@slicedearth/whoisleuth-cli 2.3.0 → 2.5.1

package/lib/perceptual-hash.mjs

@@ -8,7 +8,7 @@
 //
 // Pure JS, no external dependency and no native bindings, so it runs the same
 // on the serverless (Netlify) and self-hosted (Express) paths. That means
-// decoding the image ourselves: Node has no built-in image decoder, only
+// decoding the image ourselves: the runtime has no built-in image decoder, only
 // zlib (used here for PNG inflate). We support the favicon formats that
 // actually occur in practice - PNG, and PNG- or BMP-encoded ICO - and return
 // null for anything else (GIF/JPEG/SVG), which simply falls back to
@@ -21,11 +21,23 @@
 // case, while staying cheap (no DCT). Output is 16 lowercase hex chars;
 // similarity is the Hamming distance between two such strings.
 import * as zlib from 'node:zlib';
-import { hammingDistanceHex, isInformativePerceptualHash, } from "./perceptual-hash-comparison.mjs";
+import { hammingDistanceHex, isInformativePerceptualHash, } from "../packages/analysis/perceptual-hash-comparison.mjs";
 // Bound the decode work on attacker-controlled image bytes. Real favicons top
-// out around 256x256; anything claiming to be larger is refused rather than
-// decoded (it would also never be a legitimate favicon to compare against).
+// out around 256x256; larger inputs above this ceiling remain exact-only
+// evidence rather than causing unbounded pixel allocation.
 const MAX_DIM = 1024;
+// Permit two maximum-sized decode attempts (more than a normal resolution
+// pyramid), while bounding aggregate inflation/filtering across a container.
+// Encoded payloads may consume at most the container's byte length in total;
+// ordinary non-overlapping entries never exceed that bound.
+const MAX_DECODE_PIXELS = 2 * MAX_DIM * MAX_DIM;
+function admitPixels(work, width, height) {
+    const count = width * height;
+    if (count > work.pixels)
+        return false;
+    work.pixels -= count;
+    return true;
+}
 const PNG_SIGNATURE = Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]);
 function byteAt(bytes, index) {
     return bytes[index] ?? 0;
@@ -53,7 +65,7 @@ function paethPredictor(a, b, c) {
 // { width, height, pixels } with pixels as RGBA bytes, or null for anything
 // outside that subset (or malformed input). CRCs are intentionally not
 // verified - we're computing a fuzzy hash, not validating integrity.
-function decodePng(buf) {
+function decodePng(buf, work) {
     const CHANNELS = { 0: 1, 2: 3, 3: 1, 4: 2, 6: 4 };
     let width = 0;
     let height = 0;
@@ -70,14 +82,18 @@ function decodePng(buf) {
         const dataStart = offset + 8;
         const dataEnd = dataStart + length;
         if (dataEnd + 4 > buf.length)
-            break; // truncated chunk
+            return null;
         const data = buf.subarray(dataStart, dataEnd);
         if (type === 'IHDR') {
+            if (length !== 13 || width !== 0 || offset !== 8)
+                return null;
             width = buf.readUInt32BE(dataStart);
             height = buf.readUInt32BE(dataStart + 4);
             bitDepth = byteAt(data, 8);
             colorType = byteAt(data, 9);
             interlace = byteAt(data, 12);
+            if (byteAt(data, 10) !== 0 || byteAt(data, 11) !== 0)
+                return null;
         }
         else if (type === 'PLTE') {
             palette = data;
@@ -86,7 +102,7 @@ function decodePng(buf) {
             transparency = data;
         }
         else if (type === 'IDAT') {
-            idatParts.push(Buffer.from(data));
+            idatParts.push(data);
         }
         else if (type === 'IEND') {
             break;
@@ -100,8 +116,17 @@ function decodePng(buf) {
         return null;
     if (colorType === 3 && !palette)
         return null;
+    if (palette && (palette.length < 3 || palette.length > 768 || palette.length % 3 !== 0))
+        return null;
+    if (transparency && ((colorType === 0 && transparency.length !== 2)
+        || (colorType === 2 && transparency.length !== 6)
+        || (colorType === 3 && (!palette || transparency.length > palette.length / 3))
+        || colorType === 4 || colorType === 6))
+        return null;
     if (idatParts.length === 0)
         return null;
+    if (!admitPixels(work, width, height))
+        return null;
     // A valid non-interlaced 8-bit PNG decompresses to exactly one filter byte
     // plus one scanline per row. Cap the inflate at that size so a malicious
     // IDAT can't expand a sub-200KB favicon into hundreds of MB (a zip bomb)
@@ -162,6 +187,8 @@ function decodePng(buf) {
         let alpha = 255;
         if (colorType === 0) {
             r = g = b = byteAt(recon, s);
+            if (transparency && r === transparency.readUInt16BE(0))
+                alpha = 0;
         }
         else if (colorType === 4) {
             r = g = b = byteAt(recon, s);
@@ -171,6 +198,9 @@ function decodePng(buf) {
             r = byteAt(recon, s);
             g = byteAt(recon, s + 1);
             b = byteAt(recon, s + 2);
+            if (transparency && r === transparency.readUInt16BE(0)
+                && g === transparency.readUInt16BE(2) && b === transparency.readUInt16BE(4))
+                alpha = 0;
         }
         else if (colorType === 6) {
             r = byteAt(recon, s);
@@ -200,13 +230,13 @@ function decodePng(buf) {
 // BITMAPINFOHEADER, an optional palette (for <=8-bit depths), then bottom-up
 // pixel rows. Supports the depths favicons actually ship: 1/4/8-bit
 // palettized and 24/32-bit truecolour. The stored height is doubled (it
-// includes the 1-bpp AND transparency mask); we use the real image height
-// and ignore the mask (opaque is fine for a brightness-based hash).
-function decodeDib(buf) {
+// includes the 1-bpp AND transparency mask). Non-alpha and legacy all-zero
+// alpha images use that mask; meaningful 32-bit alpha remains authoritative.
+function decodeDib(buf, work) {
     if (buf.length < 40)
         return null;
     const headerSize = buf.readUInt32LE(0);
-    if (headerSize < 40)
+    if (headerSize < 40 || headerSize > buf.length)
         return null;
     const width = buf.readInt32LE(4);
     const rawHeight = buf.readInt32LE(8);
@@ -216,7 +246,9 @@ function decodeDib(buf) {
         return null; // BI_RGB only
     if (![1, 4, 8, 24, 32].includes(bitCount))
         return null;
-    const height = Math.floor(Math.abs(rawHeight) / 2) || Math.abs(rawHeight);
+    if (rawHeight <= 0 || rawHeight % 2 !== 0 || buf.readUInt16LE(12) !== 1)
+        return null;
+    const height = rawHeight / 2;
     if (width < 1 || height < 1 || width > MAX_DIM || height > MAX_DIM)
         return null;
     // Palette (BGRA quads) for indexed depths, sitting between the header and
@@ -235,6 +267,13 @@ function decodeDib(buf) {
     const rowSize = Math.floor((bitCount * width + 31) / 32) * 4; // padded to 4 bytes
     if (pixelStart + rowSize * height > buf.length)
         return null;
+    const maskStart = pixelStart + rowSize * height;
+    const maskRowSize = Math.ceil(width / 32) * 4;
+    const maskPresent = maskStart + maskRowSize * height <= buf.length;
+    if (bitCount !== 32 && !maskPresent)
+        return null;
+    if (!admitPixels(work, width, height))
+        return null;
     const paletteColor = (index) => {
         if (!palette || index >= palette.count)
             return [0, 0, 0];
@@ -282,11 +321,16 @@ function decodeDib(buf) {
     }
     // Many legacy 32-bit BMP-in-ICO payloads leave the alpha plane all-zero and
     // rely on the separate 1-bit AND mask for transparency. Trusting those alpha
-    // bytes literally would composite the whole icon to white and hash to a
-    // meaningless all-zero value, so treat a fully-zero alpha plane as opaque.
-    if (bitCount === 32 && !sawNonzeroAlpha) {
-        for (let i = 3; i < pixels.length; i += 4)
-            pixels[i] = 255;
+    // bytes literally would composite the whole icon to white. Restore opacity
+    // only where the legacy mask permits it. No mask plus meaningful 32-bit
+    // alpha is valid; an omitted legacy mask retains the opaque fallback.
+    if (bitCount !== 32 || !sawNonzeroAlpha) {
+        for (let y = 0; y < height; y += 1) {
+            for (let x = 0; x < width; x += 1) {
+                const mask = maskPresent ? byteAt(buf, maskStart + (height - 1 - y) * maskRowSize + (x >> 3)) : 0;
+                pixels[(y * width + x) * 4 + 3] = mask & (0x80 >> (x & 7)) ? 0 : 255;
+            }
+        }
     }
     return { width, height, pixels };
 }
@@ -295,9 +339,10 @@ function decodeDib(buf) {
 // one is in a variant we don't decode (e.g. a 4-bit-palette PNG sub-entry
 // alongside a plain BMP one). A multi-size favicon.ico only needs one usable
 // entry, and any size hashes to nearly the same dHash since it downsamples.
-function decodeIco(buf) {
+function decodeIco(buf, work) {
     const count = buf.readUInt16LE(4);
-    if (count < 1 || 6 + count * 16 > buf.length)
+    const directoryEnd = 6 + count * 16;
+    if (count < 1 || directoryEnd > buf.length)
         return null;
     const entries = [];
     for (let i = 0; i < count; i += 1) {
@@ -306,14 +351,22 @@ function decodeIco(buf) {
         const h = buf[entry + 1] || 256;
         const size = buf.readUInt32LE(entry + 8);
         const dataOffset = buf.readUInt32LE(entry + 12);
-        if (dataOffset + size > buf.length || size < 1)
+        if (dataOffset < directoryEnd || dataOffset + size > buf.length || size < 1)
             continue;
         entries.push({ area: w * h, dataOffset, size });
     }
     entries.sort((a, b) => b.area - a.area);
+    const visited = new Set();
     for (const { dataOffset, size } of entries) {
+        const identity = `${dataOffset}:${size}`;
+        if (visited.has(identity))
+            continue;
+        visited.add(identity);
+        if (size > work.encodedBytes)
+            return null;
+        work.encodedBytes -= size;
         const payload = buf.subarray(dataOffset, dataOffset + size);
-        const image = isPng(payload) ? decodePng(payload) : decodeDib(payload);
+        const image = isPng(payload) ? decodePng(payload, work) : decodeDib(payload, work);
         if (image)
             return image;
     }
@@ -322,10 +375,11 @@ function decodeIco(buf) {
 function decodeImage(buf) {
     if (!Buffer.isBuffer(buf))
         return null;
+    const work = { encodedBytes: buf.length, pixels: MAX_DECODE_PIXELS };
     if (isPng(buf))
-        return decodePng(buf);
+        return decodePng(buf, work);
     if (isIco(buf))
-        return decodeIco(buf);
+        return decodeIco(buf, work);
     return null;
 }
 // Downscales to cols x rows of grayscale luma. Transparency is composited
@@ -428,4 +482,5 @@ function inspectDecodedImage(buf) {
 // produced by the optional local capture package. Keep the generic name as an
 // alias so the evidence contract does not imply that a screenshot is a favicon.
 const imagePerceptualHash = faviconPerceptualHash;
-export { faviconPerceptualHash, hammingDistanceHex, imagePerceptualHash, inspectDecodedImage };
+// Pixel consumers share the same strict byte/dimension admission as hashing.
+export { faviconPerceptualHash, hammingDistanceHex, imagePerceptualHash, inspectDecodedImage, decodeImage as decodeBoundedImagePixels, dHash as imagePixelsPerceptualHash };

package/lib/portable-generator.mjs

@@ -1,29 +1,2 @@
-import { WHOISLEUTH_SOURCE_REPOSITORY_URL, } from "./project-metadata.mjs";
-import { normalizeBoundedSemanticVersion } from "./semantic-version.mjs";
-const URI_LABEL_UNSAFE_GLOBAL_RE = /[\u0000-\u001f\u007f-\u009f]|\p{Default_Ignorable_Code_Point}/gu;
-const URI_LABEL_SCHEME_RE = /^[A-Za-z][A-Za-z0-9+.-]*:(?:\/\/|[^\s])/u;
-export function isUriShapedLabel(value) {
-    if (typeof value !== 'string')
-        return false;
-    const candidate = value.replace(URI_LABEL_UNSAFE_GLOBAL_RE, '').trim();
-    return URI_LABEL_SCHEME_RE.test(candidate);
-}
-export function buildPortableGeneratorMetadata(applicationVersion) {
-    let version = null;
-    if (applicationVersion !== null && applicationVersion !== undefined && applicationVersion !== '') {
-        try {
-            version = normalizeBoundedSemanticVersion(applicationVersion, 'Portable report application');
-        }
-        catch {
-            version = null;
-        }
-    }
-    return Object.freeze({
-        name: 'WHOISleuth',
-        version,
-        projectUrl: WHOISLEUTH_SOURCE_REPOSITORY_URL,
-    });
-}
-export function portableGeneratorAttribution(generator) {
-    return `Generated with ${generator.name}${generator.version ? ` ${generator.version}` : ''} · Source: ${generator.projectUrl}`;
-}
+// Retained public import; the runtime-neutral implementation lives in the domain layer.
+export * from "../packages/analysis/portable-generator.mjs";

package/lib/project-metadata.mjs

@@ -1,8 +1,2 @@
-// Browser-safe public project metadata shared by request identity, package
-// verification, canonical URLs, structured data, and public policy pages.
-export const WHOISLEUTH_SITE_ORIGIN = 'https://www.whoisleuth.com';
-export const WHOISLEUTH_PROJECT_URL = `${WHOISLEUTH_SITE_ORIGIN}/`;
-export const WHOISLEUTH_REQUEST_POLICY_URL = `${WHOISLEUTH_SITE_ORIGIN}/request-policy`;
-export const WHOISLEUTH_SOURCE_REPOSITORY_URL = 'https://github.com/slicedearth/whoisleuth';
-export const WHOISLEUTH_SOURCE_REPOSITORY_GIT_URL = `git+${WHOISLEUTH_SOURCE_REPOSITORY_URL}.git`;
-export const WHOISLEUTH_SOURCE_ISSUES_URL = `${WHOISLEUTH_SOURCE_REPOSITORY_URL}/issues`;
+// Retained public import; the runtime-neutral implementation lives in the domain layer.
+export * from "../packages/analysis/project-metadata.mjs";

package/lib/rdap-bootstrap.mjs

@@ -1,6 +1,7 @@
 // IANA RDAP bootstrap retrieval, bounded stale caching, and authority
 // selection for domain, IP, and ASN queries.
 import net from 'node:net';
+import { abortable } from "./abort.mjs";
 import { fetchRdapDetailedWithTimeout, } from "./rdap-transport.mjs";
 const BOOTSTRAP_TTL_MS = 60 * 60 * 1000;
 const BOOTSTRAP_STALE_TTL_MS = 7 * 24 * 60 * 60 * 1000;
@@ -116,21 +117,17 @@ function validBootstrap(data) {
             && Array.isArray(service[1]) && service[1].length > 0
             && service[1].some((url) => typeof url === 'string' && /^https?:\/\//i.test(url))));
 }
-async function fetchBootstrap(kind, options = {}) {
-    if (!BOOTSTRAP_KINDS.has(kind))
-        throw new Error(`Unsupported RDAP bootstrap kind: ${kind}`);
-    const now = typeof options.now === 'function' ? options.now : Date.now;
-    const fetchUpstream = options.fetchUpstream || fetchRdapDetailedWithTimeout;
-    const cached = bootstrapCache.get(kind);
-    if (cached && now() - cached.fetchedAt < BOOTSTRAP_TTL_MS)
-        return cached.data;
-    const inflight = bootstrapInflight.get(kind);
-    if (inflight)
-        return inflight;
-    const request = (async () => {
+function startBootstrap(kind, options) {
+    const now = options.now ?? Date.now;
+    const fetchUpstream = options.fetchUpstream ?? fetchRdapDetailedWithTimeout;
+    const controller = new AbortController();
+    const { signal } = controller;
+    const request = abortable(async () => {
         try {
+            signal.throwIfAborted();
             const requestedEndpoint = `https://data.iana.org/rdap/${kind}.json`;
-            const response = await fetchUpstream(requestedEndpoint, {}, BOOTSTRAP_FETCH_TIMEOUT_MS);
+            const response = await fetchUpstream(requestedEndpoint, { signal }, BOOTSTRAP_FETCH_TIMEOUT_MS);
+            signal.throwIfAborted();
             const finalEndpoint = admitRdapEndpoint(response.finalUrl ?? requestedEndpoint);
             if (finalEndpoint !== requestedEndpoint) {
                 throw new Error(`IANA bootstrap redirected outside its fixed source endpoint for ${kind}`);
@@ -152,21 +149,74 @@ async function fetchBootstrap(kind, options = {}) {
             return data;
         }
         catch (cause) {
+            signal.throwIfAborted();
             const fallback = bootstrapCache.get(kind);
             if (fallback && now() - fallback.fetchedAt <= BOOTSTRAP_STALE_TTL_MS) {
                 return fallback.data;
             }
             throw cause;
         }
-        finally {
-            bootstrapInflight.delete(kind);
+    }, signal);
+    const flight = {
+        controller, readers: 0, settled: false,
+        request: request.finally(() => {
+            flight.settled = true;
+            if (bootstrapInflight.get(kind) === flight)
+                bootstrapInflight.delete(kind);
+        }),
+    };
+    bootstrapInflight.set(kind, flight);
+    return flight;
+}
+async function fetchBootstrap(kind, options = {}) {
+    if (!BOOTSTRAP_KINDS.has(kind))
+        throw new Error(`Unsupported RDAP bootstrap kind: ${kind}`);
+    options.signal?.throwIfAborted();
+    const now = options.now ?? Date.now;
+    const cached = bootstrapCache.get(kind);
+    if (cached && now() - cached.fetchedAt < BOOTSTRAP_TTL_MS)
+        return cached.data;
+    const flight = bootstrapInflight.get(kind) ?? startBootstrap(kind, options);
+    flight.readers++;
+    let released = false;
+    const release = () => {
+        if (released)
+            return;
+        released = true;
+        // One deadline releases only its reader. The fixed-source transport lives
+        // until the last reader leaves, and never caches a cancelled late response.
+        flight.readers--;
+        if (!flight.readers && !flight.settled) {
+            flight.controller.abort();
+            if (bootstrapInflight.get(kind) === flight)
+                bootstrapInflight.delete(kind);
         }
-    })();
-    bootstrapInflight.set(kind, request);
-    return request;
+    };
+    const { signal } = options;
+    let cancel = () => { };
+    const result = new Promise((resolve, reject) => {
+        // Attach before observing cancellation so even an abandoned queued flight
+        // retains a rejection handler. Release synchronously to avoid starting it.
+        flight.request.then(resolve, reject);
+        cancel = () => { release(); reject(signal?.reason); };
+        signal?.addEventListener('abort', cancel, { once: true });
+        if (signal?.aborted)
+            cancel();
+    });
+    try {
+        return await result;
+    }
+    finally {
+        signal?.removeEventListener('abort', cancel);
+        release();
+        if (flight.controller.signal.aborted)
+            await flight.request.catch(() => { });
+    }
 }
 function clearRdapBootstrapCache() {
     bootstrapCache.clear();
+    for (const flight of bootstrapInflight.values())
+        flight.controller.abort();
     bootstrapInflight.clear();
 }
 function uniqueRdapBases(urls) {
@@ -185,9 +235,9 @@ function uniqueRdapBases(urls) {
         return true;
     });
 }
-async function findRdapBases(type, value) {
+async function findRdapBases(type, value, options = {}) {
     if (type === 'domain') {
-        const bootstrap = await fetchBootstrap('dns');
+        const bootstrap = await fetchBootstrap('dns', options);
         const tld = value.split('.').pop()?.toLowerCase() || '';
         for (const [tlds, urls] of bootstrap.services) {
             if (tlds.some((entry) => entry.toLowerCase() === tld))
@@ -196,7 +246,7 @@ async function findRdapBases(type, value) {
         return [];
     }
     if (type === 'ipv4' || type === 'ipv6') {
-        const bootstrap = await fetchBootstrap(type);
+        const bootstrap = await fetchBootstrap(type, options);
         const matcher = type === 'ipv4' ? ipInCidrV4 : ipInCidrV6;
         let best = null;
         let bestPrefix = -1;
@@ -215,7 +265,7 @@ async function findRdapBases(type, value) {
         return best || [];
     }
     if (type === 'asn') {
-        const bootstrap = await fetchBootstrap('asn');
+        const bootstrap = await fetchBootstrap('asn', options);
         const number = parseInt(value.replace(/^AS/i, ''), 10);
         for (const [ranges, urls] of bootstrap.services) {
             for (const range of ranges) {

package/lib/rdap-client.mjs

@@ -1,7 +1,7 @@
 import { cached } from "./lookup-cache.mjs";
 import { findRdapBases, uniqueRdapBases, } from "./rdap-bootstrap.mjs";
 import { rdapAttempt, rdapFailure } from "./rdap-attempts.mjs";
-import { fetchRdapDetailedWithTimeout, } from "./rdap-transport.mjs";
+import { fetchRdapDetailedWithTimeout, RdapBodyAdmissionError, } from "./rdap-transport.mjs";
 import { admitRdapObjectEndpoint, validateRdapResponse, } from "./rdap-validation.mjs";
 const UPSTREAM_TIMEOUT_MS = 7_000;
 const UPSTREAM_TOTAL_DEADLINE_MS = 12_000;
@@ -24,20 +24,23 @@ function rdapPathFor(type, value) {
  * Query the bounded bootstrap candidate set while retaining every attempted
  * endpoint as separately attributed transport evidence.
  */
-export async function fetchRdapFromBasesWithParser(type, value, bases, parseRdap, fetchUpstream = fetchRdapDetailedWithTimeout) {
+export async function fetchRdapFromBasesWithParser(type, value, bases, parseRdap, fetchUpstream = fetchRdapDetailedWithTimeout, signal) {
+    signal?.throwIfAborted();
     const candidates = uniqueRdapBases(bases).slice(0, MAX_RDAP_ENDPOINTS);
     if (candidates.length === 0)
         return null;
     const startedAt = Date.now();
     const attempts = [];
     for (const base of candidates) {
+        signal?.throwIfAborted();
         const elapsed = Date.now() - startedAt;
         const remaining = UPSTREAM_TOTAL_DEADLINE_MS - elapsed;
         if (remaining <= 0)
             break;
         const url = `${base.replace(/\/$/, '')}/${rdapPathFor(type, value)}`;
         try {
-            const upstream = await fetchUpstream(url, { headers: { Accept: 'application/rdap+json' } }, Math.min(UPSTREAM_TIMEOUT_MS, remaining));
+            const upstream = await fetchUpstream(url, { headers: { Accept: 'application/rdap+json' }, ...(signal ? { signal } : {}) }, Math.min(UPSTREAM_TIMEOUT_MS, remaining));
+            signal?.throwIfAborted();
             const selectedEndpoint = admitRdapObjectEndpoint(type, value, upstream.finalUrl ?? url);
             if (!selectedEndpoint) {
                 attempts.push(rdapAttempt(url, 'invalid_response', {
@@ -58,21 +61,25 @@ export async function fetchRdapFromBasesWithParser(type, value, bases, parseRdap
                 }));
                 continue;
             }
-            let data;
+            let data = null;
             try {
                 data = JSON.parse(upstream.text);
             }
             catch {
-                attempts.push(rdapAttempt(selectedEndpoint, 'invalid_json', {
-                    status: upstream.status,
-                    detail: 'The endpoint returned invalid JSON.',
-                }));
-                continue;
+                // RFC 7480 section 5.3 makes the explanatory body optional for a
+                // negative answer. URL binding and transport/body bounds still apply.
+                if (upstream.status !== 404) {
+                    attempts.push(rdapAttempt(selectedEndpoint, 'invalid_json', {
+                        status: upstream.status,
+                        detail: 'The endpoint returned invalid JSON.',
+                    }));
+                    continue;
+                }
             }
             if (upstream.status === 404) {
                 attempts.push(rdapAttempt(selectedEndpoint, 'not_found', {
                     status: upstream.status,
-                    detail: 'The authoritative endpoint reported no matching object.',
+                    detail: `The authoritative endpoint reported no matching object.${data === null ? ' No usable JSON explanation was supplied.' : ''}`,
                     selected: true,
                 }));
                 return {
@@ -110,6 +117,11 @@ export async function fetchRdapFromBasesWithParser(type, value, bases, parseRdap
             };
         }
         catch (cause) {
+            signal?.throwIfAborted();
+            if (cause instanceof RdapBodyAdmissionError) {
+                attempts.push(rdapAttempt(url, 'invalid_response', { status: cause.status, detail: cause.message }));
+                continue;
+            }
             const detail = String(errorProperty(cause, 'message') || 'request failed');
             const outcome = errorProperty(cause, 'name') === 'AbortError' ||
                 /timed? out|time limit/i.test(detail)
@@ -125,9 +137,9 @@ export async function fetchRdapFromBasesWithParser(type, value, bases, parseRdap
         : 'the total upstream deadline expired';
     throw Object.assign(new Error(`RDAP lookup failed across ${candidates.length} endpoint(s): ${detail}`), { attempts });
 }
-export async function fetchRdapRecordWithParser(type, value, parseRdap) {
+export async function fetchRdapRecordWithParser(type, value, parseRdap, options = {}) {
     return cached(`rdap:${type}:${value}`, async () => {
-        const bases = await findRdapBases(type, value);
-        return fetchRdapFromBasesWithParser(type, value, bases, parseRdap);
-    });
+        const bases = await findRdapBases(type, value, options);
+        return fetchRdapFromBasesWithParser(type, value, bases, parseRdap, options.fetchUpstream, options.signal);
+    }, options.signal);
 }

package/lib/rdap-normalization.mjs

@@ -1,8 +1,9 @@
 // Bounded normalization of untrusted RDAP response objects.
 import net from 'node:net';
 import { registryDateIso } from "./registry-dates.mjs";
-import {} from "./rdap-types.mjs";
+import { MAX_RDAP_STATUSES, MAX_RDAP_REDACTIONS, } from "./rdap-types.mjs";
 const MAX_RDAP_ENTITIES = 100;
+const MAX_RDAP_EVENTS = 100;
 const MAX_RDAP_ENTITY_DEPTH = 6;
 const MAX_ENTITIES_PER_ROLE = 5;
 const MAX_VCARD_ENTRIES = 100;
@@ -10,7 +11,6 @@ const MAX_ENTITY_ROLES = 12;
 const MAX_CONTACT_VALUES = 8;
 const MAX_ENTITY_LINKS = 10;
 const MAX_RDAP_LINKS = 20;
-const MAX_RDAP_REDACTIONS = 100;
 const MAX_RDAP_VARIANT_GROUPS = 20;
 const MAX_RDAP_VARIANT_NAMES = 50;
 const MAX_RDAP_SERVER_TRUNCATION_REASONS = 8;
@@ -166,8 +166,10 @@ function contactValuesTruncated(vcardArray) {
             return rawPart.length > 300 || /[\u0000-\u001f\u007f]/u.test(rawPart) || rawPart.trim() !== '';
         });
         const retainedParts = parts.filter((part) => part !== null);
+        // Empty structured components publish no address; they are not omitted
+        // evidence. Supplied non-blank values still pass every validation bound.
         if (rejectedNonBlankPart
-            || boundedString(retainedParts.join(', '), 1000) === null)
+            || (retainedParts.length > 0 && boundedString(retainedParts.join(', '), 1000) === null))
             return true;
     }
     return false;
@@ -506,18 +508,33 @@ function boundedEventString(value, maxLength) {
         return null;
     return value.trim() || null;
 }
-function normalizeRdapEvents(value) {
+function normalizedEventInventory(value) {
     if (!Array.isArray(value))
-        return [];
-    return value.slice(0, 100).map((event) => {
-        if (!event || typeof event !== 'object' || Array.isArray(event))
-            return null;
+        return { items: [], truncated: value !== undefined };
+    let truncated = value.length > MAX_RDAP_EVENTS;
+    const items = [];
+    for (const event of value.slice(0, MAX_RDAP_EVENTS)) {
+        if (!event || typeof event !== 'object' || Array.isArray(event)) {
+            truncated = true;
+            continue;
+        }
         const record = event;
         const action = boundedEventString(record.eventAction, 100)?.toLowerCase().replace(/\s+/g, ' ') || null;
         const date = boundedEventString(record.eventDate, 64);
         const actor = boundedEventString(record.eventActor, 160);
-        return action || date ? { action, date, actor } : null;
-    }).filter((event) => event !== null);
+        if (record.eventAction !== undefined && action === null
+            || record.eventDate !== undefined && date === null
+            || record.eventActor !== undefined && actor === null)
+            truncated = true;
+        if (action || date)
+            items.push({ action, date, actor });
+        else
+            truncated = true;
+    }
+    return { items, truncated };
+}
+function normalizeRdapEvents(value) {
+    return normalizedEventInventory(value).items;
 }
 function lifecycleDate(events, action, newest) {
     let selected = null;
@@ -697,7 +714,8 @@ function entityInventory(entities) {
 function parseRdapObject(type, data) {
     if (!data || typeof data !== 'object' || Array.isArray(data))
         return null;
-    const events = normalizeRdapEvents(data.events);
+    const eventInfo = normalizedEventInventory(data.events);
+    const events = eventInfo.items;
     const redactionInfo = normalizeRedactions(data.redacted);
     const noticesInfo = summarizeTextBlocks(data.notices);
     const remarksInfo = summarizeTextBlocks(data.remarks);
@@ -708,12 +726,11 @@ function parseRdapObject(type, data) {
     // to every RDAP object type. Unlike set-like fields, status order and
     // repetition remain as published for backwards compatibility.
     const statuses = Array.isArray(data.status)
-        ? data.status.slice(0, 100)
+        ? data.status.slice(0, MAX_RDAP_STATUSES)
             .map((status) => boundedString(status, 160))
             .filter((status) => status !== null)
         : [];
-    const inspectedStatusCount = Array.isArray(data.status) ? Math.min(data.status.length, 100) : 0;
-    const inspectedEventCount = Array.isArray(data.events) ? Math.min(data.events.length, 100) : 0;
+    const inspectedStatusCount = Array.isArray(data.status) ? Math.min(data.status.length, MAX_RDAP_STATUSES) : 0;
     const common = {
         objectClassName: boundedString(data.objectClassName, 80, { lower: true }),
         language: boundedString(data.lang, 35, { lower: true }),
@@ -732,12 +749,10 @@ function parseRdapObject(type, data) {
         serverTruncationReasons,
         statuses,
         statusesTruncated: data.status !== undefined && (!Array.isArray(data.status)
-            || data.status.length > 100
+            || data.status.length > MAX_RDAP_STATUSES
             || statuses.length < inspectedStatusCount),
         events,
-        eventsTruncated: data.events !== undefined && (!Array.isArray(data.events)
-            || data.events.length > 100
-            || events.length < inspectedEventCount),
+        eventsTruncated: eventInfo.truncated,
         lifecycle: summarizeLifecycle(events),
     };
     if (type === 'domain') {

package/lib/rdap-search-workbench.mjs

@@ -213,7 +213,7 @@ function inspectRdapReverseSearchResponse(value, requestedProperties = []) {
         mappings.push(Object.freeze({
             property,
             propertyPath,
-            state: REGISTERED_PROPERTY_PATHS[property]?.includes(propertyPath)
+            state: Object.hasOwn(REGISTERED_PROPERTY_PATHS, property) && REGISTERED_PROPERTY_PATHS[property]?.includes(propertyPath)
                 ? 'registered'
                 : 'unrecognized',
         }));