@slicedearth/whoisleuth-cli 2.4.0 → 2.5.1

package/lib/availability.mjs

@@ -1,599 +1,11 @@
-// Domain availability check.
-//
-// Determines registered vs. available vs. expiring via RDAP/WHOIS, and flags
-// likely for-sale listings by checking for known parking/marketplace
-// nameservers and "for sale" listing language on the domain's own homepage.
-// This does not attempt to price the domain - registries don't publish sale
-// prices, and that's proprietary marketplace data.
-//
-// Shared by the Express server and the Netlify Functions.
-import { promises as dns } from 'node:dns';
-import { abortable } from "./abort.mjs";
-import { fetchRdapRecord } from "./rdap.mjs";
-import { buildWhoisChain, parseWhoisChain } from "./whois.mjs";
-import { safeFetchDetailed, readTextCapped } from "./safe-fetch.mjs";
-import { whoisleuthRequestHeaders } from "./outbound-identity.mjs";
-import { collectDnsIntelligence, skippedDnsIntelligence } from "./dns-intelligence.mjs";
-import { fetchFaviconHash } from "./favicon.mjs";
-import { extractHtmlSignals } from "./html-signals.mjs";
-import { analyzeStaticHtml } from "./static-html-analysis.mjs";
+// Composition boundary shared by the server and serverless handlers.
+// Registration authority and optional website enrichment retain separate owners.
 import { featureDecision, networkFeaturePolicy } from "./feature-policy.mjs";
-import { buildHttpObservation, failedHttpObservation, skippedHttpObservation } from "./http-intelligence.mjs";
-import { collectTlsIntelligence, skippedTlsObservation } from "./tls-intelligence.mjs";
-import { parseRegistryDate, registryDateIso } from "./registry-dates.mjs";
-import { analyzeWebsiteSecurityPosture } from "./website-security-posture.mjs";
-import { analyzeWebsiteTechnology, captureTechnologyResponseHeaders, } from "./website-technology.mjs";
-import { analyzeResponsePolicyHeaders, qualifyResponsePolicyWithCspMeta, } from "./response-policy.mjs";
-import { nonEmptyErrorMessage } from "./error-detail.mjs";
-import { registryServiceAdmissionFor } from "./registry-capabilities.mjs";
-import { canonicalRegistrableDomain } from "./registrable-domain.mjs";
-import { isValidAsciiHostname } from "./hostname.mjs";
+import { canonicalRegistrableDomain } from "../packages/analysis/registrable-domain.mjs";
+import { isValidAsciiHostname } from "../packages/contracts/domain-name.mjs";
 import { prepareSelectedLookupUrl } from "../packages/evidence/lookup-target.mjs";
-import { HOMEPAGE_FETCH_TIMEOUT_MS, MAX_HOMEPAGE_BYTES, } from "./outbound-request-bounds.mjs";
-const DNS_DELEGATION_TIMEOUT_MS = 4000;
-const MAX_DELEGATION_NAMESERVERS = 50;
-const MISSING_DNS_CODES = new Set(['ENODATA', 'ENOTFOUND', 'ENONAME', 'NXDOMAIN']);
-function errorRecord(value) {
-    return value && typeof value === 'object' && !Array.isArray(value)
-        ? value
-        : {};
-}
-function registryStatusToken(value) {
-    return value.toLowerCase().replace(/[^a-z0-9]+/gu, '');
-}
-function rdapEventDate(events, action) {
-    const date = events.find((event) => event.action === action)?.date;
-    return typeof date === 'string' ? date : null;
-}
-function withoutHttpDeliveryMetadata(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        return value;
-    const output = { ...value };
-    if (output.response && typeof output.response === 'object' && !Array.isArray(output.response)) {
-        const response = { ...output.response };
-        delete response.deliveryMetadata;
-        output.response = response;
-    }
-    return output;
-}
-// No marketplace (Afternic/Sedo/Dan.com/GoDaddy Auctions/etc.) offers a
-// free, no-auth API to check "is this specific domain listed for sale" -
-// what's checkable without credentials is the parking/landing-page
-// nameservers and homepage copy these services actually use, which is
-// broader coverage of the same signal, not a live cross-marketplace lookup.
-const PARKING_NS_PATTERNS = [
-    /sedoparking\.com$/i,
-    /sedo\.com$/i,
-    /above\.com$/i,
-    /bodis\.com$/i,
-    /parkingcrew\.net$/i,
-    /dan\.com$/i,
-    /hugedomains\.com$/i,
-    /uniregistry/i,
-    /squadhelp/i,
-    /afternic/i,
-    /voodoo\.com$/i,
-    /fabulous\.com$/i,
-    /namedrive/i,
-    /smartname\.com$/i,
-    /domainsponsor\.com$/i,
-    /undeveloped\.com$/i,
-    /trafficz\.com$/i,
-    /dsredirection\.com$/i,
-];
-const FOR_SALE_PATH_RE = /\/(?:premium-)?domains?-for-sale(?:\/|$)/i;
-function forSaleRedirectSignal(httpObservation) {
-    if (!httpObservation || typeof httpObservation !== 'object')
-        return null;
-    const observation = httpObservation;
-    const urls = [
-        observation.finalUrl,
-        ...(Array.isArray(observation.redirects)
-            ? observation.redirects.map((redirect) => redirect && typeof redirect === 'object' ? redirect.to : null)
-            : []),
-    ];
-    for (const value of urls) {
-        if (typeof value !== 'string' || value.length > 2048)
-            continue;
-        try {
-            const url = new URL(value);
-            if (['http:', 'https:'].includes(url.protocol) && FOR_SALE_PATH_RE.test(url.pathname)) {
-                return `for-sale landing-page redirect (${url.origin}${url.pathname})`;
-            }
-        }
-        catch {
-            // Malformed retained provenance cannot establish a sale signal.
-        }
-    }
-    return null;
-}
-// ---------------------------------------------------------------------------
-// Acquisition/sourcing signals: domain age, privacy-redaction, expiry
-// proximity, and site-activity status. These read data already fetched by
-// checkDomainAvailability (RDAP/WHOIS dates and registrant info) - none of
-// this triggers extra registry queries.
-// ---------------------------------------------------------------------------
-function computeAgeDays(dateStr) {
-    const d = parseRegistryDate(dateStr);
-    return d ? Math.floor((Date.now() - d.getTime()) / 86400000) : null;
-}
-function computeDaysUntil(dateStr) {
-    const d = parseRegistryDate(dateStr);
-    return d ? Math.ceil((d.getTime() - Date.now()) / 86400000) : null;
-}
-const PRIVACY_MARKERS = [
-    /redacted for privacy/i,
-    /data protected/i,
-    /privacy\s*protect/i,
-    /whoisguard/i,
-    /domains by proxy/i,
-    /perfect privacy/i,
-    /contact privacy/i,
-    /private registration/i,
-    /identity protect/i,
-    /not disclosed/i,
-    /withheld for privacy/i,
-];
-// Explicit privacy/redaction markers establish a positive privacy signal.
-// Usable public contact data establishes a negative one. A missing or blank
-// contact can instead reflect registry policy, access tier, parser coverage,
-// or ordinary omission, so it remains inconclusive rather than being promoted
-// to an affirmative privacy claim.
-function isPrivacyProtected(registrant) {
-    if (!registrant)
-        return null;
-    const blob = [registrant.name, registrant.org, registrant.email].filter(Boolean).join(' ');
-    if (!blob)
-        return null;
-    return PRIVACY_MARKERS.some((re) => re.test(blob));
-}
-// RDAP Lookup retains a bounded multi-value contact inventory, but Bulk and
-// watchlist availability records deliberately keep the historical compact
-// shape. This prevents repeated contact arrays and registry links from
-// expanding browser-local stores or flowing into case evidence implicitly.
-function compactContact(contact) {
-    if (!contact || typeof contact !== 'object' || Array.isArray(contact))
-        return null;
-    const value = contact;
-    const compact = {
-        handle: value.handle || null,
-        name: value.name || null,
-        org: value.org || null,
-        email: value.email || null,
-        phone: value.phone || null,
-        address: value.address || null,
-    };
-    return Object.values(compact).some(Boolean) ? compact : null;
-}
-// A number of ccTLD registries publish neither an RDAP bootstrap entry nor a
-// generally reachable port-43 WHOIS service. A positive NS answer cannot
-// replace registry registration data, but it does prove that the registrable
-// domain has an active DNS delegation. Use that as a bounded, positive-only
-// fallback: no answer is never interpreted as availability because registered
-// domains can legitimately be undelegated.
-async function checkDnsDelegation(domain, options = {}) {
-    options.signal?.throwIfAborted();
-    // Cancel only this lookup's c-ares requests, never the shared DNS resolver.
-    const ownedResolver = options.resolver ? null : new dns.Resolver();
-    const resolve = options.resolver || ((name) => ownedResolver.resolveNs(name));
-    const controller = new AbortController();
-    const signal = options.signal ? AbortSignal.any([options.signal, controller.signal]) : controller.signal;
-    const cancel = () => ownedResolver?.cancel();
-    signal.addEventListener('abort', cancel, { once: true });
-    const timer = setTimeout(() => controller.abort(new Error('DNS delegation lookup timed out')), DNS_DELEGATION_TIMEOUT_MS);
-    try {
-        const records = await abortable(() => resolve(domain), signal);
-        const validNameservers = [...new Set((Array.isArray(records) ? records : [])
-                .filter((value) => typeof value === 'string')
-                .map((value) => value.trim().replace(/\.+$/, '').toLowerCase())
-                .filter((value) => value.length > 0 && value.length <= 253)
-                .filter((value) => value.split('.').every((label) => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i.test(label))))]
-            .sort();
-        const normalized = validNameservers.slice(0, MAX_DELEGATION_NAMESERVERS);
-        return {
-            delegated: normalized.length > 0,
-            nameservers: normalized,
-            nameserversTruncated: validNameservers.length > MAX_DELEGATION_NAMESERVERS,
-            error: null,
-        };
-    }
-    catch (err) {
-        options.signal?.throwIfAborted();
-        const error = errorRecord(err);
-        if (typeof error.code === 'string' && MISSING_DNS_CODES.has(error.code)) {
-            return { delegated: false, nameservers: [], nameserversTruncated: false, error: null };
-        }
-        return {
-            delegated: false,
-            nameservers: [],
-            nameserversTruncated: false,
-            error: nonEmptyErrorMessage(err, String(err)).slice(0, 180),
-        };
-    }
-    finally {
-        clearTimeout(timer);
-        signal.removeEventListener('abort', cancel);
-    }
-}
-// Fetches enough of the homepage for the lightweight HTML signals below and
-// preserves why the probe failed. A failed request is not evidence that a
-// domain has "no site": transient DNS/TLS/network failures, a slow origin, or
-// an HTTP error can all produce the same null body. Keeping that distinction
-// avoids turning an inconclusive probe into a false inactivity claim.
-async function fetchHomepage(domain, { fetcher = safeFetchDetailed, timeoutMs = HOMEPAGE_FETCH_TIMEOUT_MS, selectedUrl, signal } = {}) {
-    const selected = selectedUrl === undefined ? null : prepareSelectedLookupUrl(selectedUrl, domain);
-    const requestTimeoutMs = Number.isInteger(timeoutMs) && timeoutMs >= 10 && timeoutMs <= HOMEPAGE_FETCH_TIMEOUT_MS
-        ? timeoutMs
-        : HOMEPAGE_FETCH_TIMEOUT_MS;
-    const headers = whoisleuthRequestHeaders();
-    const failures = [];
-    const probeStartedAt = Date.now();
-    for (const requestUrl of selected ? [selected] : [`https://${domain}`, `http://${domain}`]) {
-        signal?.throwIfAborted();
-        const scheme = new URL(requestUrl).protocol.slice(0, -1);
-        const attemptStartedAt = Date.now();
-        const controller = new AbortController();
-        const timeout = setTimeout(() => controller.abort(), requestTimeoutMs);
-        try {
-            const fetched = await fetcher(requestUrl, { signal: signal ? AbortSignal.any([signal, controller.signal]) : controller.signal, headers });
-            const fetchedResponse = fetched instanceof Response ? fetched : fetched.response;
-            const detail = fetched && typeof fetched === 'object' && 'response' in fetched
-                ? fetched
-                : {
-                    response: fetchedResponse,
-                    requestedUrl: requestUrl,
-                    finalUrl: requestUrl,
-                    redirectCount: 0,
-                    redirectLimitReached: false,
-                    hops: [{ url: requestUrl, status: fetchedResponse.status, location: null, durationMs: Date.now() - attemptStartedAt }],
-                    durationMs: Date.now() - attemptStartedAt,
-                };
-            const res = detail.response;
-            const analysisBase = new URL(detail.finalUrl);
-            analysisBase.search = '';
-            analysisBase.hash = '';
-            // Retain an explicitly partial prefix when the body exceeds its bound;
-            // downstream analyses must not treat it as a complete page. The
-            // timeout stays armed through this read (cleared in `finally` below,
-            // not here) - a malicious site could otherwise send headers
-            // immediately and then trickle or stall the body forever, hanging
-            // this worker with no deadline once the timer above is disarmed.
-            if (res.ok) {
-                const body = await readTextCapped(res, MAX_HOMEPAGE_BYTES, { includeSha256: true });
-                return {
-                    text: body.text,
-                    status: 'fetched',
-                    detail: `${selected ? 'Selected URL' : 'Homepage'} responded over ${scheme.toUpperCase()} (HTTP ${res.status}).`,
-                    responsePolicy: analyzeResponsePolicyHeaders(res.headers),
-                    technologyHeaders: captureTechnologyResponseHeaders(res.headers),
-                    ...(selected ? { analysisBaseUrl: analysisBase.toString() } : {}),
-                    http: buildHttpObservation({ ...detail, durationMs: Date.now() - attemptStartedAt }, {
-                        previousAttempts: failures,
-                        capturedBodyBytes: body.bytesRead,
-                        bodyInspected: true,
-                        bodyTruncated: body.truncated,
-                        bodySha256: body.sha256,
-                    }),
-                };
-            }
-            // A non-2xx HTTP response still conclusively proves that a web service
-            // answered on this domain. It may block this probe (403), require auth
-            // (401), have a broken homepage route (404), or be unhealthy (5xx), but
-            // none of those are equivalent to "no website". We cannot inspect its
-            // HTML signals, so preserve a separate responded status and release the
-            // unused body.
-            await res.body?.cancel().catch(() => { });
-            return {
-                text: null,
-                status: 'responded',
-                detail: `Web server responded over ${scheme.toUpperCase()} (HTTP ${res.status}); ${selected ? 'selected page' : 'homepage'} content was not available for inspection.`,
-                responsePolicy: analyzeResponsePolicyHeaders(res.headers),
-                technologyHeaders: captureTechnologyResponseHeaders(res.headers),
-                http: buildHttpObservation({ ...detail, durationMs: Date.now() - attemptStartedAt }, {
-                    previousAttempts: failures,
-                    capturedBodyBytes: 0,
-                    bodyInspected: false,
-                }),
-            };
-        }
-        catch (err) {
-            signal?.throwIfAborted();
-            const error = errorRecord(err);
-            const reason = error.name === 'AbortError'
-                ? `timed out after ${requestTimeoutMs} milliseconds`
-                : selected ? 'request failed; the selected URL was not retried at another path or scheme'
-                    : nonEmptyErrorMessage(err, 'request failed')
-                        .replace(/[\u0000-\u001f\u007f]+/g, ' ')
-                        .slice(0, 180);
-            failures.push({ url: requestUrl, error: `${scheme.toUpperCase()} ${reason}` });
-        }
-        finally {
-            clearTimeout(timeout);
-        }
-    }
-    return {
-        text: null,
-        status: 'inconclusive',
-        detail: failures.length
-            ? `Could not confirm ${selected ? 'selected URL' : 'homepage'} activity: ${failures.map((attempt) => attempt.error).join('; ')}.`
-            : 'Could not confirm homepage activity.',
-        http: failedHttpObservation(failures, { durationMs: Date.now() - probeStartedAt }),
-    };
-}
-function deriveWebsiteActivity(homepageStatus, hasFavicon, alreadyParked = false) {
-    if (alreadyParked)
-        return 'parked';
-    if (homepageStatus === 'fetched' || homepageStatus === 'responded' || hasFavicon)
-        return 'active';
-    return 'unreachable';
-}
-function registryPolicyDetail(domain, fast) {
-    const details = [];
-    const rdapAdmission = registryServiceAdmissionFor(domain, 'rdap');
-    if (rdapAdmission && !rdapAdmission.allowed) {
-        details.push('RDAP was not queried because the registry access policy does not permit collection.');
-    }
-    const whoisAdmission = fast ? null : registryServiceAdmissionFor(domain, 'whois');
-    if (whoisAdmission && !whoisAdmission.allowed) {
-        details.push(whoisAdmission.state === 'permission_required'
-            ? 'WHOIS was not queried because registry permission or source authorisation is required.'
-            : 'WHOIS was not queried because IANA publishes no domain WHOIS service for this suffix.');
-    }
-    return details.length ? ` ${details.join(' ')}` : '';
-}
-// fast: true skips the WHOIS fallback (no TCP:43 chain) and the homepage
-// fetch (no for-sale/parking detection) - just RDAP plus the signals
-// derivable from it (age, expiry proximity, privacy). Meant for scanning
-// large sourcing candidate lists quickly and gently on registry rate
-// limits; anything it can't resolve (state "unknown") is meant to get a
-// follow-up deep check (fast: false, the default) on the shortlist only.
-async function resolveDomainRegistration(domain, options, featurePolicy) {
-    options.signal?.throwIfAborted();
-    const fast = options.fast === true;
-    const rdapEnabled = featureDecision('rdap', featurePolicy).enabled;
-    const whoisEnabled = featureDecision('whois', featurePolicy).enabled;
-    const dnsIntelligenceEnabled = featureDecision('dns_intelligence', featurePolicy).enabled;
-    const hasPreloadedRdap = Object.prototype.hasOwnProperty.call(options, 'rdapRecord');
-    const hasPreloadedWhois = Object.prototype.hasOwnProperty.call(options, 'whoisChain');
-    const hasPreloadedRdapPromise = Object.prototype.hasOwnProperty.call(options, 'rdapRecordPromise');
-    const hasPreloadedWhoisPromise = Object.prototype.hasOwnProperty.call(options, 'whoisChainPromise');
-    const hasPreloadedDnsDelegation = Object.prototype.hasOwnProperty.call(options, 'dnsDelegation');
-    let nameservers = [];
-    let statuses = [];
-    let rdapServer = null;
-    let rdapFound = false;
-    let registrar = null;
-    let registrant = null;
-    let abuse = null;
-    let createdDate = null;
-    let expiryDate = null;
-    let createdDateIso = null;
-    let expiryDateIso = null;
-    let registrationSource = null;
-    let registrationConfidence = 'high';
-    let dnssec = null;
-    let registryDnsEvidence = null;
-    const assessment = (registration) => ({
-        registration, registryDnsEvidence, nameservers, dnssec,
-    });
-    if (rdapEnabled) {
-        try {
-            // Shared with /api/rdap (lib/rdap.mts's fetchRdapRecord) rather than a
-            // separate fetch+parse here - same registry data either way, and this
-            // also picks up that function's short-TTL cache (lib/lookup-cache.mts)
-            // and upstream timeout for free.
-            const recordValue = hasPreloadedRdapPromise
-                ? await abortable(() => options.rdapRecordPromise, options.signal)
-                : hasPreloadedRdap
-                    ? options.rdapRecord
-                    : await fetchRdapRecord('domain', domain, options.signal ? { signal: options.signal } : {});
-            options.signal?.throwIfAborted();
-            const record = errorRecord(recordValue);
-            const recordRdapServer = typeof record.rdapServer === 'string' ? record.rdapServer : null;
-            const upstreamStatus = typeof record.upstreamStatus === 'number' ? record.upstreamStatus : null;
-            if (Object.keys(record).length) {
-                rdapServer = recordRdapServer;
-                if (upstreamStatus === 404) {
-                    return assessment({
-                        state: 'available',
-                        confidence: 'high',
-                        detail: 'The registry\'s RDAP service has no record for this domain.',
-                        source: 'rdap',
-                        rdapServer: recordRdapServer,
-                    });
-                }
-                const parsed = errorRecord(record.parsed);
-                if (Object.keys(parsed).length) {
-                    registryDnsEvidence = parsed;
-                    statuses = Array.isArray(parsed.statuses)
-                        ? parsed.statuses.filter((status) => typeof status === 'string').map((status) => status.toLowerCase())
-                        : [];
-                    nameservers = Array.isArray(parsed.nameservers)
-                        ? parsed.nameservers.filter((nameserver) => typeof nameserver === 'string')
-                        : [];
-                    registrar = compactContact(parsed.registrar);
-                    registrant = compactContact(parsed.registrant);
-                    abuse = compactContact(parsed.abuse);
-                    const events = Array.isArray(parsed.events)
-                        ? parsed.events.map(errorRecord)
-                        : [];
-                    const lifecycle = errorRecord(parsed.lifecycle);
-                    createdDate = typeof lifecycle.createdDate === 'string'
-                        ? lifecycle.createdDate
-                        : rdapEventDate(events, 'registration');
-                    expiryDate = typeof lifecycle.expiryDate === 'string'
-                        ? lifecycle.expiryDate
-                        : rdapEventDate(events, 'expiration');
-                    createdDateIso = typeof lifecycle.createdDateIso === 'string'
-                        ? lifecycle.createdDateIso
-                        : registryDateIso(createdDate);
-                    expiryDateIso = typeof lifecycle.expiryDateIso === 'string'
-                        ? lifecycle.expiryDateIso
-                        : registryDateIso(expiryDate);
-                    dnssec = typeof parsed.dnssec === 'string' ? parsed.dnssec : null;
-                    rdapFound = true;
-                    registrationSource = 'rdap';
-                }
-            }
-        }
-        catch {
-            options.signal?.throwIfAborted();
-            /* fall through to WHOIS-based detection (deep mode only) */
-        }
-    }
-    const dnsDelegationPromise = !rdapFound && dnsIntelligenceEnabled
-        ? hasPreloadedDnsDelegation
-            ? Promise.resolve(options.dnsDelegation)
-            : checkDnsDelegation(domain, {
-                ...(options.resolveNs ? { resolver: options.resolveNs } : {}),
-                ...(options.signal ? { signal: options.signal } : {}),
-            })
-        : null;
-    // DNS may settle while the independent WHOIS source is still pending. Keep
-    // its rejection observed even if WHOIS supplies an early conclusive return.
-    void dnsDelegationPromise?.catch(() => { });
-    let whoisChain = null;
-    let whoisParsed = null;
-    if (!rdapFound && !fast && whoisEnabled) {
-        try {
-            whoisChain = (hasPreloadedWhoisPromise
-                ? await abortable(() => options.whoisChainPromise, options.signal)
-                : hasPreloadedWhois
-                    ? options.whoisChain
-                    : await buildWhoisChain(domain, options.signal ? { signal: options.signal } : {})) ?? null;
-            options.signal?.throwIfAborted();
-            if (!Array.isArray(whoisChain))
-                throw new Error('WHOIS chain unavailable');
-            const parsed = parseWhoisChain(whoisChain);
-            whoisParsed = parsed;
-            if (parsed.notFound) {
-                return assessment({
-                    state: 'available',
-                    confidence: 'medium',
-                    detail: `WHOIS reports no matching record for this domain${parsed.notFoundSource ? ` (per ${parsed.notFoundSource})` : ''}.`,
-                    source: 'whois',
-                });
-            }
-            if (parsed.registrationStatus === 'registered') {
-                if (parsed.nameservers.length)
-                    nameservers = parsed.nameservers;
-                if (parsed.statuses.length)
-                    statuses = parsed.statuses.map((status) => status.toLowerCase());
-                if (parsed.registrar) {
-                    registrar = {
-                        handle: null,
-                        ianaId: parsed.registrarIanaId || null,
-                        name: parsed.registrar,
-                        org: null,
-                        email: parsed.abuseEmail || null,
-                        phone: parsed.abusePhone || null,
-                    };
-                }
-                if (parsed.registrantName || parsed.registrantOrg || parsed.registrantEmail || parsed.registrantPhone) {
-                    registrant = {
-                        handle: null,
-                        name: parsed.registrantName || null,
-                        org: parsed.registrantOrg || null,
-                        email: parsed.registrantEmail || null,
-                        phone: parsed.registrantPhone || null,
-                    };
-                }
-                if (parsed.abuseEmail || parsed.abusePhone) {
-                    abuse = { handle: null, name: null, org: parsed.registrar || null, email: parsed.abuseEmail || null, phone: parsed.abusePhone || null };
-                }
-                createdDate = parsed.createdDate || null;
-                expiryDate = parsed.expiryDate || null;
-                createdDateIso = parsed.createdDateIso || parsed.lifecycle?.createdDateIso || registryDateIso(createdDate);
-                expiryDateIso = parsed.expiryDateIso || parsed.lifecycle?.expiryDateIso || registryDateIso(expiryDate);
-                if (!dnssec)
-                    dnssec = parsed.dnssec || null;
-                registrationSource = 'whois';
-            }
-        }
-        catch {
-            options.signal?.throwIfAborted();
-            /* if both RDAP and WHOIS fail, we simply can't determine availability */
-        }
-    }
-    // WHOIS ran and was not a confirmed not-found, but produced no positive
-    // registration evidence either - e.g. the registry answered inconclusively
-    // or every referral hop failed/rate-limited. Report "unknown" rather than
-    // fabricating "registered" from an empty record.
-    const hasWhoisRegistrationData = whoisParsed?.registrationStatus === 'registered';
-    let dnsDelegated = false;
-    if (!rdapFound && !hasWhoisRegistrationData && dnsDelegationPromise) {
-        const delegation = await dnsDelegationPromise;
-        if (delegation && delegation.delegated === true && Array.isArray(delegation.nameservers) && delegation.nameservers.length) {
-            dnsDelegated = true;
-            nameservers = delegation.nameservers;
-            registrationSource = 'dns';
-            registrationConfidence = 'medium';
-        }
-    }
-    options.signal?.throwIfAborted();
-    if (!rdapFound && !hasWhoisRegistrationData && !dnsDelegated) {
-        const disabledSources = [
-            !rdapEnabled ? 'RDAP' : null,
-            !fast && !whoisEnabled ? 'WHOIS' : null,
-            !dnsIntelligenceEnabled ? 'DNS intelligence' : null,
-        ].filter(Boolean);
-        const disabledDetail = disabledSources.length
-            ? ` ${disabledSources.join(', ')} ${disabledSources.length === 1 ? 'is' : 'are'} disabled by deployment policy.`
-            : '';
-        const policyDetail = registryPolicyDetail(domain, fast);
-        return assessment({
-            state: 'unknown',
-            confidence: 'low',
-            detail: fast
-                ? `No enabled registration source produced a record or authoritative delegation. A fast scan cannot determine registration status.${disabledDetail}${policyDetail}`
-                : whoisParsed && whoisParsed.failedHop
-                    ? `WHOIS was inconclusive - a referral hop did not answer conclusively (${whoisParsed.failedHop}).${policyDetail}`
-                    : `No enabled registration source returned conclusive data or an authoritative DNS delegation.${disabledDetail}${policyDetail}`,
-            ...(!fast && whoisEnabled ? { source: 'whois' } : {}),
-        });
-    }
-    const domainAgeDays = computeAgeDays(createdDateIso || createdDate);
-    const expiresInDays = computeDaysUntil(expiryDateIso || expiryDate);
-    // DNS proves delegation only; it says nothing about whether registry
-    // contact data is privacy-protected or merely unavailable.
-    const privacyProtected = registrationSource === 'dns' ? null : isPrivacyProtected(registrant);
-    const baseInfo = {
-        nameservers,
-        statuses,
-        registrar,
-        registrant,
-        abuse,
-        createdDate,
-        expiryDate,
-        createdDateIso,
-        expiryDateIso,
-        rdapServer,
-        domainAgeDays,
-        expiresInDays,
-        privacyProtected,
-        dnssec,
-        source: registrationSource,
-    };
-    if (statuses.some((status) => {
-        const normalizedStatus = registryStatusToken(status);
-        return normalizedStatus.includes('pendingdelete') || normalizedStatus.includes('redemptionperiod');
-    })) {
-        return assessment({
-            state: 'expiring',
-            confidence: 'medium',
-            detail: 'Domain is in redemption/pending-delete status and may become available soon.',
-            ...baseInfo,
-        });
-    }
-    return assessment({
-        state: 'registered',
-        confidence: registrationConfidence,
-        detail: registrationSource === 'dns'
-            ? 'Authoritative DNS delegation confirms the domain is registered, but RDAP/WHOIS registration details were unavailable.'
-            : 'Domain is registered. Run a deep check for parking/for-sale detection.',
-        ...baseInfo,
-    });
-}
+import { resolveDomainRegistration } from "./domain-registration.mjs";
+import { enrichWebsite } from "./website-enrichment.mjs";
 async function checkDomainAvailability(domain, options = {}) {
     options.signal?.throwIfAborted();
     const fast = options.fast === true;
@@ -608,201 +20,13 @@ async function checkDomainAvailability(domain, options = {}) {
     const websiteProbeEnabled = featureDecision('website_probe', featurePolicy).enabled;
     if (selectedUrl && (fast || !websiteProbeEnabled))
         throw new TypeError('Selected URL collection requires an enabled Deep website observation.');
-    const { registration, registryDnsEvidence, nameservers, dnssec } = await resolveDomainRegistration(domain, options, featurePolicy);
+    const assessment = await resolveDomainRegistration(domain, options, featurePolicy);
+    const { registration } = assessment;
     if (fast || registration.state !== 'registered' && !selectedUrl)
         return registration;
-    const collectDns = options.collectDnsIntelligence || collectDnsIntelligence;
-    const collectTls = options.collectTlsIntelligence || collectTlsIntelligence;
-    const fetchHomepageForDomain = options.fetchHomepage || fetchHomepage;
-    const fetchFaviconForDomain = options.fetchFaviconHash || fetchFaviconHash;
-    const dnsIntelligenceEnabled = featureDecision('dns_intelligence', featurePolicy).enabled;
-    const tlsIntelligenceEnabled = featureDecision('tls_intelligence', featurePolicy).enabled;
-    const deepScanComplete = ['rdap', 'whois', 'dns_intelligence', 'website_probe', 'tls_intelligence']
-        .every((feature) => featureDecision(feature, featurePolicy).enabled);
-    // Registered - look for for-sale/parked/website signals (homepage fetch,
-    // deep mode only), and check for a configured mail exchanger as a
-    // phishing-risk signal (a lookalike domain that can receive/send mail is
-    // capable of running credential-harvesting or BEC campaigns).
-    const nsSignal = registration.state === 'registered' ? nameservers.find((ns) => PARKING_NS_PATTERNS.some((re) => re.test(ns))) : undefined;
-    let forSaleSignal = nsSignal ? `parking nameserver (${nsSignal})` : null;
-    let activityStatus = nsSignal && observationHostname === domain ? 'parked' : 'unknown';
-    // Homepage + bounded DNS evidence resolve in parallel; the favicon fetch is sequenced after
-    // the homepage so it can use any <link rel="icon"> the page declares (many
-    // sites serve no /favicon.ico and only point to a CDN PNG this way). One
-    // extra round-trip on the already-slow deep path, in exchange for finding
-    // favicons the bare /favicon.ico probe would miss.
-    const [homepage, dnsIntelligence, tlsIntelligence] = await Promise.all([
-        websiteProbeEnabled ? fetchHomepageForDomain(observationHostname, {
-            ...(selectedUrl ? { selectedUrl } : {}), ...(options.signal ? { signal: options.signal } : {}),
-        }).catch((err) => ({
-            text: null,
-            status: 'inconclusive',
-            detail: selectedUrl ? 'Could not confirm selected URL activity.'
-                : `Could not confirm homepage activity: ${String(err && err.message ? err.message : 'request failed').slice(0, 180)}.`,
-            http: failedHttpObservation([
-                { url: selectedUrl ?? `https://${observationHostname}`, error: selectedUrl ? 'request failed' : String(err && err.message ? err.message : 'request failed') },
-            ]),
-        })) : Promise.resolve({
-            text: null,
-            status: 'skipped',
-            detail: 'Website probing is disabled by deployment policy.',
-            http: skippedHttpObservation(),
-        }),
-        dnsIntelligenceEnabled
-            ? collectDns(observationHostname, {
-                ...(options.dnsResolvers ? { resolvers: options.dnsResolvers } : {}),
-                includeExtendedContext: options.includeExtendedDnsContext === true,
-                includeInheritedCaa: options.includeInheritedCaa === true,
-                registryEvidence: registryDnsEvidence,
-                ...(observationHostname !== domain ? { registrationDomain: domain } : {}),
-            })
-            : Promise.resolve(skippedDnsIntelligence('DNS intelligence is disabled by deployment policy.', {
-                includeExtendedContext: options.includeExtendedDnsContext === true,
-                includeInheritedCaa: options.includeInheritedCaa === true,
-            })),
-        tlsIntelligenceEnabled
-            ? collectTls(observationHostname)
-            : Promise.resolve(skippedTlsObservation()),
-    ]);
-    options.signal?.throwIfAborted();
-    const page = homepage.text;
-    const pageBaseUrl = homepage.analysisBaseUrl ?? (typeof homepage.http?.finalUrl === 'string' ? homepage.http.finalUrl : `https://${observationHostname}/`);
-    let pageAnalysis = page ? analyzeStaticHtml(page, { baseUrl: pageBaseUrl, includeVisibleText: true }) : undefined;
-    let htmlSignals = {
-        domainSaleSignal: null,
-        pageTitle: null,
-        hasPasswordField: false,
-        phishingLanguageMatch: null,
-        hasExternalFormAction: null,
-        externalAssetHosts: [],
-        cspMetaPolicy: null,
-        pageIdentity: null,
-        credentialSurfaceProfile: null,
-        structuredDataIdentity: null,
-        technologyProfile: null,
-        pageRoleProfile: null,
-        clientBehaviorProfile: null,
-    };
-    if (homepage.status === 'fetched') {
-        if (page) {
-            const responseContentType = homepage.http?.response?.contentType;
-            const pageIdentityEligible = typeof responseContentType !== 'string'
-                || responseContentType.trim() === ''
-                || /^(?:text\/html|application\/xhtml\+xml)(?:\s*;|$)/i.test(responseContentType.trim());
-            htmlSignals = await extractHtmlSignals(page, observationHostname, {
-                ...(options.signal ? { signal: options.signal } : {}),
-                ...(pageAnalysis ? { htmlAnalysis: pageAnalysis } : {}),
-                baseUrl: pageBaseUrl,
-                ...(typeof homepage.http?.observedAt === 'string' ? { observedAt: homepage.http.observedAt } : {}),
-                sourceTruncated: homepage.http?.response?.bodyTruncated === true,
-                exactBodyHash: homepage.http?.response?.bodyHash,
-                httpServer: homepage.http?.response?.server,
-                responseHeaders: homepage.technologyHeaders,
-                activityStatus,
-                includePageIdentity: pageIdentityEligible,
-                includePublicationMetadata: options.includePublicationMetadata !== false,
-                ...(options.includeCredentialSurfaceProfile !== undefined
-                    ? { includeCredentialSurfaceProfile: options.includeCredentialSurfaceProfile }
-                    : {}),
-                ...(options.includeStructuredDataIdentity !== undefined
-                    ? { includeStructuredDataIdentity: options.includeStructuredDataIdentity }
-                    : {}),
-                ...(options.includeTechnologyProfile !== undefined
-                    ? { includeTechnologyProfile: options.includeTechnologyProfile }
-                    : {}),
-            });
-            if (pageIdentityEligible && htmlSignals.domainSaleSignal) {
-                if (!selectedUrl && observationHostname === domain)
-                    forSaleSignal = forSaleSignal || htmlSignals.domainSaleSignal;
-                activityStatus = 'parked';
-            }
-        }
-    }
-    if (options.includeTechnologyProfile !== false && htmlSignals.technologyProfile === null
-        && ['fetched', 'responded'].includes(homepage.status)) {
-        htmlSignals.technologyProfile = await analyzeWebsiteTechnology({
-            ...(options.signal ? { signal: options.signal } : {}),
-            htmlAvailable: false,
-            httpServer: homepage.http?.response?.server,
-            responseHeaders: homepage.technologyHeaders,
-            observedAt: homepage.http?.observedAt,
-        });
-    }
-    // Complete document consumers before an optional network wait. Only the
-    // small icon projection, not every parsed element/token, crosses that wait.
-    const faviconEvidence = pageAnalysis ? {
-        iconLinks: pageAnalysis.iconLinks, effectiveBaseUrl: pageAnalysis.effectiveBaseUrl,
-    } : undefined;
-    pageAnalysis = undefined;
-    const favicon = websiteProbeEnabled
-        ? await fetchFaviconForDomain(observationHostname, {
-            baseUrl: pageBaseUrl, ...(faviconEvidence ? { htmlAnalysis: faviconEvidence } : {}),
-        }).catch(() => null)
-        : null;
-    const faviconHash = favicon ? favicon.hash : null;
-    const faviconPHash = favicon ? favicon.phash : null;
-    const responsePolicy = qualifyResponsePolicyWithCspMeta(homepage.responsePolicy, htmlSignals.cspMetaPolicy);
-    const retainedHttp = options.includeDeliveryMetadata === false
-        ? withoutHttpDeliveryMetadata(homepage.http)
-        : homepage.http;
-    const { cspMetaPolicy: _cspMetaPolicy, domainSaleSignal: _domainSaleSignal, ...retainedHtmlSignals } = htmlSignals;
-    const securityPosture = options.includeSecurityPosture === false ? null : analyzeWebsiteSecurityPosture({
-        http: homepage.http,
-        responsePolicy,
-        pageIdentity: htmlSignals.pageIdentity,
-        tls: tlsIntelligence,
-        dns: dnsIntelligence,
-        dnssec,
-        observedAt: homepage.http?.observedAt,
-    });
-    const redirectSaleSignal = forSaleRedirectSignal(homepage.http);
-    if (!selectedUrl && observationHostname === domain && !forSaleSignal && redirectSaleSignal) {
-        forSaleSignal = redirectSaleSignal;
-        activityStatus = 'parked';
-    }
-    const faviconProvedActive = !selectedUrl && homepage.status === 'inconclusive' && Boolean(favicon);
-    const websiteProbeStatus = faviconProvedActive ? 'responded' : homepage.status;
-    const websiteProbeDetail = faviconProvedActive
-        ? `${homepage.detail} A favicon responded successfully, confirming an active web service.`
-        : homepage.detail;
-    if (websiteProbeEnabled) {
-        activityStatus = deriveWebsiteActivity(homepage.status, !selectedUrl && Boolean(favicon), activityStatus === 'parked');
-    }
-    const registrationResult = registration.state !== 'registered' ? registration
-        : !forSaleSignal ? {
-            ...registration,
-            detail: 'source' in registration && registration.source === 'dns'
-                ? 'Authoritative DNS delegation confirms the domain is registered, but RDAP/WHOIS registration details were unavailable.'
-                : selectedUrl ? 'The domain is registered. Website observations concern the explicitly selected URL.'
-                    : observationHostname === domain ? 'Domain is registered and shows no for-sale signals.'
-                        : 'The domain is registered. Website observations concern the separately identified hostname.',
-        } : {
-            ...registration,
-            state: 'for_sale',
-            confidence: 'medium',
-            detail: `Detected a for-sale listing (${forSaleSignal}).`,
-        };
-    return {
-        ...registrationResult,
-        activityStatus,
-        websiteProbeStatus,
-        websiteProbeDetail,
-        http: retainedHttp,
-        ...(options.observationHostname !== undefined || selectedUrl ? { observationHostname } : {}),
-        ...(selectedUrl ? { webObservationMode: 'selected_url' } : {}),
-        deepScanComplete,
-        faviconHash,
-        faviconPHash,
-        ...retainedHtmlSignals,
-        securityPosture,
-        nameservers: nameservers.length || observationHostname !== domain ? nameservers : dnsIntelligence.records.ns,
-        dns: dnsIntelligence,
-        tls: tlsIntelligence,
-        hasMx: dnsIntelligence.hasMx,
-        hasNullMx: dnsIntelligence.hasNullMx,
-        mxHosts: dnsIntelligence.mxHosts,
-        hasSpf: dnsIntelligence.hasSpf,
-        hasDmarc: dnsIntelligence.hasDmarc,
-    };
+    return enrichWebsite({ domain, observationHostname, selectedUrl, ...assessment }, options, featurePolicy);
 }
-export { checkDomainAvailability, checkDnsDelegation, fetchHomepage, isPrivacyProtected, deriveWebsiteActivity, forSaleRedirectSignal, parseRegistryDate as parseWhoisDate, };
+export { checkDomainAvailability };
+export { checkDnsDelegation, isPrivacyProtected } from "./domain-registration.mjs";
+export { fetchHomepage, deriveWebsiteActivity, forSaleRedirectSignal } from "./website-enrichment.mjs";
+export { parseRegistryDate as parseWhoisDate } from "./registry-dates.mjs";