@slicedearth/whoisleuth-cli 2.4.0 → 2.5.1

package/lib/lookup-diagnostics.mjs

@@ -1,31 +1,9 @@
 // Lookup diagnostics, bounded source errors and optional deep-lookup timing.
 import { OPERATION_BUDGET_ERROR_CODE } from "./operation-budget.mjs";
 import { FEATURE_DISABLED_ERROR_CODE } from "./feature-policy.mjs";
+import { LOOKUP_SOURCE_STATES, lookupDiagnosticStates } from "./lookup-progress.mjs";
 const LOOKUP_DIAGNOSTICS_VERSION = 8;
 const LOOKUP_LEGACY_DIAGNOSTICS_VERSION = 7;
-const LOOKUP_SOURCE_STATES = Object.freeze([
-    'success', 'partial', 'not_found', 'skipped', 'error', 'unsupported',
-    'not_applicable', 'unavailable', 'rate_limited', 'complete', 'disabled', 'stale',
-]);
-const SOURCE_STATES = new Set(LOOKUP_SOURCE_STATES);
-function lookupDiagnosticStates(value) {
-    const record = (input) => input && typeof input === 'object' && !Array.isArray(input)
-        ? input : {};
-    const diagnostics = record(value);
-    const candidates = {
-        rdap: record(diagnostics.rdap).status,
-        registrar_rdap: record(record(diagnostics.rdap).registrar).status,
-        whois: record(diagnostics.whois).status,
-        availability: record(diagnostics.availability).status,
-        reverse_dns: record(diagnostics.reverseDns).status,
-        network_context: record(diagnostics.network).status,
-        security_txt: record(diagnostics.securityTxt).status,
-        sslbl: record(diagnostics.sslbl).status,
-    };
-    return Object.freeze(Object.fromEntries(Object.entries(candidates).map(([source, state]) => [
-        source, typeof state === 'string' && SOURCE_STATES.has(state) ? state : null,
-    ])));
-}
 const LOOKUP_TIMING_VERSION = 1;
 const MAX_LOOKUP_TIMING_MS = 120_000;
 const LOOKUP_TIMING_SOURCE_ORDER = Object.freeze([

package/lib/lookup-network-evidence-bounds.mjs

@@ -1,10 +1 @@
-// Browser-safe collection bounds shared by the network evidence producers,
-// the Lookup response trust boundary, and the display projection.
-export const MAX_LOOKUP_DNS_RECORDS_PER_TYPE = 16;
-export const MAX_LOOKUP_REVERSE_DNS_PTR_RECORDS = 8;
-export const TLS_PROFILE_VERSION = 3;
-export const MAX_LOOKUP_TLS_CHAIN_CERTIFICATES = 8;
-export const MAX_LOOKUP_TLS_ALT_NAMES = 50;
-export const MAX_LOOKUP_TLS_NAME_VALUES = 4;
-export const MAX_LOOKUP_TLS_FINDINGS = 5;
-export const MAX_LOOKUP_TLS_CERTIFICATE_POLICIES = 16;
+export * from "../packages/analysis/lookup-network-evidence-bounds.mjs";

package/lib/lookup-progress.mjs

@@ -1,7 +1,7 @@
 // Portable bounded NDJSON Lookup progress contract. Partial events are
 // presentation-only; only a validated final ordinary Lookup result may cross
 // the persistence boundary.
-import { scanBoundedJson, MAX_BOUNDED_JSON_DEPTH, MAX_BOUNDED_JSON_KEYS, MAX_BOUNDED_JSON_VALUES } from "./bounded-json.mjs";
+import { scanBoundedJson, MAX_BOUNDED_JSON_DEPTH, MAX_BOUNDED_JSON_KEYS, MAX_BOUNDED_JSON_VALUES } from "../packages/analysis/bounded-json.mjs";
 export const LOOKUP_PROGRESS_SCHEMA = 'whoisleuth.lookup-progress';
 export const LOOKUP_PROGRESS_VERSION = 1;
 export const MAX_LOOKUP_PROGRESS_SOURCES = 16;
@@ -32,7 +32,56 @@ const SOURCE_STATES = new Set([
     'unavailable',
     'rate_limited',
 ]);
+// Final diagnostic states are distinct from the provisional progress subset.
+export const LOOKUP_SOURCE_STATES = Object.freeze([
+    'success', 'partial', 'not_found', 'skipped', 'error', 'unsupported',
+    'not_applicable', 'unavailable', 'rate_limited', 'complete', 'disabled', 'stale',
+]);
+const FINAL_SOURCE_STATES = new Set(LOOKUP_SOURCE_STATES);
+export function lookupDiagnosticStates(value) {
+    const record = (input) => input && typeof input === 'object' && !Array.isArray(input)
+        ? input : {};
+    const diagnostics = record(value);
+    const candidates = {
+        rdap: record(diagnostics.rdap).status,
+        registrar_rdap: record(record(diagnostics.rdap).registrar).status,
+        whois: record(diagnostics.whois).status,
+        availability: record(diagnostics.availability).status,
+        reverse_dns: record(diagnostics.reverseDns).status,
+        network_context: record(diagnostics.network).status,
+        security_txt: record(diagnostics.securityTxt).status,
+        sslbl: record(diagnostics.sslbl).status,
+    };
+    return Object.freeze(Object.fromEntries(Object.entries(candidates).map(([source, state]) => [
+        source, typeof state === 'string' && FINAL_SOURCE_STATES.has(state) ? state : null,
+    ])));
+}
 const SOURCE_ID_RE = /^[a-z][a-z0-9_]{0,39}$/u;
+/** The existing Lookup recipe, shared by offline plans and source progress.
+ * This describes admitted families, not provider health or request counts. */
+export function plannedLookupSources(targetType, mode, options = {}) {
+    const sources = ['rdap'];
+    if (mode === 'fast') {
+        if (targetType === 'domain')
+            sources.push('domain_evidence');
+        return Object.freeze(sources);
+    }
+    sources.push('whois');
+    if (targetType === 'domain') {
+        sources.push('domain_evidence', 'registrar_rdap', 'network_context');
+        if (options.securityTxt)
+            sources.push('security_txt');
+        if (options.externalIntelligence)
+            sources.push('external_intelligence');
+        if (options.malwareHostIntelligence)
+            sources.push('malware_host_intelligence');
+        if (options.malwareIocIntelligence)
+            sources.push('malware_ioc_intelligence');
+    }
+    else if (targetType === 'ipv4' || targetType === 'ipv6')
+        sources.push('reverse_dns');
+    return Object.freeze(sources);
+}
 const TEXT_ENCODER = new TextEncoder();
 function byteLength(value) {
     return TEXT_ENCODER.encode(value).byteLength;

package/lib/lookup-response-contract.mjs

@@ -6,12 +6,13 @@
 // relies on before any evidence is derived or rendered. Nested source records
 // stay separately attributed and additive; their own normalizers remain the
 // authority for source-specific fields.
-import { THREAT_INTELLIGENCE_CONTRACT_VERSION, THREAT_INTELLIGENCE_CATEGORIES, THREAT_INTELLIGENCE_CONFIDENCES, THREAT_INTELLIGENCE_ENVELOPE_VERSION, THREAT_INTELLIGENCE_RESULT_STATES, THREAT_INTELLIGENCE_SCHEMA, THREAT_INTELLIGENCE_SEVERITIES, } from "./threat-intelligence-types.mjs";
-import { MAX_HTTP_ATTEMPTS, MAX_HTTP_ERROR_LENGTH, MAX_HTTP_EVIDENCE_REDIRECTS, } from "./http-evidence-bounds.mjs";
+import { THREAT_INTELLIGENCE_CONTRACT_VERSION, THREAT_INTELLIGENCE_CATEGORIES, THREAT_INTELLIGENCE_CONFIDENCES, THREAT_INTELLIGENCE_ENVELOPE_VERSION, THREAT_INTELLIGENCE_RESULT_STATES, THREAT_INTELLIGENCE_SCHEMA, THREAT_INTELLIGENCE_SEVERITIES, } from "../packages/analysis/threat-intelligence-types.mjs";
+import { MAX_HTTP_ATTEMPTS, MAX_HTTP_ERROR_LENGTH, MAX_HTTP_EVIDENCE_REDIRECTS, } from "../packages/analysis/http-evidence-bounds.mjs";
 import { MAX_OBSERVATION_LIMITATIONS, MAX_OBSERVATION_LIMITATION_LENGTH, normalizeExplicitIsoTimestamp, } from "../packages/evidence/observation.mjs";
-import { assertBoundedJsonStructure } from "./bounded-json.mjs";
-import { canonicalRegistrableDomain } from "./registrable-domain.mjs";
+import { assertBoundedJsonStructure } from "../packages/analysis/bounded-json.mjs";
+import { canonicalRegistrableDomain } from "../packages/analysis/registrable-domain.mjs";
 import { validLookupObservationScope } from "../packages/evidence/lookup-target.mjs";
+import { isWebCollectionQuality } from "../packages/evidence/collection-quality.mjs";
 import { MAX_LOOKUP_DNS_RECORDS_PER_TYPE, MAX_LOOKUP_REVERSE_DNS_PTR_RECORDS, MAX_LOOKUP_TLS_ALT_NAMES, MAX_LOOKUP_TLS_CERTIFICATE_POLICIES, MAX_LOOKUP_TLS_CHAIN_CERTIFICATES, MAX_LOOKUP_TLS_FINDINGS, MAX_LOOKUP_TLS_NAME_VALUES, } from "./lookup-network-evidence-bounds.mjs";
 import { MAX_SECURITY_POSTURE_FINDINGS, sanitizeLookupChildProfiles, validSecurityPostureFinding, validTlsChainCertificate, validTlsFinding, } from "./lookup-child-profile-contract.mjs";
 import { validHttpDeliveryMetadata, validPagePublicationMetadata, } from "./homepage-metadata-contract.mjs";
@@ -136,22 +137,28 @@ function normalizeThreatFinding(value, providerId) {
 }
 function normalizeThreatProvider(value, expectedDomain) {
     const input = record(value);
+    const identity = record(input.provider);
+    const providerId = boundedThreatText(identity.id, 80);
+    const providerDefinition = providerId && Object.hasOwn(THREAT_INTELLIGENCE_PROVIDERS, providerId)
+        ? THREAT_INTELLIGENCE_PROVIDERS[providerId] : null;
+    const withheld = (reason) => ({ provider: null, withheld: {
+            providerId: providerDefinition ? providerId : null,
+            label: providerDefinition ? `${providerDefinition.label} record` : 'Unrecognised provider record',
+            count: 1, reason,
+        } });
     if (input.schema !== THREAT_INTELLIGENCE_SCHEMA
         || input.version !== THREAT_INTELLIGENCE_CONTRACT_VERSION)
-        return null;
+        return withheld('Unsupported provider format; evidence was withheld.');
     const target = record(input.target);
     if (target.type !== 'domain'
         || target.exposure !== 'registrable_domain'
         || target.value !== expectedDomain)
-        return null;
-    const identity = record(input.provider);
-    const providerId = boundedThreatText(identity.id, 80);
-    const providerDefinition = providerId ? THREAT_INTELLIGENCE_PROVIDERS[providerId] : null;
+        return withheld('The provider target did not match this Lookup; evidence was withheld.');
     if (!providerId || !providerDefinition)
-        return null;
+        return withheld('The provider identity was not recognised; evidence was withheld.');
     const state = boundedThreatText(input.state, 32);
     if (!state || !THREAT_INTELLIGENCE_STATES.has(state))
-        return null;
+        return withheld('The provider result state was not supported; evidence was withheld.');
     const observationInput = record(input.observation);
     const limitations = Array.isArray(observationInput.limitations)
         ? observationInput.limitations
@@ -177,35 +184,40 @@ function normalizeThreatProvider(value, expectedDomain) {
             ? `${omitted} invalid or over-limit provider finding${omitted === 1 ? ' was' : 's were'} omitted from this view.`
             : 'Provider findings were not a supported array and were withheld from this view.');
     }
-    return {
-        schema: THREAT_INTELLIGENCE_SCHEMA,
-        version: THREAT_INTELLIGENCE_CONTRACT_VERSION,
-        provider: {
-            id: providerId,
-            label: providerDefinition.label,
-        },
-        target: {
-            type: 'domain',
-            value: expectedDomain,
-            exposure: 'registrable_domain',
-        },
-        state: projectionIncomplete && ['success', 'not_found'].includes(state) ? 'partial' : state,
-        detail: boundedThreatText(input.detail),
-        findings,
-        observation: {
-            observedAt: threatTimestamp(observationInput.observedAt),
-            limitations: limitations.slice(0, MAX_THREAT_INTELLIGENCE_LIMITATIONS),
-            complete: projectionIncomplete ? false : typeof observationInput.complete === 'boolean' ? observationInput.complete : null,
-            truncated: projectionTruncated ? true : typeof observationInput.truncated === 'boolean' ? observationInput.truncated : null,
-        },
-    };
+    return { withheld: null, provider: {
+            schema: THREAT_INTELLIGENCE_SCHEMA,
+            version: THREAT_INTELLIGENCE_CONTRACT_VERSION,
+            provider: {
+                id: providerId,
+                label: providerDefinition.label,
+            },
+            target: {
+                type: 'domain',
+                value: expectedDomain,
+                exposure: 'registrable_domain',
+            },
+            state: projectionIncomplete && ['success', 'not_found'].includes(state) ? 'partial' : state,
+            detail: boundedThreatText(input.detail),
+            findings,
+            observation: {
+                observedAt: threatTimestamp(observationInput.observedAt),
+                limitations: limitations.slice(0, MAX_THREAT_INTELLIGENCE_LIMITATIONS),
+                complete: projectionIncomplete ? false : typeof observationInput.complete === 'boolean' ? observationInput.complete : null,
+                truncated: projectionTruncated ? true : typeof observationInput.truncated === 'boolean' ? observationInput.truncated : null,
+            },
+        } };
 }
 function projectThreatProviders(values, expectedDomain) {
     const grouped = new Map();
+    const withheld = [];
+    const unexamined = Math.max(0, values.length - MAX_THREAT_INTELLIGENCE_PROVIDERS * 2);
     for (const value of values.slice(0, MAX_THREAT_INTELLIGENCE_PROVIDERS * 2)) {
-        const provider = normalizeThreatProvider(value, expectedDomain);
-        if (!provider)
+        const projection = normalizeThreatProvider(value, expectedDomain);
+        if (projection.withheld) {
+            withheld.push(projection.withheld);
             continue;
+        }
+        const provider = projection.provider;
         const providerId = String(record(provider.provider).id || '');
         if (!providerId)
             continue;
@@ -218,20 +230,25 @@ function projectThreatProviders(values, expectedDomain) {
             grouped.set(providerId, { first: provider, signatures: new Set([signature]) });
         }
     }
-    return [...grouped.values()].slice(0, MAX_THREAT_INTELLIGENCE_PROVIDERS).map(({ first, signatures }) => (signatures.size === 1
+    if (unexamined)
+        withheld.push({ providerId: null, label: 'Additional provider records', count: unexamined,
+            reason: 'The provider-record review bound was exceeded; these records were not examined.' });
+    const withheldIds = new Set(withheld.map((item) => item.providerId).filter(Boolean));
+    const providers = [...grouped.values()].slice(0, MAX_THREAT_INTELLIGENCE_PROVIDERS).map(({ first, signatures }) => (signatures.size === 1 && !withheldIds.has(String(record(first.provider).id)) && unexamined === 0
         ? first
         : {
             ...first,
             state: 'partial',
-            detail: 'Conflicting records were returned for this provider; no conclusive provider projection is available.',
+            detail: 'Conflicting or unvalidated provider records prevent a conclusive provider projection.',
             findings: [],
             observation: {
                 observedAt: null,
-                limitations: ['Conflicting records for the same provider identity were withheld rather than resolved by array order.'],
+                limitations: ['Conflicting or unvalidated records were withheld rather than resolved by array order.'],
                 complete: false,
                 truncated: null,
             },
         }));
+    return { providers, withheld };
 }
 function optionalBoundedText(value, maxLength) {
     return value === undefined || (typeof value === 'string'
@@ -624,6 +641,7 @@ function validAvailabilityScalars(value) {
         && validOptionalNullableText(value.pageTitle, MAX_LOOKUP_RESPONSE_PAGE_TITLE_LENGTH)
         && validOptionalNullableText(value.dnssec, 40)
         && (value.deepScanComplete === undefined || typeof value.deepScanComplete === 'boolean')
+        && (value.webCollectionQuality === undefined || isWebCollectionQuality(value.webCollectionQuality))
         && (value.hasMx === undefined || value.hasMx === null || typeof value.hasMx === 'boolean')
         && (value.hasNullMx === undefined || value.hasNullMx === null || typeof value.hasNullMx === 'boolean')
         && (value.hasSpf === undefined || value.hasSpf === null || typeof value.hasSpf === 'boolean')
@@ -860,6 +878,7 @@ function parseCompactLookupHttpResponse(value, expectedDomain) {
         || typeof availability.confidence !== 'string'
         || !COMPACT_CONFIDENCE_LEVELS.has(availability.confidence)
         || (availability.deepScanComplete !== undefined && typeof availability.deepScanComplete !== 'boolean')
+        || (availability.webCollectionQuality !== undefined && !isWebCollectionQuality(availability.webCollectionQuality))
         || (availability.bulkComparison !== undefined
             && !validCompactBulkComparison(availability.bulkComparison))
         || compactPageIdentity !== null && Object.hasOwn(compactPageIdentity, 'publicationMetadata')
@@ -968,11 +987,20 @@ function createLookupViewModel(response) {
         ? canonicalRegistrableDomain(response.registrableDomain)
             ?? canonicalRegistrableDomain(availability.domain)
         : null;
-    const providers = expectedThreatDomain
+    const threatProjection = expectedThreatDomain
         && rawThreatIntelligence.version === THREAT_INTELLIGENCE_ENVELOPE_VERSION
         && Array.isArray(rawThreatIntelligence.providers)
         ? projectThreatProviders(rawThreatIntelligence.providers, expectedThreatDomain)
-        : [];
+        : { providers: [], withheld: Object.keys(rawThreatIntelligence).length ? [{
+                    providerId: null,
+                    label: 'External-intelligence data',
+                    count: Array.isArray(rawThreatIntelligence.providers) ? rawThreatIntelligence.providers.length : null,
+                    reason: !expectedThreatDomain ? 'External intelligence was not bound to a domain Lookup and was withheld.'
+                        : rawThreatIntelligence.version !== THREAT_INTELLIGENCE_ENVELOPE_VERSION
+                            ? 'The external-intelligence envelope uses an unsupported version; its records were withheld.'
+                            : 'External-intelligence records were not a supported array and were withheld.',
+                }] : [] };
+    const { providers, withheld } = threatProjection;
     const threatIntelligence = providers.length
         ? { version: THREAT_INTELLIGENCE_ENVELOPE_VERSION, providers }
         : {};
@@ -1008,6 +1036,7 @@ function createLookupViewModel(response) {
         sslbl,
         threatIntelligence,
         threatIntelligenceProviders: providers,
+        threatIntelligenceWithheld: withheld,
         dnsEvidence,
         dnsRecords: record(dnsEvidence.records),
         httpEvidence,

package/lib/lookup-response.mjs

@@ -1,11 +1,12 @@
 // Lookup result shaping after the source plan has settled. This module starts no
 // collection and preserves compact, diagnostics and enrichment response shapes.
+import { withoutHttpDeliveryMetadata } from "./http-intelligence.mjs";
 import { buildBulkComparisonEvidence } from "./bulk-comparison-evidence.mjs";
 import { failedReverseDnsIntelligence, skippedReverseDnsIntelligence, } from "./dns-intelligence.mjs";
 import { LOOKUP_DIAGNOSTICS_VERSION, LOOKUP_ERROR_CODES, LOOKUP_LEGACY_DIAGNOSTICS_VERSION, boundedSourceDetail, } from "./lookup-diagnostics.mjs";
 import { createThreatIntelligenceResult } from "./threat-intelligence-contract.mjs";
 import { THREATFOX_PROVIDER, URLHAUS_PROVIDER, URLSCAN_PROVIDER, } from "./lookup-threat-provider-inventory.mjs";
-import { THREAT_INTELLIGENCE_ENVELOPE_VERSION } from "./threat-intelligence-types.mjs";
+import { THREAT_INTELLIGENCE_ENVELOPE_VERSION } from "../packages/analysis/threat-intelligence-types.mjs";
 import { registryAccessDiagnosticFor } from "./registry-capabilities.mjs";
 import { buildRegistryInsights } from "./registry-insights.mjs";
 import { buildRegistrarStanding } from "./registrar-standing.mjs";
@@ -20,17 +21,6 @@ function withoutNestedPublicationMetadata(value) {
     delete output.publicationMetadata;
     return output;
 }
-function withoutNestedDeliveryMetadata(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        return value;
-    const output = { ...value };
-    if (output.response && typeof output.response === 'object' && !Array.isArray(output.response)) {
-        const response = { ...output.response };
-        delete response.deliveryMetadata;
-        output.response = response;
-    }
-    return output;
-}
 async function buildUnifiedLookupResponse(context) {
     const { availabilityEnabled, availabilityPromise, classified, compact, dnsIntelligenceEnabled, fast, inspectCertificateWarningData, networkContextPromise, options, rdapEnabled, rdapPromise, registrarRdapPromise, reverseDnsEligible, reverseDnsPromise, securityTxtPromise, skipWhois, threatfoxIntelligencePromise, timing, urlhausIntelligencePromise, urlscanIntelligencePromise, whoisEnabled, whoisPromise, } = context;
     const [rdapResult, whoisResult, availabilityResult, reverseDnsResult, registrarRdapResult, networkContextResult, securityTxtResult, urlscanIntelligenceResult, urlhausIntelligenceResult, threatfoxIntelligenceResult] = await Promise.allSettled([
@@ -100,7 +90,7 @@ async function buildUnifiedLookupResponse(context) {
         whois = { skipped: true, detail: 'WHOIS is omitted in fast RDAP-only mode.' };
     }
     else if (Array.isArray(whoisChain)) {
-        whois = { chain: whoisChain, parsed: parseWhoisChain(whoisChain) };
+        whois = { chain: whoisChain, parsed: parseWhoisChain(whoisChain, classified.type === 'domain' ? classified.registrableDomain ?? classified.value : undefined) };
     }
     else {
         whois = {
@@ -154,7 +144,7 @@ async function buildUnifiedLookupResponse(context) {
             ? 'skipped'
             : whoisResult.status === 'rejected'
                 ? 'error'
-                : whoisCollectionStatus(whoisChain);
+                : whoisCollectionStatus(whoisChain, classified.type === 'domain' ? classified.registrableDomain ?? classified.value : undefined);
     const availabilityStatus = classified.type !== 'domain'
         ? 'not_applicable'
         : !availabilityEnabled ? 'disabled'
@@ -298,7 +288,7 @@ async function buildUnifiedLookupResponse(context) {
             availability: {
                 ...compactAvailability,
                 ...(richPageIdentity !== undefined ? { pageIdentity: withoutNestedPublicationMetadata(richPageIdentity) } : {}),
-                ...(richHttp !== undefined ? { http: withoutNestedDeliveryMetadata(richHttp) } : {}),
+                ...(richHttp !== undefined ? { http: withoutHttpDeliveryMetadata(richHttp) } : {}),
                 ...(bulkComparison ? { bulkComparison } : {}),
             },
             diagnostics,

package/lib/lookup-source-progress.mjs

@@ -3,7 +3,8 @@
 // provider payloads, and request errors. The ordinary final Lookup response
 // remains the only authoritative and persistable result.
 import { whoisCollectionStatus } from "./whois-authority.mjs";
-import { THREAT_INTELLIGENCE_CONTRACT_VERSION, THREAT_INTELLIGENCE_RESULT_STATES, THREAT_INTELLIGENCE_SCHEMA, } from "./threat-intelligence-types.mjs";
+import { THREAT_INTELLIGENCE_CONTRACT_VERSION, THREAT_INTELLIGENCE_RESULT_STATES, THREAT_INTELLIGENCE_SCHEMA, } from "../packages/analysis/threat-intelligence-types.mjs";
+import { plannedLookupSources } from "./lookup-progress.mjs";
 const RESULT_STATES = new Set([
     'available',
     'expiring',
@@ -38,28 +39,13 @@ function sourceTruncated(value) {
         .some(([key, field]) => field === true && (key === 'truncated' || key.endsWith('Truncated'))));
 }
 function plannedLookupProgressSources(classified, options = {}) {
-    const sources = ['rdap', 'whois'];
-    if (classified.type === 'domain') {
-        sources.push('domain_evidence', 'registrar_rdap', 'network_context');
-        if (options.securityTxt)
-            sources.push('security_txt');
-        if (options.externalIntelligence)
-            sources.push('external_intelligence');
-        if (options.malwareHostIntelligence)
-            sources.push('malware_host_intelligence');
-        if (options.malwareIocIntelligence)
-            sources.push('malware_ioc_intelligence');
-    }
-    else if (classified.type === 'ipv4' || classified.type === 'ipv6') {
-        sources.push('reverse_dns');
-    }
-    return Object.freeze(sources);
+    return plannedLookupSources(classified.type, 'deep', options);
 }
-function normalizedState(source, outcome, value) {
+function normalizedState(source, outcome, value, requestedDomain, requested = true) {
     if (outcome === 'rejected')
         return 'error';
     if (value === null || value === undefined)
-        return 'skipped';
+        return source === 'rdap' && requested ? 'unsupported' : 'skipped';
     if (source === 'rdap') {
         const rdap = record(value);
         if (rdap.upstreamStatus === 404)
@@ -69,7 +55,7 @@ function normalizedState(source, outcome, value) {
         return sourceTruncated(rdap) ? 'partial' : 'success';
     }
     if (source === 'whois') {
-        const status = whoisCollectionStatus(value);
+        const status = whoisCollectionStatus(value, requestedDomain);
         return status === 'complete' ? 'success' : status;
     }
     if (source === 'domain_evidence') {
@@ -94,8 +80,8 @@ function normalizedState(source, outcome, value) {
         return 'skipped';
     return 'error';
 }
-function normalizeLookupSourceSettlement(source, outcome, value) {
-    const state = normalizedState(source, outcome, value);
+function normalizeLookupSourceSettlement(source, outcome, value, requestedDomain, requested = true) {
+    const state = normalizedState(source, outcome, value, requestedDomain, requested);
     const sourceRecord = record(value);
     const threatObservation = THREAT_INTELLIGENCE_SOURCES.has(source)
         ? record(sourceRecord.observation)

package/lib/lookup.mjs

@@ -170,7 +170,7 @@ async function runUnifiedLookup(classified, options = {}) {
         ]);
         const notify = (source, outcome, value) => {
             try {
-                options.onSourceSettled?.(normalizeLookupSourceSettlement(source, outcome, value));
+                options.onSourceSettled?.(normalizeLookupSourceSettlement(source, outcome, value, classified.type === 'domain' ? classified.registrableDomain ?? classified.value : undefined, source !== 'rdap' || rdapEnabled));
             }
             catch {
                 // Presentation callbacks must never change evidence collection.

package/lib/opportunity-scoring.mjs

@@ -1,107 +1,2 @@
-import { buildScoreEvidenceQuality, } from "./scoring-evidence-quality.mjs";
-export const OPPORTUNITY_MODEL_VERSION = 2;
-export const OPPORTUNITY_REVIEW_THRESHOLD = 70;
-const STATE_BASE = Object.freeze({
-    available: 82,
-    for_sale: 70,
-    expiring: 52,
-    registered: 22,
-});
-const STATE_LABELS = Object.freeze({
-    available: 'available',
-    for_sale: 'registered with a sale signal',
-    expiring: 'registered in a lifecycle transition',
-    registered: 'registered',
-});
-function finite(value) {
-    return typeof value === 'number' && Number.isFinite(value) ? value : null;
-}
-function formatAge(days) {
-    if (days < 60)
-        return `${Math.max(0, Math.round(days))}d old`;
-    const years = days / 365.25;
-    return years < 1 ? `${Math.round(days / 30)}mo old` : `${years.toFixed(1)}y old`;
-}
-function addFactor(factors, dimensions, family, label, delta) {
-    factors.push({ family, label, delta });
-    dimensions.set(family, (dimensions.get(family) ?? 0) + delta);
-}
-export function normalizeOpportunityModelVersion(value) {
-    return typeof value === 'number' && Number.isSafeInteger(value) && value > 0 && value <= 1000 ? value : null;
-}
-// Opportunity is acquisition readiness, not price, value, eligibility, or a
-// prediction that a registration will lapse. It uses only bounded evidence
-// already collected for the current lookup.
-export function explainOpportunityScore(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        return null;
-    const input = value;
-    const state = input.availability ?? input.state;
-    if (typeof state !== 'string' || !Object.hasOwn(STATE_BASE, state))
-        return null;
-    const factors = [];
-    const dimensions = new Map();
-    addFactor(factors, dimensions, 'registration', `Base readiness for “${STATE_LABELS[state] ?? state}”`, STATE_BASE[state] ?? 0);
-    if (input.confidence === 'high')
-        addFactor(factors, dimensions, 'registration', 'High-confidence registration decision', 8);
-    else if (input.confidence === 'medium')
-        addFactor(factors, dimensions, 'registration', 'Medium-confidence registration decision', 3);
-    else if (input.confidence === 'low')
-        addFactor(factors, dimensions, 'registration', 'Low-confidence registration decision', -8);
-    if (state === 'for_sale')
-        addFactor(factors, dimensions, 'listing', 'Bounded sale signal observed; listing remains unverified', 6);
-    else if (input.activityStatus === 'parked')
-        addFactor(factors, dimensions, 'listing', 'Parked page observed without a verified sale offer', 3);
-    else if (state === 'registered' && input.activityStatus === 'active') {
-        addFactor(factors, dimensions, 'listing', 'Active website suggests an in-use registration', -12);
-    }
-    if (input.hasPublicRegistrantContact === true) {
-        addFactor(factors, dimensions, 'contactability', 'Public registrant contact route observed; acquisition suitability is not established', 10);
-    }
-    const expiresInDays = finite(input.expiresInDays);
-    if (state === 'registered' && expiresInDays !== null && expiresInDays >= 0 && expiresInDays < 30) {
-        addFactor(factors, dimensions, 'lifecycle', 'Published expiry is within 30 days; release is not implied', 4);
-    }
-    if (typeof input.privacyProtected === 'boolean') {
-        addFactor(factors, dimensions, 'contactability', 'Registration privacy is neutral; it does not establish contactability', 0);
-    }
-    const ageDays = finite(input.domainAgeDays);
-    if (ageDays !== null && ageDays >= 0) {
-        addFactor(factors, dimensions, 'registration', `Domain age (${formatAge(ageDays)}) is context only`, 0);
-    }
-    const rawScore = Math.round(factors.reduce((total, factor) => total + factor.delta, 0));
-    const score = Math.max(0, Math.min(100, rawScore));
-    const dimensionLabels = {
-        registration: 'Registration certainty',
-        listing: 'Listing readiness',
-        contactability: 'Contactability',
-        lifecycle: 'Lifecycle timing',
-    };
-    const observedFamilies = [...dimensions.keys()];
-    const evidenceQuality = buildScoreEvidenceQuality(input, {
-        expectedDepth: 'fast',
-        observedFamilies,
-        expectedFamilies: ['registration'],
-    });
-    return {
-        modelVersion: OPPORTUNITY_MODEL_VERSION,
-        score,
-        rawScore,
-        capped: score !== rawScore,
-        factors,
-        dimensions: [...dimensions.entries()].map(([id, contribution]) => ({ id, label: dimensionLabels[id], contribution })),
-        evidenceQuality,
-    };
-}
-export function computeOpportunityScore(value) {
-    return explainOpportunityScore(value)?.score ?? null;
-}
-export function opportunityTone(score) {
-    if (score === null)
-        return 'neutral';
-    if (score >= OPPORTUNITY_REVIEW_THRESHOLD)
-        return 'good';
-    if (score >= 40)
-        return 'neutral';
-    return 'warn';
-}
+// Retained public import; the runtime-neutral implementation lives in the domain layer.
+export * from "../packages/analysis/opportunity-scoring.mjs";

package/lib/outbound-identity.mjs

@@ -1,5 +1,5 @@
 import { WHOISLEUTH_APPLICATION_VERSION } from "./application-version.mjs";
-import { WHOISLEUTH_PROJECT_URL, WHOISLEUTH_REQUEST_POLICY_URL, } from "./project-metadata.mjs";
+import { WHOISLEUTH_PROJECT_URL, WHOISLEUTH_REQUEST_POLICY_URL, } from "../packages/analysis/project-metadata.mjs";
 export { WHOISLEUTH_PROJECT_URL, WHOISLEUTH_REQUEST_POLICY_URL };
 export const WHOISLEUTH_USER_AGENT_VERSION = WHOISLEUTH_APPLICATION_VERSION;
 export const WHOISLEUTH_USER_AGENT = `WHOISleuth/${WHOISLEUTH_USER_AGENT_VERSION} (+${WHOISLEUTH_REQUEST_POLICY_URL})`;

package/lib/page-fingerprints.mjs

@@ -64,7 +64,24 @@ function reduceDynamicValues(value) {
         .replace(/\b\d{4}-\d{1,2}-\d{1,2}(?:[t\s]\d{1,2}:\d{2}(?::\d{2}(?:\.\d+)?)?(?:z|[+-]\d{2}:?\d{2})?)?\b/gi, '<time>')
         .replace(/\b\d{10,13}\b/g, '<time>')
         .replace(/\b[a-f0-9]{16,}\b/gi, '<id>')
-        .replace(/\b(?=[a-z0-9_-]{20,}\b)(?=[a-z0-9_-]*[a-z])(?=[a-z0-9_-]*\d)[a-z0-9_-]+\b/gi, '<id>');
+        .replace(/[a-z0-9_-]+/gi, (token) => {
+        // Visit each maximal token once. Repeated lookaheads at word boundaries
+        // rescan hyphenated text quadratically when a required digit is absent.
+        // Only hyphens are outside the former ASCII word-boundary match;
+        // underscores remain part of the identifier, including at either end.
+        let start = 0;
+        let end = token.length;
+        while (start < end && token[start] === '-')
+            start += 1;
+        while (end > start && token[end - 1] === '-')
+            end -= 1;
+        if (end - start < 20)
+            return token;
+        const identifier = token.slice(start, end);
+        return /[a-z]/i.test(identifier) && /\d/.test(identifier)
+            ? `${token.slice(0, start)}<id>${token.slice(end)}`
+            : token;
+    });
 }
 function normalizeText(value, maxLength = 512) {
     const normalized = reduceDynamicValues(String(value || ''))

package/lib/perceptual-hash-comparison.mjs

@@ -1,34 +1,2 @@
-// Browser-safe comparison contract for the 64-bit perceptual hashes produced
-// by the bounded image decoder. Keeping comparison and informativeness here
-// prevents Node and browser consumers from drifting into different matches.
-export const PERCEPTUAL_HASH_HEX_RE = /^[0-9a-f]{16}$/u;
-export const MIN_INFORMATIVE_HASH_BITS = 10;
-const POPCOUNT = new Uint8Array(16);
-for (let index = 0; index < POPCOUNT.length; index += 1) {
-    POPCOUNT[index] = (index & 1) + ((index >> 1) & 1) + ((index >> 2) & 1) + ((index >> 3) & 1);
-}
-export function isPerceptualHash(value) {
-    return typeof value === 'string' && PERCEPTUAL_HASH_HEX_RE.test(value);
-}
-function popcountHex(hex) {
-    let bits = 0;
-    for (let index = 0; index < hex.length; index += 1) {
-        bits += POPCOUNT[parseInt(hex.charAt(index), 16)] ?? 0;
-    }
-    return bits;
-}
-export function isInformativePerceptualHash(value) {
-    if (!isPerceptualHash(value))
-        return false;
-    const bits = popcountHex(value);
-    return bits >= MIN_INFORMATIVE_HASH_BITS && bits <= 64 - MIN_INFORMATIVE_HASH_BITS;
-}
-export function hammingDistanceHex(left, right) {
-    if (!isPerceptualHash(left) || !isPerceptualHash(right))
-        return null;
-    let distance = 0;
-    for (let index = 0; index < 16; index += 1) {
-        distance += POPCOUNT[parseInt(left.charAt(index), 16) ^ parseInt(right.charAt(index), 16)] ?? 0;
-    }
-    return distance;
-}
+// Retained public import; the runtime-neutral implementation lives in the domain layer.
+export * from "../packages/analysis/perceptual-hash-comparison.mjs";