@slicedearth/whoisleuth-cli 2.3.0 → 2.5.1

package/lib/lookup-response.mjs

@@ -1,17 +1,19 @@
 // Lookup result shaping after the source plan has settled. This module starts no
 // collection and preserves compact, diagnostics and enrichment response shapes.
+import { withoutHttpDeliveryMetadata } from "./http-intelligence.mjs";
 import { buildBulkComparisonEvidence } from "./bulk-comparison-evidence.mjs";
 import { failedReverseDnsIntelligence, skippedReverseDnsIntelligence, } from "./dns-intelligence.mjs";
-import { LOOKUP_DIAGNOSTICS_VERSION, LOOKUP_ERROR_CODES, LOOKUP_LEGACY_DIAGNOSTICS_VERSION, boundedSourceDetail, errorMessage, } from "./lookup-diagnostics.mjs";
+import { LOOKUP_DIAGNOSTICS_VERSION, LOOKUP_ERROR_CODES, LOOKUP_LEGACY_DIAGNOSTICS_VERSION, boundedSourceDetail, } from "./lookup-diagnostics.mjs";
 import { createThreatIntelligenceResult } from "./threat-intelligence-contract.mjs";
 import { THREATFOX_PROVIDER, URLHAUS_PROVIDER, URLSCAN_PROVIDER, } from "./lookup-threat-provider-inventory.mjs";
-import { THREAT_INTELLIGENCE_ENVELOPE_VERSION } from "./threat-intelligence-types.mjs";
+import { THREAT_INTELLIGENCE_ENVELOPE_VERSION } from "../packages/analysis/threat-intelligence-types.mjs";
 import { registryAccessDiagnosticFor } from "./registry-capabilities.mjs";
 import { buildRegistryInsights } from "./registry-insights.mjs";
 import { buildRegistrarStanding } from "./registrar-standing.mjs";
 import { resolveRegistrarIanaId } from "./registrar-standing-contract.mjs";
 import { securityTxtUnavailable } from "./security-txt.mjs";
 import { parseWhoisChain } from "./whois.mjs";
+import { whoisCollectionStatus } from "./whois-authority.mjs";
 function withoutNestedPublicationMetadata(value) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
         return value;
@@ -19,17 +21,6 @@ function withoutNestedPublicationMetadata(value) {
     delete output.publicationMetadata;
     return output;
 }
-function withoutNestedDeliveryMetadata(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        return value;
-    const output = { ...value };
-    if (output.response && typeof output.response === 'object' && !Array.isArray(output.response)) {
-        const response = { ...output.response };
-        delete response.deliveryMetadata;
-        output.response = response;
-    }
-    return output;
-}
 async function buildUnifiedLookupResponse(context) {
     const { availabilityEnabled, availabilityPromise, classified, compact, dnsIntelligenceEnabled, fast, inspectCertificateWarningData, networkContextPromise, options, rdapEnabled, rdapPromise, registrarRdapPromise, reverseDnsEligible, reverseDnsPromise, securityTxtPromise, skipWhois, threatfoxIntelligencePromise, timing, urlhausIntelligencePromise, urlscanIntelligencePromise, whoisEnabled, whoisPromise, } = context;
     const [rdapResult, whoisResult, availabilityResult, reverseDnsResult, registrarRdapResult, networkContextResult, securityTxtResult, urlscanIntelligenceResult, urlhausIntelligenceResult, threatfoxIntelligenceResult] = await Promise.allSettled([
@@ -99,7 +90,7 @@ async function buildUnifiedLookupResponse(context) {
         whois = { skipped: true, detail: 'WHOIS is omitted in fast RDAP-only mode.' };
     }
     else if (Array.isArray(whoisChain)) {
-        whois = { chain: whoisChain, parsed: parseWhoisChain(whoisChain) };
+        whois = { chain: whoisChain, parsed: parseWhoisChain(whoisChain, classified.type === 'domain' ? classified.registrableDomain ?? classified.value : undefined) };
     }
     else {
         whois = {
@@ -125,10 +116,8 @@ async function buildUnifiedLookupResponse(context) {
             availability = {
                 applicable: true,
                 ...result,
-                // Every observation nested in the availability envelope is collected
-                // against this registrable target. Request context remains on the
-                // top-level response; exact-host sources such as security.txt retain
-                // their own requested/final URL attribution.
+                // Registration authority retains its registrable target. Deep source
+                // observations declare their independently collected hostname.
                 domain: classified.value,
             };
         }
@@ -138,7 +127,7 @@ async function buildUnifiedLookupResponse(context) {
                 domain: classified.value,
                 state: 'unknown',
                 confidence: 'low',
-                detail: errorMessage(availabilityResult.reason, 'Availability lookup failed'),
+                detail: boundedSourceDetail(availabilityResult.reason, 'Availability lookup failed'),
             };
         }
     }
@@ -153,11 +142,9 @@ async function buildUnifiedLookupResponse(context) {
         ? 'disabled'
         : skipWhois
             ? 'skipped'
-            : whoisResult.status === 'rejected' || !Array.isArray(whoisChain)
+            : whoisResult.status === 'rejected'
                 ? 'error'
-                : whoisChain.length === 1
-                    ? 'unsupported'
-                    : whois.parsed && whois.parsed.chainStatus === 'complete' ? 'complete' : 'partial';
+                : whoisCollectionStatus(whoisChain, classified.type === 'domain' ? classified.registrableDomain ?? classified.value : undefined);
     const availabilityStatus = classified.type !== 'domain'
         ? 'not_applicable'
         : !availabilityEnabled ? 'disabled'
@@ -301,7 +288,7 @@ async function buildUnifiedLookupResponse(context) {
             availability: {
                 ...compactAvailability,
                 ...(richPageIdentity !== undefined ? { pageIdentity: withoutNestedPublicationMetadata(richPageIdentity) } : {}),
-                ...(richHttp !== undefined ? { http: withoutNestedDeliveryMetadata(richHttp) } : {}),
+                ...(richHttp !== undefined ? { http: withoutHttpDeliveryMetadata(richHttp) } : {}),
                 ...(bulkComparison ? { bulkComparison } : {}),
             },
             diagnostics,

package/lib/lookup-source-progress.mjs

@@ -2,7 +2,9 @@
 // Lookup. These deliberately exclude raw RDAP/WHOIS bodies, contacts, URLs,
 // provider payloads, and request errors. The ordinary final Lookup response
 // remains the only authoritative and persistable result.
-import { THREAT_INTELLIGENCE_CONTRACT_VERSION, THREAT_INTELLIGENCE_RESULT_STATES, THREAT_INTELLIGENCE_SCHEMA, } from "./threat-intelligence-types.mjs";
+import { whoisCollectionStatus } from "./whois-authority.mjs";
+import { THREAT_INTELLIGENCE_CONTRACT_VERSION, THREAT_INTELLIGENCE_RESULT_STATES, THREAT_INTELLIGENCE_SCHEMA, } from "../packages/analysis/threat-intelligence-types.mjs";
+import { plannedLookupSources } from "./lookup-progress.mjs";
 const RESULT_STATES = new Set([
     'available',
     'expiring',
@@ -31,44 +33,33 @@ function record(value) {
         ? value
         : {};
 }
+function sourceTruncated(value) {
+    // RDAP's normalised *Truncated fields describe loss independently of HTTP success.
+    return [record(value), record(record(value).parsed)].some(part => Object.entries(part)
+        .some(([key, field]) => field === true && (key === 'truncated' || key.endsWith('Truncated'))));
+}
 function plannedLookupProgressSources(classified, options = {}) {
-    const sources = ['rdap', 'whois'];
-    if (classified.type === 'domain') {
-        sources.push('domain_evidence', 'registrar_rdap', 'network_context');
-        if (options.securityTxt)
-            sources.push('security_txt');
-        if (options.externalIntelligence)
-            sources.push('external_intelligence');
-        if (options.malwareHostIntelligence)
-            sources.push('malware_host_intelligence');
-        if (options.malwareIocIntelligence)
-            sources.push('malware_ioc_intelligence');
-    }
-    else if (classified.type === 'ipv4' || classified.type === 'ipv6') {
-        sources.push('reverse_dns');
-    }
-    return Object.freeze(sources);
+    return plannedLookupSources(classified.type, 'deep', options);
 }
-function normalizedState(source, outcome, value) {
+function normalizedState(source, outcome, value, requestedDomain, requested = true) {
     if (outcome === 'rejected')
         return 'error';
     if (value === null || value === undefined)
-        return 'skipped';
+        return source === 'rdap' && requested ? 'unsupported' : 'skipped';
     if (source === 'rdap') {
         const rdap = record(value);
         if (rdap.upstreamStatus === 404)
             return 'not_found';
-        return rdap.upstreamStatus === 200 ? 'success' : 'unsupported';
+        if (rdap.upstreamStatus !== 200 || !Object.keys(record(rdap.parsed)).length)
+            return 'error';
+        return sourceTruncated(rdap) ? 'partial' : 'success';
     }
     if (source === 'whois') {
-        if (!Array.isArray(value))
-            return 'error';
-        if (value.length <= 1)
-            return 'unsupported';
-        return 'success';
+        const status = whoisCollectionStatus(value, requestedDomain);
+        return status === 'complete' ? 'success' : status;
     }
     if (source === 'domain_evidence') {
-        return record(value).deepScanComplete === false ? 'partial' : 'success';
+        return record(value).deepScanComplete === true ? 'success' : 'partial';
     }
     if (THREAT_INTELLIGENCE_SOURCES.has(source)) {
         const intelligence = record(value);
@@ -81,16 +72,16 @@ function normalizedState(source, outcome, value) {
     }
     const status = record(value).status;
     if (typeof status === 'string' && DIRECT_STATES.has(status)) {
+        if (status === 'success' && (sourceTruncated(value) || record(value).complete === false))
+            return 'partial';
         return status;
     }
-    if (status === 'complete' || status === 'observed' || status === 'found')
-        return 'success';
     if (status === 'not_applicable' || status === 'disabled')
         return 'skipped';
-    return 'success';
+    return 'error';
 }
-function normalizeLookupSourceSettlement(source, outcome, value) {
-    const state = normalizedState(source, outcome, value);
+function normalizeLookupSourceSettlement(source, outcome, value, requestedDomain, requested = true) {
+    const state = normalizedState(source, outcome, value, requestedDomain, requested);
     const sourceRecord = record(value);
     const threatObservation = THREAT_INTELLIGENCE_SOURCES.has(source)
         ? record(sourceRecord.observation)
@@ -102,12 +93,10 @@ function normalizeLookupSourceSettlement(source, outcome, value) {
         : null;
     const complete = threatObservation
         ? state !== 'error' && threatObservation.complete === true
-        : !['partial', 'error', 'unavailable', 'rate_limited'].includes(state);
+        : ['success', 'not_found'].includes(state) && sourceRecord.complete !== false;
     const truncated = threatObservation
         ? threatObservation.truncated === true
-        : sourceRecord.truncated === true
-            || sourceRecord.recordsTruncated === true
-            || sourceRecord.bodyTruncated === true;
+        : sourceTruncated(value);
     const limitation = outcome === 'rejected'
         ? 'This source did not complete. No absence or safety conclusion was inferred.'
         : state === 'skipped'

package/lib/lookup.mjs

@@ -21,6 +21,7 @@ import { inspectSslblCertificate } from "./sslbl-intelligence.mjs";
 import { normalizeLookupSourceSettlement, plannedLookupProgressSources, } from "./lookup-source-progress.mjs";
 import { buildUnifiedLookupResponse } from "./lookup-response.mjs";
 import { createLookupTimingTracker } from "./lookup-diagnostics.mjs";
+import { prepareSelectedLookupUrl } from "../packages/evidence/lookup-target.mjs";
 async function runUnifiedLookup(classified, options = {}) {
     const fetchRdap = options.fetchRdapRecord || fetchRdapRecord;
     const fetchRegistrarRdap = options.fetchRegistrarRdapRecord || fetchRegistrarRdapRecord;
@@ -44,19 +45,30 @@ async function runUnifiedLookup(classified, options = {}) {
     const securityTxtRequested = options.securityTxt === true;
     const featurePolicy = options.featurePolicy || networkFeaturePolicy();
     const timing = createLookupTimingTracker(!fast && !compact, options.now || Date.now);
-    const measure = (source, operation) => (timing.measure(source, () => abortable(operation, options.signal)));
+    const startedCollectors = [];
+    const measure = (source, operation) => (timing.measure(source, () => abortable(() => {
+        const running = Promise.resolve(operation());
+        if (options.waitForStartedCollectors)
+            startedCollectors.push(running.catch(() => { }));
+        return running;
+    }, options.signal)));
     const rdapEnabled = featureDecision('rdap', featurePolicy).enabled;
     const whoisEnabled = featureDecision('whois', featurePolicy).enabled;
     const availabilityEnabled = featureDecision('availability', featurePolicy).enabled;
     const websiteProbeEnabled = featureDecision('website_probe', featurePolicy).enabled;
     const dnsIntelligenceEnabled = featureDecision('dns_intelligence', featurePolicy).enabled;
     const skipWhois = fast || !whoisEnabled;
+    const selectedUrl = options.selectedUrl === undefined ? undefined
+        : prepareSelectedLookupUrl(options.selectedUrl, classified.inputHostname ?? classified.value);
+    if (selectedUrl && (classified.type !== 'domain' || fast || compact || !availabilityEnabled || !websiteProbeEnabled)) {
+        throw new TypeError('Selected URL collection requires an enabled full Deep domain lookup.');
+    }
     const rdapPromise = rdapEnabled
-        ? measure('rdap', () => fetchRdap(classified.type, classified.value))
+        ? measure('rdap', () => fetchRdap(classified.type, classified.value, options.signal ? { signal: options.signal } : {}))
         : Promise.resolve(null);
     const whoisPromise = skipWhois
         ? Promise.resolve(null)
-        : measure('whois', () => fetchWhois(classified.value));
+        : measure('whois', () => fetchWhois(classified.value, options.signal ? { signal: options.signal } : {}));
     // Registrar RDAP is a separately attributed deep-lookup enrichment. It may
     // overlap the WHOIS chain, but it never joins the promises used to decide
     // availability and can add up to its own bounded timeout to a deep lookup.
@@ -76,7 +88,10 @@ async function runUnifiedLookup(classified, options = {}) {
             includeStructuredDataIdentity: !fast && !compact,
             includeTechnologyProfile: !fast,
             includeSecurityPosture: !compact,
+            ...(!fast && !compact ? { observationHostname: classified.inputHostname } : {}),
+            ...(selectedUrl ? { selectedUrl } : {}),
             featurePolicy,
+            ...(options.signal ? { signal: options.signal } : {}),
             rdapRecordPromise: rdapPromise,
             whoisChainPromise: whoisPromise,
             ...(selectedDnsResolvers ? {
@@ -155,7 +170,7 @@ async function runUnifiedLookup(classified, options = {}) {
         ]);
         const notify = (source, outcome, value) => {
             try {
-                options.onSourceSettled?.(normalizeLookupSourceSettlement(source, outcome, value));
+                options.onSourceSettled?.(normalizeLookupSourceSettlement(source, outcome, value, classified.type === 'domain' ? classified.registrableDomain ?? classified.value : undefined, source !== 'rdap' || rdapEnabled));
             }
             catch {
                 // Presentation callbacks must never change evidence collection.
@@ -171,30 +186,36 @@ async function runUnifiedLookup(classified, options = {}) {
             void Promise.resolve(sourcePromise).then((value) => notify(source, 'fulfilled', value), (error) => notify(source, 'rejected', error));
         }
     }
-    return buildUnifiedLookupResponse({
-        availabilityEnabled,
-        availabilityPromise,
-        classified,
-        compact,
-        dnsIntelligenceEnabled,
-        fast,
-        inspectCertificateWarningData,
-        networkContextPromise,
-        options,
-        rdapEnabled,
-        rdapPromise,
-        registrarRdapPromise,
-        reverseDnsEligible,
-        reverseDnsPromise,
-        securityTxtPromise,
-        skipWhois,
-        threatfoxIntelligencePromise,
-        timing,
-        urlhausIntelligencePromise,
-        urlscanIntelligencePromise,
-        whoisEnabled,
-        whoisPromise,
-    });
+    try {
+        return await buildUnifiedLookupResponse({
+            availabilityEnabled,
+            availabilityPromise,
+            classified,
+            compact,
+            dnsIntelligenceEnabled,
+            fast,
+            inspectCertificateWarningData,
+            networkContextPromise,
+            options,
+            rdapEnabled,
+            rdapPromise,
+            registrarRdapPromise,
+            reverseDnsEligible,
+            reverseDnsPromise,
+            securityTxtPromise,
+            skipWhois,
+            threatfoxIntelligencePromise,
+            timing,
+            urlhausIntelligencePromise,
+            urlscanIntelligencePromise,
+            whoisEnabled,
+            whoisPromise,
+        });
+    }
+    finally {
+        if (options.waitForStartedCollectors)
+            await Promise.all(startedCollectors);
+    }
 }
 export { runUnifiedLookup };
 export { LOOKUP_DIAGNOSTICS_VERSION, LOOKUP_LEGACY_DIAGNOSTICS_VERSION, LOOKUP_TIMING_VERSION, MAX_LOOKUP_TIMING_MS, LOOKUP_ERROR_CODES, } from "./lookup-diagnostics.mjs";

package/lib/observed-network-context.mjs

@@ -11,6 +11,7 @@ const OBSERVED_NETWORK_CONTEXT_VERSION = 1;
 const MAX_NETWORK_CIDRS = 16;
 const MAX_NETWORK_ATTEMPTS = 3;
 const MAX_NETWORK_ABUSE_ROUTES = 6;
+const NETWORK_ABUSE_ROUTE_LIMITATION = 'The network abuse-route projection reached its local retention limit; additional published routes may exist.';
 const MAX_ENDPOINT_LENGTH = 2048;
 const MAX_DETAIL_LENGTH = 240;
 const MAX_NAME_LENGTH = 300;
@@ -144,20 +145,25 @@ function networkAbuseEntities(parsed) {
     const fallback = parsed.abuse && typeof parsed.abuse === 'object' && !Array.isArray(parsed.abuse)
         ? [parsed.abuse]
         : [];
-    return [...roleEntities, ...fallback]
-        .filter((item) => Boolean(item) && typeof item === 'object' && !Array.isArray(item))
-        .slice(0, MAX_NETWORK_ABUSE_ROUTES);
+    return {
+        entities: [...roleEntities.slice(0, MAX_NETWORK_ABUSE_ROUTES + 1), ...fallback]
+            .filter((item) => Boolean(item) && typeof item === 'object' && !Array.isArray(item)),
+        truncated: roleEntities.length > MAX_NETWORK_ABUSE_ROUTES + 1,
+    };
 }
 function projectNetworkAbuseRoutes(parsed, provenance) {
     const routes = new Map();
-    for (const entity of networkAbuseEntities(parsed)) {
+    const inventory = networkAbuseEntities(parsed);
+    let truncated = inventory.truncated;
+    for (const entity of inventory.entities) {
         const emails = Array.isArray(entity.emails) ? entity.emails : [];
         const phones = Array.isArray(entity.phones) ? entity.phones : [];
+        truncated ||= emails.length > MAX_NETWORK_ABUSE_ROUTES + 1 || phones.length > MAX_NETWORK_ABUSE_ROUTES + 1;
         const candidates = [
             { channel: 'email', value: entity.email },
-            ...emails.slice(0, MAX_NETWORK_ABUSE_ROUTES).map((value) => ({ channel: 'email', value })),
+            ...emails.slice(0, MAX_NETWORK_ABUSE_ROUTES + 1).map((value) => ({ channel: 'email', value })),
             { channel: 'phone', value: entity.phone },
-            ...phones.slice(0, MAX_NETWORK_ABUSE_ROUTES).map((value) => ({ channel: 'phone', value })),
+            ...phones.slice(0, MAX_NETWORK_ABUSE_ROUTES + 1).map((value) => ({ channel: 'phone', value })),
         ];
         for (const candidate of candidates) {
             const contact = normalizedAbuseContact(candidate.value, candidate.channel);
@@ -165,6 +171,10 @@ function projectNetworkAbuseRoutes(parsed, provenance) {
                 continue;
             const key = `${candidate.channel}:${contact.toLowerCase()}`;
             if (!routes.has(key)) {
+                if (routes.size >= MAX_NETWORK_ABUSE_ROUTES) {
+                    truncated = true;
+                    continue;
+                }
                 routes.set(key, {
                     kind: 'network_hosting',
                     channel: candidate.channel,
@@ -186,11 +196,14 @@ function projectNetworkAbuseRoutes(parsed, provenance) {
                     ],
                 });
             }
-            if (routes.size >= MAX_NETWORK_ABUSE_ROUTES)
-                return [...routes.values()];
         }
     }
-    return [...routes.values()];
+    return {
+        routes: [...routes.values()].map((route) => truncated
+            ? { ...route, complete: false, truncated: true, limitations: [...route.limitations, NETWORK_ABUSE_ROUTE_LIMITATION] }
+            : route),
+        truncated,
+    };
 }
 function networkSummary(parsedValue, family) {
     const parsed = record(parsedValue);
@@ -204,10 +217,12 @@ function networkSummary(parsedValue, family) {
     const startAddress = publicAddress(parsed.startAddress, family);
     const endAddress = publicAddress(parsed.endAddress, family);
     const country = boundedString(parsed.country, 2);
-    const truncated = parsed.serverTruncated === true
-        || parsed.cidrsTruncated === true
-        || parsed.entitiesTruncated === true
-        || sourceCidrs.length > MAX_NETWORK_CIDRS;
+    const limitations = [
+        ...(parsed.serverTruncated === true ? ['The RDAP server declared that part of its response was truncated.'] : []),
+        ...(parsed.entitiesTruncated === true ? ['Some IP RDAP contact records or fields were omitted during bounded normalisation.'] : []),
+        ...(parsed.cidrsTruncated === true ? ['Some IP RDAP CIDR entries were invalid or exceeded the normalisation limit.'] : []),
+        ...(sourceCidrs.length > MAX_NETWORK_CIDRS ? ['The network CIDR summary reached its local retention limit.'] : []),
+    ];
     return {
         value: {
             handle: boundedString(parsed.handle, MAX_NAME_LENGTH),
@@ -220,8 +235,8 @@ function networkSummary(parsedValue, family) {
             networkType: boundedString(parsed.networkType, 160),
             databaseUpdatedAt: isoTimestamp(lifecycle.databaseUpdatedDateIso || lifecycle.databaseUpdatedDate),
         },
-        truncated,
-        serverTruncated: parsed.serverTruncated === true,
+        truncated: limitations.length > 0,
+        limitations,
     };
 }
 function baseContext(selection, input) {
@@ -299,28 +314,33 @@ async function collectObservedNetworkContext(availabilityValue, options = {}) {
         if (rdap.httpStatus !== 200 || !Object.keys(parsed).length)
             throw new Error('IP RDAP returned no usable normalised object');
         const summary = networkSummary(parsed, selection.family);
-        const partial = summary.truncated;
         const sourceObservedAt = rdap.fetchedAt || observedAt();
-        const abuseRouting = projectNetworkAbuseRoutes(parsed, {
+        const routeProjection = projectNetworkAbuseRoutes(parsed, {
             endpoint: rdap.endpoint,
             observedAt: sourceObservedAt,
             selection,
-            complete: !partial,
-            truncated: partial,
+            complete: !summary.truncated,
+            truncated: summary.truncated,
         });
+        const incompleteReasons = [
+            ...summary.limitations,
+            ...(routeProjection.truncated ? [NETWORK_ABUSE_ROUTE_LIMITATION] : []),
+        ];
+        const partial = incompleteReasons.length > 0;
         return baseContext(selection, {
             status: partial ? 'partial' : 'success',
             observedAt: sourceObservedAt,
             durationMs,
             complete: !partial,
             truncated: partial,
-            detail: 'The selected public endpoint address was mapped to its separately attributed IP RDAP registration.',
+            detail: partial
+                ? `Network registration was retained, but the source record is incomplete. ${incompleteReasons[0]}`
+                : 'The selected public endpoint address was mapped to its separately attributed IP RDAP registration.',
             limitations: [
+                ...incompleteReasons,
                 'This identifies the registered network for one point-in-time endpoint address, not a definitive origin host or hosting provider.',
                 'CDNs, reverse proxies, load balancers, shared hosting, and location-dependent DNS can present different networks.',
                 'Network registration is an investigative lead and does not prove control, ownership, intent, or maliciousness.',
-                ...(summary.serverTruncated ? ['The RDAP server declared that part of its response was truncated.'] : []),
-                ...(sourceCidrsWereCapped(parsed) ? ['The network CIDR summary reached its local retention limit.'] : []),
             ],
             diagnostics: {
                 requestCount: 1,
@@ -330,7 +350,7 @@ async function collectObservedNetworkContext(availabilityValue, options = {}) {
             },
             rdap,
             network: summary.value,
-            abuseRouting,
+            abuseRouting: routeProjection.routes,
         });
     }
     catch (error) {
@@ -348,8 +368,4 @@ async function collectObservedNetworkContext(availabilityValue, options = {}) {
         });
     }
 }
-function sourceCidrsWereCapped(parsed) {
-    return parsed.cidrsTruncated === true
-        || (Array.isArray(parsed.cidrs) && parsed.cidrs.length > MAX_NETWORK_CIDRS);
-}
 export { MAX_NETWORK_ATTEMPTS, MAX_NETWORK_ABUSE_ROUTES, MAX_NETWORK_CIDRS, OBSERVED_NETWORK_CONTEXT_VERSION, collectObservedNetworkContext, selectObservedNetworkAddress, };

package/lib/opportunity-scoring.mjs

@@ -1,107 +1,2 @@
-import { buildScoreEvidenceQuality, } from "./scoring-evidence-quality.mjs";
-export const OPPORTUNITY_MODEL_VERSION = 2;
-export const OPPORTUNITY_REVIEW_THRESHOLD = 70;
-const STATE_BASE = Object.freeze({
-    available: 82,
-    for_sale: 70,
-    expiring: 52,
-    registered: 22,
-});
-const STATE_LABELS = Object.freeze({
-    available: 'available',
-    for_sale: 'registered with a sale signal',
-    expiring: 'registered in a lifecycle transition',
-    registered: 'registered',
-});
-function finite(value) {
-    return typeof value === 'number' && Number.isFinite(value) ? value : null;
-}
-function formatAge(days) {
-    if (days < 60)
-        return `${Math.max(0, Math.round(days))}d old`;
-    const years = days / 365.25;
-    return years < 1 ? `${Math.round(days / 30)}mo old` : `${years.toFixed(1)}y old`;
-}
-function addFactor(factors, dimensions, family, label, delta) {
-    factors.push({ family, label, delta });
-    dimensions.set(family, (dimensions.get(family) ?? 0) + delta);
-}
-export function normalizeOpportunityModelVersion(value) {
-    return typeof value === 'number' && Number.isSafeInteger(value) && value > 0 && value <= 1000 ? value : null;
-}
-// Opportunity is acquisition readiness, not price, value, eligibility, or a
-// prediction that a registration will lapse. It uses only bounded evidence
-// already collected for the current lookup.
-export function explainOpportunityScore(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        return null;
-    const input = value;
-    const state = input.availability ?? input.state;
-    if (typeof state !== 'string' || !Object.hasOwn(STATE_BASE, state))
-        return null;
-    const factors = [];
-    const dimensions = new Map();
-    addFactor(factors, dimensions, 'registration', `Base readiness for “${STATE_LABELS[state] ?? state}”`, STATE_BASE[state] ?? 0);
-    if (input.confidence === 'high')
-        addFactor(factors, dimensions, 'registration', 'High-confidence registration decision', 8);
-    else if (input.confidence === 'medium')
-        addFactor(factors, dimensions, 'registration', 'Medium-confidence registration decision', 3);
-    else if (input.confidence === 'low')
-        addFactor(factors, dimensions, 'registration', 'Low-confidence registration decision', -8);
-    if (state === 'for_sale')
-        addFactor(factors, dimensions, 'listing', 'Bounded sale signal observed; listing remains unverified', 6);
-    else if (input.activityStatus === 'parked')
-        addFactor(factors, dimensions, 'listing', 'Parked page observed without a verified sale offer', 3);
-    else if (state === 'registered' && input.activityStatus === 'active') {
-        addFactor(factors, dimensions, 'listing', 'Active website suggests an in-use registration', -12);
-    }
-    if (input.hasPublicRegistrantContact === true) {
-        addFactor(factors, dimensions, 'contactability', 'Public registrant contact route observed; acquisition suitability is not established', 10);
-    }
-    const expiresInDays = finite(input.expiresInDays);
-    if (state === 'registered' && expiresInDays !== null && expiresInDays >= 0 && expiresInDays < 30) {
-        addFactor(factors, dimensions, 'lifecycle', 'Published expiry is within 30 days; release is not implied', 4);
-    }
-    if (typeof input.privacyProtected === 'boolean') {
-        addFactor(factors, dimensions, 'contactability', 'Registration privacy is neutral; it does not establish contactability', 0);
-    }
-    const ageDays = finite(input.domainAgeDays);
-    if (ageDays !== null && ageDays >= 0) {
-        addFactor(factors, dimensions, 'registration', `Domain age (${formatAge(ageDays)}) is context only`, 0);
-    }
-    const rawScore = Math.round(factors.reduce((total, factor) => total + factor.delta, 0));
-    const score = Math.max(0, Math.min(100, rawScore));
-    const dimensionLabels = {
-        registration: 'Registration certainty',
-        listing: 'Listing readiness',
-        contactability: 'Contactability',
-        lifecycle: 'Lifecycle timing',
-    };
-    const observedFamilies = [...dimensions.keys()];
-    const evidenceQuality = buildScoreEvidenceQuality(input, {
-        expectedDepth: 'fast',
-        observedFamilies,
-        expectedFamilies: ['registration'],
-    });
-    return {
-        modelVersion: OPPORTUNITY_MODEL_VERSION,
-        score,
-        rawScore,
-        capped: score !== rawScore,
-        factors,
-        dimensions: [...dimensions.entries()].map(([id, contribution]) => ({ id, label: dimensionLabels[id], contribution })),
-        evidenceQuality,
-    };
-}
-export function computeOpportunityScore(value) {
-    return explainOpportunityScore(value)?.score ?? null;
-}
-export function opportunityTone(score) {
-    if (score === null)
-        return 'neutral';
-    if (score >= OPPORTUNITY_REVIEW_THRESHOLD)
-        return 'good';
-    if (score >= 40)
-        return 'neutral';
-    return 'warn';
-}
+// Retained public import; the runtime-neutral implementation lives in the domain layer.
+export * from "../packages/analysis/opportunity-scoring.mjs";

package/lib/outbound-identity.mjs

@@ -1,5 +1,5 @@
 import { WHOISLEUTH_APPLICATION_VERSION } from "./application-version.mjs";
-import { WHOISLEUTH_PROJECT_URL, WHOISLEUTH_REQUEST_POLICY_URL, } from "./project-metadata.mjs";
+import { WHOISLEUTH_PROJECT_URL, WHOISLEUTH_REQUEST_POLICY_URL, } from "../packages/analysis/project-metadata.mjs";
 export { WHOISLEUTH_PROJECT_URL, WHOISLEUTH_REQUEST_POLICY_URL };
 export const WHOISLEUTH_USER_AGENT_VERSION = WHOISLEUTH_APPLICATION_VERSION;
 export const WHOISLEUTH_USER_AGENT = `WHOISleuth/${WHOISLEUTH_USER_AGENT_VERSION} (+${WHOISLEUTH_REQUEST_POLICY_URL})`;

package/lib/outbound-request-bounds.mjs

@@ -3,7 +3,10 @@
 // disclosures cannot drift from the enforced request boundaries.
 export const MAX_OUTBOUND_REDIRECTS = 5;
 export const HOMEPAGE_FETCH_TIMEOUT_MS = 6_000;
-export const MAX_HOMEPAGE_BYTES = 300_000;
+// One MiB admits large static application pages while bounding bytes retained
+// from each response. Parsing, derived outputs and request concurrency retain
+// separate work limits; this is not a claim that larger pages lack evidence.
+export const MAX_HOMEPAGE_BYTES = 1024 * 1024;
 export const FAVICON_FETCH_TIMEOUT_MS = 5_000;
 export const MAX_FAVICON_BYTES = 200_000;
 export const MAX_FAVICON_CANDIDATES = 4;