GROUPS = Object.freeze({
     t: "тτ",
     u: "υսᴜꭎʋꞟꭒ",
     v: "ѵνᴠ",
-    w: "ԝաᴡшɯѡⲽ",
+    w: "ԝաᴡшɯꟺѡⲽ",
     x: "хχ",
     y: "уүʏγⲩɣᶌỿ",
-    z: "ᴢ",
+    z: "ᴢⱬⲍ",
 });

package/lib/html-signals.mjs

@@ -43,13 +43,8 @@ const HAS_CONTROL_CHARACTER_RE = /[\u0000-\u001f\u007f-\u009f]|\p{Default_Ignora
 // scoped to resource tags, not every <a href> - an outbound link to the
 // real site is normal on all sorts of pages; a resource pulled live from it
 // during page load is not.
-const ASSET_TAG_RE = /<(?:img|script|link)\b[^>]*?\b(?:src|href)\s*=\s*["']([^"']+)["'][^>]*>/gi;
-const ABSOLUTE_URL_HOST_RE = /^(?:https?:)?\/\/([^/]+)/i;
-const IDENTITY_TAG_RE = /<(html|link|meta|form)\b[^>]{0,4096}>/gi;
-const OVERSIZED_IDENTITY_TAG_RE = /<(?:html|link|meta|form)\b[^>]{4097}/i;
-const RELATIONSHIP_TAG_RE = /<(a|img|script|link|iframe|frame|source|video|audio|object|embed)\b[^>]{0,4096}>/gi;
-const OVERSIZED_RELATIONSHIP_TAG_RE = /<(?:a|img|script|link|iframe|frame|source|video|audio|object|embed)\b[^>]{4097}/i;
-const ATTRIBUTE_RE = /([^\s"'<>\/=]+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'=<>`]+)))?/g;
+const IDENTITY_TAGS = new Set(['html', 'link', 'meta', 'form']);
+const RELATIONSHIP_TAGS = new Set(['a', 'img', 'script', 'link', 'iframe', 'frame', 'source', 'video', 'audio', 'object', 'embed']);
 const LANGUAGE_TAG_RE = /^[a-z]{2,8}(?:-[a-z0-9]{1,8})*$/i;
 const HOSTNAME_RE = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i;
 const RESOURCE_LINK_RELS = new Set(['stylesheet', 'icon', 'preload', 'prefetch', 'modulepreload', 'manifest']);
@@ -57,9 +52,6 @@ const RISKY_DOWNLOAD_EXTENSIONS = new Set([
     '7z', 'apk', 'bat', 'cmd', 'dmg', 'docm', 'exe', 'img', 'iso', 'jar', 'js',
     'msi', 'pkg', 'ps1', 'rar', 'scr', 'vbs', 'xlsm', 'zip',
 ]);
-const HTML_COMMENT_RE = /<!--[\s\S]*?(?:-->|$)/g;
-const RAW_TEXT_BLOCK_RE = /<(script|style|textarea|template)\b([^>]*)>[\s\S]*?<\/\1\s*>/gi;
-const NON_EXECUTING_RAW_TEXT_BLOCK_RE = /<(style|textarea|template)\b[^>]*>[\s\S]*?<\/\1\s*>/gi;
 function stripWwwPrefix(host) {
     return host.toLowerCase().replace(/^www\./, '');
 }
@@ -72,24 +64,19 @@ function boundedHtmlText(value, maxLength, ellipsis = false) {
         return null;
     if (text.length <= maxLength)
         return text;
-    return ellipsis ? `${text.slice(0, maxLength)}…` : text.slice(0, maxLength);
+    return ellipsis ? `${text.slice(0, Math.max(0, maxLength - 1))}…` : text.slice(0, maxLength);
 }
-function extractExternalAssetHosts(html, ownDomain) {
+function extractExternalAssetHosts(analysis, ownDomain, documentUrl) {
     const ownHost = stripWwwPrefix(ownDomain);
     const hosts = new Set();
-    let match;
-    ASSET_TAG_RE.lastIndex = 0;
-    while ((match = ASSET_TAG_RE.exec(html))) {
-        const resourceUrl = match[1];
-        if (!resourceUrl)
+    for (const element of analysis.elements) {
+        if (!element.html || !['img', 'script', 'link'].includes(element.name))
             continue;
-        const hostMatch = resourceUrl.match(ABSOLUTE_URL_HOST_RE);
-        if (!hostMatch)
+        const attribute = element.attributes.find((attribute) => attribute.name === (element.name === 'link' ? 'href' : 'src'));
+        const resource = normalizeIdentityUrl(attribute?.value, analysis.effectiveBaseUrl ?? documentUrl);
+        if (!resource)
             continue;
-        const matchedHost = hostMatch[1];
-        if (!matchedHost || HAS_CONTROL_CHARACTER_RE.test(matchedHost))
-            continue;
-        const host = stripWwwPrefix(matchedHost);
+        const host = stripWwwPrefix(new URL(resource.url).hostname);
         if (host && host !== ownHost)
             hosts.add(host);
         if (hosts.size >= MAX_EXTERNAL_ASSET_HOSTS)
@@ -97,32 +84,6 @@ function extractExternalAssetHosts(html, ownDomain) {
     }
     return [...hosts];
 }
-function parseAttributes(tag) {
-    const start = tag.search(/\s/);
-    if (start === -1)
-        return new Map();
-    const attributes = new Map();
-    ATTRIBUTE_RE.lastIndex = 0;
-    let match;
-    while ((match = ATTRIBUTE_RE.exec(tag.slice(start)))) {
-        const name = (match[1] ?? '').toLowerCase();
-        if (!name)
-            continue;
-        if (!attributes.has(name))
-            attributes.set(name, match[2] ?? match[3] ?? match[4] ?? '');
-    }
-    return attributes;
-}
-function markupForTagParsing(html) {
-    return html
-        .replace(HTML_COMMENT_RE, ' ')
-        .replace(RAW_TEXT_BLOCK_RE, '<$1$2>');
-}
-function markupForTrackingIdentifiers(html) {
-    return html
-        .replace(HTML_COMMENT_RE, ' ')
-        .replace(NON_EXECUTING_RAW_TEXT_BLOCK_RE, ' ');
-}
 function normalizeLanguage(value) {
     if (typeof value !== 'string' || value.length > 35 || HAS_CONTROL_CHARACTER_RE.test(value))
         return null;
@@ -295,10 +256,9 @@ function trackingIdentifiers(html) {
         truncated,
     };
 }
-function extractPageRelationships(html, domain, options = {}) {
+function extractPageRelationships(analysis, domain, options = {}) {
     const documentUrl = resolvedBaseUrl(domain, options.baseUrl);
     const baseUrl = resolvedBaseUrl(domain, options.effectiveBaseUrl ?? documentUrl);
-    const markup = typeof options.tagMarkup === 'string' ? options.tagMarkup : markupForTagParsing(html);
     const baseOrigin = options.documentOrigin ?? new URL(documentUrl).origin;
     const resourceKeys = new Set();
     const resourceOrigins = new Set();
@@ -312,25 +272,27 @@ function extractPageRelationships(html, domain, options = {}) {
     let riskyDownloadCount = 0;
     let tagsExamined = 0;
     let discardedUrls = 0;
-    let tagLimitReached = OVERSIZED_RELATIONSHIP_TAG_RE.test(markup);
+    let tagLimitReached = analysis.inputLimitReached || analysis.tagLimitReached;
     let resourceOriginLimitReached = false;
     let embeddedOriginLimitReached = false;
     let contactDomainLimitReached = false;
     let downloadOriginLimitReached = false;
     let downloadFileTypeLimitReached = false;
     let perTagLimitReached = false;
-    let match;
-    RELATIONSHIP_TAG_RE.lastIndex = 0;
-    while ((match = RELATIONSHIP_TAG_RE.exec(markup))) {
+    let resourceCountLimitReached = false;
+    let resourceIdentityTruncated = false;
+    for (const element of analysis.elements) {
+        if (!element.html || !RELATIONSHIP_TAGS.has(element.name))
+            continue;
         if (tagsExamined >= MAX_RESOURCE_TAGS) {
             tagLimitReached = true;
             break;
         }
         tagsExamined += 1;
-        const tagName = (match[1] ?? '').toLowerCase();
-        if (!tagName)
-            continue;
-        const attributes = parseAttributes(match[0]);
+        const tagName = element.name;
+        const attributes = new Map(element.attributes.map(({ name, value }) => [name, value]));
+        if (element.attributesTruncated)
+            tagLimitReached = true;
         if (tagName === 'a') {
             const href = attributes.get('href');
             const contacts = mailtoDomains(href);
@@ -376,8 +338,14 @@ function extractPageRelationships(html, domain, options = {}) {
                     discardedUrls += 1;
                 continue;
             }
+            if (normalized.pathTruncated)
+                resourceIdentityTruncated = true;
             const key = `${reference.type}:${normalized.url}`;
             if (!resourceKeys.has(key)) {
+                if (resourceKeys.size >= MAX_RESOURCE_TAGS) {
+                    resourceCountLimitReached = true;
+                    continue;
+                }
                 resourceKeys.add(key);
                 byType[reference.type] += 1;
             }
@@ -389,10 +357,15 @@ function extractPageRelationships(html, domain, options = {}) {
                 embeddedOriginLimitReached = true;
         }
     }
-    const tracking = trackingIdentifiers(markupForTrackingIdentifiers(html));
+    const tracking = trackingIdentifiers([
+        ...analysis.elements.filter((element) => element.html).flatMap((element) => element.attributes.map((attribute) => attribute.value)),
+        ...analysis.scripts.map((script) => script.inlineContent),
+    ].join('\n'));
+    if (analysis.scriptLimitReached || analysis.inlineLimitReached)
+        tracking.truncated = true;
     const truncated = tagLimitReached || resourceOriginLimitReached || embeddedOriginLimitReached
         || contactDomainLimitReached || downloadOriginLimitReached || downloadFileTypeLimitReached
-        || perTagLimitReached || tracking.truncated;
+        || perTagLimitReached || resourceCountLimitReached || resourceIdentityTruncated || tracking.truncated;
     const limitations = [];
     if (tagLimitReached)
         limitations.push(`Resource parsing reached the ${MAX_RESOURCE_TAGS}-tag or ${MAX_IDENTITY_TAG_LENGTH}-character tag limit.`);
@@ -408,6 +381,10 @@ function extractPageRelationships(html, domain, options = {}) {
         limitations.push(`Only the first ${MAX_DOWNLOAD_FILE_TYPES} risky download file types were retained.`);
     if (perTagLimitReached)
         limitations.push(`Some srcset URL candidates could not be safely enumerated within the ${MAX_URLS_PER_TAG}-candidate per-tag boundary.`);
+    if (resourceCountLimitReached)
+        limitations.push(`Only the first ${MAX_RESOURCE_TAGS} distinct resource references were examined.`);
+    if (resourceIdentityTruncated)
+        limitations.push('Overlong resource paths were reduced to origins; distinct resource counts may be incomplete.');
     if (tracking.truncated)
         limitations.push(`Only the first ${MAX_TRACKING_IDENTIFIERS} tracking identifiers were retained.`);
     return {
@@ -415,7 +392,7 @@ function extractPageRelationships(html, domain, options = {}) {
             count: resourceKeys.size,
             byType,
             externalOrigins: [...resourceOrigins].sort(),
-            truncated: tagLimitReached || resourceOriginLimitReached || perTagLimitReached,
+            truncated: tagLimitReached || resourceOriginLimitReached || perTagLimitReached || resourceCountLimitReached || resourceIdentityTruncated,
         },
         embeddedOrigins: [...embeddedOrigins].sort(),
         contactDomains: [...contactDomains].sort(),
@@ -445,12 +422,9 @@ function metaRefreshTarget(content) {
 }
 function extractPageIdentity(html, domain, options = {}) {
     const documentUrl = resolvedBaseUrl(domain, options.baseUrl);
-    const baseAnalysis = options.effectiveBaseUrl === undefined
-        ? analyzeStaticHtml(html, { baseUrl: documentUrl })
-        : null;
-    const baseUrl = resolvedBaseUrl(domain, options.effectiveBaseUrl ?? baseAnalysis?.effectiveBaseUrl ?? documentUrl);
-    const baseHrefState = options.baseHrefState ?? baseAnalysis?.baseHrefState ?? 'absent';
-    const tagMarkup = markupForTagParsing(html);
+    const analysis = options.htmlAnalysis ?? analyzeStaticHtml(html, { baseUrl: documentUrl, includeVisibleText: true });
+    const baseUrl = resolvedBaseUrl(domain, options.effectiveBaseUrl ?? analysis.effectiveBaseUrl ?? documentUrl);
+    const baseHrefState = options.baseHrefState ?? analysis.baseHrefState;
     const parsedDocument = new URL(documentUrl);
     const baseOrigin = options.documentOrigin ?? parsedDocument.origin;
     const baseUsesHttps = parsedDocument.protocol === 'https:';
@@ -469,19 +443,19 @@ function extractPageIdentity(html, domain, options = {}) {
     let discardedUrls = 0;
     let formLimitReached = false;
     let originLimitReached = false;
-    let tagLimitReached = OVERSIZED_IDENTITY_TAG_RE.test(tagMarkup);
-    let match;
-    IDENTITY_TAG_RE.lastIndex = 0;
-    while ((match = IDENTITY_TAG_RE.exec(tagMarkup))) {
+    let tagLimitReached = analysis.inputLimitReached || analysis.tagLimitReached;
+    for (const element of analysis.elements) {
+        if (!element.html || !IDENTITY_TAGS.has(element.name))
+            continue;
         if (tagsExamined >= MAX_IDENTITY_TAGS) {
             tagLimitReached = true;
             break;
         }
         tagsExamined += 1;
-        const tagName = (match[1] ?? '').toLowerCase();
-        if (!tagName)
-            continue;
-        const attributes = parseAttributes(match[0]);
+        const tagName = element.name;
+        const attributes = new Map(element.attributes.map(({ name, value }) => [name, value]));
+        if (element.attributesTruncated)
+            tagLimitReached = true;
         if (tagName === 'html' && documentLanguage === null) {
             documentLanguage = normalizeLanguage(attributes.get('lang'));
             continue;
@@ -551,12 +525,10 @@ function extractPageIdentity(html, domain, options = {}) {
     const queryOmitted = [canonical, metaRefresh, openGraphUrl].some((item) => item?.queryOmitted);
     const pathTruncated = [canonical, metaRefresh, openGraphUrl].some((item) => item?.pathTruncated);
     const sourceTruncated = options.sourceTruncated === true;
-    const relationships = extractPageRelationships(html, domain, { baseUrl: documentUrl, effectiveBaseUrl: baseUrl, documentOrigin: baseOrigin, tagMarkup });
+    const relationships = extractPageRelationships(analysis, domain, { baseUrl: documentUrl, effectiveBaseUrl: baseUrl, documentOrigin: baseOrigin });
     const fingerprints = createPageFingerprints(html, {
-        // Retained fingerprint algorithms pre-date document-base handling. Keep
-        // their response-URL normalization stable until a versioned fingerprint
-        // migration is intentionally introduced.
         baseUrl: documentUrl,
+        htmlAnalysis: analysis,
         exactBodyHash: options.exactBodyHash,
         sourceTruncated,
         resources: relationships.resources,
@@ -696,9 +668,34 @@ function buildPagePublicationMetadata(analysis, sourceTruncated) {
         },
     };
 }
-function extractHtmlSignals(html, domain, options = {}) {
+function domainSaleLandingPage(analysis, domain) {
+    if (analysis.inputLimitReached || analysis.tagLimitReached || analysis.visibleTextLimitReached)
+        return false;
+    const title = analysis.title?.trim().toLowerCase() ?? '';
+    const content = analysis.visibleText.trim().toLowerCase();
+    const saleSuffix = /^\s+(?:(?:is|may be)\s+)?(?:for sale|available for purchase|available for lease)(?:[.!?:\s]|$)/u;
+    const explicitSale = (value) => {
+        const genericSubject = /^(?:(?:this|the) domain(?: name)?|domain(?: name)?)/u.exec(value)?.[0];
+        return (genericSubject !== undefined && saleSuffix.test(value.slice(genericSubject.length)))
+            || (value.startsWith(domain) && saleSuffix.test(value.slice(domain.length)));
+    };
+    const explicitPurchase = /^(?:buy|purchase|own|bid on|inquire about) (?:this|the) domain(?: name)?(?:[.!?:\s]|$)/u;
+    // A short, directly worded landing page is sufficient. Long articles need
+    // corroborating page-title and transaction-control evidence; a generic
+    // commerce CTA or quoted example cannot classify the domain for sale.
+    if (content.length <= 240 && (explicitSale(content) || explicitPurchase.test(content)))
+        return true;
+    if (!explicitSale(title) && !explicitPurchase.test(title))
+        return false;
+    if (!/(?:this domain(?: name)? (?:is )?for sale|buy this domain|purchase this domain|domain name for sale)/u.test(content))
+        return false;
+    return analysis.elements.some((element) => element.html
+        && ['form', 'button', 'a'].includes(element.name));
+}
+async function extractHtmlSignals(html, domain, options = {}) {
+    options.signal?.throwIfAborted();
     const documentUrl = resolvedBaseUrl(domain, options.baseUrl);
-    const htmlAnalysis = analyzeStaticHtml(html, { baseUrl: documentUrl, includeVisibleText: true });
+    const htmlAnalysis = options.htmlAnalysis ?? analyzeStaticHtml(html, { baseUrl: documentUrl, includeVisibleText: true });
     const effectiveBaseUrl = htmlAnalysis.effectiveBaseUrl ?? documentUrl;
     const documentOrigin = new URL(documentUrl).origin;
     const pageIdentity = options.includePageIdentity === false ? null : extractPageIdentity(html, domain, {
@@ -707,6 +704,7 @@ function extractHtmlSignals(html, domain, options = {}) {
         effectiveBaseUrl,
         documentOrigin,
         baseHrefState: htmlAnalysis.baseHrefState,
+        htmlAnalysis,
     });
     const includeCredentialSurfaceProfile = pageIdentity && options.includeCredentialSurfaceProfile === true;
     const includeStructuredDataIdentity = pageIdentity && options.includeStructuredDataIdentity !== false;
@@ -719,14 +717,17 @@ function extractHtmlSignals(html, domain, options = {}) {
         }
         : pageIdentity;
     const pageLanguageSignal = detectPageLanguageSignal(html, pageIdentity?.documentLanguage, htmlAnalysis);
+    const domainSaleSignal = options.sourceTruncated !== true && domainSaleLandingPage(htmlAnalysis, domain)
+        ? 'explicit domain-sale landing-page content' : null;
     return {
+        domainSaleSignal,
         pageTitle: htmlAnalysis.title,
         hasPasswordField: htmlAnalysis.forms.categories.password > 0,
         phishingLanguageMatch: pageLanguageSignal?.label ?? null,
         hasExternalFormAction: pageIdentity
             ? pageIdentity.forms.externalActionOrigins.length > 0
             : null,
-        externalAssetHosts: extractExternalAssetHosts(html, domain),
+        externalAssetHosts: extractExternalAssetHosts(htmlAnalysis, domain, documentUrl),
         cspMetaPolicy: analyzeCspMetaPolicies(htmlAnalysis.cspMetaPolicies, htmlAnalysis.cspMetaLimitReached),
         pageIdentity: pageIdentityOutput,
         credentialSurfaceProfile: includeCredentialSurfaceProfile && htmlAnalysis ? analyzeCredentialSurfaceProfile({
@@ -740,9 +741,10 @@ function extractHtmlSignals(html, domain, options = {}) {
             observedAt: options.observedAt,
             sourceTruncated: options.sourceTruncated,
         }) : null,
-        technologyProfile: includeTechnologyProfile && htmlAnalysis ? analyzeWebsiteTechnology({
+        technologyProfile: includeTechnologyProfile && htmlAnalysis ? await analyzeWebsiteTechnology({
             htmlAnalysis,
             generator: pageIdentity.generator,
+            ...(options.signal ? { signal: options.signal } : {}),
             httpServer: options.httpServer,
             responseHeaders: options.responseHeaders,
             resourceOrigins: pageIdentity.resources.externalOrigins,
@@ -754,7 +756,7 @@ function extractHtmlSignals(html, domain, options = {}) {
         pageRoleProfile: includeDerivedPageProfiles && htmlAnalysis ? analyzePageRole({
             htmlAnalysis,
             pageTitle: htmlAnalysis.title,
-            activityStatus: options.activityStatus,
+            activityStatus: domainSaleSignal ? 'parked' : options.activityStatus,
             observedAt: options.observedAt,
             sourceTruncated: options.sourceTruncated,
         }) : null,

package/lib/http-evidence-bounds.mjs

@@ -1,7 +1,2 @@
-// Browser-safe bounds for the rich HTTP evidence contract and its compact
-// browser-local projection. Both producers and consumers import these values
-// so valid retained evidence is not rejected by a stale projection.
-export const MAX_HTTP_EVIDENCE_REDIRECTS = 5;
-export const MAX_HTTP_ATTEMPTS = 2;
-export const MAX_HTTP_PROVENANCE_URL = 2_048;
-export const MAX_HTTP_ERROR_LENGTH = 180;
+// Retained public import; the runtime-neutral implementation lives in the domain layer.
+export * from "../packages/analysis/http-evidence-bounds.mjs";

package/lib/http-intelligence.mjs

@@ -3,8 +3,21 @@
 // converts the shared safe-fetch trace and selected response metadata into an
 // additive evidence object suitable for API responses and exports.
 import { createObservation } from "../packages/evidence/observation.mjs";
-import { MAX_HTTP_ATTEMPTS, MAX_HTTP_ERROR_LENGTH, MAX_HTTP_EVIDENCE_REDIRECTS, MAX_HTTP_PROVENANCE_URL, } from "./http-evidence-bounds.mjs";
+import { MAX_OUTBOUND_HTTP_URL_CHARACTERS } from "../packages/contracts/http-url.mjs";
+import { MAX_HTTP_ATTEMPTS, MAX_HTTP_ERROR_LENGTH, MAX_HTTP_EVIDENCE_REDIRECTS, MAX_HTTP_PROVENANCE_URL, } from "../packages/analysis/http-evidence-bounds.mjs";
 import { HTTP_DELIVERY_LIMITATIONS, HTTP_DELIVERY_METADATA_VERSION, MAX_HTTP_CACHE_SECONDS, MAX_HTTP_DELIVERY_HEADER_BYTES, MAX_HTTP_DELIVERY_TOKENS, } from "./homepage-metadata-contract.mjs";
+/** Publish delivery metadata only at its owning response boundary. */
+export function withoutHttpDeliveryMetadata(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return value;
+    const output = { ...value };
+    if (output.response && typeof output.response === 'object' && !Array.isArray(output.response)) {
+        const response = { ...output.response };
+        delete response.deliveryMetadata;
+        output.response = response;
+    }
+    return output;
+}
 const MAX_HTTP_REDIRECTS = MAX_HTTP_EVIDENCE_REDIRECTS;
 const MAX_HTTP_HEADER_LENGTH = 1024;
 const MAX_HTTP_DELIVERY_HEADER_LENGTH = MAX_HTTP_DELIVERY_HEADER_BYTES;
@@ -25,7 +38,7 @@ function boundedString(value, maxLength) {
     return normalized ? normalized.slice(0, maxLength) : null;
 }
 function normalizeProvenanceUrl(value) {
-    if (typeof value !== 'string' || value.length === 0 || value.length > 4096)
+    if (typeof value !== 'string' || value.length === 0 || value.length > MAX_OUTBOUND_HTTP_URL_CHARACTERS)
         return null;
     try {
         const parsed = new URL(value);
@@ -165,14 +178,14 @@ function headerValidity(header, validator) {
         return { present: true, valid: null };
     return { present: true, valid: header.state === 'observed' && Boolean(header.value && validator(header.value)) };
 }
-function validHttpDate(value) {
+function validHttpDate(value, observedAt) {
     const months = ['Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec'];
     const weekdays = ['Sun', 'Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat'];
     const longWeekdays = ['Sunday', 'Monday', 'Tuesday', 'Wednesday', 'Thursday', 'Friday', 'Saturday'];
-    const time = '([01]\\d|2[0-3]):([0-5]\\d):([0-5]\\d)';
+    const time = '([01]\\d|2[0-3]):([0-5]\\d):([0-5]\\d|60)';
     const imfFixdate = value.match(new RegExp(`^(${weekdays.join('|')}), (0[1-9]|[12]\\d|3[01]) (${months.join('|')}) (\\d{4}) ${time} GMT$`, 'u'));
     const rfc850 = value.match(new RegExp(`^(${longWeekdays.join('|')}), (0[1-9]|[12]\\d|3[01])-(${months.join('|')})-(\\d{2}) ${time} GMT$`, 'u'));
-    const asctime = value.match(new RegExp(`^(${weekdays.join('|')}) (${months.join('|')}) ( {2}[1-9]| [12]\\d| 3[01]) ${time} (\\d{4})$`, 'u'));
+    const asctime = value.match(new RegExp(`^(${weekdays.join('|')}) (${months.join('|')}) ( [1-9]|0[1-9]|[12]\\d|3[01]) ${time} (\\d{4})$`, 'u'));
     let weekday;
     let day;
     let month;
@@ -196,10 +209,19 @@ function validHttpDate(value) {
         day = Number(rfc850[2]);
         month = months.indexOf(rfc850[3]);
         const shortYear = Number(rfc850[4]);
-        year = shortYear >= 70 ? 1900 + shortYear : 2000 + shortYear;
+        // RFC 9110's rolling window is relative to receipt, not a later review
+        // or the host's timezone. The observation supplies that stable reference.
+        const futureBoundary = new Date(observedAt);
+        futureBoundary.setUTCFullYear(futureBoundary.getUTCFullYear() + 50);
+        year = Math.floor(futureBoundary.getUTCFullYear() / 100) * 100 + shortYear;
         hour = Number(rfc850[5]);
         minute = Number(rfc850[6]);
         second = Number(rfc850[7]);
+        const candidate = new Date(0);
+        candidate.setUTCFullYear(year, month, day);
+        candidate.setUTCHours(hour, minute, Math.min(second, 59), 0);
+        if (candidate.getTime() > futureBoundary.getTime())
+            year -= 100;
         expectedWeekdays = longWeekdays;
     }
     else if (asctime) {
@@ -218,13 +240,15 @@ function validHttpDate(value) {
         return false;
     const parsed = new Date(0);
     parsed.setUTCFullYear(year, month, day);
-    parsed.setUTCHours(hour, minute, second, 0);
+    // A leap-second spelling must not roll into the following calendar day
+    // while validating the declared date and weekday.
+    parsed.setUTCHours(hour, minute, Math.min(second, 59), 0);
     return parsed.getUTCFullYear() === year
         && parsed.getUTCMonth() === month
         && parsed.getUTCDate() === day
         && expectedWeekdays[parsed.getUTCDay()] === weekday;
 }
-function parseCachePolicy(headers) {
+function parseCachePolicy(headers, observedAt) {
     const cacheControl = deliveryHeader(headers, 'cache-control');
     const age = deliveryHeader(headers, 'age', 64);
     const etagHeader = deliveryHeader(headers, 'etag');
@@ -329,8 +353,8 @@ function parseCachePolicy(headers) {
     if (age.state === 'observed' && ageSeconds === null)
         malformed = true;
     const etag = headerValidity(etagHeader, (value) => /^(?:W\/)?"[\x21\x23-\x7e]*"$/u.test(value));
-    const lastModified = headerValidity(lastModifiedHeader, validHttpDate);
-    const expires = headerValidity(expiresHeader, validHttpDate);
+    const lastModified = headerValidity(lastModifiedHeader, (value) => validHttpDate(value, observedAt));
+    const expires = headerValidity(expiresHeader, (value) => validHttpDate(value, observedAt));
     malformed = malformed || [etag, lastModified, expires].some((item) => item.present && item.valid === false);
     const headersObserved = [cacheControl, age, etagHeader, lastModifiedHeader, expiresHeader]
         .some((header) => header.state !== 'not_observed');
@@ -362,9 +386,9 @@ function parseCachePolicy(headers) {
         truncated: partial,
     };
 }
-function buildDeliveryMetadata(headers) {
+function buildDeliveryMetadata(headers, observedAt) {
     const contentEncoding = parseContentEncoding(headers);
-    const cacheResult = parseCachePolicy(headers);
+    const cacheResult = parseCachePolicy(headers, observedAt);
     const cachePolicy = cacheResult.value;
     const incomplete = [contentEncoding.status, cachePolicy.status].some((status) => ['partial', 'malformed'].includes(status));
     const truncated = contentEncoding.status === 'partial' || cacheResult.truncated;
@@ -466,21 +490,22 @@ function buildHttpObservation(detail, options = {}) {
         ...(Array.isArray(options.previousAttempts) ? options.previousAttempts : []),
         { url: detail && detail.requestedUrl, httpStatus: status },
     ]);
+    const observation = createObservation({
+        status: incomplete ? 'partial' : 'success',
+        observedAt: options.observedAt,
+        scanMode: 'deep',
+        source: 'http',
+        durationMs: detail && detail.durationMs,
+        complete: !incomplete,
+        truncated: incomplete,
+        limitations,
+        diagnostics: {
+            redirectCount: redirects.length,
+            httpStatus: status,
+        },
+    });
     return {
-        ...createObservation({
-            status: incomplete ? 'partial' : 'success',
-            observedAt: options.observedAt,
-            scanMode: 'deep',
-            source: 'http',
-            durationMs: detail && detail.durationMs,
-            complete: !incomplete,
-            truncated: incomplete,
-            limitations,
-            diagnostics: {
-                redirectCount: redirects.length,
-                httpStatus: status,
-            },
-        }),
+        ...observation,
         requestUrl: requested ? requested.url : null,
         finalUrl: final ? final.url : null,
         transportSecurity: final ? final.url.split(':', 1)[0] : null,
@@ -506,7 +531,7 @@ function buildHttpObservation(detail, options = {}) {
                 bytes: capturedBodyBytes,
             } : null,
             securityHeaders: securityHeaders(response && response.headers),
-            deliveryMetadata: buildDeliveryMetadata(response && response.headers),
+            deliveryMetadata: buildDeliveryMetadata(response && response.headers, observation.observedAt),
         },
     };
 }

package/lib/idn-confusable-policy.mjs

@@ -1,9 +1,9 @@
 // Versioned policy for projecting the Unicode UTS #39 confusables data into
 // WHOISleuth's intentionally small domain-label mapping. The full upstream
 // table is never shipped to browsers or consulted at runtime.
-export const UNICODE_CONFUSABLE_DATA_VERSION = '17.0.0';
-export const UNICODE_CONFUSABLE_SOURCE_URL = 'https://www.unicode.org/Public/17.0.0/security/confusables.txt';
-export const UNICODE_CONFUSABLE_SOURCE_SHA256 = '091c7f82fc39ef208faf8f94d29c244de99254675e09de163160c810d13ef22a';
+export const UNICODE_CONFUSABLE_DATA_VERSION = '18.0.0';
+export const UNICODE_CONFUSABLE_SOURCE_URL = `https://www.unicode.org/Public/${UNICODE_CONFUSABLE_DATA_VERSION}/security/confusables.txt`;
+export const UNICODE_CONFUSABLE_SOURCE_SHA256 = '6ed3ee967c9dfdf6677d563c9985182fbc50a2efb7d6059cd57b2e2ce18f5b92';
 export const UNICODE_CONFUSABLE_LICENSE = 'Unicode-3.0';
 export const CONFUSABLE_PROJECTION_SCHEMA = 'whoisleuth.unicode-confusable-projection';
 export const CONFUSABLE_PROJECTION_VERSION = 1;
@@ -71,7 +71,9 @@ export const REVIEWED_GENERATION_CONFUSABLES = Object.freeze({
     l: 'ӏǀꓲ',
     m: 'м',
     n: 'ոռ',
-    o: 'оοօᴏⲟ',
+    // Keep the complete previously generated o-set when newer source mappings
+    // compete for the same bounded generation slots.
+    o: 'оοօᴏⲟᴑꬽσ',
     p: 'рρⲣ',
     q: 'ԛգզ',
     r: 'гꭇ',

package/lib/idn-confusables.mjs

@@ -4,7 +4,7 @@
 // bounded projection of Unicode Technical Standard #39 data plus the existing
 // reviewed compatibility set. It focuses on characters that visually collapse
 // to common ASCII domain-label characters.
-import { GENERATED_CONFUSABLE_GROUPS, GENERATED_CONFUSABLE_MAPPING_VERSION, GENERATED_GENERATION_CONFUSABLE_GROUPS, } from "./generated/unicode-confusables-17.mjs";
+import { GENERATED_CONFUSABLE_GROUPS, GENERATED_CONFUSABLE_MAPPING_VERSION, GENERATED_GENERATION_CONFUSABLE_GROUPS, } from "./generated/unicode-confusables.mjs";
 import { MAX_GENERATION_CONFUSABLES_PER_ASCII, REVIEWED_GENERATION_CONFUSABLES, } from "./idn-confusable-policy.mjs";
 export const IDN_ANALYSIS_VERSION = 1;
 export const CONFUSABLE_MAPPING_VERSION = GENERATED_CONFUSABLE_MAPPING_VERSION;