@slicedearth/whoisleuth-cli 2.4.0 → 2.6.0

package/lib/risk-scoring.mjs

@@ -1,345 +1,2 @@
-import { calibrateExternalIntelligenceRisk } from "./external-intelligence-risk.mjs";
-import { buildScoreEvidenceQuality, } from "./scoring-evidence-quality.mjs";
-const RISK_STATES = new Set(['registered', 'for_sale', 'expiring']);
-const STATE_LABELS = Object.freeze({
-    for_sale: 'for sale',
-    expiring: 'expiring/pending delete',
-    registered: 'registered',
-});
-// Version 8 keeps unreviewed whole-page similarity as visible review context
-// without assigning it Risk points. Reviewed favicon and official-asset
-// observations remain bounded within the brand-presentation family, generic
-// operational properties remain supporting context, and missing evidence never
-// contributes points.
-export const RISK_MODEL_VERSION = 8;
-export const RISK_REVIEW_THRESHOLD = 70;
-const CURRENT_RISK_MODEL = Object.freeze({
-    modelVersion: RISK_MODEL_VERSION,
-    includePageBaselineMatch: false,
-});
-const RISK_MODEL_V7 = Object.freeze({
-    modelVersion: 7,
-    includePageBaselineMatch: true,
-});
-const RISK_STATE_BASE = Object.freeze({
-    registered: 6,
-    for_sale: 4,
-    expiring: 5,
-});
-const FAMILY_CAPS = Object.freeze({
-    'domain-resemblance': 20,
-    'brand-presentation': 24,
-    'credential-lure': 18,
-    'external-intelligence': 18,
-    'operational-support': 12,
-});
-const REMOVABLE_RISK_FAMILY_MAP = Object.freeze({
-    'brand-presentation': true,
-    'credential-lure': true,
-    'domain-resemblance': true,
-    'external-intelligence': true,
-    'operational-support': true,
-});
-const REMOVABLE_RISK_FAMILIES = Object.freeze(Object.keys(REMOVABLE_RISK_FAMILY_MAP));
-const HIGH_CONTEXT_MUTATIONS = new Set([
-    'unicode_homoglyph',
-    'unicode_homoglyph_depth_2',
-    'dictionary',
-    'dictionary_token_replacement',
-]);
-const MEDIUM_CONTEXT_MUTATIONS = new Set(['ascii_homoglyph', 'bitsquatting', 'tld_embedding', 'tld_typo', 'tld_substitution']);
-const LOW_CONTEXT_MUTATIONS = new Set([
-    'character_addition',
-    'character_omission',
-    'character_duplication',
-    'character_transposition',
-    'pluralization',
-    'www_prefix',
-    'hyphenation',
-    'separator_omission',
-    'word_reordering',
-    'keyboard_substitution',
-    'keyboard_insertion',
-    'vowel_swap',
-]);
-export const RISK_MUTATION_TYPES = Object.freeze([
-    ...HIGH_CONTEXT_MUTATIONS,
-    ...MEDIUM_CONTEXT_MUTATIONS,
-    ...LOW_CONTEXT_MUTATIONS,
-]);
-export function normalizeRiskModelVersion(value) {
-    return typeof value === 'number' && Number.isSafeInteger(value) && value > 0 && value <= 1000 ? value : null;
-}
-function formatAge(days) {
-    if (days < 60)
-        return `${Math.round(days)}d old`;
-    const years = days / 365.25;
-    return years < 1 ? `${Math.round(days / 30)}mo old` : `${years.toFixed(1)}y old`;
-}
-function mutationContext(mutationTypes) {
-    if (!Array.isArray(mutationTypes))
-        return null;
-    const bounded = mutationTypes.slice(0, 30);
-    if (bounded.some((value) => typeof value === 'string' && HIGH_CONTEXT_MUTATIONS.has(value))) {
-        return { label: 'High-similarity or phishing-term candidate context', delta: 18 };
-    }
-    if (bounded.some((value) => typeof value === 'string' && MEDIUM_CONTEXT_MUTATIONS.has(value))) {
-        return { label: 'Lookalike candidate context', delta: 12 };
-    }
-    if (bounded.some((value) => typeof value === 'string' && LOW_CONTEXT_MUTATIONS.has(value))) {
-        return { label: 'Generated variation candidate context', delta: 8 };
-    }
-    return null;
-}
-function hasBoolean(value) {
-    return typeof value === 'boolean';
-}
-function scoreQuality(input) {
-    const observedFamilies = ['registration'];
-    const expectedFamilies = ['registration', 'operational-support'];
-    if (Array.isArray(input.mutationTypes) || hasBoolean(input.idnReferenceMatch))
-        observedFamilies.push('domain-resemblance');
-    if (input.hasActiveBrandProfile === true)
-        expectedFamilies.push('domain-resemblance', 'brand-presentation');
-    if ([input.faviconMatch, input.faviconNearMatch, input.reusesOfficialAssets, input.pageBaselineMatch].some(hasBoolean)) {
-        observedFamilies.push('brand-presentation');
-    }
-    if ([input.hasPasswordField, input.hasExternalFormAction].some(hasBoolean) || typeof input.phishingLanguageMatch === 'string') {
-        observedFamilies.push('credential-lure');
-    }
-    if (calibrateExternalIntelligenceRisk(input.threatIntelligence, input.domain).eligibleProviderCount > 0) {
-        observedFamilies.push('external-intelligence');
-    }
-    if ([input.hasMx, input.hasSpf, input.hasDmarc].some(hasBoolean)
-        || typeof input.activityStatus === 'string'
-        || typeof input.domainAgeDays === 'number')
-        observedFamilies.push('operational-support');
-    if (input.scanDepth === 'deep')
-        expectedFamilies.push('credential-lure');
-    return buildScoreEvidenceQuality(input, {
-        expectedDepth: 'deep',
-        observedFamilies,
-        expectedFamilies,
-    });
-}
-// Risk prioritizes a registered lookalike/typosquat domain for analyst review.
-// It is a heuristic indicator, never a maliciousness or safety verdict.
-function explainRiskScoreInternal(input, excludedFamily, model) {
-    const state = input.availability ?? input.state;
-    if (typeof state !== 'string' || !RISK_STATES.has(state))
-        return null;
-    const factors = [];
-    const familyTotals = new Map();
-    const add = (family, label, requestedDelta) => {
-        if (family === excludedFamily)
-            return 0;
-        const current = familyTotals.get(family) ?? 0;
-        const cap = FAMILY_CAPS[family] ?? Number.POSITIVE_INFINITY;
-        const delta = Math.max(0, Math.min(requestedDelta, Math.max(0, cap - current)));
-        const capped = delta !== requestedDelta;
-        factors.push({ family, label: capped ? `${label} (family cap reached)` : label, delta });
-        familyTotals.set(family, current + delta);
-        return delta;
-    };
-    add('registration', `Base context for “${STATE_LABELS[state] ?? state}”`, RISK_STATE_BASE[state] ?? 0);
-    const mutation = mutationContext(input.mutationTypes);
-    if (mutation)
-        add('domain-resemblance', mutation.label, mutation.delta);
-    if (input.idnReferenceMatch === true)
-        add('domain-resemblance', 'IDN skeleton matches an official Brand Profile domain', 20);
-    if (input.faviconMatch === true)
-        add('brand-presentation', 'Favicon matches an official Brand Profile site', 18);
-    else if (input.faviconNearMatch === true)
-        add('brand-presentation', 'Favicon resembles an official Brand Profile site', 14);
-    if (input.reusesOfficialAssets === true)
-        add('brand-presentation', 'Official asset-host relationship observed', 6);
-    if (model.includePageBaselineMatch && input.pageBaselineMatch === true) {
-        add('brand-presentation', 'Multiple independently compared page-identity components match the official baseline', 14);
-    }
-    if (typeof input.phishingLanguageMatch === 'string' && input.phishingLanguageMatch.trim()) {
-        add('credential-lure', 'Suspicious urgency language observed', 8);
-    }
-    if (input.hasPasswordField === true && input.hasExternalFormAction === true) {
-        add('credential-lure', 'Password form submits to an external origin', 10);
-    }
-    else if (input.hasPasswordField === true) {
-        add('credential-lure', 'Login/password form present', 5);
-    }
-    else if (input.hasExternalFormAction === true) {
-        add('credential-lure', 'External form destination observed without a password field', 0);
-    }
-    const external = calibrateExternalIntelligenceRisk(input.threatIntelligence, input.domain);
-    if (external.factor)
-        add('external-intelligence', external.factor.label, external.contribution);
-    const primaryFamilies = ['domain-resemblance', 'brand-presentation', 'credential-lure', 'external-intelligence']
-        .filter((family) => (familyTotals.get(family) ?? 0) > 0);
-    if (primaryFamilies.length >= 2) {
-        add('corroboration', `Corroborating context across ${primaryFamilies.length} independent evidence families`, primaryFamilies.length >= 3 ? 18 : 10);
-    }
-    const hasIndependentContext = primaryFamilies.length > 0;
-    const supporting = (label, delta) => {
-        add('operational-support', hasIndependentContext ? label : `${label}; neutral without independent suspicious context`, hasIndependentContext ? delta : 0);
-    };
-    if (input.activityStatus === 'active')
-        supporting('Active website observed', 4);
-    if (input.hasMx === true)
-        supporting('Mail server configured', 4);
-    if (input.hasSpf === true && input.hasDmarc === true)
-        supporting('SPF and DMARC records present', 1);
-    else if (input.hasSpf === true || input.hasDmarc === true)
-        supporting('SPF or DMARC record present', 0);
-    if (typeof input.domainAgeDays === 'number' && Number.isFinite(input.domainAgeDays) && input.domainAgeDays >= 0) {
-        if (input.domainAgeDays < 90)
-            supporting(`Recently registered (${formatAge(input.domainAgeDays)})`, 6);
-        else if (input.domainAgeDays < 365)
-            supporting(`Registered under a year ago (${formatAge(input.domainAgeDays)})`, 2);
-    }
-    if (typeof input.privacyProtected === 'boolean') {
-        add('registration', 'Registration privacy is neutral context', 0);
-    }
-    const rawScore = Math.round(factors.reduce((total, factor) => total + factor.delta, 0));
-    const score = Math.max(0, Math.min(100, rawScore));
-    const familyOrder = [
-        'registration', 'domain-resemblance', 'brand-presentation', 'credential-lure',
-        'external-intelligence', 'corroboration', 'operational-support',
-    ];
-    return {
-        modelVersion: model.modelVersion,
-        score,
-        rawScore,
-        capped: score !== rawScore,
-        factors,
-        families: familyOrder
-            .filter((id) => familyTotals.has(id))
-            .map((id) => ({ id, contribution: familyTotals.get(id) ?? 0, cap: FAMILY_CAPS[id] ?? null })),
-        evidenceQuality: scoreQuality(input),
-    };
-}
-export function explainRiskScore(input) {
-    return explainRiskScoreInternal(input, null, CURRENT_RISK_MODEL);
-}
-export function buildRiskScoreSensitivity(input) {
-    const baseline = explainRiskScoreInternal(input, null, CURRENT_RISK_MODEL);
-    if (!baseline)
-        return null;
-    const removableFamilies = REMOVABLE_RISK_FAMILIES
-        .filter((family) => baseline.families.some((item) => item.id === family && item.contribution > 0));
-    const scenarios = removableFamilies.map((excludedFamily) => {
-        const result = explainRiskScoreInternal(input, excludedFamily, CURRENT_RISK_MODEL);
-        const score = result?.score ?? baseline.score;
-        return Object.freeze({ excludedFamily, score, difference: score - baseline.score });
-    }).sort((left, right) => left.score - right.score || left.excludedFamily.localeCompare(right.excludedFamily));
-    const minimumScenarioScore = scenarios[0]?.score ?? baseline.score;
-    const thresholdState = baseline.score < RISK_REVIEW_THRESHOLD
-        ? 'below'
-        : minimumScenarioScore < RISK_REVIEW_THRESHOLD ? 'crosses' : 'stable_above';
-    return Object.freeze({
-        version: 1,
-        baselineScore: baseline.score,
-        reviewThreshold: RISK_REVIEW_THRESHOLD,
-        minimumScenarioScore,
-        thresholdState,
-        scenarios: Object.freeze(scenarios),
-        limitations: Object.freeze([
-            'Each scenario removes one observed evidence family and recalculates family caps and corroboration; it does not predict missing evidence.',
-            'The sensitivity review qualifies prioritisation only and does not determine maliciousness, safety, ownership, or intent.',
-        ]),
-    });
-}
-export function computeRiskScore(input) {
-    return explainRiskScore(input)?.score ?? null;
-}
-// Retained only for deterministic offline comparison of reviewed calibration
-// datasets. Runtime lookups always use the current model above.
-export function explainRiskScoreV7(input) {
-    return explainRiskScoreInternal(input, null, RISK_MODEL_V7);
-}
-// Retained only for deterministic offline comparison of reviewed calibration
-// datasets. Runtime lookups always use the current model above.
-export function explainRiskScoreV6(input) {
-    const state = input.availability ?? input.state;
-    if (typeof state !== 'string' || !RISK_STATES.has(state))
-        return null;
-    const legacyBase = { registered: 10, for_sale: 5, expiring: 8 };
-    const factors = [];
-    const totals = new Map();
-    const add = (family, label, delta) => {
-        factors.push({ family, label, delta });
-        totals.set(family, (totals.get(family) ?? 0) + delta);
-    };
-    add('registration', `Base score for “${STATE_LABELS[state] ?? state}”`, legacyBase[state] ?? 0);
-    const contextual = new Set();
-    const context = mutationContext(input.mutationTypes);
-    if (context) {
-        add('domain-resemblance', context.label, context.delta);
-        contextual.add('domain-resemblance');
-    }
-    if (input.faviconMatch === true) {
-        add('brand-presentation', 'Favicon matches an official Brand Profile site', 18);
-        contextual.add('brand-presentation');
-    }
-    else if (input.faviconNearMatch === true) {
-        add('brand-presentation', 'Favicon resembles an official Brand Profile site', 14);
-        contextual.add('brand-presentation');
-    }
-    if (input.reusesOfficialAssets === true) {
-        add('brand-presentation', 'Official asset-host relationship observed', 6);
-        contextual.add('brand-presentation');
-    }
-    if (typeof input.phishingLanguageMatch === 'string' && input.phishingLanguageMatch.trim()) {
-        add('credential-lure', 'Suspicious urgency language observed', 8);
-        contextual.add('credential-lure');
-    }
-    if (input.hasPasswordField === true) {
-        add('credential-lure', 'Login/password form present', 5);
-        contextual.add('credential-lure');
-    }
-    if (contextual.size >= 2)
-        add('corroboration', `Corroborating context across ${contextual.size} distinct evidence families`, contextual.size >= 3 ? 20 : 10);
-    const external = calibrateExternalIntelligenceRisk(input.threatIntelligence, input.domain);
-    if (external.factor)
-        add('external-intelligence', external.factor.label, external.contribution);
-    if (input.activityStatus === 'active')
-        add('operational-support', 'Active site in use', 8);
-    if (input.hasMx === true)
-        add('operational-support', 'Mail server configured', 8);
-    if (input.hasSpf === true && input.hasDmarc === true)
-        add('operational-support', 'SPF and DMARC records present', 3);
-    else if (input.hasSpf === true || input.hasDmarc === true)
-        add('operational-support', 'SPF or DMARC record present', 1);
-    if (input.privacyProtected === true)
-        add('registration', 'WHOIS privacy protected', 3);
-    if (typeof input.domainAgeDays === 'number' && Number.isFinite(input.domainAgeDays) && input.domainAgeDays >= 0) {
-        if (input.domainAgeDays < 90)
-            add('operational-support', `Recently registered (${formatAge(input.domainAgeDays)})`, 10);
-        else if (input.domainAgeDays < 365)
-            add('operational-support', `Registered under a year ago (${formatAge(input.domainAgeDays)})`, 4);
-    }
-    const rawScore = Math.round(factors.reduce((total, factor) => total + factor.delta, 0));
-    const score = Math.max(0, Math.min(100, rawScore));
-    return {
-        modelVersion: 6,
-        score,
-        rawScore,
-        capped: score !== rawScore,
-        factors,
-        families: [...totals].map(([id, contribution]) => ({ id, contribution, cap: null })),
-        evidenceQuality: scoreQuality(input),
-    };
-}
-export function riskTone(score) {
-    if (score === null)
-        return 'neutral';
-    if (score >= RISK_REVIEW_THRESHOLD)
-        return 'danger';
-    if (score >= 40)
-        return 'warn';
-    return 'neutral';
-}
-export function formatScoreBreakdown(explained, separator = '\n') {
-    if (!explained)
-        return '';
-    const parts = explained.factors.map((factor) => `${factor.label} ${factor.delta >= 0 ? '+' : ''}${Math.round(factor.delta)}`);
-    parts.push(`Total ${explained.score} · Risk model v${explained.modelVersion} · evidence ${explained.evidenceQuality.state}`);
-    return parts.join(separator);
-}
+// Retained public import; the runtime-neutral implementation lives in the domain layer.
+export * from "../packages/analysis/risk-scoring.mjs";

package/lib/scoring-evidence-quality.mjs

@@ -1,107 +1,2 @@
-export const SCORE_EVIDENCE_QUALITY_VERSION = 1;
-const MAX_SOURCES = 24;
-const MAX_FAMILIES = 12;
-const SOURCE_ID_RE = /^[a-z][a-z0-9_-]{0,63}$/u;
-const COMPLETE_STATES = new Set(['complete', 'not_found', 'success']);
-const LIMITED_STATES = new Set(['partial', 'unknown']);
-const UNAVAILABLE_STATES = new Set(['error', 'rate_limited', 'unavailable']);
-const SKIPPED_STATES = new Set(['skipped', 'unsupported']);
-const ACCEPTED_SOURCE_STATES = new Set([
-    ...COMPLETE_STATES,
-    ...LIMITED_STATES,
-    ...UNAVAILABLE_STATES,
-    ...SKIPPED_STATES,
-]);
-function boundedFamilyList(value) {
-    const output = new Set();
-    for (const item of value.slice(0, MAX_FAMILIES * 2)) {
-        const normalized = String(item).trim().toLowerCase().replace(/[^a-z0-9_-]+/gu, '-').slice(0, 64);
-        if (SOURCE_ID_RE.test(normalized))
-            output.add(normalized);
-        if (output.size >= MAX_FAMILIES)
-            break;
-    }
-    return [...output].sort();
-}
-function sourceCoverage(value) {
-    if (!Array.isArray(value))
-        return [];
-    const output = [];
-    const seen = new Set();
-    for (const candidate of value.slice(0, MAX_SOURCES * 4)) {
-        if (!candidate || typeof candidate !== 'object' || Array.isArray(candidate))
-            continue;
-        const item = candidate;
-        const source = typeof item.source === 'string' ? item.source.trim().toLowerCase() : '';
-        const state = typeof item.state === 'string' ? item.state.trim().toLowerCase() : '';
-        if (!SOURCE_ID_RE.test(source) || seen.has(source))
-            continue;
-        if (!ACCEPTED_SOURCE_STATES.has(state))
-            continue;
-        seen.add(source);
-        output.push({ source, state });
-        if (output.length >= MAX_SOURCES)
-            break;
-    }
-    return output;
-}
-function scanDepth(value) {
-    return value === 'deep' || value === 'fast' ? value : 'unknown';
-}
-function observedFreshness(value) {
-    if (typeof value !== 'string' || value.length > 64)
-        return 'unknown';
-    return Number.isFinite(Date.parse(value)) ? 'observed' : 'unknown';
-}
-export function buildScoreEvidenceQuality(input, options) {
-    const depth = scanDepth(input.scanDepth);
-    const coverage = sourceCoverage(input.sourceCoverage);
-    const completeSources = coverage.filter((item) => COMPLETE_STATES.has(item.state)).length;
-    const limitedSources = coverage.filter((item) => LIMITED_STATES.has(item.state)).length;
-    const unavailableSources = coverage.filter((item) => UNAVAILABLE_STATES.has(item.state)).length;
-    const skippedSources = coverage.filter((item) => SKIPPED_STATES.has(item.state)).length;
-    const observedFamilies = boundedFamilyList(options.observedFamilies ?? []);
-    const expectedFamilies = boundedFamilyList(options.expectedFamilies ?? []);
-    const observedSet = new Set(observedFamilies);
-    const missingFamilies = expectedFamilies.filter((family) => !observedSet.has(family));
-    const limitations = [];
-    let state = 'complete';
-    if (!coverage.length || depth === 'unknown')
-        state = 'unknown';
-    else if (unavailableSources || limitedSources)
-        state = 'partial';
-    else if (options.expectedDepth === 'deep' && depth !== 'deep')
-        state = 'limited';
-    if (missingFamilies.length && state === 'complete')
-        state = 'limited';
-    if (options.expectedDepth === 'deep' && depth !== 'deep') {
-        limitations.push('A fast or unknown-depth observation does not evaluate every website and mail scoring family.');
-    }
-    if (limitedSources || unavailableSources) {
-        limitations.push('One or more score-relevant sources were partial, unavailable, or indeterminate.');
-    }
-    if (skippedSources) {
-        limitations.push('One or more reported sources were skipped or unsupported and did not contribute to the score.');
-    }
-    if (!coverage.length)
-        limitations.push('Source-level coverage was not supplied with this score.');
-    if (missingFamilies.length)
-        limitations.push(`No usable observation was supplied for: ${missingFamilies.join(', ')}.`);
-    const boundedLimitations = [
-        ...limitations.slice(0, 5),
-        'Evidence coverage qualifies the score; it never adds points or turns missing evidence into a negative finding.',
-    ];
-    return Object.freeze({
-        version: SCORE_EVIDENCE_QUALITY_VERSION,
-        state,
-        scanDepth: depth,
-        freshness: observedFreshness(input.observedAt),
-        completeSources,
-        limitedSources,
-        unavailableSources,
-        skippedSources,
-        observedFamilies: Object.freeze(observedFamilies),
-        missingFamilies: Object.freeze(missingFamilies),
-        limitations: Object.freeze(boundedLimitations),
-    });
-}
+// Retained public import; the runtime-neutral implementation lives in the domain layer.
+export * from "../packages/analysis/scoring-evidence-quality.mjs";

package/lib/semantic-version.mjs

@@ -1,54 +1,2 @@
-// Dependency-free semantic-version validation shared by release tooling,
-// runtime identity, and the frontend build. Callers provide a bounded label so
-// errors retain their local context without reimplementing SemVer parsing.
-export const MAX_SEMANTIC_VERSION_LENGTH = 128;
-function fail(label, detail) {
-    throw new TypeError(`${label} ${detail}`);
-}
-function validateIdentifierList(value, label, kind, forbidNumericLeadingZero) {
-    const identifiers = value.split('.');
-    if (identifiers.some((identifier) => identifier.length === 0)) {
-        fail(label, `${kind} contains an empty identifier.`);
-    }
-    for (const identifier of identifiers) {
-        if (!/^[0-9A-Za-z-]+$/u.test(identifier)) {
-            fail(label, `${kind} contains an invalid identifier.`);
-        }
-        if (forbidNumericLeadingZero && /^[0-9]+$/u.test(identifier) && identifier.length > 1 && identifier.startsWith('0')) {
-            fail(label, `${kind} numeric identifiers must not contain leading zeroes.`);
-        }
-    }
-}
-export function normalizeBoundedSemanticVersion(value, label = 'Semantic') {
-    if (typeof value !== 'string'
-        || value.length === 0
-        || value.length > MAX_SEMANTIC_VERSION_LENGTH
-        || value.trim() !== value) {
-        fail(label, 'version must be a bounded semantic-version string.');
-    }
-    const buildParts = value.split('+');
-    if (buildParts.length > 2)
-        fail(label, 'version contains more than one build-metadata separator.');
-    const [precedence, buildMetadata] = buildParts;
-    if (!precedence)
-        fail(label, 'version must include numeric precedence.');
-    const prereleaseSeparator = precedence.indexOf('-');
-    const core = prereleaseSeparator === -1 ? precedence : precedence.slice(0, prereleaseSeparator);
-    const prerelease = prereleaseSeparator === -1 ? undefined : precedence.slice(prereleaseSeparator + 1);
-    const coreParts = core.split('.');
-    if (coreParts.length !== 3 || coreParts.some((part) => !/^(?:0|[1-9][0-9]*)$/u.test(part))) {
-        fail(label, 'version must contain major, minor, and patch numbers without leading zeroes.');
-    }
-    if (prerelease !== undefined)
-        validateIdentifierList(prerelease, label, 'prerelease', true);
-    if (buildMetadata !== undefined)
-        validateIdentifierList(buildMetadata, label, 'build metadata', false);
-    return value;
-}
-export function normalizeBoundedStableSemanticVersion(value, label = 'Stable semantic') {
-    const version = normalizeBoundedSemanticVersion(value, label);
-    if (version.includes('-') || version.includes('+')) {
-        fail(label, 'version must not include prerelease or build identifiers.');
-    }
-    return version;
-}
+// Retained public import; the runtime-neutral implementation lives in the domain layer.
+export * from "../packages/analysis/semantic-version.mjs";

package/lib/service-binding-dns.mjs

@@ -376,6 +376,8 @@ function parseServiceBindingDnsResponse(messageValue, expected) {
         throw new ServiceBindingDnsError('DNS response question does not match the query');
     }
     const records = [];
+    const aliases = new Map();
+    const answerOwners = new Set();
     let truncated = false;
     for (let index = 0; index < recordCount; index += 1) {
         const ownerResult = decodeDnsName(message, offset);
@@ -388,9 +390,18 @@ function parseServiceBindingDnsResponse(messageValue, expected) {
         offset += 10;
         const rdataEnd = offset + rdataLength;
         assertRange(message, offset, rdataLength);
+        if (index < answerCount && rrClass === DNS_CLASS_IN && rrType === 5) {
+            const alias = decodeDnsName(message, offset);
+            if (alias.nextOffset !== rdataEnd || alias.name === '.'
+                || (aliases.has(ownerResult.name) && aliases.get(ownerResult.name) !== alias.name)) {
+                throw new ServiceBindingDnsError('DNS answer contains an invalid or ambiguous alias');
+            }
+            aliases.set(ownerResult.name, alias.name);
+        }
         if (index < answerCount
             && rrType === recordTypeCode(expected.type)
             && rrClass === DNS_CLASS_IN) {
+            answerOwners.add(ownerResult.name);
             const parsed = parseServiceBindingRecord(message, ownerResult.name, expected.type, ttl, offset, rdataEnd);
             truncated = parsed.truncated || truncated;
             if (records.length < MAX_SERVICE_BINDING_RECORDS)
@@ -402,6 +413,22 @@ function parseServiceBindingDnsResponse(messageValue, expected) {
     }
     if (offset !== message.length)
         throw new ServiceBindingDnsError('DNS response has trailing bytes');
+    const allowedOwners = new Set();
+    let owner = question.name;
+    while (true) {
+        if (allowedOwners.has(owner))
+            throw new ServiceBindingDnsError('DNS answer contains a cyclic alias chain');
+        allowedOwners.add(owner);
+        const next = aliases.get(owner);
+        if (!next)
+            break;
+        if (answerOwners.has(owner))
+            throw new ServiceBindingDnsError('DNS alias owner also contains service-binding records');
+        owner = next;
+    }
+    if ([...answerOwners].some(value => !allowedOwners.has(value))) {
+        throw new ServiceBindingDnsError('DNS service-binding answer owner is not bound to the query');
+    }
     const unique = new Map();
     for (const record of records)
         unique.set(JSON.stringify(record), record);
@@ -499,6 +526,8 @@ function defaultTcpExchange(query, resolver, options) {
             }
         });
         socket.once('connect', () => {
+            if (settled)
+                return;
             const length = Buffer.alloc(2);
             length.writeUInt16BE(query.length, 0);
             socket.write(Buffer.concat([length, query]));
@@ -507,6 +536,7 @@ function defaultTcpExchange(query, resolver, options) {
 }
 function defaultDnsExchange(query, resolver, options) {
     return new Promise((resolve, reject) => {
+        options.signal?.throwIfAborted();
         const socket = createSocket(resolver.family === 6 ? 'udp6' : 'udp4');
         let settled = false;
         const timer = setTimeout(() => {
@@ -517,6 +547,7 @@ function defaultDnsExchange(query, resolver, options) {
                 return;
             settled = true;
             clearTimeout(timer);
+            options.signal?.removeEventListener('abort', cancelled);
             try {
                 socket.close();
             }
@@ -528,6 +559,12 @@ function defaultDnsExchange(query, resolver, options) {
             else
                 resolve(response);
         };
+        const cancelled = () => finish(options.signal?.reason ?? new Error('DNS UDP query cancelled'));
+        options.signal?.addEventListener('abort', cancelled, { once: true });
+        if (options.signal?.aborted) {
+            cancelled();
+            return;
+        }
         socket.once('error', (error) => finish(error));
         socket.once('message', (message) => {
             if (message.length > MAX_DNS_MESSAGE_BYTES) {
@@ -538,6 +575,8 @@ function defaultDnsExchange(query, resolver, options) {
             }
         });
         socket.connect(resolver.port, resolver.address, () => {
+            if (settled)
+                return;
             socket.send(query, (error) => {
                 if (error)
                     finish(error);
@@ -565,6 +604,7 @@ function missingResponseError(rcode) {
     return new ServiceBindingDnsError(`DNS resolver returned ${names[rcode] || `rcode ${rcode}`}`, 'EDNSFAIL');
 }
 async function resolveServiceBindingRecords(nameValue, type, options = {}) {
+    options.signal?.throwIfAborted();
     const name = normalizeQueryName(nameValue);
     const transactionId = options.transactionId ?? randomInt(0x1_0000);
     const query = buildServiceBindingDnsQuery(name, type, transactionId);
@@ -581,17 +621,20 @@ async function resolveServiceBindingRecords(nameValue, type, options = {}) {
     const deadline = Date.now() + timeoutMs;
     let lastError = null;
     for (const resolver of resolvers) {
+        options.signal?.throwIfAborted();
         const udpTimeoutMs = deadline - Date.now();
         if (udpTimeoutMs <= 0)
             break;
         try {
-            let response = await exchange(query, resolver, { timeoutMs: udpTimeoutMs });
+            let response = await exchange(query, resolver, { timeoutMs: udpTimeoutMs, ...(options.signal ? { signal: options.signal } : {}) });
+            options.signal?.throwIfAborted();
             if (isTruncatedDnsResponse(response, transactionId)) {
                 const tcpTimeoutMs = deadline - Date.now();
                 if (tcpTimeoutMs <= 0) {
                     throw new ServiceBindingDnsError('DNS service-binding query timed out', 'ETIMEOUT');
                 }
-                response = await (options.tcpExchange || defaultTcpExchange)(query, resolver, { timeoutMs: tcpTimeoutMs });
+                response = await (options.tcpExchange || defaultTcpExchange)(query, resolver, { timeoutMs: tcpTimeoutMs, ...(options.signal ? { signal: options.signal } : {}) });
+                options.signal?.throwIfAborted();
             }
             const parsed = parseServiceBindingDnsResponse(response, { transactionId, name, type });
             if (parsed.truncatedResponse)
@@ -604,6 +647,7 @@ async function resolveServiceBindingRecords(nameValue, type, options = {}) {
             return { records: parsed.records, truncated: parsed.truncated };
         }
         catch (error) {
+            options.signal?.throwIfAborted();
             lastError = error;
             const code = error && typeof error === 'object' ? String(error.code || '') : '';
             if (code === 'ENODATA' || code === 'ENOTFOUND')